last executing test programs: 20.925012408s ago: executing program 0 (id=3278): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYBLOB="0198000000000000200012800800010067726500140002800800010089"], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x40) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x5, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x6, 0x2}}}}]}, 0x79}}, 0x800) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=@newtfilter={0x43c, 0x28, 0xd27, 0x1004001, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x2, 0x9}, {0x3}, {0x2, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x40c, 0x2, [@TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x7, 0x2, 0x80000001, 0x7, 0x6, 0x9, 0x1, 0x7ff, 0x7, 0x9, 0x0, 0x5, 0x1, 0x3, 0x7, 0x66, 0x316a, 0x86dc, 0x1, 0x5, 0x0, 0x8, 0x80000001, 0x8, 0x4, 0x2, 0x9, 0x9, 0x1b8, 0xbb5f, 0x7, 0x3f, 0x3ff, 0x80000003, 0xffffff81, 0x696, 0x2, 0x7, 0x2a, 0x1, 0x91, 0xff, 0x903, 0x3ff, 0x4, 0x1, 0x9, 0x9, 0x5, 0x7ff, 0x6, 0x5, 0x3, 0x83, 0xb, 0x2, 0x6, 0xc, 0xa, 0x5, 0x7, 0x0, 0x1f5, 0xeb, 0x9, 0x7491, 0x9, 0xa, 0x9, 0x2, 0x4, 0x7, 0xe, 0x8000, 0x557, 0x8, 0xff, 0xd8f, 0x2, 0x5, 0x5, 0x3, 0x1000, 0x8c, 0x6, 0x7ff, 0x7fffffff, 0x8, 0x1, 0x80000001, 0x9e, 0x7, 0x7, 0x5, 0x7, 0x7fff, 0x3, 0xb380, 0x6, 0x8, 0x10001, 0x2, 0x5, 0xad76, 0x7, 0x7f, 0xf6, 0x4, 0x6c41, 0x2, 0x2, 0xf, 0x1ff, 0x9, 0x4, 0xc9, 0x7, 0x9, 0xab7, 0x7, 0x2, 0x1, 0x3, 0x4, 0x200, 0x7, 0x3d9d, 0x80000000, 0x2, 0x0, 0x8, 0x1, 0x8, 0x0, 0x1000, 0x9, 0xb96c, 0x3, 0x8, 0x0, 0x8, 0x6, 0x80000001, 0xbe5, 0xff, 0x6, 0x200, 0x95, 0xe0d, 0x458ba105, 0xd8, 0x90, 0x6, 0x4, 0x297a, 0xfffffff7, 0x0, 0x56, 0x8000, 0x2, 0x4, 0x8001, 0xa469, 0x10000, 0x7fffffff, 0x9, 0x6, 0x9, 0xe, 0xff, 0x0, 0x7, 0x7, 0x2, 0xdc8a, 0x1, 0xb07, 0x5, 0x6, 0x3, 0x97, 0x0, 0xff, 0x9, 0x2, 0x4, 0xffffff7f, 0x6f7, 0x2, 0x3, 0x7, 0x2, 0x81, 0xb, 0x2, 0x4, 0xf, 0x1, 0x1, 0xfffff800, 0x6, 0x4, 0x4, 0x9, 0x0, 0x8, 0xbc7d, 0x9, 0xcff, 0x1, 0x1ff, 0x2, 0x1, 0xff, 0xa, 0x5, 0x81, 0x3, 0x9, 0xfffffff5, 0xfffffffd, 0x3, 0xfffffffb, 0x8, 0x1000, 0xbc, 0x5a, 0x9, 0x0, 0x7, 0xfff, 0xbfc, 0x1, 0x3, 0x5, 0x9, 0x200, 0x800, 0x10, 0x8, 0x10001, 0x0, 0xd, 0x0, 0xffffff2d, 0x3, 0x4, 0xfffffff9, 0x7fff, 0x400, 0x10000, 0x8, 0x400, 0x9, 0x7, 0x1000]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x8810}, 0x404c0c0) (fail_nth: 1) 20.292547574s ago: executing program 0 (id=3279): r0 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100000cb768405e0483020b9901e4020109021b000100000000090400fb015c291d00090509"], 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000080), 0x5, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f000001f500)={0x4, 0x8, 0x2, {0x1, @pix={0x8, 0x80, 0x34343459, 0x0, 0x5, 0xb, 0x5, 0xfeedcafe, 0x1, 0x1, 0x2, 0x7}}}) syz_open_dev$sndpcmp(&(0x7f0000000000), 0x3, 0x183a00) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) epoll_create(0x401) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="0180a70000000180c2000000080045000024150000000011907800000000e0000001cd3e00bc3222b75b5178d0372d4e2417"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r6, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x5, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x7, 0x81}, 0x0) socket$packet(0x11, 0x2, 0x300) syz_open_procfs(0x0, &(0x7f0000000600)='net/tcp6\x00') r7 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4040aea0, 0x0) syz_usb_disconnect(r0) ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000040)={'pim6reg0\x00', {0x2, 0x0, @remote}}) r8 = fsopen(&(0x7f00000003c0)='tracefs\x00', 0x1) syz_usb_disconnect(r0) close_range(r8, 0xffffffffffffffff, 0x0) 16.870721357s ago: executing program 0 (id=3293): r0 = getpgid(0x0) syz_clone(0x2802000, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = mq_open(&(0x7f0000000040)='!^:)!}-,@[!*\x00', 0x1, 0x40, &(0x7f0000000080)={0x7d5, 0x4, 0xfffffffffffffffe, 0x5}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x4020aeb2, &(0x7f0000000740)={0x0, 0x12c, @pic={0x8, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x14}}) r4 = getpid() fstat(r1, &(0x7f0000000100)) process_vm_readv(r4, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) mq_notify(r1, &(0x7f00000000c0)={0x0, 0x23, 0x4, @tid=r4}) getpriority(0x1, r0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2080, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r6, 0x4048aec9, &(0x7f0000000080)={0x3, 0xffffffffffffffff, 0x3}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000040000000030a010200000000000000000100ffff0900030073797a320000000014000480080002400000000008000140000000050900010073797a310000000030000000050a01020000000000000000010000040c00024000000000000000010900030073797a30000000000400048014000000020a0102000000000000000000000003140000001100010000000000000000000000000ae80182e9f1d21799c9f92276b63a96501b4a9aee54f95cd5"], 0xcc}}, 0x200000d4) sched_getaffinity(r0, 0x8, &(0x7f0000000000)) 14.058862442s ago: executing program 0 (id=3299): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x45) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0), r1) readv(r1, &(0x7f0000000140)=[{&(0x7f0000000600)=""/152, 0x98}], 0x1) recvmmsg(r1, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x63, 0x0, 0x1000, 0xffffffffffffffff, 0xfffffffffffffffc, 0x5}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='gid_map\x00') syz_io_uring_setup(0xf04, &(0x7f00000002c0)={0x0, 0xdb0d, 0x3f, 0xfffffffe, 0x24000, 0x0, r4}, 0x0, 0x0) preadv(r4, 0x0, 0x0, 0x8, 0x200) ioctl$DRM_IOCTL_SG_ALLOC(r4, 0xc0106438, &(0x7f00000003c0)={0x9}) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r5, 0xc01064c8, &(0x7f0000000280)={0x0, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000340)={0x48}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000180)=0x0) sched_getattr(r6, &(0x7f00000001c0)={0x38}, 0x38, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, 0x0) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x6, 0x0, 0x0) r7 = getpid() r8 = syz_pidfd_open(r7, 0x0) setns(r8, 0x24020000) syz_clone(0xfdba2180, 0x0, 0x0, 0x0, 0x0, 0x0) 8.004634343s ago: executing program 3 (id=3317): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r2, 0x0, 0x8080) socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_procfs(0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000580)={0x1c, 0x3, 0x6, 0x5, 0x0, 0x0, {0x5, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) mknod$loop(&(0x7f0000000080)='./bus\x00', 0x2, 0x0) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x2) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/sysvipc/shm\x00', 0x0, 0x0) read$FUSE(r5, &(0x7f0000002480)={0x2020}, 0x2020) lseek(r5, 0xfffffffffffffff5, 0x1) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f00000000c0), 0x0) syz_open_dev$ndb(0x0, 0x0, 0x10000) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x101840, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r7, 0x401054d6, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) 5.133667968s ago: executing program 4 (id=3323): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x5, 0xa8, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @tracing}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0xc00}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x78, 0x2c, 0xd27, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, {0xc, 0xfff1}, {}, {0x5, 0xf}}, [@filter_kind_options=@f_flow={{0x9}, {0x48, 0x2, [@TCA_FLOW_EMATCHES={0x44, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xfffb}}, @TCA_EMATCH_TREE_LIST={0x38, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x34, 0x1, 0x0, 0x0, {{0x7, 0x7, 0x2}, {{0x0, 0x1, 0x0, 0x1}, {0x0, 0x1, 0x1, 0x1}}}}, @TCF_EM_META={0x20, 0x2, 0x0, 0x0, {{0xfffb, 0x4, 0x2}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x5, 0xe, 0x2}, {0x0, 0x7, 0x2}}}, @TCA_EM_META_RVALUE={0x6, 0x3, [@TCF_META_TYPE_VAR="5bb4"]}]}}]}]}]}}]}, 0x78}}, 0x20040054) r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1}, 0x18) connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000940)={0x1, 0x58, &(0x7f00000008c0)}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000ac0)={0xffffffffffffffff, 0x58, &(0x7f0000000a40)}, 0x10) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000b00)={@private1}, &(0x7f0000000b40)=0x14) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000001c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(r4, 0x4002f516, &(0x7f0000000040)={0x50, 0xbb}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x24, 0x29, 0xa19702d202eff97b, 0x4001, 0xfff7fdfc, {0x0, 0x0, 0x0, r6, {0xb}, {0xffff}, {0x4, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) socket(0x2b, 0x1, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) close_range(r8, r8, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r9 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/65, 0x328000, 0x800}, 0x20) 4.946980388s ago: executing program 3 (id=3325): r0 = getpgid(0x0) syz_clone(0x2802000, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0/file0\x00', 0x42242, 0x0) close(0x3) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_emit_ethernet(0x4a, &(0x7f0000000400)={@remote, @empty, @val={@val={0x88a8, 0x3, 0x1, 0x4}, {0x8100, 0x2, 0x1, 0x4}}, {@arp={0x806, @ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0xa, @remote, @private2={0xfc, 0x2, '\x00', 0x1}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3f}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}}, 0x0) recvfrom(r1, &(0x7f0000000000)=""/92, 0x5c, 0x40, 0x0, 0x0) getpriority(0x1, r0) 4.348809433s ago: executing program 3 (id=3326): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000480)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) syz_emit_ethernet(0x46, &(0x7f0000000400)={@local, @random="df00004000", @void, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x11}, {[@ssrr={0x89, 0x3, 0xa2}, @timestamp={0x44, 0x4, 0x25, 0x3}, @cipso={0x86, 0x6, 0x1}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000340), 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000004, 0x10012, r5, 0x0) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r4, 0x3b71, &(0x7f00000000c0)={0x20, 0x2, 0x0, 0x8000, 0xffffffffffffeffd}) syz_usb_connect(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x5f, 0x82, 0x10, 0x20, 0xae6f, 0x79f4, 0x8f99, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x58, 0x42, 0x0, 0x0, [], [{{0x9, 0x5, 0xf}}, {{0x9, 0x5, 0x1}}]}}]}}]}}, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_REPLACE_IOAS(r0, 0x3ba0, &(0x7f0000000500)={0x48, 0xb, r2, 0x0, r3}) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000500), 0xc80, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r6, 0x8000000000000000) r7 = userfaultfd(0x801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ac2000/0x3000)=nil, 0x3000}, 0x1}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x5, 0x9fd, 0x84}, 0x48) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000800)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2, r9, 0x4}, 0xfffffffffffffefa) socket$nl_route(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r10, @ANYRES16=r8, @ANYBLOB="ca917cfe46db525b0a2f1df5b6103af7c0fa5fa7210f8c12453e44d7298f292020fc13381501d2c4d74e8e4f8b50b1ff3ae609a70eae4d07956e908e53189a5b76642d8ed2b1300850ef4f75db627d3ebeb5a8c34442e948ec8e8f81603813108bec3da20a3a1eb26cef74f8caaefc8b8945e714d2ced4449f3ce7a90cc20e62fbae57bd730c6e60087152cb6657a3aed0be2111f6d9cb2c708afde67f7f10e2394d52e976c21bf5ac84420057f3789e61f6f182bc21af6bc75bab7219c5ccaba6f1d7af1046bf39bc41af1a1c972b807635a49f4905c3b3f3ce2cd1ec1e65d796ca2e337b1e9e9441763793fbeedd5e113629cf52a262686b782108252d6e61e08313e4058a2992c346cbdd359992d8db1c8f53daeff4c18b5f95a4cbd6723d910ee6752a61af381a6acbb8bc291d10c3eb0943310f68d95dd5ba99eb1f737e67b291cc"], 0x38}}, 0x10) 3.884190155s ago: executing program 4 (id=3328): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x10, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x4b}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80383, 0x0) r2 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x3cfa, 0x0, 0x3, 0x69}, &(0x7f0000000200)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r2, 0x47f6, 0x0, 0x2, 0x0, 0x0) ioctl$SNDCTL_SEQ_PANIC(r1, 0x5111) ioctl$SNDCTL_SEQ_PANIC(r1, 0x5100) 3.648103252s ago: executing program 2 (id=3329): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r2, 0x1, &(0x7f0000000200)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x7, 0x4b6f, r1, 0x0, 0x0, 0x0, 0x0, 0x2}]) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000a80)=ANY=[@ANYBLOB="00042dbd7000fcdbdf254f000000080003", @ANYBLOB="10007a800c0003"], 0x1d0}, 0x1, 0x0, 0x0, 0x20000890}, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$igmp6(0xa, 0x3, 0x2) setuid(0xee01) tkill(0x0, 0x13) sendmsg$inet6(r5, &(0x7f0000000200)={&(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, 0x1c, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYRESDEC=r4], 0x18}, 0x800) connect$inet6(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x0, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x4000000001, 0x0, 0x2, 0x0) fsopen(&(0x7f0000000000)='hfsplus\x00', 0x1) sendmsg(r7, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0x0, 0x26f, 0x9, 0x8, 0xffff0001, 0x3}, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(0xffffffffffffffff, 0x40086602, 0x0) r8 = openat$sysfs(0xffffff9c, 0x0, 0x42, 0x0) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000300), 0x301000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r8) setsockopt(r9, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) 3.398921346s ago: executing program 4 (id=3331): r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'netdevsim0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0_to_bridge\x00'}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0xba01, 0x0, 0x4000044}, 0x10) 3.172367764s ago: executing program 4 (id=3332): r0 = io_uring_setup(0x194e, &(0x7f0000000a80)={0x0, 0xd3d5, 0x80, 0x5, 0x30f}) close_range(r0, 0xffffffffffffffff, 0x0) (async) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) read(r1, &(0x7f0000000040)=""/148, 0xffffff96) (async) ioctl$int_in(r1, 0x5421, &(0x7f0000000000)=0x3) 3.044553322s ago: executing program 1 (id=3333): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x10, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x0, &(0x7f00000003c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x0, 0x1c, &(0x7f0000000040)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007b88f8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb7020000", @ANYBLOB="0000000000000000b705000008"], 0x0, 0x20, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ptrace$getregset(0x4205, r2, 0x1, &(0x7f0000000080)={&(0x7f00000000c0)=""/120, 0x78}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYBLOB="0198000000000000200012800800010067726500140002800800010089"], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x40) r4 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}, {0x5, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x6, 0x2}}}}]}, 0x79}}, 0x800) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=@newtfilter={0x43c, 0x28, 0xd27, 0x1004001, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x2, 0x9}, {0x3}, {0x2, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x40c, 0x2, [@TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x7, 0x2, 0x80000001, 0x7, 0x6, 0x9, 0x1, 0x7ff, 0x7, 0x9, 0x0, 0x5, 0x1, 0x3, 0x7, 0x66, 0x316a, 0x86dc, 0x1, 0x5, 0x0, 0x8, 0x80000001, 0x8, 0x4, 0x2, 0x9, 0x9, 0x1b8, 0xbb5f, 0x7, 0x3f, 0x3ff, 0x80000003, 0xffffff81, 0x696, 0x2, 0x7, 0x2a, 0x1, 0x91, 0xff, 0x903, 0x3ff, 0x4, 0x1, 0x9, 0x9, 0x5, 0x7ff, 0x6, 0x5, 0x3, 0x83, 0xb, 0x2, 0x6, 0xc, 0xa, 0x5, 0x7, 0x0, 0x1f5, 0xeb, 0x9, 0x7491, 0x9, 0xa, 0x9, 0x2, 0x4, 0x7, 0xe, 0x8000, 0x557, 0x8, 0xff, 0xd8f, 0x2, 0x5, 0x5, 0x3, 0x1000, 0x8c, 0x6, 0x7ff, 0x7fffffff, 0x8, 0x1, 0x80000001, 0x9e, 0x7, 0x7, 0x5, 0x7, 0x7fff, 0x3, 0xb380, 0x6, 0x8, 0x10001, 0x2, 0x5, 0xad76, 0x7, 0x7f, 0xf6, 0x4, 0x6c41, 0x2, 0x2, 0xf, 0x1ff, 0x9, 0x4, 0xc9, 0x7, 0x9, 0xab7, 0x7, 0x2, 0x1, 0x3, 0x4, 0x200, 0x7, 0x3d9d, 0x80000000, 0x2, 0x0, 0x8, 0x1, 0x8, 0x0, 0x1000, 0x9, 0xb96c, 0x3, 0x8, 0x0, 0x8, 0x6, 0x80000001, 0xbe5, 0xff, 0x6, 0x200, 0x95, 0xe0d, 0x458ba105, 0xd8, 0x90, 0x6, 0x4, 0x297a, 0xfffffff7, 0x0, 0x56, 0x8000, 0x2, 0x4, 0x8001, 0xa469, 0x10000, 0x7fffffff, 0x9, 0x6, 0x9, 0xe, 0xff, 0x0, 0x7, 0x7, 0x2, 0xdc8a, 0x1, 0xb07, 0x5, 0x6, 0x3, 0x97, 0x0, 0xff, 0x9, 0x2, 0x4, 0xffffff7f, 0x6f7, 0x2, 0x3, 0x7, 0x2, 0x81, 0xb, 0x2, 0x4, 0xf, 0x1, 0x1, 0xfffff800, 0x6, 0x4, 0x4, 0x9, 0x0, 0x8, 0xbc7d, 0x9, 0xcff, 0x1, 0x1ff, 0x2, 0x1, 0xff, 0xa, 0x5, 0x81, 0x3, 0x9, 0xfffffff5, 0xfffffffd, 0x3, 0xfffffffb, 0x8, 0x1000, 0xbc, 0x5a, 0x9, 0x0, 0x7, 0xfff, 0xbfc, 0x1, 0x3, 0x5, 0x9, 0x200, 0x800, 0x10, 0x8, 0x10001, 0x0, 0xd, 0x0, 0xffffff2d, 0x3, 0x4, 0xfffffff9, 0x7fff, 0x400, 0x10000, 0x8, 0x400, 0x9, 0x7, 0x1000]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x8810}, 0x404c0c0) 2.738681722s ago: executing program 2 (id=3334): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="4dc07f947163", 0x6) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$inet(r1, &(0x7f0000003340)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000002c0)="af8d195ac29a2a0fe48238e1543d21ee817644e51046a895ff2b7e18d764b6e016752938c9d661e72f7cc56a70a2967587d23dfbef4857038e1cf33269f981efe0dc9d60409b63866620856ebf18d3dc1efe26620cef44f9311cc7b4fb0aee4581ccb941afd07c76517b7cee360ef44217cf70bfb7f34b8cef568000e6a94f0e3a2a35edbe8739bc4203acd8179229f375ff9c71210818738eabb1988fa217f608427624c073807576e4dfbc6cae39f311d1aacfd5a6ee473edeb0947459", 0xbe}], 0x1}}, {{0x0, 0x0, &(0x7f0000001bc0)=[{&(0x7f0000000780)="39cf2a43b36375c8fc27", 0xa}, {&(0x7f0000000440)="c80308947503af258859e0be5946a385f4b8494e6acd7c90dc2ad0292bc111c01b6cce5170b897e57db614b4be21c101e1c5af685176986b24f636f1a77f75b6005d7c7d2580c19f6ebe37ef3b51226b96113fcb14db1fdc7c100c9f9bf30600a022f4ba2bfd568f1fb7ec6bc5cca808d9ca36999f4ca6818cd6d6eebe3ea9f4f846d2c548d1bb87931cff150afa35eab1b059636efbfc21dbfd41b8e4c00e28c98c60fe81cf41a4ef6e889002a191e28b09fd4dad0e42fec4e97a64190507d9718b1092eba1fcec6f54a25b3c19e547e0778fa9d23aa8650c5040e6b4646ea9a3a96a28a2a5db67fcfe2eeb6d61fd7ab378758baf15b9bf1aec5627b8ec1b8db26001180910e65f57b223458c1d2f8998f5fb6857d5f92e30b59a41300a3f54a16626291316956e8c1a60b9cee270c6a876786fda724ca4547061747e6411ffc667576c2eba19583098c73395a47aaeb9d65c427bb5393b0206d449", 0x15c}, {&(0x7f00000019c0)="46813196e6a84f286f5c34523818c5d6069c3d068f0c57e97d418e3566c8e2bb2b0ca8d3a16e81357c81bb47e2916311615ecdf4da861713becc", 0x3a}, {&(0x7f0000001a80)="cc15fe0530ed7899ffef88a735d3e154c702c6a3fccffda6f61f7523150742c198aaa84e07951efd0078ec28619f6e6d0164cd62383a9fb326471c9a6664dba2315fbfd4861c1753f0c577ab5127fcbdd3545e2eecc9996e4d6de2432a8d2e73ec49702654e72ceb5f2eaf", 0x6b}, {&(0x7f0000000080)="0819f1ac7c", 0x5}], 0x5}}, {{0x0, 0x0, &(0x7f0000003080)}}], 0x3, 0x44008090) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x4010}, 0x4) 2.652178043s ago: executing program 2 (id=3335): r0 = io_uring_setup(0x64a, 0x0) io_uring_register$IORING_REGISTER_FILE_ALLOC_RANGE(r0, 0x19, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB], 0x44}}, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x2982, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x6) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0xa, {"a2e39b214fc752f91b2909094bf70e0dd038e7ff7fc6e5539b324d078b089b3b0838681a0890e0878f0e1ac6e7049b3d6d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b343b0d076c0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0d9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c30900004288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef7becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda930b000000cbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe505003d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6ae4effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d71eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d471c8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949d9a92587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15aa82000000000000a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000", 0x1000}}, 0x1006) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f00000010c0)='./file0\x00', 0x105800, 0x41) openat(r4, &(0x7f0000001100)='./file0\x00', 0x2082, 0xc9) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000001040)=0x0) sched_setattr(r5, &(0x7f0000001080)={0x38, 0x0, 0x10000076, 0xad, 0x7, 0x9, 0x134b800000, 0x7f, 0x3, 0x2}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="120100009080e140fc044a500243010203010902120001000000"], 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="b80000001300e9990100000000000000fc000000000000000000000000000000ac1e000100000000000000000000000000000000000000000a003000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000000000000000000000000000000090000000000000000000002000000000050630000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000001000000000000"], 0xb8}}, 0x4000) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x389601, 0x0) r8 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r9 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r9, &(0x7f00000000c0), 0x10) sendmsg$can_bcm(r9, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000001140)=ANY=[@ANYBLOB="05000000000000000100000000000000", @ANYRES64=0x0, @ANYRES64=0xea60, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000310000000000000027000000000000000000"], 0x48}}, 0x0) sendmsg$can_bcm(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="050000000808"], 0x80}}, 0x0) close_range(r8, 0xffffffffffffffff, 0x0) ioctl$TIOCMIWAIT(r7, 0x545c, 0x7cb7562f2d67) ioctl$TIOCMSET(r7, 0x5418, 0x0) 2.434109353s ago: executing program 1 (id=3336): r0 = syz_open_dev$dri(&(0x7f0000000000), 0xbc1, 0x100000) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f00000001c0)={&(0x7f0000000140)=[r1, r2, r3, r4], &(0x7f0000000180)=[0x91, 0x3], 0x4, 0x1}) r5 = getpgid(0x0) syz_clone(0x2802000, 0x0, 0x0, 0x0, 0x0, 0x0) getpriority(0x1, r5) 2.242199527s ago: executing program 1 (id=3337): socket$nl_route(0x10, 0x3, 0x0) (async) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) (async, rerun: 64) r2 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (rerun: 64) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x0, 0x0) (async) recvmmsg(r3, &(0x7f00000001c0), 0x1014a, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x8000, 0x48, 0x7, 0x8}, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) (async, rerun: 64) fcntl$getown(r3, 0x9) (rerun: 64) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, 0x0) (async) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r8 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r6, 0xe3fc) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xfffffffffffff000, 0x101, &(0x7f0000000080)) (async, rerun: 32) getrusage(0xffffffffffffffff, &(0x7f0000000640)) (rerun: 32) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000580)={[0x5, 0x0, 0x41a3, 0x2000000005, 0x4, 0xfffffffffffffffb, 0x2, 0x8, 0x3, 0x1, 0x800, 0x9, 0x9, 0xfffffffffffff805, 0x51, 0x3], 0x0, 0x310011}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000480)={0x88, 0x0, &(0x7f00000004c0)=[@exit_looper, @dead_binder_done, @dead_binder_done, @free_buffer={0x40086303, r8}, @acquire_done, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@binder={0x73622a85, 0x0, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000340)=""/185, 0xb9, 0x1, 0x2c}, @fd}, &(0x7f0000000140)={0x0, 0x18, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) (async, rerun: 32) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0xe811) (async, rerun: 32) syz_usb_connect(0x1, 0x36, &(0x7f0000000780)=ANY=[@ANYBLOB="ea57398947b56c2522aad85245b473663e56e8740774f62c61d82ef5ce957cdb200ca5d09126a47aac335161d3053234ee80d18a522feaae3a92e181c196ef7eda3b04b1a332df35d35527659c1899d20e", @ANYRESDEC=r1], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) (async) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r9, &(0x7f0000000380), 0x0) pread64(r9, &(0x7f0000000280)=""/123, 0x7b, 0x2) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) timer_settime(r10, 0x0, &(0x7f0000000240)={{0x77359400}, {0x77359400}}, 0x0) 2.152784979s ago: executing program 4 (id=3338): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000000010000040900010073797a3100000000080005400000002b0900020073797a310000000008000a40fffffffc140000001100010000000000000000000100000a00"/100], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x4001, 0x0) (async) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x4001, 0x0) ioctl$PPPIOCGUNIT(r1, 0x80047456, &(0x7f00000001c0)) (async) ioctl$PPPIOCGUNIT(r1, 0x80047456, &(0x7f00000001c0)) syz_emit_ethernet(0x5a, &(0x7f0000000000)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0xe, 0x4, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x5, 0x0, @dev, @rand_addr=0x64010102, {[@timestamp_addr={0x44, 0x14, 0x5, 0x3, 0x0, [{@multicast2}, {@empty, 0x9}]}, @ssrr={0x89, 0xb, 0x77, [@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @generic={0x7, 0x2}]}}, {{0x4, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x28}}}}}}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') preadv2(r2, &(0x7f0000000380)=[{&(0x7f0000000300)=""/103, 0x67}, {&(0x7f0000001600)=""/239, 0xef}], 0x2, 0x5, 0x101, 0x1) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r2, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000240)={&(0x7f0000000340)={0x9c, 0x3, 0x1, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8}, [@CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x2}, @CTA_SYNPROXY={0x24, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x2}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x6}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x2}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x5}]}, @CTA_LABELS={0x18, 0x16, 0x1, 0x0, [0x4, 0x200, 0x7, 0x8, 0xffff0001]}, @CTA_SEQ_ADJ_ORIG={0x44, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x4}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x5}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x200}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x2}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x9}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xd32}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x7}, @CTA_SEQADJ_OFFSET_AFTER={0x8}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x24048000}, 0x100) (async) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r2, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000240)={&(0x7f0000000340)={0x9c, 0x3, 0x1, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8}, [@CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x2}, @CTA_SYNPROXY={0x24, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x2}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x6}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x2}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x5}]}, @CTA_LABELS={0x18, 0x16, 0x1, 0x0, [0x4, 0x200, 0x7, 0x8, 0xffff0001]}, @CTA_SEQ_ADJ_ORIG={0x44, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x4}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x5}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x200}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x2}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x9}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xd32}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x7}, @CTA_SEQADJ_OFFSET_AFTER={0x8}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x24048000}, 0x100) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYRESOCT=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x0, 0x4000) 2.027079998s ago: executing program 4 (id=3339): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) r1 = socket$inet6(0xa, 0x800, 0x8) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x8c36, 0x10000, 0x2, 0xbfdffffa}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r6 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r7 = dup(r6) write$6lowpan_enable(r7, &(0x7f0000000000)='0', 0xfffffd2c) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000280)={&(0x7f0000000200)="15bf62d6aaa4eb70b33f201630088d4934d17b137ff39f9d858b9c3ea2a0e9e8a4811b81010ddfbf80d5d7938b7bbcdc61e1ae894188d1f38551c827e1d5ad03345666cd30ba3d991cdac41d3868", &(0x7f00000000c0)=""/41, &(0x7f0000000300)="050e77b54a3ea869609e6a8924aa6456e8a2ea99eb1f29b167437def626f52a21c28b5d919dda8f17ac633474b13de35be9657866244899d7cff1910709336f27f1ec5ed8b30ae51b36060ea2192bdb8b55b3ac00ebb7d7a00e7ad9c188eda91f47bec710497f9c8cca277fa731f614f612e767c0443b4fd7b4d3dd67e18707d7cb5a8aa89c97e3f968567ad56609e521ff4cd6cbe6e36680340875f65a0d1b2", &(0x7f00000003c0)="d5b2c981d7c56d2983644279ee0807f964ef273da562e49ec441c17a11b48f5742865b74d8f9c83a8c4df3bb7bb1f6900ac16235b6a2e61a68c3c661289a03d430ae4932c6f81cc68cab3b2f9486106f021b3bc41c9ec6eee77d90c46d7f7b76947015261ca4bcc03c217b7ff4a8424867cab030fb54b32bfd2564f430a0d8daa154bf9af5be695d13d721909225e9ab304a0753dd73fe20a419a17740b60db0b83ab6db0545b479aa6abcd5e0701c", 0x9, r7, 0x4}, 0x38) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="050000400000000000000600000008000300", @ANYRES32=r10, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[@ANYBLOB="1beaee", @ANYRES16=r9, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r10, @ANYBLOB="42000e0080000000ffffffffffff080211000000ffffffffffff0000feffffffffffffff070001000406f0027f0006a7050358e00725030164007206030303030303000021000f00011b566566c044d76ff2cb984d505d6261f445ae7a1fba57871d75497b000000080026006c09000008000c006400000008000d0000000000"], 0x9c}, 0x1, 0x0, 0x0, 0x20004090}, 0x0) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c000000090601020000000000000000020000000900020073797a31000000000500010007000000240007801800018014000240fd8000000000000000000000000000bb060004404e1f00007fb2272eb14cda221f17eea96d4a83da48079449fc4f67e552"], 0x4c}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) io_uring_enter(r3, 0x47f6, 0x0, 0x0, 0x0, 0x0) r12 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='sessionid\x00') read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$PPPOEIOCDFWD(r12, 0xb101, 0x0) sendmsg$tipc(r2, &(0x7f0000000c80)={&(0x7f0000000980)=@id, 0x10, 0x0}, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0x9eb9, 0x4) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f0000000880)=0xfbf, 0x4) bind$inet6(r1, &(0x7f0000f65000)={0xa, 0x4c20, 0x0, @loopback}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0xfffffefffbfbbfbe, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty, 0x6}, 0x1c) r13 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r13, 0x4004743d, 0x110e22fff6) syz_usb_connect(0x0, 0x24, &(0x7f0000000540)=ANY=[@ANYRES8=r0, @ANYRESDEC=r5, @ANYBLOB="316117c489ffcf0f147032b4198b90d760b40535a1091dfa8381d11d88da45d68ccaecda7f4aefb45ebefec4f18c8e64c99f4fafdaac414863cf4070c37318f4c30819592d146edab21e4de74efe03f926bbd6ec294bb53626d6d9083adee3505d11dc4bc388ce6b737083a5b38c8fcf6a89adaa86b6ce742a6508197ee65a44861d1a5d541be4c44fac91a2e518e256a9dc976221e92b7ba4564d9153d185bb53b79d67d790db32e86e03814f7819790b21468ac46d046e8645e42aec000f1fa8ad45ed56a45d30744db06c64c52c"], 0x0) 1.964137133s ago: executing program 1 (id=3340): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = dup(r1) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040)={0x3}, 0x1) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000380)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000080)="b1", 0x1, 0x400c0d4, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r4 = timerfd_create(0x0, 0x800) timerfd_settime(r4, 0x3, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$UHID_INPUT(r2, &(0x7f0000002080)={0x2, {"a2e3ad214fc752f91b450a0787f70e06d038e7ff7fc6e5539b326d078b089b2008385d090890e0878f0e1ac6e70a9b334a959b689a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31320d095d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5bb6f5dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f0841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b158b41f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b00005e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85824056526f889af43a605608057228652010400006c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d82d6734b849304c27b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a4d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833c596c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f5d6d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9ef6d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ca4d24ad92f243941ed274f12a29ff962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e029efe0703615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712ea5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9b97474a5966a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185daba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687fd1602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81da8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6687f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741258c5488efeee327415cc19451432c6f14c27693102a5bd848d7cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a941f0000005f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c86310e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39e3313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13b5c1fa7cfaadba85c7248758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb9957697c9ede7885d94ffb0759be0daf60a842b09eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f49013a3a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000210000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b1271e0400", 0x1000}}, 0x1006) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'veth1_virt_wifi\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x839, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r5, {0xe, 0x6}, {0x5}, {0x3}}}, 0x24}}, 0x0) 1.812654871s ago: executing program 0 (id=3341): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000001580), 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@bloom_filter={0x1e, 0x9, 0x3, 0x40, 0x1, 0xffffffffffffffff, 0x0, '\x00', r1, 0xffffffffffffffff, 0x1, 0x4, 0x3, 0x6}, 0x50) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="74010000", @ANYRES16=r2, @ANYBLOB="11060000000000000000010000000800050001000000200108803c0000801400040002000000ac1e00010000000000000000240001000000000000000000000000000000000000000000000000000000000000000000e0000080a400098028000080060001000a0000001400020020010000000000000000000000000001050003000100000028000080060001000a00000014000200ff010000000000000000000000000001050003002aea091428000080060001000a00000014000200ff010000000000000000000000000001050003000300000028020080060001000a00000014000200ff0100000000000000000000000000010500030000000000240001000000000000000000000000000000000000000000000000000000000000000000140004000200000000000000000000000000000024000300000000000000000000000000000000000000000000000000000000000000000014000200776731"], 0x174}}, 0x0) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, r2, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000040}, 0x4010) ustat(0x801, &(0x7f0000000300)) socket$packet(0x11, 0x3, 0x300) socket$inet_udp(0x2, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000b, 0x50, 0xffffffffffffffff, 0x9f1fb000) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x2172, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0xe) mlock2(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) r3 = shmget$private(0x0, 0x9000, 0x0, &(0x7f0000ff7000/0x9000)=nil) shmat(r3, &(0x7f0000ffc000/0x2000)=nil, 0x4000) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) ioctl$RTC_UIE_OFF(0xffffffffffffffff, 0x7004) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000240), 0x20000, 0x0) ioctl$PTP_PIN_SETFUNC(r4, 0x40603d07, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000240), 0xd21, 0x4000) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f00000000c0)=0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) 1.440772476s ago: executing program 2 (id=3342): r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'netdevsim0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0_to_bridge\x00'}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={0x0, 0x40}, 0x1, 0xba01, 0x0, 0x4000044}, 0x10) 1.438957527s ago: executing program 1 (id=3343): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x53b903, 0x0) (async) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x53b903, 0x0) write$binfmt_misc(r2, &(0x7f0000000200), 0xfffffecc) ioctl$KDENABIO(r3, 0x4b36) (async) ioctl$KDENABIO(r3, 0x4b36) splice(r1, 0x0, r3, 0x0, 0x100000006, 0x0) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r4, 0xc00864bf, &(0x7f0000000240)) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r4, 0xc00864bf, &(0x7f0000000240)) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) r5 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000940)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r4, 0xc05064a7, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000b40)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0, 0x6, 0x0, 0x0, r6}) ioctl$DRM_IOCTL_RES_CTX(r5, 0xc0106426, &(0x7f0000000300)={0x5, &(0x7f0000000280)=[{0x0}, {}, {}, {}, {}]}) ioctl$DRM_IOCTL_UNLOCK(0xffffffffffffffff, 0x4008642b, &(0x7f0000000340)={r7, 0x34}) (async) ioctl$DRM_IOCTL_UNLOCK(0xffffffffffffffff, 0x4008642b, &(0x7f0000000340)={r7, 0x34}) ioctl$DRM_IOCTL_GET_CTX(r1, 0xc0086423, &(0x7f0000000280)={r7, 0x3}) (async) ioctl$DRM_IOCTL_GET_CTX(r1, 0xc0086423, &(0x7f0000000280)={r7, 0x3}) r8 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181e00) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='blkio.bfq.io_service_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r9, &(0x7f0000000b00)=ANY=[], 0x1df) (async) write$UHID_CREATE2(r9, &(0x7f0000000b00)=ANY=[], 0x1df) write$binfmt_misc(r2, &(0x7f0000000080)="c0452e49fb1f75954603e88d565f6fc7633d4f72328f076bc24019fa23dccd1a051574113daca8796d6ba7c5868c298caf0000", 0x33) ioctl$LOOP_CONFIGURE(r8, 0x4c0a, &(0x7f00000002c0)={r9, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54a08000000000000002d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00", [0x3]}}) recvmmsg(r0, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}, 0x8101}, {{0x0, 0x0, 0x0, 0xfffffffffffffc9a}, 0x10000}, {{0x0, 0x0, 0x0}, 0x40000e}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000380)=""/188, 0xbc}, {&(0x7f0000000840)=""/245, 0xf5}, {&(0x7f0000000a80)=""/101, 0x65}, {&(0x7f0000001400)=""/4109, 0x100d}, {&(0x7f00000006c0)=""/229, 0xe5}], 0x5}, 0x80000010}, {{&(0x7f00000004c0)=@qipcrtr, 0x80, &(0x7f0000000980)=[{&(0x7f0000000540)=""/24, 0x18}, {&(0x7f0000000600)=""/9, 0x9}, {&(0x7f0000000580)=""/62, 0x3e}, {&(0x7f00000007c0)=""/102, 0x66}], 0x4, &(0x7f0000000cc0)=""/197, 0xc5}, 0x8}], 0x5, 0x122, 0x0) r10 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000640)=ANY=[@ANYRES8=0x0, @ANYRESHEX=r10, @ANYRES16=0x0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB], 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000640)=ANY=[@ANYRES8=0x0, @ANYRESHEX=r10, @ANYRES16=0x0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x2302808, 0x0) r11 = open_tree(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x89901) move_mount(r11, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r12 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000e80)=ANY=[@ANYRESDEC=r0, @ANYRESHEX=r12, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYRES16]) (async) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000e80)=ANY=[@ANYRESDEC=r0, @ANYRESHEX=r12, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYRES16]) umount2(&(0x7f0000000100)='./file0\x00', 0x0) (async) umount2(&(0x7f0000000100)='./file0\x00', 0x0) openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000b00), 0x2, 0x0) 1.340517315s ago: executing program 3 (id=3344): r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x44}}, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000080)={{0x1009, 0x0, 0x0, 0x80, 'syz0\x00', 0x40000000}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x8, 'syz1\x00', 0x0}) 1.289194809s ago: executing program 3 (id=3345): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="4dc07f947163", 0x6) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$inet(r1, &(0x7f0000003340)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000002c0)="af8d195ac29a2a0fe48238e1543d21ee817644e51046a895ff2b7e18d764b6e016752938c9d661e72f7cc56a70a2967587d23dfbef4857038e1cf33269f981efe0dc9d60409b63866620856ebf18d3dc1efe26620cef44f9311cc7b4fb0aee4581ccb941afd07c76517b7cee360ef44217cf70bfb7f34b8cef568000e6a94f0e3a2a35edbe8739bc4203acd8179229f375ff9c71210818738eabb1988fa217f608427624c073807576e4dfbc6cae39f311d1aacfd5a6ee473edeb0947459", 0xbe}], 0x1}}, {{0x0, 0x0, &(0x7f0000001bc0)=[{&(0x7f0000000780)="39cf2a43b36375c8fc27", 0xa}, {&(0x7f0000000440)="c80308947503af258859e0be5946a385f4b8494e6acd7c90dc2ad0292bc111c01b6cce5170b897e57db614b4be21c101e1c5af685176986b24f636f1a77f75b6005d7c7d2580c19f6ebe37ef3b51226b96113fcb14db1fdc7c100c9f9bf30600a022f4ba2bfd568f1fb7ec6bc5cca808d9ca36999f4ca6818cd6d6eebe3ea9f4f846d2c548d1bb87931cff150afa35eab1b059636efbfc21dbfd41b8e4c00e28c98c60fe81cf41a4ef6e889002a191e28b09fd4dad0e42fec4e97a64190507d9718b1092eba1fcec6f54a25b3c19e547e0778fa9d23aa8650c5040e6b4646ea9a3a96a28a2a5db67fcfe2eeb6d61fd7ab378758baf15b9bf1aec5627b8ec1b8db26001180910e65f57b223458c1d2f8998f5fb6857d5f92e30b59a41300a3f54a16626291316956e8c1a60b9cee270c6a876786fda724ca4547061747e6411ffc667576c2eba19583098c73395a47aaeb9d65c427bb5393b0206d449", 0x15c}, {&(0x7f00000019c0)="46813196e6a84f286f5c34523818c5d6069c3d068f0c57e97d418e3566c8e2bb2b0ca8d3a16e81357c81bb47e2916311615ecdf4da861713becc", 0x3a}, {&(0x7f0000001a80)="cc15fe0530ed7899ffef88a735d3e154c702c6a3fccffda6f61f7523150742c198aaa84e07951efd0078ec28619f6e6d0164cd62383a9fb326471c9a6664dba2315fbfd4861c1753f0c577ab5127fcbdd3545e2eecc9996e4d6de2432a8d2e73ec49702654e72ceb5f2eaf", 0x6b}, {&(0x7f0000000080)="0819f1ac7c", 0x5}], 0x5}}, {{0x0, 0x0, &(0x7f0000003080)}}], 0x3, 0x44008090) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x4010}, 0x4) 1.208498591s ago: executing program 3 (id=3346): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f00000000c0)={[{0x0, 0x800, 0x0, 0x24, 0x0, 0xa5, 0xbd, 0x9, 0xad, 0x4, 0x1, 0x0, 0x40000000}, {0xa, 0x4005, 0x0, 0x0, 0x41, 0x0, 0x8, 0x0, 0x99, 0xff, 0x0, 0x2, 0x7}, {0x3fe, 0x2, 0x4, 0xfd, 0x0, 0x0, 0xb3, 0x0, 0x4, 0xfe, 0x80, 0xf7, 0x7}], 0x5}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x3) ioctl$KVM_SET_CPUID2(r5, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYBLOB="070000000000000007000000ffffffff"]) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f0000003380)=[{{&(0x7f00000001c0)=@rc={0x1f, @fixed}, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000280)=""/78, 0x4e}, {&(0x7f0000000a80)=""/4096, 0x1000}, {&(0x7f0000001dc0)=""/4096, 0x1000}, {&(0x7f0000000300)=""/252, 0xfc}, {&(0x7f0000000500)=""/183, 0xb7}, {&(0x7f00000005c0)=""/249, 0xf9}, {&(0x7f00000006c0)=""/140, 0x8c}, {&(0x7f0000000440)=""/125, 0x7d}, {&(0x7f0000000780)=""/173, 0xad}, {&(0x7f0000000840)=""/125, 0x7d}], 0xa, &(0x7f0000001b40)=""/252, 0xfc}, 0x741}, {{&(0x7f0000000980)=@qipcrtr, 0x80, &(0x7f0000000140)=[{&(0x7f0000001c40)=""/194, 0xc2}], 0x1, &(0x7f0000002dc0)=""/130, 0x82}, 0x9}, {{&(0x7f0000001a80)=@pppoe, 0x80, &(0x7f0000003200)=[{&(0x7f0000002e80)=""/156, 0x9c}, {&(0x7f0000000a00)=""/39, 0x27}, {&(0x7f0000002f40)=""/71, 0x47}, {&(0x7f0000001d40)=""/39, 0x27}, {&(0x7f0000002fc0)=""/42, 0x2a}, {&(0x7f0000003000)=""/186, 0xba}, {&(0x7f00000030c0)=""/225, 0xe1}, {&(0x7f00000031c0)=""/9, 0x9}], 0x8, &(0x7f0000003280)=""/202, 0xca}, 0x2e}], 0x3, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r7, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="120100004c2c5a105e047507f84901020301090212000100fd00007d5bbf5e00aecd"], 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40000000, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'veth1_to_batadv\x00', 0x7101}) unshare(0x2040400) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4050) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r8, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) newfstatat(0xffffffff0000005d, 0x0, 0x0, 0x1000) socket$alg(0x26, 0x5, 0x0) 1.207853415s ago: executing program 2 (id=3347): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYBLOB="0198000000000000200012800800010067726500140002800800010089"], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x40) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@newqdisc={0x7c, 0x24, 0x5820a61ca228659, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r1, {0x0, 0x9}, {0xffff, 0xffff}, {0x5, 0x7}}, [@qdisc_kind_options=@q_pfifo={{0xa}, {0x8}}, @TCA_STAB={0x2c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x22, 0xa, 0x90, 0xc5, 0x2, 0x7, 0x3, 0x4}}, {0xc, 0x2, [0x1, 0x4, 0x1, 0x1]}}]}, @qdisc_kind_options=@q_gred={{0x9}, {0xc, 0x2, [@TCA_GRED_MAX_P={0x8, 0x4, 0x800}]}}]}, 0x7c}}, 0x800) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=@newtfilter={0x43c, 0x28, 0xd27, 0x1004001, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x2, 0x9}, {0x3}, {0x2, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x40c, 0x2, [@TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x7, 0x2, 0x80000001, 0x7, 0x6, 0x9, 0x1, 0x7ff, 0x7, 0x9, 0x0, 0x5, 0x1, 0x3, 0x7, 0x66, 0x316a, 0x86dc, 0x1, 0x5, 0x0, 0x8, 0x80000001, 0x8, 0x4, 0x2, 0x9, 0x9, 0x1b8, 0xbb5f, 0x7, 0x3f, 0x3ff, 0x80000003, 0xffffff81, 0x696, 0x2, 0x7, 0x2a, 0x1, 0x91, 0xff, 0x903, 0x3ff, 0x4, 0x1, 0x9, 0x9, 0x5, 0x7ff, 0x6, 0x5, 0x3, 0x83, 0xb, 0x2, 0x6, 0xc, 0xa, 0x5, 0x7, 0x0, 0x1f5, 0xeb, 0x9, 0x7491, 0x9, 0xa, 0x9, 0x2, 0x4, 0x7, 0xe, 0x8000, 0x557, 0x8, 0xff, 0xd8f, 0x2, 0x5, 0x5, 0x3, 0x1000, 0x8c, 0x6, 0x7ff, 0x7fffffff, 0x8, 0x1, 0x80000001, 0x9e, 0x7, 0x7, 0x5, 0x7, 0x7fff, 0x3, 0xb380, 0x6, 0x8, 0x10001, 0x2, 0x5, 0xad76, 0x7, 0x7f, 0xf6, 0x4, 0x6c41, 0x2, 0x2, 0xf, 0x1ff, 0x9, 0x4, 0xc9, 0x7, 0x9, 0xab7, 0x7, 0x2, 0x1, 0x3, 0x4, 0x200, 0x7, 0x3d9d, 0x80000000, 0x2, 0x0, 0x8, 0x1, 0x8, 0x0, 0x1000, 0x9, 0xb96c, 0x3, 0x8, 0x0, 0x8, 0x6, 0x80000001, 0xbe5, 0xff, 0x6, 0x200, 0x95, 0xe0d, 0x458ba105, 0xd8, 0x90, 0x6, 0x4, 0x297a, 0xfffffff7, 0x0, 0x56, 0x8000, 0x2, 0x4, 0x8001, 0xa469, 0x10000, 0x7fffffff, 0x9, 0x6, 0x9, 0xe, 0xff, 0x0, 0x7, 0x7, 0x2, 0xdc8a, 0x1, 0xb07, 0x5, 0x6, 0x3, 0x97, 0x0, 0xff, 0x9, 0x2, 0x4, 0xffffff7f, 0x6f7, 0x2, 0x3, 0x7, 0x2, 0x81, 0xb, 0x2, 0x4, 0xf, 0x1, 0x1, 0xfffff800, 0x6, 0x4, 0x4, 0x9, 0x0, 0x8, 0xbc7d, 0x9, 0xcff, 0x1, 0x1ff, 0x2, 0x1, 0xff, 0xa, 0x5, 0x81, 0x3, 0x9, 0xfffffff5, 0xfffffffd, 0x3, 0xfffffffb, 0x8, 0x1000, 0xbc, 0x5a, 0x9, 0x0, 0x7, 0xfff, 0xbfc, 0x1, 0x3, 0x5, 0x9, 0x200, 0x800, 0x10, 0x8, 0x10001, 0x0, 0xd, 0x0, 0xffffff2d, 0x3, 0x4, 0xfffffff9, 0x7fff, 0x400, 0x10000, 0x8, 0x400, 0x9, 0x7, 0x1000]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x8810}, 0x404c0c0) 1.028620557s ago: executing program 1 (id=3348): timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMIWAIT(r1, 0x545c, 0x7cb7562f2d67) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo\x00') r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000005500e502000000000000000007"], 0x38}}, 0x0) getdents64(r2, &(0x7f0000000fc0)=""/224, 0xe0) 1.026391915s ago: executing program 0 (id=3349): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r0 = getpgrp(0x0) syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x101301) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) rt_tgsigqueueinfo(r0, r0, 0x1a, &(0x7f0000000600)={0x2f, 0x1, 0x2}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r3 = io_uring_setup(0x191a, &(0x7f0000000000)={0x0, 0x761, 0x10, 0x1, 0x11cb}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r4 = request_key(&(0x7f0000000240)='rxrpc\x00', &(0x7f0000000400)={'syz', 0x0}, &(0x7f00000005c0)='/dev/infiniband/rdma_cm\x00', 0xffffffffffffffff) add_key$user(&(0x7f00000000c0), &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0, r4) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="48000000100005040000005f596da40000880900", @ANYRES32=r6, @ANYBLOB="0000000000000000280012800b00010065727370616e000018000280060011004e23000004001200080015"], 0x48}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'syztnl0\x00', &(0x7f0000000300)={'ip6tnl0\x00', r6, 0x29, 0x2, 0x5, 0x5, 0x18, @dev={0xfe, 0x80, '\x00', 0x31}, @loopback, 0x0, 0x7830, 0x8001, 0x4}}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) poll(0x0, 0x0, 0x1) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) socket$kcm(0x21, 0x2, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x40000) r8 = openat$cgroup_int(r7, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) write$cgroup_subtree(r8, &(0x7f00000000c0)=ANY=[], 0x6a) 0s ago: executing program 2 (id=3350): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff000000001d040000000000001c200000000000007504000001ed0a0064000000170000000c040000000000007b0a00fe000000006e04000000001000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29fa9ec35866a96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed90000800847683c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d680000000000"], &(0x7f00000001c0)='GPL\x00'}, 0x48) kernel console output (not intermixed with test programs): [ 726.301520][ T1158] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.318794][ T1158] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.331167][ T5966] usb usb1-port1: unable to enumerate USB device [ 726.355499][ T1158] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.397222][ T1158] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.534576][ T9177] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 726.562887][ T9177] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 726.626758][ T1158] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 726.659218][ T1158] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 727.083497][T16425] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 727.267468][T16425] usb 5-1: config 0 has no interfaces? [ 727.354084][T16425] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 727.470066][T16425] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 727.520802][T16425] usb 5-1: Product: syz [ 727.560606][T16425] usb 5-1: Manufacturer: syz [ 727.630982][T16425] usb 5-1: SerialNumber: syz [ 727.688566][T16425] usb 5-1: config 0 descriptor?? [ 728.883246][ T5182] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 728.920015][ T5182] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 728.929797][ T5182] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 728.956334][ T5182] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 728.966572][ T5182] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 729.198325][ T9179] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 729.258294][ T9179] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 730.822722][T13829] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 731.026793][T16425] usb 5-1: USB disconnect, device number 124 [ 731.058797][ T5182] Bluetooth: hci0: command tx timeout [ 731.072440][T13829] usb 3-1: Using ep0 maxpacket: 16 [ 731.112985][ T5923] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 731.184400][T13829] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 731.202642][T13829] usb 3-1: config 0 has no interfaces? [ 731.239023][T13829] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 731.241443][ T9179] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 731.283594][ T5923] usb 2-1: Using ep0 maxpacket: 16 [ 731.332105][ T9179] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 731.346817][T13829] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 731.364148][ T5923] usb 2-1: config 1 has an invalid interface number: 105 but max is 0 [ 731.382721][T13829] usb 3-1: Manufacturer: syz [ 731.387816][ T5923] usb 2-1: config 1 has no interface number 0 [ 731.408412][T13829] usb 3-1: config 0 descriptor?? [ 731.414294][ T5923] usb 2-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 731.425713][ T5923] usb 2-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 731.437755][ T5923] usb 2-1: config 1 interface 105 has no altsetting 0 [ 731.451979][ T5923] usb 2-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 731.471897][ T5923] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 731.487487][ T5923] usb 2-1: Product: syz [ 731.491733][ T5923] usb 2-1: Manufacturer: syz [ 731.519577][ T5923] usb 2-1: SerialNumber: syz [ 731.572778][T16425] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 731.573648][T16902] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 731.592637][T16902] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 731.593684][ T9179] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 731.690395][T16895] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 731.715330][T16895] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 731.748943][ T9179] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 731.800244][T16425] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 731.821593][T16425] usb 5-1: New USB device found, idVendor=0458, idProduct=0087, bcdDevice= 0.00 [ 731.852207][T16425] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 731.935530][T16425] usb 5-1: config 0 descriptor?? [ 732.087527][T16902] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 732.104356][T16902] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 732.128449][ T9179] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 732.145106][ T9179] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 732.358486][T16425] kye 0003:0458:0087.0020: unbalanced delimiter at end of report description [ 732.373164][T16425] kye 0003:0458:0087.0020: parse failed [ 732.382282][T16425] kye 0003:0458:0087.0020: probe with driver kye failed with error -22 [ 732.466934][T16892] chnl_net:caif_netlink_parms(): no params data found [ 732.557992][T16908] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 732.567191][T16908] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 732.585464][T16925] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 732.595800][T16925] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 732.667196][T16425] usb 5-1: USB disconnect, device number 125 [ 733.125288][T13829] usb 3-1: USB disconnect, device number 120 [ 733.134501][ T5182] Bluetooth: hci0: command tx timeout [ 733.182447][T16425] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 733.375845][T16425] usb 5-1: device descriptor read/64, error -71 [ 733.383762][ T5923] aqc111 2-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 733.384476][T16892] bridge0: port 1(bridge_slave_0) entered blocking state [ 733.429106][T16892] bridge0: port 1(bridge_slave_0) entered disabled state [ 733.439862][T16892] bridge_slave_0: entered allmulticast mode [ 733.476053][T16892] bridge_slave_0: entered promiscuous mode [ 733.535731][ T5923] aqc111 2-1:1.105 eth5: register 'aqc111' at usb-dummy_hcd.1-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 20:fc:94:45:3a:41 [ 733.606203][ T5923] usb 2-1: USB disconnect, device number 24 [ 733.614318][T16425] usb 5-1: new high-speed USB device number 127 using dummy_hcd [ 733.639490][ T5923] aqc111 2-1:1.105 eth5: unregister 'aqc111' usb-dummy_hcd.1-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 733.802616][T16425] usb 5-1: device descriptor read/64, error -71 [ 733.927645][T16425] usb usb5-port1: attempt power cycle [ 734.110220][T16975] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3020'. [ 734.338173][T16425] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 734.382808][T16425] usb 5-1: device descriptor read/8, error -71 [ 734.652514][T16425] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 734.677715][T16425] usb 5-1: device descriptor read/8, error -71 [ 734.823414][T16425] usb usb5-port1: unable to enumerate USB device [ 734.998799][ T9179] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 735.012289][ T9179] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 735.031048][ T9179] bond0 (unregistering): (slave bond3): Releasing backup interface [ 735.041537][ T9179] bond0 (unregistering): (slave bond4): Releasing backup interface [ 735.053086][ T9179] bond0 (unregistering): Released all slaves [ 735.212744][ T5182] Bluetooth: hci0: command tx timeout [ 735.454359][ T9179] bond1 (unregistering): Released all slaves [ 735.489759][ T9179] bond2 (unregistering): Released all slaves [ 735.731958][ T9179] bond3 (unregistering): Released all slaves [ 735.941344][T16994] kAFS: unparsable volume name [ 735.990586][ T9179] bond4 (unregistering): Released all slaves [ 736.007946][T16892] bridge0: port 2(bridge_slave_1) entered blocking state [ 736.017010][T16892] bridge0: port 2(bridge_slave_1) entered disabled state [ 736.029314][T16892] bridge_slave_1: entered allmulticast mode [ 736.037763][T16892] bridge_slave_1: entered promiscuous mode [ 736.163351][ T5923] aqc111 2-1:1.105 eth5 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 736.186637][ T5923] aqc111 2-1:1.105 eth5 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 736.202201][ T5923] aqc111 2-1:1.105 eth5 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 736.234312][ T9179] _ÐZ`Ô€@ÿÃ: left promiscuous mode [ 736.301151][T16892] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 736.330673][T16892] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 736.403970][T17004] netlink: 'syz.3.3027': attribute type 25 has an invalid length. [ 736.412015][T17004] netlink: 'syz.3.3027': attribute type 1 has an invalid length. [ 736.433432][T17004] bridge0: port 1(bridge_slave_0) entered learning state [ 736.446253][ T9179] tipc: Disabling bearer [ 736.481852][ T9179] tipc: Left network mode [ 736.601279][T16892] team0: Port device team_slave_0 added [ 736.835971][T16892] team0: Port device team_slave_1 added [ 737.229150][T17026] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3030'. [ 737.256384][T17026] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3030'. [ 737.292720][ T5182] Bluetooth: hci0: command tx timeout [ 737.601560][T17029] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 737.611167][T17029] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 737.654892][T16892] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 737.664854][T16892] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 737.723736][T16892] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 737.864144][T16892] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 737.871125][T16892] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 737.904660][T16892] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 737.960012][ T9179] veth1_macvtap: left promiscuous mode [ 737.974319][ T9179] veth0_macvtap: left promiscuous mode [ 738.053601][T16425] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 738.233316][T16425] usb 4-1: config 0 has an invalid interface number: 244 but max is 0 [ 738.242153][T16425] usb 4-1: config 0 has no interface number 0 [ 738.249055][T16425] usb 4-1: config 0 interface 244 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 738.268066][T16425] usb 4-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=92.c2 [ 738.277752][T16425] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 738.290749][T16425] usb 4-1: Product: syz [ 738.295116][T16425] usb 4-1: Manufacturer: syz [ 738.299867][T16425] usb 4-1: SerialNumber: syz [ 738.315064][T16425] usb 4-1: config 0 descriptor?? [ 738.320871][T17044] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 738.338501][T16425] usbserial_generic 4-1:0.244: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 738.355317][T16425] usbserial_generic 4-1:0.244: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 738.368017][T16425] usbserial_generic 4-1:0.244: generic converter detected [ 738.388501][T16425] usb 4-1: generic converter now attached to ttyUSB0 [ 738.537745][ T5923] usb 4-1: USB disconnect, device number 48 [ 738.565396][ T5923] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 738.574625][ T5923] usbserial_generic 4-1:0.244: device disconnected [ 738.660222][ T9179] team0 (unregistering): Port device team_slave_1 removed [ 738.717188][ T9179] team0 (unregistering): Port device team_slave_0 removed [ 738.899967][T17057] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3038'. [ 739.201923][T17067] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3042'. [ 739.292686][T13829] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 739.362892][ T981] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 739.482499][T13829] usb 2-1: Using ep0 maxpacket: 16 [ 739.494003][T13829] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 31, changing to 8 [ 739.505783][T13829] usb 2-1: config 0 interface 0 has no altsetting 0 [ 739.512583][T13829] usb 2-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 739.521925][T13829] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 739.533859][ T981] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 739.546403][T13829] usb 2-1: config 0 descriptor?? [ 739.554550][ T981] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 739.575488][ T981] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 739.585913][ T981] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 739.603568][ T981] usb 5-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 739.613154][ T981] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 739.636276][ T981] usb 5-1: config 0 descriptor?? [ 739.764606][T16892] hsr_slave_0: entered promiscuous mode [ 739.771220][T16892] hsr_slave_1: entered promiscuous mode [ 739.778440][T16892] debugfs: 'hsr0' already exists in 'hsr' [ 739.781337][T17061] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 739.785423][T16892] Cannot create hsr debugfs directory [ 739.800140][T17061] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 740.069558][T13829] hid (null): unknown global tag 0x77 [ 740.105713][T13829] hid (null): unknown global tag 0xc [ 740.119986][T13829] hid (null): invalid report_size 28520 [ 740.157227][ T981] hid-picolcd 0003:04D8:C002.0021: No report with id 0x11 found [ 740.177510][T13829] cougar 0003:060B:500A.0022: usage count exceeds max: fixing up report descriptor [ 740.304676][T13829] cougar 0003:060B:500A.0022: unexpected long global item [ 740.314311][T13829] cougar 0003:060B:500A.0022: parse failed [ 740.320579][T13829] cougar 0003:060B:500A.0022: probe with driver cougar failed with error -22 [ 740.361439][T13829] usb 2-1: USB disconnect, device number 25 [ 740.573543][ T5930] usb 5-1: USB disconnect, device number 4 [ 741.571511][T17103] netlink: 'syz.1.3048': attribute type 33 has an invalid length. [ 742.020793][T17103] (unnamed net_device) (uninitialized): option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 742.172641][T16414] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 742.254193][T17121] netlink: 200 bytes leftover after parsing attributes in process `syz.2.3053'. [ 742.294510][T17121] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3053'. [ 742.354715][T16414] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 742.372628][T16414] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 742.384590][T16414] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 742.404783][T16414] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 742.433034][T16414] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 742.445633][T16414] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 742.465376][T16414] usb 4-1: config 0 descriptor?? [ 742.502565][ T5930] usb 2-1: new full-speed USB device number 26 using dummy_hcd [ 742.576336][T16892] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 742.605373][T16892] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 742.656404][T16892] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 742.664002][T17131] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3058'. [ 742.678771][T16892] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 742.697168][ T5930] usb 2-1: unable to get BOS descriptor or descriptor too short [ 742.700077][T17131] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 742.720283][ T5930] usb 2-1: not running at top speed; connect to a high speed hub [ 742.741323][ T5930] usb 2-1: config 12 has an invalid interface number: 173 but max is 1 [ 742.759662][ T5930] usb 2-1: config 12 has an invalid interface number: 173 but max is 1 [ 742.787149][ T5930] usb 2-1: config 12 has 1 interface, different from the descriptor's value: 2 [ 742.807157][ T5930] usb 2-1: config 12 has no interface number 0 [ 742.818494][ T5930] usb 2-1: config 12 interface 173 has no altsetting 0 [ 742.829325][ T5930] usb 2-1: config 12 interface 173 has no altsetting 1 [ 742.840893][ T5930] usb 2-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice=33.b7 [ 742.862108][ T5930] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 742.887786][ T5930] usb 2-1: Product: syz [ 742.897650][ T5930] usb 2-1: Manufacturer: syz [ 742.912133][ T5930] usb 2-1: SerialNumber: syz [ 742.932930][T16414] plantronics 0003:047F:FFFF.0023: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 742.999421][T13829] usb 3-1: new full-speed USB device number 121 using dummy_hcd [ 743.002534][T16425] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 743.014877][T16892] 8021q: adding VLAN 0 to HW filter on device bond0 [ 743.072236][T16892] 8021q: adding VLAN 0 to HW filter on device team0 [ 743.099515][ T75] bridge0: port 1(bridge_slave_0) entered blocking state [ 743.106788][ T75] bridge0: port 1(bridge_slave_0) entered forwarding state [ 743.137118][ T75] bridge0: port 2(bridge_slave_1) entered blocking state [ 743.144363][ T75] bridge0: port 2(bridge_slave_1) entered forwarding state [ 743.172765][ T5930] usb 2-1: USB disconnect, device number 26 [ 743.195119][T13829] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 743.196569][T16425] usb 5-1: New USB device found, idVendor=0d81, idProduct=1900, bcdDevice=eb.c6 [ 743.231829][T16425] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 743.240217][T13829] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 743.240274][T13829] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 743.240297][T13829] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 743.289671][T13829] usb 3-1: config 0 descriptor?? [ 743.298899][T16425] usb 5-1: Product: syz [ 743.307308][T16425] usb 5-1: Manufacturer: syz [ 743.310963][T16892] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 743.331848][T16425] usb 5-1: SerialNumber: syz [ 743.345126][T13829] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 743.376441][T13829] dvb-usb: bulk message failed: -22 (3/0) [ 743.399894][T13829] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 743.421824][T16892] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 743.431258][T13829] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 743.446020][T13829] usb 3-1: media controller created [ 743.468237][T13829] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 743.509465][T13829] dvb-usb: bulk message failed: -22 (6/0) [ 743.530045][T13829] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 743.544863][T16892] veth0_vlan: entered promiscuous mode [ 743.554826][T13829] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input39 [ 743.594849][T13829] dvb-usb: schedule remote query interval to 150 msecs. [ 743.595573][T16425] pwc: Visionite VCS-UC300 USB webcam detected. [ 743.612931][T13829] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 743.630573][T16892] veth1_vlan: entered promiscuous mode [ 743.649132][T16425] pwc: Failed to set LED on/off time (-71) [ 743.661591][T16425] pwc: send_video_command error -71 [ 743.695134][T16425] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 743.713218][T16425] Philips webcam 5-1:5.0: probe with driver Philips webcam failed with error -71 [ 743.764496][T16892] veth0_macvtap: entered promiscuous mode [ 743.772735][T13829] dvb-usb: bulk message failed: -22 (1/0) [ 743.772992][T16425] usb 5-1: USB disconnect, device number 5 [ 743.786263][T13829] dvb-usb: error while querying for an remote control event. [ 743.808326][T16892] veth1_macvtap: entered promiscuous mode [ 743.925936][T16892] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 743.982497][T13829] dvb-usb: bulk message failed: -22 (1/0) [ 743.989056][T13829] dvb-usb: error while querying for an remote control event. [ 744.004796][T16892] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 744.050971][ T971] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.097048][ T971] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.131839][ T971] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.169482][ T971] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.182620][T13829] dvb-usb: bulk message failed: -22 (1/0) [ 744.189760][T13829] dvb-usb: error while querying for an remote control event. [ 744.365739][ T5951] usb 3-1: USB disconnect, device number 121 [ 744.420780][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 744.458373][ T5951] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 744.471791][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 744.572169][ T75] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 744.607530][ T75] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 744.633949][T17175] loop2: detected capacity change from 0 to 7 [ 744.652006][T17175] Dev loop2: unable to read RDB block 7 [ 744.670477][T17175] loop2: unable to read partition table [ 744.686874][T17175] loop2: partition table beyond EOD, truncated [ 744.700403][T17175] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 744.855809][T17178] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3005'. [ 745.038074][ T5930] usb 4-1: USB disconnect, device number 49 [ 747.378919][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.386983][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.932644][T12303] Bluetooth: hci0: command 0x0405 tx timeout [ 748.041956][T17225] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 748.052608][T17225] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 748.067298][T17200] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 748.091923][T17200] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 748.120577][T17200] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 748.138037][T17200] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 748.146430][T17200] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 748.170829][T17200] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 748.235151][T17200] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 748.251530][T17200] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 748.289757][T17200] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 748.413915][T12303] Bluetooth: hci5: command 0x0c1a tx timeout [ 748.421626][T12303] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 748.434653][T12303] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 748.443691][T12303] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 748.455988][T12303] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 748.531913][T12303] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 748.642591][T16414] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 748.742566][ T981] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 748.786099][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 748.798360][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.838348][T16414] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD6, changing to 0x86 [ 748.855810][T16414] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 748.876974][T16414] usb 2-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24 [ 748.887784][T16414] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 748.902458][ T981] usb 1-1: Using ep0 maxpacket: 8 [ 749.388443][T16414] usb 2-1: Product: syz [ 749.417368][ T981] usb 1-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice=d0.ab [ 749.429179][ T981] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 749.438372][ T981] usb 1-1: Product: syz [ 749.442588][ T981] usb 1-1: Manufacturer: syz [ 749.447182][ T981] usb 1-1: SerialNumber: syz [ 749.455607][ T981] usb 1-1: config 0 descriptor?? [ 749.458877][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 749.478687][T16414] usb 2-1: Manufacturer: syz [ 749.488257][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 749.494154][T16414] usb 2-1: SerialNumber: syz [ 749.516930][T16414] usb 2-1: config 0 descriptor?? [ 749.530814][T16414] usb 2-1: can't set config #0, error -71 [ 749.541540][T16414] usb 2-1: USB disconnect, device number 27 [ 749.578799][T17247] tipc: Started in network mode [ 749.590232][T17247] tipc: Node identity 0ed4802f546b, cluster identity 4711 [ 749.602051][T17247] tipc: Enabled bearer , priority 0 [ 749.617822][T17247] syzkaller0: entered promiscuous mode [ 749.625351][T17247] syzkaller0: entered allmulticast mode [ 749.656677][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 749.672429][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 749.712481][ T5966] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 749.905578][T17258] netlink: 'syz.3.3082': attribute type 49 has an invalid length. [ 749.925247][ T5966] usb 3-1: config 0 has no interfaces? [ 749.936097][ T5966] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 749.947472][ T5966] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.976870][ T5966] usb 3-1: Product: syz [ 749.981203][ T5966] usb 3-1: Manufacturer: syz [ 749.981223][ T5966] usb 3-1: SerialNumber: syz [ 749.986818][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 749.986853][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.018620][ T5966] usb 3-1: config 0 descriptor?? [ 750.027004][ T981] usb 1-1: USB disconnect, device number 8 [ 750.172137][ C0] vkms_vblank_simulate: vblank timer overrun [ 750.173569][T12303] Bluetooth: hci1: command 0x0c1a tx timeout [ 750.183737][T17248] tipc: Resetting bearer [ 750.219512][T17248] tipc: Disabling bearer [ 750.235185][ T5965] udevd[5965]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 750.254425][T12303] Bluetooth: hci0: command 0x0405 tx timeout [ 750.496387][T12303] Bluetooth: hci5: command 0x0c1a tx timeout [ 750.517013][T17236] chnl_net:caif_netlink_parms(): no params data found [ 750.577388][T12303] Bluetooth: hci2: command tx timeout [ 750.652727][ T5966] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 750.833631][ T5966] usb 2-1: Using ep0 maxpacket: 16 [ 750.854495][ T5966] usb 2-1: config 0 has no interfaces? [ 750.869922][ T5966] usb 2-1: New USB device found, idVendor=0458, idProduct=704a, bcdDevice=3a.55 [ 750.896874][ T5966] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 750.983670][ T5966] usb 2-1: Product: syz [ 750.990246][ T5966] usb 2-1: Manufacturer: syz [ 751.000050][ T5966] usb 2-1: SerialNumber: syz [ 751.019411][ T5966] usb 2-1: config 0 descriptor?? [ 751.762758][ T5930] usb 3-1: USB disconnect, device number 122 [ 752.252795][T12303] Bluetooth: hci1: command 0x0c1a tx timeout [ 752.332998][T12303] Bluetooth: hci0: command 0x0405 tx timeout [ 752.341220][ T5930] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 752.495555][ T5951] usb 1-1: new low-speed USB device number 9 using dummy_hcd [ 752.565843][ T5930] usb 3-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 752.584030][T12303] Bluetooth: hci5: command 0x0c1a tx timeout [ 752.598551][ T5930] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 752.609159][ T5930] usb 3-1: Product: syz [ 752.613630][ T5930] usb 3-1: Manufacturer: syz [ 752.622410][ T5930] usb 3-1: SerialNumber: syz [ 752.649135][ T5930] usb 3-1: config 0 descriptor?? [ 752.657287][T12303] Bluetooth: hci2: command tx timeout [ 752.664939][ T5951] usb 1-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 752.676619][ T5951] usb 1-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 512, setting to 8 [ 752.687538][ T5951] usb 1-1: config 0 interface 0 has no altsetting 0 [ 752.694264][ T5951] usb 1-1: New USB device found, idVendor=045e, idProduct=00dc, bcdDevice= 0.00 [ 752.704335][ T5951] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 752.719608][ T5930] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 752.729847][ T12] bond0 (unregistering): (slave bond3): Releasing backup interface [ 752.742016][ T5951] usb 1-1: config 0 descriptor?? [ 752.748801][T17305] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 752.782642][ T12] bond0 (unregistering): Released all slaves [ 752.824163][ T12] bond1 (unregistering): Released all slaves [ 752.859332][ T12] bond2 (unregistering): Released all slaves [ 753.009509][ T5951] usbhid 1-1:0.0: can't add hid device: -71 [ 753.016163][ T5951] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 753.041386][ T5951] usb 1-1: USB disconnect, device number 9 [ 753.367031][ T12] bond3 (unregistering): Released all slaves [ 753.569095][ T12] IPVS: stopping master sync thread 8119 ... [ 753.602184][ T5966] usb 2-1: USB disconnect, device number 28 [ 754.000906][T17316] batman_adv: batadv0: Adding interface: dummy0 [ 754.009413][T17316] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 754.041383][T17316] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 754.063529][T17320] macvlan2: entered promiscuous mode [ 754.069176][T17320] macvlan2: entered allmulticast mode [ 754.128716][T17236] bridge0: port 1(bridge_slave_0) entered blocking state [ 754.137217][T17236] bridge0: port 1(bridge_slave_0) entered disabled state [ 754.159686][T17236] bridge_slave_0: entered allmulticast mode [ 754.179471][T17236] bridge_slave_0: entered promiscuous mode [ 754.222625][T17236] bridge0: port 2(bridge_slave_1) entered blocking state [ 754.254895][T17236] bridge0: port 2(bridge_slave_1) entered disabled state [ 754.278550][T17236] bridge_slave_1: entered allmulticast mode [ 754.314011][T17236] bridge_slave_1: entered promiscuous mode [ 754.332876][T12303] Bluetooth: hci1: command 0x0c1a tx timeout [ 754.414185][T12303] Bluetooth: hci0: command 0x0405 tx timeout [ 754.518162][T17236] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 754.645757][ T12] hsr_slave_0: left promiscuous mode [ 754.674538][ T12] hsr_slave_1: left promiscuous mode [ 754.721590][T17339] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3097'. [ 754.738086][T12303] Bluetooth: hci2: command tx timeout [ 754.744958][T17339] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3097'. [ 754.780595][ T12] veth1_macvtap: left promiscuous mode [ 754.787021][ T12] veth0_macvtap: left promiscuous mode [ 754.802425][ T5930] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 754.962442][ T981] usb 3-1: USB disconnect, device number 123 [ 755.003789][ T5930] usb 2-1: Using ep0 maxpacket: 8 [ 755.056451][ T5930] usb 2-1: unable to get BOS descriptor or descriptor too short [ 755.074473][ T5930] usb 2-1: too many configurations: 137, using maximum allowed: 8 [ 755.097379][ T5930] usb 2-1: config 127 has an invalid interface number: 181 but max is 0 [ 755.111953][ T5930] usb 2-1: config 127 has no interface number 0 [ 755.152748][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0xC has invalid maxpacket 64 [ 755.196890][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0x6 has invalid maxpacket 64 [ 755.223622][ T5930] usb 2-1: config 127 interface 181 has no altsetting 0 [ 755.253297][ T5930] usb 2-1: config 127 has an invalid interface number: 181 but max is 0 [ 755.271143][ T5930] usb 2-1: config 127 has no interface number 0 [ 755.295553][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0xC has invalid maxpacket 64 [ 755.338015][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0x6 has invalid maxpacket 64 [ 755.372463][ T981] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 755.388088][ T5930] usb 2-1: config 127 interface 181 has no altsetting 0 [ 755.408048][ T5930] usb 2-1: config 127 has an invalid interface number: 181 but max is 0 [ 755.433881][ T5930] usb 2-1: config 127 has no interface number 0 [ 755.440297][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0xC has invalid maxpacket 64 [ 755.451006][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0x6 has invalid maxpacket 64 [ 755.468259][ T5930] usb 2-1: config 127 interface 181 has no altsetting 0 [ 755.496579][ T5966] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 755.504780][ T5930] usb 2-1: config 127 has an invalid interface number: 181 but max is 0 [ 755.517020][ T5930] usb 2-1: config 127 has no interface number 0 [ 755.525000][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0xC has invalid maxpacket 64 [ 755.535929][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0x6 has invalid maxpacket 64 [ 755.547147][ T981] usb 3-1: Using ep0 maxpacket: 8 [ 755.552727][ T5930] usb 2-1: config 127 interface 181 has no altsetting 0 [ 755.570138][ T981] usb 3-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 755.581280][ T5930] usb 2-1: config 127 has an invalid interface number: 181 but max is 0 [ 755.590211][ T981] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 755.611234][ T5930] usb 2-1: config 127 has no interface number 0 [ 755.621316][ T981] usb 3-1: Product: syz [ 755.629939][ T981] usb 3-1: Manufacturer: syz [ 755.634828][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0xC has invalid maxpacket 64 [ 755.645692][ T981] usb 3-1: SerialNumber: syz [ 755.660505][ T981] usb 3-1: config 0 descriptor?? [ 755.667545][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0x6 has invalid maxpacket 64 [ 755.690112][ T5966] usb 4-1: Using ep0 maxpacket: 16 [ 755.698209][T17365] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3102'. [ 755.720025][ T5930] usb 2-1: config 127 interface 181 has no altsetting 0 [ 755.730025][ T981] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 755.738849][ T5966] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 755.740149][ T5930] usb 2-1: config 127 has an invalid interface number: 181 but max is 0 [ 755.766953][ T5966] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 8 [ 755.791784][ T5966] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 755.809465][ T5966] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 755.821553][ T5966] usb 4-1: config 1 interface 2 altsetting 1 has an endpoint descriptor with address 0x1A, changing to 0xA [ 755.833072][ T5930] usb 2-1: config 127 has no interface number 0 [ 755.833150][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0xC has invalid maxpacket 64 [ 755.833175][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0x6 has invalid maxpacket 64 [ 755.833198][ T5930] usb 2-1: config 127 interface 181 has no altsetting 0 [ 755.843203][ T5930] usb 2-1: config 127 has an invalid interface number: 181 but max is 0 [ 755.861090][ T5966] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0xA has invalid maxpacket 239, setting to 64 [ 755.889416][ T5930] usb 2-1: config 127 has no interface number 0 [ 755.905850][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0xC has invalid maxpacket 64 [ 755.920396][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0x6 has invalid maxpacket 64 [ 755.923811][ T5966] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 755.933053][ T5930] usb 2-1: config 127 interface 181 has no altsetting 0 [ 755.955885][ T5966] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 755.962669][ T5930] usb 2-1: config 127 has an invalid interface number: 181 but max is 0 [ 755.964374][ T5966] usb 4-1: Product: syz [ 755.977218][ T5966] usb 4-1: Manufacturer: syz [ 755.981854][ T5966] usb 4-1: SerialNumber: syz [ 755.983980][ T5930] usb 2-1: config 127 has no interface number 0 [ 756.010885][T17347] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3099'. [ 756.022576][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0xC has invalid maxpacket 64 [ 756.035515][ T5930] usb 2-1: config 127 interface 181 altsetting 249 bulk endpoint 0x6 has invalid maxpacket 64 [ 756.040431][T17347] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 756.063708][T17347] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 756.066794][ T5930] usb 2-1: config 127 interface 181 has no altsetting 0 [ 756.087792][T17347] input: syz1 as /devices/virtual/input/input40 [ 756.113645][ T5930] usb 2-1: New USB device found, idVendor=0bfd, idProduct=5e5e, bcdDevice=a8.e2 [ 756.136842][ T5930] usb 2-1: New USB device strings: Mfr=136, Product=66, SerialNumber=70 [ 756.147527][ T5930] usb 2-1: Product: syz [ 756.152020][ T5930] usb 2-1: Manufacturer: syz [ 756.157311][ T5930] usb 2-1: SerialNumber: syz [ 756.208801][T17335] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 756.222729][T17335] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 756.243118][ T981] gspca_sonixj: reg_w1 err -110 [ 756.248293][ T981] sonixj 3-1:0.0: probe with driver sonixj failed with error -110 [ 756.318236][T17367] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=640 (1280 ns) > initial count (640 ns). Using initial count to start timer. [ 756.468496][ T5930] usb 2-1: USB disconnect, device number 29 [ 756.511754][T16414] usb 3-1: USB disconnect, device number 124 [ 756.813521][T12303] Bluetooth: hci2: command tx timeout [ 757.512019][T17236] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 757.742464][ T5504] usb 3-1: new high-speed USB device number 125 using dummy_hcd [ 757.773562][T17236] team0: Port device team_slave_0 added [ 757.815033][T17236] team0: Port device team_slave_1 added [ 757.836243][ T5966] usb 4-1: USB disconnect, device number 50 [ 757.916774][ T5965] udevd[5965]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 757.946810][ T5504] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 758.000129][ T5504] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 758.028202][ T5504] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 758.045151][T17236] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 758.066387][T17236] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 758.095090][ T5504] usb 3-1: config 1 interface 1 altsetting 157 has 0 endpoint descriptors, different from the interface descriptor's value: 8 [ 758.109361][ T5504] usb 3-1: config 1 interface 1 has no altsetting 0 [ 758.118101][T17236] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 758.168708][ T5504] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 758.183752][ T5504] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 758.192454][ T5504] usb 3-1: Product: syz [ 758.199377][T17236] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 758.210321][ T5504] usb 3-1: Manufacturer: syz [ 758.222614][ T5504] usb 3-1: SerialNumber: syz [ 758.228886][T17236] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 758.262934][T17236] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 758.287838][ T5504] usb 3-1: selecting invalid altsetting 0 [ 758.306031][ T5504] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 758.352760][ T5504] usb 3-1: selecting invalid altsetting 0 [ 758.358556][ T5504] usbtest 3-1:1.1: probe with driver usbtest failed with error -22 [ 758.502498][ T5951] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 758.659663][ T5951] usb 1-1: device descriptor read/64, error -71 [ 758.683581][T17236] hsr_slave_0: entered promiscuous mode [ 758.918840][T17236] hsr_slave_1: entered promiscuous mode [ 758.955233][ T5951] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 758.970143][ T981] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 759.225547][T17236] debugfs: 'hsr0' already exists in 'hsr' [ 759.231631][T17236] Cannot create hsr debugfs directory [ 759.262487][ T5951] usb 1-1: device descriptor read/64, error -71 [ 759.278616][ T12] IPVS: stop unused estimator thread 0... [ 759.382087][ T5951] usb usb1-port1: attempt power cycle [ 759.401978][ T981] usb 2-1: unable to get BOS descriptor or descriptor too short [ 759.490371][ T981] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 759.500190][ T981] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 759.540516][ T981] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 759.598447][ T981] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 759.637870][ T981] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 759.666048][ T981] usb 2-1: Product: syz [ 759.684034][ T981] usb 2-1: Manufacturer: syz [ 759.690580][ T981] usb 2-1: SerialNumber: syz [ 759.752503][ T5951] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 759.782481][T13829] usb 3-1: USB disconnect, device number 125 [ 759.799096][ T5951] usb 1-1: device descriptor read/8, error -71 [ 760.020858][T17415] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2856151591 (22849212728 ns) > initial count (5743301600 ns). Using initial count to start timer. [ 760.054093][ T5951] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 760.096984][T17393] kvm: Disabled LAPIC found during irq injection [ 760.111840][ T5951] usb 1-1: device descriptor read/8, error -71 [ 760.275863][T13829] usb 3-1: new high-speed USB device number 126 using dummy_hcd [ 760.284866][ T5951] usb usb1-port1: unable to enumerate USB device [ 760.452760][T13829] usb 3-1: Using ep0 maxpacket: 32 [ 760.471042][T13829] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 760.488837][T13829] usb 3-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 760.502147][T13829] usb 3-1: config 0 interface 0 has no altsetting 0 [ 760.527937][T13829] usb 3-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 760.539945][T13829] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 760.552439][T13829] usb 3-1: config 0 descriptor?? [ 760.611050][T17427] hsr0: entered promiscuous mode [ 760.616452][T17427] macvlan2: entered allmulticast mode [ 760.622016][T17427] hsr0: entered allmulticast mode [ 760.627264][T17427] hsr_slave_0: entered allmulticast mode [ 760.638255][T17427] hsr_slave_1: entered allmulticast mode [ 760.651069][T17427] hsr0: left allmulticast mode [ 760.656253][T17427] hsr_slave_0: left allmulticast mode [ 760.661801][T17427] hsr_slave_1: left allmulticast mode [ 760.983241][T13829] corsair-cpro 0003:1B1C:0C10.0024: hidraw0: USB HID v0.00 Device [HID 1b1c:0c10] on usb-dummy_hcd.2-1/input0 [ 761.078164][T13829] corsair-cpro 0003:1B1C:0C10.0024: probe with driver corsair-cpro failed with error -38 [ 761.188183][T17412] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 761.215036][T17412] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 761.274062][T17236] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 761.285748][ T5504] usb 3-1: USB disconnect, device number 126 [ 761.374005][T17236] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 761.380253][T17429] fido_id[17429]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 761.414564][T17236] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 761.461099][T17236] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 761.534503][ T981] usb 2-1: 0:2 : does not exist [ 761.592606][ T5951] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 761.608423][ T981] usb 2-1: USB disconnect, device number 30 [ 761.777541][ T5951] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 761.798817][ T5951] usb 1-1: config 0 interface 0 has no altsetting 0 [ 761.823487][ T5951] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 761.840554][ T5951] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 761.868828][ T5951] usb 1-1: Product: syz [ 761.884611][ T5951] usb 1-1: Manufacturer: syz [ 761.895319][ T5951] usb 1-1: SerialNumber: syz [ 761.933838][ T5951] usb 1-1: config 0 descriptor?? [ 761.942102][T17236] 8021q: adding VLAN 0 to HW filter on device bond0 [ 762.010509][ T5951] usb 1-1: selecting invalid altsetting 0 [ 762.077193][T17236] 8021q: adding VLAN 0 to HW filter on device team0 [ 762.138492][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 762.145904][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 762.297567][ T9180] bridge0: port 2(bridge_slave_1) entered blocking state [ 762.305020][ T9180] bridge0: port 2(bridge_slave_1) entered forwarding state [ 762.526360][T17461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 762.536130][T17461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 762.558709][T17461] netlink: 'syz.0.3113': attribute type 1 has an invalid length. [ 762.723703][T13829] usb 3-1: new high-speed USB device number 127 using dummy_hcd [ 762.982458][T13829] usb 3-1: Using ep0 maxpacket: 8 [ 763.047662][T17236] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 763.086566][T13829] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 763.240929][T13829] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 57300, setting to 1024 [ 763.285265][T17236] veth0_vlan: entered promiscuous mode [ 763.330064][T13829] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 763.376229][T17236] veth1_vlan: entered promiscuous mode [ 763.461096][T13829] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 763.532164][T13829] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 763.562738][T16414] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 763.575050][T13829] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 763.588002][T17236] veth0_macvtap: entered promiscuous mode [ 763.599055][T13829] usb 3-1: Product: syz [ 763.610123][T13829] usb 3-1: Manufacturer: syz [ 763.637619][T13829] usb 3-1: SerialNumber: syz [ 763.645626][T17236] veth1_macvtap: entered promiscuous mode [ 763.672850][T17453] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 763.681475][T17453] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 763.729132][T17236] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 763.768066][T16414] usb 4-1: config 0 has an invalid interface number: 101 but max is 0 [ 763.846352][T16414] usb 4-1: config 0 has no interface number 0 [ 763.909973][T17453] loop2: detected capacity change from 0 to 7 [ 764.047346][T13829] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 764.077808][T13829] usbtest 3-1:1.0: Linux user mode ISO test driver [ 764.090465][T16414] usb 4-1: New USB device found, idVendor=093a, idProduct=2623, bcdDevice=b2.14 [ 764.098314][T13829] usbtest 3-1:1.0: high-speed {control bulk-in bulk-out} tests (+alt) [ 764.143075][T16414] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.168397][T16414] usb 4-1: Product: syz [ 764.175230][T16414] usb 4-1: Manufacturer: syz [ 764.192138][T16414] usb 4-1: SerialNumber: syz [ 764.218827][T16414] usb 4-1: config 0 descriptor?? [ 764.255366][T13829] usb 3-1: USB disconnect, device number 127 [ 764.267831][T16414] gspca_main: gspca_pac7302-2.14.0 probing 093a:2623 [ 765.012804][T16414] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 765.039724][T16414] gspca_pac7302 4-1:0.101: probe with driver gspca_pac7302 failed with error -110 [ 765.296038][T17236] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 765.357846][ T9180] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 766.003654][ T9180] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 766.058880][ T9180] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 766.145628][ T9180] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 766.343112][ T1175] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 766.350937][ T1175] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 766.447492][ T971] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 766.490554][ T971] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 766.493568][T17488] netlink: 1 bytes leftover after parsing attributes in process `syz.1.3119'. [ 766.573233][T17488] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3119'. [ 766.602727][T17488] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3119'. [ 766.611796][T17488] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3119'. [ 766.696785][ T5504] usb 4-1: USB disconnect, device number 51 [ 766.759952][T16414] usb 1-1: USB disconnect, device number 14 [ 766.886975][ T5966] IPVS: starting estimator thread 0... [ 766.995710][T17498] IPVS: using max 29 ests per chain, 69600 per kthread [ 767.022875][ T981] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 767.212624][ T5504] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 767.366199][ T981] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 767.428612][ T981] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 767.438281][ T981] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 767.527912][ T981] usb 5-1: config 0 descriptor?? [ 767.541663][ T981] pwc: Askey VC010 type 2 USB webcam detected. [ 767.543605][ T5504] usb 4-1: Using ep0 maxpacket: 8 [ 767.665194][ T5504] usb 4-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 767.695210][ T5504] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 767.756454][ T981] pwc: recv_control_msg error -32 req 02 val 2b00 [ 767.766367][ T981] pwc: recv_control_msg error -32 req 02 val 2700 [ 767.777131][ T5504] usb 4-1: Product: syz [ 767.789132][ T981] pwc: recv_control_msg error -32 req 02 val 2c00 [ 767.807715][ T5504] usb 4-1: Manufacturer: syz [ 767.807756][ T981] pwc: recv_control_msg error -32 req 04 val 1000 [ 767.836199][ T5504] usb 4-1: SerialNumber: syz [ 767.870018][ T5504] usb 4-1: config 0 descriptor?? [ 767.873703][ T981] pwc: recv_control_msg error -32 req 04 val 1300 [ 767.907053][ T5504] gspca_main: se401-2.14.0 probing 047d:5003 [ 768.123033][ T981] pwc: recv_control_msg error -32 req 04 val 1400 [ 768.142444][ T981] pwc: recv_control_msg error -32 req 02 val 2000 [ 768.167984][ T981] pwc: recv_control_msg error -32 req 02 val 2100 [ 768.205619][ T981] pwc: recv_control_msg error -32 req 04 val 1500 [ 768.238723][ T981] pwc: recv_control_msg error -32 req 02 val 2500 [ 768.258856][ T981] pwc: recv_control_msg error -32 req 02 val 2400 [ 768.271789][T17493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 768.283765][T17493] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 768.298689][ T981] pwc: recv_control_msg error -32 req 02 val 2600 [ 768.329388][ T981] pwc: recv_control_msg error -32 req 02 val 2900 [ 768.338764][T17494] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 768.344802][ T981] pwc: recv_control_msg error -32 req 02 val 2800 [ 768.411763][T17494] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 768.431610][ T981] pwc: Registered as video103. [ 768.529588][ T981] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input41 [ 768.584173][ T981] usb 5-1: USB disconnect, device number 6 [ 768.724420][ T5504] input: se401 as /devices/platform/dummy_hcd.3/usb4/4-1/input/input42 [ 769.119224][ T5504] usb 4-1: USB disconnect, device number 52 [ 769.502456][T16414] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 769.712937][ T5966] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 769.747990][T16414] usb 3-1: config 0 has an invalid interface number: 101 but max is 0 [ 769.834481][T16414] usb 3-1: config 0 has no interface number 0 [ 769.860873][T16414] usb 3-1: New USB device found, idVendor=093a, idProduct=2623, bcdDevice=b2.14 [ 769.879585][T16414] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 769.903501][T16414] usb 3-1: Product: syz [ 769.920297][T16414] usb 3-1: Manufacturer: syz [ 769.934949][T16414] usb 3-1: SerialNumber: syz [ 769.964492][ T5966] usb 1-1: config 0 has no interfaces? [ 769.977726][T16414] usb 3-1: config 0 descriptor?? [ 769.996131][ T5966] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 770.025694][T16414] gspca_main: gspca_pac7302-2.14.0 probing 093a:2623 [ 770.035404][ T5966] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.064170][ T5966] usb 1-1: Product: syz [ 770.077423][ T5966] usb 1-1: Manufacturer: syz [ 770.082150][ T5966] usb 1-1: SerialNumber: syz [ 770.108804][ T5966] usb 1-1: config 0 descriptor?? [ 770.132669][ T5952] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 770.387337][ T5952] usb 4-1: Using ep0 maxpacket: 8 [ 770.408218][ T5952] usb 4-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 770.429196][ T5952] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.477990][ T5952] usb 4-1: Product: syz [ 770.505531][ T5952] usb 4-1: Manufacturer: syz [ 770.522000][ T5952] usb 4-1: SerialNumber: syz [ 770.556772][ T5952] usb 4-1: config 0 descriptor?? [ 770.562740][T16414] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 770.590490][ T5952] gspca_main: se401-2.14.0 probing 047d:5003 [ 770.608130][T16414] gspca_pac7302 3-1:0.101: probe with driver gspca_pac7302 failed with error -110 [ 771.472534][T16414] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 771.510651][ T30] audit: type=1326 audit(1754527003.250:434): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17607 comm="syz.4.3142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f798c58ebe9 code=0x7ffc0000 [ 771.688300][T17611] fuse: Bad value for 'rootmode' [ 771.732413][T16414] usb 2-1: Using ep0 maxpacket: 8 [ 771.752653][T16414] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 771.763418][ T30] audit: type=1326 audit(1754527003.250:435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17607 comm="syz.4.3142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=152 compat=0 ip=0x7f798c58ebe9 code=0x7ffc0000 [ 771.814448][T16414] usb 2-1: config 179 has no interface number 0 [ 771.840782][T16414] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 771.874997][ T5952] usb 4-1: reset high-speed USB device number 53 using dummy_hcd [ 771.898973][ T30] audit: type=1326 audit(1754527003.250:436): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17607 comm="syz.4.3142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f798c58ebe9 code=0x7ffc0000 [ 771.929341][T16414] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 772.052897][T16414] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 772.092629][ T5952] usb 4-1: device descriptor read/64, error -32 [ 772.120117][ T30] audit: type=1326 audit(1754527003.250:437): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17607 comm="syz.4.3142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f798c58ebe9 code=0x7ffc0000 [ 772.149071][T16414] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 772.212596][T16414] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 772.397363][ T30] audit: type=1326 audit(1754527003.290:438): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17607 comm="syz.4.3142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f798c58ebe9 code=0x7ffc0000 [ 772.432431][ T981] usb 1-1: USB disconnect, device number 15 [ 772.452656][ T5952] usb 4-1: reset high-speed USB device number 53 using dummy_hcd [ 772.812711][ T30] audit: type=1326 audit(1754527003.290:439): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17607 comm="syz.4.3142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f798c58ebe9 code=0x7ffc0000 [ 772.819085][T16414] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 772.853838][ T5952] usb 4-1: device descriptor read/64, error -32 [ 772.874523][T16414] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 772.936810][T17600] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 772.945237][ T30] audit: type=1326 audit(1754527003.290:440): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17607 comm="syz.4.3142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f798c58ebe9 code=0x7ffc0000 [ 772.976100][ T5504] usb 3-1: USB disconnect, device number 2 [ 773.057678][ T30] audit: type=1326 audit(1754527003.290:441): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17607 comm="syz.4.3142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f798c58ebe9 code=0x7ffc0000 [ 773.080514][ T30] audit: type=1326 audit(1754527003.290:442): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17607 comm="syz.4.3142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f798c58ebe9 code=0x7ffc0000 [ 773.103766][ T30] audit: type=1326 audit(1754527003.290:443): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17607 comm="syz.4.3142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f798c58ebe9 code=0x7ffc0000 [ 773.162552][ T5952] usb 4-1: reset high-speed USB device number 53 using dummy_hcd [ 773.245206][ T5952] usb 4-1: device descriptor read/8, error -32 [ 773.319438][T16414] usb 2-1: USB disconnect, device number 31 [ 773.325472][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 773.325524][ C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 773.513695][ T5952] usb 4-1: reset high-speed USB device number 53 using dummy_hcd [ 773.576006][ T5952] usb 4-1: device descriptor read/8, error -32 [ 773.629512][T17633] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 773.636431][ T5966] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 773.713741][ T5952] raw-gadget.2 gadget.3: failed to queue suspend event [ 773.764214][ T5952] gspca_se401: read req failed req 0x06 error -19 [ 773.799327][ T5952] usb 4-1: USB disconnect, device number 53 [ 773.814626][ T5966] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 773.856939][ T5966] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 773.881779][ T5952] raw-gadget.2 gadget.3: failed to queue reset event [ 773.922180][ T5966] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 773.972474][ T5966] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 773.990600][ T5966] usb 3-1: config 0 descriptor?? [ 773.993074][ T5952] raw-gadget.2 gadget.3: failed to queue resume event [ 774.003808][T17626] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 774.172668][ T5952] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 774.180539][ C0] raw-gadget.2 gadget.3: ignoring, device is not running [ 774.232525][ T5952] raw-gadget.2 gadget.3: failed to queue reset event [ 774.402667][ T5952] raw-gadget.2 gadget.3: failed to queue resume event [ 774.471079][T17609] raw-gadget.2 gadget.3: failed to queue suspend event [ 774.522789][ T5952] usb 4-1: device descriptor read/64, error -32 [ 774.583657][T17609] raw-gadget.2 gadget.3: failed to queue disconnect event [ 774.731636][T17660] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3152'. [ 775.752564][T16414] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 775.803389][T17669] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3154'. [ 775.945454][T16414] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 775.972908][T16414] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 776.036268][T16414] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 776.047114][T16414] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 776.061776][T16414] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 776.153625][T16414] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 776.165715][T16414] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 776.175587][T16414] usb 2-1: Product: syz [ 776.179948][T16414] usb 2-1: Manufacturer: syz [ 776.200250][T16414] cdc_wdm 2-1:1.0: skipping garbage [ 776.209639][T16414] cdc_wdm 2-1:1.0: skipping garbage [ 776.234747][T16414] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 776.241966][T16414] cdc_wdm 2-1:1.0: Unknown control protocol [ 776.406714][T16414] usb 2-1: USB disconnect, device number 32 [ 776.684667][ T5966] usbhid 3-1:0.0: can't add hid device: -71 [ 776.698698][ T5966] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 776.736201][ T5966] usb 3-1: USB disconnect, device number 3 [ 776.931466][T17676] FAULT_INJECTION: forcing a failure. [ 776.931466][T17676] name failslab, interval 1, probability 0, space 0, times 0 [ 776.981064][T17676] CPU: 0 UID: 0 PID: 17676 Comm: syz.2.3157 Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 PREEMPT(full) [ 776.981094][T17676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 776.981107][T17676] Call Trace: [ 776.981115][T17676] [ 776.981125][T17676] dump_stack_lvl+0x189/0x250 [ 776.981152][T17676] ? __pfx____ratelimit+0x10/0x10 [ 776.981174][T17676] ? __pfx_dump_stack_lvl+0x10/0x10 [ 776.981196][T17676] ? __pfx__printk+0x10/0x10 [ 776.981226][T17676] ? __pfx___might_resched+0x10/0x10 [ 776.981243][T17676] ? fs_reclaim_acquire+0x7d/0x100 [ 776.981274][T17676] should_fail_ex+0x414/0x560 [ 776.981300][T17676] should_failslab+0xa8/0x100 [ 776.981327][T17676] __kmalloc_noprof+0xcb/0x4f0 [ 776.981349][T17676] ? kfree+0x4d/0x440 [ 776.981367][T17676] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 776.981398][T17676] tomoyo_realpath_from_path+0xe3/0x5d0 [ 776.981424][T17676] ? tomoyo_domain+0xd9/0x130 [ 776.981455][T17676] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 776.981476][T17676] tomoyo_path_number_perm+0x1e8/0x5a0 [ 776.981501][T17676] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 776.981540][T17676] ? __lock_acquire+0xab9/0xd20 [ 776.981584][T17676] ? __fget_files+0x2a/0x420 [ 776.981612][T17676] ? __fget_files+0x2a/0x420 [ 776.981645][T17676] ? __fget_files+0x3a0/0x420 [ 776.981668][T17676] ? __fget_files+0x2a/0x420 [ 776.981696][T17676] security_file_ioctl+0xcb/0x2d0 [ 776.981719][T17676] __se_sys_ioctl+0x47/0x170 [ 776.981745][T17676] do_syscall_64+0xfa/0x3b0 [ 776.981765][T17676] ? lockdep_hardirqs_on+0x9c/0x150 [ 776.981786][T17676] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 776.981804][T17676] ? clear_bhb_loop+0x60/0xb0 [ 776.981826][T17676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 776.981845][T17676] RIP: 0033:0x7f642198ebe9 [ 776.981862][T17676] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 776.981878][T17676] RSP: 002b:00007f642272d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 776.981898][T17676] RAX: ffffffffffffffda RBX: 00007f6421bb5fa0 RCX: 00007f642198ebe9 [ 776.981912][T17676] RDX: 0000200000000000 RSI: 0000000000005393 RDI: 0000000000000007 [ 776.981924][T17676] RBP: 00007f642272d090 R08: 0000000000000000 R09: 0000000000000000 [ 776.981936][T17676] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 776.981947][T17676] R13: 00007f6421bb6038 R14: 00007f6421bb5fa0 R15: 00007f6421cdfa28 [ 776.981978][T17676] [ 776.981987][T17676] ERROR: Out of memory at tomoyo_realpath_from_path. [ 777.334328][T17688] loop2: detected capacity change from 0 to 7 [ 777.366141][T17688] Dev loop2: unable to read RDB block 7 [ 777.371758][T17688] loop2: unable to read partition table [ 777.415570][T17688] loop2: partition table beyond EOD, truncated [ 777.460491][T17688] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 777.527236][ T5232] Dev loop2: unable to read RDB block 7 [ 777.562877][ T5232] loop2: unable to read partition table [ 777.570357][ T5232] loop2: partition table beyond EOD, truncated [ 777.854257][T17702] input: syz0 as /devices/virtual/input/input43 [ 778.352608][ T5966] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 778.662457][ T5966] usb 3-1: Using ep0 maxpacket: 8 [ 778.686224][ T5966] usb 3-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 778.715882][ T5966] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 778.772430][ T5966] usb 3-1: Product: syz [ 778.802485][ T5966] usb 3-1: Manufacturer: syz [ 778.807135][ T5966] usb 3-1: SerialNumber: syz [ 778.886734][ T5966] usb 3-1: config 0 descriptor?? [ 778.914976][ T5966] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 779.506749][ T5966] gspca_sonixj: reg_r err -71 [ 779.512745][ T5966] sonixj 3-1:0.0: probe with driver sonixj failed with error -71 [ 779.555470][ T5966] usb 3-1: USB disconnect, device number 4 [ 779.982543][ T5966] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 780.008582][T17728] netlink: 27 bytes leftover after parsing attributes in process `syz.4.3169'. [ 780.021314][T17730] netlink: 27 bytes leftover after parsing attributes in process `syz.4.3169'. [ 780.096885][ T981] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 780.139326][T17728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 780.149511][ T5966] usb 3-1: Using ep0 maxpacket: 16 [ 780.164543][ T5966] usb 3-1: config index 0 descriptor too short (expected 4795, got 18) [ 780.173626][ T5966] usb 3-1: config 1 descriptor has 1 excess byte, ignoring [ 780.180864][ T5966] usb 3-1: config 1 has no interfaces? [ 780.192819][T17728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 780.215900][ T5966] usb 3-1: New USB device found, idVendor=0403, idProduct=b8d8, bcdDevice=30.bb [ 780.225259][ T5966] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.242715][ T5966] usb 3-1: Product: syz [ 780.247048][ T5966] usb 3-1: Manufacturer: syz [ 780.251657][ T5966] usb 3-1: SerialNumber: syz [ 780.266499][ T981] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 780.300481][ T981] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 780.321128][ T981] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 780.346691][ T981] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 780.362662][ T981] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 780.382639][T16414] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 780.385136][ T981] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 780.412422][ T981] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 780.420454][ T981] usb 2-1: Product: syz [ 780.442531][ T981] usb 2-1: Manufacturer: syz [ 780.457895][ T981] cdc_wdm 2-1:1.0: skipping garbage [ 780.467626][T17722] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 780.472469][ T981] cdc_wdm 2-1:1.0: skipping garbage [ 780.492921][T17722] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 780.506961][ T981] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 780.513841][ T981] cdc_wdm 2-1:1.0: Unknown control protocol [ 780.555110][T16414] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 780.596269][T16414] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 780.664051][T16414] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 780.674513][T17726] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3171'. [ 780.697041][ T981] usb 2-1: USB disconnect, device number 33 [ 780.746984][T16414] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 780.760977][T16414] usb 5-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 780.771481][T16414] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.810986][T16414] usb 5-1: Product: syz [ 780.819981][T16414] usb 5-1: Manufacturer: syz [ 780.825146][T16414] usb 5-1: SerialNumber: syz [ 780.840870][T16414] usb 5-1: config 0 descriptor?? [ 780.864697][T16414] iguanair 5-1:0.0: probe with driver iguanair failed with error -12 [ 781.062408][ T981] usb 5-1: USB disconnect, device number 7 [ 781.731353][T13829] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 781.831133][T17741] FAULT_INJECTION: forcing a failure. [ 781.831133][T17741] name failslab, interval 1, probability 0, space 0, times 0 [ 781.850853][T17741] CPU: 1 UID: 0 PID: 17741 Comm: syz.3.3174 Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 PREEMPT(full) [ 781.850882][T17741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 781.850894][T17741] Call Trace: [ 781.850902][T17741] [ 781.850910][T17741] dump_stack_lvl+0x189/0x250 [ 781.850938][T17741] ? __pfx____ratelimit+0x10/0x10 [ 781.850960][T17741] ? __pfx_dump_stack_lvl+0x10/0x10 [ 781.850982][T17741] ? __pfx__printk+0x10/0x10 [ 781.851008][T17741] ? __pfx___might_resched+0x10/0x10 [ 781.851026][T17741] ? fs_reclaim_acquire+0x7d/0x100 [ 781.851058][T17741] should_fail_ex+0x414/0x560 [ 781.851084][T17741] should_failslab+0xa8/0x100 [ 781.851111][T17741] __kmalloc_noprof+0xcb/0x4f0 [ 781.851134][T17741] ? tomoyo_encode+0x28b/0x550 [ 781.851170][T17741] tomoyo_encode+0x28b/0x550 [ 781.851200][T17741] tomoyo_realpath_from_path+0x58d/0x5d0 [ 781.851236][T17741] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 781.851258][T17741] tomoyo_path_number_perm+0x1e8/0x5a0 [ 781.851283][T17741] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 781.851323][T17741] ? __lock_acquire+0xab9/0xd20 [ 781.851369][T17741] ? __fget_files+0x2a/0x420 [ 781.851396][T17741] ? __fget_files+0x2a/0x420 [ 781.851420][T17741] ? __fget_files+0x3a0/0x420 [ 781.851443][T17741] ? __fget_files+0x2a/0x420 [ 781.851472][T17741] security_file_ioctl+0xcb/0x2d0 [ 781.851495][T17741] __se_sys_ioctl+0x47/0x170 [ 781.851519][T17741] do_syscall_64+0xfa/0x3b0 [ 781.851541][T17741] ? lockdep_hardirqs_on+0x9c/0x150 [ 781.851562][T17741] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 781.851580][T17741] ? clear_bhb_loop+0x60/0xb0 [ 781.851603][T17741] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 781.851621][T17741] RIP: 0033:0x7f05fcd8ebe9 [ 781.851639][T17741] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 781.851655][T17741] RSP: 002b:00007f05fdc10038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 781.851676][T17741] RAX: ffffffffffffffda RBX: 00007f05fcfb5fa0 RCX: 00007f05fcd8ebe9 [ 781.851690][T17741] RDX: 0000200000000000 RSI: 0000000000005393 RDI: 0000000000000007 [ 781.851702][T17741] RBP: 00007f05fdc10090 R08: 0000000000000000 R09: 0000000000000000 [ 781.851715][T17741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 781.851726][T17741] R13: 00007f05fcfb6038 R14: 00007f05fcfb5fa0 R15: 00007f05fd0dfa28 [ 781.851756][T17741] [ 781.851799][T17741] ERROR: Out of memory at tomoyo_realpath_from_path. [ 782.115346][T13829] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 782.178107][T13829] usb 2-1: can't read configurations, error -61 [ 782.300933][T17744] loop2: detected capacity change from 0 to 7 [ 782.311315][ T5916] Dev loop2: unable to read RDB block 7 [ 782.342506][T13829] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 782.391933][ T5916] loop2: unable to read partition table [ 782.427363][ T5916] loop2: partition table beyond EOD, truncated [ 782.445549][T17744] Dev loop2: unable to read RDB block 7 [ 782.451236][T17744] loop2: unable to read partition table [ 782.462762][T17744] loop2: partition table beyond EOD, truncated [ 782.476761][T17744] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 782.596053][T13829] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 782.632862][T13829] usb 2-1: can't read configurations, error -61 [ 782.649487][T13829] usb usb2-port1: attempt power cycle [ 782.680479][ T5966] usb 3-1: USB disconnect, device number 5 [ 782.736595][T17751] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 782.789982][T17751] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 782.813948][T17751] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3177'. [ 783.015748][T17759] sctp: [Deprecated]: syz.4.3179 (pid 17759) Use of struct sctp_assoc_value in delayed_ack socket option. [ 783.015748][T17759] Use struct sctp_sack_info instead [ 783.043121][ T5966] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 783.072496][T13829] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 783.095719][T17759] loop2: detected capacity change from 0 to 7 [ 783.127892][T13829] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 783.135869][T13829] usb 2-1: can't read configurations, error -61 [ 783.155194][ T5965] Dev loop2: unable to read RDB block 7 [ 783.171365][ T5965] loop2: unable to read partition table [ 783.182183][ T5965] loop2: partition table beyond EOD, truncated [ 783.202553][ T5966] usb 3-1: device descriptor read/64, error -71 [ 783.212881][T17759] Dev loop2: unable to read RDB block 7 [ 783.233305][T17759] loop2: unable to read partition table [ 783.259733][T17759] loop2: partition table beyond EOD, truncated [ 783.302437][T13829] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 783.310284][T17759] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 783.377230][T13829] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 783.392442][T13829] usb 2-1: can't read configurations, error -61 [ 783.413347][T13829] usb usb2-port1: unable to enumerate USB device [ 783.472627][ T5966] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 783.623082][ T5966] usb 3-1: device descriptor read/64, error -71 [ 783.742860][ T5966] usb usb3-port1: attempt power cycle [ 783.748706][T17748] vivid-001: ================= START STATUS ================= [ 783.778109][T17748] vivid-001: Radio HW Seek Mode: Bounded [ 783.793662][T17748] vivid-001: Radio Programmable HW Seek: false [ 783.807746][T17748] vivid-001: RDS Rx I/O Mode: Block I/O [ 783.820488][T17748] vivid-001: Generate RBDS Instead of RDS: false [ 783.833821][T17748] vivid-001: RDS Reception: true [ 783.858312][T17748] vivid-001: RDS Program Type: 0 inactive [ 783.876310][T17633] net_ratelimit: 13 callbacks suppressed [ 783.876331][T17633] Set syz1 is full, maxelem 65536 reached [ 783.878555][T17748] vivid-001: RDS PS Name: inactive [ 783.938857][T17748] vivid-001: RDS Radio Text: inactive [ 783.967947][T17748] vivid-001: RDS Traffic Announcement: false inactive [ 783.989102][T17748] vivid-001: RDS Traffic Program: false inactive [ 784.016964][T17748] vivid-001: RDS Music: false inactive [ 784.035454][T17748] vivid-001: ================== END STATUS ================== [ 784.079672][T17772] 8021q: adding VLAN 0 to HW filter on device bond1 [ 784.097702][T17772] bond0: (slave bond1): Enslaving as an active interface with an up link [ 784.112480][ T5966] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 784.133306][ T5966] usb 3-1: device descriptor read/8, error -71 [ 784.410611][ T5966] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 784.437829][ T5966] usb 3-1: device descriptor read/8, error -71 [ 784.570672][ T5966] usb usb3-port1: unable to enumerate USB device [ 784.634970][T17782] FAULT_INJECTION: forcing a failure. [ 784.634970][T17782] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 784.663752][T17782] CPU: 1 UID: 0 PID: 17782 Comm: syz.3.3186 Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 PREEMPT(full) [ 784.663780][T17782] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 784.663790][T17782] Call Trace: [ 784.663798][T17782] [ 784.663807][T17782] dump_stack_lvl+0x189/0x250 [ 784.663834][T17782] ? __pfx____ratelimit+0x10/0x10 [ 784.663854][T17782] ? __pfx_dump_stack_lvl+0x10/0x10 [ 784.663874][T17782] ? __pfx__printk+0x10/0x10 [ 784.663897][T17782] ? __might_fault+0xb0/0x130 [ 784.663938][T17782] should_fail_ex+0x414/0x560 [ 784.663964][T17782] _copy_from_user+0x2d/0xb0 [ 784.663983][T17782] scsi_ioctl+0x489/0x1fb0 [ 784.664008][T17782] ? __pfx_scsi_ioctl+0x10/0x10 [ 784.664056][T17782] ? kasan_quarantine_put+0xdd/0x220 [ 784.664079][T17782] ? __pfx___might_resched+0x10/0x10 [ 784.664104][T17782] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 784.664133][T17782] ? scsi_block_when_processing_errors+0x390/0x470 [ 784.664158][T17782] ? __pfx_scsi_block_when_processing_errors+0x10/0x10 [ 784.664199][T17782] sg_ioctl+0x1886/0x2230 [ 784.664232][T17782] ? __pfx_sg_ioctl+0x10/0x10 [ 784.664256][T17782] ? __fget_files+0x2a/0x420 [ 784.664284][T17782] ? __fget_files+0x2a/0x420 [ 784.664307][T17782] ? __fget_files+0x3a0/0x420 [ 784.664330][T17782] ? __fget_files+0x2a/0x420 [ 784.664358][T17782] ? bpf_lsm_file_ioctl+0x9/0x20 [ 784.664380][T17782] ? __pfx_sg_ioctl+0x10/0x10 [ 784.664402][T17782] __se_sys_ioctl+0xfc/0x170 [ 784.664427][T17782] do_syscall_64+0xfa/0x3b0 [ 784.664447][T17782] ? lockdep_hardirqs_on+0x9c/0x150 [ 784.664468][T17782] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.664486][T17782] ? clear_bhb_loop+0x60/0xb0 [ 784.664508][T17782] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.664525][T17782] RIP: 0033:0x7f05fcd8ebe9 [ 784.664542][T17782] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 784.664558][T17782] RSP: 002b:00007f05fdc10038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 784.664578][T17782] RAX: ffffffffffffffda RBX: 00007f05fcfb5fa0 RCX: 00007f05fcd8ebe9 [ 784.664593][T17782] RDX: 0000200000000000 RSI: 0000000000005393 RDI: 0000000000000007 [ 784.664605][T17782] RBP: 00007f05fdc10090 R08: 0000000000000000 R09: 0000000000000000 [ 784.664617][T17782] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 784.664628][T17782] R13: 00007f05fcfb6038 R14: 00007f05fcfb5fa0 R15: 00007f05fd0dfa28 [ 784.664654][T17782] [ 785.116691][T17788] loop2: detected capacity change from 0 to 7 [ 785.120974][T17780] netlink: 'syz.4.3185': attribute type 1 has an invalid length. [ 785.156952][T17788] Dev loop2: unable to read RDB block 7 [ 785.163600][T17790] binder: 17789:17790 ioctl 50009401 200000000b80 returned -22 [ 785.182103][T17788] loop2: unable to read partition table [ 785.188439][T17788] loop2: partition table beyond EOD, truncated [ 785.207063][T17788] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 785.346980][T17793] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 785.417925][T13829] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 785.574717][T13829] usb 4-1: config 0 has an invalid descriptor of length 228, skipping remainder of the config [ 785.602131][T13829] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 785.639613][T13829] usb 4-1: New USB device found, idVendor=20b7, idProduct=151c, bcdDevice=b7.5a [ 785.665472][T13829] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 785.698488][T13829] usb 4-1: Product: syz [ 785.718051][T13829] usb 4-1: Manufacturer: syz [ 785.761347][T13829] usb 4-1: SerialNumber: syz [ 785.845736][T13829] usb 4-1: config 0 descriptor?? [ 786.071719][T13829] usb 4-1: USB disconnect, device number 56 [ 786.742530][T17826] loop2: detected capacity change from 0 to 7 [ 786.753265][T17824] FAULT_INJECTION: forcing a failure. [ 786.753265][T17824] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 786.764441][ T5916] Dev loop2: unable to read RDB block 7 [ 786.768868][T17824] CPU: 1 UID: 0 PID: 17824 Comm: syz.4.3199 Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 PREEMPT(full) [ 786.768893][T17824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 786.768905][T17824] Call Trace: [ 786.768913][T17824] [ 786.768921][T17824] dump_stack_lvl+0x189/0x250 [ 786.768947][T17824] ? __pfx____ratelimit+0x10/0x10 [ 786.768969][T17824] ? __pfx_dump_stack_lvl+0x10/0x10 [ 786.768988][T17824] ? __pfx__printk+0x10/0x10 [ 786.769015][T17824] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 786.769042][T17824] should_fail_ex+0x414/0x560 [ 786.769068][T17824] _copy_from_user+0x2d/0xb0 [ 786.769085][T17824] sg_io+0x29f/0x8a0 [ 786.769110][T17824] scsi_ioctl+0x1399/0x1fb0 [ 786.769133][T17824] ? __pfx_scsi_ioctl+0x10/0x10 [ 786.769179][T17824] ? kasan_quarantine_put+0xdd/0x220 [ 786.769202][T17824] ? __pfx___might_resched+0x10/0x10 [ 786.769226][T17824] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 786.769255][T17824] ? scsi_block_when_processing_errors+0x390/0x470 [ 786.769278][T17824] ? __pfx_scsi_block_when_processing_errors+0x10/0x10 [ 786.769317][T17824] sg_ioctl+0x1886/0x2230 [ 786.769353][T17824] ? __pfx_sg_ioctl+0x10/0x10 [ 786.769376][T17824] ? __fget_files+0x2a/0x420 [ 786.769404][T17824] ? __fget_files+0x2a/0x420 [ 786.769499][T17824] ? __fget_files+0x3a0/0x420 [ 786.769521][T17824] ? __fget_files+0x2a/0x420 [ 786.769549][T17824] ? bpf_lsm_file_ioctl+0x9/0x20 [ 786.769570][T17824] ? __pfx_sg_ioctl+0x10/0x10 [ 786.769592][T17824] __se_sys_ioctl+0xfc/0x170 [ 786.769616][T17824] do_syscall_64+0xfa/0x3b0 [ 786.769636][T17824] ? lockdep_hardirqs_on+0x9c/0x150 [ 786.769656][T17824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 786.769673][T17824] ? clear_bhb_loop+0x60/0xb0 [ 786.769696][T17824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 786.769713][T17824] RIP: 0033:0x7f798c58ebe9 [ 786.769730][T17824] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 786.769746][T17824] RSP: 002b:00007f798d4a2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 786.769765][T17824] RAX: ffffffffffffffda RBX: 00007f798c7b5fa0 RCX: 00007f798c58ebe9 [ 786.769779][T17824] RDX: 0000200000000000 RSI: 0000000000005393 RDI: 0000000000000007 [ 786.769791][T17824] RBP: 00007f798d4a2090 R08: 0000000000000000 R09: 0000000000000000 [ 786.769803][T17824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 786.769813][T17824] R13: 00007f798c7b6038 R14: 00007f798c7b5fa0 R15: 00007f798c8dfa28 [ 786.769842][T17824] [ 787.169975][ T5916] loop2: unable to read partition table [ 787.197748][ T5916] loop2: partition table beyond EOD, truncated [ 787.238907][T17826] Dev loop2: unable to read RDB block 7 [ 787.244725][T17826] loop2: unable to read partition table [ 787.252119][T17826] loop2: partition table beyond EOD, truncated [ 787.261358][T17826] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 787.577102][ T5966] IPVS: starting estimator thread 0... [ 787.585941][T17847] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 787.694002][T17849] IPVS: using max 32 ests per chain, 76800 per kthread [ 787.865498][T17854] netlink: 'syz.4.3209': attribute type 16 has an invalid length. [ 787.874573][T13829] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 787.880653][T17853] bridge0: port 1(bridge_slave_0) entered disabled state [ 787.898269][T17853] bridge0: port 2(bridge_slave_1) entered disabled state [ 787.956577][T17854] netlink: 'syz.4.3209': attribute type 17 has an invalid length. [ 788.003614][T17854] bridge0: port 1(bridge_slave_0) entered blocking state [ 788.010830][T17854] bridge0: port 1(bridge_slave_0) entered forwarding state [ 788.024650][T13829] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 788.026326][T17854] bridge0: port 2(bridge_slave_1) entered blocking state [ 788.042832][T17854] bridge0: port 2(bridge_slave_1) entered forwarding state [ 788.094396][T13829] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 788.156781][T13829] usb 1-1: New USB device found, idVendor=04b4, idProduct=de61, bcdDevice= 0.00 [ 788.173288][T17858] tipc: Started in network mode [ 788.190214][T17858] tipc: Node identity b2730afa1f6c, cluster identity 4711 [ 788.200338][T13829] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 788.209046][T17858] tipc: Enabled bearer , priority 0 [ 788.233001][T17858] syzkaller0: entered promiscuous mode [ 788.238591][T17858] syzkaller0: entered allmulticast mode [ 788.258567][T13829] usb 1-1: config 0 descriptor?? [ 788.291410][T17858] tipc: Resetting bearer [ 788.479240][T17867] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3213'. [ 788.819238][T17855] tipc: Resetting bearer [ 788.971994][T17855] tipc: Disabling bearer [ 789.104931][T17880] loop2: detected capacity change from 0 to 7 [ 789.123411][T17880] Dev loop2: unable to read RDB block 7 [ 789.129031][T17880] loop2: unable to read partition table [ 789.196857][T17880] loop2: partition table beyond EOD, truncated [ 789.222630][T17880] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 789.292024][ T5232] Dev loop2: unable to read RDB block 7 [ 789.316847][ T5232] loop2: unable to read partition table [ 789.379665][ T5232] loop2: partition table beyond EOD, truncated [ 789.824020][ T5966] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 790.002567][ T5966] usb 3-1: Using ep0 maxpacket: 16 [ 790.023215][ T5966] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 790.036835][ T5966] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 790.062692][ T5966] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 790.109305][ T5966] usb 3-1: New USB device found, idVendor=1e7d, idProduct=31ce, bcdDevice= 0.00 [ 790.118853][ T5966] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 790.166154][ T5966] usb 3-1: config 0 descriptor?? [ 790.332637][ T5952] usb 4-1: new full-speed USB device number 57 using dummy_hcd [ 790.493983][ T5952] usb 4-1: device descriptor read/64, error -71 [ 790.696650][T13829] usbhid 1-1:0.0: can't add hid device: -71 [ 790.709650][T17915] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3228'. [ 790.730509][T13829] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 790.754325][T17894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 790.801779][T13829] usb 1-1: USB disconnect, device number 16 [ 790.808274][ T5952] usb 4-1: new full-speed USB device number 58 using dummy_hcd [ 790.851687][T17894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 790.962757][ T5952] usb 4-1: device descriptor read/64, error -71 [ 790.979862][T17894] pim6reg: entered allmulticast mode [ 791.065232][ T5966] ryos 0003:1E7D:31CE.0025: unbalanced delimiter at end of report description [ 791.084958][ T5952] usb usb4-port1: attempt power cycle [ 791.093998][ T5966] ryos 0003:1E7D:31CE.0025: parse failed [ 791.109567][ T5966] ryos 0003:1E7D:31CE.0025: probe with driver ryos failed with error -22 [ 791.321288][T16414] usb 3-1: USB disconnect, device number 10 [ 791.353344][T13829] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 791.442410][ T5952] usb 4-1: new full-speed USB device number 59 using dummy_hcd [ 791.493321][ T5952] usb 4-1: device descriptor read/8, error -71 [ 791.512491][ T5966] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 791.554882][T13829] usb 2-1: config 0 has no interfaces? [ 791.577438][T13829] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 791.607829][T13829] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 791.651758][T13829] usb 2-1: Product: syz [ 791.671332][T13829] usb 2-1: Manufacturer: syz [ 791.674550][ T5966] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 791.690924][ T5966] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 791.715020][T13829] usb 2-1: SerialNumber: syz [ 791.719914][ T5966] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 791.737622][ T5966] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 791.738627][T13829] usb 2-1: config 0 descriptor?? [ 791.756798][ T5952] usb 4-1: new full-speed USB device number 60 using dummy_hcd [ 791.778832][ T5966] usb 5-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 791.791052][ T5966] usb 5-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 791.833695][ T5952] usb 4-1: device descriptor read/8, error -71 [ 791.860714][ T5966] usb 5-1: Manufacturer: syz [ 791.932236][ T5966] usb 5-1: config 0 descriptor?? [ 791.962149][ T5952] usb usb4-port1: unable to enumerate USB device [ 792.081776][T17926] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 792.091952][T17926] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 792.103106][T17926] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3229'. [ 792.185177][T13829] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 792.227043][ T5966] usbhid 5-1:0.0: can't add hid device: -71 [ 792.249786][ T5966] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 792.270062][ T30] kauditd_printk_skb: 49 callbacks suppressed [ 792.270077][ T30] audit: type=1326 audit(1754527024.010:493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17942 comm="syz.2.3236" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f642198ebe9 code=0x7ffc0000 [ 792.301584][ T30] audit: type=1326 audit(1754527024.010:494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17942 comm="syz.2.3236" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f642198ebe9 code=0x7ffc0000 [ 792.311327][ T5966] usb 5-1: USB disconnect, device number 8 [ 792.332484][T13829] usb 1-1: device descriptor read/64, error -71 [ 792.464873][ T30] audit: type=1326 audit(1754527024.010:495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17942 comm="syz.2.3236" exe="/root/syz-executor" sig=0 arch=c000003e syscall=433 compat=0 ip=0x7f642198ebe9 code=0x7ffc0000 [ 792.528426][T17948] input: syz1 as /devices/virtual/input/input45 [ 792.602468][T13829] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 792.620269][ T30] audit: type=1326 audit(1754527024.010:496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17942 comm="syz.2.3236" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f642198ebe9 code=0x7ffc0000 [ 792.709894][ T30] audit: type=1326 audit(1754527024.010:497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17942 comm="syz.2.3236" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f642198ebe9 code=0x7ffc0000 [ 792.742524][T13829] usb 1-1: device descriptor read/64, error -71 [ 792.763787][ T30] audit: type=1326 audit(1754527024.010:498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17942 comm="syz.2.3236" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f642198ebe9 code=0x7ffc0000 [ 792.839741][ T30] audit: type=1326 audit(1754527024.010:499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17942 comm="syz.2.3236" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f642198ebe9 code=0x7ffc0000 [ 792.869393][T13829] usb usb1-port1: attempt power cycle [ 793.212673][T13829] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 793.243297][T13829] usb 1-1: device descriptor read/8, error -71 [ 793.582579][T13829] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 793.603045][T13829] usb 1-1: device descriptor read/8, error -71 [ 793.725683][T13829] usb usb1-port1: unable to enumerate USB device [ 794.050711][ T24] usb 2-1: USB disconnect, device number 38 [ 794.251911][ T30] audit: type=1804 audit(1754527025.980:500): pid=17968 uid=0 auid=0 ses=1 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.3241" name="file0" dev="ramfs" ino=80198 res=1 errno=0 [ 794.325538][T17972] Invalid logical block size (4100) [ 794.529765][T17977] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3243'. [ 794.540808][T17977] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3243'. [ 794.593048][T17977] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 794.706407][T17977] bond1: entered allmulticast mode [ 794.713118][T17977] 8021q: adding VLAN 0 to HW filter on device bond1 [ 795.082591][ T5952] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 795.237388][ T5952] usb 4-1: config 0 has an invalid interface number: 101 but max is 0 [ 795.248137][ T5952] usb 4-1: config 0 has no interface number 0 [ 795.339546][ T5952] usb 4-1: New USB device found, idVendor=093a, idProduct=2623, bcdDevice=b2.14 [ 795.404482][ T5952] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 795.417770][ T5952] usb 4-1: Product: syz [ 795.422676][ T5952] usb 4-1: Manufacturer: syz [ 795.427697][ T5952] usb 4-1: SerialNumber: syz [ 795.509725][ T5952] usb 4-1: config 0 descriptor?? [ 795.533395][ T5952] gspca_main: gspca_pac7302-2.14.0 probing 093a:2623 [ 796.103822][ T5952] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 796.151613][ T5952] gspca_pac7302 4-1:0.101: probe with driver gspca_pac7302 failed with error -110 [ 796.371411][T17997] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 796.371513][ T5849] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 796.473336][ T5966] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 796.644738][ T5966] usb 1-1: config 0 has an invalid interface number: 110 but max is 0 [ 796.654050][ T5966] usb 1-1: config 0 has no interface number 0 [ 796.661420][ T5966] usb 1-1: config 0 interface 110 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 796.685606][ T5966] usb 1-1: config 0 interface 110 has no altsetting 0 [ 796.705287][ T5966] usb 1-1: New USB device found, idVendor=0547, idProduct=2720, bcdDevice=af.55 [ 796.715859][ T5966] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 796.735807][ T5966] usb 1-1: Product: syz [ 796.741669][ T5966] usb 1-1: Manufacturer: syz [ 796.749528][ T5966] usb 1-1: SerialNumber: syz [ 796.760001][ T5966] usb 1-1: config 0 descriptor?? [ 796.766353][T17995] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 796.976950][T17995] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 796.987613][ T5966] cdc_subset 1-1:0.110: probe with driver cdc_subset failed with error -22 [ 797.212250][T17995] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 797.244283][T17995] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 797.271280][ T5966] usb 1-1: USB disconnect, device number 21 [ 797.647471][T18015] 8021q: adding VLAN 0 to HW filter on device bond4 [ 797.673510][T18018] fuse: Bad value for 'fd' [ 797.676131][T18015] bond0: (slave bond4): Enslaving as an active interface with an up link [ 797.698367][ T24] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 797.887379][ T24] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 797.912923][ T24] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 797.942179][ T5966] usb 4-1: USB disconnect, device number 61 [ 797.955622][ T24] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 797.965759][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 797.978169][ T24] usb 5-1: SerialNumber: syz [ 798.093038][ T30] audit: type=1800 audit(1754527029.820:501): pid=18029 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.3260" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 798.239984][T18029] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3260'. [ 798.319229][T18029] tc_dump_action: action bad kind [ 798.337501][ T24] usb 5-1: 0:2 : does not exist [ 798.344784][T18029] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3260'. [ 798.400307][ T30] audit: type=1326 audit(1754527030.140:502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18028 comm="syz.3.3260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05fcd8ebe9 code=0x7ffc0000 [ 798.424394][ T24] usb 5-1: USB disconnect, device number 9 [ 798.452894][ T30] audit: type=1326 audit(1754527030.140:503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18028 comm="syz.3.3260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05fcd8ebe9 code=0x7ffc0000 [ 798.598452][ T5965] udevd[5965]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 798.627923][T18035] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3258'. [ 798.658584][T18035] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 798.689025][T18035] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 798.920597][ T30] audit: type=1326 audit(1754527030.140:504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18028 comm="syz.3.3260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=122 compat=0 ip=0x7f05fcd8ebe9 code=0x7ffc0000 [ 798.944940][ T30] audit: type=1326 audit(1754527030.140:505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18028 comm="syz.3.3260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05fcd8ebe9 code=0x7ffc0000 [ 798.990267][ T30] audit: type=1326 audit(1754527030.140:506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18028 comm="syz.3.3260" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05fcd8ebe9 code=0x7ffc0000 [ 799.413281][T18049] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3263'. [ 800.194118][ T30] audit: type=1326 audit(1754527031.940:507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18056 comm="syz.2.3265" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f642198ebe9 code=0x0 [ 800.315275][T18066] batadv_slave_1: entered promiscuous mode [ 800.333467][T18066] batadv_slave_1: left promiscuous mode [ 800.512522][ T5966] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 800.667717][T18074] 8021q: adding VLAN 0 to HW filter on device bond5 [ 800.676015][ T5966] usb 5-1: config 0 interface 0 altsetting 7 endpoint 0x81 has invalid wMaxPacketSize 0 [ 800.686071][ T5966] usb 5-1: config 0 interface 0 has no altsetting 0 [ 800.689486][T18074] bond0: (slave bond5): Enslaving as an active interface with an up link [ 800.692941][ T5966] usb 5-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 800.692971][ T5966] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 800.696635][ T5966] usb 5-1: config 0 descriptor?? [ 801.092557][ T981] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 801.175044][ T5966] magicmouse 0003:05AC:0269.0026: hidraw0: USB HID v10.00 Device [HID 05ac:0269] on usb-dummy_hcd.4-1/input0 [ 801.262774][ T981] usb 3-1: device descriptor read/64, error -71 [ 801.530721][ T981] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 801.540892][T18089] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3275'. [ 801.553058][T18089] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3275'. [ 801.672680][ T981] usb 3-1: device descriptor read/64, error -71 [ 801.793013][ T981] usb usb3-port1: attempt power cycle [ 801.832513][ T5952] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 801.909919][T18096] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3277'. [ 801.968606][ T5952] usb 2-1: device descriptor read/64, error -71 [ 802.068561][T18101] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3278'. [ 802.083933][T18101] FAULT_INJECTION: forcing a failure. [ 802.083933][T18101] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 802.128600][T18101] CPU: 0 UID: 0 PID: 18101 Comm: syz.0.3278 Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 PREEMPT(full) [ 802.128629][T18101] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 802.128639][T18101] Call Trace: [ 802.128647][T18101] [ 802.128656][T18101] dump_stack_lvl+0x189/0x250 [ 802.128683][T18101] ? __pfx____ratelimit+0x10/0x10 [ 802.128706][T18101] ? __pfx_dump_stack_lvl+0x10/0x10 [ 802.128727][T18101] ? __pfx__printk+0x10/0x10 [ 802.128752][T18101] ? __might_fault+0xb0/0x130 [ 802.128787][T18101] should_fail_ex+0x414/0x560 [ 802.128814][T18101] _copy_from_user+0x2d/0xb0 [ 802.128834][T18101] ___sys_sendmsg+0x158/0x2a0 [ 802.128863][T18101] ? __pfx____sys_sendmsg+0x10/0x10 [ 802.128923][T18101] ? __fget_files+0x2a/0x420 [ 802.128947][T18101] ? __fget_files+0x3a0/0x420 [ 802.128983][T18101] __x64_sys_sendmsg+0x19b/0x260 [ 802.129011][T18101] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 802.129045][T18101] ? __pfx_ksys_write+0x10/0x10 [ 802.129066][T18101] ? rcu_is_watching+0x15/0xb0 [ 802.129090][T18101] ? do_syscall_64+0xbe/0x3b0 [ 802.129115][T18101] do_syscall_64+0xfa/0x3b0 [ 802.129135][T18101] ? lockdep_hardirqs_on+0x9c/0x150 [ 802.129156][T18101] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 802.129175][T18101] ? clear_bhb_loop+0x60/0xb0 [ 802.129204][T18101] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 802.129223][T18101] RIP: 0033:0x7fe49518ebe9 [ 802.129240][T18101] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 802.129255][T18101] RSP: 002b:00007fe495ffb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 802.129275][T18101] RAX: ffffffffffffffda RBX: 00007fe4953b5fa0 RCX: 00007fe49518ebe9 [ 802.129290][T18101] RDX: 000000000404c0c0 RSI: 0000200000000040 RDI: 0000000000000003 [ 802.129302][T18101] RBP: 00007fe495ffb090 R08: 0000000000000000 R09: 0000000000000000 [ 802.129315][T18101] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 802.129326][T18101] R13: 00007fe4953b6038 R14: 00007fe4953b5fa0 R15: 00007fe4954dfa28 [ 802.129356][T18101] [ 802.558980][ T981] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 802.593624][ T981] usb 3-1: device descriptor read/8, error -71 [ 802.622595][ T5952] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 802.781056][ T5952] usb 2-1: device descriptor read/64, error -71 [ 802.902113][ T981] usb 3-1: new full-speed USB device number 14 using dummy_hcd [ 802.909790][T13829] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 802.922993][ T5952] usb usb2-port1: attempt power cycle [ 803.001736][ T981] usb 3-1: device descriptor read/8, error -71 [ 803.145500][T13829] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 803.189157][T13829] usb 1-1: config 0 interface 0 has no altsetting 0 [ 803.268267][ T981] usb usb3-port1: unable to enumerate USB device [ 803.280071][ T5504] usb 5-1: USB disconnect, device number 10 [ 803.282520][T13829] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 803.305731][T13829] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 803.332667][T13829] usb 1-1: Product: syz [ 803.349108][T13829] usb 1-1: Manufacturer: syz [ 803.362442][T13829] usb 1-1: SerialNumber: syz [ 803.370021][T13829] usb 1-1: config 0 descriptor?? [ 803.375681][ T5952] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 803.395739][T13829] usb 1-1: selecting invalid altsetting 0 [ 803.405831][ T5952] usb 2-1: device descriptor read/8, error -71 [ 803.642475][ T5952] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 803.665338][ T5952] usb 2-1: device descriptor read/8, error -71 [ 803.682526][ T5504] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 803.882470][ T5952] usb usb2-port1: unable to enumerate USB device [ 803.897682][ T5504] usb 5-1: Using ep0 maxpacket: 16 [ 803.904918][ T5504] usb 5-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 803.915553][ T5504] usb 5-1: config 0 interface 0 altsetting 16 endpoint 0x2 has an invalid bInterval 129, changing to 11 [ 803.935826][T18122] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 803.966241][ T5966] usb 1-1: USB disconnect, device number 22 [ 803.994529][ T5504] usb 5-1: config 0 interface 0 altsetting 16 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 804.045445][ T5504] usb 5-1: config 0 interface 0 has no altsetting 0 [ 804.072626][ T5504] usb 5-1: New USB device found, idVendor=4271, idProduct=9d6c, bcdDevice= 0.ab [ 804.072657][ T5504] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 804.091641][ T5504] usb 5-1: config 0 descriptor?? [ 804.309978][ T5504] hid-generic 0003:4271:9D6C.0027: unknown main item tag 0x0 [ 804.340205][ T5504] hid-generic 0003:4271:9D6C.0027: unknown main item tag 0x0 [ 804.395858][ T5504] hid-generic 0003:4271:9D6C.0027: unknown main item tag 0x0 [ 804.407858][ T5504] hid-generic 0003:4271:9D6C.0027: unknown main item tag 0x0 [ 804.482777][ T5504] hid-generic 0003:4271:9D6C.0027: unknown main item tag 0x0 [ 804.509403][ T5504] hid-generic 0003:4271:9D6C.0027: hidraw0: USB HID v0.05 Device [HID 4271:9d6c] on usb-dummy_hcd.4-1/input0 [ 804.579266][ T5504] usb 5-1: USB disconnect, device number 11 [ 804.822272][T18130] fido_id[18130]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 805.192898][T18148] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3289'. [ 805.270172][T18148] FAULT_INJECTION: forcing a failure. [ 805.270172][T18148] name failslab, interval 1, probability 0, space 0, times 0 [ 805.319136][T18148] CPU: 0 UID: 0 PID: 18148 Comm: syz.4.3289 Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 PREEMPT(full) [ 805.319164][T18148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 805.319176][T18148] Call Trace: [ 805.319184][T18148] [ 805.319193][T18148] dump_stack_lvl+0x189/0x250 [ 805.319219][T18148] ? __pfx____ratelimit+0x10/0x10 [ 805.319241][T18148] ? __pfx_dump_stack_lvl+0x10/0x10 [ 805.319262][T18148] ? __pfx__printk+0x10/0x10 [ 805.319291][T18148] ? __pfx___might_resched+0x10/0x10 [ 805.319313][T18148] should_fail_ex+0x414/0x560 [ 805.319338][T18148] should_failslab+0xa8/0x100 [ 805.319366][T18148] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 805.319390][T18148] ? __alloc_skb+0x112/0x2d0 [ 805.319416][T18148] __alloc_skb+0x112/0x2d0 [ 805.319442][T18148] netlink_sendmsg+0x5c6/0xb30 [ 805.319474][T18148] ? __pfx_netlink_sendmsg+0x10/0x10 [ 805.319499][T18148] ? aa_sock_msg_perm+0xf1/0x1d0 [ 805.319525][T18148] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 805.319544][T18148] ? __pfx_netlink_sendmsg+0x10/0x10 [ 805.319567][T18148] __sock_sendmsg+0x219/0x270 [ 805.319590][T18148] ____sys_sendmsg+0x505/0x830 [ 805.319631][T18148] ? __pfx_____sys_sendmsg+0x10/0x10 [ 805.319664][T18148] ? import_iovec+0x74/0xa0 [ 805.319685][T18148] ___sys_sendmsg+0x21f/0x2a0 [ 805.319712][T18148] ? __pfx____sys_sendmsg+0x10/0x10 [ 805.319770][T18148] ? __fget_files+0x2a/0x420 [ 805.319795][T18148] ? __fget_files+0x3a0/0x420 [ 805.319833][T18148] __x64_sys_sendmsg+0x19b/0x260 [ 805.319859][T18148] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 805.319893][T18148] ? __pfx_ksys_write+0x10/0x10 [ 805.319920][T18148] ? do_syscall_64+0xbe/0x3b0 [ 805.319946][T18148] do_syscall_64+0xfa/0x3b0 [ 805.319967][T18148] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 805.319984][T18148] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 805.320001][T18148] ? clear_bhb_loop+0x60/0xb0 [ 805.320023][T18148] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 805.320041][T18148] RIP: 0033:0x7f798c58ebe9 [ 805.320056][T18148] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 805.320070][T18148] RSP: 002b:00007f798d4a2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 805.320091][T18148] RAX: ffffffffffffffda RBX: 00007f798c7b5fa0 RCX: 00007f798c58ebe9 [ 805.320105][T18148] RDX: 000000000404c0c0 RSI: 0000200000000040 RDI: 0000000000000003 [ 805.320118][T18148] RBP: 00007f798d4a2090 R08: 0000000000000000 R09: 0000000000000000 [ 805.320130][T18148] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 805.320141][T18148] R13: 00007f798c7b6038 R14: 00007f798c7b5fa0 R15: 00007f798c8dfa28 [ 805.320170][T18148] [ 806.622635][ T5504] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 806.632752][ T981] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 806.762504][ T5504] usb 4-1: device descriptor read/64, error -71 [ 806.832969][ T981] usb 2-1: Using ep0 maxpacket: 8 [ 806.851550][ T981] usb 2-1: config 0 has an invalid interface number: 250 but max is 0 [ 806.912364][ T981] usb 2-1: config 0 has no interface number 0 [ 807.181075][ T5504] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 807.294524][ T981] usb 2-1: New USB device found, idVendor=a168, idProduct=0614, bcdDevice=1b.10 [ 807.534118][ T5504] usb 4-1: device descriptor read/64, error -71 [ 807.642934][ T5504] usb usb4-port1: attempt power cycle [ 807.742498][ T981] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 807.813513][ T981] usb 2-1: Product: syz [ 807.833533][ T981] usb 2-1: Manufacturer: syz [ 807.852704][ T981] usb 2-1: SerialNumber: syz [ 808.172687][ T5504] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 808.303537][ T981] usb 2-1: config 0 descriptor?? [ 808.316849][ T5504] usb 4-1: device descriptor read/8, error -71 [ 808.325271][ T981] gspca_main: gspca_sn9c20x-2.14.0 probing a168:0614 [ 808.524537][ T981] gspca_sn9c20x: Write register 1000 failed -71 [ 808.530898][ T981] gspca_sn9c20x: Device initialization failed [ 808.538889][ T981] gspca_sn9c20x 2-1:0.250: probe with driver gspca_sn9c20x failed with error -71 [ 808.563627][ T5504] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 808.564036][ T981] usb 2-1: USB disconnect, device number 43 [ 808.593289][ T5504] usb 4-1: device descriptor read/8, error -71 [ 808.714593][ T5504] usb usb4-port1: unable to enumerate USB device [ 808.817365][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.825468][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.204560][T18190] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3301'. [ 809.221431][ T981] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 809.364267][ T981] usb 3-1: device descriptor read/64, error -71 [ 809.592543][T13829] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 810.172446][ T981] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 810.352587][ T981] usb 3-1: device descriptor read/64, error -71 [ 810.366443][T13829] usb 1-1: config 0 has no interfaces? [ 810.375481][T13829] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 810.395769][T13829] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 810.421915][T13829] usb 1-1: Product: syz [ 810.521487][ T981] usb usb3-port1: attempt power cycle [ 810.540197][T13829] usb 1-1: Manufacturer: syz [ 810.551476][T13829] usb 1-1: SerialNumber: syz [ 810.591715][T13829] usb 1-1: config 0 descriptor?? [ 810.853216][T16425] usb 4-1: new low-speed USB device number 66 using dummy_hcd [ 810.892589][ T981] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 810.994047][ T981] usb 3-1: device descriptor read/8, error -71 [ 811.092584][T18215] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3309'. [ 811.108499][T16425] usb 4-1: config 0 has an invalid interface number: 3 but max is 0 [ 811.127844][T16425] usb 4-1: config 0 has no interface number 0 [ 811.154176][T16425] usb 4-1: config 0 interface 3 altsetting 0 endpoint 0x6 has invalid maxpacket 64, setting to 8 [ 811.220139][T16425] usb 4-1: config 0 interface 3 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 811.232467][T16425] usb 4-1: config 0 interface 3 altsetting 0 endpoint 0x8 has invalid maxpacket 1024, setting to 8 [ 811.248259][T16425] usb 4-1: config 0 interface 3 altsetting 0 endpoint 0x4 has invalid maxpacket 1023, setting to 8 [ 811.262549][ T981] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 811.296089][ T981] usb 3-1: device descriptor read/8, error -71 [ 811.347185][T16425] usb 4-1: config 0 interface 3 altsetting 0 endpoint 0xA has invalid maxpacket 1023, setting to 8 [ 811.411236][T16425] usb 4-1: New USB device found, idVendor=1199, idProduct=6821, bcdDevice=98.59 [ 811.412941][ T981] usb usb3-port1: unable to enumerate USB device [ 812.493309][T16425] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 812.634281][T16425] usb 4-1: config 0 descriptor?? [ 812.639993][T18208] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 812.671221][T16425] hub 4-1:0.3: bad descriptor, ignoring hub [ 812.725026][T16425] hub 4-1:0.3: probe with driver hub failed with error -5 [ 812.747658][T16425] sierra 4-1:0.3: Sierra USB modem converter detected [ 812.950845][T18208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 812.986048][T18208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 813.027741][T18232] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3311'. [ 813.145518][T18237] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3313'. [ 813.193359][T18237] FAULT_INJECTION: forcing a failure. [ 813.193359][T18237] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 813.211543][T18237] CPU: 0 UID: 0 PID: 18237 Comm: syz.4.3313 Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 PREEMPT(full) [ 813.211572][T18237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 813.211579][T18237] Call Trace: [ 813.211584][T18237] [ 813.211590][T18237] dump_stack_lvl+0x189/0x250 [ 813.211608][T18237] ? __pfx____ratelimit+0x10/0x10 [ 813.211621][T18237] ? __pfx_dump_stack_lvl+0x10/0x10 [ 813.211638][T18237] ? __pfx__printk+0x10/0x10 [ 813.211662][T18237] ? __might_fault+0xb0/0x130 [ 813.211695][T18237] should_fail_ex+0x414/0x560 [ 813.211719][T18237] _copy_from_iter+0x1db/0x16f0 [ 813.211736][T18237] ? rcu_is_watching+0x15/0xb0 [ 813.211746][T18237] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 813.211762][T18237] ? __pfx__copy_from_iter+0x10/0x10 [ 813.211778][T18237] ? __build_skb_around+0x257/0x3e0 [ 813.211803][T18237] ? netlink_sendmsg+0x642/0xb30 [ 813.211824][T18237] ? skb_put+0x11b/0x210 [ 813.211857][T18237] netlink_sendmsg+0x6b2/0xb30 [ 813.211879][T18237] ? __pfx_netlink_sendmsg+0x10/0x10 [ 813.211893][T18237] ? aa_sock_msg_perm+0xf1/0x1d0 [ 813.211908][T18237] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 813.211919][T18237] ? __pfx_netlink_sendmsg+0x10/0x10 [ 813.211935][T18237] __sock_sendmsg+0x219/0x270 [ 813.211958][T18237] ____sys_sendmsg+0x505/0x830 [ 813.211988][T18237] ? __pfx_____sys_sendmsg+0x10/0x10 [ 813.212027][T18237] ? import_iovec+0x74/0xa0 [ 813.212038][T18237] ___sys_sendmsg+0x21f/0x2a0 [ 813.212053][T18237] ? __pfx____sys_sendmsg+0x10/0x10 [ 813.212092][T18237] ? __fget_files+0x2a/0x420 [ 813.212117][T18237] ? __fget_files+0x3a0/0x420 [ 813.212151][T18237] __x64_sys_sendmsg+0x19b/0x260 [ 813.212174][T18237] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 813.212192][T18237] ? __pfx_ksys_write+0x10/0x10 [ 813.212204][T18237] ? rcu_is_watching+0x15/0xb0 [ 813.212217][T18237] ? do_syscall_64+0xbe/0x3b0 [ 813.212234][T18237] do_syscall_64+0xfa/0x3b0 [ 813.212263][T18237] ? lockdep_hardirqs_on+0x9c/0x150 [ 813.212284][T18237] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 813.212302][T18237] ? clear_bhb_loop+0x60/0xb0 [ 813.212322][T18237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 813.212338][T18237] RIP: 0033:0x7f798c58ebe9 [ 813.212353][T18237] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 813.212367][T18237] RSP: 002b:00007f798d4a2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 813.212384][T18237] RAX: ffffffffffffffda RBX: 00007f798c7b5fa0 RCX: 00007f798c58ebe9 [ 813.212397][T18237] RDX: 000000000404c0c0 RSI: 0000200000000040 RDI: 0000000000000003 [ 813.212409][T18237] RBP: 00007f798d4a2090 R08: 0000000000000000 R09: 0000000000000000 [ 813.212419][T18237] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 813.212429][T18237] R13: 00007f798c7b6038 R14: 00007f798c7b5fa0 R15: 00007f798c8dfa28 [ 813.212454][T18237] [ 813.948634][T18235] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3312'. [ 814.118921][T18243] netlink: 'syz.2.3315': attribute type 1 has an invalid length. [ 814.202117][T18243] 8021q: adding VLAN 0 to HW filter on device bond2 [ 814.225827][T18247] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 814.235155][T18247] batadv_slave_1: entered promiscuous mode [ 814.256459][T18243] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3315'. [ 814.267451][T18247] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 814.357508][T18247] bond2: (slave batadv_slave_1): making interface the new active one [ 814.427024][T18247] bond2: (slave batadv_slave_1): Enslaving as an active interface with an up link [ 814.770164][T18251] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3316'. [ 814.972972][T16425] usb 4-1: Sierra USB modem converter now attached to ttyUSB0 [ 814.995244][T16425] usb 4-1: Sierra USB modem converter now attached to ttyUSB1 [ 815.123680][T16425] usb 4-1: USB disconnect, device number 66 [ 815.445889][T16425] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 815.478717][T16425] sierra ttyUSB1: Sierra USB modem converter now disconnected from ttyUSB1 [ 815.514251][T16425] sierra 4-1:0.3: device disconnected [ 815.764418][T18260] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 816.355154][T18272] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3320'. [ 818.235872][T18291] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3324'. [ 819.182485][T16425] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 819.307137][T18304] netlink: 'syz.1.3327': attribute type 4 has an invalid length. [ 819.319700][T18304] netlink: 'syz.1.3327': attribute type 4 has an invalid length. [ 819.322578][T16425] usb 4-1: device descriptor read/64, error -71 [ 819.612479][T16425] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 819.762592][T16425] usb 4-1: device descriptor read/64, error -71 [ 819.872819][T16425] usb usb4-port1: attempt power cycle [ 820.222520][T16425] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 820.268064][T18321] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3333'. [ 820.273488][T16425] usb 4-1: device descriptor read/8, error -71 [ 820.582539][T16425] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 820.613250][T16425] usb 4-1: device descriptor read/8, error -71 [ 820.652505][ T5504] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 820.723066][T16425] usb usb4-port1: unable to enumerate USB device [ 820.814219][ T5504] usb 3-1: config 0 has an invalid descriptor of length 213, skipping remainder of the config [ 820.862503][ T5504] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 820.936398][ T5504] usb 3-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 820.947318][ T5504] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 820.985949][ T5504] usb 3-1: Product: syz [ 820.997055][ T5504] usb 3-1: Manufacturer: syz [ 821.001795][ T5504] usb 3-1: SerialNumber: syz [ 821.031630][ T5504] usb 3-1: config 0 descriptor?? [ 821.124872][ T5504] usb 1-1: USB disconnect, device number 23 [ 821.432114][ T5504] usb 3-1: USB disconnect, device number 19 [ 821.582730][T16425] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 821.712472][T16425] usb 5-1: device descriptor read/64, error -71 [ 821.922295][T18372] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3347'. [ 821.954105][T16425] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 822.092552][T16425] usb 5-1: device descriptor read/64, error -71 [ 822.222767][T16425] usb usb5-port1: attempt power cycle [ 822.412517][ T5930] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 822.802614][ T5930] usb 4-1: Using ep0 maxpacket: 16 [ 822.809600][ T5930] usb 4-1: config 0 has an invalid descriptor of length 125, skipping remainder of the config [ 822.820782][ T5930] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 822.832648][T16425] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 822.855535][T16425] usb 5-1: device descriptor read/8, error -71 [ 822.881706][ T5930] usb 4-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice=49.f8 [ 822.899790][ T5930] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 822.941132][ T5930] usb 4-1: Product: syz [ 822.956522][ T5930] usb 4-1: Manufacturer: syz [ 822.970253][ T5930] usb 4-1: SerialNumber: syz [ 823.025940][ T5930] usb 4-1: config 0 descriptor?? [ 823.031061][ C0] [ 823.031073][ C0] ============================= [ 823.031080][ C0] [ BUG: Invalid wait context ] [ 823.031092][ C0] 6.16.0-syzkaller-11852-g479058002c32 #0 Not tainted [ 823.031102][ C0] ----------------------------- [ 823.031109][ C0] kworker/0:4/5930 is trying to lock: [ 823.031118][ C0] ffff88805a74d410 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1fb/0x9b0 [ 823.031164][ C0] other info that might help us debug this: [ 823.031171][ C0] context-{2:2} [ 823.031180][ C0] 7 locks held by kworker/0:4/5930: [ 823.031190][ C0] #0: ffff8881446afd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 823.031233][ C0] #1: ffffc90004c3fbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 823.031272][ C0] #2: ffff8881457e9198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a20 [ 823.031312][ C0] #3: ffff88807a847198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 823.031356][ C0] #4: ffffffff8e12e180 (console_lock){+.+.}-{0:0}, at: dev_vprintk_emit+0x337/0x3f0 [ 823.031399][ C0] #5: ffffffff8e015a50 (console_srcu){....}-{0:0}, at: console_flush_all+0x13a/0xc40 [ 823.031440][ C0] #6: ffff88805a74d960 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1c3/0x9b0 [ 823.031481][ C0] stack backtrace: [ 823.031491][ C0] CPU: 0 UID: 0 PID: 5930 Comm: kworker/0:4 Not tainted 6.16.0-syzkaller-11852-g479058002c32 #0 PREEMPT(full) [ 823.031512][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 823.031522][ C0] Workqueue: usb_hub_wq hub_event [ 823.031539][ C0] Call Trace: [ 823.031545][ C0] [ 823.031552][ C0] dump_stack_lvl+0x189/0x250 [ 823.031573][ C0] ? __pfx_dump_stack_lvl+0x10/0x10 [ 823.031590][ C0] ? __pfx__printk+0x10/0x10 [ 823.031612][ C0] ? print_lock_name+0xde/0x100 [ 823.031633][ C0] __lock_acquire+0xbcb/0xd20 [ 823.031657][ C0] ? kvm_xen_set_evtchn_fast+0x1fb/0x9b0 [ 823.031672][ C0] lock_acquire+0x120/0x360 [ 823.031693][ C0] ? kvm_xen_set_evtchn_fast+0x1fb/0x9b0 [ 823.031713][ C0] _raw_read_lock_irqsave+0xaf/0x100 [ 823.031733][ C0] ? kvm_xen_set_evtchn_fast+0x1fb/0x9b0 [ 823.031748][ C0] ? __pfx__raw_read_lock_irqsave+0x10/0x10 [ 823.031764][ C0] ? xa_load+0x1ea/0x210 [ 823.031786][ C0] kvm_xen_set_evtchn_fast+0x1fb/0x9b0 [ 823.031802][ C0] ? do_raw_spin_unlock+0x122/0x240 [ 823.031822][ C0] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 823.031839][ C0] ? kvm_xen_set_evtchn_fast+0x1c3/0x9b0 [ 823.031855][ C0] xen_timer_callback+0x109/0x220 [ 823.031872][ C0] ? __pfx_xen_timer_callback+0x10/0x10 [ 823.031896][ C0] __hrtimer_run_queues+0x4e0/0xc60 [ 823.031918][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 823.031934][ C0] ? read_tsc+0x9/0x20 [ 823.031959][ C0] hrtimer_interrupt+0x45b/0xaa0 [ 823.031985][ C0] __sysvec_apic_timer_interrupt+0x108/0x410 [ 823.032005][ C0] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 823.032023][ C0] [ 823.032029][ C0] [ 823.032034][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 823.032052][ C0] RIP: 0010:console_flush_all+0x7f7/0xc40 [ 823.032072][ C0] Code: 48 21 c3 0f 85 e9 01 00 00 e8 35 49 1f 00 48 8b 5c 24 20 4d 85 f6 75 07 e8 26 49 1f 00 eb 06 e8 1f 49 1f 00 fb 48 8b 44 24 28 <42> 80 3c 20 00 74 08 48 89 df e8 aa b3 82 00 48 8b 1b 48 8b 44 24 [ 823.032088][ C0] RSP: 0018:ffffc90004c3eb20 EFLAGS: 00000283 [ 823.032103][ C0] RAX: 1ffffffff1d3610b RBX: ffffffff8e9b0858 RCX: 0000000000100000 [ 823.032116][ C0] RDX: ffffc90019c76000 RSI: 000000000001dfca RDI: 000000000001dfcb [ 823.032127][ C0] RBP: ffffc90004c3ec70 R08: ffffffff8fa34137 R09: 1ffffffff1f46826 [ 823.032139][ C0] R10: dffffc0000000000 R11: fffffbfff1f46827 R12: dffffc0000000000 [ 823.032152][ C0] R13: 0000000000000001 R14: 0000000000000200 R15: ffffffff8e9b0800 [ 823.032172][ C0] ? console_flush_all+0x13a/0xc40 [ 823.032192][ C0] ? __pfx_console_flush_all+0x10/0x10 [ 823.032212][ C0] ? number+0x41/0xf60 [ 823.032229][ C0] ? is_printk_cpu_sync_owner+0x32/0x40 [ 823.032250][ C0] console_unlock+0xc4/0x270 [ 823.032268][ C0] ? __pfx_console_unlock+0x10/0x10 [ 823.032285][ C0] ? is_printk_cpu_sync_owner+0x32/0x40 [ 823.032307][ C0] vprintk_emit+0x5b7/0x7a0 [ 823.032322][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 823.032336][ C0] ? __pfx_snprintf+0x10/0x10 [ 823.032353][ C0] dev_vprintk_emit+0x337/0x3f0 [ 823.032370][ C0] ? kernfs_new_node+0x102/0x210 [ 823.032387][ C0] ? __pfx_dev_vprintk_emit+0x10/0x10 [ 823.032403][ C0] ? __device_attach_driver+0x2ce/0x530 [ 823.032420][ C0] ? idr_get_free+0x8dc/0xa70 [ 823.032439][ C0] dev_printk_emit+0xe0/0x130 [ 823.032456][ C0] ? idr_alloc_u32+0x1b7/0x2d0 [ 823.032473][ C0] ? __pfx_dev_printk_emit+0x10/0x10 [ 823.032493][ C0] ? __dev_printk+0x131/0x190 [ 823.032507][ C0] _dev_warn+0x10a/0x160 [ 823.032525][ C0] ? __pfx__dev_warn+0x10/0x10 [ 823.032545][ C0] usb_set_configuration+0x1f1e/0x20e0 [ 823.032563][ C0] ? up_write+0x1c4/0x420 [ 823.032579][ C0] ? usb_device_is_owned+0xc9/0x210 [ 823.032598][ C0] ? usb_choose_configuration+0x8e0/0xbc0 [ 823.032616][ C0] usb_generic_driver_probe+0x8d/0x150 [ 823.032631][ C0] usb_probe_device+0x1c1/0x390 [ 823.032648][ C0] ? __pfx_usb_probe_device+0x10/0x10 [ 823.032662][ C0] really_probe+0x26a/0x9e0 [ 823.032678][ C0] __driver_probe_device+0x18c/0x2f0 [ 823.032700][ C0] driver_probe_device+0x4f/0x430 [ 823.032716][ C0] __device_attach_driver+0x2ce/0x530 [ 823.032731][ C0] bus_for_each_drv+0x251/0x2e0 [ 823.032750][ C0] ? __pfx___device_attach_driver+0x10/0x10 [ 823.032766][ C0] ? __pfx_bus_for_each_drv+0x10/0x10 [ 823.032787][ C0] __device_attach+0x2b8/0x400 [ 823.032811][ C0] ? __pfx___device_attach+0x10/0x10 [ 823.032834][ C0] ? do_raw_spin_unlock+0x122/0x240 [ 823.032854][ C0] bus_probe_device+0x185/0x260 [ 823.032873][ C0] device_add+0x7b6/0xb50 [ 823.032905][ C0] usb_new_device+0xa39/0x16f0 [ 823.032928][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 823.032948][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 823.032965][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 823.032984][ C0] hub_event+0x2958/0x4a20 [ 823.033016][ C0] ? __pfx_hub_event+0x10/0x10 [ 823.033031][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 823.033047][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 823.033063][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 823.033076][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 823.033091][ C0] process_scheduled_works+0xade/0x17b0 [ 823.033113][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 823.033141][ C0] worker_thread+0x8a0/0xda0 [ 823.033158][ C0] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 823.033179][ C0] ? __kthread_parkme+0x7b/0x200 [ 823.033200][ C0] kthread+0x70e/0x8a0 [ 823.033219][ C0] ? __pfx_worker_thread+0x10/0x10 [ 823.033236][ C0] ? __pfx_kthread+0x10/0x10 [ 823.033255][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 823.033270][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 823.033284][ C0] ? __pfx_kthread+0x10/0x10 [ 823.033303][ C0] ret_from_fork+0x3fc/0x770 [ 823.033320][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 823.033338][ C0] ? __switch_to_asm+0x39/0x70 [ 823.033356][ C0] ? __switch_to_asm+0x33/0x70 [ 823.033375][ C0] ? __pfx_kthread+0x10/0x10 [ 823.033393][ C0] ret_from_fork_asm+0x1a/0x30 [ 823.033418][ C0] [ 823.122747][T16425] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 823.783324][T16425] usb 5-1: device descriptor read/8, error -71 [ 823.892819][T16425] usb usb5-port1: unable to enumerate USB device [ 823.937429][T18390] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3348'. [ 825.170883][ T5930] usb 4-1: USB disconnect, device number 71