last executing test programs: 14.500833299s ago: executing program 3 (id=1645): fsopen(&(0x7f0000000580)='overlay\x00', 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000200)={0xd8a, 0x20000800, 0x2000, 0x0, 0x3, 0x1, 0x1, 0x1}, 0x10) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000200)={0x48}) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000640)=@filter={'filter\x00', 0x42, 0x4, 0x348, 0xffffffff, 0x1b8, 0x0, 0x1b8, 0xffffffff, 0xffffffff, 0x2b0, 0x2b0, 0x2b0, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0xf}}, @common=@unspec=@connmark={{0x30}, {0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0xb8, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0xf, 0x2}}, @common=@socket0={{0x20}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a8) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x80800) setsockopt$sock_int(r5, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}, {&(0x7f0000000740)=""/105, 0xfffffe0b}], 0x2}, 0x0) 13.413629163s ago: executing program 3 (id=1649): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x3c}, 0x1, 0x0, 0x0, 0x24000804}, 0x24040801) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x2) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r10, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x8}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004100)=@newtfilter={0x64, 0x28, 0x575ac7824d421509, 0x70bd2d, 0x4, {0x0, 0x0, 0x0, r10, {0xa}, {0x6}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0x38, 0x2, [@TCA_BPF_ACT={0x34, 0x1, [@m_police={0x30, 0x14, 0x0, 0x0, {{0xb}, {0x4, 0x2, 0x0, 0x1, [[]]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x64}}, 0x40) r11 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r11, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r12], 0x5c}}, 0x40) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r13}, @IFLA_MASTER={0x8, 0xa, r13}]}, 0x4c}}, 0x884) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r14, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000540)={0x1c, 0x8, 0x6, 0x3, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x4008040) 13.121613669s ago: executing program 1 (id=1650): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r7 = socket$pppl2tp(0x18, 0x1, 0x1) r8 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r7, &(0x7f0000001080)=@pppol2tpv3={0x18, 0x1, {0x3, r8, {0x41, 0x0, @remote}, 0x20020003}}, 0x2e) close_range(r4, 0xffffffffffffffff, 0x0) connect$pppl2tp(r1, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x4e24, @private=0xa010101}, 0x4, 0x3, 0x3, 0x1}}, 0x2e) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) syz_open_dev$audion(&(0x7f00000001c0), 0x6, 0x4000) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="00022dbd7000fbdbdf2506", @ANYBLOB="b600223b8aeec71b9a", @ANYRES32, @ANYRESDEC=r6], 0x34}, 0x1, 0x0, 0x0, 0x861}, 0x44008) r9 = socket$nl_generic(0x10, 0x3, 0x10) timer_create(0x2, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x8000000, 0x0, 0xff, 0x1}, 0x20) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r10], 0x14}, 0x1, 0x0, 0x0, 0x40001}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[], 0x7c}}, 0x0) 12.151756788s ago: executing program 0 (id=1654): syz_open_dev$vim2m(&(0x7f0000000000), 0x5, 0x2) socket(0x2, 0x80805, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_serviced\x00', 0x275a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_sctp(0x2, 0x5, 0x84) socket(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x1, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0xb) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) memfd_create(&(0x7f0000000180)='\b\x9dF\xd8\b\xb3~u\xa5\"\xdc\xfdq\xf6c\r;\xfcO\x8c=\x81\xb1\x8aWpA\xd4\x98\x85K\x89>N\x8ar\x17O\x0fKR\xe2{mn\xcc\xbf2\xc0\xa7\x14\xd0\xd4\xfe/m\xdf\xb6]\xc2\xaa\x86\xec(\xf7\xcd\xa6\xd9n^.\x13*\xd4\xb8\xe8\xc4\xefb\x14Vx\xc6\xfe\x9e\xee\xe7\xd7E\xe9\t\x83\xdeNX\xec\xe66\x1b\x97$\xee\x84\x14n,B\xd5?\xe5E:+Pm\x1d\xb4\xb8\xeb\xe8Op2\x82\xc7\x0e\x97\x03\xef\x1a\xa5\x00.\x89\b!m\f\xd9\x8b$}\x9f\fX\x81\xa8\xf6\x94\xbc\xed\x80|l]\xe9\xca\xd3\xc9\xa3\x9e\x9cJI\xf1\xa2\xa0\xc4:\x00\x00\x00\x00\x00\x00\b\x00\x00', 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x200000000003, 0x87) socket$netlink(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000004c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000010025bd7000fadbdf2500000000", @ANYRES32=r1, @ANYBLOB="138000002b9201002400128009000100626f6e6400000000140002800800", @ANYRES64=r0], 0x44}, 0x1, 0x0, 0x0, 0x40448e0}, 0x4000) 12.026485823s ago: executing program 3 (id=1655): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000407d1ef62c0000040000010902"], 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x5, 0x84) socket$rds(0x15, 0x5, 0x0) socket(0x15, 0x5, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f00004d4000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000890000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r4 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc0}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES8=r3], 0x50) io_uring_enter(r4, 0x2219, 0xcf74, 0x51, 0x0, 0x0) 11.949665289s ago: executing program 0 (id=1656): socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) shmget$private(0x0, 0x1000, 0x40, &(0x7f0000ffc000/0x1000)=nil) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ptrace$ARCH_MAP_VDSO_32(0x1e, 0xffffffffffffffff, 0x4, 0x2002) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000000308010100000000000000000000002b050003002100"], 0x30}}, 0x90) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x448000, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) restart_syscall() r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f00000010c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x310, 0x280, 0x268, 0x300, 0x280, 0x268, 0x390, 0x460, 0x460, 0x390, 0x460, 0x9, 0x0, {[{{@uncond, 0x0, 0xf0, 0x130, 0x0, {0x9401}, [@common=@unspec=@limit={{0x48}, {0xfff, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x2}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x8, 0x21, "6bb6778f9bdec125b0fb4f26be757b1e6f2fb8e9079627dc6726c4bc85e9"}}}, {{@ipv6={@private2, @remote, [], [], 'ip6gretap0\x00', 'ip6_vti0\x00'}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x370) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000002c00ef5f"], 0x14}, 0x1, 0x0, 0x0, 0x20048081}, 0x800) recvmsg(r4, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x12000) r6 = dup3(0xffffffffffffffff, r3, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) 11.536803629s ago: executing program 1 (id=1657): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000005c0), 0x40000000088d82, 0x0) r3 = syz_io_uring_setup(0xbdc, &(0x7f0000000040)={0x0, 0xeae, 0x100, 0xfffffffc, 0x11}, &(0x7f0000000480)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0x1, &(0x7f0000000140)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r3, 0x847b9, 0xebd0, 0xa, 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f0000000000)) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xe6, 0x35, 0x55, 0x40, 0x5ac, 0x290, 0xdc1b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0xbb, 0x2}}]}}]}}, 0x0) open_tree(0xffffffffffffffff, 0x0, 0x8100) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r6, 0x0, 0x20000004) syz_usb_connect(0x0, 0x2d, &(0x7f0000000b80)={{0x12, 0x1, 0x0, 0x69, 0xdd, 0x34, 0x40, 0xccd, 0x93, 0x235a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x6c, 0xe0, 0x8d, 0x0, [], [{{0x9, 0x5, 0x2}}]}}]}}]}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x24000000) syz_usb_connect(0x0, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 10.168972196s ago: executing program 2 (id=1658): r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000800)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x0, 0x81, 0xe9ea, 0x4783, 0x5, 0x2b61b794}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x7fffe, {0x0, 0x0, 0x0, r4, {0x0, 0xffe0}, {0xb, 0xb}, {0x2, 0xb}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x44040}, 0x8000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r0, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) 9.874082356s ago: executing program 0 (id=1659): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000200), 0x0) sendmmsg$unix(r2, &(0x7f00000019c0), 0x0, 0x8000) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) sendmsg$key(r3, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={0x0, 0x50}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000640), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r4, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="31032abd7000fbdbdf250b00000008000300", @ANYRES32=r6], 0x1c}, 0x1, 0x0, 0x0, 0x400c080}, 0x0) 9.776802208s ago: executing program 2 (id=1660): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x3c}, 0x1, 0x0, 0x0, 0x24000804}, 0x24040801) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x8}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004100)=@newtfilter={0x64, 0x28, 0x575ac7824d421509, 0x70bd2d, 0x4, {0x0, 0x0, 0x0, r8, {0xa}, {0x6}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0x38, 0x2, [@TCA_BPF_ACT={0x34, 0x1, [@m_police={0x30, 0x14, 0x0, 0x0, {{0xb}, {0x4, 0x2, 0x0, 0x1, [[]]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x64}}, 0x40) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r9], 0x5c}}, 0x40) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r10}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x4c}}, 0x884) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r11, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000540)={0x1c, 0x8, 0x6, 0x3, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x4008040) 9.380376398s ago: executing program 4 (id=1661): fsmount(0xffffffffffffffff, 0x0, 0x20) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x3}}, './file0\x00'}) ioctl$DVB_DEMUX_DMX_SET_FILTER(0xffffffffffffffff, 0x403c6f2b, &(0x7f0000000040)={0xc270, {"4edf0900001f0b007900470a1877732c", "af8c2a7506b5b00c9f00000000fdff00", "00000000000000000200"}, 0xe, 0x5}) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(0xffffffffffffffff, 0x40146f2c, &(0x7f0000000180)={0x5, 0x0, 0x3, 0x14, 0x4}) mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x1000003, 0x20031, 0xffffffffffffffff, 0xffffe000) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000007e000/0x1000)=nil) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) cachestat(r3, &(0x7f0000000280)={0x52a, 0x6}, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x0, 0x0}) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) openat(0xffffffffffffff9c, 0x0, 0x289c2, 0x1) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x2000) r6 = gettid() process_vm_writev(r6, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0x7ffff000}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x66) 8.297261067s ago: executing program 3 (id=1662): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1}) r3 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [], [0x8200], 0x1}}}) ioctl$VIDIOC_QBUF(r3, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x0, {0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, "8000"}, 0x0, 0x2, {}, 0x20800}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="b8000000190001000000000000000000e0000002000000000000000000000000000000000000000000000000000000004f00290000000000000000000000000014b2b0a0ac011b957af7aab3a8cbd83b188d4589b46bdcb9e6b826c1d6c5a026dd1710ec4288896b8e6f1159732c8c98a81d9020990051ba9e6fc190ccf8f294d39abcf2e5d98399af69d3d19597b1027c7c4e95b177fd6106f32f1e7b423853a04c9dc01dc40566dd672a417c38db199aa4c460bae07217bad65f6f5e72122cb4a532c92a4002cfbcb531940589558d95e8fe223feb59c46083f99b16c854692def02dacf748105a085d17a0364b33348d208a144d8037c731b9175e656cbb7e5c9f3ebf256", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000700000000000000000000000000000000000000000000000200000000000000ffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00"/112], 0xb8}}, 0x4004) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0xfffffffffffffffb}}}, 0xb8}}, 0x0) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000150001000000000000000000e000000200000000000000000000000000000000000003"], 0xb8}}, 0x0) syz_usb_connect(0x1, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x2, &(0x7f0000000380)=ANY=[@ANYRES8=r4]}]}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x5f, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000003c0)="c4c37905d6040f0866bad104ec66660f388043006665660f3a0d9a0050000000b805000000b9050000000f01d926d0eb0f20e035200000000f22e0b9800000c00f3235000100000f306566dad3", 0x4d}], 0x1, 0x43, 0x0, 0x0) request_key(&(0x7f00000000c0)='id_resolver\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f00000002c0)='\x00', 0x0) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff}) ioctl$KVM_RUN(r9, 0xae80, 0x0) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) 8.223206585s ago: executing program 1 (id=1663): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) socket$inet6(0xa, 0x3, 0x3) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a32000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs$userns(0x0, &(0x7f0000000080)) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@delneigh={0x30, 0x1d, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r4, 0x0, 0x96, 0x4}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}, @NDA_VLAN={0x6, 0x5, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_usb_connect(0x6, 0x36, &(0x7f0000000000)=ANY=[@ANYRES16], 0x0) 8.14955484s ago: executing program 2 (id=1664): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='mountstats\x00') madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f000001a2c0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f000001a300)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r0, 0xc02864c3, &(0x7f000001a380)={&(0x7f000001a340)=[0x0, 0x0, 0x0, 0x0, r1, r2], 0x7, 0x6, 0x2}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r4, 0x0) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r5, 0x7a7, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = semget$private(0x0, 0x5, 0x500) semop(r6, &(0x7f0000000000)=[{0x3, 0xfff7, 0x1000}], 0x1) ioctl$IOCTL_VMCI_INIT_CONTEXT(r5, 0x7a0, &(0x7f0000000180)={@hyper, 0x1}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r5, 0x7cb, &(0x7f0000000100)={0x0, 0x0, 0x1008}) capset(&(0x7f0000000040)={0x20080522}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) mlock2(&(0x7f0000245000/0x1000)=nil, 0x1000, 0x1) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') read$FUSE(r8, 0x0, 0x0) pread64(r0, &(0x7f0000001240)=""/102400, 0x19000, 0xff) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) 7.805362772s ago: executing program 4 (id=1665): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x3c}, 0x1, 0x0, 0x0, 0x24000804}, 0x24040801) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x2) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r10, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x8}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004100)=@newtfilter={0x64, 0x28, 0x575ac7824d421509, 0x70bd2d, 0x4, {0x0, 0x0, 0x0, r10, {0xa}, {0x6}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0x38, 0x2, [@TCA_BPF_ACT={0x34, 0x1, [@m_police={0x30, 0x14, 0x0, 0x0, {{0xb}, {0x4, 0x2, 0x0, 0x1, [[]]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x64}}, 0x40) r11 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r11, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r12], 0x5c}}, 0x40) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r13}, @IFLA_MASTER={0x8, 0xa, r13}]}, 0x4c}}, 0x884) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r14, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000540)={0x1c, 0x8, 0x6, 0x3, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x4008040) 7.602790471s ago: executing program 0 (id=1666): r0 = fsopen(&(0x7f0000000580)='overlay\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000200)={0xd8a, 0x20000800, 0x2000, 0x0, 0x3, 0x1, 0x1, 0x1}, 0x10) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000200)={0x48}) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000640)=@filter={'filter\x00', 0x42, 0x4, 0x348, 0xffffffff, 0x1b8, 0x0, 0x1b8, 0xffffffff, 0xffffffff, 0x2b0, 0x2b0, 0x2b0, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0xf}}, @common=@unspec=@connmark={{0x30}, {0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0xb8, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0xf, 0x2}}, @common=@socket0={{0x20}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a8) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r5, 0x0, 0x30, &(0x7f0000000440)=ANY=[@ANYBLOB="400000000000000002004e22ac14142c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000002004e20ac141410000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000926320b038d86508e357382df0ef843f4e54db3499da6b27804817314b8d7417d43022821b7f126af441357f7c2f"], 0x110) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r6, 0x4611, 0x3) ioctl$FBIO_WAITFORVSYNC(r6, 0x40044620, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) r8 = dup(r7) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r10, 0x40045431, &(0x7f0000000140)={0x0, 0xc, 0x0, 0x0, 0xff, "810000cc2b000000000000fa25ffff00ffffff"}) r11 = syz_open_pts(r10, 0x141601) fcntl$setstatus(r11, 0x4, 0x102800) write(r11, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$TIOCSETD(r11, 0x5423, &(0x7f0000000100)=0x19) close_range(r9, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 6.987764509s ago: executing program 2 (id=1667): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/bus/input/devices\x00', 0x0, 0x0) preadv(r6, &(0x7f00000015c0)=[{&(0x7f0000000140)=""/4078, 0xfee}], 0x1, 0xf2, 0x207fff) keyctl$instantiate(0xc, 0x0, &(0x7f0000001340)=ANY=[@ANYBLOB="6e657720723a73797a2030df8bd503303bc330303030303430393300"/48], 0x2a, 0x0) r7 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f0000000080)="13", 0x1, 0xfffffffffffffffd) keyctl$read(0xb, r7, &(0x7f0000000240)=""/112, 0x349b7f55) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r9 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r9, 0x40146f2c, &(0x7f00000000c0)={0x100, 0x0, 0x0, 0x5, 0x4}) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r9, 0x40146f2c, &(0x7f0000000040)={0x4, 0x0, 0x0, 0xb, 0x4}) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x5, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000180)="9a", 0x1, 0x800, &(0x7f0000000480)={0xa, 0x4e23, 0x20000000, @loopback}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@deltaction={0x14, 0x31, 0x4, 0xff, 0x25dfdbfc}, 0x14}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000001300)={&(0x7f0000001140)={0x10, 0x0, 0x0, 0x100200}, 0xc, &(0x7f00000012c0)={&(0x7f0000001180)=ANY=[@ANYBLOB="2c0100001e00000129bd7000fbdbdf2507000000", @ANYRES32=r8, @ANYBLOB="0200000000100100080025000200000008000f00010000000f00240085e641a3453d1d2081effa00080023000400000008000500", @ANYRES32, @ANYBLOB="08001c00", @ANYRES32=r6, @ANYBLOB="cc003480140035007767320000000000000000000000000014003500767863616e31000000000000000000001400350076657468315f746f5f62726964677a6b616c6c657230000000000000140035007465616d3000000000000000000000001400350067656e65766530000000000000000000140035007866726d3000000000000000000000001400350067656e65766531000000000000000000140035006e657464657673696d30000000000000140035006261746164763000000000000000000008001f00466f0000"], 0x12c}, 0x1, 0x0, 0x0, 0x40015}, 0x44810) 6.501090711s ago: executing program 4 (id=1668): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x3c}, 0x1, 0x0, 0x0, 0x24000804}, 0x24040801) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r9) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x8}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000004100)=@newtfilter={0x64, 0x28, 0x575ac7824d421509, 0x70bd2d, 0x4, {0x0, 0x0, 0x0, 0x0, {0xa}, {0x6}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0x38, 0x2, [@TCA_BPF_ACT={0x34, 0x1, [@m_police={0x30, 0x14, 0x0, 0x0, {{0xb}, {0x4, 0x2, 0x0, 0x1, [[]]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x64}}, 0x40) r10 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r10, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r11], 0x5c}}, 0x40) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r12}, @IFLA_MASTER={0x8, 0xa, r12}]}, 0x4c}}, 0x884) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r13, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000540)={0x1c, 0x8, 0x6, 0x3, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x4008040) 5.918441318s ago: executing program 0 (id=1669): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000680)={0x2, 'virt_wifi0\x00', {0xff}, 0x2f97}) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000380)=@newlink={0x48, 0x10, 0x503, 0x70bd2a, 0xc, {0x0, 0x0, 0x0, 0x0, 0x3a, 0x201a0}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_ADDRESS={0xa, 0x1, @local}]}, 0x48}}, 0x800) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4c0000002000010000000000fcdbdf250a805f00000000031a00030014000200fc020000000000000000000000000001080017004e234e231400010020010000000000000000000000000001a4c42b01ab074afa174282d70aac6e59a46cf0d08b9535cba053165c969be9b1a9be48f3619e22cd926e14e2bdbd0dbc3388c54343ff6e8d0f8c81"], 0x4c}}, 0x40000) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x22000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0xe1}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xc931e000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f0000000340)={0x48, 0x2, r8, 0x0, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r7, 0x3ba0, &(0x7f0000000800)={0x48, 0x3, r9, 0x0, 0x1004000, 0x0, 0x0}) syz_clone3(&(0x7f0000001880)={0x100000200, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$BLKREPORTZONE(r4, 0xc0101282, &(0x7f00000002c0)={0x800}) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x7c, 0x9, 0xa, 0x3, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}, @NFTA_SET_EXPRESSIONS={0x60, 0x12, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz0\x00'}]}}}, {0xc, 0x1, 0x0, 0x1, @osf={{0x8}, @void}}, {0x24, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0xf}]}}}]}]}, @NFT_MSG_DELOBJ={0xc0, 0x14, 0xa, 0x5, 0x0, 0x0, {}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_USERDATA={0x94, 0x8, "2a568c5c06f3dfe356c1595f2c6ce1a090b9dd3bf4f5373298041c836d6a6b52c8cec2b80c4ce251873ee7f5cf1a7417dc0eae7e340bb059560dd943dac8ee64fcfa0223a0e8e112066adf0c268195b2013c2dc9fdc108478d563729a88ee5e27b91fe0d34f55a1ba1e7d235dc3f748cf76580e8edf4a29f1bfd30f907c3456fe916e05f7499cfd3154fda1fea9cf619"}]}, @NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x401, 0x0, 0x0, {0xa}, @NFT_OBJECT_QUOTA=@NFTA_OBJ_TYPE={0x8}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x180}, 0x1, 0x0, 0x0, 0x4048041}, 0x8000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000400)) socket$can_bcm(0x1d, 0x2, 0x2) 5.697524386s ago: executing program 4 (id=1670): sendmmsg$unix(0xffffffffffffffff, &(0x7f0000006300)=[{{0x0, 0x0, &(0x7f0000000900), 0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="000000001c00000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00,\x00\x00', @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00'], 0xb8, 0x20048000}}, {{&(0x7f0000000bc0)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000002140), 0x0, 0x0, 0x48, 0x8008841}}], 0x2, 0x4000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, &(0x7f0000000140)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x40000, 0x0) getdents64(r2, &(0x7f0000001000)=""/164, 0xa4) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000100)='test_dummy_encryption', 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) ioctl$SIOCSIFHWADDR(r4, 0x8914, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) read$FUSE(0xffffffffffffffff, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) msgrcv(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 5.509165184s ago: executing program 2 (id=1671): landlock_restrict_self(0xffffffffffffffff, 0x0) landlock_create_ruleset(&(0x7f0000000080)={0x1063, 0x1, 0x1}, 0x18, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000540), 0xe30f42, 0x0) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, 0x0, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, &(0x7f00000001c0)={&(0x7f0000000200), 0x0, 0x80800, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}) ioctl$DRM_IOCTL_MODE_GETENCODER(r4, 0xc01464a6, &(0x7f0000000180)={r5}) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) keyctl$join(0x1, &(0x7f0000000140)={'syz', 0x0}) 5.113232551s ago: executing program 1 (id=1672): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) socket(0x10, 0x3, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x2002) write$evdev(r2, &(0x7f0000000040)=[{{}, 0x0, 0x2}], 0x37) ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f00000001c0)=0x1) shmat(0x0, &(0x7f0000ff1000/0x3000)=nil, 0x400c) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2e) syz_kvm_setup_syzos_vm$x86(r3, &(0x7f0000c00000/0x400000)=nil) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r4 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f00000004c0)=ANY=[], 0xe) mremap(&(0x7f0000ff4000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={@fallback, 0xffffffffffffffff, 0x25}, 0x20) capget(0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="b8000000190001002dbd70000000000000000000000000000000000000000001fe8000000000000000000000000000bb00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000fffffffffeffffff0000800000200000fcffffffffffffff0000000000000000000a000000000000040000000000000002e3b5000000000800000000000000000101"], 0xb8}}, 0x4) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@updpolicy={0xb8, 0x19, 0x1, 0xfffffffc, 0x0, {{@in=@dev={0xac, 0x14, 0x14, 0x2c}, @in6=@empty, 0x4e22, 0x0, 0x4e24, 0x0, 0xa, 0x0, 0x60}, {0x0, 0x1000000000000401, 0xfffffffffffffffb, 0x40000000, 0x0, 0x1a, 0x200000000001, 0xfffffffffffffffe}, {0x7a, 0x5, 0x0, 0x7fff}, 0x8, 0xfffffffe, 0x1, 0x0, 0x3, 0x2}}, 0xb8}}, 0x8044) sendto$inet6(r5, &(0x7f0000000240)="c8", 0x1, 0x51, &(0x7f0000000080)={0xa, 0x3, 0x1, @dev={0xfe, 0x80, '\x00', 0x36}, 0x9}, 0x1c) 5.102898564s ago: executing program 3 (id=1673): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x118d7, 0x0, 0x0, &(0x7f00000002c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0x5e}, 0x1c) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x14e22, 0xfffffff8, @ipv4}, 0x1c) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040) setsockopt$inet_udp_int(r2, 0x11, 0x67, &(0x7f0000000000)=0x507, 0x4) sendmmsg$inet(r2, &(0x7f0000000600)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c844) r6 = socket$netlink(0x10, 0x3, 0x0) writev(r6, &(0x7f00000003c0)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) sendto$inet(r2, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440606769ebdf12cfacae8e8c03f5db079da7d9ecda75e2a7d49d5cbcb370c4d789390a328ba42c9c60cf2154d1b659aa709e8980a522cfb72f23ad87fb7019706ccae98cfe7c4fd23e8297b8cabc46ede1ac3da78f1b488c6357e7edfcd417df6660af20a54ecdcb02f689ae15ee655d4b7b1ea733e88ee9f53669388dff487c1c49953f3bc142112bd4b582b29b35d43962ed245c2cd5d5df40a3e0ed6beaf3b641e84b0f0dfa121a9efe05269f9f4a0e9bcbf43c7a90a711f453668c730c3badedca687b71a9c27bab9e724cc4a4918713031596ea6fd01124f973f257ccd9665aee7df4a9d64f079d176abc00000000d7af3e2dd4396f72373fb0a787a6129ca41181f5087fb843212550b58e3707d5a0399de36c2503836cbe2133de4f574e9e05c96788b0de1bd13e390445433d96737b964fa8af2ac4b2f0f9390ca93d8d3d810044d024359e067c4553230ab748947d33f8fc115ce9a49e6571c45a05d786cbd49342c236537dbbeec666b07baab917252113a5b9a77283189b518f356debe42d80cf2d0687b9c64d0253a6a09286fded6e4f8557b8fb4f25ca4fb138af8945c74bbc98748eaaa030be5317646f195e6e085ac6ddb29542e3581961259987241f7e7061526a7afec8962e74215fea43703a4e543ee9d1a3c3f5f2a41977ece8fdadcf89ce331ce59bebae5f53513d0e10485d7ddbda60513bf339602510b3a23ea29a0d5d03a61e34d12942ea4a847c884b27b5344a456d02a55f8929cc567e7c792c01fab7a7b32780a14c361000609b817dd91507b04d875279527946fdb8fb92a512485e234d092c28f1d0a0498731ccc0eb10515d510e8945839307b46512ceca6f495fdd2c6ae5eb2ef3b2a40ebdc7edf0048e3fb5e3d97a9ea5113a6b70d20ad5c43f0df95d88c0f121a1884da21a21f0ba47420f8391a97921cc51871dbb272e43710fe71d5e342c3afd10608a8b02f00e8fbd8d570b6faace86c494ecea8913233391e7b7cec3d571bb3032181ed58e1b513e511f79ee562c8cde9b3b74c2e95dcde7fadb5a666bdc0c1684794620ce8cf0c0aee8e90b3ef6e7160d3f055cb4d1ced32e4edc15e7d102952d3237e6c02c591a95a182bf190c0124abc7f1225332ff1c5e1b94e4e9bf02c1a18bd7bfce20707f7298da322560bc1a4cf298d46f5bf8ff41da21e25aa17f65f9ee43ca890b5ef6a3ccf3efedf3ca60a9acef1352ad0c43e6cf375108cf0974ce89a99adba7e6a3f8949dc573440fafe0e3abdd0066057a2d868e8386080f18a421568d8e7a89536a4173861bd55245c8fcf7dcba18edce36d2e85b9630fbc218db9ebd16abb11ac06fdbf2bc3e6394d4c6e7ae71813d30772d487743a2856348fee09989ce03331e7848770fc91e62191c20fe5f4a73c5dae467dd612bdb63b1e50921d38271305d7412103d5a6214d6d534d1d530b9169f882b6926bbd338f0282a8bd9a44603934e5249e83f1d0947b39f82a7843d2b6f796d8abf7ff3e66cfd4519324d71cebbf6580dffc10d555e479e9acaa12c3c59e3732c181aa4223d0fcdac514e9d7c7963c2634964520286b028f60a4ae612b8e6049315139e884cbffd6836253094ad023329183496cf663366ad4d7f7f5f1bd2db9b0d33f106c041fba4494c7da404d45d8955e5459ca4a62862721ec1fa534fd95e262c5814426816e60000000000000000001aa4fb6f40ec24f42f6949cc28d2a0d4eb61cb1664627582d962523586539445b81e9759321652280ecb", 0xffe3, 0x6000000000000000, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, 0x0, 0x4000000) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) socket$alg(0x26, 0x5, 0x0) 3.265426817s ago: executing program 1 (id=1674): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) socket$inet6(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000280)={'ip6_vti0\x00', 0x0, 0x4, 0x0, 0x3, 0x5, 0x12, @mcast2, @private0, 0x0, 0x8007, 0x100, 0x5}}) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x800) recvmmsg(r5, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001180)=""/4096}, {&(0x7f0000000440)=""/128}], 0x0, &(0x7f00000004c0)=""/193}, 0x7f}, {{&(0x7f00000005c0)=@in, 0x0, &(0x7f0000000700)=[{&(0x7f0000000640)=""/35}, {&(0x7f0000000680)=""/127}], 0x0, &(0x7f0000000740)=""/23}, 0x3}], 0x400000000000054, 0x40012100, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x6, 0x0, 0x6}, {0x6, 0x0, 0x0, 0xb}}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}, {0x56}}], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000002940)=ANY=[@ANYBLOB='0\x00', @ANYRES16=r2, @ANYBLOB="01f6366b8a1bae235e7bfc80000008000316ca3cf4b325db655a3c82a98fe31ec412be4c502cd33591724775cc0791fbc99c7b", @ANYRES32=r7, @ANYBLOB="0c00990009000000440000000800020001000000"], 0x30}, 0x1, 0x0, 0x0, 0x2400c891}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) 3.203425053s ago: executing program 0 (id=1675): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x5}, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB(0xffffffffffffffff, 0xc01c64ae, &(0x7f0000000100)={0x0, 0x4, 0x9, 0x3, 0xf, 0xa, 0xfffffffc}) r2 = socket$netlink(0x10, 0x3, 0x6) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000080)='source', &(0x7f00000019c0)='//\xf2/\x06\b/?\\o\xdc\xea\x95\x9a)\x00bb\x8a\x80\x91\xdf\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6h\xd1\x1d\xac\xaa\xfb\xc7Y\xcd\xc5n\xeb\xab\xf70\x99\xef\x8b0x0], &(0x7f0000000700)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x9, 0x5, 0x9}) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000840)={0x0, 0x0, r3, 0x0, 0x0, 0x0, &(0x7f0000000800)}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) timer_create(0x7, &(0x7f0000001880)={0x0, 0x2b, 0x1}, 0x0) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000400)={0x0, 0xffffffffffffffff, 0x80, 0x69, @buffer={0x0, 0x9, &(0x7f0000000140)=""/9}, &(0x7f0000000280)="99d3a24738682d0c1c1cd66fd35b568856fc3a45500836a494b5fd5fc07adfed31556cc6a593978da7f96e3891556ee93d06070912cf42085046e03a2e546dd83779aad39639307fb9b955470e5febf3b8588357c48644e2ce292d12dcee0ff0323b3dae269b7434357c167b58384e358bed021a1a8be956337955db3ca276a6", &(0x7f0000000340)=""/166, 0x7, 0x1, 0xffffffffffffffff, 0x0}) syz_mount_image$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x208402, 0x0, 0x0, 0x0, 0x0) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, 0x0, 0x0) write$sysctl(r4, &(0x7f0000000580)='1\x00', 0x2) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12011900000000406a0563000000000000010902"], 0x0) write$sysctl(r4, &(0x7f00000000c0)='2\x00', 0x2) 3.183865651s ago: executing program 4 (id=1676): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.events\x00', 0x275a, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_SUBMITURB(r2, 0x802c550a, &(0x7f0000000440)=@urb_type_control={0x2, {0x6, 0x1}, 0x5, 0x67, 0x0, 0x0, 0xffff, 0x9, 0x0, 0x400, 0x0, 0x0}) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x11, r0, 0xa06e4000) r3 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) syz_clone(0x14a080, 0x0, 0x0, 0x0, 0x0, 0x0) landlock_restrict_self(r3, 0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0xffffd000) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=ANY=[@ANYBLOB="8500000010010000180a00000000000000000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0x12, &(0x7f000000cf3d)=""/195}, 0x23) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d083911000000000000a1180015000600142603600e120900210000000401a80016000400144006000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040", 0xa2}], 0x1}, 0x0) write$binfmt_script(r0, &(0x7f0000000100), 0xfffffd9d) r4 = socket(0x1e, 0x4, 0x0) connect$tipc(r4, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x1, 0x4}}, 0x10) sendfile(r4, r0, 0x0, 0xd) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @private=0xa010102}, 0x10) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x109c02, 0x0) r5 = syz_io_uring_setup(0x70ca, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0x3, 0x179}, &(0x7f0000000100)=0x0, &(0x7f00000007c0)=0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@mpls_delroute={0x24, 0x18, 0x9, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_TTL_PROPAGATE={0x5}]}, 0x24}}, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_WRITEV={0x2, 0x40, 0x0, @fd_index=0x3, 0x0, &(0x7f0000000440)=[{&(0x7f0000000580)="1a", 0x1}, {0x0, 0x47}], 0x2}) io_uring_enter(r5, 0x4d10, 0x2, 0x2, 0x0, 0x0) 2.031800552s ago: executing program 1 (id=1677): syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = socket(0x10, 0x80002, 0x2) bind$netlink(r3, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) r4 = syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_usb_control_io$printer(r4, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r4, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r4, 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0x3) r5 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0x0) fsopen(&(0x7f0000000200)='ecryptfs\x00', 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40100}, 0x2c000010) syz_emit_ethernet(0x0, 0x0, 0x0) 1.028929293s ago: executing program 3 (id=1678): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x840000000002, 0x3, 0xfa) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0), &(0x7f00000002c0)=0xc) bpf$MAP_CREATE(0x0, 0x0, 0x50) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x30}, 0x1, 0x0, 0x0, 0x46801}, 0x4000000) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x7a, &(0x7f0000000340)={r6, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r4, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001"], 0x30}], 0x1, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000180)={r6}, &(0x7f0000000240)=0x8) 407.663718ms ago: executing program 2 (id=1679): openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x4, &(0x7f0000000640)=0x10000, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) unshare(0x8000000) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f00000001c0)={0xa, {{0xa, 0x4e20, 0x6, @local}}}, 0x84) r3 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000180)={0x0, &(0x7f00000000c0), 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f0000000580)={0x0}) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = msgget$private(0x0, 0x480) msgsnd(r5, &(0x7f0000000480)=ANY=[], 0x401, 0x0) msgsnd(r5, &(0x7f0000000a00)=ANY=[@ANYBLOB="01"], 0x401, 0x0) msgrcv(r5, 0x0, 0x0, 0x1, 0x1000) msgctl$IPC_RMID(r5, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="13df00003a00010325bd"], 0x5a}, 0x1, 0x0, 0x0, 0x448d3}, 0x0) madvise(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xc) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000001040)=[0xc, 0xf, 0x1, 0x2, 0x8, 0x80, 0x5, 0x0]) syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) r6 = socket$kcm(0xa, 0x5, 0x0) mkdir(0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x890c, &(0x7f0000000000)) 0s ago: executing program 4 (id=1680): r0 = fsopen(&(0x7f0000000580)='overlay\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000200)={0xd8a, 0x20000800, 0x2000, 0x0, 0x3, 0x1, 0x1, 0x1}, 0x10) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000200)={0x48}) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000640)=@filter={'filter\x00', 0x42, 0x4, 0x348, 0xffffffff, 0x1b8, 0x0, 0x1b8, 0xffffffff, 0xffffffff, 0x2b0, 0x2b0, 0x2b0, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0xf}}, @common=@unspec=@connmark={{0x30}, {0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0xb8, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0xf, 0x2}}, @common=@socket0={{0x20}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a8) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r5, 0x0, 0x30, &(0x7f0000000440)=ANY=[@ANYBLOB="400000000000000002004e22ac14142c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000002004e20ac141410000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000926320b038d86508e357382df0ef843f4e54db3499da6b27804817314b8d7417d43022821b7f126af441357f7c2f"], 0x110) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r6, 0x4611, 0x3) ioctl$FBIO_WAITFORVSYNC(r6, 0x40044620, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) r8 = dup(r7) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r10, 0x40045431, &(0x7f0000000140)={0x0, 0xc, 0x0, 0x0, 0xff, "810000cc2b000000000000fa25ffff00ffffff"}) r11 = syz_open_pts(r10, 0x141601) fcntl$setstatus(r11, 0x4, 0x102800) write(r11, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$TIOCSETD(r11, 0x5423, &(0x7f0000000100)=0x19) close_range(r9, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): 414.120785][ T5909] pwc: Warning: more than 1 configuration available. [ 414.242700][ T9797] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 415.052112][ T9799] xt_hashlimit: size too large, truncated to 1048576 [ 416.224818][ T5909] pwc: Failed to set LED on/off time (-71) [ 416.391024][ T5909] pwc: send_video_command error -71 [ 416.400145][ T5909] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 416.479347][ T5909] Philips webcam 3-1:0.0: probe with driver Philips webcam failed with error -71 [ 416.499320][ T5909] usb 3-1: USB disconnect, device number 20 [ 417.943479][ T9827] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 418.233909][ T9838] binder: BINDER_SET_CONTEXT_MGR already set [ 418.239997][ T9838] binder: 9832:9838 ioctl 4018620d 200000000040 returned -16 [ 418.556748][ T9845] kAFS: unable to lookup cell 'ÿ' [ 419.620372][ T9838] syz.3.798 (9838): drop_caches: 2 [ 420.231128][ T9862] netlink: 'syz.3.801': attribute type 10 has an invalid length. [ 420.384614][ T9862] bond0: (slave dummy0): Releasing backup interface [ 420.554495][ T9863] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 420.622477][ T9862] team0: Port device dummy0 added [ 420.708389][ T9868] ip6gre1: entered promiscuous mode [ 421.979868][ T9881] binder: BINDER_SET_CONTEXT_MGR already set [ 421.987720][ T9881] binder: 9874:9881 ioctl 4018620d 200000004a80 returned -16 [ 422.597732][ T1589] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 422.832691][ T1589] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD6, changing to 0x86 [ 422.854595][ T1589] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 422.959576][ T1589] usb 4-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24 [ 422.984180][ T1589] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.022800][ T1589] usb 4-1: Product: syz [ 423.054921][ T1589] usb 4-1: Manufacturer: syz [ 423.062876][ T1589] usb 4-1: SerialNumber: syz [ 423.120574][ T1589] usb 4-1: config 0 descriptor?? [ 423.130991][ T9888] 8021q: adding VLAN 0 to HW filter on device bond0 [ 423.530997][ T9888] 8021q: adding VLAN 0 to HW filter on device team0 [ 424.002306][ T9898] netlink: 24 bytes leftover after parsing attributes in process `syz.4.809'. [ 424.032929][ T9888] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 425.365303][ T1589] powermate: unknown product id 0240 [ 425.386946][ T1589] powermate: Expected payload of 3--6 bytes, found 7 bytes! [ 425.414876][ T1589] input: Griffin SoundKnob as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input20 [ 425.484773][ C1] powermate: config urb returned -71 [ 425.490598][ C1] powermate: config urb returned -71 [ 425.496029][ C1] powermate: config urb returned -71 [ 425.501521][ C1] powermate: config urb returned -71 [ 425.561352][ T1589] usb 4-1: USB disconnect, device number 18 [ 425.567302][ C1] powermate 4-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 425.897938][ T9914] netlink: 'syz.3.811': attribute type 6 has an invalid length. [ 425.906182][ T9914] netlink: 'syz.3.811': attribute type 7 has an invalid length. [ 425.914053][ T9914] netlink: 'syz.3.811': attribute type 8 has an invalid length. [ 426.152494][ T9920] fuse: Bad value for 'rootmode' [ 426.888944][ T9925] syz.4.812 (9925): drop_caches: 2 [ 427.253952][ T9932] netlink: 'syz.2.815': attribute type 12 has an invalid length. [ 427.491564][ T9926] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 427.759893][ T24] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 427.919178][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 427.933325][ T24] usb 3-1: config 0 has an invalid interface number: 216 but max is 0 [ 427.972102][ T9937] tipc: Failed to remove unknown binding: 66,0,0/2532053454:2748615282/2748615284 [ 427.982169][ T9937] tipc: Failed to remove unknown binding: 66,0,0/2532053454:2748615282/2748615283 [ 428.000340][ T9937] tipc: Failed to remove unknown binding: 66,0,0/2532053454:2748615282/2748615284 [ 428.023903][ T9937] tipc: Failed to remove unknown binding: 66,0,0/2532053454:2748615282/2748615283 [ 428.040687][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 428.054595][ T24] usb 3-1: config 0 has no interface number 0 [ 428.074940][ T24] usb 3-1: config 0 interface 216 altsetting 0 endpoint 0xA has invalid maxpacket 4098, setting to 1024 [ 428.124633][ T24] usb 3-1: config 0 interface 216 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1024 [ 428.362686][ T24] usb 3-1: config 0 interface 216 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 428.406532][ T24] usb 3-1: New USB device found, idVendor=c877, idProduct=d477, bcdDevice=ca.74 [ 428.415668][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.441867][ T24] usb 3-1: Product: syz [ 428.452411][ T24] usb 3-1: Manufacturer: syz [ 428.466093][ T24] usb 3-1: SerialNumber: syz [ 428.508901][ T24] usb 3-1: config 0 descriptor?? [ 428.534053][ T9932] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 428.742903][ T24] usb-storage 3-1:0.216: USB Mass Storage device detected [ 430.598692][ T9977] netlink: 'syz.4.827': attribute type 10 has an invalid length. [ 430.686515][ T9978] netlink: 'syz.4.827': attribute type 10 has an invalid length. [ 430.730219][ T9977] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 430.826066][ T9977] team0: Port device netdevsim0 added [ 430.951067][ T9978] team0: Port device netdevsim0 removed [ 430.982812][ T5922] usb 3-1: USB disconnect, device number 21 [ 431.020886][ T9978] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 431.616459][ T9984] vivid-007: ================= START STATUS ================= [ 431.639431][ T9984] vivid-007: Generate PTS: true [ 431.679002][ T9984] vivid-007: Generate SCR: true [ 431.720645][ T9984] tpg source WxH: 320x240 (Y'CbCr) [ 431.849723][ T9984] tpg field: 1 [ 431.856574][ T9984] tpg crop: (0,0)/320x240 [ 431.867002][ T9984] tpg compose: (0,0)/320x240 [ 431.899423][ T9984] tpg colorspace: 8 [ 431.912379][ T9984] tpg transfer function: 0/0 [ 431.929624][ T9984] tpg Y'CbCr encoding: 0/0 [ 431.941989][ T9984] tpg quantization: 0/0 [ 431.954555][ T9984] tpg RGB range: 0/2 [ 431.958524][ T9984] vivid-007: ================== END STATUS ================== [ 432.049332][ T5910] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 432.321604][T10001] netlink: 'syz.2.835': attribute type 2 has an invalid length. [ 432.379651][ T5910] usb 4-1: Using ep0 maxpacket: 8 [ 432.490194][ T5910] usb 4-1: config 127 has an invalid interface number: 171 but max is 1 [ 432.532642][ T5910] usb 4-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config [ 432.564499][ T5910] usb 4-1: config 127 has 1 interface, different from the descriptor's value: 2 [ 432.578336][ T5910] usb 4-1: config 127 has no interface number 0 [ 432.616229][ T5910] usb 4-1: config 127 interface 171 has no altsetting 0 [ 432.689198][ T5910] usb 4-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9 [ 432.700113][ T5910] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.708121][ T5910] usb 4-1: Product: syz [ 432.717824][ T5910] usb 4-1: Manufacturer: syz [ 432.722979][ T5910] usb 4-1: SerialNumber: syz [ 432.773286][T10011] netlink: 104 bytes leftover after parsing attributes in process `syz.2.839'. [ 434.674845][ T5910] usb 4-1: USB disconnect, device number 19 [ 436.486314][T10064] netlink: 8 bytes leftover after parsing attributes in process `syz.0.853'. [ 436.549597][ T29] audit: type=1800 audit(1771651712.989:192): pid=10063 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.853" name="file0" dev="fuse" ino=3 res=0 errno=0 [ 438.309236][ T5910] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 438.489704][ T5910] usb 4-1: Using ep0 maxpacket: 32 [ 438.512133][ T5910] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 438.539337][ T5910] usb 4-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 438.562724][ T5910] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 438.574342][ T5910] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 438.638125][ T5910] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 438.649431][ T5910] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.657447][ T5910] usb 4-1: Product: syz [ 438.661983][ T5910] usb 4-1: Manufacturer: syz [ 438.666568][ T5910] usb 4-1: SerialNumber: syz [ 438.707014][ C1] imon 4-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 438.729812][ T5910] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/input/input21 [ 438.954297][T10099] loop5: detected capacity change from 0 to 7 [ 438.983696][T10099] Dev loop5: unable to read RDB block 7 [ 438.991456][T10099] loop5: AHDI p1 p2 p3 [ 438.995676][T10099] loop5: partition table partially beyond EOD, truncated [ 439.044222][ T5910] imon 4-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 439.055196][ T5910] (id 0x00) [ 439.082268][T10099] loop5: p1 start 1601398130 is beyond EOD, truncated [ 439.111200][T10099] loop5: p2 start 1702059890 is beyond EOD, truncated [ 439.360061][T10107] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 439.401665][T10105] overlayfs: missing 'lowerdir' [ 439.411676][ T5910] rc_core: IR keymap rc-imon-pad not found [ 439.419430][ T5910] Registered IR keymap rc-empty [ 439.424376][ T5910] imon 4-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 439.462844][T10099] netlink: 64 bytes leftover after parsing attributes in process `syz.2.868'. [ 439.486967][ T5910] imon 4-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 439.513361][T10112] netlink: 16 bytes leftover after parsing attributes in process `syz.1.872'. [ 439.541167][ T5910] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/rc/rc0 [ 439.568745][ T5910] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/rc/rc0/input22 [ 439.612770][ T5910] imon 4-1:155.0: iMON device (15c2:ffdc, intf0) on usb<4:20> initialized [ 440.033599][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.040143][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.390990][T10080] imon:send_packet: packet tx failed (-71) [ 440.397585][ T5912] usb 4-1: USB disconnect, device number 20 [ 440.420315][T10080] imon:vfd_write: send packet #0 failed [ 440.484067][T10120] netlink: 'syz.1.883': attribute type 4 has an invalid length. [ 440.587988][T10122] QAT: failed to copy from user cfg_data. [ 441.109016][T10127] netlink: 104 bytes leftover after parsing attributes in process `syz.2.874'. [ 441.449558][ T5912] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 441.600888][ T5912] usb 2-1: Using ep0 maxpacket: 16 [ 441.615205][ T5912] usb 2-1: config 0 has no interfaces? [ 441.625933][ T5912] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 441.635985][ T5912] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 441.667789][ T5912] usb 2-1: Manufacturer: syz [ 441.825280][ T5912] usb 2-1: config 0 descriptor?? [ 442.872391][T10150] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 442.933932][T10151] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 442.994016][T10153] binder: BINDER_SET_CONTEXT_MGR already set [ 443.000204][T10153] binder: 10146:10153 ioctl 4018620d 200000000040 returned -16 [ 443.048446][T10153] syz.0.880 (10153): drop_caches: 2 [ 443.388370][T10157] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 443.961435][ T24] usb 2-1: USB disconnect, device number 21 [ 444.480388][T10166] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 444.568624][T10167] overlayfs: missing 'lowerdir' [ 445.104790][T10178] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 445.431165][T10178] overlayfs: missing 'lowerdir' [ 445.881637][T10195] netlink: 'syz.2.896': attribute type 25 has an invalid length. [ 445.899784][T10195] netlink: 40 bytes leftover after parsing attributes in process `syz.2.896'. [ 446.036021][T10197] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 446.697484][T10204] bridge0: port 1(bridge_slave_0) entered disabled state [ 446.997665][T10206] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 447.177049][T10223] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 447.241644][T10223] overlayfs: missing 'lowerdir' [ 447.524960][T10230] netlink: 12 bytes leftover after parsing attributes in process `syz.0.907'. [ 447.632606][T10226] bridge1: port 1(gretap1) entered blocking state [ 447.647512][T10226] bridge1: port 1(gretap1) entered disabled state [ 447.675479][T10226] gretap1: entered allmulticast mode [ 447.694347][T10226] gretap1: entered promiscuous mode [ 448.430739][T10236] xt_hashlimit: size too large, truncated to 1048576 [ 448.686094][T10243] netlink: 104 bytes leftover after parsing attributes in process `syz.2.910'. [ 448.940837][T10246] netlink: 'syz.4.911': attribute type 1 has an invalid length. [ 449.209832][T10246] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 449.300097][T10257] netlink: 12 bytes leftover after parsing attributes in process `syz.4.911'. [ 449.340668][T10246] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 449.405375][T10257] 8021q: adding VLAN 0 to HW filter on device bond2 [ 449.524671][T10259] bond2: (slave gretap1): making interface the new active one [ 449.540103][ T24] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 449.566971][T10259] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 449.651232][T10246] macvlan2: entered promiscuous mode [ 449.659758][T10246] macvlan2: entered allmulticast mode [ 449.665680][T10246] bond2: entered promiscuous mode [ 449.681741][T10246] gretap1: entered promiscuous mode [ 449.695544][T10246] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 449.755978][ T24] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD4, changing to 0x84 [ 449.769699][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 51544, setting to 1024 [ 449.791368][ T24] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 449.811338][ T24] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 449.817977][T10246] bond2: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 449.838450][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 449.846884][ T24] usb 4-1: Product: syz [ 449.851995][ T24] usb 4-1: Manufacturer: syz [ 449.856890][ T24] usb 4-1: SerialNumber: syz [ 449.857078][T10246] bond2: left promiscuous mode [ 449.867454][T10246] gretap1: left promiscuous mode [ 449.974920][ T24] usb 4-1: config 0 descriptor?? [ 449.982089][T10256] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 450.221973][T10253] netlink: 56 bytes leftover after parsing attributes in process `syz.3.912'. [ 450.439843][T10256] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 450.729508][T10253] netlink: 8 bytes leftover after parsing attributes in process `syz.3.912'. [ 451.255898][T10283] netlink: 8 bytes leftover after parsing attributes in process `syz.1.919'. [ 452.557493][ T1589] usb 4-1: USB disconnect, device number 21 [ 452.712671][T10301] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 452.781970][T10303] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 453.106646][T10309] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 454.521332][T10326] usb usb8: usbfs: process 10326 (syz.4.932) did not claim interface 0 before use [ 454.557060][T10328] netlink: 104 bytes leftover after parsing attributes in process `syz.2.931'. [ 454.893174][ T5910] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 454.904881][ T5910] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 455.364133][T10340] macsec0: entered promiscuous mode [ 455.370575][T10340] macsec0: entered allmulticast mode [ 455.376103][T10340] veth1_macvtap: entered allmulticast mode [ 456.674726][T10363] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 456.879384][T10352] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 456.990397][ T5910] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 457.216899][ T5910] usb 4-1: config 0 has an invalid interface number: 113 but max is 0 [ 457.252191][ T5910] usb 4-1: config 0 has no interface number 0 [ 457.277541][ T5910] usb 4-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 457.339960][ T5910] usb 4-1: config 0 interface 113 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 457.359442][ T5910] usb 4-1: config 0 interface 113 has no altsetting 0 [ 457.461460][ T5910] usb 4-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 457.479866][ T5910] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.489871][ T5910] usb 4-1: Product: syz [ 457.516999][ T5910] usb 4-1: Manufacturer: syz [ 457.527100][ T5910] usb 4-1: SerialNumber: syz [ 457.539931][ T5910] usb 4-1: config 0 descriptor?? [ 457.696958][ C1] usb 4-1: NFC: Urb failure (status -71) [ 457.710690][ T5910] usb 4-1: NFC: Unable to get FW version [ 457.763352][ T5910] pn533_usb 4-1:0.113: probe with driver pn533_usb failed with error -90 [ 458.347742][T10385] netlink: 'syz.0.946': attribute type 1 has an invalid length. [ 458.530465][T10387] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 458.582542][T10387] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 459.706757][T10412] netlink: 40 bytes leftover after parsing attributes in process `syz.4.954'. [ 459.849020][ T5912] usb 4-1: USB disconnect, device number 22 [ 460.077224][T10421] netlink: 156 bytes leftover after parsing attributes in process `syz.3.959'. [ 460.687356][T10434] batman_adv: batadv0: adding TT local entry b6:95:b7:e1:ed:06 to non-existent VLAN 1340 [ 460.969236][ T1589] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 461.054555][T10450] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 461.098625][T10450] overlayfs: missing 'lowerdir' [ 461.245011][ T1589] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 461.269691][ T1589] usb 5-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 461.281642][ T1589] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 461.314451][ T1589] usb 5-1: config 220 has no interface number 2 [ 461.321371][ T1589] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 461.335192][ T1589] usb 5-1: config 220 interface 0 has no altsetting 0 [ 461.342464][ T1589] usb 5-1: config 220 interface 76 has no altsetting 0 [ 461.350512][ T1589] usb 5-1: config 220 interface 1 has no altsetting 0 [ 461.360794][ T1589] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 461.373271][ T1589] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.434676][ T1589] usb 5-1: Product: syz [ 461.438897][ T1589] usb 5-1: Manufacturer: syz [ 461.468826][ T1589] usb 5-1: SerialNumber: syz [ 461.510856][T10458] netlink: 'syz.2.973': attribute type 10 has an invalid length. [ 461.709390][ T1589] uvcvideo 5-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 461.721461][ T1589] uvcvideo 5-1:220.0: No valid video chain found. [ 461.729580][ T1589] usb 5-1: selecting invalid altsetting 0 [ 461.793846][ T1589] usb 5-1: selecting invalid altsetting 0 [ 461.805512][ T1589] usbtest 5-1:220.1: probe with driver usbtest failed with error -22 [ 461.817618][T10467] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 461.834489][ T1589] usb 5-1: USB disconnect, device number 30 [ 463.019390][ T5922] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 463.272741][ T5922] usb 2-1: Using ep0 maxpacket: 32 [ 463.319690][T10491] netlink: 'syz.0.989': attribute type 1 has an invalid length. [ 463.348257][ T5922] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 463.362319][ T5922] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 463.400012][ T5912] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 463.424579][ T5922] usb 2-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 463.441654][ T5922] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 463.457788][ T5922] usb 2-1: config 0 descriptor?? [ 463.483751][T10495] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 463.518593][T10491] netlink: 12 bytes leftover after parsing attributes in process `syz.0.989'. [ 463.530559][T10495] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 463.610075][ T5912] usb 4-1: Using ep0 maxpacket: 8 [ 463.629709][ T5912] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 463.650052][T10491] 8021q: adding VLAN 0 to HW filter on device bond4 [ 463.664288][ T5912] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 463.690747][T10491] macvlan2: entered promiscuous mode [ 463.696542][ T5912] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.709936][T10491] macvlan2: entered allmulticast mode [ 463.716001][ T5912] usb 4-1: Product: syz [ 463.716948][T10491] bond4: entered promiscuous mode [ 463.733261][T10491] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 463.740550][ T5912] usb 4-1: Manufacturer: syz [ 463.748584][ T5912] usb 4-1: SerialNumber: syz [ 463.767928][T10491] bond4: left promiscuous mode [ 463.773497][ T5912] usb 4-1: config 0 descriptor?? [ 463.783612][ T5912] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 463.793530][ T5912] usb 4-1: setting power ON [ 463.798444][ T5912] dvb-usb: bulk message failed: -22 (2/0) [ 463.827158][ T5912] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 463.855831][ T5912] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 463.889471][ T5912] usb 4-1: media controller created [ 463.909660][ T9] usb 3-1: new low-speed USB device number 22 using dummy_hcd [ 463.940341][ T5912] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 463.957222][ T5922] logitech 0003:046D:C29C.0009: unbalanced delimiter at end of report description [ 463.967401][ T5922] logitech 0003:046D:C29C.0009: parse failed [ 463.976461][ T5922] logitech 0003:046D:C29C.0009: probe with driver logitech failed with error -22 [ 464.010143][ T5912] usb 4-1: selecting invalid altsetting 6 [ 464.016122][ T5912] usb 4-1: digital interface selection failed (-22) [ 464.036461][ T5912] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 464.036550][T10489] dvb-usb: bulk message failed: -22 (4/0) [ 464.046740][ T5912] usb 4-1: setting power OFF [ 464.063198][T10489] cxusb: i2c read failed [ 464.063256][ T5912] dvb-usb: bulk message failed: -22 (2/0) [ 464.079721][ T5912] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 464.090168][ T5912] (NULL device *): no alternate interface [ 464.092227][ T9] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 464.134764][ T9] usb 3-1: config 0 has no interface number 0 [ 464.150842][ T9] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 464.165876][ T5922] usb 2-1: USB disconnect, device number 22 [ 464.180176][ T5912] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 464.222446][ T9] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 464.233963][ T5912] usb 4-1: USB disconnect, device number 23 [ 464.272696][ T9] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 464.289635][ T9] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 464.306756][ T9] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 464.318790][ T9] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 464.332369][ T9] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 464.346276][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 464.363044][ T9] usb 3-1: config 0 descriptor?? [ 464.369008][T10500] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 464.377858][T10500] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 464.390454][ T9] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 464.473799][T10505] netlink: 4 bytes leftover after parsing attributes in process `syz.4.992'. [ 464.483642][T10505] netem: invalid attributes len -7 [ 464.489162][T10505] netem: change failed [ 464.647436][T10500] ldusb 3-1:0.55: Write buffer overflow, 2 bytes dropped [ 464.658737][ T1589] usb 3-1: USB disconnect, device number 22 [ 464.668515][ T1589] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 464.809050][T10512] macsec2: entered promiscuous mode [ 464.825489][T10512] dummy0: entered promiscuous mode [ 464.844410][T10512] macsec2: entered allmulticast mode [ 464.854612][T10512] dummy0: entered allmulticast mode [ 464.966454][T10512] dummy0: left allmulticast mode [ 464.973780][T10512] dummy0: left promiscuous mode [ 465.143797][T10522] netlink: 'syz.1.998': attribute type 10 has an invalid length. [ 465.414273][T10522] bond0: (slave dummy0): Releasing backup interface [ 465.497318][T10522] team0: Port device dummy0 added [ 465.512249][T10525] vlan2: entered promiscuous mode [ 466.288043][T10546] random: crng reseeded on system resumption [ 466.885753][T10562] bridge0: port 2(bridge_slave_1) entered disabled state [ 466.940764][T10567] program syz.3.1017 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 467.161969][T10574] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 467.665952][T10597] netlink: 'syz.0.1026': attribute type 10 has an invalid length. [ 467.897737][T10599] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 467.925161][T10599] overlayfs: missing 'lowerdir' [ 468.132312][T10596] netlink: 'syz.3.1028': attribute type 10 has an invalid length. [ 469.104703][T10604] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1031'. [ 469.216471][T10612] netlink: 'syz.0.1033': attribute type 3 has an invalid length. [ 469.251300][T10612] netlink: 'syz.0.1033': attribute type 3 has an invalid length. [ 469.281859][T10612] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1033'. [ 469.992730][T10646] netlink: 'syz.0.1045': attribute type 10 has an invalid length. [ 470.067748][T10651] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1047'. [ 470.385543][ T29] audit: type=1326 audit(1771651746.869:193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10660 comm="syz.3.1050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e2319c629 code=0x7ffc0000 [ 470.418983][T10661] delete_channel: no stack [ 470.447291][T10660] delete_channel: no stack [ 470.474462][ T29] audit: type=1326 audit(1771651746.889:194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10660 comm="syz.3.1050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e2319c629 code=0x7ffc0000 [ 470.587648][ T29] audit: type=1326 audit(1771651746.899:195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10660 comm="syz.3.1050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2e2319c629 code=0x7ffc0000 [ 470.687300][ T29] audit: type=1326 audit(1771651746.899:196): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10660 comm="syz.3.1050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e2319c629 code=0x7ffc0000 [ 470.819155][ T29] audit: type=1326 audit(1771651746.899:197): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10660 comm="syz.3.1050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e2319c629 code=0x7ffc0000 [ 470.870055][ T29] audit: type=1326 audit(1771651746.899:198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10660 comm="syz.3.1050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2e2319c629 code=0x7ffc0000 [ 470.899448][ T29] audit: type=1326 audit(1771651746.899:199): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10660 comm="syz.3.1050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e2319c629 code=0x7ffc0000 [ 470.947576][ T29] audit: type=1326 audit(1771651746.899:200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10660 comm="syz.3.1050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e2319c629 code=0x7ffc0000 [ 471.071187][ T29] audit: type=1326 audit(1771651746.899:201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10660 comm="syz.3.1050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=292 compat=0 ip=0x7f2e2319c629 code=0x7ffc0000 [ 471.121325][ T29] audit: type=1326 audit(1771651746.929:202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10660 comm="syz.3.1050" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e2319c629 code=0x7ffc0000 [ 471.191957][T10680] veth0_to_team: entered promiscuous mode [ 471.299755][ T1589] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 471.412678][T10686] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1060'. [ 471.499621][ T1589] usb 4-1: Using ep0 maxpacket: 16 [ 471.516463][ T1589] usb 4-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 471.529586][ T1589] usb 4-1: config 0 interface 0 altsetting 1 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 471.641668][ T1589] usb 4-1: config 0 interface 0 has no altsetting 0 [ 471.662953][ T1589] usb 4-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 471.679752][ T1589] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 471.688651][ T1589] usb 4-1: Product: syz [ 471.692951][ T1589] usb 4-1: Manufacturer: syz [ 471.697567][ T1589] usb 4-1: SerialNumber: syz [ 471.705434][ T1589] usb 4-1: config 0 descriptor?? [ 471.772138][T10696] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 471.942569][ T1589] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input23 [ 472.076578][T10706] netlink: 'syz.0.1069': attribute type 1 has an invalid length. [ 472.199583][ T9] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 472.208532][T10710] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 472.223139][ T5922] usb 4-1: USB disconnect, device number 24 [ 472.267825][T10710] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 472.295366][T10706] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1069'. [ 472.328862][T10706] 8021q: adding VLAN 0 to HW filter on device bond5 [ 472.379854][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 472.387918][ T9] usb 5-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=3a.b2 [ 472.398321][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.407799][ T9] usb 5-1: Product: syz [ 472.412622][ T9] usb 5-1: Manufacturer: syz [ 472.417304][ T9] usb 5-1: SerialNumber: syz [ 472.429982][ T9] usb 5-1: config 0 descriptor?? [ 472.491376][T10717] netlink: 'syz.1.1072': attribute type 10 has an invalid length. [ 472.646309][ T9] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 473.060797][ T9] gspca_sunplus: reg_w_riv err -71 [ 473.080061][ T9] sunplus 5-1:0.0: probe with driver sunplus failed with error -71 [ 473.106455][ T9] usb 5-1: USB disconnect, device number 31 [ 473.194953][T10729] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 473.520939][T10741] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 473.701818][T10741] overlayfs: missing 'lowerdir' [ 473.805528][T10753] netlink: 'syz.0.1087': attribute type 1 has an invalid length. [ 473.833597][T10749] xt_hashlimit: size too large, truncated to 1048576 [ 473.880878][T10756] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 473.915001][T10756] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 474.046849][T10753] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1087'. [ 474.135733][T10753] 8021q: adding VLAN 0 to HW filter on device bond6 [ 474.166194][T10753] macvlan2: entered promiscuous mode [ 474.175788][T10753] macvlan2: entered allmulticast mode [ 474.183071][T10753] bond6: entered promiscuous mode [ 474.196770][T10753] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 474.252517][T10753] bond6: left promiscuous mode [ 474.382610][T10763] tipc: Cannot configure node identity twice [ 474.622258][T10774] netlink: 'syz.4.1092': attribute type 10 has an invalid length. [ 475.083023][T10782] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1098'. [ 475.161903][T10784] vcan0: tx address claim with dest, not broadcast [ 475.447378][T10794] netlink: 'syz.2.1101': attribute type 10 has an invalid length. [ 475.581306][T10796] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1104'. [ 475.981917][T10800] netlink: 'syz.1.1105': attribute type 1 has an invalid length. [ 476.125522][T10800] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 476.140132][T10804] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1105'. [ 476.150119][T10800] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 476.268403][T10804] 8021q: adding VLAN 0 to HW filter on device bond3 [ 476.316248][T10804] macvlan2: entered promiscuous mode [ 476.322862][T10804] macvlan2: entered allmulticast mode [ 476.328907][T10804] bond3: entered promiscuous mode [ 476.335533][T10804] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 476.360504][T10810] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1108'. [ 476.375369][T10804] bond3: left promiscuous mode [ 476.429892][T10812] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1109'. [ 476.457515][ T5910] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 476.478658][ T5910] hid-generic 0000:0000:0000.000A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 476.672817][T10819] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1112'. [ 476.801503][T10823] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 477.549977][ T9] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 477.623237][T10837] netlink: 'syz.4.1117': attribute type 10 has an invalid length. [ 477.702136][ T9] usb 2-1: config 0 has an invalid interface number: 117 but max is 0 [ 477.712220][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 477.874968][ T9] usb 2-1: config 0 has no interface number 0 [ 477.886753][ T9] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 477.914152][ T9] usb 2-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 477.928521][T10845] netlink: 'syz.2.1119': attribute type 10 has an invalid length. [ 478.017971][ T9] usb 2-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 478.027689][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.094414][ T9] usb 2-1: Product: syz [ 478.107780][ T9] usb 2-1: Manufacturer: syz [ 478.166224][ T9] usb 2-1: SerialNumber: syz [ 478.215178][ T9] usb 2-1: config 0 descriptor?? [ 478.348932][T10851] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1122'. [ 478.778284][T10859] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1126'. [ 478.910975][ T9] usb 2-1: USB disconnect, device number 23 [ 479.340868][ T24] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 479.372124][ T24] hid-generic 0000:0000:0000.000B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 480.501489][T10885] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1135'. [ 481.234711][T10902] netlink: 'syz.4.1140': attribute type 10 has an invalid length. [ 481.599726][T10906] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1143'. [ 481.783047][T10915] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1147'. [ 481.850510][T10915] hsr0: entered promiscuous mode [ 481.884978][T10915] macsec2: entered promiscuous mode [ 481.891850][T10915] macsec2: entered allmulticast mode [ 481.897645][T10915] hsr0: entered allmulticast mode [ 481.905803][T10915] hsr_slave_0: entered allmulticast mode [ 481.914755][T10915] hsr_slave_1: entered allmulticast mode [ 481.989400][T10915] hsr0: left allmulticast mode [ 481.999661][T10919] netlink: 'syz.0.1149': attribute type 1 has an invalid length. [ 482.008831][T10915] hsr_slave_0: left allmulticast mode [ 482.018171][T10915] hsr_slave_1: left allmulticast mode [ 482.106128][T10922] bond7: (slave vxcan3): The slave device specified does not support setting the MAC address [ 482.154168][T10922] bond7: (slave vxcan3): Error -95 calling set_mac_address [ 482.182413][T10919] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1149'. [ 482.192850][T10919] 8021q: adding VLAN 0 to HW filter on device bond7 [ 482.228237][T10927] loop5: detected capacity change from 0 to 7 [ 482.281956][T10927] Dev loop5: unable to read RDB block 7 [ 482.288561][T10927] loop5: unable to read partition table [ 482.299788][T10927] loop5: partition table beyond EOD, truncated [ 482.306009][T10927] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 482.540682][T10940] kAFS: unable to lookup cell 'ÿ' [ 483.908504][T10955] netlink: 'syz.2.1161': attribute type 2 has an invalid length. [ 483.979839][T10957] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1161'. [ 484.022952][T10955] : entered promiscuous mode [ 485.272896][ T9] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 485.323333][T11001] netlink: 'syz.4.1182': attribute type 1 has an invalid length. [ 485.417160][T11005] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 485.459750][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 485.474500][T11005] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 485.487869][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 485.504375][T11001] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1182'. [ 485.531840][T11001] 8021q: adding VLAN 0 to HW filter on device bond3 [ 485.532095][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 485.563922][T11011] vcan0: tx drop: invalid da for name 0xffffffffffffffff [ 485.585387][ T9] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 485.598852][T11001] macvlan2: entered promiscuous mode [ 485.609844][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.618355][T11001] macvlan2: entered allmulticast mode [ 485.632956][ T9] usb 2-1: config 0 descriptor?? [ 485.635152][T11013] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1187'. [ 485.651458][T11001] bond3: entered promiscuous mode [ 485.657137][T11001] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 485.682868][T11001] bond3: left promiscuous mode [ 486.070878][ T9] plantronics 0003:047F:FFFF.000C: reserved main item tag 0xd [ 486.247913][ T9] plantronics 0003:047F:FFFF.000C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 486.458820][ T24] usb 2-1: USB disconnect, device number 24 [ 486.494231][T11030] loop5: detected capacity change from 0 to 7 [ 486.515813][T11027] fido_id[11027]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 486.542825][T11030] Dev loop5: unable to read RDB block 7 [ 486.548442][T11030] loop5: unable to read partition table [ 486.563166][T11030] loop5: partition table beyond EOD, truncated [ 486.603701][T11030] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 487.116760][T11048] netlink: 'syz.1.1199': attribute type 1 has an invalid length. [ 487.255369][T11051] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 487.347680][T11048] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1199'. [ 487.357915][T11051] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 487.373395][T11048] 8021q: adding VLAN 0 to HW filter on device bond4 [ 487.889231][ T5910] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 488.075497][ T5910] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 488.086223][ T5910] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.101195][ T5910] usb 4-1: Product: syz [ 488.105395][ T5910] usb 4-1: Manufacturer: syz [ 488.129411][ T5910] usb 4-1: SerialNumber: syz [ 488.145771][ T5910] usb 4-1: config 0 descriptor?? [ 488.218161][T11067] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1206'. [ 488.272991][T11069] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1204'. [ 488.611894][ T5910] usb 4-1: Firmware: major: 0, minor: 187, hardware type: ATUSB (0) [ 488.621095][ T9] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 488.882242][ T5910] usb 4-1: failed to fetch extended address, random address set [ 488.935564][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 488.971134][T11084] bridge: RTM_NEWNEIGH with invalid ether address [ 488.996924][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 488.997760][ T5910] usb 4-1: USB disconnect, device number 25 [ 489.030448][ T9] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 489.050642][T11085] bridge: RTM_NEWNEIGH with invalid ether address [ 489.060156][ T9] usb 5-1: New USB device found, idVendor=093b, idProduct=a104, bcdDevice= 0.01 [ 489.070905][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.081694][ T9] usb 5-1: Product: syz [ 489.098592][ T9] usb 5-1: Manufacturer: syz [ 489.114470][ T9] usb 5-1: SerialNumber: syz [ 489.134478][ T9] usb 5-1: config 0 descriptor?? [ 489.165040][ T9] go7007 5-1:0.0: probe with driver go7007 failed with error -12 [ 490.139443][ T5912] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 490.299496][ T5912] usb 4-1: Using ep0 maxpacket: 8 [ 490.307445][ T5912] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 490.331359][ T5912] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 490.358622][ T5912] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.412781][ T5912] usb 4-1: config 0 descriptor?? [ 490.496505][T11110] loop8: detected capacity change from 0 to 8 [ 490.522814][T11110] Dev loop8: unable to read RDB block 8 [ 490.542746][T11110] loop8: unable to read partition table [ 490.576592][T11110] loop8: partition table beyond EOD, truncated [ 490.633129][ T5912] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 490.656229][T11110] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 491.038573][T11116] team0 (unregistering): Port device team_slave_0 removed [ 491.053211][T11116] team0 (unregistering): Port device team_slave_1 removed [ 491.076132][T11116] team0 (unregistering): Port device batadv0 removed [ 491.087352][T11119] IPv6: NLM_F_CREATE should be specified when creating new route [ 491.098495][T11116] team0 (unregistering): Port device dummy0 removed [ 491.207699][T11121] netlink: 'syz.1.1225': attribute type 1 has an invalid length. [ 491.271419][ T5912] usb 4-1: USB disconnect, device number 26 [ 491.316513][T11124] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 491.358402][T11121] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1225'. [ 491.368160][T11124] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 491.387386][T11121] 8021q: adding VLAN 0 to HW filter on device bond5 [ 491.426009][T11121] macvlan1: entered promiscuous mode [ 491.441000][T11121] macvlan1: entered allmulticast mode [ 491.457281][T11121] bond5: entered promiscuous mode [ 491.469681][T11121] 8021q: adding VLAN 0 to HW filter on device macvlan1 [ 491.518335][T11121] bond5: left promiscuous mode [ 492.161730][ T5910] usb 5-1: USB disconnect, device number 32 [ 492.336028][T11146] netlink: 'syz.4.1232': attribute type 12 has an invalid length. [ 492.366236][T11146] netlink: 'syz.4.1232': attribute type 29 has an invalid length. [ 492.408498][T11146] netlink: 148 bytes leftover after parsing attributes in process `syz.4.1232'. [ 492.428326][T11146] netlink: 'syz.4.1232': attribute type 2 has an invalid length. [ 492.436741][T11146] netlink: 11 bytes leftover after parsing attributes in process `syz.4.1232'. [ 492.609667][ T5912] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 492.869730][T11161] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1239'. [ 492.902773][ T5912] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 492.946022][ T5912] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.003735][ T5912] usb 3-1: Product: syz [ 493.014068][ T5912] usb 3-1: Manufacturer: syz [ 493.024832][ T5912] usb 3-1: SerialNumber: syz [ 493.114431][ T5912] usb 3-1: config 0 descriptor?? [ 493.148381][ T5912] ch341 3-1:0.0: ch341-uart converter detected [ 493.219701][ T5922] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 493.389774][ T5922] usb 2-1: Using ep0 maxpacket: 32 [ 493.401748][ T5922] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 493.422317][ T5922] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 493.454820][ T5922] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 493.464394][ T5922] usb 2-1: Product: syz [ 493.468637][ T5922] usb 2-1: Manufacturer: syz [ 493.473416][ T5922] usb 2-1: SerialNumber: syz [ 493.486860][ T5922] usb 2-1: config 0 descriptor?? [ 493.498868][T11164] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 493.517231][ T5922] hub 2-1:0.0: bad descriptor, ignoring hub [ 493.525669][ T5922] hub 2-1:0.0: probe with driver hub failed with error -5 [ 493.537516][T11175] loop7: detected capacity change from 0 to 7 [ 493.547551][T11175] Dev loop7: unable to read RDB block 7 [ 493.554475][T11175] loop7: unable to read partition table [ 493.560862][T11175] loop7: partition table beyond EOD, truncated [ 493.609831][T11175] loop_reread_partitions: partition scan of loop7 (þ被xü—ŸÑà– ) failed (rc=-5) [ 493.829501][ T5910] usb 2-1: USB disconnect, device number 25 [ 493.935022][T11183] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1246'. [ 494.192541][ T5912] usb 3-1: failed to send control message: -71 [ 494.201999][ T5912] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 494.220107][ T5922] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 494.229011][ T5912] usb 3-1: USB disconnect, device number 23 [ 494.246044][ T5912] ch341 3-1:0.0: device disconnected [ 494.406237][ T5922] usb 2-1: Using ep0 maxpacket: 32 [ 494.486673][ T5922] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 494.519978][ T5922] usb 2-1: string descriptor 0 read error: -22 [ 494.527057][ T5922] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 494.543542][ T5922] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 494.572986][ T5922] usb 2-1: config 0 descriptor?? [ 494.585734][T11164] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 494.693760][ T5922] hub 2-1:0.0: bad descriptor, ignoring hub [ 494.706461][ T5922] hub 2-1:0.0: probe with driver hub failed with error -5 [ 494.919875][T11199] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 495.013253][T11209] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 495.029761][ T5910] usb 2-1: USB disconnect, device number 26 [ 496.249211][ T5922] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 496.309885][ T10] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 496.364637][T11232] netlink: 'syz.4.1265': attribute type 1 has an invalid length. [ 496.395356][T11232] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 496.407309][T11232] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 496.415184][ T5922] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 496.423605][ T5922] usb 4-1: config 0 has no interface number 0 [ 496.438654][ T5922] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 496.449498][ T5910] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 496.450054][ T5922] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.465814][ T5922] usb 4-1: Product: syz [ 496.474613][ T5922] usb 4-1: Manufacturer: syz [ 496.480862][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 496.486126][ T5922] usb 4-1: SerialNumber: syz [ 496.491540][T11232] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1265'. [ 496.502283][T11232] 8021q: adding VLAN 0 to HW filter on device bond4 [ 496.510339][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 496.527795][T11232] macvlan2: entered promiscuous mode [ 496.534359][ T10] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 496.539826][T11232] macvlan2: entered allmulticast mode [ 496.545137][ T5922] usb 4-1: config 0 descriptor?? [ 496.550294][T11232] bond4: entered promiscuous mode [ 496.559746][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.568739][T11232] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 496.582654][ T10] usb 2-1: config 0 descriptor?? [ 496.589053][T11232] bond4: left promiscuous mode [ 496.608702][ T5910] usb 3-1: config 0 interface 0 has no altsetting 0 [ 496.618985][ T5910] usb 3-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 496.628711][ T5910] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.641331][ T5910] usb 3-1: config 0 descriptor?? [ 496.774503][ T5922] usb 4-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 496.791737][ T5922] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 496.803148][ T5922] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 496.811784][ T5922] usb 4-1: media controller created [ 496.831799][ T5922] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 497.011853][T11237] loop8: detected capacity change from 0 to 8 [ 497.013633][ T10] cm6533_jd 0003:0D8C:0022.000D: unknown main item tag 0x0 [ 497.026161][T11237] Dev loop8: unable to read RDB block 8 [ 497.029851][ T10] cm6533_jd 0003:0D8C:0022.000D: unknown main item tag 0x0 [ 497.035936][T11237] loop8: unable to read partition table [ 497.040412][ T10] cm6533_jd 0003:0D8C:0022.000D: unknown main item tag 0x0 [ 497.045561][T11237] loop8: partition table beyond EOD, truncated [ 497.052994][ T10] cm6533_jd 0003:0D8C:0022.000D: unknown main item tag 0x0 [ 497.060074][T11237] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 497.087009][ T10] cm6533_jd 0003:0D8C:0022.000D: unknown main item tag 0x0 [ 497.121723][ T10] cm6533_jd 0003:0D8C:0022.000D: hiddev0,hidraw0: USB HID v0.05 Device [HID 0d8c:0022] on usb-dummy_hcd.1-1/input0 [ 497.371751][ T10] usb 2-1: USB disconnect, device number 27 [ 497.663494][ T5910] radio-keene 3-1:0.0: V4L2 device registered as radio48 [ 497.755143][T11243] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 497.884567][ T5910] usb 3-1: USB disconnect, device number 24 [ 497.954511][ T5922] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 498.161001][ T5922] usb 4-1: USB disconnect, device number 27 [ 498.199818][T11259] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1274'. [ 498.326532][T11261] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1273'. [ 498.549850][ T5922] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 498.779545][ T5922] usb 2-1: Using ep0 maxpacket: 16 [ 498.810738][T11266] netlink: 'syz.3.1277': attribute type 1 has an invalid length. [ 498.839567][ T5922] usb 2-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 498.849601][ T5922] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 498.864166][ T5922] usb 2-1: Product: syz [ 498.872020][ T5922] usb 2-1: Manufacturer: syz [ 498.876662][ T5922] usb 2-1: SerialNumber: syz [ 498.885291][ T5922] usb 2-1: config 0 descriptor?? [ 498.960393][T11274] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1277'. [ 498.992439][ T5910] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 499.052373][ T5910] hid-generic 0000:0000:0000.000E: hidraw0: HID v0.00 Device [syz1] on syz0 [ 499.084364][T11269] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 499.161669][ T5922] usb 2-1: USB disconnect, device number 28 [ 499.220513][T11269] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 499.641583][T11274] 8021q: adding VLAN 0 to HW filter on device bond2 [ 499.705875][T11280] macvlan3: entered promiscuous mode [ 499.739684][T11280] macvlan3: entered allmulticast mode [ 499.765994][T11280] bond2: entered promiscuous mode [ 499.798510][T11280] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 499.836172][T11280] bond2: left promiscuous mode [ 500.068467][T11296] netlink: 'syz.0.1283': attribute type 10 has an invalid length. [ 500.515247][T11300] netlink: 'syz.4.1285': attribute type 4 has an invalid length. [ 501.130525][T11309] loop4: detected capacity change from 0 to 1 [ 501.139621][ T5922] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 501.148356][T11309] Dev loop4: unable to read RDB block 1 [ 501.177239][T11309] loop4: unable to read partition table [ 501.267105][T11313] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1290'. [ 501.299684][ T5922] usb 5-1: Using ep0 maxpacket: 16 [ 501.325720][ T5922] usb 5-1: config 0 has no interfaces? [ 501.352551][ T5922] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 501.362234][ T5922] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 501.376774][T11309] loop4: partition table beyond EOD, truncated [ 501.377350][ T5922] usb 5-1: Manufacturer: syz [ 501.393247][ T5922] usb 5-1: config 0 descriptor?? [ 501.402153][T11309] loop_reread_partitions: partition scan of loop4 (þ被xü^>Ñà– ) failed (rc=-5) [ 501.487080][ T5191] Dev loop4: unable to read RDB block 1 [ 501.494161][ T5191] loop4: unable to read partition table [ 501.501892][ T5191] loop4: partition table beyond EOD, truncated [ 501.508622][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.521347][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.882757][T11316] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 502.224386][T11319] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1292'. [ 502.259401][T11319] erspan0: entered promiscuous mode [ 502.322948][T11319] macvtap1: entered promiscuous mode [ 502.348538][T11319] macvtap1: entered allmulticast mode [ 502.373267][T11319] erspan0: entered allmulticast mode [ 502.438918][T11322] erspan0: left allmulticast mode [ 502.463163][T11322] erspan0: left promiscuous mode [ 502.849793][T11332] netlink: 'syz.0.1297': attribute type 1 has an invalid length. [ 502.968339][T11337] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1297'. [ 503.051037][T11335] bond8: (slave vxcan3): The slave device specified does not support setting the MAC address [ 503.116110][T11335] bond8: (slave vxcan3): Error -95 calling set_mac_address [ 503.172081][T11337] 8021q: adding VLAN 0 to HW filter on device bond8 [ 503.520883][ T5922] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 503.540704][ T5922] hid-generic 0000:0000:0000.000F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 503.578117][T11351] netlink: 'syz.3.1304': attribute type 1 has an invalid length. [ 503.634984][T11351] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 503.650271][T11351] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 503.705369][T11354] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1304'. [ 503.727687][T11354] 8021q: adding VLAN 0 to HW filter on device bond3 [ 503.735027][ T5922] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 503.780892][T11354] macvlan3: entered promiscuous mode [ 503.786201][T11354] macvlan3: entered allmulticast mode [ 503.792802][T11354] bond3: entered promiscuous mode [ 503.798431][T11354] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 503.846254][T11354] bond3: left promiscuous mode [ 503.891430][ T5922] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 503.905155][ T5922] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 503.922218][T11356] syzkaller1: entered promiscuous mode [ 503.928269][T11356] syzkaller1: entered allmulticast mode [ 503.935226][ T5922] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 503.945270][ T5922] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 503.977503][ T5922] usb 2-1: SerialNumber: syz [ 504.072089][ T24] usb 5-1: USB disconnect, device number 33 [ 504.233916][ T5922] usb 2-1: 0:2 : does not exist [ 504.318407][T11366] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1306'. [ 504.331884][ T5922] usb 2-1: USB disconnect, device number 29 [ 504.791074][ T5840] udevd[5840]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 504.909341][T11379] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 505.184085][T11379] overlayfs: missing 'lowerdir' [ 505.556042][ T9] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 505.823864][ T9] usb 3-1: New USB device found, idVendor=055f, idProduct=c420, bcdDevice=6a.33 [ 505.851263][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 505.906368][ T9] usb 3-1: config 0 descriptor?? [ 505.969886][T11385] netlink: 'syz.1.1311': attribute type 4 has an invalid length. [ 506.002515][ T9] gspca_main: sunplus-2.14.0 probing 055f:c420 [ 506.049198][T11386] netlink: 'syz.1.1311': attribute type 4 has an invalid length. [ 506.418491][T11394] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1312'. [ 506.599710][ T9] gspca_sunplus: reg_w_riv err -110 [ 506.611138][ T9] sunplus 3-1:0.0: probe with driver sunplus failed with error -110 [ 506.699620][ T5912] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 506.871244][ T5912] usb 5-1: Using ep0 maxpacket: 32 [ 506.936347][ T5912] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 507.033813][ T5912] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 507.261529][ T5912] usb 5-1: New USB device found, idVendor=093b, idProduct=a104, bcdDevice= 0.01 [ 507.304193][ T5912] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.317440][ T5912] usb 5-1: Product: syz [ 507.329001][ T5912] usb 5-1: Manufacturer: syz [ 507.337048][ T5912] usb 5-1: SerialNumber: syz [ 507.392410][ T5912] usb 5-1: config 0 descriptor?? [ 507.413400][T11402] sctp: [Deprecated]: syz.0.1317 (pid 11402) Use of int in max_burst socket option deprecated. [ 507.413400][T11402] Use struct sctp_assoc_value instead [ 507.438648][ T5912] go7007 5-1:0.0: probe with driver go7007 failed with error -12 [ 507.619649][ T5912] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 507.804662][ T5912] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 507.816134][ T5912] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 507.833327][ T5912] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 507.870301][T11411] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 508.044917][ T5922] usb 3-1: USB disconnect, device number 25 [ 508.086512][T11413] netlink: 'syz.2.1321': attribute type 1 has an invalid length. [ 508.158890][ T5912] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 508.246509][ T5912] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.287080][T11415] bond2: (slave vxcan1): The slave device specified does not support setting the MAC address [ 508.341350][T11413] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1321'. [ 508.367938][ T5912] usb 4-1: config 0 descriptor?? [ 508.401462][T11415] bond2: (slave vxcan1): Error -95 calling set_mac_address [ 508.476597][T11413] 8021q: adding VLAN 0 to HW filter on device bond2 [ 508.499349][T11413] macvlan2: entered promiscuous mode [ 508.534097][T11413] macvlan2: entered allmulticast mode [ 508.550661][T11413] bond2: entered promiscuous mode [ 508.558688][T11410] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 508.611954][T11413] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 508.710610][T11413] bond2: left promiscuous mode [ 508.821634][ T5912] plantronics 0003:047F:FFFF.0010: unknown main item tag 0x0 [ 508.839837][ T5912] plantronics 0003:047F:FFFF.0010: unknown main item tag 0x0 [ 508.847352][ T5912] plantronics 0003:047F:FFFF.0010: unknown main item tag 0x0 [ 508.857470][ T5912] plantronics 0003:047F:FFFF.0010: unknown main item tag 0x0 [ 508.865804][ T5912] plantronics 0003:047F:FFFF.0010: unknown main item tag 0x0 [ 508.880026][ T5912] plantronics 0003:047F:FFFF.0010: unknown main item tag 0x0 [ 508.888870][ T5912] plantronics 0003:047F:FFFF.0010: unknown main item tag 0x0 [ 508.896963][ T5912] plantronics 0003:047F:FFFF.0010: unknown main item tag 0x0 [ 508.933465][ T5912] plantronics 0003:047F:FFFF.0010: unknown main item tag 0x0 [ 508.969249][ T5912] plantronics 0003:047F:FFFF.0010: unknown main item tag 0x0 [ 509.015828][ T5912] plantronics 0003:047F:FFFF.0010: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 509.116426][ T5912] usb 4-1: USB disconnect, device number 28 [ 509.213837][T11422] fido_id[11422]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 509.685252][T11431] af_packet: tpacket_rcv: packet too big, clamped from 1 to 4294967272. macoff=96 [ 509.752362][ T5922] usb 5-1: USB disconnect, device number 34 [ 510.332593][T11454] netlink: 'syz.0.1333': attribute type 1 has an invalid length. [ 510.529593][T11454] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1333'. [ 510.555865][T11456] bond9: (slave vxcan3): The slave device specified does not support setting the MAC address [ 510.567965][T11456] bond9: (slave vxcan3): Error -95 calling set_mac_address [ 510.774840][T11463] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1335'. [ 510.807189][T11454] 8021q: adding VLAN 0 to HW filter on device bond9 [ 510.993058][T11471] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1339'. [ 511.239299][T11471] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1339'. [ 511.280481][T11480] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1337'. [ 511.609184][ T24] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 511.881300][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 511.901605][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 511.934813][ T24] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 511.975919][ T24] usb 2-1: New USB device found, idVendor=093b, idProduct=a104, bcdDevice= 0.01 [ 512.008648][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.037380][ T24] usb 2-1: Product: syz [ 512.051671][ T24] usb 2-1: Manufacturer: syz [ 512.076487][ T24] usb 2-1: SerialNumber: syz [ 512.104944][ T24] usb 2-1: config 0 descriptor?? [ 512.139599][ T24] go7007 2-1:0.0: probe with driver go7007 failed with error -12 [ 512.388895][T11510] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1349'. [ 513.013936][T11514] syz_tun: entered allmulticast mode [ 513.326849][T11516] kvm: user requested TSC rate below hardware speed [ 513.351015][T11516] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 513.750098][T11525] netlink: 'syz.2.1355': attribute type 1 has an invalid length. [ 513.902985][ T5922] usb 2-1: USB disconnect, device number 30 [ 513.948019][T11530] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1355'. [ 513.978538][T11532] netlink: 'syz.1.1357': attribute type 1 has an invalid length. [ 514.054951][T11527] bond3: (slave vxcan1): The slave device specified does not support setting the MAC address [ 514.096564][T11536] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1357'. [ 514.096956][T11527] bond3: (slave vxcan1): Error -95 calling set_mac_address [ 514.181302][T11530] 8021q: adding VLAN 0 to HW filter on device bond3 [ 514.364879][T11535] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 514.378398][T11535] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 514.467908][T11536] 8021q: adding VLAN 0 to HW filter on device bond6 [ 514.526519][T11532] macvlan1: entered promiscuous mode [ 514.532763][T11532] macvlan1: entered allmulticast mode [ 514.541343][T11532] bond6: entered promiscuous mode [ 514.554064][T11532] 8021q: adding VLAN 0 to HW filter on device macvlan1 [ 514.583586][T11532] bond6: left promiscuous mode [ 515.398679][T11567] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1365'. [ 515.483265][T11563] netlink: 548 bytes leftover after parsing attributes in process `syz.0.1364'. [ 515.499163][ T24] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 515.659691][ T5912] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 515.702187][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 515.795445][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 515.833953][ T24] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 515.859363][ T5912] usb 3-1: Using ep0 maxpacket: 32 [ 515.892951][ T5912] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 515.903847][ T24] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 515.919657][ T5912] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 3 [ 516.024229][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 516.037427][ T5912] usb 3-1: New USB device found, idVendor=093b, idProduct=a104, bcdDevice= 0.01 [ 516.059589][ T5912] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.084528][ T24] usb 5-1: config 0 descriptor?? [ 516.087365][ T5912] usb 3-1: Product: syz [ 516.108993][ T5912] usb 3-1: Manufacturer: syz [ 516.146425][ T5912] usb 3-1: SerialNumber: syz [ 516.172238][ T5912] usb 3-1: config 0 descriptor?? [ 516.514603][ T24] hid_parser_main: 5 callbacks suppressed [ 516.514626][ T24] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 516.592200][ T24] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 516.620110][ T24] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 516.634879][ T24] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 516.649852][ T24] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 516.668111][ T24] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 516.676230][ T24] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 516.704680][ T24] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 516.726339][ T24] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 516.753958][ T24] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 516.844889][ T24] plantronics 0003:047F:FFFF.0011: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 516.874187][ T24] usb 5-1: USB disconnect, device number 35 [ 517.080391][T11577] fido_id[11577]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 517.430953][T11586] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1371'. [ 517.716963][T11594] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1373'. [ 518.134500][T11602] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1377'. [ 518.174559][T11602] tipc: Enabled bearer , priority 10 [ 518.371846][T11608] set match dimension is over the limit! [ 518.389842][ T5912] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 518.458900][T11610] netlink: 'syz.4.1380': attribute type 1 has an invalid length. [ 518.550535][ T5912] usb 2-1: Using ep0 maxpacket: 16 [ 518.558909][ T5912] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 518.591468][T11611] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 518.602991][T11610] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1380'. [ 518.603779][T11611] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 518.621343][ T5912] usb 2-1: config 0 has no interfaces? [ 518.640033][T11610] 8021q: adding VLAN 0 to HW filter on device bond5 [ 518.648941][ T5912] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 518.658647][ T5912] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.667331][ T5912] usb 2-1: Product: syz [ 518.672351][ T5912] usb 2-1: Manufacturer: syz [ 518.693668][T11610] macvlan2: entered promiscuous mode [ 518.702403][T11610] macvlan2: entered allmulticast mode [ 518.708226][ T5912] usb 2-1: SerialNumber: syz [ 518.718027][T11610] bond5: entered promiscuous mode [ 518.726210][ T5912] usb 2-1: config 0 descriptor?? [ 518.738230][T11610] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 518.754703][T11610] bond5: left promiscuous mode [ 518.947173][ T9] usb 2-1: USB disconnect, device number 31 [ 519.193884][ T5909] usb 3-1: USB disconnect, device number 26 [ 519.282492][T11615] kvm: kvm [11614]: vcpu0, guest rIP: 0x9135 Unhandled WRMSR(0xc1) = 0xfffffc00 [ 519.292506][T11615] kvm: kvm [11614]: vcpu0, guest rIP: 0x9135 Unhandled WRMSR(0xc2) = 0xfffffc00 [ 519.303717][T11615] kvm: kvm [11614]: vcpu0, guest rIP: 0x9135 Unhandled WRMSR(0x11e) = 0xfffffc00 [ 519.315842][T11615] kvm: kvm [11614]: vcpu0, guest rIP: 0x9135 Unhandled WRMSR(0x186) = 0xfffffc00 [ 519.325438][T11615] kvm: kvm [11614]: vcpu0, guest rIP: 0x9135 Unhandled WRMSR(0x187) = 0xfffffc00 [ 519.843797][T11627] netlink: 'syz.2.1385': attribute type 1 has an invalid length. [ 519.974377][T11631] bond4: (slave vxcan1): The slave device specified does not support setting the MAC address [ 520.040737][T11631] bond4: (slave vxcan1): Error -95 calling set_mac_address [ 520.063076][T11627] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1385'. [ 520.118931][T11627] 8021q: adding VLAN 0 to HW filter on device bond4 [ 520.172118][T11627] macvlan2: entered promiscuous mode [ 520.213553][T11627] macvlan2: entered allmulticast mode [ 520.228057][T11627] bond4: entered promiscuous mode [ 520.235551][T11627] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 520.235987][T11642] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1390'. [ 520.254431][T11627] bond4: left promiscuous mode [ 520.362284][T11645] netlink: 548 bytes leftover after parsing attributes in process `syz.1.1389'. [ 521.086510][T11661] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 522.080270][ T5922] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 522.242067][ T5922] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 522.465136][ T5922] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 522.484482][ T5922] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 522.505705][ T5922] usb 3-1: Product: syz [ 522.517304][ T5922] usb 3-1: Manufacturer: syz [ 522.529611][ T5922] usb 3-1: SerialNumber: syz [ 522.674146][T11689] loop2: detected capacity change from 0 to 7 [ 522.697304][T11689] Dev loop2: unable to read RDB block 7 [ 522.719977][T11689] loop2: AHDI p2 p3 [ 522.724071][T11689] loop2: partition table partially beyond EOD, truncated [ 522.733791][T11689] loop2: p3 start 335544320 is beyond EOD, truncated [ 522.785146][ T5922] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 27 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 523.021733][ T5912] usb 3-1: USB disconnect, device number 27 [ 523.033711][ T5912] usblp0: removed [ 523.105993][T11695] binder: 11693:11695 ioctl 40044591 0 returned -22 [ 523.174898][T11694] binder: 11693:11694 ioctl c0306201 200000000040 returned -14 [ 523.753176][ T5909] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 523.808237][T11718] netlink: 'syz.2.1415': attribute type 1 has an invalid length. [ 523.866768][T11718] bond5: (slave vxcan1): The slave device specified does not support setting the MAC address [ 523.882799][T11718] bond5: (slave vxcan1): Error -95 calling set_mac_address [ 523.908482][T11722] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1415'. [ 523.922092][T11722] 8021q: adding VLAN 0 to HW filter on device bond5 [ 523.940999][ T5909] usb 2-1: config 0 has no interfaces? [ 523.949399][ T5909] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 523.952805][T11724] raw_sendmsg: syz.3.1416 forgot to set AF_INET. Fix it! [ 523.958705][ T5909] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.975918][ T5909] usb 2-1: Product: syz [ 523.980305][ T5909] usb 2-1: Manufacturer: syz [ 523.985081][ T5909] usb 2-1: SerialNumber: syz [ 523.992695][ T5909] usb 2-1: config 0 descriptor?? [ 524.011191][T11718] macvlan2: entered promiscuous mode [ 524.016542][T11718] macvlan2: entered allmulticast mode [ 524.043980][T11718] bond5: entered promiscuous mode [ 524.052541][T11718] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 524.064061][T11718] bond5: left promiscuous mode [ 524.210426][T11706] veth1_vlan: left promiscuous mode [ 524.305621][T11706] veth1_vlan: entered promiscuous mode [ 524.315845][ T5922] usb 2-1: USB disconnect, device number 32 [ 524.330036][T11731] bridge0: port 3(veth1_to_team) entered blocking state [ 524.338004][T11731] bridge0: port 3(veth1_to_team) entered disabled state [ 524.345569][T11731] veth1_to_team: entered allmulticast mode [ 524.353362][T11731] veth1_to_team: entered promiscuous mode [ 524.365340][T11731] bridge0: port 3(veth1_to_team) entered blocking state [ 524.372628][T11731] bridge0: port 3(veth1_to_team) entered forwarding state [ 524.443098][T11736] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1421'. [ 524.469993][T11736] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1421'. [ 524.486785][T11736] bridge0: entered promiscuous mode [ 524.495878][T11736] ip6gretap0: entered promiscuous mode [ 524.658480][T11747] kvm: pic: non byte read [ 524.663217][T11747] kvm: pic: non byte read [ 524.669588][T11747] kvm: pic: non byte read [ 524.677625][T11747] kvm: pic: non byte read [ 524.683662][T11747] kvm: pic: non byte read [ 524.690031][T11747] kvm: pic: non byte read [ 524.694704][T11747] kvm: pic: non byte read [ 524.702991][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 524.703005][ T29] audit: type=1326 audit(1771651801.189:204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11737 comm="syz.0.1422" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde7499c629 code=0x7fc00000 [ 524.732345][T11747] kvm: pic: non byte read [ 524.736916][T11747] kvm: pic: non byte read [ 524.742696][T11747] kvm: pic: non byte read [ 525.085916][ T5909] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 525.118999][ T5992] veth1_vlan: left promiscuous mode [ 525.250592][ T5909] usb 3-1: Using ep0 maxpacket: 8 [ 525.276886][ T5909] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 525.297298][ T5909] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 525.310178][ T5909] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 64319, setting to 1024 [ 525.324176][ T5909] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 525.337934][ T5909] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 525.352600][ T5909] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 525.362479][ T5909] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 525.584106][ T5909] usb 3-1: GET_CAPABILITIES returned 0 [ 525.590371][ T5909] usbtmc 3-1:16.0: can't read capabilities [ 525.666175][ T29] audit: type=1326 audit(1771651802.149:205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11737 comm="syz.0.1422" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fde74996417 code=0x7fc00000 [ 525.697030][T11767] netlink: 'syz.3.1431': attribute type 27 has an invalid length. [ 525.805247][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 525.825850][T11767] bridge0: port 3(veth1_to_team) entered disabled state [ 525.833254][T11767] bridge0: port 2(bridge_slave_1) entered disabled state [ 525.840838][T11767] bridge0: port 1(bridge_slave_0) entered disabled state [ 525.925902][ T47] usb 3-1: USB disconnect, device number 28 [ 526.107627][T11767] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 526.119237][T11782] netlink: 'syz.4.1436': attribute type 1 has an invalid length. [ 526.143919][T11767] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 526.176756][T11767] hsr0: left promiscuous mode [ 526.236259][T11784] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1436'. [ 526.301252][T11767] syzkaller0: left promiscuous mode [ 526.306500][T11767] syzkaller0: left allmulticast mode [ 526.335199][T11767] macvtap1: left promiscuous mode [ 526.342004][T11767] macvtap1: left allmulticast mode [ 526.515433][T11783] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 526.528788][T11783] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 526.551188][ T13] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.563127][ T13] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.617931][ T13] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.652909][T11782] macvlan2: entered promiscuous mode [ 526.658241][T11782] macvlan2: entered allmulticast mode [ 526.668416][T11782] bond6: entered promiscuous mode [ 526.724525][T11782] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 526.778166][T11782] bond6: left promiscuous mode [ 526.801434][ T13] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.941081][T11812] fuse: Bad value for 'fd' [ 527.968586][T11831] kvm: pic: non byte write [ 528.440317][T11847] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1457'. [ 528.465303][T11849] 8021q: adding VLAN 0 to HW filter on device bond4 [ 528.523024][ T5912] usb 3-1: new low-speed USB device number 29 using dummy_hcd [ 528.557003][T11849] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 528.581723][T11849] bond4: (slave macvlan3): making interface the new active one [ 528.601155][T11849] bond4: (slave macvlan3): Enslaving as an active interface with an up link [ 528.725874][ T5912] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 528.759995][ T5912] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid maxpacket 1023, setting to 8 [ 528.779574][T11792] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 528.799765][ T5912] usb 3-1: config 0 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 528.829714][ T5912] usb 3-1: config 0 interface 0 has no altsetting 0 [ 528.836373][ T5912] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 528.876917][ T5912] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 528.894577][ T5912] usb 3-1: config 0 descriptor?? [ 528.906451][T11843] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 528.952652][T11792] usb 2-1: Using ep0 maxpacket: 32 [ 528.985827][T11792] usb 2-1: config 0 has an invalid interface number: 85 but max is 0 [ 528.997536][T11792] usb 2-1: config 0 has no interface number 0 [ 529.015984][T11792] usb 2-1: config 0 interface 85 altsetting 7 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 529.039214][T11792] usb 2-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 529.060978][T11792] usb 2-1: config 0 interface 85 has no altsetting 0 [ 529.087069][T11792] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 529.102402][T11792] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.111528][T11792] usb 2-1: Product: syz [ 529.115741][T11792] usb 2-1: Manufacturer: syz [ 529.120560][T11792] usb 2-1: SerialNumber: syz [ 529.127550][T11792] usb 2-1: config 0 descriptor?? [ 529.279204][ T5910] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 529.333831][ T5912] uclogic 0003:28BD:0094.0012: interface is invalid, ignoring [ 529.353478][T11792] appletouch 2-1:0.85: Failed to read mode from device. [ 529.364744][T11792] appletouch 2-1:0.85: probe with driver appletouch failed with error -5 [ 529.377379][T11865] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1464'. [ 529.385408][T11792] usb 2-1: USB disconnect, device number 33 [ 529.392170][T11865] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 529.450928][ T5910] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 90, changing to 10 [ 529.462423][ T5910] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 529.475761][ T5910] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 529.484904][ T5910] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 529.496377][ T5910] usb 4-1: config 0 descriptor?? [ 529.548479][T11789] usb 3-1: USB disconnect, device number 29 [ 529.932306][ T5910] hid_parser_main: 5 callbacks suppressed [ 529.932329][ T5910] cp2112 0003:10C4:EA90.0013: unknown main item tag 0x0 [ 529.952854][ T5910] cp2112 0003:10C4:EA90.0013: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 530.130296][ T5910] cp2112 0003:10C4:EA90.0013: Part Number: 0x82 Device Version: 0xFE [ 530.332327][ T5910] cp2112 0003:10C4:EA90.0013: error requesting SMBus config [ 530.344558][ T5910] cp2112 0003:10C4:EA90.0013: probe with driver cp2112 failed with error -32 [ 530.384918][ T5910] usb 4-1: USB disconnect, device number 29 [ 531.329879][T11899] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1473'. [ 531.600103][ T5912] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 531.780592][ T5912] usb 2-1: Using ep0 maxpacket: 32 [ 531.807627][ T5912] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 531.849618][ T5912] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 531.886423][ T5912] usb 2-1: New USB device found, idVendor=093b, idProduct=a104, bcdDevice= 0.01 [ 531.897016][ T5912] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.922165][ T5912] usb 2-1: Product: syz [ 531.936391][ T5912] usb 2-1: Manufacturer: syz [ 531.947581][ T5912] usb 2-1: SerialNumber: syz [ 531.964888][ T5912] usb 2-1: config 0 descriptor?? [ 531.976171][ T5912] go7007 2-1:0.0: probe with driver go7007 failed with error -12 [ 534.400355][T11974] batadv_slave_1: entered promiscuous mode [ 534.525377][T11789] usb 2-1: USB disconnect, device number 34 [ 534.586590][T11979] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1491'. [ 534.596178][T11979] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1491'. [ 534.612808][T11979] team0: entered promiscuous mode [ 534.618020][T11979] team_slave_0: entered promiscuous mode [ 534.624043][T11979] team_slave_1: entered promiscuous mode [ 534.630353][T11979] dummy0: entered promiscuous mode [ 534.636798][T11979] bond0: entered promiscuous mode [ 534.642031][T11979] bond_slave_0: entered promiscuous mode [ 534.647846][T11979] bond_slave_1: entered promiscuous mode [ 534.654626][T11979] debugfs: 'hsr1' already exists in 'hsr' [ 534.660421][T11979] Cannot create hsr debugfs directory [ 534.665950][T11979] hsr1: Slave B (bond0) is not up; please bring it up to get a fully working HSR network [ 534.677514][T11979] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 535.135241][T11987] syzkaller0: entered promiscuous mode [ 535.142954][T11987] syzkaller0: entered allmulticast mode [ 535.156144][T11987] TC_ACT_REPEAT abuse ? [ 535.730666][T11972] batadv_slave_1: left promiscuous mode [ 535.969949][T11995] syzkaller0: entered promiscuous mode [ 536.028088][T11995] syzkaller0: entered allmulticast mode [ 536.436579][ T5910] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 536.646713][ T5910] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 536.658081][ T5910] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.678591][ T5910] usb 3-1: Product: syz [ 536.684882][ T5910] usb 3-1: Manufacturer: syz [ 536.689911][ T5910] usb 3-1: SerialNumber: syz [ 536.753902][ T5910] usb 3-1: config 0 descriptor?? [ 536.787613][ T5910] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 536.866857][T12012] netlink: 'syz.3.1502': attribute type 1 has an invalid length. [ 536.890813][T12010] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1500'. [ 536.925497][T12012] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1502'. [ 537.456076][T12020] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 538.024195][T12027] tipc: Started in network mode [ 538.035201][T12027] tipc: Node identity , cluster identity 4711 [ 538.042932][T12027] tipc: Failed to obtain node identity [ 538.051471][T12027] tipc: Enabling of bearer rejected, failed to enable media [ 538.066247][T12027] syzkaller0: entered promiscuous mode [ 538.078003][T12027] syzkaller0: entered allmulticast mode [ 538.654840][ T5910] gspca_sunplus: reg_r err -71 [ 538.674308][ T5910] sunplus 3-1:0.0: probe with driver sunplus failed with error -71 [ 538.695335][ T5910] usb 3-1: USB disconnect, device number 30 [ 539.486214][T12047] syzkaller0: entered promiscuous mode [ 539.492868][T12047] syzkaller0: entered allmulticast mode [ 539.906297][T12056] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 542.826128][T12081] tipc: Can't bind to reserved service type 0 [ 543.429250][T11785] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 543.600865][T11785] usb 4-1: Using ep0 maxpacket: 32 [ 543.648424][T11785] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 543.667206][T11785] usb 4-1: config 0 has no interface number 0 [ 543.694589][T11785] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 543.725393][T11785] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.768567][T11785] usb 4-1: Product: syz [ 543.778700][T11785] usb 4-1: Manufacturer: syz [ 543.804324][T11785] usb 4-1: SerialNumber: syz [ 543.830111][T11785] usb 4-1: config 0 descriptor?? [ 544.353602][T12101] syzkaller0: entered promiscuous mode [ 544.359508][T12101] syzkaller0: entered allmulticast mode [ 544.680029][T12103] netlink: 'syz.2.1527': attribute type 1 has an invalid length. [ 544.899581][T12107] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1527'. [ 544.954225][T12105] bond6: (slave vxcan1): The slave device specified does not support setting the MAC address [ 544.977243][T12105] bond6: (slave vxcan1): Error -95 calling set_mac_address [ 545.168514][T11785] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000030: -71 [ 545.179465][T11785] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 545.197848][T11785] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 545.230038][T11785] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 545.303155][T11785] usb 4-1: USB disconnect, device number 30 [ 545.319178][T12114] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 545.354965][T12113] macvlan2: entered promiscuous mode [ 545.371067][T12113] macvlan2: entered allmulticast mode [ 545.383389][T12113] bond6: entered promiscuous mode [ 545.404153][T12113] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 545.425806][T12113] bond6: left promiscuous mode [ 545.446137][T12115] syzkaller0: entered promiscuous mode [ 545.451865][T12115] syzkaller0: entered allmulticast mode [ 545.482007][T12114] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1529'. [ 545.543616][T12117] tipc: Enabled bearer , priority 0 [ 545.561973][T12117] syzkaller0: entered promiscuous mode [ 545.573060][T12117] syzkaller0: entered allmulticast mode [ 545.666471][T12117] tipc: Resetting bearer [ 545.692226][T12116] tipc: Resetting bearer [ 545.766419][T12116] tipc: Disabling bearer [ 547.706427][T12146] tipc: Enabling of bearer rejected, failed to enable media [ 547.914916][T12148] netlink: 'syz.2.1540': attribute type 1 has an invalid length. [ 547.942088][T12148] 8021q: adding VLAN 0 to HW filter on device bond7 [ 547.973190][T12148] bond7: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 548.207494][T12148] 8021q: adding VLAN 0 to HW filter on device bond8 [ 548.236019][T12148] bond7: (slave bond8): Enslaving as an active interface with a down link [ 548.400591][T12160] netlink: 'syz.3.1544': attribute type 1 has an invalid length. [ 548.621487][T12160] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 548.809652][T12160] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 548.828309][T12165] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1544'. [ 548.852049][T12165] macvlan4: entered promiscuous mode [ 548.863393][T12165] macvlan4: entered allmulticast mode [ 548.924947][T12165] bond5: entered promiscuous mode [ 548.945811][T12165] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 548.981428][T12165] bond5: left promiscuous mode [ 549.538077][T12175] netlink: 'syz.2.1547': attribute type 1 has an invalid length. [ 549.546093][T12174] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 549.651764][T12179] binder: 12178:12179 ioctl 40189206 2000000005c0 returned -22 [ 549.679481][T12180] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1547'. [ 549.694210][T12179] binder: 12178:12179 ioctl c0306201 2000000003c0 returned -14 [ 549.723504][T12175] bond9: entered promiscuous mode [ 549.752760][T12175] 8021q: adding VLAN 0 to HW filter on device bond9 [ 549.797836][T12180] bond9: entered allmulticast mode [ 549.970281][T12175] bond9: (slave bridge4): making interface the new active one [ 549.993515][T12175] bridge4: entered promiscuous mode [ 550.005175][T12175] bridge4: entered allmulticast mode [ 550.017260][T12175] bond9: (slave bridge4): Enslaving as an active interface with an up link [ 550.571166][T12204] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 550.597526][T12204] batadv_slave_0: entered promiscuous mode [ 552.000249][T12219] syzkaller0: entered promiscuous mode [ 552.023268][T12219] syzkaller0: entered allmulticast mode [ 552.263892][T12227] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1560'. [ 552.394281][T12230] syzkaller0: entered promiscuous mode [ 552.409924][T12230] syzkaller0: entered allmulticast mode [ 552.568177][T12230] 0: reclassify loop, rule prio 0, protocol 800 [ 552.587134][T12236] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1564'. [ 552.629041][T12236] xt_hashlimit: size too large, truncated to 1048576 [ 552.679819][ T5910] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 552.849486][ T5910] usb 3-1: Using ep0 maxpacket: 16 [ 552.887711][ T5910] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 552.906775][ T5910] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.942337][ T5910] usb 3-1: Product: syz [ 552.951254][ T5910] usb 3-1: Manufacturer: syz [ 552.960165][ T5910] usb 3-1: SerialNumber: syz [ 553.277029][ T5910] usb 3-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 553.306492][ T5910] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 553.319508][ T5910] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 553.328173][ T5910] usb 3-1: media controller created [ 553.373856][ T5910] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 553.403272][T12248] syzkaller0: left promiscuous mode [ 553.421826][T12248] syzkaller0: left allmulticast mode [ 553.649655][ T5910] zl10353_read_register: readreg error (reg=127, ret==-110) [ 553.763559][ T5910] dvb_usb_gl861 3-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 553.783360][ T5910] usb 3-1: USB disconnect, device number 31 [ 554.193702][T12264] Cannot find set identified by id 0 to match [ 554.721709][ T9] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 554.977966][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 555.000502][ T9] usb 3-1: config index 0 descriptor too short (expected 156, got 27) [ 555.023910][ T9] usb 3-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 555.036364][ T9] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 555.049000][ T9] usb 3-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 555.062888][ T9] usb 3-1: config 0 interface 0 has no altsetting 0 [ 555.074774][ T9] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 555.085350][ T9] usb 3-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 555.153206][ T9] usb 3-1: Product: syz [ 555.158537][ T9] usb 3-1: Manufacturer: syz [ 555.163975][ T9] usb 3-1: SerialNumber: syz [ 555.185211][ T9] usb 3-1: config 0 descriptor?? [ 555.237933][ T9] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 555.289837][ T9] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 555.543360][T12280] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 555.574965][ T9] usb 3-1: USB disconnect, device number 32 [ 555.581866][ C0] ldusb 3-1:0.0: usb_submit_urb failed (-19) [ 555.594776][T12266] ldusb 3-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 555.644195][ T9] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 555.644716][T12268] ldusb: No device or device unplugged -19 [ 556.542103][T12294] syzkaller0: entered promiscuous mode [ 556.553288][T12294] syzkaller0: entered allmulticast mode [ 556.641295][ T9] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 556.803865][ T9] usb 5-1: config 246 has 1 interface, different from the descriptor's value: 7 [ 556.864483][ T9] usb 5-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 556.972213][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 557.057135][ T29] audit: type=1326 audit(1771651833.379:206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12300 comm="syz.2.1580" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb20b99c629 code=0x0 [ 557.259431][ T9] usb 5-1: Product: syz [ 557.283939][ T9] usb 5-1: Manufacturer: syz [ 557.288550][ T9] usb 5-1: SerialNumber: syz [ 557.694941][T12308] syzkaller0: entered promiscuous mode [ 557.700761][T12308] syzkaller0: entered allmulticast mode [ 558.026619][T12320] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1583'. [ 559.570277][ T9] usb-storage 5-1:246.0: USB Mass Storage device detected [ 559.743913][ T9] usb 5-1: USB disconnect, device number 36 [ 560.159542][ T9] usb 5-1: new full-speed USB device number 37 using dummy_hcd [ 560.352130][ T9] usb 5-1: config 0 has no interfaces? [ 560.382050][ T9] usb 5-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 560.398720][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.421126][ T9] usb 5-1: Product: syz [ 560.425378][ T9] usb 5-1: Manufacturer: syz [ 560.438545][ T9] usb 5-1: SerialNumber: syz [ 560.468606][ T9] usb 5-1: config 0 descriptor?? [ 561.656707][T12348] loop4: detected capacity change from 0 to 7 [ 561.697317][T12348] Dev loop4: unable to read RDB block 7 [ 561.703359][T12348] loop4: unable to read partition table [ 561.712780][T12348] loop4: partition table beyond EOD, truncated [ 561.732363][T12348] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 562.948003][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.958349][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.044338][T11785] usb 5-1: USB disconnect, device number 37 [ 563.779755][ T10] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 564.253378][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 564.290315][ T10] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 564.321697][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 564.347114][ T10] usb 5-1: config 0 descriptor?? [ 564.613652][ T10] pwc: Askey VC010 type 2 USB webcam detected. [ 564.848625][ T10] pwc: recv_control_msg error -32 req 02 val 2b00 [ 564.856936][ T10] pwc: recv_control_msg error -32 req 02 val 2700 [ 564.865935][ T10] pwc: recv_control_msg error -32 req 02 val 2c00 [ 564.874367][ T10] pwc: recv_control_msg error -32 req 04 val 1000 [ 564.882920][ T10] pwc: recv_control_msg error -32 req 04 val 1300 [ 564.891984][ T10] pwc: recv_control_msg error -32 req 04 val 1400 [ 564.900315][ T10] pwc: recv_control_msg error -32 req 02 val 2000 [ 564.913985][ T10] pwc: recv_control_msg error -32 req 02 val 2100 [ 564.929858][ T10] pwc: recv_control_msg error -32 req 04 val 1500 [ 564.941482][ T10] pwc: recv_control_msg error -32 req 02 val 2500 [ 564.960056][ T10] pwc: recv_control_msg error -32 req 02 val 2400 [ 564.967470][ T10] pwc: recv_control_msg error -32 req 02 val 2600 [ 565.020585][T12382] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1597'. [ 565.181075][ T10] pwc: recv_control_msg error -71 req 02 val 2800 [ 565.189928][ T10] pwc: recv_control_msg error -71 req 04 val 1100 [ 565.198731][ T10] pwc: recv_control_msg error -71 req 04 val 1200 [ 565.521313][ T10] pwc: Registered as video103. [ 565.533859][ T10] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input27 [ 565.555980][ T10] usb 5-1: USB disconnect, device number 38 [ 566.345600][T12392] syzkaller0: entered promiscuous mode [ 566.425833][ T29] audit: type=1326 audit(1771651842.899:207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12394 comm="syz.2.1601" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 566.436221][T12392] syzkaller0: entered allmulticast mode [ 566.794651][ T29] audit: type=1326 audit(1771651842.899:208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12394 comm="syz.2.1601" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 567.119163][ T29] audit: type=1326 audit(1771651842.899:209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12394 comm="syz.2.1601" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 567.299167][ T29] audit: type=1326 audit(1771651842.899:210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12394 comm="syz.2.1601" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 567.322713][T12401] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1601'. [ 567.372866][ T29] audit: type=1326 audit(1771651842.899:211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12394 comm="syz.2.1601" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 567.677736][ T29] audit: type=1326 audit(1771651842.909:212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12394 comm="syz.2.1601" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 567.784821][ T29] audit: type=1326 audit(1771651842.909:213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12394 comm="syz.2.1601" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 567.826382][ T29] audit: type=1326 audit(1771651842.909:214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12394 comm="syz.2.1601" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 567.892485][ T29] audit: type=1326 audit(1771651842.909:215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12394 comm="syz.2.1601" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fb20b95cece code=0x7ffc0000 [ 567.918467][ T29] audit: type=1326 audit(1771651843.359:216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12394 comm="syz.2.1601" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 568.010642][T12389] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 570.449814][ T10] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 570.605634][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 570.612584][ T10] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 570.635241][ T10] usb 3-1: config 0 has no interface number 0 [ 570.651076][ T10] usb 3-1: config 0 interface 12 has no altsetting 0 [ 570.674631][ T10] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 570.684143][ T5912] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 570.696172][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.728765][ T10] usb 3-1: Product: syz [ 570.886109][ T10] usb 3-1: Manufacturer: syz [ 570.906333][ T10] usb 3-1: SerialNumber: syz [ 570.939745][ T5912] usb 2-1: device descriptor read/64, error -71 [ 570.978341][ T10] usb 3-1: config 0 descriptor?? [ 571.206960][T12444] netlink: 'syz.4.1610': attribute type 13 has an invalid length. [ 571.219346][ T5912] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 571.250125][T12446] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1611'. [ 571.382197][ T5912] usb 2-1: device descriptor read/64, error -71 [ 571.489970][T12456] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 571.489970][T12456] program syz.3.1612 not setting count and/or reply_len properly [ 571.540169][ T5912] usb usb2-port1: attempt power cycle [ 571.552398][T12457] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 571.879792][ T5912] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 571.910977][ T5912] usb 2-1: device descriptor read/8, error -71 [ 572.158925][ T10] f81534 3-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 572.167665][ T10] f81534 3-1:0.12: f81534_find_config_idx: read failed: -71 [ 572.175426][ T10] f81534 3-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 572.183391][ T5912] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 572.193873][ T10] f81534 3-1:0.12: probe with driver f81534 failed with error -71 [ 572.253709][ T5912] usb 2-1: device descriptor read/8, error -71 [ 572.370584][ T5912] usb usb2-port1: unable to enumerate USB device [ 572.384875][ T10] usb 3-1: USB disconnect, device number 33 [ 573.214442][T12467] netlink: 'syz.0.1616': attribute type 1 has an invalid length. [ 573.491590][T12469] bond10: (slave vxcan3): The slave device specified does not support setting the MAC address [ 573.543212][T12469] bond10: (slave vxcan3): Error -95 calling set_mac_address [ 573.673843][T12470] macvlan2: entered promiscuous mode [ 573.697386][T12470] macvlan2: entered allmulticast mode [ 573.714977][T12470] bond10: entered promiscuous mode [ 573.747767][T12470] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 573.919301][T12470] bond10: left promiscuous mode [ 574.167447][T11789] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 574.169649][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 574.169666][ T29] audit: type=1326 audit(1771651850.579:226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.2.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 574.245517][ T29] audit: type=1326 audit(1771651850.579:227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.2.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 574.284981][T12487] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 574.352871][ T29] audit: type=1326 audit(1771651850.579:228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.2.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 574.361912][T11789] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 574.408273][T12488] overlayfs: missing 'lowerdir' [ 574.458956][ T29] audit: type=1326 audit(1771651850.579:229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.2.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 574.529763][T11789] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 574.552836][T11789] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 574.552876][ T29] audit: type=1326 audit(1771651850.579:230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.2.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 574.726751][ T29] audit: type=1326 audit(1771651850.579:231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.2.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 574.862597][ T29] audit: type=1326 audit(1771651850.589:232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.2.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 574.939165][T11789] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 574.952391][T11789] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.979217][ T29] audit: type=1326 audit(1771651850.589:233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.2.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 574.988243][T11789] usb 4-1: config 0 descriptor?? [ 575.080222][ T29] audit: type=1326 audit(1771651850.589:234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.2.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 575.141548][T12489] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 575.196926][ T29] audit: type=1326 audit(1771651850.589:235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.2.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb20b99c629 code=0x7ffc0000 [ 575.280242][T12473] netlink: 'syz.3.1617': attribute type 6 has an invalid length. [ 575.649885][T12498] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1622'. [ 575.670098][T11789] plantronics 0003:047F:FFFF.0014: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 576.238133][ T10] usb 4-1: USB disconnect, device number 31 [ 577.348455][T12520] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1627'. [ 578.544722][T12529] netlink: 'syz.3.1628': attribute type 10 has an invalid length. [ 578.608317][T12530] netlink: 'syz.3.1628': attribute type 10 has an invalid length. [ 578.640596][T12530] team0: Port device dummy0 removed [ 578.653368][T12530] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 578.679928][T12529] bond0: (slave dummy0): Releasing backup interface [ 579.085974][T12529] team0: Port device dummy0 added [ 579.124589][T12536] netlink: 'syz.2.1631': attribute type 1 has an invalid length. [ 579.161696][T12538] netlink: 'syz.1.1630': attribute type 2 has an invalid length. [ 579.228406][T12536] bond10: (slave vxcan1): The slave device specified does not support setting the MAC address [ 579.242139][T12536] bond10: (slave vxcan1): Error -95 calling set_mac_address [ 579.551069][T12542] macvlan2: entered promiscuous mode [ 579.562156][T12542] macvlan2: entered allmulticast mode [ 579.578239][T12542] bond10: entered promiscuous mode [ 579.610690][T12542] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 579.635684][T12542] bond10: left promiscuous mode [ 580.131073][T12550] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1633'. [ 580.368162][T12555] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1634'. [ 580.618315][T12557] syzkaller0: entered promiscuous mode [ 580.628896][T12557] syzkaller0: entered allmulticast mode [ 580.709752][ T5823] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 580.762947][T12559] netlink: 'syz.4.1636': attribute type 1 has an invalid length. [ 580.810846][T12559] bond7: (slave vxcan3): The slave device specified does not support setting the MAC address [ 580.838287][T12559] bond7: (slave vxcan3): Error -95 calling set_mac_address [ 580.848913][T12563] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1636'. [ 580.859610][ T5823] usb 3-1: Using ep0 maxpacket: 16 [ 580.867901][ T5823] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 580.878716][ T5823] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 580.893066][ T5823] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 581.144986][T12559] macvlan2: entered promiscuous mode [ 581.150817][T12559] macvlan2: entered allmulticast mode [ 581.162482][ T5823] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 581.164463][T12559] bond7: entered promiscuous mode [ 581.171074][ T5823] usb 3-1: Product: syz [ 581.180517][ T5823] usb 3-1: Manufacturer: syz [ 581.182292][T12559] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 581.185130][ T5823] usb 3-1: SerialNumber: syz [ 581.252953][T12559] bond7: left promiscuous mode [ 581.469841][T11789] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 581.510378][ T5823] usb 3-1: 0:2 : does not exist [ 581.523442][ T5823] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 581.587321][ T5823] usb 3-1: USB disconnect, device number 34 [ 581.729831][T11789] usb 2-1: Using ep0 maxpacket: 8 [ 581.741476][T12571] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1638'. [ 581.833155][T11789] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 581.967517][T11789] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 581.998889][T11789] usb 2-1: config 16 has 0 interfaces, different from the descriptor's value: 1 [ 582.025279][T11789] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 582.065664][T11789] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 582.319474][ T5823] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 582.488198][T12579] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 582.567163][ T5823] usb 5-1: Using ep0 maxpacket: 8 [ 582.587064][ T5823] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 582.596943][ T5823] usb 5-1: config 0 has no interface number 0 [ 582.607206][ T5823] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 582.625249][ T5823] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 582.682611][ T5823] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 582.701914][ T5823] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 582.728124][ T5823] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 582.829766][ T5823] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 582.841351][ T5823] usb 5-1: config 0 descriptor?? [ 582.860547][ T5823] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 583.209359][T12581] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 583.224412][T12581] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 583.282060][T12573] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 583.343994][ T5910] usb 5-1: USB disconnect, device number 39 [ 583.350002][ C1] ldusb 5-1:0.55: usb_submit_urb failed (-19) [ 583.363764][ T5910] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 583.669036][T12587] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1642'. [ 584.103121][ T5823] usb 2-1: USB disconnect, device number 39 [ 584.293174][T12591] netlink: 'syz.1.1644': attribute type 1 has an invalid length. [ 584.594011][T12591] bond7: (slave vxcan3): The slave device specified does not support setting the MAC address [ 584.643895][T12591] bond7: (slave vxcan3): Error -95 calling set_mac_address [ 584.730520][T12601] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 584.892467][T12597] macvlan0: entered promiscuous mode [ 584.898019][T12597] macvlan0: entered allmulticast mode [ 584.954701][T12597] bond7: entered promiscuous mode [ 584.960986][T12597] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 585.101615][T12597] bond7: left promiscuous mode [ 585.157004][T12608] syzkaller0: entered promiscuous mode [ 585.178772][T12608] syzkaller0: entered allmulticast mode [ 585.528455][T12616] netlink: 'syz.3.1649': attribute type 1 has an invalid length. [ 585.675318][T12614] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 585.687583][T12614] Cannot find set identified by id 0 to match [ 585.699241][T12620] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1649'. [ 585.700977][T12616] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 585.720190][T12616] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 585.834548][T12616] macvlan4: entered promiscuous mode [ 585.840629][T12616] macvlan4: entered allmulticast mode [ 586.069832][T12616] bond6: entered promiscuous mode [ 586.075426][T12616] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 586.190767][T12616] bond6: left promiscuous mode [ 586.519570][ T5912] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 586.736700][ T5912] usb 5-1: Using ep0 maxpacket: 16 [ 586.751970][ T5912] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 586.770364][ T5912] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 586.783346][ T5912] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 586.803687][T12633] netlink: 'syz.0.1654': attribute type 29 has an invalid length. [ 586.811980][T12633] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1654'. [ 586.821193][T12633] bond0: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 586.838517][ T5912] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 586.875645][ T5912] usb 5-1: Product: syz [ 586.884144][ T5912] usb 5-1: Manufacturer: syz [ 586.901786][ T5912] usb 5-1: SerialNumber: syz [ 586.927071][ T5912] usb 5-1: config 0 descriptor?? [ 587.232375][T12642] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1656'. [ 587.299186][ T5910] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 587.607947][ T5910] usb 4-1: config 0 has no interfaces? [ 587.749016][ T5910] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 587.758127][ T5910] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 587.766150][ T5910] usb 4-1: Manufacturer: syz [ 587.776770][ T5910] usb 4-1: config 0 descriptor?? [ 587.909219][T11789] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 588.690679][T11789] usb 2-1: New USB device found, idVendor=05ac, idProduct=0290, bcdDevice=dc.1b [ 588.737943][T12654] syzkaller0: entered promiscuous mode [ 588.744299][T12654] syzkaller0: entered allmulticast mode [ 588.757517][T11789] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 588.786013][T11789] usb 2-1: config 0 descriptor?? [ 588.858028][T11789] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input28 [ 589.249522][T12648] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 589.307351][T12648] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 589.385185][T12662] netlink: 'syz.2.1660': attribute type 1 has an invalid length. [ 589.493643][T11789] usb 5-1: USB disconnect, device number 40 [ 589.677948][T12662] macvlan2: entered promiscuous mode [ 589.706496][T12662] macvlan2: entered allmulticast mode [ 589.742141][T12662] bond11: entered promiscuous mode [ 589.773719][T12662] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 589.876038][T12662] bond11: left promiscuous mode [ 590.485584][ T5823] usb 4-1: USB disconnect, device number 32 [ 590.669852][T11792] usb 2-1: USB disconnect, device number 40 [ 590.984004][T12681] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1662'. [ 591.310068][T12687] netlink: 'syz.4.1665': attribute type 1 has an invalid length. [ 591.480384][T12694] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 591.568336][T12695] bond8: (slave vxcan3): The slave device specified does not support setting the MAC address [ 591.588843][T12687] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1665'. [ 591.608095][T12695] bond8: (slave vxcan3): Error -95 calling set_mac_address [ 591.694214][T12694] overlayfs: missing 'lowerdir' [ 591.702726][T12687] macvlan2: entered promiscuous mode [ 591.709048][T12687] macvlan2: entered allmulticast mode [ 591.720841][T12687] bond8: entered promiscuous mode [ 591.736224][T12687] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 591.775253][T12687] bond8: left promiscuous mode [ 592.072397][T12701] trusted_key: encrypted_key: insufficient parameters specified [ 592.412963][T12703] netlink: 'syz.4.1668': attribute type 1 has an invalid length. [ 592.495915][T12705] bond9: (slave vxcan3): The slave device specified does not support setting the MAC address [ 592.511360][T12705] bond9: (slave vxcan3): Error -95 calling set_mac_address [ 592.547033][T12703] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1668'. [ 592.570710][T12703] macvlan2: entered promiscuous mode [ 592.576526][T12703] macvlan2: entered allmulticast mode [ 592.583348][T12703] bond9: entered promiscuous mode [ 592.594214][T12703] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 592.611034][T12703] bond9: left promiscuous mode [ 593.509562][T12708] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 594.172957][T12725] netlink: 'syz.3.1673': attribute type 4 has an invalid length. [ 594.903703][ T5823] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 594.929387][ T9] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 595.239709][ T5823] usb 3-1: Using ep0 maxpacket: 32 [ 595.251189][ T5823] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 595.259817][ T5823] usb 3-1: config 0 has no interface number 0 [ 595.265928][ T5823] usb 3-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 595.316895][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 595.357071][ T5823] usb 3-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 595.378047][ T9] usb 4-1: config 0 has no interfaces? [ 595.399626][ T9] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 595.414742][ T5823] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 595.425177][ T9] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 595.451892][ T5823] usb 3-1: Product: syz [ 595.458451][ T9] usb 4-1: Manufacturer: syz [ 595.468904][ T5823] usb 3-1: Manufacturer: syz [ 595.512352][ T9] usb 4-1: config 0 descriptor?? [ 595.523002][ T5823] usb 3-1: SerialNumber: syz [ 595.611365][ T5823] usb 3-1: config 0 descriptor?? [ 595.685738][ T5823] em28xx 3-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 595.788429][ T5823] em28xx 3-1:0.132: Video interface 132 found: [ 596.188239][ T5823] em28xx 3-1:0.132: unknown em28xx chip ID (0) [ 597.472428][ T5823] em28xx 3-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 597.518331][ T5823] em28xx 3-1:0.132: board has no eeprom [ 597.590419][ T5823] em28xx 3-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 597.601804][ T5823] em28xx 3-1:0.132: analog set to bulk mode. [ 597.611703][ T9] em28xx 3-1:0.132: Registering V4L2 extension [ 597.757854][ T9] em28xx 3-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 597.783791][ T5910] usb 4-1: USB disconnect, device number 33 [ 597.823251][ T9] em28xx 3-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 597.862348][ T9] em28xx 3-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 597.908721][ T9] em28xx 3-1:0.132: failed to trigger read from i2c address 0x40 (error=-5) [ 598.172482][ T9] em28xx 3-1:0.132: failed to trigger read from i2c address 0x84 (error=-5) [ 598.186280][ T9] em28xx 3-1:0.132: failed to trigger read from i2c address 0x86 (error=-5) [ 598.228548][ T9] em28xx 3-1:0.132: failed to trigger read from i2c address 0x94 (error=-5) [ 598.270932][ T9] em28xx 3-1:0.132: failed to trigger read from i2c address 0x96 (error=-5) [ 598.389152][ T5910] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 598.487223][ T5823] usb 3-1: USB disconnect, device number 35 [ 598.525444][ T5823] em28xx 3-1:0.132: Disconnecting em28xx [ 598.552083][ T9] em28xx 3-1:0.132: Config register raw data: 0xffffffed [ 598.563985][ T9] em28xx 3-1:0.132: AC97 chip type couldn't be determined [ 598.593381][ T9] em28xx 3-1:0.132: No AC97 audio processor [ 598.602409][ T5910] usb 4-1: Using ep0 maxpacket: 16 [ 598.627627][ T5910] usb 4-1: config 0 has no interfaces? [ 598.690701][ T5910] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 598.741652][ T5910] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 598.785764][ T5910] usb 4-1: Manufacturer: syz [ 598.849632][ T5910] usb 4-1: config 0 descriptor?? [ 598.852163][ T9] usb 3-1: Decoder not found [ 598.862834][ T9] em28xx 3-1:0.132: failed to create media graph [ 598.955794][ T9] em28xx 3-1:0.132: V4L2 device video103 deregistered [ 599.061881][ T9] em28xx 3-1:0.132: Remote control support is not available for this card. [ 599.077027][T12761] ================================================================== [ 599.085124][T12761] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 599.092508][T12761] Read of size 8 at addr ffff88803d92c748 by task v4l_id/12761 [ 599.100035][T12761] [ 599.102363][T12761] CPU: 1 UID: 0 PID: 12761 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 599.102379][T12761] Tainted: [L]=SOFTLOCKUP [ 599.102383][T12761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 599.102395][T12761] Call Trace: [ 599.102401][T12761] [ 599.102406][T12761] dump_stack_lvl+0xe8/0x150 [ 599.102424][T12761] print_report+0xba/0x230 [ 599.102435][T12761] ? v4l2_fh_open+0xac/0x420 [ 599.102445][T12761] kasan_report+0x117/0x150 [ 599.102458][T12761] ? v4l2_fh_open+0xac/0x420 [ 599.102467][T12761] v4l2_fh_open+0xac/0x420 [ 599.102476][T12761] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 599.102492][T12761] em28xx_v4l2_open+0x157/0x9a0 [ 599.102504][T12761] ? do_raw_spin_lock+0x12b/0x2f0 [ 599.102515][T12761] v4l2_open+0x1bf/0x3a0 [ 599.102526][T12761] chrdev_open+0x4cd/0x5e0 [ 599.102537][T12761] ? __pfx_chrdev_open+0x10/0x10 [ 599.102547][T12761] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 599.102565][T12761] ? __pfx_chrdev_open+0x10/0x10 [ 599.102575][T12761] do_dentry_open+0x785/0x14e0 [ 599.102589][T12761] vfs_open+0x3b/0x340 [ 599.102600][T12761] ? path_openat+0x2df0/0x3860 [ 599.102610][T12761] path_openat+0x2e08/0x3860 [ 599.102621][T12761] ? __pfx_stack_trace_save+0x10/0x10 [ 599.102632][T12761] ? stack_depot_save_flags+0x33/0x810 [ 599.102644][T12761] ? __pfx_path_openat+0x10/0x10 [ 599.102653][T12761] ? __x64_sys_openat+0x138/0x170 [ 599.102664][T12761] ? do_syscall_64+0x14d/0xf80 [ 599.102677][T12761] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.102689][T12761] ? __lock_acquire+0x6b5/0x2cf0 [ 599.102701][T12761] do_file_open+0x23e/0x4a0 [ 599.102711][T12761] ? __pfx_do_file_open+0x10/0x10 [ 599.102724][T12761] ? _raw_spin_unlock+0x28/0x50 [ 599.102735][T12761] ? alloc_fd+0x64b/0x6c0 [ 599.102748][T12761] do_sys_openat2+0x113/0x200 [ 599.102760][T12761] ? __pfx_do_sys_openat2+0x10/0x10 [ 599.102772][T12761] ? exc_page_fault+0x6a/0xc0 [ 599.102785][T12761] ? do_user_addr_fault+0xc6f/0x1340 [ 599.102798][T12761] __x64_sys_openat+0x138/0x170 [ 599.102815][T12761] do_syscall_64+0x14d/0xf80 [ 599.102828][T12761] ? trace_irq_disable+0x3b/0x150 [ 599.102842][T12761] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.102851][T12761] ? clear_bhb_loop+0x40/0x90 [ 599.102861][T12761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.102873][T12761] RIP: 0033:0x7f41d34a7407 [ 599.102889][T12761] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 599.102897][T12761] RSP: 002b:00007ffd4d1c83d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 599.102909][T12761] RAX: ffffffffffffffda RBX: 00007f41d33b9880 RCX: 00007f41d34a7407 [ 599.102920][T12761] RDX: 0000000000000000 RSI: 00007ffd4d1c8f1b RDI: ffffffffffffff9c [ 599.102932][T12761] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 599.102941][T12761] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 599.102950][T12761] R13: 00007ffd4d1c8620 R14: 00007f41d3c3d000 R15: 000055e8d2c784d8 [ 599.102969][T12761] [ 599.102974][T12761] [ 599.402736][T12761] Allocated by task 9: [ 599.407038][T12761] kasan_save_track+0x3e/0x80 [ 599.411699][T12761] __kasan_kmalloc+0x93/0xb0 [ 599.416266][T12761] __kmalloc_cache_noprof+0x31c/0x660 [ 599.421615][T12761] em28xx_v4l2_init+0x10b/0x2e70 [ 599.426532][T12761] em28xx_init_extension+0x120/0x1c0 [ 599.431796][T12761] process_scheduled_works+0xb02/0x1830 [ 599.437327][T12761] worker_thread+0xa50/0xfc0 [ 599.441898][T12761] kthread+0x388/0x470 [ 599.445946][T12761] ret_from_fork+0x51e/0xb90 [ 599.450519][T12761] ret_from_fork_asm+0x1a/0x30 [ 599.455267][T12761] [ 599.457569][T12761] Freed by task 9: [ 599.461262][T12761] kasan_save_track+0x3e/0x80 [ 599.465917][T12761] kasan_save_free_info+0x46/0x50 [ 599.470937][T12761] __kasan_slab_free+0x5c/0x80 [ 599.475677][T12761] kfree+0x1c1/0x630 [ 599.479558][T12761] em28xx_v4l2_init+0x1683/0x2e70 [ 599.484577][T12761] em28xx_init_extension+0x120/0x1c0 [ 599.489844][T12761] process_scheduled_works+0xb02/0x1830 [ 599.495373][T12761] worker_thread+0xa50/0xfc0 [ 599.499955][T12761] kthread+0x388/0x470 [ 599.504018][T12761] ret_from_fork+0x51e/0xb90 [ 599.508584][T12761] ret_from_fork_asm+0x1a/0x30 [ 599.513326][T12761] [ 599.515630][T12761] The buggy address belongs to the object at ffff88803d92c000 [ 599.515630][T12761] which belongs to the cache kmalloc-8k of size 8192 [ 599.529660][T12761] The buggy address is located 1864 bytes inside of [ 599.529660][T12761] freed 8192-byte region [ffff88803d92c000, ffff88803d92e000) [ 599.543645][T12761] [ 599.545947][T12761] The buggy address belongs to the physical page: [ 599.552344][T12761] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3d928 [ 599.561086][T12761] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 599.569651][T12761] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 599.577182][T12761] page_type: f5(slab) [ 599.581322][T12761] raw: 00fff00000000040 ffff88813fea9280 dead000000000100 dead000000000122 [ 599.589884][T12761] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 599.598445][T12761] head: 00fff00000000040 ffff88813fea9280 dead000000000100 dead000000000122 [ 599.607443][T12761] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 599.616101][T12761] head: 00fff00000000003 ffffea0000f64a01 00000000ffffffff 00000000ffffffff [ 599.624760][T12761] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 599.633407][T12761] page dumped because: kasan: bad access detected [ 599.639806][T12761] page_owner tracks the page as allocated [ 599.645498][T12761] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 12399, tgid 12394 (syz.2.1601), ts 567270343718, free_ts 567251817196 [ 599.668397][T12761] post_alloc_hook+0x231/0x280 [ 599.673154][T12761] get_page_from_freelist+0x24dc/0x2580 [ 599.678684][T12761] __alloc_frozen_pages_noprof+0x18d/0x380 [ 599.684471][T12761] allocate_slab+0x77/0x660 [ 599.688960][T12761] refill_objects+0x331/0x3c0 [ 599.693619][T12761] __pcs_replace_empty_main+0x2b9/0x620 [ 599.699156][T12761] __kmalloc_cache_noprof+0x392/0x660 [ 599.704518][T12761] audit_log_d_path+0xb8/0x1a0 [ 599.709268][T12761] audit_log_d_path_exe+0x42/0x70 [ 599.714286][T12761] audit_log_task+0x2c3/0x3d0 [ 599.718943][T12761] audit_seccomp+0x85/0x190 [ 599.723423][T12761] __seccomp_filter+0xd48/0x1ef0 [ 599.728425][T12761] do_syscall_64+0xf4/0xf80 [ 599.732910][T12761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.738778][T12761] page last free pid 12398 tgid 12391 stack trace: [ 599.745253][T12761] __free_frozen_pages+0xc2b/0xdb0 [ 599.750346][T12761] __folio_put+0x414/0x4f0 [ 599.754774][T12761] skb_release_data+0x4cb/0x940 [ 599.759606][T12761] __kfree_skb+0x5d/0x210 [ 599.763925][T12761] unix_release_sock+0x9ad/0xc80 [ 599.768836][T12761] unix_release+0x92/0xd0 [ 599.773139][T12761] sock_close+0xc3/0x240 [ 599.777366][T12761] __fput+0x44f/0xa70 [ 599.781327][T12761] task_work_run+0x1d9/0x270 [ 599.785894][T12761] get_signal+0x11eb/0x1330 [ 599.790377][T12761] arch_do_signal_or_restart+0xbc/0x830 [ 599.795913][T12761] exit_to_user_mode_loop+0x86/0x480 [ 599.801174][T12761] do_syscall_64+0x32d/0xf80 [ 599.805744][T12761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.811613][T12761] [ 599.813912][T12761] Memory state around the buggy address: [ 599.819523][T12761] ffff88803d92c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 599.827574][T12761] ffff88803d92c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 599.835632][T12761] >ffff88803d92c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 599.843668][T12761] ^ [ 599.850056][T12761] ffff88803d92c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 599.858093][T12761] ffff88803d92c800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 599.866131][T12761] ================================================================== [ 599.964566][ T5823] em28xx 3-1:0.132: Closing input extension [ 600.016831][T12761] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 600.024080][T12761] CPU: 1 UID: 0 PID: 12761 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 600.034687][T12761] Tainted: [L]=SOFTLOCKUP [ 600.039016][T12761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 600.049077][T12761] Call Trace: [ 600.052363][T12761] [ 600.055301][T12761] vpanic+0x56c/0xa60 [ 600.059298][T12761] ? __pfx_vpanic+0x10/0x10 [ 600.063816][T12761] panic+0xc5/0xd0 [ 600.067571][T12761] ? __pfx_panic+0x10/0x10 [ 600.071993][T12761] ? preempt_schedule_thunk+0x16/0x30 [ 600.077378][T12761] ? preempt_schedule_thunk+0x16/0x30 [ 600.082760][T12761] ? v4l2_fh_open+0xac/0x420 [ 600.087352][T12761] check_panic_on_warn+0x89/0xb0 [ 600.092301][T12761] ? v4l2_fh_open+0xac/0x420 [ 600.096903][T12761] end_report+0x73/0x180 [ 600.101163][T12761] ? v4l2_fh_open+0xac/0x420 [ 600.105759][T12761] kasan_report+0x128/0x150 [ 600.110272][T12761] ? v4l2_fh_open+0xac/0x420 [ 600.114866][T12761] v4l2_fh_open+0xac/0x420 [ 600.119282][T12761] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 600.125270][T12761] em28xx_v4l2_open+0x157/0x9a0 [ 600.130131][T12761] ? do_raw_spin_lock+0x12b/0x2f0 [ 600.135160][T12761] v4l2_open+0x1bf/0x3a0 [ 600.139410][T12761] chrdev_open+0x4cd/0x5e0 [ 600.143827][T12761] ? __pfx_chrdev_open+0x10/0x10 [ 600.148769][T12761] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 600.155106][T12761] ? __pfx_chrdev_open+0x10/0x10 [ 600.160043][T12761] do_dentry_open+0x785/0x14e0 [ 600.164819][T12761] vfs_open+0x3b/0x340 [ 600.168893][T12761] ? path_openat+0x2df0/0x3860 [ 600.173751][T12761] path_openat+0x2e08/0x3860 [ 600.178350][T12761] ? __pfx_stack_trace_save+0x10/0x10 [ 600.183726][T12761] ? stack_depot_save_flags+0x33/0x810 [ 600.189191][T12761] ? __pfx_path_openat+0x10/0x10 [ 600.194127][T12761] ? __x64_sys_openat+0x138/0x170 [ 600.199160][T12761] ? do_syscall_64+0x14d/0xf80 [ 600.203929][T12761] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 600.209998][T12761] ? __lock_acquire+0x6b5/0x2cf0 [ 600.214944][T12761] do_file_open+0x23e/0x4a0 [ 600.219450][T12761] ? __pfx_do_file_open+0x10/0x10 [ 600.224481][T12761] ? _raw_spin_unlock+0x28/0x50 [ 600.229333][T12761] ? alloc_fd+0x64b/0x6c0 [ 600.233672][T12761] do_sys_openat2+0x113/0x200 [ 600.238362][T12761] ? __pfx_do_sys_openat2+0x10/0x10 [ 600.243569][T12761] ? exc_page_fault+0x6a/0xc0 [ 600.248260][T12761] ? do_user_addr_fault+0xc6f/0x1340 [ 600.253554][T12761] __x64_sys_openat+0x138/0x170 [ 600.258412][T12761] do_syscall_64+0x14d/0xf80 [ 600.263008][T12761] ? trace_irq_disable+0x3b/0x150 [ 600.268038][T12761] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 600.274104][T12761] ? clear_bhb_loop+0x40/0x90 [ 600.278794][T12761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 600.284693][T12761] RIP: 0033:0x7f41d34a7407 [ 600.289118][T12761] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 600.308732][T12761] RSP: 002b:00007ffd4d1c83d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 600.317164][T12761] RAX: ffffffffffffffda RBX: 00007f41d33b9880 RCX: 00007f41d34a7407 [ 600.325150][T12761] RDX: 0000000000000000 RSI: 00007ffd4d1c8f1b RDI: ffffffffffffff9c [ 600.333131][T12761] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 600.341100][T12761] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 600.349067][T12761] R13: 00007ffd4d1c8620 R14: 00007f41d3c3d000 R15: 000055e8d2c784d8 [ 600.357044][T12761] [ 600.360536][T12761] Kernel Offset: disabled [ 600.364854][T12761] Rebooting in 86400 seconds..