last executing test programs: 9m28.974431556s ago: executing program 0 (id=540): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="85000000b400000034000000000000009500"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffbfffffffffffe}, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f0000001a00), 0x2, 0x0) r3 = socket$rxrpc(0x21, 0x2, 0xa) r4 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r4, 0x110, 0x4, &(0x7f0000000040)=0x2, 0x4) sendmsg$inet(r4, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00}, 0x0) connect$rxrpc(r3, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast1}}, 0x24) ioctl$DRM_IOCTL_MODE_ADDFB(0xffffffffffffffff, 0xc01c64ae, 0x0) syz_io_uring_setup(0x304, &(0x7f0000000240)={0x0, 0x0, 0x10100, 0x2, 0xe1}, &(0x7f0000000100), &(0x7f0000000140)) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10061, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe1a}], 0x1, &(0x7f0000000a40)=ANY=[@ANYBLOB="18000000000000001701000003000000010000000000000000000000000000001701000002000000000000007005baa38d33e2e1650de8f13f421b2d4b60252e76171216e42961c3b08d4d3dacb0a7089ff7cbfd613d46fa95d6e2f6e76ac3266c9b1a531c4bcf0e7071f117cca4e883b4a6eb5dee7a9ab4d05d7ee311ab1c55b817285e0c3714ee6137e3b8553de667701a7c93437583b5f0b285a188098c1ac4ebac40b315ff8db6f736992497879a42b95248fed4d4888970573d0e88ceead26d97e172588a3ad30fbd01b7bbeeaa668e835f7ae3113fe2d949bb47bc0b2c62541714cc0538601ae4bab19d69a5addee134dd447034da6dd89704603d31a3d25b9d5f46cfd43d9e29aac7422920d98e1463256bd4cc929373ad9000000000faf6a95a04ad3b9db9b230f8224a3d6db187a94e5dadfe181d20d3a4bd08e8b0e6eeb79fdee230dd852a36dfc9046d03b8f316b2d460ca5d08c515d914db8ce430ea0237911c440ee750fe787aaffa83b809651c529e4cf68c8219a827ea003c59e3e51b00cd7f9464f37be2eb3e1475819ad37edcc238b85ab205a2b394916815d9cf7bf3f8e3d19a4697756299e21f2afd3ae31e0f09b8153965635216de47156f4e5fc97cb04f9c5e13256be1d9e0a94f9c6387940de1bcd7b532d16ebba216601cf23be6a7c259550bd059a5a7aee85eb558de8201c1d9c7b29e27313f61cf0b07dd790071bdbceabdd32ce2bcc279b1575a1431b03e5dc37307d15a2782175c87dad1a3aadf48b382bea4ae0b423edee0e12ada4c1dacc40bf387630792ab5c7ed6e2ef7e8a77268b0ff8978ccddfa8da4521d24b3fddc70d181c20caa9a584df9b2e"], 0x18}], 0x4924924924924fd, 0x0) r7 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000004c0)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0x1000000, {0x0, 0x0, 0x12, r8, {0x0, 0x300}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x1}, @TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x1}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9], 0x0, [0x8, 0x4], [0x0, 0x0, 0x0, 0x0, 0xd645, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffff]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x3f0000}]}]}]}}]}, 0xac}, 0x1, 0x7a00}, 0x0) clock_gettime(0x0, &(0x7f0000002400)) recvmmsg(r6, &(0x7f0000002300)=[{{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000900)=""/82, 0x52}, {&(0x7f0000000dc0)=""/49, 0x31}], 0x2}, 0x7f}], 0x1, 0x11102, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a3000000000b0000000060a010400000000000000000100000008000b400000000034000480300001800e000100627974656f726465720000001c0002800800024000000000080001400000000008000140000000100900010073797a3000000000530007"], 0x124}}, 0x0) 9m26.206640169s ago: executing program 0 (id=554): prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000040)={0x6, &(0x7f0000000000)=[{0x8, 0x40, 0x6, 0x6}, {0xffe8, 0x5, 0x3, 0x8}, {0xff, 0x5, 0x8, 0x6}, {0xd40, 0x10, 0x7, 0x4}, {0x7, 0x93, 0x5, 0xc}, {0x8, 0x84, 0x7f, 0xfd}]}) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000002c80)={{0x12, 0x1, 0x0, 0x41, 0x7, 0xf5, 0x40, 0xcf3, 0x9375, 0x1a9e, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xbe, 0xe4, 0xf9}}]}}]}}, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) (async) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) unshare(0x400) inotify_init1(0x0) openat$userio(0xffffffffffffff9c, &(0x7f00000000c0), 0x600800, 0x0) (async) r1 = openat$userio(0xffffffffffffff9c, &(0x7f00000000c0), 0x600800, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000200)) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x34, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x34, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 9m23.024862517s ago: executing program 0 (id=574): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB="200025bd7000fedbdf256c0000000800", @ANYRES32=0x0, @ANYBLOB="74fe2600f4150000"], 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x4000000) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0x8, 0x6c1, 0xfffffffffffffd52, 0x7, 0x55, 0x1000, 0x7, 0xc, 0x7, 0x200, 0x4, 0x6, 0x2, 0xa93, 0x2, 0x5], 0xd5d43001, 0x206f01}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0xff}) ioctl$KVM_RUN(r2, 0xae80, 0x7000000) 9m22.363784649s ago: executing program 0 (id=580): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000000010104000000000000000002001000240002801400018008000100e000000108000200e00000010c00028005000100000000001c0010800800014000000000d974050100000000080002400000000a0800", @ANYRES64=r0], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 9m22.031589433s ago: executing program 0 (id=582): socket$inet6(0xa, 0x1, 0x0) socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) syz_usb_connect(0x4, 0x36, &(0x7f00000002c0)=ANY=[], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet(0x2, 0x1, 0x0) socket$packet(0x11, 0x2, 0x300) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet(0x2, 0x4000000805, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) epoll_create1(0x0) r0 = getpid() syz_pidfd_open(r0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) syz_usb_connect(0x4, 0x5a, &(0x7f00000001c0)=ANY=[], 0x0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB="6400000010000304000000040000000000000000", @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200060000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}}, 0x0) 9m20.797911173s ago: executing program 0 (id=591): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x8, 0x3, 0x1e0, 0x0, 0x43, 0x90, 0x90, 0x98, 0x148, 0x178, 0x178, 0x148, 0x178, 0x3, 0x0, {[{{@ip={@multicast1, @local, 0x0, 0x0, 'macsec0\x00', 'ip6erspan0\x00', {}, {0xff}, 0x0, 0x2}, 0x0, 0x70, 0x90, 0x0, {0x0, 0x7a010000}}, @unspec=@NOTRACK={0x20}}, {{@ip={@multicast1, @multicast2, 0x0, 0x0, 'team_slave_1\x00', 'syzkaller1\x00', {0x910ce4d44a7fbba1}}, 0x0, 0x70, 0xb8}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@broadcast, 'dummy0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x240) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0xc2d41, 0x0) syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000240)=ANY=[], 0x0) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000000)="97", 0x1}], 0x1) syz_open_dev$sndctrl(&(0x7f00000000c0), 0x0, 0x500) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x2, 0x0) r4 = dup3(r3, r2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/image_size', 0x0, 0x100) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1400000015000103000000000070000001"], 0x14}}, 0x0) read(r5, &(0x7f0000000080)=""/186, 0xba) r6 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = syz_io_uring_setup(0x1714, &(0x7f0000002040)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r9, 0x16, &(0x7f0000000140)={&(0x7f0000001000)={[{0x0}, {0x0, 0x0, 0x2}, {0x0}, {0x0}]}, 0x4}, 0x1) syz_io_uring_submit(r10, r11, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r7, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0}}) sendmsg(r8, &(0x7f0000002440)={0x0, 0x0, &(0x7f0000002380)=[{&(0x7f0000002000)="92", 0x1}], 0x1}, 0x80) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000340)={0x8, {"eb9d8988e81b395b45bd0cba3a8483077474dd3dd0c47bc253e5f8e8b4292aac2796001366e4c71f9f35008b53e42578e610c78571ad7fd714bbf1d6fd513c82063c7b62f80247dae47c5c719fcb141465938af815fb5f2695978afaf02bc89e649ba154d25cd9128fa00c4655085aaa52d42552f2b09df1d9bb0e372396aa8bcb1358797975d0f0609075102a2744764709002ff83c2341d3365f98a022a3adb2984c475f59af4129dbfd9a93d73ebd4e3cb4f1e4ab97495820ac3a2091f1a472e09074da690ef8a1271c19fa97898e3be7b5000d91bbc78a0e2415b557a6ac425159469271188e5adbb631ee32f1c01b8aab308dad8548079f00eb770e058ec6480cb78a47d832ff6f7d23348118d2a8a317c1d0cb05299e4541dd566ca584cbe7508ab24fa6fdd1e5fd301a57f7b01f55543d5289911b1040011acfa9247e9f2b08635fc066b8725bc114c59fdbdd3a35903b19613e3f29ce4457a59c64567f1fea4a17185e7edde0ccc64cf9d0086ef292c318c8a56b28406cdcfd091245a8e0fa721e11aa064b642d9afbcf3dd23c79c466e634e84e0ccf866e8bcc03a6e6ac823fe6056a7aa6aa8622969e263eff3fb74ea46e0bd6a1ce08244e39f59df03e6cdd7fdc2811c4c1719099a56f1c5e07ab0e7d6a07192dcc0d03f6bcbc2323f4606b52950e3ebf54b379a97bb4c0c27db1e0824068a353aa025258f16eec23148997eb0f14ade49c1216cfd2ce324f289ddcf0ff8247984c4567692e9b64c2fbbc1272a3e532122e65f97cec13564ece0b7029c2c34ca9c7a9557d487336d849513afaaaa6c1a0388e72dba891750cebb09747cdadd4228b66ce5972f9c67bc4bd795753bc83fd36897edb29a4d9ca5c5cbb0e92dab163d6c980ef76a5f79f6f05f9a7e0e745a129cbbfc12281f9566f656b1f9de9bec23d3a2bec3852430fb7dcbc692e0fcccb69402639a0e1693a70a5983a462b001131a4774e5e3d8bd9a19389ab7e819a77ae145d2ca8e4477215905e8e1dce02ccd3f8942744313a30b68025844e5a68a9a2dd382a3a32042c232459a776d6e1741eec549b4d2867580fc511393281917f5145952997aebd29d8056d4282586ccd91d633a7c1764012e09d7746fef7246eb56640fef2bdd74b78fbcaa32e6b6f4136431a51229956a8a8149de241511e2760f997886e098fc1847adee880f3ae61a1240581e13758be18a33bde20ffad43a0ae9a4f7144a16993858e445c7c5bc83e13dfeb81ae6fc11be70e0ab490ab976106e3d8e627c44df3ac588239fbf885a2439b69e5a121245fd3c42c86555b198452ffcac7168d789ff3f61da76d389b0fc1e6c39df6608824babcb098c509e0def7f1701e67ab7d6c64ab5150eaaadbe38a11673fee8d286d88ae6f39241966fa6df46464166db4f41d67596d9d67382f1069042ee118b0af630a5e12f07d8cfa4183f2c28b27a6105d69804508235f877693cf1f359ffb95b585496b941c2e3f2170d916ded547beee1ae24e1724f17cb85cfcba15e1cbabe44e60b16c2ac4f4afed9506e25bd35a8897de4ae4a4c929b25289f75b2da34a1b65edfc2dd74b74b8f3d74f1387805cf5933a616798fa890718c9ebd6079c26a5f732298f8e8a2e378fccffd7fc3ecc8b10d1cd013a7340b7842c4b1dff0e9f2ea70329fb9c3013151f43fa5bad0dd5f61a92da5a78e68052ab72c38d915136184a49da2a6b6e248e9d106777c1bde4dfc94f8a4a29dfa95fe7681516061a83650c8b39968bd3a7a34b34e93844fc8ed8a84b59f7e657a025592db7a7252491b18695693a68d178564909e5971b8956479e518a1202af31718fe22f4e65c93a9a08e802e07fd274e5a23cb466a7b48cf344a2176d61ef27d348b40a510e8cc8e372693cb6c1c7cfb4e3972fbe4204f0048bc53793e049b0484b3bbe6d3b6a986bc2c95fdb63f60ebfdbea38b48405a8b85ee84568fb6921a75fb54e9026671ed43b923286d64d60c9060a86c2217f98f049259d99d0c5ce4889b165557fa4536a6d5222eb289a6dd83ff235dbde83897d1627f6d85c3e551997007b5219c5b010d53b92879e19951ba21db665f724d7c45da7c635f3a982047a1ebed638dca4f3e97ee036e18ae68d37cd8fda64fac7dce84587311b2e17420c31d50a5da4d052052ea1b4116aa9a0ef20434420c51887cf2d03a1d578925f19e700451f404413f7371693f2e0a622e1ae49daccd12de5ec59d2acbb635d854ce22a418f143c3a637dc731d45c5d1c38adcb770602a92f3de006a4eef1d838b91178476ff168fa639eb5b420da8a343a0ec6e6144cc802eb08d1833beb6ca18ffa1fd7b019bb2d02c97d62963a8a9180769323d8e45639b68aaa56775306bdc6c020678ecd64e751fb92c85dc474bbde8f94c029d92dea48b837c7b5524dc061374e637e299fef6b1355ce23d0f649f0e61402d375bb444a37a22a812821ade48df3be021ecacff6873654bf21e111d079f5bb140568b5c4b77f1aaa22416ab983eb8fe903286fdf114024622f443686078c8318329aebe5df891a9a91bd5512b3aed59557de62d1a9586e10fa07306f815fc10204200d6282813f729c3f8e8af7c450f55037397125ef5e806306a9ba351a6f3e1dede486bc75ae897581b649ef55f19c97b330c5a61a6f76674722429ea894d1c638074cedb0b863514c19166a5c2baf4ee6d1eaeee85155afd10fdd4361c78b3c0d00d01a37df52be0ed3458bc7a1afa0c8c9a2f3406b1e4607e955f57f626c7ed2efac888e72110e0dc0f79cfdd02bc245f0b3a7939bbdc31229ab99ecd36927e1fdd7b17b5037457856fe3f773b6af24af6d67cbd7978e2f127b86b50153e9b0f13f4942006198d6a6ac335cf7560676fd607e6a3a7b518fa815def5eca1372813f97d6ea9d62b848db37015aa648c8426f26776728332fad5f72c919a6f96d1c3b0a97df4c1892ff814e2e57979da7f7098c42b963ca5929765b1ad2284abd2c1f7ef9570b8c97a513da8f4078130e70f31327708619331571d78d3475b6b41e835dc948f0e809c6610942e4c7d515d9303e6281a3980a742dc85f4528fddc34d22bbd9aa4b4b2351df10884f1dbc877717d984b0b3bafda47801103cda459d006a9a9982f5cf67fc0face3def54d579358e623dae4d9b4248cebd82111cf4c431f8852bcf862a65a124ca709cec2454e4c65514128bc2d6f8cc92624f20c02b008081d334cc7fa0b8e8d9d3dfe2a283600e875c7ecb8e4949f958f6f84f8e52b78e3eae58fa02d85bb8ac52ddf3b262ec52eca50d6d590139c24c042e1c040d8da6c9a2e95055dc91ed65881bc4c43c13c240eb9f6ef9a4cffb44e96c9c055cbbc10b5d63850bc3e2fa46aabb2c732c0c31bf1dba3ad1ce2b1b671259aaaef955d39c420b18d78828248563cacd9417ef2cb63859ebef3936e26803e7ccf5233cb3c0a2f440d898ff258cb03a783415a6f81b1b1a07bb5cef530c78c30ec9adfd2df246d581bc662336d5029f65588995adc3190e97a418c15fa3620eb68cdcc6233f1aa0009ab558b22ae9316003c6af1fe0d7807e583943e48692fcd9fa2525fefe3467d099951c83943312f0e889cef4c1ecf17ad469f5ad683b405eb59230e89df96e8dd94e41e5f62822ba957e065f22d96b1c0c2b83f5a57fbb04d5af399ece3ddd52e5afff783a876e2066fbe30963421acb427c95fd3e7bc6b7d3d731a7e347052cd9636805cab94ad40bdb63a264b3127c7f8d21d25810bd2eadb2c3e31b5c807283ad062d750e5b21ec1e20cc3ac5753ac536faf23e2b5c37e9d021870b0350ecea7187643a00a08ec3ffaf7e6c236c4d694ff41af7b5fbf8a554949f5026a8b2adcf377f94848cd17fbcc0249e796008962d3db16b4bb85483dbe75ef5b301175e052203436b38248fbd1a28a5e2b3ab75c77eb8f853e60e95d5f16cb9858b33b3752b4c69776ec4506ba2bd490a6f17aae1152d8762d86cc0ef32788cf149e8fa9464c3ea588f15d8eb2092254c470acf221cfe680845167fc6778b8af1609681ae4f4e65426ce059b9768eb2e0c89f29de7b91db89a72e4c677c65dd980f9a6bfa656ed01d5e683a33e6b80462139476225cc0fcc309d926c36aa250bdad1454db46cd2536046f909a05b08829cad973bc705231a32a5f2e7ac5e96e2315cb175724607a5af02073fc936272aa724990ba6dcc4ea79da6eb7ec0bbdbd0a878114c493bc4b3e26e24b18553bd0a617981d8ea9e91ed2e3bcbd48f5d67aa913790bf52c31435184d6c73079e964e9ef05194e88b072b372d48cb70dbca99238c4474ed0b6932cc1b233bce0c87d48d478fa3c937c42c8637714e9995041f8b2b7dce17eb2f26c730f5559cf5919b88ee00bbf40726f90e1cf29e0f5fadc64de1bf28d447e8996948dc2fe658620b6fb8cfc592d5e0621b66057eb774c31ab16235456210c5ee7990b71b5b3d51cf13e30361a8cdaa107b13fa6a1c84b172efece3b70753e81e7e9e572d228c7bbcdaba40d8d0eb4de13bda1fca38d3ed667bb0897335aadaa0c3905a1283292c89ef5747ad5462db4011c3f8a4a476aa78d74badf8bf3785997ba9824e21256eed4c2805331fa24c81e28f21e895a0b03e7de52787065faded0f1b59eba1c922dce5576e8ab190ef716c021d8dfa13a1e73b8962d9f9238ba8b9fa2cf84addfe37e78cdb398ee4c0642a716fb8db1e332f873a16c6225ebc51fe05f33273380e64272159bb808336e87b4b0cddb492a992b2e7f423bf37725e1d9dda0dc6b4426172c2a93ee1cc9acea7fe1ece9ba0ddee3e232efb11fc4d4e266cd2a83c017e32315c434b73e9729d5a3a7fe993e72f9bb70d78672493263a2653fe1bfd42d1f97cbf0fffb6705b2e35fe65ceb9ad7ddc525b689027352db9c194939559ebb3b505a58e0404103482ce10f7d67761c13b235b52ad1b25803aa94cf7df5ca8d8bd0d4e6d0ab8bcfb8f72a26cecf071e31c02a1034c0144d850f1732926981dca7a18f0a197da3703d74d3e951ed510ed38a8fcae93eb2bebdf92e0feb0f06dbe1331cb43cfa548ca294ea479ecb325aea7aff8d924745298a3d34f23f40b992995a908130165b44beb8cc9da8390dae2a09cb7e1ac7e95b84f35e7be147b4be04883047cdcaec662aa8b66694ae8914e65edb63696494bff66eacb3aecdb23746a36cec7f832d628d38698ba6b3d4020095eae2a5b36a21039ce50901cdf2582b88ab8c86c6f4a8c345618f10d7aab081edb3ce8e4479e0ac476112d4b261cb8ed952221fb660898491fc7134b091c0565173bebf014caffae12852b5314c930d41e27bcfa7bc536fc4da3b714630e1ac7aaf006755da1da792dcad08f796c2ebdd6427ad3374e25132a103d62f98584462aa164d742b4d7c668a85119480199dd90f0a903f6c76cfca28b84a2279ae6965fdec403072be146d2d1f39b122113fbcfb52cf8c7c1d47a32f437b895bcd7a67ad08f196112a15b07e5b57b4db2b7c7f70a42923d6d0625515375b9281d331bd1e5dd75ff3a6e1ca5b75eb328e6c935f2c8f0c57b0aaf2ad85983160b0e53fca44d95e956ef2726d97acb2da34ca4482bb86aabde6d8b8b85da2e44ae89b8359f7edb88a3e2a9aad23125b8c2bd0c7be0847ac9b1e16db2c395e0c9eb040af710c31d32f7b356bfb6f1704f4d884f37c15b865eda87685ae8926fbf3a4465e7e2968ee18ea1ff5d4f4cbfb55634089687b9f0bce5b9cf10779299893cf64980193fd3a1096507e7a8be", 0x1000}}, 0x1006) io_uring_enter(r9, 0x27e2, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="2000000044000701fcffff7c00000c0004"], 0x20}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) r12 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r12, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xb, 0x0, 0x0}) r13 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r14 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) dup3(r14, r13, 0x0) 9m5.698017697s ago: executing program 32 (id=591): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x8, 0x3, 0x1e0, 0x0, 0x43, 0x90, 0x90, 0x98, 0x148, 0x178, 0x178, 0x148, 0x178, 0x3, 0x0, {[{{@ip={@multicast1, @local, 0x0, 0x0, 'macsec0\x00', 'ip6erspan0\x00', {}, {0xff}, 0x0, 0x2}, 0x0, 0x70, 0x90, 0x0, {0x0, 0x7a010000}}, @unspec=@NOTRACK={0x20}}, {{@ip={@multicast1, @multicast2, 0x0, 0x0, 'team_slave_1\x00', 'syzkaller1\x00', {0x910ce4d44a7fbba1}}, 0x0, 0x70, 0xb8}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@broadcast, 'dummy0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x240) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0xc2d41, 0x0) syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000240)=ANY=[], 0x0) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000000)="97", 0x1}], 0x1) syz_open_dev$sndctrl(&(0x7f00000000c0), 0x0, 0x500) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x2, 0x0) r4 = dup3(r3, r2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/image_size', 0x0, 0x100) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1400000015000103000000000070000001"], 0x14}}, 0x0) read(r5, &(0x7f0000000080)=""/186, 0xba) r6 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = syz_io_uring_setup(0x1714, &(0x7f0000002040)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r9, 0x16, &(0x7f0000000140)={&(0x7f0000001000)={[{0x0}, {0x0, 0x0, 0x2}, {0x0}, {0x0}]}, 0x4}, 0x1) syz_io_uring_submit(r10, r11, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r7, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0}}) sendmsg(r8, &(0x7f0000002440)={0x0, 0x0, &(0x7f0000002380)=[{&(0x7f0000002000)="92", 0x1}], 0x1}, 0x80) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000340)={0x8, {"eb9d8988e81b395b45bd0cba3a8483077474dd3dd0c47bc253e5f8e8b4292aac2796001366e4c71f9f35008b53e42578e610c78571ad7fd714bbf1d6fd513c82063c7b62f80247dae47c5c719fcb141465938af815fb5f2695978afaf02bc89e649ba154d25cd9128fa00c4655085aaa52d42552f2b09df1d9bb0e372396aa8bcb1358797975d0f0609075102a2744764709002ff83c2341d3365f98a022a3adb2984c475f59af4129dbfd9a93d73ebd4e3cb4f1e4ab97495820ac3a2091f1a472e09074da690ef8a1271c19fa97898e3be7b5000d91bbc78a0e2415b557a6ac425159469271188e5adbb631ee32f1c01b8aab308dad8548079f00eb770e058ec6480cb78a47d832ff6f7d23348118d2a8a317c1d0cb05299e4541dd566ca584cbe7508ab24fa6fdd1e5fd301a57f7b01f55543d5289911b1040011acfa9247e9f2b08635fc066b8725bc114c59fdbdd3a35903b19613e3f29ce4457a59c64567f1fea4a17185e7edde0ccc64cf9d0086ef292c318c8a56b28406cdcfd091245a8e0fa721e11aa064b642d9afbcf3dd23c79c466e634e84e0ccf866e8bcc03a6e6ac823fe6056a7aa6aa8622969e263eff3fb74ea46e0bd6a1ce08244e39f59df03e6cdd7fdc2811c4c1719099a56f1c5e07ab0e7d6a07192dcc0d03f6bcbc2323f4606b52950e3ebf54b379a97bb4c0c27db1e0824068a353aa025258f16eec23148997eb0f14ade49c1216cfd2ce324f289ddcf0ff8247984c4567692e9b64c2fbbc1272a3e532122e65f97cec13564ece0b7029c2c34ca9c7a9557d487336d849513afaaaa6c1a0388e72dba891750cebb09747cdadd4228b66ce5972f9c67bc4bd795753bc83fd36897edb29a4d9ca5c5cbb0e92dab163d6c980ef76a5f79f6f05f9a7e0e745a129cbbfc12281f9566f656b1f9de9bec23d3a2bec3852430fb7dcbc692e0fcccb69402639a0e1693a70a5983a462b001131a4774e5e3d8bd9a19389ab7e819a77ae145d2ca8e4477215905e8e1dce02ccd3f8942744313a30b68025844e5a68a9a2dd382a3a32042c232459a776d6e1741eec549b4d2867580fc511393281917f5145952997aebd29d8056d4282586ccd91d633a7c1764012e09d7746fef7246eb56640fef2bdd74b78fbcaa32e6b6f4136431a51229956a8a8149de241511e2760f997886e098fc1847adee880f3ae61a1240581e13758be18a33bde20ffad43a0ae9a4f7144a16993858e445c7c5bc83e13dfeb81ae6fc11be70e0ab490ab976106e3d8e627c44df3ac588239fbf885a2439b69e5a121245fd3c42c86555b198452ffcac7168d789ff3f61da76d389b0fc1e6c39df6608824babcb098c509e0def7f1701e67ab7d6c64ab5150eaaadbe38a11673fee8d286d88ae6f39241966fa6df46464166db4f41d67596d9d67382f1069042ee118b0af630a5e12f07d8cfa4183f2c28b27a6105d69804508235f877693cf1f359ffb95b585496b941c2e3f2170d916ded547beee1ae24e1724f17cb85cfcba15e1cbabe44e60b16c2ac4f4afed9506e25bd35a8897de4ae4a4c929b25289f75b2da34a1b65edfc2dd74b74b8f3d74f1387805cf5933a616798fa890718c9ebd6079c26a5f732298f8e8a2e378fccffd7fc3ecc8b10d1cd013a7340b7842c4b1dff0e9f2ea70329fb9c3013151f43fa5bad0dd5f61a92da5a78e68052ab72c38d915136184a49da2a6b6e248e9d106777c1bde4dfc94f8a4a29dfa95fe7681516061a83650c8b39968bd3a7a34b34e93844fc8ed8a84b59f7e657a025592db7a7252491b18695693a68d178564909e5971b8956479e518a1202af31718fe22f4e65c93a9a08e802e07fd274e5a23cb466a7b48cf344a2176d61ef27d348b40a510e8cc8e372693cb6c1c7cfb4e3972fbe4204f0048bc53793e049b0484b3bbe6d3b6a986bc2c95fdb63f60ebfdbea38b48405a8b85ee84568fb6921a75fb54e9026671ed43b923286d64d60c9060a86c2217f98f049259d99d0c5ce4889b165557fa4536a6d5222eb289a6dd83ff235dbde83897d1627f6d85c3e551997007b5219c5b010d53b92879e19951ba21db665f724d7c45da7c635f3a982047a1ebed638dca4f3e97ee036e18ae68d37cd8fda64fac7dce84587311b2e17420c31d50a5da4d052052ea1b4116aa9a0ef20434420c51887cf2d03a1d578925f19e700451f404413f7371693f2e0a622e1ae49daccd12de5ec59d2acbb635d854ce22a418f143c3a637dc731d45c5d1c38adcb770602a92f3de006a4eef1d838b91178476ff168fa639eb5b420da8a343a0ec6e6144cc802eb08d1833beb6ca18ffa1fd7b019bb2d02c97d62963a8a9180769323d8e45639b68aaa56775306bdc6c020678ecd64e751fb92c85dc474bbde8f94c029d92dea48b837c7b5524dc061374e637e299fef6b1355ce23d0f649f0e61402d375bb444a37a22a812821ade48df3be021ecacff6873654bf21e111d079f5bb140568b5c4b77f1aaa22416ab983eb8fe903286fdf114024622f443686078c8318329aebe5df891a9a91bd5512b3aed59557de62d1a9586e10fa07306f815fc10204200d6282813f729c3f8e8af7c450f55037397125ef5e806306a9ba351a6f3e1dede486bc75ae897581b649ef55f19c97b330c5a61a6f76674722429ea894d1c638074cedb0b863514c19166a5c2baf4ee6d1eaeee85155afd10fdd4361c78b3c0d00d01a37df52be0ed3458bc7a1afa0c8c9a2f3406b1e4607e955f57f626c7ed2efac888e72110e0dc0f79cfdd02bc245f0b3a7939bbdc31229ab99ecd36927e1fdd7b17b5037457856fe3f773b6af24af6d67cbd7978e2f127b86b50153e9b0f13f4942006198d6a6ac335cf7560676fd607e6a3a7b518fa815def5eca1372813f97d6ea9d62b848db37015aa648c8426f26776728332fad5f72c919a6f96d1c3b0a97df4c1892ff814e2e57979da7f7098c42b963ca5929765b1ad2284abd2c1f7ef9570b8c97a513da8f4078130e70f31327708619331571d78d3475b6b41e835dc948f0e809c6610942e4c7d515d9303e6281a3980a742dc85f4528fddc34d22bbd9aa4b4b2351df10884f1dbc877717d984b0b3bafda47801103cda459d006a9a9982f5cf67fc0face3def54d579358e623dae4d9b4248cebd82111cf4c431f8852bcf862a65a124ca709cec2454e4c65514128bc2d6f8cc92624f20c02b008081d334cc7fa0b8e8d9d3dfe2a283600e875c7ecb8e4949f958f6f84f8e52b78e3eae58fa02d85bb8ac52ddf3b262ec52eca50d6d590139c24c042e1c040d8da6c9a2e95055dc91ed65881bc4c43c13c240eb9f6ef9a4cffb44e96c9c055cbbc10b5d63850bc3e2fa46aabb2c732c0c31bf1dba3ad1ce2b1b671259aaaef955d39c420b18d78828248563cacd9417ef2cb63859ebef3936e26803e7ccf5233cb3c0a2f440d898ff258cb03a783415a6f81b1b1a07bb5cef530c78c30ec9adfd2df246d581bc662336d5029f65588995adc3190e97a418c15fa3620eb68cdcc6233f1aa0009ab558b22ae9316003c6af1fe0d7807e583943e48692fcd9fa2525fefe3467d099951c83943312f0e889cef4c1ecf17ad469f5ad683b405eb59230e89df96e8dd94e41e5f62822ba957e065f22d96b1c0c2b83f5a57fbb04d5af399ece3ddd52e5afff783a876e2066fbe30963421acb427c95fd3e7bc6b7d3d731a7e347052cd9636805cab94ad40bdb63a264b3127c7f8d21d25810bd2eadb2c3e31b5c807283ad062d750e5b21ec1e20cc3ac5753ac536faf23e2b5c37e9d021870b0350ecea7187643a00a08ec3ffaf7e6c236c4d694ff41af7b5fbf8a554949f5026a8b2adcf377f94848cd17fbcc0249e796008962d3db16b4bb85483dbe75ef5b301175e052203436b38248fbd1a28a5e2b3ab75c77eb8f853e60e95d5f16cb9858b33b3752b4c69776ec4506ba2bd490a6f17aae1152d8762d86cc0ef32788cf149e8fa9464c3ea588f15d8eb2092254c470acf221cfe680845167fc6778b8af1609681ae4f4e65426ce059b9768eb2e0c89f29de7b91db89a72e4c677c65dd980f9a6bfa656ed01d5e683a33e6b80462139476225cc0fcc309d926c36aa250bdad1454db46cd2536046f909a05b08829cad973bc705231a32a5f2e7ac5e96e2315cb175724607a5af02073fc936272aa724990ba6dcc4ea79da6eb7ec0bbdbd0a878114c493bc4b3e26e24b18553bd0a617981d8ea9e91ed2e3bcbd48f5d67aa913790bf52c31435184d6c73079e964e9ef05194e88b072b372d48cb70dbca99238c4474ed0b6932cc1b233bce0c87d48d478fa3c937c42c8637714e9995041f8b2b7dce17eb2f26c730f5559cf5919b88ee00bbf40726f90e1cf29e0f5fadc64de1bf28d447e8996948dc2fe658620b6fb8cfc592d5e0621b66057eb774c31ab16235456210c5ee7990b71b5b3d51cf13e30361a8cdaa107b13fa6a1c84b172efece3b70753e81e7e9e572d228c7bbcdaba40d8d0eb4de13bda1fca38d3ed667bb0897335aadaa0c3905a1283292c89ef5747ad5462db4011c3f8a4a476aa78d74badf8bf3785997ba9824e21256eed4c2805331fa24c81e28f21e895a0b03e7de52787065faded0f1b59eba1c922dce5576e8ab190ef716c021d8dfa13a1e73b8962d9f9238ba8b9fa2cf84addfe37e78cdb398ee4c0642a716fb8db1e332f873a16c6225ebc51fe05f33273380e64272159bb808336e87b4b0cddb492a992b2e7f423bf37725e1d9dda0dc6b4426172c2a93ee1cc9acea7fe1ece9ba0ddee3e232efb11fc4d4e266cd2a83c017e32315c434b73e9729d5a3a7fe993e72f9bb70d78672493263a2653fe1bfd42d1f97cbf0fffb6705b2e35fe65ceb9ad7ddc525b689027352db9c194939559ebb3b505a58e0404103482ce10f7d67761c13b235b52ad1b25803aa94cf7df5ca8d8bd0d4e6d0ab8bcfb8f72a26cecf071e31c02a1034c0144d850f1732926981dca7a18f0a197da3703d74d3e951ed510ed38a8fcae93eb2bebdf92e0feb0f06dbe1331cb43cfa548ca294ea479ecb325aea7aff8d924745298a3d34f23f40b992995a908130165b44beb8cc9da8390dae2a09cb7e1ac7e95b84f35e7be147b4be04883047cdcaec662aa8b66694ae8914e65edb63696494bff66eacb3aecdb23746a36cec7f832d628d38698ba6b3d4020095eae2a5b36a21039ce50901cdf2582b88ab8c86c6f4a8c345618f10d7aab081edb3ce8e4479e0ac476112d4b261cb8ed952221fb660898491fc7134b091c0565173bebf014caffae12852b5314c930d41e27bcfa7bc536fc4da3b714630e1ac7aaf006755da1da792dcad08f796c2ebdd6427ad3374e25132a103d62f98584462aa164d742b4d7c668a85119480199dd90f0a903f6c76cfca28b84a2279ae6965fdec403072be146d2d1f39b122113fbcfb52cf8c7c1d47a32f437b895bcd7a67ad08f196112a15b07e5b57b4db2b7c7f70a42923d6d0625515375b9281d331bd1e5dd75ff3a6e1ca5b75eb328e6c935f2c8f0c57b0aaf2ad85983160b0e53fca44d95e956ef2726d97acb2da34ca4482bb86aabde6d8b8b85da2e44ae89b8359f7edb88a3e2a9aad23125b8c2bd0c7be0847ac9b1e16db2c395e0c9eb040af710c31d32f7b356bfb6f1704f4d884f37c15b865eda87685ae8926fbf3a4465e7e2968ee18ea1ff5d4f4cbfb55634089687b9f0bce5b9cf10779299893cf64980193fd3a1096507e7a8be", 0x1000}}, 0x1006) io_uring_enter(r9, 0x27e2, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="2000000044000701fcffff7c00000c0004"], 0x20}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) r12 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r12, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xb, 0x0, 0x0}) r13 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r14 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) dup3(r14, r13, 0x0) 29.812967189s ago: executing program 2 (id=2893): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) r2 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r2, &(0x7f0000000080)={0x1d, r1, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000200)={'syztnl1\x00', &(0x7f0000000180)={'ip6tnl0\x00', 0x0, 0x4, 0x2, 0x9, 0x7ff, 0x20, @mcast1, @private2, 0xc1, 0x40, 0x8, 0x8}}) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000200}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)=@deltclass={0x60, 0x29, 0x4, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r4, {0x5}, {0x6, 0xa}, {0x8, 0x9}}, [@TCA_RATE={0x6, 0x5, {0x4, 0x6}}, @TCA_RATE={0x6, 0x5, {0x3, 0x96}}, @TCA_RATE={0x6, 0x5, {0x57, 0x7a}}, @tclass_kind_options=@c_qfq={{0x8}, {0x1c, 0x2, [@TCA_QFQ_LMAX={0x8, 0x2, 0x4800000}, @TCA_QFQ_WEIGHT={0x8, 0x1, 0x10001}, @TCA_QFQ_LMAX={0x8, 0x2, 0x554}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4080}, 0x41) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14615}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x44}}, 0x4000) getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000280)=0x14) r7 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r8, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb], 0x0, [0x5, 0x4, 0x2, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0xfffc]}}]}}]}, 0x8c}}, 0x0) socket$unix(0x1, 0x1, 0x0) r10 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000280), 0x8000, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000005980)=ANY=[@ANYBLOB="a400000010000104fcffffff8000000000000000", @ANYRES32=0x0, @ANYBLOB="0315000000000000740012800c0001006d6163766c616e0064000280340005800a000400aaaaaaaaaaaa00000a000400aaaaaaaaaaaa00000a000400aaaaaaaaaaaa00000a000400aaaaaaaaaabb00000800070005000000080003000300000006000200000000000a00040036566011ebc10000080001001000000008000500", @ANYRES32, @ANYRES16=r10, @ANYRES32, @ANYBLOB="2c46035929d83a292cbbcf4234c4f4a2abee7531064520530a329995a4bc7cf125fbb3ef269186dbf72db80d0324e130652efdf950bb8938468f7219634fc3436f6b59ad03e48a6ac4"], 0xa4}, 0x1, 0x0, 0x0, 0x4001}, 0x0) 29.105180353s ago: executing program 2 (id=2894): ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x101}}, './file0\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'veth0_vlan\x00'}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x4008032, 0xffffffffffffffff, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x7, &(0x7f000082a000/0x400000)=nil) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) prlimit64(0x0, 0x7, &(0x7f00000003c0), 0x0) pipe2(0x0, 0x0) mlock(&(0x7f0000b37000/0x4000)=nil, 0x4000) 26.179799921s ago: executing program 2 (id=2909): ppoll(0x0, 0x0, &(0x7f0000000280)={0x0, 0x3938700}, 0x0, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000000)={0xf6a248d08e4854cf, 0x2, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000011c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x438, 0x250, 0x940c, 0x3002, 0x0, 0x2c0, 0x368, 0x3d8, 0x3d8, 0x368, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0x208, 0x250, 0x4001, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x4001, 0x2, 0x3, 'syz0\x00'}}, @common=@inet=@iprange={{0x68}, {@ipv4=@broadcast, @ipv4=@broadcast, @ipv4=@multicast2, @ipv4=@remote, 0x2}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@loopback, 'virt_wifi0\x00', {0xfffffffffffffffe}}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@local, 'veth1\x00', {0xb8cd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x498) socket$xdp(0x2c, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x200000d4) inotify_add_watch(0xffffffffffffffff, &(0x7f00000000c0)='.\x00', 0x602) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r3, 0x0, 0x0) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f00000000c0)=ANY=[]) ioctl$KVM_CAP_VM_DISABLE_NX_HUGE_PAGES(r0, 0x4068aea3, &(0x7f0000001040)) ioctl$KVM_RUN(r1, 0xae80, 0x0) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000240)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec0000000109021200010000000009"], 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000080)={0x84, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$printer(r4, 0x0, &(0x7f0000000600)={0x34, &(0x7f0000000300)=ANY=[@ANYBLOB="400a440000005a6e8a2360c115f5ffbe7bc382945bb9d7dc7f0e0f1d92c66fd6626896e5ffc0d7efc1614915c06554f8d50e4e7f37c8e40f9db2590000000000000000b666888785ee0b"], 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0200e2362a6dcdcedfe7934dba078ba69ddc327b7761696d9fcb8966d5b7d5ea9722ad6742476a8413e4260d75224aa76b9daa59be7a58b0acdf639e7e504b53b50bf753d9437937c56bc6402915d98868106fdb56bde2222d6632"], &(0x7f0000000440)={0x20, 0x1, 0x1, 0x8}, &(0x7f00000002c0)={0x20, 0x0, 0x1, 0xff}}) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.sectors\x00', 0x26e1, 0x0) close(r5) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000480)) write$cgroup_subtree(r5, &(0x7f0000000400)=ANY=[@ANYRES64, @ANYRESDEC=r0], 0x9) 22.566587999s ago: executing program 2 (id=2922): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x3, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCPKT(r2, 0x5420, 0x0) socket$nl_generic(0x10, 0x3, 0x10) add_key$user(0x0, &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x38011, 0xffffffffffffffff, 0x2c9ab000) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x6) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r3, &(0x7f0000001180)={0x23d, 0x7d, 0x0, {{0x500, 0xfc, 0x0, 0xfffffffa, {}, 0x1bac0000, 0x0, 0x0, 0x0, 0x25, '\x04no\xc8f\xc9}`\x99\x06\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x1d\xf6\xdb\x00\x00\x00\x00\x00\x00=\xd3\x00\x00\x00\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00;Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x06\xb4\x94\xe1', 0x17, '\xcf\xc2\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x0fX\x05\x02\xb6n\x00\xf3\x13\xf6\x00', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xd4\x89\xdad\x9a7\x00'}, 0x12c, 'odev-n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x05\x00\x00\x00\x00\x00\x00\x00\xc2g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0x23d) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) msgget$private(0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_LOG_STATUS(r4, 0x5646, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='numa_maps\x00') preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0x0) fsopen(0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)) socket$kcm(0x2d, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) syz_io_uring_setup(0x49a, &(0x7f00000013c0)={0x0, 0x79af, 0x200, 0x7ffc, 0x40024c}, 0x0, 0x0) 19.541161079s ago: executing program 2 (id=2936): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0900000004000000e27f00000100000000000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f00000005c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x221c0, 0xac) fanotify_init(0x200, 0x0) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0x82002, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, &(0x7f0000000180)=0x6f) mmap$dsp(&(0x7f00003c0000/0x2000)=nil, 0x2000, 0x3, 0x11, r2, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xee, 0xfffffffd) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) socket(0x15, 0x5, 0x0) 8.828522102s ago: executing program 3 (id=2962): landlock_restrict_self(0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f00000011c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)={0x0}, 0x1, 0x0, 0x0, 0x41}, 0x0) writev(0xffffffffffffffff, &(0x7f00000003c0), 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="d4000000000101040000000000000100020000002400018014000180080001007f00000108000200ac1414000c0002800500010000000000240002801400018008000100e000000108000200e00000010c00028005000100000000000800074000000000080008400000000a0400164008001540000000030400170058000d"], 0xd4}}, 0x0) getxattr(0x0, &(0x7f0000000580)=@random={'security.', '/dev/usbmon#\x00'}, 0x0, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000000040)) 8.787251896s ago: executing program 4 (id=2963): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="85000000b400000034000000000000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffbfffffffffffe}, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f0000001a00), 0x2, 0x0) r3 = socket$rxrpc(0x21, 0x2, 0xa) r4 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r4, 0x110, 0x4, &(0x7f0000000040)=0x2, 0x4) sendmsg$inet(r4, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00}, 0x0) connect$rxrpc(r3, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast1}}, 0x24) ioctl$DRM_IOCTL_MODE_ADDFB(0xffffffffffffffff, 0xc01c64ae, 0x0) syz_io_uring_setup(0x304, &(0x7f0000000240)={0x0, 0x0, 0x10100, 0x2, 0xe1}, 0x0, &(0x7f0000000140)) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef91", 0x12) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10061, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe1a}], 0x1, &(0x7f0000000a40)=ANY=[@ANYBLOB="18000000000000001701000003000000010000000000000000000000000000001701000002000000000000007005baa38d33e2e1650de8f13f421b2d4b60252e76171216e42961c3b08d4d3dacb0a7089ff7cbfd613d46fa95d6e2f6e76ac3266c9b1a531c4bcf0e7071f117cca4e883b4a6eb5dee7a9ab4d05d7ee311ab1c55b817285e0c3714ee6137e3b8553de667701a7c93437583b5f0b285a188098c1ac4ebac40b315ff8db6f736992497879a42b95248fed4d4888970573d0e88ceead26d97e172588a3ad30fbd01b7bbeeaa668e835f7ae3113fe2d949bb47bc0b2c62541714cc0538601ae4bab19d69a5addee134dd447034da6dd89704603d31a3d25b9d5f46cfd43d9e29aac7422920d98e1463256bd4cc929373ad9000000000faf6a95a04ad3b9db9b230f8224a3d6db187a94e5dadfe181d20d3a4bd08e8b0e6eeb79fdee230dd852a36dfc9046d03b8f316b2d460ca5d08c515d914db8ce430ea0237911c440ee750fe787aaffa83b809651c529e4cf68c8219a827ea003c59e3e51b00cd7f9464f37be2eb3e1475819ad37edcc238b85ab205a2b394916815d9cf7bf3f8e3d19a4697756299e21f2afd3ae31e0f09b8153965635216de47156f4e5fc97cb04f9c5e13256be1d9e0a94f9c6387940de1bcd7b532d16ebba216601cf23be6a7c259550bd059a5a7aee85eb558de8201c1d9c7b29e27313f61cf0b07dd790071bdbceabdd32ce2bcc279b1575a1431b03e5dc37307d15a2782175c87dad1a3aadf48b382bea4ae0b423edee0e12ada4c1dacc40bf387630792ab5c7ed6e2ef7e8a77268b0ff8978ccddfa8da4521d24b3fddc70d181c20caa9a584df9b2e"], 0x18}], 0x4924924924924fd, 0x0) r7 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000004c0)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0x1000000, {0x0, 0x0, 0x12, 0x0, {0x0, 0x300}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x1}, @TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x1}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9], 0x0, [0x8, 0x4], [0x0, 0x0, 0x0, 0x0, 0xd645, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffff]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x3f0000}]}]}]}}]}, 0xac}, 0x1, 0x7a00}, 0x0) clock_gettime(0x0, &(0x7f0000002400)) recvmmsg(r6, &(0x7f0000002300)=[{{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000900)=""/82, 0x52}, {&(0x7f0000000dc0)=""/49, 0x31}], 0x2}, 0x7f}], 0x1, 0x11102, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a3000000000b0000000060a010400000000000000000100000008000b400000000034000480300001800e000100627974656f726465720000001c0002800800024000000000080001400000000008000140000000100900010073797a3000000000530007"], 0x124}}, 0x0) 8.572385119s ago: executing program 3 (id=2965): openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x8) openat$audio(0xffffff9c, 0x0, 0x80, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0xee24, 0xffffffffffffffff, 0x0, 0x3}, 0x0) r3 = fsopen(&(0x7f0000000000)='exfat\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000240)='i>\xa9S2\xc2:\x13\xa3rset', &(0x7f0000000680)='io#ha\xf4kIO}\x83\xe3~\x11\xb3\x8c\x80\x14ozN\xf9\xa5\xbd\xa9\x1ar\xde;\x99\x037\x04\x11\"\xe6\xa9\xcbeH\xa2\xd41\x12\x99\x05\xbf*Jw\xdb\xfd\xc5=TZ-z\xeb\"\v\xb1][E/\xff\xc0j\\\x83\xd9\xc3\xcc\xa8\xfa\xe6\xfct&\xac\xe2`\xf0\xe7O\"X\n\xbd@\xc3\xb1\x9a\x93\xdb\xbe+\xaboQ\x00\x00\xbc4\xb2\x81\xa5\xf4e\x1bT,\x84\xc4\xcb\x99\xac%2q4\xfb\xb3\x86\xcf\x02III*8p\xcc', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000001100)='iocharset', &(0x7f0000001140)='\xe0^@&&}\'\x00', 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000080), 0x8, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000380)={0x8, 0x2, 0x3}) r5 = signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f00000001c0)=@multiplanar_fd={0x7, 0x2, 0x4, 0x20, 0xa, {0x0, 0x2710}, {0x4, 0x0, 0x5, 0x3, 0x14, 0x6, "00000300"}, 0x1b1, 0x4, {&(0x7f00000004c0)=[{0x5, 0x9683, {r5}, 0xfffffff5}, {0x6, 0x8, {0xffffffffffffffff}, 0x1ff}]}, 0xedc5}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f00000002c0)={0x48}) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, 0x0) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r8, &(0x7f0000000040)='T', 0x1, 0x8910, &(0x7f0000000280)={0xa, 0xfffc, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c) socket$netlink(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r5, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r6}, './file0\x00'}) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$EVIOCGBITSND(r5, 0x80404532, &(0x7f0000000440)=""/102) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r9, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x0, 0x11cfa, 0x0, 0x8000008, 0x40002, 0x4, 0x1, 0x0, 0x2}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r9, 0x40505330, &(0x7f00000001c0)={0x800100, 0xffffffff, 0x1, 0x4000e1d9, 0x5, 0x102}) 6.137410035s ago: executing program 4 (id=2971): r0 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000005d40)=[{{&(0x7f0000000180)=@can={0x1d, r2}, 0x80, 0x0}}, {{&(0x7f00000022c0)=@can={0x1d, r2, 0x88a8}, 0x80, 0x0}}], 0x2, 0x0) 5.591905891s ago: executing program 4 (id=2972): ppoll(0x0, 0x0, &(0x7f0000000280)={0x0, 0x3938700}, 0x0, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000000)={0xf6a248d08e4854cf, 0x2, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000011c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x438, 0x250, 0x940c, 0x3002, 0x0, 0x2c0, 0x368, 0x3d8, 0x3d8, 0x368, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0x208, 0x250, 0x4001, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x4001, 0x2, 0x3, 'syz0\x00'}}, @common=@inet=@iprange={{0x68}, {@ipv4=@broadcast, @ipv4=@broadcast, @ipv4=@multicast2, @ipv4=@remote, 0x2}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@loopback, 'virt_wifi0\x00', {0xfffffffffffffffe}}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@local, 'veth1\x00', {0xb8cd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x498) socket$xdp(0x2c, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x200000d4) inotify_add_watch(0xffffffffffffffff, &(0x7f00000000c0)='.\x00', 0x602) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r3, 0x0, 0x0) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f00000000c0)=ANY=[]) ioctl$KVM_CAP_VM_DISABLE_NX_HUGE_PAGES(r0, 0x4068aea3, &(0x7f0000001040)) ioctl$KVM_RUN(r1, 0xae80, 0x0) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000240)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec0000000109021200010000000009"], 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000080)={0x84, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$printer(r4, 0x0, &(0x7f0000000600)={0x34, &(0x7f0000000300)=ANY=[@ANYBLOB="400a440000005a6e8a2360c115f5ffbe7bc382945bb9d7dc7f0e0f1d92c66fd6626896e5ffc0d7efc1614915c06554f8d50e4e7f37c8e40f9db2590000000000000000b666888785ee0b"], 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0200e2362a6dcdcedfe7934dba078ba69ddc327b7761696d9fcb8966d5b7d5ea9722ad6742476a8413e4260d75224aa76b9daa59be7a58b0acdf639e7e504b53b50bf753d9437937c56bc6402915d98868106fdb56bde2222d663271d57629330ac5116e4e6032239433"], &(0x7f0000000440)={0x20, 0x1, 0x1, 0x8}, &(0x7f00000002c0)={0x20, 0x0, 0x1, 0xff}}) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.sectors\x00', 0x26e1, 0x0) close(r5) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000480)) write$cgroup_subtree(r5, &(0x7f0000000400)=ANY=[@ANYRES64, @ANYRESDEC=r0], 0x9) 4.500766292s ago: executing program 1 (id=2973): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x215, 0x5dc}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE={0x8, 0x2, @remote}]}}}]}, 0x3c}, 0x1, 0xba01, 0x0, 0x20000000}, 0x0) 4.452453138s ago: executing program 5 (id=2974): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) r2 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r2, &(0x7f0000000080)={0x1d, r1, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000200)={'syztnl1\x00', &(0x7f0000000180)={'ip6tnl0\x00', 0x0, 0x4, 0x2, 0x9, 0x7ff, 0x20, @mcast1, @private2, 0xc1, 0x40, 0x8, 0x8}}) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000200}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)=@deltclass={0x60, 0x29, 0x4, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r4, {0x5}, {0x6, 0xa}, {0x8, 0x9}}, [@TCA_RATE={0x6, 0x5, {0x4, 0x6}}, @TCA_RATE={0x6, 0x5, {0x3, 0x96}}, @TCA_RATE={0x6, 0x5, {0x57, 0x7a}}, @tclass_kind_options=@c_qfq={{0x8}, {0x1c, 0x2, [@TCA_QFQ_LMAX={0x8, 0x2, 0x4800000}, @TCA_QFQ_WEIGHT={0x8, 0x1, 0x10001}, @TCA_QFQ_LMAX={0x8, 0x2, 0x554}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4080}, 0x41) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14615}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x44}}, 0x4000) getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000280)=0x14) socket$inet(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb], 0x0, [0x5, 0x4, 0x2, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0xfffc]}}]}}]}, 0x8c}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r8 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000280), 0x8000, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000005980)=ANY=[@ANYBLOB="a400000010000104fcffffff8000000000000000", @ANYRES32=0x0, @ANYBLOB="0315000000000000740012800c0001006d6163766c616e0064000280340005800a000400aaaaaaaaaaaa00000a000400aaaaaaaaaaaa00000a000400aaaaaaaaaaaa00000a000400aaaaaaaaaabb00000800070005000000080003000300000006000200000000000a00040036566011ebc10000080001001000000008000500", @ANYRES32, @ANYRES16=r8, @ANYRES32, @ANYBLOB="2c46035929d83a292cbbcf4234c4f4a2abee7531064520530a329995a4bc7cf125fbb3ef269186dbf72db80d0324e130652efdf950bb8938468f7219634fc3436f6b59ad03e48a6ac4"], 0xa4}, 0x1, 0x0, 0x0, 0x4001}, 0x0) 4.407315267s ago: executing program 3 (id=2975): r0 = socket(0x80000000000000a, 0x2, 0x0) socket$inet6(0xa, 0x1, 0x8010000000000084) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, &(0x7f00000000c0)) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) openat$sequencer(0xffffffffffffff9c, 0x0, 0x8002, 0x0) socket$nl_generic(0x11, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_TLV_READ(0xffffffffffffffff, 0xc008551a, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x4, 0x4007, @fd, 0x87, 0x0, 0x0, 0x0, 0x0, {0x1}}) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) ioctl$FBIOGET_FSCREENINFO(0xffffffffffffffff, 0x4602, &(0x7f0000000100)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000380)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c2000000080045000044000000000021907800000000ffffffff050090780a0101024a0000000000000000000000ac1e0001ac141401071300e000000200000000ffffffffac14140c"], 0x0) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0xa0201, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000500)=ANY=[@ANYBLOB="5800000010000d0400"/20, @ANYRES32=0x0, @ANYBLOB="737e000000000000240012800c0001006d6163766c616e001400028008000900fdffffff0800010002000000140035006d6163766c616e30"], 0x58}}, 0x0) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000000640)=0x8000) r6 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @private2={0xfc, 0x2, '\x00', 0x1}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0xfffffffffffffffe, 0x41, 0x0, 0x0, 0x1000, 0x6}}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x200}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x3, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x5, @loopback, 0x4}}}, 0x108) 4.248210955s ago: executing program 1 (id=2976): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, 0x0) 4.204189759s ago: executing program 1 (id=2977): socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0}, 0x1, 0x0, 0x0, 0x8801}, 0x20000800) socket$netlink(0x10, 0x3, 0x2) r0 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x503, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, 0x0, 0xc3ff}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) 4.104685247s ago: executing program 5 (id=2978): mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRESHEX]) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="2508007a0000000000000700000008000300", @ANYRES32, @ANYBLOB="1400060064756d6d7930000a00000000000000001400040076657468315f746f5f626f0164000000050053000100000008000500"], 0x54}}, 0x0) 3.915901106s ago: executing program 5 (id=2979): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xf, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4000}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r2}, &(0x7f00000002c0), &(0x7f0000000300)=r1}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808007000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x20008040) 3.853415402s ago: executing program 5 (id=2980): socket$can_raw(0x1d, 0x3, 0x1) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f00000001c0)=ANY=[], 0x118) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0xb8, &(0x7f0000000000), &(0x7f00000000c0)=0x4) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='gid_map\x00') r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r6, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x2c, 0x11, 0x1, 0x2000000, 0xffffffff, {0x0, 0x0, 0x0, r6, {}, {}, {0xfff3}}, [{0x8, 0xb, 0x200}]}, 0x2c}}, 0x0) bind$packet(r3, &(0x7f0000000040)={0x11, 0x1b, r6, 0x1, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x224b5bee36ba75e4}}, 0x14) unshare(0x2c020400) syz_io_uring_setup(0x5080, &(0x7f0000000180)={0x0, 0xdb0d, 0x800, 0xfffffffd, 0x3b5}, 0x0, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r9, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r9, 0x3b85, &(0x7f00000000c0)={0x28, 0x7, r10, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) r11 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r11, 0xc05064a7, &(0x7f0000001780)={0x0, 0x0, 0x0, 0x0}) close_range(r8, 0xffffffffffffffff, 0x10000000000000) 3.63683906s ago: executing program 1 (id=2981): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1}) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x101301) r6 = socket$unix(0x1, 0x1, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) syz_io_uring_setup(0x58f7, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000008400)=@newtfilter={0x90, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x0, 0x3}, {}, {0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x40, 0x6, 0x4, 0xea, 0x100004}, 0x1}}, @TCA_IFE_DMAC={0xa, 0x3, @local}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r5, 0x40605346, &(0x7f0000000400)={0x0, 0x0, {0x0, 0x3, 0x0, 0x0, 0xffffffff}, 0xc}) close_range(r4, 0xffffffffffffffff, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0xc0086202, &(0x7f0000000080)=0x2) r10 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r10, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0x12, 0x0, 0x1, 0x0, 0x10, 0xc708}}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_RTOINFO(r10, 0x84, 0x0, &(0x7f0000000040)={0x0, 0x2, 0x0, 0xe}, &(0x7f0000000080)=0x10) r13 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x8002) write$binfmt_aout(r13, &(0x7f0000000380)=ANY=[@ANYBLOB="03070000b5"], 0xc8) r14 = dup(r13) write$binfmt_aout(r14, &(0x7f00000008c0)=ANY=[@ANYBLOB="03040000b500000001008aea0000feff"], 0xc8) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r11, 0x84, 0x1f, &(0x7f0000000140)={r12, @in6={{0xa, 0x4e20, 0xce15, @private0={0xfc, 0x0, '\x00', 0x1}, 0xff}}, 0x2, 0x53bd}, 0x90) 3.036633967s ago: executing program 3 (id=2982): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) bpf$PROG_LOAD(0x5, 0x0, 0x0) preadv(r1, &(0x7f0000000000)=[{&(0x7f0000000380)=""/155, 0x9b}], 0x1, 0x4, 0xffffff31) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20181, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) clock_adjtime(0x3, &(0x7f0000000280)={0x6, 0x8, 0x1, 0x0, 0x7f, 0xe6, 0x1, 0x1, 0x5, 0x7ff, 0x1, 0x23c4, 0x100000000000000, 0x2, 0xffffffff, 0xa, 0xffffffffffffffff, 0x2, 0x7f, 0x4, 0x9d8, 0x5, 0x7, 0x7537, 0xffffffff, 0x7}) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000001200)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x48, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000640)=0x4) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x41, 0x3, 0x3, '\x00', 0x8}) ioctl$KVM_RUN(r4, 0xae80, 0xe0000000) 2.982430733s ago: executing program 1 (id=2983): r0 = syz_io_uring_setup(0x117, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffff, 0x106}, &(0x7f0000000500)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffc00, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_TIMEOUT={0xb, 0x5, 0x0, 0x0, 0x4, &(0x7f0000000000), 0x1, 0x40}) io_uring_enter(r0, 0x47f6, 0x80ffff, 0xf0ffffffffffff, 0x0, 0x0) 2.651472006s ago: executing program 1 (id=2984): openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x8) openat$audio(0xffffff9c, 0x0, 0x80, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0xee24, 0xffffffffffffffff, 0x0, 0x3}, 0x0) r3 = fsopen(&(0x7f0000000000)='exfat\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000240)='i>\xa9S2\xc2:\x13\xa3rset', &(0x7f0000000680)='io#ha\xf4kIO}\x83\xe3~\x11\xb3\x8c\x80\x14ozN\xf9\xa5\xbd\xa9\x1ar\xde;\x99\x037\x04\x11\"\xe6\xa9\xcbeH\xa2\xd41\x12\x99\x05\xbf*Jw\xdb\xfd\xc5=TZ-z\xeb\"\v\xb1][E/\xff\xc0j\\\x83\xd9\xc3\xcc\xa8\xfa\xe6\xfct&\xac\xe2`\xf0\xe7O\"X\n\xbd@\xc3\xb1\x9a\x93\xdb\xbe+\xaboQ\x00\x00\xbc4\xb2\x81\xa5\xf4e\x1bT,\x84\xc4\xcb\x99\xac%2q4\xfb\xb3\x86\xcf\x02III*8p\xcc', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000001100)='iocharset', &(0x7f0000001140)='\xe0^@&&}\'\x00', 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000080), 0x8, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000380)={0x8, 0x2, 0x3}) r5 = signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f00000001c0)=@multiplanar_fd={0x7, 0x2, 0x4, 0x20, 0xa, {0x0, 0x2710}, {0x4, 0x0, 0x5, 0x3, 0x14, 0x6, "00000300"}, 0x1b1, 0x4, {&(0x7f00000004c0)=[{0x5, 0x9683, {r5}, 0xfffffff5}, {0x6, 0x8, {0xffffffffffffffff}, 0x1ff}]}, 0xedc5}) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f00000002c0)={0x48}) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, 0x0) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r8, &(0x7f0000000040)='T', 0x1, 0x8910, &(0x7f0000000280)={0xa, 0xfffc, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c) socket$netlink(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r5, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r6}, './file0\x00'}) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$EVIOCGBITSND(r5, 0x80404532, &(0x7f0000000440)=""/102) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r9, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x0, 0x11cfa, 0x0, 0x8000008, 0x40002, 0x4, 0x1, 0x0, 0x2}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r9, 0x40505330, &(0x7f00000001c0)={0x800100, 0xffffffff, 0x1, 0x4000e1d9, 0x5, 0x102}) 2.482016733s ago: executing program 4 (id=2985): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@loopback, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xfffd, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}}, {{@in=@private=0xa010102, 0x0, 0x2b}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x75, 0x40082) r1 = io_uring_setup(0x3454, &(0x7f0000000080)={0x0, 0xffffafff, 0x1000, 0x2, 0x33d}) socket(0x10, 0x803, 0x0) pipe(&(0x7f0000000080)) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = io_uring_setup(0x3eae, &(0x7f0000000080)={0x0, 0xc95e}) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r3 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r3, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) pwrite64(0xffffffffffffffff, &(0x7f0000000300)="fec96b1890e924f0e68a5720c990384ffbdf05ecba334fb8", 0x18, 0x8) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000080)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=0x0, @ANYRES32=0x0, @ANYBLOB="1c007a800c000300631f17af01aa24ee0c00030058422dbbcfcb238f"], 0x38}, 0x1, 0x0, 0x0, 0x4040}, 0x840) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x5044}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r1, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, r4, {0x8001}}, './file0\x00'}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x2, 0x2, 0x0, 0x3, 0x11, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb}, @sadb_x_sa2={0x2, 0x9}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @sadb_x_sec_ctx={0x1, 0x18, 0x4}]}, 0x88}}, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000240)={[0x583a, 0x5, 0x9, 0xe55, 0x6, 0x2, 0x1040, 0x4, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0x1, 0x9, 0x5, 0x6a], 0x1, 0x1000d6}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000040)=0x2) 1.310042734s ago: executing program 4 (id=2986): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, 0x0) 1.008163013s ago: executing program 4 (id=2987): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000840)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x80000}, 0x0) syz_usb_connect(0x5, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="120110031fcd1b08cf10"], 0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, 0x0, 0x10) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f00000010c0)=[@in6={0xa, 0x4e21, 0xad, @private0, 0x8001}, @in6={0xa, 0x4e23, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3}]}, &(0x7f0000000180)=0x10) getsockopt$bt_hci(r2, 0x84, 0x6d, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) getrusage(0xffffffffffffffff, &(0x7f0000000680)) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r3, 0x40045108, &(0x7f0000000200)) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0xe}, {0xf}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x4, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x8c0}, 0x0) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000980), 0x0, 0x0) ioctl$SNDCTL_SEQ_RESET(r7, 0x5100) ioctl$SNDCTL_SEQ_RESET(r7, 0x5100) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r8, 0xffffffffffffffff, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mknod(0x0, 0x804, 0x0) 856.989835ms ago: executing program 2 (id=2939): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xe) ioctl$TIOCSSOFTCAR(r1, 0x5432, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010800000000fbdbdf2500a5c500", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x4) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x2ddfdbff, 0x2ffffffff}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100feffffff0000000005000000180001801400020073797a5f74756e000000000000000000240003801c0003800c00018008000100000000000c0401800800010000000000040001"], 0x50}}, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x9, 0x26d0d5f1) syz_open_procfs(0x0, &(0x7f0000000200)='task\x00') write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000001040)={0xc, {"f8ffffff4fc752f91b3e090987f70e06d038e7ff7fc6e5539b3264078b089b0e083871090890e0878f0e1ac6e7049b334c959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31360d3b5d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0aee29973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e821119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa177b3c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfdd95083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d780231c9c99a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dacc4c3f0008047096a44002bebc2421aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b346fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f068bb87af8b90fd8f08876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e20cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047499569373c0e23ef4df5c89644f48bb536f7945b59d7bcddff754420d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad039c2211f1033195563c7f93cd54b9094f226e783271e1e5a207c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d8c768f7971d31488b8658afc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae095ed3eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b281769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a897fe8e757a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f12f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3918c54e24b48ec027562d0687dc746b0827cbf6529006c6b95f2722e5655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2786f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f11aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7cb6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af22af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e51074b41bc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000022ff00", 0x1000}}, 0x1006) r7 = syz_open_dev$video(0x0, 0xa7, 0x0) ioctl$VIDIOC_S_PARM(r7, 0xc0cc5616, &(0x7f0000000080)={0x1, @capture={0x0, 0x0, {}, 0x0, 0x33}}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) socket$nl_generic(0x10, 0x3, 0x10) r8 = getpid() r9 = syz_pidfd_open(r8, 0x0) open_by_handle_at(r9, &(0x7f0000000180)=@reiserfs_5={0x14, 0x5, {0x7fff, 0xf, 0x6, 0x8, 0x9}}, 0x1) socket$kcm(0x11, 0x3, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) syz_usb_connect$uac1(0x3, 0xa4, &(0x7f0000000040)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d24050000050000000000", @ANYBLOB], 0x0) 577.486298ms ago: executing program 5 (id=2988): syz_emit_ethernet(0x5a, &(0x7f0000000080)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x24, 0x6, 0x1, @private1={0xfc, 0x1, '\x00', 0x2}, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x9, 0x2, 0xc, 0x0, 0x0, {[@generic={0x4, 0x5, "5eee37"}, @exp_fastopen={0xfe, 0x7, 0xf989, "feff98"}, @mss={0x2, 0x4, 0x4da}]}}}}}}}}, 0x0) r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x0, 0x384, 0xdf4a, 0x0, 0xd968d5b908ac0cdc, 0x0, {}, {0x3}, {0xf4ef}, {0x0, 0x0, 0xffe}, 0x2, 0x100, 0x0, 0xd613, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1}) 388.070057ms ago: executing program 3 (id=2989): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000f5ffffff0a98000000060a0b04000000000000000c020000006c000480680001800a000100696e6e6572000000580002800800024000000084080003400000000708000440000000400800014000000000340005800c0001007061796c6f61640024000280080004400000005608000340000000b908000140000000f307000240000000010900010073797a30000000000900020073797a32"], 0xc0}}, 0x0) 115.025381ms ago: executing program 5 (id=2990): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={'veth0_to_bond\x00', {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x27}}}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fspick(0xffffffffffffffff, 0x0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r3 = socket$netlink(0x10, 0x3, 0xa) r4 = dup(r3) r5 = open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) ftruncate(r5, 0x200004) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) ioctl$KVM_CAP_X2APIC_API(r7, 0x4068aea3, &(0x7f0000000000)={0x81, 0x0, 0x3}) ioctl$KVM_SIGNAL_MSI(r7, 0x4020aea5, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)={0x2c, 0x3e, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x10, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @nested={0x4, 0x1}]}, @nested={0x4, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x24, 0x41, 0x107, 0x0, 0x7, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}]}, 0x24}}, 0x4010) sendfile(r4, r5, 0x0, 0x80001d00c0d1) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/card3/oss_mixer\x00', 0x262103, 0x0) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x200400, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOMMU_VFIO_SET_IOMMU(r10, 0x3b66, 0x3) 0s ago: executing program 3 (id=2992): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000003c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) execve(0x0, 0x0, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x8080, 0x40) openat$dsp1(0xffffffffffffff9c, 0x0, 0x400080, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = dup(r2) write$UHID_INPUT(r3, &(0x7f00000009c0)={0xf, {"a2e3ad214fc752f90b5e09094bf70e0dd038e7ff7fc6e5539b1b48078b089b3b0838721a0890e0878f0e1ac6e7049b3d6c959b4c9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31320d07420736cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e2c5070000179c6f30e065cd5b91cd0ae17d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3bb469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918070000003f0000000c558cdc0a3621c56cea8d20fa911afe40db6ebe8cac64289fd3da232f1b5dbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860421c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000e0a37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2f09000000000000007747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847354b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d483d4675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516ab68032f88c042ffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d95f2e8c77d95a3d3a6df40babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9d1a3d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f39a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdfa1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60559516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442748af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500", 0x1009}}, 0x1006) syz_emit_ethernet(0x3e, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaa59e0abe22112e7e5addee3ab6de7ecefaaaaaaaaaaaaaaaa2786dd603000bb00082b00fc020000000000000000000001000000fe8000000000000000de0b00000000aa00009a030000089078"], 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000003800010324bd7002fa0000ca07"], 0x14}}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'hsr0\x00', 0x0}) bind$packet(r5, &(0x7f0000000000)={0x11, 0x3, r6, 0x1, 0x0, 0x6, @local}, 0x14) r7 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f0000000040)={r6, 0x1, 0x6, @local}, 0x10) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@getchain={0x24, 0x11, 0x839, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0xc}, {0xfff3, 0x8}}}, 0x24}}, 0x20048100) kernel console output (not intermixed with test programs): : New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 648.317714][T10385] usb 4-1: Product: syz [ 648.329031][T10385] usb 4-1: Manufacturer: syz [ 648.352784][T10385] usb 4-1: SerialNumber: syz [ 648.395397][T10385] usb 4-1: config 0 descriptor?? [ 648.434850][T14284] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 648.446462][T10385] usb 4-1: ucan: probing device on interface #0 [ 648.477101][T10385] usb 4-1: ucan: invalid endpoint configuration [ 648.558696][T10385] usb 4-1: ucan: probe failed; try to update the device firmware [ 649.003077][T14284] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2517'. [ 649.032426][T14284] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2517'. [ 649.065238][T14284] netlink: 'syz.3.2517': attribute type 6 has an invalid length. [ 649.086608][T14303] netlink: 276 bytes leftover after parsing attributes in process `syz.3.2517'. [ 649.109794][ T5881] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 649.259641][ T5881] usb 3-1: Using ep0 maxpacket: 16 [ 649.277657][ T5881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 649.289459][ T5881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 649.353576][ T5881] usb 3-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 649.382757][T10388] usb 2-1: USB disconnect, device number 90 [ 649.392511][T10388] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 649.425106][ T5881] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 649.450746][T10388] keyspan 2-1:4.196: device disconnected [ 649.483853][ T5881] usb 3-1: config 0 descriptor?? [ 649.555415][T14305] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2526'. [ 649.658434][T10385] usb 4-1: USB disconnect, device number 101 [ 649.910640][ T5881] corsair 0003:1B1C:1B02.0014: global environment stack underflow [ 649.925676][T14317] veth1_to_bond: entered allmulticast mode [ 649.931935][ T5881] corsair 0003:1B1C:1B02.0014: item 0 4 1 11 parsing failed [ 649.940518][T14317] veth1_to_bond: entered promiscuous mode [ 649.951826][ T5881] corsair 0003:1B1C:1B02.0014: parse failed [ 649.967789][ T5881] corsair 0003:1B1C:1B02.0014: probe with driver corsair failed with error -22 [ 650.115634][T14302] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 650.145318][T14315] veth1_to_bond: left promiscuous mode [ 650.163070][T14302] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 650.169924][T14315] veth1_to_bond: left allmulticast mode [ 650.206633][T10385] usb 3-1: USB disconnect, device number 95 [ 650.419714][ T5881] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 650.599841][ T5881] usb 2-1: Using ep0 maxpacket: 32 [ 650.638262][ T5881] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 650.650179][ T5881] usb 2-1: can't read configurations, error -61 [ 650.809952][ T5881] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 650.836423][T14335] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2534'. [ 650.849447][T14335] FAULT_INJECTION: forcing a failure. [ 650.849447][T14335] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 650.894134][T14335] CPU: 0 UID: 0 PID: 14335 Comm: syz.2.2534 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 650.894160][T14335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 650.894170][T14335] Call Trace: [ 650.894177][T14335] [ 650.894184][T14335] dump_stack_lvl+0x189/0x250 [ 650.894210][T14335] ? __lock_acquire+0xaac/0xd20 [ 650.894234][T14335] ? __pfx_dump_stack_lvl+0x10/0x10 [ 650.894255][T14335] ? __pfx__printk+0x10/0x10 [ 650.894270][T14335] ? __might_fault+0xb0/0x130 [ 650.894298][T14335] should_fail_ex+0x414/0x560 [ 650.894318][T14335] _copy_from_iter+0x1db/0x15a0 [ 650.894343][T14335] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 650.894360][T14335] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 650.894381][T14335] ? __pfx__copy_from_iter+0x10/0x10 [ 650.894401][T14335] ? __build_skb_around+0x257/0x3e0 [ 650.894424][T14335] ? netlink_sendmsg+0x642/0xb30 [ 650.894441][T14335] ? skb_put+0x11b/0x210 [ 650.894463][T14335] netlink_sendmsg+0x6b2/0xb30 [ 650.894487][T14335] ? __pfx_netlink_sendmsg+0x10/0x10 [ 650.894508][T14335] ? aa_sock_msg_perm+0x94/0x160 [ 650.894526][T14335] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 650.894544][T14335] ? __pfx_netlink_sendmsg+0x10/0x10 [ 650.894562][T14335] __sock_sendmsg+0x219/0x270 [ 650.894580][T14335] ____sys_sendmsg+0x52d/0x830 [ 650.894605][T14335] ? __pfx_____sys_sendmsg+0x10/0x10 [ 650.894632][T14335] ? import_iovec+0x74/0xa0 [ 650.894656][T14335] ___sys_sendmsg+0x21f/0x2a0 [ 650.894678][T14335] ? __pfx____sys_sendmsg+0x10/0x10 [ 650.894725][T14335] ? __fget_files+0x2a/0x420 [ 650.894745][T14335] ? __fget_files+0x3a0/0x420 [ 650.894772][T14335] __sys_sendmmsg+0x227/0x430 [ 650.894797][T14335] ? __pfx___sys_sendmmsg+0x10/0x10 [ 650.894825][T14335] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 650.894858][T14335] ? ksys_write+0x1f0/0x250 [ 650.894874][T14335] ? rcu_is_watching+0x15/0xb0 [ 650.894901][T14335] __x64_sys_sendmmsg+0xa0/0xc0 [ 650.894925][T14335] do_syscall_64+0xf6/0x210 [ 650.894946][T14335] ? clear_bhb_loop+0x60/0xb0 [ 650.894965][T14335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 650.894979][T14335] RIP: 0033:0x7f985cd8e969 [ 650.894993][T14335] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 650.895006][T14335] RSP: 002b:00007f985dc7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 650.895022][T14335] RAX: ffffffffffffffda RBX: 00007f985cfb5fa0 RCX: 00007f985cd8e969 [ 650.895033][T14335] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000003 [ 650.895044][T14335] RBP: 00007f985dc7f090 R08: 0000000000000000 R09: 0000000000000000 [ 650.895053][T14335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 650.895062][T14335] R13: 0000000000000000 R14: 00007f985cfb5fa0 R15: 00007f985d0dfa28 [ 650.895084][T14335] [ 651.115362][ T5881] usb 2-1: Using ep0 maxpacket: 32 [ 651.387296][ T5881] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 651.427220][ T5881] usb 2-1: can't read configurations, error -61 [ 651.473329][ T5881] usb usb2-port1: attempt power cycle [ 651.559686][T10388] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 651.747924][T10388] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 651.771219][T10388] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 651.808695][T10388] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 651.832840][T10388] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 651.872414][ T5881] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 651.881734][T10388] usb 6-1: SerialNumber: syz [ 651.931930][ T5881] usb 2-1: Using ep0 maxpacket: 32 [ 652.082430][ T5881] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 652.131199][T10388] usb 6-1: 0:2 : does not exist [ 652.162485][ T5881] usb 2-1: can't read configurations, error -61 [ 652.274017][T10388] usb 6-1: USB disconnect, device number 86 [ 652.280268][ T5882] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 652.372187][ T5881] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 652.440071][ T5882] usb 4-1: Using ep0 maxpacket: 32 [ 652.450438][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 652.512666][ T5882] usb 4-1: config 0 interface 0 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 652.559127][ T5881] usb 2-1: Using ep0 maxpacket: 32 [ 652.651947][ T5882] usb 4-1: config 0 interface 0 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 652.678084][ T5881] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 652.704428][ T5881] usb 2-1: can't read configurations, error -61 [ 652.714619][ T5882] usb 4-1: config 0 interface 0 has no altsetting 0 [ 652.722533][ T5881] usb usb2-port1: unable to enumerate USB device [ 652.735704][ T5882] usb 4-1: New USB device found, idVendor=056a, idProduct=0094, bcdDevice= 0.00 [ 652.759759][ T5882] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 652.783045][ T5882] usb 4-1: config 0 descriptor?? [ 653.268202][ T5882] wacom 0003:056A:0094.0015: Using device in hidraw-only mode [ 653.319358][ T5882] wacom 0003:056A:0094.0015: hidraw0: USB HID v0.05 Device [HID 056a:0094] on usb-dummy_hcd.3-1/input0 [ 653.795540][T14367] input: syz1 as /devices/virtual/input/input73 [ 654.300371][T10385] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 654.474602][T10385] usb 3-1: config 0 has no interfaces? [ 654.496560][T10385] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 654.535789][T10385] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 654.845015][ T5882] usb 4-1: USB disconnect, device number 102 [ 654.885322][T10385] usb 3-1: Product: syz [ 654.933429][T10385] usb 3-1: Manufacturer: syz [ 654.938139][T10385] usb 3-1: SerialNumber: syz [ 655.010986][T10385] usb 3-1: config 0 descriptor?? [ 656.223803][T14403] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2553'. [ 657.288082][ T5882] usb 3-1: USB disconnect, device number 96 [ 657.760111][ T5881] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 657.916492][T14433] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2563'. [ 657.951755][ T5881] usb 4-1: Using ep0 maxpacket: 8 [ 657.981613][T14427] netlink: 'syz.3.2560': attribute type 13 has an invalid length. [ 658.151873][T14427] gretap0: refused to change device tx_queue_len [ 658.158328][T14427] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 658.174258][T14436] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2564'. [ 658.296997][ T5881] usb 4-1: unable to get BOS descriptor or descriptor too short [ 658.330899][ T5881] usb 4-1: no configurations [ 658.335573][ T5881] usb 4-1: can't read configurations, error -22 [ 659.760082][T10385] usb 5-1: new full-speed USB device number 83 using dummy_hcd [ 660.144334][T10385] usb 5-1: config index 0 descriptor too short (expected 45568, got 9) [ 660.169677][T10385] usb 5-1: config 0 has too many interfaces: 34, using maximum allowed: 32 [ 660.237273][T10385] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 34 [ 660.332693][T10385] usb 5-1: New USB device found, idVendor=04a5, idProduct=300a, bcdDevice=5f.57 [ 660.401187][ T5881] usb 3-1: new full-speed USB device number 97 using dummy_hcd [ 660.409685][T10385] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 660.431041][T10385] usb 5-1: Product: syz [ 660.452991][T10385] usb 5-1: Manufacturer: syz [ 660.535965][T10385] usb 5-1: SerialNumber: syz [ 660.589782][ T5882] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 660.610383][T10385] usb 5-1: config 0 descriptor?? [ 660.618237][ T5881] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 660.709960][ T5881] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 660.771862][T10385] usb 5-1: can't set config #0, error -71 [ 660.792643][T10385] usb 5-1: USB disconnect, device number 83 [ 660.920211][ T5881] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 25647, setting to 64 [ 660.960237][ T5882] usb 6-1: config 0 has no interfaces? [ 660.987096][ T5881] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 661.007798][ T5882] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 661.026560][ T5882] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 661.044480][ T5881] usb 3-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 661.069879][T14471] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2575'. [ 661.153469][ T5882] usb 6-1: Product: syz [ 661.157707][ T5882] usb 6-1: Manufacturer: syz [ 661.203532][ T5881] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 661.260311][ T5882] usb 6-1: SerialNumber: syz [ 661.270061][ T5881] usb 3-1: Product: syz [ 661.301533][ T5881] usb 3-1: Manufacturer: syz [ 661.309026][ T5882] usb 6-1: config 0 descriptor?? [ 661.367538][ T5881] usb 3-1: SerialNumber: syz [ 661.400348][ T5881] usb 3-1: config 0 descriptor?? [ 661.433556][T14464] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 661.449480][ T5881] input: KB Gear Tablet as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input74 [ 661.459820][T10385] usb 4-1: new full-speed USB device number 105 using dummy_hcd [ 661.601925][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 661.601946][ T30] audit: type=1400 audit(1748074866.381:10136): apparmor="DENIED" operation="setprocattr" info="current" error=-22 profile="unconfined" pid=14466 comm="syz.5.2574" [ 661.738765][T10385] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 661.753092][T10385] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x35, changing to 0x5 [ 661.767642][T10385] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 661.954700][T10385] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 661.967628][T10385] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 661.979497][T10385] usb 4-1: Product: syz [ 662.045663][T10385] usb 4-1: Manufacturer: syz [ 662.058372][T10385] usb 4-1: SerialNumber: syz [ 662.159199][T10385] usb 4-1: config 0 descriptor?? [ 662.169274][T14475] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 662.251300][T10385] usb 4-1: ucan: probing device on interface #0 [ 662.257881][T10385] usb 4-1: ucan: invalid endpoint configuration [ 662.276297][T10385] usb 4-1: ucan: probe failed; try to update the device firmware [ 662.822263][T14475] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2577'. [ 662.854043][T14475] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2577'. [ 662.883866][T14486] netlink: 276 bytes leftover after parsing attributes in process `syz.3.2577'. [ 662.913515][T14475] netlink: 'syz.3.2577': attribute type 6 has an invalid length. [ 662.996756][T14488] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2579'. [ 663.112559][T14489] pimreg: entered allmulticast mode [ 663.181158][ T5881] usb 3-1: USB disconnect, device number 97 [ 663.490908][ T5882] usb 4-1: USB disconnect, device number 105 [ 663.758302][T10385] usb 6-1: USB disconnect, device number 87 [ 663.800339][T14494] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 664.110506][T14509] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 664.253546][ T5882] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 664.519826][ T5882] usb 5-1: Using ep0 maxpacket: 8 [ 664.897796][T14504] netlink: 'syz.4.2581': attribute type 13 has an invalid length. [ 665.060812][ T5882] usb 5-1: unable to get BOS descriptor or descriptor too short [ 665.080184][ T5882] usb 5-1: no configurations [ 665.089010][ T5882] usb 5-1: can't read configurations, error -22 [ 665.359847][ T5881] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 665.460520][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 665.529739][ T5881] usb 6-1: Using ep0 maxpacket: 8 [ 665.579917][T14518] netlink: 'syz.5.2586': attribute type 13 has an invalid length. [ 665.642773][ T5881] usb 6-1: unable to get BOS descriptor or descriptor too short [ 665.661941][ T5881] usb 6-1: no configurations [ 665.688415][ T5881] usb 6-1: can't read configurations, error -22 [ 666.763206][T14534] macvlan0: entered allmulticast mode [ 666.910832][T14534] veth1_vlan: entered allmulticast mode [ 667.006355][T14534] xt_hashlimit: invalid interval [ 667.199808][T10385] usb 3-1: new full-speed USB device number 98 using dummy_hcd [ 667.393342][T10385] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 667.405587][T10385] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 667.509342][T10385] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 25647, setting to 64 [ 667.544083][T10385] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 667.566887][ T5881] usb 2-1: new full-speed USB device number 95 using dummy_hcd [ 667.663455][T10385] usb 3-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 667.676949][T10385] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 667.693013][T10385] usb 3-1: Product: syz [ 667.706210][T10385] usb 3-1: Manufacturer: syz [ 667.724602][T10385] usb 3-1: SerialNumber: syz [ 667.740909][T10385] usb 3-1: config 0 descriptor?? [ 667.747942][T14535] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 667.758159][ T5881] usb 2-1: config index 0 descriptor too short (expected 45568, got 9) [ 667.761539][T10385] input: KB Gear Tablet as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input75 [ 667.843811][ T5881] usb 2-1: config 0 has too many interfaces: 34, using maximum allowed: 32 [ 667.887406][ T5881] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 34 [ 668.093610][ T5881] usb 2-1: New USB device found, idVendor=04a5, idProduct=300a, bcdDevice=5f.57 [ 668.367985][ T5881] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 668.559708][ T5881] usb 2-1: Product: syz [ 668.573399][ T5881] usb 2-1: Manufacturer: syz [ 668.809917][ T5881] usb 2-1: SerialNumber: syz [ 669.024074][ T5881] usb 2-1: config 0 descriptor?? [ 669.275724][ T5881] usb 2-1: USB disconnect, device number 95 [ 669.769643][T10385] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 669.901288][ T10] usb 3-1: USB disconnect, device number 98 [ 669.930237][T10385] usb 4-1: Using ep0 maxpacket: 8 [ 669.943590][T10385] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 669.990268][T10385] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 669.999449][T10385] usb 4-1: config 1 has no interface number 1 [ 670.059851][T10385] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 670.072921][T10385] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 670.091343][T10385] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 670.109062][T10385] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 670.174247][T10385] usb 4-1: Product: syz [ 670.179784][T10385] usb 4-1: Manufacturer: syz [ 670.184522][T10385] usb 4-1: SerialNumber: syz [ 670.407991][T10385] usb 4-1: 2:1 : no or invalid class specific endpoint descriptor [ 670.428465][T10385] usb 4-1: 2:1 : format type 0 is detected, processed as PCM [ 670.439347][T10385] usb 4-1: 2:1 : unsupported sample bitwidth 0 in 0 bytes [ 670.480104][ T10] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 670.511763][T10385] usb 4-1: USB disconnect, device number 106 [ 670.618745][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 670.692584][ T10] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 670.733210][ T10] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 670.790070][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 670.838790][ T10] usb 6-1: config 0 descriptor?? [ 670.959668][ T5881] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 671.231980][ T5881] usb 2-1: Using ep0 maxpacket: 8 [ 671.318343][T14575] netlink: 'syz.1.2602': attribute type 13 has an invalid length. [ 671.355615][ T5881] usb 2-1: unable to get BOS descriptor or descriptor too short [ 671.384299][ T5881] usb 2-1: no configurations [ 671.734073][ T5881] usb 2-1: can't read configurations, error -22 [ 673.237372][ T5881] usb 6-1: USB disconnect, device number 90 [ 673.366466][T14601] blktrace: Concurrent blktraces are not allowed on sg0 [ 673.720749][ T5882] usb 3-1: new full-speed USB device number 99 using dummy_hcd [ 673.871276][ T5882] usb 3-1: config index 0 descriptor too short (expected 45568, got 9) [ 673.886043][ T5882] usb 3-1: config 0 has too many interfaces: 34, using maximum allowed: 32 [ 673.894775][ T5882] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 34 [ 673.904297][ T5881] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 673.921037][ T5882] usb 3-1: New USB device found, idVendor=04a5, idProduct=300a, bcdDevice=5f.57 [ 673.930892][ T5882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.943805][ T5882] usb 3-1: Product: syz [ 673.950323][ T5882] usb 3-1: Manufacturer: syz [ 673.957138][ T5882] usb 3-1: SerialNumber: syz [ 673.979679][T10388] usb 4-1: new full-speed USB device number 107 using dummy_hcd [ 673.992935][ T5882] usb 3-1: config 0 descriptor?? [ 674.088268][T14611] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2609'. [ 674.092383][ T5881] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 674.117486][ T5881] usb 6-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 674.127757][ T5881] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 674.148377][T10388] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 674.162639][T10388] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 674.178216][ T5881] usb 6-1: config 0 descriptor?? [ 674.187085][T10388] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 25647, setting to 64 [ 674.209019][T10388] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 674.226340][T10388] usb 4-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 674.226406][T10388] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.226430][T10388] usb 4-1: Product: syz [ 674.259652][T10388] usb 4-1: Manufacturer: syz [ 674.259677][T10388] usb 4-1: SerialNumber: syz [ 674.340764][T10388] usb 4-1: config 0 descriptor?? [ 674.347288][T14609] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 674.403170][T10388] input: KB Gear Tablet as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input76 [ 674.603903][T14604] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 674.625182][T14604] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 674.677112][T14604] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 674.710386][T14604] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 674.735510][ T5881] logitech 0003:046D:C295.0016: ignoring exceeding usage max [ 674.747112][ T5881] logitech 0003:046D:C295.0016: ignoring exceeding usage max [ 674.851520][ T5881] logitech 0003:046D:C295.0016: usage index exceeded [ 674.876335][ T5882] usb 3-1: USB disconnect, device number 99 [ 674.970260][ T5881] logitech 0003:046D:C295.0016: item 0 0 2 2 parsing failed [ 675.068341][ T5881] logitech 0003:046D:C295.0016: parse failed [ 675.259944][ T5881] logitech 0003:046D:C295.0016: probe with driver logitech failed with error -22 [ 675.266992][ T5881] usb 6-1: USB disconnect, device number 91 [ 675.774139][T14632] FAULT_INJECTION: forcing a failure. [ 675.774139][T14632] name failslab, interval 1, probability 0, space 0, times 0 [ 675.790773][T14632] CPU: 1 UID: 0 PID: 14632 Comm: syz.1.2615 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 675.790805][T14632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 675.790820][T14632] Call Trace: [ 675.790830][T14632] [ 675.790839][T14632] dump_stack_lvl+0x189/0x250 [ 675.790879][T14632] ? __pfx_dump_stack_lvl+0x10/0x10 [ 675.790909][T14632] ? __pfx__printk+0x10/0x10 [ 675.790933][T14632] ? __pfx___might_resched+0x10/0x10 [ 675.790954][T14632] ? fs_reclaim_acquire+0x7d/0x100 [ 675.790991][T14632] should_fail_ex+0x414/0x560 [ 675.791017][T14632] ? __pfx_sock_alloc_inode+0x10/0x10 [ 675.791039][T14632] should_failslab+0xa8/0x100 [ 675.791069][T14632] ? __pfx_sock_alloc_inode+0x10/0x10 [ 675.791088][T14632] kmem_cache_alloc_lru_noprof+0x78/0x3d0 [ 675.791115][T14632] ? sock_alloc_inode+0x28/0xc0 [ 675.791140][T14632] ? __pfx_sock_alloc_inode+0x10/0x10 [ 675.791160][T14632] sock_alloc_inode+0x28/0xc0 [ 675.791180][T14632] alloc_inode+0x67/0x1b0 [ 675.791207][T14632] __sock_create+0x12d/0x9f0 [ 675.791229][T14632] ? fput+0xa0/0xd0 [ 675.791262][T14632] ? rcu_is_watching+0x15/0xb0 [ 675.791286][T14632] __sys_socket+0xd7/0x1b0 [ 675.791313][T14632] __x64_sys_socket+0x7a/0x90 [ 675.791337][T14632] do_syscall_64+0xf6/0x210 [ 675.791367][T14632] ? clear_bhb_loop+0x60/0xb0 [ 675.791394][T14632] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.791415][T14632] RIP: 0033:0x7f839d58e969 [ 675.791434][T14632] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 675.791453][T14632] RSP: 002b:00007f839e488038 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 675.791476][T14632] RAX: ffffffffffffffda RBX: 00007f839d7b5fa0 RCX: 00007f839d58e969 [ 675.791493][T14632] RDX: 000000000000000a RSI: 0000000000000002 RDI: 0000000000000021 [ 675.791506][T14632] RBP: 00007f839e488090 R08: 0000000000000000 R09: 0000000000000000 [ 675.791520][T14632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 675.791533][T14632] R13: 0000000000000000 R14: 00007f839d7b5fa0 R15: 00007f839d8dfa28 [ 675.791566][T14632] [ 675.791817][T14632] socket: no more sockets [ 676.527491][ T5881] usb 4-1: USB disconnect, device number 107 [ 676.874681][T14642] bond5: entered allmulticast mode [ 676.928874][T14642] bond5 (unregistering): Released all slaves [ 677.028256][T14647] netlink: 'syz.4.2620': attribute type 2 has an invalid length. [ 677.464818][T14636] vivid-007: ================= START STATUS ================= [ 677.472697][T14636] vivid-007: Enable Output Cropping: true [ 677.478474][T14636] vivid-007: Enable Output Composing: true [ 677.484507][T14636] vivid-007: Enable Output Scaler: true [ 677.490180][T14636] vivid-007: Tx RGB Quantization Range: Automatic [ 677.496697][T14636] vivid-007: Transmit Mode: HDMI [ 677.501811][T14636] vivid-007: Hotplug Present: 0x00000000 [ 677.507553][T14636] vivid-007: RxSense Present: 0x00000000 [ 677.513376][T14636] vivid-007: EDID Present: 0x00000000 [ 677.518877][T14636] vivid-007: ================== END STATUS ================== [ 677.769081][T14658] usb usb9: usbfs: process 14658 (syz.5.2623) did not claim interface 0 before use [ 678.395570][ T10] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 678.823713][ T10] usb 3-1: config 0 has no interfaces? [ 678.876102][ T10] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 678.885362][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 678.898696][ T10] usb 3-1: Product: syz [ 678.907847][ T10] usb 3-1: Manufacturer: syz [ 678.913166][ T10] usb 3-1: SerialNumber: syz [ 678.921397][ T10] usb 3-1: config 0 descriptor?? [ 679.027289][T14674] netlink: 276 bytes leftover after parsing attributes in process `syz.5.2628'. [ 679.156012][ T5882] usb 4-1: new full-speed USB device number 108 using dummy_hcd [ 679.228537][T14678] macsec1: entered allmulticast mode [ 679.257582][T14678] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 679.366469][ T5882] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 679.382337][ T5882] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 679.397622][ T5882] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 25647, setting to 64 [ 679.413888][ T5882] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 679.435044][ T5882] usb 4-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 679.445233][ T5882] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.456614][ T5882] usb 4-1: Product: syz [ 679.464944][T14678] netdevsim netdevsim5 netdevsim0: left allmulticast mode [ 679.488732][ T5882] usb 4-1: Manufacturer: syz [ 679.496167][ T5882] usb 4-1: SerialNumber: syz [ 679.508766][ T5882] usb 4-1: config 0 descriptor?? [ 679.524918][T14672] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 679.655501][T14686] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2630'. [ 679.699315][ T5882] input: KB Gear Tablet as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input77 [ 679.727369][T14686] bridge0: entered promiscuous mode [ 679.733649][T14686] macvlan2: entered promiscuous mode [ 680.126865][ C1] kbtab 4-1:0.0: kbtab_irq - usb_submit_urb failed with result -1 [ 680.355992][ T30] audit: type=1326 audit(1748074885.141:10137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14692 comm="syz.5.2633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 680.384511][ T30] audit: type=1326 audit(1748074885.141:10138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14692 comm="syz.5.2633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 680.411878][ T30] audit: type=1326 audit(1748074885.141:10139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14692 comm="syz.5.2633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 680.597257][ T30] audit: type=1326 audit(1748074885.141:10140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14692 comm="syz.5.2633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 680.668153][ T30] audit: type=1326 audit(1748074885.141:10141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14692 comm="syz.5.2633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 680.749048][ T30] audit: type=1326 audit(1748074885.141:10142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14692 comm="syz.5.2633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 680.827689][ T30] audit: type=1326 audit(1748074885.141:10143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14692 comm="syz.5.2633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 680.850332][ C0] vkms_vblank_simulate: vblank timer overrun [ 680.978219][ T10] usb 3-1: USB disconnect, device number 100 [ 681.013728][ T30] audit: type=1326 audit(1748074885.141:10144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14692 comm="syz.5.2633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 681.040089][ T30] audit: type=1326 audit(1748074885.141:10145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14692 comm="syz.5.2633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 681.078253][ T30] audit: type=1326 audit(1748074885.141:10146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14692 comm="syz.5.2633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 681.296084][ T5882] usb 4-1: USB disconnect, device number 108 [ 681.967893][T14720] vivid-000: disconnect [ 682.078249][T14721] netlink: 'syz.3.2641': attribute type 4 has an invalid length. [ 682.108993][T14699] vivid-000: reconnect [ 682.230667][T14724] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2643'. [ 682.355054][T14726] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2645'. [ 682.386418][T14726] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2645'. [ 682.411312][T14728] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2644'. [ 683.252489][T14741] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2649'. [ 683.269673][ T5882] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 683.279660][ T5881] usb 2-1: new full-speed USB device number 98 using dummy_hcd [ 683.330090][ T10] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 683.421632][ T5882] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 683.439735][ T5882] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 683.464762][ T5882] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 683.473960][ T5881] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 683.495068][ T5881] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 683.498351][ T10] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 683.518452][ T5882] usb 6-1: config 0 descriptor?? [ 683.528078][ T5881] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 25647, setting to 64 [ 683.547336][ T10] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 683.557093][ T5881] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 683.564809][ T5881] usb 2-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 683.590743][ T5881] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 683.598951][ T5881] usb 2-1: Product: syz [ 683.604823][ T5881] usb 2-1: Manufacturer: syz [ 683.610976][ T5881] usb 2-1: SerialNumber: syz [ 683.626862][ T5881] usb 2-1: config 0 descriptor?? [ 683.639390][T14739] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 683.648329][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 683.709085][ T10] usb 3-1: config 0 descriptor?? [ 683.750494][ T5881] input: KB Gear Tablet as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input78 [ 683.849911][T14750] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2652'. [ 683.940100][ T5882] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 684.079618][ T5882] usb 5-1: device descriptor read/64, error -71 [ 684.176122][T14754] usb usb9: usbfs: process 14754 (syz.3.2653) did not claim interface 0 before use [ 684.330051][ T5882] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 684.479845][ T5882] usb 5-1: device descriptor read/64, error -71 [ 684.599874][ T5882] usb usb5-port1: attempt power cycle [ 684.940273][ T5882] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 684.976009][ T5882] usb 5-1: device descriptor read/8, error -71 [ 685.219696][ T5882] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 685.260561][ T5882] usb 5-1: device descriptor read/8, error -71 [ 685.379884][ T5882] usb usb5-port1: unable to enumerate USB device [ 685.661723][ T10] usb 2-1: USB disconnect, device number 98 [ 685.797059][T14768] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2657'. [ 685.807415][T14768] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2657'. [ 685.853719][ T5882] usb 6-1: USB disconnect, device number 92 [ 685.947780][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.954283][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.096304][ T5882] usb 3-1: USB disconnect, device number 101 [ 686.118945][T14778] delete_channel: no stack [ 686.132934][T14778] program syz.3.2659 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 686.419660][ T5881] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 686.844783][T14788] netlink: 'syz.4.2662': attribute type 2 has an invalid length. [ 686.909754][ T5882] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 686.931464][ T5881] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 686.957705][ T5881] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 687.016355][ T5881] usb 4-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 687.215950][ T5882] usb 3-1: config 0 has no interfaces? [ 687.222231][ T5881] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 687.309989][ T10] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 687.375696][ T5881] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 687.425038][ T5882] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 687.479969][ T5882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 687.495160][ T5882] usb 3-1: Product: syz [ 687.511083][ T5881] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 687.518085][ T5882] usb 3-1: Manufacturer: syz [ 687.529778][ T5882] usb 3-1: SerialNumber: syz [ 687.535841][ T5881] usb 4-1: invalid MIDI out EP 0 [ 687.554675][ T5882] usb 3-1: config 0 descriptor?? [ 687.645832][ T5881] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 687.678323][ T10] usb 6-1: config 0 has an invalid interface number: 246 but max is 0 [ 687.730053][T14778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 687.742635][T14778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 687.760067][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 687.777207][ T5833] udevd[5833]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 687.974014][ T10] usb 6-1: config 0 has no interface number 0 [ 688.009711][ T10] usb 6-1: New USB device found, idVendor=28a7, idProduct=71ab, bcdDevice=df.39 [ 688.019731][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 688.027745][ T10] usb 6-1: Product: syz [ 688.150129][ T10] usb 6-1: Manufacturer: syz [ 688.154775][ T10] usb 6-1: SerialNumber: syz [ 688.284610][ T10] usb 6-1: config 0 descriptor?? [ 688.319147][ T10] cdc_wdm 6-1:0.246: More than one union descriptor, skipping ... [ 688.330969][T10385] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 688.381041][ T10] cdc_wdm 6-1:0.246: probe with driver cdc_wdm failed with error -22 [ 688.505317][T10385] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 688.544827][T10385] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 688.704257][T14792] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2663'. [ 688.729267][T10385] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 688.829015][T10385] usb 2-1: config 0 descriptor?? [ 689.129620][ T5881] usb 6-1: USB disconnect, device number 93 [ 689.409656][T10388] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 689.559671][T10388] usb 5-1: Using ep0 maxpacket: 32 [ 689.572731][ T10] usb 4-1: USB disconnect, device number 109 [ 689.580535][T10388] usb 5-1: config 0 interface 0 has no altsetting 0 [ 689.590029][T10388] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 689.610048][T10388] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 689.625996][T10388] usb 5-1: Product: syz [ 689.637235][T10388] usb 5-1: Manufacturer: syz [ 689.654651][T10388] usb 5-1: SerialNumber: syz [ 689.676488][T10388] usb 5-1: config 0 descriptor?? [ 689.807221][T14816] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2671'. [ 689.825981][T14816] tc_dump_action: action bad kind [ 689.839369][T14816] binder: 14815:14816 ioctl c0306201 2000000003c0 returned -14 [ 689.857313][T14816] binder_alloc: 14815: binder_alloc_buf, no vma [ 689.956729][ T5881] usb 3-1: USB disconnect, device number 102 [ 690.097290][T10388] gs_usb 5-1:0.0: Configuring for 1 interfaces [ 690.531019][ T5881] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 690.541664][T10388] usb 5-1: USB disconnect, device number 90 [ 690.724831][ T5881] usb 3-1: Using ep0 maxpacket: 8 [ 690.801961][T14827] netlink: 'syz.2.2673': attribute type 13 has an invalid length. [ 690.859996][ T5881] usb 3-1: unable to get BOS descriptor or descriptor too short [ 690.867795][ T5881] usb 3-1: no configurations [ 690.888928][ T5881] usb 3-1: can't read configurations, error -22 [ 691.264879][ T10] usb 2-1: USB disconnect, device number 99 [ 691.277554][T10385] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 691.471691][T10385] usb 6-1: Using ep0 maxpacket: 32 [ 691.502882][T10385] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 691.511855][T10385] usb 6-1: config 0 has no interface number 0 [ 691.521554][T10385] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 691.531224][T10385] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 691.561450][T10385] usb 6-1: Product: syz [ 691.575815][T10385] usb 6-1: Manufacturer: syz [ 691.587223][T10385] usb 6-1: SerialNumber: syz [ 691.606356][T10385] usb 6-1: config 0 descriptor?? [ 691.639371][T10385] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 691.653332][T10385] usb 6-1: selecting invalid altsetting 1 [ 691.668980][T10385] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 691.679623][ T10] usb 2-1: new low-speed USB device number 100 using dummy_hcd [ 691.698706][T10385] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 691.724730][T10385] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 691.744937][T10385] usb 6-1: media controller created [ 691.809693][ T10] usb 2-1: device descriptor read/64, error -71 [ 691.856655][T10385] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 691.866845][T14860] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 691.899429][T14860] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 692.038495][ T30] kauditd_printk_skb: 61 callbacks suppressed [ 692.038514][ T30] audit: type=1326 audit(1748074896.821:10208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14862 comm="syz.3.2681" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f2014f8e969 code=0x0 [ 692.059672][ T10] usb 2-1: new low-speed USB device number 101 using dummy_hcd [ 692.129608][ T5882] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 692.229754][ T10] usb 2-1: device descriptor read/64, error -71 [ 692.325689][ T5882] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 692.337869][ T5882] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 692.340712][ T10] usb usb2-port1: attempt power cycle [ 692.364262][T10385] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 692.384157][T10385] zl10353_read_register: readreg error (reg=127, ret==-71) [ 692.391123][ T5882] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 692.411783][T10385] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 692.425146][ T5882] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 692.435439][ T5882] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 692.445524][ T5882] usb 5-1: Product: syz [ 692.450508][ T5882] usb 5-1: Manufacturer: syz [ 692.457555][ T5882] usb 5-1: SerialNumber: syz [ 692.611795][T10385] usb 6-1: USB disconnect, device number 94 [ 692.696300][ T5882] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 91 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 692.709698][ T10] usb 2-1: new low-speed USB device number 102 using dummy_hcd [ 692.753442][ T10] usb 2-1: device descriptor read/8, error -71 [ 692.814496][ T5882] usb 5-1: USB disconnect, device number 91 [ 692.842500][ T5882] usblp0: removed [ 693.000085][ T10] usb 2-1: new low-speed USB device number 103 using dummy_hcd [ 693.021101][ T10] usb 2-1: device descriptor read/8, error -71 [ 693.130057][ T10] usb usb2-port1: unable to enumerate USB device [ 693.691521][T14899] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2688'. [ 693.969740][ T5882] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 694.133359][ T5882] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 694.142679][ T5882] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 694.154308][ T5882] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 694.175891][ T5882] usb 5-1: config 0 descriptor?? [ 695.014386][T14914] pimreg: entered allmulticast mode [ 695.331262][T14903] pimreg: left allmulticast mode [ 695.465768][T14917] macsec2: entered allmulticast mode [ 695.478486][T14917] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 695.493849][T14917] netdevsim netdevsim3 netdevsim0: left allmulticast mode [ 696.081939][T14935] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2696'. [ 696.110375][ T10] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 696.242575][T14939] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2698'. [ 696.252862][T14939] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2698'. [ 696.266356][T14939] FAULT_INJECTION: forcing a failure. [ 696.266356][T14939] name failslab, interval 1, probability 0, space 0, times 0 [ 696.279905][T14939] CPU: 1 UID: 0 PID: 14939 Comm: syz.2.2698 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 696.279935][T14939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 696.279948][T14939] Call Trace: [ 696.279957][T14939] [ 696.279967][T14939] dump_stack_lvl+0x189/0x250 [ 696.280007][T14939] ? __pfx_dump_stack_lvl+0x10/0x10 [ 696.280037][T14939] ? __pfx__printk+0x10/0x10 [ 696.280064][T14939] ? __pfx___might_resched+0x10/0x10 [ 696.280085][T14939] ? fs_reclaim_acquire+0x7d/0x100 [ 696.280122][T14939] should_fail_ex+0x414/0x560 [ 696.280150][T14939] should_failslab+0xa8/0x100 [ 696.280179][T14939] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 696.280208][T14939] ? __alloc_skb+0x112/0x2d0 [ 696.280239][T14939] __alloc_skb+0x112/0x2d0 [ 696.280269][T14939] netlink_ack+0x146/0xa50 [ 696.280291][T14939] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 696.280317][T14939] ? __lock_acquire+0xaac/0xd20 [ 696.280361][T14939] netlink_rcv_skb+0x2a0/0x490 [ 696.280386][T14939] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 696.280413][T14939] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 696.280465][T14939] ? netlink_deliver_tap+0x2e/0x1b0 [ 696.280489][T14939] ? netlink_deliver_tap+0x2e/0x1b0 [ 696.280520][T14939] netlink_unicast+0x758/0x8d0 [ 696.280558][T14939] netlink_sendmsg+0x805/0xb30 [ 696.280595][T14939] ? __pfx_netlink_sendmsg+0x10/0x10 [ 696.280624][T14939] ? aa_sock_msg_perm+0x94/0x160 [ 696.280651][T14939] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 696.280674][T14939] ? __pfx_netlink_sendmsg+0x10/0x10 [ 696.280701][T14939] __sock_sendmsg+0x219/0x270 [ 696.280727][T14939] ____sys_sendmsg+0x52d/0x830 [ 696.280763][T14939] ? __pfx_____sys_sendmsg+0x10/0x10 [ 696.280802][T14939] ? import_iovec+0x74/0xa0 [ 696.280835][T14939] ___sys_sendmsg+0x21f/0x2a0 [ 696.280867][T14939] ? __pfx____sys_sendmsg+0x10/0x10 [ 696.280943][T14939] ? __might_fault+0xb0/0x130 [ 696.280975][T14939] __sys_sendmmsg+0x227/0x430 [ 696.281010][T14939] ? __pfx___sys_sendmmsg+0x10/0x10 [ 696.281050][T14939] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 696.281097][T14939] ? ksys_write+0x1f0/0x250 [ 696.281119][T14939] ? rcu_is_watching+0x15/0xb0 [ 696.281149][T14939] __x64_sys_sendmmsg+0xa0/0xc0 [ 696.281182][T14939] do_syscall_64+0xf6/0x210 [ 696.281210][T14939] ? clear_bhb_loop+0x60/0xb0 [ 696.281235][T14939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 696.281256][T14939] RIP: 0033:0x7f985cd8e969 [ 696.281275][T14939] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 696.281293][T14939] RSP: 002b:00007f985dc7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 696.281315][T14939] RAX: ffffffffffffffda RBX: 00007f985cfb5fa0 RCX: 00007f985cd8e969 [ 696.281330][T14939] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000003 [ 696.281345][T14939] RBP: 00007f985dc7f090 R08: 0000000000000000 R09: 0000000000000000 [ 696.281358][T14939] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 696.281370][T14939] R13: 0000000000000000 R14: 00007f985cfb5fa0 R15: 00007f985d0dfa28 [ 696.281402][T14939] [ 696.340466][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 696.608725][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 696.620078][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 696.630031][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 696.675381][T10373] usb 5-1: USB disconnect, device number 92 [ 696.685810][ T10] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 696.700625][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 696.716489][T14942] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2699'. [ 696.731836][T14942] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2699'. [ 696.749065][ T10] usb 4-1: config 0 descriptor?? [ 697.182176][ T10] microsoft 0003:045E:07DA.0017: global environment stack underflow [ 697.199643][ T10] microsoft 0003:045E:07DA.0017: item 0 0 1 11 parsing failed [ 697.238708][ T10] microsoft 0003:045E:07DA.0017: parse failed [ 697.255470][ T10] microsoft 0003:045E:07DA.0017: probe with driver microsoft failed with error -22 [ 697.385580][T14929] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 697.398012][T14929] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 697.527475][T10373] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 698.061258][T14961] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 698.259836][T10373] usb 6-1: Using ep0 maxpacket: 32 [ 698.284494][T10373] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 698.321597][T10373] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 698.380692][T10373] usb 6-1: New USB device found, idVendor=17cc, idProduct=5500, bcdDevice=f3.5e [ 698.390233][T10373] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 698.433670][T10373] usb 6-1: Product: syz [ 698.437908][T10373] usb 6-1: Manufacturer: syz [ 698.469923][T10373] usb 6-1: SerialNumber: syz [ 698.508323][T10373] usb 6-1: config 0 descriptor?? [ 698.749811][T14955] x_tables: ip_tables: udp match: only valid for protocol 17 [ 699.366657][T14976] macvlan0: entered allmulticast mode [ 699.373006][T14976] veth1_vlan: entered allmulticast mode [ 699.415428][T14976] xt_hashlimit: invalid interval [ 700.616133][ T10] usb 4-1: USB disconnect, device number 110 [ 701.146532][T10373] usb 6-1: USB disconnect, device number 95 [ 701.269717][T14983] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2711'. [ 701.330196][ T10] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 701.429681][T14990] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2712'. [ 701.432233][T14990] vivid-007: ================= START STATUS ================= [ 701.432275][T14990] vivid-007: Enable Output Cropping: true [ 701.432319][T14990] vivid-007: Enable Output Composing: true [ 701.432346][T14990] vivid-007: Enable Output Scaler: true [ 701.432372][T14990] vivid-007: Tx RGB Quantization Range: Automatic [ 701.432399][T14990] vivid-007: Transmit Mode: HDMI [ 701.432425][T14990] vivid-007: Hotplug Present: 0x00000000 [ 701.432452][T14990] vivid-007: RxSense Present: 0x00000000 [ 701.432479][T14990] vivid-007: EDID Present: 0x00000000 [ 701.432505][T14990] vivid-007: ================== END STATUS ================== [ 701.513370][ T10] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 701.513407][ T10] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 701.513425][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 701.567475][ T10] usb 3-1: config 0 descriptor?? [ 702.059647][ T5882] usb 2-1: new full-speed USB device number 104 using dummy_hcd [ 702.278469][ T5882] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 702.291815][ T5882] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 702.384154][ T5882] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 702.467079][T15004] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 702.561923][ T5882] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 702.622683][ T5882] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 702.928504][ T5882] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 702.941225][ T5882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 702.966969][ T5882] usb 2-1: Product: syz [ 702.971455][ T5881] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 702.987962][ T5882] usb 2-1: Manufacturer: syz [ 703.002710][ T5882] usb 2-1: SerialNumber: syz [ 703.023754][ T5882] usb 2-1: config 0 descriptor?? [ 703.131764][ T5881] usb 5-1: config 0 has no interfaces? [ 703.144143][ T5881] usb 5-1: New USB device found, idVendor=03da, idProduct=2820, bcdDevice=52.3c [ 703.174030][ T5881] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 703.211375][ T5881] usb 5-1: config 0 descriptor?? [ 703.244882][ T5882] radio-si470x 2-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 703.263227][ T5882] radio-si470x 2-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 703.594752][T15006] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2718'. [ 703.611370][ T5881] usb 5-1: USB disconnect, device number 93 [ 703.734592][ T5882] radio-si470x 2-1:0.0: software version 0, hardware version 0 [ 703.743453][ T5882] radio-si470x 2-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 703.756148][ T5882] radio-si470x 2-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 703.773593][T15019] futex_wake_op: syz.5.2720 tries to shift op by -1; fix this program [ 704.038012][T10373] usb 3-1: USB disconnect, device number 105 [ 704.279853][ T5882] radio-si470x 2-1:0.0: si470x_set_report: usb_control_msg returned -110 [ 704.299640][ T5882] radio-si470x 2-1:0.0: submitting int urb failed (-90) [ 704.318286][ T5882] radio-si470x 2-1:0.0: si470x_set_report: usb_control_msg returned -32 [ 704.329704][ T5882] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -22 [ 704.494600][T15035] xt_hashlimit: invalid interval [ 704.919611][T10373] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 705.058907][ T10] usb 2-1: USB disconnect, device number 104 [ 705.082550][T10373] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 705.112319][T10373] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 705.167884][T10373] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 705.178238][T10373] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 705.232840][T10373] usb 3-1: SerialNumber: syz [ 705.470370][T10373] usb 3-1: 0:2 : does not exist [ 705.602100][T10373] usb 3-1: USB disconnect, device number 106 [ 705.696241][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 706.665601][T15049] macsec2: entered allmulticast mode [ 706.677607][T15049] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 706.697092][T15049] netdevsim netdevsim1 netdevsim0: left allmulticast mode [ 706.745531][T15053] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 706.871623][T15056] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2728'. [ 707.349804][ T5882] usb 6-1: new full-speed USB device number 96 using dummy_hcd [ 707.564522][ T5882] usb 6-1: config 0 has no interfaces? [ 707.614645][ T5882] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 707.623939][ T5882] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 707.634093][ T5882] usb 6-1: Product: syz [ 707.638315][ T5882] usb 6-1: Manufacturer: syz [ 707.646768][ T5882] usb 6-1: SerialNumber: syz [ 707.657134][ T5882] usb 6-1: config 0 descriptor?? [ 707.659623][T10373] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 707.856370][T10373] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 707.890532][T10373] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 707.967075][T15063] program syz.5.2731 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 707.984650][T10373] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 708.016379][T10373] usb 2-1: config 0 descriptor?? [ 708.349788][T15088] xt_hashlimit: invalid interval [ 709.300455][T15095] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2741'. [ 709.796538][T15102] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 710.154101][T15109] delete_channel: no stack [ 710.165600][T15109] program syz.2.2744 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 710.526408][ T5881] usb 2-1: USB disconnect, device number 105 [ 710.609674][ T5882] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 710.693188][T15016] usb 6-1: USB disconnect, device number 96 [ 710.782765][T15118] macsec1: entered allmulticast mode [ 710.788128][T15118] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 710.794179][ T5882] usb 3-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 710.825902][ T5882] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 710.838988][ T5882] usb 3-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 710.852446][ T5882] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 710.852479][ T5882] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 710.875687][ T5882] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 710.876640][ T5882] usb 3-1: invalid MIDI out EP 0 [ 711.011266][T15118] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 711.046246][ T5882] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 711.081646][T15109] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 711.091084][T15109] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 711.140032][T15016] usb 6-1: new high-speed USB device number 97 using dummy_hcd [ 711.309966][T15016] usb 6-1: Using ep0 maxpacket: 32 [ 711.323998][T15016] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 711.332991][T15016] usb 6-1: config 0 has no interface number 0 [ 711.340384][T15016] usb 6-1: config 0 interface 1 has no altsetting 0 [ 711.386694][T15016] usb 6-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 711.398396][T15016] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.503296][T15016] usb 6-1: Product: syz [ 711.507536][T15016] usb 6-1: Manufacturer: syz [ 711.529617][T15016] usb 6-1: SerialNumber: syz [ 711.557009][T15016] usb 6-1: config 0 descriptor?? [ 712.062559][T15016] cx231xx 6-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 712.072663][T15016] cx231xx 6-1:0.1: Failed to read PCB config [ 712.079037][T15016] cx231xx 6-1:0.1: probe with driver cx231xx failed with error -71 [ 712.105385][T15138] usb usb9: usbfs: process 15138 (syz.4.2753) did not claim interface 0 before use [ 712.338223][T15016] usb 6-1: USB disconnect, device number 97 [ 712.452887][T15143] xt_hashlimit: invalid interval [ 712.559121][T15145] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2756'. [ 712.575359][T15145] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2756'. [ 712.989821][T15016] usb 6-1: new high-speed USB device number 98 using dummy_hcd [ 713.010114][T10373] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 713.179204][T15016] usb 6-1: Using ep0 maxpacket: 32 [ 713.187849][T15016] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 713.198705][T15016] usb 6-1: config 0 has no interface number 0 [ 713.205924][ T10] usb 3-1: USB disconnect, device number 107 [ 713.218368][T15016] usb 6-1: config 0 interface 1 has no altsetting 0 [ 713.271309][T10373] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 713.273915][T15016] usb 6-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 713.302548][T10373] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 713.303346][T15016] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 713.329833][T15016] usb 6-1: Product: syz [ 713.334295][T15016] usb 6-1: Manufacturer: syz [ 713.350846][T10373] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 713.356575][T15016] usb 6-1: SerialNumber: syz [ 713.376921][T15016] usb 6-1: config 0 descriptor?? [ 713.391860][T10373] usb 4-1: config 0 descriptor?? [ 713.483574][T15152] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 713.611867][T15016] cx231xx 6-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 713.647621][T15016] cx231xx 6-1:0.1: Identified as Conexant Hybrid TV - RDU253S (card=4) [ 713.790199][T15016] cx231xx 6-1:0.1: cx231xx_send_gpio_cmd: failed with status --110 [ 713.819977][T15016] cx231xx 6-1:0.1: cx231xx_send_gpio_cmd: failed with status --32 [ 713.844856][T15016] cx231xx 6-1:0.1: cx231xx_send_gpio_cmd: failed with status --32 [ 713.990319][T15016] cx231xx 6-1:0.1: cx231xx_send_gpio_cmd: failed with status --110 [ 714.011872][T15016] cx231xx 6-1:0.1: Failed to set devmode to analog: error: -110 [ 714.128421][T15016] i2c i2c-2: Added multiplexed i2c bus 4 [ 714.158664][T15016] i2c i2c-2: Added multiplexed i2c bus 5 [ 714.197924][T15016] cx231xx 6-1:0.1: cx231xx_dev_init: Failed to set Power - errCode [-71]! [ 714.218346][T15016] cx231xx 6-1:0.1: cx231xx_init_dev: cx231xx_i2c_register - errCode [-71]! [ 714.262767][T15016] cx231xx 6-1:0.1: probe with driver cx231xx failed with error -71 [ 714.281854][T15016] usb 6-1: USB disconnect, device number 98 [ 714.814859][ T10] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 714.858088][T15181] loop7: detected capacity change from 0 to 7 [ 715.029854][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 715.112121][ T10] usb 5-1: config 0 interface 0 altsetting 48 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 715.200581][ T10] usb 5-1: config 0 interface 0 has no altsetting 0 [ 715.222026][ T10] usb 5-1: New USB device found, idVendor=046d, idProduct=c219, bcdDevice= 0.00 [ 715.236248][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 715.560787][ T10] usb 5-1: config 0 descriptor?? [ 715.723455][T15179] vivid-007: ================= START STATUS ================= [ 715.731839][T15179] vivid-007: Enable Output Cropping: true [ 715.737668][T15179] vivid-007: Enable Output Composing: true [ 715.806156][T15179] vivid-007: Enable Output Scaler: true [ 715.876270][ T10] usb 4-1: USB disconnect, device number 111 [ 715.962422][T15179] vivid-007: Tx RGB Quantization Range: Automatic [ 715.978101][T15179] vivid-007: Transmit Mode: HDMI [ 716.004428][T15179] vivid-007: Hotplug Present: 0x00000000 [ 716.010806][T15179] vivid-007: RxSense Present: 0x00000000 [ 716.036038][T15179] vivid-007: EDID Present: 0x00000000 [ 716.068778][T15179] vivid-007: ================== END STATUS ================== [ 716.720330][T15200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 716.742827][T15200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 717.372493][T15208] macvlan0: entered allmulticast mode [ 717.378347][T15208] veth1_vlan: entered allmulticast mode [ 717.414598][T15208] xt_hashlimit: invalid interval [ 717.800239][T15216] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 718.005407][ T5882] usb 5-1: USB disconnect, device number 94 [ 718.031154][T15016] usb 2-1: new full-speed USB device number 106 using dummy_hcd [ 718.334988][T15016] usb 2-1: config 0 has no interfaces? [ 718.347123][T15016] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 718.360849][T15016] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 718.389589][T15016] usb 2-1: Product: syz [ 718.398329][T15016] usb 2-1: Manufacturer: syz [ 718.406077][T15016] usb 2-1: SerialNumber: syz [ 718.420609][T15016] usb 2-1: config 0 descriptor?? [ 718.746275][T15215] program syz.1.2774 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 718.869680][ T10] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 719.030583][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 719.045647][ T10] usb 5-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 719.058219][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 719.090200][ T10] usb 5-1: config 0 descriptor?? [ 719.295853][ T10] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 719.698166][ T10] gspca_sonixj: reg_r err -71 [ 719.707160][ T10] sonixj 5-1:0.0: probe with driver sonixj failed with error -71 [ 719.751890][ T10] usb 5-1: USB disconnect, device number 95 [ 719.841244][T15233] FAULT_INJECTION: forcing a failure. [ 719.841244][T15233] name failslab, interval 1, probability 0, space 0, times 0 [ 719.873825][T15233] CPU: 1 UID: 0 PID: 15233 Comm: syz.5.2780 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 719.873858][T15233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 719.873869][T15233] Call Trace: [ 719.873875][T15233] [ 719.873882][T15233] dump_stack_lvl+0x189/0x250 [ 719.873912][T15233] ? __pfx_dump_stack_lvl+0x10/0x10 [ 719.873934][T15233] ? __pfx__printk+0x10/0x10 [ 719.873953][T15233] ? __pfx___might_resched+0x10/0x10 [ 719.873967][T15233] ? fs_reclaim_acquire+0x7d/0x100 [ 719.873993][T15233] should_fail_ex+0x414/0x560 [ 719.874013][T15233] should_failslab+0xa8/0x100 [ 719.874034][T15233] kmem_cache_alloc_noprof+0x73/0x3c0 [ 719.874053][T15233] ? alloc_empty_file+0x55/0x1d0 [ 719.874078][T15233] alloc_empty_file+0x55/0x1d0 [ 719.874100][T15233] alloc_file_pseudo+0x13d/0x210 [ 719.874125][T15233] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 719.874155][T15233] ? alloc_fd+0x64c/0x6c0 [ 719.874179][T15233] sock_alloc_file+0xb8/0x2e0 [ 719.874193][T15233] ? __sys_socket+0x12c/0x1b0 [ 719.874212][T15233] __sys_socket+0x13d/0x1b0 [ 719.874231][T15233] __x64_sys_socket+0x7a/0x90 [ 719.874249][T15233] do_syscall_64+0xf6/0x210 [ 719.874270][T15233] ? clear_bhb_loop+0x60/0xb0 [ 719.874288][T15233] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 719.874303][T15233] RIP: 0033:0x7f467118e969 [ 719.874317][T15233] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 719.874330][T15233] RSP: 002b:00007f467206c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 719.874347][T15233] RAX: ffffffffffffffda RBX: 00007f46713b5fa0 RCX: 00007f467118e969 [ 719.874358][T15233] RDX: 000000000000000a RSI: 0000000000000002 RDI: 0000000000000021 [ 719.874367][T15233] RBP: 00007f467206c090 R08: 0000000000000000 R09: 0000000000000000 [ 719.874377][T15233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 719.874386][T15233] R13: 0000000000000000 R14: 00007f46713b5fa0 R15: 00007f46714dfa28 [ 719.874414][T15233] [ 720.296388][T15238] macsec1: entered allmulticast mode [ 720.312225][T15238] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 720.327181][T15238] netdevsim netdevsim5 netdevsim0: left allmulticast mode [ 720.330011][T15016] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 720.494358][T15016] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 720.512418][T15016] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 720.542902][T15016] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 720.583180][T15016] usb 4-1: config 0 descriptor?? [ 720.762770][T15254] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 720.860305][T15257] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 721.322822][T15016] usb 2-1: USB disconnect, device number 106 [ 721.368258][T15273] xt_hashlimit: invalid interval [ 721.690200][T15016] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 721.749858][ T10] usb 5-1: new low-speed USB device number 96 using dummy_hcd [ 721.885848][T15016] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 721.885883][T15016] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 721.885906][T15016] usb 2-1: Product: syz [ 721.885923][T15016] usb 2-1: Manufacturer: syz [ 721.885940][T15016] usb 2-1: SerialNumber: syz [ 721.897364][T15016] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 721.899684][ T10] usb 5-1: Invalid ep0 maxpacket: 64 [ 721.969417][T15016] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 722.029743][ T10] usb 5-1: new low-speed USB device number 97 using dummy_hcd [ 722.176993][T15281] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 722.195996][T15281] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 722.207140][T15281] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 722.217960][T15281] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 722.220201][ T10] usb 5-1: Invalid ep0 maxpacket: 64 [ 722.254542][ T10] usb usb5-port1: attempt power cycle [ 722.326855][ T5882] usb 2-1: USB disconnect, device number 107 [ 722.397973][T15288] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2799'. [ 722.547443][T15294] unknown channel width for channel at 909000KHz? [ 722.576299][T15294] netlink: 276 bytes leftover after parsing attributes in process `syz.1.2801'. [ 722.619749][ T10] usb 5-1: new low-speed USB device number 98 using dummy_hcd [ 722.642876][ T10] usb 5-1: Invalid ep0 maxpacket: 64 [ 722.790542][ T10] usb 5-1: new low-speed USB device number 99 using dummy_hcd [ 722.823070][ T10] usb 5-1: Invalid ep0 maxpacket: 64 [ 722.833509][ T10] usb usb5-port1: unable to enumerate USB device [ 722.980178][T15016] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 722.991779][T15016] ath9k_htc: Failed to initialize the device [ 723.002665][ T5882] usb 2-1: ath9k_htc: USB layer deinitialized [ 723.013475][T15308] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 723.239315][ T5881] usb 4-1: USB disconnect, device number 112 [ 723.318175][T15310] hsr0: entered promiscuous mode [ 723.323944][T15310] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2807'. [ 723.388790][T15310] hsr_slave_0: left promiscuous mode [ 723.438702][T15310] hsr_slave_1: left promiscuous mode [ 723.469077][T15310] hsr0 (unregistering): left promiscuous mode [ 723.500426][ T5882] usb 2-1: new full-speed USB device number 108 using dummy_hcd [ 724.009634][ T5882] usb 2-1: config 0 has no interfaces? [ 724.116599][ T5882] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 724.128331][ T5882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 724.207161][ T5882] usb 2-1: Product: syz [ 724.222586][ T5882] usb 2-1: Manufacturer: syz [ 724.273389][ T5882] usb 2-1: SerialNumber: syz [ 724.296662][ T5882] usb 2-1: config 0 descriptor?? [ 724.741094][T15303] program syz.1.2804 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 725.306912][T15333] vlan2: entered promiscuous mode [ 726.034790][ T5881] usb 2-1: USB disconnect, device number 108 [ 726.198568][T15342] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2819'. [ 726.208032][T15345] FAULT_INJECTION: forcing a failure. [ 726.208032][T15345] name failslab, interval 1, probability 0, space 0, times 0 [ 726.241116][T15345] CPU: 0 UID: 0 PID: 15345 Comm: syz.4.2820 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 726.241149][T15345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 726.241163][T15345] Call Trace: [ 726.241172][T15345] [ 726.241181][T15345] dump_stack_lvl+0x189/0x250 [ 726.241221][T15345] ? __pfx_dump_stack_lvl+0x10/0x10 [ 726.241253][T15345] ? __pfx__printk+0x10/0x10 [ 726.241277][T15345] ? __pfx___might_resched+0x10/0x10 [ 726.241298][T15345] ? fs_reclaim_acquire+0x7d/0x100 [ 726.241335][T15345] should_fail_ex+0x414/0x560 [ 726.241364][T15345] should_failslab+0xa8/0x100 [ 726.241394][T15345] __kmalloc_noprof+0xcb/0x4f0 [ 726.241421][T15345] ? tomoyo_encode+0x28b/0x550 [ 726.241453][T15345] tomoyo_encode+0x28b/0x550 [ 726.241486][T15345] tomoyo_realpath_from_path+0x58d/0x5d0 [ 726.241526][T15345] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 726.241549][T15345] tomoyo_path_number_perm+0x1e8/0x5a0 [ 726.241574][T15345] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 726.241616][T15345] ? __lock_acquire+0xaac/0xd20 [ 726.241667][T15345] ? __fget_files+0x2a/0x420 [ 726.241701][T15345] ? __fget_files+0x3a0/0x420 [ 726.241728][T15345] ? __fget_files+0x2a/0x420 [ 726.241760][T15345] security_file_ioctl+0xcb/0x2d0 [ 726.241790][T15345] __se_sys_ioctl+0x47/0x170 [ 726.241815][T15345] do_syscall_64+0xf6/0x210 [ 726.241845][T15345] ? clear_bhb_loop+0x60/0xb0 [ 726.241870][T15345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.241891][T15345] RIP: 0033:0x7f87a498e969 [ 726.241908][T15345] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 726.241926][T15345] RSP: 002b:00007f87a5885038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 726.241948][T15345] RAX: ffffffffffffffda RBX: 00007f87a4bb5fa0 RCX: 00007f87a498e969 [ 726.241963][T15345] RDX: 0000000000000002 RSI: 0000000000003b66 RDI: 0000000000000003 [ 726.241975][T15345] RBP: 00007f87a5885090 R08: 0000000000000000 R09: 0000000000000000 [ 726.241988][T15345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 726.242001][T15345] R13: 0000000000000000 R14: 00007f87a4bb5fa0 R15: 00007f87a4cdfa28 [ 726.242034][T15345] [ 726.242055][T15345] ERROR: Out of memory at tomoyo_realpath_from_path. [ 726.449407][T15351] FAULT_INJECTION: forcing a failure. [ 726.449407][T15351] name failslab, interval 1, probability 0, space 0, times 0 [ 726.498563][T15351] CPU: 1 UID: 0 PID: 15351 Comm: syz.2.2823 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 726.498598][T15351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 726.498612][T15351] Call Trace: [ 726.498622][T15351] [ 726.498631][T15351] dump_stack_lvl+0x189/0x250 [ 726.498671][T15351] ? __pfx_dump_stack_lvl+0x10/0x10 [ 726.498699][T15351] ? __pfx__printk+0x10/0x10 [ 726.498722][T15351] ? __pfx___might_resched+0x10/0x10 [ 726.498742][T15351] ? fs_reclaim_acquire+0x7d/0x100 [ 726.498778][T15351] should_fail_ex+0x414/0x560 [ 726.498805][T15351] should_failslab+0xa8/0x100 [ 726.498834][T15351] kmem_cache_alloc_noprof+0x73/0x3c0 [ 726.498860][T15351] ? security_file_alloc+0x34/0x330 [ 726.498884][T15351] security_file_alloc+0x34/0x330 [ 726.498906][T15351] init_file+0x93/0x2f0 [ 726.498938][T15351] alloc_empty_file+0x6e/0x1d0 [ 726.498970][T15351] alloc_file_pseudo+0x13d/0x210 [ 726.499004][T15351] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 726.499042][T15351] ? alloc_fd+0x64c/0x6c0 [ 726.499074][T15351] sock_alloc_file+0xb8/0x2e0 [ 726.499094][T15351] ? __sys_socket+0x12c/0x1b0 [ 726.499120][T15351] __sys_socket+0x13d/0x1b0 [ 726.499146][T15351] __x64_sys_socket+0x7a/0x90 [ 726.499172][T15351] do_syscall_64+0xf6/0x210 [ 726.499201][T15351] ? clear_bhb_loop+0x60/0xb0 [ 726.499227][T15351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.499248][T15351] RIP: 0033:0x7f985cd8e969 [ 726.499267][T15351] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 726.499286][T15351] RSP: 002b:00007f985dc7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 726.499309][T15351] RAX: ffffffffffffffda RBX: 00007f985cfb5fa0 RCX: 00007f985cd8e969 [ 726.499325][T15351] RDX: 000000000000000a RSI: 0000000000000002 RDI: 0000000000000021 [ 726.499338][T15351] RBP: 00007f985dc7f090 R08: 0000000000000000 R09: 0000000000000000 [ 726.499352][T15351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 726.499364][T15351] R13: 0000000000000000 R14: 00007f985cfb5fa0 R15: 00007f985d0dfa28 [ 726.499396][T15351] [ 726.850053][T10373] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 726.900401][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 726.964904][T15365] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 727.058648][T15364] netlink: 4400 bytes leftover after parsing attributes in process `syz.5.2826'. [ 727.090277][T10373] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 727.110621][T10373] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 727.130837][T10373] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 727.161279][T10373] usb 2-1: config 0 descriptor?? [ 727.341570][T15375] FAULT_INJECTION: forcing a failure. [ 727.341570][T15375] name failslab, interval 1, probability 0, space 0, times 0 [ 727.398804][T15375] CPU: 0 UID: 0 PID: 15375 Comm: syz.5.2831 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 727.398836][T15375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 727.398850][T15375] Call Trace: [ 727.398859][T15375] [ 727.398869][T15375] dump_stack_lvl+0x189/0x250 [ 727.398908][T15375] ? __pfx_dump_stack_lvl+0x10/0x10 [ 727.398938][T15375] ? __pfx__printk+0x10/0x10 [ 727.398965][T15375] ? __pfx___might_resched+0x10/0x10 [ 727.398986][T15375] ? fs_reclaim_acquire+0x7d/0x100 [ 727.399023][T15375] should_fail_ex+0x414/0x560 [ 727.399050][T15375] should_failslab+0xa8/0x100 [ 727.399081][T15375] __kmalloc_noprof+0xcb/0x4f0 [ 727.399106][T15375] ? kfree+0x4d/0x440 [ 727.399127][T15375] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 727.399160][T15375] tomoyo_realpath_from_path+0xe3/0x5d0 [ 727.399189][T15375] ? tomoyo_domain+0xda/0x130 [ 727.399223][T15375] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 727.399245][T15375] tomoyo_path_number_perm+0x1e8/0x5a0 [ 727.399271][T15375] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 727.399312][T15375] ? __lock_acquire+0xaac/0xd20 [ 727.399362][T15375] ? __fget_files+0x2a/0x420 [ 727.399396][T15375] ? __fget_files+0x3a0/0x420 [ 727.399422][T15375] ? __fget_files+0x2a/0x420 [ 727.399455][T15375] security_file_ioctl+0xcb/0x2d0 [ 727.399482][T15375] __se_sys_ioctl+0x47/0x170 [ 727.399506][T15375] do_syscall_64+0xf6/0x210 [ 727.399534][T15375] ? clear_bhb_loop+0x60/0xb0 [ 727.399558][T15375] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.399578][T15375] RIP: 0033:0x7f467118e969 [ 727.399596][T15375] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 727.399613][T15375] RSP: 002b:00007f467206c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 727.399636][T15375] RAX: ffffffffffffffda RBX: 00007f46713b5fa0 RCX: 00007f467118e969 [ 727.399652][T15375] RDX: 0000200000000100 RSI: 0000000000004601 RDI: 0000000000000003 [ 727.399665][T15375] RBP: 00007f467206c090 R08: 0000000000000000 R09: 0000000000000000 [ 727.399686][T15375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 727.399699][T15375] R13: 0000000000000000 R14: 00007f46713b5fa0 R15: 00007f46714dfa28 [ 727.399732][T15375] [ 727.663158][T15375] ERROR: Out of memory at tomoyo_realpath_from_path. [ 728.180066][T10373] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 728.379857][ T10] usb 6-1: new high-speed USB device number 99 using dummy_hcd [ 728.612745][T15408] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2842'. [ 728.663878][ T10] usb 6-1: config 0 has no interfaces? [ 728.676288][ T10] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 728.736915][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.757844][T15410] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2843'. [ 728.767699][ T10] usb 6-1: Product: syz [ 728.774808][ T10] usb 6-1: Manufacturer: syz [ 728.782663][ T10] usb 6-1: SerialNumber: syz [ 728.805872][ T10] usb 6-1: config 0 descriptor?? [ 729.202490][T15421] macsec1: entered promiscuous mode [ 729.220844][T15421] bridge0: entered promiscuous mode [ 729.242010][T15421] macsec1: entered allmulticast mode [ 729.262700][T15421] bridge0: entered allmulticast mode [ 729.302748][T15421] bridge0: port 1(macsec1) entered blocking state [ 729.330135][T15421] bridge0: port 1(macsec1) entered disabled state [ 729.484505][T15421] bridge0: left allmulticast mode [ 729.490186][T15421] bridge0: left promiscuous mode [ 729.553812][T15428] SET target dimension over the limit! [ 729.641358][T15428] input: syz1 as /devices/virtual/input/input79 [ 729.691050][T15430] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2850'. [ 729.763756][T10373] usb 2-1: USB disconnect, device number 109 [ 730.489891][T10373] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 730.504794][T15442] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 730.529997][ T5881] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 730.652432][T10373] usb 5-1: Using ep0 maxpacket: 32 [ 730.662466][T10373] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 730.671228][T10373] usb 5-1: config 0 has no interface number 0 [ 730.686784][T10373] usb 5-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 730.689735][ T5881] usb 2-1: Using ep0 maxpacket: 32 [ 730.709061][T10373] usb 5-1: config 0 interface 1 has no altsetting 0 [ 730.717853][ T5881] usb 2-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 730.738549][ T5881] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 730.754781][T10373] usb 5-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 730.764542][T10373] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 730.776626][ T5881] usb 2-1: config 0 descriptor?? [ 730.795851][T10373] usb 5-1: Product: syz [ 730.796534][ T5881] gspca_main: sunplus-2.14.0 probing 041e:400b [ 730.821594][T10373] usb 5-1: Manufacturer: syz [ 730.840587][T10373] usb 5-1: SerialNumber: syz [ 730.862977][T10373] usb 5-1: config 0 descriptor?? [ 731.083775][T15435] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2853'. [ 731.142837][T15435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 731.164264][T15435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 731.204027][T10373] cx231xx 5-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 731.232179][T10373] cx231xx 5-1:0.1: Not found matching IAD interface [ 731.268443][T10373] usb 5-1: USB disconnect, device number 100 [ 731.410738][T15016] usb 6-1: USB disconnect, device number 99 [ 732.040679][T15439] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2854'. [ 732.050872][ T5881] gspca_sunplus: reg_w_riv err -71 [ 732.059084][ T5881] sunplus 2-1:0.0: probe with driver sunplus failed with error -71 [ 732.070484][T15016] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 732.177580][ T5881] usb 2-1: USB disconnect, device number 110 [ 732.331761][T15016] usb 6-1: Using ep0 maxpacket: 16 [ 732.844992][ T5881] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 733.032525][ T5881] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 733.042703][ T5881] usb 5-1: config 0 interface 0 has no altsetting 0 [ 733.064502][ T5881] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 733.074076][ T5881] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 733.096077][ T5881] usb 5-1: Product: syz [ 733.107311][ T5881] usb 5-1: Manufacturer: syz [ 733.122964][ T5881] usb 5-1: SerialNumber: syz [ 733.155031][ T5881] usb 5-1: config 0 descriptor?? [ 733.206742][ T5881] usb 5-1: selecting invalid altsetting 0 [ 733.413060][ T5881] usb 5-1: USB disconnect, device number 101 [ 733.688791][T15465] SET target dimension over the limit! [ 733.769898][T10373] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 733.813046][T15465] input: syz1 as /devices/virtual/input/input80 [ 733.922922][T10373] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 733.959377][T10373] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 734.027462][T10373] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.077613][T10373] usb 2-1: config 0 descriptor?? [ 734.723453][T15016] usb 6-1: unable to get BOS descriptor or descriptor too short [ 734.753253][T15016] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 734.770759][ T30] audit: type=1326 audit(1748074939.551:10209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15476 comm="syz.5.2865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 734.796654][T15477] fuse: Bad value for 'rootmode' [ 734.805642][T15016] usb 6-1: can't read configurations, error -71 [ 734.829790][ T30] audit: type=1326 audit(1748074939.551:10210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15476 comm="syz.5.2865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 734.852761][ C1] vkms_vblank_simulate: vblank timer overrun [ 734.900077][T15477] netlink: 'syz.5.2865': attribute type 39 has an invalid length. [ 734.930543][ T30] audit: type=1326 audit(1748074939.581:10211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15476 comm="syz.5.2865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 734.953962][ C1] vkms_vblank_simulate: vblank timer overrun [ 735.011181][ T30] audit: type=1326 audit(1748074939.581:10212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15476 comm="syz.5.2865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 735.035093][ C1] vkms_vblank_simulate: vblank timer overrun [ 735.096151][ T30] audit: type=1326 audit(1748074939.581:10213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15476 comm="syz.5.2865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 735.120618][ C1] vkms_vblank_simulate: vblank timer overrun [ 735.231833][ T30] audit: type=1326 audit(1748074939.581:10214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15476 comm="syz.5.2865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f467118d1d7 code=0x7ffc0000 [ 735.424521][ T30] audit: type=1326 audit(1748074939.581:10215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15476 comm="syz.5.2865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f467119010a code=0x7ffc0000 [ 735.448048][ C1] vkms_vblank_simulate: vblank timer overrun [ 735.570132][ T30] audit: type=1326 audit(1748074939.611:10216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15476 comm="syz.5.2865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 735.694753][ T30] audit: type=1326 audit(1748074939.611:10217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15476 comm="syz.5.2865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 735.718324][ C1] vkms_vblank_simulate: vblank timer overrun [ 735.843397][ T30] audit: type=1326 audit(1748074939.651:10218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15476 comm="syz.5.2865" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f467118e969 code=0x7ffc0000 [ 735.866195][ C1] vkms_vblank_simulate: vblank timer overrun [ 735.999927][ T5881] usb 4-1: new full-speed USB device number 113 using dummy_hcd [ 736.082031][T15500] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2871'. [ 736.172827][ T5881] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 736.257776][ T5881] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x35, changing to 0x5 [ 736.274420][ T5881] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 736.295738][ T5881] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 736.321403][ T5881] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 736.369170][ T5881] usb 4-1: Product: syz [ 736.400343][ T5881] usb 4-1: Manufacturer: syz [ 736.416096][T15509] SET target dimension over the limit! [ 736.430031][ T5881] usb 4-1: SerialNumber: syz [ 736.465993][ T5881] usb 4-1: config 0 descriptor?? [ 736.485171][T15510] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 736.514812][T15509] input: syz1 as /devices/virtual/input/input81 [ 736.555222][T10373] usb 2-1: USB disconnect, device number 111 [ 736.561937][T15498] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 736.563790][ T5881] usb 4-1: ucan: probing device on interface #0 [ 736.629662][ T5881] usb 4-1: ucan: invalid endpoint configuration [ 736.635997][ T5881] usb 4-1: ucan: probe failed; try to update the device firmware [ 737.579982][T10373] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 737.739990][T10373] usb 2-1: Using ep0 maxpacket: 16 [ 737.746955][T10373] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 737.962274][T10373] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 737.978013][ T10] usb 4-1: USB disconnect, device number 113 [ 738.013383][T10373] usb 2-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 738.079589][T10373] usb 2-1: config 0 interface 0 has no altsetting 0 [ 738.096775][T10373] usb 2-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 738.107042][T15537] netlink: 'syz.3.2883': attribute type 11 has an invalid length. [ 738.128646][T10373] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 738.332571][T10373] usb 2-1: config 0 descriptor?? [ 738.540343][T15542] tipc: Started in network mode [ 738.545741][T15542] tipc: Node identity fe800000000000000000000000000013, cluster identity 4711 [ 738.569202][T15527] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 738.579923][T15527] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 738.679027][T15542] tipc: Enabled bearer , priority 10 [ 738.688331][T15527] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 738.693099][T15548] SET target dimension over the limit! [ 738.842980][T15527] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 739.023897][T15549] input: syz1 as /devices/virtual/input/input82 [ 739.131644][ T10] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 739.312150][ T10] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 739.323414][ T10] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 739.355011][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 739.391300][ T10] usb 5-1: config 0 descriptor?? [ 739.667463][T15557] netlink: 84 bytes leftover after parsing attributes in process `syz.3.2889'. [ 739.792656][ T5881] tipc: Node number set to 4269801491 [ 739.846151][T15566] macsec1: entered allmulticast mode [ 739.852403][T15566] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 740.084469][T15574] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 740.095034][T15566] netdevsim netdevsim2 netdevsim0: left allmulticast mode [ 740.482001][T10373] usbhid 2-1:0.0: can't add hid device: -71 [ 740.492155][T10373] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 740.516783][T10373] usb 2-1: USB disconnect, device number 112 [ 741.567799][T15592] pimreg: entered allmulticast mode [ 742.154396][T15585] pimreg: left allmulticast mode [ 742.208581][T10373] usb 5-1: USB disconnect, device number 102 [ 742.286462][T15600] SET target dimension over the limit! [ 742.409442][T15604] input: syz1 as /devices/virtual/input/input83 [ 742.557357][T15612] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2903'. [ 743.150106][ T5881] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 743.310116][T15620] vivid-007: ================= START STATUS ================= [ 743.321141][ T5881] usb 2-1: Using ep0 maxpacket: 32 [ 743.345904][ T5881] usb 2-1: config 0 interface 0 altsetting 2 has an endpoint descriptor with address 0x71, changing to 0x1 [ 743.358443][T15620] vivid-007: Enable Output Cropping: true [ 743.364846][T15620] vivid-007: Enable Output Composing: true [ 743.371559][T15620] vivid-007: Enable Output Scaler: true [ 743.377244][T15620] vivid-007: Tx RGB Quantization Range: Automatic [ 743.386490][T15620] vivid-007: Transmit Mode: HDMI [ 743.392439][ T5881] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid maxpacket 17622, setting to 1024 [ 743.406797][T15620] vivid-007: Hotplug Present: 0x00000000 [ 743.412859][T15620] vivid-007: RxSense Present: 0x00000000 [ 743.418679][T15620] vivid-007: EDID Present: 0x00000000 [ 743.424574][T15620] vivid-007: ================== END STATUS ================== [ 743.499169][T15628] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 743.528980][ T5881] usb 2-1: config 0 interface 0 has no altsetting 0 [ 743.617665][ T5881] usb 2-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 743.635156][ T5881] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 743.646711][ T5881] usb 2-1: Product: syz [ 743.652727][ T5881] usb 2-1: Manufacturer: syz [ 743.657431][ T5881] usb 2-1: SerialNumber: syz [ 743.685318][ T5881] usb 2-1: config 0 descriptor?? [ 743.693277][ T5881] gs_usb 2-1:0.0: Required endpoints not found [ 743.954834][ T10] usb 2-1: USB disconnect, device number 113 [ 744.033047][T10373] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 744.157773][T15639] netlink: 'syz.1.2910': attribute type 6 has an invalid length. [ 744.355220][T10373] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 744.370413][T10373] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 744.400186][T10373] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 744.423810][T10373] usb 3-1: config 0 descriptor?? [ 745.063580][T10373] usb 2-1: new full-speed USB device number 114 using dummy_hcd [ 745.283827][T10373] usb 2-1: unable to get BOS descriptor or descriptor too short [ 745.295625][T10373] usb 2-1: not running at top speed; connect to a high speed hub [ 745.299820][ T5881] usb 5-1: new full-speed USB device number 103 using dummy_hcd [ 745.334084][T10373] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 745.389915][T10373] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 745.442926][T10373] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 745.453290][T10373] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.463640][T10373] usb 2-1: Product: syz [ 745.467874][T10373] usb 2-1: Manufacturer: syz [ 745.479131][T10373] usb 2-1: SerialNumber: syz [ 745.547345][ T5881] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 745.581085][ T5881] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 745.594640][ T5881] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10 [ 745.607516][ T5881] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 745.648359][ T5881] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 745.677987][ T5881] usb 5-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 745.692962][ T5881] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.713867][ T5881] usb 5-1: Product: syz [ 745.721489][ T5881] usb 5-1: Manufacturer: syz [ 745.743790][ T5881] usb 5-1: SerialNumber: syz [ 745.758977][ T5881] usb 5-1: config 0 descriptor?? [ 745.774926][T15664] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_hsr, syncid = 2, id = 0 [ 745.814483][ T5881] input: KB Gear Tablet as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input84 [ 746.602007][ T10] usb 6-1: new high-speed USB device number 102 using dummy_hcd [ 746.770486][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 746.779436][ T10] usb 6-1: config 0 has an invalid interface number: 64 but max is 0 [ 746.796330][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 746.824676][ T10] usb 6-1: config 0 has no interface number 0 [ 746.843056][ T10] usb 6-1: New USB device found, idVendor=0bd3, idProduct=0555, bcdDevice= 0.5b [ 746.852627][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 746.883862][ T10] usb 6-1: config 0 descriptor?? [ 746.927468][ T10] usb 6-1: Found UVC 0.00 device (0bd3:0555) [ 746.943265][ T10] usb 6-1: No valid video chain found. [ 746.967259][ T5881] usb 3-1: USB disconnect, device number 109 [ 747.387099][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.394376][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.515928][T10373] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 747.531753][T10373] usb 2-1: USB disconnect, device number 114 [ 747.853805][T10373] usb 5-1: USB disconnect, device number 103 [ 748.155013][T15693] fuse: Bad value for 'user_id' [ 748.167273][T15693] fuse: Bad value for 'user_id' [ 748.194498][T15697] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 748.571510][T15683] vivid-007: ================= START STATUS ================= [ 748.579197][T15683] vivid-007: Enable Output Cropping: true [ 748.659938][T15683] vivid-007: Enable Output Composing: true [ 748.669589][T15683] vivid-007: Enable Output Scaler: true [ 748.675528][T15683] vivid-007: Tx RGB Quantization Range: Automatic [ 748.682296][T15683] vivid-007: Transmit Mode: HDMI [ 748.687591][T15683] vivid-007: Hotplug Present: 0x00000000 [ 748.699748][T15683] vivid-007: RxSense Present: 0x00000000 [ 748.718833][T15683] vivid-007: EDID Present: 0x00000000 [ 748.725796][T15683] vivid-007: ================== END STATUS ================== [ 749.033392][T15705] netlink: 84 bytes leftover after parsing attributes in process `syz.4.2929'. [ 749.471610][T15708] binder: 15707:15708 ioctl c0306201 200000000100 returned -14 [ 749.755737][ T10] usb 6-1: USB disconnect, device number 102 [ 749.803675][T15717] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2933'. [ 749.923530][T15719] futex_wake_op: syz.5.2934 tries to shift op by -1; fix this program [ 750.219966][ T5881] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 750.392038][ T5881] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 750.417850][ T5881] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 750.417885][ T5881] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 750.437307][ T5881] usb 5-1: config 0 descriptor?? [ 750.460576][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 750.460599][ T30] audit: type=1326 audit(1748074955.241:10224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15730 comm="syz.1.2940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f839d58e969 code=0x7ffc0000 [ 750.460653][ T30] audit: type=1326 audit(1748074955.241:10225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15730 comm="syz.1.2940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f839d58e969 code=0x7ffc0000 [ 750.460701][ T30] audit: type=1326 audit(1748074955.241:10226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15730 comm="syz.1.2940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f839d58e969 code=0x7ffc0000 [ 750.460747][ T30] audit: type=1326 audit(1748074955.241:10227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15730 comm="syz.1.2940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f839d58e969 code=0x7ffc0000 [ 750.460794][ T30] audit: type=1326 audit(1748074955.241:10228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15730 comm="syz.1.2940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f839d58e969 code=0x7ffc0000 [ 750.460840][ T30] audit: type=1326 audit(1748074955.241:10229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15730 comm="syz.1.2940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f839d58e969 code=0x7ffc0000 [ 750.460885][ T30] audit: type=1326 audit(1748074955.241:10230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15730 comm="syz.1.2940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f839d58e969 code=0x7ffc0000 [ 750.460930][ T30] audit: type=1326 audit(1748074955.241:10231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15730 comm="syz.1.2940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f839d58e969 code=0x7ffc0000 [ 750.460973][ T30] audit: type=1326 audit(1748074955.241:10232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15730 comm="syz.1.2940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=2 compat=0 ip=0x7f839d58e969 code=0x7ffc0000 [ 750.461018][ T30] audit: type=1326 audit(1748074955.241:10233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15730 comm="syz.1.2940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f839d58e969 code=0x7ffc0000 [ 750.570158][T15734] fuse: Unknown parameter '' [ 750.571669][T15734] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2940'. [ 751.077534][T15744] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 751.090474][T15744] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 751.103834][T15744] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 751.117131][T15744] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 751.128102][T15744] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 751.160455][ T5881] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 751.195178][ T62] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 751.301670][ T62] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 751.390916][ T5881] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 751.413898][ T5881] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 751.423913][ T5881] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 751.552898][ T5881] usb 6-1: config 0 interface 0 has no altsetting 0 [ 751.592868][ T5881] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 751.607670][ T5881] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 751.649875][T15016] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 751.664423][ T5881] usb 6-1: config 0 interface 0 has no altsetting 0 [ 751.674223][ T5881] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 751.684001][ T5881] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 751.696167][ T5881] usb 6-1: config 0 interface 0 has no altsetting 0 [ 751.703577][ T62] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 751.708985][ T5881] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 751.764970][ T5881] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 751.785621][ T5881] usb 6-1: config 0 interface 0 has no altsetting 0 [ 751.795873][ T5881] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 751.807584][ T62] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 751.808994][ T5881] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 751.832660][T15016] usb 4-1: Using ep0 maxpacket: 8 [ 751.839211][ T5881] usb 6-1: config 0 interface 0 has no altsetting 0 [ 751.863542][T15749] netlink: 'syz.3.2944': attribute type 13 has an invalid length. [ 751.888569][ T5881] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 751.899738][T10373] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 751.902547][ T5881] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 751.953498][T15749] gretap0: refused to change device tx_queue_len [ 751.962554][T15749] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 751.981121][ T5881] usb 6-1: config 0 interface 0 has no altsetting 0 [ 752.016704][ T5881] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 752.036084][ T5881] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 752.054423][T10373] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 752.066917][T10373] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 752.072779][ T5881] usb 6-1: config 0 interface 0 has no altsetting 0 [ 752.126587][T10373] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 752.152991][ T5881] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 752.165389][ T5881] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 752.177244][T10373] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 752.187230][T10373] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 752.206147][ T5881] usb 6-1: config 0 interface 0 has no altsetting 0 [ 752.211644][T10373] usb 2-1: config 0 descriptor?? [ 752.339899][ T5881] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 752.385315][ T5881] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 752.477716][ T5881] usb 6-1: Product: syz [ 752.540018][ T5881] usb 6-1: Manufacturer: syz [ 752.573756][ T5881] usb 6-1: SerialNumber: syz [ 752.643701][ T5881] usb 6-1: config 0 descriptor?? [ 752.652721][T10373] plantronics 0003:047F:FFFF.0018: reserved main item tag 0xe [ 752.683132][T10373] plantronics 0003:047F:FFFF.0018: unknown main item tag 0x0 [ 752.697639][T10373] plantronics 0003:047F:FFFF.0018: No inputs registered, leaving [ 752.759053][T15745] chnl_net:caif_netlink_parms(): no params data found [ 752.773575][T10373] plantronics 0003:047F:FFFF.0018: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 752.796050][ T5881] yurex 6-1:0.0: USB YUREX device now attached to Yurex #1 [ 752.866918][T15754] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 752.904357][T10373] usb 2-1: USB disconnect, device number 115 [ 752.909055][ T5881] usb 5-1: USB disconnect, device number 104 [ 752.995893][ T10] usb 6-1: USB disconnect, device number 103 [ 753.094282][ T10] yurex 6-1:0.0: USB YUREX #1 now disconnected [ 753.231422][ T5838] Bluetooth: hci0: command tx timeout [ 753.270787][T15767] FAULT_INJECTION: forcing a failure. [ 753.270787][T15767] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 753.343551][T15762] fido_id[15762]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 753.371397][T15767] CPU: 0 UID: 0 PID: 15767 Comm: syz.4.2947 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 753.371431][T15767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 753.371445][T15767] Call Trace: [ 753.371454][T15767] [ 753.371465][T15767] dump_stack_lvl+0x189/0x250 [ 753.371499][T15767] ? __lock_acquire+0xaac/0xd20 [ 753.371532][T15767] ? __pfx_dump_stack_lvl+0x10/0x10 [ 753.371562][T15767] ? __pfx__printk+0x10/0x10 [ 753.371584][T15767] ? __might_fault+0xb0/0x130 [ 753.371623][T15767] should_fail_ex+0x414/0x560 [ 753.371651][T15767] _copy_from_user+0x2d/0xb0 [ 753.371682][T15767] ___sys_sendmsg+0x158/0x2a0 [ 753.371715][T15767] ? __pfx____sys_sendmsg+0x10/0x10 [ 753.371792][T15767] ? __might_fault+0xb0/0x130 [ 753.371824][T15767] __sys_sendmmsg+0x227/0x430 [ 753.371879][T15767] ? __pfx___sys_sendmmsg+0x10/0x10 [ 753.371919][T15767] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 753.371968][T15767] ? ksys_write+0x1f0/0x250 [ 753.371992][T15767] ? rcu_is_watching+0x15/0xb0 [ 753.372021][T15767] __x64_sys_sendmmsg+0xa0/0xc0 [ 753.372053][T15767] do_syscall_64+0xf6/0x210 [ 753.372082][T15767] ? clear_bhb_loop+0x60/0xb0 [ 753.372107][T15767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 753.372128][T15767] RIP: 0033:0x7f87a498e969 [ 753.372146][T15767] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 753.372163][T15767] RSP: 002b:00007f87a5885038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 753.372185][T15767] RAX: ffffffffffffffda RBX: 00007f87a4bb5fa0 RCX: 00007f87a498e969 [ 753.372201][T15767] RDX: 0000000000000299 RSI: 0000200000003dc0 RDI: 0000000000000004 [ 753.372215][T15767] RBP: 00007f87a5885090 R08: 0000000000000000 R09: 0000000000000000 [ 753.372238][T15767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 753.372250][T15767] R13: 0000000000000000 R14: 00007f87a4bb5fa0 R15: 00007f87a4cdfa28 [ 753.372280][T15767] [ 753.580421][ C0] vkms_vblank_simulate: vblank timer overrun [ 754.131115][T15782] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 755.313583][ T5838] Bluetooth: hci0: command tx timeout [ 755.721967][ T62] bond0 (unregistering): left promiscuous mode [ 755.728933][ T62] bond0 (unregistering): Released all slaves [ 755.747928][ T62] bond1 (unregistering): Released all slaves [ 756.200890][ T62] bond2 (unregistering): Released all slaves [ 756.229152][ T62] bond3 (unregistering): Released all slaves [ 756.495047][ T62] bond4 (unregistering): Released all slaves [ 756.644116][T15016] usb 4-1: unable to get BOS descriptor or descriptor too short [ 756.672973][T15016] usb 4-1: no configurations [ 756.714202][T15016] usb 4-1: can't read configurations, error -22 [ 756.939062][ T62] tipc: Left network mode [ 756.945893][T15745] bridge0: port 1(bridge_slave_0) entered blocking state [ 756.957044][T15745] bridge0: port 1(bridge_slave_0) entered disabled state [ 756.974224][T15745] bridge_slave_0: entered allmulticast mode [ 756.985367][T15745] bridge_slave_0: entered promiscuous mode [ 757.006364][T15745] bridge0: port 2(bridge_slave_1) entered blocking state [ 757.026654][T15745] bridge0: port 2(bridge_slave_1) entered disabled state [ 757.036263][T15745] bridge_slave_1: entered allmulticast mode [ 757.061603][T15745] bridge_slave_1: entered promiscuous mode [ 757.287034][T15745] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 757.371793][T15745] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 757.395809][ T5838] Bluetooth: hci0: command tx timeout [ 757.789945][T15016] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 757.799689][ T5881] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 757.912895][T15745] team0: Port device team_slave_0 added [ 757.950818][ T62] veth1_vlan: left allmulticast mode [ 757.969921][T15016] usb 4-1: Using ep0 maxpacket: 8 [ 758.077086][T15814] netlink: 'syz.3.2955': attribute type 13 has an invalid length. [ 758.166086][ T5881] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 758.196673][ T5881] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 758.279751][ T5881] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 758.352251][ T5881] usb 5-1: config 0 descriptor?? [ 759.461571][ T5838] Bluetooth: hci0: command tx timeout [ 760.487983][T15745] team0: Port device team_slave_1 added [ 760.519040][T15814] gretap0: refused to change device tx_queue_len [ 760.525677][T15814] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 760.549928][T15016] usb 4-1: unable to get BOS descriptor or descriptor too short [ 760.598165][T15016] usb 4-1: no configurations [ 760.604436][T15016] usb 4-1: can't read configurations, error -22 [ 760.613277][T15016] usb usb4-port1: attempt power cycle [ 760.782194][T15745] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 760.789387][ T5881] usb 5-1: USB disconnect, device number 105 [ 760.811646][T15745] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 760.848560][T15745] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 760.881707][T15846] netlink: 84 bytes leftover after parsing attributes in process `syz.3.2962'. [ 760.940065][T15745] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 760.947070][T15745] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 761.064396][T15745] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 761.507138][T15868] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 761.779435][T15745] hsr_slave_0: entered promiscuous mode [ 761.796622][T15745] hsr_slave_1: entered promiscuous mode [ 762.220532][T15883] FAULT_INJECTION: forcing a failure. [ 762.220532][T15883] name failslab, interval 1, probability 0, space 0, times 0 [ 762.339894][ T10] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 762.380099][T15883] CPU: 0 UID: 0 PID: 15883 Comm: syz.1.2969 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 762.380133][T15883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 762.380146][T15883] Call Trace: [ 762.380155][T15883] [ 762.380165][T15883] dump_stack_lvl+0x189/0x250 [ 762.380204][T15883] ? __pfx_dump_stack_lvl+0x10/0x10 [ 762.380235][T15883] ? __pfx__printk+0x10/0x10 [ 762.380280][T15883] ? __pfx___might_resched+0x10/0x10 [ 762.380300][T15883] ? fs_reclaim_acquire+0x7d/0x100 [ 762.380340][T15883] should_fail_ex+0x414/0x560 [ 762.380368][T15883] should_failslab+0xa8/0x100 [ 762.380398][T15883] kmem_cache_alloc_noprof+0x73/0x3c0 [ 762.380426][T15883] ? alloc_empty_file+0x55/0x1d0 [ 762.380462][T15883] alloc_empty_file+0x55/0x1d0 [ 762.380494][T15883] path_openat+0x107/0x3830 [ 762.380515][T15883] ? arch_stack_walk+0xfc/0x150 [ 762.380556][T15883] ? stack_trace_save+0x9c/0xe0 [ 762.380583][T15883] ? stack_depot_save_flags+0x40/0x910 [ 762.380616][T15883] ? kasan_save_track+0x4f/0x80 [ 762.380640][T15883] ? __kasan_slab_alloc+0x6c/0x80 [ 762.380664][T15883] ? kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 762.380690][T15883] ? getname_flags+0xb8/0x540 [ 762.380719][T15883] ? __pfx_path_openat+0x10/0x10 [ 762.380740][T15883] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 762.380783][T15883] do_filp_open+0x1fa/0x410 [ 762.380808][T15883] ? __pfx_do_filp_open+0x10/0x10 [ 762.380855][T15883] ? _raw_spin_unlock+0x28/0x50 [ 762.380878][T15883] ? alloc_fd+0x64c/0x6c0 [ 762.380917][T15883] do_sys_openat2+0x121/0x1c0 [ 762.380941][T15883] ? __pfx_do_sys_openat2+0x10/0x10 [ 762.380977][T15883] __se_sys_openat2+0x226/0x2c0 [ 762.381001][T15883] ? __pfx___se_sys_openat2+0x10/0x10 [ 762.381030][T15883] ? do_syscall_64+0xba/0x210 [ 762.381063][T15883] do_syscall_64+0xf6/0x210 [ 762.381092][T15883] ? clear_bhb_loop+0x60/0xb0 [ 762.381117][T15883] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 762.381138][T15883] RIP: 0033:0x7f839d58e969 [ 762.381156][T15883] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 762.381175][T15883] RSP: 002b:00007f839e488038 EFLAGS: 00000246 ORIG_RAX: 00000000000001b5 [ 762.381197][T15883] RAX: ffffffffffffffda RBX: 00007f839d7b5fa0 RCX: 00007f839d58e969 [ 762.381213][T15883] RDX: 0000200000000240 RSI: 0000200000000140 RDI: ffffffffffffff9c [ 762.381229][T15883] RBP: 00007f839e488090 R08: 0000000000000000 R09: 0000000000000000 [ 762.381242][T15883] R10: 0000000000000018 R11: 0000000000000246 R12: 0000000000000001 [ 762.381262][T15883] R13: 0000000000000000 R14: 00007f839d7b5fa0 R15: 00007f839d8dfa28 [ 762.381294][T15883] [ 763.060055][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 763.094141][T15881] netlink: 'syz.5.2968': attribute type 13 has an invalid length. [ 763.268707][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 763.279265][ T10] usb 6-1: no configurations [ 763.284856][ T10] usb 6-1: can't read configurations, error -22 [ 763.553172][T10373] usb 2-1: new full-speed USB device number 116 using dummy_hcd [ 763.741616][T10373] usb 2-1: not running at top speed; connect to a high speed hub [ 763.763657][T10373] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 763.801333][T10373] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 763.841287][T10373] usb 2-1: config 1 has no interface number 1 [ 763.865290][T10373] usb 2-1: config 1 interface 2 has no altsetting 0 [ 763.886048][T10373] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 763.906144][T10373] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 763.935062][T10373] usb 2-1: Product: syz [ 763.957070][T10373] usb 2-1: Manufacturer: syz [ 763.979389][T10373] usb 2-1: SerialNumber: syz [ 764.469698][ T5881] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 764.540547][T10373] usb 2-1: 2:1 : sample bitwidth 10 in over sample bytes 1 [ 764.558999][T10373] usb 2-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 764.571756][T10373] usb 2-1: selecting invalid altsetting 0 [ 764.631935][ T5881] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 764.654918][ T5881] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 764.696356][ T5881] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 764.721634][T10373] usb 2-1: USB disconnect, device number 116 [ 764.737752][ T5881] usb 5-1: config 0 descriptor?? [ 764.889449][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 764.927411][T15745] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 764.954945][T15745] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 765.018210][T15745] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 765.068689][T15745] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 765.257898][T15907] macsec1: entered allmulticast mode [ 765.268950][T15907] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 765.287268][T15907] netdevsim netdevsim5 netdevsim0: left allmulticast mode [ 765.408839][T15914] xt_hashlimit: invalid interval [ 765.465948][T15745] 8021q: adding VLAN 0 to HW filter on device bond0 [ 765.513777][T15917] bond5: entered promiscuous mode [ 765.519275][T15917] bond5: entered allmulticast mode [ 765.525682][T15917] 8021q: adding VLAN 0 to HW filter on device bond5 [ 765.565452][T15921] netlink: 'syz.5.2978': attribute type 11 has an invalid length. [ 765.825066][T15917] bond5 (unregistering): Released all slaves [ 765.877258][T15933] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2980'. [ 766.432051][T15745] 8021q: adding VLAN 0 to HW filter on device team0 [ 766.492845][ T966] bridge0: port 1(bridge_slave_0) entered blocking state [ 766.501593][ T966] bridge0: port 1(bridge_slave_0) entered forwarding state [ 766.607754][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 766.615042][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 766.744575][T15745] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 766.764608][T15745] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 766.924910][T15745] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 767.109071][ T10] usb 5-1: USB disconnect, device number 106 [ 767.187242][T15745] veth0_vlan: entered promiscuous mode [ 767.228028][T15969] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 767.383383][T15745] veth1_vlan: entered promiscuous mode [ 767.618876][T15745] veth0_macvtap: entered promiscuous mode [ 767.663756][T15745] veth1_macvtap: entered promiscuous mode [ 767.794509][T15745] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 767.835276][T15745] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 767.875869][T15745] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 767.933008][T15745] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 767.962025][T15745] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 767.973868][T15745] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.247896][ T7560] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 768.310355][ T7560] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 768.504248][ T7560] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 768.552966][ T7560] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 769.106011][T15991] bridge_slave_0: left allmulticast mode [ 769.168838][T15991] bridge_slave_0: left promiscuous mode [ 769.183661][T15991] bridge0: port 1(bridge_slave_0) entered disabled state [ 769.220342][ T5881] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 769.296368][T15991] bridge_slave_1: left allmulticast mode [ 769.321026][T15991] bridge_slave_1: left promiscuous mode [ 769.398166][T15991] bridge0: port 2(bridge_slave_1) entered disabled state [ 769.488093][T15991] bond0: (slave bond_slave_0): Releasing backup interface [ 769.500376][ T5881] usb 5-1: Using ep0 maxpacket: 8 [ 769.666219][T15991] bond0: (slave bond_slave_1): Releasing backup interface [ 769.695348][T15986] netlink: 'syz.4.2987': attribute type 13 has an invalid length. [ 769.714924][ T47] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 769.918337][T15991] team0: Failed to send options change via netlink (err -105) [ 769.980165][T15991] team0: Failed to send port change of device team_slave_0 via netlink (err -105) [ 770.033941][ T47] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 770.060183][T15991] team0: Port device team_slave_0 removed [ 770.232215][T16015] openvswitch: netlink: Unknown key attributes 2 [ 770.257674][T16015] netlink: set zone limit has 8 unknown bytes [ 770.329965][T15991] ================================================================== [ 770.338067][T15991] BUG: KASAN: global-out-of-bounds in fib6_clean_node+0x35d/0x590 [ 770.346464][T15991] Read of size 8 at addr ffffffff99d1d888 by task syz.2.2939/15991 [ 770.354465][T15991] [ 770.356860][T15991] CPU: 1 UID: 0 PID: 15991 Comm: syz.2.2939 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 770.356892][T15991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 770.356907][T15991] Call Trace: [ 770.356916][T15991] [ 770.356926][T15991] dump_stack_lvl+0x189/0x250 [ 770.356962][T15991] ? __virt_addr_valid+0x18c/0x540 [ 770.356990][T15991] ? rcu_is_watching+0x15/0xb0 [ 770.357009][T15991] ? __kasan_check_byte+0x12/0x40 [ 770.357045][T15991] ? __pfx_dump_stack_lvl+0x10/0x10 [ 770.357074][T15991] ? rcu_is_watching+0x15/0xb0 [ 770.357094][T15991] ? lock_release+0x4b/0x3e0 [ 770.357126][T15991] ? __virt_addr_valid+0x18c/0x540 [ 770.357154][T15991] ? __virt_addr_valid+0x469/0x540 [ 770.357184][T15991] print_report+0xb4/0x290 [ 770.357209][T15991] ? fib6_clean_node+0x35d/0x590 [ 770.357234][T15991] kasan_report+0x118/0x150 [ 770.357264][T15991] ? fib6_clean_node+0x35d/0x590 [ 770.357303][T15991] fib6_clean_node+0x35d/0x590 [ 770.357331][T15991] ? __pfx_fib6_clean_node+0x10/0x10 [ 770.357361][T15991] ? fib6_walk_continue+0x131/0x910 [ 770.357390][T15991] fib6_walk_continue+0x67b/0x910 [ 770.357423][T15991] fib6_walk+0x149/0x290 [ 770.357449][T15991] __fib6_clean_all+0x234/0x380 [ 770.357473][T15991] ? __fib6_clean_all+0x9b/0x380 [ 770.357497][T15991] ? __pfx_fib6_ifup+0x10/0x10 [ 770.357524][T15991] ? __pfx___fib6_clean_all+0x10/0x10 [ 770.357550][T15991] ? __pfx_fib6_clean_node+0x10/0x10 [ 770.357575][T15991] ? __pfx_fib6_ifup+0x10/0x10 [ 770.357601][T15991] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 770.357635][T15991] rt6_sync_up+0x128/0x160 [ 770.357662][T15991] ? __pfx_rt6_sync_up+0x10/0x10 [ 770.357690][T15991] ? ipv6_mc_up+0x3da/0x580 [ 770.357715][T15991] addrconf_notify+0xd55/0x1010 [ 770.357745][T15991] notifier_call_chain+0x1b6/0x3e0 [ 770.357771][T15991] netif_state_change+0x284/0x3a0 [ 770.357798][T15991] ? __pfx_netif_state_change+0x10/0x10 [ 770.357823][T15991] ? do_set_master+0x1f7/0x6d0 [ 770.357850][T15991] ? validate_linkmsg+0x765/0x950 [ 770.357873][T15991] do_setlink+0x2eb6/0x40d0 [ 770.357909][T15991] ? __pfx_do_setlink+0x10/0x10 [ 770.357939][T15991] ? __lock_acquire+0xaac/0xd20 [ 770.357972][T15991] ? __mutex_trylock_common+0x153/0x260 [ 770.357996][T15991] ? __pfx___mutex_trylock_common+0x10/0x10 [ 770.358021][T15991] ? rcu_is_watching+0x15/0xb0 [ 770.358041][T15991] ? trace_contention_end+0x39/0x120 [ 770.358072][T15991] ? __mutex_lock+0x330/0xe80 [ 770.358100][T15991] ? __pfx_aa_get_newest_label+0x10/0x10 [ 770.358128][T15991] ? rtnl_newlink+0x8db/0x1c70 [ 770.358184][T15991] ? rcu_is_watching+0x15/0xb0 [ 770.358204][T15991] ? __pfx___mutex_lock+0x10/0x10 [ 770.358237][T15991] ? ns_capable+0x8a/0xf0 [ 770.358258][T15991] ? rtnl_link_get_net_capable+0x16a/0x350 [ 770.358294][T15991] rtnl_newlink+0x149f/0x1c70 [ 770.358318][T15991] ? kasan_save_track+0x3e/0x80 [ 770.358348][T15991] ? __pfx_rtnl_newlink+0x10/0x10 [ 770.358388][T15991] ? kasan_quarantine_put+0xdd/0x220 [ 770.358412][T15991] ? lockdep_hardirqs_on+0x9c/0x150 [ 770.358441][T15991] ? nlmon_xmit+0xb0/0x100 [ 770.358471][T15991] ? kmem_cache_free+0x192/0x3f0 [ 770.358508][T15991] ? __local_bh_enable_ip+0x12d/0x1c0 [ 770.358529][T15991] ? lockdep_hardirqs_on+0x9c/0x150 [ 770.358555][T15991] ? __local_bh_enable_ip+0x12d/0x1c0 [ 770.358575][T15991] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 770.358600][T15991] ? aa_get_newest_label+0xf7/0x5d0 [ 770.358625][T15991] ? __lock_acquire+0xaac/0xd20 [ 770.358666][T15991] ? __pfx_rtnl_newlink+0x10/0x10 [ 770.358690][T15991] rtnetlink_rcv_msg+0x7cf/0xb70 [ 770.358716][T15991] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 770.358741][T15991] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 770.358768][T15991] ? ref_tracker_free+0x63a/0x7d0 [ 770.358792][T15991] ? __copy_skb_header+0xa7/0x550 [ 770.358827][T15991] netlink_rcv_skb+0x21c/0x490 [ 770.358853][T15991] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 770.358879][T15991] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 770.358914][T15991] ? netlink_deliver_tap+0x2e/0x1b0 [ 770.358939][T15991] ? netlink_deliver_tap+0x2e/0x1b0 [ 770.358967][T15991] netlink_unicast+0x758/0x8d0 [ 770.358995][T15991] netlink_sendmsg+0x805/0xb30 [ 770.359026][T15991] ? __pfx_netlink_sendmsg+0x10/0x10 [ 770.359054][T15991] ? aa_sock_msg_perm+0x94/0x160 [ 770.359079][T15991] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 770.359104][T15991] ? __pfx_netlink_sendmsg+0x10/0x10 [ 770.359131][T15991] __sock_sendmsg+0x219/0x270 [ 770.359155][T15991] ____sys_sendmsg+0x505/0x830 [ 770.359187][T15991] ? __pfx_____sys_sendmsg+0x10/0x10 [ 770.359221][T15991] ? import_iovec+0x74/0xa0 [ 770.359253][T15991] ___sys_sendmsg+0x21f/0x2a0 [ 770.359291][T15991] ? __pfx____sys_sendmsg+0x10/0x10 [ 770.359340][T15991] ? __fget_files+0x2a/0x420 [ 770.359369][T15991] ? __fget_files+0x3a0/0x420 [ 770.359403][T15991] __x64_sys_sendmsg+0x19b/0x260 [ 770.359435][T15991] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 770.359472][T15991] ? do_syscall_64+0xba/0x210 [ 770.359498][T15991] do_syscall_64+0xf6/0x210 [ 770.359524][T15991] ? clear_bhb_loop+0x60/0xb0 [ 770.359548][T15991] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.359568][T15991] RIP: 0033:0x7f65a838e969 [ 770.359587][T15991] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 770.359604][T15991] RSP: 002b:00007f65a91c8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 770.359625][T15991] RAX: ffffffffffffffda RBX: 00007f65a85b5fa0 RCX: 00007f65a838e969 [ 770.359641][T15991] RDX: 0000000000000004 RSI: 0000200000000140 RDI: 0000000000000003 [ 770.359655][T15991] RBP: 00007f65a8410ab1 R08: 0000000000000000 R09: 0000000000000000 [ 770.359668][T15991] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 770.359681][T15991] R13: 0000000000000000 R14: 00007f65a85b5fa0 R15: 00007f65a86dfa28 [ 770.359701][T15991] [ 770.359707][T15991] [ 770.927103][T15991] The buggy address belongs to the variable: [ 770.933087][T15991] binder_devices+0x8/0x20 [ 770.937559][T15991] [ 770.939896][T15991] The buggy address belongs to the physical page: [ 770.946334][T15991] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x19d1d [ 770.955109][T15991] flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff) [ 770.963038][T15991] raw: 00fff00000002000 ffffea0000674748 ffffea0000674748 0000000000000000 [ 770.971640][T15991] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 770.980243][T15991] page dumped because: kasan: bad access detected [ 770.986674][T15991] page_owner info is not present (never set?) [ 770.992742][T15991] [ 770.995072][T15991] Memory state around the buggy address: [ 771.000706][T15991] ffffffff99d1d780: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 771.008786][T15991] ffffffff99d1d800: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 771.016865][T15991] >ffffffff99d1d880: 00 f9 f9 f9 00 00 f9 f9 00 00 00 00 00 00 00 00 [ 771.024933][T15991] ^ [ 771.029264][T15991] ffffffff99d1d900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 771.037335][T15991] ffffffff99d1d980: 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 00 f9 f9 f9 [ 771.045403][T15991] ================================================================== [ 771.053593][T15991] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 771.060848][T15991] CPU: 1 UID: 0 PID: 15991 Comm: syz.2.2939 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) [ 771.072957][T15991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 771.083028][T15991] Call Trace: [ 771.086324][T15991] [ 771.089281][T15991] dump_stack_lvl+0x99/0x250 [ 771.093897][T15991] ? __asan_memcpy+0x40/0x70 [ 771.098501][T15991] ? __pfx_dump_stack_lvl+0x10/0x10 [ 771.103725][T15991] ? __pfx__printk+0x10/0x10 [ 771.108333][T15991] panic+0x2db/0x790 [ 771.112251][T15991] ? __pfx_panic+0x10/0x10 [ 771.116707][T15991] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 771.122628][T15991] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 771.128545][T15991] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 771.134888][T15991] ? print_memory_metadata+0x314/0x400 [ 771.140388][T15991] ? fib6_clean_node+0x35d/0x590 [ 771.145357][T15991] check_panic_on_warn+0x89/0xb0 [ 771.150333][T15991] ? fib6_clean_node+0x35d/0x590 [ 771.155411][T15991] end_report+0x78/0x160 [ 771.159684][T15991] kasan_report+0x129/0x150 [ 771.164233][T15991] ? fib6_clean_node+0x35d/0x590 [ 771.169207][T15991] fib6_clean_node+0x35d/0x590 [ 771.174006][T15991] ? __pfx_fib6_clean_node+0x10/0x10 [ 771.179319][T15991] ? fib6_walk_continue+0x131/0x910 [ 771.184542][T15991] fib6_walk_continue+0x67b/0x910 [ 771.189596][T15991] fib6_walk+0x149/0x290 [ 771.193864][T15991] __fib6_clean_all+0x234/0x380 [ 771.198726][T15991] ? __fib6_clean_all+0x9b/0x380 [ 771.203870][T15991] ? __pfx_fib6_ifup+0x10/0x10 [ 771.208658][T15991] ? __pfx___fib6_clean_all+0x10/0x10 [ 771.214046][T15991] ? __pfx_fib6_clean_node+0x10/0x10 [ 771.219364][T15991] ? __pfx_fib6_ifup+0x10/0x10 [ 771.224326][T15991] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 771.230020][T15991] rt6_sync_up+0x128/0x160 [ 771.234686][T15991] ? __pfx_rt6_sync_up+0x10/0x10 [ 771.239669][T15991] ? ipv6_mc_up+0x3da/0x580 [ 771.244236][T15991] addrconf_notify+0xd55/0x1010 [ 771.249227][T15991] notifier_call_chain+0x1b6/0x3e0 [ 771.254366][T15991] netif_state_change+0x284/0x3a0 [ 771.259502][T15991] ? __pfx_netif_state_change+0x10/0x10 [ 771.265064][T15991] ? do_set_master+0x1f7/0x6d0 [ 771.269854][T15991] ? validate_linkmsg+0x765/0x950 [ 771.274898][T15991] do_setlink+0x2eb6/0x40d0 [ 771.279425][T15991] ? __pfx_do_setlink+0x10/0x10 [ 771.284307][T15991] ? __lock_acquire+0xaac/0xd20 [ 771.289178][T15991] ? __mutex_trylock_common+0x153/0x260 [ 771.294762][T15991] ? __pfx___mutex_trylock_common+0x10/0x10 [ 771.300856][T15991] ? rcu_is_watching+0x15/0xb0 [ 771.305634][T15991] ? trace_contention_end+0x39/0x120 [ 771.310934][T15991] ? __mutex_lock+0x330/0xe80 [ 771.315647][T15991] ? __pfx_aa_get_newest_label+0x10/0x10 [ 771.321317][T15991] ? rtnl_newlink+0x8db/0x1c70 [ 771.326102][T15991] ? rcu_is_watching+0x15/0xb0 [ 771.330965][T15991] ? __pfx___mutex_lock+0x10/0x10 [ 771.336012][T15991] ? ns_capable+0x8a/0xf0 [ 771.340354][T15991] ? rtnl_link_get_net_capable+0x16a/0x350 [ 771.346207][T15991] rtnl_newlink+0x149f/0x1c70 [ 771.351254][T15991] ? kasan_save_track+0x3e/0x80 [ 771.356149][T15991] ? __pfx_rtnl_newlink+0x10/0x10 [ 771.361219][T15991] ? kasan_quarantine_put+0xdd/0x220 [ 771.366608][T15991] ? lockdep_hardirqs_on+0x9c/0x150 [ 771.372003][T15991] ? nlmon_xmit+0xb0/0x100 [ 771.376493][T15991] ? kmem_cache_free+0x192/0x3f0 [ 771.381814][T15991] ? __local_bh_enable_ip+0x12d/0x1c0 [ 771.387217][T15991] ? lockdep_hardirqs_on+0x9c/0x150 [ 771.392560][T15991] ? __local_bh_enable_ip+0x12d/0x1c0 [ 771.398043][T15991] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 771.403781][T15991] ? aa_get_newest_label+0xf7/0x5d0 [ 771.408997][T15991] ? __lock_acquire+0xaac/0xd20 [ 771.413886][T15991] ? __pfx_rtnl_newlink+0x10/0x10 [ 771.419024][T15991] rtnetlink_rcv_msg+0x7cf/0xb70 [ 771.423980][T15991] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 771.429219][T15991] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 771.434711][T15991] ? ref_tracker_free+0x63a/0x7d0 [ 771.439769][T15991] ? __copy_skb_header+0xa7/0x550 [ 771.444813][T15991] netlink_rcv_skb+0x21c/0x490 [ 771.449590][T15991] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 771.455068][T15991] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 771.460384][T15991] ? netlink_deliver_tap+0x2e/0x1b0 [ 771.465616][T15991] ? netlink_deliver_tap+0x2e/0x1b0 [ 771.470832][T15991] netlink_unicast+0x758/0x8d0 [ 771.475616][T15991] netlink_sendmsg+0x805/0xb30 [ 771.480426][T15991] ? __pfx_netlink_sendmsg+0x10/0x10 [ 771.485728][T15991] ? aa_sock_msg_perm+0x94/0x160 [ 771.490681][T15991] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 771.495991][T15991] ? __pfx_netlink_sendmsg+0x10/0x10 [ 771.501322][T15991] __sock_sendmsg+0x219/0x270 [ 771.506204][T15991] ____sys_sendmsg+0x505/0x830 [ 771.511008][T15991] ? __pfx_____sys_sendmsg+0x10/0x10 [ 771.516355][T15991] ? import_iovec+0x74/0xa0 [ 771.520884][T15991] ___sys_sendmsg+0x21f/0x2a0 [ 771.525585][T15991] ? __pfx____sys_sendmsg+0x10/0x10 [ 771.530817][T15991] ? __fget_files+0x2a/0x420 [ 771.535512][T15991] ? __fget_files+0x3a0/0x420 [ 771.540210][T15991] __x64_sys_sendmsg+0x19b/0x260 [ 771.545174][T15991] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 771.550665][T15991] ? do_syscall_64+0xba/0x210 [ 771.555379][T15991] do_syscall_64+0xf6/0x210 [ 771.559912][T15991] ? clear_bhb_loop+0x60/0xb0 [ 771.564620][T15991] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.570826][T15991] RIP: 0033:0x7f65a838e969 [ 771.575261][T15991] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 771.594902][T15991] RSP: 002b:00007f65a91c8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 771.603336][T15991] RAX: ffffffffffffffda RBX: 00007f65a85b5fa0 RCX: 00007f65a838e969 [ 771.611336][T15991] RDX: 0000000000000004 RSI: 0000200000000140 RDI: 0000000000000003 [ 771.619317][T15991] RBP: 00007f65a8410ab1 R08: 0000000000000000 R09: 0000000000000000 [ 771.627317][T15991] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 771.635303][T15991] R13: 0000000000000000 R14: 00007f65a85b5fa0 R15: 00007f65a86dfa28 [ 771.643313][T15991] [ 771.646616][T15991] Kernel Offset: disabled [ 771.650953][T15991] Rebooting in 86400 seconds..