last executing test programs: 12m21.137012462s ago: executing program 1 (id=137): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x147e, &(0x7f0000000080)={0x0, 0x1010b6, 0x80, 0x400002, 0x403ae}, &(0x7f00000003c0)=0x0, &(0x7f0000000340)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000240)=0xfffffc04, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_SENDMSG={0x9, 0x40, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@pppoe={0x18, 0x0, {0x2, @random="400000009000", 'veth1_to_team\x00'}}, 0xffffffffffffffd4, 0x0}, 0x0, 0x20040000}) io_uring_enter(r2, 0x1ae0, 0x4, 0x48, 0x0, 0x0) 12m18.556062971s ago: executing program 1 (id=146): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040bd28090900000000000109022400cc0000000009040000020300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) mq_notify(0xffffffffffffffff, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x18, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\a'], 0x0, 0x0, 0x0, 0x0}, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffff7f}]}) close_range(r2, 0xffffffffffffffff, 0x0) 12m16.036502488s ago: executing program 1 (id=152): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) connect$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r2, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x3ec0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) ppoll(&(0x7f0000000040)=[{r1, 0x245}, {r1, 0x6200}], 0x2, 0x0, 0x0, 0x0) close(0x3) 12m15.715947198s ago: executing program 1 (id=154): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x26020480) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x80000, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) 12m14.700146045s ago: executing program 1 (id=161): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x5, 0x5, 0x2, 0x4}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001c40)={0x64142b0381a2aa16, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000001bc6500850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x8001, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000005"], 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 12m14.417983636s ago: executing program 1 (id=164): set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x41000, 0x53, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100}, 0x94) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x11}, 0x1, 0x0, 0x0, 0xc00}, 0x0) r0 = syz_io_uring_setup(0x24fe, &(0x7f0000000580)={0x0, 0xf36e, 0x10100, 0x4, 0xfffffffe}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000004c0)=""/120, 0x78}], 0x1) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='='], 0x38}}, 0x80) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x100000d, 0x12, r3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_FALLOCATE={0x11, 0x10, 0x0, @fd_index=0x8, 0xfff, 0x0, 0x6, 0x0, 0x1}) io_uring_enter(r0, 0x6686, 0x2936, 0x28, 0x0, 0x0) 12m13.472553653s ago: executing program 32 (id=164): set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x41000, 0x53, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100}, 0x94) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x11}, 0x1, 0x0, 0x0, 0xc00}, 0x0) r0 = syz_io_uring_setup(0x24fe, &(0x7f0000000580)={0x0, 0xf36e, 0x10100, 0x4, 0xfffffffe}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000004c0)=""/120, 0x78}], 0x1) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='='], 0x38}}, 0x80) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x100000d, 0x12, r3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_FALLOCATE={0x11, 0x10, 0x0, @fd_index=0x8, 0xfff, 0x0, 0x6, 0x0, 0x1}) io_uring_enter(r0, 0x6686, 0x2936, 0x28, 0x0, 0x0) 19.112754994s ago: executing program 5 (id=2164): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xffffffffffffff2c}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}, {&(0x7f0000000100)='p', 0x1}], 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='*'], 0x50) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) 16.553625505s ago: executing program 5 (id=2169): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_open_dev$video4linux(0x0, 0x7fff, 0x48b03) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r2, 0x80085665, &(0x7f00000003c0)={0x3, 0x101}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video4linux(0x0, 0x3, 0x3cf281) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(0xffffffffffffffff, 0xc01064c8, &(0x7f0000000300)={0xffffffffffffff5e, 0x0, 0x0}) ioctl$SNDRV_TIMER_IOCTL_INFO(0xffffffffffffffff, 0x80e85411, 0x0) getpid() syz_80211_join_ibss(0x0, &(0x7f00000002c0)=@default_ap_ssid, 0x6, 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) 14.18884708s ago: executing program 0 (id=2172): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x123e00, 0x0) ioctl$TCSBRKP(r0, 0x5425, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000180)='net/unix\x00') ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000}) read$FUSE(r4, &(0x7f00000025c0)={0x2020}, 0x2020) preadv(r4, &(0x7f00000003c0)=[{&(0x7f0000000000)=""/100, 0x64}], 0x1, 0x80000000, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) r5 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x800, 0xffffffff, 0xbfe00000}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r5, 0x47f6, 0x0, 0x2, 0x0, 0x300) 13.832554203s ago: executing program 5 (id=2173): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp256-generic\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$sock(r1, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000000340)="8224aca5f41b9e0ec5e7a706c919e7c0e343f0cd0a779c17e7f992396b09252009d2d12e9475a57ec39f71417044cf4151af34ac1dfd5d87cdd80bc4c24478821f64d4d971bbc1fc7bdd181a839344917165bb9cd0fa568aac55d8e38ee30fd3a9bc63e2656b6941c812e6ea0692ec276deb2b7b817906cf8c5429a42164e8bb521e216e554d509a0fd0d86729b5f4b9a01fb336bef1be8a68a628452b83", 0x9e}, {0x0}, {&(0x7f00000005c0)="f2b314c96d500b66f7fd46", 0xb}], 0x3}}], 0x1, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000002c0)="36c1fefc4a84cb34adfedaf464", 0xd}], 0x1, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffd}}, @dstopts_2292={{0x128, 0x29, 0x4, {0x4, 0x21, '\x00', [@calipso={0x7, 0x10, {0x1, 0x2, 0x9, 0x9f, [0x8]}}, @generic={0xfe, 0x72, "f4a4a3142ee1e12b9826287997a6b33d89f3d60da1641d9fe3896c3c1b6c130ef4f01be8f5836d417874540898619050b14420ab124b11de36afb16ef4fc1cf3f4e4fa0e647cd1b07b068d3894180b6aa7527a4a8252f6836a0d67a7782c675a838ea989e567e4774de1f52d188e0b0888c5"}, @generic={0x80, 0xf, "09e12e5f0b6bdcf72f2ec7008a15fa"}, @calipso={0x7, 0x40, {0x1, 0xe, 0x7a, 0x8001, [0x5, 0x9, 0x4, 0x6, 0x4, 0x400, 0xb]}}, @ra={0x5, 0x2, 0xa7e}, @pad1, @ra={0x5, 0x2, 0xbf4}, @hao={0xc9, 0x10, @private2}, @generic={0x93, 0x11, "e80ee304ecb784ec4655260cecea14e498"}]}}}, @hoplimit={{0x14}}, @hopopts={{0x198, 0x29, 0x36, {0x5e, 0x2f, '\x00', [@generic={0xff, 0x23, "50d650847249ad288702ebd0d654b985e8908defb7ec6c5ff115c58e128b9e3a21c34b"}, @pad1, @pad1, @padn={0x1, 0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x40, {0x3, 0xe, 0x0, 0xfff, [0x2, 0x4, 0x966, 0x7, 0xfffffffffffffff7, 0x1, 0x1]}}, @calipso={0x7, 0x10, {0x0, 0x2, 0x7, 0x6, [0x7fff]}}, @generic={0x8, 0xc6, "c8a110995d439fbfac9716a99c357bcb2d59a850490739734f6b321d19b3754df39cc2dc26cf263cbebbddb9a7f17b6771f74c46623f9e38bd23e6f0a2fd3a9a017f66738394aca44d1a9f0b35d9df0a964360ab0900a5e6fcac1cd41c91c97f6826ff706c41edc4e00205bbb53218ed58a1122d993b55a1b9a870a17e7869e3fc704b388202add651f628963a90fea5d8196d5e0373fd13584ae57b4f1c03d4f67005cdb5938591d5ea712014e358ea0808807873fd7290c6d4f033de64c7e86ab309f93fd8"}, @calipso={0x7, 0x20, {0x3, 0x6, 0x3, 0x7, [0x0, 0x8000, 0xffffffffffffff04]}}, @generic={0x1, 0x8, "2bdb86d1ce6a20c2"}]}}}, @rthdrdstopts={{0x20, 0x29, 0x37, {0x73, 0x0, '\x00', [@pad1]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @rthdr={{0x18}}, @rthdr_2292={{0x38, 0x29, 0x39, {0x3a, 0x4, 0x2, 0x70, 0x0, [@mcast1, @mcast2]}}}], 0x390}}], 0x1, 0x810) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 12.322960459s ago: executing program 5 (id=2174): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_open_dev$sg(&(0x7f00000004c0), 0x0, 0x20c02) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="aefdda9d240303005a90f57f07703aeff0f64eb9ee07962c220a2e11b44e65d76641cb010852f426072a", 0x2a}], 0x1) r1 = syz_io_uring_setup(0xbde, &(0x7f0000000540)={0x0, 0xec25, 0x400, 0x41, 0x40000337}, &(0x7f0000000dc0)=0x0, &(0x7f0000000a40)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{0x0}], 0x1}) openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x90, 0x0, 0x4000000000000, {0x0, 0x200000000, 0x20000000, 0x4, 0x6, 0x0, {0x0, 0x20000010001, 0x0, 0xd, 0x3, 0x100, 0x10000, 0x2, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) unshare(0x66000080) r4 = socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x4) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000001100)={r6, 0x9, 0x30, 0x7f, 0x1}, &(0x7f0000001140)=0x18) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000001c0)={'veth1_vlan\x00'}) r7 = socket$inet_tcp(0x2, 0x1, 0x0) socket(0x2b, 0x2, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x220, 0x0, 0x43, 0xa0, 0xd8, 0x98, 0x188, 0x178, 0x178, 0x188, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffff00, 0xffffffff, 'veth0_vlan\x00', 'bond0\x00', {0xff}, {}, 0x0, 0x2}, 0x12a, 0xb8, 0xd8, 0x0, {0x0, 0x7a010000}, [@common=@socket0={{0x20}}, @inet=@rpfilter={{0x28}, {0x3}}]}, @unspec=@TRACE={0x20}}, {{@ip={@loopback, @multicast1, 0xffffffff, 0xffffff00, 'bond0\x00', 'syzkaller1\x00', {}, {0xff}, 0x1d, 0x1, 0xe}, 0x0, 0x70, 0xb0}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x3, 0x1, "7a7d0d9452729a5afa385120281f126a6bc52700"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x280) 12.312979686s ago: executing program 2 (id=2175): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x34, 0x2, 0x3, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFQA_CFG_MASK={0x8}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x6}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x18}, @NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x11}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x90) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) bind$tipc(r1, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x3, {0x41, 0x2, 0xfffffffd}}, 0x10) bind$tipc(r1, &(0x7f0000000100)=@name={0x1e, 0x2, 0x9d3354bba4295a8d, {{0x41}}}, 0x10) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f00000001c0)={0x200001fe0000, 0x1}) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r4, 0x11283000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) quotactl$Q_QUOTAON(0xffffffff80000202, 0x0, 0x0, 0x0) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xf974, 0x0, 0x1, 0xbfdffffc}, &(0x7f00000000c0)=0x0, &(0x7f00000003c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x85c3}}) io_uring_enter(r7, 0x47f6, 0x0, 0x0, 0x0, 0x0) 11.632798893s ago: executing program 4 (id=2177): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x9b99}, 0x37, [0x6, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x5, 0x25cd, 0xfffffffd, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x8, 0x7, 0xd, 0x4, 0x12a3, 0x4, 0x1, 0x2, 0x4, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x4, 0x0, 0x91, 0x4, 0x4, 0x7, 0x2, 0x5, 0x400, 0x7ff7, 0x5, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x3, 0x1, 0x6, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x6], [0x9, 0x3, 0x2006, 0x5f, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x3, 0x2, 0x809, 0x4, 0xa, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x2, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00040, 0x5, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x762, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0xfffff50f, 0x4, 0x3, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x2, 0x2e6bf783, 0x80000001, 0xb, 0x5, 0x491, 0x8d3, 0x6, 0x8, 0x400, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x7, 0x5, 0x8000003, 0x5, 0x9, 0x0, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x8000, 0x400, 0x3e55, 0xff, 0xd3, 0x8, 0x3437, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd7d, 0x60a2, 0x7f, 0x9d26, 0x0, 0x8, 0x2, 0x2, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x4, 0x10000, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1afa, 0xbfc, 0x8, 0x7c81, 0x7f, 0x56, 0x40, 0xff, 0x5, 0x7fffffff, 0x7, 0xe, 0x9, 0x81, 0x3, 0x9d86, 0xd, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x3, 0x6, 0x80000001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x624dfaee, 0xc, 0x32d, 0x1000, 0x1ff, 0x2000003, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x7, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x3, 0x8, 0x13ffd, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe0200108500000007"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={0x0, &(0x7f00000001c0)=[0x7], 0x0, 0x0, 0x1}}, 0x40) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x7, 0x5, 0x3, 0xfffffffffffffffe, 0x45, 0x4, 0xbdb], 0x1, 0x1c4213}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 11.197800842s ago: executing program 2 (id=2179): r0 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100000cb768405e0483020b9901e4020109021b000100000000090400fb015c291d00090509"], 0x0) syz_open_dev$sndpcmp(&(0x7f0000000000), 0x3, 0x183a00) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x5, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x7, 0x81}, 0x0) ioctl$VIDIOC_G_FMT(0xffffffffffffffff, 0xc0d05604, &(0x7f0000000100)={0x9, @pix={0x0, 0x0, 0x32435750}}) syz_usb_disconnect(r0) setsockopt$CAN_RAW_ERR_FILTER(0xffffffffffffffff, 0x65, 0x2, &(0x7f0000000080)=0x8, 0x4) landlock_restrict_self(0xffffffffffffffff, 0x0) link(&(0x7f0000000140)='.\x00', 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, 0x0, 0x4000000) close(0xffffffffffffffff) r3 = fsopen(&(0x7f00000003c0)='tracefs\x00', 0x1) close_range(r3, 0xffffffffffffffff, 0x0) 11.036445814s ago: executing program 4 (id=2180): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x24}}, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x15, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000480)=[{0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000000680)}], 0x5, 0x4, 0x5) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180), 0x102, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x3c}, 0x1, 0x0, 0x0, 0x4044050}, 0x40) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x20000000) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000002dc0)={0x0, 0x0, &(0x7f0000002d00)=[{&(0x7f0000000400)={0x64, 0x3c, 0x1, 0x70bd2a, 0x25dfdbfe, "", [@typed={0x14, 0x9e, 0x0, 0x0, @ipv6=@mcast1}, @nested={0x3f, 0x18, 0x0, 0x1, [@typed={0x8, 0x10a7, 0x0, 0x0, @u32}, @generic="7f95ef8e7b21620430343227c49290dc0a3ce7c8b8caecd18d384720b21db28301acbdb487dd5e03f9d8b6406a6de911d97c42"]}]}, 0x64}], 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff}) ioctl$KVM_RUN(r4, 0xae80, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x19, 0x0, 0x0) 9.809404151s ago: executing program 4 (id=2181): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000200)={0x48}) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r3, 0x4611, 0x3) ioctl$FBIO_WAITFORVSYNC(r3, 0x40044620, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = dup(r4) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x4}, 0x8) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r4, &(0x7f0000000800)={&(0x7f00000000c0)={0xa, 0x4e24, 0x8, @loopback, 0x7}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000100)='e', 0x1}], 0x1}, 0x4048043) 9.583149212s ago: executing program 0 (id=2183): socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) socket$l2tp(0x2, 0x2, 0x73) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x80, 0x0) ioctl$PTP_SYS_OFFSET(r2, 0x43403d05, &(0x7f00000007c0)={0x9}) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x3c, r3, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xffeffffc}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x20}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) bpf$MAP_CREATE(0x1101000000000000, &(0x7f0000000540)=@base={0x5, 0x80, 0x1a00, 0xf7, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffe}, 0x50) syz_usb_connect(0x0, 0x36, &(0x7f0000000780)={{0x12, 0x1, 0x0, 0xc9, 0x66, 0x7c, 0x40, 0x1d50, 0x60c6, 0xafe7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x4, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x58, 0x77, 0x2, 0x25, 0x84, 0x53, 0x0, [], [{{0x9, 0x5, 0xb, 0x0, 0x10, 0x1, 0x2, 0x2}}, {{0x9, 0x5, 0xb, 0x0, 0x10, 0xff, 0x0, 0x6}}]}}]}}]}}, 0x0) 8.959136883s ago: executing program 5 (id=2184): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() 7.379826019s ago: executing program 4 (id=2185): socket$kcm(0x10, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = inotify_init1(0x0) inotify_add_watch(r2, 0x0, 0xa4000021) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x21800, 0x0) socket$nl_route(0x10, 0x3, 0x0) add_key$user(&(0x7f0000000200), 0x0, 0x0, 0x0, 0xfffffffffffffffd) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, 0x0) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r3, 0xc05064a7, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}) ioctl$DRM_IOCTL_MODE_GETENCODER(0xffffffffffffffff, 0xc01464a6, &(0x7f0000000180)={r5}) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x1}) 6.483866673s ago: executing program 2 (id=2187): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0, 0xff2b}], 0x2) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x48, 0x12}) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) syz_open_dev$video4linux(0x0, 0xf, 0x60100) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_DESTROY_ID(r5, &(0x7f00000005c0)={0x1, 0x10, 0xfa00, {0x0}}, 0x18) sendto$packet(r0, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 6.192748768s ago: executing program 5 (id=2188): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000400)={0xf0f000, 0x4}) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x40, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4c, 0x9, 0x6, 0x0, 0x3}, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) clock_gettime(0x8, &(0x7f0000001ac0)) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r4, r3, &(0x7f00000000c0)=0x58, 0x5) 6.025021193s ago: executing program 3 (id=2189): creat(0x0, 0xecf86c37d53049cc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) futex(0x0, 0x4, 0x0, 0x0, 0x0, 0xb201fffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) write(r2, &(0x7f0000000080)="1400000052004f030e789e7ee2ce2fa4ff612d27", 0x14) recvmmsg(r2, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}], 0x344, 0x10122, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r3, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick=0x1f4, {}, {}, @raw32={[0x2600]}}], 0xffc8) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) write$sndseq(r4, &(0x7f0000000080)=[{0x1e, 0x0, 0x8, 0xfd, @time={0x7ffffffe, 0x4}, {}, {}, @result={0x1f00}}], 0x1c) syz_open_dev$tty1(0xc, 0x4, 0x4) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0xf5, 0x1}, 0x10) sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, 0x0, 0x20000822) 5.569866158s ago: executing program 0 (id=2190): mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 5.019938509s ago: executing program 4 (id=2191): r0 = syz_usb_connect(0x5, 0xf4, &(0x7f0000000700)=ANY=[@ANYBLOB="120110014c306f10da0b38011230010203010902e20002a60000000904b10403d7b5d25b09210400020122c705090500100004f40804072501832f08000905000040008103ff0905091b08000c078009042201040e010003090509000000030004090502020002f7810671300c458e9532438d4aae3ef0c9bf5c520b1aaab11a8cae9a60c3160adc1dfedebf5a6ead8834c7780c2eb777ef0caf96cd8b3b77f357f4aa1b662ab40651e6ae8cc63dd9f6e2d24afaed81a927ca2e0354281cfeffffffffffffffbf09aac591308e5c0c3c419bb288a21890e1af4af409050303ff030840040705a6c6415a9f09058503"], 0x0) syz_usb_control_io(r0, &(0x7f00000009c0)={0x2c, 0x0, &(0x7f0000000800)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000540)={0x14, 0x0, &(0x7f0000000500)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000240)={0x20, 0x16, 0x2, "2ef8"}, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r2, 0xc0045516, &(0x7f0000000000)=0x639) select(0x40, &(0x7f0000000000)={0x9, 0x7, 0xffff, 0x0, 0x0, 0x1000}, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x2}) socket$netlink(0x10, 0x3, 0xc) r3 = socket$inet_sctp(0x2, 0x1, 0x84) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) r4 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7ff, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix_mp={0x0, 0x0, 0x3231564e}}) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000080)={0x0, 0x7, 0x2, 0x9, 0x2, 0x1ff, 0x9, 0x9}, &(0x7f0000000100)=0x20) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r5, 0x29, 0x19, 0x0, 0x1b) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="442300003b000701010000000000000003"], 0x2344}, 0x1, 0x0, 0x0, 0x20000000}, 0x4c000) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, 0x0, &(0x7f0000000180)) 4.465749802s ago: executing program 2 (id=2192): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000200)='0', 0x1) socket$netlink(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = semget(0x1, 0x4, 0x10) semtimedop(r2, &(0x7f0000000240), 0x0, &(0x7f0000000780)={0x77359400}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) readahead(0xffffffffffffffff, 0x100, 0x96) socket$packet(0x11, 0x3, 0x300) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r3, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x550, 0x40, 0xffc, 0x0, 0xd968d5b908ac0cde, 0x2, {0x0, 0x8}, {0x350, 0x0, 0x1}, {0xf4ef}, {0x0, 0x4, 0xffe}, 0x1, 0x100, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x8, 0x4, 0x0, 0xb}) 4.461886232s ago: executing program 0 (id=2193): r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_open_dev$sndctrl(0x0, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r4, 0x0, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000200)=@mmap={0x1, 0x1, 0x4, 0x1, 0x6, {0x77359400}, {0x1, 0x0, 0x5, 0x9, 0x64, 0xe, "7cf93be8"}, 0xfffffff7, 0x1, {}, 0x2}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) 4.293917888s ago: executing program 3 (id=2194): socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x100, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x70, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xf, 0xf}, {}, {0x7, 0xd}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x40, 0x2, [@TCA_CGROUP_EMATCHES={0x3c, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x800, 0x7, 0x1}, {{0x0, 0x0, 0x1}, {0x3, 0x1, 0x1}}}}, @TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{0xe85, 0x6e4, 0xc}, {0x4, 0x80000000, 0x3, 0x1, 0xf, 0x1}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6e4}}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x10}, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000006100)=@delchain={0x24, 0x65, 0x1, 0x70bd2e, 0x25dfdbff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff3}, {}, {0xb}}}, 0x51}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r10 = socket(0x400000000010, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000740)=@newtfilter={0x24, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r12, {0x0, 0x4}, {}, {0x8, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) 3.601303294s ago: executing program 3 (id=2195): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000540)={&(0x7f0000000240)={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f0000000780)}, 0x2000c040) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x200000, 0x0, 0xb49, 0x6, 0xc, 0x0, 0x1}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$dsp(r3, 0x0, 0x0) r4 = openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r4, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r4, 0x40047459, &(0x7f0000000100)=0x2000004) pwritev(r4, &(0x7f00000002c0), 0x0, 0xe, 0x200004) gettid() sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r5 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000580)="1400000016004163d25a80648c2594f91724fc60", 0x14}], 0x1}, 0x0) 3.536684639s ago: executing program 0 (id=2196): socket$kcm(0x10, 0x7, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x4a0000, 0x0) pipe2(0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x7f, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x20000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r3) socket$key(0xf, 0x3, 0x2) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000400)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\x01\x00\x00\x00a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|\x00\x17\xc0\xa3\xd5\xf9\xaa\x98/\xa4v\xe4)I\xf3+[e\x95\x89\x99\xca\x8e\xc5\xd3\\T\xf0\x1a|5\xfff\xff\x99\xa4\xbb\x9e#oR\xa4\xf1\xba\x04c\xb3-\xf7R\xb85\xb5\xdb\xe9?\xfa/\xdf\xb4R\xbfx=\v_j\x8e\xb0\'\xf4\xe5\xff!\xe1\xbf\x82e\xb1\x9b\x8d\xf3L\t\xd21\x9cbwV\xc8\xcc\xe4\x96M_w\xbc\xdf9\b\r\xf6\x95\xae\xb5,\x92\x8c\xc0DQm\x80\xd1w\xa2\x1a\x12Z\xe5\xf4H\xf7D\n\x96J\x93\xfb\xf0$\x9f\xf7\xa2\xae$O\xa3\xb6\xf5\x98\xd3\v\x00\x86\xa5\x8b\x81\x04\xaf\x03s\xe5\x86>\x0e\xa6\xe6\x1aV\x17\x8b\xed\xa7\'\xd0\r_\xe8,XVR\x13\xe5%\xb9\x88\xb8W@D\'\x17A\xc8\x80\x02J\xd4V\x00wH(\xc5v\f\xc9\xb6\xdf..$\xe6P(_\xf1\'\xc1:\xa3\xcb\xd9\xd1\xc7\x13\x99Md\x1dc\xf1\'j\x03!\x13\xd1\xb8\xbf\xe6\xb2M\b/\rp\xa5\x00\x00\x00\x00', 0x40, 0x9, 0x0) fcntl$setlease(r5, 0x400, 0x0) mq_open(&(0x7f00000005c0)='eth0\x00\xdd\xad4=2k\xf1\x05\x9b\x91y\xe1;F\xa2\x8df\xe9\x04\x00\x00\x00\x00\x0078z=\x8f\xd5F\xa4AR\xc7\x9f.\xdc\xdb\"A\x16\xd8\x19\xf1lZ\xc8\x93\xda\xf2\xc9\xe8h[u8\xc6\xfa\x9ep\xbe\a\xe2\xbb\r\xf1\xc7\xee\xe1\xbd\x1e\xdf\xe1\x9c\x19\xda\xd3\x94EL\xca\x88\x85\xd1\x02\xd9L\x90\xeb%/\xb1\xeb\x11uP7\x1f\xd9b\xc3V\x88\xd1\x1f\xc8\x94\xebF\xf8\x88\xf0\xac.\x94\xfc\v\xb1W\xef~+n\xb1\x9b\x02n]xr\xb3\x80\xbc>\xe8XX\xe6\x12\xf3\xc9\xd5\xf8\xd1\x8d\xcb9\xbf\xb0(<\xeb\x92\x8a\x16\xb7\x11^\xb6\xb7n\xd5\xb5\x00[\xdf\x94\x00\r\x95\x17\xa1h\xf8\x00\x00\x00\"\xa0\x05\xcc^\x90c\xc9}\xb8\ny\xf4\xe1\xb4.\xa4\a\x05\xbb}\x91\xf4C\xf5O\xf1a\x12\b\x86\xa16\xbb}C\xc9\x1d\\\xedD\x14\xb1w\x1e\xa0\xc1E\xb5\xf8\xab\xfb\xd9\x93\xb8vJ\x85p\xb5n\x1b\xe4\xd5g\xae\xe4\xeb\xca\xae\x1bs\xd4\xf0\xc0\xdag\x19R4\xd4\xd4\x04\xfc\x04Zb\xf6\xba\xf8B\xf6YU\xcd\xf2\xdb\xb5\xa2\xda\xdf\x8dD\xef`\x13\x15$\xceq\xd7j\xd7\xe3V\xf2\xa2\x95\xcf\x18T\xf1\xb0\xf3\xf8O', 0x1, 0x0, 0x0) 3.339110232s ago: executing program 3 (id=2197): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x239, &(0x7f0000000480)={0x0, 0x8901, 0x400, 0x0, 0x2cf}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$rds(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x20000800}, 0x4000008) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r6, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r6, 0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x2007, @fd, 0x800, 0x0, 0x0, 0x18, 0x0, {0x2}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) io_uring_enter(r3, 0x47ba, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r3, 0x18, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1, {0x7, 0xa44}, 0x80}, 0x1) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a00"/28, @ANYRES32=r7, @ANYRESOCT, @ANYRES64=r0], 0x38}}, 0x10) 2.364874948s ago: executing program 2 (id=2198): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0xa) r4 = dup(r3) r5 = open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) r6 = openat$kvm(0xffffffffffffff9c, 0x0, 0x80141, 0x0) clock_gettime(0x0, 0x0) ppoll(&(0x7f0000000200)=[{r0, 0x8001}, {r3, 0x205}, {0xffffffffffffffff, 0x105}, {r6, 0x943e}, {r3, 0x4408}], 0x5, &(0x7f0000000500), 0x0, 0x0) ftruncate(r5, 0x200004) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) syz_emit_ethernet(0x46, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$apparmor_exec(r5, &(0x7f0000000400)=ANY=[], 0x8) sendfile(r4, r5, 0x0, 0x80001d00c0d1) 2.310666894s ago: executing program 4 (id=2199): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@ipv6_getroute={0x20, 0x1a, 0x101, 0x0, 0x0, {}, [@RTA_METRICS={0x4}]}, 0x20}}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r0 = socket(0x1e, 0x2, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=@gettclass={0x24, 0x2a, 0x2, 0x70bd2b, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x5, 0xffe0}, {0x2, 0xfff3}, {0xb, 0xfff2}}, ["", "", "", "", "", ""]}, 0x24}}, 0x24004010) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x1000000000, 0x7, 0xfa11, 0xffffffff}, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fe76181004160780a6af011703010902120001000000", @ANYRESDEC, @ANYRES8], 0x0) r5 = syz_open_dev$sndctrl(&(0x7f0000000380), 0x3, 0xbc01) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r5, 0x80dc5521, &(0x7f0000000180)=""/135) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a54000000060a010400000000000000000a0000040900010073797a31000000000900020073797a320000000028000480240001800b0001007470726f7879000014000280080002400000080c080001400000000a"], 0x7c}, 0x1, 0x0, 0x0, 0x4000050}, 0x24044010) 1.140829385s ago: executing program 0 (id=2200): socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) socket$l2tp(0x2, 0x2, 0x73) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x80, 0x0) ioctl$PTP_SYS_OFFSET(r2, 0x43403d05, &(0x7f00000007c0)={0x9}) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x3c, r3, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xffeffffc}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x20}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) bpf$MAP_CREATE(0x1101000000000000, &(0x7f0000000540)=@base={0x5, 0x80, 0x1a00, 0xf7, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffe}, 0x50) syz_usb_connect(0x0, 0x36, &(0x7f0000000780)={{0x12, 0x1, 0x0, 0xc9, 0x66, 0x7c, 0x40, 0x1d50, 0x60c6, 0xafe7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x4, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x58, 0x77, 0x2, 0x25, 0x84, 0x53, 0x0, [], [{{0x9, 0x5, 0xb, 0x0, 0x10, 0x1, 0x2, 0x2}}, {{0x9, 0x5, 0xb, 0x0, 0x10, 0xff, 0x0, 0x6}}]}}]}}]}}, 0x0) 1.038029216s ago: executing program 3 (id=2201): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x303880, 0x0) ioctl$SNAPSHOT_PLATFORM_SUPPORT(r2, 0x330f, 0x7ff) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000040)={r1, 0x1, 0x6, @multicast}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000100)={r1, 0x1, 0x6, @remote}, 0x10) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000080)={r1, 0x1, 0x0, @multicast}, 0x10) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r3, 0x40045108, &(0x7f0000000200)) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000980), 0x0, 0x0) ioctl$SNDCTL_SEQ_RESET(r4, 0x5100) r5 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f00000003c0)=@gettaction={0x14, 0x32, 0x100, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$SNDCTL_SEQ_RESET(r4, 0x5100) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x0) r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000140), 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000004580)={0x11, 0xf, &(0x7f0000000280)=ANY=[@ANYBLOB="1800200000010000000000009f090000181100001a54f62fc5a0aec57fed7cd42f9c0f7f00cccd09ecff4211e6419f0c5d4116bc2ccc01966038114868f873e4dbfb1d2117e0776d4fedefb57d08a872ba5196d28372e4c3e929b902cc5154544c9af7545295c90ca0238f6d8981cf6da67213795b0a7b6168785bec20efc0209253cd7482467e8814bd6c3c6c025a7d8d5ce5000095c4f14edfe4cbf29a220c71df1d79ae703247e2", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b703000000000000850000008300007d8a1f797a00bf0900000000000055090100000000009500000048b27000000000bf91000000000000b7020000000000008500000084000000b70000000000000095000020"], &(0x7f0000000040)='syzkaller\x00', 0x800006, 0x20, &(0x7f00000043c0)=""/32, 0x40f00, 0xa, '\x00', 0x0, 0x0, r7, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) 832.526404ms ago: executing program 3 (id=2202): r0 = socket(0x80000000000000a, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, 0x0, &(0x7f00000000c0)) ioctl$FBIOGET_FSCREENINFO(0xffffffffffffffff, 0x4602, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000380)=ANY=[], 0x0) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, 0x0, 0x0) sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x24004000, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x1) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x82, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x10000000, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000201b4510fc0428155d6d01020301090212000100000000090401"], 0x0) 0s ago: executing program 2 (id=2203): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff}) pipe(0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000100003040000000000000000000074"], 0x44}, 0x1, 0x0, 0x0, 0x40800}, 0x20004000) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r1 = socket(0x18, 0x80003, 0x744) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r1) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) sched_setattr(r4, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000001c0), 0x13f, 0x1}}, 0x20) r5 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) pipe2$watch_queue(0x0, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x14) keyctl$KEYCTL_WATCH_KEY(0x20, r5, 0xffffffffffffffff, 0x100000000000f7) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000340)=0xf) kernel console output (not intermixed with test programs): -1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.568662][ T5900] usb 4-1: Product: syz [ 579.574417][ T5900] usb 4-1: Manufacturer: syz [ 579.579468][ T5900] usb 4-1: SerialNumber: syz [ 579.592398][ T5900] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 579.623263][ T24] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 579.889296][ T9] em28xx 6-1:0.0: chip ID is em2765 [ 580.523143][ T9] em28xx 6-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 580.541318][ T9] em28xx 6-1:0.0: board has no eeprom [ 581.467856][ T24] usb 4-1: Service connection timeout for: 257 [ 581.498098][ T24] ath9k_htc 4-1:1.0: ath9k_htc: Unable to initialize HTC services [ 581.698947][ T9] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 581.748969][ T9] em28xx 6-1:0.0: dvb set to bulk mode. [ 581.803668][ T24] ath9k_htc: Failed to initialize the device [ 581.879846][ T5923] em28xx 6-1:0.0: Binding DVB extension [ 581.925549][ T9] usb 6-1: USB disconnect, device number 15 [ 581.939832][ T9] em28xx 6-1:0.0: Disconnecting em28xx [ 582.025751][T16640] sctp: [Deprecated]: syz.3.1438 (pid 16640) Use of int in maxseg socket option. [ 582.025751][T16640] Use struct sctp_assoc_value instead [ 582.179629][ T5900] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 582.251895][ T24] usb 4-1: ath9k_htc: USB layer deinitialized [ 582.309011][ T5982] usb 4-1: USB disconnect, device number 24 [ 582.361482][T16667] syzkaller0: entered promiscuous mode [ 582.367027][T16667] syzkaller0: entered allmulticast mode [ 582.408931][ T5900] usb 5-1: Using ep0 maxpacket: 8 [ 582.440716][ T5900] usb 5-1: New USB device found, idVendor=093b, idProduct=a104, bcdDevice= 0.01 [ 582.450558][ T5900] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 582.472147][ T5900] usb 5-1: Product: syz [ 582.493514][ T5900] usb 5-1: Manufacturer: syz [ 582.506710][ T5900] usb 5-1: SerialNumber: syz [ 582.559359][ T5923] em28xx 6-1:0.0: Registering input extension [ 582.566066][ T9] em28xx 6-1:0.0: Closing input extension [ 582.617945][ T5900] usb 5-1: config 0 descriptor?? [ 582.636219][ T9] em28xx 6-1:0.0: Freeing device [ 582.647178][ T5900] go7007 5-1:0.0: probe with driver go7007 failed with error -12 [ 582.863483][T16671] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 583.062850][ T30] kauditd_printk_skb: 22 callbacks suppressed [ 583.146828][ T30] audit: type=1804 audit(1763718481.845:291): pid=16674 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.1446" name="file0" dev="ramfs" ino=46450 res=1 errno=0 [ 585.678923][ T9] usb 5-1: USB disconnect, device number 34 [ 589.061426][T16721] netlink: 'syz.3.1458': attribute type 1 has an invalid length. [ 589.107412][T16721] 8021q: adding VLAN 0 to HW filter on device bond2 [ 589.619263][T16721] bond2: (slave veth3): Enslaving as an active interface with a down link [ 589.764112][T16723] bond2: (slave veth0_to_bond): making interface the new active one [ 589.812180][T16723] veth0_to_bond: entered promiscuous mode [ 589.822774][T16723] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 589.922563][T16724] vlan2: entered allmulticast mode [ 589.929649][T16724] veth0_to_bond: entered allmulticast mode [ 589.938275][T16724] bond2: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 589.994106][T16727] syzkaller0: entered promiscuous mode [ 590.003596][T16727] syzkaller0: entered allmulticast mode [ 591.688442][ T2154] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 591.871427][ T2154] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 591.882044][ T2154] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 591.929671][ T2154] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 591.949466][ T24] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 591.969839][ T2154] usb 6-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 591.988956][ T2154] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.018938][ T2154] usb 6-1: Product: syz [ 592.054378][ T2154] usb 6-1: Manufacturer: syz [ 592.064578][ T2154] usb 6-1: SerialNumber: syz [ 592.102529][ T2154] usb 6-1: config 0 descriptor?? [ 592.120151][ T24] usb 5-1: config 0 has no interfaces? [ 592.128990][ T24] usb 5-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 592.150372][T16739] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 592.190443][T16739] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 592.198998][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.231058][ T2154] usb 6-1: ucan: probing device on interface #0 [ 592.240114][ T24] usb 5-1: Product: syz [ 592.269257][ T24] usb 5-1: Manufacturer: syz [ 592.275413][ T24] usb 5-1: SerialNumber: syz [ 592.315184][ T24] usb 5-1: config 0 descriptor?? [ 592.571178][T16745] team_slave_0: entered promiscuous mode [ 592.578860][T16745] team_slave_1: entered promiscuous mode [ 592.637111][T16745] vlan3: entered promiscuous mode [ 592.687689][ T2154] usb 6-1: ucan: failed to retrieve device info [ 592.727842][T16745] team0: entered promiscuous mode [ 592.736742][ T2154] usb 6-1: ucan: probe failed; try to update the device firmware [ 592.806766][ T2154] usb 6-1: USB disconnect, device number 16 [ 593.059381][ T24] usb 5-1: USB disconnect, device number 35 [ 593.458939][ T5982] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 593.629891][ T5982] usb 3-1: Using ep0 maxpacket: 32 [ 593.641206][ T5982] usb 3-1: config 0 has an invalid interface number: 136 but max is 0 [ 593.658171][ T5982] usb 3-1: config 0 has no interface number 0 [ 593.673403][ T5982] usb 3-1: config 0 interface 136 altsetting 0 has an endpoint descriptor with address 0xAD, changing to 0x8D [ 593.687053][ T5982] usb 3-1: config 0 interface 136 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 593.741781][ T5982] usb 3-1: config 0 interface 136 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 0 [ 593.870204][ T5982] usb 3-1: config 0 interface 136 altsetting 0 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 593.970211][ T5982] usb 3-1: config 0 interface 136 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 593.981310][ T5982] usb 3-1: New USB device found, idVendor=0763, idProduct=1021, bcdDevice=8e.c0 [ 593.992711][ T5982] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 594.006315][ T5982] usb 3-1: config 0 descriptor?? [ 594.016170][ T5982] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 594.234916][T16750] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 594.299285][T16750] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 594.434114][T16762] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 595.079514][ T2154] usb 3-1: USB disconnect, device number 25 [ 595.673171][ T30] audit: type=1326 audit(1763718494.485:292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16769 comm="syz.2.1474" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8e7338f749 code=0x0 [ 595.700545][ C0] vkms_vblank_simulate: vblank timer overrun [ 603.139226][ T37] veth0_to_bond: left promiscuous mode [ 607.719596][ T5982] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 608.386517][ T5982] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 608.408361][ T5982] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 608.432839][ T5982] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 608.500075][ T5982] usb 4-1: config 0 descriptor?? [ 608.541659][ T5982] pwc: Askey VC010 type 2 USB webcam detected. [ 608.930947][ T5982] pwc: recv_control_msg error -32 req 02 val 2b00 [ 608.939199][ T5982] pwc: recv_control_msg error -32 req 02 val 2700 [ 608.947493][ T5982] pwc: recv_control_msg error -32 req 02 val 2c00 [ 609.153142][ T5982] pwc: recv_control_msg error -32 req 04 val 1000 [ 609.261873][ T5982] pwc: recv_control_msg error -32 req 04 val 1300 [ 609.271843][ T5982] pwc: recv_control_msg error -32 req 04 val 1400 [ 609.294599][ T5982] pwc: recv_control_msg error -32 req 02 val 2000 [ 609.343008][ T5982] pwc: recv_control_msg error -32 req 02 val 2100 [ 609.368086][ T5982] pwc: recv_control_msg error -32 req 04 val 1500 [ 609.383624][ T5982] pwc: recv_control_msg error -32 req 02 val 2500 [ 609.412497][ T5982] pwc: recv_control_msg error -32 req 02 val 2400 [ 609.492859][ T5982] pwc: recv_control_msg error -32 req 02 val 2600 [ 609.968481][ T5982] pwc: recv_control_msg error -71 req 02 val 2800 [ 609.989575][ T5982] pwc: recv_control_msg error -71 req 04 val 1100 [ 609.999356][ T5982] pwc: recv_control_msg error -71 req 04 val 1200 [ 610.013410][ T5982] pwc: Registered as video103. [ 610.046117][ T5982] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input24 [ 610.172145][T16880] netlink: 'syz.5.1498': attribute type 27 has an invalid length. [ 610.516427][ T5982] usb 4-1: USB disconnect, device number 25 [ 610.923395][T16887] tipc: Enabled bearer , priority 0 [ 611.018101][T16891] syzkaller0: entered promiscuous mode [ 611.054804][T16891] syzkaller0: entered allmulticast mode [ 611.119558][T16887] sch_tbf: burst 2 is lower than device syzkaller0 mtu (1514) ! [ 611.155008][T16887] tipc: Resetting bearer [ 611.268202][T16886] tipc: Resetting bearer [ 611.422064][T16886] tipc: Disabling bearer [ 612.300187][T16907] tipc: Enabled bearer , priority 0 [ 612.308373][T16907] syzkaller0: entered promiscuous mode [ 612.313946][T16907] syzkaller0: entered allmulticast mode [ 612.426659][T16907] netlink: 2 bytes leftover after parsing attributes in process `syz.2.1505'. [ 612.446874][T16907] tipc: Resetting bearer [ 612.480143][T16912] tipc: Started in network mode [ 612.492879][T16912] tipc: Node identity 027ce86472df, cluster identity 4711 [ 612.549198][T16912] tipc: Enabled bearer , priority 0 [ 612.561475][T16906] tipc: Resetting bearer [ 612.586502][T16906] tipc: Disabling bearer [ 612.601320][T16918] syzkaller0: entered promiscuous mode [ 612.607034][T16918] syzkaller0: entered allmulticast mode [ 612.682944][T16912] tipc: Resetting bearer [ 612.755076][T16911] tipc: Resetting bearer [ 612.777258][T16920] netlink: 'syz.2.1510': attribute type 10 has an invalid length. [ 612.806794][T16911] tipc: Disabling bearer [ 612.844773][T16920] mac80211_hwsim hwsim10 wlan1: entered promiscuous mode [ 612.854106][T16920] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 612.989096][T16925] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 613.021476][T16919] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 613.047787][T16925] block device autoloading is deprecated and will be removed. [ 613.414289][T16930] tipc: Enabled bearer , priority 0 [ 613.422264][T16930] syzkaller0: entered promiscuous mode [ 613.427824][T16930] syzkaller0: entered allmulticast mode [ 613.448336][T16930] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1511'. [ 613.463283][T16930] tipc: Resetting bearer [ 613.478440][T16928] tipc: Resetting bearer [ 613.515547][T16928] tipc: Disabling bearer [ 613.729094][ T2154] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 613.900351][ T2154] usb 4-1: Using ep0 maxpacket: 8 [ 614.012181][ T2154] usb 4-1: New USB device found, idVendor=093b, idProduct=a104, bcdDevice= 0.01 [ 614.029234][T16935] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1513'. [ 614.044178][ T2154] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.053046][ T2154] usb 4-1: Product: syz [ 614.068238][ T2154] usb 4-1: Manufacturer: syz [ 614.083212][ T2154] usb 4-1: SerialNumber: syz [ 614.137607][ T2154] usb 4-1: config 0 descriptor?? [ 614.202997][ T2154] go7007 4-1:0.0: probe with driver go7007 failed with error -12 [ 615.441484][T16950] mac80211_hwsim hwsim4 syzkaller0: left promiscuous mode [ 615.459683][T16950] mac80211_hwsim hwsim4 syzkaller0: left allmulticast mode [ 616.282748][ T2154] usb 4-1: USB disconnect, device number 26 [ 616.482427][T16959] tipc: Enabled bearer , priority 0 [ 616.492095][T16959] syzkaller0: entered promiscuous mode [ 616.497914][T16959] syzkaller0: entered allmulticast mode [ 616.790120][T16959] tipc: Resetting bearer [ 616.797322][T16958] tipc: Resetting bearer [ 616.813810][T16958] tipc: Disabling bearer [ 616.888825][ T5982] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 617.058892][ T5982] usb 3-1: Using ep0 maxpacket: 16 [ 617.181776][ T5982] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 617.190218][ T5982] usb 3-1: config 0 has no interface number 0 [ 617.204375][ T5982] usb 3-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 617.276711][ T5982] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 617.310618][ T5982] usb 3-1: Product: syz [ 617.318858][ T5982] usb 3-1: Manufacturer: syz [ 617.328787][ T5982] usb 3-1: SerialNumber: syz [ 617.345550][ T5982] usb 3-1: config 0 descriptor?? [ 617.377287][ T5982] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 617.929280][T16980] mac80211_hwsim hwsim4 syzkaller0: entered promiscuous mode [ 617.963022][T16980] mac80211_hwsim hwsim4 syzkaller0: entered allmulticast mode [ 620.021875][ T24] usb 3-1: USB disconnect, device number 26 [ 621.017245][ T5982] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 621.188102][ T9] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 621.208861][ T5982] usb 5-1: Using ep0 maxpacket: 32 [ 621.228941][ T5982] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 621.252747][ T5982] usb 5-1: config 0 has no interface number 0 [ 621.265835][ T5982] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 621.329795][ T5982] usb 5-1: config 0 interface 85 has no altsetting 0 [ 621.339813][ T5982] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 621.349134][ T5982] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 621.357418][ T5982] usb 5-1: Product: syz [ 621.362760][ T5982] usb 5-1: Manufacturer: syz [ 621.367558][ T5982] usb 5-1: SerialNumber: syz [ 621.376375][ T5982] usb 5-1: config 0 descriptor?? [ 621.806165][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 622.224924][ T9] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 622.233117][ T9] usb 3-1: config 0 has no interface number 0 [ 622.255500][ T9] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 622.324888][ T9] usb 3-1: config 0 interface 85 has no altsetting 0 [ 622.426051][ T9] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 622.485767][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 622.575945][ T9] usb 3-1: Product: syz [ 622.588246][ T9] usb 3-1: Manufacturer: syz [ 622.606403][ T9] usb 3-1: SerialNumber: syz [ 622.631893][ T9] usb 3-1: config 0 descriptor?? [ 622.833696][ T5982] appletouch 5-1:0.85: Geyser mode initialized. [ 622.878288][ T5982] input: appletouch as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.85/input/input25 [ 623.255935][ T9] appletouch 3-1:0.85: Geyser mode initialized. [ 623.304406][ T9] input: appletouch as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.85/input/input26 [ 623.379982][ T9] usb 5-1: USB disconnect, device number 36 [ 623.468286][ T9] appletouch 5-1:0.85: input: appletouch disconnected [ 623.532621][ T2154] usb 3-1: USB disconnect, device number 27 [ 623.674924][ T2154] appletouch 3-1:0.85: input: appletouch disconnected [ 625.257606][T17043] tipc: Enabled bearer , priority 0 [ 625.265450][T17043] syzkaller0: entered promiscuous mode [ 625.271402][T17043] syzkaller0: entered allmulticast mode [ 625.622949][T17046] tipc: Resetting bearer [ 625.639228][T17042] tipc: Resetting bearer [ 625.680005][T17042] tipc: Disabling bearer [ 627.509796][T17061] SET target dimension over the limit! [ 627.682544][T17067] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1550'. [ 627.884779][T17069] ptrace attach of "./syz-executor exec"[5845] was attempted by "\x09   Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ  € \x0a N\x22   \x07"[17069] [ 628.350072][T17072] syzkaller0: entered promiscuous mode [ 628.363920][T17072] syzkaller0: entered allmulticast mode [ 628.959299][T17090] tipc: Enabled bearer , priority 0 [ 629.182742][T17088] tipc: Resetting bearer [ 629.380131][T17098] tipc: Enabling of bearer rejected, already enabled [ 629.797026][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 629.803636][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 630.599713][T17106] kvm: kvm [17103]: vcpu0, guest rIP: 0x1bc Unhandled WRMSR(0xc1) = 0x1 [ 630.656355][T17106] kvm: kvm [17103]: vcpu0, guest rIP: 0x1bc Unhandled WRMSR(0xc2) = 0x1 [ 630.720740][T17106] kvm: kvm [17103]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x0 [ 630.772032][T17106] kvm: kvm [17103]: vcpu0, guest rIP: 0x1bc Unhandled WRMSR(0x11e) = 0x1 [ 630.859814][T17106] kvm: kvm [17103]: vcpu0, guest rIP: 0x1bc Unhandled WRMSR(0x186) = 0x1 [ 630.911540][T17106] kvm: kvm [17103]: vcpu0, guest rIP: 0x1bc Unhandled WRMSR(0x187) = 0x1 [ 630.953947][T17106] kvm_intel: kvm [17103]: vcpu0, guest rIP: 0x1bc Unhandled WRMSR(0x1d9) = 0x1 [ 634.169931][ T9] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 634.360904][T17141] netlink: 'syz.5.1569': attribute type 1 has an invalid length. [ 634.472721][ T9] usb 5-1: config 4 has an invalid interface number: 88 but max is 0 [ 634.501635][T17141] 8021q: adding VLAN 0 to HW filter on device bond1 [ 634.537910][T17145] macvlan2: entered promiscuous mode [ 634.543334][T17145] macvlan2: entered allmulticast mode [ 634.547653][ T9] usb 5-1: config 4 has no interface number 0 [ 634.549322][T17145] bond1: entered promiscuous mode [ 634.564577][T17145] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 634.581373][T17145] team0: Port device macvlan2 added [ 634.607815][ T9] usb 5-1: config 4 interface 88 altsetting 119 has a duplicate endpoint with address 0xB, skipping [ 634.659070][ T9] usb 5-1: config 4 interface 88 has no altsetting 0 [ 634.697521][ T9] usb 5-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=af.e7 [ 634.719419][T17147] tipc: Enabled bearer , priority 0 [ 634.733912][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.765446][T17144] syzkaller0: entered promiscuous mode [ 634.799310][T17144] syzkaller0: entered allmulticast mode [ 634.805489][ T9] usb 5-1: Product: syz [ 634.822694][ T9] usb 5-1: Manufacturer: syz [ 634.827357][ T9] usb 5-1: SerialNumber: syz [ 634.858914][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 634.863110][T17144] tipc: Resetting bearer [ 634.875514][T17144] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.008944][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.148907][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.178549][T17142] tipc: Resetting bearer [ 635.262090][T17142] tipc: Disabling bearer [ 635.768845][ T9] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 636.041323][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 636.053986][ T9] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 636.145087][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 636.179592][ T9] usb 4-1: config 0 descriptor?? [ 636.214590][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 636.848848][ T9] pwc: recv_control_msg error -32 req 02 val 2b00 [ 636.870632][ T9] pwc: recv_control_msg error -32 req 02 val 2700 [ 636.939451][ T9] pwc: recv_control_msg error -32 req 02 val 2c00 [ 636.949828][ T9] pwc: recv_control_msg error -32 req 04 val 1000 [ 636.967397][ T9] pwc: recv_control_msg error -32 req 04 val 1300 [ 636.999205][ T9] pwc: recv_control_msg error -32 req 04 val 1400 [ 637.033087][ T9] pwc: recv_control_msg error -32 req 02 val 2000 [ 637.081677][ T9] pwc: recv_control_msg error -32 req 02 val 2100 [ 637.419279][ T9] pwc: recv_control_msg error -32 req 04 val 1500 [ 637.467874][ T9] pwc: recv_control_msg error -32 req 02 val 2500 [ 637.486039][ T9] pwc: recv_control_msg error -32 req 02 val 2400 [ 637.545041][ T9] pwc: recv_control_msg error -32 req 02 val 2600 [ 637.565253][ T9] pwc: recv_control_msg error -32 req 02 val 2900 [ 637.787880][ T24] usb 5-1: USB disconnect, device number 37 [ 637.806205][ T9] pwc: recv_control_msg error -71 req 04 val 1100 [ 637.826978][T17182] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 637.839193][T17182] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 637.844336][ T9] pwc: recv_control_msg error -71 req 04 val 1200 [ 637.862652][T17180] tipc: Enabled bearer , priority 0 [ 637.879400][T17180] syzkaller0: entered promiscuous mode [ 637.885925][T17182] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 637.886968][ T9] pwc: Registered as video103. [ 637.915596][T17180] syzkaller0: entered allmulticast mode [ 637.932241][ T9] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input27 [ 637.982245][ T9] usb 4-1: USB disconnect, device number 27 [ 638.005143][T17180] tipc: Resetting bearer [ 638.075451][T17179] tipc: Resetting bearer [ 638.143406][T17179] tipc: Disabling bearer [ 638.560120][T17201] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(5) [ 638.566706][T17201] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 638.580831][T17201] vhci_hcd vhci_hcd.0: Device attached [ 638.838838][ T2154] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 638.858970][ T9] vhci_hcd: vhci_device speed not set [ 638.918819][ T9] usb 43-1: new full-speed USB device number 2 using vhci_hcd [ 638.989109][ T2154] usb 3-1: Using ep0 maxpacket: 8 [ 639.007352][ T2154] usb 3-1: config 0 has no interfaces? [ 639.025969][ T2154] usb 3-1: New USB device found, idVendor=050d, idProduct=3201, bcdDevice= 0.00 [ 639.065801][ T2154] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 639.099010][ T2154] usb 3-1: config 0 descriptor?? [ 639.395850][T17202] vhci_hcd: connection reset by peer [ 639.423118][ T9607] vhci_hcd: stop threads [ 639.431370][ T24] usb 3-1: USB disconnect, device number 28 [ 639.439341][ T9607] vhci_hcd: release socket [ 639.453139][ T9607] vhci_hcd: disconnect device [ 640.764397][ T30] audit: type=1800 audit(1763718539.235:293): pid=17224 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1590" name="bus" dev="ramfs" ino=50127 res=0 errno=0 [ 641.472021][T17230] tipc: Enabled bearer , priority 0 [ 641.532739][T17230] syzkaller0: entered promiscuous mode [ 641.577102][T17230] syzkaller0: entered allmulticast mode [ 641.748937][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.772224][T17230] tipc: Resetting bearer [ 641.792374][T17230] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.856467][T17233] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1593'. [ 641.866870][T17229] tipc: Resetting bearer [ 641.989015][T17229] tipc: Disabling bearer [ 642.011703][T17233] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 642.135831][T17233] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 642.265768][T17241] tipc: Enabling of bearer rejected, already enabled [ 643.355067][T17262] syzkaller0: entered promiscuous mode [ 643.401502][T17262] syzkaller0: entered allmulticast mode [ 643.516115][T17262] tipc: Enabled bearer , priority 0 [ 643.648950][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.657693][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.788909][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.889052][T17261] tipc: Resetting bearer [ 643.942050][T17261] tipc: Disabling bearer [ 644.039354][ T9] vhci_hcd: vhci_device speed not set [ 645.518910][ T5923] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 645.673847][ T5923] usb 5-1: Using ep0 maxpacket: 16 [ 645.685895][ T5923] usb 5-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 645.697243][ T5923] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 645.741505][ T5923] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 645.751246][ T5923] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 645.778855][ T5923] usb 5-1: Product: syz [ 645.788809][ T5923] usb 5-1: Manufacturer: syz [ 645.803835][ T5923] usb 5-1: SerialNumber: syz [ 646.210568][ T5923] usb 5-1: 0:2 : does not exist [ 646.281966][ T5923] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 646.370373][ T5923] usb 5-1: USB disconnect, device number 38 [ 646.448870][ T2154] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 646.540446][ T6448] udevd[6448]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 646.602293][ T2154] usb 3-1: Using ep0 maxpacket: 16 [ 646.613833][ T2154] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 646.627603][ T2154] usb 3-1: config 0 has no interface number 0 [ 646.652999][ T2154] usb 3-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 646.678870][ T2154] usb 3-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 646.700951][ T2154] usb 3-1: config 0 interface 41 has no altsetting 0 [ 646.792676][ T2154] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 646.807763][ T2154] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.823168][ T2154] usb 3-1: Product: syz [ 646.827416][ T2154] usb 3-1: Manufacturer: syz [ 646.836031][ T2154] usb 3-1: SerialNumber: syz [ 646.905206][ T2154] usb 3-1: config 0 descriptor?? [ 646.912384][T17300] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 646.945138][T17300] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 647.196034][T17300] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 647.204742][T17300] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 647.619185][ T2154] Error reading MAC address [ 647.625925][T17300] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 647.633828][T17300] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 648.467455][T17282] tipc: Enabling of bearer rejected, failed to enable media [ 648.517059][T17313] syzkaller0: entered promiscuous mode [ 648.538862][T17313] syzkaller0: entered allmulticast mode [ 648.918664][T17327] syz.3.1612 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 649.682698][ T9] usb 5-1: new full-speed USB device number 39 using dummy_hcd [ 649.910926][ T9] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 649.929016][ T9] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 650.048948][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10 [ 650.081036][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 255, setting to 64 [ 650.504866][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 650.593658][ T9] usb 5-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 650.602990][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 650.612020][ T9] usb 5-1: Product: syz [ 650.617079][ T9] usb 5-1: Manufacturer: syz [ 650.628162][ T9] usb 5-1: SerialNumber: syz [ 650.675232][ T9] usb 5-1: config 0 descriptor?? [ 650.689281][T17321] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 650.711989][ T9] input: KB Gear Tablet as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input28 [ 650.728107][ T2154] sr9700 3-1:0.41 eth5: register 'sr9700' at usb-dummy_hcd.2-1, CoreChip SR9700 USB Ethernet, c2:7c:41:aa:c7:4d [ 650.749401][ T44] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 650.822927][ T2154] usb 3-1: USB disconnect, device number 29 [ 650.875187][ T2154] sr9700 3-1:0.41 eth5: unregister 'sr9700' usb-dummy_hcd.2-1, CoreChip SR9700 USB Ethernet [ 650.952307][ T44] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 650.969539][ T44] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 650.985007][ T44] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 651.005072][ T44] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 651.007282][ T9] usb 5-1: USB disconnect, device number 39 [ 651.033338][ T44] usb 6-1: SerialNumber: syz [ 651.064743][T17338] syzkaller0: entered promiscuous mode [ 651.075793][T17338] syzkaller0: entered allmulticast mode [ 651.261252][ T44] usb 6-1: 0:2 : does not exist [ 651.423263][ T44] usb 6-1: USB disconnect, device number 17 [ 651.842439][ T6448] udevd[6448]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 652.505271][T17349] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 652.573979][T17355] tipc: Enabled bearer , priority 0 [ 652.616974][T17355] syzkaller0: entered promiscuous mode [ 652.651443][T17355] syzkaller0: entered allmulticast mode [ 652.808671][T17355] tipc: Resetting bearer [ 652.911226][T17354] tipc: Resetting bearer [ 653.005038][T17354] tipc: Disabling bearer [ 653.990189][ T44] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 654.170499][ T44] usb 6-1: Using ep0 maxpacket: 16 [ 654.241422][ T44] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 654.253301][ T44] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 654.560723][ T44] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 654.604970][ T44] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 654.627589][ T44] usb 6-1: Product: syz [ 654.635447][ T44] usb 6-1: Manufacturer: syz [ 654.645617][ T44] usb 6-1: SerialNumber: syz [ 654.670078][ T44] usb 6-1: config 0 descriptor?? [ 654.823790][ T44] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 654.833227][ T44] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 655.393892][T17395] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 655.474074][ T44] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 655.481910][ T44] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 655.534276][T17396] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 656.163569][ T44] em28xx 6-1:0.0: Unknown AC97 audio processor detected! [ 656.171458][ T44] em28xx 6-1:0.0: couldn't setup AC97 register 2 [ 656.182677][ T44] em28xx 6-1:0.0: couldn't setup AC97 register 4 [ 656.191988][ T44] em28xx 6-1:0.0: couldn't setup AC97 register 6 [ 656.208957][ T44] em28xx 6-1:0.0: couldn't setup AC97 register 54 [ 656.222935][ T44] em28xx 6-1:0.0: couldn't setup AC97 register 56 [ 656.634964][ T44] em28xx 6-1:0.0: couldn't setup AC97 register 2 [ 656.649549][ T44] em28xx 6-1:0.0: couldn't setup AC97 register 4 [ 656.680974][ T44] em28xx 6-1:0.0: couldn't setup AC97 register 6 [ 656.738776][ T44] em28xx 6-1:0.0: couldn't setup AC97 register 54 [ 656.775505][ T44] em28xx 6-1:0.0: couldn't setup AC97 register 56 [ 656.950320][ T44] usb 6-1: USB disconnect, device number 18 [ 657.598184][T17423] fuse: Bad value for 'rootmode' [ 658.091816][T17427] tipc: Enabled bearer , priority 0 [ 658.200133][T17427] syzkaller0: entered promiscuous mode [ 658.322398][T17427] syzkaller0: entered allmulticast mode [ 658.662874][T17433] tipc: Resetting bearer [ 658.772922][T17426] tipc: Resetting bearer [ 658.972574][T17426] tipc: Disabling bearer [ 660.120477][T17449] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x6 [ 661.702329][ T30] audit: type=1804 audit(1763718560.405:294): pid=17460 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1638" name="file0" dev="ramfs" ino=50798 res=1 errno=0 [ 661.828846][ T5923] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 662.273322][ T5923] usb 4-1: Using ep0 maxpacket: 32 [ 662.541504][ T5923] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 662.550122][ T5923] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 662.558869][ T5923] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 662.671485][ T5923] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 662.691141][ T5923] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 662.721210][ T5923] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 14385, setting to 1024 [ 662.742589][ T5923] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 662.776503][ T5923] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 662.823775][ T5923] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 662.848786][ T5923] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 662.944675][ T5923] usb 4-1: config 0 descriptor?? [ 662.963860][T17458] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 663.183859][ T5923] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 28 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 663.542964][ C1] usblp0: nonzero read bulk status received: -71 [ 663.788285][ T30] audit: type=1326 audit(1763718562.535:295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17472 comm="syz.4.1642" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f830898f749 code=0x0 [ 663.862178][ T44] usb 4-1: USB disconnect, device number 28 [ 663.978884][ T44] usblp0: removed [ 665.215410][T17487] tipc: Enabled bearer , priority 0 [ 665.241834][T17487] syzkaller0: entered promiscuous mode [ 665.329920][T17487] syzkaller0: entered allmulticast mode [ 665.534901][T17486] tipc: Resetting bearer [ 665.762433][T17486] tipc: Disabling bearer [ 665.948546][T17501] tipc: Enabled bearer , priority 0 [ 666.068608][T17503] syzkaller0: entered promiscuous mode [ 666.075311][T17503] syzkaller0: entered allmulticast mode [ 666.099829][T17501] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 666.165543][T17501] tipc: Resetting bearer [ 666.231381][T17500] tipc: Resetting bearer [ 666.268639][T17500] tipc: Disabling bearer [ 666.614513][T17507] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 666.621391][T17507] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 666.642461][T17507] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 666.648664][T17507] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 666.676016][T17507] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 666.684405][T17507] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 666.694818][T17507] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 666.701003][T17507] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 667.287928][T17514] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1652'. [ 667.422956][T17519] tipc: Enabled bearer , priority 0 [ 667.430740][T17519] syzkaller0: entered promiscuous mode [ 667.436223][T17519] syzkaller0: entered allmulticast mode [ 667.489834][T17519] tipc: Resetting bearer [ 667.532060][T17516] tipc: Resetting bearer [ 667.647633][T17516] tipc: Disabling bearer [ 667.661661][ T5900] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 667.908827][ T5900] usb 6-1: Using ep0 maxpacket: 16 [ 667.954102][ T5900] usb 6-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 667.970139][ T5900] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.002996][ T5900] usb 6-1: config 0 descriptor?? [ 668.019495][ T5900] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 668.696312][ T5841] Bluetooth: hci3: command 0x0406 tx timeout [ 668.704295][ T5841] Bluetooth: hci0: command 0x0406 tx timeout [ 668.760154][ T5841] Bluetooth: hci2: command 0x0406 tx timeout [ 668.762005][T17541] Bluetooth: hci4: command 0x0406 tx timeout [ 668.940639][ T30] audit: type=1804 audit(1763718567.605:296): pid=17543 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1659" name="file0" dev="ramfs" ino=52249 res=1 errno=0 [ 669.176105][T17545] netlink: 'syz.4.1661': attribute type 1 has an invalid length. [ 669.397241][T17547] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1661'. [ 669.443028][T17547] 8021q: adding VLAN 0 to HW filter on device bond3 [ 669.507660][T17548] 8021q: adding VLAN 0 to HW filter on device bond3 [ 669.534998][T17548] bond3: (slave geneve2): making interface the new active one [ 669.585102][T17548] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 669.594501][ T6634] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 669.603743][ T6634] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 669.699981][ T6634] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 669.778875][ T6634] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 670.818870][ T5841] Bluetooth: hci3: command 0x0406 tx timeout [ 670.823007][T17541] Bluetooth: hci0: command 0x0406 tx timeout [ 670.831078][ T5841] Bluetooth: hci2: command 0x0406 tx timeout [ 670.918901][T17541] Bluetooth: hci4: command 0x0406 tx timeout [ 671.447258][ T5900] input: sonixj as /devices/platform/dummy_hcd.5/usb6/6-1/input/input29 [ 671.672678][ T5900] usb 6-1: USB disconnect, device number 19 [ 675.090899][T17583] tipc: Enabling of bearer rejected, already enabled [ 675.759508][T17598] openvswitch: netlink: Flow key attr not present in new flow. [ 675.879371][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 676.909278][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.033539][T17610] syzkaller0: entered promiscuous mode [ 677.050300][T17610] syzkaller0: entered allmulticast mode [ 677.948795][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 678.263396][T17619] netlink: 'syz.5.1678': attribute type 1 has an invalid length. [ 678.989285][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 680.028801][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 680.765726][T17619] 8021q: adding VLAN 0 to HW filter on device bond2 [ 680.797090][T17621] bond2: (slave veth3): Enslaving as an active interface with a down link [ 680.839598][T17614] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 680.845784][T17614] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 680.854487][T17614] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 680.861846][T17614] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 680.883184][T17625] bond2: (slave veth0_to_bond): making interface the new active one [ 680.892983][T17625] veth0_to_bond: entered promiscuous mode [ 680.900501][T17625] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 680.927084][T17626] vlan2: entered allmulticast mode [ 680.935508][T17626] veth0_to_bond: entered allmulticast mode [ 680.943552][T17626] bond2: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 681.068820][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 682.108800][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 683.087123][T17541] Bluetooth: hci2: command 0x0406 tx timeout [ 683.107400][T17541] Bluetooth: hci4: command 0x0406 tx timeout [ 683.113557][T17541] Bluetooth: hci3: command 0x0406 tx timeout [ 683.113993][ T5841] Bluetooth: hci0: command 0x0406 tx timeout [ 683.148782][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 684.188799][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 684.949242][ T9] usb 4-1: new full-speed USB device number 29 using dummy_hcd [ 685.228793][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.578247][ T9] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 685.601082][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 685.669285][ T9] usb 4-1: Product: syz [ 685.683500][ T9] usb 4-1: Manufacturer: syz [ 685.693652][ T9] usb 4-1: SerialNumber: syz [ 685.711469][ T9] usb 4-1: config 0 descriptor?? [ 686.058585][ T9] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 686.169567][ T30] audit: type=1804 audit(1763718584.965:297): pid=17669 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1690" name="file0" dev="ramfs" ino=53783 res=1 errno=0 [ 686.230899][T17671] loop7: detected capacity change from 16384 to 16383 [ 686.268793][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.876467][T17676] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1691'. [ 687.171514][T17679] tipc: Enabled bearer , priority 0 [ 687.190514][T17679] syzkaller0: entered promiscuous mode [ 687.196198][T17679] syzkaller0: entered allmulticast mode [ 687.308782][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.321759][T17679] tipc: Resetting bearer [ 687.362869][T17678] tipc: Resetting bearer [ 687.455878][T17678] tipc: Disabling bearer [ 687.470026][ T9] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 687.517468][ T9] usb 4-1: USB disconnect, device number 29 [ 688.348783][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 688.523744][T17697] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 689.388789][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.428806][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.504655][T17707] syzkaller0: entered promiscuous mode [ 690.538553][T17707] syzkaller0: entered allmulticast mode [ 691.120042][T17715] tipc: Enabling of bearer rejected, already enabled [ 691.247825][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 691.259419][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 691.268231][T17717] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1703'. [ 692.414318][T17737] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1708'. [ 692.446142][T17737] bridge_slave_1: left allmulticast mode [ 692.458582][T17737] bridge_slave_1: left promiscuous mode [ 692.483355][T17737] bridge0: port 2(bridge_slave_1) entered disabled state [ 692.732399][T17737] bridge_slave_0: left allmulticast mode [ 692.738181][T17737] bridge_slave_0: left promiscuous mode [ 692.752906][T17737] bridge0: port 1(bridge_slave_0) entered disabled state [ 692.889473][T17752] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 693.160455][T17749] syzkaller0: entered promiscuous mode [ 693.183203][T17749] syzkaller0: entered allmulticast mode [ 694.023933][T17758] tipc: Enabled bearer , priority 0 [ 694.031960][T17758] syzkaller0: entered promiscuous mode [ 694.037871][T17758] syzkaller0: entered allmulticast mode [ 694.228158][T17758] tipc: Resetting bearer [ 694.243882][T17755] tipc: Resetting bearer [ 694.310012][T17755] tipc: Disabling bearer [ 694.769162][ T1145] veth0_to_bond: left promiscuous mode [ 696.749480][ T5874] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 697.248983][T17778] program syz.0.1716 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 697.551990][ T5874] usb 6-1: Using ep0 maxpacket: 32 [ 697.578235][T17771] team_slave_0: entered promiscuous mode [ 697.584388][T17771] team_slave_1: entered promiscuous mode [ 697.590104][T17771] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 697.659797][T17771] vlan2: entered promiscuous mode [ 697.665261][T17771] team0: entered promiscuous mode [ 698.212459][ T5874] usb 6-1: unable to get BOS descriptor or descriptor too short [ 698.225018][ T5874] usb 6-1: no configurations [ 698.243762][ T5874] usb 6-1: can't read configurations, error -22 [ 698.952286][ T9] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 699.280003][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 699.369276][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 699.392467][ T9] usb 3-1: New USB device found, idVendor=050d, idProduct=3201, bcdDevice= 0.00 [ 699.484132][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 700.139789][ T9] usb 3-1: config 0 descriptor?? [ 700.280074][T17791] binder: 17788:17791 ioctl 400c620e 0 returned -14 [ 700.417992][ T9] usbhid 3-1:0.0: can't add hid device: -71 [ 700.424978][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 700.445295][ T9] usb 3-1: USB disconnect, device number 30 [ 701.413617][T17805] syzkaller0: entered promiscuous mode [ 701.459706][T17805] syzkaller0: entered allmulticast mode [ 702.181369][T17819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1726'. [ 702.193827][T17819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1726'. [ 702.203859][T17819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1726'. [ 702.213685][T17819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1726'. [ 702.223723][T17819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1726'. [ 702.233623][T17819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1726'. [ 702.243514][T17819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1726'. [ 702.253490][T17819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1726'. [ 702.263422][T17819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1726'. [ 702.273300][T17819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1726'. [ 702.808835][ T44] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 703.140424][ T44] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 703.206467][ T44] usb 3-1: config 0 has no interfaces? [ 703.255624][ T44] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 703.266287][ T44] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 703.284906][ T44] usb 3-1: config 0 descriptor?? [ 703.325226][T17832] tipc: Enabled bearer , priority 0 [ 703.333407][T17832] syzkaller0: entered promiscuous mode [ 703.360794][T17832] syzkaller0: entered allmulticast mode [ 703.794516][ T9] usb 3-1: USB disconnect, device number 31 [ 703.805796][T17834] tipc: Resetting bearer [ 703.906137][T17831] tipc: Resetting bearer [ 703.930532][ T44] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 704.031642][T17831] tipc: Disabling bearer [ 704.099010][ T44] usb 4-1: Using ep0 maxpacket: 32 [ 704.177777][ T44] usb 4-1: config 0 has an invalid interface number: 54 but max is 0 [ 704.202543][ T44] usb 4-1: config 0 has no interface number 0 [ 704.240391][ T44] usb 4-1: config 0 interface 54 has no altsetting 0 [ 704.280534][ T44] usb 4-1: New USB device found, idVendor=0cf2, idProduct=6250, bcdDevice=46.42 [ 704.332221][ T44] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 704.342889][ T44] usb 4-1: Product: syz [ 704.364662][ T44] usb 4-1: Manufacturer: syz [ 704.379076][ T44] usb 4-1: SerialNumber: syz [ 704.405860][ T44] usb 4-1: config 0 descriptor?? [ 704.914811][T17846] tipc: Enabled bearer , priority 0 [ 705.080553][T17850] syzkaller0: entered promiscuous mode [ 705.090591][T17850] syzkaller0: entered allmulticast mode [ 705.271921][T17846] tipc: Resetting bearer [ 705.314920][T17843] tipc: Resetting bearer [ 705.347493][T17852] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 705.430840][T17843] tipc: Disabling bearer [ 706.289980][ T44] ums_eneub6250 4-1:0.54: USB Mass Storage device detected [ 706.679654][T17861] syzkaller0: entered promiscuous mode [ 706.685405][T17861] syzkaller0: entered allmulticast mode [ 706.808618][ T44] usb 4-1: USB disconnect, device number 30 [ 707.846135][T17876] netlink: 'syz.2.1737': attribute type 1 has an invalid length. [ 708.327052][T17876] 8021q: adding VLAN 0 to HW filter on device bond5 [ 708.489294][ T44] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 708.525441][T17886] bond5: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 708.701962][ T44] usb 5-1: Using ep0 maxpacket: 32 [ 708.712257][T17884] bond5: (slave veth15): Enslaving as an active interface with a down link [ 708.731897][ T44] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 708.857639][T17876] vlan2: entered allmulticast mode [ 708.878785][ T44] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 708.909012][T17876] veth0_to_bond: entered allmulticast mode [ 708.919672][ T44] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 708.930603][T17876] bond5: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 708.951402][ T44] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 708.978811][ T44] usb 5-1: Product: syz [ 708.983152][ T44] usb 5-1: Manufacturer: syz [ 709.003664][ T44] usb 5-1: SerialNumber: syz [ 709.023121][ T44] usb 5-1: config 0 descriptor?? [ 709.066113][ T44] hub 5-1:0.0: bad descriptor, ignoring hub [ 709.072737][ T44] hub 5-1:0.0: probe with driver hub failed with error -5 [ 710.700806][T17900] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 711.240114][ T9] usb 5-1: USB disconnect, device number 40 [ 712.058904][ T2154] usb 4-1: new full-speed USB device number 31 using dummy_hcd [ 712.271340][ T2154] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 712.336272][ T2154] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 712.360416][ T2154] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 712.386050][ T2154] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 712.420123][ T2154] usb 4-1: config 0 descriptor?? [ 712.458036][ T2154] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 712.472154][ T2154] dvb-usb: bulk message failed: -22 (3/0) [ 712.515048][ T2154] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 712.609293][ T2154] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 712.658831][ T2154] usb 4-1: media controller created [ 712.666993][ T2154] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 712.764700][ T2154] dvb-usb: bulk message failed: -22 (6/0) [ 712.788952][ T2154] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 712.909193][ T2154] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input31 [ 712.971184][ T2154] dvb-usb: schedule remote query interval to 150 msecs. [ 713.068751][ T2154] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 713.242478][ T2154] dvb-usb: bulk message failed: -22 (1/0) [ 713.248497][ T2154] dvb-usb: error while querying for an remote control event. [ 713.809934][ T2154] dvb-usb: bulk message failed: -22 (1/0) [ 713.821022][ T2154] dvb-usb: error while querying for an remote control event. [ 714.038868][ T2154] dvb-usb: bulk message failed: -22 (1/0) [ 714.189081][ T2154] dvb-usb: error while querying for an remote control event. [ 714.459767][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 714.460847][ T5923] usb 4-1: USB disconnect, device number 31 [ 714.465571][ T44] dvb-usb: error while querying for an remote control event. [ 714.845103][T17932] netlink: 'syz.2.1752': attribute type 1 has an invalid length. [ 714.921928][ T5923] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 715.057108][T17934] bond6: (slave ip6gretap2): Enslaving as a backup interface with an up link [ 715.101419][ T1145] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 715.116355][T17932] 8021q: adding VLAN 0 to HW filter on device bond6 [ 715.183942][T17935] veth17: entered promiscuous mode [ 715.192907][T17935] bond6: (slave veth17): Enslaving as a backup interface with a down link [ 715.251047][ T12] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 717.222434][T17967] syz_tun: entered allmulticast mode [ 717.289913][T17967] pimreg: entered allmulticast mode [ 717.325282][T17966] syz_tun: left allmulticast mode [ 717.639498][ T5923] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 717.650444][T17982] SET target dimension over the limit! [ 717.840643][T17988] tipc: New replicast peer: 255.255.255.255 [ 717.869575][T17988] tipc: Enabled bearer , priority 10 [ 717.883425][ T5923] usb 6-1: Using ep0 maxpacket: 16 [ 717.897614][T17988] __nla_validate_parse: 31 callbacks suppressed [ 717.897663][T17988] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1766'. [ 717.914580][ T5923] usb 6-1: config 252 has an invalid interface number: 15 but max is 0 [ 717.930206][T17988] tipc: Disabling bearer [ 717.940129][ T5923] usb 6-1: config 252 has no interface number 0 [ 717.960910][ T5923] usb 6-1: config 252 interface 15 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 717.981977][T17990] tipc: Resetting bearer [ 718.016765][ T5923] usb 6-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=2b.29 [ 718.084676][ T5923] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 718.246430][ T5923] usb 6-1: Product: syz [ 718.319590][ T5923] usb 6-1: Manufacturer: syz [ 718.334317][ T5923] usb 6-1: SerialNumber: syz [ 719.862103][ T5923] usb 6-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 720.912282][ T1160] usb 6-1: Failed to submit usb control message: -110 [ 720.939800][ T1160] usb 6-1: unable to send the bmi data to the device: -110 [ 720.957278][ T1160] usb 6-1: unable to get target info from device [ 720.979257][ T1160] usb 6-1: could not get target info (-110) [ 721.019568][ T1160] usb 6-1: could not probe fw (-110) [ 722.063316][ T2154] usb 6-1: USB disconnect, device number 22 [ 723.763181][T18037] 0: reclassify loop, rule prio 0, protocol 800 [ 724.134313][ T30] audit: type=1326 audit(1763718622.935:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18020 comm="syz.5.1772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f640478f749 code=0x7ffc0000 [ 724.212118][ T30] audit: type=1326 audit(1763718622.935:299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18020 comm="syz.5.1772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f640478f749 code=0x7ffc0000 [ 724.238575][ T30] audit: type=1326 audit(1763718623.055:300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18020 comm="syz.5.1772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f640478df90 code=0x7ffc0000 [ 724.285067][ T30] audit: type=1326 audit(1763718623.085:301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18020 comm="syz.5.1772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f640478df90 code=0x7ffc0000 [ 724.346920][ T30] audit: type=1326 audit(1763718623.085:302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18020 comm="syz.5.1772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f640478f749 code=0x7ffc0000 [ 724.469692][ T30] audit: type=1326 audit(1763718623.085:303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18020 comm="syz.5.1772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f640478f749 code=0x7ffc0000 [ 724.567669][ T30] audit: type=1326 audit(1763718623.085:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18020 comm="syz.5.1772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=200 compat=0 ip=0x7f640478f749 code=0x7ffc0000 [ 724.756216][ T30] audit: type=1326 audit(1763718623.085:305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18020 comm="syz.5.1772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f640478f749 code=0x7ffc0000 [ 724.897103][ T30] audit: type=1326 audit(1763718623.085:306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18020 comm="syz.5.1772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f640478f749 code=0x7ffc0000 [ 725.016705][ C1] vkms_vblank_simulate: vblank timer overrun [ 726.297491][ T30] audit: type=1804 audit(1763718625.105:307): pid=18056 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1781" name="/newroot/353/file1" dev="fuse" ino=1 res=1 errno=0 [ 726.809677][ T44] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 726.935928][ T2154] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 727.088857][ T44] usb 5-1: Using ep0 maxpacket: 32 [ 727.094164][ T2154] usb 3-1: Using ep0 maxpacket: 8 [ 727.114075][ T2154] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 727.135160][ T44] usb 5-1: config 0 interface 0 has no altsetting 0 [ 727.171500][ T2154] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 727.187651][ T44] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 727.209258][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 727.224044][ T2154] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 727.232718][ T44] usb 5-1: Product: syz [ 727.236973][ T44] usb 5-1: Manufacturer: syz [ 727.251603][ T44] usb 5-1: SerialNumber: syz [ 727.264130][ T2154] usb 3-1: config 0 descriptor?? [ 727.281572][ T44] usb 5-1: config 0 descriptor?? [ 727.500005][ T44] gs_usb 5-1:0.0: Couldn't send data format (err=-71) [ 727.517797][ T2154] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 727.547697][ T44] gs_usb 5-1:0.0: probe with driver gs_usb failed with error -71 [ 727.598556][ T44] usb 5-1: USB disconnect, device number 41 [ 727.730944][T18082] syzkaller0: entered promiscuous mode [ 727.757022][T18082] syzkaller0: entered allmulticast mode [ 728.078160][T18069] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 728.122674][T18069] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 728.186843][ T5874] usb 3-1: USB disconnect, device number 32 [ 731.168964][ T2154] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 731.414040][ T2154] usb 5-1: Using ep0 maxpacket: 8 [ 731.451078][ T2154] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 731.472048][ T2154] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 731.514060][ T2154] usb 5-1: Product: syz [ 731.526345][ T2154] usb 5-1: Manufacturer: syz [ 731.538225][ T2154] usb 5-1: SerialNumber: syz [ 731.577115][ T2154] usb 5-1: config 0 descriptor?? [ 731.801541][ T2154] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 731.849272][ T5923] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 732.149402][ T5923] usb 6-1: Using ep0 maxpacket: 32 [ 732.158510][ T5923] usb 6-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 732.206237][ T5923] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 732.226489][ T5923] usb 6-1: Product: syz [ 732.236580][ T5923] usb 6-1: Manufacturer: syz [ 732.256905][ T5923] usb 6-1: SerialNumber: syz [ 732.280980][T18138] kvm: kvm [18137]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x800 [ 732.281343][ T5923] usb 6-1: config 0 descriptor?? [ 732.321231][T18138] kvm: kvm [18137]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x610000000800 [ 732.356954][T18138] kvm: kvm [18137]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x170000000800 [ 732.405596][ T5923] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 733.002179][ T5923] gspca_ov534_9: reg_w failed -71 [ 733.245536][ T2154] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 733.271317][ T2154] usb 5-1: USB disconnect, device number 42 [ 733.360882][ T5923] gspca_ov534_9: Unknown sensor 0000 [ 733.360981][ T5923] ov534_9 6-1:0.0: probe with driver ov534_9 failed with error -22 [ 733.483950][ T5923] usb 6-1: USB disconnect, device number 23 [ 736.259251][ T5874] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 736.309466][ T5923] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 736.434612][ T5874] usb 6-1: Using ep0 maxpacket: 8 [ 736.600638][ T5874] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 736.626420][ T5874] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 736.647785][ T5923] usb 3-1: config 0 has no interfaces? [ 736.676532][ T5923] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 736.726682][ T5874] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 736.883801][ T5923] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 736.893913][ T5874] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 736.908255][ T5923] usb 3-1: Product: syz [ 736.913840][ T5923] usb 3-1: Manufacturer: syz [ 736.930253][ T5923] usb 3-1: SerialNumber: syz [ 736.935200][ T5874] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 736.948421][T18198] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 736.967635][ T5874] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 736.990255][ T5923] usb 3-1: config 0 descriptor?? [ 737.265077][T18192] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1815'. [ 737.311309][T18187] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 737.364268][T18187] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 738.937044][ T5874] usb 6-1: usb_control_msg returned -71 [ 738.981156][ T5874] usbtmc 6-1:16.0: can't read capabilities [ 739.072035][ T5874] usb 6-1: USB disconnect, device number 24 [ 739.195142][T18215] netlink: 'syz.3.1821': attribute type 10 has an invalid length. [ 739.246479][T18214] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 739.599382][ T5874] usb 3-1: USB disconnect, device number 33 [ 741.379365][T18248] sit3: entered allmulticast mode [ 743.160574][ T5874] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 743.439512][ T5874] usb 6-1: Using ep0 maxpacket: 8 [ 743.549839][ T5874] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 743.576055][ T5874] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 743.657694][ T5874] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 743.780972][ T5874] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 743.925047][ T5874] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 744.043751][ T5874] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 745.146057][T18288] binder: 18287:18288 unknown command 0 [ 745.153276][T18288] binder: 18287:18288 ioctl c0306201 200000000080 returned -22 [ 745.167309][T18288] binder: 18287:18288 ioctl c0306201 200000000300 returned -11 [ 746.082252][ T5874] usb 6-1: usb_control_msg returned -71 [ 746.206718][ T5874] usbtmc 6-1:16.0: can't read capabilities [ 746.277217][T18302] binder: 18290:18302 ioctl c0306201 200000000180 returned -14 [ 746.306761][ T5874] usb 6-1: USB disconnect, device number 25 [ 746.469658][T18306] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x6 [ 748.661851][ T2154] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 749.122013][ T2154] usb 5-1: Using ep0 maxpacket: 16 [ 749.139268][ T2154] usb 5-1: New USB device found, idVendor=0483, idProduct=1234, bcdDevice=ff.76 [ 749.149213][ T2154] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.157235][ T2154] usb 5-1: Product: syz [ 749.162406][ T2154] usb 5-1: Manufacturer: syz [ 749.167019][ T2154] usb 5-1: SerialNumber: syz [ 749.200169][ T2154] usb 5-1: config 0 descriptor?? [ 749.439823][ T2154] usb 5-1: ignoring: not an USB2CAN converter [ 750.439469][ T5874] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 750.469861][T18353] netlink: 'syz.5.1858': attribute type 12 has an invalid length. [ 750.628878][ T5874] usb 3-1: Using ep0 maxpacket: 8 [ 750.643680][ T5874] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 750.654774][ T5874] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 750.671992][ T5874] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 750.721197][ T5874] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 750.765841][ T5874] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 750.791866][ T5874] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 751.113143][ T30] audit: type=1326 audit(1763718649.925:308): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18355 comm="syz.0.1859" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f9b82d8f749 code=0x0 [ 751.229556][ T9] usb 5-1: USB disconnect, device number 43 [ 752.495409][T18372] netlink: zone id is out of range [ 752.532511][T18372] netlink: zone id is out of range [ 752.565638][T18372] netlink: zone id is out of range [ 752.582401][T18372] netlink: zone id is out of range [ 752.597836][T18372] netlink: zone id is out of range [ 752.606621][T18372] netlink: zone id is out of range [ 752.611941][T18372] netlink: zone id is out of range [ 752.617372][T18372] netlink: zone id is out of range [ 752.622984][T18372] netlink: zone id is out of range [ 752.628596][T18372] netlink: zone id is out of range [ 752.674632][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 752.681889][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 752.894385][ T24] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 753.032903][T18382] IPVS: set_ctl: invalid protocol: 44 10.1.1.1:20004 [ 753.061862][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 753.091291][ T24] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 753.136627][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 753.218269][ T5874] usb 3-1: usb_control_msg returned -71 [ 753.236583][ T5874] usbtmc 3-1:16.0: can't read capabilities [ 753.271978][ T5874] usb 3-1: USB disconnect, device number 34 [ 753.340282][ T24] usb 5-1: config 0 descriptor?? [ 753.349752][ T24] pwc: Askey VC010 type 2 USB webcam detected. [ 753.837626][ T24] pwc: recv_control_msg error -32 req 02 val 2b00 [ 753.849370][ T24] pwc: recv_control_msg error -32 req 02 val 2700 [ 753.860554][ T24] pwc: recv_control_msg error -32 req 02 val 2c00 [ 753.877881][ T24] pwc: recv_control_msg error -32 req 04 val 1000 [ 753.927375][ T24] pwc: recv_control_msg error -32 req 04 val 1300 [ 753.950963][ T24] pwc: recv_control_msg error -32 req 04 val 1400 [ 753.971339][ T24] pwc: recv_control_msg error -32 req 02 val 2000 [ 753.985657][ T24] pwc: recv_control_msg error -32 req 02 val 2100 [ 754.009580][ T24] pwc: recv_control_msg error -32 req 04 val 1500 [ 754.028071][ T24] pwc: recv_control_msg error -32 req 02 val 2500 [ 754.050916][ T24] pwc: recv_control_msg error -32 req 02 val 2400 [ 754.079641][ T24] pwc: recv_control_msg error -32 req 02 val 2600 [ 754.109544][ T24] pwc: recv_control_msg error -32 req 02 val 2900 [ 754.130206][ T24] pwc: recv_control_msg error -32 req 02 val 2800 [ 754.349427][ T24] pwc: recv_control_msg error -71 req 04 val 1200 [ 754.470331][ T24] pwc: Registered as video103. [ 754.528025][ T24] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input32 [ 754.598225][ T24] usb 5-1: USB disconnect, device number 44 [ 755.708372][T18405] vivid-007: ================= START STATUS ================= [ 755.718055][T18405] vivid-007: Enable Output Cropping: true [ 755.728164][T18405] vivid-007: Enable Output Composing: true [ 755.745367][T18405] vivid-007: Enable Output Scaler: true [ 755.760362][T18405] vivid-007: Tx RGB Quantization Range: Automatic [ 755.791117][T18405] vivid-007: Transmit Mode: HDMI [ 755.798855][T18405] vivid-007: Hotplug Present: 0x00000000 [ 755.817284][T18405] vivid-007: RxSense Present: 0x00000000 [ 755.828655][T18405] vivid-007: EDID Present: 0x00000000 [ 755.839205][T18405] vivid-007: ================== END STATUS ================== [ 756.924682][T18422] netlink: 'syz.0.1876': attribute type 12 has an invalid length. [ 758.029053][ T5874] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 758.179317][ T5874] usb 6-1: Using ep0 maxpacket: 8 [ 758.186284][ T5874] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 758.198326][ T5874] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 758.209962][ T5874] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 758.234815][ T5874] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 758.268033][ T5874] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 758.297790][ T5874] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 758.533748][ T5874] usb 6-1: GET_CAPABILITIES returned 0 [ 758.589582][ T5874] usbtmc 6-1:16.0: can't read capabilities [ 759.652314][T18457] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1886'. [ 759.682797][T18457] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1886'. [ 760.571993][ T2154] usb 6-1: USB disconnect, device number 26 [ 760.619503][T18471] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 761.559017][ T2154] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 763.331623][ T5923] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 763.539341][ T5923] usb 4-1: Using ep0 maxpacket: 8 [ 763.546651][ T5923] usb 4-1: config 0 has no interfaces? [ 763.555060][ T5923] usb 4-1: New USB device found, idVendor=050d, idProduct=3201, bcdDevice= 0.00 [ 763.566024][ T5923] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 763.584397][ T5923] usb 4-1: config 0 descriptor?? [ 763.837179][ T5923] usb 4-1: USB disconnect, device number 32 [ 763.932398][T18511] mac80211_hwsim hwsim4 syzkaller0: left promiscuous mode [ 763.944692][T18511] mac80211_hwsim hwsim4 syzkaller0: left allmulticast mode [ 770.057839][T18581] netlink: 220 bytes leftover after parsing attributes in process `syz.0.1912'. [ 770.092427][T18581] netlink: 220 bytes leftover after parsing attributes in process `syz.0.1912'. [ 770.092458][T18581] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1912'. [ 770.478823][ T24] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 770.654855][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 770.683935][ T24] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 770.698132][ T24] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 770.722116][ T24] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 770.772017][ T24] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 770.834259][T18592] net_ratelimit: 31 callbacks suppressed [ 770.834281][T18592] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x6 [ 770.857792][ T24] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 770.926825][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 771.247477][T18595] syzkaller0: entered promiscuous mode [ 771.259984][T18582] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.298208][T18582] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 771.306368][T18595] syzkaller0: entered allmulticast mode [ 771.395342][T18595] tipc: Enabled bearer , priority 0 [ 771.458590][T18594] tipc: Resetting bearer [ 771.516570][T18594] tipc: Disabling bearer [ 772.310790][T18601] netlink: 'syz.0.1919': attribute type 1 has an invalid length. [ 772.446683][T18601] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 772.506160][T18601] veth5: entered promiscuous mode [ 772.518047][T18601] bond2: (slave veth5): Enslaving as a backup interface with a down link [ 772.527555][T18603] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1919'. [ 772.541920][T18603] 8021q: adding VLAN 0 to HW filter on device bond2 [ 772.542248][ T6634] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 772.693704][ T6634] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 773.076339][ T24] usb 5-1: usb_control_msg returned -71 [ 773.104953][ T24] usbtmc 5-1:16.0: can't read capabilities [ 773.191135][ T24] usb 5-1: USB disconnect, device number 45 [ 773.271558][T18616] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1924'. [ 773.383369][T18619] bridge0: port 1(veth9) entered blocking state [ 773.436605][T18619] bridge0: port 1(veth9) entered disabled state [ 773.462658][T18619] veth9: entered allmulticast mode [ 773.475638][T18619] veth9: entered promiscuous mode [ 773.538618][T18616] bridge0: port 2(erspan0) entered blocking state [ 773.540382][T18616] bridge0: port 2(erspan0) entered disabled state [ 773.540513][T18616] erspan0: entered allmulticast mode [ 773.543448][T18616] erspan0: entered promiscuous mode [ 773.596843][T18623] vlan3: entered allmulticast mode [ 773.596870][T18623] veth0_to_bond: entered allmulticast mode [ 773.597188][T18623] bridge0: port 3(vlan3) entered blocking state [ 773.597298][T18623] bridge0: port 3(vlan3) entered disabled state [ 773.615394][T18623] vlan3: entered promiscuous mode [ 773.615413][T18623] veth0_to_bond: entered promiscuous mode [ 773.907653][T18631] netlink: 'syz.4.1926': attribute type 12 has an invalid length. [ 773.995904][T18633] IPVS: nq: FWM 3 0x00000003 - no destination available [ 774.082190][ T24] IPVS: starting estimator thread 0... [ 774.179411][T18635] IPVS: using max 36 ests per chain, 86400 per kthread [ 776.106842][T18656] syzkaller0: entered promiscuous mode [ 776.113176][T18656] syzkaller0: entered allmulticast mode [ 777.320863][ T24] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 777.509513][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 777.649269][ T24] usb 3-1: config 0 has an invalid interface descriptor of length 8, skipping [ 777.676822][ T24] usb 3-1: config 0 descriptor has 1 excess byte, ignoring [ 777.684203][ T24] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 777.701215][ T24] usb 3-1: New USB device found, idVendor=10b9, idProduct=8000, bcdDevice=c0.fa [ 777.719996][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 777.739487][ T24] usb 3-1: Product: syz [ 777.744654][T18672] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1936'. [ 777.759002][ T24] usb 3-1: Manufacturer: syz [ 777.800992][ T24] usb 3-1: SerialNumber: syz [ 777.832231][T18676] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1937'. [ 777.856372][ T24] usb 3-1: config 0 descriptor?? [ 778.091679][T18677] bridge2: port 1(veth7) entered blocking state [ 778.149193][T18677] bridge2: port 1(veth7) entered disabled state [ 778.169674][T18677] veth7: entered allmulticast mode [ 778.221555][T18677] veth7: entered promiscuous mode [ 778.254119][T18676] bridge2: port 2(veth0_to_bond) entered blocking state [ 778.280209][T18676] bridge2: port 2(veth0_to_bond) entered disabled state [ 778.304398][T18676] veth0_to_bond: entered allmulticast mode [ 778.345564][T18680] kvm: kvm [18679]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x20 [ 778.363618][T18680] kvm: kvm [18679]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0xe0 [ 778.381332][T18676] veth0_to_bond: entered promiscuous mode [ 778.419459][T18678] vlan2: entered allmulticast mode [ 778.457233][T18678] veth1: entered allmulticast mode [ 778.483813][T18678] bridge2: port 3(vlan2) entered blocking state [ 778.513735][T18678] bridge2: port 3(vlan2) entered disabled state [ 778.553832][T18678] vlan2: entered promiscuous mode [ 778.577889][T18678] veth1: entered promiscuous mode [ 779.569613][ T5874] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 779.769552][ T5874] usb 4-1: Using ep0 maxpacket: 32 [ 779.777378][ T5874] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 779.787477][ T5874] usb 4-1: config 0 has no interface number 0 [ 779.799954][ T5874] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 779.837699][ T5874] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 779.859237][ T44] usb 6-1: new full-speed USB device number 28 using dummy_hcd [ 779.866932][ T5874] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 779.866964][ T5874] usb 4-1: Product: syz [ 779.866982][ T5874] usb 4-1: Manufacturer: syz [ 779.866999][ T5874] usb 4-1: SerialNumber: syz [ 779.909848][ T5874] usb 4-1: config 0 descriptor?? [ 779.947344][ T5874] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 779.977088][ T5874] em28xx 4-1:0.132: Video interface 132 found: [ 780.163692][ T44] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 780.187866][ T44] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.217466][ T44] usb 6-1: Product: syz [ 780.227398][ T44] usb 6-1: Manufacturer: syz [ 780.274536][ T44] usb 6-1: SerialNumber: syz [ 780.338238][ T44] usb 6-1: config 0 descriptor?? [ 780.390229][ T5874] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 780.585582][ T44] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 781.077012][ T5874] em28xx 4-1:0.132: failed to trigger write to i2c address 0xa0 (error=-5) [ 781.108319][ T5874] em28xx 4-1:0.132: failed to read eeprom (err=-5) [ 781.123645][ T5874] em28xx 4-1:0.132: em28xx_i2c_register: em28xx_i2_eeprom failed! retval [-5] [ 781.125403][ T24] usb 3-1: USB disconnect, device number 35 [ 781.163822][T18709] kvm: kvm [18708]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x800 [ 781.214577][T18709] kvm: kvm [18708]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x610000000800 [ 781.230045][ T5874] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 781.236820][T18709] kvm: kvm [18708]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x170000000800 [ 781.266308][ T5874] em28xx 4-1:0.132: analog set to bulk mode. [ 781.294800][ T9] em28xx 4-1:0.132: Registering V4L2 extension [ 781.328401][ T5874] usb 4-1: USB disconnect, device number 33 [ 781.361726][ T5874] em28xx 4-1:0.132: Disconnecting em28xx [ 781.574423][ T9] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 781.582655][ T9] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 781.607839][ T9] em28xx 4-1:0.132: No AC97 audio processor [ 781.638087][ T9] usb 4-1: Decoder not found [ 781.661711][ T9] em28xx 4-1:0.132: failed to create media graph [ 781.694926][ T9] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 781.782946][ T9] em28xx 4-1:0.132: Remote control support is not available for this card. [ 781.814525][T18722] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1949'. [ 781.829498][ T5874] em28xx 4-1:0.132: Closing input extension [ 781.870957][ T5874] em28xx 4-1:0.132: Freeing device [ 781.997532][T18724] syzkaller0: entered promiscuous mode [ 782.027806][T18724] syzkaller0: entered allmulticast mode [ 782.222343][T18726] vlan2: entered promiscuous mode [ 782.224871][T18730] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1951'. [ 782.262440][T18726] vlan2: entered allmulticast mode [ 782.284016][T18726] hsr_slave_1: entered allmulticast mode [ 782.312219][ T44] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 782.336933][ T44] usb 6-1: USB disconnect, device number 28 [ 784.156170][T18752] input: syz1 as /devices/virtual/input/input33 [ 787.295231][T18783] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1962'. [ 788.129107][T18797] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x6 [ 792.258765][ T2154] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 792.638918][ T2154] usb 6-1: Using ep0 maxpacket: 16 [ 792.655859][ T2154] usb 6-1: config 0 has no interfaces? [ 792.694264][ T2154] usb 6-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 792.722350][ T2154] usb 6-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 792.749717][ T2154] usb 6-1: Product: syz [ 792.763684][ T2154] usb 6-1: Manufacturer: syz [ 792.778235][ T2154] usb 6-1: SerialNumber: syz [ 792.805967][ T2154] usb 6-1: config 0 descriptor?? [ 795.743563][ T9] usb 6-1: USB disconnect, device number 29 [ 796.121364][T18869] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1978'. [ 796.419227][ T9] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 796.639915][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 796.668544][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 796.772617][ T9] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 796.799855][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 796.862363][ T9] usb 4-1: SerialNumber: syz [ 797.145358][ T9] usb 4-1: 0:2 : does not exist [ 797.161154][ T9] usb 4-1: unit 255 not found! [ 797.164802][ T2154] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 797.203062][ T9] usb 4-1: 5:0: cannot get min/max values for control 4 (id 5) [ 797.250410][ T9] usb 4-1: USB disconnect, device number 34 [ 797.336043][ T2154] usb 6-1: Using ep0 maxpacket: 8 [ 797.343066][ T2154] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 797.388483][ T2154] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 797.430447][T18880] mac80211_hwsim hwsim4 syzkaller0: entered promiscuous mode [ 797.437902][T18880] mac80211_hwsim hwsim4 syzkaller0: entered allmulticast mode [ 797.455622][ T2154] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 797.489408][ T2154] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 797.511539][T18880] tipc: Enabling of bearer rejected, already enabled [ 797.556989][ T2154] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 797.578716][ T2154] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 797.884848][T18889] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 798.405810][T18898] ip6tnl1: entered promiscuous mode [ 798.463370][T18898] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1986'. [ 798.586278][ T30] audit: type=1326 audit(1763718697.395:309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18899 comm="syz.0.1987" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 798.733894][T18905] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1988'. [ 798.757994][ T30] audit: type=1326 audit(1763718697.395:310): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18899 comm="syz.0.1987" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 798.814975][ T30] audit: type=1326 audit(1763718697.395:311): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18899 comm="syz.0.1987" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 798.849181][ T30] audit: type=1326 audit(1763718697.395:312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18899 comm="syz.0.1987" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 798.901412][ T1091] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 798.930786][T18905] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1988'. [ 798.941412][ T30] audit: type=1326 audit(1763718697.395:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18899 comm="syz.0.1987" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 799.043477][ T6634] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 799.079623][ T30] audit: type=1326 audit(1763718697.395:314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18899 comm="syz.0.1987" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 799.114581][ T6634] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 799.196602][ T30] audit: type=1326 audit(1763718697.395:315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18899 comm="syz.0.1987" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 799.220527][ T6634] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 799.318257][ T30] audit: type=1326 audit(1763718697.395:316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18899 comm="syz.0.1987" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 799.401359][ T30] audit: type=1326 audit(1763718697.395:317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18899 comm="syz.0.1987" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 799.452293][ T30] audit: type=1326 audit(1763718697.395:318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18899 comm="syz.0.1987" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 799.771589][ T2154] usb 6-1: usb_control_msg returned -71 [ 799.841984][ T2154] usbtmc 6-1:16.0: can't read capabilities [ 799.971052][ T2154] usb 6-1: USB disconnect, device number 30 [ 800.303050][T18920] syzkaller0: entered promiscuous mode [ 800.367487][T18920] syzkaller0: entered allmulticast mode [ 800.478787][ T2154] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 800.722159][ T2154] usb 6-1: config 4 has an invalid interface number: 88 but max is 0 [ 800.751129][ T2154] usb 6-1: config 4 has no interface number 0 [ 800.903166][ T2154] usb 6-1: config 4 interface 88 altsetting 119 has a duplicate endpoint with address 0xB, skipping [ 800.945716][ T2154] usb 6-1: config 4 interface 88 has no altsetting 0 [ 800.979189][ T2154] usb 6-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=af.e7 [ 801.002258][ T2154] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 801.024828][ T2154] usb 6-1: Product: syz [ 801.038776][ T2154] usb 6-1: Manufacturer: syz [ 801.053841][ T2154] usb 6-1: SerialNumber: syz [ 801.325574][ T2154] usb 6-1: USB disconnect, device number 31 [ 804.055024][T18959] tipc: Enabling of bearer rejected, failed to enable media [ 804.788084][T18972] sch_tbf: burst 2 is lower than device syzkaller0 mtu (313) ! [ 805.006795][ T2154] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 805.130591][T18977] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2006'. [ 805.202721][ T2154] usb 6-1: Using ep0 maxpacket: 8 [ 805.220041][ T2154] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 805.265207][ T2154] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 805.302946][ T2154] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 805.348765][ T2154] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 805.412665][ T2154] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 805.458755][ T2154] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 806.396849][T18995] mac80211_hwsim hwsim4 syzkaller0: left promiscuous mode [ 806.416950][T18995] mac80211_hwsim hwsim4 syzkaller0: left allmulticast mode [ 807.691727][ T2154] usb 6-1: usb_control_msg returned -71 [ 807.729304][ T2154] usbtmc 6-1:16.0: can't read capabilities [ 807.811567][ T2154] usb 6-1: USB disconnect, device number 32 [ 809.358317][T19027] tipc: Enabled bearer , priority 0 [ 809.392131][T19027] syzkaller0: entered promiscuous mode [ 809.423547][T19027] syzkaller0: entered allmulticast mode [ 809.472713][T19027] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 809.672782][T19033] tipc: Resetting bearer [ 809.705963][T19025] tipc: Resetting bearer [ 809.710382][ T5874] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 809.803056][T19025] tipc: Disabling bearer [ 809.905421][ T5874] usb 5-1: config 4 has an invalid interface number: 88 but max is 0 [ 809.965189][ T5874] usb 5-1: config 4 has no interface number 0 [ 809.992229][ T5874] usb 5-1: config 4 interface 88 altsetting 119 has a duplicate endpoint with address 0xB, skipping [ 810.062040][ T5874] usb 5-1: config 4 interface 88 has no altsetting 0 [ 810.115480][ T5874] usb 5-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=af.e7 [ 810.154030][ T5874] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 810.249658][ T5874] usb 5-1: Product: syz [ 810.290328][ T5874] usb 5-1: Manufacturer: syz [ 810.302775][T19040] nvme_fabrics: missing parameter 'transport=%s' [ 810.312734][T19040] nvme_fabrics: missing parameter 'nqn=%s' [ 810.342628][ T5874] usb 5-1: SerialNumber: syz [ 812.937122][ T2154] usb 5-1: USB disconnect, device number 46 [ 813.503554][ T2154] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 813.766421][T19085] netlink: 'syz.3.2034': attribute type 10 has an invalid length. [ 813.827307][T19083] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 813.954814][ T2154] usb 5-1: config 4 has an invalid interface number: 88 but max is 0 [ 813.963032][ T2154] usb 5-1: config 4 has no interface number 0 [ 813.971127][T19088] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 813.977517][T19088] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 813.994214][T19088] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 814.004022][T19088] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 814.017011][T19088] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 814.023899][T19088] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 814.035706][T19088] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 814.043145][T19088] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 814.054961][ T2154] usb 5-1: config 4 interface 88 altsetting 119 has a duplicate endpoint with address 0xB, skipping [ 814.076083][ T2154] usb 5-1: config 4 interface 88 has no altsetting 0 [ 814.103450][ T2154] usb 5-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=af.e7 [ 814.117840][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 814.126046][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 814.179629][ T2154] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 814.187944][ T2154] usb 5-1: Product: syz [ 814.241146][ T2154] usb 5-1: Manufacturer: syz [ 814.245879][ T2154] usb 5-1: SerialNumber: syz [ 814.971424][T19098] syzkaller0: entered promiscuous mode [ 814.987766][T19098] syzkaller0: entered allmulticast mode [ 815.068555][T19098] tipc: Enabled bearer , priority 0 [ 815.094923][T19096] tipc: Resetting bearer [ 815.146883][T19096] tipc: Disabling bearer [ 816.875442][ T24] usb 5-1: USB disconnect, device number 47 [ 817.179425][T19116] mac80211_hwsim hwsim4 syzkaller0: entered promiscuous mode [ 817.221098][T19116] mac80211_hwsim hwsim4 syzkaller0: entered allmulticast mode [ 818.539423][ T5923] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 818.759591][ T5923] usb 5-1: Using ep0 maxpacket: 16 [ 818.773563][ T5923] usb 5-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 818.822186][ T5923] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 818.853505][ T5923] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 818.874047][ T5923] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 818.917923][ T5923] usb 5-1: Product: syz [ 818.930782][ T5923] usb 5-1: Manufacturer: syz [ 818.940869][ T5923] usb 5-1: SerialNumber: syz [ 819.173961][ T5923] usb 5-1: 0:2 : does not exist [ 819.183896][ T2154] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 819.386550][ T2154] usb 3-1: Using ep0 maxpacket: 8 [ 819.393556][ T5923] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 819.408415][ T2154] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 819.458403][ T5923] usb 5-1: USB disconnect, device number 48 [ 819.530203][ T6448] udevd[6448]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 819.710235][ T2154] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 819.948486][ T2154] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 820.112662][ T2154] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 820.359620][ T2154] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 820.372325][ T2154] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 820.787149][T19139] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 820.851228][T19139] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 822.316991][T19159] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2054'. [ 822.632580][T19163] kvm: kvm [19160]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x10 [ 822.710075][T19163] kvm: kvm [19160]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0xc1) = 0x4010 [ 822.764515][T19163] kvm: kvm [19160]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x61 [ 822.791182][T19159] bridge_slave_1: left allmulticast mode [ 822.807651][T19159] bridge_slave_1: left promiscuous mode [ 822.823420][T19159] bridge0: port 2(bridge_slave_1) entered disabled state [ 822.884269][T19159] bridge_slave_0: left allmulticast mode [ 822.892314][T19159] bridge_slave_0: left promiscuous mode [ 822.901977][T19159] bridge0: port 1(bridge_slave_0) entered disabled state [ 822.983824][T19163] kvm: kvm [19160]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0xc2) = 0x4061 [ 823.007542][T19163] kvm: kvm [19160]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x0 [ 823.047375][T19163] kvm: kvm [19160]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0x11e) = 0x4000 [ 823.171541][T19163] kvm: kvm [19160]: vcpu0, guest rIP: 0x1be Unhandled WRMSR(0x186) = 0x4000 [ 823.982624][ T2154] usb 3-1: usb_control_msg returned -71 [ 823.988359][ T2154] usbtmc 3-1:16.0: can't read capabilities [ 824.072154][ T2154] usb 3-1: USB disconnect, device number 36 [ 827.329492][ T5923] usb 5-1: new full-speed USB device number 49 using dummy_hcd [ 827.528061][ T5923] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 827.582222][ T5923] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 827.661979][ T5923] usb 5-1: Product: syz [ 827.699949][ T5923] usb 5-1: Manufacturer: syz [ 827.704665][ T5923] usb 5-1: SerialNumber: syz [ 827.747154][ T5923] usb 5-1: config 0 descriptor?? [ 827.958220][ T30] kauditd_printk_skb: 16 callbacks suppressed [ 827.958239][ T30] audit: type=1326 audit(1763718726.765:335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19203 comm="syz.5.2066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f640478f749 code=0x7ffc0000 [ 827.991376][ T30] audit: type=1326 audit(1763718726.805:336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19203 comm="syz.5.2066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f640478f749 code=0x7ffc0000 [ 828.017860][ T30] audit: type=1326 audit(1763718726.835:337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19203 comm="syz.5.2066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f640478f749 code=0x7ffc0000 [ 828.103913][ T5923] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 828.137383][ T30] audit: type=1326 audit(1763718726.905:338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19203 comm="syz.5.2066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f640478f749 code=0x7ffc0000 [ 828.229415][ T30] audit: type=1326 audit(1763718726.905:339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19203 comm="syz.5.2066" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f640478f749 code=0x7ffc0000 [ 829.329532][ T5874] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 829.510450][ T5874] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 829.531219][ T5923] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 829.573855][ T5874] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 829.655171][ T5874] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 829.667694][ T5923] usb 5-1: USB disconnect, device number 49 [ 829.722500][ T5874] usb 3-1: config 0 interface 0 has no altsetting 0 [ 829.784865][ T5874] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 829.827438][ T5874] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 829.935689][ T5874] usb 3-1: config 0 interface 0 has no altsetting 0 [ 829.938229][T19228] loop6: detected capacity change from 0 to 524288000 [ 829.980309][ T5874] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 830.019574][ T5874] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 830.080119][ T5874] usb 3-1: config 0 interface 0 has no altsetting 0 [ 830.131313][ T5874] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 830.157152][ T5874] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 830.206774][ T5874] usb 3-1: config 0 interface 0 has no altsetting 0 [ 830.277067][ T5874] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 830.298370][ T5874] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 830.382969][ T5874] usb 3-1: config 0 interface 0 has no altsetting 0 [ 830.431682][ T5874] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 830.470649][ T5874] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 830.533885][ T5874] usb 3-1: config 0 interface 0 has no altsetting 0 [ 830.562329][ T5874] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 830.649378][ T5874] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 830.721402][ T5874] usb 3-1: config 0 interface 0 has no altsetting 0 [ 830.801273][ T5874] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 830.861602][ T5874] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 830.938220][ T5874] usb 3-1: config 0 interface 0 has no altsetting 0 [ 831.015405][ T5874] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 831.033922][ T5874] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 831.109418][ T5874] usb 3-1: Product: syz [ 831.152856][ T5874] usb 3-1: Manufacturer: syz [ 831.173173][ T5874] usb 3-1: SerialNumber: syz [ 831.219947][ T5874] usb 3-1: config 0 descriptor?? [ 831.263401][ T5874] yurex 3-1:0.0: USB YUREX device now attached to Yurex #0 [ 831.649752][ C0] usb 3-1: yurex_control_callback - control failed: -71 [ 831.659307][ C0] usb 3-1: yurex_control_callback - control failed: -71 [ 831.667061][ T5874] usb 3-1: USB disconnect, device number 37 [ 831.682600][T19241] mac80211_hwsim hwsim12 syzkaller0: entered promiscuous mode [ 831.699938][T19241] mac80211_hwsim hwsim12 syzkaller0: entered allmulticast mode [ 831.821674][ T5874] yurex 3-1:0.0: USB YUREX #0 now disconnected [ 831.825820][T19245] ALSA: mixer_oss: invalid OSS volume '' [ 834.719377][ T2154] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 834.932818][ T2154] usb 5-1: config 4 has an invalid interface number: 88 but max is 0 [ 834.960224][ T2154] usb 5-1: config 4 has no interface number 0 [ 834.991865][ T2154] usb 5-1: config 4 interface 88 altsetting 119 has a duplicate endpoint with address 0xB, skipping [ 835.126724][ T2154] usb 5-1: config 4 interface 88 has no altsetting 0 [ 835.287988][ T2154] usb 5-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=af.e7 [ 835.297553][ T2154] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 835.305700][ T2154] usb 5-1: Product: syz [ 835.309996][ T2154] usb 5-1: Manufacturer: syz [ 835.314620][ T2154] usb 5-1: SerialNumber: syz [ 835.371815][T19310] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2091'. [ 835.718863][ T2154] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 835.729421][ T5923] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 835.917606][ T2154] usb 4-1: config 4 has an invalid interface number: 88 but max is 0 [ 835.932426][ T2154] usb 4-1: config 4 has no interface number 0 [ 835.965577][ T2154] usb 4-1: config 4 interface 88 altsetting 119 has a duplicate endpoint with address 0xB, skipping [ 835.997900][ T2154] usb 4-1: config 4 interface 88 has no altsetting 0 [ 836.028617][ T2154] usb 4-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=af.e7 [ 836.061118][ T2154] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.085845][ T2154] usb 4-1: Product: syz [ 836.099367][ T2154] usb 4-1: Manufacturer: syz [ 836.113771][ T2154] usb 4-1: SerialNumber: syz [ 836.168734][ T5923] usb 6-1: Using ep0 maxpacket: 16 [ 836.210370][ T5923] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 836.218424][ T5923] usb 6-1: config 0 has no interface number 0 [ 836.349782][ T5923] usb 6-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 836.364628][ T5923] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.414817][ T5923] usb 6-1: Product: syz [ 836.425287][ T5923] usb 6-1: Manufacturer: syz [ 836.475571][ T5923] usb 6-1: SerialNumber: syz [ 836.590004][ T5923] usb 6-1: config 0 descriptor?? [ 836.598114][ T5923] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 836.797251][ T5923] gspca_spca1528: reg_w err -71 [ 836.819518][ T5923] spca1528 6-1:0.1: probe with driver spca1528 failed with error -71 [ 836.832243][ T5923] usb 6-1: USB disconnect, device number 33 [ 837.509883][ T5923] usb 5-1: USB disconnect, device number 50 [ 838.675563][ T5900] usb 4-1: USB disconnect, device number 35 [ 839.501417][T19339] tipc: Enabled bearer , priority 0 [ 840.348904][ T2154] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 840.510598][ T2154] usb 3-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 840.525498][ T2154] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 840.541011][T19353] netlink: 84 bytes leftover after parsing attributes in process `syz.0.2100'. [ 840.574087][ T2154] usb 3-1: config 0 descriptor?? [ 840.617146][ T2154] gspca_main: spca508-2.14.0 probing 8086:0110 [ 840.632438][ T9] tipc: Node number set to 1326377580 [ 840.663513][T19353] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 841.319139][ T2154] gspca_spca508: reg_read err -110 [ 841.331858][ T2154] gspca_spca508: reg_read err -32 [ 841.348894][ T2154] gspca_spca508: reg_read err -32 [ 841.357920][ T2154] gspca_spca508: reg_read err -32 [ 841.374468][ T2154] gspca_spca508: reg write: error -32 [ 841.399139][ T2154] spca508 3-1:0.0: probe with driver spca508 failed with error -32 [ 841.715127][ T2154] usb 3-1: USB disconnect, device number 38 [ 842.399409][ T9] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 842.552085][ T9] usb 4-1: config 4 has an invalid interface number: 88 but max is 0 [ 842.607160][ T9] usb 4-1: config 4 has no interface number 0 [ 842.627208][ T9] usb 4-1: config 4 interface 88 altsetting 119 has a duplicate endpoint with address 0xB, skipping [ 842.670504][ T9] usb 4-1: config 4 interface 88 has no altsetting 0 [ 842.723216][T19374] netlink: 44 bytes leftover after parsing attributes in process `syz.5.2108'. [ 842.809694][ T9] usb 4-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=af.e7 [ 842.855710][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 842.892485][ T9] usb 4-1: Product: syz [ 842.905697][ T9] usb 4-1: Manufacturer: syz [ 842.924781][ T9] usb 4-1: SerialNumber: syz [ 843.211803][ T9] usb 4-1: USB disconnect, device number 36 [ 846.180405][T19408] ALSA: mixer_oss: invalid OSS volume '' [ 846.190170][T19413] netlink: 'syz.5.2118': attribute type 12 has an invalid length. [ 847.698774][ T5900] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 847.941034][ T5900] usb 6-1: Using ep0 maxpacket: 16 [ 847.953354][T19411] syz.2.2117 (19411): drop_caches: 2 [ 848.050740][ T5900] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 848.087653][ T5900] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 848.400419][ T5900] usb 6-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 848.446692][ T5900] usb 6-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 848.475960][ T5900] usb 6-1: Product: syz [ 848.486041][ T5900] usb 6-1: Manufacturer: syz [ 848.496170][ T5900] usb 6-1: SerialNumber: syz [ 848.517023][ T5900] usb 6-1: config 0 descriptor?? [ 848.858841][T19431] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 848.894541][T19431] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 849.059240][ T5874] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 849.294333][ T5874] usb 3-1: config 4 has an invalid interface number: 88 but max is 0 [ 849.338050][ T5874] usb 3-1: config 4 has no interface number 0 [ 849.379533][ T5874] usb 3-1: config 4 interface 88 altsetting 119 has a duplicate endpoint with address 0xB, skipping [ 849.413425][ T5874] usb 3-1: config 4 interface 88 has no altsetting 0 [ 849.460346][ T5874] usb 3-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=af.e7 [ 849.482768][ T5874] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 849.494635][ T5874] usb 3-1: Product: syz [ 849.501505][ T5874] usb 3-1: Manufacturer: syz [ 849.506174][ T5874] usb 3-1: SerialNumber: syz [ 850.833722][ T5874] usb 6-1: USB disconnect, device number 34 [ 851.509868][ T5874] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 851.577842][ T9] usb 3-1: USB disconnect, device number 39 [ 851.679620][ T5874] usb 6-1: Using ep0 maxpacket: 16 [ 851.687136][ T5874] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 851.709535][ T5874] usb 6-1: config 0 has no interfaces? [ 851.715098][ T5874] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 851.769847][ T5874] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 851.871327][ T5874] usb 6-1: config 0 descriptor?? [ 852.859603][T19470] fuse: Bad value for 'fd' [ 854.051468][ T5874] usb 6-1: USB disconnect, device number 35 [ 855.129396][T19490] sch_tbf: burst 0 is lower than device veth1 mtu (1514) ! [ 855.236294][T19491] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2134'. [ 856.869068][ T5900] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 857.069240][ T5900] usb 6-1: Using ep0 maxpacket: 8 [ 857.088713][ T5900] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 857.147640][ T5900] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 857.167172][ T5900] usb 6-1: Product: syz [ 857.181621][ T5900] usb 6-1: Manufacturer: syz [ 857.191688][ T5900] usb 6-1: SerialNumber: syz [ 857.245380][ T5900] usb 6-1: config 0 descriptor?? [ 857.494758][ T5900] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 857.727276][ T30] audit: type=1326 audit(1763718756.535:340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19520 comm="syz.0.2143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 857.795590][ T30] audit: type=1326 audit(1763718756.535:341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19520 comm="syz.0.2143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 857.827889][ T30] audit: type=1326 audit(1763718756.535:342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19520 comm="syz.0.2143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=133 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 857.852447][ T30] audit: type=1326 audit(1763718756.535:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19520 comm="syz.0.2143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 857.874824][ C1] vkms_vblank_simulate: vblank timer overrun [ 857.903842][ T30] audit: type=1326 audit(1763718756.535:344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19520 comm="syz.0.2143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 857.926209][ C1] vkms_vblank_simulate: vblank timer overrun [ 857.967999][ T30] audit: type=1326 audit(1763718756.535:345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19520 comm="syz.0.2143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 858.009631][ T30] audit: type=1326 audit(1763718756.535:346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19520 comm="syz.0.2143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 858.032810][ T30] audit: type=1326 audit(1763718756.535:347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19520 comm="syz.0.2143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 858.055177][ C1] vkms_vblank_simulate: vblank timer overrun [ 858.089438][ T30] audit: type=1326 audit(1763718756.535:348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19520 comm="syz.0.2143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 858.124013][ T30] audit: type=1326 audit(1763718756.535:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19520 comm="syz.0.2143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b82d8f749 code=0x7ffc0000 [ 858.729442][ T12] bond6: (slave ip6gretap2): link status up again after 0 ms [ 858.741450][ T12] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 858.890540][ T1091] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 858.965385][ T5900] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 859.008547][ T5900] usb 6-1: USB disconnect, device number 36 [ 859.149771][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 859.279830][ T1091] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 859.409246][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 859.518800][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 859.659332][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 859.782247][ T12] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 859.969399][ T9607] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 860.193220][T19543] netlink: 'syz.5.2148': attribute type 14 has an invalid length. [ 861.756357][T19571] bond7: entered promiscuous mode [ 861.769429][T19571] bond7: entered allmulticast mode [ 861.799866][T19571] 8021q: adding VLAN 0 to HW filter on device bond7 [ 863.829241][ T1145] net_ratelimit: 27 callbacks suppressed [ 863.829259][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 863.989627][ T12] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 864.168926][ T12] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 864.319567][ T12] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 864.458756][ T6634] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 864.599637][ T6634] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 864.779486][ T12] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 864.958826][ T9607] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 865.083323][ T9607] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 865.221642][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 866.635044][T19591] bond3 (unregistering): Released all slaves [ 867.583326][T19631] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 869.199328][ T12] net_ratelimit: 16 callbacks suppressed [ 869.199350][ T12] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 869.539630][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 869.650217][ T1160] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 869.779269][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 869.918801][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 870.030341][ T6634] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 870.199999][ T6634] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 870.367864][T19655] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2170'. [ 870.742251][T19655] bridge_slave_1: left allmulticast mode [ 870.749793][T19655] bridge_slave_1: left promiscuous mode [ 870.756589][T19655] bridge0: port 2(bridge_slave_1) entered disabled state [ 871.041016][T19655] bridge_slave_0: left allmulticast mode [ 871.046732][T19655] bridge_slave_0: left promiscuous mode [ 871.113872][T19655] bridge0: port 1(bridge_slave_0) entered disabled state [ 872.131550][T19661] netlink: 'syz.0.2172': attribute type 13 has an invalid length. [ 875.212043][ T79] bond2: (slave ip6gretap1): link status up again after 0 ms [ 875.242006][ T79] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 875.260345][ T37] bond2: (slave ip6gretap1): link status up again after 0 ms [ 875.319539][ T5874] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 875.349439][ T79] bond2: (slave ip6gretap1): link status up again after 0 ms [ 875.400046][T19697] kvm: pic: non byte write [ 875.403231][ T79] bond2: (slave ip6gretap1): link status up again after 0 ms [ 875.449330][ T79] bond2: (slave ip6gretap1): link status up again after 0 ms [ 875.489428][ T37] bond2: (slave ip6gretap1): link status up again after 0 ms [ 875.505115][ T5874] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 875.523314][ T79] bond2: (slave ip6gretap1): link status up again after 0 ms [ 875.549105][ T12] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 875.563298][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 875.569893][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 875.622295][ T5874] usb 3-1: config 0 interface 0 has no altsetting 0 [ 875.650180][ T1091] bond2: (slave ip6gretap1): link status up again after 0 ms [ 875.754813][ T5874] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 875.775687][ T5874] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 875.858301][ T5874] usb 3-1: Product: syz [ 875.922237][ T5874] usb 3-1: Manufacturer: syz [ 875.935937][ T5874] usb 3-1: SerialNumber: syz [ 875.952923][ T5874] usb 3-1: config 0 descriptor?? [ 875.964756][ T5874] usb 3-1: selecting invalid altsetting 0 [ 876.565247][T19704] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 876.702089][ T44] usb 3-1: USB disconnect, device number 40 [ 880.249885][ T1145] net_ratelimit: 71 callbacks suppressed [ 880.249906][ T1145] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 880.359642][ T12] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 880.530008][ T1145] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 880.549377][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 880.641464][ T6634] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 880.690428][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 880.770266][ T1145] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 880.988902][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 881.108756][ T1091] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 881.144014][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 881.359447][ T5900] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 881.558703][ T5900] usb 5-1: Using ep0 maxpacket: 16 [ 881.602755][ T5900] usb 5-1: config 166 has an invalid interface number: 177 but max is 1 [ 881.618934][ T5900] usb 5-1: config 166 has an invalid interface number: 34 but max is 1 [ 881.637614][ T5900] usb 5-1: config 166 has no interface number 0 [ 881.657834][ T5900] usb 5-1: config 166 has no interface number 1 [ 881.678217][ T5900] usb 5-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 881.699400][ T5900] usb 5-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 881.729403][ T5900] usb 5-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 881.749597][ T5900] usb 5-1: config 166 interface 34 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 881.792610][ T5900] usb 5-1: config 166 interface 34 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024 [ 881.818855][ T5900] usb 5-1: config 166 interface 34 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024 [ 881.842818][ T5900] usb 5-1: config 166 interface 34 altsetting 1 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 881.874824][ T5900] usb 5-1: config 166 interface 34 altsetting 1 endpoint 0x85 has invalid wMaxPacketSize 0 [ 881.895278][ T5900] usb 5-1: config 166 interface 34 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 881.928720][ T5900] usb 5-1: config 166 interface 177 has no altsetting 0 [ 881.946098][ T5900] usb 5-1: config 166 interface 34 has no altsetting 0 [ 881.957094][ T5900] usb 5-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 881.968914][ T5900] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 881.977222][ T5900] usb 5-1: Product: syz [ 881.981826][ T5900] usb 5-1: Manufacturer: syz [ 881.986422][ T5900] usb 5-1: SerialNumber: syz [ 882.241152][ T5900] ums-realtek 5-1:166.177: USB Mass Storage device detected [ 882.446664][ T5900] ums-realtek 5-1:166.34: USB Mass Storage device detected [ 882.776006][ T5900] ums-realtek 5-1:166.34: probe with driver ums-realtek failed with error -5 [ 882.897070][ T5900] uvcvideo 5-1:166.34: Found UVC 0.00 device syz (0bda:0138) [ 882.916779][ T5900] uvcvideo 5-1:166.34: No valid video chain found. [ 882.943581][ T5900] usb 5-1: USB disconnect, device number 51 [ 883.933844][T19778] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2197'. [ 884.208753][ T5874] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 884.369394][ T5874] usb 5-1: Using ep0 maxpacket: 16 [ 884.484159][ T5874] usb 5-1: config 0 has an invalid descriptor of length 56, skipping remainder of the config [ 884.509421][ T5874] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 885.128475][ T5874] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 885.143057][ T5874] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 885.157146][ T5874] usb 5-1: Product: syz [ 885.178446][ T5874] usb 5-1: Manufacturer: syz [ 885.194628][ T5874] usb 5-1: SerialNumber: syz [ 885.233909][ T5874] usb 5-1: config 0 descriptor?? [ 885.281747][ T1145] net_ratelimit: 68 callbacks suppressed [ 885.281762][ T1145] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 885.309456][ T1145] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 885.399304][ T37] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 885.419490][ T37] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 885.519373][ T37] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 885.553067][ T37] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 885.639213][ T1091] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 885.707896][T19801] netlink: 'syz.3.2202': attribute type 27 has an invalid length. [ 885.800023][T19802] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 885.870941][ T1091] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 885.970104][ T5874] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 886.175100][T19801] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 886.219904][ T5874] usb 4-1: Using ep0 maxpacket: 16 [ 886.234267][ T5874] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 886.249860][ T5874] usb 4-1: config 0 has no interface number 0 [ 886.280258][ T5874] usb 4-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 886.314533][ T5874] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 886.344114][ T5874] usb 4-1: Product: syz [ 886.362112][ T5874] usb 4-1: Manufacturer: syz [ 886.385430][ T5874] usb 4-1: SerialNumber: syz [ 886.407760][ T5874] usb 4-1: config 0 descriptor?? [ 886.427708][ T5874] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 886.691273][T19801] ip6gre1: left promiscuous mode [ 886.704630][T19801] ip6gre1: left allmulticast mode [ 886.744372][T19801] gretap1: left promiscuous mode [ 886.787605][T19801] ------------[ cut here ]------------ [ 886.794280][T19801] WARNING: CPU: 0 PID: 19801 at net/mac80211/chan.c:833 ieee80211_recalc_chanctx_chantype+0x89d/0x10f0 [ 886.806011][T19801] Modules linked in: [ 886.810761][T19801] CPU: 0 UID: 0 PID: 19801 Comm: syz.3.2202 Not tainted syzkaller #0 PREEMPT(full) [ 886.821149][T19801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 886.832668][T19801] RIP: 0010:ieee80211_recalc_chanctx_chantype+0x89d/0x10f0 [ 886.840398][T19801] Code: c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 5b 9d 5a f7 4d 8b 36 4d 39 fe 74 22 e8 8e db f4 f6 e9 ef f8 ff ff e8 84 db f4 f6 90 <0f> 0b 90 e9 47 07 00 00 e8 76 db f4 f6 e9 39 07 00 00 48 83 7c 24 [ 886.860716][T19801] RSP: 0018:ffffc90004aa6220 EFLAGS: 00010246 [ 886.866818][T19801] RAX: ffffffff8acb3082 RBX: 0000000000000000 RCX: 0000000000080000 [ 886.875367][T19801] RDX: ffffc9000d8b0000 RSI: 000000000007ffff RDI: 0000000000080000 [ 886.884207][T19801] RBP: ffffc90004aa6400 R08: ffff888032b657c7 R09: 1ffff1100656caf8 [ 886.892808][T19801] R10: dffffc0000000000 R11: ffffed100656caf9 R12: dffffc0000000000 [ 886.901331][T19801] R13: 0000000000000070 R14: ffff888027a2a910 R15: ffff888027a2a910 [ 886.909927][T19801] FS: 00007fcf133ab6c0(0000) GS:ffff88812613b000(0000) knlGS:0000000000000000 [ 886.919727][T19801] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 886.926325][T19801] CR2: 0000200000285030 CR3: 000000003117a000 CR4: 00000000003526f0 [ 886.935112][T19801] Call Trace: [ 886.938418][T19801] [ 886.941919][T19801] ? __pfx_ieee80211_recalc_chanctx_chantype+0x10/0x10 [ 886.949298][T19801] ? __local_bh_enable_ip+0x12d/0x1c0 [ 886.954692][T19801] ? __pfx___might_resched+0x10/0x10 [ 886.960523][T19801] ieee80211_assign_link_chanctx+0x5ca/0xd70 [ 886.966545][T19801] __ieee80211_link_release_channel+0x33b/0x4a0 [ 886.973280][T19801] ieee80211_leave_mesh+0xc5/0x130 [ 886.978460][T19801] cfg80211_leave_mesh+0x293/0x800 [ 886.984206][T19801] cfg80211_netdev_notifier_call+0x1aa/0x1440 [ 886.990915][T19801] ? __pfx_cfg80211_netdev_notifier_call+0x10/0x10 [ 886.997531][T19801] ? finish_task_switch+0x266/0x950 [ 887.003169][T19801] ? finish_task_switch+0x32b/0x950 [ 887.008401][T19801] ? rcu_is_watching+0x15/0xb0 [ 887.013221][T19801] ? trace_sched_exit_tp+0x36/0x110 [ 887.018465][T19801] ? __lock_acquire+0xab9/0xd20 [ 887.023795][T19801] ? do_raw_spin_lock+0x121/0x290 [ 887.029632][T19801] ? inetdev_event+0x464/0x15b0 [ 887.034529][T19801] ? igmp_netdev_event+0x7c/0x770 [ 887.040062][T19801] notifier_call_chain+0x1b6/0x3e0 [ 887.045217][T19801] __dev_close_many+0x106/0x6f0 [ 887.050587][T19801] ? __local_bh_enable_ip+0x13e/0x1c0 [ 887.055985][T19801] ? __pfx___dev_close_many+0x10/0x10 [ 887.061879][T19801] __dev_change_flags+0x2c7/0x6d0 [ 887.066932][T19801] ? __pfx___dev_change_flags+0x10/0x10 [ 887.073220][T19801] ? netif_state_change+0x256/0x3a0 [ 887.078489][T19801] ? __pfx_netif_state_change+0x10/0x10 [ 887.084562][T19801] netif_change_flags+0x88/0x1a0 [ 887.090002][T19801] do_setlink+0xc55/0x41c0 [ 887.094451][T19801] ? rcu_is_watching+0x15/0xb0 [ 887.099711][T19801] ? __schedule+0x17ae/0x4cc0 [ 887.104418][T19801] ? __lock_acquire+0xab9/0xd20 [ 887.109865][T19801] ? __pfx_do_setlink+0x10/0x10 [ 887.114754][T19801] ? __lock_acquire+0xab9/0xd20 [ 887.120128][T19801] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 887.126440][T19801] ? lockdep_hardirqs_on+0x9c/0x150 [ 887.132457][T19801] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 887.138392][T19801] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 887.145270][T19801] ? rcu_is_watching+0x15/0xb0 [ 887.150539][T19801] ? __mutex_lock+0xd3b/0x1350 [ 887.155341][T19801] ? __mutex_lock+0x5bb/0x1350 [ 887.160703][T19801] ? rtnl_newlink+0x8e9/0x1c80 [ 887.165506][T19801] ? __pfx___mutex_lock+0x10/0x10 [ 887.171035][T19801] ? ns_capable+0x8a/0xf0 [ 887.175398][T19801] ? rtnl_link_get_net_capable+0x16a/0x350 [ 887.181734][T19801] rtnl_newlink+0x14ad/0x1c80 [ 887.186444][T19801] ? netlink_deliver_tap+0x19c/0x1b0 [ 887.192233][T19801] ? __pfx_rtnl_newlink+0x10/0x10 [ 887.197328][T19801] ? kasan_quarantine_put+0xdd/0x220 [ 887.203162][T19801] ? lockdep_hardirqs_on+0x9c/0x150 [ 887.208405][T19801] ? nlmon_xmit+0xb0/0x100 [ 887.213311][T19801] ? kmem_cache_free+0x19b/0x690 [ 887.218298][T19801] ? __local_bh_enable_ip+0x12d/0x1c0 [ 887.224169][T19801] ? lockdep_hardirqs_on+0x9c/0x150 [ 887.230279][T19801] ? __local_bh_enable_ip+0x12d/0x1c0 [ 887.235664][T19801] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 887.242191][T19801] ? __dev_queue_xmit+0x27b/0x3b50 [ 887.247339][T19801] ? __dev_queue_xmit+0x27b/0x3b50 [ 887.252946][T19801] ? __dev_queue_xmit+0x27b/0x3b50 [ 887.258082][T19801] ? __dev_queue_xmit+0x1d79/0x3b50 [ 887.263807][T19801] ? kasan_save_track+0x3e/0x80 [ 887.269195][T19801] ? __kasan_slab_alloc+0x6c/0x80 [ 887.274348][T19801] ? __lock_acquire+0xab9/0xd20 [ 887.279751][T19801] ? __pfx_rtnl_newlink+0x10/0x10 [ 887.284815][T19801] rtnetlink_rcv_msg+0x7cf/0xb70 [ 887.290259][T19801] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 887.295421][T19801] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 887.301411][T19801] ? ref_tracker_free+0x63a/0x7d0 [ 887.306458][T19801] ? __asan_memcpy+0x40/0x70 [ 887.311749][T19801] ? __pfx_ref_tracker_free+0x10/0x10 [ 887.317275][T19801] netlink_rcv_skb+0x208/0x470 [ 887.322101][T19801] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 887.327620][T19801] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 887.333307][T19801] ? netlink_deliver_tap+0x2e/0x1b0 [ 887.338519][T19801] netlink_unicast+0x82f/0x9e0 [ 887.344106][T19801] ? __pfx_netlink_unicast+0x10/0x10 [ 887.349921][T19801] ? netlink_sendmsg+0x642/0xb30 [ 887.354889][T19801] ? skb_put+0x11b/0x210 [ 887.359649][T19801] netlink_sendmsg+0x805/0xb30 [ 887.364463][T19801] ? __pfx_netlink_sendmsg+0x10/0x10 [ 887.370260][T19801] ? aa_sock_msg_perm+0xf1/0x1d0 [ 887.375235][T19801] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 887.381007][T19801] ? __pfx_netlink_sendmsg+0x10/0x10 [ 887.386342][T19801] __sock_sendmsg+0x21c/0x270 [ 887.391747][T19801] ____sys_sendmsg+0x505/0x830 [ 887.396551][T19801] ? __pfx_____sys_sendmsg+0x10/0x10 [ 887.402413][T19801] ? import_iovec+0x74/0xa0 [ 887.406979][T19801] ___sys_sendmsg+0x21f/0x2a0 [ 887.412160][T19801] ? __pfx____sys_sendmsg+0x10/0x10 [ 887.417416][T19801] ? __fget_files+0x2a/0x420 [ 887.422520][T19801] ? __fget_files+0x3a0/0x420 [ 887.427230][T19801] __x64_sys_sendmsg+0x19b/0x260 [ 887.433102][T19801] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 887.438592][T19801] ? do_syscall_64+0xbe/0xfa0 [ 887.444140][T19801] do_syscall_64+0xfa/0xfa0 [ 887.449262][T19801] ? lockdep_hardirqs_on+0x9c/0x150 [ 887.454511][T19801] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 887.461071][T19801] ? clear_bhb_loop+0x60/0xb0 [ 887.465771][T19801] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 887.472290][T19801] RIP: 0033:0x7fcf1258f749 [ 887.476749][T19801] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 887.496946][T19801] RSP: 002b:00007fcf133ab038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 887.505875][T19801] RAX: ffffffffffffffda RBX: 00007fcf127e6090 RCX: 00007fcf1258f749 [ 887.514346][T19801] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 887.522870][T19801] RBP: 00007fcf12613f91 R08: 0000000000000000 R09: 0000000000000000 [ 887.531360][T19801] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 887.540251][T19801] R13: 00007fcf127e6128 R14: 00007fcf127e6090 R15: 00007fcf1290fa28 [ 887.548262][T19801] [ 887.552230][T19801] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 887.559522][T19801] CPU: 0 UID: 0 PID: 19801 Comm: syz.3.2202 Not tainted syzkaller #0 PREEMPT(full) [ 887.568893][T19801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 887.578955][T19801] Call Trace: [ 887.582244][T19801] [ 887.585176][T19801] dump_stack_lvl+0x99/0x250 [ 887.589779][T19801] ? __asan_memcpy+0x40/0x70 [ 887.594377][T19801] ? __pfx_dump_stack_lvl+0x10/0x10 [ 887.599591][T19801] ? __pfx__printk+0x10/0x10 [ 887.604191][T19801] vpanic+0x237/0x6d0 [ 887.608181][T19801] ? __pfx_vpanic+0x10/0x10 [ 887.612702][T19801] panic+0xb9/0xc0 [ 887.616470][T19801] ? __pfx_panic+0x10/0x10 [ 887.620910][T19801] __warn+0x31b/0x4b0 [ 887.624900][T19801] ? ieee80211_recalc_chanctx_chantype+0x89d/0x10f0 [ 887.631503][T19801] ? ieee80211_recalc_chanctx_chantype+0x89d/0x10f0 [ 887.638104][T19801] report_bug+0x2be/0x4f0 [ 887.642442][T19801] ? ieee80211_recalc_chanctx_chantype+0x89d/0x10f0 [ 887.649066][T19801] ? ieee80211_recalc_chanctx_chantype+0x89d/0x10f0 [ 887.655673][T19801] ? ieee80211_recalc_chanctx_chantype+0x89f/0x10f0 [ 887.662278][T19801] handle_bug+0x84/0x160 [ 887.666525][T19801] exc_invalid_op+0x1a/0x50 [ 887.671031][T19801] asm_exc_invalid_op+0x1a/0x20 [ 887.675881][T19801] RIP: 0010:ieee80211_recalc_chanctx_chantype+0x89d/0x10f0 [ 887.683089][T19801] Code: c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 5b 9d 5a f7 4d 8b 36 4d 39 fe 74 22 e8 8e db f4 f6 e9 ef f8 ff ff e8 84 db f4 f6 90 <0f> 0b 90 e9 47 07 00 00 e8 76 db f4 f6 e9 39 07 00 00 48 83 7c 24 [ 887.702702][T19801] RSP: 0018:ffffc90004aa6220 EFLAGS: 00010246 [ 887.708785][T19801] RAX: ffffffff8acb3082 RBX: 0000000000000000 RCX: 0000000000080000 [ 887.716773][T19801] RDX: ffffc9000d8b0000 RSI: 000000000007ffff RDI: 0000000000080000 [ 887.724749][T19801] RBP: ffffc90004aa6400 R08: ffff888032b657c7 R09: 1ffff1100656caf8 [ 887.732720][T19801] R10: dffffc0000000000 R11: ffffed100656caf9 R12: dffffc0000000000 [ 887.740692][T19801] R13: 0000000000000070 R14: ffff888027a2a910 R15: ffff888027a2a910 [ 887.748683][T19801] ? ieee80211_recalc_chanctx_chantype+0x10e2/0x10f0 [ 887.755396][T19801] ? __pfx_ieee80211_recalc_chanctx_chantype+0x10/0x10 [ 887.762264][T19801] ? __local_bh_enable_ip+0x12d/0x1c0 [ 887.767643][T19801] ? __pfx___might_resched+0x10/0x10 [ 887.772945][T19801] ieee80211_assign_link_chanctx+0x5ca/0xd70 [ 887.778937][T19801] __ieee80211_link_release_channel+0x33b/0x4a0 [ 887.785190][T19801] ieee80211_leave_mesh+0xc5/0x130 [ 887.790309][T19801] cfg80211_leave_mesh+0x293/0x800 [ 887.795427][T19801] cfg80211_netdev_notifier_call+0x1aa/0x1440 [ 887.801506][T19801] ? __pfx_cfg80211_netdev_notifier_call+0x10/0x10 [ 887.808022][T19801] ? finish_task_switch+0x266/0x950 [ 887.813236][T19801] ? finish_task_switch+0x32b/0x950 [ 887.818446][T19801] ? rcu_is_watching+0x15/0xb0 [ 887.823213][T19801] ? trace_sched_exit_tp+0x36/0x110 [ 887.828426][T19801] ? __lock_acquire+0xab9/0xd20 [ 887.833315][T19801] ? do_raw_spin_lock+0x121/0x290 [ 887.838386][T19801] ? inetdev_event+0x464/0x15b0 [ 887.843254][T19801] ? igmp_netdev_event+0x7c/0x770 [ 887.848297][T19801] notifier_call_chain+0x1b6/0x3e0 [ 887.853431][T19801] __dev_close_many+0x106/0x6f0 [ 887.858296][T19801] ? __local_bh_enable_ip+0x13e/0x1c0 [ 887.863670][T19801] ? __pfx___dev_close_many+0x10/0x10 [ 887.869059][T19801] __dev_change_flags+0x2c7/0x6d0 [ 887.874090][T19801] ? __pfx___dev_change_flags+0x10/0x10 [ 887.879634][T19801] ? netif_state_change+0x256/0x3a0 [ 887.884844][T19801] ? __pfx_netif_state_change+0x10/0x10 [ 887.890405][T19801] netif_change_flags+0x88/0x1a0 [ 887.895346][T19801] do_setlink+0xc55/0x41c0 [ 887.899763][T19801] ? rcu_is_watching+0x15/0xb0 [ 887.904533][T19801] ? __schedule+0x17ae/0x4cc0 [ 887.909249][T19801] ? __lock_acquire+0xab9/0xd20 [ 887.914112][T19801] ? __pfx_do_setlink+0x10/0x10 [ 887.918964][T19801] ? __lock_acquire+0xab9/0xd20 [ 887.923830][T19801] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 887.929727][T19801] ? lockdep_hardirqs_on+0x9c/0x150 [ 887.934936][T19801] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 887.940835][T19801] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 887.947172][T19801] ? rcu_is_watching+0x15/0xb0 [ 887.951943][T19801] ? __mutex_lock+0xd3b/0x1350 [ 887.956719][T19801] ? __mutex_lock+0x5bb/0x1350 [ 887.961496][T19801] ? rtnl_newlink+0x8e9/0x1c80 [ 887.966272][T19801] ? __pfx___mutex_lock+0x10/0x10 [ 887.971326][T19801] ? ns_capable+0x8a/0xf0 [ 887.975664][T19801] ? rtnl_link_get_net_capable+0x16a/0x350 [ 887.981475][T19801] rtnl_newlink+0x14ad/0x1c80 [ 887.986164][T19801] ? netlink_deliver_tap+0x19c/0x1b0 [ 887.991459][T19801] ? __pfx_rtnl_newlink+0x10/0x10 [ 887.996513][T19801] ? kasan_quarantine_put+0xdd/0x220 [ 888.001805][T19801] ? lockdep_hardirqs_on+0x9c/0x150 [ 888.007011][T19801] ? nlmon_xmit+0xb0/0x100 [ 888.011428][T19801] ? kmem_cache_free+0x19b/0x690 [ 888.016385][T19801] ? __local_bh_enable_ip+0x12d/0x1c0 [ 888.021757][T19801] ? lockdep_hardirqs_on+0x9c/0x150 [ 888.026964][T19801] ? __local_bh_enable_ip+0x12d/0x1c0 [ 888.032338][T19801] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 888.038070][T19801] ? __dev_queue_xmit+0x27b/0x3b50 [ 888.043185][T19801] ? __dev_queue_xmit+0x27b/0x3b50 [ 888.048472][T19801] ? __dev_queue_xmit+0x27b/0x3b50 [ 888.053587][T19801] ? __dev_queue_xmit+0x1d79/0x3b50 [ 888.058795][T19801] ? kasan_save_track+0x3e/0x80 [ 888.063654][T19801] ? __kasan_slab_alloc+0x6c/0x80 [ 888.068693][T19801] ? __lock_acquire+0xab9/0xd20 [ 888.073560][T19801] ? __pfx_rtnl_newlink+0x10/0x10 [ 888.078590][T19801] rtnetlink_rcv_msg+0x7cf/0xb70 [ 888.083559][T19801] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 888.088684][T19801] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 888.094147][T19801] ? ref_tracker_free+0x63a/0x7d0 [ 888.099170][T19801] ? __asan_memcpy+0x40/0x70 [ 888.103764][T19801] ? __pfx_ref_tracker_free+0x10/0x10 [ 888.109142][T19801] netlink_rcv_skb+0x208/0x470 [ 888.113910][T19801] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 888.119377][T19801] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 888.124668][T19801] ? netlink_deliver_tap+0x2e/0x1b0 [ 888.129901][T19801] netlink_unicast+0x82f/0x9e0 [ 888.134680][T19801] ? __pfx_netlink_unicast+0x10/0x10 [ 888.139972][T19801] ? netlink_sendmsg+0x642/0xb30 [ 888.144912][T19801] ? skb_put+0x11b/0x210 [ 888.149155][T19801] netlink_sendmsg+0x805/0xb30 [ 888.153923][T19801] ? __pfx_netlink_sendmsg+0x10/0x10 [ 888.159216][T19801] ? aa_sock_msg_perm+0xf1/0x1d0 [ 888.164178][T19801] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 888.169467][T19801] ? __pfx_netlink_sendmsg+0x10/0x10 [ 888.174758][T19801] __sock_sendmsg+0x21c/0x270 [ 888.179458][T19801] ____sys_sendmsg+0x505/0x830 [ 888.184232][T19801] ? __pfx_____sys_sendmsg+0x10/0x10 [ 888.189529][T19801] ? import_iovec+0x74/0xa0 [ 888.194041][T19801] ___sys_sendmsg+0x21f/0x2a0 [ 888.198737][T19801] ? __pfx____sys_sendmsg+0x10/0x10 [ 888.203963][T19801] ? __fget_files+0x2a/0x420 [ 888.208552][T19801] ? __fget_files+0x3a0/0x420 [ 888.213238][T19801] __x64_sys_sendmsg+0x19b/0x260 [ 888.218179][T19801] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 888.223651][T19801] ? do_syscall_64+0xbe/0xfa0 [ 888.228343][T19801] do_syscall_64+0xfa/0xfa0 [ 888.232854][T19801] ? lockdep_hardirqs_on+0x9c/0x150 [ 888.238061][T19801] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 888.244125][T19801] ? clear_bhb_loop+0x60/0xb0 [ 888.248808][T19801] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 888.254700][T19801] RIP: 0033:0x7fcf1258f749 [ 888.259119][T19801] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 888.278726][T19801] RSP: 002b:00007fcf133ab038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 888.287143][T19801] RAX: ffffffffffffffda RBX: 00007fcf127e6090 RCX: 00007fcf1258f749 [ 888.295115][T19801] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 888.303115][T19801] RBP: 00007fcf12613f91 R08: 0000000000000000 R09: 0000000000000000 [ 888.311097][T19801] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 888.319069][T19801] R13: 00007fcf127e6128 R14: 00007fcf127e6090 R15: 00007fcf1290fa28 [ 888.327057][T19801] [ 888.330455][T19801] Kernel Offset: disabled [ 888.334784][T19801] Rebooting in 86400 seconds..