last executing test programs: 4m18.445460192s ago: executing program 3 (id=2763): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan0\x00', 0x0}) r2 = socket$caif_seqpacket(0x25, 0x5, 0x3) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000000080)={0x12}) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) (async) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000100), 0x40000, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000140)={0x2, 0x17}, 0x2) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) ioctl$RTC_VL_CLR(r4, 0x7014) (async, rerun: 32) getsockopt$CAN_RAW_LOOPBACK(r4, 0x65, 0x3, &(0x7f00000001c0), &(0x7f0000000200)=0x4) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r5) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7, 0x6, &(0x7f0000000280)=0x1) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000340)={'ip6_vti0\x00', &(0x7f00000002c0)={'ip6tnl0\x00', r1, 0x4, 0x6, 0x8, 0x0, 0x1a, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @dev={0xfe, 0x80, '\x00', 0x1f}, 0x7, 0x10, 0x1, 0x400}}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0xffffff80, '\x00', r6, r4, 0x0, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x50) (async) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r4, 0xc0189379, &(0x7f0000000440)={{0x1, 0x1, 0x18, r4}, './file0\x00'}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r7) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x5, 0xd3e23f9, &(0x7f0000000480)) (async, rerun: 32) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000004c0)="0c088ebabbc25eefcfc9fbb79b2c51c6dffdb151bf7d5050611ee3d7a72b89cc069ae9c63eb3c7212b5d57e5e5cffbd5f21085f04d7460ca01697c867ec71922654da8a1b0983a1ae8620f", 0x4b) (rerun: 32) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r7, 0x0, 0x51, 0x94, &(0x7f0000000540)="bf35d232fe4f513e1c29fb786ebf3de01b983463de5bbd7fa2788112d1944e4a79822b958c045c65ff947844150865ab13ca1f51fec9cede58a45fce9a9d3947abd74011461540e31a680ad87c0355a5d2", &(0x7f00000005c0)=""/148, 0x7, 0x0, 0xe4, 0x3c, &(0x7f0000000680)="1a707d7ccbf8a8d9b4f333ff35850e46db07b9ed428e835189861fbec54379844755e336d0d623579362fd7eb96830481e5f4d646c91ed97412b172b32f76271d498f3b1df52888178bd39dcf78b40d6ec5ccee378fa2c7a09feac43e967143c57c0cbff9f51d73f28e931ad0b65802684da2f11c4dd705d7d5e9a61c158900af998671192894a1ff65aef19a164741b6b795d99b224db9a45a31f4d604c4dbbb2aaeb718323baee8b8887816fd5bdd22b75becab1e82ce179ef75945e6e9a46324e84ac09618d645c2899f7acb08ab0717d57a974b0147667a8d762994cb8886551b8d6", &(0x7f0000000780)="bcc4dd08f5318c3ffe81297557c86719fe505bc9ff491393ebe4aafa3cf83014884a8a5637c892539f589ee720bb0ba291a7354458c269c01577c771", 0x2, 0x0, 0x4}, 0x50) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xc05, 0x4, &(0x7f0000000840)) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000880)={@private, @empty}, &(0x7f00000008c0)=0xc) (async) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000940), r7) sendmsg$NL80211_CMD_GET_WOWLAN(r7, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x14, r8, 0x1, 0x70bd25, 0x25dfdbfb, {{}, {@void, @void, @void}}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4100}, 0x4004000) (async) fsync(r2) (async) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) (async, rerun: 64) r9 = signalfd4(r3, &(0x7f0000000a40)={[0x5]}, 0x8, 0x0) (rerun: 64) setsockopt$MRT6_ADD_MFC_PROXY(r9, 0x29, 0xd2, &(0x7f0000000a80)={{0xa, 0x4e21, 0xfffffffb, @loopback, 0x8}, {0xa, 0x4e22, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x6}, 0x1, {[0x9, 0x6, 0xff, 0x8, 0x8, 0x9, 0x81, 0x4]}}, 0x5c) (async) mkdirat(r9, &(0x7f0000000b00)='./file0\x00', 0x4) (async) open(&(0x7f0000000b40)='./file0\x00', 0x2000, 0x1) 4m15.776014558s ago: executing program 3 (id=2773): syz_io_uring_setup(0xd2, &(0x7f0000008e40)={0x0, 0xd77c, 0x1086, 0x1001003, 0x1eb}, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x10, 0x2a43, &(0x7f0000006680)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYNAME(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB="6c0000000e06010100000000000000000700000605000100"], 0x6c}, 0x1, 0x0, 0x0, 0x20040080}, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x0, 0x2, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x7, &(0x7f0000000140)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x5, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0xe, 0x0, &(0x7f0000000000)="c03cba2d1f1f78de2c3ba843600c", 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="2c0000000d0a010e000000000000000001000000090001007379000000eaffff0800020073797a32000000005effada0298352c7e14f1a56c47bd15bf09a6de663272ef2c922b4bf4cd0a97bc2694fea08aad9f6ee708f7168d7e9c01e656365b7254a16e308f9e4735a13f1ab402d35179ae8929ca8ef9de0728d623e10bdefbd5a877ed48a8d86f51c97b5b007b8888c57e568abc262023fce5096da7d277e2c98039d9a368af123e0562f63d5538605708c96a6a96225c75c328ce219d7b1ec555629fdd10bfa2c721d66e4bb50b320164f5ec4fc"], 0x2c}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x25dfdc00, {0x0, 0x0, 0x74, r6, {0xf}, {0x0, 0x1}, {0x3, 0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x8881}, 0x44) 4m13.818017997s ago: executing program 3 (id=2781): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a8f4dd086d0492082a6d0000000109021b0001000000000904"], 0x0) r1 = syz_usb_connect$hid(0x4, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x56a, 0x33c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xd, 0x20, 0x8, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x1, 0xd, {0x9, 0x21, 0x8, 0x9, 0x1, {0x22, 0x2ca}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x7f}}}}}]}}]}}, &(0x7f0000000280)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x250, 0x5, 0x5, 0x50, 0x8, 0xa}, 0x114, &(0x7f0000000100)={0x5, 0xf, 0x114, 0x4, [@generic={0xf5, 0x10, 0xa, "a89812c3e5bb280b227d5e720b407633dfe60bfc754e933b26197c4c6b8cc3fe20cec35838172222821647f42a5700d85b0eb77c3312f80bad8a3ec6e36558a5c34947a87677402d15b7b1d87efc63a9b06a8d8ba1906bf02d980c3e6f0b324458d1bca779818383f3a36ed148b568f1bd0719a8b7fc646e1ae90754fc418415cf51b1da323dea4205631dd856d42e57a8cce03b04ec624c6fc855976dfcaec91d06b4d5c972913d8d883bfcc6cb03540d762cc2efedc56412e64bd52b21ce1342c93c1b69d887a50d0fb58a1dc7c1299f82785383f5df946aba6267a9f1b3e426d4a220f11171129b548427444ad23fdda2"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x1, 0x68, 0xac, 0x0, 0x24}, @ssp_cap={0xc, 0x10, 0xa, 0x2, 0x0, 0x3, 0xf00, 0x9}, @ptm_cap={0x3}]}, 0x1, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x44f}}]}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) close_range(r2, 0xffffffffffffffff, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, 0x0, r4, 0x0, 0x46) syz_usb_control_io$printer(r0, 0x0, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f00000009c0)='4\x00', 0x2) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000cc0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000800)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000b80)={0x24, &(0x7f0000000a00)={0x40, 0xe, 0x7b, {0x7b, 0x5, "ed208ffe549b46c180d746b2132c6e148af77d2492fe488c90575f1bf4b5dc2937417a69e70dc3d6459882e744bee6b422b64fc017b63d679bb110489ced5689fb9c3cdcd2b4a8bed46d2858a0b5a38ca962dd7966de10af765181107ea2d4ebbb6bab06ed125f58a1b00c19403b15bc4b62bf3024506f97ce"}}, &(0x7f0000000ac0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x500a}}, &(0x7f0000000b00)={0x0, 0x22, 0x11, {[@local=@item_012={0x1, 0x2, 0xe, "9c"}, @main=@item_4={0x3, 0x0, 0x8, "a98aac4c"}, @local=@item_4={0x3, 0x2, 0x1, "50bd1bff"}, @local=@item_012={0x2, 0x2, 0x3, "0321"}, @main=@item_012={0x1, 0x0, 0x8, "e7"}]}}, &(0x7f0000000b40)={0x0, 0x21, 0x9, {0x9, 0x21, 0x3, 0x2, 0x1, {0x22, 0xf0}}}}, &(0x7f0000000e80)={0x2c, &(0x7f0000000bc0)={0x20, 0xe, 0xcb, "b2f956ad3c2e9ef92e5ac16b40949db3982586e8dd1e1ba4828aeb79e4e4172bf33e63da56529660389c057a1ad0d932e681b3a5c4614532456041156b15adb0cf845f3cf80f4cf2cb7de3f4b84757e15742d88d1d5fef284630c696374311f1322c2caa0198540eb71314c4cbcc1f4750c29539f2c0a8e4566855ca1e5e2a000d62fa16350022c5bd6d09bd5e816b9f6f1915668f5e126ca275d61246d5902be85a98abf347eb668a442fc8c780f618573518020aa94f802752e5e29867bc088cd99dc441b546b20e941a"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0xb}, &(0x7f0000000dc0)={0x20, 0x1, 0x44, "690301c127b99783863b22cf2c6e88e8175fb8320fa8861c36b10faae7d0ec570d5639d94312315606759ee9bed2f228022162d1688764a8738a7024d36eb74ac6997ef1"}, &(0x7f0000000e40)={0x20, 0x3, 0x1, 0x2e}}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a0103000000000000000001000000050a03000000000000000000010020000900030073797a3200000000140000001100"], 0x68}}, 0x200000d4) r6 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="12010000b1bd2f087d0403508c2f010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r6, &(0x7f00000000c0)={0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="0000f50000000341e9"], 0x0}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r7, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x34, 0x0, 0x20, 0x70bd26, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0x10}, @NL80211_ATTR_BSS_HT_OPMODE={0x6, 0x6d, 0x8}, @NL80211_ATTR_BSS_SHORT_PREAMBLE={0x5, 0x1d, 0x6}, @NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x10}]}, 0x34}, 0x1, 0x0, 0x0, 0x30000000}, 0x44000) syz_usb_control_io$cdc_ecm(r6, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000680)={0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="001203000000c8"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000400)={0x14, &(0x7f00000002c0)={0x40, 0x22, 0xb3, {0xb3, 0xe, "d2eadf1e1dd3447c92c4681e976c9c27a8632f2abae4f456b12db58ebe0d64e1916dd453f90decfcf6a6544e91af5025834efc7a32888e7fd95e918984717459746ef1d9e4e7c744d2e9e0374e48ace847d98a2fd0f97f658ef222e5d2abc014865d5c2736db53deb377740f58d0aa2e42e9a174d7203019fffc96e17009c091e2abbd6e4548d4d82e2e4858aac5b539a36234fae46ee580f3edae883ae0231eddc198a435418c411864ab6eda8432fd3c"}}, &(0x7f00000003c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000780)={0x44, &(0x7f0000000440)={0x0, 0x14, 0xc4, "0760e877c4a43329ebff024af94b02b6b197cfee2d22aa07f52769d34974b03684233cf019f03189f3f50002535367052058c45fce24aad0d179ff85b40940ba16f6486c9a9ca3cce32bb2e4e929005ab1ee05c9c52a1a489210cdeb819be4d828eaa784feed121d0c79d3b0cbd5b338bbe26ac8e20a7540030feeb201d8d076348bdbf4bfc47a3005f7198ca740354af355d717a144727369d53dda0ecf5b861cf4791ee3008da0f9e612751588417c09caef4f1a2f4f830bda18e68ef86024a66fc6fe"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0xb}, &(0x7f00000005c0)={0x20, 0x80, 0x1c, {0x5, 0x0, 0x79, 0x1, 0x0, 0xfed9, 0x5567, 0x6c, 0xe, 0x6, 0x5, 0xa2}}, &(0x7f0000000600)={0x20, 0x85, 0x4, 0x6}, &(0x7f0000000640)={0x20, 0x83, 0x2}, &(0x7f0000000700)={0x20, 0x87, 0x2, 0xfffd}, &(0x7f0000000740)={0x20, 0x89, 0x2}}) syz_usb_control_io(r0, 0x0, 0x0) 4m11.210285003s ago: executing program 3 (id=2790): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f0000000240)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000040)='./file0\x00') r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x202, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000080)={0x7fff, 0x2, 0xfff, 0x6a}, 0x10) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000001200)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x48, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000640)=0x4) syz_usbip_server_init(0x3) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000180)=@arm64={0xf9, 0xff, 0x5, '\x00', 0x8}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 4m10.585469647s ago: executing program 3 (id=2792): openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x20a800, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000340)=""/187, 0xbb}], 0x1, 0x1a, 0x40) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x11, &(0x7f0000000040)=0x5f, 0x4) socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xb, 0x0, 0x0) getrandom(0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) connect$can_bcm(r0, &(0x7f00000000c0), 0x10) openat$sequencer(0xffffffffffffff9c, 0x0, 0x400, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0xa2001, 0x0) symlink(&(0x7f0000000680)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000001680)='./file0/file0\x00') r2 = syz_io_uring_setup(0xe34, &(0x7f0000000400)={0x0, 0x3b4e, 0x200, 0x7, 0x801, 0x0, r0}, &(0x7f0000000180)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_CLOSE={0x13, 0x16, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x7277, 0x0, 0x28, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200), 0x447c40, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_open_dev$sndctrl(&(0x7f0000000040), 0x80000000, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x1df) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, 0x0, 0x0) open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x6f) 4m9.607032986s ago: executing program 3 (id=2796): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) recvmmsg$unix(r0, &(0x7f0000003100)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x13}}], 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, &(0x7f0000000000)={@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}, 0x4, 0x0, 0x1}, 0x20) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000180)=""/66, 0x42}], 0x1, 0x0, 0x3) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa29956f4, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) 4m8.734785297s ago: executing program 32 (id=2796): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) recvmmsg$unix(r0, &(0x7f0000003100)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x13}}], 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, &(0x7f0000000000)={@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}, 0x4, 0x0, 0x1}, 0x20) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000180)=""/66, 0x42}], 0x1, 0x0, 0x3) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa29956f4, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) 50.662049829s ago: executing program 2 (id=3502): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x3, 0x0) r2 = socket(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000380)={&(0x7f0000000040), 0xc, &(0x7f0000000340)={&(0x7f0000000400)=@delchain={0x17c, 0x65, 0x800, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0xe, 0xfff3}, {0x7}, {0xffff, 0x2}}, [@TCA_CHAIN={0x8, 0xb, 0xc}, @TCA_RATE={0x6, 0x5, {0x1, 0xf7}}, @TCA_RATE={0x6, 0x5, {0x2, 0x5}}, @filter_kind_options=@f_u32={{0x8}, {0x138, 0x2, [@TCA_U32_HASH={0x8, 0x2, 0x5}, @TCA_U32_SEL={0x114, 0x5, {0x6, 0xc, 0x1, 0xa, 0x2, 0x3, 0xfff9, 0x9, [{0x8, 0x81, 0x100, 0xffff}, {0x2d80, 0x400, 0x3b, 0x7}, {0x10, 0x101, 0xef9, 0x100}, {0x7fffffff, 0x10, 0xff, 0x96ad}, {0x7fff, 0x6, 0x7, 0xfff}, {0x4, 0x6, 0x6, 0x1}, {0x182, 0x401, 0x0, 0x7}, {0x1, 0x80000001, 0x548bbece}, {0xfffffffd, 0x3, 0x653, 0x6}, {0x6c, 0x1ff, 0x14ff, 0xbe73}, {0x7ff, 0x62, 0x80000001, 0x6}, {0x10001, 0x4, 0xffff, 0x3}, {0x3, 0x0, 0x5, 0x6}, {0xfffffffe, 0x1, 0x7, 0x22c}, {0x3, 0x80000000, 0xffff0001, 0xfffffff7}, {0x1fe000, 0x7, 0x2, 0x9}]}}, @TCA_U32_LINK={0x8, 0x3, 0xffffffff}, @TCA_U32_MARK={0x10, 0xa, {0x1a, 0x800}}]}}]}, 0x17c}, 0x1, 0x0, 0x0, 0xc004}, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000003c0)={'bridge0\x00', 0x0}) setsockopt$MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000000)={0x0, 0x0, 0x0, r5}, 0xc) write(r1, &(0x7f0000000240)="2400000011005f0414f9f40700090400810000000d0000deffffffff07000f000100000090a71c6afc3bab20b21dc667eb2c881d6a038006a8bc5766509bdd5013c44038bef3d3d70000000000000000d73dde999a015037bc8ee9a3b90e4082c5ff0615d4334483e094ca6d2171dcb22945e444569f406e7588a9b1d3d994095a95bf20f24474b0af10384e2c", 0xfffffffffffffe6e) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) syz_io_uring_setup(0x43f6, &(0x7f0000000000)={0x0, 0x7d43, 0x400, 0x1, 0x258}, &(0x7f00000001c0), &(0x7f0000000280)) r7 = fsopen(&(0x7f0000000000)='devpts\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000280)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\bb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xd7\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) r8 = fcntl$dupfd(r0, 0x406, r0) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r9, 0x89f1, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000100)={'syztnl0\x00', 0x0, 0x0, 0x10, 0x3, 0x6, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x5e55b37311de6d89, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x13}}}}}) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r0) sendmsg$DEVLINK_CMD_GET(r8, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r10, 0x738, 0x70bd28, 0x25dfdbfb, {}, [@pci={{0x8}, {0x11}}]}, 0x30}}, 0x0) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000004a0e0d0000000e0001006e65744e657673696d0000000f0002006e657464657654696d3000000800a80000000000"], 0x3c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket(0x10, 0x3, 0x0) (async) socket(0xa, 0x3, 0x3a) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000380)={&(0x7f0000000040), 0xc, &(0x7f0000000340)={&(0x7f0000000400)=@delchain={0x17c, 0x65, 0x800, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0xe, 0xfff3}, {0x7}, {0xffff, 0x2}}, [@TCA_CHAIN={0x8, 0xb, 0xc}, @TCA_RATE={0x6, 0x5, {0x1, 0xf7}}, @TCA_RATE={0x6, 0x5, {0x2, 0x5}}, @filter_kind_options=@f_u32={{0x8}, {0x138, 0x2, [@TCA_U32_HASH={0x8, 0x2, 0x5}, @TCA_U32_SEL={0x114, 0x5, {0x6, 0xc, 0x1, 0xa, 0x2, 0x3, 0xfff9, 0x9, [{0x8, 0x81, 0x100, 0xffff}, {0x2d80, 0x400, 0x3b, 0x7}, {0x10, 0x101, 0xef9, 0x100}, {0x7fffffff, 0x10, 0xff, 0x96ad}, {0x7fff, 0x6, 0x7, 0xfff}, {0x4, 0x6, 0x6, 0x1}, {0x182, 0x401, 0x0, 0x7}, {0x1, 0x80000001, 0x548bbece}, {0xfffffffd, 0x3, 0x653, 0x6}, {0x6c, 0x1ff, 0x14ff, 0xbe73}, {0x7ff, 0x62, 0x80000001, 0x6}, {0x10001, 0x4, 0xffff, 0x3}, {0x3, 0x0, 0x5, 0x6}, {0xfffffffe, 0x1, 0x7, 0x22c}, {0x3, 0x80000000, 0xffff0001, 0xfffffff7}, {0x1fe000, 0x7, 0x2, 0x9}]}}, @TCA_U32_LINK={0x8, 0x3, 0xffffffff}, @TCA_U32_MARK={0x10, 0xa, {0x1a, 0x800}}]}}]}, 0x17c}, 0x1, 0x0, 0x0, 0xc004}, 0x10) (async) socket$netlink(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000003c0)={'bridge0\x00'}) (async) setsockopt$MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000000)={0x0, 0x0, 0x0, r5}, 0xc) (async) write(r1, &(0x7f0000000240)="2400000011005f0414f9f40700090400810000000d0000deffffffff07000f000100000090a71c6afc3bab20b21dc667eb2c881d6a038006a8bc5766509bdd5013c44038bef3d3d70000000000000000d73dde999a015037bc8ee9a3b90e4082c5ff0615d4334483e094ca6d2171dcb22945e444569f406e7588a9b1d3d994095a95bf20f24474b0af10384e2c", 0xfffffffffffffe6e) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) (async) syz_io_uring_setup(0x43f6, &(0x7f0000000000)={0x0, 0x7d43, 0x400, 0x1, 0x258}, &(0x7f00000001c0), &(0x7f0000000280)) (async) fsopen(&(0x7f0000000000)='devpts\x00', 0x1) (async) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000280)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\bb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xd7\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) (async) fcntl$dupfd(r0, 0x406, r0) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r9, 0x89f1, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000100)={'syztnl0\x00', 0x0, 0x0, 0x10, 0x3, 0x6, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x5e55b37311de6d89, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x13}}}}}) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r0) (async) sendmsg$DEVLINK_CMD_GET(r8, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r10, 0x738, 0x70bd28, 0x25dfdbfb, {}, [@pci={{0x8}, {0x11}}]}, 0x30}}, 0x0) (async) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000004a0e0d0000000e0001006e65744e657673696d0000000f0002006e657464657654696d3000000800a80000000000"], 0x3c}}, 0x0) (async) 50.525042857s ago: executing program 2 (id=3503): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8500, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x800) (async) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) (async) r5 = epoll_create1(0x0) (async) r6 = syz_open_dev$tty1(0xc, 0x4, 0x4) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000000000)={0xa000000d}) (async) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0x9, 0x0, 0x0) (async) write$UHID_INPUT(r4, &(0x7f0000001580)={0xfc, {"a2e3ad1bed0d09f91b5e071887f70e09d038e7ff7fc6e5539b0d500a8b089b3f3b3568030890e0879b0af8c6e70a9b334a959b669a242f0a0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d0773090acd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb62913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab002f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) (async) r8 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000001080)=ANY=[@ANYRES32=r3]) (async) r9 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f00000010c0)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) (async) io_setup(0x30, &(0x7f0000000600)=0x0) r12 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) io_submit(r11, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r12, 0x0}]) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4040aea0, &(0x7f00000001c0)=@arm64={0x3e, 0x8, 0x1, '\x00', 0x1004}) (async) ioctl$KVM_SET_GUEST_DEBUG(r9, 0x4048ae9b, &(0x7f0000000200)={0xf0003, 0x0, [0x0, 0x8, 0x0, 0x0, 0xfffffffffffffffd]}) ioctl$KVM_SET_GUEST_DEBUG(r9, 0x4048ae9b, &(0x7f0000000000)={0x1a0000, 0x0, [0xd, 0xf429, 0x2, 0x1, 0x100, 0x2, 0x400, 0x7fffffffffffffff]}) (async) socket(0xa, 0x3, 0x3a) (async) r13 = syz_open_procfs(0x0, &(0x7f0000000040)='net/raw6\x00') preadv(r13, &(0x7f0000000000)=[{&(0x7f0000002780)=""/4096, 0x1000}], 0x1, 0x40, 0x0) (async) syz_usb_connect(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000025245c407c2c9101050f00000001090224000100008000090454fd02ffffff00090507ffff048140060905870308"], 0x0) (async) syz_usb_connect(0x0, 0x3b, &(0x7f0000000040)=ANY=[], 0x0) (async) socket$packet(0x11, 0x2, 0x300) 50.258261237s ago: executing program 2 (id=3506): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=ANY=[@ANYBLOB="a0000000000101040000000000000000020000002400018014000180080001006401010208000200ac1414000400028005000100"], 0xa0}}, 0x0) (fail_nth: 5) 49.774221513s ago: executing program 2 (id=3508): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)) socket$nl_generic(0x10, 0x3, 0x10) epoll_create1(0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="5c00000002060511001f0000000000000000000005000400000000000900020073797a30000000001400078008001340000000000800064000000000050005000000000005000100060000000d000300686173683a6d6163"], 0x5c}}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') socket(0x40000000015, 0x5, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_audit(0x10, 0x3, 0x9) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32, @ANYRES32, @ANYRES64=r5, @ANYRES64=r4, @ANYBLOB="ed"], 0x20) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 48.863499717s ago: executing program 2 (id=3516): r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$yama_ptrace_scope(r1, 0x0, 0x0) (async) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x891b, &(0x7f0000000000)={'veth0_virt_wifi\x00', {0x2, 0x400, @loopback}}) 48.706770925s ago: executing program 2 (id=3517): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) fsopen(0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x1eb640) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)={0x1b, 0x0, 0x0, 0x8, 0x0, 0x1, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @void, @value, @void, @value}, 0x50) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) writev(r2, &(0x7f00000014c0)=[{0x0}], 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@bloom_filter={0x1e, 0x7fffffff, 0x2, 0x1a00, 0x0, 0xffffffffffffffff, 0x2fc, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x0, 0x0, @void, @value, @void, @value}, 0x50) pipe2$watch_queue(0x0, 0x80) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000580)='1\x00', 0x2) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'lo\x00'}) r4 = socket$inet_udp(0x2, 0x2, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) setsockopt$SO_BINDTODEVICE_wg(r4, 0x1, 0x19, &(0x7f0000000140)='wg0\x00', 0x4) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$apparmor_current(r5, &(0x7f0000000040)=@profile={'stack ', ':\x00'}, 0x8) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x191c) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r6, 0xaf01, 0x0) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, {'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f00000004c0)=""/2, 0x2, 0x0, 0x3, 0x0, 0x0, 0xc07}}, 0x120) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000540)={{0x1, 0x1, 0x18}, './file0\x00'}) 48.196493797s ago: executing program 33 (id=3517): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) fsopen(0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x1eb640) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)={0x1b, 0x0, 0x0, 0x8, 0x0, 0x1, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @void, @value, @void, @value}, 0x50) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) writev(r2, &(0x7f00000014c0)=[{0x0}], 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@bloom_filter={0x1e, 0x7fffffff, 0x2, 0x1a00, 0x0, 0xffffffffffffffff, 0x2fc, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x0, 0x0, @void, @value, @void, @value}, 0x50) pipe2$watch_queue(0x0, 0x80) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000580)='1\x00', 0x2) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'lo\x00'}) r4 = socket$inet_udp(0x2, 0x2, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) setsockopt$SO_BINDTODEVICE_wg(r4, 0x1, 0x19, &(0x7f0000000140)='wg0\x00', 0x4) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$apparmor_current(r5, &(0x7f0000000040)=@profile={'stack ', ':\x00'}, 0x8) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x191c) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r6, 0xaf01, 0x0) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, {'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f00000004c0)=""/2, 0x2, 0x0, 0x3, 0x0, 0x0, 0xc07}}, 0x120) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000540)={{0x1, 0x1, 0x18}, './file0\x00'}) 10.226393858s ago: executing program 0 (id=3661): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001b40)={&(0x7f00000000c0)={0x1c, r4, 0x62c21a4ade68aba1, 0x70bd28, 0x0, {{0x32}, {@void, @val={0x8, 0x3, r6}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4000080) 8.702149145s ago: executing program 1 (id=3665): openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x0) r0 = syz_io_uring_setup(0x9eb, &(0x7f0000000140)={0x0, 0xfad6}, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0) r3 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) syz_usb_disconnect(r3) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r0, 0xdb4, 0x0, 0x0, 0x0, 0x0) 7.872738123s ago: executing program 6 (id=3669): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x8c36, 0x3c00, 0x2, 0xbfdffffa}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r1, 0x47f6, 0x0, 0x0, 0x0, 0x0) umount2(&(0x7f0000000180)='./file0\x00', 0x2) 7.536919722s ago: executing program 6 (id=3670): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x34, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0xfffffffc}, @ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}]}, 0x34}}, 0x0) 7.258760564s ago: executing program 0 (id=3672): r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f00000006c0)={0x2, 0x1000, @dev={0xac, 0x14, 0x14, 0x2}}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="19000000040000000400000008"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', 0xffffffffffffffff, 0x0, 0x8000000}, 0x18) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001c40)=@newtaction={0xf0, 0x30, 0x1, 0x7000000, 0x0, {}, [{0xdc, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x4, 0x8, 0x0, 0x0, 0x0, {0x0, 0x2, 0x7, 0x8}, {}, 0x14, 0xffffffff}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_police={0x6c, 0x2, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0xd, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xb8b}, {0x10, 0x1, 0x0, 0x0, 0x0, 0xffffffff}, 0x0, 0x4}}]]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xf0}}, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x1, 0x4) sendmmsg$inet(r0, &(0x7f0000003780)=[{{0x0, 0x0, 0x0}}], 0x1, 0x24004441) keyctl$set_reqkey_keyring(0xe, 0x7) socket$inet6_tcp(0xa, 0x1, 0x0) request_key(&(0x7f0000000240)='asymmetric\x00', &(0x7f0000000780)={'syz', 0x0}, &(0x7f0000000740)='logon\x00', 0x0) 7.228398894s ago: executing program 6 (id=3673): syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x50}}, 0x0) openat$mice(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0x20, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}}, 0x0, 0x0, 0x1b, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4f5d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r3, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmsg$inet6(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000380)='d', 0x1}], 0x1}, 0x8000) writev(r3, &(0x7f0000000100)=[{0x0}], 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000a80)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], [0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000], [0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) 6.868459459s ago: executing program 4 (id=3675): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000280)) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) 6.686848855s ago: executing program 1 (id=3676): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = mq_open(&(0x7f0000000040)='!\x7f\x00\xca\x00\x00\x00\f\x00\x00\x01E!Tnux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f00000000c0)={0x40, 0x9, 0x8}) mq_timedreceive(r0, 0x0, 0xfffffffffffffee3, 0x1, 0x0) mq_timedreceive(r0, &(0x7f0000000180)=""/196, 0xc4, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mq_timedreceive(r0, &(0x7f0000000440)=""/30, 0x1e, 0x80000000, 0x0) 6.22619376s ago: executing program 6 (id=3677): r0 = socket(0x80000000000000a, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) r5 = getpid() syz_pidfd_open(r5, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000006980)={{{@in=@multicast2, @in6=@remote}}, {{@in6=@empty}, 0x0, @in6=@initdev}}, 0x0) getegid() r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) preadv2(r6, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fee00}], 0x2, 0x0, 0x0, 0x0) 6.008723745s ago: executing program 0 (id=3679): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x32, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x4, "d57e190d001e6e1d16c1711bbd8adbf65bd846957b378a02340c68117aa1b390", "b0b4e2d8157cddfb9792c8e37bafb99e319950347e93f4d34870ee24c0ea06d56270e45c8d3e7d708161ba81dd33c54b", "01acae6f69ea1443db8d53af54944d4894a87f20c65bfb8e0c8cfb67", {"38f5e54b3dc7c070b4d66f0f9565df74", "d2653a13d554fee0e7be27c873db314d"}}}}}}}, 0x0) 5.818114967s ago: executing program 5 (id=3680): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) recvmmsg(r0, &(0x7f00000011c0)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000380)=""/203, 0xcb}], 0x1}, 0x5}], 0x1, 0x1, 0x0) 5.817894303s ago: executing program 0 (id=3681): ppoll(0x0, 0x0, 0x0, &(0x7f00000000c0)={[0x8001a0ffffffff]}, 0x8) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58, &(0x7f00000002c0)}, 0x65) 5.731296361s ago: executing program 1 (id=3682): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100088}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$sndctrl(&(0x7f0000001ac0), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r3, 0xc4c85513, &(0x7f0000000000)={0x2, 0x5, 0x1, 0x0, 'syz1\x00'}) 4.870124442s ago: executing program 5 (id=3683): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x60, r2, 0xb7a006d1969b963b, 0x1, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x42, 0x33, @probe_request={{{}, {}, @device_a, @device_b}, @void, @val, @void, @val={0x2d, 0x1a, {0x8802, 0x3, 0x6, 0x0, {0x6, 0xd, 0x0, 0xc0, 0x0, 0x0, 0x0, 0x3, 0x1}, 0x1, 0x95ce, 0x6}}, @val={0x72, 0x6}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x8011}, 0x10) 4.599602456s ago: executing program 4 (id=3684): socket$packet(0x11, 0x3, 0x300) r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x20) syz_emit_ethernet(0x46, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60f91e2e00107300fc040000000000000000000000000000ff02000000000000000000000000000100000000ff"], 0x0) read(r0, &(0x7f0000001240)=""/4096, 0x1000) 4.599109726s ago: executing program 5 (id=3685): syz_io_uring_setup(0xd2, &(0x7f0000008e40)={0x0, 0xd77c, 0x1086, 0x1001003, 0x1eb}, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x10, 0x2a43, &(0x7f0000006680)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYNAME(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB="6c0000000e06010100000000000000000700000605000100"], 0x6c}, 0x1, 0x0, 0x0, 0x20040080}, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x0, 0x2, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x7, &(0x7f0000000140)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="18030000000000000000000000000000850000002e000000850000000700000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0xe, 0x0, &(0x7f0000000000)="c03cba2d1f1f78de2c3ba843600c", 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000540)=ANY=[], 0x2c}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x25dfdc00, {0x0, 0x0, 0x74, r6, {0xf}, {0x0, 0x1}, {0x3, 0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x8881}, 0x44) 4.369123736s ago: executing program 1 (id=3686): setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000000)={0x3, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x6, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000400)={0x3, {{0xa, 0x4e21, 0x7, @mcast2}}, {{0xa, 0x4e20, 0x2, @empty}}}, 0x108) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x84, 0x0, 0xffffffffffffffff, &(0x7f0000000000)=0x84) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/kexec_crash_loaded', 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="01000000000000006a000000000000000f20d835200000000f22d83e66400f38828484020000000f20e035000200000f22e03012c74424009c696ddfc744240200000000c7442406000000000f011c24c48259a9e866ba6100ed670f0093000001000f01cb470f412bc300000000000000001800000000000000020000000000000000000000000000001800000000000000060000000000000000000000000000001800000000000000020000000000000000007f00000000000000663e3e64f336400f01c52800000cb8dc5df289ef66bafc0c66b83c2c66ef670fae774b66baf80cb8a8525f88ef66bafc0cec26460f9850a00f20c035080000000f22c047dfe0b9800000c00f3235000800000f3066bad00466ed66baf80cb88c81d481ef66bafc0c66b8005066efc300000000000000001800000000000000090000000000000002000000000000001800000000000000000000000400000001000000b400000000730000000000000066b83c018ed8b805000000b9000000000f01df0f20c035000001000f22c0c74424007e000000c74424027800c0feff2c2466baf80cb8bb44f087ef66bafc0cecf4b9bc090000b8878974a2ba44647d7b0f30670f229b65f30fc73523000000f3dc2ec300000000000000001800000000000000000000000000000002000000000000001800000000000000080000004883ffff00000000000000001800000000000000800300000000000002000000000000001800000000000000080000000700000000020000000000001800000000000000ffffffffffffff7f0200000000000000180000000000000000000100ff00000002000000000000001800000000000000020000000800000002000000000000001800000000000000050000000900000000000000000000001800000000000000040000000000000001000000000000006e00000000000000c4c1f171f52bc4026dba410066f3f04780aa00000000f0c4012f5a05818000800f20e035200000000f22e066baf80cb8a6912e87ef66bafc0cb0ceee360f22d966baa10066edc7442400c6000000c744240200200000ff2c24420f01c4c300000000000000001800000000000000030000000000000001000000000000005e0000000000000066baf80cb888f7b78aef66bafc0cb8b8c30000ef2e2e2e2e480fc72d00000000450f01c8470f01c3470f01dfb9e2000000b877000000ba000000000f30f2410f30450f30450f71e1f0410f01c2c302000000000000001800000000000000090000000300000000000000000000001800000000000000179200009fd821f70c887714a4c9948755165a3800000000020000000000000018000000000000007f000000060000000100000000000000760000000000000042ddb231ff00000f20e035000002000f22e0185934440f011a420f0666ba4100b800980000ef48b800000000008000000f23c00f21f835000005000f23f866ba210066b8000066efc4a281afb7a900000066baf80cb874dc458bef66bafc0cb8edde0000efc301000000000000006a0000000000000066baf80cb8ee64ea8bef66bafc0c66b8c99a66ef660f388122b96b030000b800000080ba000000000f30c482590001470f22c50f073e6466470f208066b852000f00d0b998000040b8f5000000ba000000000f30360f007a02c30000000000000000180000000000000003000000000000c22d51c6facd206789d7a6d4781d9c67b521df8c8eb9b591c58af257b5df6626c35f6c2ec3b01edd02565c16b0fee32d581b635220a534cd2a1843061b5ff255b1962e74c0c4768d8ca5028bb466676bb305feecd57797fed3b52897d7c5302a702b1aa6f50b4bd60a35400b106c24e546d5859f034650300bcfe6b655c0aa8cd7e19f689fc8b86bf74c3da32181482526aa803e4b0ed59fc96f06bee84320dbabaa4a5db22ee7f77ef7e3a0fca82ede23703e112edae30c82847ce31c5b91d18ed6ddfb71fcaf931d17094dac999ee2568e0896031ca5b288a714842eeaaea55e9ba5a4b10ad5ca2f199f5802ac4f11e3ba11243ef4d9b006b2d966cc3ac700b2a9181b66f9853ba0b4f80a54d1156fdafc06a4091ce50753fca39c8c1706aadf621deb67b1d78285289620b4c7d1000000000000"], 0x4d0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5393, &(0x7f0000000000)) 4.130703206s ago: executing program 1 (id=3687): r0 = socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) landlock_restrict_self(r4, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x4, 0x3}, &(0x7f0000000200)=0x8) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x8000000) syz_open_procfs(0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="d80000001e0081054e81f782060000000000000006007c095dd2466518000e800a00142603600e1208000f0000000406a80016c00800094014000000035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791433a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad909d5e1cace81ed0bffece0b42a9eca0200e6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000580)=@filter={'filter\x00', 0x2, 0x4, 0x3a0, 0xffffffff, 0xd0, 0x0, 0xd0, 0xfeffffff, 0xffffffff, 0x2d0, 0x2d0, 0x2d0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev, @mcast1, [], [], 'macsec0\x00', 'bond_slave_0\x00', {}, {}, 0x6, 0x0, 0x7, 0x45}, 0x2f2, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, [], [], 'sit0\x00', 'dvmrp0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@uncond, 0x0, 0x108, 0x130, 0x0, {}, [@common=@srh={{0x30}}, @common=@unspec=@mark={{0x30}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffb}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x400) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x1c, r5, 0x5, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40048}, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r9 = dup3(r8, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r9, 0x0, 0x11, &(0x7f00000000c0)='/dev/usb/hiddev#\x00'}, 0x30) migrate_pages(0x0, 0x5, &(0x7f00000002c0)=0x23ec, &(0x7f0000000300)=0x401) r10 = signalfd(0xffffffffffffffff, 0x0, 0x0) r11 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d5304905) close(r11) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000019100)={[&(0x7f0000000200)=' ']}) fcntl$setstatus(r10, 0x4, 0x2c00) r12 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582", @ANYRES16=r11], 0x0) syz_usb_control_io(r12, 0x0, 0x0) 4.047468056s ago: executing program 6 (id=3688): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="68000000130001000000000000", @ANYBLOB="00000000000000001400030067"], 0x68}}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/kexec_crash_loaded', 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000500)=[@code={0x1, 0x6a, {"0f20d835200000000f22d83e66400f38828484020000000f20e035000200000f22e03012c74424009c696ddfc744240200000000c7442406000000000f011c24c48259a9e866ba6100ed670f0093000001000f01cb470f412b"}}, @uexit={0x0, 0x18, 0x2}, @uexit={0x0, 0x18, 0x2}, @code={0x1, 0x7f, {"663e3e64f336400f01f866baf80cb8dc5df289ef66bafc0c66b83c2c66ef670fae774b66baf80cb8a8525f88ef66bafc0cec26460f9850a00f20c035080000000f22c047dfe0b9800000c00f3235000800000f3066bad00466ed66baf80cb88c81d481ef66bafc0c66b8005066ef"}}, @uexit={0x0, 0x18, 0x9}, @cpuid={0x2, 0x18, {0x0, 0x4}}, @code={0x1, 0x73, {"66b83c018ed8b805000000b9000000000f01d90f20c035000001000f22c0c74424007e000000c74424027800c0feff2c2466baf80cb8bb44f087ef66bafc0cecf4b9bc090000b8878974a2ba44647d7b0f30670f229b65f30fc73523000000f3dc2e"}}, @uexit={0x0, 0x18, 0x1ff}, @cpuid={0x2, 0x18, {0x8, 0xffff8348}}, @uexit={0x0, 0x18, 0x380}, @cpuid={0x2, 0x18, {0x8, 0x7}}, @uexit={0x0, 0x18, 0x7fffffffffffffff}, @cpuid={0x2, 0x18, {0x10000, 0xff}}, @cpuid={0x2, 0x18, {0x2, 0x8}}, @uexit={0x0, 0x18, 0x401}, @uexit={0x0, 0x18, 0x4}, @code={0x1, 0x6e, {"c4c1f171f52bc4026dba410066f3f04780aa00000000f0c4012f5a05818000800f20e035200000000f22e066baf80cb8a6912e87ef66bafc0cb0ceee360f22d966baa10066edc7442400c6000000c744240200200000ff2c24420f01c4"}}, @uexit={0x0, 0x18, 0x3}, @code={0x1, 0x5e, {"66baf80cb888f7b78aef66bafc0cb8b8c30000ef2e2e2e2e480fc72d00000000450f01c8470f01c3470f01dfb9e2000000b877000000ba000000000f30f2410f30450f30450f71e1f0410f01c2"}}, @cpuid={0x2, 0x18, {0x9, 0x3}}, @uexit={0x0, 0x18, 0x9217}, @cpuid={0x2, 0x18, {0x7f, 0x6}}, @code={0x1, 0x76, {"42ddb231ff00000f20e035000002000f22e0185934440f011a420f0666ba4100b800980000ef48b800000000008000000f23c00f21f835000005000f23f866ba210066b8000066efc4a281afb7a900000066baf80cb874dc458bef66bafc0cb8edde0000ef"}}, @code={0x1, 0x6a, {"66baf80cb8ee64ea8bef66bafc0c66b8c99a66ef660f388122b96b030000b800000080ba000000000f30c482590001470f22c50f073e6466470f208066b852000f00d0b998000040b8f5000000ba000000000f30360f017a02"}}, @uexit={0x0, 0x18, 0x3}], 0x4b8}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5393, &(0x7f0000000000)) 3.795531117s ago: executing program 5 (id=3689): r0 = socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = getpgrp(0x0) kcmp(r3, r3, 0x6, 0xffffffffffffffff, 0xffffffffffffffff) r4 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xfffffdf2, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003e000b05d25a806c8c6f94f90324fc60350005000a000200053582c137153e37000c0980fc0b10000300", 0x33fe0}], 0x1}, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) r6 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x18, &(0x7f0000000080)=0x200, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r8, &(0x7f0000003640)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)="95573dcefd5e0261d48bd6eb86d04d03bfa0b2d054ba8db38b3d5946b2c75c8b54a35d1f607eb08b73ef902c9be764c5b348ab12ca904a6ae1ef611e8d96c3cd26b2ca0865e3b4f26995b345c9a07db5175cae22e588d5ee28dec07a2a06d41870ab3fd438b41db644e6f4a4e3c1f89e7ad44e2b2847d7da17858f423348455d7c5a490bdf392e07b70831abac459b9a7b0a536a51bb1eb92e505fe67ac8ca84722c3b9883320e08e4c2e0f7cfc7421b570ae0219a87ba75fbad6bb9af01b688e79dc152574bf5903341f17ee6f52641673eb4052d3d2051b014c7bdfff2ee5886e82aefbc47848a14cee42aa3", 0xed}, {&(0x7f0000000400)="04930719331d32612336df7ab216aac724f5954307a7d63d2faf71c616007b599dd250af9b59074c671796d9b78d43dd25ce23b0162b7153c30f5f2856b29b1689cdcd016902c8a4578c3ec08551dd6bbcfc4ed35069ebd59e026db481bd6820618c43a9f74c37ebcc0a5cab7f12c0d6c7cf4459863ec87d4897d9ba9505361f6a81fc130eb962", 0x87}, {&(0x7f00000004c0)="f0f149a8bfcdf6873d65276fb80e7699c24ad5db032cd7c25c691a14109a497a0e235b0f5a8c5463c1981f95d368bb4960ea0732fb25cff16284b24c417cf41acfd92f637239b6c257b1d7fd515972da3310b278a8350abb112660d6311cf5f4398aa198b2d8d468f9fe0e5fe21fe52d7cbf1912c2b9f80428ce2663799a9a036c11c3c7f519c378aefd1c61502e73821ce19828de2ac87a3cdeeb4b4c271db20c3a03290a5e40dc68272cda78b3719cadaa83efe6d9b120d959ba8cb241f552e08abe96e4bf57b06225a9bfd5f4f13cea7e3adf28021c77e67649c668", 0xdd}, {&(0x7f0000000140)="1fd229a0aafd789f5b4108faad0b77a3f5e37bcd1580767a9f991413f154baa2dd8b82f2918ac3c7a0", 0x29}], 0x4, &(0x7f0000000600)=[@cred={{0x1c, 0x1, 0x2, {r3}}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [r2, r7, r2, r2, 0xffffffffffffffff, 0xffffffffffffffff, r4, r5, r0]}}], 0x88, 0x4004015}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000800)="d868d8b7edc7307d21e2fc2cf7f4cf6093f91fb5a18505210cadf903b857ce94bf005b54ff2531ee7b18410ee787da243567cf74c964eea2ec20d0db7aa0837d617054fa3631bf15d253bb18ac625ec73508986a61c69ec83e6160ecf6a4a5355a20abcf658b", 0x66}, {&(0x7f0000000880)="82f1f1a83a0e633392e372bf5061fae654b6f0ecf990ae3b938522b3f4ad186d725ecb9958c7", 0x26}, {&(0x7f00000008c0)="6fb3ca393e3c80bc7a6a0d9731690d1fdffc3a1a5b962e031893fb869dd9", 0x1e}, {&(0x7f0000000900)="1013bdf66e264d3f08b1fc4fe7c962fc669c226d75bae1fd6459e89b1d3b0aaa499d3c6e117c425c47db62aa04e3ff4ac78876cf2876e6afe12201ac91ce56204351ab15a990e1bbef73147045a06cb64b64a9f47ffa6734dbdcd8ebeb8a4ba0306b41617813ff82f8638dbd34f039e1316da66a8f0e425242b6bee8a1a5", 0x7e}, {&(0x7f0000000980)="840a8a2525c7551bead77740619f203310f4582bf2a9891c3b6183198a8d863b3bef", 0x22}, {&(0x7f00000009c0)="1d03454f46323fa1505357a1338f0da4ac7b11205d3f468b28e5", 0x1a}, {&(0x7f0000000a00)="6cb85171993cd6a4b718ba1ed1e190d747361bf08199ccabf423466fa79f83134c201a4a19782b22e34ed5950b10095a909a9d0b6801342581a3b398c61084ba5b3e6f34523372dcdd70b90706604a8479366677ab81daddc8fc833154243b63846c17b5347c85a05ae4bcc970c6331d6a61d28fdbb8e09c03235303a629669ea076e233e878459b24772b4098a910aa4edb9138bbd073fac8ea99862bee9fa7ffedd4380c86783277e39f56fb455ff0250a9aed134755380b18", 0xba}, {&(0x7f0000000ac0)="73a76c7f3ac55c41524a834dd897019dc82c43d4ce3ed9284d9a6ac26b6f175cb228542a80b8bcb47828d6c85b81624574026c6c3c461649fa3a1fa7c638c105f4dca7549cbb9db03369eef2fe46e77ce4b458a8e7d0927f80c3b1c9ed7f89929b457f793456ecccfb3a502956939a69ded143291e74d563c5da89e919566e006dd6a823cffcfef85fa5da5adcc45e672c9b747582c06125fb6e803f11039c7ac6b1ab7e608b1c68987a6b8c048f09530718e87bf2de7580ced44c5fad022b7c3aff7159eb1e4df9e850120611423200e143c134ce79fac6e3fee3754777a950ac6607187529", 0xe6}, {&(0x7f0000000bc0)="cdc3e1914d96edc7100c1cbaced19d666f144fb3ed499f9981cd02a24df635eeaa003dee18dc466fea7695f621753d6453f7151b2eb844ef7441ed64affac89b610ab062d72563c15b1dd324e8ec98915113c252a62193b1b563e5803bc90fad87f85497ff1af2739b473662", 0x6c}, {&(0x7f0000000c40)="67f2518f9838290a01ee3f7dceae26ae6a583af12a8ca0bda38f9dab6cdedf09075dbe69b3e41ad6a5ceeca7443b771bb20c0cc98b69aac6a1a066b6c77c770f18bce420e604a9ed8ee6082cc7f35a9dfba02699fa30d47d0b9ef9e19a510cb634436f8ed27337a8d61b6509953cf7eeabf1b89a35430d3c8695900cf6f7864f2d0ed1b6baa90942849b9fffa403cc2d38c0dc532f4f7e0a9b30e03e7fedd5521b4a95bf65c3a1bb282a9579336f034e2206c9f80c7c5d10d2b6ec2fd53128af168bae2490f2be05ad0d8aec772909ee83ff786e405cc7615599c31d7e9c6a", 0xdf}], 0xa, &(0x7f0000003000)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r3, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r3, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0002003993", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000001000000", @ANYRES32=r7, @ANYRES32=r8, @ANYRES32=r6, @ANYBLOB='\x00\x00\x00\x00'], 0x118, 0x40080}}, {{&(0x7f0000003140)=@file={0x1, './file0/file0\x00'}, 0x6e, &(0x7f00000033c0)=[{&(0x7f00000031c0)="5a88354cad4b4eee3c51d078806468a0bae0357a417163467a56c99bb883f2bff9dbd109970046a855bbf5d8d9dac36b45a829b5c1ba7c163df792676c73f502300c4378ec439237ccdc2bbc81745639194cf8e5051aa7feae131a8fee41c5e96a", 0x61}, {&(0x7f0000003240)}, {&(0x7f0000003280)}, {&(0x7f00000032c0)="46401abf8b8a585b3bac3d67b9edaa1b73e808c65195a143f9e1ce80e4a2cbba0aaf49b911eb6abd77a8ea1c1f4dbc6be224cf4b2f7762d299eac41ad83753be2da83ab96ce21988b614d9731173905fa2ae247e871eece4916881c2ba10d8a1134cbc0860d1650893675a7b5635c11c2d207c489000a99d60e76dbe0d611536b0dab5f9f61527e0521c834d702c19bd65682ff4ed518541e31f065065683ff9650365a63534bf5689acfb09f93bc05b66c20d279fcad46136c9dfc20d383c2af9f309e51ef452906b560e13bf18268d47c120dc6440a1e58db94331b0516ba8f72ce2df1ce96d", 0xe7}], 0x4, &(0x7f0000003580)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, r5, 0xffffffffffffffff, r2, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {r3}}}], 0xa0, 0x8001}}], 0x3, 0x20000080) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r9, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r9, 0x0) r10 = syz_open_procfs(0x0, &(0x7f0000000240)='smaps\x00') pread64(r10, &(0x7f0000000280)=""/70, 0x46, 0xbbf9) ioctl$vim2m_VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f0000000040)={0x2}) close(r6) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) 3.577872403s ago: executing program 4 (id=3690): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000004c0)=@filter={'filter\x00', 0x42, 0x4, 0x298, 0xffffffff, 0x98, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x270, 0x270, 0x270, 0xffffffff, 0x4, 0x0, {[{{@ip={@broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xff, 0x0, 'netpci0\x00', 'syzkaller1\x00', {}, {}, 0x6, 0x1}, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@ip={@remote, @multicast2, 0x0, 0x0, 'veth1_macvtap\x00', 'ip6_vti0\x00'}, 0x0, 0x70, 0xd0, 0x0, {0x60010000}}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x0, 0xfffc, [0x16, 0x0, 0x0, 0x0, 0x1c, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x100]}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f8) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r0, 0x0, 0x14, &(0x7f0000000000)=0x40, 0x4) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) 3.560968273s ago: executing program 6 (id=3691): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x80001, 0x0) ioctl$BLKGETSIZE64(r2, 0x80081272, &(0x7f0000000100)) r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x25, 0x0, @val=@tracing={0xffffffffffffffff, 0x4}}, 0x20) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r3}, 0x8) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r5 = socket(0x10, 0x3, 0x4) ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000000180)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, r6, 0x1, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x1, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r7 = memfd_create(&(0x7f0000000480)='\xff\x00l\x1e\xa00xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = socket(0x10, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x60, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x9, 0x803, 0x0, 0x40001, 0x1, 0x6, 0x7, 0x9, 0x4}}}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x1}]}, 0x60}}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x10, 0x800020, 0x0, 0xffffffffffffffc0, 0x9, 0x8, 0xfffffffe, 0xff}, 0x0) socket$kcm(0x2d, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) setresuid(0x0, 0xee00, 0x0) r4 = fspick(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x1) fsmount(r4, 0x0, 0x5) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYRES32], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) mlock2(&(0x7f00005c2000/0x1000)=nil, 0x1000, 0x1) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r6 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000240)='cpu.idle\x00', 0x2, 0x0) write$cgroup_subtree(r6, 0x0, 0x27) r7 = add_key(&(0x7f0000000140)='cifs.spnego\x00', &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$KEYCTL_WATCH_KEY(0x20, r7, r5, 0xffffffff) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) dup(r8) 2.383671355s ago: executing program 0 (id=3693): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=ANY=[@ANYBLOB="a0000000000101040000000000000000020000002400018014000180080001006401010208000200ac1414000400028005000100"], 0xa0}}, 0x0) (fail_nth: 7) 2.166336037s ago: executing program 0 (id=3694): r0 = socket(0x40000000015, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sndseq(0xffffff9c, &(0x7f0000000040), 0x8000) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f000010"], 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4) syz_usb_connect$uac1(0x3, 0x78, &(0x7f00000004c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0xff, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x66, 0x3, 0x1, 0x0, 0xf0, 0xff, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x5, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x4, 0x7, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0xbc, 0x66, 0x8, {0x7, 0x25, 0x1, 0x1, 0x3, 0x1000}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x80, 0x8, 0xdf, {0x7, 0x25, 0x1, 0x80, 0x41, 0x8}}}}}}}]}}, 0x0) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[], 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200), 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) clock_gettime(0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704001201000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x42) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000300)=r4, 0x4) sendmsg$nl_xfrm(r3, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000580)=ANY=[@ANYBLOB="f8000000160039030000000000000000e000000100"/32, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x002'], 0xf8}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x1, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0xaa000, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000080)={'pim6reg1\x00', {0x2, 0x4e20, @local}}) fgetxattr(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="6fbc782e252a2400"], 0x0, 0x0) recvmmsg$unix(r1, 0x0, 0x0, 0x2, 0x0) 1.750020056s ago: executing program 5 (id=3695): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$alg(0x26, 0x5, 0x0) socket$rds(0x15, 0x5, 0x0) (async) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(cast5)\x00'}, 0x58) (async) accept4(r0, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$inet6_sctp(0xa, 0x801, 0x84) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018", @ANYBLOB="0000000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async, rerun: 64) r1 = socket(0x15, 0x5, 0x0) (rerun: 64) recvmmsg(r1, &(0x7f00000000c0), 0x4000000000002fe, 0x61, 0x0) (async) bpf$BPF_PROG_DETACH(0x1c, &(0x7f00000006c0)=ANY=[@ANYRES64=r1], 0x20) ppoll(&(0x7f0000000540)=[{}], 0x5b, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) (async, rerun: 64) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) (async, rerun: 64) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="30000000120001000000002000000010100000000c00000000000000000000002378e29f6a8a94751fa60f"], 0x30}], 0x1}, 0x0) (async) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f00000000c0)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) (async, rerun: 32) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) (rerun: 32) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) (async, rerun: 64) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x10, 0x0, 0x0) (async, rerun: 64) ioctl$KVM_RUN(r7, 0xae80, 0x0) 1.189964083s ago: executing program 5 (id=3696): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x24008094) (async) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) r1 = io_uring_setup(0x622f, &(0x7f00000004c0)={0x0, 0xbfe, 0x1000, 0x2, 0xba}) r2 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r2, &(0x7f0000002980)={&(0x7f0000000180)={0x2, 0x0, @dev}, 0x10, &(0x7f0000001400)=[{&(0x7f0000001800)='_', 0x1}], 0x1}, 0x4000000) (async) setsockopt$sock_attach_bpf(r2, 0x84, 0x1e, &(0x7f0000000000), 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000380)={'syztnl0\x00', &(0x7f00000007c0)={'syztnl2\x00', 0x0, 0x29, 0x7, 0x81, 0xb, 0x21, @private1={0xfc, 0x1, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7800, 0x80, 0x2, 0x1ca3}}) bind$packet(0xffffffffffffffff, &(0x7f0000000840)={0x11, 0x17, r4, 0x1, 0x7}, 0x14) (async) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYRES8, @ANYRESHEX, @ANYBLOB="403dba3852d1dbe69fb8104121a600000000000000fcbc91d414a87eb0f4e588c17dc7906afbeba109000000000001", @ANYRES64=r3, @ANYRES32=r4, @ANYBLOB="ab43b706d0400154fc188cc9fd615d46083ada75f1d6c4e5652485a8191676c2be170822c88cc3fc994dd4cacb9d9bf5396f85ee5a12", @ANYRESOCT=r0, @ANYRES16=r4, @ANYRESDEC=r0], 0x1c}, 0x1, 0x0, 0x0, 0x24001044}, 0x40010) (async) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/reserved_size', 0x202000, 0x4) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="c0010000100001000000000000000000000000000000000000000000000000002001000000000000000000000000000200000000000000000000008001000000", @ANYRES32=0xffffffffffffffff, @ANYRES32=0x0, @ANYBLOB="e00000010000000000000000000000000000000032000000ac1414aa00000000000000000000000000000000000000000000206b000000000100000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000000000000000000000000000ff030000000000000000000000000000000000000000800000000000000000000000000000000000000000000a000300af0000000000000048000200656362286369706865725f6e756c6c2900333f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c"], 0x1c0}, 0x1, 0x0, 0x0, 0x240080d4}, 0x0) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000004d40)=ANY=[@ANYRES8=r6], 0x1114}, 0x1, 0x0, 0x0, 0x8011}, 0xc000) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'veth0_vlan\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000200)=@getchain={0x24, 0x11, 0x43d, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r8, {}, {0x0, 0xffe0}, {0x8, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x4080810}, 0x0) (async) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) (async) execveat(0xffffffffffffff9c, &(0x7f00000002c0)='./file2\x00', 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x2000, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000280)='./file0/file0\x00', 0x10, 0x103) (async) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x401064d1, &(0x7f0000000400)={0xd, 0x2}) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)=0x1000) (async) ioctl$PPPIOCSPASS(r9, 0x40107447, &(0x7f00000003c0)={0x1, &(0x7f0000000100)=[{0x1006, 0x60, 0xdd}]}) (async) write$ppp(r9, &(0x7f00000001c0)="3fa3", 0x2) (async) unlinkat(r5, &(0x7f0000000340)='./file0/file1\x00', 0x200) close_range(r1, 0xffffffffffffffff, 0x0) (async) bind$unix(0xffffffffffffffff, 0x0, 0x0) 424.869946ms ago: executing program 4 (id=3697): setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000000)={0x3, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x6, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000400)={0x3, {{0xa, 0x4e21, 0x7, @mcast2}}, {{0xa, 0x4e20, 0x2, @empty}}}, 0x108) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x68}}, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x84, 0x0, 0xffffffffffffffff, &(0x7f0000000000)=0x84) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/kexec_crash_loaded', 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="01000000000000006a000000000000000f20d835200000000f22d83e66400f38828484020000000f20e035000200000f22e03012c74424009c696ddfc744240200000000c7442406000000000f011c24c48259a9e866ba6100ed670f0093000001000f01cb470f412bc300000000000000001800000000000000020000000000000000000000000000001800000000000000060000000000000000000000000000001800000000000000020000000000000000007f00000000000000663e3e64f336400f01c52800000cb8dc5df289ef66bafc0c66b83c2c66ef670fae774b66baf80cb8a8525f88ef66bafc0cec26460f9850a00f20c035080000000f22c047dfe0b9800000c00f3235000800000f3066bad00466ed66baf80cb88c81d481ef66bafc0c66b8005066efc300000000000000001800000000000000090000000000000002000000000000001800000000000000000000000400000001000000b400000000730000000000000066b83c018ed8b805000000b9000000000f01df0f20c035000001000f22c0c74424007e000000c74424027800c0feff2c2466baf80cb8bb44f087ef66bafc0cecf4b9bc090000b8878974a2ba44647d7b0f30670f229b65f30fc73523000000f3dc2ec300000000000000001800000000000000000000000000000002000000000000001800000000000000080000004883ffff00000000000000001800000000000000800300000000000002000000000000001800000000000000080000000700000000020000000000001800000000000000ffffffffffffff7f0200000000000000180000000000000000000100ff00000002000000000000001800000000000000020000000800000002000000000000001800000000000000050000000900000000000000000000001800000000000000040000000000000001000000000000006e00000000000000c4c1f171f52bc4026dba410066f3f04780aa00000000f0c4012f5a05818000800f20e035200000000f22e066baf80cb8a6912e87ef66bafc0cb0ceee360f22d966baa10066edc7442400c6000000c744240200200000ff2c24420f01c4c300000000000000001800000000000000030000000000000001000000000000005e0000000000000066baf80cb888f7b78aef66bafc0cb8b8c30000ef2e2e2e2e480fc72d00000000450f01c8470f01c3470f01dfb9e2000000b877000000ba000000000f30f2410f30450f30450f71e1f0410f01c2c302000000000000001800000000000000090000000300000000000000000000001800000000000000179200009fd821f70c887714a4c9948755165a3800000000020000000000000018000000000000007f000000060000000100000000000000760000000000000042ddb231ff00000f20e035000002000f22e0185934440f011a420f0666ba4100b800980000ef48b800000000008000000f23c00f21f835000005000f23f866ba210066b8000066efc4a281afb7a900000066baf80cb874dc458bef66bafc0cb8edde0000efc301000000000000006a0000000000000066baf80cb8ee64ea8bef66bafc0c66b8c99a66ef660f388122b96b030000b800000080ba000000000f30c482590001470f22c50f073e6466470f208066b852000f00d0b998000040b8f5000000ba000000000f30360f007a02c30000000000000000180000000000000003000000000000c22d51c6facd206789d7a6d4781d9c67b521df8c8eb9b591c58af257b5df6626c35f6c2ec3b01edd02565c16b0fee32d581b635220a534cd2a1843061b5ff255b1962e74c0c4768d8ca5028bb466676bb305feecd57797fed3b52897d7c5302a702b1aa6f50b4bd60a35400b106c24e546d5859f034650300bcfe6b655c0aa8cd7e19f689fc8b86bf74c3da32181482526aa803e4b0ed59fc96f06bee84320dbabaa4a5db22ee7f77ef7e3a0fca82ede23703e112edae30c82847ce31c5b91d18ed6ddfb71fcaf931d17094dac999ee2568e0896031ca5b288a714842eeaaea55e9ba5a4b10ad5ca2f199f5802ac4f11e3ba11243ef4d9b006b2d966cc3ac700b2a9181b66f9853ba0b4f80a54d1156fdafc06a4091ce50753fca39c8c1706aadf621deb67b1d78285289620b4c7d1000000000000"], 0x4d0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5393, &(0x7f0000000000)) 57.089659ms ago: executing program 4 (id=3698): unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x110, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x110, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="2400000020000103000000000000000002000004000000000000000008000b00050b0000480c54fdf8e37f5c5166029c43690a08e315fb084984d8460e6a8227a3ba525fc7dd98165797da4d90e22628b19af4d64207fef302907f103b3943aca81e67c1719707fb94f0a534bb14"], 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) 0s ago: executing program 1 (id=3699): syz_io_uring_setup(0xd2, &(0x7f0000008e40)={0x0, 0xd77c, 0x1086, 0x1001003, 0x1eb}, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x10, 0x2a43, &(0x7f0000006680)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYNAME(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB="6c0000000e06010100000000000000000700000605000100"], 0x6c}, 0x1, 0x0, 0x0, 0x20040080}, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x0, 0x2, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x7, &(0x7f0000000140)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="18030000000000000000000000000000850000002e000000850000000700000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0xe, 0x0, &(0x7f0000000000)="c03cba2d1f1f78de2c3ba843600c", 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000540)=ANY=[@ANYBLOB], 0x2c}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x25dfdc00, {0x0, 0x0, 0x74, r6, {0xf}, {0x0, 0x1}, {0x3, 0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x8881}, 0x44) kernel console output (not intermixed with test programs): uncated [ 897.695827][T24231] Dev loop2: unable to read RDB block 7 [ 897.707095][T24231] loop2: unable to read partition table [ 897.713068][T24231] loop2: partition table beyond EOD, truncated [ 897.725570][T24231] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 897.764181][ T5827] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 897.904096][ T9] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 897.945222][ T5827] usb 5-1: Using ep0 maxpacket: 8 [ 897.954658][ T5827] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 897.967501][ T5827] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 897.977554][ T5827] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 897.990726][ T5827] usb 5-1: New USB device found, idVendor=046d, idProduct=c293, bcdDevice= 0.00 [ 898.002320][ T5827] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 898.012554][ T5827] usb 5-1: config 0 descriptor?? [ 898.044321][ T9] usb 1-1: device descriptor read/64, error -71 [ 898.075056][ T43] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 898.154169][ T24] usb 3-1: new full-speed USB device number 68 using dummy_hcd [ 898.224102][ T43] usb 2-1: Using ep0 maxpacket: 32 [ 898.230926][ T43] usb 2-1: config 0 has an invalid interface number: 235 but max is 0 [ 898.239897][ T43] usb 2-1: config 0 has no interface number 0 [ 898.249241][ T43] usb 2-1: New USB device found, idVendor=085a, idProduct=0009, bcdDevice=a3.47 [ 898.258733][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 898.266847][ T43] usb 2-1: Product: syz [ 898.271222][ T43] usb 2-1: Manufacturer: syz [ 898.276823][ T43] usb 2-1: SerialNumber: syz [ 898.283886][ T43] usb 2-1: config 0 descriptor?? [ 898.294322][ T9] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 898.326819][ T24] usb 3-1: config 0 has an invalid interface number: 29 but max is 0 [ 898.335489][ T24] usb 3-1: config 0 has no interface number 0 [ 898.341030][T12789] usb 6-1: USB disconnect, device number 29 [ 898.341721][ T24] usb 3-1: config 0 interface 29 has no altsetting 0 [ 898.365860][ T24] usb 3-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 898.376539][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 898.392307][ T24] usb 3-1: Product: syz [ 898.397975][ T24] usb 3-1: Manufacturer: syz [ 898.403450][ T24] usb 3-1: SerialNumber: syz [ 898.434383][ T24] usb 3-1: config 0 descriptor?? [ 898.446034][ T9] usb 1-1: device descriptor read/64, error -71 [ 898.448954][ T5827] logitech 0003:046D:C293.0033: bogus close delimiter [ 898.462930][ T5827] logitech 0003:046D:C293.0033: item 0 1 2 10 parsing failed [ 898.488941][ T5827] logitech 0003:046D:C293.0033: parse failed [ 898.511988][ T43] kaweth 2-1:0.235: Firmware present in device. [ 898.519027][ T5827] logitech 0003:046D:C293.0033: probe with driver logitech failed with error -22 [ 898.554981][ T9] usb usb1-port1: attempt power cycle [ 898.631669][T24211] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3318'. [ 898.640904][T24211] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3318'. [ 898.660603][T24211] dummy0: entered promiscuous mode [ 898.677111][ T24] peak_usb 3-1:0.29: PEAK-System PCAN-USB X6 v65 fw v224.204.25 (2 channels) [ 898.723048][T24211] team0: entered promiscuous mode [ 898.734640][T24211] team_slave_0: entered promiscuous mode [ 898.738798][ T43] kaweth 2-1:0.235: Statistics collection: 0 [ 898.742430][T24211] team_slave_1: entered promiscuous mode [ 898.747232][ T43] kaweth 2-1:0.235: Multicast filter limit: 0 [ 898.760272][ T43] kaweth 2-1:0.235: MTU: 0 [ 898.766661][ T43] kaweth 2-1:0.235: Read MAC address 00:00:00:00:00:00 [ 898.832945][T12789] usb 5-1: USB disconnect, device number 65 [ 898.878639][ T24] peak_usb 3-1:0.29 can0: sending command failure: -22 [ 898.885583][ T24] peak_usb 3-1:0.29 can0: sending command failure: -22 [ 898.897052][ T24] peak_usb 3-1:0.29 can0: sending command failure: -22 [ 898.907379][ T9] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 898.939487][ T9] usb 1-1: device descriptor read/8, error -71 [ 898.985753][ T24] peak_usb 3-1:0.29: probe with driver peak_usb failed with error -22 [ 899.545556][T24289] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 899.570621][T24289] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 899.594532][ T43] kaweth 2-1:0.235: Error setting SOFS wait [ 899.600700][ T43] kaweth 2-1:0.235: probe with driver kaweth failed with error -5 [ 899.629666][ T43] usb 2-1: USB disconnect, device number 99 [ 899.632453][ T5907] usb 3-1: USB disconnect, device number 68 [ 899.704095][ T9] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 899.755226][ T9] usb 1-1: device descriptor read/8, error -71 [ 899.875019][ T9] usb usb1-port1: unable to enumerate USB device [ 900.197272][T24333] loop2: detected capacity change from 0 to 7 [ 900.205837][T17543] Dev loop2: unable to read RDB block 7 [ 900.211607][T17543] loop2: unable to read partition table [ 900.221111][T17543] loop2: partition table beyond EOD, truncated [ 900.259371][T24333] Dev loop2: unable to read RDB block 7 [ 900.271407][T24333] loop2: unable to read partition table [ 900.277497][T24333] loop2: partition table beyond EOD, truncated [ 900.283976][T24333] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 900.284226][ T9] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 900.477192][T24327] xt_CT: No such helper "snmp" [ 900.570152][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 900.606607][ T9] usb 5-1: config 64 has an invalid interface number: 123 but max is 1 [ 900.642105][ T9] usb 5-1: config 64 has an invalid interface number: 171 but max is 1 [ 900.651023][ T9] usb 5-1: config 64 has no interface number 0 [ 900.658728][ T9] usb 5-1: config 64 has no interface number 1 [ 900.665886][ T9] usb 5-1: config 64 interface 123 altsetting 67 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 900.684552][ T9] usb 5-1: config 64 interface 123 altsetting 67 has an invalid descriptor for endpoint zero, skipping [ 900.735033][ T9] usb 5-1: config 64 interface 123 altsetting 67 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 900.746729][ T9] usb 5-1: config 64 interface 123 altsetting 67 has an invalid descriptor for endpoint zero, skipping [ 900.760711][ T9] usb 5-1: config 64 interface 123 altsetting 67 endpoint 0x6 has invalid maxpacket 1136, setting to 64 [ 900.774193][T24356] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3333'. [ 900.783725][ T9] usb 5-1: config 64 interface 123 altsetting 67 has an invalid descriptor for endpoint zero, skipping [ 900.784330][ T43] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 900.805350][T24356] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3333'. [ 900.856877][ T9] usb 5-1: config 64 interface 171 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 900.938983][ T9] usb 5-1: config 64 interface 171 altsetting 0 has a duplicate endpoint with address 0x6, skipping [ 900.985175][ T9] usb 5-1: config 64 interface 171 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 900.995848][ T43] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 901.023027][ T9] usb 5-1: config 64 interface 171 altsetting 0 has an endpoint descriptor with address 0x45, changing to 0x5 [ 901.035138][ T43] usb 2-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 901.045483][ T43] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 901.057932][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 901.092119][ T9] usb 5-1: config 64 interface 171 altsetting 0 endpoint 0x5 has an invalid bInterval 70, changing to 10 [ 901.108479][ T9] usb 5-1: config 64 interface 171 altsetting 0 endpoint 0x5 has invalid maxpacket 50482, setting to 1024 [ 901.121631][ T9] usb 5-1: config 64 interface 171 altsetting 0 bulk endpoint 0xC has invalid maxpacket 8 [ 901.131782][ T1216] usb 6-1: new full-speed USB device number 30 using dummy_hcd [ 901.186540][ T9] usb 5-1: config 64 interface 171 altsetting 0 endpoint 0x9 has an invalid bInterval 146, changing to 7 [ 901.222550][ T9] usb 5-1: config 64 interface 171 altsetting 0 has a duplicate endpoint with address 0x9, skipping [ 901.249338][ T9] usb 5-1: config 64 interface 171 altsetting 0 has 11 endpoint descriptors, different from the interface descriptor's value: 10 [ 901.267457][ T9] usb 5-1: config 64 interface 123 has no altsetting 0 [ 901.336377][ T9] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0058, bcdDevice=85.46 [ 901.361954][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.372333][ T1216] usb 6-1: config 5 has an invalid interface number: 123 but max is 0 [ 901.385298][ T1216] usb 6-1: config 5 has no interface number 0 [ 901.400317][ T9] usb 5-1: Product: syz [ 901.405021][ T1216] usb 6-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 901.423592][ T9] usb 5-1: Manufacturer: syz [ 901.429157][ T9] usb 5-1: SerialNumber: syz [ 901.433825][ T1216] usb 6-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xE6, changing to 0x86 [ 901.445654][T12789] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 901.471531][ T1216] usb 6-1: config 5 interface 123 altsetting 7 endpoint 0x86 has invalid wMaxPacketSize 0 [ 901.484623][ T1216] usb 6-1: config 5 interface 123 has no altsetting 0 [ 901.501420][ T1216] usb 6-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 901.514767][ T1216] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.522931][ T1216] usb 6-1: Product: syz [ 901.564374][ T1216] usb 6-1: Manufacturer: syz [ 901.569206][ T1216] usb 6-1: SerialNumber: syz [ 901.616774][T12789] usb 1-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 901.627239][T12789] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 901.654461][T12789] usb 1-1: New USB device found, idVendor=046d, idProduct=c087, bcdDevice= 0.00 [ 901.663858][T12789] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 901.668256][T24319] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3330'. [ 901.675859][T12789] usb 1-1: config 0 descriptor?? [ 901.765392][ T9] dvb-usb: found a 'Terratec Cinergy HT USB XE' in cold state, will try to load a firmware [ 901.836047][ T9] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 901.845781][ T9] dib0700: firmware download failed at 7 with -71 [ 901.882169][ T9] dvb-usb: found a 'Terratec Cinergy HT USB XE' in cold state, will try to load a firmware [ 901.894832][ T9] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 901.903610][ T9] dib0700: firmware download failed at 7 with -71 [ 901.920953][ T9] usb 5-1: USB disconnect, device number 66 [ 901.990423][T12789] usb 1-1: USB disconnect, device number 89 [ 902.004560][ T24] usb 3-1: new full-speed USB device number 69 using dummy_hcd [ 902.067221][ T1216] ni6501 6-1:5.123: driver 'ni6501' failed to auto-configure device. [ 902.086392][ T1216] usb 6-1: USB disconnect, device number 30 [ 902.189460][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 902.200815][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 902.212001][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 902.221723][ T24] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 902.235793][ T24] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 902.244955][ T24] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 902.253079][ T24] usb 3-1: Manufacturer: syz [ 902.260893][ T24] usb 3-1: config 0 descriptor?? [ 902.353064][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 902.353081][ T30] audit: type=1326 audit(1750607817.595:680): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24421 comm="syz.4.3341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3c278e929 code=0x7ffc0000 [ 902.407055][ T30] audit: type=1326 audit(1750607817.625:681): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24421 comm="syz.4.3341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc3c272ab19 code=0x7ffc0000 [ 902.457755][ T30] audit: type=1326 audit(1750607817.625:682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24421 comm="syz.4.3341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc3c272ab19 code=0x7ffc0000 [ 902.533439][ T30] audit: type=1326 audit(1750607817.625:683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24421 comm="syz.4.3341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc3c272ab19 code=0x7ffc0000 [ 902.577278][ T30] audit: type=1326 audit(1750607817.625:684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24421 comm="syz.4.3341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc3c272ab19 code=0x7ffc0000 [ 902.639122][ T30] audit: type=1326 audit(1750607817.625:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24421 comm="syz.4.3341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3c278e929 code=0x7ffc0000 [ 902.666225][ T24] rc_core: IR keymap rc-hauppauge not found [ 902.672217][ T24] Registered IR keymap rc-empty [ 902.678618][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 902.686341][ T30] audit: type=1326 audit(1750607817.635:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24421 comm="syz.4.3341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3c278e929 code=0x7ffc0000 [ 902.727609][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 902.745095][ T30] audit: type=1326 audit(1750607817.635:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24421 comm="syz.4.3341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc3c272ab19 code=0x7ffc0000 [ 902.773214][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 902.814185][ T30] audit: type=1326 audit(1750607817.635:688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24421 comm="syz.4.3341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3c278e929 code=0x7ffc0000 [ 902.837893][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input80 [ 902.892232][ T30] audit: type=1326 audit(1750607817.635:689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24421 comm="syz.4.3341" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc3c272ab19 code=0x7ffc0000 [ 902.954980][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 902.994339][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 903.064340][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 903.094737][T24438] loop2: detected capacity change from 0 to 7 [ 903.102622][ T5885] Dev loop2: unable to read RDB block 7 [ 903.111376][ T5885] loop2: unable to read partition table [ 903.114259][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 903.132342][ T5885] loop2: partition table beyond EOD, truncated [ 903.148060][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 903.162585][T24438] Dev loop2: unable to read RDB block 7 [ 903.168391][T24438] loop2: unable to read partition table [ 903.174269][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 903.184697][T24438] loop2: partition table beyond EOD, truncated [ 903.200975][T24438] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 903.211533][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 903.244273][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 903.277271][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 903.338638][ T24] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 903.377394][ T1216] usb 2-1: USB disconnect, device number 100 [ 903.407988][ T24] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 903.425161][T24346] delete_channel: no stack [ 903.440881][ T24] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 903.486162][T24444] fuse: Bad value for 'group_id' [ 903.491141][T24444] fuse: Bad value for 'group_id' [ 903.981796][T24478] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 904.270076][T24497] loop2: detected capacity change from 0 to 7 [ 904.287648][T24497] Dev loop2: unable to read RDB block 7 [ 904.298475][T24497] loop2: unable to read partition table [ 904.305855][T24497] loop2: partition table beyond EOD, truncated [ 904.312150][T24497] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 904.484440][ T1216] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 905.061480][T24513] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3357'. [ 905.140925][T24513] macsec0: left allmulticast mode [ 905.146127][T24513] veth1_macvtap: left allmulticast mode [ 905.151729][T24513] macsec0: left promiscuous mode [ 905.157858][T24513] bridge0: port 3(macsec0) entered disabled state [ 905.182202][ T1216] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 905.192517][ T1216] usb 6-1: config 1 has an invalid descriptor of length 142, skipping remainder of the config [ 905.219143][ T24] usb 3-1: USB disconnect, device number 69 [ 905.237023][ T1216] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 905.247098][ T1216] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 149, changing to 11 [ 905.261021][ T1216] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 16829, setting to 1024 [ 905.279897][ T1216] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 905.337341][T24513] bridge_slave_1: left allmulticast mode [ 905.359798][T24513] bridge_slave_1: left promiscuous mode [ 905.391311][ T1216] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 905.405359][T24513] bridge0: port 2(bridge_slave_1) entered disabled state [ 905.441744][ T1216] usb 6-1: Product: syz [ 905.453632][ T1216] usb 6-1: Manufacturer: syz [ 905.466649][T24536] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3360'. [ 905.476999][T24513] bridge_slave_0: left allmulticast mode [ 905.492158][ T1216] cdc_wdm 6-1:1.0: skipping garbage [ 905.500989][ T1216] cdc_wdm 6-1:1.0: skipping garbage [ 905.509427][T24513] bridge_slave_0: left promiscuous mode [ 905.520169][ T1216] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 905.528881][T24513] bridge0: port 1(bridge_slave_0) entered disabled state [ 905.537320][ T1216] cdc_wdm 6-1:1.0: Unknown control protocol [ 905.627137][T24543] sctp: [Deprecated]: syz.4.3361 (pid 24543) Use of struct sctp_assoc_value in delayed_ack socket option. [ 905.627137][T24543] Use struct sctp_sack_info instead [ 905.658311][ T24] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 905.814173][ T24] usb 3-1: device descriptor read/64, error -71 [ 905.822132][T24551] sctp: [Deprecated]: syz.4.3361 (pid 24551) Use of struct sctp_assoc_value in delayed_ack socket option. [ 905.822132][T24551] Use struct sctp_sack_info instead [ 906.084116][ T24] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 906.143589][T24559] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 906.388424][T24559] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 906.571213][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -EPIPE [ 906.597840][T24573] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3362'. [ 906.884207][ T5827] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 907.034073][ T5827] usb 2-1: Using ep0 maxpacket: 16 [ 907.041285][ T5827] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 907.049966][ T5827] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 907.101392][ T5827] usb 2-1: config 0 has no interface number 0 [ 907.112743][ T5827] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 907.128985][ T5827] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 907.139894][ T5827] usb 2-1: Product: syz [ 907.147108][ T5827] usb 2-1: Manufacturer: syz [ 907.151928][ T5827] usb 2-1: SerialNumber: syz [ 907.219269][ T5827] usb 2-1: config 0 descriptor?? [ 907.432607][ T5827] usb 2-1: Found UVC 0.00 device syz (046d:08f3) [ 907.442311][ T43] usb 6-1: USB disconnect, device number 31 [ 907.470020][ T5827] usb 2-1: No valid video chain found. [ 907.811650][T24616] loop2: detected capacity change from 0 to 7 [ 907.853241][T24616] Dev loop2: unable to read RDB block 7 [ 907.861605][T24616] loop2: unable to read partition table [ 907.877488][T24616] loop2: partition table beyond EOD, truncated [ 907.921133][T24616] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 908.019976][ T24] usb 2-1: USB disconnect, device number 101 [ 908.284113][ T5827] usb 5-1: new full-speed USB device number 67 using dummy_hcd [ 908.330744][T24641] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3371'. [ 908.370390][T24642] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3373'. [ 908.456546][ T5827] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 908.488552][T24641] ptrace attach of "./syz-executor exec"[18458] was attempted by " @       H 4 x)ա\x07 N$ |IKpD9[9c`\x0c !.3Ʉ}-( CRLl֧%ひMڜy+-I 2}\x0dRٺVX2M@Q\x0bp5Šn|ܷ?jk3r/HEVHƊ{rAf g:ehugx\x1br\x09q[DCBADCBA\x5c x [ 908.524141][ T5827] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 908.663429][ T5827] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 908.783696][ T5827] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 908.892569][ T5827] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 908.921661][ T5827] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 908.990298][ T5827] usb 5-1: Manufacturer: syz [ 909.069407][ T5827] usb 5-1: config 0 descriptor?? [ 909.134297][ T24] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 909.329580][T24691] loop2: detected capacity change from 0 to 7 [ 909.352184][ T24] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 909.374269][ T24] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 909.405259][T24691] Dev loop2: unable to read RDB block 7 [ 909.410947][T24691] loop2: unable to read partition table [ 909.416947][ T24] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 909.436299][T24691] loop2: partition table beyond EOD, truncated [ 909.444106][ T24] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 909.464119][ T5827] rc_core: IR keymap rc-hauppauge not found [ 909.470064][ T5827] Registered IR keymap rc-empty [ 909.475204][T24691] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 909.493325][ T5827] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 909.536066][ T5827] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 909.585440][ T5827] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 909.610030][T12789] usb 6-1: new full-speed USB device number 32 using dummy_hcd [ 909.627630][ T24] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 909.667875][ T5827] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input81 [ 909.683445][ T24] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 909.712651][ T24] usb 1-1: can't set config #1, error -71 [ 909.734977][ T5827] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 909.759726][ T24] usb 1-1: USB disconnect, device number 90 [ 909.804231][ T5827] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 909.806053][T12789] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 909.835213][ T5827] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 909.840305][T12789] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 909.854611][ T5827] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 909.876584][ T5827] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 909.877334][T12789] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 909.893731][T12789] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 909.905211][ T5827] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 909.912599][T12789] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 909.923742][T12789] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 909.935302][ T5827] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 909.936927][T12789] usb 6-1: Manufacturer: syz [ 909.966571][T12789] usb 6-1: config 0 descriptor?? [ 909.982529][ T5827] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 909.998811][ T43] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 910.024321][ T5827] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 910.044559][ T5827] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 910.074170][ T9] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 910.075658][ T5827] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 910.105090][ T5827] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 910.309401][ T43] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 910.343955][ T43] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 910.344394][ T9] usb 2-1: device descriptor read/64, error -71 [ 910.370660][ T5827] usb 5-1: USB disconnect, device number 67 [ 910.411544][ T43] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 910.433405][ T43] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 910.443167][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 910.507634][ T43] usb 3-1: Product: syz [ 910.512308][ T43] usb 3-1: Manufacturer: syz [ 910.520719][ T43] usb 3-1: SerialNumber: syz [ 910.526950][T12789] rc_core: IR keymap rc-hauppauge not found [ 910.536661][ T1216] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 910.547094][ T43] hub 3-1:1.0: bad descriptor, ignoring hub [ 910.557510][ T43] hub 3-1:1.0: probe with driver hub failed with error -5 [ 910.564432][T12789] Registered IR keymap rc-empty [ 910.570268][T12789] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 910.606714][T12789] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 910.638993][T12789] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc1 [ 910.659137][ T9] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 910.711816][T12789] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc1/input82 [ 910.753536][ T1216] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 910.775109][ T43] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 72 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 910.822568][ T1216] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 910.837918][T12789] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 910.860649][ T9] usb 2-1: device descriptor read/64, error -71 [ 910.891455][ T1216] usb 1-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 910.909320][T12789] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 910.925619][ T1216] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 910.936177][ T1216] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 910.957012][ T5907] usb 3-1: USB disconnect, device number 72 [ 910.974142][T12789] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 910.991966][ T9] usb usb2-port1: attempt power cycle [ 911.002978][ T5907] usblp0: removed [ 911.026089][T12789] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 911.066629][T12789] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 911.095330][T12789] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 911.124278][T12789] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 911.164208][T12789] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 911.190738][ T1216] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 911.225507][ T1216] usb 1-1: invalid MIDI out EP 0 [ 911.249405][T24788] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3388'. [ 911.254445][T12789] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 911.287416][T12789] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 911.337600][T12789] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 911.348091][T24805] netlink: 212 bytes leftover after parsing attributes in process `syz.4.3388'. [ 911.370247][ T9] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 911.375514][T24805] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 911.403065][T12789] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 911.416835][T24741] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 911.427222][T24741] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 911.440319][T24741] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 911.450535][T24741] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 911.515097][ T9] usb 2-1: device descriptor read/8, error -71 [ 911.527630][T12789] usb 6-1: USB disconnect, device number 32 [ 911.572681][ T1216] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 911.828593][ T9] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 911.962450][ T9] usb 2-1: device descriptor read/8, error -71 [ 912.060910][T24843] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3391'. [ 912.100845][ T9] usb usb2-port1: unable to enumerate USB device [ 912.124715][ T43] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 912.156610][T24843] ptrace attach of "./syz-executor exec"[20859] was attempted by " @       H 4 x)ա\x07 N$ |IKpD9[9c`\x0c !.3Ʉ}-( CRLl֧%ひMڜy+-I 2}\x0dRٺVX2M@Q\x0bp5Šn|ܷ?jk3r/HEVHƊ{rAf g:ehugx\x1br\x09q[DCBADCBA\x5c x [ 912.300797][ T43] usb 6-1: device descriptor read/64, error -71 [ 912.534136][ T24] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 912.810100][ T43] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 913.064160][ T43] usb 6-1: device descriptor read/64, error -71 [ 913.174594][ T43] usb usb6-port1: attempt power cycle [ 913.200237][T24880] loop2: detected capacity change from 0 to 7 [ 913.209533][T24880] Dev loop2: unable to read RDB block 7 [ 913.215301][T24880] loop2: AHDI p1 p2 p3 p4 [ 913.220354][T24880] loop2: partition table partially beyond EOD, truncated [ 913.230312][T24880] loop2: p1 start 1601398130 is beyond EOD, truncated [ 913.238941][T24880] loop2: p2 start 1702059890 is beyond EOD, truncated [ 913.258466][T24880] loop2: p3 start 16777215 is beyond EOD, truncated [ 913.504082][ T9] usb 3-1: new full-speed USB device number 73 using dummy_hcd [ 913.684197][ T43] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 913.855625][ T43] usb 6-1: device descriptor read/8, error -71 [ 913.890616][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 913.901838][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 913.921226][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 913.950553][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 913.973673][T24030] usb 1-1: USB disconnect, device number 91 [ 914.024184][ T5827] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 914.095677][ T43] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 914.095755][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 914.118000][ T9] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 914.126792][ T9] usb 3-1: Manufacturer: syz [ 914.143608][ T43] usb 6-1: device descriptor read/8, error -71 [ 914.173827][ T9] usb 3-1: config 0 descriptor?? [ 914.174788][ T5827] usb 2-1: Using ep0 maxpacket: 32 [ 914.202283][ T5827] usb 2-1: config 0 has an invalid interface number: 217 but max is 0 [ 914.218278][ T5827] usb 2-1: config 0 has no interface number 0 [ 914.289743][ T43] usb usb6-port1: unable to enumerate USB device [ 914.369529][ T5827] usb 2-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice= 0.02 [ 914.387295][ T5827] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 914.398992][ T5827] usb 2-1: Product: syz [ 914.403180][ T5827] usb 2-1: Manufacturer: syz [ 914.410831][ T5827] usb 2-1: SerialNumber: syz [ 914.429607][ T5827] usb 2-1: config 0 descriptor?? [ 914.454719][ T5827] ftdi_sio 2-1:0.217: FTDI USB Serial Device converter detected [ 914.464769][ T5827] usb 2-1: Detected SIO [ 914.472532][ T5827] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 914.555291][T24030] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 914.744456][T24030] usb 1-1: Using ep0 maxpacket: 8 [ 914.754081][T24030] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 914.765918][T24030] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 914.774464][T24030] usb 1-1: Product: syz [ 914.779497][T24030] usb 1-1: Manufacturer: syz [ 914.784348][T24030] usb 1-1: SerialNumber: syz [ 914.796188][T24030] usb 1-1: config 0 descriptor?? [ 915.007190][T24030] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 916.376362][ T5827] usb 2-1: USB disconnect, device number 106 [ 916.414889][ T5827] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 916.432759][ T5827] ftdi_sio 2-1:0.217: device disconnected [ 916.659355][T24030] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 916.687307][T24964] dummy0: entered promiscuous mode [ 916.707849][T24964] dummy0: left promiscuous mode [ 916.713378][T24030] usb 1-1: USB disconnect, device number 92 [ 916.721382][ T9] rc_core: IR keymap rc-hauppauge not found [ 916.774890][ T9] Registered IR keymap rc-empty [ 916.787543][T24978] dlm: no locking on control device [ 917.021786][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 917.299080][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 917.326092][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 917.338252][T24987] netlink: 80 bytes leftover after parsing attributes in process `syz.4.3412'. [ 917.360106][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input83 [ 917.382067][T24987] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3412'. [ 917.386808][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 917.458398][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 917.506737][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 917.534529][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 917.555477][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 917.579247][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 917.623131][T24997] mmap: syz.1.3413 (24997): VmData 37519360 exceed data ulimit 10. Update limits or use boot option ignore_rlimit_data. [ 917.694232][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 917.714195][ T1216] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 917.786019][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 917.817314][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 917.894291][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 917.936043][ T9] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 917.956399][ T9] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 917.972956][ T1216] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 918.009115][ T43] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 918.043003][ T1216] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 918.086730][ T9] usb 3-1: USB disconnect, device number 73 [ 918.096795][ T1216] usb 1-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 918.121637][ T1216] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 918.133905][ T1216] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 918.206474][ T1216] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 918.217605][ T1216] usb 1-1: invalid MIDI out EP 0 [ 918.224746][ T43] usb 6-1: Using ep0 maxpacket: 8 [ 918.317852][ T43] usb 6-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 918.370949][T24993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 918.381233][T24993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 918.394101][T24993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 918.404242][T24993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 918.453778][ T43] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 918.476958][ T43] usb 6-1: Product: syz [ 918.502813][ T43] usb 6-1: Manufacturer: syz [ 918.502852][T24987] team0 (unregistering): left promiscuous mode [ 918.509696][ T5978] udevd[5978]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 918.524115][T24987] team_slave_0: left promiscuous mode [ 918.544888][ T1216] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 918.555158][ T9] usb 3-1: new full-speed USB device number 74 using dummy_hcd [ 918.581112][T24987] team_slave_1: left promiscuous mode [ 918.592650][ T43] usb 6-1: SerialNumber: syz [ 918.634299][ T43] usb 6-1: config 0 descriptor?? [ 918.691341][ T43] gspca_main: se401-2.14.0 probing 047d:5003 [ 918.749539][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 918.780232][T24987] team0 (unregistering): Port device team_slave_0 removed [ 918.793187][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 918.827669][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 918.884172][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 918.912364][T24987] team0 (unregistering): Port device team_slave_1 removed [ 918.955576][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 919.015549][ T9] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 919.069105][ T9] usb 3-1: Manufacturer: syz [ 919.083089][ T43] gspca_se401: Wrong descriptor type [ 919.146444][ T9] usb 3-1: config 0 descriptor?? [ 919.341297][T25095] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3417'. [ 919.426471][T25014] bond_slave_0: entered promiscuous mode [ 919.432329][T25014] bond_slave_1: entered promiscuous mode [ 919.443937][T25014] macvlan2: entered allmulticast mode [ 919.451837][T25014] bond0: entered allmulticast mode [ 919.464272][T25095] ptrace attach of "./syz-executor exec"[22659] was attempted by " @       H 4 x)ա\x07 N$ |IKpD9[9c`\x0c !.3Ʉ}-( CRLl֧%ひMڜy+-I 2}\x0dRٺVX2M@Q\x0bp5Šn|ܷ?jk3r/HEVHƊ{rAf g:ehugx\x1br\x09q[DCBADCBA\x5c x [ 919.465880][T25014] bond_slave_0: entered allmulticast mode [ 919.667646][T25014] bond_slave_1: entered allmulticast mode [ 919.689062][T25014] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 919.721414][T25014] bridge0: port 3(macvlan2) entered blocking state [ 919.751426][T25014] bridge0: port 3(macvlan2) entered disabled state [ 919.807668][T25014] macvlan2: entered promiscuous mode [ 919.818751][T25014] bond0: entered promiscuous mode [ 919.829114][T25014] bridge0: port 3(macvlan2) entered blocking state [ 919.836034][T25014] bridge0: port 3(macvlan2) entered forwarding state [ 919.888353][ T9] rc_core: IR keymap rc-hauppauge not found [ 919.897884][ T9] Registered IR keymap rc-empty [ 919.917104][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 919.986071][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 920.053006][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 920.075962][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input84 [ 920.100471][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 920.162148][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 920.210264][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 920.254262][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 920.278251][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 920.324160][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 920.446958][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 920.494882][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 920.514105][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 920.914134][ T9] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 920.964031][T12789] usb 6-1: USB disconnect, device number 37 [ 921.012024][ T9] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 921.029184][ T1216] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 921.049803][ T9] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 921.073539][ T9] usb 3-1: USB disconnect, device number 74 [ 921.196732][ T1216] usb 2-1: Using ep0 maxpacket: 32 [ 921.204327][ T1216] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 921.219204][ T1216] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 921.233391][ T1216] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 921.244194][ T1216] usb 2-1: config 1 has no interface number 0 [ 921.250274][ T1216] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 921.261387][ T1216] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 921.277530][ T1216] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 921.287619][ T1216] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 921.309098][ T1216] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 921.334557][T16462] usb 1-1: USB disconnect, device number 93 [ 921.558163][ T1216] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now attached [ 921.644477][ T30] kauditd_printk_skb: 691 callbacks suppressed [ 921.644493][ T30] audit: type=1326 audit(1750607836.895:1381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25105 comm="syz.4.3418" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc3c278e929 code=0x0 [ 921.767440][T16462] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 921.834117][ T1216] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 921.928563][T16462] usb 1-1: Using ep0 maxpacket: 8 [ 921.952481][T16462] usb 1-1: config 0 has an invalid interface number: 31 but max is 0 [ 921.978724][T16462] usb 1-1: config 0 has no interface number 0 [ 921.994138][ T5827] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 922.010166][T16462] usb 1-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 922.034267][ T1216] usb 3-1: Using ep0 maxpacket: 32 [ 922.048783][T16462] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 922.054886][ T1216] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 922.073802][ T1216] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 922.087138][ T1216] usb 3-1: config 0 descriptor?? [ 922.121079][T16462] usb 1-1: Product: syz [ 922.138684][T16462] usb 1-1: Manufacturer: syz [ 922.153172][T16462] usb 1-1: SerialNumber: syz [ 922.170531][T16462] usb 1-1: config 0 descriptor?? [ 922.218346][ T5827] usb 6-1: config 0 has no interfaces? [ 922.253485][ T5827] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 922.278378][ T5827] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 922.312791][ T5827] usb 6-1: Product: syz [ 922.313305][ T1216] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 922.339530][ T1216] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 922.369522][ T1216] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 922.379045][ T1216] usb 3-1: media controller created [ 922.392844][ T5827] usb 6-1: Manufacturer: syz [ 922.419238][ T1216] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 922.463385][T25181] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 922.491179][ T5827] usb 6-1: SerialNumber: syz [ 922.503426][T25181] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 922.524735][T16462] usb 1-1: Found UVC 0.04 device syz (046d:08c3) [ 922.540055][T16462] usb 1-1: No valid video chain found. [ 922.555640][ T5827] usb 6-1: config 0 descriptor?? [ 922.568165][T16462] usb 1-1: USB disconnect, device number 94 [ 922.577387][T12789] snd_usb_pod 2-1:1.1: line6_send_raw_message_async_part: usb_submit_urb failed (-22) [ 922.600009][T25220] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 922.628613][T25220] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 922.836360][T25231] syzkaller1: entered promiscuous mode [ 922.842265][T25231] syzkaller1: entered allmulticast mode [ 922.991229][T25197] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 923.001320][T25197] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 923.113146][T25243] xt_cgroup: invalid path, errno=-2 [ 923.121185][T25243] FAULT_INJECTION: forcing a failure. [ 923.121185][T25243] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 923.154254][T25243] CPU: 1 UID: 0 PID: 25243 Comm: syz.4.3429 Not tainted 6.16.0-rc2-syzkaller-00318-g739a6c93cc75 #0 PREEMPT(full) [ 923.154284][T25243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 923.154297][T25243] Call Trace: [ 923.154305][T25243] [ 923.154315][T25243] dump_stack_lvl+0x189/0x250 [ 923.154349][T25243] ? __pfx____ratelimit+0x10/0x10 [ 923.154378][T25243] ? __pfx_dump_stack_lvl+0x10/0x10 [ 923.154407][T25243] ? __pfx__printk+0x10/0x10 [ 923.154428][T25243] ? __might_fault+0xb0/0x130 [ 923.154457][T25243] should_fail_ex+0x414/0x560 [ 923.154492][T25243] _copy_from_user+0x2d/0xb0 [ 923.154513][T25243] smc_setsockopt+0x3b8/0xab0 [ 923.154547][T25243] ? __pfx_smc_setsockopt+0x10/0x10 [ 923.154578][T25243] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 923.154602][T25243] ? __pfx_smc_setsockopt+0x10/0x10 [ 923.154632][T25243] do_sock_setsockopt+0x25a/0x3e0 [ 923.154658][T25243] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 923.154686][T25243] ? __fget_files+0x2a/0x420 [ 923.154716][T25243] __x64_sys_setsockopt+0x18b/0x220 [ 923.154746][T25243] do_syscall_64+0xfa/0x3b0 [ 923.154762][T25243] ? lockdep_hardirqs_on+0x9c/0x150 [ 923.154790][T25243] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 923.154810][T25243] ? clear_bhb_loop+0x60/0xb0 [ 923.154833][T25243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 923.154852][T25243] RIP: 0033:0x7fc3c278e929 [ 923.154871][T25243] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 923.154888][T25243] RSP: 002b:00007fc3c360a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 923.154909][T25243] RAX: ffffffffffffffda RBX: 00007fc3c29b5fa0 RCX: 00007fc3c278e929 [ 923.154927][T25243] RDX: 0000000000000040 RSI: 0004000000000000 RDI: 0000000000000003 [ 923.154941][T25243] RBP: 00007fc3c360a090 R08: 00000000000022f8 R09: 0000000000000000 [ 923.154954][T25243] R10: 0000200000002300 R11: 0000000000000246 R12: 0000000000000001 [ 923.154967][T25243] R13: 0000000000000000 R14: 00007fc3c29b5fa0 R15: 00007fc3c2adfa28 [ 923.154997][T25243] [ 923.434185][T12789] usb 2-1: USB disconnect, device number 107 [ 923.443540][T12789] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 923.513660][ T5837] Bluetooth: hci2: command 0x0406 tx timeout [ 924.134160][ T5827] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 924.164201][T16462] usb 1-1: new full-speed USB device number 95 using dummy_hcd [ 924.301060][ T5827] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 924.311680][ T5827] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 924.326737][ T5827] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 924.389146][T16462] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 924.419827][ T5827] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 924.429825][T16462] usb 1-1: config 0 interface 0 has no altsetting 0 [ 924.439721][T16462] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00 [ 924.449544][ T5827] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 924.462668][T16462] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 924.498694][T16462] usb 1-1: config 0 descriptor?? [ 924.505037][ T1216] az6027: usb out operation failed. (-110) [ 924.522798][ T1216] az6027: usb out operation failed. (-32) [ 924.529628][T25271] raw-gadget.5 gadget.0: fail, usb_ep_enable returned -22 [ 924.541327][ T5827] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 924.553918][ T1216] stb0899_attach: Driver disabled by Kconfig [ 924.561257][ T1216] az6027: no front-end attached [ 924.561257][ T1216] [ 924.561679][ T5827] usb 2-1: invalid MIDI out EP 0 [ 924.579098][ T1216] az6027: usb out operation failed. (-32) [ 924.627261][ T1216] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 924.718136][ T5907] usb 6-1: USB disconnect, device number 38 [ 924.777237][ T1216] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input85 [ 924.845658][T16462] konepure 0003:1E7D:2DBE.0034: item fetching failed at offset 0/2 [ 924.883564][ T1216] dvb-usb: schedule remote query interval to 400 msecs. [ 924.906230][T16462] konepure 0003:1E7D:2DBE.0034: parse failed [ 924.934159][T16462] konepure 0003:1E7D:2DBE.0034: probe with driver konepure failed with error -22 [ 924.969750][ T1216] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 924.993619][ T1216] usb 3-1: USB disconnect, device number 75 [ 925.039747][T25308] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 925.064455][T25308] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 925.083332][T25266] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 925.093668][T25266] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 925.251527][ T5827] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 925.407329][ T9] hid-generic 0000:0000:0000.0035: unknown main item tag 0x0 [ 925.495648][ T9] hid-generic 0000:0000:0000.0035: hidraw0: HID v0.00 Device [syz1] on syz0 [ 925.528959][ T1216] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 925.834260][T16462] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 925.984242][T16462] usb 5-1: Using ep0 maxpacket: 16 [ 925.995646][T16462] usb 5-1: config 14 has an invalid interface number: 27 but max is 0 [ 926.006169][T16462] usb 5-1: config 14 contains an unexpected descriptor of type 0x1, skipping [ 926.030564][T16462] usb 5-1: config 14 has an invalid interface descriptor of length 7, skipping [ 926.060717][T16462] usb 5-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 926.092294][T16462] usb 5-1: config 14 has no interface number 0 [ 926.111938][T16462] usb 5-1: config 14 interface 27 altsetting 0 endpoint 0x84 has invalid maxpacket 1023, setting to 64 [ 926.137666][T16462] usb 5-1: config 14 interface 27 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 16 [ 926.164327][T16462] usb 5-1: New USB device found, idVendor=06cb, idProduct=0009, bcdDevice=55.8a [ 926.187928][T16462] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 926.423903][T16462] usb 5-1: string descriptor 0 read error: -71 [ 926.463489][T16462] usb 5-1: selecting invalid altsetting 1 [ 926.496981][T16462] usb 5-1: Can not set alternate setting to 1, error: -22 [ 926.533357][T16462] synaptics_usb 5-1:14.27: probe with driver synaptics_usb failed with error -22 [ 926.628252][T16462] usb 5-1: USB disconnect, device number 69 [ 926.930730][ T1216] usb 1-1: USB disconnect, device number 95 [ 927.006719][T16462] usb 2-1: USB disconnect, device number 108 [ 927.276707][ T1216] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 927.301374][ T5827] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 927.414081][ T1216] usb 1-1: device descriptor read/64, error -71 [ 927.503552][ T5827] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 927.514480][ T9] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 927.544312][ T5827] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 927.560152][ T5827] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 927.561113][ T5907] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 927.569255][ T5827] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.601620][ T5827] usb 3-1: config 0 descriptor?? [ 927.656228][ T1216] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 927.695199][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 927.702330][ T9] usb 5-1: too many configurations: 242, using maximum allowed: 8 [ 927.715681][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 927.723648][ T9] usb 5-1: can't read configurations, error -61 [ 927.745268][ T5907] usb 2-1: Using ep0 maxpacket: 16 [ 927.756125][ T5907] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 927.773589][ T5907] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 927.791411][ T5907] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 927.810592][ T1216] usb 1-1: device descriptor read/64, error -71 [ 927.820801][ T5907] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2e22, bcdDevice= 0.00 [ 927.835560][ T5907] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.859485][ T5907] usb 2-1: config 0 descriptor?? [ 927.874197][ T9] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 927.924656][ T1216] usb usb1-port1: attempt power cycle [ 928.015550][ T5827] cm6533_jd 0003:0D8C:0022.0036: unknown main item tag 0x0 [ 928.034077][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 928.041391][ T9] usb 5-1: too many configurations: 242, using maximum allowed: 8 [ 928.082439][ T5827] cm6533_jd 0003:0D8C:0022.0036: unknown main item tag 0x0 [ 928.104082][ T5827] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0D8C:0022.0036/input/input86 [ 928.130407][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 928.131062][ T5827] cm6533_jd 0003:0D8C:0022.0036: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.2-1/input0 [ 928.160873][ T9] usb 5-1: can't read configurations, error -61 [ 928.219194][ T9] usb usb5-port1: attempt power cycle [ 928.242437][ T5827] usb 3-1: USB disconnect, device number 76 [ 928.288449][ T1216] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 928.325911][ T5907] koneplus 0003:1E7D:2E22.0037: item fetching failed at offset 0/2 [ 928.350081][ T5907] koneplus 0003:1E7D:2E22.0037: parse failed [ 928.367072][ T1216] usb 1-1: device descriptor read/8, error -71 [ 928.383077][ T5907] koneplus 0003:1E7D:2E22.0037: probe with driver koneplus failed with error -22 [ 928.529380][ T5827] usb 2-1: USB disconnect, device number 109 [ 928.657966][ T1216] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 928.665589][ T9] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 928.705036][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 928.710404][ T1216] usb 1-1: device descriptor read/8, error -71 [ 928.719140][ T9] usb 5-1: too many configurations: 242, using maximum allowed: 8 [ 928.728656][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 928.745134][ T9] usb 5-1: can't read configurations, error -61 [ 928.834521][ T1216] usb usb1-port1: unable to enumerate USB device [ 928.874146][ T9] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 928.876618][T25478] trusted_key: encrypted_key: master key parameter 'defCuu' is invalid [ 928.895332][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 928.906092][ T9] usb 5-1: too many configurations: 242, using maximum allowed: 8 [ 928.916695][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 928.933784][ T9] usb 5-1: can't read configurations, error -61 [ 928.940730][ T9] usb usb5-port1: unable to enumerate USB device [ 929.093623][T25483] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3452'. [ 929.169068][T25483] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3452'. [ 929.298005][T25487] FAULT_INJECTION: forcing a failure. [ 929.298005][T25487] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 929.311922][T25487] CPU: 1 UID: 0 PID: 25487 Comm: syz.1.3453 Not tainted 6.16.0-rc2-syzkaller-00318-g739a6c93cc75 #0 PREEMPT(full) [ 929.311949][T25487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 929.311961][T25487] Call Trace: [ 929.311969][T25487] [ 929.311977][T25487] dump_stack_lvl+0x189/0x250 [ 929.312012][T25487] ? __pfx____ratelimit+0x10/0x10 [ 929.312040][T25487] ? __pfx_dump_stack_lvl+0x10/0x10 [ 929.312069][T25487] ? __pfx__printk+0x10/0x10 [ 929.312103][T25487] should_fail_ex+0x414/0x560 [ 929.312131][T25487] _copy_to_user+0x31/0xb0 [ 929.312151][T25487] simple_read_from_buffer+0xe1/0x170 [ 929.312183][T25487] proc_fail_nth_read+0x1df/0x250 [ 929.312211][T25487] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 929.312237][T25487] ? rw_verify_area+0x258/0x650 [ 929.312264][T25487] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 929.312287][T25487] vfs_read+0x200/0x980 [ 929.312320][T25487] ? __pfx___mutex_lock+0x10/0x10 [ 929.312336][T25487] ? __pfx_vfs_read+0x10/0x10 [ 929.312353][T25487] ? __fget_files+0x2a/0x420 [ 929.312367][T25487] ? __fget_files+0x3a0/0x420 [ 929.312377][T25487] ? __fget_files+0x2a/0x420 [ 929.312393][T25487] ksys_read+0x145/0x250 [ 929.312403][T25487] ? __pfx_ksys_read+0x10/0x10 [ 929.312417][T25487] ? fput+0xa0/0xd0 [ 929.312432][T25487] ? do_syscall_64+0xbe/0x3b0 [ 929.312444][T25487] do_syscall_64+0xfa/0x3b0 [ 929.312452][T25487] ? lockdep_hardirqs_on+0x9c/0x150 [ 929.312467][T25487] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 929.312478][T25487] ? clear_bhb_loop+0x60/0xb0 [ 929.312494][T25487] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 929.312512][T25487] RIP: 0033:0x7f531798d33c [ 929.312530][T25487] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 929.312547][T25487] RSP: 002b:00007f53187ac030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 929.312566][T25487] RAX: ffffffffffffffda RBX: 00007f5317bb5fa0 RCX: 00007f531798d33c [ 929.312581][T25487] RDX: 000000000000000f RSI: 00007f53187ac0a0 RDI: 0000000000000004 [ 929.312594][T25487] RBP: 00007f53187ac090 R08: 0000000000000000 R09: 0000000000000000 [ 929.312603][T25487] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 929.312610][T25487] R13: 0000000000000000 R14: 00007f5317bb5fa0 R15: 00007f5317cdfa28 [ 929.312632][T25487] [ 930.064518][ T24] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 930.230138][ T24] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 930.250811][ T24] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 930.287526][ T24] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 930.305897][ T24] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 930.320970][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 930.365996][ T24] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 930.385409][ T24] usb 2-1: invalid MIDI out EP 0 [ 930.558955][T25491] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 930.569313][T25491] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 930.582140][T25491] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 930.592496][T25491] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 930.663335][ T24] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 931.034199][ T9] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 931.224079][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 931.308646][ T9] usb 1-1: New USB device found, idVendor=07ca, idProduct=b800, bcdDevice=31.1f [ 931.340217][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 931.382180][ T9] usb 1-1: Product: syz [ 931.397629][ T9] usb 1-1: Manufacturer: syz [ 931.428342][ T9] usb 1-1: SerialNumber: syz [ 931.463021][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.470717][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.497248][ T9] usb 1-1: config 0 descriptor?? [ 931.549799][ T9] (null): radio-mr800 - initialization failed [ 931.615140][T25595] loop2: detected capacity change from 0 to 7 [ 931.625188][ T9] radio-mr800 1-1:0.0: probe with driver radio-mr800 failed with error -22 [ 931.657354][T25595] Dev loop2: unable to read RDB block 7 [ 931.678721][T25595] loop2: unable to read partition table [ 931.692100][ T9] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 931.741525][T25595] loop2: partition table beyond EOD, truncated [ 931.789457][ T9] usb 1-1: USB disconnect, device number 100 [ 931.824148][T25595] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 931.947889][ T30] audit: type=1326 audit(1750607847.195:1382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25565 comm="syz.5.3463" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fda9ed8e929 code=0x0 [ 932.514519][T25625] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3470'. [ 932.570883][T25625] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3470'. [ 932.682384][ T1216] usb 2-1: USB disconnect, device number 110 [ 932.765973][ T5907] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 932.889468][ T5827] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 932.968725][ T5907] usb 5-1: config 0 has no interfaces? [ 932.977396][ T5907] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 932.988206][ T5907] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 933.001281][ T5907] usb 5-1: Product: syz [ 933.009283][ T5907] usb 5-1: Manufacturer: syz [ 933.014252][T25664] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3477'. [ 933.015383][ T5907] usb 5-1: SerialNumber: syz [ 933.035730][ T5907] usb 5-1: config 0 descriptor?? [ 933.044331][T24030] usb 6-1: new full-speed USB device number 39 using dummy_hcd [ 933.084158][ T5827] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 933.103369][ T5827] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 933.117564][ T5827] usb 1-1: Product: syz [ 933.124612][ T5827] usb 1-1: Manufacturer: syz [ 933.130989][ T5827] usb 1-1: SerialNumber: syz [ 933.152874][ T5827] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 933.172245][ T24] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 933.204155][ T9] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 933.226210][T24030] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 933.257014][T24030] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 933.273273][T24030] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 933.284991][T24030] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 933.314182][T16462] usb 2-1: new full-speed USB device number 111 using dummy_hcd [ 933.332041][T25622] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 933.343620][T24030] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 933.356241][T24030] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 933.365984][T24030] usb 6-1: Manufacturer: syz [ 933.373256][T24030] usb 6-1: config 0 descriptor?? [ 933.391854][T25622] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 933.404199][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 933.416949][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 233, changing to 11 [ 933.433095][ T9] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 933.477972][T16462] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 933.496271][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=c623, bcdDevice= 0.40 [ 933.507730][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 933.515995][T16462] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 933.530441][ T9] usb 3-1: Product: syz [ 933.536408][ T9] usb 3-1: Manufacturer: syz [ 933.541257][ T9] usb 3-1: SerialNumber: syz [ 933.549864][T16462] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 933.571813][T16462] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 933.592935][T25632] netlink: zone id is out of range [ 933.598442][T25632] netlink: zone id is out of range [ 933.604851][T25632] netlink: zone id is out of range [ 933.609993][T25632] netlink: zone id is out of range [ 933.627509][T25632] netlink: zone id is out of range [ 933.632759][T25632] netlink: zone id is out of range [ 933.642833][T25632] netlink: zone id is out of range [ 933.660907][T25632] netlink: zone id is out of range [ 933.670823][T25632] netlink: zone id is out of range [ 933.695882][T16462] usb 2-1: config 0 descriptor?? [ 933.723258][T25632] netlink: set zone limit has 4 unknown bytes [ 933.811138][ T5827] usb 1-1: USB disconnect, device number 101 [ 933.875604][T25659] netlink: 'syz.2.3475': attribute type 27 has an invalid length. [ 933.904692][T24030] rc_core: IR keymap rc-hauppauge not found [ 933.913691][T24030] Registered IR keymap rc-empty [ 933.932502][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 933.996336][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 934.007900][T25659] bridge0: port 3(macvlan2) entered disabled state [ 934.014642][T25659] bridge0: port 2(bridge_slave_1) entered disabled state [ 934.023465][T25659] bridge0: port 1(bridge_slave_0) entered disabled state [ 934.041739][T25688] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 934.053360][T25688] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 934.089024][T24030] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 934.134512][T24030] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input87 [ 934.163676][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 934.183689][T16462] konepure 0003:1E7D:2DB4.0038: unbalanced collection at end of report description [ 934.212980][T16462] konepure 0003:1E7D:2DB4.0038: parse failed [ 934.239266][T16462] konepure 0003:1E7D:2DB4.0038: probe with driver konepure failed with error -22 [ 934.268843][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 934.304723][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 934.326117][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 934.354555][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 934.382128][T25664] netlink: 'syz.1.3477': attribute type 10 has an invalid length. [ 934.390340][T25664] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3477'. [ 934.414411][ T24] usb 1-1: Service connection timeout for: 256 [ 934.427137][ T24] ath9k_htc 1-1:1.0: ath9k_htc: Unable to initialize HTC services [ 934.442551][ T24] ath9k_htc: Failed to initialize the device [ 934.452405][ T5827] usb 1-1: ath9k_htc: USB layer deinitialized [ 934.486223][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 934.536529][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 934.584277][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 934.667271][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 934.749015][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 934.783640][T25659] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 934.807581][T24030] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 934.841998][T24030] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 934.914822][T25659] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 935.244978][T25659] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 935.253965][T25659] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 935.270090][T25659] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 935.282584][T25659] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 935.314123][ T24] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 935.351072][T25659] bridge1: left promiscuous mode [ 935.358472][T25659] bridge2: left allmulticast mode [ 935.370020][T25659] bond0: left allmulticast mode [ 935.376840][T25659] bond_slave_0: left allmulticast mode [ 935.382409][T25659] bond_slave_1: left allmulticast mode [ 935.388144][T25659] bond0: left promiscuous mode [ 935.396110][T25659] bond_slave_0: left promiscuous mode [ 935.401883][T25659] bond_slave_1: left promiscuous mode [ 935.468305][T25684] 8021q: adding VLAN 0 to HW filter on device bond0 [ 935.477150][T25684] 8021q: adding VLAN 0 to HW filter on device team0 [ 935.484305][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 935.495089][ T24] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 935.506143][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 935.514547][ T24] usb 1-1: Product: syz [ 935.519183][ T24] usb 1-1: Manufacturer: syz [ 935.524804][ T24] usb 1-1: SerialNumber: syz [ 935.572029][ T24] usb 1-1: config 0 descriptor?? [ 935.611063][T25664] team0: Port device geneve0 added [ 935.657646][ T5907] usb 2-1: USB disconnect, device number 111 [ 935.737627][ T1216] usb 6-1: USB disconnect, device number 39 [ 935.786795][ T24] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 936.008022][ T24] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 936.046617][ T24] usb 1-1: USB disconnect, device number 102 [ 936.257598][ T1216] usb 5-1: USB disconnect, device number 74 [ 936.424854][ T24] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 936.739050][ T24] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 936.778337][ T24] usb 1-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 936.789119][ T9] usbhid 3-1:1.0: can't add hid device: -71 [ 936.816817][ T9] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 936.819613][ T24] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 936.843062][ T9] usb 3-1: USB disconnect, device number 77 [ 936.919816][ T43] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 936.927985][ T5827] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 936.960756][ T24] usb 1-1: config 220 has no interface number 2 [ 937.123008][ T24] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 937.137565][ T24] usb 1-1: config 220 interface 0 has no altsetting 0 [ 937.146970][ T24] usb 1-1: config 220 interface 76 has no altsetting 0 [ 937.154391][ T24] usb 1-1: config 220 interface 1 has no altsetting 0 [ 937.164246][ T24] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 937.173356][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 937.181835][ T43] usb 2-1: device descriptor read/64, error -71 [ 937.188911][ T24] usb 1-1: Product: syz [ 937.194126][ T24] usb 1-1: Manufacturer: syz [ 937.199108][ T24] usb 1-1: SerialNumber: syz [ 937.242437][ T5827] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 937.252880][ T5827] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 937.264782][T24030] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 937.270459][ T5827] usb 5-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 937.292034][ T5827] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 937.304500][ T5827] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 937.337831][ T5827] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 937.350173][ T5827] usb 5-1: invalid MIDI out EP 0 [ 937.454386][T24030] usb 6-1: Using ep0 maxpacket: 8 [ 937.454590][ T43] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 937.463711][T24030] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 937.511131][T18802] udevd[18802]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 937.533890][ T5827] snd-usb-audio 5-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 937.546596][T25775] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 937.556104][T25775] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 937.566222][T25775] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 937.575648][T25775] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 937.634766][T24030] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 937.664089][ T43] usb 2-1: device descriptor read/64, error -71 [ 937.771177][ T24] usb 1-1: Found UVC 7.01 device syz (8086:0b07) [ 937.771199][ T24] usb 1-1: No valid video chain found. [ 937.771233][ T24] usb 1-1: selecting invalid altsetting 0 [ 937.783598][ T43] usb usb2-port1: attempt power cycle [ 937.784924][ T24] usb 1-1: selecting invalid altsetting 0 [ 937.784941][ T24] usbtest 1-1:220.1: probe with driver usbtest failed with error -22 [ 937.788277][ T24] usb 1-1: USB disconnect, device number 103 [ 937.795608][T24030] usb 6-1: Product: syz [ 937.795627][T24030] usb 6-1: Manufacturer: syz [ 937.795641][T24030] usb 6-1: SerialNumber: syz [ 937.839715][T24030] usb 6-1: config 0 descriptor?? [ 938.043664][T24030] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 938.137577][ T43] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 938.195875][ T43] usb 2-1: device descriptor read/8, error -71 [ 938.434095][ T43] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 938.454737][ T43] usb 2-1: device descriptor read/8, error -71 [ 938.574387][ T43] usb usb2-port1: unable to enumerate USB device [ 938.962019][T25855] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3492'. [ 939.467641][ T24] usb 1-1: new full-speed USB device number 104 using dummy_hcd [ 939.512236][T25872] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3495'. [ 939.544716][T25870] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3495'. [ 939.555888][T25877] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3494'. [ 939.637684][ T24] usb 1-1: config 150 has an invalid descriptor of length 49, skipping remainder of the config [ 939.683440][T25877] ptrace attach of "./syz-executor exec"[20859] was attempted by " @       H 4 x)ա\x07 N$ |IKpD9[9c`\x0c !.3Ʉ}-( CRLl֧%ひMڜy+-I 2}\x0dRٺVX2M@Q\x0bp5Šn|ܷ?jk3r/HEVHƊ{rAf g:ehugx\x1br\x09q[DCBADCBA\x5c x [ 939.692545][ T24] usb 1-1: config 150 has 0 interfaces, different from the descriptor's value: 2 [ 939.783590][ C1] vkms_vblank_simulate: vblank timer overrun [ 939.892183][ T24] usb 1-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 939.902726][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 939.910944][ T24] usb 1-1: Product: syz [ 939.916417][ T24] usb 1-1: Manufacturer: syz [ 939.916898][ T9] usb 5-1: USB disconnect, device number 75 [ 939.921172][ T24] usb 1-1: SerialNumber: syz [ 939.939688][ T24] usb 1-1: rejected 1 configuration due to insufficient available bus power [ 939.948684][ T24] usb 1-1: no configuration chosen from 1 choice [ 940.087316][T24030] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 940.101777][T24030] usb 6-1: USB disconnect, device number 40 [ 940.264200][ T24] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 940.377021][ T9] usb 5-1: new full-speed USB device number 76 using dummy_hcd [ 940.419003][ T24] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 940.429490][ T24] usb 2-1: config 0 interface 0 has no altsetting 0 [ 940.439911][ T24] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 940.450525][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 940.458732][ T24] usb 2-1: Product: syz [ 940.463505][ T24] usb 2-1: Manufacturer: syz [ 940.477943][ T24] usb 2-1: SerialNumber: syz [ 940.492705][ T24] usb 2-1: config 0 descriptor?? [ 940.510480][ T24] usb 2-1: selecting invalid altsetting 0 [ 940.594671][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 940.633843][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 940.664682][ T9] usb 5-1: New USB device found, idVendor=0b05, idProduct=18c6, bcdDevice= 0.00 [ 940.694854][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 940.717162][ T9] usb 5-1: config 0 descriptor?? [ 940.734759][T25900] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 940.760998][T25893] input: syz0 as /devices/virtual/input/input88 [ 940.836058][ T24] usb 2-1: USB disconnect, device number 116 [ 941.052268][T25973] bridge0: entered allmulticast mode [ 941.092792][T25973] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3502'. [ 941.115287][T25944] xt_cgroup: invalid path, errno=-2 [ 941.185735][ T9] hid (null): unknown global tag 0xe [ 941.210002][ T9] asus 0003:0B05:18C6.0039: reserved main item tag 0xe [ 941.219453][ T9] asus 0003:0B05:18C6.0039: unknown main item tag 0x4 [ 941.236966][ T9] asus 0003:0B05:18C6.0039: unknown main item tag 0x1 [ 941.251705][ T9] asus 0003:0B05:18C6.0039: unknown global tag 0xe [ 941.263951][ T9] asus 0003:0B05:18C6.0039: item 0 0 1 14 parsing failed [ 941.278953][ T9] asus 0003:0B05:18C6.0039: Asus hid parse failed: -22 [ 941.292856][ T9] asus 0003:0B05:18C6.0039: probe with driver asus failed with error -22 [ 941.393430][ T9] usb 5-1: USB disconnect, device number 76 [ 941.490260][T26012] FAULT_INJECTION: forcing a failure. [ 941.490260][T26012] name failslab, interval 1, probability 0, space 0, times 0 [ 941.508834][T26012] CPU: 0 UID: 0 PID: 26012 Comm: syz.2.3506 Not tainted 6.16.0-rc2-syzkaller-00318-g739a6c93cc75 #0 PREEMPT(full) [ 941.508862][T26012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 941.508874][T26012] Call Trace: [ 941.508883][T26012] [ 941.508891][T26012] dump_stack_lvl+0x189/0x250 [ 941.508926][T26012] ? __pfx____ratelimit+0x10/0x10 [ 941.508956][T26012] ? __pfx_dump_stack_lvl+0x10/0x10 [ 941.508984][T26012] ? __pfx__printk+0x10/0x10 [ 941.509012][T26012] ? ref_tracker_alloc+0x318/0x460 [ 941.509040][T26012] should_fail_ex+0x414/0x560 [ 941.509068][T26012] should_failslab+0xa8/0x100 [ 941.509091][T26012] kmem_cache_alloc_noprof+0x73/0x3c0 [ 941.509121][T26012] ? skb_clone+0x212/0x3a0 [ 941.509152][T26012] skb_clone+0x212/0x3a0 [ 941.509179][T26012] __netlink_deliver_tap+0x404/0x850 [ 941.509214][T26012] ? netlink_deliver_tap+0x2e/0x1b0 [ 941.509238][T26012] netlink_deliver_tap+0x19c/0x1b0 [ 941.509261][T26012] netlink_unicast+0x72f/0x8d0 [ 941.509291][T26012] netlink_sendmsg+0x805/0xb30 [ 941.509322][T26012] ? __pfx_netlink_sendmsg+0x10/0x10 [ 941.509348][T26012] ? aa_sock_msg_perm+0x94/0x160 [ 941.509374][T26012] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 941.509397][T26012] ? __pfx_netlink_sendmsg+0x10/0x10 [ 941.509420][T26012] __sock_sendmsg+0x21c/0x270 [ 941.509452][T26012] ____sys_sendmsg+0x505/0x830 [ 941.509480][T26012] ? __pfx_____sys_sendmsg+0x10/0x10 [ 941.509513][T26012] ? import_iovec+0x74/0xa0 [ 941.509535][T26012] ___sys_sendmsg+0x21f/0x2a0 [ 941.509561][T26012] ? __pfx____sys_sendmsg+0x10/0x10 [ 941.509619][T26012] ? __fget_files+0x2a/0x420 [ 941.509638][T26012] ? __fget_files+0x3a0/0x420 [ 941.509672][T26012] __x64_sys_sendmsg+0x19b/0x260 [ 941.509699][T26012] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 941.509730][T26012] ? __pfx_ksys_write+0x10/0x10 [ 941.509746][T26012] ? rcu_is_watching+0x15/0xb0 [ 941.509783][T26012] ? do_syscall_64+0xbe/0x3b0 [ 941.509803][T26012] do_syscall_64+0xfa/0x3b0 [ 941.509817][T26012] ? lockdep_hardirqs_on+0x9c/0x150 [ 941.509843][T26012] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 941.509862][T26012] ? clear_bhb_loop+0x60/0xb0 [ 941.509885][T26012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 941.509905][T26012] RIP: 0033:0x7fd48618e929 [ 941.509922][T26012] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 941.509940][T26012] RSP: 002b:00007fd486f97038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 941.509961][T26012] RAX: ffffffffffffffda RBX: 00007fd4863b5fa0 RCX: 00007fd48618e929 [ 941.509976][T26012] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 941.509988][T26012] RBP: 00007fd486f97090 R08: 0000000000000000 R09: 0000000000000000 [ 941.510001][T26012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 941.510013][T26012] R13: 0000000000000000 R14: 00007fd4863b5fa0 R15: 00007fd4864dfa28 [ 941.510039][T26012] [ 941.510061][T26012] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3506'. [ 941.947880][T24030] usb 6-1: new full-speed USB device number 41 using dummy_hcd [ 942.066624][T26022] loop2: detected capacity change from 0 to 7 [ 942.084991][T26022] Dev loop2: unable to read RDB block 7 [ 942.090606][T26022] loop2: AHDI p1 p2 p3 p4 [ 942.107054][T24030] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 942.114220][T26022] loop2: partition table partially beyond EOD, truncated [ 942.132087][T24030] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 942.134683][T26022] loop2: p1 start 1601398130 is beyond EOD, truncated [ 942.161012][T26022] loop2: p2 start 1702059890 is beyond EOD, truncated [ 942.168265][T24030] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 942.185429][T26022] loop2: p3 start 16777215 is beyond EOD, truncated [ 942.187606][T24030] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 942.217079][T24030] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 942.233625][T24030] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 942.242770][T24030] usb 6-1: Manufacturer: syz [ 942.258212][T24030] usb 6-1: config 0 descriptor?? [ 942.288782][ T5827] usb 1-1: USB disconnect, device number 104 [ 942.492441][T26002] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3504'. [ 942.543000][T26002] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3504'. [ 942.736545][T24030] rc_core: IR keymap rc-hauppauge not found [ 942.742483][T24030] Registered IR keymap rc-empty [ 942.750169][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 942.760681][T26060] netlink: 'syz.0.3514': attribute type 10 has an invalid length. [ 942.775797][T26060] netlink: 'syz.0.3514': attribute type 10 has an invalid length. [ 942.783837][T26060] netlink: 'syz.0.3514': attribute type 10 has an invalid length. [ 942.791977][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 942.812468][T26060] netlink: 'syz.0.3514': attribute type 10 has an invalid length. [ 942.827378][T26060] netlink: 'syz.0.3514': attribute type 10 has an invalid length. [ 942.839335][T24030] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 942.844954][T26060] netlink: 'syz.0.3514': attribute type 10 has an invalid length. [ 942.854661][T24030] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input89 [ 942.865296][T26060] netlink: 'syz.0.3514': attribute type 10 has an invalid length. [ 942.876836][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 942.908320][T26060] netlink: 'syz.0.3514': attribute type 10 has an invalid length. [ 942.916533][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 942.925646][T26060] netlink: 'syz.0.3514': attribute type 10 has an invalid length. [ 942.933741][T26060] netlink: 'syz.0.3514': attribute type 10 has an invalid length. [ 942.974869][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 943.005029][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 943.044203][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 943.065332][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 943.106191][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 943.154632][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 943.204212][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 943.224436][T24030] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 943.288012][T24030] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 943.319523][T24030] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 943.589230][T26087] syz.1.3520: vmalloc error: size 8388608, failed to allocated page array size 16384, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 943.642159][T26087] CPU: 1 UID: 0 PID: 26087 Comm: syz.1.3520 Not tainted 6.16.0-rc2-syzkaller-00318-g739a6c93cc75 #0 PREEMPT(full) [ 943.642187][T26087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 943.642200][T26087] Call Trace: [ 943.642208][T26087] [ 943.642217][T26087] dump_stack_lvl+0x189/0x250 [ 943.642254][T26087] ? __pfx_dump_stack_lvl+0x10/0x10 [ 943.642284][T26087] ? __pfx__printk+0x10/0x10 [ 943.642306][T26087] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 943.642328][T26087] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 943.642352][T26087] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 943.642375][T26087] warn_alloc+0x214/0x310 [ 943.642402][T26087] ? __pfx_warn_alloc+0x10/0x10 [ 943.642438][T26087] ? __get_vm_area_node+0x28f/0x300 [ 943.642457][T26087] ? translate_table+0x19b/0x2040 [ 943.642482][T26087] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 943.642531][T26087] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 943.642558][T26087] ? rcu_is_watching+0x15/0xb0 [ 943.642588][T26087] ? translate_table+0x19b/0x2040 [ 943.642613][T26087] ? translate_table+0x19b/0x2040 [ 943.642634][T26087] __kvmalloc_node_noprof+0x3b8/0x5f0 [ 943.642654][T26087] ? translate_table+0x19b/0x2040 [ 943.642675][T26087] ? xt_alloc_table_info+0x3b/0xa0 [ 943.642709][T26087] translate_table+0x19b/0x2040 [ 943.642746][T26087] ? __lock_acquire+0xab9/0xd20 [ 943.642778][T26087] ? __pfx_translate_table+0x10/0x10 [ 943.642804][T26087] ? __might_fault+0xb0/0x130 [ 943.642841][T26087] ? _copy_from_user+0x94/0xb0 [ 943.642865][T26087] do_ip6t_set_ctl+0x970/0xce0 [ 943.642897][T26087] ? rcu_is_watching+0x15/0xb0 [ 943.642924][T26087] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 943.642967][T26087] ? __pfx___mutex_lock+0x10/0x10 [ 943.642986][T26087] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 943.643015][T26087] ? aa_sk_perm+0x81e/0x950 [ 943.643040][T26087] ? __pfx_aa_sk_perm+0x10/0x10 [ 943.643068][T26087] nf_setsockopt+0x26c/0x290 [ 943.643095][T26087] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 943.643118][T26087] do_sock_setsockopt+0x25a/0x3e0 [ 943.643144][T26087] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 943.643171][T26087] ? __fget_files+0x2a/0x420 [ 943.643200][T26087] __x64_sys_setsockopt+0x18b/0x220 [ 943.643230][T26087] do_syscall_64+0xfa/0x3b0 [ 943.643248][T26087] ? lockdep_hardirqs_on+0x9c/0x150 [ 943.643275][T26087] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 943.643295][T26087] ? clear_bhb_loop+0x60/0xb0 [ 943.643319][T26087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 943.643338][T26087] RIP: 0033:0x7f531798e929 [ 943.643356][T26087] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 943.643373][T26087] RSP: 002b:00007f53187ac038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 943.643394][T26087] RAX: ffffffffffffffda RBX: 00007f5317bb5fa0 RCX: 00007f531798e929 [ 943.643410][T26087] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000005 [ 943.643431][T26087] RBP: 00007f5317a10b39 R08: 00000000000002e8 R09: 0000000000000000 [ 943.643444][T26087] R10: 0000200000000ac0 R11: 0000000000000246 R12: 0000000000000000 [ 943.643457][T26087] R13: 0000000000000000 R14: 00007f5317bb5fa0 R15: 00007f5317cdfa28 [ 943.643486][T26087] [ 943.655506][T26087] Mem-Info: [ 943.971172][ T7003] macvlan2: left allmulticast mode [ 943.990792][ T7003] macvlan2: left promiscuous mode [ 944.009312][T26087] active_anon:12903 inactive_anon:0 isolated_anon:0 [ 944.009312][T26087] active_file:20423 inactive_file:40250 isolated_file:0 [ 944.009312][T26087] unevictable:768 dirty:168 writeback:0 [ 944.009312][T26087] slab_reclaimable:7067 slab_unreclaimable:113990 [ 944.009312][T26087] mapped:28993 shmem:3432 pagetables:1425 [ 944.009312][T26087] sec_pagetables:0 bounce:0 [ 944.009312][T26087] kernel_misc_reclaimable:0 [ 944.009312][T26087] free:1278578 free_pcp:16103 free_cma:0 [ 944.014278][ T7003] bridge0: port 3(macvlan2) entered disabled state [ 944.054847][ C1] vkms_vblank_simulate: vblank timer overrun [ 944.091834][T26087] Node 0 active_anon:51612kB inactive_anon:0kB active_file:81616kB inactive_file:160780kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:115884kB dirty:660kB writeback:0kB shmem:12192kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12620kB pagetables:5564kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 944.144433][ T9] usb 1-1: new full-speed USB device number 105 using dummy_hcd [ 944.180288][ T7003] bridge_slave_1: left allmulticast mode [ 944.190660][ T7003] bridge_slave_1: left promiscuous mode [ 944.200556][T26087] Node 1 active_anon:0kB inactive_anon:0kB active_file:76kB inactive_file:220kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:88kB dirty:12kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 944.220277][ T7003] bridge0: port 2(bridge_slave_1) entered disabled state [ 944.283867][T26087] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 944.347371][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 944.368159][T26087] lowmem_reserve[]: 0 2501 2502 2502 2502 [ 944.384034][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 944.427982][T26087] Node 0 DMA32 free:1146596kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:51868kB inactive_anon:0kB active_file:81616kB inactive_file:158948kB unevictable:1536kB writepending:660kB present:3129332kB managed:2561024kB mlocked:0kB bounce:0kB free_pcp:33440kB local_pcp:5500kB free_cma:0kB [ 944.471877][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 944.493561][ T7003] bridge_slave_0: left allmulticast mode [ 944.499960][ T7003] bridge_slave_0: left promiscuous mode [ 944.502662][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 944.521106][ T7003] bridge0: port 1(bridge_slave_0) entered disabled state [ 944.529647][T26087] lowmem_reserve[]: 0 0 1 1 1 [ 944.539737][T26087] Node 0 Normal free:16kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:1832kB unevictable:0kB writepending:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 944.578775][ T9] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 944.595427][ T9] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 944.618568][ T9] usb 1-1: Manufacturer: syz [ 944.623325][T26087] lowmem_reserve[]: 0 0 0 0 0 [ 944.636880][T26087] Node 1 Normal free:3891940kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:76kB inactive_file:220kB unevictable:1536kB writepending:12kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:30180kB local_pcp:16740kB free_cma:0kB [ 944.678343][T25169] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 944.678574][ T9] usb 1-1: config 0 descriptor?? [ 944.691915][T25169] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 944.699470][T26087] lowmem_reserve[]: 0 0 0 0 0 [ 944.718005][T25169] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 944.754344][T25169] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 944.767235][T25169] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 944.779607][T26087] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 944.814116][T26087] Node 0 DMA32: 5*4kB (E) 158*8kB (UME) 916*16kB (UME) 662*32kB (ME) 319*64kB (UME) 102*128kB (ME) 61*256kB (UME) 30*512kB (UME) 87*1024kB (UME) 6*2048kB (UM) 229*4096kB (UM) = 1140932kB [ 944.857769][T26087] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 944.899467][T26087] Node 1 Normal: 227*4kB (UME) 61*8kB (UME) 47*16kB (UME) 166*32kB (UME) 45*64kB (UME) 11*128kB (UME) 2*256kB (UM) 2*512kB (ME) 2*1024kB (ME) 1*2048kB (E) 946*4096kB (UM) = 3892196kB [ 944.949539][T26087] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 944.988358][T26087] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 945.018020][ T43] usb 6-1: USB disconnect, device number 41 [ 945.076673][T26087] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 945.116186][T26087] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 945.204098][T26087] 64104 total pagecache pages [ 945.208839][T26087] 0 pages in swap cache [ 945.244162][T26087] Free swap = 124996kB [ 945.252221][T26087] Total swap = 124996kB [ 945.272513][T26087] 2097051 pages RAM [ 945.298026][T26087] 0 pages HighMem/MovableOnly [ 945.318704][T26087] 424689 pages reserved [ 945.322915][T26087] 0 pages cma reserved [ 945.621456][ T7003] bridge0 (unregistering): left allmulticast mode [ 945.628018][ T9] rc_core: IR keymap rc-hauppauge not found [ 945.633928][ T9] Registered IR keymap rc-empty [ 945.649838][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 945.704433][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 945.747571][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 945.790464][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input90 [ 945.835883][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 945.887652][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 945.925508][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 945.969149][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 946.014807][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 946.049418][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 946.064616][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 946.094741][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 946.139581][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 946.165758][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 946.201184][ T9] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 946.236756][ T9] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 946.246606][ T9] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 946.329565][ T7003] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 946.361682][ T7003] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 946.397627][ T7003] bond0 (unregistering): Released all slaves [ 946.514986][T26091] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 946.546875][T26091] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 946.593657][T26091] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 946.613596][T26091] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 946.799048][T26091] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 946.806074][T26091] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 946.817921][ T5837] Bluetooth: hci3: command tx timeout [ 946.836206][T26091] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 946.898924][T26091] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 946.941269][T26091] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 947.044533][T26091] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 947.249530][ T7003] hsr_slave_0: left promiscuous mode [ 947.287794][ T7003] hsr_slave_1: left promiscuous mode [ 947.295322][ T7003] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 947.317204][ T5907] usb 1-1: USB disconnect, device number 105 [ 947.334866][ T7003] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 948.579853][ T5837] Bluetooth: hci1: command 0x0c1a tx timeout [ 948.586099][T25169] Bluetooth: hci5: command 0x0c1a tx timeout [ 948.654367][ T5837] Bluetooth: hci2: command 0x0406 tx timeout [ 948.814104][ T5837] Bluetooth: hci0: command 0x0c1a tx timeout [ 948.982340][ T5837] Bluetooth: hci3: command 0x041b tx timeout [ 949.489202][ T7003] team0 (unregistering): Port device team_slave_1 removed [ 949.764756][ T7003] team0 (unregistering): Port device team_slave_0 removed [ 950.744889][ T5837] Bluetooth: hci2: command 0x0406 tx timeout [ 950.908599][ T5837] Bluetooth: hci0: command 0x0c1a tx timeout [ 951.054138][ T5837] Bluetooth: hci3: command 0x041b tx timeout [ 951.784633][T26266] validate_nla: 23 callbacks suppressed [ 951.784646][T26266] netlink: 'syz.5.3533': attribute type 1 has an invalid length. [ 951.908575][T26270] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3533'. [ 952.414564][T26269] 8021q: adding VLAN 0 to HW filter on device bond3 [ 952.459542][T26269] bond2: (slave bond3): making interface the new active one [ 952.488849][T26269] bond2: (slave bond3): Enslaving as an active interface with an up link [ 952.744453][T26270] 8021q: adding VLAN 0 to HW filter on device bond2 [ 952.977683][ T5837] Bluetooth: hci0: command 0x0c1a tx timeout [ 953.052126][T26368] input: syz0 as /devices/virtual/input/input91 [ 953.135800][ T5837] Bluetooth: hci3: command 0x041b tx timeout [ 953.517382][T26119] chnl_net:caif_netlink_parms(): no params data found [ 953.579049][ T5837] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 953.896864][T26119] bridge0: port 1(bridge_slave_0) entered blocking state [ 953.904264][T26119] bridge0: port 1(bridge_slave_0) entered disabled state [ 953.911861][T26119] bridge_slave_0: entered allmulticast mode [ 953.920216][T26119] bridge_slave_0: entered promiscuous mode [ 953.931755][T26119] bridge0: port 2(bridge_slave_1) entered blocking state [ 953.939545][T26119] bridge0: port 2(bridge_slave_1) entered disabled state [ 953.947112][T26119] bridge_slave_1: entered allmulticast mode [ 953.954141][T24129] usb 1-1: new full-speed USB device number 106 using dummy_hcd [ 953.955011][T26119] bridge_slave_1: entered promiscuous mode [ 954.054877][T26119] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 954.088197][T26119] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 954.133778][T24129] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 954.159621][T24129] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 954.196241][T24129] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 954.214431][T24129] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 954.239406][T24129] usb 1-1: Product: syz [ 954.247801][T26119] team0: Port device team_slave_0 added [ 954.251486][T24129] usb 1-1: Manufacturer: syz [ 954.271399][T26119] team0: Port device team_slave_1 added [ 954.274055][T24129] usb 1-1: SerialNumber: syz [ 954.402261][T26119] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 954.424886][T26119] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 954.476498][T26119] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 954.508549][T26119] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 954.514340][T24129] usb 1-1: 0:2 : does not exist [ 954.531077][T24129] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 954.538491][T26119] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 954.538553][T26119] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 954.804784][T26119] hsr_slave_0: entered promiscuous mode [ 954.843040][T24129] usb 1-1: USB disconnect, device number 106 [ 954.855352][T26119] hsr_slave_1: entered promiscuous mode [ 954.982592][T26281] udevd[26281]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 955.225801][ T5837] Bluetooth: hci3: command 0x041b tx timeout [ 955.235784][T26702] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3550'. [ 955.772206][T26119] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 955.867047][ T9] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 955.888640][T26119] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 955.942415][T26119] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 955.960627][T26766] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3555'. [ 956.024196][T26119] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 956.064849][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 956.093047][ T9] usb 6-1: config 0 has an invalid interface number: 85 but max is 0 [ 956.112829][ T9] usb 6-1: config 0 has no interface number 0 [ 956.135737][ T9] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 956.197003][ T9] usb 6-1: config 0 interface 85 has no altsetting 0 [ 956.232139][ T9] usb 6-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 956.254221][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 956.282717][ T9] usb 6-1: Product: syz [ 956.293054][ T9] usb 6-1: Manufacturer: syz [ 956.310306][ T9] usb 6-1: SerialNumber: syz [ 956.337257][ T9] usb 6-1: config 0 descriptor?? [ 956.403025][T26119] 8021q: adding VLAN 0 to HW filter on device bond0 [ 956.488029][T26119] 8021q: adding VLAN 0 to HW filter on device team0 [ 956.528588][T19643] bridge0: port 1(bridge_slave_0) entered blocking state [ 956.535774][T19643] bridge0: port 1(bridge_slave_0) entered forwarding state [ 956.582279][ T7003] bridge0: port 2(bridge_slave_1) entered blocking state [ 956.589467][ T7003] bridge0: port 2(bridge_slave_1) entered forwarding state [ 956.867327][T26119] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 956.964284][ T9] appletouch 6-1:0.85: Geyser mode initialized. [ 957.006249][ T9] input: appletouch as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.85/input/input93 [ 957.097415][T26119] veth0_vlan: entered promiscuous mode [ 957.146061][T26119] veth1_vlan: entered promiscuous mode [ 957.169248][ T9] usb 6-1: USB disconnect, device number 42 [ 957.237756][ T9] appletouch 6-1:0.85: input: appletouch disconnected [ 957.290777][T26119] veth0_macvtap: entered promiscuous mode [ 957.297040][ T5837] Bluetooth: hci3: command 0x041b tx timeout [ 957.320391][T26119] veth1_macvtap: entered promiscuous mode [ 957.368392][T26119] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 957.398330][T26119] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 957.445678][T26119] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 957.479296][T26119] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 957.508361][T26119] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 957.554144][T26119] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 957.840367][ T7003] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 957.868702][ T7003] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 957.967751][T19643] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 957.983151][T19643] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 959.381975][ T5837] Bluetooth: hci3: command 0x041b tx timeout [ 959.486338][T26878] input: syz1 as /devices/virtual/input/input94 [ 959.932837][T26889] vivid-000: ================= START STATUS ================= [ 959.990135][T26889] vivid-000: Generate PTS: true [ 960.036590][T26889] vivid-000: Generate SCR: true [ 960.075064][T26889] tpg source WxH: 1280x720 (Y'CbCr) [ 960.137223][T26889] tpg field: 1 [ 960.171822][T26889] tpg crop: (1264,0)/16x720 [ 960.251099][T26889] tpg compose: (0,0)/16x720 [ 960.264181][T26889] tpg colorspace: 3 [ 960.281189][T26889] tpg transfer function: 0/0 [ 960.292380][T26889] tpg Y'CbCr encoding: 0/0 [ 960.315224][T26889] tpg quantization: 0/0 [ 960.362687][T26889] tpg RGB range: 2/1 [ 960.379167][T26889] vivid-000: ================== END STATUS ================== [ 960.933853][ T5827] hid-generic 0000:0003:0000.003A: unknown main item tag 0x0 [ 961.009094][ T5827] hid-generic 0000:0003:0000.003A: hidraw0: HID v0.00 Device [syz0] on syz1 [ 962.398688][T26950] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3572'. [ 962.424730][T26947] bridge0: port 2(bridge_slave_1) entered disabled state [ 962.806655][T26947] bridge_slave_1 (unregistering): left allmulticast mode [ 962.884175][T26947] bridge_slave_1 (unregistering): left promiscuous mode [ 962.934503][T26947] bridge0: port 2(bridge_slave_1) entered disabled state [ 964.444090][ T5831] usb 6-1: new full-speed USB device number 43 using dummy_hcd [ 964.626804][ T5831] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 964.654146][ T5831] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 964.694088][ T5831] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 964.735768][ T5831] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 964.768916][ T5831] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 964.788401][ T5831] usb 6-1: config 0 descriptor?? [ 965.397524][ T5831] plantronics 0003:047F:FFFF.003B: unknown main item tag 0x0 [ 965.445057][ T5831] plantronics 0003:047F:FFFF.003B: No inputs registered, leaving [ 965.515257][ T5831] plantronics 0003:047F:FFFF.003B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 966.204959][ T5907] usb 6-1: USB disconnect, device number 43 [ 968.074723][T24129] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 968.279203][T24129] usb 2-1: no configurations [ 968.283871][T24129] usb 2-1: can't read configurations, error -22 [ 968.454086][T24129] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 968.454120][ T5907] usb 5-1: new full-speed USB device number 77 using dummy_hcd [ 968.629950][T24129] usb 2-1: no configurations [ 968.635793][T24129] usb 2-1: can't read configurations, error -22 [ 968.642626][T24129] usb usb2-port1: attempt power cycle [ 968.660046][T27129] kvm: kvm [27128]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 968.756979][ T5907] usb 5-1: config index 0 descriptor too short (expected 31, got 27) [ 968.774087][ T5907] usb 5-1: config 1 interface 0 altsetting 253 endpoint 0x1 has invalid wMaxPacketSize 0 [ 968.794287][ T5907] usb 5-1: config 1 interface 0 has no altsetting 0 [ 968.807168][ T5907] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= b.72 [ 968.828285][ T5907] usb 5-1: New USB device strings: Mfr=28, Product=37, SerialNumber=3 [ 968.847704][ T5907] usb 5-1: Product: syz [ 968.851922][ T5907] usb 5-1: Manufacturer: syz [ 968.868175][ T5907] usb 5-1: SerialNumber: syz [ 969.024088][T24129] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 969.055992][T24129] usb 2-1: no configurations [ 969.062474][T24129] usb 2-1: can't read configurations, error -22 [ 969.204223][T24129] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 969.249585][T24129] usb 2-1: no configurations [ 969.254404][T24129] usb 2-1: can't read configurations, error -22 [ 969.261127][T24129] usb usb2-port1: unable to enumerate USB device [ 969.501900][ T5907] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 77 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 969.708049][T24129] usb 5-1: USB disconnect, device number 77 [ 969.723345][T24129] usblp0: removed [ 971.074813][T27210] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3614'. [ 971.115702][T27210] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3614'. [ 971.151465][T27210] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3614'. [ 971.586054][T27210] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3614'. [ 971.621549][T27210] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3614'. [ 971.960633][T27210] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3614'. [ 971.969975][T27210] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3614'. [ 977.774671][ T30] audit: type=1326 audit(1750607893.015:1383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27369 comm="syz.5.3647" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda9ed8e929 code=0x7ffc0000 [ 977.847103][ T30] audit: type=1326 audit(1750607893.015:1384): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27369 comm="syz.5.3647" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda9ed8e929 code=0x7ffc0000 [ 977.936401][ T30] audit: type=1326 audit(1750607893.025:1385): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27369 comm="syz.5.3647" exe="/root/syz-executor" sig=0 arch=c000003e syscall=179 compat=0 ip=0x7fda9ed8e929 code=0x7ffc0000 [ 978.028439][ T30] audit: type=1326 audit(1750607893.125:1386): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27369 comm="syz.5.3647" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda9ed8e929 code=0x7ffc0000 [ 978.124650][ T30] audit: type=1326 audit(1750607893.125:1387): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27369 comm="syz.5.3647" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fda9ed8e929 code=0x7ffc0000 [ 979.492802][T27385] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3650'. [ 979.671424][T27385] bridge_slave_1: left allmulticast mode [ 979.678324][T27385] bridge_slave_1: left promiscuous mode [ 979.704315][T27385] bridge0: port 2(bridge_slave_1) entered disabled state [ 979.735616][T27385] bridge_slave_0: left allmulticast mode [ 979.762786][T27385] bridge_slave_0: left promiscuous mode [ 979.786074][T27385] bridge0: port 1(bridge_slave_0) entered disabled state [ 981.500511][T27496] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3656'. [ 983.244166][T24129] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 983.418185][T24129] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 983.672487][ T30] audit: type=1326 audit(1750607898.915:1388): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27541 comm="syz.6.3668" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f659878e929 code=0x0 [ 983.737989][T24129] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 983.768486][T24129] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 983.810648][T24129] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 983.852250][T27523] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 983.891124][T24129] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 984.148560][ T5907] usb 2-1: USB disconnect, device number 121 [ 987.189609][T27664] netlink: 80 bytes leftover after parsing attributes in process `syz.5.3685'. [ 987.259416][T27664] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3685'. [ 987.767739][T27683] netlink: 156 bytes leftover after parsing attributes in process `syz.1.3687'. [ 987.787133][T27683] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 988.013865][T27693] netlink: 209852 bytes leftover after parsing attributes in process `syz.5.3689'. [ 988.033726][T27693] net_ratelimit: 2 callbacks suppressed [ 988.033745][T27693] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 988.098742][T27693] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 988.195181][ T5827] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 988.454231][ T5827] usb 2-1: Using ep0 maxpacket: 32 [ 988.462732][ T5827] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 988.471279][ T5827] usb 2-1: config 0 has no interface number 0 [ 988.477422][ T5827] usb 2-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 988.488150][ T5827] usb 2-1: config 0 interface 132 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 988.502029][ T5827] usb 2-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 988.511217][ T5827] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 988.531025][ T5827] usb 2-1: Product: syz [ 988.539605][ T5827] usb 2-1: Manufacturer: syz [ 988.551114][ T5827] usb 2-1: SerialNumber: syz [ 988.560270][ T5827] usb 2-1: config 0 descriptor?? [ 988.584893][ T5827] em28xx 2-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 988.596452][ T5827] em28xx 2-1:0.132: Video interface 132 found: bulk [ 989.884174][ T5827] em28xx 2-1:0.132: unknown em28xx chip ID (0) [ 990.007763][ T5827] em28xx 2-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 990.038078][ T5827] em28xx 2-1:0.132: board has no eeprom [ 990.104491][ T5827] em28xx 2-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 990.112344][ T5827] em28xx 2-1:0.132: analog set to bulk mode. [ 990.156481][ T43] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 990.221578][ T24] em28xx 2-1:0.132: Registering V4L2 extension [ 990.364456][ T43] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 990.374732][ T43] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 990.491148][T27742] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3696'. [ 990.516187][ T43] usb 1-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 990.587641][ T24] em28xx 2-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 990.609304][ T43] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 990.635538][ T24] em28xx 2-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 990.657768][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 990.669859][ T24] em28xx 2-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 990.702904][ T43] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 990.715141][ T24] em28xx 2-1:0.132: failed to trigger read from i2c address 0x40 (error=-5) [ 990.724821][ T43] usb 1-1: invalid MIDI out EP 0 [ 991.017657][T27726] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 991.033112][ T43] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 991.059537][T27726] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 991.170109][T27586] udevd[27586]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 991.212761][ T24] em28xx 2-1:0.132: failed to trigger read from i2c address 0x84 (error=-5) [ 991.333690][T27726] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 991.384071][ T24] em28xx 2-1:0.132: failed to trigger read from i2c address 0x86 (error=-5) [ 991.418245][ T24] em28xx 2-1:0.132: failed to trigger read from i2c address 0x94 (error=-5) [ 991.449201][T27726] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 991.474402][ T24] em28xx 2-1:0.132: failed to trigger read from i2c address 0x96 (error=-5) [ 991.630911][ T43] usb 2-1: USB disconnect, device number 122 [ 991.638634][ T43] em28xx 2-1:0.132: Disconnecting em28xx [ 991.664739][ T24] em28xx 2-1:0.132: Config register raw data: 0xffffffed [ 991.671810][ T24] em28xx 2-1:0.132: AC97 chip type couldn't be determined [ 991.719843][ T24] em28xx 2-1:0.132: No AC97 audio processor [ 991.781496][ T24] usb 2-1: Decoder not found [ 991.817256][ T24] em28xx 2-1:0.132: failed to create media graph [ 991.897394][ T24] em28xx 2-1:0.132: V4L2 device video103 deregistered [ 991.904757][T27804] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3699'. [ 991.930908][ T24] em28xx 2-1:0.132: Remote control support is not available for this card. [ 991.931210][T27798] ================================================================== [ 991.947576][T27798] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xc7/0x430 [ 991.954959][T27798] Read of size 8 at addr ffff88806bb88738 by task v4l_id/27798 [ 991.962504][T27798] [ 991.964831][T27798] CPU: 0 UID: 0 PID: 27798 Comm: v4l_id Not tainted 6.16.0-rc2-syzkaller-00318-g739a6c93cc75 #0 PREEMPT(full) [ 991.964855][T27798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 991.964866][T27798] Call Trace: [ 991.964879][T27798] [ 991.964887][T27798] dump_stack_lvl+0x189/0x250 [ 991.964916][T27798] ? __virt_addr_valid+0x1c8/0x5c0 [ 991.964933][T27798] ? rcu_is_watching+0x15/0xb0 [ 991.964959][T27798] ? __pfx_dump_stack_lvl+0x10/0x10 [ 991.964983][T27798] ? rcu_is_watching+0x15/0xb0 [ 991.965007][T27798] ? lock_release+0x4b/0x3e0 [ 991.965030][T27798] ? __virt_addr_valid+0x1c8/0x5c0 [ 991.965047][T27798] ? __virt_addr_valid+0x4a5/0x5c0 [ 991.965064][T27798] print_report+0xd2/0x2b0 [ 991.965085][T27798] ? v4l2_fh_open+0xc7/0x430 [ 991.965109][T27798] kasan_report+0x118/0x150 [ 991.965127][T27798] ? v4l2_fh_open+0xc7/0x430 [ 991.965154][T27798] v4l2_fh_open+0xc7/0x430 [ 991.965177][T27798] ? __pfx___mutex_lock+0x10/0x10 [ 991.965194][T27798] em28xx_v4l2_open+0x157/0x9a0 [ 991.965222][T27798] v4l2_open+0x20f/0x360 [ 991.965239][T27798] chrdev_open+0x4c9/0x5e0 [ 991.965258][T27798] ? __pfx_chrdev_open+0x10/0x10 [ 991.965279][T27798] ? __pfx_chrdev_open+0x10/0x10 [ 991.965296][T27798] do_dentry_open+0xdf0/0x1970 [ 991.965321][T27798] vfs_open+0x3b/0x340 [ 991.965340][T27798] ? path_openat+0x2ecd/0x3830 [ 991.965364][T27798] path_openat+0x2ee5/0x3830 [ 991.965385][T27798] ? arch_stack_walk+0xfc/0x150 [ 991.965408][T27798] ? rcu_is_watching+0x15/0xb0 [ 991.965436][T27798] ? __pfx_path_openat+0x10/0x10 [ 991.965457][T27798] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 991.965481][T27798] do_filp_open+0x1fa/0x410 [ 991.965503][T27798] ? __lock_acquire+0xab9/0xd20 [ 991.965525][T27798] ? __pfx_do_filp_open+0x10/0x10 [ 991.965555][T27798] ? _raw_spin_unlock+0x28/0x50 [ 991.965576][T27798] ? alloc_fd+0x64c/0x6c0 [ 991.965596][T27798] do_sys_openat2+0x121/0x1c0 [ 991.965618][T27798] ? __pfx_do_sys_openat2+0x10/0x10 [ 991.965644][T27798] __x64_sys_openat+0x138/0x170 [ 991.965667][T27798] do_syscall_64+0xfa/0x3b0 [ 991.965682][T27798] ? lockdep_hardirqs_on+0x9c/0x150 [ 991.965705][T27798] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 991.965721][T27798] ? clear_bhb_loop+0x60/0xb0 [ 991.965739][T27798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 991.965757][T27798] RIP: 0033:0x7f1a700a7407 [ 991.965772][T27798] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 991.965788][T27798] RSP: 002b:00007ffcb0204820 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 991.965806][T27798] RAX: ffffffffffffffda RBX: 00007f1a7085e880 RCX: 00007f1a700a7407 [ 991.965819][T27798] RDX: 0000000000000000 RSI: 00007ffcb0204f1b RDI: ffffffffffffff9c [ 991.965832][T27798] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 991.965842][T27798] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 991.965853][T27798] R13: 00007ffcb0204a70 R14: 00007f1a709c5000 R15: 000055f618f0c4d8 [ 991.965876][T27798] [ 991.965882][T27798] [ 992.263798][T27798] Allocated by task 24: [ 992.267947][T27798] kasan_save_track+0x3e/0x80 [ 992.272634][T27798] __kasan_kmalloc+0x93/0xb0 [ 992.277214][T27798] __kmalloc_cache_noprof+0x230/0x3d0 [ 992.282579][T27798] em28xx_v4l2_init+0x10b/0x2e70 [ 992.287517][T27798] em28xx_init_extension+0x11d/0x1c0 [ 992.292801][T27798] process_scheduled_works+0xae1/0x17b0 [ 992.298353][T27798] worker_thread+0x8a0/0xda0 [ 992.302936][T27798] kthread+0x70e/0x8a0 [ 992.307001][T27798] ret_from_fork+0x3f9/0x770 [ 992.311587][T27798] ret_from_fork_asm+0x1a/0x30 [ 992.316346][T27798] [ 992.318661][T27798] Freed by task 24: [ 992.322453][T27798] kasan_save_track+0x3e/0x80 [ 992.327130][T27798] kasan_save_free_info+0x46/0x50 [ 992.332151][T27798] __kasan_slab_free+0x62/0x70 [ 992.336905][T27798] kfree+0x18e/0x440 [ 992.340799][T27798] em28xx_v4l2_init+0x1683/0x2e70 [ 992.345830][T27798] em28xx_init_extension+0x11d/0x1c0 [ 992.351115][T27798] process_scheduled_works+0xae1/0x17b0 [ 992.356659][T27798] worker_thread+0x8a0/0xda0 [ 992.361239][T27798] kthread+0x70e/0x8a0 [ 992.365299][T27798] ret_from_fork+0x3f9/0x770 [ 992.369885][T27798] ret_from_fork_asm+0x1a/0x30 [ 992.374674][T27798] [ 992.376989][T27798] The buggy address belongs to the object at ffff88806bb88000 [ 992.376989][T27798] which belongs to the cache kmalloc-8k of size 8192 [ 992.391141][T27798] The buggy address is located 1848 bytes inside of [ 992.391141][T27798] freed 8192-byte region [ffff88806bb88000, ffff88806bb8a000) [ 992.405158][T27798] [ 992.407566][T27798] The buggy address belongs to the physical page: [ 992.413974][T27798] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6bb88 [ 992.422738][T27798] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 992.431227][T27798] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 992.438767][T27798] page_type: f5(slab) [ 992.442746][T27798] raw: 00fff00000000040 ffff88801a442280 ffffea0000cca000 dead000000000002 [ 992.451322][T27798] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 992.459901][T27798] head: 00fff00000000040 ffff88801a442280 ffffea0000cca000 dead000000000002 [ 992.468607][T27798] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 992.477270][T27798] head: 00fff00000000003 ffffea0001aee201 00000000ffffffff 00000000ffffffff [ 992.485935][T27798] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 992.494595][T27798] page dumped because: kasan: bad access detected [ 992.501005][T27798] page_owner tracks the page as allocated [ 992.506707][T27798] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1528c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 20859, tgid 20859 (syz-executor), ts 844651611461, free_ts 843825668375 [ 992.528145][T27798] post_alloc_hook+0x240/0x2a0 [ 992.532907][T27798] get_page_from_freelist+0x21e4/0x22c0 [ 992.538448][T27798] __alloc_frozen_pages_noprof+0x181/0x370 [ 992.544249][T27798] alloc_pages_mpol+0x232/0x4a0 [ 992.549088][T27798] allocate_slab+0x8a/0x3b0 [ 992.553585][T27798] ___slab_alloc+0xbfc/0x1480 [ 992.558253][T27798] __kvmalloc_node_noprof+0x429/0x5f0 [ 992.563615][T27798] pfifo_fast_init+0x238/0x6b0 [ 992.568372][T27798] qdisc_create_dflt+0x138/0x4e0 [ 992.573299][T27798] dev_activate+0x378/0x1150 [ 992.577888][T27798] __dev_open+0x69c/0x880 [ 992.582207][T27798] __dev_change_flags+0x1ea/0x6d0 [ 992.587227][T27798] netif_change_flags+0x88/0x1a0 [ 992.592161][T27798] do_setlink+0xc55/0x41c0 [ 992.596570][T27798] rtnl_newlink+0x160b/0x1c70 [ 992.601239][T27798] rtnetlink_rcv_msg+0x7cc/0xb70 [ 992.606166][T27798] page last free pid 21715 tgid 21699 stack trace: [ 992.612657][T27798] __free_frozen_pages+0xc71/0xe70 [ 992.617764][T27798] __slab_free+0x326/0x400 [ 992.622172][T27798] qlist_free_all+0x97/0x140 [ 992.626761][T27798] kasan_quarantine_reduce+0x148/0x160 [ 992.632218][T27798] __kasan_slab_alloc+0x22/0x80 [ 992.637056][T27798] __kmalloc_noprof+0x224/0x4f0 [ 992.641898][T27798] tomoyo_realpath_from_path+0xe3/0x5d0 [ 992.647442][T27798] tomoyo_path_number_perm+0x1e8/0x5a0 [ 992.652912][T27798] security_file_ioctl+0xcb/0x2d0 [ 992.657936][T27798] __se_sys_ioctl+0x47/0x170 [ 992.662523][T27798] do_syscall_64+0xfa/0x3b0 [ 992.667020][T27798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 992.672904][T27798] [ 992.675220][T27798] Memory state around the buggy address: [ 992.680839][T27798] ffff88806bb88600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 992.688899][T27798] ffff88806bb88680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 992.696951][T27798] >ffff88806bb88700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 992.705000][T27798] ^ [ 992.710883][T27798] ffff88806bb88780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 992.718932][T27798] ffff88806bb88800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 992.727008][T27798] ================================================================== [ 992.754993][ T43] em28xx 2-1:0.132: Closing input extension [ 992.777377][T27804] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3699'. [ 992.904916][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.911215][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.198959][T27798] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 993.206216][T27798] CPU: 1 UID: 0 PID: 27798 Comm: v4l_id Not tainted 6.16.0-rc2-syzkaller-00318-g739a6c93cc75 #0 PREEMPT(full) [ 993.217938][T27798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 993.228082][T27798] Call Trace: [ 993.231344][T27798] [ 993.234262][T27798] dump_stack_lvl+0x99/0x250 [ 993.238838][T27798] ? __asan_memcpy+0x40/0x70 [ 993.243409][T27798] ? __pfx_dump_stack_lvl+0x10/0x10 [ 993.248590][T27798] ? __pfx__printk+0x10/0x10 [ 993.253166][T27798] panic+0x2db/0x790 [ 993.257050][T27798] ? __pfx_panic+0x10/0x10 [ 993.261450][T27798] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 993.267330][T27798] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 993.273645][T27798] ? print_memory_metadata+0x314/0x400 [ 993.279087][T27798] ? v4l2_fh_open+0xc7/0x430 [ 993.283690][T27798] check_panic_on_warn+0x89/0xb0 [ 993.288611][T27798] ? v4l2_fh_open+0xc7/0x430 [ 993.293184][T27798] end_report+0x78/0x160 [ 993.297409][T27798] kasan_report+0x129/0x150 [ 993.301898][T27798] ? v4l2_fh_open+0xc7/0x430 [ 993.306483][T27798] v4l2_fh_open+0xc7/0x430 [ 993.310886][T27798] ? __pfx___mutex_lock+0x10/0x10 [ 993.315929][T27798] em28xx_v4l2_open+0x157/0x9a0 [ 993.320770][T27798] v4l2_open+0x20f/0x360 [ 993.324991][T27798] chrdev_open+0x4c9/0x5e0 [ 993.329387][T27798] ? __pfx_chrdev_open+0x10/0x10 [ 993.334328][T27798] ? __pfx_chrdev_open+0x10/0x10 [ 993.339245][T27798] do_dentry_open+0xdf0/0x1970 [ 993.344002][T27798] vfs_open+0x3b/0x340 [ 993.348052][T27798] ? path_openat+0x2ecd/0x3830 [ 993.352818][T27798] path_openat+0x2ee5/0x3830 [ 993.357416][T27798] ? arch_stack_walk+0xfc/0x150 [ 993.362252][T27798] ? rcu_is_watching+0x15/0xb0 [ 993.367003][T27798] ? __pfx_path_openat+0x10/0x10 [ 993.371926][T27798] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 993.377981][T27798] do_filp_open+0x1fa/0x410 [ 993.382465][T27798] ? __lock_acquire+0xab9/0xd20 [ 993.387300][T27798] ? __pfx_do_filp_open+0x10/0x10 [ 993.392307][T27798] ? _raw_spin_unlock+0x28/0x50 [ 993.397147][T27798] ? alloc_fd+0x64c/0x6c0 [ 993.401463][T27798] do_sys_openat2+0x121/0x1c0 [ 993.406128][T27798] ? __pfx_do_sys_openat2+0x10/0x10 [ 993.411314][T27798] __x64_sys_openat+0x138/0x170 [ 993.416148][T27798] do_syscall_64+0xfa/0x3b0 [ 993.420636][T27798] ? lockdep_hardirqs_on+0x9c/0x150 [ 993.425816][T27798] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 993.431858][T27798] ? clear_bhb_loop+0x60/0xb0 [ 993.436513][T27798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 993.442382][T27798] RIP: 0033:0x7f1a700a7407 [ 993.446778][T27798] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 993.466365][T27798] RSP: 002b:00007ffcb0204820 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 993.474760][T27798] RAX: ffffffffffffffda RBX: 00007f1a7085e880 RCX: 00007f1a700a7407 [ 993.482720][T27798] RDX: 0000000000000000 RSI: 00007ffcb0204f1b RDI: ffffffffffffff9c [ 993.490698][T27798] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 993.498657][T27798] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 993.506615][T27798] R13: 00007ffcb0204a70 R14: 00007f1a709c5000 R15: 000055f618f0c4d8 [ 993.514577][T27798] [ 993.517829][T27798] Kernel Offset: disabled [ 993.522139][T27798] Rebooting in 86400 seconds..