last executing test programs: 6.375194711s ago: executing program 4 (id=141): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000000c0)={[{0x4, 0xc63, 0x2, 0x8, 0x1, 0x4, 0xf, 0xc, 0x9, 0x2, 0x0, 0x4, 0xb}, {0x3, 0x8, 0x0, 0x1, 0x7f, 0xc2, 0x1, 0x8, 0x9, 0x4, 0x6, 0xf7, 0x2}, {0xff, 0x7, 0x2, 0x3, 0xe, 0x27, 0x5, 0x0, 0x1, 0x8e, 0x6, 0x9}], 0xfffffffa}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x2004cd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3], 0x0, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$AUTOFS_IOC_CATATONIC(0xffffffffffffffff, 0x9362, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) 5.990838466s ago: executing program 4 (id=145): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000000c0)={[{0x4, 0xc63, 0x2, 0x8, 0x1, 0x4, 0xf, 0xc, 0x9, 0x2, 0x0, 0x4, 0xb}, {0x3, 0x8, 0x0, 0x1, 0x7f, 0xc2, 0x1, 0x8, 0x9, 0x4, 0x6, 0xf7, 0x2}, {0xff, 0x7, 0x2, 0x3, 0xe, 0x27, 0x5, 0x0, 0x1, 0x8e, 0x6, 0x9}], 0xfffffffa}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x2004cd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3], 0x0, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$AUTOFS_IOC_CATATONIC(0xffffffffffffffff, 0x9362, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) 5.725733519s ago: executing program 2 (id=149): socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x13, 0x1ff, 0x3, 0x1, 0x60400, r0, 0x8000, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3, 0x4, 0x0, @void, @value, @void, @value}, 0x50) socket$netlink(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) r3 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x102) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f0000000180)={&(0x7f0000000080)=[0x0, 0x0], 0x2}) r4 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x0, 0x0) fcntl$lock(r3, 0x25, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x7fffffff, r4}) sched_setattr(r4, &(0x7f0000000140)={0x38, 0x5, 0x4, 0x6, 0x1000, 0x8, 0x9, 0x3, 0x10000, 0x101}, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000000)={'ip6tnl0\x00', &(0x7f0000000180)={'syztnl0\x00', r2, 0x29, 0x7, 0x9, 0x13, 0x5, @remote, @rand_addr=' \x01\x00', 0x10, 0x8000, 0x7, 0xffffff46}}) 5.535578282s ago: executing program 2 (id=151): r0 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x1, @local}, 0x48, {0x2, 0x0, @dev}}) r1 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r1, 0x5411, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x1, @local}, 0x4a, {0x2, 0x0, @dev}, 'veth0_to_team\x00'}) 5.331569007s ago: executing program 0 (id=154): syz_emit_ethernet(0x56, &(0x7f0000000180)={@local, @local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00', 0x20, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x2c}, @remote, {[@hopopts={0x2f, 0x2, '\x00', [@enc_lim={0x4, 0x1, 0x7f}, @enc_lim, @ra={0x5, 0x2, 0x453}, @jumbo={0xc2, 0x4, 0xc}, @ra={0x5, 0x2, 0x80}]}]}}}}}, 0x0) r0 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000200)={0x0, 0xb1, "9e7b1886858dd4dcafd0a6b34ff07f4e0f24aec4b3903a90f0202ba59823148ad1c04b28387a68269f3e827c95023544bdeebc7b040929908de66b018aa1a95403f6ce58e3d54403948cd00f3a93accf4210bcc28131d227359948569a8b9e5770ca8c33e74b8825338dcf30c5d6da157c4ed1b1c7f7f1dd8af80677e63f42ce5fb344ab6de0fef251fc34625fd46c3541c8a1d819626224edd3903c940707c5f4e262e2a3b8386974e2ef797ec328928c"}, &(0x7f0000000080)=0xb9) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000002c0)={r1, @in6={{0xa, 0x4e24, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x1}}, 0xfffb, 0xbb}, &(0x7f0000000100)=0x88) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000009c0)='m ', 0x2}], 0x1}, 0x8005) recvmsg$unix(r2, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002) sendmsg$NFQNL_MSG_VERDICT(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000480)={&(0x7f0000000d40)={0x488, 0x1, 0x3, 0x401, 0x0, 0x0, {0x5, 0x0, 0x6}, [@NFQA_VLAN={0x1c, 0x13, 0x0, 0x1, [@NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x8001}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x88a8}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x8100}]}, @NFQA_CT={0xc4, 0xb, 0x0, 0x1, [@CTA_TUPLE_ORIG={0xa0, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x32}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x5}}}}]}, @CTA_NAT_SRC={0x20, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MAXIP={0x8, 0x2, @multicast1}, @CTA_NAT_V6_MINIP={0x14, 0x4, @loopback}]}]}, @NFQA_EXP={0x44, 0xf, 0x0, 0x1, [@CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x1}, @CTA_EXPECT_TUPLE={0x38, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010100}, {0x8, 0x2, @multicast2}}}]}]}, @NFQA_VLAN={0x1c, 0x13, 0x0, 0x1, [@NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x8100}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x88a8}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x1000}]}, @NFQA_EXP={0x1e0, 0xf, 0x0, 0x1, [@CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x9}, @CTA_EXPECT_MASK={0x7c, 0x3, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @private=0xa010102}}, {0x14, 0x4, @local}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}]}, @CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_MASTER={0x34, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0xb2}}]}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x44}, @CTA_EXPECT_MASTER={0x18, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @multicast2}}}]}, @CTA_EXPECT_TUPLE={0x5c, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x6}}, {0x8, 0x2, @broadcast}}}]}, @CTA_EXPECT_NAT={0xa0, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x40, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT_TUPLE={0x4c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}]}, @NFQA_EXP={0x154, 0xf, 0x0, 0x1, [@CTA_EXPECT_HELP_NAME={0x8, 0x6, 'RAS\x00'}, @CTA_EXPECT_MASK={0x4c, 0x3, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT={0xbc, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x20, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_EXPECT_NAT_TUPLE={0x28, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x58, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x18}}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8}]}, @CTA_EXPECT_MASTER={0x2c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_FN={0x13, 0xb, 'callforwarding\x00'}]}]}, 0x488}, 0x1, 0x0, 0x0, 0x1}, 0x80) sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0xb8, 0x1, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFCTH_TUPLE={0x9c, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x44}}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x9}]}, 0xb8}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) recvmsg$unix(r2, &(0x7f0000000d00)={0x0, 0x0, 0x0}, 0x2) getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)) 5.285409817s ago: executing program 2 (id=156): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="1b000000000000a734abe94219fcb7ef0000000000", @ANYRES32=0x1, @ANYBLOB='\f\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="03000000050000000300"/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000100)}, 0x1c) r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000380)=0xffffffffffffffff, 0x4) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000400)={0x10200, 0x0}, 0x8) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = dup(r5) write$UHID_INPUT(r6, &(0x7f0000001040)={0xf, {"a2e3ad21ed0d1bf91b4d090955f70e06d038e7ff7fc6e5539b0d3f0e8b089b3f35076e090890e0878f0e1ac6e7049b3346959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15ffffffffffffffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400", 0x1000}}, 0x96d) r7 = syz_open_dev$mouse(&(0x7f0000000440), 0x80c5652c, 0x400) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000480)={0x1b, 0x0, 0x0, 0xb, 0x0, 0x1, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x3, 0x0, @void, @value, @void, @value}, 0x50) ioctl$TUNSETFILTEREBPF(r5, 0x800454e1, &(0x7f0000000c80)=r7) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r7, 0x89f8, &(0x7f0000000900)={'erspan0\x00', &(0x7f0000000a40)={'tunl0\x00', 0x0, 0x40, 0x40, 0x5, 0x100, {{0x2e, 0x4, 0x3, 0x4, 0xb8, 0x68, 0x0, 0x9, 0x2f, 0x0, @private=0xa010100, @multicast1, {[@generic={0x94, 0x3, "ab"}, @rr={0x7, 0x27, 0x5f, [@multicast2, @multicast2, @empty, @rand_addr=0x64010100, @loopback, @dev={0xac, 0x14, 0x14, 0x21}, @rand_addr=0x64010102, @local, @dev={0xac, 0x14, 0x14, 0x14}]}, @timestamp_prespec={0x44, 0x34, 0xc, 0x3, 0x1, [{@dev={0xac, 0x14, 0x14, 0x20}, 0x1cd3e9ca}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x5}, {@private=0xa010100, 0x80000000}, {@multicast1, 0x7}, {@broadcast, 0x1}, {@multicast2, 0x5}]}, @timestamp_addr={0x44, 0x3c, 0xed, 0x1, 0x3, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x8}, {@remote, 0x6}, {@empty, 0x101}, {@multicast2, 0x7}, {@private=0xa010101, 0xb}, {@multicast2, 0x8}, {@remote, 0x9}]}, @generic={0x94, 0x7, "23911a85b3"}, @end]}}}}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000bc0)={0x18, 0x16, &(0x7f0000000780)=@raw=[@ldst={0x1, 0x0, 0xd, 0x9, 0x8, 0xfffffffffffffffc}, @generic={0xb, 0x9, 0xb, 0x5, 0x6}, @alu={0xf62658b3be514832, 0x0, 0x9, 0x3, 0x5, 0x10, 0xfffffffffffffffc}, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}}, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x7}}, @ldst={0x1, 0x0, 0x3, 0x6, 0x0, 0xfffffffffffffff0}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x4}], &(0x7f00000000c0)='GPL\x00', 0x7, 0x88, &(0x7f0000000840)=""/136, 0x40f00, 0x4a, '\x00', r9, 0x0, r6, 0x8, &(0x7f0000000940)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000980)={0x1, 0x2, 0x10001, 0x4}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000000b40)=[r8, r1, r6, r1], &(0x7f0000000b80)=[{0x0, 0x4, 0xe, 0x7}, {0x5, 0x2, 0xe}, {0x0, 0x5, 0xc, 0x6}], 0x10, 0x6, @void, @value}, 0x94) r10 = open(&(0x7f0000000040)='./file1\x00', 0x80242, 0x0) write$FUSE_CREATE_OPEN(r10, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0xff, 0x5, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) sendfile(r10, r10, &(0x7f0000000080)=0x2, 0x7f03) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@bloom_filter={0x1e, 0x1ff, 0x8, 0x0, 0x205, 0x1, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3, 0x2, 0x4, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x7, 0x15, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @generic={0x99, 0x8, 0x3, 0x3e, 0x903b}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000340)='GPL\x00', 0x8, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x11, r3, 0x8, &(0x7f00000003c0)={0x0, 0x1}, 0x8, 0x10, 0x0, 0x0, r4, r6, 0x3, &(0x7f0000000580)=[0x1, r7, r8, 0x1, r10, r11], &(0x7f00000005c0)=[{0x3, 0x2, 0x9, 0x3}, {0x5, 0x3, 0x0, 0x6}, {0x5, 0x5, 0x4, 0x3}], 0x10, 0x9, @void, @value}, 0x94) listen(r0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000140)={@in6={{0xa, 0x4e23, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x10000}}, 0x0, 0x0, 0x45, 0x0, "6d331a719b431d049c2c7c7ccc755458efbb51ec29765edfee10261252c67a0981266c65daab690608aacc8fb1f8de3a408e754418984e6585e4f8fcea167a3b25d26e17990ec4585bc35b3b88a0906c"}, 0xd8) syz_emit_ethernet(0xaa, &(0x7f0000000cc0)={@local, @dev, @val={@void, {0x8100, 0x6, 0x1}}, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00@\x00', 0x70, 0x6, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, {[@routing={0x29, 0x6, 0x2, 0xc6, 0x0, [@local, @dev={0xfe, 0x80, '\x00', 0x13}, @private0={0xfc, 0x0, '\x00', 0x1}]}, @fragment={0x3b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68}, @fragment={0x2f, 0x0, 0x4, 0x0, 0x0, 0x10, 0x65}], {{0x4e24, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, '\r\x00'}]}}}}}}}}, 0x0) ioctl$int_out(r2, 0x0, &(0x7f00000006c0)) 5.202508416s ago: executing program 4 (id=157): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x800, 0xffffffff) syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fffffff, 0x2) r2 = socket(0x11, 0x3, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f0000000340)=0x97b, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) bind$packet(r2, &(0x7f0000000080)={0x11, 0xf5, r3}, 0x14) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000008c0)={'syztnl2\x00', &(0x7f0000000880)={'syztnl2\x00', 0x0, 0x8000, 0x20, 0x5, 0x400, {{0x7, 0x4, 0x1, 0x27, 0x1c, 0x64, 0x0, 0xb, 0x2f, 0x0, @rand_addr=0x64010102, @multicast1, {[@timestamp={0x44, 0x8, 0x3b, 0x0, 0x4, [0x9]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000900)={'vcan0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000009c0)={'syztnl0\x00', &(0x7f0000000940)={'syztnl0\x00', 0x0, 0x29, 0x7, 0xd, 0xfffffff7, 0x58, @private2={0xfc, 0x2, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1, 0x40, 0x2, 0x2}}) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) r7 = socket(0x40000000015, 0x5, 0x0) connect$inet(r7, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r7, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r7, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000200)="67d8902400aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db7", 0x2d}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df895d9907e4afb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b907e0974f1073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf4dee8512f3bac440f5d5e4bed6b897608b01eae26a54433e5f5c74a2ee3c2fc50067be05a677ff52a7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fedb679328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023f", 0x3a0}], 0x2}, 0x0) setsockopt$RDS_CONG_MONITOR(r7, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) sendmsg$NL80211_CMD_JOIN_MESH(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x40) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f0000000000)={'syztnl2\x00', &(0x7f0000000200)={'syztnl2\x00', r8, 0x29, 0x0, 0x1, 0x9, 0x1, @local, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8000, 0x700, 0x6, 0xd8}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000a80)={'gre0\x00', &(0x7f0000000a00)={'syztnl2\x00', 0x0, 0x80, 0x1, 0x4, 0x10, {{0x15, 0x4, 0x2, 0x32, 0x54, 0x66, 0x0, 0x8, 0x4, 0x0, @remote, @loopback, {[@timestamp={0x44, 0x10, 0xfe, 0x0, 0x4, [0x0, 0x8, 0xa7a]}, @timestamp={0x44, 0x8, 0x1c, 0x0, 0x0, [0xbd]}, @end, @timestamp={0x44, 0x24, 0x30, 0x0, 0x8, [0x5c89162a, 0x80000000, 0xfffffffa, 0x0, 0x9, 0x7ff, 0x7d65, 0x6]}]}}}}}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000ac0)={0x134, 0x0, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg0\x00'}]}, @HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x24040000}, 0x20084080) syz_open_dev$vim2m(&(0x7f0000000040), 0x40005, 0x2) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 4.988938297s ago: executing program 4 (id=160): r0 = syz_open_dev$vbi(&(0x7f0000000040), 0x2, 0x2) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000980)={0x6}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)={0x1c, 0x52, 0x1, 0x70bd2a, 0x25dfdbff, {0x2}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0xfffffffe}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0x40800) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f00000000c0)={{0x2, 0x4e21, @multicast1}, {0x1}, 0x8, {0x2, 0x4e21, @broadcast}, 'nicvf0\x00'}) ioctl$VIDIOC_ENUM_FREQ_BANDS(r0, 0xc0405665, &(0x7f0000000280)={0x7, 0x2}) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) r2 = socket(0x10, 0x3, 0x6) r3 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0xf}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1], 0x0, [0x0, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x1]}}}}]}, 0x88}}, 0x20000000) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x2, 0x0) 4.887734508s ago: executing program 2 (id=161): socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x13, 0x1ff, 0x3, 0x1, 0x60400, r0, 0x8000, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3, 0x4, 0x0, @void, @value, @void, @value}, 0x50) socket$netlink(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) r3 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x102) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f0000000180)={&(0x7f0000000080)=[0x0, 0x0], 0x2}) r4 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x0, 0x0) fcntl$lock(r3, 0x25, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x7fffffff, r4}) sched_setattr(r4, &(0x7f0000000140)={0x38, 0x5, 0x4, 0x6, 0x1000, 0x8, 0x9, 0x3, 0x10000, 0x101}, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000000)={'ip6tnl0\x00', &(0x7f0000000180)={'syztnl0\x00', r2, 0x29, 0x7, 0x9, 0x13, 0x5, @remote, @rand_addr=' \x01\x00', 0x10, 0x8000, 0x7, 0xffffff46}}) 4.394209868s ago: executing program 2 (id=164): r0 = socket$unix(0x1, 0x2, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='gid_map\x00') write$UHID_INPUT2(r1, 0x0, 0xff0f) bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg$unix(r2, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) 4.268218325s ago: executing program 0 (id=165): write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, 0x0, 0x0) ioctl$PTP_PIN_SETFUNC(0xffffffffffffffff, 0x40603d07, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x18, 0x30, 0x1, 0x0, 0x2, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x804}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000080)={0x32, 0x0}) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0x112, &(0x7f0000000280)={0x0, 0x408c, 0x100, 0x8, 0x40}, &(0x7f0000000240), &(0x7f0000000040)) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000580)=0x4) (fail_nth: 1) 3.701987092s ago: executing program 3 (id=167): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_int(r0, 0x11, 0x5, 0x0, &(0x7f0000000c00)) 3.56049997s ago: executing program 3 (id=169): socket$netlink(0x10, 0x3, 0xe) rt_sigsuspend(0xffffffffffffffff, 0x8) 3.333646894s ago: executing program 2 (id=170): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) eventfd(0xc) syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f0000000600), 0x0, 0x103, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000640), r4) sendmsg$MPTCP_PM_CMD_GET_ADDR(r4, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000000c0)={0x28, r5, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x12}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x5800}, 0x4) bind$alg(r3, 0x0, 0x0) r6 = accept4(r3, 0x0, 0x0, 0x0) syz_emit_ethernet(0x5a, &(0x7f0000000200)={@local, @multicast, @void, {@ipv4={0x800, @tcp={{0xe, 0x4, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x7, 0xdf, [@initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp={0x44, 0x14, 0x5, 0x3, 0x0, [0x0, 0x0, 0x10, 0x0]}, @cipso={0x86, 0x6}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) sendmmsg(r6, &(0x7f00000094c0)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000180)="6dd1d20ea33b64dbe6df735b9074eb86e9a529a699a96487493109f2801696a5425c51cb5072d9f04d9c543f26e945afa51b569b4f914ff985667c169e73e024227211247d6dcb6e73e4ab396d78cefa4ba4dcf264719c73331cc7", 0x5b}, {&(0x7f0000000280)="6a5ea97c78c386661de72437082f87a07f7fcc2ddd7a2569ac1f3034b70e8a299af06d95e0341962058eab2a905746b96886d55f213572a488974a25bf0398422bdc0fd17cacc304a3fe683290aa448b9412286576c4bde37bb45bbd6f803931c8b76dccd5cfea9abe3fd66a410605599cef469a5f7aecbb74869512275395e558c1ed2fa9ce4232a18954b4797e8b74dbbec1bd617c1a087dce317e9f7254e40a74887c3cde039b5c4eb250c58502fc917948a27f7dc053078da3189b2ac882b4a7ad736e1fc3aac42256945bfe9b90f01c9edfceb215e0b998dd3d030b1aba6d419efe085f009d", 0xe8}, {&(0x7f0000000380)="921c9e65615110daa76091b3a1565773b980939c14df3f4cab15dbaee58017ecc78959698882f1f850a3a5ad1579717477b2801b6b63eea2b01f3832e455b684d099d12bef4dcf1ba51c3ddc2a6d38df71a30c1368f368707de1a8489451b42d0202a7c03c5a4f487a880f36354e4331f1205cb8d1f4b3a8aa663edc586a9d303d90f7c3a73ddeda7e63942716527926bc542a4adbc5416c539bc0c0bf2c5c04c1f1192a1488424659099c7b8ed8f792f34477801cd05cfd96cb52e1294414d9794835bf827428bd5851be7a2e3dc4ec39921c588098eb53cb5cd0116b955c20", 0xe0}, {&(0x7f0000000200)="d04da7328b056c5d892e6936447a2df76831", 0x12}, {&(0x7f0000000480)="0d6a2cf672e1062fd84f908e58ac9337bc441bef40de382c7d130e55c0cf23e3e94a9bf68f8835cbcf49f47e23fe8568f345bf40362eb121de489ff00ecadf43c4a0167f9d6216c6b39d", 0x4a}, {&(0x7f0000000540)="553ec8b992b4", 0x6}], 0x6}}], 0x1, 0x40004) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0xf, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r7 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r9, {}, {0x9, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x5, 0x9, 0x2, 0x1}, 0x9, 0x0, 0x3, 0x3, 0xc, 0x1a, 0x12, 0x7, 0x5, 0x3ff, {0xe, 0x9, 0xfffffffe, 0x7, 0x6, 0x7ff}}}}]}, 0x78}}, 0x0) sendmsg$MPTCP_PM_CMD_GET_ADDR(r6, &(0x7f0000000500)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000580)={0x70, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x5}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x99}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x34, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x16}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r9}]}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}]}, 0x70}, 0x1, 0x0, 0x0, 0x8084}, 0x8000) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) 2.712438009s ago: executing program 3 (id=171): madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x17) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x2}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2c}, @NFTA_SET_DESC={0x14, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}]}]}]}]}], {0x14, 0x10}}, 0x78}}, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x4000, 0x1}) 2.70611324s ago: executing program 1 (id=172): pipe(&(0x7f0000000100)) pipe(&(0x7f00000000c0)) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000002c0)={'veth0_to_bond\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x2300, 0x0, 0xfffffffd, 0xffffffff, 0x1, 0x2, 0x0, 0x1ff}}) sched_setattr(0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a300000000014000780080008400000000008001240200000000500050002000000050004000000000010000300686173683a69702c6d6163"], 0x5c}, 0x1, 0x0, 0x0, 0x50}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x803}, 0x0) clock_nanosleep(0x2, 0x0, 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000380)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a0000000086d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f6853772b21a140efb76cba37ff3111d6847e8b9398a646717af75fc008daefba68e6222103472bc55704cdb737ae996ed831f3b802549db3a8ffff7d34171113d806726615380fe65a6a0a72e1ac2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be500e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef1d7ee686be0fc58e384f93a13f4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe363590d1f600"}) sendmsg$NFT_BATCH(r2, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) sendmmsg$alg(r5, 0x0, 0x0, 0x40800) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x29, 0x0, 0x29, 0x0, @loopback, @multicast2}}}}) bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r7, 0x4601, &(0x7f0000000940)={0x60, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {}, {}, {}, {0x3}}) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x3}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, {}, 0x0, 0x0, 0x1}, {{@in6=@dev, 0x0, 0x33}, 0x0, @in6=@private2, 0x0, 0x2, 0x0, 0xb7, 0xffffffff}}, 0xe4) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) 2.49113289s ago: executing program 1 (id=173): r0 = socket(0x10, 0x8000000803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}, @IFLA_GRE_OFLAGS={0x6}]}}}]}, 0x50}}, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) r2 = dup(r1) write$UHID_INPUT(r2, &(0x7f0000001040)={0xf, {"a2e3ad21ed0d09f91b3d090987f70e06d038e7ff7fc6e5539b0d650e8b089b3f350768090890e0878f0e1ac6e7049b3346959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15ffffffffffffffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400", 0x1000}}, 0x1006) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c00810ce00f80ecdb4cb9f207c804a00d000000010006fb640002000a0ada1b40d805481100c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) 2.446046367s ago: executing program 3 (id=174): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000000)={'ip6tnl0\x00', &(0x7f0000000180)={'syztnl0\x00', r1, 0x29, 0x7, 0x9, 0x13, 0x5, @remote, @rand_addr=' \x01\x00', 0x10, 0x8000, 0x7, 0xffffff46}}) 2.301209442s ago: executing program 3 (id=175): syz_emit_ethernet(0x56, &(0x7f0000000180)={@local, @local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00', 0x20, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x2c}, @remote, {[@hopopts={0x2f, 0x2, '\x00', [@enc_lim={0x4, 0x1, 0x7f}, @enc_lim, @ra={0x5, 0x2, 0x453}, @jumbo={0xc2, 0x4, 0xc}, @ra={0x5, 0x2, 0x80}]}]}}}}}, 0x0) r0 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000200)={0x0, 0xb1, "9e7b1886858dd4dcafd0a6b34ff07f4e0f24aec4b3903a90f0202ba59823148ad1c04b28387a68269f3e827c95023544bdeebc7b040929908de66b018aa1a95403f6ce58e3d54403948cd00f3a93accf4210bcc28131d227359948569a8b9e5770ca8c33e74b8825338dcf30c5d6da157c4ed1b1c7f7f1dd8af80677e63f42ce5fb344ab6de0fef251fc34625fd46c3541c8a1d819626224edd3903c940707c5f4e262e2a3b8386974e2ef797ec328928c"}, &(0x7f0000000080)=0xb9) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000002c0)={r1, @in6={{0xa, 0x4e24, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x1}}, 0xfffb, 0xbb}, &(0x7f0000000100)=0x88) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000009c0)='m ', 0x2}], 0x1}, 0x8005) recvmsg$unix(r2, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002) sendmsg$NFQNL_MSG_VERDICT(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000480)={&(0x7f0000000d40)={0x488, 0x1, 0x3, 0x401, 0x0, 0x0, {0x5, 0x0, 0x6}, [@NFQA_VLAN={0x1c, 0x13, 0x0, 0x1, [@NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x8001}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x88a8}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x8100}]}, @NFQA_CT={0xc4, 0xb, 0x0, 0x1, [@CTA_TUPLE_ORIG={0xa0, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x32}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x5}}}}]}, @CTA_NAT_SRC={0x20, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MAXIP={0x8, 0x2, @multicast1}, @CTA_NAT_V6_MINIP={0x14, 0x4, @loopback}]}]}, @NFQA_EXP={0x44, 0xf, 0x0, 0x1, [@CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x1}, @CTA_EXPECT_TUPLE={0x38, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010100}, {0x8, 0x2, @multicast2}}}]}]}, @NFQA_VLAN={0x1c, 0x13, 0x0, 0x1, [@NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x8100}, @NFQA_VLAN_PROTO={0x6, 0x1, 0x1, 0x0, 0x88a8}, @NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x1000}]}, @NFQA_EXP={0x1e0, 0xf, 0x0, 0x1, [@CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x9}, @CTA_EXPECT_MASK={0x7c, 0x3, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @private=0xa010102}}, {0x14, 0x4, @local}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}]}, @CTA_EXPECT_ZONE={0x6}, @CTA_EXPECT_MASTER={0x34, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0xb2}}]}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x44}, @CTA_EXPECT_MASTER={0x18, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @multicast2}}}]}, @CTA_EXPECT_TUPLE={0x5c, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x6}}, {0x8, 0x2, @broadcast}}}]}, @CTA_EXPECT_NAT={0xa0, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x40, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT_TUPLE={0x4c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}]}, @NFQA_EXP={0x154, 0xf, 0x0, 0x1, [@CTA_EXPECT_HELP_NAME={0x8, 0x6, 'RAS\x00'}, @CTA_EXPECT_MASK={0x4c, 0x3, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT={0xbc, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x20, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_EXPECT_NAT_TUPLE={0x28, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x58, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x18}}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8}]}, @CTA_EXPECT_MASTER={0x2c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_FN={0x13, 0xb, 'callforwarding\x00'}]}]}, 0x488}, 0x1, 0x0, 0x0, 0x1}, 0x80) sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0xb8, 0x1, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFCTH_TUPLE={0x9c, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x44}}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x9}]}, 0xb8}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) recvmsg$unix(r2, &(0x7f0000000d00)={0x0, 0x0, 0x0}, 0x2) getresgid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)) 2.092533231s ago: executing program 1 (id=176): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="000000000000000000000b00000008000300", @ANYRES32=0x0, @ANYBLOB="97a89d51d1cb2673613cdc7678f41a02514987ac17816532769d45fbe125510f4d39c5574d81077cf360a205689545e3ad7116b8a0adc3c0abbb89ee13b31e518f29de21c1a89032a6d5b20beb04b435e936147d214baa29a03c5698e1f885299d164954f46e05094ad7348d3ee7c44d0b2d639d0145e4e809f5fe7848b1c4adf8a17ab87e8df00e581b1784fd9136d5dfd05bae2d785a187e8aee81373ed9e4818960a2c3d690ed714809388fec03c52a441c41bb1eb10123f09f30f53bcb764aef88aa46649e858a0e83b0f6498b4fd6295872"], 0x1c}}, 0x4000004) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000000)='bridge0\x00') syz_emit_ethernet(0x2a, &(0x7f0000001800)={@link_local, @random="50a245d5cde0", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x700, 0x0, 0x2, 0x0, @empty, @broadcast}, @address_reply}}}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd6060626000102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa11000001"], 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c0000001e00010000000000ffffffff020000000100000700000000993c790bf14c9213570b6b0e3d7e09b3f98ca74e65ac0a83e659575a675a5359a15ea7dc4f605272dedfbf2b63daee35aea9c264cde6ff78ef208b456f4cc82ac1d665e0ceec7d526e756deebc76197b7558aea9503670fa6ed500558921ede143423720f6f129ffcd34d27395a2ec95edc32665315c1fc64076ea6786a4ec8e154553b324cb6ce739003517a9d10916f480f6b8619004d6dcaa63d705d804"], 0x1c}, 0x1, 0x0, 0x0, 0x4080}, 0x4000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="7586e889", @ANYRES16=r3, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32=r4, @ANYBLOB="1c005a80180001801400030009000104f400fcff010000f800000080"], 0x38}, 0x1, 0x0, 0x0, 0x4040805}, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r6, 0x11b, 0x6, &(0x7f0000000200)=0x1, 0x4) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r6, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r5, 0x11b, 0x6, &(0x7f0000000080)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_wireguard(r7, 0x8933, &(0x7f0000000400)={'wg2\x00'}) r8 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r8, 0x89f1, &(0x7f0000000340)={'ip6tnl0\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x0, 0x3, 0x0, 0x0, 0x43, @private1, @loopback={0xfec0ffff00000000, 0xffff8881114a4aa8}, 0x40, 0x8, 0x7, 0x4000008}}) 1.83775939s ago: executing program 0 (id=177): r0 = socket$inet(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, r1, 0x1, 0x80, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x1c1900, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000540)="0fa20367553f46836b4876760fc71a66ba4100edb9800000c00f320f4285a15a00000f30420f017805450f0866b8af008ed86446d8e4b8010000000f01d9", 0x3e}], 0x1, 0x20, 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000020002001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r4], 0x4c}}, 0x4000) 1.698895735s ago: executing program 4 (id=178): r0 = socket$inet(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, r1, 0x1, 0x80, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000020002001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r4], 0x4c}}, 0x4000) (fail_nth: 1) 1.187787281s ago: executing program 4 (id=179): r0 = syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000180)=ANY=[@ANYBLOB="12015001022500402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d240f01f9fffffffdff08000006241a0000100905810240000004000904010000020d00000904010102020d00000905820210"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000680)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x80, 0x1c, {0xfff, 0xdf0, 0x80000100, 0x9, 0x3, 0x0, 0x7ff, 0x1916, 0x1, 0x7fc, 0x4, 0x6}}, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0x208) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0x9, 0x9}, 0x8) r2 = accept4(r1, 0x0, 0x0, 0x80000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x4}, 0x8) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) setrlimit(0x2, &(0x7f00000000c0)={0x2000000, 0xffffffffffffffff}) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r5 = eventfd(0x4) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r6, 0xae03, 0xa) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha384-generic\x00'}, 0x58) r8 = accept4(r7, 0x0, 0x0, 0x0) sendmmsg$unix(r8, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000140)="12", 0x63}], 0x1}}, {{&(0x7f000000a7c0)=@abs={0x1, 0x0, 0x4e23}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4000}}, {{&(0x7f000000abc0)=@abs={0x1, 0x0, 0x4e23}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4000}}], 0x3, 0xfff0) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r5) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r5}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000140)={0x0, 0x1, 0x0, &(0x7f0000000600)=""/52, 0x0, 0xffff1000}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000002c0)) syz_io_uring_setup(0x240, &(0x7f0000000380)={0x0, 0x876, 0x8, 0x1, 0x3}, &(0x7f0000000340), &(0x7f0000000180)) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc00c64b5, &(0x7f0000000400)={&(0x7f0000000300)=[0x0], 0x1}) 1.069143768s ago: executing program 3 (id=180): openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) getdents(0xffffffffffffffff, &(0x7f0000000180)=""/64, 0x40) writev(0xffffffffffffffff, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x1) r2 = openat$sndseq(0xffffff9c, &(0x7f0000001240), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r2, 0xc0a45320, &(0x7f00000000c0)={{0x80}, 'port0\x00', 0x3eb, 0x21e2f, 0x7f, 0x1681bcd7, 0x0, 0x0, 0x400, 0x0, 0x6}) openat$sequencer2(0xffffff9c, &(0x7f0000000040), 0x44711, 0x0) 974.756921ms ago: executing program 1 (id=181): r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000440), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0185648, &(0x7f0000000080)={0x980410, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f911, 0x80008002, '\x00', @p_u16=&(0x7f00000010c0)=0xa5b}}) 833.93031ms ago: executing program 0 (id=182): r0 = syz_open_dev$vbi(&(0x7f0000000200), 0x0, 0x2) r1 = socket$inet6(0xa, 0x3, 0x75) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in=@multicast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x2b}, {}, {0x0, 0xfef2}, 0x0, 0x1, 0x1}, {{@in6=@rand_addr=' \x01\x00', 0x0, 0x32}, 0x0, @in=@multicast1}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@remote, @in6=@mcast1, 0x4e24, 0x0, 0x0, 0x8, 0x2, 0x0, 0x20, 0x73}, {0x10000, 0xeca, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x7789, 0x10000}, {0x0, 0x0, 0x1}}, {{@in6=@mcast2, 0x4d6, 0x3c}, 0x0, @in=@private=0xa010100, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}}, 0xe4) close(r1) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f00000007c0)={0x0, @bt={0x4ca, 0x870, 0x1, 0x2, 0xd59f82, 0x19f5, 0x4, 0xb, 0x0, 0x6, 0x27fd, 0x2800, 0x440, 0x3, 0xd, 0x8, {0x45, 0x80}, 0xcd, 0x3}}) 752.252077ms ago: executing program 1 (id=183): pipe(&(0x7f0000000100)) pipe(&(0x7f00000000c0)) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000002c0)={'veth0_to_bond\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x2300, 0x0, 0xfffffffd, 0xffffffff, 0x1, 0x2, 0x0, 0x1ff}}) sched_setattr(0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a300000000014000780080008400000000008001240200000000500050002000000050004000000000010000300686173683a69702c6d6163"], 0x5c}, 0x1, 0x0, 0x0, 0x50}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x803}, 0x0) clock_nanosleep(0x2, 0x0, 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000380)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a0000000086d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f6853772b21a140efb76cba37ff3111d6847e8b9398a646717af75fc008daefba68e6222103472bc55704cdb737ae996ed831f3b802549db3a8ffff7d34171113d806726615380fe65a6a0a72e1ac2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be500e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef1d7ee686be0fc58e384f93a13f4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe363590d1f600"}) sendmsg$NFT_BATCH(r2, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) sendmmsg$alg(r5, 0x0, 0x0, 0x40800) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x29, 0x0, 0x29, 0x0, @loopback, @multicast2}}}}) bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r7, 0x4601, &(0x7f0000000940)={0x60, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {}, {}, {}, {0x3}}) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x3}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, {}, 0x0, 0x0, 0x1}, {{@in6=@dev, 0x0, 0x33}, 0x0, @in6=@private2, 0x0, 0x2, 0x0, 0xb7, 0xffffffff}}, 0xe4) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) 363.921503ms ago: executing program 1 (id=184): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0xca, 0xb4, 0xc5, 0x8, 0xc72, 0x14, 0x578a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0xb, 0x0, 0xe0, 0x9, [{{0x9, 0x4, 0xf4, 0x5, 0x2, 0x1d, 0xf4, 0x52, 0x8, [], [{{0x9, 0x5, 0x3, 0x3, 0x0, 0x5, 0x8, 0x81}}, {{0x9, 0x5, 0xb, 0x0, 0x10, 0x40, 0x1, 0x7f}}]}}]}}]}}, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0}) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f00000004c0)={0x1, 0xc, 0x0, 0x0, @vifc_lcl_addr=@dev={0xac, 0x14, 0x14, 0x37}, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10) setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=@bloom_filter={0x1e, 0x4, 0xfffffff0, 0x9, 0x1001, 0x1, 0x40, '\x00', 0x0, r0, 0x2, 0x1, 0x1, 0x7, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r4 = dup(r3) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) r5 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000006c0)=@generic={&(0x7f0000000680)='./file0\x00', 0x0, 0x10}, 0x14) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000700)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) r7 = openat$vcsu(0xffffff9c, &(0x7f0000000740), 0x599880, 0x0) r8 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r8, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r8, 0x4008af03, &(0x7f0000000280)) ioctl$VHOST_SET_FEATURES(r8, 0x4008af00, &(0x7f0000000080)=0x200000000) r9 = dup2(r8, r8) preadv2(r9, &(0x7f0000000400)=[{0x0, 0x30}, {&(0x7f00000002c0)=""/89, 0x59}], 0x2, 0x2007, 0x3, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x3, &(0x7f0000000340)=@raw=[@map_idx={0x18, 0x5, 0x5, 0x0, 0x10}, @call={0x85, 0x0, 0x0, 0x27}], &(0x7f0000000380)='syzkaller\x00', 0x7fff, 0xbc, &(0x7f0000000500)=""/188, 0x41100, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000400)={0x4, 0x3}, 0x8, 0x10, &(0x7f0000000480)={0x5, 0x7, 0xb, 0x4}, 0x10, 0x0, 0x0, 0x8, &(0x7f00000003c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r2, r4, r5, r6, r7, r9, r2], &(0x7f00000007c0)=[{0x3, 0x4, 0x1, 0x7}, {0x0, 0x1, 0xd, 0x7}, {0x1, 0x5, 0x1, 0xc}, {0x1, 0x2, 0x5, 0x3}, {0x3, 0x3, 0x4}, {0x3, 0x3, 0xc, 0x3}, {0x0, 0x3, 0xb, 0x6}, {0x1, 0x1, 0x6, 0x7}], 0x10, 0x8, @void, @value}, 0x94) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @address_request}}}}, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000280)=ANY=[@ANYBLOB="bbbbbbbbbbbb0180c200000008004500005800000000002f9078000000e00000000010000800000086dd080088be000000001000000088f7ffff0000ecf4080022eb00000000200000000200000000000000000000000800655800000000000000000000000031801d6ae0f1fb4368588b8d6eb5f941b0118bf050ad4b8dfc51342237d4a2992c274d45077e0dfad03edb05e6ed8c18b99c553e9b82126e417d6c08f9e0f2e74bdb554bcc97efec3637b5b70009"], 0x0) getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x43, &(0x7f0000000200), &(0x7f0000000240)=0x8) r10 = syz_io_uring_setup(0x6c11, &(0x7f00000000c0)={0x0, 0xc9fd, 0x200, 0x1, 0x262}, &(0x7f0000000040), &(0x7f0000000140)) io_uring_setup(0x75c1, &(0x7f0000000180)={0x0, 0xebad, 0x2, 0x2, 0x103, 0x0, r10}) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) setsockopt$MRT_FLUSH(r1, 0x0, 0xd4, 0x0, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f00000005c0)=ANY=[@ANYBLOB="12974305b12ac78727b96b29eda101100390132210cb043f016f60010203010902120001ff0080400904ea4e000ed0ff07de9f6b841542e4497921ff89bdab833ab478f197548f3ec299784d76ff783a166faccbbebc13a8a69276fb599d63009f10e596fefdfa0af95a9fee515644ca3f3a753db3bfa55b839520a834c59a951469ea518e4d856bc93c8b5454f67f9b5dec65843727af3d09e9a847f9f381fe54"], &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0}) setsockopt$MRT_FLUSH(r1, 0x0, 0xd4, &(0x7f0000000440)=0x9, 0x4) 305.88991ms ago: executing program 0 (id=185): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000000)={'ip6tnl0\x00', &(0x7f0000000180)={'syztnl0\x00', r1, 0x29, 0x7, 0x9, 0x13, 0x5, @remote, @rand_addr=' \x01\x00', 0x10, 0x8000, 0x7, 0xffffff46}}) 0s ago: executing program 0 (id=186): r0 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r0, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) recvmsg(r0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.190' (ED25519) to the list of known hosts. [ 81.374222][ T5816] cgroup: Unknown subsys name 'net' [ 81.510387][ T5816] cgroup: Unknown subsys name 'cpuset' [ 81.519579][ T5816] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 83.162067][ T5816] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 85.773216][ T5827] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.786217][ T5827] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.794142][ T5827] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.802527][ T5827] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.810279][ T5827] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 86.006126][ T5827] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 86.014308][ T5827] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 86.034453][ T5834] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 86.042202][ T5834] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 86.050569][ T5834] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 86.058912][ T5834] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 86.066904][ T5834] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 86.083943][ T5834] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 86.091521][ T5141] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 86.100530][ T5141] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 86.108207][ T5141] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 86.116986][ T5141] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 86.124718][ T5141] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 86.140128][ T5835] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 86.150339][ T5835] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 86.176213][ T5835] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 86.185972][ T5835] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 86.203940][ T5835] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 86.213156][ T5835] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 86.226361][ T5835] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 86.633939][ T5830] chnl_net:caif_netlink_parms(): no params data found [ 87.107522][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.114790][ T5830] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.123494][ T5830] bridge_slave_0: entered allmulticast mode [ 87.132449][ T5830] bridge_slave_0: entered promiscuous mode [ 87.142301][ T5842] chnl_net:caif_netlink_parms(): no params data found [ 87.158067][ T5841] chnl_net:caif_netlink_parms(): no params data found [ 87.178365][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.187029][ T5830] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.194221][ T5830] bridge_slave_1: entered allmulticast mode [ 87.202050][ T5830] bridge_slave_1: entered promiscuous mode [ 87.228581][ T5838] chnl_net:caif_netlink_parms(): no params data found [ 87.264366][ T5840] chnl_net:caif_netlink_parms(): no params data found [ 87.291877][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.346054][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.533999][ T5830] team0: Port device team_slave_0 added [ 87.602058][ T5830] team0: Port device team_slave_1 added [ 87.608208][ T5838] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.615335][ T5838] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.622858][ T5838] bridge_slave_0: entered allmulticast mode [ 87.631160][ T5838] bridge_slave_0: entered promiscuous mode [ 87.639506][ T5838] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.646846][ T5838] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.654101][ T5838] bridge_slave_1: entered allmulticast mode [ 87.661593][ T5838] bridge_slave_1: entered promiscuous mode [ 87.668451][ T5841] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.675951][ T5841] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.683271][ T5841] bridge_slave_0: entered allmulticast mode [ 87.690621][ T5841] bridge_slave_0: entered promiscuous mode [ 87.719272][ T5842] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.726507][ T5842] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.733902][ T5842] bridge_slave_0: entered allmulticast mode [ 87.741364][ T5842] bridge_slave_0: entered promiscuous mode [ 87.791406][ T5841] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.798756][ T5841] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.806792][ T5841] bridge_slave_1: entered allmulticast mode [ 87.814064][ T5841] bridge_slave_1: entered promiscuous mode [ 87.835780][ T5842] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.842954][ T5842] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.850295][ T5842] bridge_slave_1: entered allmulticast mode [ 87.857658][ T5842] bridge_slave_1: entered promiscuous mode [ 87.877893][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.884866][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.911274][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.922910][ T5827] Bluetooth: hci0: command tx timeout [ 88.000032][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.007261][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.033551][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.049207][ T5838] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.062489][ T5841] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.072375][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.079680][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.087067][ T5840] bridge_slave_0: entered allmulticast mode [ 88.094918][ T5840] bridge_slave_0: entered promiscuous mode [ 88.105018][ T5842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.118479][ T5842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.138591][ T5838] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.147789][ T5827] Bluetooth: hci1: command tx timeout [ 88.155848][ T5827] Bluetooth: hci3: command tx timeout [ 88.156042][ T5841] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.170870][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.178568][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.185837][ T5840] bridge_slave_1: entered allmulticast mode [ 88.193076][ T5840] bridge_slave_1: entered promiscuous mode [ 88.226174][ T5827] Bluetooth: hci2: command tx timeout [ 88.306204][ T5827] Bluetooth: hci4: command tx timeout [ 88.333231][ T5838] team0: Port device team_slave_0 added [ 88.357350][ T5841] team0: Port device team_slave_0 added [ 88.365409][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.378892][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.394341][ T5830] hsr_slave_0: entered promiscuous mode [ 88.401558][ T5830] hsr_slave_1: entered promiscuous mode [ 88.411393][ T5842] team0: Port device team_slave_0 added [ 88.420111][ T5838] team0: Port device team_slave_1 added [ 88.442572][ T5841] team0: Port device team_slave_1 added [ 88.477515][ T5842] team0: Port device team_slave_1 added [ 88.528012][ T5840] team0: Port device team_slave_0 added [ 88.548874][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.556042][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.582192][ T5838] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.608247][ T5841] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.615221][ T5841] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.641440][ T5841] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.654510][ T5840] team0: Port device team_slave_1 added [ 88.676090][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.683079][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.709220][ T5838] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.729079][ T5841] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.736680][ T5841] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.762827][ T5841] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.789362][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.796587][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.822557][ T5842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.899205][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.906421][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.932748][ T5842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.959489][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.967122][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.993500][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.051585][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.058996][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.085055][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.176602][ T5842] hsr_slave_0: entered promiscuous mode [ 89.182973][ T5842] hsr_slave_1: entered promiscuous mode [ 89.190188][ T5842] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.198019][ T5842] Cannot create hsr debugfs directory [ 89.209063][ T5838] hsr_slave_0: entered promiscuous mode [ 89.215349][ T5838] hsr_slave_1: entered promiscuous mode [ 89.222173][ T5838] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.230140][ T5838] Cannot create hsr debugfs directory [ 89.278319][ T5841] hsr_slave_0: entered promiscuous mode [ 89.284743][ T5841] hsr_slave_1: entered promiscuous mode [ 89.291122][ T5841] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.299070][ T5841] Cannot create hsr debugfs directory [ 89.452708][ T5840] hsr_slave_0: entered promiscuous mode [ 89.459523][ T5840] hsr_slave_1: entered promiscuous mode [ 89.466036][ T5840] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.473708][ T5840] Cannot create hsr debugfs directory [ 89.839714][ T5830] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 89.890619][ T5830] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 89.939192][ T5830] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 89.971095][ T5830] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 89.985803][ T5827] Bluetooth: hci0: command tx timeout [ 90.001910][ T5838] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 90.018159][ T5838] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 90.030944][ T5838] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 90.047751][ T5838] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.126522][ T5842] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 90.138055][ T5842] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 90.149858][ T5842] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 90.174024][ T5842] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 90.234126][ T5827] Bluetooth: hci3: command tx timeout [ 90.239703][ T5835] Bluetooth: hci1: command tx timeout [ 90.306249][ T5827] Bluetooth: hci2: command tx timeout [ 90.321123][ T5841] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 90.332059][ T5841] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 90.365385][ T5841] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 90.386070][ T5827] Bluetooth: hci4: command tx timeout [ 90.394476][ T5841] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 90.499088][ T5840] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 90.518334][ T5838] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.531029][ T5840] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 90.543418][ T5840] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 90.559775][ T5840] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 90.613502][ T5838] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.643259][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.664356][ T69] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.671680][ T69] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.702600][ T3507] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.709814][ T3507] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.773890][ T5830] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.804921][ T3028] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.812118][ T3028] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.833353][ T5842] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.850599][ T3028] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.857790][ T3028] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.973276][ T5842] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.011216][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.022423][ T3507] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.029644][ T3507] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.090653][ T1135] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.097869][ T1135] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.126400][ T5841] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.143182][ T5840] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.181523][ T5838] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.200521][ T3507] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.207728][ T3507] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.225921][ T5841] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.251556][ T3028] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.258831][ T3028] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.283187][ T3028] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.290339][ T3028] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.315193][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.329652][ T3028] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.336860][ T3028] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.497316][ T5838] veth0_vlan: entered promiscuous mode [ 91.517089][ T5842] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.553841][ T5838] veth1_vlan: entered promiscuous mode [ 91.609272][ T5830] veth0_vlan: entered promiscuous mode [ 91.630033][ T5841] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.645112][ T5830] veth1_vlan: entered promiscuous mode [ 91.679865][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.742919][ T5842] veth0_vlan: entered promiscuous mode [ 91.773696][ T5841] veth0_vlan: entered promiscuous mode [ 91.784854][ T5830] veth0_macvtap: entered promiscuous mode [ 91.804366][ T5838] veth0_macvtap: entered promiscuous mode [ 91.819302][ T5830] veth1_macvtap: entered promiscuous mode [ 91.830609][ T975] cfg80211: failed to load regulatory.db [ 91.843957][ T5841] veth1_vlan: entered promiscuous mode [ 91.852150][ T5838] veth1_macvtap: entered promiscuous mode [ 91.893669][ T5842] veth1_vlan: entered promiscuous mode [ 91.937050][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.949786][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.960935][ T5830] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.970932][ T5830] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.979903][ T5830] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.990436][ T5830] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.006648][ T5840] veth0_vlan: entered promiscuous mode [ 92.036872][ T5838] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.048456][ T5838] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.060121][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.068575][ T5827] Bluetooth: hci0: command tx timeout [ 92.098184][ T5838] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.110210][ T5838] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.125148][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.139026][ T5840] veth1_vlan: entered promiscuous mode [ 92.149343][ T5842] veth0_macvtap: entered promiscuous mode [ 92.180733][ T5841] veth0_macvtap: entered promiscuous mode [ 92.191472][ T5838] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.201769][ T5838] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.210644][ T5838] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.222853][ T5838] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.243492][ T5842] veth1_macvtap: entered promiscuous mode [ 92.258441][ T5841] veth1_macvtap: entered promiscuous mode [ 92.306507][ T5835] Bluetooth: hci1: command tx timeout [ 92.312030][ T5827] Bluetooth: hci3: command tx timeout [ 92.330892][ T3507] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.349383][ T3507] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.386576][ T5827] Bluetooth: hci2: command tx timeout [ 92.400296][ T5841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.411268][ T5841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.421739][ T5841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.432594][ T5841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.444451][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.460381][ T5842] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.471119][ T5842] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.482055][ T5827] Bluetooth: hci4: command tx timeout [ 92.488267][ T5842] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.499543][ T5842] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.509857][ T5842] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.521082][ T5842] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.533033][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.543882][ T5840] veth0_macvtap: entered promiscuous mode [ 92.564850][ T5842] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.575862][ T5842] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.588438][ T5842] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.600055][ T5842] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.611461][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.625412][ T5841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.627256][ T3028] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.642354][ T5841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.654650][ T5841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.661202][ T3028] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.668148][ T5841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.682417][ T5841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.692934][ T5841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.704853][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.721507][ T5840] veth1_macvtap: entered promiscuous mode [ 92.732236][ T5842] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.741222][ T5842] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.750197][ T5842] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.758984][ T5842] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.783352][ T5841] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.803518][ T5841] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.812928][ T5841] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.822147][ T5841] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.866934][ T5840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.874116][ T5830] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 92.878311][ T5840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.902538][ T5840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.913385][ T5840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.923303][ T5840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.933899][ T5840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.943894][ T5840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.954457][ T5840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.967043][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.000681][ T5840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.015431][ T5840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.026726][ T5840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.045936][ T5840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.066159][ T5840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.083706][ T5840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.093659][ T5840] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.111704][ T5840] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.123493][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.149907][ T1135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.161731][ T1135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.188811][ T5840] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.199130][ T5840] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.209315][ T5840] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.218712][ T5840] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.285112][ T5882] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 93.347657][ T3028] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.365200][ T3028] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.407221][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.434514][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.556977][ T3028] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.564932][ T3028] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.639885][ T3507] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.652235][ T3507] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.917626][ T1159] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.929585][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 93.953840][ T1159] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.964791][ T1135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.006015][ T1135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.016066][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 94.055930][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 94.128609][ T5893] xt_CT: You must specify a L4 protocol and not use inversions on it [ 94.134273][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 94.145900][ T0] NOHZ tick-stop error: local softirq work is pending, handler #342!!! [ 94.168626][ T5827] Bluetooth: hci0: command tx timeout [ 94.249560][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 94.259724][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 94.269898][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 94.326576][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 94.351890][ T1135] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.359894][ T5897] netlink: 'syz.0.7': attribute type 10 has an invalid length. [ 94.375852][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 94.389044][ T5827] Bluetooth: hci3: command tx timeout [ 94.389149][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 94.394477][ T5827] Bluetooth: hci1: command tx timeout [ 94.415067][ T1135] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.466835][ T5827] Bluetooth: hci2: command tx timeout [ 94.475806][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 94.555651][ T5827] Bluetooth: hci4: command tx timeout [ 94.561422][ T9] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 94.622718][ T5897] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 94.633016][ T9] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 94.666340][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.716314][ T5905] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 94.773303][ T9] usb 2-1: config 0 descriptor?? [ 94.835604][ T5904] netlink: 80 bytes leftover after parsing attributes in process `syz.2.3'. [ 94.936571][ T5897] syz.0.7 (5897) used greatest stack depth: 19976 bytes left [ 95.419797][ T5916] netlink: 44 bytes leftover after parsing attributes in process `syz.0.8'. [ 95.451521][ T5907] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5'. [ 96.208143][ T5929] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10'. [ 96.303261][ T5929] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 96.365717][ T5929] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 96.404189][ T5929] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 96.448575][ T5929] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 96.595844][ T5878] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 96.765893][ T2149] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 96.853785][ T5937] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13'. [ 96.902345][ T5937] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.910785][ T5937] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.005689][ T2149] usb 4-1: Using ep0 maxpacket: 32 [ 97.050225][ T5878] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 97.088734][ T2149] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 97.116962][ T5878] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 97.154845][ T5878] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 97.194688][ T5878] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.267611][ T2149] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 97.314068][ T2149] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 97.409143][ T5878] usb 3-1: config 0 descriptor?? [ 97.419792][ T2149] usb 4-1: Product: syz [ 97.446647][ T2149] usb 4-1: Manufacturer: syz [ 97.451322][ T2149] usb 4-1: SerialNumber: syz [ 97.494629][ T2149] usb 4-1: config 0 descriptor?? [ 97.516076][ T5934] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 97.557246][ T5876] usb 2-1: USB disconnect, device number 2 [ 97.583940][ T2149] hub 4-1:0.0: bad descriptor, ignoring hub [ 97.592080][ T5885] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 97.608539][ T2149] hub 4-1:0.0: probe with driver hub failed with error -5 [ 97.767315][ T5885] usb 1-1: Using ep0 maxpacket: 8 [ 97.808824][ T5885] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 56832, setting to 1024 [ 97.866096][ T5877] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 97.977690][ T5885] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1024 [ 98.039748][ T5885] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 98.049798][ T5885] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 98.049858][ T10] usb 4-1: USB disconnect, device number 2 [ 98.099838][ T5885] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 98.144971][ T5885] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.181292][ T5953] process 'syz.2.11' launched './file0' with NULL argv: empty string added [ 98.716650][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 98.778203][ T5877] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 98.800111][ T5877] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 98.832526][ T5877] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 98.832555][ T5885] usb 1-1: GET_CAPABILITIES returned 0 [ 98.861680][ T5877] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.895870][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 98.924276][ T5877] usb 5-1: config 0 descriptor?? [ 98.973308][ T5885] usbtmc 1-1:16.0: can't read capabilities [ 99.021391][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 99.039539][ T10] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 99.078763][ T10] usb 4-1: can't read configurations, error -71 [ 99.194815][ T5885] usb 1-1: USB disconnect, device number 2 [ 99.856007][ T5885] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 99.860887][ T5877] usb 3-1: USB disconnect, device number 2 [ 100.028462][ T5885] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 56832, setting to 64 [ 100.152242][ T5885] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 100.245030][ T5972] netlink: 104 bytes leftover after parsing attributes in process `syz.3.19'. [ 100.334020][ T5885] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 100.351475][ T5885] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.276053][ T5885] usb 1-1: can't set config #16, error -71 [ 101.288925][ T5885] usb 1-1: USB disconnect, device number 3 [ 101.728969][ T5877] usb 5-1: USB disconnect, device number 2 [ 101.766890][ T5980] 8021q: adding VLAN 0 to HW filter on device bond1 [ 101.904485][ T5987] loop2: detected capacity change from 0 to 7 [ 101.951497][ T5892] Dev loop2: unable to read RDB block 7 [ 101.959884][ T5892] loop2: unable to read partition table [ 101.966478][ T5892] loop2: partition table beyond EOD, truncated [ 101.995055][ T5987] Dev loop2: unable to read RDB block 7 [ 102.035616][ T5851] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 102.056669][ T5987] loop2: unable to read partition table [ 102.092366][ T5987] loop2: partition table beyond EOD, truncated [ 102.142365][ T5987] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 102.235231][ T5993] FAULT_INJECTION: forcing a failure. [ 102.235231][ T5993] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 102.265841][ T5993] CPU: 0 UID: 0 PID: 5993 Comm: syz.2.24 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) [ 102.265874][ T5993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 102.265891][ T5993] Call Trace: [ 102.265902][ T5993] [ 102.265911][ T5993] dump_stack_lvl+0x189/0x250 [ 102.265950][ T5993] ? __lock_acquire+0xaac/0xd20 [ 102.265980][ T5993] ? __pfx_dump_stack_lvl+0x10/0x10 [ 102.266007][ T5993] ? __pfx__printk+0x10/0x10 [ 102.266027][ T5993] ? __might_fault+0xb0/0x130 [ 102.266069][ T5993] should_fail_ex+0x414/0x560 [ 102.266106][ T5993] _copy_from_user+0x2d/0xb0 [ 102.266133][ T5993] get_compat_msghdr+0xad/0x4a0 [ 102.266163][ T5993] ? __pfx_get_compat_msghdr+0x10/0x10 [ 102.266188][ T5993] ? __lock_acquire+0xaac/0xd20 [ 102.266223][ T5993] ___sys_recvmsg+0x17f/0x510 [ 102.266256][ T5993] ? __pfx____sys_recvmsg+0x10/0x10 [ 102.266307][ T5993] ? __fget_files+0x3a0/0x420 [ 102.266344][ T5993] do_recvmmsg+0x36a/0x760 [ 102.266378][ T5993] ? __pfx_do_recvmmsg+0x10/0x10 [ 102.266417][ T5993] ? __pfx_vfs_write+0x10/0x10 [ 102.266456][ T5993] __sys_recvmmsg+0x19d/0x280 [ 102.266485][ T5993] ? __pfx___sys_recvmmsg+0x10/0x10 [ 102.266517][ T5993] ? ksys_write+0x1f0/0x250 [ 102.266548][ T5993] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 102.266577][ T5993] __do_fast_syscall_32+0xb4/0x110 [ 102.266602][ T5993] ? lockdep_hardirqs_on+0x9c/0x150 [ 102.266628][ T5993] do_fast_syscall_32+0x34/0x80 [ 102.266652][ T5993] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 102.266676][ T5993] RIP: 0023:0xf702e539 [ 102.266696][ T5993] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 102.266712][ T5993] RSP: 002b:00000000f501e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 102.266732][ T5993] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800018c0 [ 102.266746][ T5993] RDX: 0000000000000001 RSI: 0000000000010000 RDI: 0000000000000000 [ 102.266757][ T5993] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 102.266768][ T5993] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 102.266779][ T5993] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 102.266806][ T5993] [ 102.336036][ T5885] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 102.567852][ T5851] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 102.584067][ T5851] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 102.613343][ T5851] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 102.636413][ T5851] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.657153][ T5851] usb 2-1: config 0 descriptor?? [ 102.813630][ T5201] Dev loop2: unable to read RDB block 7 [ 102.823321][ T5998] qrtr: Invalid version 0 [ 102.835299][ T5201] loop2: unable to read partition table [ 102.852049][ T5201] loop2: partition table beyond EOD, truncated [ 102.866964][ T6001] netlink: 4 bytes leftover after parsing attributes in process `syz.2.26'. [ 102.877834][ T6001] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 102.954202][ T6001] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 103.038826][ T5885] usb 4-1: Using ep0 maxpacket: 8 [ 103.225604][ T5885] usb 4-1: config 0 has an invalid interface number: 32 but max is 0 [ 103.236794][ T5885] usb 4-1: config 0 has no interface number 0 [ 103.249316][ T6001] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 103.257029][ T5885] usb 4-1: config 0 interface 32 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 103.266035][ T5885] usb 4-1: New USB device found, idVendor=1397, idProduct=00bd, bcdDevice=d2.54 [ 103.286464][ T5885] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.287589][ T6001] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 103.294472][ T5885] usb 4-1: Product: syz [ 103.294491][ T5885] usb 4-1: Manufacturer: syz [ 103.294506][ T5885] usb 4-1: SerialNumber: syz [ 103.444819][ T52] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 103.470384][ T5885] usb 4-1: config 0 descriptor?? [ 103.565375][ T5885] usb 4-1: invalid MIDI EP [ 103.579112][ T5885] usb 4-1: snd-bcd2000: error during probing [ 103.701961][ T5885] snd-bcd2000 4-1:0.32: probe with driver snd-bcd2000 failed with error -22 [ 103.747776][ T52] usb 1-1: device descriptor read/64, error -71 [ 103.943053][ T5877] usb 4-1: USB disconnect, device number 5 [ 104.005794][ T52] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 104.175705][ T52] usb 1-1: device descriptor read/64, error -71 [ 104.317114][ T52] usb usb1-port1: attempt power cycle [ 104.385586][ T5877] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 104.547851][ T5877] usb 3-1: device descriptor read/64, error -71 [ 104.685694][ T52] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 104.709352][ T52] usb 1-1: device descriptor read/8, error -71 [ 104.785856][ T5877] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 105.195377][ T52] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 105.236691][ T52] usb 1-1: device descriptor read/8, error -71 [ 105.315629][ T5877] usb 3-1: device descriptor read/64, error -71 [ 105.369586][ T52] usb usb1-port1: unable to enumerate USB device [ 105.435603][ T10] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 105.459239][ T5877] usb usb3-port1: attempt power cycle [ 105.589234][ T5940] usb 2-1: USB disconnect, device number 3 [ 105.996547][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 106.025604][ T5877] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 106.040128][ T10] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 106.078664][ T5877] usb 3-1: device descriptor read/8, error -71 [ 106.141215][ T10] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 106.176122][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.185669][ T5940] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 106.222009][ T10] usb 4-1: config 0 descriptor?? [ 106.335237][ T6029] tipc: Failed to obtain node identity [ 106.335288][ T6029] tipc: Enabling of bearer rejected, failed to enable media [ 106.355882][ T5940] usb 2-1: Using ep0 maxpacket: 8 [ 106.404156][ T5940] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 56832, setting to 1024 [ 106.407683][ T5877] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 106.435849][ T5940] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1024 [ 106.435886][ T5940] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 106.435911][ T5940] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 106.437191][ T5940] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 106.437220][ T5940] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.503873][ T5877] usb 3-1: device descriptor read/8, error -71 [ 106.612377][ T5877] usb usb3-port1: unable to enumerate USB device [ 106.720059][ T5940] usb 2-1: GET_CAPABILITIES returned 0 [ 106.726410][ T5940] usbtmc 2-1:16.0: can't read capabilities [ 106.842826][ T6036] netlink: 104 bytes leftover after parsing attributes in process `syz.0.33'. [ 107.047064][ T6023] usb 2-1: usbtmc_ioctl_clear_in_halt returned -32 [ 107.074540][ T52] usb 2-1: USB disconnect, device number 4 [ 107.466692][ T52] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 107.678494][ T52] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 56832, setting to 64 [ 107.694331][ T52] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 107.745829][ T2149] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 107.775950][ T52] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 107.815629][ T52] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.873983][ T6045] 8021q: adding VLAN 0 to HW filter on device bond1 [ 107.897157][ T5885] usb 4-1: USB disconnect, device number 6 [ 107.960145][ T2149] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 108.026186][ T2149] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 108.046292][ T2149] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.059521][ T2149] usb 3-1: config 0 descriptor?? [ 108.088861][ T6051] netlink: 12 bytes leftover after parsing attributes in process `syz.3.37'. [ 108.139994][ T6052] program syz.3.37 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 108.204738][ T52] usb 2-1: usb_control_msg returned -32 [ 108.212380][ T52] usbtmc 2-1:16.0: can't read capabilities [ 108.995376][ C0] usbtmc 2-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 109.035713][ T6060] usbtmc 2-1:16.0: Unable to send data, error -71 [ 109.052628][ T2149] keytouch 0003:0926:3333.0001: fixing up Keytouch IEC report descriptor [ 109.170311][ T2149] input: HID 0926:3333 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0926:3333.0001/input/input5 [ 109.379916][ T2149] keytouch 0003:0926:3333.0001: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.2-1/input0 [ 109.787258][ T6065] netlink: 8 bytes leftover after parsing attributes in process `syz.3.50'. [ 110.101273][ T2149] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 110.215570][ T52] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 110.275703][ T2149] usb 4-1: Using ep0 maxpacket: 32 [ 110.302050][ T2149] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 110.326920][ T2149] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 110.347097][ T10] usb 2-1: USB disconnect, device number 5 [ 110.349298][ T2149] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 110.392359][ T52] usb 5-1: Using ep0 maxpacket: 32 [ 110.398706][ T2149] usb 4-1: Product: syz [ 110.410024][ T52] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 110.460213][ T2149] usb 4-1: Manufacturer: syz [ 110.473490][ T6071] qrtr: Invalid version 0 [ 110.473751][ T52] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 110.496705][ T2149] usb 4-1: SerialNumber: syz [ 110.511930][ T52] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 110.522848][ T2149] usb 4-1: config 0 descriptor?? [ 110.535199][ T52] usb 5-1: Product: syz [ 110.539990][ T6067] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 110.549063][ T2149] hub 4-1:0.0: bad descriptor, ignoring hub [ 110.555058][ T2149] hub 4-1:0.0: probe with driver hub failed with error -5 [ 110.563189][ T52] usb 5-1: Manufacturer: syz [ 110.567953][ T52] usb 5-1: SerialNumber: syz [ 110.586612][ T52] usb 5-1: config 0 descriptor?? [ 110.594801][ T6068] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 110.630669][ T52] hub 5-1:0.0: bad descriptor, ignoring hub [ 110.656476][ T52] hub 5-1:0.0: probe with driver hub failed with error -5 [ 110.687411][ T52] chaoskey 5-1:0.0: Unable to register with hwrng [ 111.080523][ T6065] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 111.096408][ T52] usb 5-1: USB disconnect, device number 3 [ 111.142092][ T6065] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 111.305599][ T52] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 111.365588][ T5877] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 111.546242][ T5877] usb 1-1: Using ep0 maxpacket: 16 [ 111.548413][ T5877] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 111.548466][ T5877] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 111.548484][ T5877] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.551018][ T5877] usb 1-1: config 0 descriptor?? [ 111.555951][ T5877] gspca_main: spca501-2.14.0 probing 0000:0000 [ 111.567339][ T9] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 111.656653][ T52] usb 2-1: device descriptor read/64, error -71 [ 111.699474][ T5851] raw-gadget.2 gadget.3: failed to queue suspend event [ 111.715973][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 111.765819][ T6068] raw-gadget.2 gadget.3: failed to queue resume event [ 111.814237][ T5851] raw-gadget.2 gadget.3: failed to queue suspend event [ 111.935758][ T6068] raw-gadget.2 gadget.3: failed to queue resume event [ 111.943578][ T52] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 111.979108][ T5885] raw-gadget.2 gadget.3: failed to queue suspend event [ 112.095659][ T6068] raw-gadget.2 gadget.3: failed to queue resume event [ 112.119487][ T5877] gspca_spca501: reg write: error -71 [ 112.126872][ T52] usb 2-1: device descriptor read/64, error -71 [ 112.155623][ T5877] spca501 1-1:0.0: Reg write failed for 0x02,0xa048,0x00 [ 112.212280][ T5877] spca501 1-1:0.0: probe with driver spca501 failed with error -22 [ 112.275958][ T5877] usb 1-1: USB disconnect, device number 8 [ 112.345210][ T2149] raw-gadget.2 gadget.3: failed to queue suspend event [ 112.352779][ T52] usb usb2-port1: attempt power cycle [ 112.393346][ T5851] usb 3-1: USB disconnect, device number 7 [ 112.460763][ T6068] raw-gadget.2 gadget.3: failed to queue resume event [ 112.498234][ T5879] raw-gadget.2 gadget.3: failed to queue suspend event [ 112.575655][ T6068] raw-gadget.2 gadget.3: failed to queue resume event [ 112.602372][ T10] raw-gadget.2 gadget.3: failed to queue suspend event [ 112.675731][ T6068] raw-gadget.2 gadget.3: failed to queue resume event [ 112.738028][ T5879] raw-gadget.2 gadget.3: failed to queue suspend event [ 112.758073][ T5877] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 112.808814][ T52] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 112.827268][ T6068] raw-gadget.2 gadget.3: failed to queue resume event [ 112.884172][ T52] usb 2-1: device descriptor read/8, error -71 [ 112.895728][ T6065] raw-gadget.2 gadget.3: failed to queue suspend event [ 112.904079][ T2149] usb 4-1: USB disconnect, device number 7 [ 112.913995][ T6065] raw-gadget.2 gadget.3: failed to queue disconnect event [ 112.948197][ T5877] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 113.013114][ T6095] FAULT_INJECTION: forcing a failure. [ 113.013114][ T6095] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 113.045538][ T6095] CPU: 1 UID: 0 PID: 6095 Comm: syz.2.45 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) [ 113.045566][ T6095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 113.045577][ T6095] Call Trace: [ 113.045585][ T6095] [ 113.045592][ T6095] dump_stack_lvl+0x189/0x250 [ 113.045624][ T6095] ? __lock_acquire+0xaac/0xd20 [ 113.045655][ T6095] ? __pfx_dump_stack_lvl+0x10/0x10 [ 113.045682][ T6095] ? __pfx__printk+0x10/0x10 [ 113.045701][ T6095] ? __might_fault+0xb0/0x130 [ 113.045731][ T6095] should_fail_ex+0x414/0x560 [ 113.045787][ T6095] _copy_from_user+0x2d/0xb0 [ 113.045819][ T6095] __sys_connect+0x123/0x440 [ 113.045843][ T6095] ? __pfx___sys_connect+0x10/0x10 [ 113.045880][ T6095] __ia32_sys_connect+0x7a/0x90 [ 113.045897][ T6095] __do_fast_syscall_32+0xb4/0x110 [ 113.045919][ T6095] ? lockdep_hardirqs_on+0x9c/0x150 [ 113.045946][ T6095] do_fast_syscall_32+0x34/0x80 [ 113.045970][ T6095] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 113.045993][ T6095] RIP: 0023:0xf702e539 [ 113.046011][ T6095] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 113.046024][ T6095] RSP: 002b:00000000f501e55c EFLAGS: 00000206 ORIG_RAX: 000000000000016a [ 113.046038][ T6095] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000b00 [ 113.046048][ T6095] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 113.046056][ T6095] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 113.046076][ T6095] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 113.046089][ T6095] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 113.046123][ T6095] [ 113.229528][ T5877] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.503982][ T52] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 113.534537][ T5877] usb 1-1: config 0 descriptor?? [ 113.537538][ C1] raw-gadget.0 gadget.1: ignoring, device is not running [ 113.546840][ T52] usb 2-1: device descriptor read/8, error -32 [ 113.548591][ T5877] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 113.559524][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 113.574581][ T9] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 113.587011][ T9] usb 5-1: can't read configurations, error -71 [ 113.656010][ T52] usb usb2-port1: unable to enumerate USB device [ 113.920337][ T6110] x_tables: duplicate underflow at hook 3 [ 113.991681][ T6112] netlink: 8 bytes leftover after parsing attributes in process `syz.4.54'. [ 114.036790][ T6112] netlink: 8 bytes leftover after parsing attributes in process `syz.4.54'. [ 114.867439][ T6120] netlink: 8 bytes leftover after parsing attributes in process `syz.2.55'. [ 115.165709][ T5851] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 115.355599][ T52] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 115.382059][ T5851] usb 3-1: Using ep0 maxpacket: 32 [ 115.438671][ T5851] usb 3-1: config 2 has an invalid interface number: 15 but max is 0 [ 115.454869][ T5851] usb 3-1: config 2 has 2 interfaces, different from the descriptor's value: 1 [ 115.516458][ T52] usb 5-1: Using ep0 maxpacket: 32 [ 115.534502][ T5877] gspca_stv06xx: I2C: Read error writing address: -71 [ 115.543532][ T5877] usb 1-1: USB disconnect, device number 9 [ 115.552737][ T5851] usb 3-1: config 2 has no interface number 1 [ 115.571664][ T52] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 115.593060][ T52] usb 5-1: config 0 has no interface number 0 [ 115.623134][ T52] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 115.629153][ T5851] usb 3-1: config 2 interface 15 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 115.657966][ T5851] usb 3-1: config 2 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 115.685391][ T5851] usb 3-1: config 2 interface 0 has no altsetting 0 [ 115.730685][ T5851] usb 3-1: New USB device found, idVendor=0471, idProduct=0312, bcdDevice=94.69 [ 115.740397][ T52] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.745594][ T5851] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.752878][ T52] usb 5-1: Product: syz [ 115.767207][ T5851] usb 3-1: Product: syz [ 115.772727][ T5851] usb 3-1: Manufacturer: syz [ 115.773973][ T52] usb 5-1: Manufacturer: syz [ 115.789238][ T5851] usb 3-1: SerialNumber: syz [ 115.830149][ T52] usb 5-1: SerialNumber: syz [ 115.850038][ T5851] pwc: Philips PCVC750K (ToUCam Pro Scan) USB webcam detected. [ 115.862905][ T52] usb 5-1: config 0 descriptor?? [ 115.882596][ T52] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 116.030439][ T5851] pwc: Failed to set LED on/off time (-71) [ 116.054207][ T5851] pwc: send_video_command error -71 [ 116.100524][ T5851] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 116.101120][ T52] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 116.133196][ T5851] Philips webcam 3-1:2.0: probe with driver Philips webcam failed with error -71 [ 116.156142][ T52] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 116.210152][ T5851] usb 3-1: USB disconnect, device number 8 [ 116.318893][ T6150] qrtr: Invalid version 0 [ 116.613531][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 116.625618][ T5885] usb 5-1: USB disconnect, device number 6 [ 116.644230][ T5885] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 116.722059][ T5885] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 116.864399][ T5885] quatech2 5-1:0.51: device disconnected [ 116.895919][ T5851] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 117.048916][ T6162] xt_bpf: check failed: parse error [ 117.066800][ T5851] usb 1-1: Using ep0 maxpacket: 8 [ 117.125290][ T5851] usb 1-1: config 1 has an invalid descriptor of length 129, skipping remainder of the config [ 117.285592][ T5851] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 8 [ 117.347238][ T5851] usb 1-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 117.383666][ T5851] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.670143][ T6191] bridge0: port 3(macvlan1) entered blocking state [ 118.679212][ T6191] bridge0: port 3(macvlan1) entered disabled state [ 118.686602][ T6191] macvlan1: entered allmulticast mode [ 118.692828][ T6191] veth1_vlan: entered allmulticast mode [ 118.722179][ T6191] macvlan1: entered promiscuous mode [ 118.749414][ T6191] bridge0: port 3(macvlan1) entered blocking state [ 118.756263][ T6191] bridge0: port 3(macvlan1) entered forwarding state [ 118.889091][ T6197] FAULT_INJECTION: forcing a failure. [ 118.889091][ T6197] name failslab, interval 1, probability 0, space 0, times 0 [ 118.908091][ T6197] CPU: 1 UID: 0 PID: 6197 Comm: syz.1.70 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) [ 118.908121][ T6197] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 118.908133][ T6197] Call Trace: [ 118.908142][ T6197] [ 118.908151][ T6197] dump_stack_lvl+0x189/0x250 [ 118.908188][ T6197] ? __pfx_dump_stack_lvl+0x10/0x10 [ 118.908216][ T6197] ? __pfx__printk+0x10/0x10 [ 118.908240][ T6197] ? __pfx___might_resched+0x10/0x10 [ 118.908258][ T6197] ? fs_reclaim_acquire+0x7d/0x100 [ 118.908290][ T6197] should_fail_ex+0x414/0x560 [ 118.908326][ T6197] should_failslab+0xa8/0x100 [ 118.908352][ T6197] __kmalloc_noprof+0xcb/0x4f0 [ 118.908374][ T6197] ? kfree+0x4d/0x440 [ 118.908393][ T6197] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 118.908421][ T6197] tomoyo_realpath_from_path+0xe3/0x5d0 [ 118.908446][ T6197] ? tomoyo_domain+0xda/0x130 [ 118.908475][ T6197] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 118.908505][ T6197] tomoyo_path_number_perm+0x1e8/0x5a0 [ 118.908538][ T6197] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 118.908610][ T6197] ? __fget_files+0x2a/0x420 [ 118.908639][ T6197] ? __fget_files+0x3a0/0x420 [ 118.908662][ T6197] ? __fget_files+0x2a/0x420 [ 118.908690][ T6197] security_file_ioctl_compat+0xcb/0x2d0 [ 118.908724][ T6197] __ia32_compat_sys_ioctl+0x128/0x840 [ 118.908766][ T6197] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 118.908787][ T6197] ? __fget_files+0x3a0/0x420 [ 118.908818][ T6197] ? fput+0xa0/0xd0 [ 118.908847][ T6197] ? ksys_write+0x1f0/0x250 [ 118.908876][ T6197] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 118.908900][ T6197] ? lockdep_hardirqs_on+0x9c/0x150 [ 118.908924][ T6197] __do_fast_syscall_32+0xb4/0x110 [ 118.908949][ T6197] ? lockdep_hardirqs_on+0x9c/0x150 [ 118.908983][ T6197] do_fast_syscall_32+0x34/0x80 [ 118.909012][ T6197] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 118.909036][ T6197] RIP: 0023:0xf7fd6539 [ 118.909052][ T6197] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 118.909069][ T6197] RSP: 002b:00000000f50f655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 118.909089][ T6197] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000c0105500 [ 118.909102][ T6197] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 118.909114][ T6197] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 118.909125][ T6197] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 118.909136][ T6197] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 118.909165][ T6197] [ 118.909321][ T6197] ERROR: Out of memory at tomoyo_realpath_from_path. [ 119.235566][ T5885] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 119.395609][ T5885] usb 3-1: Using ep0 maxpacket: 16 [ 119.410583][ T5885] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 119.434733][ T5885] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 119.463751][ T5885] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 119.513448][ T5885] usb 3-1: New USB device found, idVendor=0c70, idProduct=f014, bcdDevice= 0.00 [ 119.550557][ T5885] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.596991][ T5885] usb 3-1: config 0 descriptor?? [ 119.863949][ T52] usb 1-1: USB disconnect, device number 10 [ 119.904494][ T5827] Bluetooth: hci4: ACL packet for unknown connection handle 3840 [ 120.040782][ T6214] netlink: 20 bytes leftover after parsing attributes in process `syz.3.74'. [ 120.081334][ T6214] netlink: 64 bytes leftover after parsing attributes in process `syz.3.74'. [ 120.318558][ T6191] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 120.327248][ T52] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 120.336888][ T6191] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 120.359088][ T5885] usbhid 3-1:0.0: can't add hid device: -71 [ 120.365240][ T5885] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 120.402075][ T5885] usb 3-1: USB disconnect, device number 9 [ 120.486935][ T52] usb 1-1: Using ep0 maxpacket: 16 [ 120.494428][ T52] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 120.503404][ T52] usb 1-1: config 0 has no interface number 0 [ 120.509902][ T52] usb 1-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 120.525005][ T52] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 120.534548][ T52] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.543391][ T52] usb 1-1: Product: syz [ 120.548151][ T52] usb 1-1: Manufacturer: syz [ 120.552864][ T52] usb 1-1: SerialNumber: syz [ 120.561089][ T52] usb 1-1: config 0 descriptor?? [ 120.574164][ T6213] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 120.603948][ T52] asix 1-1:0.251: probe with driver asix failed with error -22 [ 120.827706][ T6239] hsr_slave_0: left promiscuous mode [ 120.842654][ T6213] Zero length message leads to an empty skb [ 120.913048][ T6239] hsr_slave_1: left promiscuous mode [ 120.933310][ T6245] FAULT_INJECTION: forcing a failure. [ 120.933310][ T6245] name failslab, interval 1, probability 0, space 0, times 0 [ 120.995631][ T6245] CPU: 1 UID: 0 PID: 6245 Comm: syz.4.80 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) [ 120.995660][ T6245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 120.995677][ T6245] Call Trace: [ 120.995685][ T6245] [ 120.995694][ T6245] dump_stack_lvl+0x189/0x250 [ 120.995732][ T6245] ? __pfx_dump_stack_lvl+0x10/0x10 [ 120.995761][ T6245] ? __pfx__printk+0x10/0x10 [ 120.995787][ T6245] ? __pfx___might_resched+0x10/0x10 [ 120.995811][ T6245] should_fail_ex+0x414/0x560 [ 120.995849][ T6245] should_failslab+0xa8/0x100 [ 120.995878][ T6245] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 120.995905][ T6245] ? __alloc_skb+0x112/0x2d0 [ 120.995932][ T6245] __alloc_skb+0x112/0x2d0 [ 120.995963][ T6245] netlink_sendmsg+0x5c6/0xb30 [ 120.995996][ T6245] ? __pfx_netlink_sendmsg+0x10/0x10 [ 120.996022][ T6245] ? aa_sock_msg_perm+0x94/0x160 [ 120.996046][ T6245] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 120.996068][ T6245] ? __pfx_netlink_sendmsg+0x10/0x10 [ 120.996091][ T6245] __sock_sendmsg+0x219/0x270 [ 120.996126][ T6245] sock_write_iter+0x258/0x330 [ 120.996159][ T6245] ? __pfx_sock_write_iter+0x10/0x10 [ 120.996201][ T6245] ? __pfx_aa_file_perm+0x10/0x10 [ 120.996231][ T6245] do_iter_readv_writev+0x56b/0x7f0 [ 120.996261][ T6245] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 120.996292][ T6245] ? bpf_lsm_file_permission+0x9/0x20 [ 120.996317][ T6245] ? security_file_permission+0x75/0x290 [ 120.996349][ T6245] ? rw_verify_area+0x258/0x650 [ 120.996376][ T6245] vfs_writev+0x306/0x9a0 [ 120.996404][ T6245] ? vfs_write+0x8d8/0xa90 [ 120.996433][ T6245] ? __pfx_vfs_writev+0x10/0x10 [ 120.996477][ T6245] ? __fget_files+0x2a/0x420 [ 120.996508][ T6245] ? __fget_files+0x3a0/0x420 [ 120.996534][ T6245] ? __fget_files+0x2a/0x420 [ 120.996568][ T6245] do_writev+0x14d/0x2d0 [ 120.996606][ T6245] ? __pfx_do_writev+0x10/0x10 [ 120.996636][ T6245] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 120.996662][ T6245] ? lockdep_hardirqs_on+0x9c/0x150 [ 120.996687][ T6245] __do_fast_syscall_32+0xb4/0x110 [ 120.996713][ T6245] ? lockdep_hardirqs_on+0x9c/0x150 [ 120.996739][ T6245] do_fast_syscall_32+0x34/0x80 [ 120.996764][ T6245] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 120.996788][ T6245] RIP: 0023:0xf7f38539 [ 120.996805][ T6245] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 120.996821][ T6245] RSP: 002b:00000000f505655c EFLAGS: 00000206 ORIG_RAX: 0000000000000092 [ 120.996842][ T6245] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 120.996856][ T6245] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 120.996867][ T6245] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 120.996878][ T6245] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 120.996889][ T6245] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 120.996917][ T6245] [ 121.294417][ C1] vkms_vblank_simulate: vblank timer overrun [ 121.591815][ T6255] FAULT_INJECTION: forcing a failure. [ 121.591815][ T6255] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 121.685969][ T6255] CPU: 1 UID: 0 PID: 6255 Comm: syz.4.82 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) [ 121.685997][ T6255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 121.686009][ T6255] Call Trace: [ 121.686017][ T6255] [ 121.686025][ T6255] dump_stack_lvl+0x189/0x250 [ 121.686057][ T6255] ? __lock_acquire+0xaac/0xd20 [ 121.686086][ T6255] ? __pfx_dump_stack_lvl+0x10/0x10 [ 121.686130][ T6255] ? __pfx__printk+0x10/0x10 [ 121.686150][ T6255] ? __might_fault+0xb0/0x130 [ 121.686187][ T6255] should_fail_ex+0x414/0x560 [ 121.686224][ T6255] _copy_from_user+0x2d/0xb0 [ 121.686256][ T6255] __sys_connect+0x123/0x440 [ 121.686282][ T6255] ? __pfx___sys_connect+0x10/0x10 [ 121.686327][ T6255] __ia32_sys_connect+0x7a/0x90 [ 121.686350][ T6255] __do_fast_syscall_32+0xb4/0x110 [ 121.686376][ T6255] ? lockdep_hardirqs_on+0x9c/0x150 [ 121.686403][ T6255] do_fast_syscall_32+0x34/0x80 [ 121.686427][ T6255] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 121.686450][ T6255] RIP: 0023:0xf7f38539 [ 121.686467][ T6255] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 121.686483][ T6255] RSP: 002b:00000000f505655c EFLAGS: 00000206 ORIG_RAX: 000000000000016a [ 121.686503][ T6255] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000340 [ 121.686516][ T6255] RDX: 000000000000006e RSI: 0000000000000000 RDI: 0000000000000000 [ 121.686536][ T6255] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 121.686547][ T6255] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 121.686558][ T6255] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 121.686586][ T6255] [ 121.867843][ C1] vkms_vblank_simulate: vblank timer overrun [ 122.256514][ T6272] qrtr: Invalid version 0 [ 122.616814][ T5851] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 122.778296][ T5851] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 122.803568][ T5851] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 122.845690][ T5880] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 122.888792][ T5851] usb 5-1: New USB device found, idVendor=0c70, idProduct=f00b, bcdDevice= 0.00 [ 122.959933][ T5851] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.003324][ T5851] usb 5-1: config 0 descriptor?? [ 123.020385][ T5880] usb 3-1: Using ep0 maxpacket: 8 [ 123.034720][ T6273] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 123.056802][ T5880] usb 3-1: config 1 has an invalid descriptor of length 129, skipping remainder of the config [ 123.091522][ T5880] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 8 [ 123.130082][ T5880] usb 3-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 123.169014][ T5880] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.490888][ T5851] usbhid 5-1:0.0: can't add hid device: -71 [ 123.501447][ T5851] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 123.522619][ T5851] usb 5-1: USB disconnect, device number 7 [ 124.328344][ T5877] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 124.505623][ T5877] usb 5-1: Using ep0 maxpacket: 32 [ 124.530897][ T5877] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 124.539667][ T5877] usb 5-1: config 0 has no interface number 0 [ 124.550890][ T5877] usb 5-1: config 0 interface 12 has no altsetting 0 [ 124.561385][ T5877] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 124.572209][ T5877] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.580956][ T5877] usb 5-1: Product: syz [ 124.585126][ T5877] usb 5-1: Manufacturer: syz [ 124.591952][ T5877] usb 5-1: SerialNumber: syz [ 124.603993][ T6314] bridge0: port 3(macvlan1) entered blocking state [ 124.613634][ T5877] usb 5-1: config 0 descriptor?? [ 124.618863][ T6314] bridge0: port 3(macvlan1) entered disabled state [ 124.630827][ T6314] macvlan1: entered allmulticast mode [ 124.636640][ T6314] veth1_vlan: entered allmulticast mode [ 124.643904][ T6314] macvlan1: entered promiscuous mode [ 124.650646][ T6314] bridge0: port 3(macvlan1) entered blocking state [ 124.657379][ T6314] bridge0: port 3(macvlan1) entered forwarding state [ 125.005558][ T52] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 125.153844][ T2149] usb 1-1: USB disconnect, device number 11 [ 125.161581][ T52] usb 4-1: Using ep0 maxpacket: 16 [ 125.172985][ T52] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 125.185209][ T52] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 125.210463][ T52] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 125.238065][ T52] usb 4-1: New USB device found, idVendor=0c70, idProduct=f014, bcdDevice= 0.00 [ 125.262532][ T52] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 125.364708][ T52] usb 4-1: config 0 descriptor?? [ 125.443326][ T5884] usb 3-1: USB disconnect, device number 10 [ 125.454106][ T6310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.466928][ T6310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 125.547287][ T5877] f81534 5-1:0.12: f81534_set_register: reg: 1003 data: e0 failed: -71 [ 125.555829][ T5877] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 125.573013][ T5877] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 125.643454][ T5877] f81534 5-1:0.12: probe with driver f81534 failed with error -71 [ 125.729503][ T5877] usb 5-1: USB disconnect, device number 8 [ 125.931397][ T5879] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 126.031601][ T6314] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 126.064108][ T6314] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 126.094983][ T52] usbhid 4-1:0.0: can't add hid device: -71 [ 126.120579][ T52] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 126.157271][ T52] usb 4-1: USB disconnect, device number 8 [ 126.205642][ T5879] usb 1-1: Using ep0 maxpacket: 32 [ 126.214033][ T5879] usb 1-1: config 0 has an invalid interface number: 91 but max is 0 [ 126.223608][ T5879] usb 1-1: config 0 has no interface number 0 [ 126.291455][ T6338] FAULT_INJECTION: forcing a failure. [ 126.291455][ T6338] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 126.308242][ T5879] usb 1-1: New USB device found, idVendor=1d4d, idProduct=0011, bcdDevice=b7.21 [ 126.322384][ T6338] CPU: 0 UID: 0 PID: 6338 Comm: syz.1.99 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) [ 126.322410][ T6338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 126.322421][ T6338] Call Trace: [ 126.322429][ T6338] [ 126.322437][ T6338] dump_stack_lvl+0x189/0x250 [ 126.322467][ T6338] ? __lock_acquire+0xaac/0xd20 [ 126.322496][ T6338] ? __pfx_dump_stack_lvl+0x10/0x10 [ 126.322523][ T6338] ? __pfx__printk+0x10/0x10 [ 126.322542][ T6338] ? __might_fault+0xb0/0x130 [ 126.322578][ T6338] should_fail_ex+0x414/0x560 [ 126.322614][ T6338] _copy_from_user+0x2d/0xb0 [ 126.322641][ T6338] raw_setsockopt+0x495/0x1160 [ 126.322667][ T6338] ? __pfx_aa_sk_perm+0x10/0x10 [ 126.322685][ T6338] ? __pfx_raw_setsockopt+0x10/0x10 [ 126.322714][ T6338] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 126.322736][ T6338] ? __pfx_raw_setsockopt+0x10/0x10 [ 126.322760][ T6338] do_sock_setsockopt+0x257/0x3e0 [ 126.322787][ T6338] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 126.322818][ T6338] ? ksys_write+0x1e1/0x250 [ 126.322847][ T6338] __ia32_sys_setsockopt+0x18b/0x220 [ 126.322889][ T6338] __do_fast_syscall_32+0xb4/0x110 [ 126.322912][ T6338] ? lockdep_hardirqs_on+0x9c/0x150 [ 126.322937][ T6338] do_fast_syscall_32+0x34/0x80 [ 126.322959][ T6338] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 126.322980][ T6338] RIP: 0023:0xf7fd6539 [ 126.322996][ T6338] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 126.323011][ T6338] RSP: 002b:00000000f50f655c EFLAGS: 00000206 ORIG_RAX: 000000000000016e [ 126.323029][ T6338] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000065 [ 126.323041][ T6338] RDX: 0000000000000005 RSI: 0000000080000100 RDI: 0000000000000004 [ 126.323051][ T6338] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 126.323061][ T6338] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 126.323071][ T6338] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 126.323096][ T6338] [ 126.529266][ C0] vkms_vblank_simulate: vblank timer overrun [ 126.542584][ T5879] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.550676][ T5879] usb 1-1: Product: syz [ 126.554849][ T5879] usb 1-1: Manufacturer: syz [ 126.559599][ T5879] usb 1-1: SerialNumber: syz [ 126.760429][ T5879] usb 1-1: config 0 descriptor?? [ 127.203070][ T6354] FAULT_INJECTION: forcing a failure. [ 127.203070][ T6354] name failslab, interval 1, probability 0, space 0, times 0 [ 127.235567][ T5879] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 127.242745][ T6354] CPU: 1 UID: 0 PID: 6354 Comm: syz.3.105 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) [ 127.242777][ T6354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 127.242790][ T6354] Call Trace: [ 127.242799][ T6354] [ 127.242808][ T6354] dump_stack_lvl+0x189/0x250 [ 127.242848][ T6354] ? __pfx_dump_stack_lvl+0x10/0x10 [ 127.242879][ T6354] ? __pfx__printk+0x10/0x10 [ 127.242908][ T6354] ? __pfx___might_resched+0x10/0x10 [ 127.242927][ T6354] ? fs_reclaim_acquire+0x7d/0x100 [ 127.242962][ T6354] should_fail_ex+0x414/0x560 [ 127.243002][ T6354] should_failslab+0xa8/0x100 [ 127.243033][ T6354] __kmalloc_noprof+0xcb/0x4f0 [ 127.243058][ T6354] ? kfree+0x4d/0x440 [ 127.243078][ T6354] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 127.243109][ T6354] tomoyo_realpath_from_path+0xe3/0x5d0 [ 127.243137][ T6354] ? tomoyo_domain+0xda/0x130 [ 127.243169][ T6354] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 127.243202][ T6354] tomoyo_path_number_perm+0x1e8/0x5a0 [ 127.243238][ T6354] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 127.243313][ T6354] ? __fget_files+0x2a/0x420 [ 127.243348][ T6354] ? __fget_files+0x3a0/0x420 [ 127.243374][ T6354] ? __fget_files+0x2a/0x420 [ 127.243407][ T6354] security_file_ioctl_compat+0xcb/0x2d0 [ 127.243455][ T6354] __ia32_compat_sys_ioctl+0x128/0x840 [ 127.243482][ T6354] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 127.243511][ T6354] ? __fget_files+0x3a0/0x420 [ 127.243546][ T6354] ? fput+0xa0/0xd0 [ 127.243577][ T6354] ? ksys_write+0x1f0/0x250 [ 127.243609][ T6354] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 127.243635][ T6354] ? lockdep_hardirqs_on+0x9c/0x150 [ 127.243662][ T6354] __do_fast_syscall_32+0xb4/0x110 [ 127.243701][ T6354] ? lockdep_hardirqs_on+0x9c/0x150 [ 127.243727][ T6354] do_fast_syscall_32+0x34/0x80 [ 127.243753][ T6354] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 127.243777][ T6354] RIP: 0023:0xf708e539 [ 127.243794][ T6354] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 127.243816][ T6354] RSP: 002b:00000000f507e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 127.243837][ T6354] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0306201 [ 127.243851][ T6354] RDX: 0000000080000640 RSI: 0000000000000000 RDI: 0000000000000000 [ 127.243863][ T6354] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 127.243874][ T6354] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 127.243886][ T6354] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 127.243916][ T6354] [ 127.244055][ T6354] ERROR: Out of memory at tomoyo_realpath_from_path. [ 127.294108][ T6356] qrtr: Invalid version 0 [ 127.451604][ C0] vkms_vblank_simulate: vblank timer overrun [ 127.556103][ T2149] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 127.597398][ T5879] usb 2-1: config 1 interface 0 altsetting 253 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 127.610706][ T5879] usb 2-1: config 1 interface 0 has no altsetting 0 [ 127.623016][ T5879] usb 2-1: string descriptor 0 read error: -22 [ 127.632946][ T5879] usb 2-1: New USB device found, idVendor=1784, idProduct=0004, bcdDevice= 0.40 [ 127.649003][ T5879] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.727061][ T2149] usb 5-1: too many configurations: 255, using maximum allowed: 8 [ 127.737429][ T2149] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 127.750038][ T2149] usb 5-1: can't read configurations, error -61 [ 127.756301][ T6365] netlink: 84 bytes leftover after parsing attributes in process `syz.3.109'. [ 127.855601][ T5884] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 127.886509][ T6344] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 127.895641][ T2149] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 127.896799][ T6344] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 127.917435][ T6344] netlink: 32 bytes leftover after parsing attributes in process `syz.1.101'. [ 127.965415][ T5879] usbhid 2-1:1.0: can't add hid device: -71 [ 127.972301][ T5879] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 127.991572][ T5879] usb 2-1: USB disconnect, device number 10 [ 128.028270][ T5884] usb 3-1: Using ep0 maxpacket: 8 [ 128.041871][ T5884] usb 3-1: config 1 has an invalid descriptor of length 129, skipping remainder of the config [ 128.075665][ T5884] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 8 [ 128.104250][ T5884] usb 3-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 128.114372][ T2149] usb 5-1: too many configurations: 255, using maximum allowed: 8 [ 128.125261][ T5884] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.135081][ T2149] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 128.143744][ T2149] usb 5-1: can't read configurations, error -61 [ 128.158107][ T2149] usb usb5-port1: attempt power cycle [ 128.385750][ T5940] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 128.414773][ T5851] usb 1-1: USB disconnect, device number 12 [ 128.515681][ T2149] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 128.538145][ T5940] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 128.553395][ T2149] usb 5-1: too many configurations: 255, using maximum allowed: 8 [ 128.562699][ T5940] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 128.573758][ T5940] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 128.584443][ T5940] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.593030][ T2149] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 128.601795][ T2149] usb 5-1: can't read configurations, error -61 [ 128.619189][ T5940] usb 4-1: config 0 descriptor?? [ 128.755688][ T2149] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 128.780291][ T2149] usb 5-1: too many configurations: 255, using maximum allowed: 8 [ 128.793705][ T2149] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 128.806893][ T2149] usb 5-1: can't read configurations, error -61 [ 128.814062][ T2149] usb usb5-port1: unable to enumerate USB device [ 128.978821][ T6392] FAULT_INJECTION: forcing a failure. [ 128.978821][ T6392] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 129.011036][ T6392] CPU: 1 UID: 0 PID: 6392 Comm: syz.1.116 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) [ 129.011068][ T6392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 129.011079][ T6392] Call Trace: [ 129.011087][ T6392] [ 129.011095][ T6392] dump_stack_lvl+0x189/0x250 [ 129.011127][ T6392] ? __lock_acquire+0xaac/0xd20 [ 129.011157][ T6392] ? __pfx_dump_stack_lvl+0x10/0x10 [ 129.011185][ T6392] ? __pfx__printk+0x10/0x10 [ 129.011204][ T6392] ? __might_fault+0xb0/0x130 [ 129.011239][ T6392] should_fail_ex+0x414/0x560 [ 129.011275][ T6392] _copy_from_user+0x2d/0xb0 [ 129.011308][ T6392] get_compat_msghdr+0xad/0x4a0 [ 129.011339][ T6392] ? __pfx_get_compat_msghdr+0x10/0x10 [ 129.011376][ T6392] ___sys_sendmsg+0x193/0x2a0 [ 129.011405][ T6392] ? __pfx____sys_sendmsg+0x10/0x10 [ 129.011468][ T6392] ? __fget_files+0x2a/0x420 [ 129.011492][ T6392] ? __fget_files+0x3a0/0x420 [ 129.011526][ T6392] __sys_sendmsg+0x164/0x220 [ 129.011553][ T6392] ? __pfx___sys_sendmsg+0x10/0x10 [ 129.011591][ T6392] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 129.011615][ T6392] ? lockdep_hardirqs_on+0x9c/0x150 [ 129.011639][ T6392] __do_fast_syscall_32+0xb4/0x110 [ 129.011665][ T6392] ? lockdep_hardirqs_on+0x9c/0x150 [ 129.011691][ T6392] do_fast_syscall_32+0x34/0x80 [ 129.011727][ T6392] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 129.011749][ T6392] RIP: 0023:0xf7fd6539 [ 129.011765][ T6392] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 129.011780][ T6392] RSP: 002b:00000000f50f655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 129.011799][ T6392] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000400 [ 129.011812][ T6392] RDX: 0000000002000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 129.011823][ T6392] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 129.011833][ T6392] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 129.011843][ T6392] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 129.011869][ T6392] [ 130.152839][ T5940] usbhid 4-1:0.0: can't add hid device: -71 [ 130.172308][ T5940] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 130.193797][ T5940] usb 4-1: USB disconnect, device number 9 [ 130.266478][ T2149] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 130.435846][ T2149] usb 2-1: device descriptor read/64, error -71 [ 130.505460][ T5851] usb 3-1: USB disconnect, device number 11 [ 130.675681][ T2149] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 130.725702][ T5884] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 130.825716][ T2149] usb 2-1: device descriptor read/64, error -71 [ 130.898168][ T5884] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 130.913695][ T5884] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 130.929696][ T5884] usb 5-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 130.940126][ T2149] usb usb2-port1: attempt power cycle [ 130.950814][ T5884] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.962910][ T5884] usb 5-1: config 0 descriptor?? [ 131.295810][ T2149] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 131.338913][ T2149] usb 2-1: device descriptor read/8, error -71 [ 131.389834][ T5884] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 131.406458][ T5884] cp2112 0003:10C4:EA90.0002: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.4-1/input0 [ 131.585054][ T5884] cp2112 0003:10C4:EA90.0002: Part Number: 0x82 Device Version: 0xFE [ 131.603344][ T2149] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 131.636388][ T2149] usb 2-1: device descriptor read/8, error -71 [ 131.718048][ T6440] netlink: 8 bytes leftover after parsing attributes in process `syz.2.132'. [ 131.740119][ T6440] gretap0: entered promiscuous mode [ 131.758202][ T2149] usb usb2-port1: unable to enumerate USB device [ 132.049304][ T6454] netlink: 24 bytes leftover after parsing attributes in process `syz.0.136'. [ 132.283597][ T5884] cp2112 0003:10C4:EA90.0002: error reading lock byte: -71 [ 132.329247][ T5884] usb 5-1: USB disconnect, device number 13 [ 132.799769][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.811915][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.044375][ T6470] kvm: requested 3352 ns i8254 timer period limited to 200000 ns [ 133.365133][ T6484] netlink: 164 bytes leftover after parsing attributes in process `syz.2.146'. [ 133.489133][ T6491] netlink: 'syz.0.147': attribute type 10 has an invalid length. [ 133.506142][ T6486] kvm: requested 3352 ns i8254 timer period limited to 200000 ns [ 133.515148][ T6491] netlink: 40 bytes leftover after parsing attributes in process `syz.0.147'. [ 133.576856][ T6491] team0: Port device geneve0 added [ 133.588651][ T6486] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 133.608677][ T6486] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 133.676295][ T6486] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 133.766363][ T6486] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 135.234750][ T5827] Bluetooth: hci3: unexpected event 0x34 length: 14 > 6 [ 135.318279][ T6543] bridge0: entered promiscuous mode [ 135.343945][ T6543] macvlan2: entered promiscuous mode [ 135.381256][ T6544] macvlan3: entered promiscuous mode [ 135.799389][ T6551] mmap: syz.1.168 (6551) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 135.964394][ T6559] sctp: [Deprecated]: syz.0.165 (pid 6559) Use of int in max_burst socket option. [ 135.964394][ T6559] Use struct sctp_assoc_value instead [ 135.979318][ T6559] FAULT_INJECTION: forcing a failure. [ 135.979318][ T6559] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 135.992656][ T6559] CPU: 0 UID: 0 PID: 6559 Comm: syz.0.165 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) [ 135.992684][ T6559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 135.992696][ T6559] Call Trace: [ 135.992704][ T6559] [ 135.992712][ T6559] dump_stack_lvl+0x189/0x250 [ 135.992750][ T6559] ? __pfx_dump_stack_lvl+0x10/0x10 [ 135.992779][ T6559] ? __pfx__printk+0x10/0x10 [ 135.992814][ T6559] should_fail_ex+0x414/0x560 [ 135.992852][ T6559] _copy_to_user+0x31/0xb0 [ 135.992881][ T6559] sctp_getsockopt_maxburst+0x37d/0x650 [ 135.992914][ T6559] ? __pfx_sctp_getsockopt_maxburst+0x10/0x10 [ 135.992953][ T6559] sctp_getsockopt+0x8bf/0xb60 [ 135.992987][ T6559] do_sock_getsockopt+0x35d/0x650 [ 135.993016][ T6559] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 135.993043][ T6559] ? __fget_files+0x2a/0x420 [ 135.993068][ T6559] ? __fget_files+0x3a0/0x420 [ 135.993092][ T6559] ? __fget_files+0x2a/0x420 [ 135.993125][ T6559] __ia32_sys_getsockopt+0x1a5/0x250 [ 135.993161][ T6559] __do_fast_syscall_32+0xb4/0x110 [ 135.993187][ T6559] ? lockdep_hardirqs_on+0x9c/0x150 [ 135.993214][ T6559] do_fast_syscall_32+0x34/0x80 [ 135.993239][ T6559] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 135.993263][ T6559] RIP: 0023:0xf70ce539 [ 135.993280][ T6559] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 135.993296][ T6559] RSP: 002b:00000000f507c55c EFLAGS: 00000206 ORIG_RAX: 000000000000016d [ 135.993317][ T6559] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000000000084 [ 135.993330][ T6559] RDX: 0000000000000014 RSI: 0000000080000000 RDI: 0000000080000580 [ 135.993342][ T6559] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 135.993353][ T6559] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 135.993365][ T6559] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 135.993393][ T6559] [ 136.190057][ C0] vkms_vblank_simulate: vblank timer overrun [ 136.755606][ T5851] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 136.927062][ T5851] usb 3-1: Using ep0 maxpacket: 8 [ 136.957494][ T5851] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 136.985674][ T5851] usb 3-1: config 179 has no interface number 0 [ 137.009398][ T5851] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 137.031391][ T6570] netlink: 942 bytes leftover after parsing attributes in process `syz.1.173'. [ 137.071532][ T5851] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 137.105910][ T5851] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 137.180289][ T5851] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 137.222655][ T5851] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 137.267728][ T5851] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 137.336534][ T5851] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.385289][ T6562] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 137.589636][ T6579] bond0: entered promiscuous mode [ 137.594832][ T6579] bond_slave_0: entered promiscuous mode [ 137.618096][ T6579] bond_slave_1: entered promiscuous mode [ 137.624375][ T6579] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 137.662216][ T6579] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 137.694679][ T6579] bond0: left promiscuous mode [ 137.702987][ T6582] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 137.744847][ T6579] bond_slave_0: left promiscuous mode [ 137.745199][ T6582] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 137.754843][ T6584] FAULT_INJECTION: forcing a failure. [ 137.754843][ T6584] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 137.771669][ T6584] CPU: 0 UID: 0 PID: 6584 Comm: syz.4.178 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) [ 137.771696][ T6584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 137.771712][ T6584] Call Trace: [ 137.771720][ T6584] [ 137.771727][ T6584] dump_stack_lvl+0x189/0x250 [ 137.771768][ T6584] ? __lock_acquire+0xaac/0xd20 [ 137.771799][ T6584] ? __pfx_dump_stack_lvl+0x10/0x10 [ 137.771826][ T6584] ? __pfx__printk+0x10/0x10 [ 137.771846][ T6584] ? __might_fault+0xb0/0x130 [ 137.771882][ T6584] should_fail_ex+0x414/0x560 [ 137.771919][ T6584] _copy_from_user+0x2d/0xb0 [ 137.771946][ T6584] get_compat_msghdr+0xad/0x4a0 [ 137.771976][ T6584] ? __pfx_get_compat_msghdr+0x10/0x10 [ 137.772012][ T6584] ___sys_sendmsg+0x193/0x2a0 [ 137.772041][ T6584] ? __pfx____sys_sendmsg+0x10/0x10 [ 137.772102][ T6584] ? __fget_files+0x2a/0x420 [ 137.772124][ T6584] ? __fget_files+0x3a0/0x420 [ 137.772159][ T6584] __sys_sendmsg+0x164/0x220 [ 137.772187][ T6584] ? __pfx___sys_sendmsg+0x10/0x10 [ 137.772227][ T6584] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 137.772252][ T6584] ? lockdep_hardirqs_on+0x9c/0x150 [ 137.772277][ T6584] __do_fast_syscall_32+0xb4/0x110 [ 137.772302][ T6584] ? lockdep_hardirqs_on+0x9c/0x150 [ 137.772328][ T6584] do_fast_syscall_32+0x34/0x80 [ 137.772353][ T6584] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 137.772376][ T6584] RIP: 0023:0xf7f38539 [ 137.772392][ T6584] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 137.772406][ T6584] RSP: 002b:00000000f505655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 137.772426][ T6584] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000240 [ 137.772439][ T6584] RDX: 0000000000004000 RSI: 0000000000000000 RDI: 0000000000000000 [ 137.772450][ T6584] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 137.772461][ T6584] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 137.772472][ T6584] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 137.772500][ T6584] [ 137.984527][ C0] vkms_vblank_simulate: vblank timer overrun [ 137.996479][ T6579] bond_slave_1: left promiscuous mode [ 138.020417][ T6579] mac80211_hwsim hwsim5 wlan1: left promiscuous mode [ 138.366026][ T5884] usb 5-1: new full-speed USB device number 14 using dummy_hcd [ 138.552092][ T5884] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 138.569193][ T5884] usb 5-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 138.661983][ T5884] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 138.685650][ T5884] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.721621][ T5884] usb 5-1: Product: syz [ 138.726274][ T5884] usb 5-1: Manufacturer: syz [ 138.805993][ T5884] usb 5-1: SerialNumber: syz [ 139.287601][ T2149] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 139.446231][ T2149] usb 2-1: Using ep0 maxpacket: 8 [ 139.453954][ T2149] usb 2-1: unable to get BOS descriptor or descriptor too short [ 139.474129][ T2149] usb 2-1: config 11 has an invalid interface number: 244 but max is 0 [ 139.494923][ T2149] usb 2-1: config 11 has no interface number 0 [ 139.511760][ T2149] usb 2-1: config 11 interface 244 altsetting 5 endpoint 0x3 has invalid wMaxPacketSize 0 [ 139.526626][ T5940] usb 3-1: USB disconnect, device number 12 [ 139.527373][ C0] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 139.540983][ C0] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 139.549868][ C0] ================================================================== [ 139.557962][ C0] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x23d/0x290 [ 139.565804][ C0] Read of size 4 at addr ffff88802fd8805c by task ksoftirqd/0/15 [ 139.573534][ C0] [ 139.575871][ C0] CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) [ 139.575894][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 139.575906][ C0] Call Trace: [ 139.575914][ C0] [ 139.575923][ C0] dump_stack_lvl+0x189/0x250 [ 139.575954][ C0] ? __virt_addr_valid+0x18c/0x540 [ 139.575979][ C0] ? rcu_is_watching+0x15/0xb0 [ 139.576007][ C0] ? __kasan_check_byte+0x12/0x40 [ 139.576030][ C0] ? __pfx_dump_stack_lvl+0x10/0x10 [ 139.576056][ C0] ? rcu_is_watching+0x15/0xb0 [ 139.576086][ C0] ? lock_release+0x4b/0x3e0 [ 139.576115][ C0] ? __virt_addr_valid+0x18c/0x540 [ 139.576141][ C0] ? __virt_addr_valid+0x469/0x540 [ 139.576167][ C0] print_report+0xb4/0x290 [ 139.576190][ C0] ? do_raw_spin_lock+0x23d/0x290 [ 139.576210][ C0] kasan_report+0x118/0x150 [ 139.576236][ C0] ? do_raw_spin_lock+0x23d/0x290 [ 139.576277][ C0] do_raw_spin_lock+0x23d/0x290 [ 139.576299][ C0] ? __wake_up_common_lock+0x2f/0x1f0 [ 139.576325][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 139.576352][ C0] _raw_spin_lock_irqsave+0xb3/0xf0 [ 139.576373][ C0] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 139.576394][ C0] ? kcov_remote_stop+0x78/0x6d0 [ 139.576421][ C0] __wake_up_common_lock+0x2f/0x1f0 [ 139.576450][ C0] __usb_hcd_giveback_urb+0x4d7/0x690 [ 139.576470][ C0] ? usb_hcd_unlink_urb_from_ep+0x2c/0x110 [ 139.576504][ C0] ? __pfx___usb_hcd_giveback_urb+0x10/0x10 [ 139.576528][ C0] ? usb_hcd_giveback_urb+0x10e/0x420 [ 139.576561][ C0] dummy_timer+0x862/0x4550 [ 139.576605][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 139.576641][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 139.576671][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 139.576699][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 139.576734][ C0] __hrtimer_run_queues+0x529/0xc60 [ 139.576772][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 139.576801][ C0] ? read_tsc+0x9/0x20 [ 139.576819][ C0] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 139.576854][ C0] hrtimer_run_softirq+0x187/0x2b0 [ 139.576888][ C0] handle_softirqs+0x283/0x870 [ 139.576918][ C0] ? schedule+0x165/0x360 [ 139.576939][ C0] ? run_ksoftirqd+0x9b/0x100 [ 139.576961][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 139.576994][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 139.577027][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 139.577058][ C0] run_ksoftirqd+0x9b/0x100 [ 139.577077][ C0] ? __pfx_run_ksoftirqd+0x10/0x10 [ 139.577101][ C0] smpboot_thread_fn+0x53f/0xa60 [ 139.577131][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 139.577166][ C0] kthread+0x70e/0x8a0 [ 139.577190][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 139.577220][ C0] ? __pfx_kthread+0x10/0x10 [ 139.577243][ C0] ? __pfx_kthread+0x10/0x10 [ 139.577265][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 139.577284][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 139.577305][ C0] ? __pfx_kthread+0x10/0x10 [ 139.577327][ C0] ret_from_fork+0x4b/0x80 [ 139.577346][ C0] ? __pfx_kthread+0x10/0x10 [ 139.577368][ C0] ret_from_fork_asm+0x1a/0x30 [ 139.577394][ C0] [ 139.577402][ C0] [ 139.862818][ T6586] netlink: 'syz.4.179': attribute type 10 has an invalid length. [ 139.865764][ C0] Allocated by task 5851: [ 139.865779][ C0] kasan_save_track+0x3e/0x80 [ 139.865803][ C0] __kasan_kmalloc+0x93/0xb0 [ 139.865825][ C0] __kmalloc_cache_noprof+0x230/0x3d0 [ 139.907240][ C0] xpad_probe+0x41c/0x1ed0 [ 139.911665][ C0] usb_probe_interface+0x641/0xbc0 [ 139.916804][ C0] really_probe+0x26a/0x9a0 [ 139.921319][ C0] __driver_probe_device+0x18c/0x2f0 [ 139.926607][ C0] driver_probe_device+0x4f/0x430 [ 139.931646][ C0] __device_attach_driver+0x2ce/0x530 [ 139.937043][ C0] bus_for_each_drv+0x24e/0x2e0 [ 139.941920][ C0] __device_attach+0x2b8/0x400 [ 139.946878][ C0] bus_probe_device+0x185/0x260 [ 139.951743][ C0] device_add+0x7b6/0xb50 [ 139.956086][ C0] usb_set_configuration+0x1a87/0x20e0 [ 139.961583][ C0] usb_generic_driver_probe+0x8d/0x150 [ 139.967071][ C0] usb_probe_device+0x1c1/0x390 [ 139.971957][ C0] really_probe+0x26a/0x9a0 [ 139.976481][ C0] __driver_probe_device+0x18c/0x2f0 [ 139.981788][ C0] driver_probe_device+0x4f/0x430 [ 139.986844][ C0] __device_attach_driver+0x2ce/0x530 [ 139.992244][ C0] bus_for_each_drv+0x24e/0x2e0 [ 139.997120][ C0] __device_attach+0x2b8/0x400 [ 140.001904][ C0] bus_probe_device+0x185/0x260 [ 140.006761][ C0] device_add+0x7b6/0xb50 [ 140.011102][ C0] usb_new_device+0xa39/0x16c0 [ 140.015900][ C0] hub_event+0x2941/0x4a00 [ 140.020370][ C0] process_scheduled_works+0xadb/0x17a0 [ 140.025945][ C0] worker_thread+0x8a0/0xda0 [ 140.030554][ C0] kthread+0x70e/0x8a0 [ 140.034647][ C0] ret_from_fork+0x4b/0x80 [ 140.039086][ C0] ret_from_fork_asm+0x1a/0x30 [ 140.043859][ C0] [ 140.046200][ C0] Freed by task 5940: [ 140.050188][ C0] kasan_save_track+0x3e/0x80 [ 140.054882][ C0] kasan_save_free_info+0x46/0x50 [ 140.059931][ C0] __kasan_slab_free+0x62/0x70 [ 140.064700][ C0] kfree+0x193/0x440 [ 140.068602][ C0] xpad_disconnect+0x350/0x480 [ 140.073377][ C0] usb_unbind_interface+0x26b/0x8f0 [ 140.078599][ C0] device_release_driver_internal+0x4d6/0x7c0 [ 140.084856][ C0] bus_remove_device+0x34d/0x410 [ 140.089801][ C0] device_del+0x511/0x8e0 [ 140.094140][ C0] usb_disable_device+0x3e9/0x8a0 [ 140.099184][ C0] usb_disconnect+0x330/0x910 [ 140.103868][ C0] hub_event+0x1cdb/0x4a00 [ 140.108297][ C0] process_scheduled_works+0xadb/0x17a0 [ 140.113943][ C0] worker_thread+0x8a0/0xda0 [ 140.118543][ C0] kthread+0x70e/0x8a0 [ 140.122620][ C0] ret_from_fork+0x4b/0x80 [ 140.127038][ C0] ret_from_fork_asm+0x1a/0x30 [ 140.131814][ C0] [ 140.134149][ C0] The buggy address belongs to the object at ffff88802fd88000 [ 140.134149][ C0] which belongs to the cache kmalloc-1k of size 1024 [ 140.148211][ C0] The buggy address is located 92 bytes inside of [ 140.148211][ C0] freed 1024-byte region [ffff88802fd88000, ffff88802fd88400) [ 140.162110][ C0] [ 140.164438][ C0] The buggy address belongs to the physical page: [ 140.170867][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2fd88 [ 140.179664][ C0] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 140.188176][ C0] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 140.196166][ C0] page_type: f5(slab) [ 140.200175][ C0] raw: 00fff00000000040 ffff88801a041dc0 0000000000000000 dead000000000001 [ 140.208775][ C0] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 140.217397][ C0] head: 00fff00000000040 ffff88801a041dc0 0000000000000000 dead000000000001 [ 140.226096][ C0] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 140.234778][ C0] head: 00fff00000000003 ffffea0000bf6201 00000000ffffffff 00000000ffffffff [ 140.243468][ C0] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 140.252162][ C0] page dumped because: kasan: bad access detected [ 140.258607][ C0] page_owner tracks the page as allocated [ 140.264339][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5640, tgid 5640 (dhcpcd), ts 57038702064, free_ts 56902361881 [ 140.285199][ C0] post_alloc_hook+0x1d8/0x230 [ 140.289998][ C0] get_page_from_freelist+0x21ce/0x22b0 [ 140.295579][ C0] __alloc_frozen_pages_noprof+0x181/0x370 [ 140.301415][ C0] alloc_pages_mpol+0x232/0x4a0 [ 140.306286][ C0] allocate_slab+0x8a/0x3b0 [ 140.310805][ C0] ___slab_alloc+0xbfc/0x1480 [ 140.315498][ C0] __kmalloc_node_track_caller_noprof+0x2f8/0x4e0 [ 140.321939][ C0] kmemdup_array+0x3f/0x80 [ 140.326364][ C0] bpf_prepare_filter+0xd67/0x12c0 [ 140.331498][ C0] bpf_prog_create_from_user+0x2c8/0x440 [ 140.337143][ C0] do_seccomp+0x7b1/0xd90 [ 140.341493][ C0] __se_sys_prctl+0xb6a/0x1910 [ 140.346269][ C0] do_syscall_64+0xf6/0x210 [ 140.350875][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.356776][ C0] page last free pid 5495 tgid 5495 stack trace: [ 140.363094][ C0] __free_frozen_pages+0xb0e/0xcd0 [ 140.368209][ C0] __put_partials+0x161/0x1c0 [ 140.372889][ C0] put_cpu_partial+0x17c/0x250 [ 140.377682][ C0] __slab_free+0x2f7/0x400 [ 140.382114][ C0] qlist_free_all+0x9a/0x140 [ 140.386714][ C0] kasan_quarantine_reduce+0x148/0x160 [ 140.392191][ C0] __kasan_slab_alloc+0x22/0x80 [ 140.397036][ C0] __kvmalloc_node_noprof+0x2b7/0x5e0 [ 140.402419][ C0] proc_sys_call_handler+0x3f2/0x7c0 [ 140.407698][ C0] vfs_read+0x4cd/0x980 [ 140.411859][ C0] ksys_read+0x145/0x250 [ 140.416132][ C0] do_syscall_64+0xf6/0x210 [ 140.420675][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.426612][ C0] [ 140.428947][ C0] Memory state around the buggy address: [ 140.434585][ C0] ffff88802fd87f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 140.442773][ C0] ffff88802fd87f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 140.450847][ C0] >ffff88802fd88000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 140.458934][ C0] ^ [ 140.465895][ C0] ffff88802fd88080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 140.473969][ C0] ffff88802fd88100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 140.482059][ C0] ================================================================== [ 140.490161][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 140.497374][ C0] CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.15.0-rc5-syzkaller-00022-g01f95500a162 #0 PREEMPT(full) [ 140.509272][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 140.519335][ C0] Call Trace: [ 140.522629][ C0] [ 140.525570][ C0] dump_stack_lvl+0x99/0x250 [ 140.530204][ C0] ? __asan_memcpy+0x40/0x70 [ 140.534799][ C0] ? __pfx_dump_stack_lvl+0x10/0x10 [ 140.540023][ C0] ? __pfx__printk+0x10/0x10 [ 140.544624][ C0] panic+0x2db/0x790 [ 140.548552][ C0] ? __pfx_panic+0x10/0x10 [ 140.552998][ C0] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 140.558929][ C0] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 140.565259][ C0] ? print_memory_metadata+0x314/0x400 [ 140.570727][ C0] ? do_raw_spin_lock+0x23d/0x290 [ 140.575770][ C0] check_panic_on_warn+0x89/0xb0 [ 140.580731][ C0] ? do_raw_spin_lock+0x23d/0x290 [ 140.585790][ C0] end_report+0x78/0x160 [ 140.590046][ C0] kasan_report+0x129/0x150 [ 140.594581][ C0] ? do_raw_spin_lock+0x23d/0x290 [ 140.599648][ C0] do_raw_spin_lock+0x23d/0x290 [ 140.604518][ C0] ? __wake_up_common_lock+0x2f/0x1f0 [ 140.609909][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 140.615313][ C0] _raw_spin_lock_irqsave+0xb3/0xf0 [ 140.620530][ C0] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 140.626442][ C0] ? kcov_remote_stop+0x78/0x6d0 [ 140.631393][ C0] __wake_up_common_lock+0x2f/0x1f0 [ 140.636616][ C0] __usb_hcd_giveback_urb+0x4d7/0x690 [ 140.642000][ C0] ? usb_hcd_unlink_urb_from_ep+0x2c/0x110 [ 140.647832][ C0] ? __pfx___usb_hcd_giveback_urb+0x10/0x10 [ 140.653748][ C0] ? usb_hcd_giveback_urb+0x10e/0x420 [ 140.659134][ C0] dummy_timer+0x862/0x4550 [ 140.663672][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 140.669057][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 140.674008][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 140.678972][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 140.683921][ C0] __hrtimer_run_queues+0x529/0xc60 [ 140.689148][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 140.694892][ C0] ? read_tsc+0x9/0x20 [ 140.698963][ C0] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 140.704788][ C0] hrtimer_run_softirq+0x187/0x2b0 [ 140.709923][ C0] handle_softirqs+0x283/0x870 [ 140.714703][ C0] ? schedule+0x165/0x360 [ 140.719041][ C0] ? run_ksoftirqd+0x9b/0x100 [ 140.723741][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 140.729058][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 140.734102][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 140.739173][ C0] run_ksoftirqd+0x9b/0x100 [ 140.743679][ C0] ? __pfx_run_ksoftirqd+0x10/0x10 [ 140.748795][ C0] smpboot_thread_fn+0x53f/0xa60 [ 140.753741][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 140.758799][ C0] kthread+0x70e/0x8a0 [ 140.762891][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 140.768375][ C0] ? __pfx_kthread+0x10/0x10 [ 140.773004][ C0] ? __pfx_kthread+0x10/0x10 [ 140.777700][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 140.782907][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 140.788114][ C0] ? __pfx_kthread+0x10/0x10 [ 140.792716][ C0] ret_from_fork+0x4b/0x80 [ 140.797132][ C0] ? __pfx_kthread+0x10/0x10 [ 140.801734][ C0] ret_from_fork_asm+0x1a/0x30 [ 140.806511][ C0] [ 140.809857][ C0] Kernel Offset: disabled [ 140.814184][ C0] Rebooting in 86400 seconds..