last executing test programs: 1m25.248213781s ago: executing program 3 (id=5935): r0 = syz_usb_connect$uac1(0x0, 0xad, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029b0003010000000904000000010100000a2401000000020102092408000000004c58062404000052072405000053f10b24050000133b9bda531c092405fc0596efc359090401000001020000090401010101020000090501090000000000072501000600000904020000010200000904020101010200000b2402017f0200018b7e8e07240100000000090582091000000000072501f5"], 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000001100)={0x14, 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0003040000000403"]}, 0x0) syz_usb_control_io(r0, &(0x7f00000021c0)={0x18, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0003040000000003"], 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x1a1281) ioctl$USBDEVFS_CONTROL(r1, 0xc0105500, &(0x7f0000000040)={0x2, 0x0, 0x804, 0x3720, 0x0, 0x40001, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) syz_usb_connect(0x1, 0x36, &(0x7f00000026c0)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) (async) r3 = open(&(0x7f0000000080)='./file0\x00', 0x80000, 0x40) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r3, 0xc0189378, &(0x7f0000000180)={{0x1, 0x1, 0x18, r2, {r1}}, './file0\x00'}) (async) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) (async) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)) (async) syz_emit_ethernet(0x6e, &(0x7f0000000380)=ANY=[@ANYBLOB="0180c2000000e157ae65e9c186dd60062111003800ff00000000000000000000000000000000fe8000009dbb7a6d0000000000000000000000aa0005"], 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) (async) r4 = io_uring_setup(0x7fdb, &(0x7f0000000080)={0x0, 0x80100000, 0x0, 0x1, 0x8}) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000200)="ad56b6cc0400aeb995298992ea5400c2", 0x10) (async) close_range(r4, 0xffffffffffffffff, 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000580)={0x18, &(0x7f00000001c0)={0x0, 0x1, 0x11, {0x11, 0x21, "c9bc11c2d24313e18fdf896f9e9cdb"}}, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc1a}}, &(0x7f0000000440)={0x0, 0xf, 0x3e, {0x5, 0xf, 0x3e, 0x4, [@generic={0x21, 0x10, 0x3, "dbd561429283e2ae6a3835a8624f61a2835665d47ff4f7c3e680c61f233e"}, @ext_cap={0x7, 0x10, 0x2, 0x10, 0x8, 0x5}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x8, 0xe, 0x2, 0xf3}, @ext_cap={0x7, 0x10, 0x2, 0x14, 0x7, 0x9, 0x8}]}}, &(0x7f00000002c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x9d, 0x4, 0xe, 0x0, "6d85b96d", "8a885277"}}, &(0x7f00000004c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x7, 0x2, 0x8, 0x8, 0x6, 0x69, 0x2}}}, &(0x7f0000000b00)={0x44, &(0x7f00000005c0)={0x0, 0x1e, 0x63, "c1f4c1e80375744a03b24a33c14818f8eb1185e6aa690b793036f33b43edd74cb6f0ec6a999f0e98773c799d2e95b8de340ec9aba3e70c331d31aec8d4fdb39062d330d049e715e7d9e7cd9c4e1f4dbeb1bba710bc272e3c45aa1cd15e08dc7b70af73"}, &(0x7f0000000640)={0x0, 0xa, 0x1, 0xb}, &(0x7f00000006c0)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000700)={0x20, 0x0, 0x4, {0x0, 0x1}}, &(0x7f00000007c0)={0x20, 0x0, 0x4, {0x0, 0x80}}, &(0x7f0000000800)={0x40, 0x7, 0x2, 0x6}, &(0x7f0000000840)={0x40, 0x9, 0x1, 0x6}, &(0x7f0000000880)={0x40, 0xb, 0x2, "ee3a"}, &(0x7f0000000900)={0x40, 0xf, 0x2, 0x200}, &(0x7f0000000940)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}, &(0x7f0000000980)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}}, &(0x7f00000009c0)={0x40, 0x19, 0x2, "c299"}, &(0x7f0000000a00)={0x40, 0x1a, 0x2, 0x80}, &(0x7f0000000a40)={0x40, 0x1c, 0x1, 0xb3}, &(0x7f0000000a80)={0x40, 0x1e, 0x1}, &(0x7f0000000ac0)={0x40, 0x21, 0x1, 0x10}}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000740)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="2015050000002ad6a38de0"], 0x0, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000000400)={0x20, 0x0, 0x4, {0x1, 0x2}}, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x40, 0xb, 0x2, "708b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1m24.036014759s ago: executing program 3 (id=5940): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141d01) r1 = dup(r0) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8, '\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}]}, 0x48}}, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 1m23.68676779s ago: executing program 3 (id=5941): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0x0, 0x1) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @private1, 0x8002}, 0x36) syz_emit_vhci(0x0, 0x7) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_pktinfo(r2, 0x0, 0x50, 0x0, &(0x7f0000000040)=0x54) socket$l2tp6(0xa, 0x2, 0x73) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0xa2602, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000000c0)={0x1, 0x2}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140)={0x2, 0x1}, 0x2) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f00000000c0)={"0e00", 0x0, 0x6, 0x2, 0x0, 0x0, "f700000000000000001000", '\x00\x00\a\x00', "0300", '\x00', ["50d5c2a7c5ae5cace40000b6", "808e88e2e9ffffffffff00", "0c436d743c97c443084000", "ff81000000008000"]}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000040)={{@local}, @local, 0x8, 0x6, 0x343, 0xffffffff7fffffe1, 0x7, 0x100, 0x9}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={0x0, 0x0, 0x1a, 0x0, 0x1000, 0x0, 0x0, @void, @value}, 0x28) socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0x0) 1m21.985932718s ago: executing program 3 (id=5946): r0 = syz_io_uring_setup(0x121d, &(0x7f0000000500)={0x0, 0xfffffffd, 0x80, 0x3, 0x34e}, &(0x7f0000000980)=0x0, &(0x7f0000000380)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0xe6) r3 = socket(0x2a, 0x2, 0x0) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000480)=0x14) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, 0x0) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x71, 0xffffffffffffffff, 0x46e4c000) 1m21.201065156s ago: executing program 3 (id=5951): getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000000)=""/9, &(0x7f0000000040)=0x9) syz_usb_connect(0x3, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="1201500242864220f30c75930a000102030109021b00010595201009043d0601add5da000905031640"], &(0x7f0000001140)={0x0, 0x0, 0x0, 0x0}) 1m19.138987757s ago: executing program 3 (id=5960): r0 = syz_open_dev$usbmon(&(0x7f0000000b40), 0x6, 0x8003) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$vim2m(&(0x7f0000000300), 0x105, 0x2) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000340)={0x5a10, r0, 0x1}) symlinkat(&(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000380)='./file0\x00') syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_open_dev$vim2m(&(0x7f0000000000), 0x4, 0x2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000005000000020000000410"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000040)='kmem_cache_free\x00', r4}, 0x10) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000280)={0xa, 0x2, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) listen(r1, 0x2) r6 = socket$inet_tcp(0x2, 0x1, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r8 = accept4(r7, 0x0, 0x0, 0x800) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) recvmmsg(r8, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) connect$inet(r6, &(0x7f0000000040)={0x2, 0x2, @local}, 0x10) close_range(r5, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x4, 0x0, 0x7fffffff}, 0x0, 0x0) 1m3.676831918s ago: executing program 32 (id=5960): r0 = syz_open_dev$usbmon(&(0x7f0000000b40), 0x6, 0x8003) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$vim2m(&(0x7f0000000300), 0x105, 0x2) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000340)={0x5a10, r0, 0x1}) symlinkat(&(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000380)='./file0\x00') syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_open_dev$vim2m(&(0x7f0000000000), 0x4, 0x2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000005000000020000000410"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000040)='kmem_cache_free\x00', r4}, 0x10) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000280)={0xa, 0x2, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) listen(r1, 0x2) r6 = socket$inet_tcp(0x2, 0x1, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r8 = accept4(r7, 0x0, 0x0, 0x800) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) recvmmsg(r8, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) connect$inet(r6, &(0x7f0000000040)={0x2, 0x2, @local}, 0x10) close_range(r5, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x4, 0x0, 0x7fffffff}, 0x0, 0x0) 18.235395812s ago: executing program 1 (id=6095): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0x0, 0x1) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @private1, 0x8002}, 0x36) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x7) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_pktinfo(r2, 0x0, 0x50, 0x0, &(0x7f0000000040)=0x54) socket$l2tp6(0xa, 0x2, 0x73) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0xa2602, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000000c0)={0x1, 0x2}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140)={0x2, 0x1}, 0x2) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f00000000c0)={"0e00", 0x0, 0x6, 0x2, 0x0, 0x0, "f700000000000000001000", '\x00\x00\a\x00', "0300", '\x00', ["50d5c2a7c5ae5cace40000b6", "808e88e2e9ffffffffff00", "0c436d743c97c443084000", "ff81000000008000"]}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000040)={{@local}, @local, 0x8, 0x6, 0x343, 0xffffffff7fffffe1, 0x7, 0x100, 0x9}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={0x0, 0x0, 0x1a, 0x0, 0x1000, 0x0, 0x0, @void, @value}, 0x28) socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0x0) 13.634566806s ago: executing program 1 (id=6104): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x94, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x64, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x2}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffd, 0x0, 0x3], [0x0, 0x8]}}]}}]}, 0x94}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) r2 = socket$netlink(0x10, 0x3, 0xb) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$key(r1, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000240)={0x2, 0x4, 0x0, 0x2, 0xe, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0xff, 0x0, 0x0, @in6={0xa, 0x2, 0x0, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0xfb, 0x0, 0xa0000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote}}]}, 0x70}, 0x1, 0x7}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000058000000030a0102000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c0800014000000002080001400000003008000240000000030800014000000012080003"], 0x122}}, 0x0) 13.201404158s ago: executing program 1 (id=6108): sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000500), 0x8, 0x0) r3 = syz_io_uring_setup(0x2, &(0x7f0000000580)={0x0, 0x8b2, 0x13500, 0x0, 0x304}, &(0x7f0000000240), &(0x7f0000001880)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x21, &(0x7f0000000440)=r2, 0x1) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='gid_map\x00') close(0xffffffffffffffff) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000300), 0x2a101, 0x0) write$tcp_mem(r4, 0x0, 0x0) r5 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r5, 0xc2604110, 0x0) socket(0x10, 0x3, 0x0) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$can_bcm(0x1d, 0x2, 0x2) socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000100)={'vxcan0\x00'}) sendmsg$nl_route_sched(r6, 0x0, 0x98) 8.31356864s ago: executing program 2 (id=6118): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0x0, 0x1) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @private1, 0x8002}, 0x36) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x7) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_pktinfo(r2, 0x0, 0x50, 0x0, &(0x7f0000000040)=0x54) r3 = openat$userio(0xffffffffffffff9c, 0x0, 0xa2602, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000000c0)={0x1, 0x2}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140)={0x2, 0x1}, 0x2) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, 0x0) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000040)={{@local}, @local, 0x8, 0x6, 0x343, 0xffffffff7fffffe1, 0x7, 0x100, 0x9}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={0x0, 0x0, 0x1a, 0x0, 0x1000, 0x0, 0x0, @void, @value}, 0x28) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[], 0x294}, 0x1, 0x0, 0x0, 0x400}, 0x4020054) socket$netlink(0x10, 0x3, 0x0) 8.061880408s ago: executing program 1 (id=6119): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f000001f480), 0x2, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001000000000000000000e0000002000000001000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400002000000000000080000000000000000000000004400050000000000000000000000000000000000000000003c00000000000000ffffffff00000000000000000000000002000000040300"/176], 0xfc}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc0000001b0001000000000000000000e00000010000000000000000000000007f00000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000f0000000000000000000000000000010400000000000000008000000000000003000000000000000000000000000000000074abc4b80000000000000000000000000000000000000200000000000000000000000000000002000000080008000000000000000000000000000001000004d40000000000000000ffffffff0000000000000000000000005a50000000000000000000000000001000000000"], 0xfc}}, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000021c0)={0x2020}, 0x2020) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000280)={0x4, 0x0, 0xb51b, 0x10}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001200010a000000000000000080005fc3"], 0x26}}, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c0087b5ad15f987909835ed6f8bb3d00fb9c7658f8c6bff6c01d74bc0e4fbf9c5bab48a98526d2909949f26598914bc2b134d4a51869b9ae4791c91"], 0x0, 0x0, 0x0) r4 = syz_io_uring_setup(0x109, &(0x7f0000000140)={0x0, 0x601, 0x0, 0x1, 0x8b}, &(0x7f00000003c0)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x29c780}) io_uring_enter(r4, 0x3516, 0xaddf, 0x2, 0x0, 0x0) unshare(0x2a020400) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000030000200900010073797a310000000014000000020a0104000000000000000007000000540000001f0a030000000000000000000300000008000340000000000900010073797a31000000000900020073797a30000000000c0006"], 0xb0}}, 0x0) 7.61047002s ago: executing program 5 (id=6123): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x123000, 0x0) unshare(0x6a040000) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0xa131, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@ipv4_newrule={0x24, 0x20, 0x1, 0x0, 0x0, {}, [@FRA_GENERIC_POLICY=@FRA_L3MDEV={0x5, 0x13, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4044040}, 0x0) r2 = socket(0x840000000002, 0x3, 0xfa) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000340)='/sys/power/resume_offset', 0x200, 0x0) read$FUSE(r3, &(0x7f00000007c0)={0x2020}, 0x2020) connect$inet(r2, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r2, &(0x7f0000005240), 0x4000095, 0x0) getpeername$l2tp6(r2, 0x0, 0x0) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x140, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r4, 0xc018937e, &(0x7f0000001040)={{0x1, 0x1, 0x1018}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00'}) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$rxrpc(0x21, 0x2, 0x2) socket$kcm(0x10, 0x2, 0x4) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r5 = syz_io_uring_setup(0x19f2, &(0x7f0000000280)={0x0, 0x4ee7, 0x1}, &(0x7f0000000300)=0x0, &(0x7f0000000200)=0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'syztnl0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x14, 0xff, 0x0, 0x0, 0x23, @empty, @empty, 0x0, 0x7800}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='pids.events\x00', 0x275a, 0x0) write$UHID_CREATE2(r9, &(0x7f0000000180)=ANY=[@ANYRES64=r8], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r9, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_EPOLL_CTL=@add={0x1d, 0x0, 0x0, r9, 0x0}) io_uring_enter(r5, 0x2d3e, 0x0, 0x0, 0x0, 0x0) 6.447069621s ago: executing program 0 (id=6124): socketpair$tipc(0x1e, 0x2, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x24004000) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) r1 = syz_clone(0x20000000, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f00000003c0)={{0xa, 0x6, 0x7, 0x1000, 'syz1\x00', 0xff}, 0x6, 0x400, 0x1, r1, 0xa, 0x0, 'syz1\x00', &(0x7f0000000340)=['\x00', ' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', '\x00', '$o\x00', ' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', '\x00', '/!}/-\x00', ',\x04&\x00', '^\\\x00', ' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'], 0x43}) 6.443362183s ago: executing program 1 (id=6125): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0x0, 0x1) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @private1, 0x8002}, 0x36) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x7) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_pktinfo(r2, 0x0, 0x50, 0x0, &(0x7f0000000040)=0x54) r3 = openat$userio(0xffffffffffffff9c, 0x0, 0xa2602, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000000c0)={0x1, 0x2}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140)={0x2, 0x1}, 0x2) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f00000000c0)={"0e00", 0x0, 0x6, 0x2, 0x0, 0x0, "f700000000000000001000", '\x00\x00\a\x00', "0300", '\x00', ["50d5c2a7c5ae5cace40000b6", "808e88e2e9ffffffffff00", "0c436d743c97c443084000", "ff81000000008000"]}) r4 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000040)={{@local}, @local, 0x8, 0x6, 0x343, 0xffffffff7fffffe1, 0x7, 0x100, 0x9}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={0x0, 0x0, 0x1a, 0x0, 0x1000, 0x0, 0x0, @void, @value}, 0x28) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[], 0x294}, 0x1, 0x0, 0x0, 0x400}, 0x4020054) socket$netlink(0x10, 0x3, 0x0) 6.129726256s ago: executing program 5 (id=6126): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r0, 0x6, &(0x7f0000002000)={0x1}) fcntl$lock(r0, 0x26, &(0x7f00000031c0)={0x1, 0x0, 0x8000, 0x2}) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f00000001c0)) pipe(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r8, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x80) gettid() socketpair(0x2a, 0x800, 0xe48, &(0x7f00000000c0)) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r12 = syz_open_dev$ndb(&(0x7f0000000240), 0x0, 0x105840) ftruncate(r12, 0xd) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16=r5, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r11, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(r7, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="00000000a64169", @ANYRESDEC=0x0, @ANYRES64=r10], 0x38}, 0x1, 0x0, 0x0, 0x4014040}, 0x1) r13 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x22301, 0x0) ioctl$SNDCTL_DSP_SYNC(r13, 0x80105014, 0x0) write$binfmt_misc(r2, &(0x7f0000000000), 0xfffffecc) rename(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='./file0\x00') r14 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000000)={'veth0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@ipv4_deladdr={0x34, 0x15, 0x1, 0xfffffffd, 0x25dfdbfc, {0x2, 0x18, 0x0, 0x0, r15}, [@IFA_LABEL={0x14, 0x3, 'veth0\x00'}, @IFA_ADDRESS={0x8, 0x1, @multicast1}]}, 0x34}}, 0x0) splice(r1, 0x0, r3, 0x0, 0x4ffe6, 0x0) 6.081098217s ago: executing program 2 (id=6127): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0x0, 0x1) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @private1, 0x8002}, 0x36) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x7) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_pktinfo(r2, 0x0, 0x50, 0x0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0xa2602, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000000c0)={0x1, 0x2}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140)={0x2, 0x1}, 0x2) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f00000000c0)={"0e00", 0x0, 0x6, 0x2, 0x0, 0x0, "f700000000000000001000", '\x00\x00\a\x00', "0300", '\x00', ["50d5c2a7c5ae5cace40000b6", "808e88e2e9ffffffffff00", "0c436d743c97c443084000", "ff81000000008000"]}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000040)={{@local}, @local, 0x8, 0x6, 0x343, 0xffffffff7fffffe1, 0x7, 0x100, 0x9}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={0x0, 0x0, 0x1a, 0x0, 0x1000, 0x0, 0x0, @void, @value}, 0x28) socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0x0) 6.039273504s ago: executing program 0 (id=6128): setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="1800000016002dbd700046618b9873001200000000000002300000"], 0x18}}, 0x0) 5.758765508s ago: executing program 0 (id=6129): sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000500), 0x8, 0x0) r3 = syz_io_uring_setup(0x2, &(0x7f0000000580)={0x0, 0x8b2, 0x13500, 0x0, 0x304}, &(0x7f0000000240), &(0x7f0000001880)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x21, &(0x7f0000000440)=r2, 0x1) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='gid_map\x00') close(0xffffffffffffffff) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000300), 0x2a101, 0x0) write$tcp_mem(r4, 0x0, 0x0) r5 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r5, 0xc2604110, 0x0) socket(0x10, 0x3, 0x0) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$can_bcm(0x1d, 0x2, 0x2) socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000100)={'vxcan0\x00'}) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000}, 0x98) 5.699827187s ago: executing program 4 (id=6130): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x1, 0x7fff0000}]}) r0 = gettid() sched_getattr(r0, &(0x7f0000000080)={0x38}, 0x38, 0x0) 5.589488418s ago: executing program 4 (id=6131): timer_settime(0x0, 0x0, &(0x7f0000000000)={{}, {0x77359400}}, &(0x7f0000000040)) timer_create(0x2, &(0x7f0000000080)={0x0, 0x24}, &(0x7f00000000c0)=0x0) timer_gettime(r0, &(0x7f0000000100)) (async) timer_gettime(r0, &(0x7f0000000140)) (async) r1 = mq_open(&(0x7f0000000180)='/!\'\x00', 0x1, 0x11, &(0x7f00000001c0)={0x6, 0xffffffd1, 0x10000, 0x1}) (async) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) mq_timedreceive(r1, &(0x7f0000000200)=""/10, 0xa, 0x5, &(0x7f0000000280)={r2, r3+10000000}) (async) pwrite64(r1, &(0x7f00000002c0)="e9b501a5d0e9065d98a6fa61efa37f0ad09612ee5756b867589c9d87b1000e0a104061160379c8e9ad03015d08dd5441f2bc63b2f44d0ac374a6bd025260f79ffccd1d8b840aaf0bb2594b2e157f4f552c37e54408f7ed9f092d5ac83878398e21b15b333da101817fe93bbd959dc36a9d9dae9c655edab5c161988c480159035e06292d43f0b0cacfa194d475c856f1dd1654a86626d6de2fa6d7a61ed5c7b2ff231c6afedb0a7a657e1ec10505f634a363d11ef7f8a350f5cb9b41db4e9dbad2776acc9eb93b6707833f3c90f368efe755f112d4b81dba132b053affa795b461c70efa8efc2dd8461b0fb5bfd6fd", 0xef, 0x2d) (async) r4 = openat$binderfs(0xffffff9c, &(0x7f00000003c0)='./binderfs/custom0\x00', 0x800, 0x0) ioctl$BINDER_GET_FROZEN_INFO(r4, 0xc00c620f, &(0x7f0000000400)={0xffffffffffffffff}) (async, rerun: 64) r5 = socket$inet_sctp(0x2, 0x1, 0x84) (rerun: 64) setsockopt$inet_mreqn(r5, 0x0, 0x24, &(0x7f0000000440)={@loopback, @rand_addr=0x64010100}, 0xc) (async) timer_delete(r0) (async) r6 = userfaultfd(0x0) (async) r7 = epoll_create(0x8000) epoll_pwait2(r7, &(0x7f0000000480)=[{}, {}, {}, {}, {}], 0x5, &(0x7f00000004c0)={0x0, 0x989680}, &(0x7f0000000500)={[0x1, 0x1]}, 0x8) r8 = syz_open_dev$swradio(&(0x7f0000000540), 0x1, 0x2) ppoll(&(0x7f0000000580)=[{r8, 0x4000}, {r4, 0x2}, {r5}, {r4, 0x9000}], 0x4, &(0x7f00000005c0)={0x77359400}, &(0x7f0000000600)={[0x800, 0x80000001]}, 0x8) (async) prctl$PR_SCHED_CORE(0x3e, 0x3, 0xffffffffffffffff, 0x2, &(0x7f0000000640)) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = open(&(0x7f0000000680)='./file0\x00', 0x0, 0x12) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) timer_gettime(r0, &(0x7f00000006c0)) (async) ioctl$TCFLSH(r7, 0x540b, 0x2) (async) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r9, 0x8983, &(0x7f0000000700)={0x1, 'pim6reg0\x00', {}, 0x80}) r11 = syz_io_uring_setup(0x7505, &(0x7f0000000740)={0x0, 0xa494, 0x40, 0x1, 0x3cc}, &(0x7f00000007c0), &(0x7f0000000800)) io_uring_enter(r11, 0x3322, 0x5830, 0x8, &(0x7f0000000840)={[0x8, 0x9]}, 0x8) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r10, 0xc018937d, &(0x7f0000000880)={{0x1, 0x1, 0x18, r6, {0x80000000}}, './file0\x00'}) clock_gettime(0x0, &(0x7f00000018c0)={0x0, 0x0}) mq_timedsend(r1, &(0x7f00000008c0)="99131f44f6e186db8bcc5c4a5bf1a3bd2ee73ecc63842813b455ceeea40dbfcbad77094d43d4dfe23c7419499c818488a6c00de6d4aefa0d8ade8149791b26be0073cc8ed24a2282c4235d575494b5667307dcfdf56ddfa50005691fd90d17462b8de9116d3777d42449b88547820b51146267133ec7244285f66f8e5e2593d6b43692d80ca4e9eb791420ff2a6300109b92020438d5dc9cfb68e43036f71ee2393b806a4b99898f2d07efbcfc20cad2632129ba5ae83617b8f553403190d95bff5c1ea7e0baafc93559711365aa56a0e6394754a4806f2d4512416bed3ce3e74af4d83e10764789ced3320da64d7b1d293e6425e256fa12ce0be77a61fb482e520464c03c96d81f20e70fd7864d63509000e624c5bc9a986d3c49e408983d2dc9a31971b8baa23175aa788dd8ec64ff4ecbea34ca4c56523d934752adf82ae52b29ee7018de735ef68816fb05d33c004f24b851e17035ee5d8e96123d7d25d93aa3cdb389a3c35abf2d48de525cba364c1aca94c30c833a239e44a534595f766d1d20c165e42b2ce49fc9b30efe503ff043e5c090908c02ce6bea96f38bd211b8f6249fc5e7dd3eb424765606a1d40f1179314e15820497e0aacb318bbd41c4498f0afecbc8b50ecd32287299089d7b3976a1b5963d379511ef68c65eb76febbecabcff09db2a59d0eed590663b943a36950f365771504e5931d4d8a5e84bce88a8b0472b503d95216e2353871ab8b0493eb1ad9ab91fc081966c6ac48de6f22a9977f88a5c87cd72e899ca6d24de650b1609070956050d449a15420ac5861b376fe62b7dd3d8e375a59d75d63f69529724d854b88eef2eae7f8f7bcf8a65d5146f68ae32674cc0bbbad8f104e13a54c078703138b2b777af8e1becec122867ad55670e68a3efc0ae3ce7e126b9e106367b03f47060f2b50b65e943ce34bc51b3bcd2b80bb31350262bc23f2aa8f1461995f31a0da48ddd431d444f641ee8ff9cfa8a9f868c5728e1992f12b3960e5526b1a348c6f00a3b053cc087982ddf52b1cc4fae598028b0aa32ef922a5fc80b7ec1cef5d4e67725c2b51f0b88851ece76b7005acfe1007d5549edd1f870bbaef0b2620b2f6168f58a74ae54e36176b80c68e691674a825419f2aad2141b2ecc2c72ed1c79fa8acde0b3548706500c295ae4541a7d50e0d4e076a8bb8f86e2af599b95c88177e6a7ef5d1ffe701f6ebb57fbe415ea91ad1016be5616c832daf6d5fa932d6bcd00b9fc059ee18a410e04f7daea28ecdbe42c21281bf3d8501276339889325abff62d53f68e94d9509f0c3025eb1bd3e3bee93d2160ee170a340c756b0db32840a170dfbd3effbc50812be9e7497dbed0ff4c0a8bfc97ac1e54341a678e4eac0ac77ac6263f646b130c7c734772092df11cefdacff0ce86e86ccf96978ddf3fe683f71b94c8e21dfc708101a36093dcb1242c4a380b26ad5c952f47a70615dcd379e128217a788e3a34043efab12ed4e5703528b3e7485d81dcaf2fad1d7dcf9edf944481b909898406ec96e871f7f7a3535abcb543bbc29a8a42be691aac8bce9f3a05b54f4ea4db546b570ae2c019be0c071512b0a71829d0b7fa08a87ece09512ea682281ba3af25058f4df31e8af29b72a296cf0b0569a71a1a00e1f37ef1e828c7376b26b95e6b49e619c3070633a26bd2f16c65d443a33630087aa3a9c2126d68cd9d30787ce0497bde1a401b74015c2ab7af42e0f7a442a3591881307648afda2678e8a9d585028a8176f7f29cca76b7ae07651d4c1a43f7763be36a1fa62754c412bf03423a1f8b684f98925237aa22ddd4f38b0e428a16f5be6d38698f68498e887044955c3129d1478ca234fc5b7b58332d0f9d8f5ab6e142771edf207572e93a7f753dd38e7c7e5c76fef84e8ac63314e368529085ad65de46dd6ec91510dbc0cc41e16800fabec4ea8d8c4cf583f38647be5f8a451db916122281b4977bc46793088ee1dc20e19a0fc8515e6b2150543c36d17b51777d6a6c1814c07b26f71dd55c119201fe6e1b5f435ec6c99f6ff3fbac9b0ec5e57ce1457eecda91c8f2efdc8542fefa31151d643456d2282cbfe366635373b5430f0c850d1b2efe61c9983983effb9c1c8d81055d14a26ad7f6195038bc4bb99a14b3d0b6e8c91d6d4542e1b6bd594a69e3910ec62908e449b5b22aca384fb08b991c78d933c2166761dd90430c3a2b715f737c3e37b69af34625358e98ca7699b820f49669aec281bbbc9e401b1a02a228eb6f683acefb4462b8c168e10c6925095d9b5d81ef6a1e8f1631dfd9d391280ef8bbf8029a144e1c026e28d610b0a800d4a1be076e7516fd6c1582f264c93fcee7eaf892b6dd4a630cc414e53e108a3d5f69ada8e6a2edda5adec13dbe123ae97561106c6f7c306ab2e070e754506b181ba62ee398cc7eeebd97d7010765d0c83dfb048bf3efa47899080655faf903d994ec6e858579aa54da871589580203362e9678a88ed09530d59ea22b09169cfd8000f7453c6aa1431cd2afa40532d25e1bb90458539c0fd9ab172459f38a52e3863bd1d89670b1e6e62ba6aa81cb8ea5d937ecda90edcd16a4bd88e84fdd848ae1a3f286e691c06b2ecf0a149a54f80faf129061e066718820daeb5b5f1179dd0b558f0f6123bf5722bb04a20198d274a1f0ed942b1248f283a1402263ea87e67c3124886ae4a2d68c460385083a82f08d76d5ba62eacd492b7bb3124d1bab824505c9190728c685e28101e873ba8fe6b45d62fc32add501bec23051c26b77193053d0d9817f58f136f4c1d8e84f0f2f03a8337ad81cbf05367cf76146241fe6db5f7cb8226fb30b0ca296e8311adb9de95c3dcdf0a7caff91105990dbd0806da247ab3824b5c7b30632b0352c0785b85dc45fbd0edcd9943ec96ebd69eaafb4a499a6deea1c8efeb631592354249f7048bb92a401c330954c497e1a60c4db9a2ae7531bd8f2b7665027ad83846b6b068f3eb895f1be88dabc678b56cd3568ace066fa597e4dacb36ad79744a5c8f50becd27e98f3abd97281ecf453528c32eeed7a23b0aa93732583c6ae7a4dd54afa63ba69db235e2ac80b1adecefca1f3a2e424e0847de3a589e76c97cd15ef4496f2ae4097154c8b7f464a630e5298c3ec8211de5166513cec339e9c04e3eb7a70d428556bedcf9b5a5f5fcbd289904fe3d0c1b0a1f0ee192c1bb86e5c2a86f306d0d3f232956dd2c0cf2088d5f8bc583a079605236fde8224de534e17a315b9f5cfb2b31bb4541f7a93761904869720a05f8ba7f8898dca972c15ca752339b3edafa8249ace8e952806bc86541d57fe335cb641171eac170a1d62d2d61c64fa0931a38fe2eb6e238c05f353b6992169eb078684f5ff9201a5ad6c0b91889f938365e4be4ef58d2757cb8f308bcff7ab7b46beab1509a591bf9d2897751ee1310b26da55b49e78aa17e30caffd58d25f2b9e5641506ce3ca5998152f7922f4b0a3b57485c0eaee6cc664d3c7f6df8ecd4feb82bda2bbd5a3ad3b4aed64a7240d65dc6fa60a63ae44bf8d74c000ee6ad1f6a2f9b1c04f90a628a063e5d30d0b81dc59a57c128cbd3744a7cecabc78d608390c99edf95b5cf2b542d109fb9087a30c97699238d045df40e70ea410831b2fea489f8c359a0c46566e554f015395c6234892067f14499300142477109a421f8e4c2b6047098299a1cb9da4b86ff8f5e7909a8332bee8aba91b76f3ada69dd19d50dcdbb497b32129beb5287fbd1ed9c7b0664493d1d926406e1b29747b3854371d0cc3a96b848cdd8825b284af6e68f337d863acd8393bde081b42f739f97c5cf379f52ea755dffb3f908f3368c3d9ef6a56eb320ef5be86c0236cfcae8ba09009b0cd040e96a2d69dfc176cbfd499ba22691ab14d944724992f9e3ff1d913fae00020519ed7d3c8863bef0ed5386435b00bd4d41e7a59b2427f31e17400ad65003a29faf531471fb13f9bdfabbc6cfbe74d310245e6db39ffa6e05b945474251e75bbf9890d3113df841287fbfd8c03139e0b7a043667a6b63a28d892a37997e4f934f66e2d75aeb88281a2968e48f0613e5ef6b4dc4369c253739d74c732fd7e96bdf310400d89fc698e96c36092a15004f79009b72eb5a0d8b9af17ddbf3852585ecd219b71535639914cae2f2503e041a6923701ad939a0f79cfdcaea2c4aa78f08159ef435840daf25f5b3403adff835ce19ccae2e4ee92462954d2afe076ef4bebc5109a6bf2cbb4f49c420e0675c8ffc39235ed6d65cd87e7646a50e078cd7e2357df53e44d30a4bc2123e539d436b5bec948eeb6d4353847e13564028bf25c41b8e8d3f1c772f954d624a363d985fa13e962f8abf378367b6d780c577da5efedd7e9941684ec0b877fa2b95195c4801ea7cecdbf879f8400f1cdf42efcc45e5b0bab5e07099b0d35e31380d33d610bc0b3a6721d7c823ef9789fc7558a4e38ba52a792853bcb4f032518d4c96610ce8e39ef81f598a07a11b2f24bdb41dc39929c4f0e9d0aefd90d44de0008ca59d87317b49b8577cd492b8ecdbd722f4188b014d1a279313fc7e8c8d295335e2eaaaf6a04995ecf338899fc2dd2538ada37f494bdf4a099171203482e995f47ba821dc4eb5109871c3f302df17a2b1238716a481e13769218523756cc5e87b8dc7a575c92bd5c008f28deb69d7fd8b3ca645c13a9432e476469a10abb24ce5977246a36766f9314336ea8df76b5ac13a78908a98b3895a80be4f55007332ec198573c811f0d2d45222cfc60929c9a51b5151ef67b9654fa76ae59395603a53ad0987dd5645da1873b7c81359179800d675b01f2fbc6235c1862eab5e49aafa2bb517ea12ee0912b1b26e3579a3df33f2109589c6a026079ab28760f3ef55e794c573ec903f5c4d733c86cb1bd75e501ff4f46a08c635407f86fe0b9d7be1eb18e373c8d583a65cca4dc3cb0facf13c91c21baf0788e95c85dca4cfa8fcf2258826b40acc272947953c629e10766ecb7a687a4b9353fa7421868ee5f52f45b6db9caa96bf6b2ad850ce72fe5f8900800a85dd347a0eafe37f2ef8412b94a7f5b0fab0026f58d32c18d8ebd73b99c9abea562e97bd1e2625fc9280beaee7d2a74126b1b3e97f99d632ff2495fa0e7acfc40bbae1cd5045b5ee9df4d1f45cc71d00773df67e4316a8933bd908f9d598e9796125165a9552513809052a6d9f45206077b4463eaa6b99c9394cf63c13c185591a929673544647e36a2a68611ebd2b7bf40b127692a8a00feac1a44036cf223d8a762e9280bff5fe468ac7f3190b3460cbf03ec13aae0d746f1e87f812c486de9488ae41fdd75301ca7025484c3352498ab5baa716d2736426f7c3e456a10ff91140790ba5f7d8452610b08e20f31458f199f5855bab6748b44f7bc1cc4249cf669df7a0e6fe3ec4df5af017b2cef37aa58c8d8e0ffba32bf8bebb1e50dd55a92033fbe1a962749d391d6eb0d19e35441c226d5ccda697e9ffa56fc651a9063e67cb43a510d8cb6b6664815bd28a08877971840d93104ea87c895eb9f1e7f3b35638688ab1379cff3d5c84bb36cb306bc0148c7d43d6a5982286fc95b8507fa901025d09b7f4ec48188e4d796effdb0acce2a4875638a87aa32033923ab3d87cddd362cbdbd2500ae58e57147a8a6c3bc557dc646c9923bdc659e3df8b19e1aa10eb1feb23707f83930a6cc1a31cf04bf68e9b9c4b008915700ff9c927703572ef147c6add2e7d35fb87fba34a3e45c56cfde0b857f36b04cbf12c87ec7113095d6ba2cbba9c2afe46cfecf7a", 0x1000, 0x9, &(0x7f0000001900)={r12, r13+60000000}) 5.430790629s ago: executing program 4 (id=6132): socket$alg(0x26, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)={{0x14}, [@NFT_MSG_DELSET={0xa0, 0xb, 0xa, 0x301, 0x0, 0x0, {0x3}, [@NFTA_SET_EXPR={0x2c, 0x11, 0x0, 0x1, @masq={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0xb}, @NFTA_MASQ_REG_PROTO_MIN={0x8}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0xd}]}}}, @NFTA_SET_POLICY={0x8}, @NFTA_SET_EXPRESSIONS={0x44, 0x12, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @reject={{0xb}, @void}}, {0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}, {0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x86}, @NFTA_EXTHDR_DREG={0x0, 0x1, 0x1, 0x0, 0x8}]}}}]}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x100}]}, @NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x801, 0x0, 0x0, {0x5, 0x0, 0x5}, [@NFTA_SET_EXPRESSIONS={0x34, 0x12, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x16}]}}}, {0x7, 0x1, 0x0, 0x1, @notrack={{0xc}, @void}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x108}]}], {0x14}}, 0x118}}, 0x0) 5.338703618s ago: executing program 4 (id=6133): socket$netlink(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'wlan1\x00', &(0x7f0000000f40)=@ethtool_stats}) epoll_create1(0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f00000000c0)=@deltaction={0x58, 0x31, 0x100, 0x70bd2d, 0x25dfdbfc, {}, [@TCA_ACT_TAB={0x44, 0x1, [{0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xf1c}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0x10, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x62e1}}]}]}, 0x58}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x400000000010, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x4) socket$unix(0x1, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x15, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) syz_open_dev$tty1(0xc, 0x4, 0x4) socket(0x10, 0x3, 0x9) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002000000bdb34fccfdf12d141137619da5c855410c0d907f4959eb9f8ad9d7c7c37a22b9a3a0713f2e0508232399671e8761f6dbbbae87a39fde06cca707d57ff38bfb6ee031c31f8898c44129ab97d1ff32a4c833d9f5129fe52c7ccb23"], 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$printer(r3, 0x0, &(0x7f0000000580)={0x1c, &(0x7f0000000400)={0x40, 0xc, 0x4, "c3ad2058"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) 5.122920126s ago: executing program 5 (id=6134): r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x8) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3a616dc4010203010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000400)={0x18, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_usb_control_io(r1, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000280)={0x0, 0x0, 0x1, "12"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) close(r0) syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) read$FUSE(r0, &(0x7f000000c400)={0x2020}, 0x2020) 4.354518126s ago: executing program 2 (id=6135): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000020a01010000000000000000010000000900010073797a30000000000900030073797a310000000070000000060a010400000000000000000100000008000b400000000048000480440001800b000100657874686472000034000280080001400000000c080003400000000008000440000000220500020007000000080006400000000308000540000000000900010073797a300000000020000000030a010300000000000000000a0000020900030073797a300000000044010000080a01080000000000000000010000073a00074032e97608c07b8f34d704cc507d07a8d4c429672a9b6841e516ce194f03354b3c46a930469ce36ee8391a02352a70d543c633dc17a9d300007900074012119f33dbd27dbba871f33b8206fc0a59dac6df96baf86f3deffa20b8a2b13fa2fbc917a33ad4b9dc903553ff1e7533cd9d1e3f6a3248b10a63552977fab38d9ad7409cbd223b094a0bb6f0884c8839890d122f9b9963668c97749b2304852a8d461ccc39dc307f41ac41688a4f2d64a916dc532d00000008000a40000000000900010073797a30"], 0x248}}, 0x0) 4.026193586s ago: executing program 1 (id=6136): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0x0, 0x1) connect$inet6(0xffffffffffffffff, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x7) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_pktinfo(r2, 0x0, 0x50, 0x0, &(0x7f0000000040)=0x54) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0xa2602, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000000c0)={0x1, 0x2}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140)={0x2, 0x1}, 0x2) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f00000000c0)={"0e00", 0x0, 0x6, 0x2, 0x0, 0x0, "f700000000000000001000", '\x00\x00\a\x00', "0300", '\x00', ["50d5c2a7c5ae5cace40000b6", "808e88e2e9ffffffffff00", "0c436d743c97c443084000", "ff81000000008000"]}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000040)={{@local}, @local, 0x8, 0x6, 0x343, 0xffffffff7fffffe1, 0x7, 0x100, 0x9}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={0x0, 0x0, 0x1a, 0x0, 0x1000, 0x0, 0x0, @void, @value}, 0x28) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[], 0x294}, 0x1, 0x0, 0x0, 0x400}, 0x4020054) socket$netlink(0x10, 0x3, 0x0) 4.025366534s ago: executing program 2 (id=6137): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x123000, 0x0) unshare(0x6a040000) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0xa131, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@ipv4_newrule={0x24, 0x20, 0x1, 0x0, 0x0, {}, [@FRA_GENERIC_POLICY=@FRA_L3MDEV={0x5, 0x13, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4044040}, 0x0) r1 = socket(0x840000000002, 0x3, 0xfa) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000340)='/sys/power/resume_offset', 0x200, 0x0) read$FUSE(r2, &(0x7f00000007c0)={0x2020}, 0x2020) connect$inet(r1, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r1, &(0x7f0000005240), 0x4000095, 0x0) getpeername$l2tp6(r1, 0x0, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x140, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r3, 0xc018937e, &(0x7f0000001040)={{0x1, 0x1, 0x1018}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00'}) 2.175552418s ago: executing program 4 (id=6138): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0x0, 0x1) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @private1, 0x8002}, 0x36) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x7) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_pktinfo(r2, 0x0, 0x50, 0x0, &(0x7f0000000040)=0x54) r3 = openat$userio(0xffffffffffffff9c, 0x0, 0xa2602, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000000c0)={0x1, 0x2}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140)={0x2, 0x1}, 0x2) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, 0x0) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000040)={{@local}, @local, 0x8, 0x6, 0x343, 0xffffffff7fffffe1, 0x7, 0x100, 0x9}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={0x0, 0x0, 0x1a, 0x0, 0x1000, 0x0, 0x0, @void, @value}, 0x28) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[], 0x294}, 0x1, 0x0, 0x0, 0x400}, 0x4020054) socket$netlink(0x10, 0x3, 0x0) 2.174672126s ago: executing program 2 (id=6148): bpf$MAP_CREATE(0x0, 0x0, 0x48) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x891c, 0x0) setpgid(0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r1 = gettid() mq_open(&(0x7f0000000200)='{\t\x00'/17, 0x40, 0x31, &(0x7f0000000140)={0xa4b5, 0x1, 0x3d, 0x7}) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) getsockopt(r0, 0x4051, 0x5, &(0x7f0000000340)=""/154, &(0x7f0000000040)=0x9a) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r2, &(0x7f0000000780)=ANY=[@ANYBLOB="080008000600020003001400000045f70fc000640000042f90780a010100ac1414aa0c21"], 0xfce) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000100)={0x1d, r5}, 0x18) connect$can_j1939(r4, &(0x7f0000000080)={0x1d, r5, 0x0, {0x1, 0xf0}, 0x1}, 0x18) sendmsg$can_j1939(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)='.', 0x1a000}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.890377979s ago: executing program 0 (id=6139): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="1800000016002dbd700046618b9873001200000000000002300000"], 0x18}}, 0x0) 1.777340701s ago: executing program 2 (id=6141): r0 = socket(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22042, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x1000, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0xcc3) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f00000000c0)=0xc) prctl$PR_SCHED_CORE(0x3e, 0x3, r4, 0x1, 0x0) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000cc0)=ANY=[@ANYBLOB="120100004f92b90857152077ebb7000000010902120001000000000904"], 0x0) syz_usb_control_io(r5, 0x0, &(0x7f0000000f80)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e00)={0x40, 0x13, 0x6, @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r5, 0x0, &(0x7f0000001740)={0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x40, 0x19, 0x2, "0200"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000480)={0x18, &(0x7f0000000200)=ANY=[@ANYBLOB="200ecf"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) getuid() sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) socket$kcm(0x2, 0x3, 0x2) r6 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r6, 0x0, 0x60, &(0x7f0000000e80)={'filter\x00', 0xb001, 0x4, 0x3b0, 0x0, 0x10c, 0x1f0, 0x2d0, 0x2d0, 0x2d0, 0x7fffffe, 0x0, {[{{@uncond, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x2, 0x1}}}, {{@uncond, 0xbc, 0xe4, 0x0, {0x0, 0x1e03}}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x46e, 0xfffc}}}, {{@uncond, 0xbc, 0xe0}, @unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0x31caf518}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3fc) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) 1.750897589s ago: executing program 0 (id=6142): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x44, 0x10, 0x437, 0x70bd26, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6, 0x12, 0x4e22}, @IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x11}]}}}]}, 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000040)=@mangle={'mangle\x00', 0x64, 0x6, 0x560, 0x0, 0xc8, 0x0, 0x0, 0x0, 0x498, 0x498, 0x498, 0x498, 0x498, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'veth1\x00', 'veth1_vlan\x00'}, 0x0, 0xa4, 0xc8, 0x0, {0x0, 0x3a010000}}, @HL={0x24}}, {{@ipv6={@private1, @loopback, [], [], 'tunl0\x00', 'bridge_slave_1\x00'}, 0x0, 0xa4, 0xc8}, @common=@unspec=@STANDARD={0x24, '\x00', 0x0, 0x3ac}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00'}, 0x0, 0x130, 0x154, 0x0, {}, [@common=@srh1={{0x8c}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @private1, @mcast2}}]}, @unspec=@CHECKSUM={0x24}}, {{@ipv6={@mcast2, @mcast2, [], [], 'pimreg0\x00', 'vcan0\x00', {}, {}, 0x0, 0x0, 0x1}, 0x0, 0xa4, 0xc8}, @common=@inet=@SYNPROXY={0x24}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa4, 0xec}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'pim6reg1\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x5bc) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') syz_open_dev$tty20(0xc, 0x4, 0x1) fchdir(r3) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) syz_mount_image$fuse(0x0, &(0x7f0000002080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x2210052, 0x0, 0x1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfeb4}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f0000000bc0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d288168eda8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f117bdfe457f75e6f8200600f1a0e0f7643ba55fb18556858d4a4245b1e6caeeb0e52d05c3cb05983f295f1aae214d997a89a73e05534fddfde6271facada8f73b800845f8771c1e137412d98a2ad0844fbb3333c33a2884d6612424f96c337de938711ef7b9e98647a6b1aab208f998f96d9b3193ec72a89231e1acf6c4313bc6e45eff28305127bb773c2da0dcecf671a29647fac07844794", 0x169}, {&(0x7f00000002c0)="ce7ccd2d2c944169dc2b5dc4d1ffa850037245431cc5946071313f750701a08961f7fd07f408eb9136351299f22ffc3dfcc5343fa0f2", 0x36}, {&(0x7f0000000880)="8409220927e07db54a2722fa855b95004eb46eaeea27299765f609fd9a87344a8aaeb4b0aaba401545a2ec1fcc4239a328173fdb7698d2b055debc3ddbf4399afcd6838e8cdb5932b5f09863bf1f794b2ddce1b43cf8f1f7a251e276374f4846610ef2659c918492a7beddeb614e8f3d1680aac2a6dd735b00f3185535a2023e92a8514bd3f6b3e143ebc13026046616fa087bc64d0ce6210f09209c554b7edc302c4006db6fcd8fe1b310bd4f7b8ef216a5aea03173517f67a402c81fde4fa30076dc00f50faea04a8960a2e63fbd0841f0f5748907b5b959e3e9e0923e1030"}, {&(0x7f0000000300)="1179189127c144acffec4d"}, {&(0x7f0000000340)="b957851c8f100096878ec4adc3a1"}], 0x4, &(0x7f0000000380)=[@op={0x0, 0x117, 0x3, 0x1}, @assoc={0x0, 0x117, 0x4, 0x5}, @iv={0x0, 0x117, 0x2, 0x0, "f4557afeb0e1196f866757ac4f155f716d514ac4e5d301a9052d59c559dd36c195ab"}, @assoc={0x0, 0x117, 0x4, 0xf71f}, @op={0x0, 0x117, 0x3, 0x1}, @assoc={0x0, 0x117, 0x4, 0x5}]}], 0x1, 0x24040881) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 1.438720462s ago: executing program 5 (id=6143): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'vlan0\x00', 0x0}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000000200)=0x5, 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000040)=0x200, 0x4) r2 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r2, &(0x7f00000000c0)="3f030e03e8aa121206001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0x48, 0x0, &(0x7f0000000540)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) r3 = open(&(0x7f0000000100)='./file1\x00', 0x141242, 0x1b4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000580)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0xfff1, 0xfff3}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x2}, @TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x48c8}, 0x20004804) pwrite64(r3, &(0x7f0000000940)='2', 0x1, 0x8000c61) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r8, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) shutdown(r8, 0x1) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r9, 0x84, 0xc, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r8, 0x84, 0x7c, &(0x7f0000000280)={r10, 0x1, 0xe6}, 0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r3, 0x84, 0x6c, &(0x7f0000000240)={r10, 0xc3, "1cf378135de40cead425cfd36c863fb7c1ec5cf755b21250407fb0f99d1eb9a6b7f1293c75e56ebd7dc8caa22cbed457f799b9a3f3f906515c1a7296f268abaceeb8f1319cd231d3163fccf7a8ab01c8e7ab3827fc5f7d871a1fec8f79a6456bd60cbe54eea338ebb9f3ec540b892d4b9b4151a2bef38b005ab5c9160cd3b69ad9cb0de27c08bed8053bc9c11f5a9db9c2bce23059041252d574868ab6fbf7c00c1625b5f8bba0bf6be1e1d869b36ddea360ec30786e91ab10e03be05bb3d41e9e98f1"}, &(0x7f00000001c0)=0xcb) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000000)={r10, 0x5eb, 0x10}, 0xc) 709.201598ms ago: executing program 5 (id=6144): socket$alg(0x26, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)={{0x14}, [@NFT_MSG_DELSET={0xa0, 0xb, 0xa, 0x301, 0x0, 0x0, {0x3}, [@NFTA_SET_EXPR={0x2c, 0x11, 0x0, 0x1, @masq={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0xb}, @NFTA_MASQ_REG_PROTO_MIN={0x8}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0xd}]}}}, @NFTA_SET_POLICY={0x8}, @NFTA_SET_EXPRESSIONS={0x44, 0x12, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @reject={{0xb}, @void}}, {0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}, {0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x86}, @NFTA_EXTHDR_DREG={0x0, 0x1, 0x1, 0x0, 0x8}]}}}]}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x100}]}, @NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x801, 0x0, 0x0, {0x5, 0x0, 0x5}, [@NFTA_SET_EXPRESSIONS={0x34, 0x12, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x16}]}}}, {0x7, 0x1, 0x0, 0x1, @notrack={{0xc}, @void}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x108}]}], {0x14}}, 0x118}}, 0x0) 552.698018ms ago: executing program 0 (id=6145): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f00000001c0), 0x0, 0x0, 0x1) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @private1, 0x8002}, 0x36) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x7) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_pktinfo(r2, 0x0, 0x50, 0x0, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0xa2602, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000000c0)={0x1, 0x2}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140)={0x2, 0x1}, 0x2) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f00000000c0)={"0e00", 0x0, 0x6, 0x2, 0x0, 0x0, "f700000000000000001000", '\x00\x00\a\x00', "0300", '\x00', ["50d5c2a7c5ae5cace40000b6", "808e88e2e9ffffffffff00", "0c436d743c97c443084000", "ff81000000008000"]}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000040)={{@local}, @local, 0x8, 0x6, 0x343, 0xffffffff7fffffe1, 0x7, 0x100, 0x9}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={0x0, 0x0, 0x1a, 0x0, 0x1000, 0x0, 0x0, @void, @value}, 0x28) socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0x0) 434.164922ms ago: executing program 5 (id=6146): keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_load={'load ', 'ecryptfs', 0x20, 'user:', 'trusted:', 0x20, 0x40}, 0x32, 0xfffffffffffffffc) add_key(0x0, 0x0, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x12000) set_mempolicy(0x3, &(0x7f0000000040)=0xffffffffffffffff, 0xd) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000004, 0x4031, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_RENAMEAT={0x23, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(0xffffffffffffffff, 0x3516, 0x4, 0x0, 0x0, 0x0) mremap(&(0x7f00000a7000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000469000/0x4000)=nil) munlockall() 0s ago: executing program 4 (id=6147): keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_load={'load ', 'ecryptfs', 0x20, 'user:', 'trusted:', 0x20, 0x40}, 0x32, 0xfffffffffffffffc) add_key(0x0, 0x0, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x12000) set_mempolicy(0x3, &(0x7f0000000040)=0xffffffffffffffff, 0xd) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000004, 0x4031, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_RENAMEAT={0x23, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(0xffffffffffffffff, 0x3516, 0x4, 0x0, 0x0, 0x0) mremap(&(0x7f00000a7000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000469000/0x4000)=nil) munlockall() (fail_nth: 1) kernel console output (not intermixed with test programs): z [ 1640.793072][ T5922] usb usb5-port1: unable to enumerate USB device [ 1640.969254][ T24] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1640.977743][T24694] misc userio: The device must be registered before sending interrupts [ 1641.041662][ T24] usb 3-1: USB disconnect, device number 37 [ 1641.240228][T23026] udevd[23026]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1641.760735][T24701] FAULT_INJECTION: forcing a failure. [ 1641.760735][T24701] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1641.784730][T24701] CPU: 1 UID: 0 PID: 24701 Comm: syz.3.5927 Not tainted 6.15.0-rc2-syzkaller-00488-g6fea5fabd332 #0 PREEMPT(full) [ 1641.784756][T24701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 1641.784766][T24701] Call Trace: [ 1641.784772][T24701] [ 1641.784778][T24701] dump_stack_lvl+0x241/0x360 [ 1641.784807][T24701] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1641.784830][T24701] ? __pfx__printk+0x10/0x10 [ 1641.784862][T24701] should_fail_ex+0x424/0x570 [ 1641.784889][T24701] _copy_from_user+0x2d/0xb0 [ 1641.784910][T24701] do_fb_ioctl+0x30c/0x7e0 [ 1641.784934][T24701] ? __pfx_do_fb_ioctl+0x10/0x10 [ 1641.784986][T24701] ? tomoyo_path_number_perm+0x215/0x790 [ 1641.785010][T24701] ? __lock_acquire+0xad5/0xd80 [ 1641.785033][T24701] ? tomoyo_path_number_perm+0x215/0x790 [ 1641.785056][T24701] fb_compat_ioctl+0x2d8/0xce0 [ 1641.785084][T24701] ? __pfx_fb_compat_ioctl+0x10/0x10 [ 1641.785120][T24701] ? __fget_files+0x2a/0x420 [ 1641.785135][T24701] ? __fget_files+0x2a/0x420 [ 1641.785152][T24701] ? __fget_files+0x2a/0x420 [ 1641.785173][T24701] __ia32_compat_sys_ioctl+0x561/0xc90 [ 1641.785196][T24701] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1641.785218][T24701] ? __fget_files+0x2a/0x420 [ 1641.785236][T24701] ? fput+0x9b/0xd0 [ 1641.785252][T24701] ? ksys_write+0x275/0x2d0 [ 1641.785279][T24701] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1641.785296][T24701] ? lockdep_hardirqs_on+0x9d/0x150 [ 1641.785313][T24701] __do_fast_syscall_32+0xb4/0x110 [ 1641.785330][T24701] ? exc_page_fault+0x5f8/0x920 [ 1641.785348][T24701] do_fast_syscall_32+0x34/0x80 [ 1641.785365][T24701] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1641.785384][T24701] RIP: 0023:0xf7f07539 [ 1641.785398][T24701] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1641.785412][T24701] RSP: 002b:00000000f502655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1641.785428][T24701] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000004601 [ 1641.785439][T24701] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 1641.785448][T24701] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1641.785457][T24701] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1641.785466][T24701] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1641.785487][T24701] [ 1641.931599][ T976] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 1642.082186][ T24] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 1642.263628][ T24] usb 3-1: config 0 has an invalid interface number: 117 but max is 0 [ 1642.272165][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1642.286294][ T24] usb 3-1: config 0 has no interface number 0 [ 1642.293544][ T24] usb 3-1: too many endpoints for config 0 interface 117 altsetting 0: 239, using maximum allowed: 30 [ 1642.308062][ T24] usb 3-1: config 0 interface 117 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 1642.319983][ T24] usb 3-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 239 [ 1642.321630][ T976] usb 5-1: Using ep0 maxpacket: 8 [ 1642.337079][ T24] usb 3-1: New USB device found, idVendor=0742, idProduct=2009, bcdDevice=61.46 [ 1642.355151][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1642.365513][ T24] usb 3-1: Product: syz [ 1642.369999][ T24] usb 3-1: Manufacturer: syz [ 1642.376880][ T24] usb 3-1: SerialNumber: syz [ 1642.388406][ T24] usb 3-1: config 0 descriptor?? [ 1642.398415][ T976] usb 5-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1642.408932][ T24] HFC-S_USB 3-1:0.117: probe with driver HFC-S_USB failed with error -5 [ 1642.420846][ T976] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1642.431778][ T976] usb 5-1: Product: syz [ 1642.435996][ T976] usb 5-1: Manufacturer: syz [ 1642.440627][ T976] usb 5-1: SerialNumber: syz [ 1642.478003][ T976] usb 5-1: config 0 descriptor?? [ 1642.488069][ T976] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1642.502099][ T5922] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 1642.522665][ T10] usb 1-1: USB disconnect, device number 84 [ 1642.679084][ T5922] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1642.705614][ T10] usb 3-1: USB disconnect, device number 38 [ 1642.724503][ T5922] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1642.735184][ T5922] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1642.746053][ T5922] usb 2-1: SerialNumber: syz [ 1642.982146][ T3410] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 1643.003770][ T5922] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 1643.039511][ T5922] usb 2-1: USB disconnect, device number 87 [ 1643.047659][T22579] net_ratelimit: 26 callbacks suppressed [ 1643.047705][T22579] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1643.068819][T22579] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1643.083574][T22579] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1643.098617][T22579] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1643.163295][ T3410] usb 4-1: Using ep0 maxpacket: 16 [ 1643.178528][ T3410] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1643.201369][ T3410] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1643.213602][ T3410] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1643.234388][ T3410] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1643.250590][ T3410] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1643.278957][ T3410] usb 4-1: Product: syz [ 1643.286102][ T3410] usb 4-1: Manufacturer: syz [ 1643.290813][ T3410] usb 4-1: SerialNumber: syz [ 1643.342209][ T24] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 1643.472145][ T24] usb 1-1: device descriptor read/64, error -71 [ 1643.634284][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1643.649108][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1643.663803][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1643.678212][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1643.720782][ T3410] usb 4-1: 2:1 : format type 0 is detected, processed as PCM [ 1643.752060][ T24] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 1643.881987][ T24] usb 1-1: device descriptor read/64, error -71 [ 1643.894509][ T3410] usb 4-1: 2:1: cannot set freq 9338507 to ep 0x82 [ 1644.000689][ T3410] usb 4-1: USB disconnect, device number 61 [ 1644.007446][ T24] usb usb1-port1: attempt power cycle [ 1644.256843][T22579] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1644.271747][T22579] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1644.314362][T21895] udevd[21895]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1644.352112][ T24] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 1644.383824][ T24] usb 1-1: device descriptor read/8, error -71 [ 1644.446036][T24738] misc userio: The device must be registered before sending interrupts [ 1644.651643][ T24] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 1644.681932][ T976] gspca_sonixj: reg_r err -110 [ 1644.682449][ T24] usb 1-1: device descriptor read/8, error -71 [ 1644.797238][ T976] sonixj 5-1:0.0: probe with driver sonixj failed with error -110 [ 1644.831959][ T24] usb usb1-port1: unable to enumerate USB device [ 1645.221029][ T976] usb 5-1: USB disconnect, device number 92 [ 1646.071871][T23024] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 1646.331992][T23024] usb 3-1: config 0 has no interfaces? [ 1646.359510][T23024] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1646.407688][T23024] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1646.458538][T23024] usb 3-1: Product: syz [ 1646.480536][T23024] usb 3-1: Manufacturer: syz [ 1646.504874][T23024] usb 3-1: SerialNumber: syz [ 1646.518214][T23024] usb 3-1: config 0 descriptor?? [ 1646.731678][T15308] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 1646.917616][T15308] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1646.964664][T15308] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1646.991736][T15308] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1646.999897][T15308] usb 5-1: SerialNumber: syz [ 1647.162014][T23024] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 1647.176592][T24771] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5944'. [ 1647.348754][T15308] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -71 [ 1647.362328][T23024] usb 4-1: Using ep0 maxpacket: 32 [ 1647.379365][T15308] usb 5-1: USB disconnect, device number 93 [ 1647.400466][T23024] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1647.439007][T23024] usb 4-1: config 5 has an invalid interface number: 61 but max is 0 [ 1647.490799][T23024] usb 4-1: config 5 has no interface number 0 [ 1647.524996][T23024] usb 4-1: config 5 interface 61 altsetting 6 bulk endpoint 0x3 has invalid maxpacket 64 [ 1647.571892][T23024] usb 4-1: config 5 interface 61 has no altsetting 0 [ 1647.618406][T23024] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice= 0.0a [ 1647.646785][T23024] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1647.669158][T23024] usb 4-1: Product: syz [ 1647.678740][T23024] usb 4-1: Manufacturer: syz [ 1647.689454][T23024] usb 4-1: SerialNumber: syz [ 1647.754648][T24768] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1647.969771][T24783] misc userio: The device must be registered before sending interrupts [ 1648.081673][T15308] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 1648.098048][T14763] net_ratelimit: 26 callbacks suppressed [ 1648.098068][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1648.119049][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1648.134124][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1648.148571][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1648.207144][T23024] ath6kl: Failed to submit usb control message: -71 [ 1648.224339][T23024] ath6kl: unable to send the bmi data to the device: -71 [ 1648.271046][T23024] ath6kl: Unable to send get target info: -71 [ 1648.287062][T23024] ath6kl: Failed to init ath6kl core: -71 [ 1648.298775][T23024] ath6kl_usb 4-1:5.61: probe with driver ath6kl_usb failed with error -71 [ 1648.314724][T23024] usb 4-1: USB disconnect, device number 62 [ 1648.321696][T15308] usb 2-1: Using ep0 maxpacket: 8 [ 1648.331193][T15308] usb 2-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1648.341199][T15308] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1648.392797][T15308] usb 2-1: Product: syz [ 1648.435931][T15308] usb 2-1: Manufacturer: syz [ 1648.458814][T15308] usb 2-1: SerialNumber: syz [ 1648.568540][T15308] usb 2-1: config 0 descriptor?? [ 1648.613072][T15308] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1648.683933][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1648.698632][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1648.714019][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1648.729063][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1649.181432][ T3410] usb 3-1: USB disconnect, device number 39 [ 1649.351004][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1649.365854][ T12] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1649.900592][T24808] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5964'. [ 1650.413367][T24814] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1650.520118][T24814] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1650.602395][ T3410] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 1650.671681][T15308] gspca_sonixj: i2c_w8 err -110 [ 1650.732460][T15308] sonixj 2-1:0.0: probe with driver sonixj failed with error -110 [ 1650.761721][ T3410] usb 1-1: Using ep0 maxpacket: 16 [ 1650.783546][ T3410] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1650.818990][ T3410] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1650.877822][ T3410] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1650.919726][ T3410] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1650.951149][ T3410] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1650.978224][ T3410] usb 1-1: Product: syz [ 1651.002257][ T3410] usb 1-1: Manufacturer: syz [ 1651.008170][ T3410] usb 1-1: SerialNumber: syz [ 1651.255298][ T3410] usb 1-1: 0:2 : does not exist [ 1651.284013][ T3410] usb 1-1: 1:0: cannot get min/max values for control 4 (id 1) [ 1651.300492][ T5853] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1651.311373][ T5853] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1651.319965][ T5853] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1651.329624][ T5853] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1651.338292][ T5853] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1651.410368][ T3410] usb 1-1: USB disconnect, device number 89 [ 1651.449546][T15308] usb 2-1: USB disconnect, device number 88 [ 1651.603030][T23026] udevd[23026]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1652.365801][T24824] chnl_net:caif_netlink_parms(): no params data found [ 1652.618524][T24844] misc userio: The device must be registered before sending interrupts [ 1653.012343][ T976] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 1653.193432][ T3027] net_ratelimit: 27 callbacks suppressed [ 1653.193452][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1653.214241][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1653.228905][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1653.243779][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1653.433216][ T5847] Bluetooth: hci3: command tx timeout [ 1653.556800][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1653.960767][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1653.975435][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1653.990087][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1654.005052][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1654.146567][ T976] usb 1-1: config 0 has no interfaces? [ 1654.165285][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1654.220991][ T976] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1654.291040][ T976] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1654.329284][T24824] bridge0: port 1(bridge_slave_0) entered blocking state [ 1654.338775][ T976] usb 1-1: Product: syz [ 1654.369281][ T976] usb 1-1: Manufacturer: syz [ 1654.374326][T24824] bridge0: port 1(bridge_slave_0) entered disabled state [ 1654.402286][ T976] usb 1-1: SerialNumber: syz [ 1654.409026][T24824] bridge_slave_0: entered allmulticast mode [ 1654.416683][ T976] usb 1-1: config 0 descriptor?? [ 1654.428301][T24824] bridge_slave_0: entered promiscuous mode [ 1654.554590][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1654.621938][T24824] bridge0: port 2(bridge_slave_1) entered blocking state [ 1654.660580][T24824] bridge0: port 2(bridge_slave_1) entered disabled state [ 1654.672139][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1654.686672][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1654.711882][T24824] bridge_slave_1: entered allmulticast mode [ 1654.723426][T24824] bridge_slave_1: entered promiscuous mode [ 1654.917856][ T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1654.989873][T24824] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1655.042805][T24824] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1655.346096][T24824] team0: Port device team_slave_0 added [ 1655.507400][T24824] team0: Port device team_slave_1 added [ 1655.514635][ T5847] Bluetooth: hci3: command tx timeout [ 1655.648185][T24840] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5972'. [ 1655.657257][T15308] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 1655.673483][T24824] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1655.692315][T24824] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1655.711566][ T10] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 1655.733917][T24824] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1655.812407][T15308] usb 2-1: Using ep0 maxpacket: 32 [ 1655.819959][T15308] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1655.856913][T15308] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1655.881633][T15308] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1655.906650][T15308] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1655.962005][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 1655.988236][T15308] usb 2-1: config 0 descriptor?? [ 1655.997107][T24824] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1656.017945][T24824] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1656.066055][ T10] usb 3-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1656.090452][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1656.093960][T24824] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1656.130797][ T10] usb 3-1: Product: syz [ 1656.158255][ T10] usb 3-1: Manufacturer: syz [ 1656.201576][ T10] usb 3-1: SerialNumber: syz [ 1656.224093][ T10] usb 3-1: config 0 descriptor?? [ 1656.247689][ T13] bridge0: port 3(batadv0) entered disabled state [ 1656.257430][ T10] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1656.289676][ T13] bridge_slave_1: left allmulticast mode [ 1656.306504][T24859] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1656.329807][ T13] bridge_slave_1: left promiscuous mode [ 1656.351061][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 1656.387468][ T13] bridge_slave_0: left allmulticast mode [ 1656.396893][ T13] bridge_slave_0: left promiscuous mode [ 1656.417122][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 1656.420111][T24859] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1656.647627][T15308] usbhid 2-1:0.0: can't add hid device: -71 [ 1656.661826][T15308] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1656.712770][T15308] usb 2-1: USB disconnect, device number 89 [ 1657.523781][ T13] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1657.600633][ T5847] Bluetooth: hci3: command tx timeout [ 1657.643798][ T5922] usb 1-1: USB disconnect, device number 90 [ 1658.005384][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1658.020232][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1658.033276][ T13] bond0 (unregistering): Released all slaves [ 1658.331583][ T10] gspca_sonixj: i2c_w8 err -110 [ 1658.348840][T24824] hsr_slave_0: entered promiscuous mode [ 1658.358158][T24824] hsr_slave_1: entered promiscuous mode [ 1658.382771][T24824] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1658.384128][ T36] net_ratelimit: 26 callbacks suppressed [ 1658.384148][ T36] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1658.390371][T24824] Cannot create hsr debugfs directory [ 1658.416320][ T36] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1658.430877][ T36] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1658.445284][ T36] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1658.459775][ T10] sonixj 3-1:0.0: probe with driver sonixj failed with error -110 [ 1658.513612][T24887] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5984'. [ 1658.771553][T23024] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 1658.863942][ T13] batman_adv: batadv0: Removing interface: dummy0 [ 1658.889112][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1658.925881][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1658.946184][T23024] usb 1-1: config 0 has no interfaces? [ 1658.961182][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1658.972306][T23024] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1658.989926][T23024] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1659.004744][T23024] usb 1-1: Product: syz [ 1659.017833][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1659.021519][T23024] usb 1-1: Manufacturer: syz [ 1659.035610][ T10] usb 3-1: USB disconnect, device number 40 [ 1659.050576][T23024] usb 1-1: SerialNumber: syz [ 1659.090370][T23024] usb 1-1: config 0 descriptor?? [ 1659.167708][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1659.182932][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1659.198492][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1659.213068][ T13] veth0_macvtap: left promiscuous mode [ 1659.213357][ T13] veth1_vlan: left promiscuous mode [ 1659.213499][ T13] veth0_vlan: left promiscuous mode [ 1659.218825][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1659.322732][T24905] misc userio: The device must be registered before sending interrupts [ 1659.615716][T24910] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5986'. [ 1659.678191][T24911] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5983'. [ 1659.689031][ T5847] Bluetooth: hci3: command tx timeout [ 1659.934883][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1659.949418][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1660.641583][ T10] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 1660.801737][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 1660.816591][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1660.843003][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1660.874799][ T10] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1660.899045][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1660.927161][ T10] usb 2-1: config 0 descriptor?? [ 1661.173417][T24920] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1661.207318][T24920] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1661.271012][ T10] usbhid 2-1:0.0: can't add hid device: -71 [ 1661.281320][ T10] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1661.320349][ T10] usb 2-1: USB disconnect, device number 90 [ 1661.768493][ T10] usb 1-1: USB disconnect, device number 91 [ 1662.116175][ T976] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 1662.440844][ T976] usb 3-1: config 0 has no interfaces? [ 1662.609384][ T976] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1662.629035][ T976] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1662.747340][ T976] usb 3-1: Product: syz [ 1662.755224][ T976] usb 3-1: Manufacturer: syz [ 1662.759889][ T976] usb 3-1: SerialNumber: syz [ 1662.897170][ T976] usb 3-1: config 0 descriptor?? [ 1663.275894][ T13] IPVS: stop unused estimator thread 0... [ 1663.577498][ T36] net_ratelimit: 26 callbacks suppressed [ 1663.577518][ T36] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1663.597763][ T36] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1663.612368][ T36] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1663.626769][ T36] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1663.664621][T24957] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5990'. [ 1664.041357][T24824] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1664.087377][T24824] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1664.118248][T24824] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1664.152407][T14760] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1664.167121][T14760] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1664.181689][T14760] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1664.196121][T14760] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1664.274218][T24824] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1664.873533][T24824] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1664.893888][ T36] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1664.908624][ T36] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1665.000196][T24824] 8021q: adding VLAN 0 to HW filter on device team0 [ 1665.062397][ T10] usb 3-1: USB disconnect, device number 41 [ 1665.064235][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 1665.075552][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1665.138119][ T2134] bridge0: port 2(bridge_slave_1) entered blocking state [ 1665.145447][ T2134] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1665.455809][T24824] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1665.629745][T24824] veth0_vlan: entered promiscuous mode [ 1665.677875][ T5853] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1665.688396][ T5853] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1665.698360][ T5853] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1665.713320][ T5853] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1665.735569][ T5853] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1665.742237][T24824] veth1_vlan: entered promiscuous mode [ 1665.967681][T24824] veth0_macvtap: entered promiscuous mode [ 1666.037056][T24824] veth1_macvtap: entered promiscuous mode [ 1666.044828][T24991] misc userio: The device must be registered before sending interrupts [ 1666.284571][T24824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1666.327045][T24824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1666.359974][T24824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1666.392204][T24824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1666.413541][T24824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1666.451396][T24824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1666.480984][T24824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1666.503533][T24824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1666.521575][T24824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1666.545974][T24824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1666.581791][T24824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1666.621912][T24824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1666.636375][T24824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1666.666361][T24824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1666.709556][T24824] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1666.854114][T24824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1666.905390][T24824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1666.972952][T24824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1667.001536][T24824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1667.049911][T24824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1667.070357][T24824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1667.081291][T24824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1667.092229][T24824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1667.102612][T24824] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1667.114143][T24824] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1667.127555][T24824] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1667.233826][T24824] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1667.258239][T24824] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1667.289898][T24824] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1667.311919][T24824] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1667.706660][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1667.741883][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1667.832128][ T5853] Bluetooth: hci1: command tx timeout [ 1667.986813][T14760] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1668.012298][T14760] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1668.062128][T24986] chnl_net:caif_netlink_parms(): no params data found [ 1668.422307][T25032] sctp: [Deprecated]: syz.1.6005 (pid 25032) Use of int in maxseg socket option. [ 1668.422307][T25032] Use struct sctp_assoc_value instead [ 1668.440786][T25031] misc userio: The device must be registered before sending interrupts [ 1668.581661][ T24] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1668.668283][T14760] net_ratelimit: 26 callbacks suppressed [ 1668.668314][T14760] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1668.668344][T14760] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1668.668368][T14760] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1668.668392][T14760] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1668.691748][T24986] bridge0: port 1(bridge_slave_0) entered blocking state [ 1668.691834][T24986] bridge0: port 1(bridge_slave_0) entered disabled state [ 1668.692026][T24986] bridge_slave_0: entered allmulticast mode [ 1668.693984][T24986] bridge_slave_0: entered promiscuous mode [ 1668.734708][T24986] bridge0: port 2(bridge_slave_1) entered blocking state [ 1668.734794][T24986] bridge0: port 2(bridge_slave_1) entered disabled state [ 1668.735008][T24986] bridge_slave_1: entered allmulticast mode [ 1668.736615][T24986] bridge_slave_1: entered promiscuous mode [ 1668.776980][ T24] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1668.778266][ T24] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1668.778307][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1668.778332][ T24] usb 5-1: SerialNumber: syz [ 1669.201206][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1669.201247][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1669.201271][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1669.201295][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1669.319061][T24986] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1669.322035][ T24] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -71 [ 1669.341141][ T24] usb 5-1: USB disconnect, device number 94 [ 1669.347281][T24986] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1669.712345][T24986] team0: Port device team_slave_0 added [ 1669.714980][T24986] team0: Port device team_slave_1 added [ 1669.723706][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1669.723734][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1669.904918][T24986] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1669.904937][T24986] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1669.904959][T24986] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1669.908405][T24986] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1669.908421][T24986] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1669.908443][T24986] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1669.916205][ T5853] Bluetooth: hci1: command tx timeout [ 1670.469572][T24986] hsr_slave_0: entered promiscuous mode [ 1670.494074][T24986] hsr_slave_1: entered promiscuous mode [ 1670.500616][T24986] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1670.543065][ T24] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 1670.552552][T24986] Cannot create hsr debugfs directory [ 1670.712214][ T3410] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 1670.747989][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 1670.770133][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1670.808006][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1670.866480][ T3410] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1670.881728][ T24] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1670.892824][ T3410] usb 5-1: config 6 has an invalid interface number: 200 but max is 0 [ 1670.908103][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1670.916358][ T3410] usb 5-1: config 6 has no interface number 0 [ 1670.930626][ T3410] usb 5-1: config 6 interface 200 has no altsetting 0 [ 1670.942869][ T24] usb 3-1: config 0 descriptor?? [ 1670.953636][ T3410] usb 5-1: New USB device found, idVendor=05d8, idProduct=810c, bcdDevice=18.5f [ 1671.004561][ T3410] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1671.035320][ T3410] usb 5-1: Product: syz [ 1671.046397][ T3410] usb 5-1: Manufacturer: syz [ 1671.099407][ T3410] usb 5-1: SerialNumber: syz [ 1671.176287][T25053] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1671.187319][T25053] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1671.230265][ T24] usbhid 3-1:0.0: can't add hid device: -71 [ 1671.239439][ T24] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1671.272179][ T24] usb 3-1: USB disconnect, device number 42 [ 1671.318863][T25062] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6003'. [ 1671.489814][T24986] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1671.517517][T24986] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1671.580859][T24986] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1671.597864][ T3410] dvb-usb: found a 'Artec T14 - USB2.0 DVB-T' in warm state. [ 1671.600930][T24986] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1671.620077][ T3410] dvb-usb: bulk message failed: -71 (3/0) [ 1671.643184][ T3410] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1671.663456][ T3410] dvbdev: DVB: registering new adapter (Artec T14 - USB2.0 DVB-T) [ 1671.671402][ T3410] usb 5-1: media controller created [ 1671.713640][ T3410] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1671.756547][ T3410] dvb-usb: bulk message failed: -71 (6/0) [ 1671.772569][ T3410] dvb-usb: bulk message failed: -71 (6/0) [ 1671.791681][ T3410] dvb-usb: no frontend was attached by 'Artec T14 - USB2.0 DVB-T' [ 1671.801892][T15308] usb 1-1: new full-speed USB device number 92 using dummy_hcd [ 1671.861015][ T3410] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input131 [ 1671.907217][ T3410] dvb-usb: schedule remote query interval to 150 msecs. [ 1671.926600][T24986] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1671.931301][ T3410] dvb-usb: Artec T14 - USB2.0 DVB-T successfully initialized and connected. [ 1671.968715][T15308] usb 1-1: not running at top speed; connect to a high speed hub [ 1671.978438][T25066] vim2m vim2m.0: Fourcc format (0x47425247) invalid. [ 1671.978580][ T3410] usb 5-1: USB disconnect, device number 95 [ 1671.991883][ T5853] Bluetooth: hci1: command tx timeout [ 1671.999594][T24986] 8021q: adding VLAN 0 to HW filter on device team0 [ 1672.004583][T15308] usb 1-1: config 208 has an invalid interface number: 167 but max is 0 [ 1672.033969][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1672.041285][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1672.080633][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1672.087893][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1672.093837][T15308] usb 1-1: config 208 contains an unexpected descriptor of type 0x1, skipping [ 1672.108976][ T24] dvb-usb: bulk message failed: -19 (1/0) [ 1672.153143][ T24] dvb-usb: error while querying for an remote control event. [ 1672.162058][T15308] usb 1-1: config 208 has no interface number 0 [ 1672.169556][T25067] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6007'. [ 1672.191068][T15308] usb 1-1: config 208 interface 167 altsetting 7 endpoint 0xF has invalid maxpacket 2047, setting to 64 [ 1672.220743][T15308] usb 1-1: config 208 interface 167 altsetting 7 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 1672.250227][T24986] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1672.295905][T15308] usb 1-1: config 208 interface 167 altsetting 7 has a duplicate endpoint with address 0xA, skipping [ 1672.382308][T15308] usb 1-1: config 208 interface 167 altsetting 7 has an endpoint descriptor with address 0xB4, changing to 0x84 [ 1672.389286][T24986] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1672.436730][T15308] usb 1-1: config 208 interface 167 altsetting 7 endpoint 0x84 has invalid maxpacket 512, setting to 64 [ 1672.458895][ T3410] dvb-usb: Artec T14 - USB2.0 DVB-T successfully deinitialized and disconnected. [ 1672.478936][T15308] usb 1-1: config 208 interface 167 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 1672.521580][T15308] usb 1-1: config 208 interface 167 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 1672.560363][T15308] usb 1-1: config 208 interface 167 altsetting 7 has a duplicate endpoint with address 0x4, skipping [ 1672.619874][T24986] veth0_vlan: entered promiscuous mode [ 1672.621557][T15308] usb 1-1: config 208 interface 167 has no altsetting 0 [ 1672.670211][T24986] veth1_vlan: entered promiscuous mode [ 1672.675925][T15308] usb 1-1: New USB device found, idVendor=103e, idProduct=03e8, bcdDevice=9b.a6 [ 1672.732497][T15308] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1672.772075][T15308] usb 1-1: Product: ힾ즭誄⡕蛮쇅럤휎ㅍ嘢ᚹ빠铒ﭼꅩኀ䌁䜝已த觓엯丅恌턮譹魎눙䶏崖ꑕ㪤阆 [ 1672.831819][T24986] veth0_macvtap: entered promiscuous mode [ 1672.847521][T15308] usb 1-1: Manufacturer: 鋘ᤤ콸㚏扫唇㙩鈀甯ﺊῼ韨鰁⑚륵咮궁ၰ봕슌皡褟좖큡莮᭦!檶蘒宾宥ﻳͅ薉഑䃽揍ⶐ鼘ﯡﴧࢁؐ쭍ꎛЉ钨䝬ߵ㵣쬲䈄䅵痈뉩े榴ॏ₟↵몔㣙껨蕸핡討だ﮽켪蕕麲蜧낌䁥㽽꼕鏔盏떔脶鯀뿌鰭ኺ於益梧㭍உ哏댿㿔ﰩ刁 [ 1672.854231][T24986] veth1_macvtap: entered promiscuous mode [ 1672.959370][T15308] usb 1-1: SerialNumber: 泰刦刯敃ዴ识煥쮢茄敥⡝⍉࿏⛶漏䴍蓐磏䈴訣碨陯삩䌕挔⽸梥봑올ꐥ㬑쩈ݮ옦轥꟏쫨柝囓妣䦍욇㟭ٲ竱뽁䅚뮷罛猃㬟蝒ꅥ狏⌘葂一笟 [ 1673.039162][T25064] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1673.069468][T25064] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1673.159152][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1673.169744][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.184136][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1673.195472][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.207083][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1673.218191][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.228433][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1673.239484][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.272364][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1673.291902][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.310840][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1673.334580][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.360280][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1673.393634][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.413673][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1673.437395][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.459357][T24986] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1673.526129][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1673.565421][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.587297][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1673.632994][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.677695][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1673.705114][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.738049][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1673.771658][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.791590][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1673.810856][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.837193][T24986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1673.856883][T24986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1673.870448][T24986] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1673.917484][T24986] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1673.930085][T24986] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1673.940763][T22579] net_ratelimit: 31 callbacks suppressed [ 1673.940779][T22579] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1673.961079][T22579] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1673.975677][T22579] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1673.990103][T22579] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1674.009921][T24986] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1674.020942][T24986] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1674.076776][ T5853] Bluetooth: hci1: command tx timeout [ 1674.078263][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1674.089886][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1674.109008][T15308] ftdi_sio 1-1:208.167: FTDI USB Serial Device converter detected [ 1674.144243][T15308] ftdi_sio ttyUSB0: unknown device type: 0x9ba6 [ 1674.261712][T23024] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 1674.280580][T15308] usb 1-1: USB disconnect, device number 92 [ 1674.326199][T15308] ftdi_sio 1-1:208.167: device disconnected [ 1674.353493][T22579] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1674.388356][T22579] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1674.473299][T25093] misc userio: The device must be registered before sending interrupts [ 1674.520762][T23024] usb 3-1: config 0 has no interfaces? [ 1674.557637][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1674.572096][ T5922] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 1674.608391][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1674.623524][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1674.638975][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1674.653961][ T2134] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1674.698898][T23024] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1674.745101][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1674.755710][T23024] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1674.827012][T23024] usb 3-1: Product: syz [ 1674.831258][T23024] usb 3-1: Manufacturer: syz [ 1674.882187][T23024] usb 3-1: SerialNumber: syz [ 1674.896062][T23024] usb 3-1: config 0 descriptor?? [ 1675.071803][ T5922] usb 5-1: config 0 has no interfaces? [ 1675.278849][T25085] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6011'. [ 1675.294631][ T5922] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1675.570582][ T5922] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1675.901778][ T5922] usb 5-1: Product: syz [ 1675.906009][ T5922] usb 5-1: Manufacturer: syz [ 1675.911098][ T5922] usb 5-1: SerialNumber: syz [ 1675.927766][ T5922] usb 5-1: config 0 descriptor?? [ 1676.001074][T14760] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1676.015953][T14760] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1676.701771][T18165] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 1676.716838][T25104] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6012'. [ 1676.797565][T22579] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1676.891946][T18165] usb 6-1: Using ep0 maxpacket: 8 [ 1676.926711][T22579] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1676.978542][T18165] usb 6-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1677.001863][T23024] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 1677.014548][T18165] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1677.060136][T18165] usb 6-1: Product: syz [ 1677.113197][T18165] usb 6-1: Manufacturer: syz [ 1677.125404][T22579] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1677.141169][T18165] usb 6-1: SerialNumber: syz [ 1677.150609][T18165] usb 6-1: config 0 descriptor?? [ 1677.170557][T18165] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1677.181701][T23024] usb 1-1: Using ep0 maxpacket: 32 [ 1677.189302][T23024] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1677.209917][T23024] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1677.229030][T23024] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1677.247483][T23024] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1677.267919][T23024] usb 1-1: config 0 descriptor?? [ 1677.461098][T22579] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1677.531302][T25106] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1677.559483][T25106] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1677.583577][T23024] usbhid 1-1:0.0: can't add hid device: -71 [ 1677.620295][T23024] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1677.653364][T23024] usb 1-1: USB disconnect, device number 93 [ 1677.897953][T22579] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 1678.069079][ T5922] usb 3-1: USB disconnect, device number 43 [ 1678.297528][T22579] batman_adv: batadv0: Removing interface: ip6gretap1 [ 1678.489618][T25111] sctp: [Deprecated]: syz.0.6018 (pid 25111) Use of int in maxseg socket option. [ 1678.489618][T25111] Use struct sctp_assoc_value instead [ 1678.808187][ T5922] usb 5-1: USB disconnect, device number 96 [ 1678.959842][T25115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1678.980571][T25115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1679.181705][T18165] gspca_sonixj: i2c_w8 err -110 [ 1679.241736][T18165] sonixj 6-1:0.0: probe with driver sonixj failed with error -110 [ 1679.285003][ T3027] net_ratelimit: 42 callbacks suppressed [ 1679.285025][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1679.305748][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1679.320764][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1679.335493][ T3027] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1679.470543][T22579] bond0 (unregistering): left promiscuous mode [ 1679.478286][T22579] bond_slave_0: left promiscuous mode [ 1679.484350][T22579] bond_slave_1: left promiscuous mode [ 1679.506152][T22579] bond4 (unregistering): (slave macvlan2): Releasing backup interface [ 1679.523661][T22579] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1679.539499][T22579] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1679.555096][T22579] bond0 (unregistering): (slave macvlan0): Releasing backup interface [ 1679.568311][T22579] veth1_vlan: left allmulticast mode [ 1679.576935][T22579] bond0 (unregistering): Released all slaves [ 1679.596533][T22579] bond1 (unregistering): Released all slaves [ 1679.805319][T22579] bond2 (unregistering): (slave bond3): Releasing backup interface [ 1679.824917][T22579] bond3 (unregistering): left promiscuous mode [ 1679.839036][T22579] bond2 (unregistering): Released all slaves [ 1679.864271][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1679.878882][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1679.893457][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1679.907939][T14763] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1680.046918][ T5922] usb 6-1: USB disconnect, device number 2 [ 1680.248957][T22579] bond3 (unregistering): Released all slaves [ 1680.299469][T22579] bond4 (unregistering): Released all slaves [ 1680.586121][T14760] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:00:00:00:01 [ 1680.600629][T14760] batman_adv: batadv0: Local translation table size (60) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:00:00:2a [ 1680.639501][T22579] tipc: Left network mode [ 1680.792397][T25138] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6025'. [ 1681.818882][T25155] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6029'. [ 1681.931562][ T976] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 1682.031828][T22579] hsr_slave_0: left promiscuous mode [ 1682.039070][T22579] hsr_slave_1: left promiscuous mode [ 1682.066988][T22579] batman_adv: batadv0: Interface deactivated: dummy0 [ 1682.116086][T22579] batman_adv: batadv0: Removing interface: dummy0 [ 1682.139397][ T976] usb 2-1: Using ep0 maxpacket: 32 [ 1682.154167][ T3410] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 1682.202353][ T5922] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 1682.224335][T22579] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1682.253086][ T976] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1682.268380][ T976] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1682.281720][T22579] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1682.299170][ T976] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1682.315146][T22579] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1682.327284][ T976] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1682.336241][T22579] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1682.347563][ T3410] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1682.354167][ T976] usb 2-1: config 0 descriptor?? [ 1682.373745][ T5922] usb 6-1: config 0 has no interfaces? [ 1682.385666][ T5922] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1682.402338][ T3410] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1682.420851][ T5922] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1682.445075][ T3410] usb 1-1: config 0 descriptor?? [ 1682.450974][ T5922] usb 6-1: Product: syz [ 1682.457361][ T5922] usb 6-1: Manufacturer: syz [ 1682.459392][ T3410] cp210x 1-1:0.0: cp210x converter detected [ 1682.472974][ T5922] usb 6-1: SerialNumber: syz [ 1682.492007][ T5922] usb 6-1: config 0 descriptor?? [ 1682.553544][T22579] veth1_macvtap: left promiscuous mode [ 1682.559304][T22579] veth0_macvtap: left promiscuous mode [ 1682.600009][T22579] veth1_vlan: left promiscuous mode [ 1682.618521][T22579] veth0_vlan: left promiscuous mode [ 1682.657751][T25151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1682.700889][T25151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1682.785495][ T976] usbhid 2-1:0.0: can't add hid device: -71 [ 1682.802159][ T976] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1682.830636][ T976] usb 2-1: USB disconnect, device number 91 [ 1682.863544][T25152] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6027'. [ 1682.884242][T25158] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1683.039840][T25158] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1683.127414][ T3410] usb 1-1: cp210x converter now attached to ttyUSB0 [ 1683.467739][T25164] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6029'. [ 1683.778609][T25173] misc userio: The device must be registered before sending interrupts [ 1684.361660][T15308] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 1684.669548][T22579] team0 (unregistering): Port device team_slave_1 removed [ 1684.839745][T15308] usb 2-1: config 0 has no interfaces? [ 1684.993618][T22579] team0 (unregistering): Port device team_slave_0 removed [ 1685.176680][T15308] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1685.242981][T15308] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1685.284688][T15308] usb 2-1: Product: syz [ 1685.309181][T15308] usb 2-1: Manufacturer: syz [ 1685.373401][T15308] usb 2-1: SerialNumber: syz [ 1685.409493][T15308] usb 2-1: config 0 descriptor?? [ 1686.196781][ T5922] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 1686.371972][ T5922] usb 3-1: Using ep0 maxpacket: 8 [ 1686.397404][ T5922] usb 3-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1686.407146][ T5922] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1686.421955][ T5922] usb 3-1: Product: syz [ 1686.440702][ T5922] usb 3-1: Manufacturer: syz [ 1686.853786][ T5922] usb 3-1: SerialNumber: syz [ 1686.923978][ T5922] usb 3-1: config 0 descriptor?? [ 1686.938819][ T5922] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1687.252573][T22579] IPVS: stop unused estimator thread 0... [ 1687.315715][T25164] bridge_slave_1: left allmulticast mode [ 1687.333867][T25164] bridge_slave_1: left promiscuous mode [ 1687.339974][T25164] bridge0: port 2(bridge_slave_1) entered disabled state [ 1687.399631][T25164] bridge_slave_0: left allmulticast mode [ 1687.405670][T25164] bridge_slave_0: left promiscuous mode [ 1687.412286][T25164] bridge0: port 1(bridge_slave_0) entered disabled state [ 1688.030374][T15308] usb 2-1: can't set config #0, error -71 [ 1688.039947][T15308] usb 2-1: USB disconnect, device number 92 [ 1688.304165][T18165] usb 6-1: USB disconnect, device number 3 [ 1688.464873][T23024] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1688.622796][T23024] usb 5-1: Using ep0 maxpacket: 32 [ 1688.638379][T15308] usb 1-1: USB disconnect, device number 94 [ 1688.641412][T23024] usb 5-1: config index 0 descriptor too short (expected 156, got 27) [ 1688.701369][T15308] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1688.703671][T23024] usb 5-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1688.732382][T23024] usb 5-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1688.752301][T23024] usb 5-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1688.844809][T15308] cp210x 1-1:0.0: device disconnected [ 1688.855320][T23024] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1688.884931][T23024] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1688.943392][ T5922] gspca_sonixj: i2c_w8 err -110 [ 1688.947369][T23024] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1688.968216][T23024] usb 5-1: Product: syz [ 1688.978114][T23024] usb 5-1: Manufacturer: syz [ 1688.985185][T23024] usb 5-1: SerialNumber: syz [ 1688.997352][T23024] usb 5-1: config 0 descriptor?? [ 1689.007909][T23024] ldusb 5-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1689.022177][ T5922] sonixj 3-1:0.0: probe with driver sonixj failed with error -110 [ 1689.022173][T23024] ldusb 5-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1689.118851][T25221] misc userio: The device must be registered before sending interrupts [ 1689.191640][ T3410] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 1689.217621][T23024] usb 5-1: USB disconnect, device number 97 [ 1689.241353][T23024] ldusb 5-1:0.0: LD USB Device #0 now disconnected [ 1689.653676][ T5922] usb 3-1: USB disconnect, device number 44 [ 1690.093161][ T3410] usb 2-1: config 0 has no interfaces? [ 1690.137373][ T3410] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1690.158164][ T3410] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1690.211778][ T976] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 1690.213439][ T3410] usb 2-1: Product: syz [ 1690.264103][T25242] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 1690.281701][ T3410] usb 2-1: Manufacturer: syz [ 1690.306560][ T3410] usb 2-1: SerialNumber: syz [ 1690.318525][T25242] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 1690.337178][T25242] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 1690.361935][ T976] usb 1-1: Using ep0 maxpacket: 32 [ 1690.374984][ T3410] usb 2-1: config 0 descriptor?? [ 1690.382671][ T976] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1690.416384][ T976] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1690.441189][ T976] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1690.465856][ T976] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1690.499393][ T976] usb 1-1: config 0 descriptor?? [ 1690.736417][T25237] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1690.799659][T25237] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1690.947519][ T976] usbhid 1-1:0.0: can't add hid device: -71 [ 1690.956555][ T976] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1690.980228][ T976] usb 1-1: USB disconnect, device number 95 [ 1691.050927][T25215] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6047'. [ 1691.454358][T25265] misc userio: The device must be registered before sending interrupts [ 1691.521630][T23024] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 1691.724551][T23024] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1691.778794][T23024] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1691.792145][T23024] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1691.836161][T23024] usb 3-1: SerialNumber: syz [ 1692.110908][T23024] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 1692.192646][T23024] usb 3-1: USB disconnect, device number 45 [ 1693.033439][T25289] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6050'. [ 1693.253659][T18165] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 1693.331602][T23024] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 1693.382057][ T976] usb 2-1: USB disconnect, device number 93 [ 1693.421618][ T5922] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 1693.423309][T18165] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1693.446095][T18165] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1693.455490][T18165] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1693.464375][T25299] FAULT_INJECTION: forcing a failure. [ 1693.464375][T25299] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1693.487931][T18165] usb 5-1: SerialNumber: syz [ 1693.527175][T23024] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1693.550143][T23024] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1693.567444][T25299] CPU: 0 UID: 0 PID: 25299 Comm: syz.0.6053 Not tainted 6.15.0-rc2-syzkaller-00488-g6fea5fabd332 #0 PREEMPT(full) [ 1693.567497][T25299] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 1693.567512][T25299] Call Trace: [ 1693.567522][T25299] [ 1693.567531][T25299] dump_stack_lvl+0x241/0x360 [ 1693.567575][T25299] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1693.567606][T25299] ? __pfx__printk+0x10/0x10 [ 1693.567662][T25299] should_fail_ex+0x424/0x570 [ 1693.567701][T25299] _copy_from_iter+0x211/0x1c70 [ 1693.567733][T25299] ? __build_skb_around+0x247/0x3d0 [ 1693.567769][T25299] ? __alloc_skb+0x298/0x480 [ 1693.567798][T25299] ? __pfx__copy_from_iter+0x10/0x10 [ 1693.567826][T25299] ? __pfx___alloc_skb+0x10/0x10 [ 1693.567859][T25299] ? skb_put+0x114/0x1f0 [ 1693.567895][T25299] netlink_sendmsg+0x73c/0xcd0 [ 1693.567936][T25299] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1693.567968][T25299] ? aa_sock_msg_perm+0x91/0x160 [ 1693.568001][T25299] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1693.568027][T25299] __sock_sendmsg+0x221/0x270 [ 1693.568056][T25299] sock_write_iter+0x2d9/0x3f0 [ 1693.568083][T25299] ? __pfx_sock_write_iter+0x10/0x10 [ 1693.568131][T25299] do_iter_readv_writev+0x71f/0x9d0 [ 1693.568181][T25299] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 1693.568217][T25299] ? bpf_lsm_file_permission+0x9/0x10 [ 1693.568247][T25299] ? rw_verify_area+0x246/0x630 [ 1693.568278][T25299] vfs_writev+0x38d/0xbc0 [ 1693.568299][T25299] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 1693.568325][T25299] ? vfs_write+0xb29/0xd10 [ 1693.568355][T25299] ? __lock_acquire+0xad5/0xd80 [ 1693.568385][T25299] ? __pfx_vfs_writev+0x10/0x10 [ 1693.568423][T25299] ? __fget_files+0x2a/0x420 [ 1693.568445][T25299] ? __fget_files+0x39d/0x420 [ 1693.568463][T25299] ? __fget_files+0x2a/0x420 [ 1693.568492][T25299] do_writev+0x1b8/0x360 [ 1693.568519][T25299] ? __pfx_do_writev+0x10/0x10 [ 1693.568543][T25299] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1693.568566][T25299] ? lockdep_hardirqs_on+0x9d/0x150 [ 1693.568590][T25299] __do_fast_syscall_32+0xb4/0x110 [ 1693.568618][T25299] ? exc_page_fault+0x5f8/0x920 [ 1693.568643][T25299] do_fast_syscall_32+0x34/0x80 [ 1693.568667][T25299] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1693.568692][T25299] RIP: 0023:0xf70cd539 [ 1693.568709][T25299] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1693.568727][T25299] RSP: 002b:00000000f50bd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000092 [ 1693.568749][T25299] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 1693.568762][T25299] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 1693.568774][T25299] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1693.568786][T25299] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1693.568799][T25299] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1693.568827][T25299] [ 1693.860015][ T5922] usb 6-1: Using ep0 maxpacket: 8 [ 1693.870150][ T5922] usb 6-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1693.881654][ T5922] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1693.891307][ T5922] usb 6-1: Product: syz [ 1693.907104][ T5922] usb 6-1: Manufacturer: syz [ 1693.916051][ T5922] usb 6-1: SerialNumber: syz [ 1693.940870][T18165] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -71 [ 1693.960504][ T5922] usb 6-1: config 0 descriptor?? [ 1693.966843][T23024] usb 3-1: config 0 descriptor?? [ 1693.974745][T18165] usb 5-1: USB disconnect, device number 98 [ 1693.995413][T23024] cp210x 3-1:0.0: cp210x converter detected [ 1694.015938][ T5922] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1694.371780][ T976] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 1694.398665][T25289] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1694.419662][T25289] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1694.474702][T23024] usb 3-1: cp210x converter now attached to ttyUSB0 [ 1694.589636][ T976] usb 1-1: config 67 has too many interfaces: 38, using maximum allowed: 32 [ 1694.609914][ T976] usb 1-1: config 67 has an invalid descriptor of length 236, skipping remainder of the config [ 1694.622239][ T976] usb 1-1: config 67 has 0 interfaces, different from the descriptor's value: 38 [ 1694.633409][ T976] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1694.643118][ T976] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1694.721689][T25289] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6050'. [ 1694.741183][T25289] bridge_slave_1: left allmulticast mode [ 1694.753308][T25289] bridge_slave_1: left promiscuous mode [ 1694.774175][T25327] misc userio: The device must be registered before sending interrupts [ 1694.783164][T25289] bridge0: port 2(bridge_slave_1) entered disabled state [ 1694.827454][T25289] bridge_slave_0: left allmulticast mode [ 1694.852225][T25289] bridge_slave_0: left promiscuous mode [ 1694.858265][T25289] bridge0: port 1(bridge_slave_0) entered disabled state [ 1694.907545][ T976] usb 1-1: string descriptor 0 read error: -71 [ 1694.925916][ T976] usb 1-1: USB disconnect, device number 96 [ 1695.041618][T23024] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 1695.078805][T18165] usb 3-1: USB disconnect, device number 46 [ 1695.108310][T18165] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1695.159723][T18165] cp210x 3-1:0.0: device disconnected [ 1695.223797][T23024] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1695.258161][T23024] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1695.352532][T23024] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1695.401345][T23024] usb 2-1: SerialNumber: syz [ 1695.871899][ T5922] gspca_sonixj: i2c_w8 err -71 [ 1695.932158][ T5922] sonixj 6-1:0.0: probe with driver sonixj failed with error -71 [ 1695.968842][ T5922] usb 6-1: USB disconnect, device number 4 [ 1695.999545][T23024] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 1696.063464][T23024] usb 2-1: USB disconnect, device number 94 [ 1697.582033][ T5922] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 1697.667197][T25375] misc userio: The device must be registered before sending interrupts [ 1697.764933][ T5922] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1697.809922][ T5922] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1697.826218][ T5922] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1697.844599][ T5922] usb 5-1: SerialNumber: syz [ 1699.879209][ T5922] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -71 [ 1700.011843][ T5922] usb 5-1: USB disconnect, device number 99 [ 1700.491597][ T24] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 1700.655830][T25412] misc userio: The device must be registered before sending interrupts [ 1701.064875][ T24] usb 6-1: config 0 has no interfaces? [ 1701.131904][T23024] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 1701.309285][T23024] usb 5-1: Using ep0 maxpacket: 8 [ 1701.456172][T23024] usb 5-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1701.477594][T23024] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1701.516096][T23024] usb 5-1: Product: syz [ 1701.520337][T23024] usb 5-1: Manufacturer: syz [ 1701.552777][T23024] usb 5-1: SerialNumber: syz [ 1701.571006][T23024] usb 5-1: config 0 descriptor?? [ 1701.609709][T23024] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1702.259924][ T24] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1702.279305][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1702.294689][T25418] sctp: [Deprecated]: syz.1.6071 (pid 25418) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1702.294689][T25418] Use struct sctp_sack_info instead [ 1702.317314][ T24] usb 6-1: Product: syz [ 1702.322852][ T24] usb 6-1: Manufacturer: syz [ 1702.327487][ T24] usb 6-1: SerialNumber: syz [ 1702.360130][ T24] usb 6-1: config 0 descriptor?? [ 1702.465302][T23024] gspca_sonixj: reg_r err -32 [ 1702.480959][T23024] sonixj 5-1:0.0: probe with driver sonixj failed with error -32 [ 1702.541238][T25424] FAULT_INJECTION: forcing a failure. [ 1702.541238][T25424] name failslab, interval 1, probability 0, space 0, times 0 [ 1702.567771][T25424] CPU: 1 UID: 0 PID: 25424 Comm: syz.2.6072 Not tainted 6.15.0-rc2-syzkaller-00488-g6fea5fabd332 #0 PREEMPT(full) [ 1702.567800][T25424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 1702.567812][T25424] Call Trace: [ 1702.567820][T25424] [ 1702.567828][T25424] dump_stack_lvl+0x241/0x360 [ 1702.567859][T25424] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1702.567882][T25424] ? __pfx__printk+0x10/0x10 [ 1702.567908][T25424] ? __pfx___might_resched+0x10/0x10 [ 1702.567926][T25424] should_fail_ex+0x424/0x570 [ 1702.567954][T25424] should_failslab+0xac/0x100 [ 1702.567972][T25424] __kmalloc_noprof+0xdf/0x4d0 [ 1702.567988][T25424] ? tomoyo_realpath_from_path+0xc2/0x5e0 [ 1702.568009][T25424] ? tomoyo_realpath_from_path+0xcf/0x5e0 [ 1702.568035][T25424] tomoyo_realpath_from_path+0xcf/0x5e0 [ 1702.568072][T25424] tomoyo_path_number_perm+0x245/0x790 [ 1702.568090][T25424] ? __lock_acquire+0xad5/0xd80 [ 1702.568113][T25424] ? tomoyo_path_number_perm+0x215/0x790 [ 1702.568133][T25424] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1702.568179][T25424] ? __fget_files+0x2a/0x420 [ 1702.568193][T25424] ? __fget_files+0x2a/0x420 [ 1702.568210][T25424] ? __fget_files+0x2a/0x420 [ 1702.568228][T25424] security_file_ioctl_compat+0xc6/0x2a0 [ 1702.568248][T25424] __ia32_compat_sys_ioctl+0x128/0xc90 [ 1702.568269][T25424] ? __fget_files+0x2a/0x420 [ 1702.568283][T25424] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1702.568305][T25424] ? __fget_files+0x2a/0x420 [ 1702.568324][T25424] ? fput+0x9b/0xd0 [ 1702.568339][T25424] ? ksys_write+0x275/0x2d0 [ 1702.568367][T25424] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1702.568383][T25424] ? lockdep_hardirqs_on+0x9d/0x150 [ 1702.568401][T25424] __do_fast_syscall_32+0xb4/0x110 [ 1702.568418][T25424] ? exc_page_fault+0x5f8/0x920 [ 1702.568436][T25424] do_fast_syscall_32+0x34/0x80 [ 1702.568453][T25424] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1702.568472][T25424] RIP: 0023:0xf70bd539 [ 1702.568486][T25424] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1702.568498][T25424] RSP: 002b:00000000f50ad55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1702.568515][T25424] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000000227d [ 1702.568526][T25424] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 1702.568536][T25424] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1702.568544][T25424] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1702.568553][T25424] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1702.568575][T25424] [ 1702.568583][T25424] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1703.371607][T18165] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 1703.542013][T18165] usb 2-1: Using ep0 maxpacket: 32 [ 1703.556919][T18165] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1703.585680][T18165] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1703.611325][T18165] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1703.636226][T18165] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1703.682708][T18165] usb 2-1: config 0 descriptor?? [ 1703.907549][T25428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1703.923392][T25428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1703.940349][T18165] usbhid 2-1:0.0: can't add hid device: -71 [ 1703.948388][T18165] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1703.965445][T18165] usb 2-1: USB disconnect, device number 95 [ 1704.266011][T18165] usb 5-1: USB disconnect, device number 100 [ 1704.398909][T25447] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6074'. [ 1704.578179][T15308] usb 6-1: USB disconnect, device number 5 [ 1704.631669][ T976] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 1704.652687][T25453] net_ratelimit: 10 callbacks suppressed [ 1704.652710][T25453] batman_adv: batadv0: Local translation table size (80) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:bb [ 1704.675258][T23024] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 1704.761572][T18165] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 1704.822556][ T976] usb 3-1: Using ep0 maxpacket: 8 [ 1704.843255][T23024] usb 1-1: Using ep0 maxpacket: 8 [ 1704.853014][ T976] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1704.863255][ T976] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1704.874025][T23024] usb 1-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1704.883146][ T976] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1704.893245][T23024] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1704.901264][T23024] usb 1-1: Product: syz [ 1704.911599][ T976] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1704.929619][T23024] usb 1-1: Manufacturer: syz [ 1704.936662][T18165] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1704.946453][T23024] usb 1-1: SerialNumber: syz [ 1704.953083][T18165] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1704.962330][ T976] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1704.973596][T23024] usb 1-1: config 0 descriptor?? [ 1704.982261][ T976] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1704.990622][T18165] usb 5-1: config 0 descriptor?? [ 1704.997946][T23024] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1705.006263][T18165] cp210x 5-1:0.0: cp210x converter detected [ 1705.225154][ T976] usb 3-1: GET_CAPABILITIES returned 0 [ 1705.230973][ T976] usbtmc 3-1:16.0: can't read capabilities [ 1705.410557][T25447] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1705.430943][T25447] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1705.438317][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.447964][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.457100][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.487156][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.496507][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.505607][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.514758][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.582351][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.591543][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.610046][T18165] usb 5-1: cp210x converter now attached to ttyUSB0 [ 1705.632499][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.641671][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.650805][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.662558][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.671723][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.680869][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.693177][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1705.707243][ T976] usb 3-1: USB disconnect, device number 47 [ 1705.728943][T25468] misc userio: The device must be registered before sending interrupts [ 1705.831990][T25447] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6074'. [ 1705.849965][T25447] bridge_slave_1: left allmulticast mode [ 1705.898949][T25447] bridge_slave_1: left promiscuous mode [ 1705.908871][T25447] bridge0: port 2(bridge_slave_1) entered disabled state [ 1705.909176][T23024] gspca_sonixj: reg_r err -32 [ 1705.926916][T23024] sonixj 1-1:0.0: probe with driver sonixj failed with error -32 [ 1706.022064][T25447] bridge_slave_0: left allmulticast mode [ 1706.046683][T25447] bridge_slave_0: left promiscuous mode [ 1706.053347][T25447] bridge0: port 1(bridge_slave_0) entered disabled state [ 1706.382424][ T24] usb 5-1: USB disconnect, device number 101 [ 1706.391198][ T24] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1706.534803][T25473] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6079'. [ 1706.563270][ T24] cp210x 5-1:0.0: device disconnected [ 1707.424753][T25495] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1707.434587][T25495] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1707.443778][T25495] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1707.453097][T25495] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1707.486918][ T5922] usb 5-1: new full-speed USB device number 102 using dummy_hcd [ 1707.537404][T25498] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6086'. [ 1707.702480][ T5922] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 1707.716533][ T5922] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1707.739315][ T5922] usb 5-1: New USB device found, idVendor=28bd, idProduct=0078, bcdDevice= 0.00 [ 1707.763019][T25502] FAULT_INJECTION: forcing a failure. [ 1707.763019][T25502] name failslab, interval 1, probability 0, space 0, times 0 [ 1707.783313][ T5922] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1707.805417][T25502] CPU: 1 UID: 0 PID: 25502 Comm: syz.5.6087 Not tainted 6.15.0-rc2-syzkaller-00488-g6fea5fabd332 #0 PREEMPT(full) [ 1707.805441][T25502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 1707.805451][T25502] Call Trace: [ 1707.805458][T25502] [ 1707.805466][T25502] dump_stack_lvl+0x241/0x360 [ 1707.805496][T25502] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1707.805519][T25502] ? __pfx__printk+0x10/0x10 [ 1707.805544][T25502] ? __pfx___might_resched+0x10/0x10 [ 1707.805564][T25502] should_fail_ex+0x424/0x570 [ 1707.805591][T25502] should_failslab+0xac/0x100 [ 1707.805609][T25502] kmem_cache_alloc_noprof+0x78/0x390 [ 1707.805626][T25502] ? __pmd_alloc+0x118/0x440 [ 1707.805645][T25502] __pmd_alloc+0x118/0x440 [ 1707.805664][T25502] ? __pfx___pmd_alloc+0x10/0x10 [ 1707.805688][T25502] handle_mm_fault+0xf7a/0x1bf0 [ 1707.805704][T25502] ? mt_find+0x28a/0x8f0 [ 1707.805740][T25502] ? __pfx_handle_mm_fault+0x10/0x10 [ 1707.805774][T25502] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 1707.805792][T25502] exc_page_fault+0x2bb/0x920 [ 1707.805814][T25502] asm_exc_page_fault+0x26/0x30 [ 1707.805828][T25502] RIP: 0010:rep_movs_alternative+0xf/0x90 [ 1707.805850][T25502] Code: c4 10 c3 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 83 f9 40 73 44 83 f9 08 73 25 85 c9 74 0f <8a> 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 2e [ 1707.805863][T25502] RSP: 0018:ffffc90003347c58 EFLAGS: 00050202 [ 1707.805878][T25502] RAX: 00007ffffffff001 RBX: 00000000800000c0 RCX: 0000000000000004 [ 1707.805889][T25502] RDX: 0000000000000001 RSI: 00000000800000c0 RDI: ffffc90003347ce0 [ 1707.805900][T25502] RBP: ffffc90003347d50 R08: 0000000000000003 R09: fffff52000668f9c [ 1707.805910][T25502] R10: dffffc0000000000 R11: fffff52000668f9c R12: ffffc90003347ce0 [ 1707.805922][T25502] R13: 0000000000000000 R14: ffffc90003347ce0 R15: 0000000000000004 [ 1707.805945][T25502] _copy_from_user+0x7b/0xb0 [ 1707.805967][T25502] kcm_setsockopt+0x182/0x580 [ 1707.805986][T25502] ? __pfx_aa_sk_perm+0x10/0x10 [ 1707.806004][T25502] ? __pfx_kcm_setsockopt+0x10/0x10 [ 1707.806021][T25502] ? aa_sock_opt_perm+0x79/0x120 [ 1707.806044][T25502] ? __pfx_kcm_setsockopt+0x10/0x10 [ 1707.806059][T25502] do_sock_setsockopt+0x3b1/0x710 [ 1707.806086][T25502] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 1707.806107][T25502] ? lock_vma_under_rcu+0x1f0/0x9a0 [ 1707.806129][T25502] ? ksys_write+0x266/0x2d0 [ 1707.806156][T25502] __ia32_sys_setsockopt+0x186/0x210 [ 1707.806183][T25502] __do_fast_syscall_32+0xb4/0x110 [ 1707.806200][T25502] ? exc_page_fault+0x5f8/0x920 [ 1707.806226][T25502] do_fast_syscall_32+0x34/0x80 [ 1707.806243][T25502] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1707.806261][T25502] RIP: 0023:0xf7f61539 [ 1707.806274][T25502] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1707.806287][T25502] RSP: 002b:00000000f508655c EFLAGS: 00000206 ORIG_RAX: 000000000000016e [ 1707.806302][T25502] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000119 [ 1707.806312][T25502] RDX: 0000000000000001 RSI: 00000000800000c0 RDI: 0000000000000004 [ 1707.806321][T25502] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1707.806331][T25502] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1707.806340][T25502] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1707.806361][T25502] [ 1708.226136][ T5922] usb 5-1: config 0 descriptor?? [ 1708.232190][T25486] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1708.264790][T18165] usb 1-1: USB disconnect, device number 97 [ 1708.507511][T25512] misc userio: The device must be registered before sending interrupts [ 1708.606750][T25510] FAULT_INJECTION: forcing a failure. [ 1708.606750][T25510] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1708.606792][T25510] CPU: 0 UID: 0 PID: 25510 Comm: syz.4.6081 Not tainted 6.15.0-rc2-syzkaller-00488-g6fea5fabd332 #0 PREEMPT(full) [ 1708.606819][T25510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 1708.606832][T25510] Call Trace: [ 1708.606841][T25510] [ 1708.606850][T25510] dump_stack_lvl+0x241/0x360 [ 1708.606890][T25510] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1708.606922][T25510] ? __pfx__printk+0x10/0x10 [ 1708.606965][T25510] should_fail_ex+0x424/0x570 [ 1708.607003][T25510] _copy_to_user+0x31/0xb0 [ 1708.607034][T25510] __copy_siginfo_to_user32+0xa5/0x110 [ 1708.607059][T25510] ? __pfx___copy_siginfo_to_user32+0x10/0x10 [ 1708.607104][T25510] ia32_setup_rt_frame+0x7a1/0xc90 [ 1708.607128][T25510] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1708.607233][T25510] ? __pfx_ia32_setup_rt_frame+0x10/0x10 [ 1708.607259][T25510] ? __pfx_vfs_write+0x10/0x10 [ 1708.607296][T25510] arch_do_signal_or_restart+0x451/0x810 [ 1708.607335][T25510] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1708.607385][T25510] ? syscall_exit_to_user_mode+0xa3/0x340 [ 1708.607410][T25510] syscall_exit_to_user_mode+0xce/0x340 [ 1708.607435][T25510] __do_fast_syscall_32+0xc1/0x110 [ 1708.607459][T25510] ? exc_page_fault+0x5f8/0x920 [ 1708.607485][T25510] do_fast_syscall_32+0x34/0x80 [ 1708.607510][T25510] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1708.607536][T25510] RIP: 0023:0xf710d537 [ 1708.607554][T25510] Code: 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 80 5d 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1708.607573][T25510] RSP: 002b:00000000f50dc55c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 1708.607597][T25510] RAX: 0000000000000004 RBX: 0000000000000005 RCX: 0000000000000000 [ 1708.607610][T25510] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1708.607623][T25510] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1708.607637][T25510] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1708.607650][T25510] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1708.607680][T25510] [ 1708.706615][ T5922] usbhid 5-1:0.0: can't add hid device: -71 [ 1708.706741][ T5922] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1708.735519][ T5922] usb 5-1: USB disconnect, device number 102 [ 1708.841549][T18165] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 1709.764697][T18165] usb 3-1: config 0 has no interfaces? [ 1709.781840][T18165] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1709.791162][T18165] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1709.818381][T18165] usb 3-1: Product: syz [ 1709.829558][T18165] usb 3-1: Manufacturer: syz [ 1709.837823][T18165] usb 3-1: SerialNumber: syz [ 1709.859429][T18165] usb 3-1: config 0 descriptor?? [ 1709.878628][T25533] misc userio: The device must be registered before sending interrupts [ 1710.251572][T18165] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 1710.450251][T18165] usb 5-1: config index 0 descriptor too short (expected 8300, got 77) [ 1710.483172][T18165] usb 5-1: config 215 has too many interfaces: 253, using maximum allowed: 32 [ 1710.530374][T18165] usb 5-1: config 215 has an invalid descriptor of length 184, skipping remainder of the config [ 1710.629492][T18165] usb 5-1: config 215 has 0 interfaces, different from the descriptor's value: 253 [ 1710.737311][T18165] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1710.881975][T18165] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1710.936038][T18165] usb 5-1: Product: syz [ 1710.973901][T18165] usb 5-1: Manufacturer: syz [ 1710.978801][T18165] usb 5-1: SerialNumber: syz [ 1711.903625][ T976] usb 3-1: USB disconnect, device number 48 [ 1712.801568][T23024] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 1712.984896][T23024] usb 3-1: config 0 interface 0 altsetting 12 endpoint 0x87 has an invalid bInterval 102, changing to 10 [ 1713.053991][T18165] usb 5-1: USB disconnect, device number 103 [ 1713.062195][T23024] usb 3-1: config 0 interface 0 altsetting 12 endpoint 0x87 has invalid maxpacket 24624, setting to 1024 [ 1713.074324][T23024] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1713.109832][T23024] usb 3-1: New USB device found, idVendor=06cd, idProduct=0115, bcdDevice=d9.c3 [ 1713.161734][T23024] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1713.169800][T23024] usb 3-1: Product: syz [ 1713.213030][T23024] usb 3-1: Manufacturer: syz [ 1713.226032][T23024] usb 3-1: SerialNumber: syz [ 1713.255743][T23024] usb 3-1: config 0 descriptor?? [ 1713.287330][T23024] keyspan 3-1:0.0: Keyspan 2 port adapter converter detected [ 1713.305860][T23024] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 7 [ 1713.325471][T23024] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 81 [ 1713.397280][T23024] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 1 [ 1713.470024][T23024] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 2 [ 1713.521713][T23024] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 85 [ 1713.549148][T23024] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 5 [ 1713.557894][T18165] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 1713.588578][T23024] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 1713.628651][T23024] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 83 [ 1713.646612][T23024] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 3 [ 1713.660886][T25583] netlink: 268 bytes leftover after parsing attributes in process `syz.5.6101'. [ 1713.692053][T23024] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 4 [ 1713.722199][T23024] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 86 [ 1713.730909][T18165] usb 5-1: Using ep0 maxpacket: 8 [ 1713.781637][T23024] keyspan 3-1:0.0: found no endpoint descriptor for endpoint 6 [ 1713.799412][T18165] usb 5-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1713.819487][T23024] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 1713.846935][T18165] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1713.864468][T18165] usb 5-1: Product: syz [ 1713.889094][T18165] usb 5-1: Manufacturer: syz [ 1713.921573][T18165] usb 5-1: SerialNumber: syz [ 1713.978414][T18165] usb 5-1: config 0 descriptor?? [ 1714.014768][T18165] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1714.252977][T25589] Invalid option length (39174) for dns_resolver key [ 1714.267165][T23024] usb 3-1: USB disconnect, device number 49 [ 1714.313979][T23024] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 1714.403095][T23024] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 1714.444427][T23024] keyspan 3-1:0.0: device disconnected [ 1714.593854][T25597] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6104'. [ 1714.672491][ T10] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 1714.828982][T18165] gspca_sonixj: reg_r err -32 [ 1714.839545][T18165] sonixj 5-1:0.0: probe with driver sonixj failed with error -32 [ 1714.848085][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 1714.883469][ T10] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x73, changing to 0x3 [ 1714.917689][ T10] usb 6-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1714.937222][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1714.993373][ T10] usb 6-1: Product: syz [ 1715.021930][ T10] usb 6-1: Manufacturer: syz [ 1715.047716][ T10] usb 6-1: SerialNumber: syz [ 1715.069474][ T10] usb 6-1: config 0 descriptor?? [ 1715.103316][ T10] streamzap 6-1:0.0: streamzap_probe: endpoint doesn't match input device 0203 [ 1715.272612][ T5922] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 1715.355065][ T10] usb 6-1: USB disconnect, device number 6 [ 1715.750540][ T5922] usb 2-1: config 0 has no interfaces? [ 1715.822919][T25627] FAULT_INJECTION: forcing a failure. [ 1715.822919][T25627] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1715.901742][T25627] CPU: 0 UID: 0 PID: 25627 Comm: syz.2.6109 Not tainted 6.15.0-rc2-syzkaller-00488-g6fea5fabd332 #0 PREEMPT(full) [ 1715.901774][T25627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 1715.901788][T25627] Call Trace: [ 1715.901797][T25627] [ 1715.901806][T25627] dump_stack_lvl+0x241/0x360 [ 1715.901846][T25627] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1715.901876][T25627] ? __pfx__printk+0x10/0x10 [ 1715.901919][T25627] should_fail_ex+0x424/0x570 [ 1715.901957][T25627] _copy_to_user+0x31/0xb0 [ 1715.901986][T25627] copy_to_sockptr_offset+0x60/0xc0 [ 1715.902014][T25627] do_ip_getsockopt+0x17c2/0x2a70 [ 1715.902044][T25627] ? __pfx_do_ip_getsockopt+0x10/0x10 [ 1715.902075][T25627] ? kstrtoull+0x1d3/0x2f0 [ 1715.902098][T25627] ? __pfx_kstrtoull+0x10/0x10 [ 1715.902121][T25627] ? aa_label_sk_perm+0x4f4/0x6d0 [ 1715.902151][T25627] ? kstrtouint+0xfc/0x190 [ 1715.902171][T25627] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 1715.902218][T25627] ip_getsockopt+0xef/0x2e0 [ 1715.902245][T25627] ? __pfx_ip_getsockopt+0x10/0x10 [ 1715.902275][T25627] ? aa_sk_perm+0x96f/0xac0 [ 1715.902301][T25627] ipv6_getsockopt+0x1bc/0x360 [ 1715.902335][T25627] ? __pfx_ipv6_getsockopt+0x10/0x10 [ 1715.902364][T25627] ? __lock_acquire+0xad5/0xd80 [ 1715.902396][T25627] ? aa_sock_opt_perm+0x79/0x120 [ 1715.902433][T25627] ? sock_common_getsockopt+0x2e/0xb0 [ 1715.902459][T25627] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1715.902487][T25627] do_sock_getsockopt+0x391/0x740 [ 1715.902527][T25627] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1715.902556][T25627] ? __fget_files+0x2a/0x420 [ 1715.902579][T25627] ? __fget_files+0x39d/0x420 [ 1715.902597][T25627] ? __fget_files+0x2a/0x420 [ 1715.902625][T25627] __ia32_sys_getsockopt+0x231/0x310 [ 1715.902666][T25627] ? __pfx___ia32_sys_getsockopt+0x10/0x10 [ 1715.902702][T25627] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1715.902729][T25627] ? lockdep_hardirqs_on+0x9d/0x150 [ 1715.902753][T25627] __do_fast_syscall_32+0xb4/0x110 [ 1715.902777][T25627] ? exc_page_fault+0x5f8/0x920 [ 1715.902804][T25627] do_fast_syscall_32+0x34/0x80 [ 1715.902827][T25627] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1715.902852][T25627] RIP: 0023:0xf70bd539 [ 1715.902871][T25627] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1715.902889][T25627] RSP: 002b:00000000f50ad55c EFLAGS: 00000206 ORIG_RAX: 000000000000016d [ 1715.902913][T25627] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 1715.902928][T25627] RDX: 0000000000000001 RSI: 0000000080000180 RDI: 00000000800001c0 [ 1715.902943][T25627] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1715.902955][T25627] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1715.902968][T25627] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1715.902998][T25627] [ 1715.904097][ T5922] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1716.257631][ T5922] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1716.269953][ T5922] usb 2-1: Product: syz [ 1716.282564][ T5922] usb 2-1: Manufacturer: syz [ 1716.291632][ T5922] usb 2-1: SerialNumber: syz [ 1716.310004][ T5922] usb 2-1: config 0 descriptor?? [ 1716.418036][T25634] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6110'. [ 1716.742921][ T10] usb 5-1: USB disconnect, device number 104 [ 1716.897231][T25642] ip6t_REJECT: ECHOREPLY is not supported [ 1717.251912][ T10] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 1717.393457][T25659] misc userio: The device must be registered before sending interrupts [ 1717.466883][ T10] usb 5-1: device descriptor read/64, error -71 [ 1717.804555][ T10] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 1717.971568][ T10] usb 5-1: device descriptor read/64, error -71 [ 1718.081997][ T10] usb usb5-port1: attempt power cycle [ 1718.471726][ T10] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 1718.515213][ T10] usb 5-1: device descriptor read/8, error -71 [ 1718.793028][ T10] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 1718.862434][T18165] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 1718.882893][ T10] usb 5-1: device descriptor read/8, error -71 [ 1719.011978][ T10] usb usb5-port1: unable to enumerate USB device [ 1719.065834][T18165] usb 6-1: config 0 interface 0 altsetting 12 endpoint 0x87 has an invalid bInterval 102, changing to 10 [ 1719.091531][T18165] usb 6-1: config 0 interface 0 altsetting 12 endpoint 0x87 has invalid maxpacket 24624, setting to 1024 [ 1719.136712][T18165] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1719.173692][T18165] usb 6-1: New USB device found, idVendor=06cd, idProduct=0115, bcdDevice=d9.c3 [ 1719.207790][T18165] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1719.228038][T18165] usb 6-1: Product: syz [ 1719.236916][T18165] usb 6-1: Manufacturer: syz [ 1719.251505][T18165] usb 6-1: SerialNumber: syz [ 1719.288005][T18165] usb 6-1: config 0 descriptor?? [ 1719.300952][T18165] keyspan 6-1:0.0: Keyspan 2 port adapter converter detected [ 1719.319147][T18165] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 7 [ 1719.341987][T18165] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 81 [ 1719.378579][T18165] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 1 [ 1719.412021][T18165] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 2 [ 1719.441762][T18165] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 85 [ 1719.460849][T18165] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 5 [ 1719.495783][T18165] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 1719.542571][T18165] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 83 [ 1719.580998][T18165] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 3 [ 1719.601621][T18165] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 4 [ 1719.635123][T18165] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 86 [ 1719.663455][T18165] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 6 [ 1719.691814][T18165] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 1719.818709][ T5922] usb 2-1: USB disconnect, device number 96 [ 1720.086824][T25703] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6119'. [ 1720.108522][T25703] netlink: 68 bytes leftover after parsing attributes in process `syz.1.6119'. [ 1720.276640][T25708] Invalid option length (39174) for dns_resolver key [ 1720.308330][T18165] usb 6-1: USB disconnect, device number 7 [ 1720.333476][T18165] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 1720.425940][T18165] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 1720.460459][T18165] keyspan 6-1:0.0: device disconnected [ 1720.494156][T25705] netlink: 100 bytes leftover after parsing attributes in process `syz.0.6121'. [ 1720.651631][T23024] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 1720.834100][T23024] usb 5-1: Using ep0 maxpacket: 8 [ 1720.860836][T23024] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x73, changing to 0x3 [ 1720.965219][T23024] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1721.143415][T23024] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1721.191625][T23024] usb 5-1: Product: syz [ 1721.210576][T23024] usb 5-1: Manufacturer: syz [ 1721.240342][T23024] usb 5-1: SerialNumber: syz [ 1721.288080][T23024] usb 5-1: config 0 descriptor?? [ 1721.309452][T23024] streamzap 5-1:0.0: streamzap_probe: endpoint doesn't match input device 0203 [ 1721.555026][T23024] usb 5-1: USB disconnect, device number 109 [ 1722.007850][T25735] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6126'. [ 1722.065753][T25739] misc userio: The device must be registered before sending interrupts [ 1722.762394][ T5922] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 1722.928377][ T5922] usb 1-1: config 0 has no interfaces? [ 1722.962441][ T3410] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 1723.015416][ T5922] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1723.031594][ T5922] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1723.068830][ T5922] usb 1-1: Product: syz [ 1723.074836][ T5922] usb 1-1: Manufacturer: syz [ 1723.079545][ T5922] usb 1-1: SerialNumber: syz [ 1723.090615][ T5922] usb 1-1: config 0 descriptor?? [ 1723.141781][ T3410] usb 5-1: Using ep0 maxpacket: 32 [ 1723.148441][ T3410] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 1723.161730][ T3410] usb 5-1: config 0 has no interface number 0 [ 1723.177292][ T3410] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1723.187575][ T3410] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1723.207150][ T3410] usb 5-1: Product: syz [ 1723.218775][ T3410] usb 5-1: Manufacturer: syz [ 1723.226892][ T3410] usb 5-1: SerialNumber: syz [ 1723.265595][ T3410] usb 5-1: config 0 descriptor?? [ 1723.273331][ T10] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1723.283972][ T3410] smsc95xx v2.0.0 [ 1723.474167][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 1723.510286][ T10] usb 6-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1723.521548][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1723.550549][ T10] usb 6-1: Product: syz [ 1723.561867][ T10] usb 6-1: Manufacturer: syz [ 1723.566541][ T10] usb 6-1: SerialNumber: syz [ 1723.613811][ T10] usb 6-1: config 0 descriptor?? [ 1723.635609][ T10] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1723.697164][ T3410] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 1723.722684][T25760] netlink: 100 bytes leftover after parsing attributes in process `syz.2.6135'. [ 1723.725702][ T3410] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1723.960770][ T3410] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 1723.985497][ T3410] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -32 [ 1724.208387][T25768] misc userio: The device must be registered before sending interrupts [ 1725.682032][ T10] gspca_sonixj: i2c_w8 err -110 [ 1725.712064][T23024] usb 5-1: USB disconnect, device number 110 [ 1725.742023][ T10] sonixj 6-1:0.0: probe with driver sonixj failed with error -110 [ 1725.872633][T25775] syzkaller1: entered promiscuous mode [ 1725.884843][T25775] syzkaller1: entered allmulticast mode [ 1725.984599][T23024] usb 1-1: USB disconnect, device number 98 [ 1726.424955][ T10] usb 6-1: USB disconnect, device number 8 [ 1726.541122][T25790] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6142'. [ 1726.632015][T23024] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 1726.670351][T25790] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6142'. [ 1726.807927][T25790] netlink: 'syz.0.6142': attribute type 18 has an invalid length. [ 1726.817050][T23024] usb 3-1: Using ep0 maxpacket: 8 [ 1726.865390][T23024] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 1726.902933][T23024] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1726.942553][T23024] usb 3-1: config 0 descriptor?? [ 1727.473100][ T5847] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1727.492058][ T5847] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1727.512043][ T5847] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1727.539964][ T5847] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1727.557425][ T5847] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1727.972159][T25803] misc userio: The device must be registered before sending interrupts [ 1728.447017][T25797] chnl_net:caif_netlink_parms(): no params data found [ 1728.534754][T19437] bridge0: port 3(syz_tun) entered disabled state [ 1728.548666][T25806] FAULT_INJECTION: forcing a failure. [ 1728.548666][T25806] name failslab, interval 1, probability 0, space 0, times 0 [ 1728.562555][T25806] CPU: 1 UID: 0 PID: 25806 Comm: syz.4.6147 Not tainted 6.15.0-rc2-syzkaller-00488-g6fea5fabd332 #0 PREEMPT(full) [ 1728.562588][T25806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 1728.562602][T25806] Call Trace: [ 1728.562612][T25806] [ 1728.562622][T25806] dump_stack_lvl+0x241/0x360 [ 1728.562663][T25806] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1728.562695][T25806] ? __pfx__printk+0x10/0x10 [ 1728.562731][T25806] ? __pfx___might_resched+0x10/0x10 [ 1728.562757][T25806] should_fail_ex+0x424/0x570 [ 1728.562796][T25806] should_failslab+0xac/0x100 [ 1728.562821][T25806] kmem_cache_alloc_noprof+0x78/0x390 [ 1728.562844][T25806] ? mas_alloc_nodes+0x267/0x7e0 [ 1728.562872][T25806] mas_alloc_nodes+0x267/0x7e0 [ 1728.562902][T25806] mas_preallocate+0x5ea/0x950 [ 1728.562932][T25806] ? register_lock_class+0x54/0x330 [ 1728.562968][T25806] ? __pfx_mas_preallocate+0x10/0x10 [ 1728.562998][T25806] ? __lock_acquire+0xad5/0xd80 [ 1728.563035][T25806] ? __asan_memset+0x23/0x50 [ 1728.563063][T25806] ? init_multi_vma_prep+0x383/0x460 [ 1728.563093][T25806] commit_merge+0x25a/0x730 [ 1728.563134][T25806] ? __pfx_commit_merge+0x10/0x10 [ 1728.563183][T25806] ? dup_anon_vma+0x7d/0x2b0 [ 1728.563212][T25806] ? vma_merge_existing_range+0xb46/0x1750 [ 1728.563240][T25806] vma_merge_existing_range+0x11f1/0x1750 [ 1728.563276][T25806] ? vma_merge_existing_range+0x7d1/0x1750 [ 1728.563303][T25806] ? __pfx_vma_merge_existing_range+0x10/0x10 [ 1728.563339][T25806] vma_modify+0x76/0x450 [ 1728.563374][T25806] vma_modify_flags+0x3b2/0x430 [ 1728.563421][T25806] ? __pfx_vma_modify_flags+0x10/0x10 [ 1728.563478][T25806] mlock_fixup+0x21a/0x350 [ 1728.563519][T25806] apply_mlockall_flags+0x309/0x410 [ 1728.563544][T25806] ? __pfx_apply_mlockall_flags+0x10/0x10 [ 1728.563573][T25806] ? __do_sys_munlockall+0x5a/0x220 [ 1728.563606][T25806] ? ksys_write+0x275/0x2d0 [ 1728.563647][T25806] __do_sys_munlockall+0x10a/0x220 [ 1728.563683][T25806] __do_fast_syscall_32+0xb4/0x110 [ 1728.563707][T25806] ? exc_page_fault+0x5f8/0x920 [ 1728.563734][T25806] do_fast_syscall_32+0x34/0x80 [ 1728.563758][T25806] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1728.563784][T25806] RIP: 0023:0xf710d539 [ 1728.563803][T25806] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1728.563823][T25806] RSP: 002b:00000000f50fd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000099 [ 1728.563847][T25806] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 1728.563862][T25806] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1728.563874][T25806] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1728.563888][T25806] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1728.563901][T25806] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1728.563933][T25806] [ 1728.563962][T25806] vmg ffffc90011cefc00 dumped because: VM_WARN_ON_VMG(prev && start <= prev->vm_start) [ 1728.880329][T19437] syz_tun (unregistering): left allmulticast mode [ 1728.896001][T19437] syz_tun (unregistering): left promiscuous mode [ 1728.907080][T19437] bridge0: port 3(syz_tun) entered disabled state [ 1729.029253][T25806] vmg ffffc90011cefc00 state: mm ffff888033178a00 pgoff 46d [ 1729.029253][T25806] vmi ffffc90011cefda0 [8046d000,80800000) [ 1729.029253][T25806] prev ffff88806a9a3c80 middle ffff88806a9a3c80 next 0000000000000000 target 0000000000000000 [ 1729.029253][T25806] start 8046d000 end 80800000 flags 82000fc [ 1729.029253][T25806] file ffff88802fdf3180 anon_vma 0000000000000000 policy 0000000000000000 [ 1729.029253][T25806] uffd_ctx 0000000000000000 [ 1729.029253][T25806] anon_name 0000000000000000 [ 1729.029253][T25806] state 0 [ 1729.029253][T25806] just_expand 0 [ 1729.029253][T25806] __adjust_middle_start 0 __adjust_next_start 0 [ 1729.029253][T25806] __remove_middle 0 __remove_next 0 [ 1729.132551][T25806] vmg ffffc90011cefc00 mm: [ 1729.137202][T25806] mm ffff888033178a00 task_size 4294959104 [ 1729.137202][T25806] mmap_base 139666080247808 mmap_legacy_base 47966714920960 [ 1729.137202][T25806] pgd ffff88803af08000 mm_users 3 mm_count 1 pgtables_bytes 114688 map_count 39 [ 1729.137202][T25806] hiwater_rss 1e18 hiwater_vm 5f9f total_vm 5f9d locked_vm 393 [ 1729.137202][T25806] pinned_vm 0 data_vm 1406 exec_vm 1169 stack_vm 21 [ 1729.137202][T25806] start_code f7129000 end_code f72d27e8 start_data f7480000 end_data f7480000 [ 1729.137202][T25806] start_brk 5694f000 brk 56971000 start_stack fff8b940 [ 1729.137202][T25806] arg_start fff8cf6d arg_end fff8cf81 env_start fff8cf81 env_end fff8cfe9 [ 1729.137202][T25806] binfmt ffffffff8eeb4500 flags 800007fd [ 1729.137202][T25806] ioctx_table 0000000000000000 [ 1729.137202][T25806] owner ffff88802d2b1e00 exe_file ffff88806cc3bc00 [ 1729.137202][T25806] notifier_subscriptions 0000000000000000 [ 1729.137202][T25806] numa_next_scan 4295110009 numa_scan_offset 0 numa_scan_seq 0 [ 1729.137202][T25806] tlb_flush_pending 0 [ 1729.137202][T25806] def_flags: 0x0() [ 1729.255433][T25785] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1729.278544][T25806] vmg ffffc90011cefc00 prev: [ 1729.291885][T25806] vma ffff88806a9a3c80 start 000000008046d000 end 0000000080800000 mm ffff888033178a00 [ 1729.291885][T25806] prot 25 anon_vma 0000000000000000 vm_ops ffffffff8c54ab00 [ 1729.291885][T25806] pgoff 46d file ffff88802fdf3180 private_data 0000000000000000 [ 1729.291885][T25806] refcnt 1 [ 1729.291885][T25806] flags: 0x82020fc(exec|shared|mayread|maywrite|mayexec|mayshare|locked|noreserve|softdirty) [ 1729.367197][T25806] vmg ffffc90011cefc00 middle: [ 1729.380538][T25806] vma ffff88806a9a3c80 start 000000008046d000 end 0000000080800000 mm ffff888033178a00 [ 1729.380538][T25806] prot 25 anon_vma 0000000000000000 vm_ops ffffffff8c54ab00 [ 1729.380538][T25806] pgoff 46d file ffff88802fdf3180 private_data 0000000000000000 [ 1729.380538][T25806] refcnt 1 [ 1729.380538][T25806] flags: 0x82020fc(exec|shared|mayread|maywrite|mayexec|mayshare|locked|noreserve|softdirty) [ 1729.441092][T25806] vmg ffffc90011cefc00 next: (NULL) [ 1729.448792][T25806] vmg ffffc90011cefc00 vmi: [ 1729.459533][T25806] MAS: tree=ffff888033178a40 enode=ffff888030ab380c [ 1729.479874][T25806] (ma_active) [ 1729.577752][T25806] Store Type: [ 1729.581186][T25806] node_store [ 1729.594155][T14763] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1729.605495][T25806] [3/8] index=8046d000 last=807fffff [ 1729.611844][T25806] min=800a7000 max=f50bcfff alloc=0000000000000000, depth=1, flags=0 [ 1729.633672][T25806] maple_tree(ffff888033178a40) flags 30B, height 2 root ffff888032941c1e [ 1729.649499][T25806] 0-ffffffffffffffff: node ffff888032941c00 depth 0 type 3 parent ffff888033178a41 contents: 2968e000 [ 1729.649568][T25797] bridge0: port 1(bridge_slave_0) entered blocking state [ 1729.660901][T25806] 740bb000 0 ffffffff00073000 0 0 0 0 0 0 | 03 03| ffff88803294140c 800A6FFF ffff888030ab380c F50BCFFF ffff888032941a0c F6D06FFF ffff88802483ea0c FFFFFFFFFFFFFFFF 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 [ 1729.700245][ T5853] Bluetooth: hci4: command tx timeout [ 1729.712974][T25806] 0-800a6fff: node ffff888032941400 depth 1 type 1 parent ffff888032941c06 contents: 0000000000000000 C22FFFF ffff888078afd8c0 E22FFFF 0000000000000000 3271FFFF ffff888078afda00 3275FFFF 0000000000000000 5694EFFF ffff888078afd780 56970FFF 0000000000000000 7FFFEFFF ffff888078afd3c0 7FFFFFFF ffff8880346a1640 800A6FFF 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000008 [ 1729.741272][T25797] bridge0: port 1(bridge_slave_0) entered disabled state [ 1729.757576][T25806] 0-c22ffff: 0000000000000000 [ 1729.768244][T25806] c230000-e22ffff: ffff888078afd8c0 [ 1729.774274][T25806] e230000-3271ffff: 0000000000000000 [ 1729.779953][T25806] 32720000-3275ffff: ffff888078afda00 [ 1729.786072][T25806] 32760000-5694efff: 0000000000000000 [ 1729.791907][T25806] 5694f000-56970fff: ffff888078afd780 [ 1729.798690][T25806] 56971000-7fffefff: 0000000000000000 [ 1729.804942][T25806] 7ffff000-7fffffff: ffff888078afd3c0 [ 1729.810874][T25806] 80000000-800a6fff: ffff8880346a1640 [ 1729.817025][T25806] 800a7000-f50bcfff: node ffff888030ab3800 depth 1 type 1 parent ffff888032941c0e contents: 0000000000000000 800A8FFF ffff8880346a1000 80468FFF ffff8880346a1500 8046CFFF ffff88806a9a3c80 807FFFFF ffff88803b00cb40 80FBDFFF ffff88803b00cdc0 80FFFFFF ffff888078afd500 81000FFF 0000000000000000 F50BBFFF ffff88805e527c80 F50BCFFF 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000008 [ 1729.862434][T25797] bridge_slave_0: entered allmulticast mode [ 1729.874371][T25806] 800a7000-800a8fff: 0000000000000000 [ 1729.875123][T25797] bridge_slave_0: entered promiscuous mode [ 1729.880290][T25806] 800a9000-80468fff: ffff8880346a1000 [ 1729.901141][T25806] 80469000-8046cfff: ffff8880346a1500 [ 1729.907323][T25806] 8046d000-807fffff: ffff88806a9a3c80 [ 1729.918952][T25806] 80800000-80fbdfff: ffff88803b00cb40 [ 1729.924989][T25806] 80fbe000-80ffffff: ffff88803b00cdc0 [ 1729.933745][T25806] 81000000-81000fff: ffff888078afd500 [ 1729.939715][T25806] 81001000-f50bbfff: 0000000000000000 [ 1729.945966][T25806] f50bc000-f50bcfff: ffff88805e527c80 [ 1729.951956][T25806] f50bd000-f6d06fff: node ffff888032941a00 depth 1 type 1 parent ffff888032941c16 contents: ffff888050cbf280 F50DCFFF ffff8880293bcc80 F50DDFFF ffff888078afd640 F50FDFFF ffff888050cbf3c0 F50FEFFF ffff888078afd280 F58FEFFF ffff888032a823c0 F58FFFFF ffff88805121c500 F60FFFFF ffff88805121c3c0 F6101FFF ffff88805121c140 F6501FFF ffff88805121cc80 F6503FFF ffff88805121ca00 F6903FFF ffff88805121c780 F6905FFF ffff88805121cdc0 F6D05FFF ffff88805121cb40 F6D06FFF 0000000000000000 0 000000000000000d [ 1730.001571][T25806] f50bd000-f50dcfff: ffff888050cbf280 [ 1730.007507][T25806] f50dd000-f50ddfff: ffff8880293bcc80 [ 1730.017698][T25806] f50de000-f50fdfff: ffff888078afd640 [ 1730.018194][T14763] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1730.035124][T25806] f50fe000-f50fefff: ffff888050cbf3c0 [ 1730.041237][T25806] f50ff000-f58fefff: ffff888078afd280 [ 1730.048750][T25806] f58ff000-f58fffff: ffff888032a823c0 [ 1730.055072][T25806] f5900000-f60fffff: ffff88805121c500 [ 1730.061048][T25806] f6100000-f6101fff: ffff88805121c3c0 [ 1730.067035][T25806] f6102000-f6501fff: ffff88805121c140 [ 1730.073302][T25806] f6502000-f6503fff: ffff88805121cc80 [ 1730.079253][T25806] f6504000-f6903fff: ffff88805121ca00 [ 1730.089478][T25806] f6904000-f6905fff: ffff88805121c780 [ 1730.099883][T25806] f6906000-f6d05fff: ffff88805121cdc0 [ 1730.109797][T25797] bridge0: port 2(bridge_slave_1) entered blocking state [ 1730.124983][T25806] f6d06000-f6d06fff: ffff88805121cb40 [ 1730.131109][T25797] bridge0: port 2(bridge_slave_1) entered disabled state [ 1730.144417][T25806] f6d07000-ffffffffffffffff: node ffff88802483ea00 depth 1 type 1 parent ffff888032941c1e contents: ffff88805121c8c0 F7106FFF ffff88805121c640 F710AFFF ffff88805121c280 F710CFFF ffff88805121c000 F710FFFF ffff888046114dc0 F7128FFF ffff88803598a3c0 F72D2FFF ffff88803598ac80 F73A9FFF ffff888060f06a00 F7472FFF ffff888050cbfa00 F747AFFF 0000000000000000 F747FFFF ffff888050cbf640 F74CFFFF ffff888050cbf500 F74D0FFF ffff888050cbf000 F7FDAFFF 0000000000000000 FFF6BFFF ffff888050cbf140 FFF8CFFF 0000000000000000 [ 1730.192415][T25797] bridge_slave_1: entered allmulticast mode [ 1730.202362][T25797] bridge_slave_1: entered promiscuous mode [ 1730.230532][T25806] f6d07000-f7106fff: ffff88805121c8c0 [ 1730.238301][T25806] f7107000-f710afff: ffff88805121c640 [ 1730.244360][T25806] f710b000-f710cfff: ffff88805121c280 [ 1730.250128][T25806] f710d000-f710ffff: ffff88805121c000 [ 1730.260363][T25806] f7110000-f7128fff: ffff888046114dc0 [ 1730.267564][T25806] f7129000-f72d2fff: ffff88803598a3c0 [ 1730.274220][T25806] f72d3000-f73a9fff: ffff88803598ac80 [ 1730.280247][T25806] f73aa000-f7472fff: ffff888060f06a00 [ 1730.288040][T25806] f7473000-f747afff: ffff888050cbfa00 [ 1730.294386][T25806] f747b000-f747ffff: 0000000000000000 [ 1730.300216][T25806] f7480000-f74cffff: ffff888050cbf640 [ 1730.306527][T25806] f74d0000-f74d0fff: ffff888050cbf500 [ 1730.314347][T25806] f74d1000-f7fdafff: ffff888050cbf000 [ 1730.333854][T25806] f7fdb000-fff6bfff: 0000000000000000 [ 1730.351765][T14763] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1730.362969][T25806] fff6c000-fff8cfff: ffff888050cbf140 [ 1730.368776][T25806] fff8d000-ffffffffffffffff: 0000000000000000 [ 1730.395239][T25806] ------------[ cut here ]------------ [ 1730.400819][T25806] WARNING: CPU: 1 PID: 25806 at mm/vma.c:768 vma_merge_existing_range+0x13c6/0x1750 [ 1730.410680][T25806] Modules linked in: [ 1730.415525][T25806] CPU: 1 UID: 0 PID: 25806 Comm: syz.4.6147 Not tainted 6.15.0-rc2-syzkaller-00488-g6fea5fabd332 #0 PREEMPT(full) [ 1730.427708][T25806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 1730.438146][T25806] RIP: 0010:vma_merge_existing_range+0x13c6/0x1750 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1730.445620][T25806] Code: 90 e9 e0 ef ff ff e8 49 dc a4 ff 90 0f 0b 90 e9 c8 ee ff ff e8 3b dc a4 ff 48 8b 3c 24 48 c7 c6 40 65 56 8c e8 0b 4d f1 ff 90 <0f> 0b 90 e9 4d ef ff ff e8 1d dc a4 ff e9 a8 f0 ff ff e8 13 dc a4 [ 1730.466302][T25806] RSP: 0018:ffffc90011cefa20 EFLAGS: 00010286 [ 1730.472742][T25806] RAX: ffffffff8c27cff5 RBX: 000000008046d000 RCX: ffff888026128000 [ 1730.480781][T25806] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: ffffffffffffffff [ 1730.488867][T25806] RBP: ffffc90011cefb50 R08: ffffffff8c27cef0 R09: 1ffff9200239deac [ 1730.497356][T25806] R10: dffffc0000000000 R11: fffff5200239dead R12: 000000008046d000 [ 1730.505804][T25806] R13: ffffffff93686020 R14: 1ffff9200239df84 R15: 0000000080800000 [ 1730.513865][T25806] FS: 0000000000000000(0000) GS:ffff88812509a000(0063) knlGS:00000000f50fdb40 [ 1730.523395][T25806] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 1730.530019][T25806] CR2: 0000000080155018 CR3: 000000003af08000 CR4: 00000000003526f0 [ 1730.538156][T25806] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1730.547117][T25806] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1730.556204][T25806] Call Trace: [ 1730.559578][T25806] [ 1730.562630][T25806] ? vma_merge_existing_range+0x7d1/0x1750 [ 1730.568492][T25806] ? __pfx_vma_merge_existing_range+0x10/0x10 [ 1730.574690][T25806] vma_modify+0x76/0x450 [ 1730.578996][T25806] vma_modify_flags+0x3b2/0x430 [ 1730.585713][T25806] ? __pfx_vma_modify_flags+0x10/0x10 [ 1730.591173][T25806] mlock_fixup+0x21a/0x350 [ 1730.595717][T25806] apply_mlockall_flags+0x309/0x410 [ 1730.600965][T25806] ? __pfx_apply_mlockall_flags+0x10/0x10 [ 1730.610178][T25806] ? __do_sys_munlockall+0x5a/0x220 [ 1730.615805][T25806] ? ksys_write+0x275/0x2d0 [ 1730.620371][T25806] __do_sys_munlockall+0x10a/0x220 [ 1730.626348][T25806] __do_fast_syscall_32+0xb4/0x110 [ 1730.631559][T25806] ? exc_page_fault+0x5f8/0x920 [ 1730.636454][T25806] do_fast_syscall_32+0x34/0x80 [ 1730.641347][T25806] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1730.648891][T25806] RIP: 0023:0xf710d539 [ 1730.653767][T25806] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1730.674040][T25806] RSP: 002b:00000000f50fd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000099 [ 1730.682571][T25806] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 1730.690585][T25806] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1730.698652][T25806] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1730.707208][T25806] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1730.715300][T25806] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1730.723653][T25806] [ 1730.726714][T25806] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1730.734048][T25806] CPU: 1 UID: 0 PID: 25806 Comm: syz.4.6147 Not tainted 6.15.0-rc2-syzkaller-00488-g6fea5fabd332 #0 PREEMPT(full) [ 1730.746325][T25806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 1730.756414][T25806] Call Trace: [ 1730.759705][T25806] [ 1730.762648][T25806] dump_stack_lvl+0x241/0x360 [ 1730.767353][T25806] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1730.772577][T25806] ? __pfx__printk+0x10/0x10 [ 1730.777198][T25806] ? vscnprintf+0x5d/0x90 [ 1730.781546][T25806] panic+0x349/0x880 [ 1730.785556][T25806] ? __warn+0x174/0x4d0 [ 1730.789740][T25806] ? __pfx_panic+0x10/0x10 [ 1730.794187][T25806] __warn+0x344/0x4d0 [ 1730.798270][T25806] ? vma_merge_existing_range+0x13c6/0x1750 [ 1730.804185][T25806] report_bug+0x2b3/0x500 [ 1730.808539][T25806] ? vma_merge_existing_range+0x13c6/0x1750 [ 1730.814533][T25806] ? vma_merge_existing_range+0x13c6/0x1750 [ 1730.820461][T25806] ? vma_merge_existing_range+0x13c8/0x1750 [ 1730.826366][T25806] handle_bug+0x89/0x170 [ 1730.830629][T25806] exc_invalid_op+0x1a/0x50 [ 1730.835158][T25806] asm_exc_invalid_op+0x1a/0x20 [ 1730.840203][T25806] RIP: 0010:vma_merge_existing_range+0x13c6/0x1750 [ 1730.846838][T25806] Code: 90 e9 e0 ef ff ff e8 49 dc a4 ff 90 0f 0b 90 e9 c8 ee ff ff e8 3b dc a4 ff 48 8b 3c 24 48 c7 c6 40 65 56 8c e8 0b 4d f1 ff 90 <0f> 0b 90 e9 4d ef ff ff e8 1d dc a4 ff e9 a8 f0 ff ff e8 13 dc a4 [ 1730.866472][T25806] RSP: 0018:ffffc90011cefa20 EFLAGS: 00010286 [ 1730.872667][T25806] RAX: ffffffff8c27cff5 RBX: 000000008046d000 RCX: ffff888026128000 [ 1730.880672][T25806] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: ffffffffffffffff [ 1730.888672][T25806] RBP: ffffc90011cefb50 R08: ffffffff8c27cef0 R09: 1ffff9200239deac [ 1730.896663][T25806] R10: dffffc0000000000 R11: fffff5200239dead R12: 000000008046d000 [ 1730.904649][T25806] R13: ffffffff93686020 R14: 1ffff9200239df84 R15: 0000000080800000 [ 1730.912643][T25806] ? mt_dump_node+0x1860/0x2290 [ 1730.917514][T25806] ? mt_dump_node+0x1965/0x2290 [ 1730.922397][T25806] ? vma_merge_existing_range+0x7d1/0x1750 [ 1730.928310][T25806] ? __pfx_vma_merge_existing_range+0x10/0x10 [ 1730.934411][T25806] vma_modify+0x76/0x450 [ 1730.938675][T25806] vma_modify_flags+0x3b2/0x430 [ 1730.943551][T25806] ? __pfx_vma_modify_flags+0x10/0x10 [ 1730.948964][T25806] mlock_fixup+0x21a/0x350 [ 1730.953413][T25806] apply_mlockall_flags+0x309/0x410 [ 1730.958621][T25806] ? __pfx_apply_mlockall_flags+0x10/0x10 [ 1730.964356][T25806] ? __do_sys_munlockall+0x5a/0x220 [ 1730.969581][T25806] ? ksys_write+0x275/0x2d0 [ 1730.974116][T25806] __do_sys_munlockall+0x10a/0x220 [ 1730.979254][T25806] __do_fast_syscall_32+0xb4/0x110 [ 1730.984379][T25806] ? exc_page_fault+0x5f8/0x920 [ 1730.989248][T25806] do_fast_syscall_32+0x34/0x80 [ 1730.994112][T25806] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1731.000462][T25806] RIP: 0023:0xf710d539 [ 1731.004541][T25806] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1731.024174][T25806] RSP: 002b:00000000f50fd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000099 [ 1731.032626][T25806] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 1731.040716][T25806] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1731.048752][T25806] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1731.056745][T25806] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1731.064742][T25806] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1731.072747][T25806] [ 1731.076421][T25806] Kernel Offset: disabled [ 1731.080774][T25806] Rebooting in 86400 seconds..