last executing test programs: 1m9.926366159s ago: executing program 3 (id=187): r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f000000d379)={&(0x7f0000000200)={0x18, 0x14, 0x301, 0x0, 0x0, {0x1e}, [@generic="c1"]}, 0x18}}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'tunl0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$unix(0x1, 0x2, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r6 = add_key$fscrypt_provisioning(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)={0x1, 0x0, @d}, 0x18, 0xfffffffffffffffb) keyctl$get_security(0x11, r6, &(0x7f00000000c0)=""/242, 0xf2) r7 = socket$kcm(0x10, 0x3, 0x0) getsockopt$sock_timeval(r3, 0x1, 0x15, &(0x7f00000001c0), &(0x7f00000003c0)=0x10) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) syz_80211_join_ibss(&(0x7f0000000100)='wlan1\x00', &(0x7f0000000180)=@default_ibss_ssid, 0x6, 0x2) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={0x44, r5, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x7ff, 0x78}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NFT_MSG_GETCHAIN(r9, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="d40400000000000000000000000000000200000108000b40000000020c0002400000000000000001080007006e6174000000088000000240fffffffffffff00000000240000000000000000500000240000000000000000600000240000000000000000000000240000000000000000210000835b2d44e40000000000000000230f794e8cf6e36aad91e2d2a1c5b2dd9311fa6ea968fb0c74d00fa6bfbb8911502fc35e104b188fa2c11388ff9d4a2f6ea1c4dae35da7ebf152b56c17eaa0661af4068a815ed0611d5dc5cb377ba3d5a45929cd89fa2fa0fc812704e7d8df54b83b4f75974e6e0d58621799947213cfcee5553407c96e6ca4b152c9c3fb60d17789a7ed97d5a8d8f0d07c58fef4c1dd7ffee52148d832cfc05b62dce243aedb04d41e23b825c69869df7320745d819e9f68eefc5861e805e0d591e41681201db3a65dc1a177c061ec46d91cbd6c753c915cabbe5bdc73c3fc069738334710000000000000000000000720511a2515692bcdf0334900bc54daebdf0a21ca855d2bd16e2cffc8e49871db2e4f1b77893285bf6d23cb607fd3ffa8eef41f69bfdb37a7c4168c895d914929ce180c193f06a43abe56f7da5b91904cf9dafa3447661e2a5d19a6dba2076912a8ef5ea5ce4311fa2fb95081a4bb97e48d3b1a33599968a6294166516fcc3ca716d5cc5f9211d1f8509f158adf621ecdf18021d4974e2d63fc506c503de93c182821627b86d3830817b07091fc85b8a711f06c24aa34dd8f1f7afeeade740be60bc332f8f00006aa4fe5c55d7fc80"], 0xd4}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) sendmsg$nl_route(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x6, 0x0, 0x0, 0xffffff81}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x14, 0x2, @remote}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000088c}, 0x0) 1m9.351471306s ago: executing program 3 (id=191): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000001c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r2, 0xc02064b9, &(0x7f00000002c0)={0x0, 0x0, 0x0, r4}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0xa0000, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r7, 0x4068aea3, &(0x7f0000000000)={0xbe, 0x0, 0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x1, 0x0, 0x0) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f00000002c0)=ANY=[@ANYBLOB="0100000000000000064d564b"]) r8 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r8, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, 0x0, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) sendto$inet6(r9, &(0x7f0000000340), 0x0, 0x10, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c00)=ANY=[@ANYRES32=0x0, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB], 0x48) r10 = syz_open_dev$loop(&(0x7f0000000340), 0xfffffffffffffff8, 0x4a000) ioctl$BLKBSZGET(r10, 0x80081270, &(0x7f0000000380)) r11 = socket$inet6(0xa, 0x80001, 0x0) connect$inet6(r11, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$sock_linger(r11, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendmmsg$inet6(r11, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 1m6.079404691s ago: executing program 3 (id=200): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000a4d2ff40f3054002241b0102030109021b00010000000009040000014eaf32000905d657", @ANYRES16=r1], 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f00000001c0)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, "aeb81d8ee3a82d67eea9e5bdf2247481041a5b9cddbc936efc471c56ae3d5f6945d296a285858a891a3b4e7bff572ef69992da867f406182d70f47773434b8349435f2ad628d62a3b45bb98872fb1900"}, 0xd8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x7ef, 0x8bb, 0xb5, 0x9, 0x0, 0x8000000000000000, 0x500, 0x3b2, 0x3, 0xd, 0x7, 0x7, 0x7, 0x3, 0x4007, 0x200], 0xf000, 0x67002}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f00000003c0)={0x2a6, 0x0, "2dd82129cb82327389c3b42ee17f84200e7484f2b06fa73f76c4a3bb89519ec7f4e86c283a065a0036d64b8068332387a7480dc9962a6d38d39bb67b895f9c3cd96f038080c2c62f9ec93860609c35ff0f48eacd242f9e6ec1d9d2bb1af2f280a03771ae387b444b02406eb2890dcd7c211bea667ba841721bc40864e4eee3399fe804fd89ec4fedfa7496b29e4fce1122d61f1bed350d2e7404962a8284739051bd22963a0f3ee06aedb7c6cb64a61f96647b5b310fd35dd3fd3708c980d14ba87f0becf8c6ee2052eb8fd243ed8bfc3ba48944721e6a5f6d921177e14a6d06492664929f04bf583fe592ed5946f1991bf2a27a2ffa9a2d856e298b54347906"}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x80, '\x00', 0x0, 0x5}) r6 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0xe) write$binfmt_misc(r6, &(0x7f0000000dc0), 0x386) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=ANY=[@ANYBLOB="4800000010000305fcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="111102000020060020d2ae55dd74f2de6bdb7f87800b0001000061637365630000100002800c0400000100c280"], 0x48}, 0x1, 0x0, 0x0, 0x48890}, 0x4000000) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0xfffffffe, r2}) r8 = socket(0x400000000010, 0x3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2, 0x244983, 0x23456}) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_MSG_RING={0x28, 0x11, 0x0, r7, 0x1, &(0x7f0000000500)="2b504818fb067209ddcbd869e00b4c4197b527c926108cf1d87f007a5b6442e4e46ab3ddf876ac40dbd6c14f6ee0a24f85fd5f39a4c6499ea6f256e069c728cd1125df9800c7474b715387f6be256e85bfee3cc43e364a4b4d77f29cc0aa9c773c5c95f55ca29a230a43bcdd1acafcda0a89da6d980ac794f7714b0ddbdc0838e2f1350efdcb2ec4be4871ed3627bccaa7772dae6e5aea0ffe137b3d83d51796f36d02325f7c607555a3ec6a7c0cbc49158a10ea4c66e2d31426ef685cc4b6ab1f402da558be0f09652003ef152f8ed2fdbf43e48f654b5418c41669eda1f7da3343eae4e02278d0fd5ab73b93df418a", 0xf0}) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xfff1, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fff, 0x8000}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r8, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r10, {0xf000, 0xffff}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_CLASSID={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20040844) bind$packet(r7, &(0x7f00000001c0)={0x11, 0x1a, r10, 0x1, 0xd, 0x6, @remote}, 0x14) 47.401665266s ago: executing program 4 (id=265): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000180)=0x7, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000340)=0x63ba, 0x4) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f0000000280)=0x8, 0x4) sendmmsg$inet6(r0, &(0x7f0000000400)=[{{&(0x7f0000000240)={0xa, 0x4e20, 0x800, @loopback}, 0x1c, 0x0}}], 0x1, 0x40044040) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001f80)=""/129, 0x81}, 0xdb30}], 0x1, 0x40002042, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8982, &(0x7f0000000000)={0x7, 'bridge_slave_0\x00', {0xfffffff7}}) 47.163133855s ago: executing program 4 (id=267): r0 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) keyctl$read(0xb, r0, &(0x7f0000001300)=""/4082, 0xff2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x0, 0x25dfdbfe, {0x2, 0x0, 0x20, 0xe0, 0x0, 0x3}, [@RTA_SRC={0x8, 0x2, @loopback}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) setsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f0000000200)=0x1, 0x4) 46.981123434s ago: executing program 4 (id=268): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000000)={0x0, 0x0, 0xffffffffffffffff}) fcntl$getownex(r0, 0x10, &(0x7f00000000c0)={0x0, 0x0}) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0286405, &(0x7f0000000140)={0x4, 0x4, {r2}, {}, 0x4, 0x3}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000021c0)=@newtfilter={0xec4, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r5, {0x0, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_fw={{0x7}, {0xe98, 0x2, [@TCA_FW_ACT={0xe94, 0x4, [@m_pedit={0xe90, 0x1, 0x0, 0x0, {{0xa}, {0xe64, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x2, 0x1, 0x7, 0xf, 0x8}, 0x3, 0x40}, [{0x1, 0x1, 0xacc3, 0x9, 0x2, 0x2aaaa9c1}, {0x8, 0x2, 0x5, 0x8, 0x8000, 0x5}, {0x484c, 0x5, 0xe72, 0x10000, 0x140000, 0xec0}, {0x2, 0x5, 0x401, 0xa, 0x7, 0x3}, {0x0, 0x1, 0x3, 0x7, 0x7, 0xc}, {0x4, 0x6adc, 0x5a5, 0xe, 0xe, 0x9}, {0x9, 0x3, 0x2, 0x5, 0x4, 0x64}, {0x10000, 0xffffff7f, 0xfffffffa, 0x3, 0x8}, {0x7, 0x1, 0x9, 0x80, 0xb44, 0xfffffff9}, {0x6, 0xfffffff9, 0x7fffffff, 0x32a8, 0x2, 0x1}, {0x1000, 0x8000, 0x2df6, 0x8, 0x7, 0x3}, {0x7fffffff, 0x1, 0x800, 0x8, 0x2, 0x2}, {0xd28, 0xb1, 0x5, 0xe7, 0x1, 0x6}, {0x34, 0x9, 0x2, 0xa13, 0x0, 0x1}, {0xc8c863be, 0x7fff, 0x7, 0x8, 0x19c372c2, 0x3bfc7233}, {0x2, 0x0, 0x10000, 0x5, 0x1}, {0x6, 0x7, 0x1, 0x4, 0x921, 0x1000}, {0x6, 0x5ac5, 0x1c7, 0x304, 0x4, 0x4002d04}, {0x4, 0x9, 0xffff, 0x4, 0x1, 0x233}, {0x401, 0xffffffa6, 0x2, 0x7fffffff, 0xd9b, 0xfffffff9}, {0x8, 0x4db, 0x0, 0xe872, 0x3, 0xff}, {0x1, 0x9, 0xaddf, 0x200, 0x81a}, {0xd8, 0x10, 0x2, 0x7fffffff, 0x6, 0x4}, {0x3, 0x2, 0x3, 0x1, 0x8}, {0x0, 0x8, 0x80000001, 0x9, 0x0, 0x2}, {0x5, 0x8, 0x8, 0x3ffc, 0x0, 0xe6c}, {0x6, 0x400, 0xffffff9e, 0x2, 0x40, 0x5}, {0x4, 0x9, 0xd91, 0x1, 0x6, 0x1}, {0xc, 0xff, 0x3, 0x1, 0xb, 0xb}, {0x69ad7fb1, 0x0, 0x0, 0x81, 0x6100, 0x9}, {0x7a2, 0x8, 0x2338, 0x2, 0x5, 0xfffffff9}, {0x7, 0xfffffbff, 0x6, 0x7, 0x1, 0x9}, {0x7f, 0x1, 0x7, 0x9, 0x7, 0x5}, {0x1000, 0x1, 0xfffffff8, 0x9, 0x8, 0x200}, {0x3, 0x2, 0x3, 0x3, 0xb, 0x2}, {0x43b3, 0x883e, 0x1, 0x3, 0xffffff80, 0x95b8}, {0x4, 0x343, 0x2, 0x400, 0xfffffffc, 0x80000001}, {0x8, 0xcf, 0x1, 0x0, 0x9f, 0x6}, {0x400, 0x10, 0xa7, 0xc, 0x8, 0x1000}, {0x101, 0x5, 0x8, 0xa7, 0x7, 0xc84}, {0x4, 0x1, 0x5, 0x5, 0x2, 0x2}, {0x3, 0x9, 0x5, 0xffff, 0x7, 0xd}, {0x8, 0x9, 0xffffff39, 0x3, 0x8, 0x440}, {0x9, 0xb, 0x9, 0x2, 0x8, 0xa6fa}, {0xffff, 0x8ed, 0x9, 0x4, 0x3, 0x100}, {0x860, 0xfffffffb, 0xc0, 0x2, 0x9, 0x42d0}, {0xfffffffa, 0x1, 0xee, 0x8000, 0x1000, 0x40004}, {0x4, 0x90d2, 0x20000, 0x0, 0x8001, 0x646}, {0x1, 0x8, 0x0, 0x7, 0x9, 0x7}, {0x7ff, 0x0, 0x2, 0x9, 0x13d5, 0x6}, {0x3, 0x0, 0x6, 0x347, 0x8000}, {0x7, 0x8, 0xb76a, 0x6, 0x2, 0x6}, {0x7ff, 0x200, 0x6e, 0xb2, 0x80a7, 0x8001}, {0xd, 0x8, 0x0, 0x1, 0x9, 0x1}, {0x3b, 0x4, 0x0, 0xe686, 0x9, 0x400000}, {0x2, 0x2, 0xf4, 0x7, 0x3, 0x1}, {0x80, 0x3, 0x6, 0x10001, 0x0, 0xffffffff}, {0xd93, 0xf5, 0x3, 0x1, 0x6, 0x2}, {0x2, 0x2, 0x3cd6, 0x4, 0x1, 0x9}, {0x3, 0x6, 0x0, 0x5, 0xa, 0xffffff0f}, {0x7fff, 0x4, 0x8, 0x0, 0x6, 0x179436fe}, {0xb8a6, 0x0, 0x3, 0x9, 0x0, 0x51}, {0xe296, 0x7fff, 0x3, 0x2, 0xfff, 0xd}, {0x1, 0x6, 0x4, 0x6, 0x10000, 0xbd}, {0x9, 0x7d, 0x5744bcb9, 0xc, 0x10001, 0x8}, {0x2, 0x8, 0x6, 0x4, 0x2, 0xfb35}, {0x80000001, 0xb9a6, 0x1, 0x80, 0x1, 0x3f04}, {0x2, 0xffffffc0, 0xffff, 0x9, 0x300000, 0xc}, {0x2, 0x2, 0x8, 0x6, 0x5, 0x80000000}, {0x0, 0x19, 0x3, 0x0, 0xab6f, 0x9}, {0x80000001, 0x6, 0x760d, 0x80, 0x2, 0x8f7}, {0x471800, 0x3, 0x7, 0x1, 0x7, 0x6}, {0xa000000, 0x9, 0x8, 0x8000, 0xe0, 0x401}, {0xc, 0x7f, 0x4, 0x2, 0x1, 0x200}, {0xec55, 0x76, 0x6, 0x6c1f, 0x4, 0x8}, {0x7, 0x2, 0x3, 0xcb, 0x0, 0xe0}, {0x0, 0x2, 0x0, 0x2, 0x7, 0x3}, {0xe54, 0x5, 0x9, 0x8, 0x3a4, 0x6}, {0xffc000, 0x10000, 0x1a4, 0x773, 0x2, 0xe2}, {0xe581, 0x8, 0x200, 0x9, 0xa9, 0x2}, {0x8, 0x7, 0x6, 0x4, 0x9, 0x88ff}, {0xa80, 0x6, 0x7fff, 0x2, 0xfffffff7, 0x2}, {0xa0, 0x81, 0x7, 0xfffffffe, 0x17, 0x8}, {0x3, 0x2d5, 0x7, 0x0, 0xfffffffc, 0x80000001}, {0xe, 0x7, 0x0, 0x9, 0xffff, 0x200}, {0x9, 0x7fffffff, 0x8, 0x9, 0x8, 0x5}, {0x7, 0x3, 0x5, 0x8, 0x1}, {0x3, 0x4, 0x1, 0xa, 0x1, 0x9}, {0x6, 0x0, 0x0, 0x7, 0x400000, 0xfffffffc}, {0x1, 0x3, 0x81, 0xff, 0x4, 0x4}, {0x3, 0x8a8, 0x8, 0x0, 0x8, 0xfffffffe}, {0x10001, 0x8, 0x2, 0x80000001, 0x9d, 0xfffffc00}, {0x0, 0x5, 0x3, 0x9, 0x7, 0x8000}, {0x2, 0x8, 0x8, 0x0, 0x8, 0x2}, {0x4, 0x7, 0x7, 0x9, 0x7, 0x1000}, {0xfffffffa, 0xffffffff, 0x5, 0x4, 0x3, 0xa}, {0x3, 0x66c, 0xfffff001, 0x4, 0x6, 0x5c}, {0x0, 0x9, 0x7, 0x480f, 0x6, 0x1000}, {0x7fffffff, 0x0, 0x7b, 0x7fff, 0x80000001, 0x401}, {0x6, 0xc2, 0x3, 0x800, 0x1, 0x5}, {0x6, 0x7b5, 0x2, 0x2, 0xfffffffc, 0x7bc9}, {0x750, 0x2, 0x41a2, 0x6, 0x5, 0x20}, {0xf, 0x792c, 0xa4, 0x8, 0x8, 0x3}, {0x800, 0x27, 0x0, 0x2, 0x4, 0x1}, {0x2, 0x8, 0x401, 0x9, 0xe, 0xfffffff9}, {0x5, 0x4, 0x101, 0x1, 0x4, 0x8}, {0x3, 0xecd, 0x80, 0x9, 0x100, 0xdcc}, {0x2, 0xab2c, 0x80000000, 0x1a, 0x87, 0xf}, {0x6, 0x80007ff, 0x81, 0x0, 0x1, 0x800}, {0x9, 0x7, 0x7fff, 0x200, 0x80000000, 0x7}, {0x10, 0x3, 0xdb, 0x400, 0x57, 0x1}, {0x8001, 0xffff, 0x3, 0x6, 0x2, 0x7}, {0x1, 0x10000, 0x1, 0x397a, 0xfffffffd, 0x7}, {0x80000001, 0x4, 0x5, 0xe6, 0x35c, 0x800}, {0x0, 0x101, 0x8, 0x401, 0x2, 0x7}, {0x9, 0x0, 0x23, 0x4, 0xe}, {0x8, 0x56c, 0xffff9586, 0xd, 0x9, 0xb}, {0x80000001, 0x7, 0x0, 0x2, 0x4, 0xe}, {0x0, 0x5, 0x80000001, 0xf8, 0x6, 0x2}, {0xa8, 0x101, 0x0, 0x8854, 0x5, 0x5}, {0x823, 0x9, 0x0, 0x5, 0x6f3, 0x800}, {0x3, 0x9, 0x1, 0x2, 0x9, 0x4}, {0x8, 0x0, 0x2, 0x80, 0x100, 0x4}, {0xfffff801, 0x1, 0xb, 0x7, 0x2, 0x453}, {0x8, 0x0, 0x1, 0x5d0ea327, 0x0, 0x8}, {0x7, 0x7, 0x3, 0x9, 0x8, 0x7}, {0x1, 0x5, 0x5, 0x1, 0x48, 0x1}, {0x3, 0x9, 0x93e8, 0x7, 0x9, 0x7fffffff}], [{0x1, 0x1}, {0x0, 0x1}, {0x3}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x1}, {0x1}, {0x0, 0x1}, {}, {0x5}, {0x0, 0x1}, {0x4, 0x1}, {0x4, 0x1}, {0x3}, {0x4, 0x1}, {}, {0x1, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3}, {0x4}, {0x1, 0x1}, {}, {0x1}, {0x3, 0x1}, {0x3}, {0x3}, {0x3}, {0x2}, {0x4}, {0x2}, {0x0, 0x1}, {0x1}, {0x4, 0x1}, {0x3, 0x1}, {}, {0x5}, {0x3}, {}, {0x4}, {0x3}, {0x4}, {0x4, 0x1}, {0x4}, {0x2, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x1}, {0x2, 0x1}, {0x5}, {0x5}, {}, {0x1, 0x1}, {0x4, 0x1}, {}, {0x1, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x5}, {0x0, 0x1}, {}, {0x1, 0x1}, {0x5}, {0x0, 0x1}, {0x4}, {0x4}, {0x4, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x0, 0x1}, {0x2}, {0x2, 0x1}, {0x6, 0x1}, {}, {0x5, 0x1}, {0x4, 0x1}, {0x1}, {0x5}, {0x6, 0x2}, {0x3, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x3}, {0x1}, {0x3, 0x1}, {0xf}, {0x2}, {0x1, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x1}, {0x1}, {0x4, 0x1}, {0x3}, {0x2}, {0x2}, {}, {0x0, 0x1}, {0x4}, {0x4, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {}, {0x9, 0x1}, {0x5}, {0x2}, {0x1}, {0x0, 0x1}, {0x1}, {0x5, 0x1}, {}, {0x3, 0x9e6fab21fbfb7b49}, {0x3}, {}, {0x0, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x3, 0x1}], 0x1}}, @TCA_PEDIT_KEYS_EX={0x40, 0x5, 0x0, 0x1, [{0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0xffffffffffffff9b, 0x1, 0x3}]}, {0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}]}, {0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}]}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0xec4}, 0x1, 0x0, 0x0, 0x81}, 0x800) 46.344699384s ago: executing program 3 (id=200): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000a4d2ff40f3054002241b0102030109021b00010000000009040000014eaf32000905d657", @ANYRES16=r1], 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f00000001c0)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, "aeb81d8ee3a82d67eea9e5bdf2247481041a5b9cddbc936efc471c56ae3d5f6945d296a285858a891a3b4e7bff572ef69992da867f406182d70f47773434b8349435f2ad628d62a3b45bb98872fb1900"}, 0xd8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x7ef, 0x8bb, 0xb5, 0x9, 0x0, 0x8000000000000000, 0x500, 0x3b2, 0x3, 0xd, 0x7, 0x7, 0x7, 0x3, 0x4007, 0x200], 0xf000, 0x67002}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f00000003c0)={0x2a6, 0x0, "2dd82129cb82327389c3b42ee17f84200e7484f2b06fa73f76c4a3bb89519ec7f4e86c283a065a0036d64b8068332387a7480dc9962a6d38d39bb67b895f9c3cd96f038080c2c62f9ec93860609c35ff0f48eacd242f9e6ec1d9d2bb1af2f280a03771ae387b444b02406eb2890dcd7c211bea667ba841721bc40864e4eee3399fe804fd89ec4fedfa7496b29e4fce1122d61f1bed350d2e7404962a8284739051bd22963a0f3ee06aedb7c6cb64a61f96647b5b310fd35dd3fd3708c980d14ba87f0becf8c6ee2052eb8fd243ed8bfc3ba48944721e6a5f6d921177e14a6d06492664929f04bf583fe592ed5946f1991bf2a27a2ffa9a2d856e298b54347906"}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x80, '\x00', 0x0, 0x5}) r6 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0xe) write$binfmt_misc(r6, &(0x7f0000000dc0), 0x386) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=ANY=[@ANYBLOB="4800000010000305fcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="111102000020060020d2ae55dd74f2de6bdb7f87800b0001000061637365630000100002800c0400000100c280"], 0x48}, 0x1, 0x0, 0x0, 0x48890}, 0x4000000) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0xfffffffe, r2}) r8 = socket(0x400000000010, 0x3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2, 0x244983, 0x23456}) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_MSG_RING={0x28, 0x11, 0x0, r7, 0x1, &(0x7f0000000500)="2b504818fb067209ddcbd869e00b4c4197b527c926108cf1d87f007a5b6442e4e46ab3ddf876ac40dbd6c14f6ee0a24f85fd5f39a4c6499ea6f256e069c728cd1125df9800c7474b715387f6be256e85bfee3cc43e364a4b4d77f29cc0aa9c773c5c95f55ca29a230a43bcdd1acafcda0a89da6d980ac794f7714b0ddbdc0838e2f1350efdcb2ec4be4871ed3627bccaa7772dae6e5aea0ffe137b3d83d51796f36d02325f7c607555a3ec6a7c0cbc49158a10ea4c66e2d31426ef685cc4b6ab1f402da558be0f09652003ef152f8ed2fdbf43e48f654b5418c41669eda1f7da3343eae4e02278d0fd5ab73b93df418a", 0xf0}) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xfff1, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fff, 0x8000}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r8, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r10, {0xf000, 0xffff}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_CLASSID={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20040844) bind$packet(r7, &(0x7f00000001c0)={0x11, 0x1a, r10, 0x1, 0xd, 0x6, @remote}, 0x14) 46.11748929s ago: executing program 4 (id=271): getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0x6, 0x8}, &(0x7f00000000c0)=0x8) r0 = syz_usb_connect(0x2, 0x38, &(0x7f0000000080)=ANY=[@ANYBLOB="120120021bd459088904b5e02aae0102030109022600010701e00509040000029722185c090507"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000401e04012800000000000109022400010000000009040100010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000000)={0x53, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x8, {[@local=@item_4={0x3, 0x2, 0x5, "29ead26f"}, @global=@item_4={0x3, 0x1, 0x9ff2e0f1517b3f37, "6f619148"}]}}, 0x0}, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) fgetxattr(r2, &(0x7f0000000bc0)=@random={'security.', '/dev/dlm-control\x00'}, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f0000000240)={0x14, &(0x7f0000000140)={0x40, 0x5, 0xa8, {0xa8, 0xf, "c5764bbbf9b8963369dc8ab2436bbb47dbd436c15ef42164844f6ab3749beb90e3fbba899f00e90347130f79d4903d645ae3a2d90546e6ab6ff8ab7f4876ba932bb4a11e80d1ffd0faac029ad625bc0cbd802352d963f8a9110f2c0ed74f660ec2856412a3ae227220fd56d243822be4eb2ca2e8127f6730c3851bc5c4d552922cae91d88e1fc936a8b87521ca9edc894bdd68cd6f828efb96c78d4957070986c4afc09d7270"}}, &(0x7f0000000200)={0x0, 0x3, 0x1e, @string={0x1e, 0x3, "354edfd256532f0529fe74cfb354f58b348fc5ddb66ca145f4481fe1"}}}, &(0x7f0000000440)={0x2c, &(0x7f0000000280)={0x0, 0x16, 0x88, "3694887f46eba3035164bfaf3935128db425bea33bd32a70abec9a62ef2ad908af4465bb89cf27b4ddccc2cd1670750c2acfd2b42cc204a52ff2367bd1186266f1d89f22283bcbd8cc588527ed14e0263dd20dd62e91424340d8bde0481b1b6661c4c32c247ea9984efb661df1274a59da1ec133886494676894439a3b56198c65dbf30dc7cc9a55"}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0x32}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0x2}, &(0x7f00000003c0)={0xc0, 0x5, 0x6, "7af25b0f6885"}, &(0x7f0000000400)={0x40, 0x5, 0x5, "46801429f5"}}) syz_usb_connect$cdc_ecm(0x0, 0x79, &(0x7f0000000640)=ANY=[@ANYBLOB="12010002020000102505a1a440f1ffff00010902670001010000000904000012020600000b2406000002f332ac000005240000000d240f010000000087000600001524120600a317a88b045e4f01a607c0ffcb7e392a07241400000100032402"], 0x0) 44.03271086s ago: executing program 4 (id=281): move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) syz_usb_connect(0x0, 0x3d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100004e826d4094225a4241d10102030109022b0001000000000904000002e964c2000905040000000000000705"], 0x0) (async, rerun: 64) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmmsg(r1, &(0x7f0000003f40)=[{{&(0x7f0000000480)=@nl=@kern={0x10, 0x0, 0x0, 0x2000}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000500)="fe", 0x1}], 0x1, &(0x7f0000000600)=[{0x10, 0x111, 0x3}], 0x10}}, {{0x0, 0x0, &(0x7f0000002900)=[{&(0x7f0000000840)="88", 0x1}], 0x1, &(0x7f0000002940)=[{0x10, 0x1, 0x1}], 0x10}}], 0x2, 0x40002) (async, rerun: 64) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000002d00090027bd7000000000000400000008001a00", @ANYRES32, @ANYBLOB="f0792c1c4ca6eb5089589563ffffffffd49abb8940750cc9e075beee52e9f279c9fa1055d8e5636dd5570d5c5f5767f478d89d32c41265010e3a5e038362681ad4dc60f435000000000000000000482101193854ef3562879dce3e22fbd4085140b419d7d27a641163517776c7200219b1e2dfe2d1ccc92d7cc4e36bd910c64308000000000000003b8d6ac7d33f418b41efab3d0d54f882617bf179ac9825d0df11bca88b11ab1918c67af0c3b8b96be1043edfdeb0b88fb0"], 0x1c}}, 0x84) (async, rerun: 64) r2 = fsopen(&(0x7f0000000080)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) (async) r3 = fsmount(r2, 0x0, 0xf) (async) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBSCRIBE_EVENT(r4, 0x4020565a, &(0x7f0000000080)={0x5, 0x2}) (async) close_range(r4, 0xffffffffffffffff, 0x0) (async, rerun: 64) quotactl_fd$Q_GETQUOTA(r3, 0xffffffff80000701, 0x0, 0x0) (async, rerun: 64) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000000)={0xffffffffffffffff, 0x1, 0x0, 0x8, @vifc_lcl_addr=@private=0xa010100, @local}, 0x10) 43.617375522s ago: executing program 4 (id=282): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0x2}) ioctl$TUNSETOFFLOAD(r0, 0x400454c9, 0xba98575a95aeb701) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r1, 0x40806685, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setxattr$incfs_metadata(0x0, 0x0, 0x0, 0x0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket(0x0, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000240)={'macvlan0\x00', &(0x7f00000000c0)=@ethtool_cmd={0x4f, 0x6, 0x8, 0x82e8, 0x2, 0x2, 0x3, 0x9, 0x3, 0x5, 0x5, 0x3, 0x5ef, 0x9, 0xbe, 0xd1, [0x6, 0xf2]}}) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) bind$inet6(r6, &(0x7f0000000000)={0xa, 0x3, 0x3, @loopback}, 0x1c) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x3, 0xfffffffd, @loopback, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000080)='illinois\x00', 0x9) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'lo\x00'}) shutdown(r6, 0x2) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0xa, 0x8, 0x0, 0x3}, 0x0) r7 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r7, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_CHANNELS(r7, 0xc0045006, &(0x7f0000000180)=0x70) write$dsp(r7, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) syz_usb_connect(0x5, 0x3f, 0x0, 0x0) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000000)=@llc={0x1a, 0x30d, 0x8, 0x2, 0xa, 0xff, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}}, 0x80, 0x0}, 0x20000814) ioctl$TUNSETLINK(r0, 0x400454cd, 0x306) 42.997754919s ago: executing program 3 (id=284): socket(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22042, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x1000, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) ptrace$poke(0x4, r3, &(0x7f00000000c0), 0x7ff) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xd7) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x8, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000f76873fe45000000000000f1a5000000f0fff0ffc31800000000000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2cd}, 0x94) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/crypto\x00', 0x0, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) setsockopt$inet_udp_int(r5, 0x11, 0x1, &(0x7f0000000000)=0x507, 0x4) sendmmsg$inet(r5, &(0x7f0000005d40)=[{{&(0x7f0000000600)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="10000000000000000000c0"], 0x10}}], 0x1, 0x400c0) sendfile(r5, r4, 0x0, 0x20000023893) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000200)={'bond0\x00', &(0x7f0000000640)=@ethtool_per_queue_op={0x4b, 0x1d, [0x4, 0x8, 0xfffffff1, 0x8, 0x0, 0x1, 0x3e9, 0x5, 0x9, 0x6, 0x5, 0x6, 0x7ff, 0x4, 0x4, 0x3ff, 0x4, 0x8, 0x2, 0x4, 0x9, 0x4, 0x8, 0x1, 0xfffffa0c, 0x7, 0x8, 0x9be, 0x3, 0x3ff, 0x6, 0x14dc, 0x147, 0x9, 0x1, 0x3, 0x1, 0x0, 0x9, 0x6, 0x7, 0x5, 0x4, 0xfffffffb, 0x8, 0x80000000, 0x9, 0x100, 0x5, 0x19dd, 0x7, 0x3ff, 0x586, 0x6, 0xf667, 0xfffffffc, 0x7, 0x8, 0x7f, 0x6, 0xc8, 0x6, 0x0, 0xc3, 0x4, 0x10, 0xffffffa8, 0x1, 0x9, 0x1, 0x1, 0x83, 0xe39, 0xcf, 0x10, 0x401, 0x7, 0x7, 0x2a, 0x71c9, 0x1, 0x321, 0xfffffeff, 0x7f, 0x66, 0x1c24, 0xff, 0x9, 0x4, 0x2, 0x3, 0xff, 0x100, 0x126, 0x6, 0x8, 0x40000000, 0xc, 0x4, 0x8, 0xffffffc0, 0x4, 0x10001, 0x5, 0x74a000, 0x4e27, 0x3ff, 0x0, 0x8356, 0x0, 0x6, 0x9b7, 0x1, 0x80000001, 0x7f, 0xea, 0x6, 0x80000000, 0xff, 0x7, 0x4da8e6f3, 0x5, 0x10001, 0x8, 0x69e4, 0x80000001, 0xfffffff4, 0x100]}}) socket$inet_smc(0x2b, 0x1, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) 41.038285232s ago: executing program 3 (id=290): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) syz_open_dev$video(&(0x7f0000000140), 0xd, 0x0) r4 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r4, 0xc100565c, &(0x7f0000000040)={0x0, 0xfff, 0x4, {0x9, @pix_mp={0x12, 0x5be7, 0xb5315258, 0x6, 0xb, [{0x80000004, 0x7}, {0x7ff, 0x5}, {0x10000001, 0x9}, {0x63d, 0x7fd}, {0x1, 0xb}, {0x7, 0xffffff14}, {0x5}, {0xff, 0x7}], 0x1, 0xc, 0x2, 0x0, 0x2}}, 0xfffffffd}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_origin(r3, &(0x7f0000000200), &(0x7f0000000240), 0x2, 0x1) timer_create(0x2, 0x0, &(0x7f0000000040)) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x24500, 0x0) ioctl$TUNGETFEATURES(r5, 0x800454cf, &(0x7f00000000c0)) syz_open_dev$vim2m(&(0x7f0000000000), 0x3ff, 0x2) write$rfkill(r0, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) socket$netlink(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_inet_SIOCSIFNETMASK(r6, 0x891c, &(0x7f0000000280)={'syzkaller0\x00', {0x2, 0x4e22, @empty}}) socket$inet6_sctp(0xa, 0x1, 0x84) fsopen(&(0x7f0000000040)='afs\x00', 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r7) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r9, 0xae03, 0x59) sendmsg$TIPC_NL_MON_SET(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000001100000024000980"], 0x38}}, 0x0) 28.553254001s ago: executing program 32 (id=282): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0x2}) ioctl$TUNSETOFFLOAD(r0, 0x400454c9, 0xba98575a95aeb701) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r1, 0x40806685, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setxattr$incfs_metadata(0x0, 0x0, 0x0, 0x0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket(0x0, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000240)={'macvlan0\x00', &(0x7f00000000c0)=@ethtool_cmd={0x4f, 0x6, 0x8, 0x82e8, 0x2, 0x2, 0x3, 0x9, 0x3, 0x5, 0x5, 0x3, 0x5ef, 0x9, 0xbe, 0xd1, [0x6, 0xf2]}}) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) bind$inet6(r6, &(0x7f0000000000)={0xa, 0x3, 0x3, @loopback}, 0x1c) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x3, 0xfffffffd, @loopback, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000080)='illinois\x00', 0x9) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'lo\x00'}) shutdown(r6, 0x2) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0xa, 0x8, 0x0, 0x3}, 0x0) r7 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r7, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_CHANNELS(r7, 0xc0045006, &(0x7f0000000180)=0x70) write$dsp(r7, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) syz_usb_connect(0x5, 0x3f, 0x0, 0x0) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000000)=@llc={0x1a, 0x30d, 0x8, 0x2, 0xa, 0xff, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}}, 0x80, 0x0}, 0x20000814) ioctl$TUNSETLINK(r0, 0x400454cd, 0x306) 28.508257299s ago: executing program 1 (id=337): socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) syz_emit_ethernet(0xbe, &(0x7f0000000580)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x25, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x9, @loopback, @local, {[@cipso={0x86, 0x71, 0xffffffffffffffff, [{0x0, 0xc, "0800b28c590300000052"}, {0x5, 0x9, "020007651442eb"}, {0x0, 0xe, "7434954373561de584b703c8"}, {0x0, 0x9, "e706d30bd224f8"}, {0x7, 0x7, "cfa11cab1a"}, {0x0, 0x10, "8475be675de6a70a05a0dc91e5c6"}, {0x7, 0xa, "0000000000800000"}, {0x0, 0x12, "73bc95a70000ffa30900a301c8460000"}, {0x0, 0xc, "c8f46976e79ea788f03d"}]}, @timestamp_prespec={0x44, 0xc, 0xf5, 0x3, 0xa, [{@loopback, 0xf96c}]}]}}}}}}}, 0x0) 28.287399087s ago: executing program 1 (id=340): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, 0x0, 0x6) connect$unix(r0, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = syz_io_uring_setup(0x497, &(0x7f0000002c80)={0x0, 0xe3d3, 0x8, 0x800005, 0x1f0}, &(0x7f0000000440)=0x0, &(0x7f0000002d00)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r2, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000002e40)="f8f5", 0x2}], 0x1}, 0x0, 0x24000890, 0x1}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="200000000101010200030000000000000a0000040c001980080002002200000054f28fd46739dadda0a78224f04766ec7857dfbdf48dd9ecec8a7c5af4783a5d91bfb13dc8e4fa2aacf9ad8bd1c926e05f1a68d75aabbf367d00ce2849bbe861d08e60656cf463cd65874dcc3ccb9e6497485596e0a78123113d157915eafd6e973bb88f82a332c225be5c44fe1db4832fa8443da9b5ae539ab12dcdbe4a61b792c3aaf22b12191f51c2cd91b7f4f605880117eb801aa161bc328363457ecb701aa696bcf19a00be504f84f3e919f7bd89d60fd727ef6df2b3bbba53fecc02"], 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r8, 0x4038ae7a, &(0x7f0000000000)={0x80, 0x40000105, 0x0, 0x0}) ioctl$KVM_XEN_HVM_CONFIG(r8, 0x4038ae7a, &(0x7f0000000180)={0x82, 0x4000009a, 0x0, 0x0}) io_uring_enter(r3, 0x3516, 0x0, 0x41, 0x0, 0x0) 26.852633059s ago: executing program 1 (id=342): bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x25dfdbfe, 0x2ffffffff}, 0xc) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, 0x0) (async) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, 0x0) (async) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x1e2e81) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x66) write$sndseq(r2, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw8={"a357b6b140cbb6215dd33459"}}], 0xfffffee4) (async) sched_setattr(0x0, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_udp_int(r3, 0x11, 0x0, 0x0, &(0x7f0000000040)) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) syz_emit_ethernet(0x15, &(0x7f0000000240)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}, @multicast, @val={@void, {0x8100, 0x3, 0x0, 0x1}}, {@x25={0x805, {0x0, 0x8, 0xfb}}}}, 0x0) (async) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000440)={0x3, @pix_mp={0x62, 0x1, 0x3031334d, 0x3, 0xa, [{0x9, 0x6}, {0x2, 0x2}, {0x3, 0x411}, {0x10001, 0x8}, {0x6, 0x8}, {0x4, 0xd}, {0x8, 0xfffffff8}, {0x5, 0x1}], 0xc, 0x2, 0x1, 0x0, 0x2}}) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) (async) close(0xffffffffffffffff) (async) r5 = openat$vimc2(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r5, 0xc0405602, &(0x7f0000000040)={0x0, 0x2, 0x0, "e5e81571c97b166978ff61fcfd2409b2b73e0f936ed774de107de8a9041b5113"}) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r6, 0x8983, &(0x7f0000000540)={0x0, 'veth0_to_hsr\x00', {0x3}, 0x7}) (async, rerun: 64) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x2400c890) (async, rerun: 64) syz_usb_connect(0x0, 0x34, 0x0, 0x0) (async) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="2e00000011008b88040f80cb59acbc0413a1f8480f0000005e2900421803001825e60a001402000002800000121f", 0x2e}], 0x1}, 0x0) (async, rerun: 64) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000280)={{0x0, 0xfa}, 0x1, 0x8, 0x9, {0x6}, 0x5, 0x14}) (rerun: 64) 26.073877373s ago: executing program 1 (id=343): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x10000000000) read$FUSE(r0, &(0x7f0000000640)={0x2020}, 0x2020) ioctl$KVM_CAP_DISABLE_QUIRKS2(r0, 0x4068aea3, &(0x7f0000000080)={0xd5, 0x0, 0x2c}) 25.947316969s ago: executing program 33 (id=290): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) syz_open_dev$video(&(0x7f0000000140), 0xd, 0x0) r4 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r4, 0xc100565c, &(0x7f0000000040)={0x0, 0xfff, 0x4, {0x9, @pix_mp={0x12, 0x5be7, 0xb5315258, 0x6, 0xb, [{0x80000004, 0x7}, {0x7ff, 0x5}, {0x10000001, 0x9}, {0x63d, 0x7fd}, {0x1, 0xb}, {0x7, 0xffffff14}, {0x5}, {0xff, 0x7}], 0x1, 0xc, 0x2, 0x0, 0x2}}, 0xfffffffd}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_origin(r3, &(0x7f0000000200), &(0x7f0000000240), 0x2, 0x1) timer_create(0x2, 0x0, &(0x7f0000000040)) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x24500, 0x0) ioctl$TUNGETFEATURES(r5, 0x800454cf, &(0x7f00000000c0)) syz_open_dev$vim2m(&(0x7f0000000000), 0x3ff, 0x2) write$rfkill(r0, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) socket$netlink(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_inet_SIOCSIFNETMASK(r6, 0x891c, &(0x7f0000000280)={'syzkaller0\x00', {0x2, 0x4e22, @empty}}) socket$inet6_sctp(0xa, 0x1, 0x84) fsopen(&(0x7f0000000040)='afs\x00', 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r7) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r9, 0xae03, 0x59) sendmsg$TIPC_NL_MON_SET(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000001100000024000980"], 0x38}}, 0x0) 25.817196322s ago: executing program 1 (id=347): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000001980)=[{{&(0x7f0000000300)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000380)=[{&(0x7f0000000440)="05709eb84e4851ce2502c8e217d544bfa14f7caf0955e8740ae37edcd9f9255543d67ac68b17c5ce9729005caf8f29ba6c5d5851eadfaca04550b0153b0d64ca0f509b3325ec228be40d72a0fe1ca35f4cd450ae927e3b6664b2c8559635de9727bca11aade20f7ca63576156278799f094c1842bcdb04338deb7fc3f14042ed0de8c13de37fd3a5e49cfe973f82c681a4ce8f98b6710df2b2fb456420e7808b27d688159f76334521f7967198be4f9b839a448775d9b1a99032eb5aa659368bd17f0f7831f10a656b5364d74a6265dd7ed45ded22bc23508ec2d56fa8cd0c896ea3", 0xe2}, {&(0x7f0000000540)="75da4e716c91c6327a6f2fd64ebce7a8b345822b73a7d1e150c23f50a171dfb594951a191515e927a2779ad14ba27e8713985b4810a3f56c980f024bfcb416214c1b3f29482c2f55f11b47ad93e5c2e42f59e2", 0x53}, {&(0x7f00000001c0)="ab6b4bc55bac80", 0x7}, {&(0x7f00000005c0)="22d05a617983b16317387602475d361c1df60f38c353560a61091813ee11043b3f0d78c2210d010a40248ebcf2b5dfba3d3e7ecad4f224c14a9a3fe29b80cc7b6a21561112b96458df1db69f2d73f38bd76d4ce61fe3fd836f52224ba27ce4ed2d8d4fd0a436de58720f22ee3ae51d83f0bd432b1da620195a2089cc5d3e3db8a64b69427b40becb29501dbb0754496b8b7fdbedc1c4f9b81cf7210a8dcebdfd5f12f1b81ec8bb527b93ae46d5c1d78054b5105cdc04c7b0aba4f4d3ea235fcf71631bb13541638c858c8a78b21c2b4243b727e746500f877f441d", 0xdb}], 0x4, &(0x7f0000001180)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x80, 0x4050}}, {{&(0x7f0000001300)=@file={0x1, './file1\x00'}, 0x6e, &(0x7f00000006c0)=[{&(0x7f0000001380)="1d75f0025e8da0fc4c60bdad8eb03384f20f8efcbd4706456290fb3611223be5b28286343fa2625744545515eb19cd67d95bd855e45334e0cdf720c4d3b510c96cbb0bf00a6e002985a316982378a65aa3a76a9f51856f79ea683c3ead273e6a66fa693f93083c1d5986237df17a3b7f5e5830aa5f257ead141bb6660d76d4ffcc124f08966549b9b1fa7c19dde1f6367c1346fce87b6368e60da3229ae8a895524adae61d29829f09df0d483287d4494c5f2cd3cc892bffd3b87a5338747b448ba1695727056a1849ce880f292a17", 0xcf}, {&(0x7f0000001200)="540edb58ebab5126171cd7b9574237c057c154760c70d8cbcd5608eeb98522f63c8fa3e184c696fcb4", 0x29}, {&(0x7f0000001480)="75235f2629e5d2a155d0b6eefac5172089bc9318c6f168c3ea03a013a6e3e749faaecbdeaa4954c005ff34e4671e0fd192cb210e0305b8ab13d324acd54f6330f127d9f96b0aecc0d0c2e24aa743bc7fd71e1df0960d2b630f744e09124c5278ec0397a025644009637384477b5f2446a7d34525c42b0ff27af10a6c5e744be3544a30631e44984075b5ded72a652a15dbc6c214ad53a3e2f839e63694d310a4a2a05241ce32ab799d15fe4344d74239763ff02ddf38d99d958b9d159200044dd1d31adb5b797f0f64bee5cacec78c647b4e3657a70810e738e13244fbe5ef", 0xdf}, {&(0x7f00000083c0)="f8fcec9ae765cfe64f6aa79a73d200267aa6148513ae0cfe882fbb194d0d1ac790364ab4f6b056ac8d1b1f24e2757340cdef9f12750b77d2281cd1787ce2ff2c99f9335e69f0c389c80fe1bbb5f046296835515ed5b4596a29ecf4a85b95bcc5cc425e3cc0f2af8a0dbee0c665e0375394df6d6a312c693aad1f113c2b8e4ef4930df3f49bcc605bd50cb7a0fd85fcde13259de3ab474fc504807d8d81602c5956cc5a03cd7249be455f81498e194b2ea508b80398cd2042acfe9bfe1a3bdf4782ce05b8c1a30c7ddcfdceb84bb6ff4648bde120b71af2887d3b82f2ff80a3dc3a596d724015baef11c093847b40cc2f2b4b86ba9efdbd79d99b30dc3e61634760865f3d6d59a1e9dcaf5ed8c7e5328c593ff8d4164bceb6f4f38d41831b685271548c31ae964d16de9577eea021576626bd09173d22b02a64076e57985ebafee23746c617e024c0a0b02cfba29374f555ed070eb6559b15afe02bb9750d337de9bff6a5d5e2253135f743fc97151adfbb09d1021d44b94586c23f3ea6db039679bdc53f0b87fc1f29a8e5285cb44be20d5aff5cb885d0006f7bf09ee9f734c8bcbd6ff2a3b14784aa6b9e8c5e132b4d6759d112aee1456e6b1aaee57a7f4124281013a5c3698f038c5442577df159fc3818dc301bd1175a87ee4a213037b996e66e2121291b8e77cff99aa738a654e902fe847c65bb06c45b7035df68d08afd934a8f1efa13b29c5003005bf11927265b0eda02206593882070826e7d698584cd2771a44db361ccfa38cacf7bf95b5880508d65ce4421ea2c70967c3b71f5724281368827a2e095f533cffbbc13acf156893f57ae4fc156059b951bf6b1d96df14188ef74863ceb7f567a9f8c7634ae24fd450a53e1e1ae60f0119109b1dcab1606bdc8b274f14660a6e622b4191cd18518cf3a4b8359243cfa20620b5be1e4db40b9694c7c0e980f5137a68f30209cfd0e1c44a7fc1b70719e14fa211bd8f890c69692045e6b532d4be114c5b1d2d504957b45d22ca43d229e906de6cce6ed092b0d77fc7b2dec673e8f47a72d16cdbc8351cd6979e192f74d871c0764ffaab65c0152eeaf7a4c24ddbac3f8b3fe2f064c4d28ec1b565f9aeb021b96d060aaf560c69ca62ce37086ef28ce257cb0ce42ae4829be403bdf087c2ac9501fd695b1edc3ce7a893333abbff512bc08a121bdc83cd586e41bb930260f0d5c205b0c78b5c7adb14f399d0564745d01283d33acea169e3a423c30de0c98fdbaf5c8a503b02ff3a0a1f7bf44d8dfb1b361180368201dfbea629f554ecffe7f816e18fe09ccdfe71b6f43fad569f5c3f57f5136d2e34f70bee891be783b0bacb3c2ae0a5cf4b3f127cc2e5068b59bab103cfb940261c8b3d6bda4f2156d8a87f0c9484b93c9d587cdce4ccde607c7ec2231aef4480988c5fccc7c9c6858dc793fdbf5d38a2b76f57eb0fd8bfd96d9e62f33b26703876eb033341de566d3c2344239d8274019f111917c1ee2b3dc437f0df0cc99c3d191e26dbe876a5fd0105906df13963c64d071444cb70ad8a2246270a409d894366a2889814e8fa4e19f5de24705356c4de737e939806bbd308100268447b71b52b8e81344d85a0e88d2f1c787ad0b5a1d8e64529c0f3668a9db14f6164e49f59016fe38c28c2330db541a23a8d35a859fa9449dcbf794891dcaba932d5f6e8749248e37dcc649966b85ec75cfed43785bd3c4f7fbd31014f3da9722e770d208a1fe07d3087a8f417946a55dede7119bbf2a7b28c8040498fc8f3ea00c9bce646204200a26f388c80769d24803168a350272d4410b658ced9ffe6ba96078f2e1a7701df299216e2a1290fb01082b422d9a1a730e9f884b3147e787e6150fddbcbb5fc43d36b94181444a294bf4ded6c4d0498e5e9aabefa9ee18b8871daccf1a8d313aeb25deae5760bf2bc76f4ebf34958859d803cd726c5ea49710e1760b81b975d3533f981b57bf4b18d1872e3d17e1ee5e14f6b45e493757f76d7755efbaa2464da48d7b17b393732b33cdabff37b95e91876cf637e325ed1123c5ca9123c2742f28b98527bb992b26dbee3ad7244ff6d5dd717accad0ac88614b302992d8ffa0e07342bb21dadf0958ceb8c748237959ea9cbc7be67202bf90675f04f31b8bb14ddc71e52d4977c10adb80ba49a444a1f904e21c8f1beca5f529939e86e857231bdd2c9dec7f84bb22e576ad5e7959897e920e98923c5bda138fc9d2da3f64ef031b3919eb8bccfd8512e60a2a791422c928903a04948306c5afae827df4d95465bda371347866857947cf036fa9083afeae8b1dc443146ee5e79d65247a346bb8df5e934452e92e7d1e908b62573ca074f72224cf89b3f58099d20f10ea9c35b1d9c61132e5a905ed6800d92538a148b9a5b9854bad7f6e3cf3ca53f36a1e1e712d6fb9a198282d05828fb36de0afa5e69a92543583c9a51aa22a5552adc370a1ab6cb885580fb8f0ec2be5db7bcf34caa166b945cf8c1e7abda3482049836ce6135eff799bc3b4ea2dad076efdbfc59e0d55ca7709e520f3e0c2792edbfd281fc5697b73376aa402f3fdcb24341496a2c91e3ded1a2906e999f297277e59d6b9f64af2b036a6b1b8e1f0e38edce7176b935b72a9a48fa6fe5ecfcc505abb24c538612cba7b21a796f70851e295221d751c16625b245f111b80d6fd1dd6aad75490c57dbeed52d47f789bb04ec6116555a16411b7c2db679fde0c6c5728437083d09b3a39042c48b4ce774e5c1583821f6c88b0b024713177b8350282085c500b0790af0b47903bd531efcdad5befab9ebe04867f8bd1a93b1ce347cf054de4d9d01c47d03a4556bd8d95fbd37183b4c00cf1415bfac78690663b27900fe0a97d9252e1f27cf24f5b557da6b3b6329be3a576dd21c87cd5e146d6cf338640a251265fd17409bc52dfe78e44be2e495b0f2762245c1fbfdbff332d90a413d4f509e5843008cc2381d592613acaa0d8446376623174c2e6372907f6f40f0a8e24f3ed7888cc11659a828f09097094fcb429a744e038a72126d13a959f3a39c84dfaa1b9f2e1dfdf7206922e256677601979633967ba1ac77654495b75ffa3a524708ecb4fad74b0508a75d836d57b4b0ca9141aafcebc0ae1f85350f5332579e94fc2ddbd2916a9fa7946bb94ab9a334afe961554f21fa6861372970437d1c7a88afd5158d958ba5eb7cba8559f0bb5c2ebfbf4dbd1842fc5e08f9cb6e67fa7458e862e34370500a4fe914f606041589a4f37179e9f71eb3f4325a97110d1d4b3c9435f286549f5725870fa44afe32c274cf38a85554daed7050a4ce0e2819eeaf66bdff77c6bc8b0b81b29090c7348af96709eca0f94daae4f88ea91844e0dbe57c265ebdd3877d064c61f55e1bed01c3259b7ef92a132698b44f837e56dcd1c899322c827a34b242acf05b9d34ec07b0708efa70d1ae6c91bf9395593b04e2a0fc455e99e50dc7058552cea42d6cb00b7cc0164e43d2bbebf4a423881909010350a30d52af063a1e8f0a5339a6542ff05563528d18827c57b4033d97b467187ebb403d44254f4160ebf32e5ca49371d49ef1f191bb4c04a2cc437ff8dd28c49a387362ddffdccd49457cde8dc79f1c6a21746de58a836885d23a3d168bc9153a1dfe622d63fadc06122e346dcf08d7371ddc9cea446f3209f4bb8c959fdd805f7594b5abfaa945c649b06205276366ef7e7bd3be243e26916f342b908fd1cc631f952814701d435f3bd2fae47b6e9e153de9f87a45a0e69173b9552ec22613142822b2bf94ef412411999a6562ec8cc33ebc78ed7d78f4a57485fa9cdb833ca508b48e863209cbc5b8d33f3f66c04a1907205caac8497f5884f593bf4d10bbefe2054cd8659c7ae3db853c2cd8e54c9c789fa797c4c2734dc7e9fef6d52a33da0cf492708b10a3e679975aa40eb6ffafb152bcdff19cb586f6a3522897f6db79c053ebc9ddc154ac0050b1d6ac8ef355dbe36f4e9eaefb537f55d010e565331998fc47fe4f292bfcf18c84f6b9c078fe9b734d8328cc5c13308271b1894990870c326a3275ea5bafc47a157c51fb0c401ec351cdedf7074ebf141fc9009bbc4f5162be430f2e8d10a6653a2fa61876c0d5987e1f32231176b9d3e40802c7ab334a2f704d199cc56da018035461849ae24cd0780799825f92c9dfa8c27f509bf3813d343eaa088476580416c2d1657da3aff55487d4ddedc35461eb842042a6c63f65de30324550ccb97953aeac4fd3e18a61fe77ec8b342f335e049308a9ade5cea42122cc7704203d228632e2dcdaa4680665631ef7a162790ff196a8f057fcf40feba2ecb8a13bd9c4487f954701583ad7a12f9b98ac495023d9cbe0ae9243f9e9351f55d8cc8b5ed28e76641456887cea8a5f81cc81e0002e23395dd23e343fd9b872d3692c47065edf1645fb1e2f79fec4267f798d28f34372f3a5159544b381a150a9bb404dcb9da2e6681d06dec3bf4748c778b4604ae37cc5f8bb5393be37c6e21a0e2a24a4ee40b310dafec80fe71ab4bc4ca6ba282cada331e1e41076027c72b1df48a9422be5cf26e5401a6e54fc587cd09af3aa8395a5949ec99c39d709c5a5173c29964e4667f3be57e4b038e023d018d6c4850ea716d5c064fb043d2093662db045c9cec3667f956ceca246929f9bc01d79a638bf61b61f82e358f68c976ceabd5935b94e5856f30a5e1c51bab3ec6b1025306c83958f5137e35d86af07cb167c87ce8d50b1b02d4a0ae3a180f9e1c92693745cc964a098ee627d0e5b166f25b2fb775ad232ef5d81ef86fbb8a90e89f022eb5987760c2075df8265c7a1e7d4258d78a41a1f81986b712723d03fffa50fc0a39cae874c9c369eda0bbe9772f374a5ecced9368671baee070cbbeeae76225ba616a0cafda1610bfa7a1a8f9f17fb6a343ea9fe9f3d2103d3c7cf6a6ab92e08be61f4e56be334917c2c980c870ae04059e4b23bbe0a5f9e35b8f73be8b78ef5fd7a56482e9ef1a2132085fabf968577dc8962089b6fa2b1cc7c44ba15c6bf7925719143b71b88ee2ad6843ca81f36757ebcfa91c733c231d8ad7e60745aae11bb213e6e9afcba4ac4fa81ecf93c37c99f841b30e56332c1445bfe9b930046b0e5d220595a5d1319ae04c44c70e6e963b6fa8fac417b3c5769e272790d11872b0a69f07b22465976ff729ea461afc4c9e733d81dbe0d78afb62494633a931d76b1516ffbcd13dc655a5c422618cb306d933112139ba225b389656b4063f4d375d40f073708c4a6f9c8bf7e8f58dabe29ba852ce6c51bd0db09bfa099092c40efada6314f133582d58574187925ab07faa660475d0372c1f851c4755f843b6a2a23d6a9abf6119e1ed6fc9a114a13db32e43d2e67232c66018a2ed542466550aea48a2c94ea808018b349eff69a5e7002a40a41b728f735f742272e010d4213e0f813628e3090d0fb09e2722378b18445600189312df2e16a82a41d5204d001bcd8479bf0f0495f36fe65ee64c84446107ea939a0eec74ab56040a3600c8d5f8f9b755c45cbc35f944df57adf64cb6abde558c1476e2da575c8ba268a1072d5f4366ac8686ef5f1d636652c607ab71bec0401032028181ebf06db5624ef3e5fa5ca5c95b3ab8a05a2c2e47bdb6515ef4bd0a642f7948ab42df580698d1849fda98242fc38073afa5340d061886d2fbab893c8c5b2e77ea6aaf855b4171f356baa9655e794f939119c04105be852f9e156f9fd0c301db100a52a92eb48886c6f824984082c088537617ca4bd755a42cf85ec4e88cb", 0x1000}, {&(0x7f0000001580)}, {&(0x7f00000015c0)="b359afc8672e6399f0ad9b5d89b223db33b60bee836dc4ab4e21998f2f06b3011e5bdb06a781bfb74ab7cf1f95f48b089edde98947dd453b50376092fa2cb3431f042b88bd6b820fecf1bb77b6748be57d4b804303dd4c960623798ef53842cc56ee3912dd25df23c75b44287769704aa61fc7473c7579519aaecca0b636313401bf60", 0x83}], 0x6, &(0x7f0000000740)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000100000000000000001000000010000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff3e6197338703ea000000000100000002000000193df3747c22d268c337ab1ea65e421f362e210869dbbe90a917668208b22eed1777a53a6127184491fcf9", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0xf0, 0x4004}}], 0x2, 0x0) recvmmsg(r0, &(0x7f0000001700)=[{{&(0x7f0000000880)=@nfc, 0x80, &(0x7f0000000ac0)=[{&(0x7f0000000900)=""/136, 0x88}, {&(0x7f0000002280)=""/4096, 0x1000}, {&(0x7f00000017c0)=""/241, 0xf1}], 0x3, &(0x7f0000000b00)=""/250, 0xfa}, 0x9}, {{&(0x7f00000009c0)=@sco, 0x80, &(0x7f0000000f00)=[{&(0x7f0000000c80)=""/94, 0x5e}, {&(0x7f0000000d00)=""/220, 0xdc}, {&(0x7f0000003280)=""/4096, 0x1000}, {&(0x7f0000000e00)=""/253, 0xfd}], 0x4, &(0x7f0000000f40)=""/162, 0xa2}, 0x5}, {{&(0x7f0000001000)=@caif, 0x80, &(0x7f0000001680)=[{&(0x7f0000001080)=""/196, 0xc4}, {&(0x7f0000001240)=""/104, 0x68}, {&(0x7f0000000a40)=""/72, 0x48}, {&(0x7f0000001580)=""/35, 0x23}], 0x4, &(0x7f00000016c0)=""/32, 0x20}, 0x4}], 0x3, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x0, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, r2, 0xfffffffffffffffd, 0xfffffffffffffffe, 0x1) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f00000003c0)={'gre0\x00', &(0x7f0000000140)={'tunl0\x00', 0x0, 0x1, 0x10, 0x0, 0x4, {{0x5, 0x4, 0x1, 0x8, 0x14, 0x67, 0x0, 0xdb, 0x4, 0x0, @remote, @empty}}}}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_int(r5, &(0x7f0000000100)='blkio.reset_stats\x00', 0x2, 0x0) write$cgroup_int(r6, &(0x7f0000000040)=0x2, 0x12) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) syz_io_uring_setup(0x1458, &(0x7f00000003c0)={0x0, 0x104, 0x10180, 0x2000, 0x3ae}, &(0x7f0000000100), &(0x7f00000000c0)) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='9'], 0x38}, 0x1, 0x0, 0x0, 0x41}, 0x37aea8e708e70634) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r7, &(0x7f0000000180)=ANY=[], 0x118) 25.356146195s ago: executing program 1 (id=348): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000002d00090027bd70000000000004000000080018000bac0f009f"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 24.642857365s ago: executing program 0 (id=353): r0 = socket$inet_smc(0x2b, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x2b, 0x5e, 0x6, 0x10, 0x77d, 0x627a, 0x10, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xce, 0x0, 0x0, 0x3, 0xe0, 0x46}}]}}]}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040), &(0x7f0000000080)=0x14) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xf, &(0x7f0000000d80)=ANY=[@ANYBLOB="18080000feffffff000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000008b7030000000000008500000008000000bf09000000000000a5090100ffffff8095000000000000003c980480000000005e080000000000008500000005000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x14) madvise(&(0x7f00001d9000/0x4000)=nil, 0x4000, 0x11) socket$inet_smc(0x2b, 0x1, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x2b, 0x5e, 0x6, 0x10, 0x77d, 0x627a, 0x10, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xce, 0x0, 0x0, 0x3, 0xe0, 0x46}}]}}]}}, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) (async) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040), &(0x7f0000000080)=0x14) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xf, &(0x7f0000000d80)=ANY=[@ANYBLOB="18080000feffffff000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000008b7030000000000008500000008000000bf09000000000000a5090100ffffff8095000000000000003c980480000000005e080000000000008500000005000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x14) (async) madvise(&(0x7f00001d9000/0x4000)=nil, 0x4000, 0x11) (async) 24.493529459s ago: executing program 0 (id=354): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r2, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r4) close(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r5 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x18, 0x0) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r5, 0x1, &(0x7f0000000140)={0x100, r6}, 0x0) openat2(r4, &(0x7f0000000000)='./file0\x00', &(0x7f00000002c0)={0x10100, 0x1, 0x20}, 0x18) landlock_restrict_self(r5, 0x0) shmctl$IPC_RMID(0x0, 0x0) socket$inet6(0xa, 0x3, 0x8000000003c) r7 = socket(0x840000000002, 0x3, 0xff) sendmmsg$inet(r7, &(0x7f0000000280)=[{{&(0x7f00000001c0)={0x2, 0xfffd, @remote}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000240)="a905000000007464000100000000", 0xe}, {0x0}, {&(0x7f00000000c0)="d6976d1a0a08772151e1a1fddfbf8270c1d5c7fff805d7faa08f2c8bc356b2", 0x1f}], 0x3}}], 0x1, 0x24004044) setsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f00000001c0)={{{@in=@multicast2, @in=@private=0xa010102, 0x4e23, 0x8, 0x4e22, 0x0, 0x2, 0x0, 0x80, 0x3c}, {0x0, 0x5, 0x31, 0x200, 0xb801, 0xa6f, 0x3, 0x2a}, {0x81, 0x390b8798, 0x3, 0xdca8}, 0xfffffffe, 0x10, 0x2, 0x0, 0x1, 0x3}, {{@in6=@local, 0x4d5, 0x2b}, 0x2, @in6=@remote, 0x3505, 0x4, 0x520f297193e84447, 0x2, 0x8d1, 0x73b4, 0x417c5be3}}, 0xfffffffffffffee9) mknodat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file1\x00', 0x81c0, 0x0) socket(0x400000000010, 0x3, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r8, 0x5414, &(0x7f0000000340)={0x4, 0x1, 0x9, 0x3}) 23.613752557s ago: executing program 0 (id=355): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f00000042c0)="86", 0xff0f}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000600)=""/203, 0xcb}], 0x1, 0x0, 0x18}, 0x0) syz_emit_ethernet(0x11e, &(0x7f0000000400)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000286dd6000050000e83afffe8000000000000000000000000000bbff02000000000000000000000000000186009078000002000000000001800000180f00000000e50053bff4db7fb81947a98ef6c30aef8bffd4310d8c8cfbdfdcf5ad49792ea9afa9553dcd662ba253fb01a9bda9916838f848a6e18c02bf95848d398ec9dba34d082016dcb10b44b93da65d02ba88666428204a908ad971d0047aabc2491e667b9900000000000000000000000000000000220aa78ce54006598080a8030037004023aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af18020001005ff9297d00001392000100"], 0x0) 23.536866451s ago: executing program 0 (id=356): syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[], 0x0) (async) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='setgroups\x00') getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000040), &(0x7f00000000c0)=0x4) 21.916399409s ago: executing program 2 (id=360): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb47, 0x9, 0x8, 0x80000001, 0x3}, 0x0) ioctl$TIOCMGET(0xffffffffffffffff, 0x541e, &(0x7f0000000040)) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r2, 0xc0a85320, &(0x7f0000000180)={{0x80}, 'port0\x00', 0x7e, 0xa1c07, 0x6, 0x0, 0x100000}) epoll_create(0x101) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) socket$inet(0x2, 0x2, 0x80000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r3 = socket(0x10, 0x80002, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000440), r3) sendmsg$SEG6_CMD_SETHMAC(r6, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="5400004009495c780bb0fbe9bbcc40", @ANYRES16=r8, @ANYBLOB="000227bd7000fbdbdf2501000000080002000900000014000100fc00000000000000000000000000000014000100ff01000000000000000000000000000105000500030000000800020002000000"], 0x54}}, 0x20000000) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0xb, 0x9}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x1}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157) sendmmsg$alg(r3, &(0x7f00000000c0), 0x492492492492627, 0x0) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRESHEX, @ANYRESOCT, @ANYRESDEC=0x0, @ANYRESDEC=0x0]) fsopen(&(0x7f0000000000)='autofs\x00', 0x0) syz_usb_connect(0x0, 0x5e, &(0x7f0000000140)=ANY=[@ANYBLOB="120100006b36a2207b06a1279bb00102030109024c0001000010000904e7000229feac000b2402010302057ff49bfd052406000105240002000d240f0105000000090007000806241a7f000109050602ff030000000905820208"], 0x0) 20.433610142s ago: executing program 0 (id=361): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r0, 0x7a5, &(0x7f0000000180)={{@my=0x0}, 0x0, 0x1}) (async) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r0, 0x7a5, &(0x7f0000000180)={{@my=0x0}, 0x0, 0x1}) socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (async) bind$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) (async) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) setxattr$system_posix_acl(0x0, &(0x7f00000001c0)='system.posix_acl_access\x00', 0x0, 0x0, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4814}, 0x4000000) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4814}, 0x4000000) r1 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x128) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x5, 0xff, 0x1f}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7b}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000040)={r1, 0x7, 0xaf1, 0x10}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 20.428950905s ago: executing program 0 (id=362): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'wg0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000003e000701feffffff00000000017c0000000039a0040008000c0001800600060008060000080002"], 0x30}, 0x1, 0x0, 0x0, 0x4000c000}, 0xc000) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000040)={0x28, r4, 0x1, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SCAN_SSIDS={0x4}, @NL80211_ATTR_SCAN_FLAGS={0x8, 0x9e, 0xc80}]}, 0x28}, 0x1, 0x0, 0x0, 0x24004084}, 0x4c000) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0xffffff6f, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000220000012bbd7000ffdbdf250a108093050000040a000000141e322fc88c35433ed2ebf94665a4b82810d01584f451c10d5ff2484b656c707ba3416182b2f8423a94451a6125fa94d67ef1b38688d352e5631aeafb3511129803aed7a2a70abe56b3264950144ce76254c0cfa515bf4cbebff9b529d10acfcb2d3b09fa97391f97252892c535c6fae363fe8c704f1cf37ab1167dbf6be827325895e96e8076592dfc8d3febdb93e77493f90f47abe7c1b49a8d6f656ea6ce7cbeb0cba5ae670d8bccc7207848c8f1addabf54"], 0x1c}, 0x1, 0x0, 0x0, 0x2004d099}, 0x0) 18.78597173s ago: executing program 2 (id=363): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x0, &(0x7f0000000040)}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000001c0), 0x13f, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) socketpair$unix(0x1, 0x3, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000400)={0x2020}, 0x2020) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000002900)=[{{&(0x7f0000000200)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000000580), 0x0, 0x0, 0x0, 0x10}}], 0x1, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) close_range(r2, r0, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f0000000340)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x990d78d028bb7cde}, 0xc, &(0x7f0000000300)={&(0x7f0000002440)={0x344, 0x0, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0xac, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8001}]}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xd}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x10001}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3ff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_NODE={0x8}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8001}]}, @TIPC_NLA_LINK={0xe4, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xaa6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe00000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc052}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x89}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xab7e}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5b75909b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x854}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_NODE={0x178, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x1}, @TIPC_NLA_NODE_ID={0x10, 0x3, "658ed8da8abf8f5fb616738f"}, @TIPC_NLA_NODE_KEY={0x43, 0x4, {'gcm(aes)\x00', 0x1b, "cb71225254af92a21678d00e6a5d7067eb5daf40ca193ee76772fe"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x5}, @TIPC_NLA_NODE_KEY={0x49, 0x4, {'gcm(aes)\x00', 0x21, "edecdecf51c2d40924af78e00b5d80dc3becd074e318b78b380ec09b8331a244fa"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0xba, 0x3, "54b396f44ae2ddc9af064ea444769897292a6ee1ddcdea9a4a6903d10da968aa0b497b6c7cfb9cb554c0b3cffc1e99b6763366a1c8d22da33899835e1a6e2b9c2620085ffbf5244573b8ee95358b32cf12da36eaa2ac6575f00733e44725996307dfeb3ac7882aa7034147881d470c1e7ff29add771ef0b9522d2f4be91e1b27409e93f0802a0f75ff9e2eb3ccd9da86f5e53e2b4fe631fc88462e31c11cf2df37c9057f8eeecd75b10d05d00d9067cb856961da51c5"}]}, @TIPC_NLA_MEDIA={0x28, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6cfc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x344}, 0x1, 0x0, 0x0, 0x20044841}, 0x20000000) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r3, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r4, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000500)={0x28, 0x6, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000, 0x80000001}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0, 0xf4}) r5 = syz_open_dev$radio(&(0x7f00000000c0), 0x2, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205647, &(0x7f0000000100)={0xf030000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f907, 0x0, '\x00', @p_u32=0x0}}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) 17.872447198s ago: executing program 2 (id=364): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0x401) listen(r1, 0x0) shutdown(r1, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@mpls_delroute={0x1c, 0x18, 0x9, 0xffffffff, 0x25dfdbfe, {0x1c, 0x14, 0x84, 0x0, 0xfe, 0x0, 0xfe, 0x0, 0x3000}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8804) syz_usb_connect(0x0, 0x3f, &(0x7f00000004c0)={{0x12, 0x1, 0x200, 0xe0, 0x1, 0x4, 0x10, 0x34ef, 0x202b, 0x3609, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x84, 0x65, 0x20, 0x9, [{{0x9, 0x4, 0x4, 0x0, 0x3, 0x5d, 0x8e, 0xb8, 0x9, [], [{{0x9, 0x5, 0xc, 0x2, 0x3ff, 0x6, 0x2, 0x9f}}, {{0x9, 0x5, 0x2, 0x2, 0x1af, 0x5, 0x3, 0xc}}, {{0x9, 0x5, 0xf, 0x3, 0x3ff, 0xf1, 0x5}}]}}]}}]}}, 0x0) 16.565535573s ago: executing program 2 (id=365): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x7, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x200, 0xa) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000140)={r1, 0x3ff, {0x0, 0x0, 0x0, 0x7, 0x100000000, 0x0, 0x12, 0x10, 0x4, "deb38e383665f0be1c46c0db659153ff065e7ea4dd25e94302cb2f9ea62a27be1f580b216b210ae93f95721b03bfee2d18454e67d3892f57380dc5e69ced0bb7", "ac388f90476f6f809f49d1ac5d9719f6b8db68e131346f945f75c33cb978fb26e8a2c353e0c842e4ef26b15866dd509a331e13b87a1b9526cd8e90b057de6334", "cc114f54a1ea3bdbf34af74f1895cdf23643a9965d25ed7ed644a691655e64c7", [0x6, 0x5]}}) socket$nl_netfilter(0x10, 0x3, 0xc) syz_io_uring_setup(0x100c0d, &(0x7f00000000c0)={0x0, 0xadbb, 0x8, 0x0, 0x215}, 0x0, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x900, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2080, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) r6 = fsopen(&(0x7f0000000600)='devpts\x00', 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fsmount(r6, 0x1, 0x1) r7 = accept4(r5, 0x0, 0x0, 0x0) recvmmsg$unix(r7, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x639, 0x10062, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x1) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r9 = eventfd(0x1) ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f00000002c0)={0x0, 0x0, 0x4, r9, 0xb}) 15.695599279s ago: executing program 2 (id=366): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) ppoll(&(0x7f0000000000)=[{r0, 0x8108}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000640)=0x9) (async, rerun: 64) r1 = socket$inet_sctp(0x2, 0x5, 0x84) (rerun: 64) setsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f00000002c0), 0x4) r2 = syz_io_uring_complete(0x0) (async, rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$TIPC_NL_KEY_SET(r3, 0x0, 0x0) (async, rerun: 32) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) (async, rerun: 32) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) (async, rerun: 32) r4 = socket$vsock_stream(0x28, 0x1, 0x0) (async, rerun: 32) r5 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c00009040000020701010009050102"], 0x0) syz_usb_control_io$printer(r5, 0x0, &(0x7f00000011c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) socket(0xf, 0x1, 0x64) (async) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x5, 0x4, 0x1) getsockname$packet(r7, 0x0, 0x0) (async) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_CONNECT(r2, &(0x7f00000003c0)={0x6, 0x118, 0xfa00, {{0x6, 0x4, "16fc74496bcdbaadff4409f66b3313f1d29614660d27a8fd8f21cbc39bae50a9fdada1f51461249920c0c488e6aaec436248a1fc1776eac8f008ebdffad3466999c4a136b154fe243298d9e9e6adbf68f5eaf8521c22a1d8c2217b3f31a05a8339711a61922bc409fc295694e4ebbe8d64d071622381a7659feecfcda4a86f8b534e41a2c5420c6f61c0ba23b7635ddc1b3c55a8896960abe15f13726888aaa14d26f0e5a5c5ef770803ed4a6b7d663f5586f1f05fe0bdac8d07ae5387a65028c14a5fadef6d9465249db63cd4a3ba694da483f129163ef3953f8925e44e85bf427208fbdb37942ae38e59d06bd9f06987d5745f3f5f4ad07ad0433c224dc008", 0xfb, 0x9, 0x1, 0x4, 0x94, 0x5, 0x7}, r8}}, 0x120) (async) pselect6(0x40, &(0x7f0000000000)={0x3, 0x1000000000000000, 0x8000000000000000, 0x0, 0x80000, 0x0, 0x0, 0x10000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0xfff, 0x0, 0x8, 0x0, 0x0, 0x2, 0x100000000004}, 0x0, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) (async, rerun: 32) r9 = socket$inet_tcp(0x2, 0x1, 0x0) (rerun: 32) ioctl$sock_inet_SIOCDELRT(r9, 0x890c, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @private=0xa010101}, {0x2, 0x4e20, @multicast2}, {0x2, 0x4e21, @multicast1}, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x9, 0x2}) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x8012, r0, 0x0) (async) r10 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/devices\x00', 0x0, 0x0) io_setup(0x3, &(0x7f0000000140)=0x0) io_submit(r11, 0x1, &(0x7f0000000a40)=[&(0x7f0000000840)={0x0, 0x0, 0x0, 0x5, 0x0, r10, 0x0, 0x0, 0xab, 0x0, 0x0, r10}]) (async) io_uring_enter(r10, 0x5060, 0xc0c6, 0x68, &(0x7f00000000c0)={[0x10001]}, 0x8) 15.59790485s ago: executing program 2 (id=367): r0 = syz_io_uring_setup(0x8d2, &(0x7f0000001400)={0x0, 0xd80e, 0x3010, 0xfffffffc}, &(0x7f00000001c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x2, 0x2, 0x0, {0xa, 0x4e23, 0x4, @loopback, 0x8}}}, 0x80, 0x0}, 0x0, 0x40, 0x1}) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x1ff, 0x6, 0xc, 0x4}]}, 0x10) io_uring_enter(r0, 0x47ba, 0x3e80, 0x0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) semctl$GETALL(0x0, 0x0, 0xd, 0x0) r5 = syz_io_uring_setup(0x3b, &(0x7f00000001c0)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000380)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r8, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f00000018c0)=ANY=[], 0x20}, 0x0, 0xe3d08660d3c94684}) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x5) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000408000/0x18000)=nil, &(0x7f0000000480)=[@text16={0x10, &(0x7f00000003c0)="6765262e2e0f01c936f3aebad00466ed3e67d9f30f3265f2a6baf80c66b8b8c7608a66efbafc0c66ed2e0f01c40fc7ab24006766c744240096da00006766c7442402d89d77896766c744240600000000670f011424", 0x55}], 0x1, 0x11, 0x0, 0xfffffffffffffd73) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) io_uring_enter(r5, 0x92, 0x0, 0x0, 0x0, 0x0) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r13 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r13, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r13, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000000007082d5361ca10de2bccaae0dc3e0bf1b808073a2f18dc45f9ab419a2c43e76a6c3f295bce7d4f2b83a4b8e68842bc92a6dcd60d9543293430f3c3d2122526385fbe4f0c6eefbf5e94791dfabe4360f30aecdcaea39e5386bf3c9b600f69dfda55388dcda0d96d8c84a14e355e3b292c26533d9433812750b9a109493ac49a18eec2b136ff86ceada975992636e236f686ac270a162a28a967fef953b414e57f437e15b6239c94dd9a59cdf455f3d76aed0d5bc3e01a31ae70036ca87b69277", @ANYRES16=r12, @ANYBLOB="01002abd7000fcdbdf254f00000008000300", @ANYRES32=r14, @ANYBLOB="10007a800c000300793ba2bb537be833"], 0x2c}}, 0x4000080) sendmsg$NL80211_CMD_LEAVE_MESH(r3, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)={0x28, r4, 0x300, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r14}, @val={0xc, 0x99, {0x2, 0xe}}}}, ["", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x41) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r15 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r15, 0x6, 0x13, &(0x7f0000000180)=0x20000001, 0x4) connect$inet6(r15, &(0x7f0000000440)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r15, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r15, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "9806d1267c49cd76", "000000072d85a4609e9104a000", "608642ca", "bc7e7f5df6aec397"}, 0x28) setsockopt$inet6_tcp_int(r15, 0x11a, 0x4, &(0x7f0000000040), 0x44) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc}) 10.017767909s ago: executing program 34 (id=348): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000002d00090027bd70000000000004000000080018000bac0f009f"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 4.986478931s ago: executing program 35 (id=362): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'wg0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000003e000701feffffff00000000017c0000000039a0040008000c0001800600060008060000080002"], 0x30}, 0x1, 0x0, 0x0, 0x4000c000}, 0xc000) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000040)={0x28, r4, 0x1, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SCAN_SSIDS={0x4}, @NL80211_ATTR_SCAN_FLAGS={0x8, 0x9e, 0xc80}]}, 0x28}, 0x1, 0x0, 0x0, 0x24004084}, 0x4c000) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0xffffff6f, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000220000012bbd7000ffdbdf250a108093050000040a000000141e322fc88c35433ed2ebf94665a4b82810d01584f451c10d5ff2484b656c707ba3416182b2f8423a94451a6125fa94d67ef1b38688d352e5631aeafb3511129803aed7a2a70abe56b3264950144ce76254c0cfa515bf4cbebff9b529d10acfcb2d3b09fa97391f97252892c535c6fae363fe8c704f1cf37ab1167dbf6be827325895e96e8076592dfc8d3febdb93e77493f90f47abe7c1b49a8d6f656ea6ce7cbeb0cba5ae670d8bccc7207848c8f1addabf54"], 0x1c}, 0x1, 0x0, 0x0, 0x2004d099}, 0x0) 0s ago: executing program 36 (id=367): r0 = syz_io_uring_setup(0x8d2, &(0x7f0000001400)={0x0, 0xd80e, 0x3010, 0xfffffffc}, &(0x7f00000001c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x2, 0x2, 0x0, {0xa, 0x4e23, 0x4, @loopback, 0x8}}}, 0x80, 0x0}, 0x0, 0x40, 0x1}) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x1ff, 0x6, 0xc, 0x4}]}, 0x10) io_uring_enter(r0, 0x47ba, 0x3e80, 0x0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) semctl$GETALL(0x0, 0x0, 0xd, 0x0) r5 = syz_io_uring_setup(0x3b, &(0x7f00000001c0)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000380)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r8, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f00000018c0)=ANY=[], 0x20}, 0x0, 0xe3d08660d3c94684}) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x5) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000408000/0x18000)=nil, &(0x7f0000000480)=[@text16={0x10, &(0x7f00000003c0)="6765262e2e0f01c936f3aebad00466ed3e67d9f30f3265f2a6baf80c66b8b8c7608a66efbafc0c66ed2e0f01c40fc7ab24006766c744240096da00006766c7442402d89d77896766c744240600000000670f011424", 0x55}], 0x1, 0x11, 0x0, 0xfffffffffffffd73) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) io_uring_enter(r5, 0x92, 0x0, 0x0, 0x0, 0x0) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r13 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r13, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r13, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000580)=ANY=[@ANYBLOB="00000000000000000000007082d5361ca10de2bccaae0dc3e0bf1b808073a2f18dc45f9ab419a2c43e76a6c3f295bce7d4f2b83a4b8e68842bc92a6dcd60d9543293430f3c3d2122526385fbe4f0c6eefbf5e94791dfabe4360f30aecdcaea39e5386bf3c9b600f69dfda55388dcda0d96d8c84a14e355e3b292c26533d9433812750b9a109493ac49a18eec2b136ff86ceada975992636e236f686ac270a162a28a967fef953b414e57f437e15b6239c94dd9a59cdf455f3d76aed0d5bc3e01a31ae70036ca87b69277", @ANYRES16=r12, @ANYBLOB="01002abd7000fcdbdf254f00000008000300", @ANYRES32=r14, @ANYBLOB="10007a800c000300793ba2bb537be833"], 0x2c}}, 0x4000080) sendmsg$NL80211_CMD_LEAVE_MESH(r3, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)={0x28, r4, 0x300, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r14}, @val={0xc, 0x99, {0x2, 0xe}}}}, ["", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x41) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r15 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r15, 0x6, 0x13, &(0x7f0000000180)=0x20000001, 0x4) connect$inet6(r15, &(0x7f0000000440)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r15, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r15, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "9806d1267c49cd76", "000000072d85a4609e9104a000", "608642ca", "bc7e7f5df6aec397"}, 0x28) setsockopt$inet6_tcp_int(r15, 0x11a, 0x4, &(0x7f0000000040), 0x44) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc}) kernel console output (not intermixed with test programs): forwarding state [ 85.840039][ T5886] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.891682][ T5886] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.920758][ T3529] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.927953][ T3529] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.969101][ T5883] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.990127][ T3482] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.997335][ T3482] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.053402][ T5883] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.090280][ T3511] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.097483][ T3511] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.143906][ T3511] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.151127][ T3511] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.163382][ T5887] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.175907][ T5885] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.191197][ T5884] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.333237][ T5886] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.343807][ T5887] veth0_vlan: entered promiscuous mode [ 86.374316][ T5885] veth0_vlan: entered promiscuous mode [ 86.390350][ T5887] veth1_vlan: entered promiscuous mode [ 86.414589][ T5885] veth1_vlan: entered promiscuous mode [ 86.436341][ T5884] veth0_vlan: entered promiscuous mode [ 86.464750][ T5884] veth1_vlan: entered promiscuous mode [ 86.528493][ T5887] veth0_macvtap: entered promiscuous mode [ 86.568053][ T5884] veth0_macvtap: entered promiscuous mode [ 86.575386][ T5885] veth0_macvtap: entered promiscuous mode [ 86.585099][ T5887] veth1_macvtap: entered promiscuous mode [ 86.595386][ T5883] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.614166][ T5886] veth0_vlan: entered promiscuous mode [ 86.632978][ T5885] veth1_macvtap: entered promiscuous mode [ 86.640338][ T5884] veth1_macvtap: entered promiscuous mode [ 86.652884][ T5886] veth1_vlan: entered promiscuous mode [ 86.703044][ T5887] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.714511][ T5884] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.741536][ T5887] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.773571][ T5884] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.790703][ T3529] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.825827][ T3529] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.841775][ T9] cfg80211: failed to load regulatory.db [ 86.846106][ T3529] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.866027][ T5885] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.887778][ T3529] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.896522][ T3529] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.911452][ T5885] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.923059][ T5886] veth0_macvtap: entered promiscuous mode [ 86.942286][ T3529] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.968531][ T5886] veth1_macvtap: entered promiscuous mode [ 86.984459][ T3529] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.995448][ T3529] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.019420][ T5883] veth0_vlan: entered promiscuous mode [ 87.031356][ T3529] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.040352][ T202] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.082479][ T202] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.091933][ T202] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.115533][ T3529] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.133618][ T3529] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.143287][ T5886] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.155593][ T5883] veth1_vlan: entered promiscuous mode [ 87.191721][ T5886] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.227663][ T5866] Bluetooth: hci2: command tx timeout [ 87.233121][ T5866] Bluetooth: hci4: command tx timeout [ 87.239283][ T5877] Bluetooth: hci3: command tx timeout [ 87.239303][ T5876] Bluetooth: hci1: command tx timeout [ 87.244697][ T5877] Bluetooth: hci0: command tx timeout [ 87.312647][ T3529] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.341945][ T3529] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.343786][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.353609][ T3529] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.367885][ T36] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.388233][ T3511] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.398201][ T3511] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.412415][ T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.412760][ T3511] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.433065][ T3511] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.541516][ T5887] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 87.560188][ T3511] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.562039][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.569916][ T3511] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.582217][ T5883] veth0_macvtap: entered promiscuous mode [ 87.592937][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.614028][ T5883] veth1_macvtap: entered promiscuous mode [ 87.705859][ T5883] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.746402][ T202] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.752199][ T5883] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.775619][ T202] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.829128][ T3529] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.854445][ T3529] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.939314][ T5969] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 87.981868][ T3529] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.003074][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.014362][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.019179][ T5939] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 88.044728][ T3529] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.230643][ T202] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.265323][ T202] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.265953][ T5939] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 88.308556][ T5981] delete_channel: no stack [ 88.310975][ T5939] usb 4-1: New USB device found, idVendor=056a, idProduct=00b4, bcdDevice= 0.00 [ 88.330896][ T5939] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.366160][ T5981] pim6reg: entered allmulticast mode [ 88.370470][ T5939] usb 4-1: config 0 descriptor?? [ 88.381502][ T3529] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.402964][ T5960] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 88.426213][ T3529] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.539177][ T5984] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 88.571602][ T5960] usb 2-1: device descriptor read/64, error -71 [ 88.716517][ T5987] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1'. [ 88.730499][ T5987] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 88.827887][ T5960] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 88.876866][ T5961] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 88.942797][ T5989] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9'. [ 88.961984][ T5989] autofs4:pid:5989:check_dev_ioctl_version: ioctl control interface version mismatch: kernel(1.1), user(4294967071.1), cmd(0xc018937e) [ 88.981402][ T5989] autofs4:pid:5989:validate_dev_ioctl: invalid device control module version supplied for cmd(0xc018937e) [ 88.990159][ T5960] usb 2-1: device descriptor read/64, error -71 [ 89.046688][ T5961] usb 5-1: Using ep0 maxpacket: 32 [ 89.055148][ T5961] usb 5-1: config 0 interface 0 has no altsetting 0 [ 89.059285][ T10] usb 4-1: USB disconnect, device number 2 [ 89.085654][ T5961] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 89.105119][ T5961] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.127917][ T5960] usb usb2-port1: attempt power cycle [ 89.143890][ T5961] usb 5-1: Product: syz [ 89.159945][ T5961] usb 5-1: Manufacturer: syz [ 89.177973][ T5961] usb 5-1: SerialNumber: syz [ 89.205738][ T5961] usb 5-1: config 0 descriptor?? [ 89.307155][ T5877] Bluetooth: hci1: command tx timeout [ 89.312686][ T5877] Bluetooth: hci3: command tx timeout [ 89.318784][ T5866] Bluetooth: hci2: command tx timeout [ 89.324218][ T5866] Bluetooth: hci0: command tx timeout [ 89.329936][ T5882] Bluetooth: hci4: command tx timeout [ 89.375492][ T5994] Zero length message leads to an empty skb [ 89.382660][ T5994] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 89.444453][ T5961] gs_usb 5-1:0.0: Couldn't send data format (err=-71) [ 89.484161][ T5961] gs_usb 5-1:0.0: probe with driver gs_usb failed with error -71 [ 89.499432][ T5960] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 89.538102][ T5960] usb 2-1: device descriptor read/8, error -71 [ 89.559605][ T5961] usb 5-1: USB disconnect, device number 2 [ 89.577196][ T921] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 89.646823][ T5996] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 89.741109][ T921] usb 3-1: New USB device found, idVendor=249c, idProduct=9002, bcdDevice=de.ad [ 89.751384][ T921] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.777089][ T5960] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 89.800478][ T921] usb 3-1: config 0 descriptor?? [ 89.807743][ T5960] usb 2-1: device descriptor read/8, error -71 [ 89.830118][ T5996] usb 1-1: unable to get BOS descriptor or descriptor too short [ 89.841096][ T5996] usb 1-1: not running at top speed; connect to a high speed hub [ 89.861319][ T5996] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 89.876466][ T5996] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 89.908873][ T5996] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 89.931868][ T6005] loop2: detected capacity change from 0 to 7 [ 89.939523][ T5960] usb usb2-port1: unable to enumerate USB device [ 89.944565][ T5973] Dev loop2: unable to read RDB block 7 [ 89.949254][ T5996] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 89.960367][ T5973] loop2: AHDI p2 p3 [ 89.964788][ T5973] loop2: partition table partially beyond EOD, truncated [ 89.974602][ T5996] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.977538][ T5973] loop2: p2 start 1702059890 is beyond EOD, truncated [ 89.996614][ T5996] usb 1-1: Product: syz [ 90.000853][ T5996] usb 1-1: Manufacturer: syz [ 90.017180][ T6005] Dev loop2: unable to read RDB block 7 [ 90.017773][ T921] snd-usb-hiface 3-1:0.0: probe with driver snd-usb-hiface failed with error -22 [ 90.022953][ T6005] loop2: AHDI p2 p3 [ 90.033558][ T5996] usb 1-1: SerialNumber: syz [ 90.061711][ T6005] loop2: partition table partially beyond EOD, truncated [ 90.076130][ T6005] loop2: p2 start 1702059890 is beyond EOD, truncated [ 90.221044][ T5992] netlink: 4400 bytes leftover after parsing attributes in process `syz.2.10'. [ 90.283759][ T5996] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 90.321219][ T5996] usb 1-1: 2:1 : no or invalid class specific endpoint descriptor [ 90.347052][ T5996] usb 1-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 90.390416][ T5996] usb 1-1: USB disconnect, device number 2 [ 90.465180][ T5973] udevd[5973]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 90.490623][ T5992] netlink: 'syz.2.10': attribute type 10 has an invalid length. [ 90.503067][ T5992] team0: Port device dummy0 added [ 90.633132][ T982] usb 3-1: USB disconnect, device number 2 [ 91.519757][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 91.926875][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.067024][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.092392][ T6044] loop2: detected capacity change from 0 to 7 [ 92.098615][ T24] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 92.106389][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.143337][ T6044] Dev loop2: unable to read RDB block 7 [ 92.177069][ T6044] loop2: AHDI p2 p3 [ 92.197826][ T6044] loop2: partition table partially beyond EOD, truncated [ 92.205254][ T6044] loop2: p2 start 1702059890 is beyond EOD, truncated [ 92.226928][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.274070][ T24] usb 2-1: unable to get BOS descriptor or descriptor too short [ 92.292765][ T24] usb 2-1: not running at top speed; connect to a high speed hub [ 92.317585][ T24] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 92.352558][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 92.391790][ T24] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 92.432973][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.444397][ T30] audit: type=1800 audit(1755915477.598:2): pid=6050 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.27" name="file1" dev="tmpfs" ino=56 res=0 errno=0 [ 92.464326][ T24] usb 2-1: Product: syz [ 92.464527][ C0] vkms_vblank_simulate: vblank timer overrun [ 92.479323][ T24] usb 2-1: Manufacturer: syz [ 92.483967][ T24] usb 2-1: SerialNumber: syz [ 92.549552][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.564863][ T6042] (unnamed net_device) (uninitialized): option miimon: invalid value (18446744073709551615) [ 92.605613][ T6042] (unnamed net_device) (uninitialized): option miimon: allowed values 0 - 2147483647 [ 92.822916][ T6049] mmap: syz.3.26 (6049) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 92.907643][ T982] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 93.049701][ T24] usb 2-1: 0:2 : does not exist [ 93.054746][ T24] usb 2-1: unit 4 not found! [ 93.074244][ T24] usb 2-1: 5:0: cannot get min/max values for control 2 (id 5) [ 93.106057][ T24] usb 2-1: 5:0: cannot get min/max values for control 3 (id 5) [ 93.118881][ T982] usb 5-1: config 0 has an invalid interface number: 113 but max is 0 [ 93.139098][ T24] usb 2-1: 5:0: cannot get min/max values for control 3 (id 5) [ 93.152907][ T982] usb 5-1: config 0 has no interface number 0 [ 93.165107][ T24] usb 2-1: USB disconnect, device number 6 [ 93.176247][ T982] usb 5-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0xE7, changing to 0x87 [ 93.224190][ T982] usb 5-1: config 0 interface 113 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 93.264208][ T982] usb 5-1: config 0 interface 113 has no altsetting 0 [ 93.289852][ T982] usb 5-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 93.313937][ T982] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.326736][ T982] usb 5-1: Product: syz [ 93.331144][ T982] usb 5-1: Manufacturer: syz [ 93.346373][ T982] usb 5-1: SerialNumber: syz [ 93.367991][ T982] usb 5-1: config 0 descriptor?? [ 93.394884][ T982] pn533_usb 5-1:0.113: NFC: Could not find bulk-in or bulk-out endpoint [ 93.436665][ T5946] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 93.589128][ T6056] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 93.598812][ T6056] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 93.606927][ T5946] usb 1-1: Using ep0 maxpacket: 16 [ 93.624400][ T6056] netlink: 'syz.4.28': attribute type 8 has an invalid length. [ 93.636949][ T5946] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 93.648377][ T5946] usb 1-1: config 0 has no interface number 0 [ 93.668456][ T6056] dvmrp0: entered allmulticast mode [ 93.672628][ T5946] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 93.718056][ T5953] usb 5-1: USB disconnect, device number 3 [ 93.727687][ T5946] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 49152, setting to 1024 [ 93.770206][ T5946] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 93.789951][ T5946] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 93.811539][ T5946] usb 1-1: Product: syz [ 93.823142][ T5946] usb 1-1: SerialNumber: syz [ 93.832209][ T6065] loop4: detected capacity change from 0 to 7 [ 93.844992][ T5973] loop4: [POWERTEC] p1 p2 p3 p4 p5 [ 93.848066][ T5946] usb 1-1: config 0 descriptor?? [ 93.864890][ T5973] loop4: p1 start 1600481121 is beyond EOD, truncated [ 93.883445][ T5946] cm109 1-1:0.8: invalid payload size 1024, expected 4 [ 93.888802][ T5973] loop4: p2 start 536870912 is beyond EOD, truncated [ 93.918752][ T5973] loop4: p3 start 2097152 is beyond EOD, truncated [ 93.932609][ T5946] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input5 [ 93.941213][ T5973] loop4: p4 start 1310720 is beyond EOD, truncated [ 93.963804][ T5973] loop4: p5 start 791543808 is beyond EOD, truncated [ 93.996713][ T6065] loop4: [POWERTEC] p1 p2 p3 p4 p5 [ 94.013091][ T6065] loop4: p1 start 1600481121 is beyond EOD, truncated [ 94.051491][ T6065] loop4: p2 start 536870912 is beyond EOD, truncated [ 94.076931][ T6065] loop4: p3 start 2097152 is beyond EOD, truncated [ 94.095756][ C0] cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71 [ 94.096677][ T6065] loop4: p4 start 1310720 is beyond EOD, truncated [ 94.124663][ T6065] loop4: p5 start 791543808 is beyond EOD, truncated [ 94.450734][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 94.457932][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 94.465098][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 94.472468][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 94.476978][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 94.477778][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 94.480133][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 94.480360][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 94.480681][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 94.480902][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 94.481127][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 94.506602][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 94.556662][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 94.556720][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 94.624157][ T5946] usb 1-1: USB disconnect, device number 3 [ 94.624256][ C0] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 94.677823][ T5946] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 94.777947][ T5953] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 94.956787][ T5953] usb 2-1: Using ep0 maxpacket: 16 [ 95.034281][ T5953] usb 2-1: config 1 has an invalid interface number: 54 but max is 0 [ 95.044818][ T5953] usb 2-1: config 1 has no interface number 0 [ 95.062955][ T5953] usb 2-1: config 1 interface 54 has no altsetting 0 [ 95.091553][ T5953] usb 2-1: New USB device found, idVendor=1114, idProduct=0001, bcdDevice=f4.a7 [ 95.104149][ T5953] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.151552][ T5953] usb 2-1: Product: syz [ 95.155850][ T5953] usb 2-1: Manufacturer: ⠉ [ 95.186431][ T5953] usb 2-1: SerialNumber: syz [ 95.463316][ T5996] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 95.708986][ T5996] usb 1-1: Using ep0 maxpacket: 32 [ 95.721318][ T5996] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 95.735922][ T5996] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 95.755404][ T5996] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 96.064322][ T5996] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 2763, setting to 1024 [ 96.092852][ T5996] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 96.136391][ T5953] usb 2-1: USB disconnect, device number 7 [ 96.144939][ T5996] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 96.199268][ T5996] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 96.232068][ T5996] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 96.286258][ T5996] usb 1-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 96.313195][ T5996] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.348714][ T5996] usb 1-1: config 0 descriptor?? [ 96.360781][ T6084] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 96.388856][ T5996] usblp0: Disabling reads from problematic bidirectional printer [ 96.684681][ T5996] usblp 1-1:0.0: usblp0: USB Unidirectional printer dev 4 if 0 alt 0 proto 3 vid 0x03F0 pid 0x0004 [ 96.811130][ T5996] usb 1-1: USB disconnect, device number 4 [ 96.952704][ T5996] usblp0: removed [ 97.466699][ T5953] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 98.119576][ T5953] usb 4-1: Using ep0 maxpacket: 32 [ 98.173195][ T5953] usb 4-1: config 0 has an invalid interface number: 230 but max is 0 [ 98.226678][ T5953] usb 4-1: config 0 has no interface number 0 [ 98.256699][ T5953] usb 4-1: config 0 interface 230 has no altsetting 0 [ 98.304716][ T5953] usb 4-1: New USB device found, idVendor=0781, idProduct=0005, bcdDevice= 0.05 [ 98.336739][ T5953] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.409121][ T5953] usb 4-1: Product: syz [ 98.413368][ T5953] usb 4-1: Manufacturer: syz [ 98.438705][ T5953] usb 4-1: SerialNumber: syz [ 98.473078][ T5953] usb 4-1: config 0 descriptor?? [ 98.503739][ T5953] ums-usbat 4-1:0.230: USB Mass Storage device detected [ 98.546769][ T5953] ums-usbat 4-1:0.230: Quirks match for vid 0781 pid 0005: 1 [ 98.631466][ T6120] netlink: 'syz.4.42': attribute type 3 has an invalid length. [ 98.711093][ T6120] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.42'. [ 98.720984][ T6110] (unnamed net_device) (uninitialized): option miimon: invalid value (18446744073709551615) [ 98.746689][ T6110] (unnamed net_device) (uninitialized): option miimon: allowed values 0 - 2147483647 [ 98.805266][ T6119] loop3: detected capacity change from 0 to 1 [ 98.910341][ T6119] Dev loop3: unable to read RDB block 1 [ 98.933614][ T6119] loop3: unable to read partition table [ 98.978151][ T6119] loop3: partition table beyond EOD, truncated [ 99.028991][ T6119] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 99.499354][ T30] audit: type=1326 audit(1755915484.658:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6137 comm="syz.4.47" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbe2c98ebe9 code=0x0 [ 99.856663][ T24] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 99.866822][ T982] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 99.997068][ T24] usb 3-1: device descriptor read/64, error -71 [ 100.046716][ T982] usb 5-1: Using ep0 maxpacket: 16 [ 100.057131][ T982] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 100.098416][ T982] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 100.135137][ T982] usb 5-1: New USB device found, idVendor=0458, idProduct=05d7, bcdDevice= 0.00 [ 100.156413][ T982] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.203215][ T982] usb 5-1: config 0 descriptor?? [ 100.221995][ T982] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 100.291279][ T24] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 100.342106][ T6155] bond0: entered promiscuous mode [ 100.347795][ T6155] bond_slave_0: entered promiscuous mode [ 100.353930][ T6155] bond_slave_1: entered promiscuous mode [ 100.360990][ T6155] bond0: entered allmulticast mode [ 100.366266][ T6155] bond_slave_0: entered allmulticast mode [ 100.372148][ T6155] bond_slave_1: entered allmulticast mode [ 100.447075][ T24] usb 3-1: device descriptor read/64, error -71 [ 100.575147][ T6156] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 100.595982][ T24] usb usb3-port1: attempt power cycle [ 100.883151][ T5953] ums-usbat 4-1:0.230: probe with driver ums-usbat failed with error -5 [ 100.950720][ T24] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 100.977373][ T24] usb 3-1: device descriptor read/8, error -71 [ 100.999947][ T5953] usb 4-1: USB disconnect, device number 3 [ 101.230798][ T24] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 101.287539][ T24] usb 3-1: device descriptor read/8, error -71 [ 101.336752][ T5953] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 101.408142][ T24] usb usb3-port1: unable to enumerate USB device [ 101.516689][ T5953] usb 4-1: Using ep0 maxpacket: 32 [ 101.530129][ T5953] usb 4-1: config 0 has an invalid interface number: 66 but max is 0 [ 101.541720][ T5953] usb 4-1: config 0 has no interface number 0 [ 101.573824][ T5953] usb 4-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 101.593903][ T5953] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.606342][ T5953] usb 4-1: Product: syz [ 101.665237][ T5953] usb 4-1: Manufacturer: syz [ 101.670204][ T5953] usb 4-1: SerialNumber: syz [ 101.686099][ T5953] usb 4-1: config 0 descriptor?? [ 101.713628][ T6169] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 101.914802][ T5953] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 101.968154][ T5953] dvb-usb: bulk message failed: -22 (2/0) [ 101.986397][ T5953] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 102.032959][ T5953] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 102.079756][ T5953] usb 4-1: media controller created [ 102.099317][ T6155] cxusb: i2c rd: len=133 is too big! [ 102.099317][ T6155] [ 102.174670][ T5953] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 102.222788][ T6179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 102.233172][ T6179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 102.258198][ T6180] netlink: 'syz.1.54': attribute type 1 has an invalid length. [ 102.268900][ T5953] cxusb: set interface failed [ 102.289342][ T5953] dvb-usb: bulk message failed: -22 (1/0) [ 102.405362][ T5953] DVB: Unable to find symbol lgdt330x_attach() [ 102.450115][ T5953] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 102.875834][ T5946] usb 5-1: USB disconnect, device number 4 [ 102.897078][ T5953] rc_core: IR keymap rc-dvico-portable not found [ 102.910833][ T5953] Registered IR keymap rc-empty [ 102.942530][ T5953] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 103.033569][ T5953] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input6 [ 103.077274][ T5953] dvb-usb: schedule remote query interval to 100 msecs. [ 103.114141][ T5953] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 103.123376][ T48] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 103.169742][ T5953] usb 4-1: USB disconnect, device number 4 [ 103.296762][ T48] usb 3-1: Using ep0 maxpacket: 16 [ 103.314418][ T48] usb 3-1: config 8 has an invalid interface number: 39 but max is 0 [ 103.343792][ T48] usb 3-1: config 8 has no interface number 0 [ 103.428223][ T6197] netlink: 4 bytes leftover after parsing attributes in process `syz.3.59'. [ 103.442092][ T5953] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 103.453110][ T48] usb 3-1: config 8 interface 39 altsetting 1 has an endpoint descriptor with address 0xDF, changing to 0x8F [ 103.472570][ T48] usb 3-1: config 8 interface 39 altsetting 1 endpoint 0x8F has invalid wMaxPacketSize 0 [ 103.484361][ T48] usb 3-1: config 8 interface 39 altsetting 1 bulk endpoint 0x8F has invalid maxpacket 0 [ 103.505995][ T48] usb 3-1: config 8 interface 39 has no altsetting 0 [ 103.517318][ T48] usb 3-1: New USB device found, idVendor=05ac, idProduct=c704, bcdDevice=62.77 [ 103.532695][ T48] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.542616][ T48] usb 3-1: Product: syz [ 103.553118][ T48] usb 3-1: Manufacturer: syz [ 103.580845][ T48] usb 3-1: SerialNumber: syz [ 104.446909][ T10] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 104.457760][ T6210] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 104.551693][ T48] ipheth 3-1:8.39: ipheth_enable_ncm: usb_control_msg: 0 [ 104.593924][ T48] ipheth 3-1:8.39: Apple iPhone USB Ethernet device attached [ 104.617026][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 104.654767][ T10] usb 2-1: config 1 has an invalid interface number: 233 but max is 0 [ 104.672896][ T10] usb 2-1: config 1 has no interface number 0 [ 104.694169][ T10] usb 2-1: config 1 interface 233 has no altsetting 0 [ 104.721892][ T10] usb 2-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=34.ac [ 104.752239][ T5946] usb 3-1: USB disconnect, device number 7 [ 104.753973][ T6211] (unnamed net_device) (uninitialized): option miimon: invalid value (18446744073709551615) [ 104.779486][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.800354][ T6211] (unnamed net_device) (uninitialized): option miimon: allowed values 0 - 2147483647 [ 104.810062][ T10] usb 2-1: Product: syz [ 104.814251][ T10] usb 2-1: Manufacturer: syz [ 104.879787][ T10] usb 2-1: SerialNumber: syz [ 105.013585][ T5946] ipheth 3-1:8.39: Apple iPhone USB Ethernet now disconnected [ 105.142800][ T10] imon_raw 2-1:1.233: IR endpoint missing [ 105.193408][ T10] usb 2-1: USB disconnect, device number 8 [ 105.453244][ T30] audit: type=1326 audit(1755915490.548:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6214 comm="syz.3.64" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fcd3cb8ebe9 code=0x0 [ 105.587655][ T6229] loop2: detected capacity change from 0 to 7 [ 105.624565][ T6229] Dev loop2: unable to read RDB block 7 [ 105.634769][ T6229] loop2: unable to read partition table [ 105.641167][ T6229] loop2: partition table beyond EOD, truncated [ 107.207199][ T6229] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 107.520344][ T6244] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 107.772193][ T6251] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 107.804895][ T6251] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 108.016640][ T5939] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 108.296651][ T5939] usb 1-1: Using ep0 maxpacket: 8 [ 108.314925][ T5939] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 108.397984][ T5939] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 108.451232][ T5939] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 239, changing to 11 [ 108.516420][ T5939] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 9059, setting to 1024 [ 108.558363][ T5939] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 108.625186][ T5939] usb 1-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 108.634580][ T5939] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.650552][ T5939] usb 1-1: Product: syz [ 108.686934][ T5939] usb 1-1: Manufacturer: syz [ 108.700108][ T5939] usb 1-1: SerialNumber: syz [ 108.734877][ T48] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 108.737474][ T5939] usb 1-1: config 0 descriptor?? [ 108.797920][ T5939] input: KB Gear Tablet as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input8 [ 108.827441][ C0] kbtab 1-1:0.0: kbtab_irq - usb_submit_urb failed with result -1 [ 108.921709][ T48] usb 3-1: Using ep0 maxpacket: 16 [ 108.963972][ T48] usb 3-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice=2a.35 [ 108.997478][ T5939] usb 1-1: USB disconnect, device number 5 [ 109.035962][ T48] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.099493][ T48] usb 3-1: Product: syz [ 109.103698][ T48] usb 3-1: Manufacturer: syz [ 109.169116][ T48] usb 3-1: SerialNumber: syz [ 109.195729][ T48] usb 3-1: config 0 descriptor?? [ 109.258729][ T48] as10x_usb: device has been detected [ 109.274016][ T48] dvbdev: DVB: registering new adapter (Sky IT Digital Key (green led)) [ 109.353266][ T48] usb 3-1: DVB: registering adapter 1 frontend 0 (Sky IT Digital Key (green led))... [ 109.442003][ T48] as10x_usb: error during firmware upload part1 [ 109.483557][ T48] Registered device Sky IT Digital Key (green led) [ 109.497052][ T48] usb 3-1: USB disconnect, device number 8 [ 109.584016][ T48] Unregistered device Sky IT Digital Key (green led) [ 109.599086][ T6276] netlink: 'syz.4.75': attribute type 22 has an invalid length. [ 109.636483][ T48] as10x_usb: device has been disconnected [ 109.654949][ T6276] netlink: 4 bytes leftover after parsing attributes in process `syz.4.75'. [ 109.665504][ T6283] process 'syz.4.75' launched '/dev/fd/6' with NULL argv: empty string added [ 109.919388][ T6291] loop2: detected capacity change from 0 to 7 [ 109.962584][ T6291] Dev loop2: unable to read RDB block 7 [ 110.002317][ T6291] loop2: unable to read partition table [ 110.027364][ T6291] loop2: partition table beyond EOD, truncated [ 110.083730][ T6291] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 110.439704][ T6302] netlink: 12 bytes leftover after parsing attributes in process `syz.3.82'. [ 110.530358][ T6299] kvm: requested 10057 ns i8254 timer period limited to 200000 ns [ 110.555659][ T6299] kvm: requested 44419 ns i8254 timer period limited to 200000 ns [ 110.583865][ T6306] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 110.595937][ T6299] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 110.661279][ T6299] kvm: requested 155885 ns i8254 timer period limited to 200000 ns [ 110.721180][ T6297] (unnamed net_device) (uninitialized): option miimon: invalid value (18446744073709551615) [ 110.747575][ T6297] (unnamed net_device) (uninitialized): option miimon: allowed values 0 - 2147483647 [ 110.766944][ T24] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 110.790176][ T6299] kvm: requested 147504 ns i8254 timer period limited to 200000 ns [ 110.798681][ T6312] loop6: detected capacity change from 0 to 7 [ 110.820652][ T6312] Dev loop6: unable to read RDB block 7 [ 110.826268][ T6312] loop6: unable to read partition table [ 110.851980][ T6312] loop6: partition table beyond EOD, truncated [ 110.882314][ T6312] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 110.894849][ T6299] kvm: requested 38552 ns i8254 timer period limited to 200000 ns [ 110.926744][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 110.933940][ T24] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 110.943470][ T6299] kvm: requested 45257 ns i8254 timer period limited to 200000 ns [ 110.943782][ T24] usb 4-1: config 0 has no interface number 0 [ 110.977178][ T24] usb 4-1: config 0 interface 184 has no altsetting 0 [ 110.984238][ T6299] kvm: requested 191923 ns i8254 timer period limited to 200000 ns [ 110.996891][ T24] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 111.026264][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.044539][ T24] usb 4-1: Product: syz [ 111.049799][ T24] usb 4-1: Manufacturer: syz [ 111.054418][ T24] usb 4-1: SerialNumber: syz [ 111.092657][ T24] usb 4-1: config 0 descriptor?? [ 111.106686][ T48] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 111.128927][ T24] smsc75xx v1.0.0 [ 111.297407][ T48] usb 5-1: Using ep0 maxpacket: 16 [ 111.304939][ T48] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 111.340099][ T48] usb 5-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 111.357880][ T48] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.395688][ T48] usb 5-1: config 0 descriptor?? [ 111.415874][ T48] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input9 [ 111.619089][ T5223] bcm5974 5-1:0.0: could not read from device [ 111.664317][ T48] usb 5-1: USB disconnect, device number 5 [ 111.760974][ T24] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 111.779713][ T24] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 111.800061][ T24] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 111.817528][ T5939] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 111.817777][ T24] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 111.859613][ T24] usb 4-1: USB disconnect, device number 5 [ 111.977007][ T5939] usb 3-1: Using ep0 maxpacket: 32 [ 111.987464][ T5939] usb 3-1: too many configurations: 248, using maximum allowed: 8 [ 112.016345][ T5939] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 112.031527][ T5939] usb 3-1: can't read configurations, error -61 [ 112.166986][ T5939] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 112.281625][ T6338] loop2: detected capacity change from 0 to 7 [ 112.319765][ T6338] Dev loop2: unable to read RDB block 7 [ 112.325395][ T6338] loop2: unable to read partition table [ 112.336909][ T6338] loop2: partition table beyond EOD, truncated [ 112.337264][ T5939] usb 3-1: Using ep0 maxpacket: 32 [ 112.349681][ T6338] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 112.370686][ T5939] usb 3-1: too many configurations: 248, using maximum allowed: 8 [ 112.405697][ T5939] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 112.445089][ T5939] usb 3-1: can't read configurations, error -61 [ 112.452265][ T5939] usb usb3-port1: attempt power cycle [ 112.509415][ T6349] netlink: 'syz.1.95': attribute type 10 has an invalid length. [ 112.646851][ T10] IPVS: starting estimator thread 0... [ 112.781874][ T6353] IPVS: using max 25 ests per chain, 60000 per kthread [ 112.816760][ T5939] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 112.834264][ T6349] team0 (unregistering): Port device team_slave_0 removed [ 112.851016][ T5939] usb 3-1: Using ep0 maxpacket: 32 [ 112.860359][ T5939] usb 3-1: too many configurations: 248, using maximum allowed: 8 [ 112.879056][ T5939] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 112.879171][ T6349] team0 (unregistering): Port device team_slave_1 removed [ 112.891361][ T5939] usb 3-1: can't read configurations, error -61 [ 113.006670][ T5946] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 113.046667][ T5939] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 113.081035][ T5939] usb 3-1: Using ep0 maxpacket: 32 [ 113.092515][ T5939] usb 3-1: too many configurations: 248, using maximum allowed: 8 [ 113.115601][ T5939] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 113.131480][ T5939] usb 3-1: can't read configurations, error -61 [ 113.147059][ T5939] usb usb3-port1: unable to enumerate USB device [ 113.203802][ T5946] usb 2-1: Using ep0 maxpacket: 16 [ 113.227001][ T5946] usb 2-1: config 1 has an invalid interface number: 105 but max is 0 [ 113.241946][ T5946] usb 2-1: config 1 has no interface number 0 [ 113.260451][ T5946] usb 2-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 113.290750][ T5946] usb 2-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 113.326334][ T5946] usb 2-1: config 1 interface 105 has no altsetting 0 [ 113.353038][ T5946] usb 2-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 113.366584][ T5946] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.408872][ T5946] usb 2-1: Product: syz [ 113.413079][ T5946] usb 2-1: Manufacturer: syz [ 113.429313][ T5946] usb 2-1: SerialNumber: syz [ 113.449469][ T6350] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 113.460337][ T6350] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 113.806811][ T48] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 113.922802][ T6349] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 113.930389][ T6349] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 113.968562][ T48] usb 1-1: config 1 has an invalid interface number: 128 but max is 1 [ 113.986593][ T48] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 114.011027][ T48] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 114.041502][ T48] usb 1-1: config 1 has no interface number 0 [ 114.056687][ T48] usb 1-1: config 1 interface 128 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 114.071749][ T48] usb 1-1: config 1 interface 128 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 114.085352][ T48] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 114.098746][ T48] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.108651][ T48] usb 1-1: Product: syz [ 114.112824][ T48] usb 1-1: Manufacturer: syz [ 114.120213][ T48] usb 1-1: SerialNumber: syz [ 114.140494][ T48] cdc_wdm 1-1:1.128: skipping garbage [ 114.162512][ T48] cdc_wdm 1-1:1.128: cdc-wdm0: USB WDM device [ 114.168850][ T48] cdc_wdm 1-1:1.128: Unknown control protocol [ 114.290442][ T6382] block device autoloading is deprecated and will be removed. [ 114.572167][ T5946] aqc111 2-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 114.603977][ T5946] aqc111 2-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 114.754452][ T5946] aqc111 2-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.1-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 46:0b:d3:7c:d9:de [ 114.809690][ T5946] usb 2-1: USB disconnect, device number 9 [ 114.839197][ T5946] aqc111 2-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.1-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 115.167936][ T5946] aqc111 2-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 115.257374][ T5946] aqc111 2-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 115.390495][ T5946] aqc111 2-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 115.408959][ T48] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 115.572888][ T48] usb 4-1: config 0 has no interfaces? [ 115.591179][ T48] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 115.603062][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.613906][ T48] usb 4-1: Product: syz [ 115.620759][ T48] usb 4-1: Manufacturer: syz [ 115.625578][ T48] usb 4-1: SerialNumber: syz [ 115.653306][ T48] usb 4-1: config 0 descriptor?? [ 115.840036][ T6409] netlink: 148 bytes leftover after parsing attributes in process `syz.4.114'. [ 115.863527][ T6409] Context (ID=0x0) not attached to queue pair (handle=0x4db:0x0) [ 115.906783][ T5946] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 115.945995][ T6395] netlink: 32 bytes leftover after parsing attributes in process `syz.3.108'. [ 115.955387][ T6395] netlink: 32 bytes leftover after parsing attributes in process `syz.3.108'. [ 116.043950][ T6410] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 116.055215][ T6410] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 116.063445][ T5946] usb 2-1: Using ep0 maxpacket: 8 [ 116.099329][ T5946] usb 2-1: unable to get BOS descriptor or descriptor too short [ 116.110653][ T5946] usb 2-1: config 9 has an invalid interface number: 5 but max is 0 [ 116.119480][ T5946] usb 2-1: config 9 has no interface number 0 [ 116.125913][ T5946] usb 2-1: config 9 interface 5 altsetting 9 endpoint 0x9 has an invalid bInterval 181, changing to 7 [ 116.143594][ T5946] usb 2-1: config 9 interface 5 has no altsetting 0 [ 116.154110][ T5946] usb 2-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice=5d.a8 [ 116.163915][ T5946] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.211142][ T5946] usb 2-1: Product: syz [ 116.222152][ T5946] usb 2-1: Manufacturer: syz [ 116.234471][ T5946] usb 2-1: SerialNumber: syz [ 116.488832][ T5946] usb 2-1: USB disconnect, device number 10 [ 116.641426][ T10] usb 1-1: USB disconnect, device number 6 [ 116.754465][ T6417] loop2: detected capacity change from 0 to 7 [ 116.779566][ T6417] Dev loop2: unable to read RDB block 7 [ 116.785215][ T6417] loop2: unable to read partition table [ 116.796160][ T6417] loop2: partition table beyond EOD, truncated [ 116.814529][ T6417] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 116.977295][ T48] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 117.126741][ T48] usb 5-1: Using ep0 maxpacket: 8 [ 117.134071][ T48] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 117.145758][ T48] usb 5-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 117.163730][ T48] usb 5-1: config 0 interface 0 has no altsetting 0 [ 117.171727][ T48] usb 5-1: New USB device found, idVendor=0458, idProduct=4018, bcdDevice= 0.00 [ 117.181178][ T48] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.213956][ T48] usb 5-1: config 0 descriptor?? [ 117.738778][ T48] kye 0003:0458:4018.0002: unknown main item tag 0x0 [ 117.753288][ T48] kye 0003:0458:4018.0002: reserved main item tag 0xe [ 117.764612][ T48] kye 0003:0458:4018.0002: item fetching failed at offset 15/133 [ 117.851256][ T48] kye 0003:0458:4018.0002: parse failed [ 117.859085][ T48] kye 0003:0458:4018.0002: probe with driver kye failed with error -22 [ 118.003141][ T6418] (unnamed net_device) (uninitialized): option min_links: invalid value (18446744073709551608) [ 118.014031][ T6418] (unnamed net_device) (uninitialized): option min_links: allowed values 0 - 2147483647 [ 118.251407][ T5946] usb 4-1: USB disconnect, device number 6 [ 118.685371][ T5953] usb 5-1: USB disconnect, device number 6 [ 118.896917][ T48] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 119.096913][ T48] usb 1-1: Using ep0 maxpacket: 32 [ 119.108720][ T48] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 119.119454][ T48] usb 1-1: config 0 has no interface number 0 [ 119.126313][ T48] usb 1-1: config 0 interface 51 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 119.138038][ T48] usb 1-1: config 0 interface 51 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 119.154205][ T48] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 119.165490][ T48] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.175318][ T48] usb 1-1: Product: syz [ 119.180116][ T48] usb 1-1: Manufacturer: syz [ 119.184798][ T48] usb 1-1: SerialNumber: syz [ 119.203669][ T48] usb 1-1: config 0 descriptor?? [ 119.220152][ T48] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 119.422394][ T48] usb 1-1: qt2_setup_urbs - submit read urb failed -90 [ 119.430163][ T48] quatech2 1-1:0.51: probe with driver quatech2 failed with error -90 [ 119.846802][ T48] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 120.069491][ T48] usb 5-1: Using ep0 maxpacket: 32 [ 120.240284][ T48] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 120.249265][ T48] usb 5-1: config 0 has no interface number 0 [ 120.319674][ T48] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 120.329287][ T48] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.339157][ T48] usb 5-1: Product: syz [ 120.343484][ T48] usb 5-1: Manufacturer: syz [ 120.348367][ T48] usb 5-1: SerialNumber: syz [ 120.369566][ T48] usb 5-1: config 0 descriptor?? [ 120.377715][ T48] smsc95xx v2.0.0 [ 120.602598][ T48] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 120.634378][ T48] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 120.891308][ T48] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 120.960506][ T48] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 121.044909][ T48] usb 5-1: USB disconnect, device number 7 [ 121.136887][ T10] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 121.310399][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 121.320825][ T10] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 121.357087][ T10] usb 2-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 121.370195][ T5946] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 121.434923][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 121.450003][ T10] usb 2-1: New USB device found, idVendor=0458, idProduct=4018, bcdDevice= 0.00 [ 121.459597][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.476305][ T10] usb 2-1: config 0 descriptor?? [ 121.546652][ T48] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 121.596633][ T5946] usb 3-1: Using ep0 maxpacket: 8 [ 121.605092][ T5946] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 121.616961][ T5946] usb 3-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 121.631534][ T5946] usb 3-1: config 0 interface 0 has no altsetting 0 [ 121.638393][ T5946] usb 3-1: New USB device found, idVendor=0458, idProduct=4018, bcdDevice= 0.00 [ 121.675210][ T5946] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.715889][ T48] usb 5-1: device descriptor read/64, error -71 [ 121.731718][ T5946] usb 3-1: config 0 descriptor?? [ 121.908913][ T5965] usb 1-1: USB disconnect, device number 7 [ 121.956129][ T10] kye 0003:0458:4018.0003: unknown main item tag 0x0 [ 122.002744][ T10] kye 0003:0458:4018.0003: reserved main item tag 0xe [ 122.009931][ T48] usb 5-1: new full-speed USB device number 9 using dummy_hcd [ 122.025870][ T10] kye 0003:0458:4018.0003: item fetching failed at offset 15/133 [ 122.039050][ T10] kye 0003:0458:4018.0003: parse failed [ 122.044723][ T10] kye 0003:0458:4018.0003: probe with driver kye failed with error -22 [ 122.146673][ T48] usb 5-1: device descriptor read/64, error -71 [ 122.199451][ T6467] (unnamed net_device) (uninitialized): option min_links: invalid value (18446744073709551608) [ 122.224019][ T6467] (unnamed net_device) (uninitialized): option min_links: allowed values 0 - 2147483647 [ 122.257073][ T48] usb usb5-port1: attempt power cycle [ 122.358306][ T5946] kye 0003:0458:4018.0004: unknown main item tag 0x0 [ 122.365071][ T5946] kye 0003:0458:4018.0004: reserved main item tag 0xe [ 122.397274][ T5946] kye 0003:0458:4018.0004: item fetching failed at offset 15/133 [ 122.405830][ T5946] kye 0003:0458:4018.0004: parse failed [ 122.429329][ T5946] kye 0003:0458:4018.0004: probe with driver kye failed with error -22 [ 122.448101][ T5953] usb 2-1: USB disconnect, device number 11 [ 122.618140][ T48] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 122.654401][ T48] usb 5-1: device descriptor read/8, error -71 [ 122.665880][ T6473] (unnamed net_device) (uninitialized): option min_links: invalid value (18446744073709551608) [ 122.679518][ T6473] (unnamed net_device) (uninitialized): option min_links: allowed values 0 - 2147483647 [ 122.841744][ T5965] usb 3-1: USB disconnect, device number 13 [ 122.916659][ T48] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 122.992436][ T48] usb 5-1: device descriptor read/8, error -71 [ 123.036858][ T5996] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 123.108368][ T48] usb usb5-port1: unable to enumerate USB device [ 123.188827][ T5946] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 123.198529][ T5996] usb 1-1: config 0 has an invalid interface number: 235 but max is 0 [ 123.245325][ T5996] usb 1-1: config 0 has no interface number 0 [ 123.255054][ T5996] usb 1-1: config 0 interface 235 has no altsetting 0 [ 123.296890][ T5996] usb 1-1: New USB device found, idVendor=06cd, idProduct=0112, bcdDevice=3e.18 [ 123.349412][ T5996] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.456316][ T5946] usb 4-1: config 0 has no interfaces? [ 123.491988][ T5946] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 123.503442][ T5996] usb 1-1: Product: syz [ 123.503441][ T5946] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.503464][ T5946] usb 4-1: Product: syz [ 123.517149][ T5996] usb 1-1: Manufacturer: syz [ 123.534853][ T5996] usb 1-1: SerialNumber: syz [ 123.572589][ T5996] usb 1-1: config 0 descriptor?? [ 123.576749][ T5965] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 123.594679][ T5946] usb 4-1: Manufacturer: syz [ 123.603449][ T5946] usb 4-1: SerialNumber: syz [ 123.646217][ T5946] usb 4-1: config 0 descriptor?? [ 123.716356][ T30] audit: type=1326 audit(1755915508.868:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6501 comm="syz.2.139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c6518ebe9 code=0x7ffc0000 [ 123.741910][ T5965] usb 2-1: config index 0 descriptor too short (expected 39, got 27) [ 123.755942][ T5996] keyspan 1-1:0.235: Keyspan 1 port adapter converter detected [ 123.757490][ T5965] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 123.795678][ T5996] keyspan 1-1:0.235: found no endpoint descriptor for endpoint 87 [ 123.815965][ T5965] usb 2-1: config 0 interface 0 has no altsetting 0 [ 123.823954][ T30] audit: type=1326 audit(1755915508.868:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6501 comm="syz.2.139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7f2c6518ebe9 code=0x7ffc0000 [ 123.829026][ T5965] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 123.870381][ T5996] keyspan 1-1:0.235: found no endpoint descriptor for endpoint 7 [ 123.940808][ T5965] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 123.954350][ T5965] usb 2-1: Product: syz [ 123.961739][ T5996] keyspan 1-1:0.235: found no endpoint descriptor for endpoint 81 [ 123.962895][ T5965] usb 2-1: Manufacturer: syz [ 123.974768][ T5965] usb 2-1: SerialNumber: syz [ 123.996052][ T5965] usb 2-1: config 0 descriptor?? [ 124.001648][ T30] audit: type=1326 audit(1755915508.878:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6501 comm="syz.2.139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f2c6518ec23 code=0x7ffc0000 [ 124.043881][ T5996] keyspan 1-1:0.235: found no endpoint descriptor for endpoint 1 [ 124.053292][ T5996] keyspan 1-1:0.235: found no endpoint descriptor for endpoint 85 [ 124.076950][ T30] audit: type=1326 audit(1755915508.878:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6501 comm="syz.2.139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c6518ebe9 code=0x7ffc0000 [ 124.174167][ T5996] usb 1-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 124.206484][ T5965] hub 2-1:0.0: bad descriptor, ignoring hub [ 124.219931][ T5996] usb 1-1: USB disconnect, device number 8 [ 124.235850][ T30] audit: type=1326 audit(1755915508.888:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6501 comm="syz.2.139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f2c6518ebe9 code=0x7ffc0000 [ 124.273923][ T5996] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 124.292797][ T5965] hub 2-1:0.0: probe with driver hub failed with error -5 [ 124.326160][ T5965] usb 2-1: selecting invalid altsetting 0 [ 124.415688][ T6499] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 124.425357][ T5996] keyspan 1-1:0.235: device disconnected [ 124.431120][ T30] audit: type=1326 audit(1755915508.888:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6501 comm="syz.2.139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c6518ebe9 code=0x7ffc0000 [ 124.474359][ T6499] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 124.535066][ T6509] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1169731583 (18715705328 ns) > initial count (14827118032 ns). Using initial count to start timer. [ 124.562192][ T30] audit: type=1326 audit(1755915508.888:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6501 comm="syz.2.139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c6518ebe9 code=0x7ffc0000 [ 124.635784][ T30] audit: type=1326 audit(1755915508.888:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6501 comm="syz.2.139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c6518ebe9 code=0x7ffc0000 [ 125.016462][ T30] audit: type=1326 audit(1755915508.888:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6501 comm="syz.2.139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f2c6518e7eb code=0x7ffc0000 [ 125.097118][ T10] usb 2-1: USB disconnect, device number 12 [ 125.119076][ T30] audit: type=1326 audit(1755915508.888:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6501 comm="syz.2.139" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f2c6518e7eb code=0x7ffc0000 [ 125.730495][ T6532] tipc: Started in network mode [ 125.752018][ T6532] tipc: Node identity 168ba174a815, cluster identity 4711 [ 125.759742][ T6532] tipc: Enabled bearer , priority 0 [ 125.773196][ T6532] syzkaller0: entered promiscuous mode [ 125.780137][ T6532] syzkaller0: entered allmulticast mode [ 125.840093][ T6532] tipc: Resetting bearer [ 125.875187][ T6530] tipc: Resetting bearer [ 125.896871][ T10] usb 4-1: USB disconnect, device number 7 [ 125.964582][ T6530] tipc: Disabling bearer [ 126.045560][ T6538] netlink: 4 bytes leftover after parsing attributes in process `syz.0.150'. [ 126.252613][ T6544] gretap0: entered promiscuous mode [ 126.267877][ T6544] gretap0: left promiscuous mode [ 126.704815][ T6549] netlink: 'syz.2.152': attribute type 7 has an invalid length. [ 126.739285][ T6549] netlink: 'syz.2.152': attribute type 8 has an invalid length. [ 126.773704][ T6550] netlink: 60 bytes leftover after parsing attributes in process `syz.2.152'. [ 126.790513][ T6549] netlink: 8 bytes leftover after parsing attributes in process `syz.2.152'. [ 126.899962][ T6548] netlink: 60 bytes leftover after parsing attributes in process `syz.2.152'. [ 127.156179][ T6557] tipc: Enabling of bearer rejected, failed to enable media [ 127.608887][ T6572] trusted_key: syz.4.158 sent an empty control message without MSG_MORE. [ 127.634905][ T6572] sctp: [Deprecated]: syz.4.158 (pid 6572) Use of int in maxseg socket option. [ 127.634905][ T6572] Use struct sctp_assoc_value instead [ 128.508803][ T6586] fuse: Unknown parameter 'fd`0x0000000000000005' [ 128.942313][ T6595] netlink: 'syz.4.167': attribute type 1 has an invalid length. [ 129.009111][ T6595] 8021q: adding VLAN 0 to HW filter on device bond1 [ 129.142342][ T6599] bond1: (slave gretap1): making interface the new active one [ 129.233823][ T6599] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 129.456881][ T10] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 130.056996][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 130.131648][ T10] usb 3-1: New USB device found, idVendor=0403, idProduct=b8d8, bcdDevice=30.bb [ 130.156828][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.182293][ T10] usb 3-1: Product: syz [ 130.242612][ T10] usb 3-1: Manufacturer: syz [ 130.270747][ T10] usb 3-1: SerialNumber: syz [ 130.466621][ T5953] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 130.566198][ T6602] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.576315][ T6602] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.643010][ T5953] usb 4-1: Using ep0 maxpacket: 16 [ 130.652740][ T5953] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 130.670029][ T5953] usb 4-1: config 0 has no interface number 0 [ 130.688287][ T5953] usb 4-1: config 0 interface 34 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 130.745745][ T5953] usb 4-1: config 0 interface 34 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 130.807986][ T5953] usb 4-1: New USB device found, idVendor=046d, idProduct=c24f, bcdDevice= 0.00 [ 130.867823][ T5953] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.903658][ T5953] usb 4-1: config 0 descriptor?? [ 131.445738][ T6636] netlink: 4 bytes leftover after parsing attributes in process `syz.1.177'. [ 131.496018][ T6638] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 131.646941][ T5953] usb 4-1: USB disconnect, device number 8 [ 131.951977][ T10] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 132.068761][ T10] snd-usb-audio 3-1:222.0: probe with driver snd-usb-audio failed with error -71 [ 132.144835][ T5973] udevd[5973]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:222.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 132.187093][ T10] usb 3-1: USB disconnect, device number 14 [ 132.634910][ T6652] netlink: 'syz.4.185': attribute type 10 has an invalid length. [ 132.690771][ T6652] team0: Port device dummy0 added [ 132.707490][ T5953] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 132.715375][ T6653] netlink: 'syz.4.185': attribute type 10 has an invalid length. [ 132.819055][ T6652] capability: warning: `syz.4.185' uses deprecated v2 capabilities in a way that may be insecure [ 132.859533][ T6652] netlink: 8 bytes leftover after parsing attributes in process `syz.4.185'. [ 132.880020][ T6652] netlink: 20 bytes leftover after parsing attributes in process `syz.4.185'. [ 132.928067][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.934646][ T5953] usb 2-1: Using ep0 maxpacket: 32 [ 132.934658][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.978955][ T6653] team0: Port device dummy0 removed [ 132.987158][ T5953] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 133.038903][ T5953] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 133.049710][ T5953] usb 2-1: New USB device found, idVendor=0c45, idProduct=760b, bcdDevice= 0.00 [ 133.070174][ T6653] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 133.110931][ T5953] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.179273][ T6657] ip6tnl1: entered promiscuous mode [ 133.202103][ T5953] usb 2-1: config 0 descriptor?? [ 133.226332][ T6657] ip6tnl1: entered allmulticast mode [ 133.247501][ T6660] trusted_key: encrypted_key: master key parameter '' is invalid [ 133.676019][ T6672] input: syz0 as /devices/virtual/input/input11 [ 133.778700][ T5996] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 133.850861][ T6676] loop4: detected capacity change from 0 to 7 [ 133.943610][ T6676] loop4: [POWERTEC] p1 p2 p3 p4 p5 [ 133.952118][ T5953] redragon 0003:0C45:760B.0006: hidraw0: USB HID v0.02 Device [HID 0c45:760b] on usb-dummy_hcd.1-1/input0 [ 133.999242][ T5996] usb 5-1: Using ep0 maxpacket: 16 [ 134.006286][ T5996] usb 5-1: config 2 has an invalid interface number: 4 but max is 0 [ 134.014430][ T5996] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 134.030256][ T5996] usb 5-1: config 2 has no interface number 0 [ 134.038959][ T6676] loop4: p1 start 1600481121 is beyond EOD, truncated [ 134.081034][ T5996] usb 5-1: config 2 interface 4 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 134.126633][ T5996] usb 5-1: config 2 interface 4 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 134.162582][ T6676] loop4: p2 start 536870912 is beyond EOD, truncated [ 134.201614][ T5996] usb 5-1: New USB device found, idVendor=0499, idProduct=1018, bcdDevice=b2.da [ 134.211254][ T5996] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.226456][ T5996] usb 5-1: Product: syz [ 134.233466][ T6676] loop4: p3 start 2097152 is beyond EOD, truncated [ 134.245286][ T5996] usb 5-1: Manufacturer: syz [ 134.253715][ T5996] usb 5-1: SerialNumber: syz [ 134.266306][ T6676] loop4: p4 start 1310720 is beyond EOD, truncated [ 134.280782][ T5996] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 134.313588][ T6676] loop4: p5 start 791543808 is beyond EOD, truncated [ 134.418782][ T5996] snd-usb-audio 5-1:2.4: probe with driver snd-usb-audio failed with error -2 [ 134.482534][ T6665] warning: `syz.4.190' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 134.536622][ T5996] usb 5-1: USB disconnect, device number 12 [ 134.694790][ T5973] udevd[5973]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:2.4/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 135.117895][ T5996] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 135.198187][ T6688] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 135.303592][ T5996] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 135.320115][ T5996] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 135.336050][ T5996] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 135.353748][ T5996] usb 3-1: config 1 has no interface number 0 [ 135.370827][ T5996] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 135.399631][ T5996] usb 3-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 135.416752][ T24] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 135.520846][ T5996] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 135.586456][ T5996] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.600169][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 135.626702][ T24] usb 5-1: config 0 interface 0 has no altsetting 0 [ 135.636472][ T5996] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 135.659980][ T24] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 135.865231][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.874572][ T5996] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now attached [ 136.040387][ T24] usb 5-1: Product: syz [ 136.044640][ T24] usb 5-1: Manufacturer: syz [ 136.056935][ T24] usb 5-1: SerialNumber: syz [ 136.107891][ T24] usb 5-1: config 0 descriptor?? [ 136.210766][ T10] usb 2-1: USB disconnect, device number 13 [ 136.415028][ T5996] usb 3-1: USB disconnect, device number 15 [ 136.429326][ T5996] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 136.572996][ T24] gs_usb 5-1:0.0: Configuring for 1 interfaces [ 136.833856][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.897665][ T24] gs_usb 5-1:0.0: Couldn't get bit timing const for channel 0 (-EPROTO) [ 136.906396][ T24] gs_usb 5-1:0.0: probe with driver gs_usb failed with error -71 [ 136.957887][ T24] usb 5-1: USB disconnect, device number 13 [ 137.117972][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.229924][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.399232][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.551424][ T6707] bridge0: port 1(bridge_slave_0) entered disabled state [ 137.610432][ T6707] bridge0: port 2(bridge_slave_1) entered disabled state [ 137.620660][ T6714] netlink: 'syz.1.202': attribute type 16 has an invalid length. [ 137.637174][ T6714] netlink: 'syz.1.202': attribute type 17 has an invalid length. [ 137.746912][ T5997] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 137.768759][ T6722] loop3: detected capacity change from 0 to 1 [ 137.791780][ T6722] Dev loop3: unable to read RDB block 1 [ 137.829508][ T6722] loop3: unable to read partition table [ 137.835400][ T6722] loop3: partition table beyond EOD, truncated [ 137.882039][ T6722] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 137.904885][ T6714] bridge0: port 1(bridge_slave_0) entered blocking state [ 137.912429][ T6714] bridge0: port 1(bridge_slave_0) entered forwarding state [ 137.926752][ T5997] usb 1-1: Using ep0 maxpacket: 32 [ 137.946825][ T5997] usb 1-1: config 0 has an invalid interface number: 89 but max is 0 [ 137.976184][ T6714] bridge0: port 2(bridge_slave_1) entered blocking state [ 137.983452][ T6714] bridge0: port 2(bridge_slave_1) entered forwarding state [ 137.996243][ T5997] usb 1-1: config 0 has no interface number 0 [ 138.041413][ T5997] usb 1-1: config 0 interface 89 has no altsetting 0 [ 138.081981][ T5997] usb 1-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 138.109756][ T5997] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.155327][ T5997] usb 1-1: Product: syz [ 138.174680][ T5997] usb 1-1: Manufacturer: syz [ 138.197843][ T6729] netlink: 40 bytes leftover after parsing attributes in process `syz.2.207'. [ 138.207084][ T5997] usb 1-1: SerialNumber: syz [ 138.236227][ T5997] usb 1-1: config 0 descriptor?? [ 138.300865][ T5997] em28xx 1-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 138.336320][ T5997] em28xx 1-1:0.89: Video interface 89 found: bulk [ 138.606997][ T10] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 138.625429][ T5866] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 138.644933][ T5866] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 138.663142][ T5866] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 138.683075][ T5866] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 138.690994][ T5866] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 138.737933][ T13] bridge_slave_1: left allmulticast mode [ 138.776658][ T10] usb 5-1: device descriptor read/64, error -71 [ 138.784735][ T13] bridge_slave_1: left promiscuous mode [ 138.816807][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.024247][ T5997] em28xx 1-1:0.89: unknown em28xx chip ID (0) [ 139.121068][ T13] bridge_slave_0: left allmulticast mode [ 139.155853][ T13] bridge_slave_0: left promiscuous mode [ 139.161802][ T10] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 139.189466][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 139.299331][ T5946] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 139.367037][ T10] usb 5-1: device descriptor read/64, error -71 [ 139.503402][ T10] usb usb5-port1: attempt power cycle [ 139.566763][ T5946] usb 3-1: Using ep0 maxpacket: 32 [ 139.620217][ T5946] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 139.662218][ T5946] usb 3-1: config 0 has no interface number 0 [ 139.798778][ T5946] usb 3-1: config 0 interface 184 has no altsetting 0 [ 139.911275][ T5946] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 139.926359][ T5946] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.945912][ T5946] usb 3-1: Product: syz [ 139.959222][ T5946] usb 3-1: Manufacturer: syz [ 139.963852][ T5946] usb 3-1: SerialNumber: syz [ 139.979371][ T10] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 139.988986][ T5997] em28xx 1-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 140.027403][ T5997] em28xx 1-1:0.89: board has no eeprom [ 140.107612][ T5946] usb 3-1: config 0 descriptor?? [ 140.127077][ T5997] em28xx 1-1:0.89: Identified as Terratec Grabby (card=67) [ 140.127190][ T10] usb 5-1: device descriptor read/8, error -71 [ 140.169391][ T5946] smsc75xx v1.0.0 [ 140.173082][ T5946] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 140.202887][ T5997] em28xx 1-1:0.89: analog set to bulk mode. [ 140.221851][ T5946] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -22 [ 140.263846][ T5996] em28xx 1-1:0.89: Registering V4L2 extension [ 140.302758][ T5997] usb 1-1: USB disconnect, device number 9 [ 140.348128][ T5997] em28xx 1-1:0.89: Disconnecting em28xx [ 140.400119][ T5996] em28xx 1-1:0.89: Config register raw data: 0xffffffed [ 140.426093][ T5996] em28xx 1-1:0.89: AC97 chip type couldn't be determined [ 140.426690][ T10] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 140.436918][ T5996] em28xx 1-1:0.89: No AC97 audio processor [ 140.475195][ T10] usb 5-1: device descriptor read/8, error -71 [ 140.536854][ T5996] usb 1-1: Decoder not found [ 140.541493][ T5996] em28xx 1-1:0.89: failed to create media graph [ 140.576597][ T5996] em28xx 1-1:0.89: V4L2 device video103 deregistered [ 140.598246][ T10] usb usb5-port1: unable to enumerate USB device [ 140.657984][ T5996] em28xx 1-1:0.89: Registering snapshot button... [ 140.721536][ T5996] input: em28xx snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.89/input/input12 [ 140.752501][ T5877] Bluetooth: hci1: command tx timeout [ 140.786805][ T5996] em28xx 1-1:0.89: Remote control support is not available for this card. [ 140.796806][ T5997] em28xx 1-1:0.89: Closing input extension [ 140.803299][ T5997] em28xx 1-1:0.89: Deregistering snapshot button [ 141.116400][ T5997] em28xx 1-1:0.89: Freeing device [ 141.594984][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 141.614816][ T13] bond_slave_0: left promiscuous mode [ 141.652317][ T13] bond_slave_0: left allmulticast mode [ 141.679200][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 141.690711][ T13] bond_slave_1: left promiscuous mode [ 141.697953][ T13] bond_slave_1: left allmulticast mode [ 141.717765][ T13] bond0 (unregistering): Released all slaves [ 141.835677][ T6739] netlink: 28 bytes leftover after parsing attributes in process `syz.2.209'. [ 141.886929][ T6754] netlink: 20 bytes leftover after parsing attributes in process `syz.1.211'. [ 142.029861][ T6762] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 142.065623][ T6762] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 142.092350][ T6762] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 142.107985][ T6762] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 142.306917][ T10] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 142.482610][ T5965] usb 3-1: USB disconnect, device number 16 [ 142.500144][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 142.543274][ T10] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 142.559208][ T10] usb 2-1: can't read configurations, error -61 [ 142.717587][ T10] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 142.731177][ T6789] loop3: detected capacity change from 0 to 1 [ 142.771776][ T5973] Dev loop3: unable to read RDB block 1 [ 142.809076][ T5973] loop3: unable to read partition table [ 142.820586][ T5973] loop3: partition table beyond EOD, truncated [ 142.833615][ T5877] Bluetooth: hci1: command tx timeout [ 142.852759][ T6789] Dev loop3: unable to read RDB block 1 [ 142.879838][ T6789] loop3: unable to read partition table [ 142.916836][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 142.938383][ T6789] loop3: partition table beyond EOD, truncated [ 142.939158][ T10] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 142.953623][ T10] usb 2-1: can't read configurations, error -61 [ 142.962841][ T6789] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 142.964064][ T6786] netlink: 12 bytes leftover after parsing attributes in process `syz.2.216'. [ 142.975539][ T10] usb usb2-port1: attempt power cycle [ 142.996863][ T5965] usb 3-1: new low-speed USB device number 17 using dummy_hcd [ 143.151919][ T6798] FAULT_INJECTION: forcing a failure. [ 143.151919][ T6798] name failslab, interval 1, probability 0, space 0, times 1 [ 143.210178][ T6798] CPU: 0 UID: 0 PID: 6798 Comm: syz.4.218 Not tainted syzkaller #0 PREEMPT(full) [ 143.210207][ T6798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 143.210226][ T6798] Call Trace: [ 143.210234][ T6798] [ 143.210243][ T6798] dump_stack_lvl+0x189/0x250 [ 143.210274][ T6798] ? lockdep_hardirqs_on+0x9c/0x150 [ 143.210301][ T6798] ? __pfx_dump_stack_lvl+0x10/0x10 [ 143.210336][ T6798] should_fail_ex+0x414/0x560 [ 143.210365][ T6798] should_failslab+0xa8/0x100 [ 143.210394][ T6798] __kmalloc_noprof+0xcb/0x4f0 [ 143.210418][ T6798] ? tomoyo_encode+0x28b/0x550 [ 143.210439][ T6798] tomoyo_encode+0x28b/0x550 [ 143.210463][ T6798] tomoyo_mount_permission+0x44d/0x970 [ 143.210494][ T6798] ? tomoyo_mount_permission+0x27a/0x970 [ 143.210523][ T6798] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 143.210620][ T6798] security_sb_mount+0xec/0x350 [ 143.210642][ T6798] path_mount+0xbc/0xfe0 [ 143.210667][ T6798] ? user_path_at+0x44/0x60 [ 143.210687][ T6798] ? kmem_cache_free+0x18f/0x400 [ 143.210720][ T6798] __se_sys_mount+0x317/0x410 [ 143.210753][ T6798] ? __pfx___se_sys_mount+0x10/0x10 [ 143.210786][ T6798] ? do_syscall_64+0xbe/0x3b0 [ 143.210811][ T6798] ? __x64_sys_mount+0x20/0xc0 [ 143.210840][ T6798] do_syscall_64+0xfa/0x3b0 [ 143.210866][ T6798] ? lockdep_hardirqs_on+0x9c/0x150 [ 143.210891][ T6798] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.210909][ T6798] ? clear_bhb_loop+0x60/0xb0 [ 143.210933][ T6798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.210950][ T6798] RIP: 0033:0x7fbe2c98ebe9 [ 143.210971][ T6798] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 143.210988][ T6798] RSP: 002b:00007fbe2d890038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 143.211007][ T6798] RAX: ffffffffffffffda RBX: 00007fbe2cbb6090 RCX: 00007fbe2c98ebe9 [ 143.211026][ T6798] RDX: 0000200000000000 RSI: 00002000000020c0 RDI: 0000000000000000 [ 143.211039][ T6798] RBP: 00007fbe2d890090 R08: 0000200000000240 R09: 0000000000000000 [ 143.211052][ T6798] R10: 0000000000800000 R11: 0000000000000246 R12: 0000000000000002 [ 143.211062][ T6798] R13: 00007fbe2cbb6128 R14: 00007fbe2cbb6090 R15: 00007fbe2ccdfa28 [ 143.211094][ T6798] [ 143.436696][ C0] vkms_vblank_simulate: vblank timer overrun [ 143.566645][ T10] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 143.587573][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 143.594784][ T10] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 143.602501][ T10] usb 2-1: can't read configurations, error -61 [ 143.736865][ T10] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 143.776900][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 143.797283][ T10] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 143.804913][ T10] usb 2-1: can't read configurations, error -61 [ 143.820999][ T10] usb usb2-port1: unable to enumerate USB device [ 143.879909][ T5997] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 144.046925][ T5997] usb 1-1: Using ep0 maxpacket: 16 [ 144.055531][ T13] hsr_slave_0: left promiscuous mode [ 144.067245][ T13] hsr_slave_1: left promiscuous mode [ 144.077328][ T5997] usb 1-1: config 92 has an invalid descriptor of length 139, skipping remainder of the config [ 144.089159][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 144.096628][ T5997] usb 1-1: config 92 has 0 interfaces, different from the descriptor's value: 3 [ 144.099061][ T5997] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 144.156013][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 144.163699][ T5997] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.183975][ T5997] usb 1-1: Product: syz [ 144.201098][ T5997] usb 1-1: Manufacturer: syz [ 144.202493][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 144.213758][ T5997] usb 1-1: SerialNumber: syz [ 144.238975][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 144.333121][ T13] veth1_macvtap: left promiscuous mode [ 144.356112][ T13] veth0_macvtap: left promiscuous mode [ 144.376050][ T13] veth1_vlan: left promiscuous mode [ 144.399181][ T13] veth0_vlan: left promiscuous mode [ 144.916175][ T5877] Bluetooth: hci1: command tx timeout [ 145.570122][ T13] team0 (unregistering): Port device team_slave_1 removed [ 145.624106][ T13] team0 (unregistering): Port device team_slave_0 removed [ 145.896746][ T5953] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 146.073026][ T5953] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 146.084628][ T5953] usb 5-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 146.093951][ T5953] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.112853][ T5953] usb 5-1: config 0 descriptor?? [ 146.225818][ T6804] pim6reg1: entered promiscuous mode [ 146.238252][ T6804] pim6reg1: entered allmulticast mode [ 146.417228][ T6737] chnl_net:caif_netlink_parms(): no params data found [ 146.429305][ T982] usb 1-1: USB disconnect, device number 11 [ 146.565721][ T5953] logitech 0003:046D:C295.0007: item fetching failed at offset 8/11 [ 146.623874][ T5953] logitech 0003:046D:C295.0007: parse failed [ 146.685774][ T5953] logitech 0003:046D:C295.0007: probe with driver logitech failed with error -22 [ 146.783197][ T5953] usb 5-1: USB disconnect, device number 18 [ 146.989417][ T5877] Bluetooth: hci1: command tx timeout [ 147.051678][ T6845] loop9: detected capacity change from 0 to 7 [ 147.097082][ T6845] Dev loop9: unable to read RDB block 7 [ 147.135700][ T6845] loop9: unable to read partition table [ 147.144765][ T6845] loop9: partition table beyond EOD, truncated [ 147.160649][ T6845] loop_reread_partitions: partition scan of loop9 (被x ) failed (rc=-5) [ 147.328403][ T6853] fuse: Bad value for 'fd' [ 147.380128][ T6853] netlink: 20 bytes leftover after parsing attributes in process `syz.0.229'. [ 147.483653][ T6737] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.513647][ T6737] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.517221][ T6863] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 147.534303][ T6737] bridge_slave_0: entered allmulticast mode [ 147.540877][ T6863] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 147.557259][ T6737] bridge_slave_0: entered promiscuous mode [ 147.645003][ T6737] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.693049][ T6737] bridge0: port 2(bridge_slave_1) entered disabled state [ 147.729809][ T6737] bridge_slave_1: entered allmulticast mode [ 147.762582][ T6737] bridge_slave_1: entered promiscuous mode [ 148.002635][ T6737] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 148.066426][ T6737] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 148.139820][ T6737] team0: Port device team_slave_0 added [ 148.167770][ T5953] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 148.379731][ T6737] team0: Port device team_slave_1 added [ 148.459458][ T5953] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 148.470304][ T5953] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 148.501702][ T5953] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 148.548350][ T5953] usb 1-1: New USB device found, idVendor=2040, idProduct=2000, bcdDevice=65.72 [ 148.580858][ T5953] usb 1-1: New USB device strings: Mfr=151, Product=0, SerialNumber=0 [ 148.654097][ T5953] usb 1-1: Manufacturer: syz [ 148.804964][ T5953] usb 1-1: config 0 descriptor?? [ 148.843663][ T5953] smsusb:smsusb_probe: board id=9, interface number 0 [ 148.861727][ T5953] smsusb:smsusb_probe: Device initialized with return code -19 [ 149.013969][ T6737] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 149.042711][ T6737] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 149.100003][ T6737] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 149.113094][ T6737] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 149.189888][ T6893] netlink: 'syz.2.235': attribute type 10 has an invalid length. [ 149.630048][ T5953] usb 1-1: USB disconnect, device number 12 [ 149.711451][ T6737] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 149.738047][ T6737] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 150.081322][ T6893] team0: Port device netdevsim0 added [ 150.568044][ T6737] hsr_slave_0: entered promiscuous mode [ 150.701067][ T6737] hsr_slave_1: entered promiscuous mode [ 150.850111][ T6918] netlink: 4 bytes leftover after parsing attributes in process `syz.1.237'. [ 150.878999][ T6915] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(8) [ 150.885670][ T6915] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 151.216808][ T6915] vhci_hcd vhci_hcd.0: Device attached [ 151.309703][ T6920] netlink: 4 bytes leftover after parsing attributes in process `syz.2.241'. [ 151.384622][ T6916] vhci_hcd: connection closed [ 151.425263][ T3511] vhci_hcd: stop threads [ 151.451012][ T982] usb 36-1: SetAddress Request (2) to port 0 [ 151.460212][ T3511] vhci_hcd: release socket [ 151.476162][ T982] usb 36-1: new SuperSpeed USB device number 2 using vhci_hcd [ 151.491179][ T3511] vhci_hcd: disconnect device [ 151.507534][ T6924] FAULT_INJECTION: forcing a failure. [ 151.507534][ T6924] name failslab, interval 1, probability 0, space 0, times 0 [ 151.520815][ T982] usb 36-1: enqueue for inactive port 0 [ 151.620289][ T6924] CPU: 0 UID: 0 PID: 6924 Comm: syz.4.242 Not tainted syzkaller #0 PREEMPT(full) [ 151.620316][ T6924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 151.620328][ T6924] Call Trace: [ 151.620335][ T6924] [ 151.620343][ T6924] dump_stack_lvl+0x189/0x250 [ 151.620372][ T6924] ? __pfx____ratelimit+0x10/0x10 [ 151.620398][ T6924] ? __pfx_dump_stack_lvl+0x10/0x10 [ 151.620419][ T6924] ? __pfx__printk+0x10/0x10 [ 151.620449][ T6924] ? __pfx___might_resched+0x10/0x10 [ 151.620472][ T6924] should_fail_ex+0x414/0x560 [ 151.620500][ T6924] should_failslab+0xa8/0x100 [ 151.620529][ T6924] __kmalloc_node_noprof+0xd1/0x4e0 [ 151.620554][ T6924] ? alloc_slab_obj_exts+0x39/0xa0 [ 151.620584][ T6924] alloc_slab_obj_exts+0x39/0xa0 [ 151.620607][ T6924] __memcg_slab_post_alloc_hook+0x31e/0x7f0 [ 151.620641][ T6924] ? kasan_unpoison+0x48/0x70 [ 151.620666][ T6924] __kmalloc_cache_noprof+0x2d2/0x3d0 [ 151.620692][ T6924] ? alloc_fs_context+0x61/0x7d0 [ 151.620725][ T6924] alloc_fs_context+0x61/0x7d0 [ 151.620752][ T6924] ? do_raw_read_unlock+0x3d/0x80 [ 151.620774][ T6924] ? _raw_read_unlock+0x28/0x50 [ 151.620797][ T6924] ? get_fs_type+0x407/0x480 [ 151.620821][ T6924] do_new_mount+0x16f/0x9e0 [ 151.620852][ T6924] ? ns_capable+0x8a/0xf0 [ 151.620870][ T6924] ? __pfx_do_new_mount+0x10/0x10 [ 151.620897][ T6924] ? path_mount+0x61c/0xfe0 [ 151.620921][ T6924] ? user_path_at+0x44/0x60 [ 151.620950][ T6924] __se_sys_mount+0x317/0x410 [ 151.620981][ T6924] ? __pfx___se_sys_mount+0x10/0x10 [ 151.621007][ T6924] ? rcu_is_watching+0x15/0xb0 [ 151.621030][ T6924] ? do_syscall_64+0xbe/0x3b0 [ 151.621056][ T6924] ? __x64_sys_mount+0x20/0xc0 [ 151.621086][ T6924] do_syscall_64+0xfa/0x3b0 [ 151.621112][ T6924] ? lockdep_hardirqs_on+0x9c/0x150 [ 151.621138][ T6924] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.621153][ T6924] ? clear_bhb_loop+0x60/0xb0 [ 151.621175][ T6924] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.621191][ T6924] RIP: 0033:0x7fbe2c98ebe9 [ 151.621204][ T6924] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 151.621217][ T6924] RSP: 002b:00007fbe2d8b1038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 151.621233][ T6924] RAX: ffffffffffffffda RBX: 00007fbe2cbb5fa0 RCX: 00007fbe2c98ebe9 [ 151.621247][ T6924] RDX: 0000200000000000 RSI: 00002000000020c0 RDI: 0000000000000000 [ 151.621268][ T6924] RBP: 00007fbe2d8b1090 R08: 0000200000000240 R09: 0000000000000000 [ 151.621280][ T6924] R10: 0000000000800000 R11: 0000000000000246 R12: 0000000000000002 [ 151.621290][ T6924] R13: 00007fbe2cbb6038 R14: 00007fbe2cbb5fa0 R15: 00007fbe2ccdfa28 [ 151.621318][ T6924] [ 152.226340][ T6932] syz.4.247 uses obsolete (PF_INET,SOCK_PACKET) [ 152.233817][ T5953] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 152.303279][ T982] usb usb36-port1: attempt power cycle [ 152.400738][ T5953] usb 2-1: config 1 has an invalid descriptor of length 225, skipping remainder of the config [ 152.424778][ T5953] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 152.458862][ T5953] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 152.479303][ T5953] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 152.502047][ T5953] usb 2-1: SerialNumber: syz [ 152.632900][ T6949] loop3: detected capacity change from 0 to 1 [ 152.645400][ T5925] Dev loop3: unable to read RDB block 1 [ 152.654838][ T5925] loop3: unable to read partition table [ 152.664329][ T5925] loop3: partition table beyond EOD, truncated [ 152.682752][ T6949] Dev loop3: unable to read RDB block 1 [ 152.693199][ T6949] loop3: unable to read partition table [ 152.700687][ T6949] loop3: partition table beyond EOD, truncated [ 152.711188][ T6949] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 152.760735][ T5953] usb 2-1: 0:2 : does not exist [ 152.774982][ T5953] usb 2-1: unit 198 not found! [ 152.863476][ T5953] usb 2-1: USB disconnect, device number 18 [ 152.894693][ T982] usb usb36-port1: unable to enumerate USB device [ 153.003761][ T5973] udevd[5973]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 153.281659][ T982] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 153.353172][ T6737] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 153.488259][ T6737] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 153.519262][ T982] usb 5-1: config 160 has an invalid interface number: 200 but max is 0 [ 153.547080][ T982] usb 5-1: config 160 has no interface number 0 [ 153.564253][ T982] usb 5-1: config 160 interface 200 has no altsetting 0 [ 153.568655][ T6737] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 153.589486][ T982] usb 5-1: New USB device found, idVendor=21bb, idProduct=2070, bcdDevice=87.0b [ 153.615273][ T982] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.630664][ T6737] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 153.651522][ T982] usb 5-1: Product: syz [ 153.655739][ T982] usb 5-1: Manufacturer: syz [ 153.693522][ T982] usb 5-1: SerialNumber: syz [ 153.777895][ T5953] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 153.953142][ T5953] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 153.984128][ T5953] usb 2-1: New USB device found, idVendor=258a, idProduct=6a88, bcdDevice= 0.00 [ 154.026270][ T5953] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.041577][ T6737] 8021q: adding VLAN 0 to HW filter on device bond0 [ 154.062117][ T5953] usb 2-1: config 0 descriptor?? [ 154.082837][ T982] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 154.106125][ T982] usb 5-1: MIDIStreaming interface descriptor not found [ 154.186352][ T6737] 8021q: adding VLAN 0 to HW filter on device team0 [ 154.228638][ T982] usb 5-1: USB disconnect, device number 19 [ 154.273530][ T3511] bridge0: port 1(bridge_slave_0) entered blocking state [ 154.280782][ T3511] bridge0: port 1(bridge_slave_0) entered forwarding state [ 154.312223][ T3511] bridge0: port 2(bridge_slave_1) entered blocking state [ 154.319422][ T3511] bridge0: port 2(bridge_slave_1) entered forwarding state [ 154.386448][ T6293] udevd[6293]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:160.200/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 154.520434][ T7010] netlink: 'syz.0.260': attribute type 71 has an invalid length. [ 154.564327][ T7012] netlink: 'syz.0.260': attribute type 71 has an invalid length. [ 154.575844][ T7011] syzkaller1: entered promiscuous mode [ 154.623786][ T5953] itetech 0003:258A:6A88.0008: hidraw0: USB HID v0.00 Device [HID 258a:6a88] on usb-dummy_hcd.1-1/input0 [ 154.633969][ T7011] syzkaller1: entered allmulticast mode [ 154.732070][ T6737] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 154.844711][ T5996] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 154.956391][ T6737] veth0_vlan: entered promiscuous mode [ 154.995303][ T6737] veth1_vlan: entered promiscuous mode [ 155.026970][ T5996] usb 1-1: config 0 interface 0 altsetting 15 endpoint 0x81 has invalid wMaxPacketSize 0 [ 155.028352][ T7020] loop2: detected capacity change from 0 to 7 [ 155.052176][ T5973] Dev loop2: unable to read RDB block 7 [ 155.058261][ T5973] loop2: unable to read partition table [ 155.058340][ T5996] usb 1-1: config 0 interface 0 altsetting 15 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 155.064268][ T5973] loop2: partition table beyond EOD, truncated [ 155.099744][ T7020] Dev loop2: unable to read RDB block 7 [ 155.108883][ T7020] loop2: unable to read partition table [ 155.121792][ T7020] loop2: partition table beyond EOD, truncated [ 155.141428][ T7020] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 155.146583][ T5996] usb 1-1: config 0 interface 0 has no altsetting 0 [ 155.164663][ T6737] veth0_macvtap: entered promiscuous mode [ 155.175441][ T5996] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2c2e, bcdDevice= 0.00 [ 155.205280][ T5996] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 155.218447][ T6737] veth1_macvtap: entered promiscuous mode [ 155.238082][ T5996] usb 1-1: config 0 descriptor?? [ 155.296471][ T6737] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 155.342858][ T6737] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 155.432649][ T59] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.459404][ T24] usb 2-1: USB disconnect, device number 19 [ 155.467611][ T5996] usb 1-1: string descriptor 0 read error: -71 [ 155.482438][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.499608][ T5996] usbhid 1-1:0.0: can't add hid device: -71 [ 155.506006][ T5996] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 155.554943][ T5996] usb 1-1: USB disconnect, device number 13 [ 155.566440][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.593119][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.708169][ T7026] netlink: 24 bytes leftover after parsing attributes in process `syz.2.264'. [ 156.038201][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 156.067722][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 156.211152][ T202] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 156.243181][ T202] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 156.337979][ T7050] netlink: 8 bytes leftover after parsing attributes in process `syz.4.268'. [ 156.867081][ T982] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 157.017801][ T5856] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 157.028979][ T5996] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 157.079971][ T982] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD6, changing to 0x86 [ 157.101255][ T982] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 157.192055][ T982] usb 4-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24 [ 157.207469][ T982] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.235874][ T982] usb 4-1: Product: syz [ 157.249049][ T982] usb 4-1: Manufacturer: syz [ 157.249977][ T5996] usb 5-1: unable to get BOS descriptor or descriptor too short [ 157.274236][ T7074] pimreg: entered allmulticast mode [ 157.285396][ T5996] usb 5-1: not running at top speed; connect to a high speed hub [ 157.296395][ T982] usb 4-1: SerialNumber: syz [ 157.321028][ T982] usb 4-1: config 0 descriptor?? [ 157.325266][ T5996] usb 5-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 157.355351][ T5996] usb 5-1: config 7 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 157.428269][ T5996] usb 5-1: New USB device found, idVendor=0489, idProduct=e0b5, bcdDevice=ae.2a [ 157.452700][ T5996] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.456093][ T7082] netlink: 'syz.2.276': attribute type 1 has an invalid length. [ 157.462286][ T7080] loop2: detected capacity change from 0 to 7 [ 157.481714][ T7080] Dev loop2: unable to read RDB block 7 [ 157.486140][ T5996] usb 5-1: Product: syz [ 157.500036][ T5996] usb 5-1: Manufacturer: syz [ 157.506825][ T5996] usb 5-1: SerialNumber: syz [ 157.529581][ T7080] loop2: unable to read partition table [ 157.619358][ T7080] loop2: partition table beyond EOD, truncated [ 157.633589][ T7089] netlink: 40 bytes leftover after parsing attributes in process `syz.3.200'. [ 157.676672][ T7080] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 157.702151][ T7082] 8021q: adding VLAN 0 to HW filter on device bond1 [ 157.744355][ T7063] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 157.760084][ T7063] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 157.971707][ T7063] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 158.020513][ T7063] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 158.046636][ T7103] netlink: 20 bytes leftover after parsing attributes in process `syz.1.279'. [ 158.076494][ T7103] netlink: 8 bytes leftover after parsing attributes in process `syz.1.279'. [ 158.113552][ T5996] usb 5-1: USB disconnect, device number 20 [ 158.330800][ T7105] sch_fq: defrate 16 ignored. [ 158.341861][ T5997] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 158.518432][ T5997] usb 3-1: config 0 has no interfaces? [ 158.530889][ T5997] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 158.613696][ T5997] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.710587][ T5997] usb 3-1: Product: syz [ 158.733636][ T5997] usb 3-1: Manufacturer: syz [ 158.850245][ T5997] usb 3-1: SerialNumber: syz [ 158.888634][ T5997] usb 3-1: config 0 descriptor?? [ 159.761023][ T7132] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 159.773087][ T982] powermate: unknown product id 0240 [ 159.789031][ T7132] syzkaller1: linktype set to 774 [ 159.852564][ T982] input: Griffin SoundKnob as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input13 [ 159.928494][ C0] powermate: config urb returned -71 [ 159.934028][ C0] powermate: config urb returned -71 [ 159.939566][ C0] powermate: config urb returned -71 [ 159.946230][ C0] powermate: config urb returned -71 [ 159.973353][ T982] usb 4-1: USB disconnect, device number 9 [ 159.979578][ C0] powermate 4-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 160.159506][ T7146] netlink: 204 bytes leftover after parsing attributes in process `syz.0.285'. [ 160.961334][ T5996] usb 3-1: USB disconnect, device number 18 [ 161.021147][ T7158] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 162.144584][ T7181] netlink: 32 bytes leftover after parsing attributes in process `syz.3.290'. [ 162.286991][ T7188] netlink: 14 bytes leftover after parsing attributes in process `syz.2.291'. [ 162.956758][ T5997] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 163.149488][ T5997] usb 2-1: Using ep0 maxpacket: 8 [ 163.171953][ T5997] usb 2-1: config 0 has an invalid interface number: 151 but max is 1 [ 163.183058][ T5997] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 163.210084][ T5997] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 163.237155][ T5997] usb 2-1: config 0 has no interface number 0 [ 163.265262][ T5997] usb 2-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 163.276862][ T5997] usb 2-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 163.313209][ T7188] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 163.327132][ T5997] usb 2-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 210 [ 163.356672][ T5997] usb 2-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 163.380893][ T7188] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 163.418623][ T5997] usb 2-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 163.428057][ T5997] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.439892][ T7188] bond0 (unregistering): Released all slaves [ 163.456974][ T5997] usb 2-1: Product: syz [ 163.471561][ T5997] usb 2-1: Manufacturer: syz [ 163.476208][ T5997] usb 2-1: SerialNumber: syz [ 163.519255][ T7178] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 163.564914][ T7178] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 163.597692][ T5997] usb 2-1: config 0 descriptor?? [ 163.605814][ T7203] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 163.650930][ T5997] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 163.715517][ T7178] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 163.722735][ T7178] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 163.839483][ T5997] usb 2-1: USB disconnect, device number 20 [ 163.914956][ T7178] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 163.932888][ T7178] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 164.034017][ T7178] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 164.049473][ T7178] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 165.193856][ T7178] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 165.200093][ T7178] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 165.389034][ T7237] netlink: 8 bytes leftover after parsing attributes in process `syz.0.300'. [ 166.167824][ T7262] netlink: 'syz.0.305': attribute type 2 has an invalid length. [ 166.175729][ T7262] netlink: 723 bytes leftover after parsing attributes in process `syz.0.305'. [ 166.426872][ T5953] usb 1-1: new low-speed USB device number 14 using dummy_hcd [ 166.546273][ T7281] loop2: detected capacity change from 0 to 7 [ 166.555415][ T5973] Dev loop2: unable to read RDB block 7 [ 166.561850][ T5973] loop2: unable to read partition table [ 166.572124][ T5973] loop2: partition table beyond EOD, truncated [ 166.578474][ T5953] usb 1-1: Invalid ep0 maxpacket: 64 [ 166.589825][ T7281] Dev loop2: unable to read RDB block 7 [ 166.596392][ T7281] loop2: unable to read partition table [ 166.602683][ T7281] loop2: partition table beyond EOD, truncated [ 166.617042][ T7281] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 166.707905][ T5953] usb 1-1: new low-speed USB device number 15 using dummy_hcd [ 166.876930][ T5953] usb 1-1: Invalid ep0 maxpacket: 64 [ 166.885396][ T5953] usb usb1-port1: attempt power cycle [ 167.015262][ T7300] netlink: 20 bytes leftover after parsing attributes in process `syz.2.312'. [ 167.076981][ T982] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 167.237093][ T982] usb 2-1: Using ep0 maxpacket: 16 [ 167.245956][ T982] usb 2-1: config 1 interface 0 altsetting 7 endpoint 0x81 has an invalid bInterval 124, changing to 10 [ 167.246776][ T5953] usb 1-1: new low-speed USB device number 16 using dummy_hcd [ 167.265396][ T982] usb 2-1: config 1 interface 0 altsetting 7 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 167.281511][ T982] usb 2-1: config 1 interface 0 has no altsetting 0 [ 167.291526][ T982] usb 2-1: New USB device found, idVendor=1e71, idProduct=2019, bcdDevice= 0.40 [ 167.297251][ T5953] usb 1-1: Invalid ep0 maxpacket: 64 [ 167.301410][ T982] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.314699][ T982] usb 2-1: Product:  [ 167.320593][ T982] usb 2-1: Manufacturer: ǒᅔ獳⺘횞ˡ타ཙ嗿퓭놨ﾌ畅ﲡ쬽⿛த탈缦콧轍⺍뀱抃뚑쬗냍ఆ视쉀졒 [ 167.339121][ T982] usb 2-1: SerialNumber: ఄ [ 167.448045][ T5953] usb 1-1: new low-speed USB device number 17 using dummy_hcd [ 167.472842][ T5953] usb 1-1: Invalid ep0 maxpacket: 64 [ 167.479442][ T5953] usb usb1-port1: unable to enumerate USB device [ 167.880713][ T7327] netlink: 16 bytes leftover after parsing attributes in process `syz.2.313'. [ 168.961647][ T7353] loop2: detected capacity change from 0 to 7 [ 168.970989][ T7353] Dev loop2: unable to read RDB block 7 [ 168.979733][ T7353] loop2: unable to read partition table [ 168.985897][ T7353] loop2: partition table beyond EOD, truncated [ 168.994042][ T7353] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 169.426993][ T5946] usb 3-1: new low-speed USB device number 19 using dummy_hcd [ 169.568078][ T5946] usb 3-1: device descriptor read/64, error -71 [ 169.576623][ T5997] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 169.729448][ T5997] usb 1-1: config 0 has an invalid interface number: 120 but max is 0 [ 169.737764][ T5997] usb 1-1: config 0 has no interface number 0 [ 169.743887][ T5997] usb 1-1: config 0 interface 120 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 169.755691][ T5997] usb 1-1: config 0 interface 120 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 169.767205][ T5997] usb 1-1: config 0 interface 120 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 169.777306][ T5997] usb 1-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 169.786744][ T5997] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 169.797415][ T5997] usb 1-1: config 0 descriptor?? [ 169.811025][ T5997] input: USB Touchscreen 16e3:f9e9 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.120/input/input14 [ 169.856999][ T5946] usb 3-1: new low-speed USB device number 20 using dummy_hcd [ 169.894029][ T982] usbhid 2-1:1.0: can't add hid device: -71 [ 169.917444][ T982] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 169.982069][ T982] usb 2-1: USB disconnect, device number 21 [ 170.047395][ T5946] usb 3-1: device descriptor read/64, error -71 [ 170.090092][ T7364] geneve2: entered promiscuous mode [ 170.098216][ T7364] geneve2: entered allmulticast mode [ 170.196328][ T5946] usb usb3-port1: attempt power cycle [ 170.285543][ T5997] usb 1-1: USB disconnect, device number 18 [ 170.619167][ T5946] usb 3-1: new low-speed USB device number 21 using dummy_hcd [ 170.658900][ T5946] usb 3-1: device descriptor read/8, error -71 [ 170.868185][ T7376] loop2: detected capacity change from 0 to 7 [ 170.879248][ T7376] Dev loop2: unable to read RDB block 7 [ 170.885394][ T7376] loop2: unable to read partition table [ 170.892626][ T7376] loop2: partition table beyond EOD, truncated [ 170.899465][ T7376] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 170.908960][ T5946] usb 3-1: new low-speed USB device number 22 using dummy_hcd [ 170.970989][ T5946] usb 3-1: device descriptor read/8, error -71 [ 171.088426][ T5946] usb usb3-port1: unable to enumerate USB device [ 171.139522][ T7380] fuse: Bad value for 'fd' [ 171.255830][ T5946] IPVS: starting estimator thread 0... [ 171.356626][ T7385] IPVS: using max 24 ests per chain, 57600 per kthread [ 171.496608][ T5997] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 171.646676][ T5997] usb 2-1: Using ep0 maxpacket: 32 [ 171.682686][ T5997] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 171.694295][ T5997] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.720219][ T5997] usb 2-1: config 0 descriptor?? [ 171.945832][ T5997] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 171.984625][ T5997] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 172.026750][ T5997] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 172.034587][ T5997] usb 2-1: media controller created [ 172.078236][ T5997] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 172.138267][ T5997] az6027: usb out operation failed. (-71) [ 172.165855][ T5997] az6027: usb out operation failed. (-71) [ 172.176847][ T5997] stb0899_attach: Driver disabled by Kconfig [ 172.202272][ T5997] az6027: no front-end attached [ 172.202272][ T5997] [ 172.221056][ T5997] az6027: usb out operation failed. (-71) [ 172.235276][ T5997] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 172.273145][ T5997] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input15 [ 172.318994][ T5997] dvb-usb: schedule remote query interval to 400 msecs. [ 172.325976][ T5997] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 172.391737][ T5997] usb 2-1: USB disconnect, device number 22 [ 172.482992][ T5997] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 172.514818][ T7395] ptrace attach of "./syz-executor exec"[5883] was attempted by "./syz-executor exec"[7395] [ 172.795705][ T30] kauditd_printk_skb: 110 callbacks suppressed [ 172.795722][ T30] audit: type=1326 audit(1755915557.948:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7398 comm="syz.2.327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c6518ebe9 code=0x7ffc0000 [ 172.877463][ T30] audit: type=1326 audit(1755915557.978:126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7398 comm="syz.2.327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c6518ebe9 code=0x7ffc0000 [ 172.956650][ T30] audit: type=1326 audit(1755915557.988:127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7398 comm="syz.2.327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7f2c6518ebe9 code=0x7ffc0000 [ 173.016668][ T30] audit: type=1326 audit(1755915557.988:128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7398 comm="syz.2.327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c6518ebe9 code=0x7ffc0000 [ 173.112443][ T30] audit: type=1326 audit(1755915557.988:129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7398 comm="syz.2.327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c6518ebe9 code=0x7ffc0000 [ 173.163134][ T30] audit: type=1326 audit(1755915557.998:130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7398 comm="syz.2.327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7f2c6518ebe9 code=0x7ffc0000 [ 173.240574][ T30] audit: type=1326 audit(1755915557.998:131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7398 comm="syz.2.327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f2c6512ade9 code=0x7ffc0000 [ 173.263170][ T30] audit: type=1326 audit(1755915557.998:132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7398 comm="syz.2.327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f2c6512ade9 code=0x7ffc0000 [ 173.305104][ T30] audit: type=1326 audit(1755915557.998:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7398 comm="syz.2.327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f2c6512ade9 code=0x7ffc0000 [ 173.376679][ T30] audit: type=1326 audit(1755915557.998:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7398 comm="syz.2.327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f2c6512ade9 code=0x7ffc0000 [ 173.738176][ T7405] netlink: 76 bytes leftover after parsing attributes in process `syz.0.328'. [ 173.759172][ T7404] netlink: 76 bytes leftover after parsing attributes in process `syz.0.328'. [ 173.914123][ T7410] netlink: 8 bytes leftover after parsing attributes in process `syz.2.331'. [ 173.969054][ T7412] loop4: detected capacity change from 0 to 7 [ 173.992634][ T7412] loop4: [POWERTEC] p1 p2 p3 p4 p5 [ 174.005028][ T7412] loop4: p1 start 1600481121 is beyond EOD, truncated [ 174.016017][ T7414] loop2: detected capacity change from 0 to 7 [ 174.019019][ T7412] loop4: p2 start 536870912 is beyond EOD, truncated [ 174.033249][ T5973] Dev loop2: unable to read RDB block 7 [ 174.040739][ T5973] loop2: unable to read partition table [ 174.048094][ T7412] loop4: p3 start 2097152 is beyond EOD, truncated [ 174.054785][ T5973] loop2: partition table beyond EOD, truncated [ 174.062599][ T7412] loop4: p4 start 1310720 is beyond EOD, truncated [ 174.073192][ T7412] loop4: p5 start 791543808 is beyond EOD, truncated [ 174.074450][ T7414] Dev loop2: unable to read RDB block 7 [ 174.097055][ T7414] loop2: unable to read partition table [ 174.123557][ T7414] loop2: partition table beyond EOD, truncated [ 174.146630][ T7414] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 174.841596][ T5997] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 175.016656][ T5997] usb 1-1: Using ep0 maxpacket: 32 [ 175.024602][ T5997] usb 1-1: unable to get BOS descriptor or descriptor too short [ 175.034902][ T5997] usb 1-1: config 125 has an invalid interface number: 27 but max is 0 [ 175.043477][ T5997] usb 1-1: config 125 has no interface number 0 [ 175.050006][ T5997] usb 1-1: config 125 interface 27 altsetting 24 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 175.149311][ T5997] usb 1-1: config 125 interface 27 altsetting 24 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 175.180740][ T5997] usb 1-1: config 125 interface 27 altsetting 24 endpoint 0x8A has invalid maxpacket 50534, setting to 1024 [ 175.208146][ T5997] usb 1-1: config 125 interface 27 altsetting 24 has an invalid descriptor for endpoint zero, skipping [ 175.221051][ T5997] usb 1-1: config 125 interface 27 altsetting 24 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 175.235745][ T5997] usb 1-1: config 125 interface 27 has no altsetting 0 [ 175.253471][ T7441] random: crng reseeded on system resumption [ 175.297302][ T5997] usb 1-1: New USB device found, idVendor=1199, idProduct=68aa, bcdDevice=a4.70 [ 175.578352][ T5997] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 175.586416][ T5997] usb 1-1: Product: syz [ 175.593790][ T5997] usb 1-1: Manufacturer: syz [ 175.600708][ T5997] usb 1-1: SerialNumber: syz [ 175.618961][ T7431] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 175.833096][ T7431] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 175.847384][ T7431] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.358667][ T5997] hub 1-1:125.27: bad descriptor, ignoring hub [ 176.376929][ T5997] hub 1-1:125.27: probe with driver hub failed with error -5 [ 176.419082][ T5997] sierra 1-1:125.27: Sierra USB modem converter detected [ 176.461742][ T5997] usb 1-1: Sierra USB modem converter now attached to ttyUSB0 [ 176.509362][ T5997] usb 1-1: USB disconnect, device number 19 [ 176.531062][ T5997] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 176.560582][ T5997] sierra 1-1:125.27: device disconnected [ 177.146654][ T982] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 177.269863][ T7457] blkio.reset_stats is deprecated [ 177.306706][ T982] usb 1-1: Using ep0 maxpacket: 8 [ 177.313956][ T982] usb 1-1: config 0 has an invalid interface number: 143 but max is 0 [ 177.323718][ T982] usb 1-1: config 0 has no interface number 0 [ 177.330425][ T982] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 177.340673][ T982] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.354841][ T982] usb 1-1: config 0 descriptor?? [ 177.488763][ T982] viperboard 1-1:0.143: version 0.00 found at bus 001 address 020 [ 177.518740][ T982] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 177.531250][ T982] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 177.593893][ T982] usb 1-1: USB disconnect, device number 20 [ 177.997036][ T7468] macvlan2: entered promiscuous mode [ 178.002505][ T7468] macvlan2: entered allmulticast mode [ 178.202241][ T7481] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 178.214229][ T7481] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 178.366636][ T48] usb 3-1: new low-speed USB device number 23 using dummy_hcd [ 178.528433][ T48] usb 3-1: New USB device found, idVendor=046d, idProduct=08b1, bcdDevice=6d.2a [ 178.537699][ T48] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.550736][ T48] usb 3-1: config 0 descriptor?? [ 178.569556][ T48] pwc: Logitech QuickCam Notebook Pro USB webcam detected. [ 179.210264][ T48] pwc: recv_control_msg error -71 req 02 val 2b00 [ 179.227472][ T48] pwc: recv_control_msg error -71 req 02 val 2700 [ 179.234469][ T48] pwc: recv_control_msg error -71 req 04 val 1600 [ 179.244211][ T48] pwc: recv_control_msg error -71 req 02 val 2c00 [ 179.261591][ T48] pwc: recv_control_msg error -71 req 04 val 1000 [ 179.277213][ T48] pwc: recv_control_msg error -71 req 04 val 1300 [ 179.286312][ T48] pwc: recv_control_msg error -71 req 04 val 1400 [ 179.293867][ T48] pwc: recv_control_msg error -71 req 02 val 2000 [ 179.301026][ T48] pwc: recv_control_msg error -71 req 02 val 2100 [ 179.312234][ T48] pwc: recv_control_msg error -71 req 06 val 0600 [ 179.319239][ T48] pwc: recv_control_msg error -71 req 04 val 1500 [ 179.327392][ T48] pwc: recv_control_msg error -71 req 02 val 2500 [ 179.334405][ T48] pwc: recv_control_msg error -71 req 02 val 2400 [ 179.343046][ T48] pwc: recv_control_msg error -71 req 02 val 2600 [ 179.349957][ T48] pwc: recv_control_msg error -71 req 02 val 2900 [ 179.356789][ T48] pwc: recv_control_msg error -71 req 02 val 2800 [ 179.363698][ T48] pwc: recv_control_msg error -71 req 04 val 1100 [ 179.370690][ T48] pwc: recv_control_msg error -71 req 04 val 1200 [ 179.381006][ T48] pwc: Registered as video103. [ 179.395481][ T48] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input16 [ 179.414992][ T48] usb 3-1: USB disconnect, device number 23 [ 179.516781][ T10] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 179.646737][ T10] usb 1-1: device descriptor read/64, error -71 [ 179.887024][ T10] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 180.036757][ T10] usb 1-1: device descriptor read/64, error -71 [ 180.157357][ T10] usb usb1-port1: attempt power cycle [ 180.506928][ T10] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 180.537540][ T10] usb 1-1: device descriptor read/8, error -71 [ 180.777920][ T10] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 180.807973][ T10] usb 1-1: device descriptor read/8, error -71 [ 180.927300][ T10] usb usb1-port1: unable to enumerate USB device [ 181.211890][ T7515] netlink: 8 bytes leftover after parsing attributes in process `syz.2.360'. [ 181.260326][ T7516] fuse: Unknown parameter '0xffffffffffffffff017777777777777777777770000000000000000000000000000000000000000' [ 181.516616][ T48] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 181.686806][ T48] usb 3-1: Using ep0 maxpacket: 32 [ 181.697171][ T48] usb 3-1: config 0 has an invalid interface number: 231 but max is 0 [ 181.732857][ T48] usb 3-1: config 0 has no interface number 0 [ 181.739385][ T48] usb 3-1: config 0 interface 231 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 181.753187][ T48] usb 3-1: config 0 interface 231 altsetting 0 endpoint 0x82 has invalid maxpacket 2312, setting to 1024 [ 181.764829][ T48] usb 3-1: config 0 interface 231 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 181.782658][ T48] usb 3-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b [ 181.792205][ T48] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.801721][ T48] usb 3-1: Product: syz [ 181.806078][ T48] usb 3-1: Manufacturer: syz [ 181.811568][ T48] usb 3-1: SerialNumber: syz [ 181.830940][ T48] usb 3-1: config 0 descriptor?? [ 181.841480][ T7516] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 181.852926][ T7516] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 181.880668][ T48] plusb 3-1:0.231 usb0: register 'plusb' at usb-dummy_hcd.2-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1, 66:3e:ff:86:71:04 [ 183.921494][ T48] usb 3-1: USB disconnect, device number 24 [ 183.933261][ T48] plusb 3-1:0.231 usb0: unregister 'plusb' usb-dummy_hcd.2-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1 [ 184.134374][ T7526] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 185.186707][ T24] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 185.336686][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 185.343349][ T24] usb 3-1: config 132 has an invalid interface number: 4 but max is 0 [ 185.351711][ T24] usb 3-1: config 132 has no interface number 0 [ 185.358085][ T24] usb 3-1: config 132 interface 4 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1023 [ 185.368222][ T24] usb 3-1: config 132 interface 4 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 431 [ 185.378429][ T24] usb 3-1: config 132 interface 4 altsetting 0 endpoint 0xF has an invalid bInterval 241, changing to 11 [ 185.394556][ T24] usb 3-1: New USB device found, idVendor=34ef, idProduct=202b, bcdDevice=36.09 [ 185.403952][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.412101][ T24] usb 3-1: Product: syz [ 185.416277][ T24] usb 3-1: Manufacturer: syz [ 185.421179][ T24] usb 3-1: SerialNumber: syz [ 185.431923][ T7528] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 185.441120][ T7528] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 185.663299][ T24] usb 3-1: USB disconnect, device number 25 [ 186.196337][ T7530] support for cryptoloop has been removed. Use dm-crypt instead. [ 187.129363][ T7535] sctp: [Deprecated]: syz.2.366 (pid 7535) Use of int in maxseg socket option. [ 187.129363][ T7535] Use struct sctp_assoc_value instead [ 194.350630][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.357125][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.790390][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.796915][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.231320][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.238136][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 320.426856][ T31] INFO: task syz-executor:5885 blocked for more than 143 seconds. [ 320.434704][ T31] Not tainted syzkaller #0 [ 320.443414][ T31] Blocked by coredump. [ 320.448156][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 320.459508][ T31] task:syz-executor state:D stack:21480 pid:5885 tgid:5885 ppid:1 task_flags:0x40054c flags:0x00004006 [ 320.471894][ T31] Call Trace: [ 320.475167][ T31] [ 320.478232][ T31] __schedule+0x1798/0x4cc0 [ 320.482785][ T31] ? __pfx___schedule+0x10/0x10 [ 320.489073][ T31] ? schedule+0x91/0x360 [ 320.493362][ T31] schedule+0x165/0x360 [ 320.499617][ T31] schedule_preempt_disabled+0x13/0x30 [ 320.505118][ T31] __mutex_lock+0x7e6/0x1350 [ 320.510478][ T31] ? __mutex_lock+0x5bb/0x1350 [ 320.515275][ T31] ? rfkill_unregister+0xc8/0x220 [ 320.522739][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 320.528673][ T31] ? __pfx_device_del+0x10/0x10 [ 320.533549][ T31] ? hci_sock_dev_event+0x42d/0x600 [ 320.541085][ T31] rfkill_unregister+0xc8/0x220 [ 320.545989][ T31] hci_unregister_dev+0x374/0x510 [ 320.552589][ T31] vhci_release+0x80/0xd0 [ 320.559102][ T31] ? __pfx_vhci_release+0x10/0x10 [ 320.564160][ T31] __fput+0x449/0xa70 [ 320.569247][ T31] task_work_run+0x1d4/0x260 [ 320.573875][ T31] ? __pfx_task_work_run+0x10/0x10 [ 320.581415][ T31] ? kmem_cache_free+0x18f/0x400 [ 320.586395][ T31] do_exit+0x6b5/0x2300 [ 320.592255][ T31] ? do_raw_spin_lock+0x121/0x290 [ 320.599517][ T31] ? __pfx_do_exit+0x10/0x10 [ 320.604156][ T31] do_group_exit+0x21c/0x2d0 [ 320.610655][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 320.615898][ T31] get_signal+0x1286/0x1340 [ 320.620586][ T31] arch_do_signal_or_restart+0x9a/0x750 [ 320.626165][ T31] ? __pfx___x64_sys_wait4+0x10/0x10 [ 320.631563][ T31] ? fput_close_sync+0x119/0x200 [ 320.636855][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 320.643056][ T31] ? exit_to_user_mode_loop+0x40/0x110 [ 320.648615][ T31] exit_to_user_mode_loop+0x75/0x110 [ 320.653929][ T31] do_syscall_64+0x2bd/0x3b0 [ 320.658633][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 320.663861][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 320.670372][ T31] ? clear_bhb_loop+0x60/0xb0 [ 320.675092][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 320.682003][ T31] RIP: 0033:0x7fbe2c984e57 [ 320.686540][ T31] RSP: 002b:00007fbe2ccdfd80 EFLAGS: 00000293 ORIG_RAX: 000000000000003d [ 320.694977][ T31] RAX: fffffffffffffe00 RBX: 00000000000000ee RCX: 00007fbe2c984e57 [ 320.705523][ T31] RDX: 0000000040000000 RSI: 00007fbe2ccdfdec RDI: 00000000ffffffff [ 320.713591][ T31] RBP: 00007fbe2ccdfdec R08: 0000000000000000 R09: 0000000000000000 [ 320.723117][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000004a [ 320.732831][ T31] R13: 000055558b4ab590 R14: 000000000002767b R15: 00007fbe2ccdfe40 [ 320.742325][ T31] [ 320.745419][ T31] INFO: task kworker/1:8:5996 blocked for more than 143 seconds. [ 320.761459][ T31] Not tainted syzkaller #0 [ 320.766436][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 320.777004][ T31] task:kworker/1:8 state:D stack:21128 pid:5996 tgid:5996 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 320.789207][ T31] Workqueue: events rfkill_global_led_trigger_worker [ 320.795952][ T31] Call Trace: [ 320.800914][ T31] [ 320.803875][ T31] __schedule+0x1798/0x4cc0 [ 320.810029][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 320.817491][ T31] ? __pfx___schedule+0x10/0x10 [ 320.822466][ T31] ? preempt_schedule+0xae/0xc0 [ 320.827741][ T31] ? schedule+0x91/0x360 [ 320.832014][ T31] schedule+0x165/0x360 [ 320.836204][ T31] schedule_preempt_disabled+0x13/0x30 [ 320.841738][ T31] __mutex_lock+0x7e6/0x1350 [ 320.846356][ T31] ? __mutex_lock+0x5bb/0x1350 [ 320.851238][ T31] ? rfkill_global_led_trigger_worker+0x27/0xd0 [ 320.857853][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 320.862911][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 320.868754][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 320.874520][ T31] rfkill_global_led_trigger_worker+0x27/0xd0 [ 320.882121][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 320.889650][ T31] process_scheduled_works+0xae1/0x17b0 [ 320.895254][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 320.902327][ T31] worker_thread+0x8a0/0xda0 [ 320.907070][ T31] kthread+0x70e/0x8a0 [ 320.911162][ T31] ? __pfx_worker_thread+0x10/0x10 [ 320.916291][ T31] ? __pfx_kthread+0x10/0x10 [ 320.922706][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 320.928911][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 320.934139][ T31] ? __pfx_kthread+0x10/0x10 [ 320.940258][ T31] ret_from_fork+0x3f9/0x770 [ 320.944893][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 320.951669][ T31] ? __switch_to_asm+0x39/0x70 [ 320.957909][ T31] ? __switch_to_asm+0x33/0x70 [ 320.962700][ T31] ? __pfx_kthread+0x10/0x10 [ 320.968809][ T31] ret_from_fork_asm+0x1a/0x30 [ 320.973617][ T31] [ 320.977090][ T31] INFO: task syz.4.282:7134 blocked for more than 143 seconds. [ 320.984648][ T31] Not tainted syzkaller #0 [ 320.989893][ T31] Blocked by coredump. [ 320.994480][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 321.003268][ T31] task:syz.4.282 state:D stack:25848 pid:7134 tgid:7123 ppid:5885 task_flags:0x40054c flags:0x00004006 [ 321.015435][ T31] Call Trace: [ 321.018819][ T31] [ 321.021780][ T31] __schedule+0x1798/0x4cc0 [ 321.026328][ T31] ? __pfx___schedule+0x10/0x10 [ 321.031334][ T31] ? schedule+0x91/0x360 [ 321.035605][ T31] schedule+0x165/0x360 [ 321.041223][ T31] schedule_preempt_disabled+0x13/0x30 [ 321.049051][ T31] __mutex_lock+0x7e6/0x1350 [ 321.053862][ T31] ? __mutex_lock+0x5bb/0x1350 [ 321.060145][ T31] ? rfkill_unregister+0xc8/0x220 [ 321.065212][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 321.073400][ T31] ? __pfx_device_del+0x10/0x10 [ 321.079770][ T31] rfkill_unregister+0xc8/0x220 [ 321.084742][ T31] nfc_unregister_device+0x96/0x2a0 [ 321.091514][ T31] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 321.100206][ T31] virtual_ncidev_close+0x56/0x90 [ 321.105292][ T31] __fput+0x449/0xa70 [ 321.110892][ T31] task_work_run+0x1d4/0x260 [ 321.115513][ T31] ? __pfx_task_work_run+0x10/0x10 [ 321.123048][ T31] do_exit+0x6b5/0x2300 [ 321.128970][ T31] ? do_raw_spin_lock+0x121/0x290 [ 321.134022][ T31] ? __pfx_do_exit+0x10/0x10 [ 321.138809][ T31] do_group_exit+0x21c/0x2d0 [ 321.143430][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 321.148977][ T31] get_signal+0x1286/0x1340 [ 321.153728][ T31] arch_do_signal_or_restart+0x9a/0x750 [ 321.161089][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 321.168701][ T31] ? exit_to_user_mode_loop+0x40/0x110 [ 321.174192][ T31] exit_to_user_mode_loop+0x75/0x110 [ 321.181025][ T31] do_syscall_64+0x2bd/0x3b0 [ 321.185643][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 321.192624][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.200261][ T31] ? clear_bhb_loop+0x60/0xb0 [ 321.204980][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.212496][ T31] RIP: 0033:0x7fbe2c98ebe9 [ 321.218717][ T31] RSP: 002b:00007fbe2d86f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 321.227309][ T31] RAX: fffffffffffffe00 RBX: 00007fbe2cbb6188 RCX: 00007fbe2c98ebe9 [ 321.235289][ T31] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fbe2cbb6188 [ 321.243398][ T31] RBP: 00007fbe2cbb6180 R08: 0000000000000000 R09: 0000000000000000 [ 321.251537][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 321.259611][ T31] R13: 00007fbe2cbb6218 R14: 00007fbe2ccdf940 R15: 00007fbe2ccdfa28 [ 321.269056][ T31] [ 321.272143][ T31] INFO: task syz.3.290:7178 blocked for more than 144 seconds. [ 321.279838][ T31] Not tainted syzkaller #0 [ 321.285035][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 321.294045][ T31] task:syz.3.290 state:D stack:24344 pid:7178 tgid:7173 ppid:6737 task_flags:0x400040 flags:0x00004006 [ 321.306068][ T31] Call Trace: [ 321.309777][ T31] [ 321.312731][ T31] __schedule+0x1798/0x4cc0 [ 321.317412][ T31] ? __pfx___schedule+0x10/0x10 [ 321.322389][ T31] ? schedule+0x91/0x360 [ 321.326772][ T31] schedule+0x165/0x360 [ 321.330946][ T31] schedule_preempt_disabled+0x13/0x30 [ 321.336544][ T31] __mutex_lock+0x7e6/0x1350 [ 321.341176][ T31] ? __mutex_lock+0x5bb/0x1350 [ 321.345939][ T31] ? nfc_rfkill_set_block+0x50/0x2e0 [ 321.351381][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 321.356432][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 321.361746][ T31] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 321.367803][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 321.374153][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 321.379982][ T31] nfc_rfkill_set_block+0x50/0x2e0 [ 321.385114][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 321.391081][ T31] rfkill_set_block+0x1cf/0x440 [ 321.396056][ T31] rfkill_fop_write+0x44b/0x570 [ 321.401389][ T31] ? __pfx_rfkill_fop_write+0x10/0x10 [ 321.406905][ T31] ? security_kernfs_init_security+0x240/0x290 [ 321.413080][ T31] ? rw_verify_area+0x255/0x4d0 [ 321.418006][ T31] ? __lock_acquire+0xab9/0xd20 [ 321.422885][ T31] ? __pfx_rfkill_fop_write+0x10/0x10 [ 321.428346][ T31] vfs_write+0x27b/0xb30 [ 321.432612][ T31] ? __pfx_vfs_write+0x10/0x10 [ 321.437453][ T31] ? __fget_files+0x2a/0x420 [ 321.442074][ T31] ? __fget_files+0x2a/0x420 [ 321.446767][ T31] ? __fget_files+0x3a0/0x420 [ 321.451581][ T31] ? __fget_files+0x2a/0x420 [ 321.456179][ T31] ksys_write+0x145/0x250 [ 321.460603][ T31] ? __pfx_ksys_write+0x10/0x10 [ 321.465481][ T31] ? rcu_is_watching+0x15/0xb0 [ 321.470639][ T31] ? do_syscall_64+0xbe/0x3b0 [ 321.475407][ T31] do_syscall_64+0xfa/0x3b0 [ 321.480214][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 321.485438][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.491663][ T31] ? clear_bhb_loop+0x60/0xb0 [ 321.496363][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.502372][ T31] RIP: 0033:0x7f5f8218ebe9 [ 321.507002][ T31] RSP: 002b:00007f5f803d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 321.515444][ T31] RAX: ffffffffffffffda RBX: 00007f5f823b6180 RCX: 00007f5f8218ebe9 [ 321.523543][ T31] RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000003 [ 321.531569][ T31] RBP: 00007f5f82211e19 R08: 0000000000000000 R09: 0000000000000000 [ 321.539712][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 321.547872][ T31] R13: 00007f5f823b6218 R14: 00007f5f823b6180 R15: 00007f5f824dfa28 [ 321.555889][ T31] [ 321.558990][ T31] INFO: task syz-executor:7421 blocked for more than 144 seconds. [ 321.566840][ T31] Not tainted syzkaller #0 [ 321.571775][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 321.580472][ T31] task:syz-executor state:D stack:24104 pid:7421 tgid:7421 ppid:5856 task_flags:0x400000 flags:0x00004004 [ 321.592460][ T31] Call Trace: [ 321.595729][ T31] [ 321.598708][ T31] __schedule+0x1798/0x4cc0 [ 321.603232][ T31] ? __pfx___schedule+0x10/0x10 [ 321.608172][ T31] ? schedule+0x91/0x360 [ 321.612431][ T31] schedule+0x165/0x360 [ 321.616652][ T31] schedule_preempt_disabled+0x13/0x30 [ 321.622157][ T31] __mutex_lock+0x7e6/0x1350 [ 321.627125][ T31] ? __mutex_lock+0x5bb/0x1350 [ 321.631918][ T31] ? rfkill_register+0x37/0x8e0 [ 321.636903][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 321.641959][ T31] ? __raw_spin_lock_init+0x45/0x100 [ 321.647341][ T31] ? __init_waitqueue_head+0xa9/0x150 [ 321.652731][ T31] ? device_initialize+0x24b/0x440 [ 321.657893][ T31] rfkill_register+0x37/0x8e0 [ 321.662584][ T31] hci_register_dev+0x3f5/0x890 [ 321.667501][ T31] vhci_create_device+0x39c/0x6e0 [ 321.672534][ T31] vhci_write+0x3ce/0x4a0 [ 321.676920][ T31] vfs_write+0x5c6/0xb30 [ 321.681181][ T31] ? __pfx_vhci_write+0x10/0x10 [ 321.686028][ T31] ? __pfx_vfs_write+0x10/0x10 [ 321.690875][ T31] ? __lock_acquire+0xab9/0xd20 [ 321.695746][ T31] ksys_write+0x145/0x250 [ 321.700199][ T31] ? __pfx_ksys_write+0x10/0x10 [ 321.705173][ T31] ? do_syscall_64+0xbe/0x3b0 [ 321.710178][ T31] do_syscall_64+0xfa/0x3b0 [ 321.714750][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 321.719999][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.726111][ T31] ? clear_bhb_loop+0x60/0xb0 [ 321.730873][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.736965][ T31] RIP: 0033:0x7f2ca7b8d660 [ 321.741411][ T31] RSP: 002b:00007fff278e65f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 321.749961][ T31] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2ca7b8d660 [ 321.757993][ T31] RDX: 0000000000000002 RSI: 00007fff278e660a RDI: 00000000000000ca [ 321.765978][ T31] RBP: 00007f2ca7db67b8 R08: 00000000000000d7 R09: 0000000000000000 [ 321.774029][ T31] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008 [ 321.782050][ T31] R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000 [ 321.790488][ T31] [ 321.793557][ T31] [ 321.793557][ T31] Showing all locks held in the system: [ 321.801345][ T31] 1 lock held by khungtaskd/31: [ 321.806195][ T31] #0: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 321.816164][ T31] 1 lock held by klogd/5227: [ 321.820793][ T31] #0: ffff8880b8639f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 321.830796][ T31] 2 locks held by dhcpcd/5532: [ 321.835553][ T31] #0: ffffffff8f59da70 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 321.843761][ T31] #1: ffffffff8f59d888 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 321.852778][ T31] 2 locks held by getty/5628: [ 321.857698][ T31] #0: ffff8880335af0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 321.867624][ T31] #1: ffffc900036c32f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 321.877802][ T31] 1 lock held by syz-executor/5885: [ 321.882997][ T31] #0: ffffffff8f811f48 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_unregister+0xc8/0x220 [ 321.893180][ T31] 3 locks held by kworker/1:8/5996: [ 321.898422][ T31] #0: ffff88801a480d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 321.909483][ T31] #1: ffffc9000b537bc0 ((work_completion)(&rfkill_global_led_trigger_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 321.923005][ T31] #2: ffffffff8f811f48 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_global_led_trigger_worker+0x27/0xd0 [ 321.934405][ T31] 2 locks held by syz.4.282/7134: [ 321.939444][ T31] #0: ffff888031db0100 (&dev->mutex){....}-{4:4}, at: nfc_unregister_device+0x63/0x2a0 [ 321.949359][ T31] #1: ffffffff8f811f48 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_unregister+0xc8/0x220 [ 321.959539][ T31] 2 locks held by syz.3.290/7178: [ 321.964563][ T31] #0: ffffffff8f811f48 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_fop_write+0x191/0x570 [ 321.974898][ T31] #1: ffff888031db0100 (&dev->mutex){....}-{4:4}, at: nfc_rfkill_set_block+0x50/0x2e0 [ 321.984664][ T31] 2 locks held by syz-executor/7421: [ 321.990006][ T31] #0: ffff8880314ff118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x6e0 [ 322.000086][ T31] #1: ffffffff8f811f48 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 322.010052][ T31] 2 locks held by syz-executor/7451: [ 322.015335][ T31] #0: ffff888059704918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x6e0 [ 322.025427][ T31] #1: ffffffff8f811f48 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 322.035443][ T31] 3 locks held by syz.1.348/7464: [ 322.040549][ T31] #0: ffffffff8f59da70 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 322.048858][ T31] #1: ffffffff8f59d888 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 322.057885][ T31] #2: ffffffff8f811f48 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 322.067923][ T31] 2 locks held by syz.0.362/7521: [ 322.072948][ T31] #0: ffffffff8f59da70 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 322.081347][ T31] #1: ffffffff8f59d888 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 322.090404][ T31] 2 locks held by syz.2.367/7538: [ 322.095412][ T31] #0: ffffffff8f59da70 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 322.103628][ T31] #1: ffffffff8f59d888 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 322.112708][ T31] 2 locks held by syz.2.367/7539: [ 322.117798][ T31] #0: ffffffff8f59da70 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 322.126012][ T31] #1: ffffffff8f59d888 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 322.135082][ T31] 2 locks held by syz-executor/7541: [ 322.140450][ T31] #0: ffff888024ad5118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x6e0 [ 322.150606][ T31] #1: ffffffff8f811f48 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 322.160612][ T31] 2 locks held by syz-executor/7543: [ 322.165898][ T31] #0: ffff888054500118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x6e0 [ 322.176018][ T31] #1: ffffffff8f811f48 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 322.186234][ T31] 2 locks held by syz-executor/7545: [ 322.191998][ T31] #0: ffff88804ff36118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x6e0 [ 322.202117][ T31] #1: ffffffff8f811f48 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 322.212195][ T31] [ 322.214533][ T31] ============================================= [ 322.214533][ T31] [ 322.222982][ T31] NMI backtrace for cpu 1 [ 322.222997][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 322.223017][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 322.223028][ T31] Call Trace: [ 322.223035][ T31] [ 322.223042][ T31] dump_stack_lvl+0x189/0x250 [ 322.223077][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 322.223097][ T31] ? __pfx__printk+0x10/0x10 [ 322.223131][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 322.223156][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 322.223178][ T31] ? __pfx__printk+0x10/0x10 [ 322.223208][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 322.223239][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 322.223265][ T31] watchdog+0xf93/0xfe0 [ 322.223296][ T31] ? watchdog+0x1de/0xfe0 [ 322.223325][ T31] kthread+0x70e/0x8a0 [ 322.223352][ T31] ? __pfx_watchdog+0x10/0x10 [ 322.223377][ T31] ? __pfx_kthread+0x10/0x10 [ 322.223401][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 322.223425][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 322.223449][ T31] ? __pfx_kthread+0x10/0x10 [ 322.223474][ T31] ret_from_fork+0x3f9/0x770 [ 322.223498][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 322.223524][ T31] ? __switch_to_asm+0x39/0x70 [ 322.223549][ T31] ? __switch_to_asm+0x33/0x70 [ 322.223573][ T31] ? __pfx_kthread+0x10/0x10 [ 322.223598][ T31] ret_from_fork_asm+0x1a/0x30 [ 322.223637][ T31] [ 322.223644][ T31] Sending NMI from CPU 1 to CPUs 0: [ 322.371182][ C0] NMI backtrace for cpu 0 [ 322.371201][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 322.371221][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 322.371233][ C0] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 322.371263][ C0] Code: 53 e7 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 86 0e 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 322.371306][ C0] RSP: 0018:ffffffff8de07d80 EFLAGS: 000002c2 [ 322.371322][ C0] RAX: 301d1e834fa04700 RBX: ffffffff819683b8 RCX: 301d1e834fa04700 [ 322.371336][ C0] RDX: 0000000000000001 RSI: ffffffff8d9b7339 RDI: ffffffff8be33680 [ 322.371349][ C0] RBP: ffffffff8de07eb8 R08: ffff8880b8632f9b R09: 1ffff110170c65f3 [ 322.371362][ C0] R10: dffffc0000000000 R11: ffffed10170c65f4 R12: ffffffff8fa38630 [ 322.371375][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffffffff1bd2a20 [ 322.371387][ C0] FS: 0000000000000000(0000) GS:ffff888125c1b000(0000) knlGS:0000000000000000 [ 322.371402][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 322.371414][ C0] CR2: 00007f6183b0c9ce CR3: 000000000df36000 CR4: 00000000003526f0 [ 322.371431][ C0] Call Trace: [ 322.371439][ C0] [ 322.371446][ C0] default_idle+0x13/0x20 [ 322.371463][ C0] default_idle_call+0x74/0xb0 [ 322.371480][ C0] do_idle+0x1e8/0x510 [ 322.371500][ C0] ? __pfx_do_idle+0x10/0x10 [ 322.371524][ C0] cpu_startup_entry+0x44/0x60 [ 322.371541][ C0] rest_init+0x2de/0x300 [ 322.371559][ C0] start_kernel+0x3a9/0x410 [ 322.371581][ C0] x86_64_start_reservations+0x24/0x30 [ 322.371606][ C0] x86_64_start_kernel+0x143/0x1c0 [ 322.371630][ C0] common_startup_64+0x13e/0x147 [ 322.371660][ C0] [ 322.372410][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 322.553113][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 322.562217][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 322.572267][ T31] Call Trace: [ 322.575539][ T31] [ 322.578463][ T31] dump_stack_lvl+0x99/0x250 [ 322.583056][ T31] ? __asan_memcpy+0x40/0x70 [ 322.587685][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 322.592879][ T31] ? __pfx__printk+0x10/0x10 [ 322.597481][ T31] vpanic+0x281/0x750 [ 322.601459][ T31] ? __pfx_vpanic+0x10/0x10 [ 322.605956][ T31] ? __x2apic_send_IPI_mask+0x1e4/0x260 [ 322.611502][ T31] ? preempt_schedule+0xae/0xc0 [ 322.616353][ T31] ? preempt_schedule_common+0x83/0xd0 [ 322.621928][ T31] panic+0xb9/0xc0 [ 322.625644][ T31] ? __pfx_panic+0x10/0x10 [ 322.630063][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 322.635452][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 322.641606][ T31] watchdog+0xfd2/0xfe0 [ 322.645765][ T31] ? watchdog+0x1de/0xfe0 [ 322.650123][ T31] kthread+0x70e/0x8a0 [ 322.654191][ T31] ? __pfx_watchdog+0x10/0x10 [ 322.658862][ T31] ? __pfx_kthread+0x10/0x10 [ 322.663451][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 322.668646][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 322.673839][ T31] ? __pfx_kthread+0x10/0x10 [ 322.678427][ T31] ret_from_fork+0x3f9/0x770 [ 322.683018][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 322.688129][ T31] ? __switch_to_asm+0x39/0x70 [ 322.692885][ T31] ? __switch_to_asm+0x33/0x70 [ 322.697641][ T31] ? __pfx_kthread+0x10/0x10 [ 322.702399][ T31] ret_from_fork_asm+0x1a/0x30 [ 322.707167][ T31] [ 322.710467][ T31] Kernel Offset: disabled [ 322.714957][ T31] Rebooting in 86400 seconds..