last executing test programs: 11m52.970108295s ago: executing program 4 (id=531): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@bridge_newneigh={0x28, 0x1c, 0x401, 0x70bd28, 0x25dfdbfd, {0x7, 0x0, 0x0, r1, 0x2, 0xaf, 0x1}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}]}, 0x28}, 0x1, 0x0, 0x0, 0x8011}, 0x24040040) (fail_nth: 1) 11m52.47654158s ago: executing program 4 (id=534): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, 0x0, 0x0) syz_fuse_handle_req(r0, 0x0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000740)={0x2c, &(0x7f0000000980)=ANY=[@ANYBLOB="0000000100000009"], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x901800, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$EVIOCSKEYCODE(r2, 0x40084504, &(0x7f00000002c0)=[0x0, 0x7]) 11m51.803526173s ago: executing program 4 (id=540): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x880c}, 0x890) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000180)="440f20c03505000000440f22c0f26df20f38f17a64b805000000b9e10d00000f01d9d8dd0f01728eb8010000000f01d94c0fc71d000000003ef245dbed410fc7f7", 0x41}], 0x1, 0x72, 0x0, 0x0) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$int_in(r3, 0x40000000af01, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) fcntl$dupfd(r3, 0x406, 0xffffffffffffffff) dup(0xffffffffffffffff) timer_create(0x0, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x26080, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0x1, 0x0, 0x0, 0x4, 0x0, 0x10, 0x1, 0x40, 0x2, 0x9, 0x3, 0x0, 0x0, 0x1049, 0x5, 0xff, 0xcf, 0xfe, '\x00', 0x70}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 11m51.273492857s ago: executing program 4 (id=541): r0 = epoll_create1(0x80000) r1 = signalfd4(0xffffffffffffffff, &(0x7f00000000c0)={[0x4452]}, 0x8, 0x800) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100)={0xc000000b}) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r3, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000007c0)={0x44, r4, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x0) unshare(0x26020480) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='.\x00', &(0x7f0000000000), 0x0, &(0x7f0000000080)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) 11m50.351884618s ago: executing program 4 (id=543): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007baaf8ff00000000b5090800000000007baaf0ff00000000bf8700000000000007070000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32=r0, @ANYBLOB="000000000000005685b2b100080000004600000076000000bf98000000000000b5080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 11m50.062491768s ago: executing program 4 (id=544): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@bridge_newneigh={0x28, 0x1c, 0x401, 0x70bd28, 0x25dfdbfd, {0x7, 0x0, 0x0, r1, 0x2, 0xaf, 0x1}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}]}, 0x28}, 0x1, 0x0, 0x0, 0x8011}, 0x24040040) (fail_nth: 2) 11m49.429689187s ago: executing program 32 (id=544): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@bridge_newneigh={0x28, 0x1c, 0x401, 0x70bd28, 0x25dfdbfd, {0x7, 0x0, 0x0, r1, 0x2, 0xaf, 0x1}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}]}, 0x28}, 0x1, 0x0, 0x0, 0x8011}, 0x24040040) (fail_nth: 2) 11m24.294349484s ago: executing program 0 (id=623): openat$binderfs(0xffffffffffffff9c, 0x0, 0x1802, 0x0) prctl$PR_GET_NAME(0x10, &(0x7f0000000000)=""/144) prctl$PR_GET_NAME(0x10, &(0x7f00000000c0)=""/244) syz_usb_connect$cdc_ncm(0x2, 0x178, &(0x7f0000000080)=ANY=[@ANYBLOB="12011103020000082505a1a440000102030109026601020105002f0904000001020d00000524060001052400302f0d240f010400000004000dff0506241a04002f07240af90b05ac032412fc5fcb738b3aba21964701c6ceddddc76c11a6bc9d8f1bff16561e63418599374d993a13072e6e9961747efead1ea643b157be4af9e7f5111633f529577d4434fd05ca3a5fcd98fc4f505ded7f78425fba0c72a061ad38f98ad20a7446f014291eda8740aa3d977d5751bc8c561dad87b83a3d629f38c6ad3dee3250a72b999e4f73015a241a0986ee2bae0a4c3d0126d791e8ddbec556c4e0203cd5c62228e93274de2daf3a80602e1530bf9f55f0ea500afb510677e1c774221d3306000000000000009e0da492871a0378133e1dd2f834cf2b8367352cd7cc638041535821bc038d72d9f1a0f5d641869ddaef4d6a76e85262a165a86f04c5257d2218"], &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0}) socket(0x80000000000000a, 0x2, 0x0) capset(0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 11m22.391330002s ago: executing program 0 (id=626): ioctl$KDDISABIO(0xffffffffffffffff, 0x4b37) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf2, 0x30, 0x39, 0x20, 0x2c42, 0x1202, 0x8540, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc, 0x2, 0x2, 0xc1, 0x7f, 0xc, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) socket$inet(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="01000000050000000200000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000540)={{r2}, &(0x7f00000004c0), &(0x7f0000000500)='%+9llu \x00'}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000180)=r3, 0x4) sendmsg$inet(r5, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) select(0x40, &(0x7f0000000240)={0x3, 0x5, 0xb96, 0x1, 0x1, 0x9, 0x6, 0x400}, 0x0, &(0x7f0000000340)={0xa, 0x2536, 0xffffffffffff0001, 0x9, 0x1, 0x29e, 0x10000, 0x8}, &(0x7f0000000380)={0x0, 0x2710}) sendmsg$NFT_BATCH(r1, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000e00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x8}}, @NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x14, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x5}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x90}, 0x1, 0x0, 0x0, 0x4000}, 0x4) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r6, 0x7a7, &(0x7f00000000c0)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r6, 0x7a0, &(0x7f0000000100)={@host}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r6, 0x7cb, &(0x7f0000000140)={&(0x7f0000001080)={{@my=0x0}, {@host}, 0x400, "4145fdc5fec7663a106cef95c8d86f03d655b82e62dc5204ff06732791d90936bf31f7b4eafad3ed43e8da42de6780edce2e2f941399c9b9002a6a538fc1ebd3e994ce6fa4a67c775c476cdbedebbe34904cbe0d5808cf5892aa1e563f949f38cd2ebaa2c46464183ead798b1af0ba7ad5db77736a5329e7297e674242854f87ef03b0fba724523033529e64be44188740b9e9a0ba6944e9724c4aaa8470ab8d35a1746a1da4dfa2112cb5135d97efae0975e7fa5e421fe7ec12a8bbd7714076b63ddaca822d7c0383ccc4e21b11c8a0443850c05f4bb6716b6ba83016b709b44a9959c44daa717ed76b43f7c235fae47730ff2d435ed29d062451ab74bd9f65d9bf96e1afc645ca2249c89146fc815210d465ca0ede0acbfe1165b15d222ed668b79b14f901178d35e7421637588c887b0f2335ea84a442fc95bbcf0ea3b308ee18d913901cb8f40dd2798e781c4b1c620c23565b5bc18e25c206f772c863c8a8864f460c239033717d41f94fbf13b1d0c7271364bd6d144160e1df33fcb33e5d45a5e7ea4264d089397d7e022c6e1f37a2e464c01b4df6a906d3a46d9432ba1966d73aa0627491e3b3c33bee03ff2138896b64862910f24dbacc3c686e0059ff5915c8b69bce3c4022c5c80d574274d1107c9935898ae444a6c38dbd8319e778e1a86a293094bd98d0ae3ae2c32a4bcb20e0517c03e7b46839f4e3601ff98244ca5485cacbfe53c935cf14038bba908af19834a86b56cf68a7170448a434b55d66c080ea095b02ba4c3f8ba492c9e50111bf1b3085cc0f3938a58609a337e89eba9271ee071a8b9f3ab4ad0fc3c92a48cb6bc63ed74877d8425c88eb40d18c6260d2221dc295d1fa1557cfcfe1cb3a1d61b4b1235e28903ae5a4d3d358f6d3e2c87b110e38aab0fd1ca2c047b3ea826d8cd9b980b3fc64fbf38d0d3fed0057b30612880a3d93aa3e16e1c1902cc8c206d7732f426fbb063b020a03d08e3bcd4ff32c30c8ea424ea0c746e72c23e8d53576cc801bdf82f8bba865074e5dde3177820c24be87b9bd36e30a81d1d50b5aa0628262d46d19060ae37a33aa8e515fed3f8bfdf65ba5f8e11e4d517a50ce03f82bc5b3c8e9b3eb6572f1a686430170ce64bc1a61246fd99b2d8a3215104478eead271fcca07bc66e637d5543ad47147f5ad50cc5a203a37b7d2f67bb0387ae189ee7d5cfc0a421b0f0e6286aaf28a3eadfad1b8c83a26ac0a1d4a3846d93e161c82be100278d94e35fc7b5f1feb833f1b975adb33bec5d777cfbdb2c5fe171e205fd6596b37ba646b9ecb163fabcd89a469f6ad539a80937748105298b0a6364d75c6de3cbcbb96c440d5489f3f47149551e7f53d3a22d837cfb59c3e43f0c95760791ed36ff84ae82a679e4e062461bda5db7c27fb00c3238266734bc7c16d45ce7cd3f0b7e63c309877816048f24"}, 0x418, 0x6}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r7, 0xffffffffffffffff, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000c80)={0x34, &(0x7f00000003c0)=ANY=[@ANYBLOB="400b01000000e403d9011320f029307235a7d1e24b7b55c8987372ce122b843608f43a59f015a48e165e82ef291a88c6cba5afac5f2f642e50c269dadd1b32654be42cf3d2da7380"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000b80)={0x34, &(0x7f00000009c0)=ANY=[@ANYBLOB="ffff0100000024"], 0x0, 0x0, 0x0, 0x0, 0x0}) 11m19.162359184s ago: executing program 0 (id=638): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair(0x1e, 0x6, 0xfffffffa, &(0x7f0000000080)={0xffffffffffffffff}) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000000c0)={0x3, 0x1, 0x3, 0xffffff0a, 0x343}, 0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001c0001042cbd7000fddbdf2507000000", @ANYRES32=r2, @ANYBLOB="0200"/16], 0x28}, 0x1, 0x0, 0x0, 0x8011}, 0x24040040) 11m18.792254765s ago: executing program 0 (id=640): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x88101) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f0000000340)='./file0\x00', &(0x7f00000001c0)='./file0/../file0/../file0/../file0\x00') 11m18.405965074s ago: executing program 0 (id=641): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x0) dup(r1) r3 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x503, 0x0, 0xfffffffc, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) (async) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x503, 0x0, 0xfffffffc, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r5], 0x5c}}, 0x40) syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) (async) r6 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r6, 0x0, &(0x7f0000000600)={0x34, &(0x7f0000000fc0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$lan78xx(r6, 0x0, &(0x7f0000000600)={0x34, &(0x7f0000000fc0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r6, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000640)={0x40, 0x13}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$lan78xx(r6, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000640)={0x40, 0x13}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r6, 0x0, 0x0) (async) syz_usb_control_io$lan78xx(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, &(0x7f0000000540)={0x84, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r6, 0x0, &(0x7f0000003880)={0x34, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r6, 0x0, &(0x7f0000000a40)={0x34, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000180)=ANY=[@ANYBLOB="202f000000004ae6633ab6778c335eceb7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r6, 0x0, 0x0) syz_usb_control_io$lan78xx(r6, 0x0, 0x0) (async) syz_usb_control_io$lan78xx(r6, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r8) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) (async) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r9], 0x3c}}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="120100002add1e4a25bf7a20ef050a023691010203010000000904fffffffff7ffffff0803000000000009050700000000000000000000000000b1dce820687535e3fc471c2a29d921401ec82740bc68992b48289d8effa83ad1a8e0a91d078b2e4720766b16552343c01a6af1b02f3f45e1897d1916ae5105d5f8e10552bef75eaa3941876096bdda460765322a518a72f1cff3e726f27cfd807e833eb5aad1a725058c3f4224a6a3200ed5dd76e0fbdd644eda3078f10a5ff77d0e49d81159ff558d8bd04144a022f0303683eafa42ed28d3ca8c88a279f0798369ad5cf9b3475e7e8b1c5e6ad82846c019"], 0x0) (async) syz_usb_connect(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="120100002add1e4a25bf7a20ef050a023691010203010000000904fffffffff7ffffff0803000000000009050700000000000000000000000000b1dce820687535e3fc471c2a29d921401ec82740bc68992b48289d8effa83ad1a8e0a91d078b2e4720766b16552343c01a6af1b02f3f45e1897d1916ae5105d5f8e10552bef75eaa3941876096bdda460765322a518a72f1cff3e726f27cfd807e833eb5aad1a725058c3f4224a6a3200ed5dd76e0fbdd644eda3078f10a5ff77d0e49d81159ff558d8bd04144a022f0303683eafa42ed28d3ca8c88a279f0798369ad5cf9b3475e7e8b1c5e6ad82846c019"], 0x0) 11m18.190515908s ago: executing program 0 (id=643): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x54, 0x8001, 0x0, 0x9, 0xf66f, 0x6, 0x800, 0xffffffc0}, 0x0) ioctl$BTRFS_IOC_GET_FEATURES(r1, 0x80189439, &(0x7f0000000100)) quotactl_fd$Q_GETINFO(r0, 0xffffffff80000502, 0x0, &(0x7f0000000380)) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c000000020601080000000000000000000000400500010006200000050005000a00000005000400000000000900020073797a310000000011000300686173683a69702c6d61726b"], 0x4c}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, 0x0, 0x4000080) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000000306250000a62a6ebcb23a68d100000005"], 0x1c}}, 0xc855) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x143240, 0x0) r6 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000700)=ANY=[@ANYBLOB="fc010000", @ANYRES16=0x0, @ANYBLOB="000428bd7000fcdbdf25460000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008ef000a1f787ec00000000000c008f0006000000000000000c009000db070000000000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008e000200000000008f00df0b000000001e000c00900005000200303030303a30303a31302e300000000008008e00030000000c008f00ff070000000000000c0090000000000000000000080001007063690011000200303030303a30303a31302e300000000008008e00000000000c008f000e000000000000000c0090000100000000000000080001007063690011000200303030303a30303a31302e300000000008008e00000000000c008f00e50d0000000000000c0090000100000000000000080001007063690011000200303030303a30303a31302e300000000008008e00000000000c008f0081480000000000000c0090004000410000000000080001007063690011000200303030303a30303a310008008e00000000000c008f0007000000000000000c0090000200000000000000080001007063690011000200303030303a30303a31302e300000000008008e00020000000c008f0000000000000000000c00900009000000000000000000000000008be8642f8e95851016c67d567fe36c7ac59822f279b9a1c77254f891f87318"], 0x1fc}, 0x1, 0x0, 0x0, 0x44000}, 0x44014) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0x5) r7 = dup(r6) ioctl$SIOCSIFHWADDR(r7, 0x8926, &(0x7f0000002640)={'dvmrp1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}}) 11m17.551777586s ago: executing program 33 (id=643): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x54, 0x8001, 0x0, 0x9, 0xf66f, 0x6, 0x800, 0xffffffc0}, 0x0) ioctl$BTRFS_IOC_GET_FEATURES(r1, 0x80189439, &(0x7f0000000100)) quotactl_fd$Q_GETINFO(r0, 0xffffffff80000502, 0x0, &(0x7f0000000380)) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c000000020601080000000000000000000000400500010006200000050005000a00000005000400000000000900020073797a310000000011000300686173683a69702c6d61726b"], 0x4c}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, 0x0, 0x4000080) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000000306250000a62a6ebcb23a68d100000005"], 0x1c}}, 0xc855) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x143240, 0x0) r6 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000700)=ANY=[@ANYBLOB="fc010000", @ANYRES16=0x0, @ANYBLOB="000428bd7000fcdbdf25460000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008ef000a1f787ec00000000000c008f0006000000000000000c009000db070000000000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008e000200000000008f00df0b000000001e000c00900005000200303030303a30303a31302e300000000008008e00030000000c008f00ff070000000000000c0090000000000000000000080001007063690011000200303030303a30303a31302e300000000008008e00000000000c008f000e000000000000000c0090000100000000000000080001007063690011000200303030303a30303a31302e300000000008008e00000000000c008f00e50d0000000000000c0090000100000000000000080001007063690011000200303030303a30303a31302e300000000008008e00000000000c008f0081480000000000000c0090004000410000000000080001007063690011000200303030303a30303a310008008e00000000000c008f0007000000000000000c0090000200000000000000080001007063690011000200303030303a30303a31302e300000000008008e00020000000c008f0000000000000000000c00900009000000000000000000000000008be8642f8e95851016c67d567fe36c7ac59822f279b9a1c77254f891f87318"], 0x1fc}, 0x1, 0x0, 0x0, 0x44000}, 0x44014) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0x5) r7 = dup(r6) ioctl$SIOCSIFHWADDR(r7, 0x8926, &(0x7f0000002640)={'dvmrp1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}}) 9.622286836s ago: executing program 1 (id=3448): syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009c323f08a504033007c8d1b93c010902120011000200000904"], 0x0) (async) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009c323f08a504033007c8d1b93c010902120011000200000904"], 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0, 0x0}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0x6000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0x6000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CREATE_DEVICE(r2, 0xc018aec0, &(0x7f00000000c0)={0x1}) syz_usb_control_io$printer(r0, &(0x7f0000000140)={0x14, &(0x7f0000000080)={0x40, 0x21, 0x3d, {0x3d, 0xc, "ad1ff1d396b71f9c752356f2bd277beffc3cdb6b74298b1e3a0c661c7638888008bd1fe0b34bfc6c7b685e10a2f918f6792ea60568f41a63c57618"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2009}}}, &(0x7f00000003c0)={0x34, &(0x7f0000000200)={0x40, 0xd, 0x7c, "795948c4e65ff231e304f256c5f128fdac67a3dbc42098f757cc92f4510f028a37c879edbc478c7e2c5f159b30969a5ddc1a17c1a045162630448729600631d2d3a329479f97bce120f5f0f022526c9754d0ee9085dafd0c9c7b03c028862485576cf4e14f0384714b28ac22743029695415e2b17a6024129e6050ba"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000300)={0x20, 0x0, 0x27, {0x25, "d00b4a5b9477cee57e42db1b3aff1c96f2c24bf1df883087c0440bff35369cdb43fcc97651"}}, &(0x7f0000000340)={0x20, 0x1, 0x1, 0xb}, &(0x7f0000000380)={0x20, 0x0, 0x1}}) (async) syz_usb_control_io$printer(r0, &(0x7f0000000140)={0x14, &(0x7f0000000080)={0x40, 0x21, 0x3d, {0x3d, 0xc, "ad1ff1d396b71f9c752356f2bd277beffc3cdb6b74298b1e3a0c661c7638888008bd1fe0b34bfc6c7b685e10a2f918f6792ea60568f41a63c57618"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2009}}}, &(0x7f00000003c0)={0x34, &(0x7f0000000200)={0x40, 0xd, 0x7c, "795948c4e65ff231e304f256c5f128fdac67a3dbc42098f757cc92f4510f028a37c879edbc478c7e2c5f159b30969a5ddc1a17c1a045162630448729600631d2d3a329479f97bce120f5f0f022526c9754d0ee9085dafd0c9c7b03c028862485576cf4e14f0384714b28ac22743029695415e2b17a6024129e6050ba"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000300)={0x20, 0x0, 0x27, {0x25, "d00b4a5b9477cee57e42db1b3aff1c96f2c24bf1df883087c0440bff35369cdb43fcc97651"}}, &(0x7f0000000340)={0x20, 0x1, 0x1, 0xb}, &(0x7f0000000380)={0x20, 0x0, 0x1}}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x470d0, 0x40}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048090}, 0x8000) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 9.033174593s ago: executing program 6 (id=3455): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x5, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000280)={0x79, 0x0, 0x588}) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) (async) r3 = socket$inet6(0xa, 0x3, 0x5) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) (async) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_open_dev$sndctrl(0x0, 0x0, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/stat\x00', 0x0, 0x0) r7 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) (async) syz_io_uring_submit(r8, r9, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x4007, @fd=r6, 0xffffffffffffffff, &(0x7f0000000580)=""/207, 0xcf, 0x2, 0x1}) (async) io_uring_enter(r7, 0x627, 0x4c1, 0x43, 0x0, 0x30) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000680)=ANY=[@ANYBLOB="1c0000003e00cc64fb0701feffffff0000000008004280049948ee650ef393d2970248a1a9b045925f07327a5f27d398b053acb82345bc780400426a969922e56d361153fa51cc7ebaaa0258edd830a0ceb01574292b2aa1b75cc20ad841476e0eef23c67dbf225165ef60a2fb71a25a3ed2c45a74de8cbfd1091bc17f2267e8c992edac66ea9032aff1dcf6893c4e45c0d92bd51bea00000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4000c000}, 0xc000) (async) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x5f, 0x7ffc0002}]}) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r11, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000740)=ANY=[@ANYBLOB="1c0000005e00010000000000fddbdf25080000000100000004000080d19178e89fb1bdfba67eb713576d6bc4a9a966a0effbd55dbe076beef948c4497c84020bb6c7c360e4b791d57145a6c9252354491f1eda6e12380185fc6a796b34df75c4f7654dcd876a5c2f6fe55e3601914fed382c5f16667779d07728f80b7b8cf2049f09c271e5dade7caa4b01272254030d088564614415d3d3e924ffd21b2ec71877cd666ffeac7b70bf332c90b055304d7647639311b5b42123fa66c5f569968fe17bb48b503600560f250e6521251e681e4f661bd106191c52c74596930042d1c504ace88eafa3e7e4349991"], 0x1c}], 0x1}, 0x0) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c0000002d00090027bd700000000000040000000800180001ac0f0069aff4315b1ffe4bd845f454c918cabbb8d845d5e6b3ec4017cc91ac9b16e83b22014b7a32165f433742a8fe40576a7ce1ff41e062bf98573d45c3ecbedbd09336cb0b9776ae2bc0eebdb24833d338297614b09e5aa38fe05cc529b8a3eb234c6282e25d0a41b9ceb8"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) (async) sendmmsg(r3, 0x0, 0x0, 0x4000000) socket$inet(0x2, 0x1, 0x100) 8.814191966s ago: executing program 6 (id=3456): userfaultfd(0x801) r0 = socket(0x2b, 0x1, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x75, 0x0, 0x0, 0xb49, 0x1, 0x5b80a855, 0x7, 0x84}, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, 0x0, 0x0) brk(0x400000ffc000) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882) syz_io_uring_setup(0x62ce, &(0x7f00000003c0)={0x0, 0xa6b1, 0x8000, 0x2, 0xffffffff}, &(0x7f00000000c0)=0x0, &(0x7f0000000380)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r3, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)=""/4, 0x4}], 0x1}) writev(r3, &(0x7f0000001800)=[{&(0x7f00000001c0)='*', 0x1}], 0x1) io_uring_enter(0xffffffffffffffff, 0x1641, 0x3fffffff, 0x60, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@loopback={0x600}, 0x8000000, 0x0, 0xff, 0x0, 0x4}, 0x20) r6 = socket$inet_udp(0x2, 0x2, 0x0) futex(0xfffffffffffffffc, 0x9, 0x4, 0x0, 0x0, 0x1) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x2000000000000025, 0x0, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r9 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_S_FMT(r9, 0xc0d05605, &(0x7f0000000180)={0xa, @pix_mp={0x0, 0x7, 0x32314d4e, 0x7, 0x0, [{}, {0xffffffff, 0x3}, {0x4}, {}, {}, {}, {0x0, 0x140e}], 0x4e, 0x0, 0x5}}) r10 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r11, 0x4008ae89, &(0x7f00000006c0)=ANY=[@ANYBLOB="01000000000000008602"]) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000040)={'sit0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x8002, 0x10, 0x0, 0xb, {{0xa, 0x4, 0x0, 0x12, 0x28, 0x78, 0xfffc, 0x8, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x1f}, @local, {[@generic={0x83, 0x11, "676a1500db12bd5faa2d015559ebdd"}]}}}}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) 7.223220318s ago: executing program 6 (id=3461): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=@newqdisc={0x54, 0x24, 0xe0b, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x24, 0x2, {{0x1ff, 0x86, 0xfffffffd, 0x0, 0x5, 0x32d}, [@TCA_NETEM_ECN={0x8, 0x7, 0x1}]}}}]}, 0x54}}, 0x0) sendto$packet(r0, &(0x7f0000000580), 0x0, 0x0, &(0x7f0000000440)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @broadcast}, 0x14) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) 7.082342482s ago: executing program 6 (id=3462): r0 = socket$inet(0x2, 0x3, 0x4) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'team_slave_0\x00', 0x0}) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) fsopen(0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r6, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r8 = syz_io_uring_complete(0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r8, 0x4004af61, &(0x7f0000000280)) r9 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r9, 0xc004500a, &(0x7f0000000080)) ioctl$SNDCTL_DSP_SPEED(r9, 0xc0045002, &(0x7f0000000040)=0xdfe5) write$RDMA_USER_CM_CMD_CREATE_ID(r9, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) r10 = gettid() syz_clone3(&(0x7f0000000300)={0x24000080, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)=0x0, {0x27}, &(0x7f00000000c0)=""/180, 0xb4, &(0x7f0000000180)=""/149, &(0x7f0000000240)=[r10, r10], 0x2}, 0x58) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x37, 0x800000000004, @tid=r11}, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000540)={'\x00', 0x1000, 0x6, 0xe227, 0x5, 0x0, 0xffffffffffffffff}) sendmsg$nl_route_sched(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000012c0)=@newqdisc={0x74, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xe}, {0xffff, 0xffff}, {0xb, 0x1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x20, 0x2, {{0xac3, 0x2003ff, 0x8, 0x7, 0x30001, 0x1}, [@TCA_NETEM_LOSS={0x4}]}}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x6, 0x3, 0x82, 0x1, 0xff63, 0x218}}, {0x4}}]}]}, 0x74}}, 0x20000000) 6.476106225s ago: executing program 1 (id=3463): ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000280)={[0x4, 0x41592ee8, 0x8, 0x892000000000, 0x0, 0xe, 0x7, 0x401, 0x4, 0x3, 0x400, 0x7f, 0x3, 0xc, 0x8, 0x3ff], 0xdddd1000, 0x400}) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}}, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) syz_emit_ethernet(0x46, &(0x7f00000011c0)={@link_local, @random="ece65fbcee55", @void, {@ipv6={0x86dd, @dccp_packet={0xb, 0x6, "8519e7", 0x10, 0x21, 0xff, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, {[], {{0x4e20, 0x4e23, 0x4, 0x1, 0x6, 0x0, 0x0, 0xa, 0x1, "7612f3", 0x3, "c5db0d"}}}}}}}, 0x0) 6.221049473s ago: executing program 1 (id=3465): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYRESHEX=r0], 0x7c}}, 0x0) r1 = socket$inet6(0xa, 0x3, 0xff) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$inet6(r1, &(0x7f0000000880)={0xa, 0x4e20, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x24}}, 0x6}, 0x1c) 5.793057794s ago: executing program 1 (id=3468): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x400000, 0x0) r2 = syz_open_dev$sg(&(0x7f00000001c0), 0x0, 0x40) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0xfffffffffffffffd, 0x6, 0xff, @scatter={0x0, 0x1200, 0x0}, &(0x7f00000000c0)="eaff48000000", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = memfd_secret(0x80000) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, 0x0) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000880), 0x3) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000500)={'macvtap0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaaaaaabb000008000300030000000a000400aaaaaaaab1aa000008000500", @ANYRES32=r3], 0x68}}, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x6}, {0xd}, {0x11, 0xf}}}, 0x24}}, 0x0) 5.314368017s ago: executing program 1 (id=3469): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r0, 0x0, 0xffdd) syz_usb_connect$cdc_ncm(0x0, 0x72, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) poll(&(0x7f0000000000)=[{r3, 0x2}, {r3}], 0x2, 0x2) write$UHID_INPUT(r3, &(0x7f0000001040)={0xc, {"a2e3ad21ed0d52f91b5d520887f70e06d038e7ff7fc6e5539b3272298b089b07081b4d090890e0878f0e1ac6e7049b334a959bfc9a240d2567f3988f7ef319520100ffe8d178708c523c921b1b9b39070d075d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08c05000000b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc825d8e524b2451138e495bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546850a27af9544ae15a7e454dea05918b4fd42513f000000000000000a3621c56cea8d20fa911a0c41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c9000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cfe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c198045651cf4778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdc80c47ee4f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2691491abf8ab9c015073014d9e08d4338b8780bdecd436cf0541e4505bc3a45237f104b962102de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78ff95b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd735892892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af0000807e0000000002d5676d95f160ec97b1ad94872c49cca16e9848e096c6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5407000000e3ad038f2211f1033195563c7f93cd54b9094f226e78b271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b4051db55e0510a6e4114a53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005008000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a6d8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546def271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652770711935f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f42f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efff07000000000000e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599af40005b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fd30d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb84d9a88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d705000000000000007940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca039bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7985d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678458fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000000000000000000000000bd700", 0x1000}}, 0x1006) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0xd, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000100)={0x2, @pix={0x0, 0xffff, 0x47524247, 0x7, 0x0, 0x4, 0xb}}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e21, 0x63, @loopback, 0x7}, 0x1c) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/fib_triestat\x00') preadv(r4, &(0x7f0000000080), 0x0, 0x83, 0x4) socket(0x2, 0x80805, 0x0) ioctl$int_in(r6, 0x5452, &(0x7f0000000140)=0x4) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r7, 0x0) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r8 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r8, 0x0, 0x0) 4.454237098s ago: executing program 2 (id=3472): r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x88842, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x4, 0x0, 0x7ffc0005}]}) futex(&(0x7f000000cffc), 0x5, 0x0, 0x0, &(0x7f0000048000), 0x24ffffff) sendmmsg$unix(r2, &(0x7f00000bd000), 0x0, 0x4002000) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x5, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f0000000500)=[@in={0x2, 0x4620, @remote}], 0x10) r3 = socket(0x2d, 0x2, 0x0) connect$qrtr(r3, &(0x7f0000000300)={0x2d, 0x0, 0x4001}, 0xc) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}]}, &(0x7f0000000180)=0x10) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000000c0)={r6, @in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, &(0x7f00000001c0)=0x9c) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000280)={r6, 0x10000}, &(0x7f0000000300)=0x8) r7 = socket$key(0xf, 0x3, 0x2) recvmmsg(r7, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x4b, &(0x7f0000000040)=0x4, 0x4) r8 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r8, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r8, 0x40505412, 0x0) sendmsg$key(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0216000002"], 0x10}}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYRES16=0x0], 0x1310}, 0x1, 0x0, 0x0, 0x20000044}, 0x84) syz_open_dev$vim2m(&(0x7f0000000100), 0x5, 0x2) 4.293930267s ago: executing program 3 (id=3473): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'geneve1\x00'}) sendmsg$nl_route(r2, 0x0, 0x0) 3.990439006s ago: executing program 3 (id=3475): ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000280)={[0x4, 0x41592ee8, 0x8, 0x892000000000, 0x0, 0xe, 0x7, 0x401, 0x4, 0x3, 0x400, 0x7f, 0x3, 0xc, 0x8, 0x3ff], 0xdddd1000, 0x400}) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}}, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) syz_emit_ethernet(0x46, &(0x7f00000011c0)={@link_local, @random="ece65fbcee55", @void, {@ipv6={0x86dd, @dccp_packet={0xb, 0x6, "8519e7", 0x10, 0x21, 0xff, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, {[], {{0x4e20, 0x4e23, 0x4, 0x1, 0x6, 0x0, 0x0, 0xa, 0x1, "7612f3", 0x3, "c5db0d"}}}}}}}, 0x0) 3.761729071s ago: executing program 3 (id=3476): syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) (async) socket(0xa, 0x3, 0x3a) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) syz_open_dev$ptys(0xc, 0x3, 0x1) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000240)='cubic', 0x9) (async) r3 = syz_open_dev$video(&(0x7f0000000080), 0x9, 0x0) ioctl$VIDIOC_S_PARM(r3, 0xc0cc5616, &(0x7f00000001c0)={0xd, @output}) (async) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_MPP(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="050f03000000000000000000a6000000000000", @ANYRES32=r6, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x0) (async) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r2, 0x0, 0x0, 0x10) (async) syz_open_procfs(0x0, &(0x7f0000000200)='net/snmp\x00') setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000000c0)='cubic', 0x9) syz_open_dev$vim2m(&(0x7f0000002c80), 0x3, 0x2) (async) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e20, 0x6, @empty, 0x400004}}, 0x100, 0x0, 0xfffffffe, 0x10000, 0x66, 0x1, 0x4}, 0xfffffffffffffd97) 3.739003836s ago: executing program 1 (id=3477): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf10b589acab030109021b00010000100009045902019b1e2a00090582020002000000"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r4 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) madvise(&(0x7f000072a000/0x4000)=nil, 0x4000, 0x4) (async) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r5}, 0x10) (async) bpf$MAP_CREATE(0x0, 0x0, 0x48) (async) sendmmsg$inet(r2, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private=0xa010102, @multicast1}}}], 0x20}}], 0x1, 0x0) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) (async) r7 = socket$netlink(0x10, 0x3, 0x0) writev(r7, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) (async) writev(r7, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f931", 0x38}], 0x1) (async, rerun: 64) r8 = socket$inet(0x2, 0x2, 0x0) (rerun: 64) setsockopt$inet_mreqn(r8, 0x0, 0x23, &(0x7f0000000740)={@loopback, @private=0xa010101}, 0xc) (async, rerun: 32) setsockopt$inet_msfilter(r8, 0x0, 0x29, &(0x7f0000000480)=ANY=[@ANYRESOCT=r2, @ANYRESHEX=r4, @ANYBLOB="e658b7677388c33fa87b916e49d42bfb0628286f88a14301934554dac71b51f66b6aa7d04c12c0359e46c630a2d37106c3bb664ba2077ba8af021974c805303f7806d97c717f91191cb77ad7ac20022d7541d9dc364241d6ae18f6057122639f86851b3885f3638449a898a1707ddc4378b36eefaf6cc5ff92c5842a6f4c53de00e16ad44f2875cf45f1e3c96e739ab544dbff08687a7f59722fce311f14e15ba534eaf474295848", @ANYRES32=r8, @ANYRESHEX=r1, @ANYRES16=r7, @ANYRES8=r2], 0x57) (async, rerun: 32) setsockopt$inet_mreqsrc(r6, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'syztnl2\x00', &(0x7f0000000180)={'sit0\x00', 0x0, 0x7, 0x8, 0xe48, 0x100, {{0xf, 0x4, 0x3, 0x3, 0x3c, 0x64, 0x0, 0x8, 0x0, 0x0, @empty, @multicast1, {[@timestamp_prespec={0x44, 0x4, 0x24, 0x3, 0x1}, @timestamp_prespec={0x44, 0x24, 0x48, 0x3, 0xa, [{@loopback, 0x1}, {@empty, 0x1}, {@empty, 0xb7be}, {@broadcast}]}]}}}}}) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x200000000000011, 0x2, 0x0) 3.448690807s ago: executing program 2 (id=3479): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c020000190001000000000001000000fe8800000000000000000000000001010000000000000000000000000000000100000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000400000000000000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000000000000000000000078ef00000000000000000000000000000000000000000000000000000000000084010500"], 0x23c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 3.33716901s ago: executing program 6 (id=3480): r0 = add_key(&(0x7f0000000440)='asymmetric\x00', 0x0, &(0x7f0000000000)="3080", 0x2, 0x0) r1 = socket$kcm(0x2b, 0x1, 0x0) r2 = epoll_create1(0x0) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) timer_create(0x2, 0x0, &(0x7f0000000100)=0x0) timer_delete(r4) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000080)={0x20000014}) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @empty}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000280)=@ethtool_ringparam={0x33, 0x7f, 0x20000a2e, 0x0, 0xe, 0x3, 0x2000000, 0x0, 0x3000000}}) keyctl$link(0x8, r0, r0) shutdown(r1, 0x1) 3.214382102s ago: executing program 2 (id=3481): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x15, 0x3, 'lc\x00', 0x1, 0x4, 0x8}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e21, 0x3, 'wrr\x00', 0x22, 0x81, 0x5}, {@dev={0xac, 0x14, 0x14, 0x3c}, 0x4e23, 0x4, 0x7, 0x12d61, 0x12d58}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) r3 = socket$kcm(0x10, 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_wakeup_irq', 0x0, 0xb) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) socket$inet(0x10, 0x3, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000000)='cubic', 0x6) sendto$inet(r6, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r6, &(0x7f0000000580)="17", 0xfdef, 0x10008095, 0x0, 0x0) sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x8d0) sendmsg$kcm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a00100000000280", 0x2a}, {&(0x7f0000000400)="6a6f8e5e", 0x4}], 0x2}, 0x0) 2.884178039s ago: executing program 5 (id=3483): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14002000100001"], 0x28}, 0x1, 0x0, 0x0, 0x4000040}, 0x10) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="12008864"], 0xfce) 2.441810742s ago: executing program 3 (id=3484): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r0) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010329bd7000fc02df25030000000800040001000000"], 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x64044000) ioctl$int_in(r0, 0x5421, &(0x7f0000000000)=0x8) sendmsg$TIPC_CMD_GET_LINKS(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x208}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x20, 0x70bd26, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0xc8000000}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20040000}, 0x4004050) 2.412600777s ago: executing program 5 (id=3485): socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = getpid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, &(0x7f0000000040)={0x1, &(0x7f0000000180)=[{0x6, 0x2, 0x0, 0x7ffffdbd}]}) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000140)='lp\x00', 0x3) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYRES16=r2, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b'], 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r3 = syz_pidfd_open(r1, 0x0) setns(r3, 0x8020000) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f00000000c0)=0x94a, 0x4) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000001dc0)=[{{&(0x7f00000002c0)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000940)=[{&(0x7f00000001c0)="bac5a18d36e3012ca151db45c3e62f95d0ee6d201969ab2b7e8c00e1bb2bf7f17d566e5caf50a5ca4ac544f9774c0e542b85a169cb205bbfbf99", 0x3a}, {&(0x7f0000000340)="3390650cad2adabc7addee78553a0afd018647e05e67ccffc13044e4e1370a1ce3cd4366575b71a093b5715f9e518bcbe3f60d18362f4d78e82b52566a5b150332c2f07961beaa70f0de62", 0x4b}, {&(0x7f00000003c0)="4d662d522dff4dc46078e6221c08bea05db8613fdfd893249e8e0c1535d5f5332ba75931728bc3bc84c8b1e286eaeaa1bb4dc636c0f55342234d9c45f65699d01b1a7bbde0e0796276ad09711bce8790c13ad23e7981a9f2bf875947101d996147ba7742eb1d1973f971bd8a07f4859b066b22fbc26eaaaff13a2c47346e3d9e40bec59696ee9da1320ae6fb7dc03b27635224e69629f86e8868ab7d73ef03c15cdb0711d00738baef1ba3c365e4d332cdecf5c415cc2f521b3e3ec3516082ed73d4bf101278e3b326e270", 0xcb}, {&(0x7f00000005c0)="0c6f16c12985308416b262e14f05907bf9942874b462f15342822704b4d73b2d6db1320cf6b2c7ca303b46b58f45319c0d8ae29f4076cda1a3d01d203df0b0615dbf5f7e9f2e87f14d89a944245c4f57c696b95f9a1b03bb12e42a0f4bd19bf473e1bbfc54265979c689a95cfa844649470adc123a0daf9d56bfd7f1f49d18b3e8a57128ad2f96bb40dc2d4e4e95c583882cd453ba8f210d4a8201325839e3a7f45989299c86c729ca6e217703227bb9cb72727b9cad9a571d39ce36dd6e7d50bf1998832a0c036c03cba6c61cc18fc43ccb06ba92d251685fbf65038df1853d143cb74ce46e1f38a7f35e7c7bdc4abc3bac61660a51401e5ca3c7a2bc", 0xfd}, {&(0x7f00000006c0)="a225d332f6facad81970ea0ae49cc60cd85233fcf0be561ff236cccb8d7b841d7cda50546ba5df47c19e3278aa7e21017266297f1b4ade4d6b9a0667104f05ca9e64d6152fa6837acb7e8d98fd2c69069c68bc6005e60ee6581a886b746841308ed0b29d2ddd815b168485bec4bd313a45feac9ef2623f8fa8130292874ddab1a55c0e0fd42a86115b002fc7d05679927e350b9e7ada2ee47fa15413706a9e8323e6e4", 0xa3}, {&(0x7f0000000780)="67b532e9110d478d0fd8db2001e35a0e118be54e37d359890c665b87bf38b25ca2ee9940866a7cd4c51721db3414400bed7dcf7979af3838901654fd05d9f90b54fb5b1e46bf4a9e0e1f9f5bf72e8ed08b38aca1651c0683d1cf5841188461ccbfebcd4dddf3e9f0172841e3e499c88de968794c7ad106625d01333ca558e387e84e8d7a9f7749006b87dfd9b558653bad1802b1bad63c1063", 0x99}, {&(0x7f0000000240)="531e4330160e9f86d9442a62af88b711389526421f662ef160febcb9297576b229e6e6366b2499bbfcd77004e43ac4b74467ff1f31c4dd3e89399500eb9eec", 0x3f}, {&(0x7f0000000840)="51ba2c6fcaefc892d8b8eae73c87fc4f85a1cb2ae279216db881b8d651deb4abcd01cc7c6d29e57970bfc26419dd467f5196557a995cf85cdfe38282b9961c5609b388d7158fab31579fd353713899f94662faf8ad71327b079488adbc9203e143d7c62d59fcc8c744fdbb18422851bf681a199f7d5d519ff92e450379298493b456fa55a7cd18683f823d9c41cabdb431fb24dc249b84bb626741d742da660ea6cc", 0xa2}, {&(0x7f00000004c0)="20139792952699cc3af7372a35ef470df37e2d69cf3e7fc3962599c68574540b612d36b386cc9ea295a65d70844e73b1672995", 0x33}, {&(0x7f0000000900)="52ad8b442f", 0x5}], 0xa, 0x0, 0x0, 0x4c800}}, {{&(0x7f0000000a00)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000000a80)="26ed2f079809d056d9e1de83884b129d2cf5081c96a870111e992187543e0e3eba92dbe82597f5955ae2b2ef5134cc7a735dd3f26bff1e1bbd1a101dc88166340fb8484231ea1822337f325079b07f476d24cc7455f9dd3803d2802607e3c8317dbc72bc45ceae103832e280deff275ee459d0cf4b888e6a992d080621247a0cdea2c5e2dfa4dea171f24be8982401036f11d4e9be1dab06008f287e62b276eea71a9349c966adcf4bcf22ac7b97d213f0437f304b6654b2c8cb78eededabac4b46a51be20f6707e34ba845524e0ba1a082a2f6f1cc18e5b1286053e473591250dbc7959958652ea01a7f884f93f6e0192a18e8be3d8faddd08bbe7c013aca6e71ecbaf769a31de6f2441cac359d58343b57033da71ee215813b91663b9a84a8c46f156f4a88096eced7c397fd0668f525f0feff81e093cd055ec6edb40879347a928e98d0aa8858b1bd06ae0a408d0985c9e5b80d20b3aafaeb691a8d01accecd0feff756cf1a4af1848a5778e59873fe7f88ee296fb42780f7f4479abb45a6b07bae4a69a881eb4a7cb08bc0b741d015922a9df86f500ff911c69f59d1bdfb49d10bcc972f50260e9518d53bf5b558327fe0c1a3c52e7514488a3befa4e8927c0b5c1eaea8b7f4acf7117b67075f4d780b64a765ee0ed9bdb6f72197ee9d6e4b044e0c94b8454abd7ac8dd80219ca0cbd9b6658db599e97d97ce92513336a52cc791d599d6562746a0c93d3f97606434f7600f03cbd1549a7910bb4ecb43b6a4bfa577ee0e4778039741e313c6dfb338b58a4e4664834e08509dc560a7b5829a62465c5be7671d21fa802802ca142a415af980fae061bd1168bf63b41f38b4f6b5d07dc1de768d8cd86ff1669f9ed9c4d62b869fc6e139e3120cde9587235206d967ad851f040e0933e7457c6736b803846d1a4a87c33f065b9a780d27eb50895ed55b881091838e2b623f4fd9182b1f154661c5746853f98ebb1fb903263314a43b269051d566a7f7c9693a1703cdeb4cdba7a63c125021b4fe32a0e2133eef3eed444c438f80cb089f904598f10c801fee0d2940be46dae5f92b8ff71043ba5e237fcb3a84e5b8a0444a2a234727e9abf7dc3cee891ff3be8fa718fa5b14cf86b580057449050e1ecf359b08e54be1d42fc2387d695afe08d58819a5ebec6fb10e1fd4984e85f601d49605cea8472328ee293455c437a8df768262cd388616fb51632418c754012d15f4010c54730bfaf2779ca4f3f8c91d3eaa8cea486348d945760ea834af11a6aa0ae5fe7c494304d9e88e19ed0a6dd0209b4df59bb04b921c3dc5d2e074fc0c0aa4b99b31711a6f16e27b3cbb8c6ff746ef40fca7e53a0f0d9d31e0be59d883e63404517725b29d9364954479565d9b3e642580bdb4489a97444f28285dcdd140bee9e2b329d01adbe5b39c53899192a7f96102933ade8cec853c7967ccdbf2bb3420455042c39b20c645f9af992e43db33ee12b5c33246c9a584f3e23516053af6af7847d41f332e1a6f134e06bb053f66233977314f30e0c37a7ec827d4c6e556aab546b7c626179bd46e82cc1dc59325ca3c74d40fb4fe88008a7d0ad8721db619c2326c7d770a552ef56c61cd12e963bf44c3f832b172e185e41cf68f0a0152716c9d8018d2278cda92f73dffae6c0ab19a8017ab896034d0f5370e04eef823656220dc0a4412171e268ff1ddbb70bec4f14f2826eaecd8c1f2c94765dee9ac8fdfd56bbb6596ac63121aa26ce5627cbb28a47dff1a4b19849a53838945e0bacb5b38c139b5b4e1cc13672eb8674a4ee6d5333d87a67563f64520e2b5f3d1f7d2792db35025eeb2f9a4cd605b97117538477965e7fec1b0181a5f5691f7ac164af2e0a1100dee70e2974403ea1437dad9c2b637130d777a5eff941a0f5b9684fe1546f8513d3d0a0338c5a20dcef1754ebaf90016e9a6e2d659533a6c610fbd4911635d7f07903a7689aa70c8671a36b075d701f232f810ca77fa7a809c47856ca490a4cd6273ab5fef3f1bff64931bf75d580d3227f1fc252917ee3fd44572d85ae2a3409ab3948a942ddfee7b705bf19de836d85ca73730e67b911ff3b071ca18655a231962887db4ea9365a4897696d7421e4501dba45598c12b4916ef477a3871e781d903d93271a4c053aae02eb0660c835356f27ab4ac88643ac20c03e918464dac9e89f1a0b1d28fdafbe312f37a5f67c35dc21f93b8fea5e341cb16c7af6c2c037a6357f59270bdf2cf5cd29608a6283ca7523d980af411d52bd321bc8ceb8752eff32b17b18825acb754f887925025843dc379846b04a095c90212bb9efdbc9c36b0ebdc86f2817d4795fed0ffd496a348ad152e58bec076025ec9aef84af734214d6724197eb680bf026bbee4d5e0d4ad25ed29271614e1e5bb3dd13e141f3449c3c66aa7f534b3d2f90fae4d2ef2583f22b31f079e05520b318a1e240a65ade3b2d52c9c4848a308566fb68d11970b95fbe86d99ab799e67f6fae234585bf06d8db6364dd6c1dab620a0e2fa501d71e10dd3cf697fa9af4cce4690d04317c8666d10a0449e661fab80d1f539406d3898774ae469f8376ec4a772f2c9e61acd590a2531ad5a6a8b45bd873e6b2c6c464e93e7f14815fa02d38a272ecfcae0ddf0891e510039ad791f79baf7efc9732dc753e97037943e197eae2672b545a14a73f0bc1e51cb6037a73e3a593404e4bb5de6c9063bdc84792a5ee0f0b0a0e5a491b88fac725ca9d5addd378b64305d04ac9bac66b8338d111744018004dc271e11b72925eeca23e2d35b09f7ca3e2a08da2b991fbee16195c290432012aaaef9e97a983cc978676c6c41e1fff526fd98a5f37d4d2717c8e5eb8dc3144732defa7f405ad7acb4aade3182ee583b418a82e269b2df4e3b16951f28f9fbc59e91b724769867fc496d241fa7c0e479071c74709e9ef61bd6bd59d01c4bea5a9463869a21f4fecefd5edcf73b3e4934e82b1ca9fd60bef3d8a3807a8d38bfaf53ad454928c558960969a5e3013b8e3a531e36d06a3ecbd964736f862363d23e3d7511b7b9f39b43c76e39fc90a2a0d11d08ff0c9283741cf7aea103bd05e9c660075e1eb5db5b76f9cf53d5fdf5e997d8dd8df6cf519aa18431d4a9cf9ac477ec824df8d7b35eefdddf44660fcb93d12a6164e18b3b942a8f60ece4e616a8f587db61b9c6071f123f5fa92bc06142f5a84ef6a6ffa8f1fb8aee69cb35efd94aed5b1ee60c1896cbde9888e8564ca8ea27068c206c6a82eec09690996e532c6c5a75d345a8d459d483efe98f2fd74629b7f7d0d9d895a006029b7956aac6e4eedfb4ff2645cb3a3e6479c6b040d3d9fcf2a0f981838e8daa489bc5d3f21d72a190d998a95f34ae95b4b35aa11b6f320fcdc58f531cf72fd83fb8b57329920cd2521b85a3e00b836940841ff057199c13ab750e89019d5d947b3632e16e826b87ecea620932c430cf8782f45f8afc711632a656f105a6247071fca2defc2bc4b377b6cd16142151d34efe514e63c78a8eea1949a0e148ebf22df75ef28d8180d97274d4549da98d608ac6072b1f404aacd942384782cc43fc96b88a080bb112e3da4ce0af36ab1b4ea55f9c4702c15409a7f107ba9373d0c958f0b0cce9d75184114618444992594d11a26aeba3661e6b976350ffdfc8933b3619b179d24fe9f1d7b1e14a72155e196d6f08ba37a9bb0aeb785af3a393f2520749655373541a0bdaec1f3adc5a3a425527cc48c14a59b42c12bb025c3e83eaab49d2829b1634d1a184ea05eb84f4794664d85d340d0c13eec68b2341d727592799543b3b4273307632102f7d006c5af2572d6d1fb8b754b20893606af1b7097207fc819749acc5c478f07eb75e3d2dda16dfa41a8b6618d2ad863855e0fbb647be8575b13505c703fcd002937c8bb36166f3ee942d539ee2718167d712c6840e2ccac5300806abb43861ed23dd433dcbea8e87fdf448ebc06742b001d04da08079086ce1c639408cf5e9df6df162aea99d56bf987da87be67627a380debce8adfe8650014b5ba646f81c1607fedad29bdf4472db14459140ce57e0f36411e908d73a3eaa11f3a8660a5f670b3a5ed1eb8f32bb9f1b3f4212670c8ba45e48fad8e5c13a9ceeb7b32aff5864d7b61306d994d8015ae240ecc8715ec29a8c8af615bfbb822319fcebc8eeecd1ef7c168bd2ed49940e143e66d070b393be0baab4f5b82a208b915a472d4bb2f39418866cbccda918f0ca59798a53cb0d76e7367ce58f8a0936265db83458516744d8493b3b66afdd8e4e48b03c1285d2a0f01006e99448627100b53f88447bb32b08e14d07038c54c1a21f39510a296694474eb4396ec98bb2c2a7bfa18e7e57d153a49b9ed1c76c336b54235ad595cb2759e490a5078fe34119571af0bbcbc54d0d3e47afb529a5904cf835e97f409ee24afb718b25e74f23edf71fde217e8e8b0eb2b648a51e3d00ff1b9b9a6dc4f2dadb04b6c19b5c1c93f0a051882aab561dfdac5a9c43d064a1bb5a4f167afe372c6af2491f8b0eab5143d4179da9bcd1d7f9a5f7661d7af22cdf23e76423e19064e2cf1ed53741bde929201953efaa8feef84dffdcc100ec6be445865ae84e0f31180232b68e4f452e259cfafe7458b7916a607ce1bdedbf17423a4c7ebf7c933f6b3171d490a2ea1f027fbfe24c4203d20c4a035e1702671a285467481ca4e5a4e21154550484249d6d68e3b24288e1c4d17428cb1912e31619da7a6d28c6d338cd09eb5a234679a2393258202bd82948b30c45f798f6241194b73a8c7122a2d713924d74797a5aae97f7ac6d4a6d647c2687c75c19ace4436cd8b88721d17f5fd8af322f5111ff04393fa790844c32e43d8aad53175af59a3c6c87c7afce2c35dae659592393d2affc61a14832910536073d8d2863fde9bf96d514e6f58aaf35e9e2adcea05c250420888af2c38aedcac3b3baad07f3e0d8296b3280607b4fee36f326e59dfc9cda23986f86b24d25c5441edbc68e90aa276e11646c5c37f3431c61763b9c4010d8132e033a6b916b0f56f7045e1d24b1ff5d68503096e0000e7dc140bb88378df9757081b3fa0f39fd2b4fcd21fe1c75eef7e6f2367d4fffc8fa4e5ab85623490a74d10ed2be900bab820845520900d5c7ebea6f6ba6fd781a58baf5d93ffa6725c6d3407e07254dabb9609a5000cd3bfdcdd149b796b102abcadac13525a45fa7eb2c7a460579a3d303744d04f7be456a595d997d264f748bc8cd2fb5e3fb9b0ef1575c4292751c397421960e82c9241ea8314b2189d174503179c9b210b221d7b7b6b436658315bee89f2b52ecde5c2420bb22f7b6b565c9cf7974550a2487d1797af35d2cb6994d9a919069b5019d583572aeea85ea7a90b78d3e67d53ae2edfc86af0e282e0fede814c894b68f6cf0fcfb92261cfcf64ddf74cc3ca0da0eda2076bc40da26cef95b7d9d01bc74a2723efbca6a01094151005d055c71444b9a8af2e4678f34e16a29773018a5153a8c45c050ce4e51cf76dcf3dcd5f4f420d747abcdbcada9d084655c180cdca615907a2e1b5c23ecca30bc0db59ed5246ba865b1838b407875d320f3a6db4809bb79816599a20dd9b171ddefce714a70607e9db27dc5564f9728970dc5c8ac080c2fc62ce3cd64354d30ccc2960f88dc78bb15559e968eed4e9ad8f9d5e35ff5f68eaf6f3ed508e5e3ee6d1acf7d64ece29663c84ca644e999a2537dcd8cb0ffbec33e0041a32c58ec7333f4eab3fd87b19ab9d6bae17b8b2082ce44b6a265bef979c3106da498", 0x1000}, {&(0x7f0000001a80)="d095e268f0db948c7886ed55b009c7b9009922d42f81b3374552f71cbb291504ec82623bfe594fc50aae817db827cf8570dc2494ed1b6cbaacef5e419f8378fdcb9fb3cc58b6ed4eba48fbbc5fba61266ee052faf9a5f37d4097db639caeb74d46a517a0436a9f8a00fce1166c5ceaf57f892fb4bb4a13638f58e700da3f4170227aabfcff91142f4b8f385733188433792241d87220384b680c1d24c2cf6af0e28ce704c3132ed30306aaeaf2b2e00690661296ddc4d9468c5e0c3547909918759a2ffb88bf9ce1ba2ab5444facb8e663bb1ec63ba9573bf3fd4673f6b97462708332b1874b0eb01a9a43d41848926195c9026d7d22a65a", 0xf8}, {&(0x7f0000001b80)="43b3f0db52fb97f7c6558696b12f7746d228ae964c97fce8cf474dffb5489a7ea40b16d2963375ee2cf8b6522db139b024d35476b0967dec183d9cb18438b999076832b78613af43facecf0868405cfe866fae7060129433695cc5a6e9494d6f17b95607409a3b1cf2d5087f13f4fcd7b58a6aa713cae3a7d415e6dcde86cb67e21fadaeea5385e6a0f806e49e5573bf7735bca96ae852925011391d59f09b5d87a9028f612756f735cc93f77ff636c8cbcd9253cf4dfb98c3abd9a3a8011f63ced6bce29d144605e7bb496c3ff70fea4cadbd64b90b1b76770443381d4653ccc31d001d95d5322d69379c28f4ed71c39cc38ee10c70354b", 0xf8}], 0x3, &(0x7f0000001d80)=[@cred={{0x1c, 0x1, 0x2, {r1}}}], 0x20, 0x48844}}], 0x2, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x1015e, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r5, 0x29, 0x37, &(0x7f0000000200)=ANY=[@ANYBLOB="0200000000000000e5e3ac752d3bbdc586bf9dec87d0accd28063bc6edd831d264c35d203a56ec4679dd616b94cea701d200"/61], 0x8) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) r6 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, r6}, 0x94) 2.337020854s ago: executing program 3 (id=3486): ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000280)={[0x4, 0x41592ee8, 0x8, 0x892000000000, 0x0, 0xe, 0x7, 0x401, 0x4, 0x3, 0x400, 0x7f, 0x3, 0xc, 0x8, 0x3ff], 0xdddd1000, 0x400}) socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}}, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) syz_emit_ethernet(0x46, &(0x7f00000011c0)={@link_local, @random="ece65fbcee55", @void, {@ipv6={0x86dd, @dccp_packet={0xb, 0x6, "8519e7", 0x10, 0x21, 0xff, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, {[], {{0x4e20, 0x4e23, 0x4, 0x1, 0x6, 0x0, 0x0, 0xa, 0x1, "7612f3", 0x3, "c5db0d"}}}}}}}, 0x0) 2.238378242s ago: executing program 6 (id=3487): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x50, 0xffffffffffffffff, 0x0) (async) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) (async) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa07, &(0x7f0000000040)={{&(0x7f00008a7000/0x3000)=nil, 0x3000}}) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) unshare(0x24020400) (async) r3 = signalfd(0xffffffffffffffff, &(0x7f0000000140)={[0x9]}, 0x8) r4 = syz_io_uring_setup(0xddf, &(0x7f0000000300)={0x0, 0xd95f, 0x10100, 0x0, 0x242, 0x0, r3}, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, r5, &(0x7f00000001c0)=@IORING_OP_FADVISE={0x18, 0x26, 0x0, @fd=r0, 0x3, 0x0, 0x731d, 0x5}) (async, rerun: 64) io_uring_enter(r4, 0x353, 0x0, 0x0, 0x0, 0x0) (rerun: 64) r6 = signalfd(r3, &(0x7f0000002340), 0x8) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) socket$inet(0x2, 0xa, 0x0) (async) r7 = fanotify_init(0x200, 0x0) (async, rerun: 64) r8 = dup(r6) (async, rerun: 64) r9 = request_key(&(0x7f00000002c0)='asymmetric\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f00000003c0)=':&\\[\x00', 0xfffffffffffffffa) keyctl$revoke(0x3, r9) (async) fanotify_mark(r7, 0x1, 0x48001059, r8, 0x0) (async) r10 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r10, &(0x7f0000a34fff)="10", 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x800, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shutdown(r10, 0x1) setsockopt$inet_sctp_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f00000001c0)={0x0, 0xf7, 0xc, 0x8}, 0x10) (async, rerun: 32) r11 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000900), 0x10, 0x0) (rerun: 32) read$FUSE(r11, 0x0, 0xeffd) (async) write$proc_mixer(r8, &(0x7f0000000140)=ANY=[@ANYBLOB="50434d0a4c494e45330a4d4fff49544f520a524144494f0a4c494e45310a"], 0x1e) (async) ioctl$VIDIOC_S_AUDOUT(r8, 0x40345632, &(0x7f00000001c0)={0x0, "39d2a4eec269ee2513037141af5442727442bedd42d4c6c9e80d94f0752bbf23", 0x2, 0x1}) (async) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x4c091}, 0x58800) 2.025306991s ago: executing program 3 (id=3489): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x5, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x7, 0x81}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a3201000000a4000000060a010400000000000000000100000008000b40000000007c000480340001800b000100657874686472000024000280080001400000000c080003400000000008000440000000220500020007000000440001800c0001006269747769736500340002800800034000000004080001400000001408000240000000120c0005800800010088634d580c000480080001006eee7e000900010073797a3000000000140000001100010000000000000000000700000a"], 0x118}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x80086601, 0x0) fsopen(&(0x7f0000000000)='ufs\x00', 0x1) r5 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x3, 0x2, 0x9, 0xa}]}) r6 = fsmount(r5, 0x0, 0x0) r7 = openat$cgroup_pressure(r6, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) r8 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r8, 0x4601, &(0x7f0000000000)={0x60, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, {}, {}, {}, {}, 0x0, 0x1}) write$cgroup_pressure(r7, &(0x7f0000000040)={'some', 0x20, 0x17e, 0x20, 0x100002}, 0x2f) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) fchdir(0xffffffffffffffff) openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd6367fdd500085bfb6300a8998711fffc0000000000000000000000000000ff00000000000000000000ffffeaafbeeb72a918ac1414bb4e"], 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000003c0)={'gretap0\x00', &(0x7f0000000440)={'erspan0\x00', 0x0, 0x10, 0x80, 0x800, 0x2, {{0x8, 0x4, 0x1, 0x9, 0x20, 0x67, 0x0, 0x2, 0x29, 0x0, @local, @multicast2, {[@timestamp_prespec={0x44, 0xc, 0x9, 0x3, 0x9, [{@local, 0x2}]}]}}}}}) sendmmsg$inet6(r0, &(0x7f0000000580), 0x0, 0x0) 1.278980759s ago: executing program 2 (id=3490): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f0000007440)=[{{&(0x7f0000000100)=@x25={0x9, @remote}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000000380)=""/108, 0x6b}, 0x2}, {{0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000740)=""/23, 0x17}, {&(0x7f0000000780)=""/230, 0xe6}, {&(0x7f0000000880)=""/175, 0xaf}, {&(0x7f0000000940)=""/89, 0x59}, {&(0x7f00000009c0)=""/113, 0x71}, {&(0x7f0000000a40)=""/55, 0x37}], 0x6, &(0x7f0000000b00)=""/210, 0x94}, 0x2}, {{&(0x7f0000000180)=@ax25={{0x3, @default}, [@default, @null, @bcast, @remote, @netrom, @null, @netrom]}, 0x80, &(0x7f0000000e80)=[{&(0x7f0000000c80)=""/217, 0xd9}, {&(0x7f0000000d80)=""/235, 0xeb}], 0x2}, 0x7}, {{&(0x7f0000000ec0)=@pptp, 0x80, &(0x7f0000008680)=[{&(0x7f0000002480)=""/26, 0x1a}, {&(0x7f00000024c0)=""/45, 0x2d}, {&(0x7f0000002500)=""/147, 0x93}, {&(0x7f00000087c0)=""/4096, 0x1000}, {&(0x7f0000005900)=""/49, 0x31}, {&(0x7f0000007680)=""/4096, 0x1000}], 0x6}, 0x9}, {{&(0x7f0000003600)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000003b80)=[{&(0x7f0000003680)=""/221, 0xdd}, {&(0x7f0000003780)=""/201, 0xc9}, {&(0x7f0000003880)=""/163, 0xa3}, {&(0x7f0000003940)=""/162, 0xa2}, {&(0x7f0000003a00)=""/77, 0x4d}, {&(0x7f0000003a80)=""/123, 0x7b}, {&(0x7f0000003b00)=""/116, 0x74}], 0x7, &(0x7f0000003c00)=""/84, 0x54}, 0x1}, {{&(0x7f0000003c80)=@nfc_llcp, 0x80, &(0x7f00000025c0)=[{&(0x7f0000003d00)=""/210, 0xd2}, {&(0x7f0000003e00)=""/4096, 0x1000}, {&(0x7f0000002880)=""/233, 0xe9}, {&(0x7f0000004f00)=""/214, 0xd6}, {&(0x7f0000002780)=""/239, 0xef}, {&(0x7f00000026c0)=""/178, 0xb2}, {&(0x7f00000051c0)=""/35, 0x23}, {&(0x7f0000005200)=""/154, 0x9a}, {&(0x7f00000052c0)=""/94, 0x5e}, {&(0x7f0000000480)=""/127, 0x7f}, {&(0x7f0000000500)=""/80, 0x50}, {&(0x7f00000002c0)=""/32, 0x20}, {&(0x7f0000000580)=""/68, 0x44}, {&(0x7f0000001480)=""/4096, 0x1000}], 0xe, &(0x7f0000005400)=""/70, 0x46}, 0x2}, {{0x0, 0x0, &(0x7f0000005780)=[{&(0x7f0000005480)=""/250, 0xfa}, {&(0x7f0000005580)=""/199, 0xc7}, {&(0x7f0000008700)=""/141, 0x8d}, {&(0x7f0000005700)=""/70, 0x46}], 0x4, &(0x7f00000057c0)=""/153, 0x99}, 0x7}, {{&(0x7f0000005880)=@sco={0x1f, @none}, 0x80, &(0x7f0000005dc0)=[{&(0x7f0000000600)=""/15, 0xf}, {&(0x7f0000005940)=""/139, 0x8b}, {&(0x7f0000005a00)=""/131, 0x83}, {&(0x7f0000000240)=""/117, 0x75}, {&(0x7f0000005b40)=""/182, 0xb6}, {&(0x7f0000005c00)=""/93, 0x5d}, {&(0x7f0000005c80)=""/189, 0xbd}, {&(0x7f0000005d40)=""/106, 0x6a}], 0x8}, 0x201}, {{&(0x7f0000005e40)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, 0x80, &(0x7f0000007300), 0x0, &(0x7f0000007380)=""/163, 0xa3}, 0x10001}], 0x9, 0x2, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000040)={0xc0, 0x1, 0x4, 0x0, 0x9}) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405668, &(0x7f0000000000)={0xc, 0x1, 0x1, "0000087aba10fdfffffbe30b51751bc53051a30000000000000016ebffffff00", 0x30385056}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = io_uring_setup(0x6bf1, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, 0x0, 0x0) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="746172676574205043493a31643a613a3135f33c783ad66734f2422e3100e7f7196554dd94853600e20666f88edd06c81953aaf3f8a6a17dfdf0e3688163b2e39eb79f67"], 0x15) r4 = socket$inet_tcp(0x2, 0x1, 0x0) fsconfig$FSCONFIG_SET_FLAG(0xffffffffffffffff, 0x0, &(0x7f00000000c0)='rw\x00', 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000f40)=@mangle={'mangle\x00', 0x44, 0x6, 0x4e0, 0x130, 0x0, 0x200, 0x398, 0x98, 0x448, 0x448, 0x448, 0x448, 0x448, 0x6, 0x0, {[{{@ip={@local, @broadcast, 0x0, 0x0, 'geneve1\x00', 'ip6gre0\x00', {0xff}, {}, 0x0, 0x0, 0x18}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x2000000}}, @inet=@DSCP={0x28}}, {{@ip={@multicast2, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@broadcast, @private=0xa010101, 0x0, 0x0, 'dvmrp0\x00', 'nr0\x00'}, 0x0, 0xa8, 0xd0, 0x0, {}, [@common=@unspec=@time={{0x38}, {0xffffffff, 0x8000, 0x8d84, 0xcafc, 0xffffff8e, 0x70, 0x1}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @local, 0x0, 0x0, 'geneve0\x00', 'veth1_to_team\x00', {}, {}, 0x0, 0x0, 0x3}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'system_u:object_r:dbusd_etc_t:s0\x00'}}}, {{@uncond, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x3, 0x8, @ipv4=@multicast1, 0x5e20}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x540) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x810, r1, 0x4000) madvise(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) msgrcv(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1000) msgsnd(0x0, &(0x7f0000000340)=ANY=[], 0xf1, 0x800) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, 0x0, 0x4000000) bpf$PROG_LOAD(0x5, 0x0, 0x0) mbind(&(0x7f00004eb000/0x2000)=nil, 0x2000, 0x2, 0x0, 0x8000401, 0x7) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r6) 722.527619ms ago: executing program 5 (id=3491): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a2c000000090a010400000000000000040900010073797a31000000000900020073797a31000000001400000011007c000000000000000000010d000adae96dbc758f8f8f31e155eb676f747360dd0772941bdaded6af9a55fffcd1de6b2e0a17c9b940fcd9287fa43ad1960bf2fe98e514582203fe9a56ea9bc411ad345f772f4492d62d711461b6177ad5b8be5c8b5b3ec7c9628051e746173b11ac77757c34801ea9ab535ace02adcaeec494"], 0x54}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r1 = socket$l2tp(0x2, 0x2, 0x73) sendmmsg$sock(r1, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000140)="afefecc261a9de52b600c9ee94bf99d63a7999e75733404f652e522f101896bc06a43e4fd5d310870626af5bf46eac9409e15af73fdd48b7d7bfabc4aa451a183bd4b746abf989fe73b6e084bb2b33ec53bf2eec9485754061d6e4bc12", 0x5d}, {&(0x7f00000001c0)="5efc404ed53f82809fd1f8a608281d1092c34307cd44c8c5b4f72342b84e13fa12a12a44f49feabf65c6d7c3ddfacd13c3009e8df31acce504fe0357bd124a29f884248cf2d7d5addba383156cfa6e0313948b8319ec9dedebdaa8f5f42fe30029d01c1ea788b42f379e19ad5e7994ad841d0eb60ea26e2a99377727492dff7f337cda1674a785c69b320977181773aabdb4630f5c9ef752ef1b8c377d21fd7ab3b1fa8e38105d8234ed6d19f39d37477e2e36dad3b34e07f3b43075735dc3773d", 0xc1}, {&(0x7f0000000480)="aad0fd237f1382fa09e374816fae36c0460669b10c8e1d2fdd321f6dba3ed1cc412ddc153375342b883a71b3e29c620d2a63c3853864b8a7f6017848f4c7f7bad0a9a968d40a6f84c0755e7fb5eb72a2f79a36b0fa7b1f19deb618f145c21fac76edc000ac3df192d1f0a2cf9cf39478d12c39ef1e7bc313b6118fca7b203d62170b5c7909dcfb978a723288c3ab09a0541de37140042fd6a545bc291cf0e5bd7c111595410af580c89afbc520a7e90759c601c0caccc0ae6e16c11f4eb83d5c389beacf657e39a2ca14960919f0cf7e08c4073cda03f598d949e9168eac524283cd25ab795c94d1a17542f5e0ea3110e9ba0d9fc65bb6d11e1f3e4fe4358a8fa65294faaf47403df54dec139aef0237bd72cc014adb138bb1f219ccb88bbe132da4d22d55eaf775523d751932f824da8f54ceb4f4d0794d876b9720a3ce5fc3b609b5798601534c668fd7b2c28eae4fee11f90e96263a7f9c56316523f43a487608213dd7a9d614878b4a21d29fba5f89bfa597c058019cd8eb08dea4543a3f715a2bada5fe007f3fe9fde289aa0cd2e88c4bbe50ed980e1cfe33918403f9dedfd79d834339aa37fec3554fed60f7b30145d7c98d644caecfdb940e674aecdda744866786a28f9ea83c29851fed4631770580efce68d6f6b5153e8f8e3d7cc156de72e2e05e196292474cfdaa19306c2f20ba11862251880085756bc6fc09d8989de9443ddf08144bb3cdc26cf3eb9831157c2e31276f896af5cc1f90750677df4338673354522ba2259cd7811c9a1ab224f7c149e22175974fb829ca2d875debecd603a162e96ceabeb3164fdaa932770510a82db676c6aa2a06148962b8591fec3478211921436311d8a1135ab4804fdfba2eccf4d9b346a7f8055fa46bfb8d66d4d90df48389d6499feb7b066165a234e063115ea6f680b732f1a98165dd7c91f420c9bf7158837b7de97cf7a5f178168898fe635389ed17b49b110d0c6ea1c24683067ff71e9e71ab3102fbc2bd09e033a5e24ab546af3806a5a55d505e3cd47f89cbca006068e89d013b97ddd0de394fb2e60f35bfa74f7169ed90d7ad7d44b6fc1c7ba31923fc4b9613af04639f9a5db410fe8d772b0cd21b7baa4f24331be5e1ad6bc93a9e01ffe5105ff30e3ce67f136b29ec2b758c3b2b83d45e1ee8d7cf701dddb3c3ead9459914fb3d7017f88b9d5e5734088c290d984bd9694f850cffc0f06df36b14963ea1048b9976ccebed7f5435a4d2357cdd902cd16ee225210c0f18c36a2bf1bcc02bfd847ffb505b1ac9a987410bf56e6a43b9daca186e58ad666464ab0d86586af48058d054ee75a08b47033f0eafb5e0a1deb7401bf99a535f42d577da143839873acb6c952d465a06dc081bcf09a7504f853c3b3318348dd9a4e3c9f530ad1a9050b12f38ea8892cf7763d91d5e9c7922053475bda87bbc92ec91463482fd9e5ec9e543d9f2540e4461682972f5b80ab2e0ff8daba72501e457a09c36b35591f208c2dbc72ab40bb34a83627f4fdc918d238c2049edaec85f72848b7e73c28ae644b3408d3ea3e856936f65b44860450c951ed4d50e013cc97d676c7fbc59ec7a8b37729a65013b31e760f75e60e0b6ce170a0379b9045321d3a66146f8d2535fadc7ec20061ce256f13a39017baae58a5885e16ae7275fbc2b93f42cc9a984b91d630c421d7e01db1ddb2b55378d6cf35638b2ef4023eec2a46847a21f8857f4fc92378ffbb3c81f541b89bd820c3e992ba6c7f9fc021f68fa6092f219a992cb55e7a1de68f9989f384ad949ad629fc412b68eabcadfa85c8fe8bc5d98dc86f61aab26eed43013bbf63f1a344b3698b06bd653e49b38d815c35887c8e4a0e90daea3bd968cdbcbe42e0de64c6fbafa374f5820189ba93dd67e4be4cb67eddecc24015dfe833d61af6fa74333cde42c77761c60bed2f59f04d1368989b094f759bc9a81736f6cb64cc80ade978b8e756724db5ba6b64ae3e89cb19a965f5fc6c62d0a193f5f3918be4bbfd2d6d333fdd7330be6d4f8d68dff33a5fd23dbc143f98595f5f86273c4bd145f9b8055d742d09387b3924e1c3ff24911473feb752f717ff0af7edb2ea242f7483b7d1ffd1984c66b755db008c3e0e3be477b7942373c1daba1185516cbc9ef3b6b876083ed4ca620ff10361560fd03e35760a218571f1de20a7d216a6bef5fcef76c13787e64ad5ac71f89278f55916d1a2e6d84bdd37bd76c812bf63eb51ede28907034f06f4aead7d5cb19b46fc7f80217fa8a4b4be87f910aa02e79b53a57684267e00fe4019abe057940d04d41b6dbc5306b43f55dbaf55313e139006dfba97e41bb47d8584945289971500ded654192ed1d807e2affa2865ac1fe2e6cfe30ea73f1ede9534d5407ee28998a43d63d46995d1a428a74992577e12c206f995a468420cdd9175a6b03fa9f3c412481de57d94251cd07052118948a4d2652416fa720a243467c836969832e5075e9598f3350735cc64cb28c7c79925eb51b1cc0c2255fcc8fc1fe15893fb4d3f75ce3683531e53d0aafb2621c8f37f17dd82f388eee0f0cae58cfd24ba00f2c0f58a77116f46a6c7bf7e5e9c2d35147e4711a2a9c3aab1de97a43d168834a5e3916b0d0413a02004656ebc83fce64b9ecbaa141af7a994e5d01772a5bea498a099df6b4001feed6298f278992368dfbc68c5bea26fcc91cafccb09f918becf6fd59f4c48d1f2bc9f67b16dfd20364557f1ad4b1b14de754d0d74a173d2f98977c7a51c997d751bd11eab04cd8444fd8083186090b2ac5d5905eeb336c1a16e6fe57f8220bda7b79897499cedb70b0ec044c03196ae64faa75a963acd8627773ead7edd7cf07e668705196c3c9a29bed9b35bb2f63674e4a90d2328784530692915b18409c8469595225b7f778fc0371e756f763bd0d73b5d0916245b039ce293a8f1f6e24041d808b9e084dae7942512458932490130dee33e66c429aca97322aa3b895a4de71e83a941b5b267e4f144d74813831c5274fa66655fcff552f61bccf1101e3c7d1b96c3f0cf44bc65539ead89563c7799d528384564712bac6e38d33a78958abba9c97863832ca87caa115db818534c20f9a13e053ebabecb8d41c771cebac3b98333d4f6855b86ba94dd2d4e2933178e736beaca9b6c618149d19be0d4c3a776ebb324b543e464d541754fa007764c62153d2d3b9c1684cc0bdd9698e96068867cdd4754be9069a61a6e0e807d74ac0f4cfbbbea69eb1f23c2530717302c9c08190d4056c57fe668027012ab55ec5bd524371ac90baf11838459669354f3dff5f41bcd6b37bd93b87f47c7bfec78ec64764fd0f0871d0dcc9b83a7de8c7740370d43ae572e9bb2c284c4d46647bbb03aa01a939aaa49ada52467031dcb769160232fe59c8718b3746ac39ec08a0eff2d380113b1257955bf265919149ab5832e6184a696d191b6301aa54a75e43c403c8a317db58a0b615e503b8c5acc2c036c255f0fea993ba0fa5a48ebdb9cb65458af535b579c43f01f5b2ebc889e3b31f4e11c5e6353ced5314db2a74a9334904931d87e3eae5ca3344517049be8d96908f17cfe8b38cc5cda140d7ae1b3fe3eedd37a41e8c89189f32de2031b19faf9c7d06ba6c0a7ee200ca4557b77b7e2c8e9511efc038d872154d7e7ffa4dc0384036dcb70a7a6b2aa1043d929a82a0358caad4ea1f828bdd50ae71cc6952cecf752eb8b593d2d1146cca64eef6ad4b2ec24d01a66d6cf73cc2bfb9a8658700ff255cfd26603023a09e4c399d68949ac4ddcbd3c4619e79ab5961803b595a2ca50d735f1f1989c0d1d8ac17be25b6dabf652019ffb7ab07e3b2962c4d0c3d022236ec033833367e1f052933783afdde88e88569bc46faa8e8e9716274a0bf9d9337fef63542a9c58b953adf8a802c515c5072d2951c2d48f6b336a10ed1fe01de03a02ba4c016b46c95d5592df1cff250a62aa2f722d45e787da1beb8f399c87a7c221b860d7344f4c2ec04b203c4e31797d23cb26323d096f79ee3046504b6f59a49c85c43ff7f25c62da2787f71b1875a9409af71cce3b8eb5edea7213188299d5a7e4a350888263ff78e59d3419d8ec344ea775b3183c45092fbd661f8760caf53220612c56b5ebceac1e45dc34cbd5168cda9b71b213bd9e4e2a3d2b7d29a241e87a978dc77b4324eddfb3a21e9f2ec71706e278b5a9d9b91e694a7ec2bde2f3a5bff72a066340cffe373b187f905cd37953ce3d7d159724c996455f167f48a1b84c384b886df2e96ab4e7c41af9066b81031479a3f217efacc71d42b84834369bc3b033648acf85e8a496c14c305a7a7b806fc61ccca52988d1edab4902912fc1ba1a1b58f6e1d22307c71bfff0d047157d000d2b246ea75d7cc3ce7780266a89822e89f1024aad2c858ad984dba89b8d1ac4729c9b26a189deb370d0741177164f262fd91b05a2c368cc360157707d4ff9cd6be2127581d18bf0b72f1390ccafe5682da14848e96e9b252e02504a2c143e23eea3780ab3b69bb311efc8df42e1fd7242346c33f16767d2573ed5f44f808a62b04bac862a31a474e09f05e21a5270440f99fc667007fdc41f21aee2b30e0c96b69dc29f4c6a749fab2871e61ca5ef66c06786fa5ace901f9f0b644bf5ddfe562fd63df41afd204a9a8e6bc03c5d72abb086b17cd95b9f127aeeaeaa45c6973e70b1afb4224ab97866e37f9f1aae0eb3d7a81d2f38611c71cb83c78af7cb8629c499e79df7f97d03b0e52370cfba7997ac65e4880ca0058f98d43c974383db5503196c35b4ce19957af77515bb45c91c2fb955f87c3458fbb2a5eae6cba6986c6c1750f5118e42a258bdb9199225a0d101bb3e3145cd01c84ee8a880c497d627a53700c22729a4eb708d6c04e6a1e87e1bd10fead4db4e92de3a65622fddd90a307db32211dbe97aeae9d8ab9c2423eafb42af9c0f0fdee89eb97b3a30b1d8236c4bdf05863d7e1d5b7ffca424e36f28ed6c89913b6aa050d476fd9862f7415118e415254884fbcb9cb8ada62470657c2dab1962d1eab0d25929bd32e7434feb515a607a8b32960dd538d1a24005bdb134e4026fa25975d1e8074043187e6c3c30ed3f31f8deb66b884adc79334403c1a2329cd108bce1411ea9eb9ef1d2def34b9e7dc424c3bd4847e118733307441eb99dd8f22e6954eae1bb51ff813ba58f28fc6e8f814e21f444b5370ab885c0a3c562f9332829455ea2599e003f0f25be0c3619d59ec290c03fcf1f030a56c65028a771bdfebcb48e705c25f781f1765b0ab707b164b39ebf73524bec886ef408e35b8355e58a981f8c325a45fb95f19fdd0dc8217d8b009617b25a47da2629f5c4b484c86421529c1fabca18b853075ddc65773d47d72db2409d46307a607983858518169ca057430a72bcfd36bee325b7ca214394866fa1615f1bc79557975f855dc0e0728906a53f841b94a04c9c745f07734eca26f920fa69ed6ce8f7d53c93c7e799f098fe4566fc96d24731aa23a7e026a7ce28f77bcf8a6a27fc647e8f79fd0b471fc3d63836f68b6e39ca45c4c05951fb3cd7d1cbde515a7c9d8fef8d37462b96e09dbffd881c403ed63eaf954dbcf0f12c952d0643d5ca5dbaa8a6c213e0be2685944229a47c565296e5abc97984ed367c08423f75f561e13d4b1d961460af73f5cdbf41555e39179310cb6010345094e4282cf0cd355bfc6bac66f35b0b4f0dee7f434f8eb0332edfb04dcf2cd576bbe2191cd3298ba0a0ca90c1233eec405c188669fbeca60f661e537aaa0148a73", 0x1000}], 0x3, &(0x7f0000000340)=[@txtime={{0x18, 0x1, 0x3d, 0x5}}, @mark={{0x0, 0x1, 0x24, 0xffffff80}}], 0xffffffaa}}], 0x1, 0x11) r2 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0x3751, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000300)={r2, r2, r2}, 0x0, 0x0, 0x0) poll(&(0x7f0000000400)=[{r0, 0x5080}, {r0, 0x2090}, {r1, 0x2}, {r1, 0x2}, {r1, 0x8040}, {r0, 0x1020}, {r0, 0x710}], 0x7, 0x42a) 691.941089ms ago: executing program 5 (id=3492): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200"/48, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'geneve1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@newlink={0x134, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_AF_SPEC={0x114, 0x1a, 0x0, 0x1, [@AF_INET={0x40, 0x2, 0x0, 0x1, {0x3c, 0x1, 0x0, 0x1, [{0x8, 0x7}, {0x8, 0x18}, {0x8, 0x3}, {0x8, 0x9, 0x0, 0x0, 0x3}, {0x8, 0xc}, {0x8, 0x12}, {0x8, 0x1f}]}}, @AF_INET6={0x6c, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_TOKEN={0x0, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @IFLA_INET6_TOKEN={0xfffffffffffffcd8, 0x7, @private2}, @IFLA_INET6_ADDR_GEN_MODE={0x5}]}, @AF_BRIDGE={0x4}, @AF_INET6={0x0, 0xa, 0x0, 0x1, [@IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0xd9}, @IFLA_INET6_TOKEN={0x0, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x6}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x2f}, @IFLA_INET6_TOKEN={0x0, 0x7, @local}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x10}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0xeb}]}, @AF_INET6={0x2c, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @private0}, @IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}]}, @AF_INET={0x28, 0x2, 0x0, 0x1, {0x24, 0x1, 0x0, 0x1, [{0x8, 0x3ffe}, {0x8}, {0x8}, {0x8}]}}, @AF_MPLS={0x4}, @AF_INET={0x0, 0x2, 0x0, 0x1, {0x0, 0x1, 0x0, 0x1, [{0x0, 0x18, 0x0, 0x0, 0x54}]}}]}]}, 0x134}}, 0x0) 367.254639ms ago: executing program 5 (id=3493): sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x10}}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x169a82, 0x189) r0 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000400)=ANY=[], 0x1df) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d9600010000000000000000000000000000000000000000000050617cb900", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 254.493154ms ago: executing program 2 (id=3494): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c020000190001000000000001000000fe8800000000000000000000000001010000000000000000000000000000000100000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000000000000000000000000000000078ef00000000000000000000000000000000000000000000000000000000000084010500ac1414aa000000000000000000000000000000003300000000000000ffffffff0000000000000000000000000000000000000000000000000000000040000000fe8000000000000000000000000000bb0000000033"], 0x23c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 204.226531ms ago: executing program 2 (id=3495): msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x0) socket$unix(0x1, 0x1, 0x0) (async) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1}, 0x6e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1}, 0x4f) (async) bind$unix(r1, &(0x7f0000003000)=@abs={0x1}, 0x4f) r2 = socket$netlink(0x10, 0x3, 0x4) write(r2, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02159f02c26ed638eeb738256e06a40e07fff0797e", 0x140) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x109042, 0x0) (async) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x109042, 0x0) write$P9_RSTATu(r3, &(0x7f0000000080)={0x233, 0x7d, 0x2, {{0x500, 0xf2, 0x0, 0x4, {0x0, 0x1, 0x5}, 0x0, 0x0, 0x0, 0x0, 0x1b, '\x04nodev{evoo~\x059\xc6\x00\x05\x00\x007\xd9:\x8b\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4\x94\xe1', 0xf, '\xcf\xc2m\xd7\xc5\xb4\x99\xbf\xb4+\x93\x80~\x8bZ', 0x5d, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\xa6\x1dR\xc3l\xde{\a\xdb\xda\xb2\x88K\xaf\x05\x00~\x04\xe6\x9d\xb0\xc3\xca\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x9e\x95?\xa5\xe0R\x15t\x80\xe8\x00'/93}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4U\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300, 0x0, 0xee01}}, 0x233) 0s ago: executing program 5 (id=3496): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000380)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) r3 = open(&(0x7f0000000000)='./file1\x00', 0x109042, 0x0) fcntl$addseals(r3, 0x409, 0x8e3652a1e0b94d91) ioctl$EVIOCSABS20(r3, 0x401845e0, &(0x7f0000000300)={0xfffffff9, 0x73, 0x4000000, 0x8000, 0x2, 0x7}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0xeeee8000, 0x4, 0xa, 0xf1, 0x5, 0xfd, 0xd4, 0xd4, 0x0, 0x4, 0x7, 0x4f}, {0x5000, 0x2, 0xd, 0x9, 0x8, 0x3, 0x6, 0xb, 0x5, 0xf, 0x3, 0xc0}, {0x8080000, 0xdddd1000, 0xb, 0x1, 0x2, 0x7, 0x4, 0x1, 0x81, 0x0, 0x6, 0x5}, {0x8000000, 0x2000, 0x8, 0xf8, 0x3, 0x46, 0x2, 0xd, 0x6, 0x3, 0x8, 0x1}, {0x100000, 0x4000, 0xb, 0x1, 0x3, 0x9, 0xd, 0x6, 0x5, 0x4, 0x2e, 0x4b}, {0x6000, 0x0, 0xd, 0x6, 0x3, 0x6e, 0x1, 0xff, 0x4, 0x90, 0x1, 0xfc}, {0x4000, 0x4000, 0xf, 0x9d, 0x3, 0x0, 0x0, 0xb, 0x5, 0x7, 0x9, 0xf8}, {0xf7f63004, 0x8000000, 0xf, 0x5, 0x28, 0x3, 0xa, 0x9, 0x54, 0x1, 0x2, 0x7}, {0xeeef0000, 0x5}, {0x4, 0x9}, 0x40010000, 0x0, 0x80a0000, 0x300, 0x5, 0x2000, 0xe6e70c00, [0x3, 0x401, 0x7, 0xc5]}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000000), 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r4, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000740)={"373ab6e870bf64ef25ad87deef94c3b7350df627ea76a6efbd6c33a19e5dde0b3718dac0c2b8e833beb9e0347000fc7332c43a3128856f23df4628fb1e54b1745094c19bc88c190192f58dda884b3296f7cd6373842bff61047e0697c9af6e9f62b88fd21621b527902efdae6efd3516c7e5a36f4aaa12cd1b3ac0686db46783f45fe6aa2515ab6996b4807b0d9575a9061a775ef515a40b97c34035e8e412b9200000001000000062a07ab97f50ff5deb8a5978611317016887694245b363252230bbe17ed0f591f935d8e4ae7563eeff2fdfad8a775f0a4b15f63f5c4851df9aef747ace240cec55ce1659c08d38714245835e15291c4973ade3b2006d8870a1d739eb8e7a284e23f660b2061e31a70627be4acb16ecbe8a4edde1c5397c761a2fe0690f5d580ebf35b8640441ddf47d1f67a5e2d892f14a4f88412ce3cc8ec4d0580729c8638502410837253d6ac316ee9c6a24eb5d83463ff9bdf81f31c12b04adec97fe1377d2f29067e5f6f48cc123f2c4c02afe60d224c7d974a63c1aa9b110d2187f18de3753b57c630eab26238e8201501a007da99f1d07f76c4da113859ab55792049a15c5d83051f41ae951912eb81154f2398a729b6d6c51d6850bddcd4b35b24996e4ec707d1a744dff58ea5030fcd6b46a468ac029f86be30c7c3d5708e3871fed2e63b9c3ad265350e87e9fc44696eadeecc1ff67e30b64be27f480180d26218d031380149bcc31bd712063e9c09ed5329a530800000025d79eb9d4491d82d2b7a3d7d0cf9286396fcb8c2ccf1655b3ba420c36c3fb88d788308e947cc15e0957a98a843911c954c2a2feccd60d0000da8330cd1de951bcd767cf211a241c882b8d5e608fc0e796afead2a7b05018b4ae6c034c4c4997868343a5d064838dd0aca0d21b429665a0a1b4fd17cd34e711cee01d2348dc5871cca7ab4e4924f6f4bc29e7dbfae6788549e600000000271cd7ddfabd45803a6d1145734a82b2b9a6a87c8e118629840a027fd3f8e5a6a5dccee1a480d6cd0402a64db2263b1a9de61848b1eb31b51189f4caa2fdf0c3a38275386522137fe573ec27693a337c324952480c9ae476a694010aa22095c6d8bfceb5e024cbc21d6c1d1b17fae63dc627a948c4eca7dfa3f8a5e628531472e00ed28f2d2b7fcf03b5ba1975fcc010482a08c7800b3c87587a9fea37402ffafcc9cabc16a123164765d10dafe323ce33f197af8a3cf57332dbbee3f263a16cb565b61690b5804341630437ad2277be4ff82d1aa32c15b0cf99c88c7bca0ecf47a3be490bf6079f19acdf9a71f636fff612167c849b5c149cb32d8dd98d2aa8bb0606a1214fc1f0da04476cd8c3c056ec88eefca4d331ecbd5416c356466202cb97ddfc320b7594d5ab2e9102d549ffa72300"}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/igmp\x00') pread64(r6, &(0x7f0000000180)=""/43, 0xfd8a, 0x3c) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r6, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x60, 0x140b, 0x100, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x7}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x4}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4001}, 0x4040084) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={0x14, 0x42, 0x9, 0xfffffffc, 0x25dfdbfd, {0x3}}, 0x14}}, 0x0) kernel console output (not intermixed with test programs): ss 0xC, skipping [ 864.584680][ T24] usb 4-1: config 2 interface 163 altsetting 89 has 2 endpoint descriptors, different from the interface descriptor's value: 178 [ 864.641007][ T24] usb 4-1: config 2 interface 22 has no altsetting 0 [ 864.660916][ T24] usb 4-1: config 2 interface 163 has no altsetting 0 [ 864.691844][ T24] usb 4-1: New USB device found, idVendor=0bfd, idProduct=010e, bcdDevice= 5.e3 [ 864.725116][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 864.753455][ T24] usb 4-1: Product: syz [ 864.757851][ T24] usb 4-1: Manufacturer: ꎐ읣腈蹵㽳ꧪꐋ剆Ḟ䬘잕⴬Ố뚏퓬늁䪒틟盡Ꝝۈ᪛겻섨䟦ญ䖕畗瞻ᙔ⛮袧괐ຝ䮢攊剈൲﫹蘋ᡂ鰧謯쒶踸ㇰ뫩 [ 864.821480][ T24] usb 4-1: SerialNumber: syz [ 864.942113][T17918] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3111'. [ 865.049909][ T24] kvaser_usb 4-1:2.22: error -ENODEV: Cannot get usb endpoint(s) [ 865.120021][ T24] kvaser_usb 4-1:2.163: error -ENODEV: Cannot get usb endpoint(s) [ 865.138126][ T24] usb 4-1: USB disconnect, device number 27 [ 865.312047][ T5973] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 865.512430][ T5973] usb 6-1: Using ep0 maxpacket: 8 [ 865.554291][ T5973] usb 6-1: unable to get BOS descriptor or descriptor too short [ 865.604143][ T5973] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 865.648952][ T5973] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 865.716141][ T5973] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 865.813619][ T5973] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1 [ 865.825263][ T5973] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 865.836760][ T5973] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 865.860159][T17935] program syz.3.3116 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 865.877237][ T5973] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 865.938042][ T5973] usb 6-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 865.967327][ T5973] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 866.045065][ T5973] usb 6-1: Product: syz [ 866.052317][ T5973] usb 6-1: Manufacturer: syz [ 866.057080][ T5973] usb 6-1: SerialNumber: syz [ 866.094460][ T5973] usb 6-1: config 0 descriptor?? [ 866.101421][T17921] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 866.111991][ T5973] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 866.155453][ T5973] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 866.280248][ T5989] udevd[5989]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 866.360813][ T5973] usb 6-1: USB disconnect, device number 6 [ 866.942017][ T9] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 867.101788][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 867.114025][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 867.138894][ T9] usb 4-1: New USB device found, idVendor=056a, idProduct=00ba, bcdDevice= 0.00 [ 867.232239][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 867.272785][ T9] usb 4-1: config 0 descriptor?? [ 867.518460][T17947] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 867.561426][ T5934] usb 6-1: new low-speed USB device number 7 using dummy_hcd [ 867.577776][T17947] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 867.714873][T17953] FAULT_INJECTION: forcing a failure. [ 867.714873][T17953] name failslab, interval 1, probability 0, space 0, times 0 [ 867.721897][ T5934] usb 6-1: Invalid ep0 maxpacket: 64 [ 867.727943][T17953] CPU: 1 UID: 0 PID: 17953 Comm: syz.1.3121 Not tainted syzkaller #0 PREEMPT(full) [ 867.727967][T17953] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 867.727980][T17953] Call Trace: [ 867.727988][T17953] [ 867.727996][T17953] dump_stack_lvl+0x189/0x250 [ 867.728024][T17953] ? __pfx____ratelimit+0x10/0x10 [ 867.728045][T17953] ? __pfx_dump_stack_lvl+0x10/0x10 [ 867.728069][T17953] ? __pfx__printk+0x10/0x10 [ 867.728101][T17953] ? __pfx___might_resched+0x10/0x10 [ 867.728125][T17953] should_fail_ex+0x414/0x560 [ 867.728159][T17953] should_failslab+0xa8/0x100 [ 867.728188][T17953] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 867.728216][T17953] ? __alloc_skb+0x112/0x2d0 [ 867.728242][T17953] __alloc_skb+0x112/0x2d0 [ 867.728267][T17953] sctp_packet_transmit+0x2cc/0x2bb0 [ 867.728308][T17953] ? sctp_outq_flush+0xbef/0x3140 [ 867.728341][T17953] ? sctp_outq_flush+0xbef/0x3140 [ 867.728366][T17953] ? sctp_outq_flush+0xbef/0x3140 [ 867.728394][T17953] sctp_outq_flush+0xecb/0x3140 [ 867.728425][T17953] ? sctp_make_heartbeat+0x389/0x470 [ 867.728450][T17953] ? __pfx_sctp_make_heartbeat+0x10/0x10 [ 867.728475][T17953] ? __pfx_sctp_outq_flush+0x10/0x10 [ 867.728509][T17953] ? sctp_outq_tail+0x612/0x8c0 [ 867.728534][T17953] ? sctp_do_8_2_transport_strike+0x43c/0x8b0 [ 867.728552][T17953] ? sctp_outq_uncork+0x4d/0xa0 [ 867.728581][T17953] sctp_do_sm+0x5332/0x5a20 [ 867.728611][T17953] ? arch_stack_walk+0xfc/0x150 [ 867.728652][T17953] ? __pfx_sctp_do_sm+0x10/0x10 [ 867.728677][T17953] ? stack_trace_save+0x9c/0xe0 [ 867.728700][T17953] ? __pfx_stack_trace_save+0x10/0x10 [ 867.728760][T17953] ? __lock_acquire+0xab9/0xd20 [ 867.728796][T17953] sctp_primitive_REQUESTHEARTBEAT+0x98/0xc0 [ 867.728827][T17953] sctp_apply_peer_addr_params+0xdf/0x1880 [ 867.728861][T17953] ? do_raw_spin_unlock+0x122/0x240 [ 867.728890][T17953] sctp_setsockopt_peer_addr_params+0x678/0x940 [ 867.728928][T17953] sctp_setsockopt+0x709/0x1200 [ 867.728950][T17953] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 867.728975][T17953] do_sock_setsockopt+0x179/0x1b0 [ 867.729004][T17953] __x64_sys_setsockopt+0x13f/0x1b0 [ 867.729033][T17953] do_syscall_64+0xfa/0x3b0 [ 867.729053][T17953] ? lockdep_hardirqs_on+0x9c/0x150 [ 867.729073][T17953] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 867.729092][T17953] ? clear_bhb_loop+0x60/0xb0 [ 867.729115][T17953] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 867.729134][T17953] RIP: 0033:0x7f79bad8eec9 [ 867.729151][T17953] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 867.729169][T17953] RSP: 002b:00007f79bbca9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 867.729189][T17953] RAX: ffffffffffffffda RBX: 00007f79bafe5fa0 RCX: 00007f79bad8eec9 [ 867.729204][T17953] RDX: 0000000000000009 RSI: 0000000000000084 RDI: 0000000000000003 [ 867.729216][T17953] RBP: 00007f79bbca9090 R08: 000000000000009c R09: 0000000000000000 [ 867.729228][T17953] R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000001 [ 867.729240][T17953] R13: 00007f79bafe6038 R14: 00007f79bafe5fa0 R15: 00007f79bb10fa28 [ 867.729271][T17953] [ 867.918512][T17957] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3123'. [ 868.085292][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 868.091593][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 868.103263][ T9] usb 4-1: USB disconnect, device number 28 [ 868.242682][ T5934] usb 6-1: new low-speed USB device number 8 using dummy_hcd [ 868.405614][ T5934] usb 6-1: Invalid ep0 maxpacket: 64 [ 868.442780][ T5934] usb usb6-port1: attempt power cycle [ 868.791173][ T5973] usb 2-1: new low-speed USB device number 94 using dummy_hcd [ 868.801738][ T5934] usb 6-1: new low-speed USB device number 9 using dummy_hcd [ 868.822101][ T5934] usb 6-1: Invalid ep0 maxpacket: 64 [ 868.961304][ T5973] usb 2-1: device descriptor read/64, error -71 [ 868.963844][ T5934] usb 6-1: new low-speed USB device number 10 using dummy_hcd [ 869.015574][ T5934] usb 6-1: Invalid ep0 maxpacket: 64 [ 869.021622][ T5934] usb usb6-port1: unable to enumerate USB device [ 869.201110][ T5973] usb 2-1: new low-speed USB device number 95 using dummy_hcd [ 869.351647][ T5973] usb 2-1: device descriptor read/64, error -71 [ 869.488930][ T5973] usb usb2-port1: attempt power cycle [ 869.851299][ T5973] usb 2-1: new low-speed USB device number 96 using dummy_hcd [ 869.911705][ T5973] usb 2-1: device descriptor read/8, error -71 [ 869.911983][T17992] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3134'. [ 869.997279][T17987] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 870.005257][T17987] batadv0: entered promiscuous mode [ 870.038251][T17987] team0: Port device batadv0 added [ 870.151081][ T5973] usb 2-1: new low-speed USB device number 97 using dummy_hcd [ 870.202441][ T5973] usb 2-1: device descriptor read/8, error -71 [ 870.334680][ T5973] usb usb2-port1: unable to enumerate USB device [ 870.372028][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.379895][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.436893][T18002] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3136'. [ 870.561572][ T6404] usb 7-1: new full-speed USB device number 3 using dummy_hcd [ 870.766124][ T6404] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 870.810243][ T6404] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 870.828919][ T6404] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 870.840299][ T6404] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 870.854888][ T6404] usb 7-1: SerialNumber: syz [ 870.884319][ T6404] cdc_ether 7-1:1.0: probe with driver cdc_ether failed with error -22 [ 870.904373][ T6404] usb-storage 7-1:1.0: USB Mass Storage device detected [ 870.946361][ T6404] usb-storage 7-1:1.0: Quirks match for vid 0525 pid a4a5: 10000 [ 870.974068][ T6404] scsi host1: usb-storage 7-1:1.0 [ 871.002276][ T24] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 871.192555][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 871.212376][ T24] usb 4-1: config 0 interface 0 altsetting 253 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 871.238464][ T24] usb 4-1: config 0 interface 0 has no altsetting 0 [ 871.259369][ T24] usb 4-1: New USB device found, idVendor=045e, idProduct=009d, bcdDevice= 0.00 [ 871.292230][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 871.332575][ T24] usb 4-1: config 0 descriptor?? [ 871.513572][T18024] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3135'. [ 871.767661][ T24] usbhid 4-1:0.0: can't add hid device: -71 [ 871.785237][ T24] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 871.831086][ T24] usb 4-1: USB disconnect, device number 29 [ 872.372259][T18032] FAULT_INJECTION: forcing a failure. [ 872.372259][T18032] name failslab, interval 1, probability 0, space 0, times 0 [ 872.385428][T18032] CPU: 1 UID: 0 PID: 18032 Comm: syz.2.3143 Not tainted syzkaller #0 PREEMPT(full) [ 872.385454][T18032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 872.385466][T18032] Call Trace: [ 872.385475][T18032] [ 872.385484][T18032] dump_stack_lvl+0x189/0x250 [ 872.385512][T18032] ? __pfx____ratelimit+0x10/0x10 [ 872.385535][T18032] ? __pfx_dump_stack_lvl+0x10/0x10 [ 872.385560][T18032] ? __pfx__printk+0x10/0x10 [ 872.385589][T18032] ? __pfx___rt6_find_exception_rcu+0x10/0x10 [ 872.385620][T18032] should_fail_ex+0x414/0x560 [ 872.385654][T18032] should_failslab+0xa8/0x100 [ 872.385689][T18032] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 872.385717][T18032] ? __alloc_skb+0x112/0x2d0 [ 872.385742][T18032] __alloc_skb+0x112/0x2d0 [ 872.385767][T18032] alloc_skb_with_frags+0xca/0x890 [ 872.385790][T18032] ? ipv6_addr_label+0x1b5/0x240 [ 872.385813][T18032] ? ipv6_get_saddr_eval+0xb99/0xee0 [ 872.385843][T18032] sock_alloc_send_pskb+0x857/0x990 [ 872.385894][T18032] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 872.385927][T18032] ? rcuref_put+0x1b7/0x210 [ 872.385954][T18032] ? __pfx_rcuref_put+0x10/0x10 [ 872.385981][T18032] ? ip6_dst_lookup_tail+0x2ca/0x1510 [ 872.386016][T18032] __ip6_append_data+0x2b43/0x3f30 [ 872.386075][T18032] ? __pfx_icmpv6_getfrag+0x10/0x10 [ 872.386122][T18032] ? __pfx___ip6_append_data+0x10/0x10 [ 872.386149][T18032] ? __pfx_ip6_mtu+0x10/0x10 [ 872.386186][T18032] ip6_append_data+0x1c4/0x380 [ 872.386227][T18032] ? __pfx_icmpv6_getfrag+0x10/0x10 [ 872.386253][T18032] icmp6_send+0x1205/0x1940 [ 872.386279][T18032] ? icmp6_send+0x1e9/0x1940 [ 872.386322][T18032] ? __pfx_icmp6_send+0x10/0x10 [ 872.386351][T18032] ? finish_task_switch+0x266/0x950 [ 872.386390][T18032] ? xfrm_lookup_with_ifid+0x152f/0x1a70 [ 872.386429][T18032] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 872.386466][T18032] ip6_link_failure+0x3b/0x4c0 [ 872.386488][T18032] ? __pfx_ip6_link_failure+0x10/0x10 [ 872.386515][T18032] xfrmi_xmit+0xa30/0x1af0 [ 872.386546][T18032] ? validate_xmit_xfrm+0xbf/0x1160 [ 872.386569][T18032] ? finish_task_switch+0x18b/0x950 [ 872.386597][T18032] ? __pfx_xfrmi_xmit+0x10/0x10 [ 872.386643][T18032] dev_hard_start_xmit+0x2d4/0x830 [ 872.386684][T18032] __dev_queue_xmit+0x1b8d/0x3b50 [ 872.386706][T18032] ? __lock_acquire+0xab9/0xd20 [ 872.386743][T18032] ? __dev_queue_xmit+0x27b/0x3b50 [ 872.386786][T18032] ? __pfx___dev_queue_xmit+0x10/0x10 [ 872.386814][T18032] ? read_seqbegin+0x122/0x250 [ 872.386832][T18032] ? neigh_connected_output+0x1ea/0x460 [ 872.386850][T18032] ? lockdep_hardirqs_on+0x9c/0x150 [ 872.386874][T18032] ? read_seqbegin+0x1ac/0x250 [ 872.386898][T18032] ? __pfx_read_seqbegin+0x10/0x10 [ 872.386921][T18032] ? __lock_acquire+0xab9/0xd20 [ 872.386957][T18032] ? neigh_connected_output+0x3b6/0x460 [ 872.386997][T18032] ip6_finish_output2+0x11fb/0x16a0 [ 872.387022][T18032] ? ip6_finish_output2+0x701/0x16a0 [ 872.387047][T18032] ? ip6_mtu+0x7d/0x3f0 [ 872.387074][T18032] ? __pfx_ip6_finish_output2+0x10/0x10 [ 872.387095][T18032] ? ip6_mtu+0x7d/0x3f0 [ 872.387121][T18032] ? ip6_mtu+0x321/0x3f0 [ 872.387150][T18032] ? ip6_finish_output+0x2ef/0x4e0 [ 872.387183][T18032] ip6_xmit+0x107a/0x1840 [ 872.387232][T18032] ? __pfx_ip6_xmit+0x10/0x10 [ 872.387267][T18032] ? sctp_v6_xmit+0x60f/0x1300 [ 872.387300][T18032] ? sctp_v6_xmit+0x60f/0x1300 [ 872.387322][T18032] sctp_v6_xmit+0xa33/0x1300 [ 872.387364][T18032] ? __pfx_sctp_v6_xmit+0x10/0x10 [ 872.387385][T18032] ? crc32c+0x190/0x460 [ 872.387414][T18032] ? skb_crc32c+0x765/0x880 [ 872.387447][T18032] ? kmem_cache_free+0x18f/0x400 [ 872.387481][T18032] sctp_packet_transmit+0x257e/0x2bb0 [ 872.387538][T18032] ? sctp_outq_flush+0xbef/0x3140 [ 872.387566][T18032] ? sctp_outq_flush+0xbef/0x3140 [ 872.387596][T18032] sctp_outq_flush+0xecb/0x3140 [ 872.387624][T18032] ? sctp_outq_flush+0xbef/0x3140 [ 872.387652][T18032] ? sctp_make_heartbeat+0x389/0x470 [ 872.387681][T18032] ? __pfx_sctp_make_heartbeat+0x10/0x10 [ 872.387707][T18032] ? __pfx_sctp_outq_flush+0x10/0x10 [ 872.387743][T18032] ? sctp_outq_tail+0x612/0x8c0 [ 872.387770][T18032] ? sctp_do_8_2_transport_strike+0x43c/0x8b0 [ 872.387790][T18032] ? sctp_outq_uncork+0x4d/0xa0 [ 872.387821][T18032] sctp_do_sm+0x5332/0x5a20 [ 872.387852][T18032] ? arch_stack_walk+0xfc/0x150 [ 872.387890][T18032] ? __pfx_sctp_do_sm+0x10/0x10 [ 872.387915][T18032] ? stack_trace_save+0x9c/0xe0 [ 872.387939][T18032] ? __pfx_stack_trace_save+0x10/0x10 [ 872.388007][T18032] ? __lock_acquire+0xab9/0xd20 [ 872.388045][T18032] sctp_primitive_REQUESTHEARTBEAT+0x98/0xc0 [ 872.388077][T18032] sctp_apply_peer_addr_params+0xdf/0x1880 [ 872.388115][T18032] ? do_raw_spin_unlock+0x122/0x240 [ 872.388146][T18032] sctp_setsockopt_peer_addr_params+0x678/0x940 [ 872.388187][T18032] sctp_setsockopt+0x709/0x1200 [ 872.388215][T18032] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 872.388239][T18032] do_sock_setsockopt+0x179/0x1b0 [ 872.388270][T18032] __x64_sys_setsockopt+0x13f/0x1b0 [ 872.388302][T18032] do_syscall_64+0xfa/0x3b0 [ 872.388323][T18032] ? lockdep_hardirqs_on+0x9c/0x150 [ 872.388344][T18032] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 872.388365][T18032] ? clear_bhb_loop+0x60/0xb0 [ 872.388390][T18032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 872.388410][T18032] RIP: 0033:0x7fc82098eec9 [ 872.388428][T18032] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 872.388446][T18032] RSP: 002b:00007fc82182e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 872.388468][T18032] RAX: ffffffffffffffda RBX: 00007fc820be5fa0 RCX: 00007fc82098eec9 [ 872.388484][T18032] RDX: 0000000000000009 RSI: 0000000000000084 RDI: 0000000000000003 [ 872.388497][T18032] RBP: 00007fc82182e090 R08: 000000000000009c R09: 0000000000000000 [ 872.388510][T18032] R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000001 [ 872.388523][T18032] R13: 00007fc820be6038 R14: 00007fc820be5fa0 R15: 00007fc820d0fa28 [ 872.388557][T18032] [ 872.521834][ T9] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 873.158173][T18040] tipc: Enabling of bearer rejected, already enabled [ 873.246147][ T9] usb 6-1: device descriptor read/64, error -71 [ 873.370658][ T24] usb 7-1: USB disconnect, device number 3 [ 873.471887][T18043] netlink: 'syz.2.3146': attribute type 25 has an invalid length. [ 873.486387][T18043] netlink: 'syz.2.3146': attribute type 8 has an invalid length. [ 873.503330][ T9] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 873.691414][ T9] usb 6-1: device descriptor read/64, error -71 [ 873.812368][ T9] usb usb6-port1: attempt power cycle [ 874.163859][ T9] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 874.222295][ T9] usb 6-1: device descriptor read/8, error -71 [ 874.481349][ T9] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 874.502693][ T9] usb 6-1: device descriptor read/8, error -71 [ 874.643750][ T9] usb usb6-port1: unable to enumerate USB device [ 875.111531][ T6404] usb 2-1: new full-speed USB device number 98 using dummy_hcd [ 875.230981][ T5947] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 875.355783][T18093] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3156'. [ 875.422203][ T6404] usb 2-1: not running at top speed; connect to a high speed hub [ 875.434187][ T5947] usb 3-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 875.459712][ T6404] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 875.470779][ T5947] usb 3-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 875.499409][ T6404] usb 2-1: config 1 has an invalid descriptor of length 200, skipping remainder of the config [ 875.523517][ T5947] usb 3-1: config 0 interface 0 has no altsetting 0 [ 875.530279][ T6404] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 875.543857][ T5947] usb 3-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 875.560515][ T6404] usb 2-1: config 1 interface 0 altsetting 0 has an invalid endpoint descriptor of length 4, skipping [ 875.585129][ T5947] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 875.615997][ T6404] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 875.635567][ T5947] usb 3-1: config 0 descriptor?? [ 875.656629][ T6404] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 875.674123][ T6404] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 875.685804][ T6404] usb 2-1: Product: syz [ 875.690055][ T6404] usb 2-1: Manufacturer: syz [ 875.696186][ T6404] usb 2-1: SerialNumber: syz [ 875.831607][ T5934] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 875.893897][T18086] netlink: 88 bytes leftover after parsing attributes in process `syz.2.3155'. [ 875.942055][T18086] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3155'. [ 876.013085][ T5934] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 876.042614][ T5934] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 876.075336][ T5934] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 876.104271][ T5934] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 876.165281][ T5934] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 876.175539][ T5934] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 876.190673][ T5934] usb 6-1: config 0 descriptor?? [ 876.249156][ T5947] usbhid 3-1:0.0: can't add hid device: -71 [ 876.265823][ T5947] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 876.301586][ T5947] usb 3-1: USB disconnect, device number 32 [ 876.397907][ T6404] usb 2-1: 0:2 : does not exist [ 876.446622][ T6404] usb 2-1: USB disconnect, device number 98 [ 876.483908][ T7711] udevd[7711]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 876.652872][ T5934] plantronics 0003:047F:FFFF.002C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 876.832007][T18108] netlink: 452 bytes leftover after parsing attributes in process `syz.3.3159'. [ 877.121523][ T9] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 877.189459][T18116] loop6: detected capacity change from 0 to 7 [ 877.212687][T18116] Dev loop6: unable to read RDB block 7 [ 877.227175][T18116] loop6: unable to read partition table [ 877.240693][T18116] loop6: partition table beyond EOD, truncated [ 877.247846][T18116] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 877.316624][ T9] usb 4-1: config 0 has an invalid interface number: 249 but max is 0 [ 877.351707][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 877.370004][ T9] usb 4-1: config 0 has no interface number 0 [ 877.379390][ T9] usb 4-1: config 0 interface 249 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 877.422160][ T9] usb 4-1: config 0 interface 249 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 0 [ 877.440511][ T9] usb 4-1: config 0 interface 249 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 877.459031][ T9] usb 4-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=be.87 [ 877.468620][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 877.472824][ T6404] usb 6-1: USB disconnect, device number 15 [ 877.520302][ T9] usb 4-1: config 0 descriptor?? [ 877.556274][ T9] port100 4-1:0.249: NFC: Could not find bulk-in or bulk-out endpoint [ 877.896055][T18135] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3167'. [ 877.966777][ T9] usb 4-1: USB disconnect, device number 30 [ 878.861324][ T5947] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 878.957210][ T6404] usb 3-1: new low-speed USB device number 33 using dummy_hcd [ 879.042003][ T5947] usb 6-1: Using ep0 maxpacket: 32 [ 879.079011][ T5947] usb 6-1: config 6 has an invalid interface number: 91 but max is 1 [ 879.087549][ T5947] usb 6-1: config 6 contains an unexpected descriptor of type 0x1, skipping [ 879.096876][ T5947] usb 6-1: config 6 contains an unexpected descriptor of type 0x2, skipping [ 879.105750][ T5947] usb 6-1: config 6 contains an unexpected descriptor of type 0x2, skipping [ 879.121548][ T5947] usb 6-1: config 6 has an invalid interface number: 119 but max is 1 [ 879.140034][ T5947] usb 6-1: config 6 has an invalid interface number: 153 but max is 1 [ 879.154818][ T5947] usb 6-1: config 6 contains an unexpected descriptor of type 0x1, skipping [ 879.163636][ T6404] usb 3-1: device descriptor read/64, error -71 [ 879.181054][ T5947] usb 6-1: config 6 contains an unexpected descriptor of type 0x1, skipping [ 879.198541][ T5947] usb 6-1: config 6 has 3 interfaces, different from the descriptor's value: 2 [ 879.221022][ T5947] usb 6-1: config 6 has no interface number 0 [ 879.234838][ T5947] usb 6-1: config 6 has no interface number 1 [ 879.250886][ T5947] usb 6-1: config 6 has no interface number 2 [ 879.263724][ T5947] usb 6-1: config 6 interface 91 altsetting 14 endpoint 0xB has an invalid bInterval 192, changing to 11 [ 879.295866][ T5947] usb 6-1: config 6 interface 91 altsetting 14 has a duplicate endpoint with address 0xC, skipping [ 879.329460][ T5947] usb 6-1: config 6 interface 91 altsetting 14 has 5 endpoint descriptors, different from the interface descriptor's value: 6 [ 879.354839][ T5947] usb 6-1: too many endpoints for config 6 interface 119 altsetting 159: 60, using maximum allowed: 30 [ 879.377410][ T5947] usb 6-1: config 6 interface 119 altsetting 159 has 0 endpoint descriptors, different from the interface descriptor's value: 60 [ 879.401323][ T6404] usb 3-1: new low-speed USB device number 34 using dummy_hcd [ 879.417634][ T5947] usb 6-1: config 6 interface 153 altsetting 51 has an invalid descriptor for endpoint zero, skipping [ 879.443701][ T5947] usb 6-1: config 6 interface 153 altsetting 51 has an invalid descriptor for endpoint zero, skipping [ 879.468961][ T5947] usb 6-1: config 6 interface 153 altsetting 51 has a duplicate endpoint with address 0x5, skipping [ 879.494526][ T5947] usb 6-1: config 6 interface 153 altsetting 51 has an invalid descriptor for endpoint zero, skipping [ 879.518983][ T5947] usb 6-1: config 6 interface 153 altsetting 51 endpoint 0xD has invalid wMaxPacketSize 0 [ 879.551010][ T6404] usb 3-1: device descriptor read/64, error -71 [ 879.560130][ T5947] usb 6-1: config 6 interface 153 altsetting 51 has an invalid descriptor for endpoint zero, skipping [ 879.591204][ T5947] usb 6-1: config 6 interface 153 altsetting 51 has a duplicate endpoint with address 0x3, skipping [ 879.610892][ T5947] usb 6-1: config 6 interface 153 altsetting 51 has a duplicate endpoint with address 0xD, skipping [ 879.630892][ T5947] usb 6-1: config 6 interface 153 altsetting 51 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 879.658291][ T5947] usb 6-1: config 6 interface 153 altsetting 51 has a duplicate endpoint with address 0x3, skipping [ 879.672165][ T6404] usb usb3-port1: attempt power cycle [ 879.690909][ T5947] usb 6-1: config 6 interface 91 has no altsetting 0 [ 879.708032][ T5947] usb 6-1: config 6 interface 119 has no altsetting 0 [ 879.720888][ T5947] usb 6-1: config 6 interface 153 has no altsetting 0 [ 879.849456][ T5947] usb 6-1: New USB device found, idVendor=046d, idProduct=08d8, bcdDevice=ca.c4 [ 879.972590][ T5947] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 880.007305][ T5947] usb 6-1: Product: syz [ 880.021459][ T5947] usb 6-1: Manufacturer: А [ 880.037745][ T5947] usb 6-1: SerialNumber: syz [ 880.042985][ T6404] usb 3-1: new low-speed USB device number 35 using dummy_hcd [ 880.083922][ T6404] usb 3-1: device descriptor read/8, error -71 [ 880.331684][ T6404] usb 3-1: new low-speed USB device number 36 using dummy_hcd [ 880.340934][ T5973] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 880.386813][ T6404] usb 3-1: device descriptor read/8, error -71 [ 880.511603][ T6404] usb usb3-port1: unable to enumerate USB device [ 880.553758][ T5973] usb 7-1: config 0 has an invalid interface number: 113 but max is 0 [ 880.566971][ T5973] usb 7-1: config 0 has no interface number 0 [ 880.595662][ T5973] usb 7-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 880.674537][ T5973] usb 7-1: config 0 interface 113 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 880.750835][ T5973] usb 7-1: config 0 interface 113 has no altsetting 0 [ 880.788904][ T5973] usb 7-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 880.840481][ T5973] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 880.887357][ T5973] usb 7-1: Product: syz [ 880.950026][ T5973] usb 7-1: Manufacturer: syz [ 881.008255][ T5973] usb 7-1: SerialNumber: syz [ 881.025515][ T5947] usb 6-1: USB disconnect, device number 16 [ 881.040233][ T5973] usb 7-1: config 0 descriptor?? [ 881.123938][T18168] veth0_to_team: entered promiscuous mode [ 881.201769][ C1] usb 7-1: NFC: Urb failure (status -71) [ 881.242332][ T5973] usb 7-1: NFC: Unable to get FW version [ 881.263287][T18171] loop6: detected capacity change from 0 to 7 [ 881.282962][ T5973] pn533_usb 7-1:0.113: probe with driver pn533_usb failed with error -90 [ 881.347238][T18171] Dev loop6: unable to read RDB block 7 [ 881.364146][T18171] loop6: unable to read partition table [ 881.393425][T18171] loop6: partition table beyond EOD, truncated [ 881.441421][T18171] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 881.749615][T18174] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3178'. [ 881.806045][T18176] tipc: Enabling of bearer rejected, already enabled [ 882.521489][T17248] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 882.702026][T17248] usb 3-1: Using ep0 maxpacket: 16 [ 882.842675][T18188] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3184'. [ 883.534529][ T9] usb 7-1: USB disconnect, device number 4 [ 883.649463][T18197] netlink: 88 bytes leftover after parsing attributes in process `syz.6.3186'. [ 884.334447][T18204] loop6: detected capacity change from 0 to 7 [ 884.348699][ T7711] Dev loop6: unable to read RDB block 7 [ 884.356194][ T7711] loop6: unable to read partition table [ 884.365511][ T7711] loop6: partition table beyond EOD, truncated [ 884.376630][T18204] Dev loop6: unable to read RDB block 7 [ 884.393887][T18204] loop6: unable to read partition table [ 884.400601][T18204] loop6: partition table beyond EOD, truncated [ 884.412990][T18204] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 884.951882][T18207] netlink: 'syz.5.3189': attribute type 12 has an invalid length. [ 885.785906][T18212] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3190'. [ 885.932037][T17248] usb 3-1: unable to get BOS descriptor or descriptor too short [ 885.968061][T17248] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 886.009106][T17248] usb 3-1: can't read configurations, error -71 [ 886.305024][T18230] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3197'. [ 886.371485][T18230] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3197'. [ 887.780949][ T5973] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 887.821479][T18255] loop2: detected capacity change from 0 to 7 [ 887.886700][T18255] Dev loop2: unable to read RDB block 7 [ 887.911347][T18255] loop2: unable to read partition table [ 887.928022][T18255] loop2: partition table beyond EOD, truncated [ 887.952851][T18255] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 887.980923][ T5973] usb 6-1: Using ep0 maxpacket: 32 [ 888.013872][ T5973] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 888.055488][ T5973] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 888.071343][ T5934] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 888.128157][ T5973] usb 6-1: New USB device found, idVendor=0079, idProduct=1801, bcdDevice= 0.00 [ 888.200531][ T5973] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 888.222115][ T5934] usb 7-1: Using ep0 maxpacket: 16 [ 888.259800][ T5973] usb 6-1: config 0 descriptor?? [ 888.265690][ T5934] usb 7-1: config index 0 descriptor too short (expected 42, got 18) [ 888.303523][ T5934] usb 7-1: too many endpoints for config 0 interface 0 altsetting 0: 219, using maximum allowed: 30 [ 888.390796][ T5934] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 219 [ 888.506216][T18249] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 888.524524][ T5934] usb 7-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice= 7.06 [ 888.548210][T18249] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 888.554509][ T5934] usb 7-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 888.589403][ T5934] usb 7-1: Product: syz [ 888.617130][ T5934] usb 7-1: SerialNumber: syz [ 888.652407][ T5934] r8152-cfgselector 7-1: Unknown version 0x0000 [ 888.666991][ T5934] r8152-cfgselector 7-1: config 0 descriptor?? [ 888.719363][ T5973] usbhid 6-1:0.0: can't add hid device: -71 [ 888.737950][ T5973] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 888.770748][ T5973] usb 6-1: USB disconnect, device number 17 [ 888.783623][ T5934] hub 7-1:0.0: bad descriptor, ignoring hub [ 888.824760][ T5934] hub 7-1:0.0: probe with driver hub failed with error -5 [ 889.336393][T18272] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3209'. [ 889.821577][ T5934] usb 6-1: new full-speed USB device number 18 using dummy_hcd [ 889.993458][ T5934] usb 6-1: config 0 has no interfaces? [ 890.025761][ T5934] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 890.081701][ T5934] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 890.141764][ T5934] usb 6-1: Product: syz [ 890.145954][ T5934] usb 6-1: Manufacturer: syz [ 890.199194][ T5934] usb 6-1: SerialNumber: syz [ 890.221997][ T5934] usb 6-1: config 0 descriptor?? [ 890.439909][T18286] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3214'. [ 890.496237][T18286] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3214'. [ 890.624230][ T5973] r8152-cfgselector 7-1: USB disconnect, device number 5 [ 891.011755][ T5934] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 891.172626][ T5934] usb 7-1: config 3 has an invalid interface number: 168 but max is 0 [ 891.186146][ T5934] usb 7-1: config 3 has no interface number 0 [ 891.203342][ T5934] usb 7-1: config 3 interface 168 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 891.239122][ T5934] usb 7-1: config 3 interface 168 altsetting 0 endpoint 0x81 has invalid maxpacket 30768, setting to 1024 [ 891.265768][ T5934] usb 7-1: config 3 interface 168 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1024 [ 891.306171][ T5934] usb 7-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice=a8.a4 [ 891.322758][ T5934] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 891.345386][T18289] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 891.576699][ T5934] usb 7-1: string descriptor 0 read error: -71 [ 891.591167][ T5973] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 891.625917][ T5934] keyspan 7-1:3.168: Keyspan 2 port adapter converter detected [ 891.655554][ T5934] keyspan 7-1:3.168: found no endpoint descriptor for endpoint 1 [ 891.684116][ T5934] keyspan 7-1:3.168: found no endpoint descriptor for endpoint 84 [ 891.713741][ T5934] keyspan 7-1:3.168: found no endpoint descriptor for endpoint 2 [ 891.751389][ T5973] usb 2-1: Using ep0 maxpacket: 16 [ 891.767762][ T5934] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 891.771850][ T5973] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 891.803081][ T5934] keyspan 7-1:3.168: found no endpoint descriptor for endpoint 88 [ 891.828882][ T5973] usb 2-1: New USB device found, idVendor=046d, idProduct=08f0, bcdDevice=50.0d [ 891.840446][ T5934] keyspan 7-1:3.168: found no endpoint descriptor for endpoint 6 [ 891.854025][ T5973] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 891.868900][ T5934] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 891.897033][ T5973] usb 2-1: Product: syz [ 891.908879][ T5973] usb 2-1: Manufacturer: syz [ 891.920755][ T5973] usb 2-1: SerialNumber: syz [ 891.953453][ T5934] usb 7-1: USB disconnect, device number 6 [ 891.960132][ T5973] usb 2-1: config 0 descriptor?? [ 891.985160][ T5973] gspca_main: STV06xx-2.14.0 probing 046d:08f0 [ 891.993562][ T5973] gspca_stv06xx: st6422 sensor detected [ 892.008937][ T5934] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 892.078562][ T5934] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 892.133844][ T5934] keyspan 7-1:3.168: device disconnected [ 892.251215][ T5947] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 892.369497][T18311] netlink: 48 bytes leftover after parsing attributes in process `syz.6.3221'. [ 892.431378][ T5947] usb 3-1: Using ep0 maxpacket: 8 [ 892.446877][ T5947] usb 3-1: unable to get BOS descriptor or descriptor too short [ 892.480429][ T5947] usb 3-1: config 5 has an invalid interface number: 215 but max is 0 [ 892.496352][ T5947] usb 3-1: config 5 has no interface number 0 [ 892.517459][ T5947] usb 3-1: config 5 interface 215 has no altsetting 0 [ 892.547258][ T5947] usb 3-1: New USB device found, idVendor=1163, idProduct=0100, bcdDevice=dc.ba [ 892.579851][ T5947] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 892.640775][ T5947] usb 3-1: Product: ဈ [ 892.662389][ T6404] usb 6-1: USB disconnect, device number 18 [ 892.695354][ T5947] usb 3-1: Manufacturer: 댣楲㋬鱴㟠葩栜嬡﫧搐 [ 892.736020][ T5947] usb 3-1: SerialNumber: 謉ꧡꍢჂ㯶쪰쨝첡鐴ȟ嫭㹞฽铲깍⽲羹㷠罳뺝햼圭୤熹莉倱罎刑②鐒㷎ꗔᛶ웁셊虞뢉ᠠ᯷쩉漂 [ 892.800468][T18317] fuse: Unknown parameter 'fd0xffffffffffffffff00000000000000000000' [ 892.824947][T18317] netlink: 152 bytes leftover after parsing attributes in process `syz.6.3222'. [ 892.883295][T18317] ip6tnl2: entered promiscuous mode [ 892.996159][T18317] netdevsim netdevsim6 netdevsim0: entered allmulticast mode [ 893.018708][ T5947] cypress_m8 3-1:5.215: DeLorme Earthmate USB converter detected [ 893.057618][T18317] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 893.085431][ T5947] earthmate ttyUSB0: required endpoint is missing [ 893.106973][ T5973] STV06xx 2-1:0.0: probe with driver STV06xx failed with error -71 [ 893.205091][T18323] openvswitch: netlink: Flow key attr not present in new flow. [ 893.487541][ T5973] usb 2-1: USB disconnect, device number 99 [ 893.494104][ T5947] usb 3-1: USB disconnect, device number 39 [ 893.558515][ T5947] cypress_m8 3-1:5.215: device disconnected [ 893.586714][T18326] tipc: Started in network mode [ 893.620516][T18326] tipc: Node identity fe800000000000000000000000000016, cluster identity 4711 [ 893.665788][T18326] tipc: Enabled bearer , priority 10 [ 893.928093][ T30] kauditd_printk_skb: 62 callbacks suppressed [ 893.928111][ T30] audit: type=1400 audit(1758870769.302:3265): apparmor="DENIED" operation="change_hat" class="file" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=18330 comm="syz.3.3228" [ 894.158693][T18342] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 894.215318][T17248] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 894.383765][T17248] usb 6-1: Using ep0 maxpacket: 16 [ 894.392393][T17248] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 894.406541][T17248] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 894.426287][T17248] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 894.466491][T17248] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 894.493621][T17248] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 894.525125][T17248] usb 6-1: config 0 descriptor?? [ 894.661373][ T5973] tipc: Node number set to 4269801494 [ 894.831489][ T5934] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 894.883250][T18349] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3232'. [ 894.985402][ T5934] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 895.000767][ T5934] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 895.021478][ T5934] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 895.034722][ T5934] usb 7-1: config 0 descriptor?? [ 895.048396][T17248] usbhid 6-1:0.0: can't add hid device: -71 [ 895.065872][T17248] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 895.080611][ T5934] pwc: Askey VC010 type 2 USB webcam detected. [ 895.104051][T17248] usb 6-1: USB disconnect, device number 19 [ 895.292701][ T5934] pwc: recv_control_msg error -32 req 02 val 2b00 [ 895.486970][ T5934] pwc: recv_control_msg error -71 req 02 val 2700 [ 895.503320][ T5934] pwc: recv_control_msg error -71 req 02 val 2c00 [ 895.556907][ T5934] pwc: recv_control_msg error -71 req 04 val 1000 [ 895.656129][ T5934] pwc: recv_control_msg error -71 req 04 val 1300 [ 895.732220][ T5934] pwc: recv_control_msg error -71 req 04 val 1400 [ 895.752051][ T5934] pwc: recv_control_msg error -71 req 02 val 2000 [ 895.921506][ T5934] pwc: recv_control_msg error -71 req 02 val 2100 [ 895.958767][ T5934] pwc: recv_control_msg error -71 req 04 val 1500 [ 896.043436][ T5934] pwc: recv_control_msg error -71 req 02 val 2500 [ 896.074200][ T5934] pwc: recv_control_msg error -71 req 02 val 2400 [ 896.099297][ T5934] pwc: recv_control_msg error -71 req 02 val 2600 [ 896.157042][ T5934] pwc: recv_control_msg error -71 req 02 val 2900 [ 896.176838][ T5934] pwc: recv_control_msg error -71 req 02 val 2800 [ 896.194366][ T5934] pwc: recv_control_msg error -71 req 04 val 1100 [ 896.237124][ T5934] pwc: recv_control_msg error -71 req 04 val 1200 [ 896.312296][ T5934] pwc: Registered as video103. [ 896.375107][ T5934] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input50 [ 896.471851][ T5934] usb 7-1: USB disconnect, device number 7 [ 896.972557][T18373] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 896.991656][T18373] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 897.029492][T18373] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 897.074888][T18373] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 897.101337][T18373] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 897.308028][T18377] tipc: Enabling of bearer rejected, already enabled [ 897.605488][T18381] fuse: Bad value for 'rootmode' [ 898.025772][T18396] netlink: 60 bytes leftover after parsing attributes in process `syz.5.3245'. [ 898.091099][T18398] program syz.6.3246 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 898.101130][ T5973] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 898.218449][T18375] chnl_net:caif_netlink_parms(): no params data found [ 898.274198][ T5973] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 898.303142][ T5973] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 898.343059][ T5973] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 898.358501][ T5973] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 898.391800][ T5973] usb 2-1: config 0 descriptor?? [ 898.400959][ T5947] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 898.580783][T18375] bridge0: port 1(bridge_slave_0) entered blocking state [ 898.588255][ T5947] usb 7-1: Using ep0 maxpacket: 32 [ 898.593689][T18375] bridge0: port 1(bridge_slave_0) entered disabled state [ 898.652041][ T5947] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 898.675612][ T5973] usbhid 2-1:0.0: can't add hid device: -71 [ 898.684691][T18375] bridge_slave_0: entered allmulticast mode [ 898.697883][ T5973] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 898.707914][ T5947] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 898.717933][T18375] bridge_slave_0: entered promiscuous mode [ 898.743585][ T5973] usb 2-1: USB disconnect, device number 100 [ 898.753835][T18375] bridge0: port 2(bridge_slave_1) entered blocking state [ 898.765801][ T5947] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 898.793164][ T5947] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 898.801549][T18375] bridge0: port 2(bridge_slave_1) entered disabled state [ 898.818825][ T5947] usb 7-1: Product: syz [ 898.828988][ T5947] usb 7-1: Manufacturer: syz [ 898.834947][T18392] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3243'. [ 898.841751][T18375] bridge_slave_1: entered allmulticast mode [ 898.863200][ T5947] usb 7-1: SerialNumber: syz [ 898.885652][ T5947] usb 7-1: config 0 descriptor?? [ 898.886320][T18375] bridge_slave_1: entered promiscuous mode [ 899.052557][T18375] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 899.083707][T18375] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 899.222423][T18375] team0: Port device team_slave_0 added [ 899.241103][T18373] Bluetooth: hci5: command tx timeout [ 899.259875][T18375] team0: Port device team_slave_1 added [ 899.361929][ T5973] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 899.399329][T18375] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 899.426359][T18375] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 899.459417][T18375] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 899.473386][T18375] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 899.480334][T18375] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 899.526298][ T30] audit: type=1800 audit(1758870774.902:3266): pid=18416 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.3249" name="#795" dev="tmpfs" ino=795 res=0 errno=0 [ 899.530883][T18375] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 899.561185][ T5973] usb 2-1: Using ep0 maxpacket: 16 [ 899.599548][ T5973] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 899.624056][ T5973] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 899.654691][ T5973] usb 2-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 899.671138][ T5973] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 899.707051][ T5973] usb 2-1: config 0 descriptor?? [ 899.723027][T17716] usb 7-1: USB disconnect, device number 8 [ 899.799419][T18418] tipc: Enabling of bearer rejected, already enabled [ 899.820820][T18375] hsr_slave_0: entered promiscuous mode [ 899.860589][T18375] hsr_slave_1: entered promiscuous mode [ 899.878568][T18375] debugfs: 'hsr0' already exists in 'hsr' [ 899.885186][T18375] Cannot create hsr debugfs directory [ 900.231272][T17716] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 900.348533][T18392] binder: 18389:18392 ioctl 40044591 0 returned -22 [ 900.414771][T17716] usb 7-1: config 0 has no interfaces? [ 900.416936][T18375] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 900.435511][T18435] binder: 18389:18435 ioctl c0306201 200000000640 returned -22 [ 900.436224][T17716] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 900.457262][T18375] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 900.582316][T17716] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 900.605846][T17716] usb 7-1: Product: syz [ 900.610049][T17716] usb 7-1: Manufacturer: syz [ 900.615267][T17716] usb 7-1: SerialNumber: syz [ 900.633575][T17716] usb 7-1: config 0 descriptor?? [ 900.663157][ T5973] usbhid 2-1:0.0: can't add hid device: -71 [ 900.708781][ T5973] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 900.755556][ T5973] usb 2-1: USB disconnect, device number 101 [ 900.905292][T18375] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 900.920471][T18375] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 901.321345][T18373] Bluetooth: hci5: command tx timeout [ 901.627135][T17716] usb 7-1: USB disconnect, device number 9 [ 901.744351][T18375] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 901.828731][T18375] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 902.062057][T18375] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 902.103952][T18375] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 902.114556][ T5973] usb 2-1: new low-speed USB device number 102 using dummy_hcd [ 902.351160][ T5973] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 902.359316][ T5973] usb 2-1: config 0 has no interface number 0 [ 902.414916][ T5973] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 902.471376][ T5973] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 902.514868][ T5973] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 902.532240][ T5973] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 902.561639][ T5973] usb 2-1: config 0 descriptor?? [ 902.597069][ T5973] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 902.664429][T18375] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 902.705727][T18375] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 902.773544][T18375] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 902.785008][T18444] iowarrior 2-1:0.1: Error -90 while submitting URB [ 902.833634][T18466] fuse: Unknown parameter 'su' [ 902.850661][T18375] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 902.888229][ T5934] usb 2-1: USB disconnect, device number 102 [ 902.931458][T17248] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 903.118420][T17248] usb 4-1: unable to get BOS descriptor or descriptor too short [ 903.156724][T17248] usb 4-1: config 13 has an invalid interface number: 50 but max is 3 [ 903.191833][T17248] usb 4-1: config 13 has an invalid descriptor of length 0, skipping remainder of the config [ 903.244541][T17248] usb 4-1: config 13 has 1 interface, different from the descriptor's value: 4 [ 903.254461][T17248] usb 4-1: config 13 has no interface number 0 [ 903.263583][T17248] usb 4-1: config 13 interface 50 altsetting 4 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 903.275100][T17248] usb 4-1: config 13 interface 50 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 903.291720][T17248] usb 4-1: config 13 interface 50 has no altsetting 0 [ 903.297429][T18488] netlink: 68 bytes leftover after parsing attributes in process `syz.6.3269'. [ 903.301528][T17248] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=a9.e8 [ 903.331108][T17248] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 903.339113][T17248] usb 4-1: Product: syz [ 903.344475][T18375] 8021q: adding VLAN 0 to HW filter on device bond0 [ 903.351420][ T5934] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 903.364404][T17248] usb 4-1: Manufacturer: syz [ 903.368581][T18488] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3269'. [ 903.369009][T17248] usb 4-1: SerialNumber: syz [ 903.383765][T18488] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3269'. [ 903.401673][T18373] Bluetooth: hci5: command tx timeout [ 903.442715][T18375] 8021q: adding VLAN 0 to HW filter on device team0 [ 903.491935][ T5934] usb 6-1: device descriptor read/64, error -71 [ 903.548391][T18495] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3271'. [ 903.620040][T18495] 8021q: adding VLAN 0 to HW filter on device bond9 [ 903.669809][ T3475] bridge0: port 1(bridge_slave_0) entered blocking state [ 903.677018][ T3475] bridge0: port 1(bridge_slave_0) entered forwarding state [ 903.708621][T18495] bond9: (slave batadv1): Opening slave failed [ 903.726505][ T73] bridge0: port 2(bridge_slave_1) entered blocking state [ 903.733136][ T5934] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 903.733671][ T73] bridge0: port 2(bridge_slave_1) entered forwarding state [ 903.810335][T18375] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 903.838387][T18375] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 903.882503][ T5934] usb 6-1: device descriptor read/64, error -71 [ 903.916569][T18375] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 904.002995][ T5934] usb usb6-port1: attempt power cycle [ 904.027328][T18375] veth0_vlan: entered promiscuous mode [ 904.070541][T18375] veth1_vlan: entered promiscuous mode [ 904.209366][T18375] veth0_macvtap: entered promiscuous mode [ 904.277616][T18375] veth1_macvtap: entered promiscuous mode [ 904.331731][T18375] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 904.352031][ T5934] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 904.388755][T18375] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 904.398708][ T5934] usb 6-1: device descriptor read/8, error -71 [ 904.437459][T16039] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 904.467551][T16039] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 904.530103][T10447] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 904.573923][T10447] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 904.731774][ T5934] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 904.741535][T18514] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3272'. [ 904.792639][ T5934] usb 6-1: device descriptor read/8, error -71 [ 904.905642][T18514] (unnamed net_device) (uninitialized): option resend_igmp: invalid value (511) [ 904.911779][ T5934] usb usb6-port1: unable to enumerate USB device [ 904.925118][T18514] (unnamed net_device) (uninitialized): option resend_igmp: allowed values 0 - 255 [ 904.952728][T18512] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 904.977056][T18512] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 905.025325][T18512] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 905.052232][T18512] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 905.122209][T18512] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 905.256001][T16041] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 905.291736][T16041] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 905.459318][ T73] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 905.480668][ T73] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 905.852559][T17248] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 905.870107][ T12] usb 4-1: Failed to submit usb control message: -71 [ 905.948149][ T12] usb 4-1: unable to send the bmi data to the device: -71 [ 905.989968][T17248] usb 4-1: USB disconnect, device number 31 [ 905.999426][ T12] usb 4-1: unable to get target info from device [ 906.020618][ T12] usb 4-1: could not get target info (-71) [ 906.032324][ T12] usb 4-1: could not probe fw (-71) [ 906.471679][T18498] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 906.561503][T17248] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 906.571236][ T5973] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 906.631496][T18498] usb 3-1: Using ep0 maxpacket: 32 [ 906.639263][T18498] usb 3-1: unable to get BOS descriptor or descriptor too short [ 906.656459][T18498] usb 3-1: config 2 has an invalid interface number: 189 but max is 0 [ 906.678473][T18498] usb 3-1: config 2 has no interface number 0 [ 906.697439][T18498] usb 3-1: config 2 interface 189 altsetting 11 has an invalid endpoint descriptor of length 3, skipping [ 906.736409][T18498] usb 3-1: config 2 interface 189 has no altsetting 0 [ 906.744503][T17248] usb 4-1: Using ep0 maxpacket: 16 [ 906.756813][ T5973] usb 6-1: config index 0 descriptor too short (expected 36, got 35) [ 906.767442][T17248] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 906.793818][T18498] usb 3-1: New USB device found, idVendor=041e, idProduct=3f19, bcdDevice=9b.52 [ 906.806159][T17248] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 906.806168][ T5973] usb 6-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 906.806211][ T5973] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 906.847291][T18498] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 906.868914][T17248] usb 4-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 906.891655][T18498] usb 3-1: Product: syz [ 906.899499][T18498] usb 3-1: Manufacturer: syz [ 906.908297][T17248] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 906.928524][T18498] usb 3-1: SerialNumber: syz [ 906.948750][T17248] usb 4-1: config 0 descriptor?? [ 906.966662][ T5973] usb 6-1: New USB device found, idVendor=172f, idProduct=0032, bcdDevice= 0.00 [ 907.001886][T18373] Bluetooth: hci3: command 0x0c1a tx timeout [ 907.006308][ T51] Bluetooth: hci2: command 0x0c1a tx timeout [ 907.038941][ T5973] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 907.080715][ T5973] usb 6-1: config 0 descriptor?? [ 907.087310][ T51] Bluetooth: hci5: command 0x0c1a tx timeout [ 907.118770][ T5973] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 907.209059][T18498] usb 3-1: unknown interface protocol 0x3b, assuming v1 [ 907.239517][T18498] usb 3-1: 189:2 : does not exist [ 907.277068][T18498] usb 3-1: USB disconnect, device number 40 [ 907.470504][T17248] hid (null): report_id 915 is invalid [ 907.482868][ T7711] udevd[7711]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:2.189/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 907.518546][T17248] hid (null): global environment stack underflow [ 907.526844][T17248] hid (null): unknown global tag 0xd [ 907.555423][T17248] hid (null): unknown global tag 0xc [ 907.666477][ T51] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 907.845098][T18540] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.3275'. [ 907.861551][T18540] netlink: zone id is out of range [ 907.877063][T18540] netlink: zone id is out of range [ 907.893969][T18540] netlink: zone id is out of range [ 907.921959][T18540] netlink: get zone limit has 8 unknown bytes [ 908.210107][T17248] usb 4-1: string descriptor 0 read error: -71 [ 908.246452][T17248] usb 4-1: Max retries (5) exceeded reading string descriptor 200 [ 908.256271][T17248] letsketch 0003:6161:4D15.002D: probe with driver letsketch failed with error -32 [ 908.286700][T17248] usb 4-1: USB disconnect, device number 32 [ 908.451474][T18498] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 908.601680][T18498] usb 3-1: Using ep0 maxpacket: 16 [ 908.638286][T18498] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 33437, setting to 1024 [ 908.653638][T18498] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0xF has invalid maxpacket 1024 [ 908.664279][T18498] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 908.674906][T18498] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 908.698029][T18498] usb 3-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 908.710628][T18498] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 908.721634][T18498] usb 3-1: Product: syz [ 908.725874][T18498] usb 3-1: Manufacturer: syz [ 908.730520][T18498] usb 3-1: SerialNumber: syz [ 908.739595][T18498] usb 3-1: config 0 descriptor?? [ 908.760472][T18546] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 908.789971][ C0] port100 3-1:0.0: NFC: Urb failure (status -71) [ 908.819511][T18498] port100 3-1:0.0: NFC: Could not get supported command types [ 909.007710][ T5973] usb 3-1: USB disconnect, device number 41 [ 909.141137][T18558] netlink: 176 bytes leftover after parsing attributes in process `syz.1.3286'. [ 909.171836][ T51] Bluetooth: hci5: command 0x0c1a tx timeout [ 909.322408][ T5973] usb 6-1: USB disconnect, device number 24 [ 909.481792][T17248] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 909.491940][T18498] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 909.661599][T17248] usb 2-1: Using ep0 maxpacket: 8 [ 909.669467][T17248] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x99, changing to 0x89 [ 909.681536][T18498] usb 4-1: Using ep0 maxpacket: 16 [ 909.701474][T18498] usb 4-1: config 2 has an invalid interface number: 4 but max is 0 [ 909.709592][ T30] audit: type=1400 audit(1758870785.082:3267): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=3A21D01A0B978D2F2F262D2A83D1 pid=18566 comm="syz.2.3289" [ 909.742219][T17248] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 3840, setting to 64 [ 909.760532][T18498] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 909.774384][T18568] netlink: 'syz.2.3289': attribute type 3 has an invalid length. [ 909.782821][T18498] usb 4-1: config 2 has no interface number 0 [ 909.789114][T18568] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3289'. [ 909.789620][T18498] usb 4-1: config 2 interface 4 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 909.810768][T17248] usb 2-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 909.820213][T17248] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 909.828528][T17248] usb 2-1: Product: syz [ 909.833745][T17248] usb 2-1: Manufacturer: syz [ 909.838419][T18498] usb 4-1: config 2 interface 4 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 909.852524][T17248] usb 2-1: SerialNumber: syz [ 909.870184][T17248] usb 2-1: config 0 descriptor?? [ 909.880342][T17248] streamzap 2-1:0.0: streamzap_probe: endpoint attributes don't match xfer 0200 [ 909.883266][T18567] macvlan0: entered promiscuous mode [ 909.905742][T18498] usb 4-1: New USB device found, idVendor=0499, idProduct=1018, bcdDevice=b2.da [ 909.919765][T18498] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 909.929918][T18498] usb 4-1: Product: syz [ 909.935472][T18498] usb 4-1: Manufacturer: syz [ 909.956388][T18498] usb 4-1: SerialNumber: syz [ 909.962482][T18567] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3289'. [ 909.994658][T18498] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 910.049735][T18498] snd-usb-audio 4-1:2.4: probe with driver snd-usb-audio failed with error -2 [ 910.086407][T17248] usb 2-1: USB disconnect, device number 103 [ 910.239469][ T7711] udevd[7711]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:2.4/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 910.271771][ T5948] usb 4-1: USB disconnect, device number 33 [ 910.521277][T18576] loop6: detected capacity change from 0 to 7 [ 910.560241][T18576] Dev loop6: unable to read RDB block 7 [ 910.574347][T18576] loop6: unable to read partition table [ 910.580216][T18576] loop6: partition table beyond EOD, truncated [ 910.632431][T18576] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 910.799940][T18579] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 910.847805][T18582] loop4: detected capacity change from 0 to 7 [ 910.955665][T18582] Dev loop4: unable to read RDB block 7 [ 910.982570][T18589] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3296'. [ 910.999205][T18582] loop4: unable to read partition table [ 910.999462][T18582] loop4: partition table beyond EOD, truncated [ 910.999496][T18582] loop_reread_partitions: partition scan of loop4 (被x ) failed (rc=-5) [ 911.242596][ T51] Bluetooth: hci5: command 0x0c1a tx timeout [ 911.893258][T17248] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 911.957328][T17716] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 912.060092][T17248] usb 4-1: Using ep0 maxpacket: 16 [ 912.085493][T17248] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 912.117352][T17248] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 912.153016][T17248] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 912.153434][T18616] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 912.181594][T17716] usb 2-1: Using ep0 maxpacket: 16 [ 912.200605][T17716] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 912.225036][T17716] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 912.242616][T17248] usb 4-1: config 0 descriptor?? [ 912.251775][T17716] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 912.368215][T18621] netlink: 176 bytes leftover after parsing attributes in process `syz.6.3305'. [ 912.377353][T17716] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 912.377380][T17716] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 912.425522][T17716] usb 2-1: config 0 descriptor?? [ 912.573857][T18624] netlink: 68 bytes leftover after parsing attributes in process `syz.5.3306'. [ 912.602222][T18624] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3306'. [ 912.620110][T18624] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3306'. [ 912.704115][T17248] mcp2221 0003:04D8:00DD.002E: unknown main item tag 0x0 [ 912.771736][T17248] mcp2221 0003:04D8:00DD.002E: unknown main item tag 0x0 [ 912.784532][T17248] mcp2221 0003:04D8:00DD.002E: unknown main item tag 0x0 [ 912.798762][T17248] mcp2221 0003:04D8:00DD.002E: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 912.821061][ T5973] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 912.843952][T17716] microsoft 0003:045E:07DA.002F: unknown main item tag 0x0 [ 912.863804][T17716] microsoft 0003:045E:07DA.002F: unknown main item tag 0x0 [ 912.885772][T18610] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 912.905635][T18628] tipc: Enabling of bearer rejected, already enabled [ 912.925416][T18610] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 912.943582][T17716] microsoft 0003:045E:07DA.002F: unknown main item tag 0x0 [ 912.964094][T17716] microsoft 0003:045E:07DA.002F: unknown main item tag 0x0 [ 912.982413][T17716] microsoft 0003:045E:07DA.002F: unknown main item tag 0x0 [ 912.994822][T17716] microsoft 0003:045E:07DA.002F: unknown main item tag 0x0 [ 913.007797][ T6404] usb 4-1: USB disconnect, device number 34 [ 913.014960][ T5973] usb 7-1: Using ep0 maxpacket: 8 [ 913.025064][ T5973] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x99, changing to 0x89 [ 913.037257][T17716] microsoft 0003:045E:07DA.002F: unknown main item tag 0x0 [ 913.062445][T18612] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 913.074215][ T5973] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 3840, setting to 64 [ 913.101606][T17716] microsoft 0003:045E:07DA.002F: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 913.131732][T18612] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 913.145349][ T5973] usb 7-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 913.163792][T17716] microsoft 0003:045E:07DA.002F: no inputs found [ 913.177861][ T5973] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 913.199521][T17716] microsoft 0003:045E:07DA.002F: could not initialize ff, continuing anyway [ 913.229825][ T5973] usb 7-1: Product: syz [ 913.241399][ T5973] usb 7-1: Manufacturer: syz [ 913.246005][ T5973] usb 7-1: SerialNumber: syz [ 913.269945][T17716] usb 2-1: USB disconnect, device number 104 [ 913.302649][ T5973] usb 7-1: config 0 descriptor?? [ 913.333976][T18632] fido_id[18632]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 913.345339][ T5973] streamzap 7-1:0.0: streamzap_probe: endpoint attributes don't match xfer 0200 [ 913.381789][T18638] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3311'. [ 913.392395][T18638] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3311'. [ 913.511720][T17248] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 913.552647][T17716] usb 7-1: USB disconnect, device number 10 [ 913.684054][T17248] usb 6-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 913.699982][T17248] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 913.718294][T17248] usb 6-1: config 0 descriptor?? [ 913.728188][T17248] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 914.004406][T18658] FAULT_INJECTION: forcing a failure. [ 914.004406][T18658] name failslab, interval 1, probability 0, space 0, times 0 [ 914.018718][T18658] CPU: 0 UID: 0 PID: 18658 Comm: syz.3.3317 Not tainted syzkaller #0 PREEMPT(full) [ 914.018744][T18658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 914.018757][T18658] Call Trace: [ 914.018766][T18658] [ 914.018775][T18658] dump_stack_lvl+0x189/0x250 [ 914.018804][T18658] ? __pfx____ratelimit+0x10/0x10 [ 914.018830][T18658] ? __pfx_dump_stack_lvl+0x10/0x10 [ 914.018854][T18658] ? __pfx__printk+0x10/0x10 [ 914.018888][T18658] ? __pfx___might_resched+0x10/0x10 [ 914.018907][T18658] ? fs_reclaim_acquire+0x7d/0x100 [ 914.018931][T18658] should_fail_ex+0x414/0x560 [ 914.018966][T18658] should_failslab+0xa8/0x100 [ 914.018997][T18658] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 914.019024][T18658] ? __pfx_nf_tables_abort+0x10/0x10 [ 914.019048][T18658] ? __alloc_skb+0x112/0x2d0 [ 914.019075][T18658] __alloc_skb+0x112/0x2d0 [ 914.019101][T18658] netlink_ack+0x146/0xa50 [ 914.019128][T18658] ? __kasan_kmalloc+0x93/0xb0 [ 914.019165][T18658] nfnetlink_rcv+0x2290/0x2520 [ 914.019227][T18658] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 914.019274][T18658] ? ref_tracker_free+0x63a/0x7d0 [ 914.019321][T18658] ? __netlink_deliver_tap+0x807/0x850 [ 914.019343][T18658] ? netlink_deliver_tap+0x2e/0x1b0 [ 914.019381][T18658] netlink_unicast+0x82f/0x9e0 [ 914.019418][T18658] ? __pfx_netlink_unicast+0x10/0x10 [ 914.019449][T18658] ? netlink_sendmsg+0x642/0xb30 [ 914.019469][T18658] ? skb_put+0x11b/0x210 [ 914.019495][T18658] netlink_sendmsg+0x805/0xb30 [ 914.019526][T18658] ? __pfx_netlink_sendmsg+0x10/0x10 [ 914.019559][T18658] ? aa_sock_msg_perm+0xf1/0x1d0 [ 914.019581][T18658] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 914.019603][T18658] ? __pfx_netlink_sendmsg+0x10/0x10 [ 914.019626][T18658] __sock_sendmsg+0x219/0x270 [ 914.019660][T18658] ____sys_sendmsg+0x505/0x830 [ 914.019691][T18658] ? __pfx_____sys_sendmsg+0x10/0x10 [ 914.019726][T18658] ? import_iovec+0x74/0xa0 [ 914.019760][T18658] ___sys_sendmsg+0x21f/0x2a0 [ 914.019788][T18658] ? __pfx____sys_sendmsg+0x10/0x10 [ 914.019850][T18658] ? __fget_files+0x2a/0x420 [ 914.019868][T18658] ? __fget_files+0x3a0/0x420 [ 914.019897][T18658] __x64_sys_sendmsg+0x19b/0x260 [ 914.019930][T18658] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 914.019966][T18658] ? __pfx_ksys_write+0x10/0x10 [ 914.019990][T18658] ? rcu_is_watching+0x15/0xb0 [ 914.020016][T18658] ? do_syscall_64+0xbe/0x3b0 [ 914.020043][T18658] do_syscall_64+0xfa/0x3b0 [ 914.020065][T18658] ? lockdep_hardirqs_on+0x9c/0x150 [ 914.020085][T18658] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 914.020106][T18658] ? clear_bhb_loop+0x60/0xb0 [ 914.020131][T18658] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 914.020151][T18658] RIP: 0033:0x7f60e838eec9 [ 914.020169][T18658] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 914.020187][T18658] RSP: 002b:00007f60e9277038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 914.020209][T18658] RAX: ffffffffffffffda RBX: 00007f60e85e5fa0 RCX: 00007f60e838eec9 [ 914.020224][T18658] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 914.020238][T18658] RBP: 00007f60e9277090 R08: 0000000000000000 R09: 0000000000000000 [ 914.020252][T18658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 914.020264][T18658] R13: 00007f60e85e6038 R14: 00007f60e85e5fa0 R15: 00007f60e870fa28 [ 914.020296][T18658] [ 914.412897][T17248] gspca_cpia1: usb_control_msg 03, error -32 [ 914.420078][T17248] cpia1 6-1:0.0: unexpected state after lo power cmd: 3b [ 914.586546][T18666] fuse: Invalid rootmode [ 914.637921][T17248] gspca_cpia1: usb_control_msg 01, error -71 [ 914.645637][T17248] cpia1 6-1:0.0: only firmware version 1 is supported (got: 0) [ 914.675173][T17248] usb 6-1: USB disconnect, device number 25 [ 914.687386][T18674] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3321'. [ 915.138233][T18681] IPVS: Scheduler module ip_vs_ not found [ 915.574068][T18692] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3326'. [ 915.630962][ T5973] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 915.817399][ T5973] usb 3-1: config index 0 descriptor too short (expected 26642, got 18) [ 915.831209][ T5973] usb 3-1: config 138 has too many interfaces: 195, using maximum allowed: 32 [ 915.870471][ T5973] usb 3-1: config 138 has an invalid descriptor of length 17, skipping remainder of the config [ 915.934195][ T5973] usb 3-1: config 138 has 0 interfaces, different from the descriptor's value: 195 [ 916.011184][T17716] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 916.043260][ T5973] usb 3-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 916.059368][ T5973] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 916.068775][ T5973] usb 3-1: Product: syz [ 916.075590][ T5973] usb 3-1: Manufacturer: syz [ 916.082061][ T5973] usb 3-1: SerialNumber: syz [ 916.213378][T17716] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 916.247101][T17716] usb 2-1: New USB device found, idVendor=1532, idProduct=010e, bcdDevice= 0.00 [ 916.271427][T17716] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 916.325042][T17716] usb 2-1: config 0 descriptor?? [ 916.358826][ T5973] usb 3-1: USB disconnect, device number 42 [ 917.492034][T18717] syzkaller1: entered promiscuous mode [ 917.498858][T18717] syzkaller1: entered allmulticast mode [ 917.522299][T17248] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 917.681545][T17248] usb 4-1: Using ep0 maxpacket: 8 [ 917.770010][T17248] usb 4-1: unable to get BOS descriptor or descriptor too short [ 917.837557][T17248] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 917.942634][T17248] usb 4-1: can't read configurations, error -71 [ 918.429080][T18732] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3338'. [ 918.460280][T18732] netlink: 'syz.3.3338': attribute type 7 has an invalid length. [ 918.526296][T18727] netlink: 'syz.5.3337': attribute type 10 has an invalid length. [ 918.577478][T18727] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3337'. [ 918.774273][T18738] syz_tun: entered allmulticast mode [ 918.788191][T18737] syz_tun: left allmulticast mode [ 919.334011][T17716] razer 0003:1532:010E.0030: failed to enable macro keys: -71 [ 919.401706][T17716] razer 0003:1532:010E.0030: hidraw0: USB HID v0.00 Device [HID 1532:010e] on usb-dummy_hcd.1-1/input0 [ 919.496230][T17716] usb 2-1: USB disconnect, device number 105 [ 919.668091][T18745] fido_id[18745]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 919.847810][ T30] audit: type=1326 audit(1758870795.222:3268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18748 comm="syz.1.3343" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f79bad8eec9 code=0x0 [ 920.605229][T18761] netlink: 64 bytes leftover after parsing attributes in process `syz.5.3347'. [ 920.666046][T18764] loop6: detected capacity change from 0 to 7 [ 920.695011][T18764] Dev loop6: unable to read RDB block 7 [ 920.714200][T18764] loop6: unable to read partition table [ 920.743132][T18764] loop6: partition table beyond EOD, truncated [ 920.764297][T18764] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 920.794458][T18766] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3349'. [ 920.835259][T18766] netlink: 'syz.5.3349': attribute type 7 has an invalid length. [ 921.122345][ T5948] usb 4-1: new full-speed USB device number 37 using dummy_hcd [ 921.297574][ T5948] usb 4-1: config 0 has no interfaces? [ 921.332112][ T5948] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 921.345774][ T5948] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 921.354827][ T5948] usb 4-1: Product: syz [ 921.358995][ T5948] usb 4-1: Manufacturer: syz [ 921.366160][ T5948] usb 4-1: SerialNumber: syz [ 921.373686][ T5948] usb 4-1: config 0 descriptor?? [ 921.446758][T18785] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3354'. [ 921.457266][T18785] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3354'. [ 921.487052][T18785] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3354'. [ 921.540282][T18787] FAULT_INJECTION: forcing a failure. [ 921.540282][T18787] name failslab, interval 1, probability 0, space 0, times 0 [ 921.564785][T18787] CPU: 0 UID: 0 PID: 18787 Comm: syz.5.3355 Not tainted syzkaller #0 PREEMPT(full) [ 921.564813][T18787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 921.564825][T18787] Call Trace: [ 921.564834][T18787] [ 921.564843][T18787] dump_stack_lvl+0x189/0x250 [ 921.564873][T18787] ? __pfx____ratelimit+0x10/0x10 [ 921.564896][T18787] ? __pfx_dump_stack_lvl+0x10/0x10 [ 921.564920][T18787] ? __pfx__printk+0x10/0x10 [ 921.564954][T18787] ? __pfx___might_resched+0x10/0x10 [ 921.564980][T18787] should_fail_ex+0x414/0x560 [ 921.565015][T18787] should_failslab+0xa8/0x100 [ 921.565046][T18787] __kmalloc_cache_noprof+0x70/0x3d0 [ 921.565071][T18787] ? tipc_crypto_key_init+0x221/0x870 [ 921.565102][T18787] tipc_crypto_key_init+0x221/0x870 [ 921.565145][T18787] tipc_nl_node_set_key+0x6f7/0x9a0 [ 921.565178][T18787] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 921.565211][T18787] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 921.565249][T18787] genl_family_rcv_msg_doit+0x212/0x300 [ 921.565285][T18787] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 921.565329][T18787] ? stack_trace_save+0x9c/0xe0 [ 921.565361][T18787] genl_rcv_msg+0x60e/0x790 [ 921.565395][T18787] ? __pfx_genl_rcv_msg+0x10/0x10 [ 921.565421][T18787] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 921.565460][T18787] netlink_rcv_skb+0x208/0x470 [ 921.565480][T18787] ? __lock_acquire+0xab9/0xd20 [ 921.565509][T18787] ? __pfx_genl_rcv_msg+0x10/0x10 [ 921.565538][T18787] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 921.565581][T18787] ? down_read+0x1ad/0x2e0 [ 921.565609][T18787] genl_rcv+0x28/0x40 [ 921.565633][T18787] netlink_unicast+0x82f/0x9e0 [ 921.565681][T18787] ? __pfx_netlink_unicast+0x10/0x10 [ 921.565717][T18787] ? netlink_sendmsg+0x642/0xb30 [ 921.565737][T18787] ? skb_put+0x11b/0x210 [ 921.565764][T18787] netlink_sendmsg+0x805/0xb30 [ 921.565796][T18787] ? __pfx_netlink_sendmsg+0x10/0x10 [ 921.565822][T18787] ? aa_sock_msg_perm+0xf1/0x1d0 [ 921.565845][T18787] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 921.565867][T18787] ? __pfx_netlink_sendmsg+0x10/0x10 [ 921.565891][T18787] __sock_sendmsg+0x219/0x270 [ 921.565925][T18787] ____sys_sendmsg+0x505/0x830 [ 921.565957][T18787] ? __pfx_____sys_sendmsg+0x10/0x10 [ 921.565994][T18787] ? import_iovec+0x74/0xa0 [ 921.566024][T18787] ___sys_sendmsg+0x21f/0x2a0 [ 921.566053][T18787] ? __pfx____sys_sendmsg+0x10/0x10 [ 921.566119][T18787] ? __fget_files+0x2a/0x420 [ 921.566137][T18787] ? __fget_files+0x3a0/0x420 [ 921.566166][T18787] __x64_sys_sendmsg+0x19b/0x260 [ 921.566195][T18787] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 921.566232][T18787] ? __pfx_ksys_write+0x10/0x10 [ 921.566256][T18787] ? rcu_is_watching+0x15/0xb0 [ 921.566283][T18787] ? do_syscall_64+0xbe/0x3b0 [ 921.566311][T18787] do_syscall_64+0xfa/0x3b0 [ 921.566332][T18787] ? lockdep_hardirqs_on+0x9c/0x150 [ 921.566353][T18787] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 921.566373][T18787] ? clear_bhb_loop+0x60/0xb0 [ 921.566398][T18787] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 921.566418][T18787] RIP: 0033:0x7f910998eec9 [ 921.566437][T18787] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 921.566455][T18787] RSP: 002b:00007f910a803038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 921.566476][T18787] RAX: ffffffffffffffda RBX: 00007f9109be5fa0 RCX: 00007f910998eec9 [ 921.566490][T18787] RDX: 0000000004008014 RSI: 0000200000000100 RDI: 0000000000000003 [ 921.566504][T18787] RBP: 00007f910a803090 R08: 0000000000000000 R09: 0000000000000000 [ 921.566517][T18787] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 921.566529][T18787] R13: 00007f9109be6038 R14: 00007f9109be5fa0 R15: 00007f9109d0fa28 [ 921.566563][T18787] [ 922.195486][T18792] batadv0: entered promiscuous mode [ 922.252034][T18792] vlan2: entered promiscuous mode [ 922.286172][T18797] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3359'. [ 922.308503][T18797] netlink: 'syz.6.3359': attribute type 20 has an invalid length. [ 922.317334][T18797] netlink: 'syz.6.3359': attribute type 15 has an invalid length. [ 922.341114][ T6404] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 922.371051][T17248] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 922.511776][ T6404] usb 3-1: config 1 interface 0 altsetting 1 bulk endpoint 0x1 has invalid maxpacket 32 [ 922.521400][T17248] usb 6-1: Using ep0 maxpacket: 8 [ 922.528781][T17248] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 922.544374][T17248] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 922.547907][ T6404] usb 3-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 922.566751][T17248] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 922.586707][ T6404] usb 3-1: config 1 interface 0 has no altsetting 0 [ 922.596987][T17248] usb 6-1: config 0 descriptor?? [ 922.613823][ T6404] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 922.623756][ T6404] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 922.635435][ T6404] usb 3-1: Product: syz [ 922.639618][ T6404] usb 3-1: Manufacturer: syz [ 922.644658][ T6404] usb 3-1: SerialNumber: syz [ 922.659017][T18804] loop6: detected capacity change from 0 to 7 [ 922.662339][T18793] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 922.669173][T18804] Dev loop6: unable to read RDB block 7 [ 922.678227][T18804] loop6: unable to read partition table [ 922.684392][T18804] loop6: partition table beyond EOD, truncated [ 922.690690][T18804] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 922.829181][T17248] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 923.061623][T18795] fuse: Bad value for 'fd' [ 923.071627][T17248] usb 6-1: USB disconnect, device number 26 [ 923.127024][ T6404] usb 3-1: USB disconnect, device number 43 [ 923.390237][T18810] netlink: 'syz.1.3363': attribute type 1 has an invalid length. [ 923.723736][ T5948] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 923.763667][T18822] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3367'. [ 923.775164][T18822] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3367'. [ 923.881204][ T5973] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 923.889128][T17248] usb 4-1: USB disconnect, device number 37 [ 923.910096][ T5948] usb 2-1: config 4 has an invalid interface number: 39 but max is 1 [ 923.910113][ T5948] usb 2-1: config 4 has an invalid interface number: 49 but max is 1 [ 923.910125][ T5948] usb 2-1: config 4 has no interface number 0 [ 923.910135][ T5948] usb 2-1: config 4 has no interface number 1 [ 923.910157][ T5948] usb 2-1: config 4 interface 39 has no altsetting 0 [ 923.910167][ T5948] usb 2-1: config 4 interface 49 has no altsetting 0 [ 923.914343][ T5948] usb 2-1: New USB device found, idVendor=05e3, idProduct=0503, bcdDevice=25.79 [ 923.914361][ T5948] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 923.914373][ T5948] usb 2-1: Product: syz [ 923.914381][ T5948] usb 2-1: Manufacturer: syz [ 923.914390][ T5948] usb 2-1: SerialNumber: syz [ 924.026711][T18828] FAULT_INJECTION: forcing a failure. [ 924.026711][T18828] name failslab, interval 1, probability 0, space 0, times 0 [ 924.026747][T18828] CPU: 0 UID: 0 PID: 18828 Comm: syz.3.3369 Not tainted syzkaller #0 PREEMPT(full) [ 924.026773][T18828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 924.026786][T18828] Call Trace: [ 924.026794][T18828] [ 924.026803][T18828] dump_stack_lvl+0x189/0x250 [ 924.026833][T18828] ? __pfx____ratelimit+0x10/0x10 [ 924.026856][T18828] ? __pfx_dump_stack_lvl+0x10/0x10 [ 924.026880][T18828] ? __pfx__printk+0x10/0x10 [ 924.026915][T18828] ? __pfx___might_resched+0x10/0x10 [ 924.026941][T18828] should_fail_ex+0x414/0x560 [ 924.026977][T18828] should_failslab+0xa8/0x100 [ 924.027009][T18828] __kmalloc_cache_noprof+0x70/0x3d0 [ 924.027037][T18828] ? tipc_crypto_key_init+0x221/0x870 [ 924.027070][T18828] tipc_crypto_key_init+0x221/0x870 [ 924.027113][T18828] tipc_nl_node_set_key+0x6f7/0x9a0 [ 924.027145][T18828] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 924.027179][T18828] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 924.027216][T18828] genl_family_rcv_msg_doit+0x212/0x300 [ 924.027252][T18828] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 924.027306][T18828] genl_rcv_msg+0x60e/0x790 [ 924.027341][T18828] ? __pfx_genl_rcv_msg+0x10/0x10 [ 924.027367][T18828] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 924.027395][T18828] ? __asan_memcpy+0x40/0x70 [ 924.027418][T18828] ? __pfx_ref_tracker_free+0x10/0x10 [ 924.027446][T18828] netlink_rcv_skb+0x208/0x470 [ 924.027465][T18828] ? __lock_acquire+0xab9/0xd20 [ 924.027496][T18828] ? __pfx_genl_rcv_msg+0x10/0x10 [ 924.027525][T18828] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 924.027568][T18828] ? down_read+0x1ad/0x2e0 [ 924.027597][T18828] genl_rcv+0x28/0x40 [ 924.027622][T18828] netlink_unicast+0x82f/0x9e0 [ 924.027663][T18828] ? __pfx_netlink_unicast+0x10/0x10 [ 924.027702][T18828] ? netlink_sendmsg+0x642/0xb30 [ 924.027722][T18828] ? skb_put+0x11b/0x210 [ 924.027751][T18828] netlink_sendmsg+0x805/0xb30 [ 924.027784][T18828] ? __pfx_netlink_sendmsg+0x10/0x10 [ 924.027811][T18828] ? aa_sock_msg_perm+0xf1/0x1d0 [ 924.027834][T18828] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 924.027856][T18828] ? __pfx_netlink_sendmsg+0x10/0x10 [ 924.027880][T18828] __sock_sendmsg+0x219/0x270 [ 924.027914][T18828] ____sys_sendmsg+0x505/0x830 [ 924.027946][T18828] ? __pfx_____sys_sendmsg+0x10/0x10 [ 924.027981][T18828] ? import_iovec+0x74/0xa0 [ 924.028013][T18828] ___sys_sendmsg+0x21f/0x2a0 [ 924.028042][T18828] ? __pfx____sys_sendmsg+0x10/0x10 [ 924.028108][T18828] ? __fget_files+0x2a/0x420 [ 924.028127][T18828] ? __fget_files+0x3a0/0x420 [ 924.028158][T18828] __x64_sys_sendmsg+0x19b/0x260 [ 924.028187][T18828] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 924.028225][T18828] ? __pfx_ksys_write+0x10/0x10 [ 924.028249][T18828] ? rcu_is_watching+0x15/0xb0 [ 924.028277][T18828] ? do_syscall_64+0xbe/0x3b0 [ 924.028304][T18828] do_syscall_64+0xfa/0x3b0 [ 924.028326][T18828] ? lockdep_hardirqs_on+0x9c/0x150 [ 924.028347][T18828] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 924.028368][T18828] ? clear_bhb_loop+0x60/0xb0 [ 924.028393][T18828] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 924.028413][T18828] RIP: 0033:0x7f60e838eec9 [ 924.028430][T18828] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 924.028449][T18828] RSP: 002b:00007f60e9277038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 924.028471][T18828] RAX: ffffffffffffffda RBX: 00007f60e85e5fa0 RCX: 00007f60e838eec9 [ 924.028487][T18828] RDX: 0000000004008014 RSI: 0000200000000100 RDI: 0000000000000003 [ 924.028501][T18828] RBP: 00007f60e9277090 R08: 0000000000000000 R09: 0000000000000000 [ 924.028515][T18828] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 924.028528][T18828] R13: 00007f60e85e6038 R14: 00007f60e85e5fa0 R15: 00007f60e870fa28 [ 924.028562][T18828] [ 924.070907][ T5973] usb 6-1: Using ep0 maxpacket: 32 [ 924.357684][ T5948] usb 2-1: USB disconnect, device number 106 [ 924.559179][T18826] netlink: 'syz.2.3366': attribute type 13 has an invalid length. [ 924.605499][ T5973] usb 6-1: config 0 has an invalid interface number: 230 but max is 0 [ 924.614971][ T5973] usb 6-1: config 0 has no interface number 0 [ 924.630474][ T5973] usb 6-1: config 0 interface 230 has no altsetting 0 [ 924.640972][ T6404] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 924.675946][ T5973] usb 6-1: New USB device found, idVendor=0781, idProduct=0005, bcdDevice= 0.05 [ 924.686085][ T5973] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 924.766930][ T5973] usb 6-1: Product: syz [ 924.779389][ T5973] usb 6-1: Manufacturer: syz [ 924.810472][ T5973] usb 6-1: SerialNumber: syz [ 924.833920][ T5973] usb 6-1: config 0 descriptor?? [ 924.842771][ T5947] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 924.858957][ T5973] ums-usbat 6-1:0.230: USB Mass Storage device detected [ 924.867524][T18826] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 924.883584][ T6404] usb 7-1: Using ep0 maxpacket: 32 [ 924.896841][ T6404] usb 7-1: config 0 has an invalid interface number: 67 but max is 0 [ 924.906691][ T5973] ums-usbat 6-1:0.230: Quirks match for vid 0781 pid 0005: 1 [ 924.917243][ T6404] usb 7-1: config 0 has no interface number 0 [ 924.938423][ T6404] usb 7-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 924.954131][ T6404] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 924.965857][ T6404] usb 7-1: Product: syz [ 924.970086][ T6404] usb 7-1: Manufacturer: syz [ 924.975955][ T6404] usb 7-1: SerialNumber: syz [ 925.014982][ T5947] usb 4-1: Using ep0 maxpacket: 16 [ 925.031848][ T5947] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 925.067774][ T6404] usb 7-1: config 0 descriptor?? [ 925.077287][ T5947] usb 4-1: config 0 interface 0 has no altsetting 0 [ 925.090110][ T6404] smsc95xx v2.0.0 [ 925.107626][ T5947] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 925.146367][ T5947] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 925.268977][ T5947] usb 4-1: config 0 descriptor?? [ 925.378912][ T6404] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000030: -71 [ 925.416864][ T6404] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 925.476408][ T6404] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 925.527290][ T6404] smsc95xx 7-1:0.67: probe with driver smsc95xx failed with error -71 [ 925.561449][ T6404] usb 7-1: USB disconnect, device number 11 [ 925.729732][ T5947] nzxt-smart2 0003:1E71:2009.0031: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.3-1/input0 [ 926.143360][ T5947] usb 4-1: USB disconnect, device number 38 [ 926.737224][T18861] netlink: 'syz.5.3376': attribute type 1 has an invalid length. [ 926.775247][T18865] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3378'. [ 926.811057][ T5947] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 926.828320][T18865] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3378'. [ 926.847499][T18865] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3378'. [ 926.974734][ T5947] usb 2-1: device descriptor read/64, error -71 [ 927.014554][ T5948] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 927.114526][ T5973] ums-usbat 6-1:0.230: probe with driver ums-usbat failed with error -5 [ 927.135982][ T5973] usb 6-1: USB disconnect, device number 27 [ 927.176171][ T5948] usb 7-1: Using ep0 maxpacket: 32 [ 927.198699][ T5948] usb 7-1: config 0 has an invalid interface number: 51 but max is 0 [ 927.209291][T18877] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3383'. [ 927.218346][ T5948] usb 7-1: config 0 has no interface number 0 [ 927.224928][ T5947] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 927.238785][ T5948] usb 7-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 927.258430][ T5948] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 927.267850][ T5948] usb 7-1: Product: syz [ 927.268111][T18877] bridge1: port 1(veth0_to_bond) entered blocking state [ 927.272727][ T5948] usb 7-1: Manufacturer: syz [ 927.284862][ T5948] usb 7-1: SerialNumber: syz [ 927.290377][T18877] bridge1: port 1(veth0_to_bond) entered disabled state [ 927.300123][ T5934] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 927.320444][ T5948] usb 7-1: config 0 descriptor?? [ 927.329716][T18877] veth0_to_bond: entered allmulticast mode [ 927.339774][ T5948] quatech2 7-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 927.353249][T18877] veth0_to_bond: entered promiscuous mode [ 927.376526][ T5947] usb 2-1: device descriptor read/64, error -71 [ 927.463227][ T5934] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 927.474458][ T5934] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 927.484898][ T5934] usb 3-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 927.504543][ T5947] usb usb2-port1: attempt power cycle [ 927.511415][ T5934] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.524442][ T5934] usb 3-1: config 0 descriptor?? [ 927.539561][T18884] fuse: Bad value for 'rootmode' [ 927.555851][ T5948] usb 7-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 927.601422][ T5948] usb 7-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 927.744440][T18864] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 927.774622][T18864] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 927.871240][ T5947] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 927.911490][ T5947] usb 2-1: device descriptor read/8, error -71 [ 927.946103][ T5934] hid-steam 0003:28DE:1142.0032: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.2-1/input0 [ 927.985617][ C0] usb 7-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 927.993611][ T5948] usb 7-1: USB disconnect, device number 12 [ 928.001841][ T5948] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 928.045907][ T5934] hid-steam 0003:28DE:1142.0032: Steam wireless receiver connected [ 928.071423][ T5948] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 928.087795][ T5934] hid-steam 0003:28DE:1142.0032: No HID_FEATURE_REPORT submitted - nothing to read [ 928.145475][ T5948] quatech2 7-1:0.51: device disconnected [ 928.161175][ T5947] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 928.213117][ T5947] usb 2-1: device descriptor read/8, error -71 [ 928.213560][ T5934] hid-steam 0003:28DE:1142.0033: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.2-1/input0 [ 928.267932][ T5934] usb 3-1: USB disconnect, device number 44 [ 928.313576][ T5934] hid-steam 0003:28DE:1142.0032: Steam wireless receiver disconnected [ 928.340692][T18888] fido_id[18888]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 928.401718][ T5947] usb usb2-port1: unable to enumerate USB device [ 928.878029][T18901] netlink: 'syz.5.3389': attribute type 5 has an invalid length. [ 928.918974][T18901] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3389'. [ 929.179950][T18908] netlink: 4400 bytes leftover after parsing attributes in process `syz.2.3390'. [ 929.507832][T18926] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3394'. [ 929.633671][T18933] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3398'. [ 929.645906][T18933] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3398'. [ 929.658555][T18933] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3398'. [ 929.779505][T18937] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 929.868558][T18941] sctp: [Deprecated]: syz.2.3401 (pid 18941) Use of struct sctp_assoc_value in delayed_ack socket option. [ 929.868558][T18941] Use struct sctp_sack_info instead [ 930.081855][T18945] fuse: Bad value for 'rootmode' [ 930.622175][T18953] fuse: Invalid uid '00000000000000000004' [ 931.133293][ T30] audit: type=1400 audit(1758870806.512:3269): apparmor="DENIED" operation="setprocattr" info="current" error=-22 profile="unconfined" pid=18947 comm="syz.6.3403" [ 931.201789][T18963] usb usb8: usbfs: process 18963 (syz.6.3403) did not claim interface 0 before use [ 931.748376][T18979] fuse: Unknown parameter '0000000000000000000001600000000000000000000' [ 931.843541][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.849947][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 934.217257][T18373] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 934.228615][T18373] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 934.239135][T18373] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 934.249758][T18373] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 934.267160][T18373] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 935.029199][T19023] geneve2: entered promiscuous mode [ 935.052642][T19013] chnl_net:caif_netlink_parms(): no params data found [ 935.084588][ T73] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 37387 - 0 [ 935.094103][ T73] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 37387 - 0 [ 935.222203][ T73] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 37387 - 0 [ 935.245004][ T3475] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 37387 - 0 [ 935.373376][T19031] __nla_validate_parse: 5 callbacks suppressed [ 935.373395][T19031] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3426'. [ 935.766221][T19050] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3430'. [ 935.799519][T19013] bridge0: port 1(bridge_slave_0) entered blocking state [ 935.820627][T19013] bridge0: port 1(bridge_slave_0) entered disabled state [ 935.848645][T19013] bridge_slave_0: entered allmulticast mode [ 935.877821][T19013] bridge_slave_0: entered promiscuous mode [ 936.189345][ T12] gretap0 (unregistering): left promiscuous mode [ 936.361465][T18373] Bluetooth: hci0: command tx timeout [ 936.603461][ T12] bond0 (unregistering): Released all slaves [ 936.621991][ T12] bond1 (unregistering): Released all slaves [ 936.638811][ T12] bond2 (unregistering): Released all slaves [ 936.677797][T19013] bridge0: port 2(bridge_slave_1) entered blocking state [ 936.734592][T19013] bridge0: port 2(bridge_slave_1) entered disabled state [ 936.769079][T19013] bridge_slave_1: entered allmulticast mode [ 936.807851][T19013] bridge_slave_1: entered promiscuous mode [ 936.934969][ T12] tipc: Disabling bearer [ 936.955420][ T12] tipc: Left network mode [ 936.984526][T19013] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 937.008224][T19013] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 937.079818][T19013] team0: Port device team_slave_0 added [ 937.188758][T19013] team0: Port device team_slave_1 added [ 937.405498][T19013] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 937.436456][T19013] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 937.481430][T19013] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 937.514700][T19013] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 937.535051][T19013] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 937.567381][T19013] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 937.637777][ T12] batadv_slave_1: left promiscuous mode [ 937.662685][ T12] hsr_slave_0: left promiscuous mode [ 937.697934][ T12] hsr_slave_1: left promiscuous mode [ 938.442908][T18373] Bluetooth: hci0: command tx timeout [ 938.759713][T19013] hsr_slave_0: entered promiscuous mode [ 938.766324][T18373] Bluetooth: hci2: command 0x0c1a tx timeout [ 938.775124][T19013] hsr_slave_1: entered promiscuous mode [ 938.775774][T19046] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 938.782096][T19013] debugfs: 'hsr0' already exists in 'hsr' [ 938.793183][T19013] Cannot create hsr debugfs directory [ 939.047860][ T12] IPVS: stop unused estimator thread 0... [ 939.376678][T19046] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 939.391961][T19046] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 939.412156][T19046] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 939.425329][T19046] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 939.453745][T19013] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 939.466867][T19046] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 939.476548][T19013] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 939.534927][T19013] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 939.589148][T19013] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 939.912810][T19105] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 939.930951][ T6404] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 939.937034][T19105] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 939.960144][T19105] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 940.008350][T19105] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 940.032549][T19105] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 940.054613][T19105] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 940.065053][T19105] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 940.075579][T19105] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 940.088244][T19105] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 940.107653][T19105] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 940.107815][T19013] 8021q: adding VLAN 0 to HW filter on device bond0 [ 940.129414][ T6404] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 940.131229][ T5948] usb 3-1: new full-speed USB device number 45 using dummy_hcd [ 940.141694][ T6404] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 940.193051][ T6404] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 940.214951][T19013] 8021q: adding VLAN 0 to HW filter on device team0 [ 940.266026][ T73] bridge0: port 1(bridge_slave_0) entered blocking state [ 940.273225][ T73] bridge0: port 1(bridge_slave_0) entered forwarding state [ 940.281160][ T6404] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 940.291482][T17248] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 940.292592][ T6404] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 940.312018][ T6404] usb 4-1: config 0 descriptor?? [ 940.334393][ T5948] usb 3-1: not running at top speed; connect to a high speed hub [ 940.345404][ T73] bridge0: port 2(bridge_slave_1) entered blocking state [ 940.352570][ T73] bridge0: port 2(bridge_slave_1) entered forwarding state [ 940.364510][ T5948] usb 3-1: config 1 interface 0 altsetting 145 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 940.379820][ T5948] usb 3-1: config 1 interface 0 has no altsetting 0 [ 940.396738][ T5948] usb 3-1: New USB device found, idVendor=0461, idProduct=4e72, bcdDevice= 0.40 [ 940.408916][ T5948] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 940.448940][ T5948] usb 3-1: Product: ቢ뵜冴↳⧪抅ᜏظꪲꮶ牫ẋ媃툴㡯䯅蔱าᙇ쒯ᵶ硛퉧跟걙ｎ瀌凪曹ꅌ쇷ῡ軚誆桴㋫హ⃸嶺鉄흱ꟺכּ莖鮸Ԯꫩ簭쁄蘏렟栔촚茲禁鮮雀ⲛ杸춝诽髮쫫큇릏Ტ몆Ṿₙ況⿪⚊ࣗ駨얉ᘉ⨅浞昣 [ 940.490273][T17248] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 940.503944][T17248] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 16 [ 940.519935][T17248] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 940.689886][ T5948] usb 3-1: Manufacturer: Ї [ 940.695038][T17248] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 940.706810][ T5948] usb 3-1: SerialNumber: з [ 940.713827][T17248] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 940.732638][T19013] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 940.732840][T19106] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 940.750329][T17248] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 940.778912][T17248] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 940.841548][T18373] Bluetooth: hci3: command 0x0c1a tx timeout [ 940.860215][T19013] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 940.877937][T17248] usb 2-1: New USB device found, idVendor=2294, idProduct=425a, bcdDevice=d1.41 [ 940.888474][ T6404] plantronics 0003:047F:FFFF.0034: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 940.921889][T17248] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 940.949007][T17248] usb 2-1: Product: syz [ 940.967312][T17248] usb 2-1: Manufacturer: syz [ 940.988522][T17248] usb 2-1: SerialNumber: syz [ 941.022878][T17248] usb 2-1: config 0 descriptor?? [ 941.058412][T19013] veth0_vlan: entered promiscuous mode [ 941.102226][T19013] veth1_vlan: entered promiscuous mode [ 941.233662][ T5948] usbhid 3-1:1.0: can't add hid device: -71 [ 941.244172][T17248] usb 2-1: ucan: probing device on interface #0 [ 941.258971][T19013] veth0_macvtap: entered promiscuous mode [ 941.267482][ T5948] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 941.275919][T17248] usb 2-1: ucan: invalid endpoint configuration [ 941.289713][T17248] usb 2-1: ucan: probe failed; try to update the device firmware [ 941.310645][T19013] veth1_macvtap: entered promiscuous mode [ 941.318666][ T5948] usb 3-1: USB disconnect, device number 45 [ 941.377569][T17248] usb 2-1: USB disconnect, device number 111 [ 941.402310][T18373] Bluetooth: hci5: command 0x0c1a tx timeout [ 941.432141][T19013] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 941.476515][T19013] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 941.492207][T18373] Bluetooth: hci0: command 0x0419 tx timeout [ 941.555405][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.570586][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.599610][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.619965][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 942.184808][ T73] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 942.217850][ T73] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 942.459143][T19165] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3445'. [ 942.495284][T19165] netlink: 'syz.6.3445': attribute type 7 has an invalid length. [ 942.820120][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 942.847544][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 943.177847][T19179] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3447'. [ 943.292519][T17248] usb 4-1: USB disconnect, device number 39 [ 943.561838][T18373] Bluetooth: hci0: command 0x0419 tx timeout [ 944.762873][T18373] Bluetooth: hci2: command 0x0c1a tx timeout [ 944.771765][T19164] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 944.849335][T19164] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 944.858183][T19164] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 944.869272][T19164] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 945.033867][T19205] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 945.112032][ T5948] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 945.119893][T19205] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 945.261847][T17248] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 945.273380][ T5948] usb 3-1: Using ep0 maxpacket: 8 [ 945.300433][ T5948] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 945.318612][ T5948] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 945.344472][T19211] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3451'. [ 945.356954][T19211] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3451'. [ 945.367452][ T5948] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 945.383069][T19211] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3451'. [ 945.392855][ T5948] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 945.414990][ T5948] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 945.427116][T17248] usb 2-1: device descriptor read/64, error -71 [ 945.459593][ T5948] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 945.471490][ T5948] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 945.530309][ T5948] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 945.593167][ T5948] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 945.628009][ T5948] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 945.662741][ T5948] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 945.670206][ T5948] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 945.684292][T17248] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 945.702472][ T5948] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 945.715327][ T5948] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 945.741874][ T5948] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 945.771024][ T5947] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 945.776818][ T5948] usb 3-1: string descriptor 0 read error: -22 [ 945.798252][ T5948] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 945.808526][ T5948] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 945.834576][ T5948] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 945.842109][T17248] usb 2-1: device descriptor read/64, error -71 [ 945.911159][ T5947] usb 4-1: device descriptor read/64, error -71 [ 945.952000][T17248] usb usb2-port1: attempt power cycle [ 945.994472][ T5948] usb 3-1: USB disconnect, device number 46 [ 946.161070][ T5947] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 946.196580][T19229] veth3: entered promiscuous mode [ 946.321405][ T5947] usb 4-1: device descriptor read/64, error -71 [ 946.331435][T17248] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 946.377676][T17248] usb 2-1: device descriptor read/8, error -71 [ 946.485301][ T5947] usb usb4-port1: attempt power cycle [ 946.673411][T17248] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 946.732843][T17248] usb 2-1: device descriptor read/8, error -71 [ 946.842186][T17248] usb usb2-port1: unable to enumerate USB device [ 946.853211][T18373] Bluetooth: hci3: command 0x0c1a tx timeout [ 946.860900][ T5947] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 946.922419][T18373] Bluetooth: hci0: command 0x0419 tx timeout [ 946.928537][ T51] Bluetooth: hci5: command 0x0c1a tx timeout [ 946.942166][ T5947] usb 4-1: device descriptor read/8, error -71 [ 946.951420][ T5948] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 947.081654][ T5948] usb 3-1: device descriptor read/64, error -71 [ 947.221079][ T5947] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 947.265483][ T5947] usb 4-1: device descriptor read/8, error -71 [ 947.321924][ T5948] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 947.351455][T17248] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 947.386518][ T5947] usb usb4-port1: unable to enumerate USB device [ 947.461521][ T5948] usb 3-1: device descriptor read/64, error -71 [ 947.511915][T17248] usb 6-1: Using ep0 maxpacket: 16 [ 947.529330][T17248] usb 6-1: config 4 has an invalid interface number: 248 but max is 0 [ 947.549756][T17248] usb 6-1: config 4 has no interface number 0 [ 947.556482][T17248] usb 6-1: config 4 interface 248 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 947.575180][T17248] usb 6-1: config 4 interface 248 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 947.590396][ T5948] usb usb3-port1: attempt power cycle [ 947.599484][T17248] usb 6-1: config 4 interface 248 has no altsetting 0 [ 947.618403][T17248] usb 6-1: New USB device found, idVendor=19d2, idProduct=0018, bcdDevice=6a.7d [ 947.641741][T17248] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 947.658651][T17248] usb 6-1: Product: syz [ 947.663370][T17248] usb 6-1: Manufacturer: syz [ 947.667952][T17248] usb 6-1: SerialNumber: syz [ 947.677981][T19240] raw-gadget.4 gadget.5: fail, usb_ep_enable returned -22 [ 947.687684][T19240] raw-gadget.4 gadget.5: fail, usb_ep_enable returned -22 [ 947.702525][T17248] option 6-1:4.248: GSM modem (1-port) converter detected [ 947.732249][T17248] usb 6-1: GSM modem (1-port) converter now attached to ttyUSB0 [ 947.941510][ T5948] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 947.962342][ T5948] usb 3-1: device descriptor read/8, error -71 [ 948.201869][ T5948] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 948.248981][ T5948] usb 3-1: device descriptor read/8, error -71 [ 948.335376][T18498] usb 6-1: USB disconnect, device number 28 [ 948.373831][ T5948] usb usb3-port1: unable to enumerate USB device [ 948.431731][T18498] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0 [ 948.491754][T18498] option 6-1:4.248: device disconnected [ 948.509806][T19257] netlink: 68 bytes leftover after parsing attributes in process `syz.5.3464'. [ 948.556762][T19257] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3464'. [ 948.617534][T19257] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3464'. [ 948.997911][T19265] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3468'. [ 949.001678][ T51] Bluetooth: hci0: command 0x0419 tx timeout [ 949.033806][T19265] veth0_macvtap: left promiscuous mode [ 949.161699][T17716] usb 6-1: new full-speed USB device number 29 using dummy_hcd [ 949.327274][T17716] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 949.358230][T17716] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 949.417650][T17716] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 949.438274][T17716] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 949.459331][T17716] usb 6-1: Product: syz [ 949.477317][T17716] usb 6-1: Manufacturer: syz [ 949.482710][T17716] usb 6-1: SerialNumber: syz [ 949.536968][T19268] vim2m vim2m.0: Fourcc format (0x47524247) invalid. [ 949.694791][T17716] usb 6-1: 0:2 : does not exist [ 949.705362][T17716] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 949.774392][T17716] usb 6-1: USB disconnect, device number 29 [ 949.778136][T19274] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3470'. [ 949.894482][ T7711] udevd[7711]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 950.168969][ T30] audit: type=1326 audit(1758870825.542:3270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19277 comm="syz.2.3472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70418eec9 code=0x7ffc0000 [ 950.240054][ T30] audit: type=1326 audit(1758870825.542:3271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19277 comm="syz.2.3472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70418eec9 code=0x7ffc0000 [ 950.262546][ C0] vkms_vblank_simulate: vblank timer overrun [ 950.340266][ T30] audit: type=1326 audit(1758870825.582:3272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19277 comm="syz.2.3472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70418eec9 code=0x7ffc0000 [ 950.362730][ C0] vkms_vblank_simulate: vblank timer overrun [ 950.432571][ T30] audit: type=1326 audit(1758870825.582:3273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19277 comm="syz.2.3472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70418eec9 code=0x7ffc0000 [ 950.792597][ T30] audit: type=1326 audit(1758870825.582:3274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19277 comm="syz.2.3472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70418eec9 code=0x7ffc0000 [ 951.001476][ T30] audit: type=1326 audit(1758870825.582:3275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19277 comm="syz.2.3472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fa70418eec9 code=0x7ffc0000 [ 951.026735][T19300] netlink: 68 bytes leftover after parsing attributes in process `syz.5.3478'. [ 951.109377][ T30] audit: type=1326 audit(1758870825.582:3276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19277 comm="syz.2.3472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70418eec9 code=0x7ffc0000 [ 951.110715][T19300] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3478'. [ 951.194367][ T30] audit: type=1326 audit(1758870825.582:3277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19277 comm="syz.2.3472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa70418eec9 code=0x7ffc0000 [ 951.292074][T19300] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3478'. [ 951.351810][ T6404] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 951.369692][ T30] audit: type=1326 audit(1758870825.582:3278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19277 comm="syz.2.3472" exe="/root/syz-executor" sig=0 arch=c000003e syscall=299 compat=0 ip=0x7fa70418eec9 code=0x7ffc0000 [ 951.435034][T19305] netdevsim netdevsim6: Direct firmware load for . [ 951.435034][T19305] failed with error -2 [ 951.449626][T17716] IPVS: starting estimator thread 0... [ 951.504746][T19305] netdevsim netdevsim6: Falling back to sysfs fallback for: . [ 951.504746][T19305] [ 951.572421][T19308] IPVS: using max 27 ests per chain, 64800 per kthread [ 951.591041][ T6404] usb 2-1: Using ep0 maxpacket: 32 [ 951.607163][ T6404] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 951.618325][ T6404] usb 2-1: config 0 has no interface number 0 [ 951.643652][ T6404] usb 2-1: config 0 interface 89 has no altsetting 0 [ 951.669202][ T6404] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=89.b5 [ 951.688733][ T6404] usb 2-1: New USB device strings: Mfr=172, Product=171, SerialNumber=3 [ 951.700996][ T6404] usb 2-1: Product: syz [ 951.705211][ T6404] usb 2-1: Manufacturer: syz [ 951.714317][ T6404] usb 2-1: SerialNumber: syz [ 951.790216][ T6404] usb 2-1: config 0 descriptor?? [ 951.806036][ T6404] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 951.866247][ T6404] em28xx 2-1:0.89: Video interface 89 found: bulk [ 951.876678][T19317] netlink: 'syz.2.3481': attribute type 10 has an invalid length. [ 951.945383][T19317] team0: Failed to send port change of device netdevsim0 via netlink (err -105) [ 951.963870][T19317] team0: Failed to send options change via netlink (err -105) [ 951.978054][T19317] team0: Port device netdevsim0 added [ 952.127096][T16040] team0: Failed to send port change of device netdevsim0 via netlink (err -105) [ 952.538068][ T6404] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 952.815496][T19334] netlink: 'syz.1.3477': attribute type 4 has an invalid length. [ 953.190700][T18373] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 953.437022][T18373] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 953.446332][T18373] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 953.456620][T18373] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 953.466194][T18373] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 953.836539][ T6404] em28xx 2-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 953.892233][T19352] MPI: mpi too large (113288 bits) [ 953.940586][ T6404] em28xx 2-1:0.89: board has no eeprom [ 953.963165][T19354] netlink: 68 bytes leftover after parsing attributes in process `syz.5.3492'. [ 954.001017][ T6404] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 954.008269][ T6404] em28xx 2-1:0.89: analog set to bulk mode. [ 954.025163][ T5947] em28xx 2-1:0.89: Registering V4L2 extension [ 954.115627][T19354] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3492'. [ 954.134775][T19354] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3492'. [ 954.178981][ T5947] em28xx 2-1:0.89: reading from i2c device at 0x4a failed (error=-5) [ 954.319782][T19357] loop6: detected capacity change from 0 to 7 [ 954.360639][T19357] Dev loop6: unable to read RDB block 7 [ 954.399087][ T5947] em28xx 2-1:0.89: reading from i2c device at 0x48 failed (error=-5) [ 954.408674][T19357] loop6: unable to read partition table [ 954.422564][T19357] loop6: partition table beyond EOD, truncated [ 954.427945][ T5947] em28xx 2-1:0.89: reading from i2c device at 0x42 failed (error=-5) [ 954.437796][ T5947] em28xx 2-1:0.89: reading from i2c device at 0x40 failed (error=-5) [ 954.458458][ T5947] em28xx 2-1:0.89: Config register raw data: 0xfffffffb [ 954.461569][T19357] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 954.473831][ T5947] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 954.481969][ T5947] em28xx 2-1:0.89: No AC97 audio processor [ 954.497781][ T3475] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 954.528605][ T3475] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 954.546659][ T5947] usb 2-1: Decoder not found [ 954.669811][ T5947] em28xx 2-1:0.89: failed to create media graph [ 954.687688][T18498] usb 2-1: USB disconnect, device number 116 [ 954.699329][T18498] em28xx 2-1:0.89: Disconnecting em28xx [ 954.734170][ T5947] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 954.777199][ T5947] em28xx 2-1:0.89: Registering snapshot button... [ 954.801595][T19362] ================================================================== [ 954.805856][ T5947] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input52 [ 954.809675][T19362] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xc7/0x430 [ 954.827484][T19362] Read of size 8 at addr ffff888079db0740 by task v4l_id/19362 [ 954.835017][T19362] [ 954.837332][T19362] CPU: 0 UID: 0 PID: 19362 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 954.837352][T19362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 954.837363][T19362] Call Trace: [ 954.837370][T19362] [ 954.837379][T19362] dump_stack_lvl+0x189/0x250 [ 954.837401][T19362] ? rcu_is_watching+0x15/0xb0 [ 954.837418][T19362] ? __kasan_check_byte+0x12/0x40 [ 954.837441][T19362] ? __pfx_dump_stack_lvl+0x10/0x10 [ 954.837459][T19362] ? rcu_is_watching+0x15/0xb0 [ 954.837475][T19362] ? lock_release+0x4b/0x3e0 [ 954.837500][T19362] ? __virt_addr_valid+0x1c8/0x5c0 [ 954.837521][T19362] ? __virt_addr_valid+0x4a5/0x5c0 [ 954.837542][T19362] print_report+0xca/0x240 [ 954.837558][T19362] ? v4l2_fh_open+0xc7/0x430 [ 954.837574][T19362] kasan_report+0x118/0x150 [ 954.837598][T19362] ? v4l2_fh_open+0xc7/0x430 [ 954.837616][T19362] v4l2_fh_open+0xc7/0x430 [ 954.837635][T19362] em28xx_v4l2_open+0x157/0x9a0 [ 954.837663][T19362] v4l2_open+0x20c/0x360 [ 954.837683][T19362] chrdev_open+0x4c9/0x5e0 [ 954.837699][T19362] ? __pfx_chrdev_open+0x10/0x10 [ 954.837714][T19362] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 954.837742][T19362] ? __pfx_chrdev_open+0x10/0x10 [ 954.837760][T19362] do_dentry_open+0x950/0x13f0 [ 954.837781][T19362] vfs_open+0x3b/0x340 [ 954.837797][T19362] ? path_openat+0x2ecd/0x3830 [ 954.837817][T19362] path_openat+0x2ee5/0x3830 [ 954.837836][T19362] ? arch_stack_walk+0xfc/0x150 [ 954.837862][T19362] ? stack_depot_save_flags+0x40/0x860 [ 954.837892][T19362] ? __pfx_path_openat+0x10/0x10 [ 954.837910][T19362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 954.837934][T19362] do_filp_open+0x1fa/0x410 [ 954.837952][T19362] ? __lock_acquire+0xab9/0xd20 [ 954.837976][T19362] ? __pfx_do_filp_open+0x10/0x10 [ 954.838004][T19362] ? _raw_spin_unlock+0x28/0x50 [ 954.838019][T19362] ? alloc_fd+0x64c/0x6c0 [ 954.838046][T19362] do_sys_openat2+0x121/0x1c0 [ 954.838064][T19362] ? __pfx_do_sys_openat2+0x10/0x10 [ 954.838082][T19362] ? exc_page_fault+0x76/0xf0 [ 954.838100][T19362] ? do_user_addr_fault+0xc8a/0x1390 [ 954.838126][T19362] __x64_sys_openat+0x138/0x170 [ 954.838146][T19362] do_syscall_64+0xfa/0x3b0 [ 954.838163][T19362] ? lockdep_hardirqs_on+0x9c/0x150 [ 954.838180][T19362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 954.838196][T19362] ? clear_bhb_loop+0x60/0xb0 [ 954.838214][T19362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 954.838231][T19362] RIP: 0033:0x7f7a1c6a7407 [ 954.838246][T19362] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 954.838262][T19362] RSP: 002b:00007fff99abf5c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 954.838280][T19362] RAX: ffffffffffffffda RBX: 00007f7a1ce5e880 RCX: 00007f7a1c6a7407 [ 954.838293][T19362] RDX: 0000000000000000 RSI: 00007fff99ac0f1c RDI: ffffffffffffff9c [ 954.838306][T19362] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 954.838316][T19362] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 954.838327][T19362] R13: 00007fff99abf810 R14: 00007f7a1cfc5000 R15: 0000555f8a2d64d8 [ 954.838346][T19362] [ 954.838352][T19362] [ 955.144974][T19362] Allocated by task 5947: [ 955.149285][T19362] kasan_save_track+0x3e/0x80 [ 955.153951][T19362] __kasan_kmalloc+0x93/0xb0 [ 955.158529][T19362] __kmalloc_cache_noprof+0x230/0x3d0 [ 955.163890][T19362] em28xx_v4l2_init+0x10b/0x2e70 [ 955.168829][T19362] em28xx_init_extension+0x11d/0x1c0 [ 955.174113][T19362] process_scheduled_works+0xae1/0x17b0 [ 955.179648][T19362] worker_thread+0x8a0/0xda0 [ 955.184226][T19362] kthread+0x70e/0x8a0 [ 955.188289][T19362] ret_from_fork+0x439/0x7d0 [ 955.192875][T19362] ret_from_fork_asm+0x1a/0x30 [ 955.197630][T19362] [ 955.199939][T19362] Freed by task 5947: [ 955.203901][T19362] kasan_save_track+0x3e/0x80 [ 955.208568][T19362] kasan_save_free_info+0x46/0x50 [ 955.213579][T19362] __kasan_slab_free+0x5b/0x80 [ 955.218333][T19362] kfree+0x18e/0x440 [ 955.222215][T19362] em28xx_v4l2_init+0x1683/0x2e70 [ 955.227230][T19362] em28xx_init_extension+0x11d/0x1c0 [ 955.232504][T19362] process_scheduled_works+0xae1/0x17b0 [ 955.238035][T19362] worker_thread+0x8a0/0xda0 [ 955.242609][T19362] kthread+0x70e/0x8a0 [ 955.246664][T19362] ret_from_fork+0x439/0x7d0 [ 955.251240][T19362] ret_from_fork_asm+0x1a/0x30 [ 955.255992][T19362] [ 955.258297][T19362] The buggy address belongs to the object at ffff888079db0000 [ 955.258297][T19362] which belongs to the cache kmalloc-8k of size 8192 [ 955.272331][T19362] The buggy address is located 1856 bytes inside of [ 955.272331][T19362] freed 8192-byte region [ffff888079db0000, ffff888079db2000) [ 955.286280][T19362] [ 955.288585][T19362] The buggy address belongs to the physical page: [ 955.294984][T19362] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79db0 [ 955.303727][T19362] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 955.312208][T19362] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 955.319734][T19362] page_type: f5(slab) [ 955.323711][T19362] raw: 00fff00000000040 ffff88801a442280 ffffea0001f3fe00 dead000000000004 [ 955.332310][T19362] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 955.340877][T19362] head: 00fff00000000040 ffff88801a442280 ffffea0001f3fe00 dead000000000004 [ 955.349529][T19362] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 955.358182][T19362] head: 00fff00000000003 ffffea0001e76c01 00000000ffffffff 00000000ffffffff [ 955.366836][T19362] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 955.375483][T19362] page dumped because: kasan: bad access detected [ 955.381871][T19362] page_owner tracks the page as allocated [ 955.387571][T19362] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x528c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP), pid 5877, tgid 5877 (syz-executor), ts 80273736437, free_ts 80270863320 [ 955.407263][T19362] post_alloc_hook+0x240/0x2a0 [ 955.412018][T19362] get_page_from_freelist+0x21e4/0x22c0 [ 955.417549][T19362] __alloc_frozen_pages_noprof+0x181/0x370 [ 955.423345][T19362] alloc_pages_mpol+0x232/0x4a0 [ 955.428191][T19362] allocate_slab+0x8a/0x370 [ 955.432677][T19362] ___slab_alloc+0xbeb/0x1420 [ 955.437359][T19362] __kvmalloc_node_noprof+0x429/0x5f0 [ 955.442745][T19362] pfifo_fast_init+0x363/0x6b0 [ 955.447491][T19362] qdisc_create_dflt+0x138/0x4e0 [ 955.452413][T19362] dev_activate+0x378/0x1150 [ 955.456985][T19362] __dev_open+0x69c/0x880 [ 955.461297][T19362] __dev_change_flags+0x1ea/0x6d0 [ 955.466309][T19362] netif_change_flags+0x88/0x1a0 [ 955.471230][T19362] do_setlink+0xc55/0x41c0 [ 955.475634][T19362] rtnl_newlink+0x160b/0x1c70 [ 955.480293][T19362] rtnetlink_rcv_msg+0x7cf/0xb70 [ 955.485214][T19362] page last free pid 5878 tgid 5878 stack trace: [ 955.491517][T19362] __free_frozen_pages+0xbc4/0xd30 [ 955.496618][T19362] __put_partials+0x156/0x1a0 [ 955.501276][T19362] put_cpu_partial+0x17c/0x250 [ 955.506019][T19362] __slab_free+0x2d5/0x3c0 [ 955.510415][T19362] qlist_free_all+0x97/0x140 [ 955.515027][T19362] kasan_quarantine_reduce+0x148/0x160 [ 955.520476][T19362] __kasan_slab_alloc+0x22/0x80 [ 955.525314][T19362] kmem_cache_alloc_node_noprof+0x1bb/0x3c0 [ 955.531198][T19362] __alloc_skb+0x112/0x2d0 [ 955.535602][T19362] netlink_sendmsg+0x5c6/0xb30 [ 955.540349][T19362] __sock_sendmsg+0x219/0x270 [ 955.545014][T19362] __sys_sendto+0x3bd/0x520 [ 955.549502][T19362] __x64_sys_sendto+0xde/0x100 [ 955.554248][T19362] do_syscall_64+0xfa/0x3b0 [ 955.558735][T19362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 955.564614][T19362] [ 955.566921][T19362] Memory state around the buggy address: [ 955.572556][T19362] ffff888079db0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 955.580598][T19362] ffff888079db0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 955.588640][T19362] >ffff888079db0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 955.596682][T19362] ^ [ 955.602814][T19362] ffff888079db0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 955.610874][T19362] ffff888079db0800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 955.618913][T19362] ================================================================== SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 955.751447][ T5947] em28xx 2-1:0.89: Remote control support is not available for this card. [ 955.778678][T18498] em28xx 2-1:0.89: Closing input extension [ 955.785246][T18373] Bluetooth: hci4: command tx timeout [ 955.802924][T18498] em28xx 2-1:0.89: Deregistering snapshot button [ 955.812507][T19362] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 955.819724][T19362] CPU: 1 UID: 0 PID: 19362 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 955.828746][T19362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 955.838798][T19362] Call Trace: [ 955.842065][T19362] [ 955.845025][T19362] dump_stack_lvl+0x99/0x250 [ 955.849634][T19362] ? __asan_memcpy+0x40/0x70 [ 955.854228][T19362] ? __pfx_dump_stack_lvl+0x10/0x10 [ 955.859415][T19362] ? __pfx__printk+0x10/0x10 [ 955.864018][T19362] vpanic+0x281/0x750 [ 955.867989][T19362] ? preempt_schedule+0xae/0xc0 [ 955.872826][T19362] ? __pfx_vpanic+0x10/0x10 [ 955.877317][T19362] ? preempt_schedule_common+0x83/0xd0 [ 955.882770][T19362] ? preempt_schedule+0xae/0xc0 [ 955.887604][T19362] ? __pfx_preempt_schedule+0x10/0x10 [ 955.892967][T19362] panic+0xb9/0xc0 [ 955.896675][T19362] ? __pfx_panic+0x10/0x10 [ 955.901080][T19362] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 955.906968][T19362] ? v4l2_fh_open+0xc7/0x430 [ 955.911551][T19362] check_panic_on_warn+0x89/0xb0 [ 955.916479][T19362] ? v4l2_fh_open+0xc7/0x430 [ 955.921058][T19362] end_report+0x78/0x160 [ 955.925303][T19362] kasan_report+0x129/0x150 [ 955.929797][T19362] ? v4l2_fh_open+0xc7/0x430 [ 955.934378][T19362] v4l2_fh_open+0xc7/0x430 [ 955.938818][T19362] em28xx_v4l2_open+0x157/0x9a0 [ 955.943679][T19362] v4l2_open+0x20c/0x360 [ 955.947920][T19362] chrdev_open+0x4c9/0x5e0 [ 955.952328][T19362] ? __pfx_chrdev_open+0x10/0x10 [ 955.957265][T19362] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 955.963593][T19362] ? __pfx_chrdev_open+0x10/0x10 [ 955.968520][T19362] do_dentry_open+0x950/0x13f0 [ 955.973281][T19362] vfs_open+0x3b/0x340 [ 955.977336][T19362] ? path_openat+0x2ecd/0x3830 [ 955.982091][T19362] path_openat+0x2ee5/0x3830 [ 955.986670][T19362] ? arch_stack_walk+0xfc/0x150 [ 955.991520][T19362] ? stack_depot_save_flags+0x40/0x860 [ 955.996979][T19362] ? __pfx_path_openat+0x10/0x10 [ 956.001906][T19362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 956.007967][T19362] do_filp_open+0x1fa/0x410 [ 956.012457][T19362] ? __lock_acquire+0xab9/0xd20 [ 956.017299][T19362] ? __pfx_do_filp_open+0x10/0x10 [ 956.022317][T19362] ? _raw_spin_unlock+0x28/0x50 [ 956.027155][T19362] ? alloc_fd+0x64c/0x6c0 [ 956.031494][T19362] do_sys_openat2+0x121/0x1c0 [ 956.036169][T19362] ? __pfx_do_sys_openat2+0x10/0x10 [ 956.041355][T19362] ? exc_page_fault+0x76/0xf0 [ 956.046017][T19362] ? do_user_addr_fault+0xc8a/0x1390 [ 956.051297][T19362] __x64_sys_openat+0x138/0x170 [ 956.056137][T19362] do_syscall_64+0xfa/0x3b0 [ 956.060627][T19362] ? lockdep_hardirqs_on+0x9c/0x150 [ 956.065810][T19362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 956.071877][T19362] ? clear_bhb_loop+0x60/0xb0 [ 956.076549][T19362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 956.082428][T19362] RIP: 0033:0x7f7a1c6a7407 [ 956.086834][T19362] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 956.106426][T19362] RSP: 002b:00007fff99abf5c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 956.114830][T19362] RAX: ffffffffffffffda RBX: 00007f7a1ce5e880 RCX: 00007f7a1c6a7407 [ 956.122791][T19362] RDX: 0000000000000000 RSI: 00007fff99ac0f1c RDI: ffffffffffffff9c [ 956.130756][T19362] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 956.138716][T19362] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 956.146674][T19362] R13: 00007fff99abf810 R14: 00007f7a1cfc5000 R15: 0000555f8a2d64d8 [ 956.154642][T19362] [ 956.157913][T19362] Kernel Offset: disabled [ 956.162218][T19362] Rebooting in 86400 seconds..