last executing test programs: 4m47.725457441s ago: executing program 4 (id=854): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32, @ANYBLOB="080001", @ANYRES32], 0x78}}, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/19, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e00010069703665727370616e00000018000280140018"], 0x4c}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r2, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140003"], 0x4c}}, 0x0) 4m47.604648435s ago: executing program 4 (id=855): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) pselect6(0x40, &(0x7f0000000600)={0x8}, 0x0, 0x0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x5f7, @private1, 0x7af}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000740)=[{{&(0x7f0000000100)={0xa, 0x4e21, 0x10000000, @local}, 0x1c, 0x0}}], 0x1, 0x20000000) 4m46.247890878s ago: executing program 4 (id=861): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021940000000c0a01030000000000000000070000000900020073797a31000000000900010073797a300000000068000380"], 0x118}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) 4m45.971400766s ago: executing program 4 (id=865): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32, @ANYBLOB="080001", @ANYRES32], 0x78}}, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/19, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e00010069703665727370616e000000180002801400180000"], 0x4c}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r2, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140003"], 0x4c}}, 0x0) 4m45.2935656s ago: executing program 4 (id=868): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) openat$6lowpan_control(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0xfffffffffffffdf7, &(0x7f0000000140)={0x4, 0x8345, 0x185, 0x3, 0x6, 0x40, 0x800, 0x4}, 0x0, &(0x7f0000001140)={0x200000000e, 0x9, 0x1, 0x8000000000000000, 0x46a3ed47, 0x9, 0xa, 0x2}, &(0x7f00000011c0)={r1, r2+60000000}, 0x0) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) (async, rerun: 32) r4 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="2c000000200001002abd70000000000002000000000000000005001300010000000800000094bfd736"], 0x2c}}, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8d40, 0x0) ioctl$TIOCPKT(r5, 0x5420, &(0x7f0000000080)=0xfffffff7) (async, rerun: 64) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000100)={0x0, 0x6, 0x0, 0x0, 0x0, "00769a7d8200010000001495595915303d6000"}) (rerun: 64) syz_open_pts(r5, 0x0) (async) ioctl$TCSETSW(r5, 0x5403, &(0x7f0000000080)={0x6, 0x70, 0x6, 0x7, 0x9, "f08530a216b09910c24f4838d5a936fbf2c67d"}) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9c000000", @ANYRES16=r3, @ANYBLOB="250300000000000000001600000004000180"], 0x18}, 0x1, 0x0, 0x0, 0x8080}, 0x0) 4m44.348614015s ago: executing program 4 (id=871): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="090000000a86acde6fceb4ea9841a1a11b74d706f14a29344490b85129671bf0357bcb53faa89b44f9b9985ca0eebb98ad95d4f4c150f6c5e42bec40522f9814eacb25132ccc3f933c9f7a91775708408a763008260a0945442340c5c8ba125b73b6a73bb5f565e3f0fe169e92577e25a7515f96f43304853eb379f3f4149401db2685eeef20333244d25f148a701322b1281aeb7575e79efe669b3ac93429772ab319853ea1c588e13a549d0e00a27192efb8699d08a8c948f8b4bb5f00698d32869d32b7abc2a6d97443e4bbbcd497a945d500d78ab232c4d0be155690aebcc3faeb9eaee37e37f7eb87fc2748b157a0f3e20b3f", @ANYRES16=r1, @ANYBLOB="010100000000ffdbdf252b00000008000300", @ANYRES32=r2, @ANYBLOB="060034006e100000080026008f09000008002700030000000800a10009000000"], 0x3c}}, 0x4800) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x7079, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r6, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r7 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000340), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r7, 0xc004500a, &(0x7f0000000040)) write$binfmt_elf32(r7, 0x0, 0x4cd) setsockopt$inet6_IPV6_HOPOPTS(r6, 0x29, 0x36, &(0x7f0000001440)=ANY=[@ANYBLOB="0017"], 0xc0) sendmmsg$inet6(r6, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r6, 0x29, 0x37, &(0x7f00000001c0)=ANY=[], 0xd8) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc2c45513, &(0x7f0000002e00)={{0x8, 0x7, 0x3, 0x1ff, 'syz0\x00', 0x7f}, 0x0, [0x8, 0x8, 0x1000, 0x0, 0xb3d, 0xffffffff, 0x5, 0x901, 0xbbf, 0x7, 0x15b, 0x7, 0x5944, 0x5, 0x7, 0x4a7, 0x9, 0x5, 0xd, 0x3, 0x9, 0x400, 0x40, 0x10000000, 0x6, 0x0, 0xffffffff, 0x800, 0x3, 0x3, 0x4, 0x6, 0x6, 0xfff, 0x3ff, 0x1, 0x5, 0x3, 0x5, 0x9, 0x7, 0x7fff, 0xffff8000, 0x80000001, 0xe, 0x0, 0x8b70, 0x0, 0xe, 0x4, 0x9, 0x5, 0x400, 0x3, 0x9, 0xfffff647, 0x8, 0x4, 0x9, 0x0, 0x9, 0x9, 0x5, 0x2008, 0x98, 0xbe, 0x6, 0x8, 0x7, 0x80000000, 0x81, 0x10001, 0x2, 0x80000001, 0x69d, 0xb, 0x3, 0x1, 0x8, 0x9, 0x7, 0x9, 0x1, 0x3, 0x1, 0xffff, 0x6, 0x8, 0x7ff, 0x4, 0xef, 0xff, 0x6, 0x3, 0xf86, 0x589f, 0x3, 0x9, 0x895, 0xfff, 0x9, 0x89, 0x0, 0x1, 0xe0b2, 0x9, 0xfffff561, 0xe, 0x3, 0x3, 0xfffffffa, 0x3, 0x2, 0x1, 0x2ba, 0x1, 0xe, 0x0, 0xf, 0x2, 0xf2, 0x4, 0x0, 0x7, 0xff, 0x7, 0x6, 0x100]}) socket(0x2a, 0x1, 0x1ff) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x19) 4m29.151887259s ago: executing program 32 (id=871): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="090000000a86acde6fceb4ea9841a1a11b74d706f14a29344490b85129671bf0357bcb53faa89b44f9b9985ca0eebb98ad95d4f4c150f6c5e42bec40522f9814eacb25132ccc3f933c9f7a91775708408a763008260a0945442340c5c8ba125b73b6a73bb5f565e3f0fe169e92577e25a7515f96f43304853eb379f3f4149401db2685eeef20333244d25f148a701322b1281aeb7575e79efe669b3ac93429772ab319853ea1c588e13a549d0e00a27192efb8699d08a8c948f8b4bb5f00698d32869d32b7abc2a6d97443e4bbbcd497a945d500d78ab232c4d0be155690aebcc3faeb9eaee37e37f7eb87fc2748b157a0f3e20b3f", @ANYRES16=r1, @ANYBLOB="010100000000ffdbdf252b00000008000300", @ANYRES32=r2, @ANYBLOB="060034006e100000080026008f09000008002700030000000800a10009000000"], 0x3c}}, 0x4800) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x7079, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r6, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r7 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000340), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r7, 0xc004500a, &(0x7f0000000040)) write$binfmt_elf32(r7, 0x0, 0x4cd) setsockopt$inet6_IPV6_HOPOPTS(r6, 0x29, 0x36, &(0x7f0000001440)=ANY=[@ANYBLOB="0017"], 0xc0) sendmmsg$inet6(r6, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r6, 0x29, 0x37, &(0x7f00000001c0)=ANY=[], 0xd8) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc2c45513, &(0x7f0000002e00)={{0x8, 0x7, 0x3, 0x1ff, 'syz0\x00', 0x7f}, 0x0, [0x8, 0x8, 0x1000, 0x0, 0xb3d, 0xffffffff, 0x5, 0x901, 0xbbf, 0x7, 0x15b, 0x7, 0x5944, 0x5, 0x7, 0x4a7, 0x9, 0x5, 0xd, 0x3, 0x9, 0x400, 0x40, 0x10000000, 0x6, 0x0, 0xffffffff, 0x800, 0x3, 0x3, 0x4, 0x6, 0x6, 0xfff, 0x3ff, 0x1, 0x5, 0x3, 0x5, 0x9, 0x7, 0x7fff, 0xffff8000, 0x80000001, 0xe, 0x0, 0x8b70, 0x0, 0xe, 0x4, 0x9, 0x5, 0x400, 0x3, 0x9, 0xfffff647, 0x8, 0x4, 0x9, 0x0, 0x9, 0x9, 0x5, 0x2008, 0x98, 0xbe, 0x6, 0x8, 0x7, 0x80000000, 0x81, 0x10001, 0x2, 0x80000001, 0x69d, 0xb, 0x3, 0x1, 0x8, 0x9, 0x7, 0x9, 0x1, 0x3, 0x1, 0xffff, 0x6, 0x8, 0x7ff, 0x4, 0xef, 0xff, 0x6, 0x3, 0xf86, 0x589f, 0x3, 0x9, 0x895, 0xfff, 0x9, 0x89, 0x0, 0x1, 0xe0b2, 0x9, 0xfffff561, 0xe, 0x3, 0x3, 0xfffffffa, 0x3, 0x2, 0x1, 0x2ba, 0x1, 0xe, 0x0, 0xf, 0x2, 0xf2, 0x4, 0x0, 0x7, 0xff, 0x7, 0x6, 0x100]}) socket(0x2a, 0x1, 0x1ff) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x19) 2m42.373538437s ago: executing program 1 (id=1369): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0xa, 0x3, 0x3a) close(0xffffffffffffffff) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, r1, 0x4, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x1, 0x40}}}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x40}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x2b}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x21}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x6d}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x80}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x3e}]}, 0x68}}, 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2061, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="30000000100001000900"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x0) r4 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r4, &(0x7f0000000040)={0x18, 0x0, {0x402, @multicast, 'bond0\x00'}}, 0x1e) bpf$MAP_CREATE(0x1900000000000000, 0x0, 0x50) syz_usb_connect(0x0, 0x36, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) 2m40.67871806s ago: executing program 1 (id=1374): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) socket$packet(0x11, 0x3, 0x300) socket$alg(0x26, 0x5, 0x0) getsockopt$IP_SET_OP_GET_BYINDEX(0xffffffffffffffff, 0x1, 0x53, &(0x7f0000000100)={0x7, 0x7, 0x6}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6016000000102b00fc0100000000000000e2ff0000000000fe80"], 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0xa}, 0x20) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_FILES_UPDATE={0x14, 0x65, 0x0, 0x0, 0x8001, &(0x7f0000000080)}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) r4 = openat$vcsa(0xffffff9c, &(0x7f0000000000), 0x1101, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xf, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000cb116c00000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_device, r4, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'team_slave_0\x00', 0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000440)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = syz_io_uring_setup(0x10e, &(0x7f0000000140)={0x0, 0xfad6}, &(0x7f00000003c0)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x40, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, 0x0, &(0x7f0000000300)=@IORING_OP_UNLINKAT={0x24, 0x0, 0x0, r1, 0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x1}) r7 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000000, 0x4010, r4, 0x10000000) ioctl$vim2m_VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f0000000340)={0x0, 0x1, 0x7, 0x4000, 0xffffffffffffffff}) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000003c0)=@IORING_OP_CLOSE={0x13, 0x43, 0x0, r8, 0x0, 0x0, 0x0, 0x0, 0x1, {0x0, r9}}) sendmsg$kcm(r0, &(0x7f0000000380)={&(0x7f0000000e00)=@phonet={0x23, 0x0, 0x0, 0x37}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000180)="27050200590200000600002fb96dbcf706e10500070088a80000", 0x1a}], 0x1}, 0x0) syz_usb_connect(0x5, 0x50b, &(0x7f0000000e80)=ANY=[@ANYBLOB="12010003a70bc040711301945bfd010203010902f90402bc040040090428090ac936440706240600003505240000020d240f01bafaffff0800000003082407042a00fcff2e2413b7145638c2db7d3ae9b58c727dd328f6967f33b2248ceeeed5a325841fc6732bb3ef5337cc80595158a46404240209092107000101228000000205040807250181c8070009050e02ff07090604d6058bd96c4a399b16ad33db6a9a94f6c2aa01fda5d69908dac8c907bced8ce39cd86c6eab3ff03cac427946e51ab9f08e89916c998486934239f148acd9b32aa27077c53dda5e56e04d80dc67920ba56b997b4094f0c5b3323c3d3a1d2735518f34e26eea9db8d19bec9da7cc9b47911dd77a6f7ee90308f9bb28627739803224ecbeabc5d99379ff0b194009b48ef411238ae753c3451f1da90f0c958279aaa6a906238c1bb2ddbf7a8306b4e6b4fd397322d3bacd58542c0ccfd6bfd1f1893b2ee25290ce6d979f906e6e916188ba8e4a6728e30e09050b04ff03f8000709050c0c400082060b090502102000480409072501010001005c0bcc6181dd8b5f521c00800000d1432199c7fefce63f246c3d75f2f1f8aaa126990b890dbe9ad543169c8fb380b2d66068c992fffb6e62aea4c70b9594ef3842f66da156cd63b5988cbedcdd848a91563d0cdfb133f5c1ce942c5c0905020010008001900905071020000b040f73014191ba1e05d78958a5712279de665881f75c61aac455d87a66c277c0bb322267110a6e2f42b4528caf682942d8bc765017d093c604fd6827076fb631b5fe762c77cf2ca6d04f2d8cb3a62f56081ab452e8a78739f7aecd64b0f49b1dd363d4433222b074615ed5d41bcc7dd919770509050b03100205060609050508000207fb035f11e391ff1fc982491d05d2ea2ed193e47033fbebbc61ae84d94004e8dba8de10efd30baba8ed13332d650f718877a99d8c4a96f24995a7a041ac20977c188d5d9db32c1c6dcca3911df79f9a451833b470c2798d726dbd6c3424fae2b7e0483289717a9a15a96cf0fda5a30ec2f0d5a8aafe9db045b4146af774a9019f859f33142bd61d0e622a9348a666f8b1d17f5019ee729bf5346e75f38c9f7f1f6ec4c7c7055fba02ca35e9ba0cc0a0be8678ca7f3e8afbfe0904b40f04e6c504090b2406000002efd1d1cf9f05240006000d240f0103000000040000b4046024133ba8cc5da30cdf30ef1ae4dc64481f95d84f2738b194cbe152a984956dffdc8769fe538d3f9f99e92ab7d208dc7070debd5a582600da1071e86778e633e9a83b5b6ec50a8eced804887217ff3bee5efedf2a97d884a38e38d2e5f0133508240703030005000724140001090007240103ff04000b24020106011005b0bb2c090505040004700204090506002000100d110725010208060009050508ff0306030807250181080700f80abc0577dc26ce060ff9ef0267db34059b72b43a2c6e36d2b30c38a3688b025c1afebc9c77084d87bb282acaa777aa956cd933172efdd704735a300900d4a4345eb47c946e33f55e637d0edbbb5b702b130797ec944b55f53d92ce3dd428c0c0569f20b990f35afbc29b6b6737b753dbd54631c5048a930ec2ab64ac04f5c12ec3bc98c62ccf505671ece7d0d7a9fab039cebd33a1d618debb0711b36e11d92a00c478eee51c79418b1be3a3559c29eac07252be609ec9a63f657bd13e3e2a8bf8f99bc957a6253705ab4cd48f6ef0abe8b72663566f1bc7d8a2df74d2d73927e94b47d1acdac2ae86c470a853e5384a1db5bb18dec89109050b0c4006060f0b07250142090500f62bcf5b0728c5914d3ee66e96bc4a9152ba8e9b66e56e01bfd3b686c7ebdb8b956126281c6e5404ee6bdede7bc53a1c833f2e08aec48e5889cd315a00"/1364], &(0x7f00000002c0)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x201, 0x1, 0x0, 0x3, 0x8, 0x1}, 0x57, &(0x7f0000000240)=ANY=[@ANYRESOCT=r1, @ANYRES16=r1], 0x2, [{0x4, &(0x7f0000000080)=@lang_id={0x4, 0x3, 0x443}}, {0x52, &(0x7f0000000500)=@string={0x52, 0x3, "f0ec335e2c0bc6718e9d75a19b1d92e1cba2a87d0d0444d7dcd6c7aaeedfeea50c2ce332dc42c42d6ee6de6854dfcb07f42805ca1ee6f67ef8dac1b0e3b4eccc22c1835a30adbce5c14f27d138450605"}}]}) 2m38.895186626s ago: executing program 1 (id=1381): socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) syz_emit_ethernet(0x72, 0x0, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c2a, 0x4000, 0x20001, 0x1dd, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f0000000300)=0x0) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001a80)=ANY=[@ANYBLOB="b700050017000000bfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff0000000015040000000002000f030000000000003404000001ed0a0014040000170000801c400000000000007b0a00fe000000002c04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d0cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090d030000003acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931481747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885769754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8269b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd23834a50d7eb8e327fb5db12cbd6a9efe8e671c4f251fe3bf440cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa2c910fb8de24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d1767e31a3446cd57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c828c02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007f00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d05d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b530500d8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bd9b075f1488d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462aa2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783fefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9be0bdd37220e316f2297743dd4731614a50c16c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd08000000e843591d2618e2d2cdc7081c8fafffe9c350a5c554a387de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119d2a673bdae05779208409e6cf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8a9d3374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9eed636338f1835fc957729d63dc1bfc7b772cbe536c2d3aff27c22f9a2f876512616a5bdaf22a16e19d1b5f52abb40b433983d0cf50234de659c1a397ce901000000caae1bcfdce33dae6adc260321702f239c25ab181390e7dc8c1e5b1cf3b4fef1cd5c44a89b5e5d8314e02f4673ded90bce9a4025b0232eec970f7aa17f175a14e8dc0700bac0006b98a8283eee5665f3aede28228e0468dbcf8b776fe4c629d3af183a7cba5adf77f23d31f9d5a183c0da4e95f75b1496a97a46a06e4e1f5a8438d49dbd493ba2482c398ab724577fd742bf44cdd8489086e61aa3cb1d3ab3dac8183102fe6fc8a038e3868a0592811446867969f0fb3f547e83c4ca35aac023f09f15bb0acb3cdc6efd9b0e9df56af7fda01280a384028b35994388"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1e, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={r6, 0x0, 0x0}, 0x10) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_WRITE={0x17, 0x8, 0x4004, @fd=r6, 0xa, &(0x7f0000000240)="07529c7a038fbed43350e817efc51baf9fc3e22d2c6e4dedf8e0b748e3a33487832f7af05b5dc293be00ac2e8781a8ffdf1da7ae7b256a74cb78615858ad35f8d061da4c8225c58c819f2231d8fef35be49040bf29d84dd78df5f38663cbf854e7caf88d9c020fa2a5503d01ca26d0bd2179f848481f11c47d3fdc5f7bb923bfda4a83cf01660904eb4be2e561b3a50ac378f6714bf7ebe1453caaa92a", 0x9d, 0x18, 0x1, {0x0, r5}}) io_uring_enter(r2, 0x2ded, 0x4000, 0x10, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r8, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) connect$inet(r8, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r8, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000380)="cea5b4dd1bbc", 0x6}, {0x0}], 0x2}}], 0x1, 0x1) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x121c02, 0x0) ioctl$PPPIOCNEWUNIT(r9, 0xc004743e, 0x0) ioctl$PPPIOCSACTIVE(r9, 0x40107446, &(0x7f00000003c0)={0x2, &(0x7f0000000080)=[{0x50, 0x1, 0x2, 0x3}, {0x6, 0x0, 0x3, 0xffffffff}]}) write$ppp(r9, &(0x7f0000000140)="1627", 0x2) fcntl$lock(r7, 0x6, &(0x7f0000002000)={0x1, 0x0, 0x0, 0x1}) r10 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r10, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r10, 0x7a0, &(0x7f0000000140)={@my=0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r10, 0x7a8, &(0x7f00000001c0)={{@host}, @host, 0x0, 0x0, 0x2449, 0xfffffffffffffffd}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r10, 0x7a8, &(0x7f0000000040)={{@my=0x1}, @any, 0x0, 0x1, 0x9, 0xfffffffffffffffd, 0x80004}) ioctl$IOCTL_VMCI_VERSION2(r10, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r10, 0x7a4, &(0x7f0000000380)={{@host}, 0x8199, 0x800000000000000, 0x1}) 2m37.848134235s ago: executing program 1 (id=1387): capset(&(0x7f0000000280)={0x20071026}, &(0x7f0000000340)) (async) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='scalable\x00', 0x9) (async) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x2, 0x4e26, @local}, 0x10) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) openat$rdma_cm(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x208400, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)=ANY=[@ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r1], 0x20) (async) r2 = socket$inet6(0x10, 0x2, 0x4) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000480)={0xffffffffffffffff, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x1, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0], 0x0, 0xfc, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x40, 0x10, &(0x7f0000000240), &(0x7f00000002c0), 0x8, 0x76, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000004c0)=r3, 0x4) (async) sendto$inet6(r2, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x0, 0x0, 0x0) 2m37.695219719s ago: executing program 1 (id=1388): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r0, &(0x7f0000000240)={&(0x7f0000000180), 0xc, &(0x7f00000001c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="40010000010a010400008ffa747b0000080020070900010073797a310000000052000600594eef9ea2b5de5f4f3ec44d2e53d331f8a2164448617a64ac681b47e2b0b872eae6b09be2e9c3e756d774325294c250aeae0c99cd071f7814f516a3ec69da6dbe201fd1d6446968007fbeb352d30000b300060013d7db0b362a046f7efbad496ace556808bd1646be5f10dd18d590c09b4442b59adcf3d735782e23928b985a3afd5384b3ca102df3bdd58f0b110bdb78dc5b8aa8a5e3f94e2eca7bc54969911a86f06a8f1b3185a646a95b36294df1fdc48662d8e24d01c2c32ccb485a900e206eb2220e8781c784f66c8861adaf933ff39e8c34196f3b98ada1b28fb8ba5a2e42219766761b2b29d6e3b07e7f174d8d0b54c30d2d484648b85455dcf2db0821b9aff3a9e7a60dc4c122c28868ea0000000000020900010073797a3100000000"], 0x140}, 0x1, 0x0, 0x0, 0x4}, 0x8010) 2m37.568670164s ago: executing program 1 (id=1389): pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0xbe, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000000800450000b00000000000119078000000000000000000004e20009c907801000000000000007b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="180800000000001c000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000009500000000000000b7020000000000017b9af8ff00000000d60900001fffffff7baaf0ff00000000bf2700000000000007080000fffdffffbf9400000000000007040000f0ffffff640200000800000018220000", @ANYRES32, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000005000000b700000000000000950000334a000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a010100000100000000000200fffc0900010073797a30000000000800024000000001cc000000030a01020000000000000000020019000900010073797a3000000000aa000300"], 0x1e4}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x7fff, 0x0) sendmsg$nl_route(r0, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)=@getnexthop={0x28, 0x6a, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@NHA_ID={0x8}, @NHA_ID={0x8, 0x1, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000010}, 0x80) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0xb1, 0xbd, 0x2f, 0x8, 0x47d, 0x5003, 0x2f8c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xa0, 0x58, 0xb7}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r3, &(0x7f0000000c40)={0xc, &(0x7f0000000000)=ANY=[], 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000480)={{{@in6=@mcast1}}, {{@in6=@ipv4={""/10, ""/2, @local}}, 0x0, @in6=@loopback}}, &(0x7f0000000580)=0xe4) syz_usb_control_io$hid(r3, &(0x7f0000000200)={0x14, &(0x7f0000000000)={0x20, 0x22, 0x4f, {0x4f, 0x11, "8470db646d40673a0eb798bea47320debfdf40641188d73df2ce5a6ab616a7b70ccc5c7b17577729ce9ba18602ee8a33febd3bf82131911ce645cafd5bc9a5240e0823cd6bc981e54ad508f1ec"}}, &(0x7f00000000c0)=ANY=[@ANYBLOB="00038500000085034c0e3f1c3deabaf7359ad49ee1e402ff3351953b907ae79899d5116ff4d57cb491fb58402bdd701282c2653d119d5a4df6e15a194c2bca175aaef3a6b9450b5654a7eb67cc69f8399ecf95a257053a11bd9a8c551ae33efca4a518bfda1a229397424bc70d0d6fcd75abd5b963fa6b8bee512567f59474ce99a949970c62b55fda74ea"], &(0x7f0000000180)=ANY=[@ANYBLOB="00220100000c5d"], &(0x7f00000001c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x4f2, 0xd, 0x1, {0x22, 0x5e5}}}}, &(0x7f0000000440)={0x18, &(0x7f0000000240)={0x40, 0xe, 0x11, "4d4a5b40345a3b21487712987259fece13"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x6}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000300)=ANY=[@ANYBLOB="2001c200000013f6c0af76a37ebb8ce9004790970c579783c608a2b5729dde431825984ebb7018426cbd05a0b65b72fd2a15860edabbaeaf792586525c5411017f8a4cd96dd23c19445418fbdf76050d849cf5d701c6caf50de11cd513e22f51f313c1ddcf465b71f987e14af837aac358c84edbf2dcc9d0e4a2ab849f97fca4da26d8d018ad418bbcf3dd4089abf1d9a14c457a78d5d0f4a9689129eccdfa55f170a9554ed5ce114017e42c37f3271c901f818decc0e95ed719d62fd92b029f"], &(0x7f0000000400)={0x20, 0x3, 0x1, 0xff}}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r4, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$getownex(r4, 0x10, &(0x7f0000000640)={0x0, 0x0}) fcntl$lock(r4, 0x26, &(0x7f0000000080)={0x2, 0x2, 0x2007, 0x1fd, r5}) r6 = socket(0x10, 0x803, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r8 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$BLKTRACESETUP(r8, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x7ff, 0x10000003, 0xc, 0xfffffffffffffffd, 0x59c, 0xffffffffffffffff}) ioctl$SG_BLKTRACETEARDOWN(r8, 0x1276, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'veth0_to_bridge\x00', 0x8000}) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) r12 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSIFADDR(r12, 0x8916, &(0x7f0000000000)={'lo\x00', {0x2, 0x4e22, @empty}}) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newtfilter={0x78, 0x2c, 0xd2b, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {0x10, 0x1}, {}, {0xe, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x4c, 0x2, [@TCA_U32_SEL={0x44, 0x5, {0xd, 0x0, 0x3, 0x1, 0x4, 0x2, 0x6, 0xfffffffa, [{0x2000200, 0x500, 0x3, 0x6}, {0x6783, 0x80000000, 0x8001, 0x3}, {0x0, 0x53, 0xa9, 0x1}]}}, @TCA_U32_POLICE={0x4}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x24040084) 2m22.138638967s ago: executing program 33 (id=1389): pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0xbe, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000000800450000b00000000000119078000000000000000000004e20009c907801000000000000007b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="180800000000001c000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000009500000000000000b7020000000000017b9af8ff00000000d60900001fffffff7baaf0ff00000000bf2700000000000007080000fffdffffbf9400000000000007040000f0ffffff640200000800000018220000", @ANYRES32, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000005000000b700000000000000950000334a000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a010100000100000000000200fffc0900010073797a30000000000800024000000001cc000000030a01020000000000000000020019000900010073797a3000000000aa000300"], 0x1e4}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x7fff, 0x0) sendmsg$nl_route(r0, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)=@getnexthop={0x28, 0x6a, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@NHA_ID={0x8}, @NHA_ID={0x8, 0x1, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000010}, 0x80) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0xb1, 0xbd, 0x2f, 0x8, 0x47d, 0x5003, 0x2f8c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xa0, 0x58, 0xb7}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r3, &(0x7f0000000c40)={0xc, &(0x7f0000000000)=ANY=[], 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000480)={{{@in6=@mcast1}}, {{@in6=@ipv4={""/10, ""/2, @local}}, 0x0, @in6=@loopback}}, &(0x7f0000000580)=0xe4) syz_usb_control_io$hid(r3, &(0x7f0000000200)={0x14, &(0x7f0000000000)={0x20, 0x22, 0x4f, {0x4f, 0x11, "8470db646d40673a0eb798bea47320debfdf40641188d73df2ce5a6ab616a7b70ccc5c7b17577729ce9ba18602ee8a33febd3bf82131911ce645cafd5bc9a5240e0823cd6bc981e54ad508f1ec"}}, &(0x7f00000000c0)=ANY=[@ANYBLOB="00038500000085034c0e3f1c3deabaf7359ad49ee1e402ff3351953b907ae79899d5116ff4d57cb491fb58402bdd701282c2653d119d5a4df6e15a194c2bca175aaef3a6b9450b5654a7eb67cc69f8399ecf95a257053a11bd9a8c551ae33efca4a518bfda1a229397424bc70d0d6fcd75abd5b963fa6b8bee512567f59474ce99a949970c62b55fda74ea"], &(0x7f0000000180)=ANY=[@ANYBLOB="00220100000c5d"], &(0x7f00000001c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x4f2, 0xd, 0x1, {0x22, 0x5e5}}}}, &(0x7f0000000440)={0x18, &(0x7f0000000240)={0x40, 0xe, 0x11, "4d4a5b40345a3b21487712987259fece13"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x6}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000300)=ANY=[@ANYBLOB="2001c200000013f6c0af76a37ebb8ce9004790970c579783c608a2b5729dde431825984ebb7018426cbd05a0b65b72fd2a15860edabbaeaf792586525c5411017f8a4cd96dd23c19445418fbdf76050d849cf5d701c6caf50de11cd513e22f51f313c1ddcf465b71f987e14af837aac358c84edbf2dcc9d0e4a2ab849f97fca4da26d8d018ad418bbcf3dd4089abf1d9a14c457a78d5d0f4a9689129eccdfa55f170a9554ed5ce114017e42c37f3271c901f818decc0e95ed719d62fd92b029f"], &(0x7f0000000400)={0x20, 0x3, 0x1, 0xff}}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r4, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$getownex(r4, 0x10, &(0x7f0000000640)={0x0, 0x0}) fcntl$lock(r4, 0x26, &(0x7f0000000080)={0x2, 0x2, 0x2007, 0x1fd, r5}) r6 = socket(0x10, 0x803, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r8 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$BLKTRACESETUP(r8, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x7ff, 0x10000003, 0xc, 0xfffffffffffffffd, 0x59c, 0xffffffffffffffff}) ioctl$SG_BLKTRACETEARDOWN(r8, 0x1276, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'veth0_to_bridge\x00', 0x8000}) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) r12 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSIFADDR(r12, 0x8916, &(0x7f0000000000)={'lo\x00', {0x2, 0x4e22, @empty}}) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newtfilter={0x78, 0x2c, 0xd2b, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {0x10, 0x1}, {}, {0xe, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x4c, 0x2, [@TCA_U32_SEL={0x44, 0x5, {0xd, 0x0, 0x3, 0x1, 0x4, 0x2, 0x6, 0xfffffffa, [{0x2000200, 0x500, 0x3, 0x6}, {0x6783, 0x80000000, 0x8001, 0x3}, {0x0, 0x53, 0xa9, 0x1}]}}, @TCA_U32_POLICE={0x4}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x24040084) 9.562914681s ago: executing program 6 (id=1890): unshare(0x8040600) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f00000004c0)=0x27) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x6, &(0x7f0000000000)=0x9, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x80000000000000, &(0x7f00000002c0)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) syz_emit_ethernet(0x7a, &(0x7f00000009c0)={@random="856b1200ff00", @local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "381f34", 0x44, 0x2f, 0x0, @private0, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88a8}}}}}}}, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f0000000380)={0xe, 0x18, 0xfa00, @id_afonly={0x0, r4}}, 0x20) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000040)=ANY=[@ANYBLOB="54010000100013070000000000000000ac1414aa000000000100000000000000fe80000000000000", @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="0000000000000000000000000000000000000000320000000000000000000000000000000000000000004ec786000000000000000000000000000000000000000000444f606e1c98d81b00"/93], 0x154}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x4, 0x2, 0x3, {0xa, 0x4e22, 0xff, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8}}}, 0x32) setsockopt$inet_opts(r5, 0x0, 0x480, 0x0, 0x0) prctl$PR_GET_IO_FLUSHER(0x3a) r6 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x240) mmap$snddsp_control(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000003, 0x12, r6, 0x83000000) 9.562547071s ago: executing program 3 (id=1891): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x2e4, 0xb8, 0x8, 0xfa04, 0xb8, 0x6c02, 0x250, 0x194, 0x194, 0x250, 0x194, 0x4000000, 0x0, {[{{@ip={@empty=0x1e00, @broadcast, 0x0, 0x0, 'veth0_to_hsr\x00', 'veth0_virt_wifi\x00', {}, {}, 0x6}, 0x0, 0x94, 0xb8, 0x0, {0x0, 0x74020000}, [@common=@inet=@socket1={{0x24}}]}, @common=@inet=@SYNPROXY={0x24}}, {{@ip={@private=0xa010101, @dev, 0x0, 0xffffff00, '\x00', 'tunl0\x00'}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x0, 0x2, 'system_u:object_r:man_t:s0\x00'}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x340) 9.040141805s ago: executing program 3 (id=1893): mq_notify(0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0xa, 0x8010000000000084) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00'/20, @ANYRES32=0x0, @ANYBLOB="001000000000000008001b0000000000"], 0x28}}, 0x0) (async) bind$netlink(r1, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfc, 0x80000000}, 0xc) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x39}}, 0x8}, 0x1c) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) (async, rerun: 32) sendmmsg$unix(r3, &(0x7f00000bd000), 0x218, 0x0) (rerun: 32) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000140)={'#! ', './file0'}, 0xb) (async) cachestat(r4, &(0x7f0000000040), &(0x7f0000000080), 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000000300)={0x0, 0x2, 0x2, 0x6}, 0x10) (async, rerun: 64) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) (rerun: 64) r7 = dup(r6) syz_kvm_setup_cpu$x86(r7, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000004c0)=0x7) (async) r8 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000001c0)={'macvlan0\x00', 0x8000}) (async) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000240)={'macsec0\x00', 0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) (async) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) (async, rerun: 64) sched_setattr(0x0, &(0x7f0000000100)={0x82, 0x5, 0x5d, 0x0, 0x8, 0xffffffffffffffff, 0x7f, 0xfffffffffffffffe, 0x13}, 0x0) (async, rerun: 64) socket$pppl2tp(0x18, 0x1, 0x1) (async) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r9, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) (async, rerun: 64) connect$inet6(r9, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty, 0x40000}, 0x1c) (rerun: 64) 8.655277076s ago: executing program 3 (id=1895): socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) syz_usb_connect(0x0, 0x286, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000a1f169405909d02b9848000000010902740201000000000904a80010ff8a3700090505104000057f03090507010002080b04090503"], 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r3, 0x4188aec6, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000300)={[0xbb5, 0xffffffffffffffca, 0x100, 0xfffffffffffffff6, 0x6, 0x401, 0x6, 0x2, 0x0, 0x8, 0x100000001, 0xba25, 0x1000, 0x3, 0xfffffffffffffe00, 0x4], 0xeeef0000, 0x40080}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000140)={0x4, 0x3, 0x641352225ed612c7, 0x1000, &(0x7f0000cb0000/0x1000)=nil}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 8.630537275s ago: executing program 6 (id=1896): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x200800, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={0x1, 0xffffffffffffffff}, 0x4) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ipvlan1\x00', 0x0}) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$packet(0x11, 0x3, 0x300) r7 = socket$inet_dccp(0x2, 0x6, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040011) connect$inet(r7, &(0x7f00000002c0)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, 0x0, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000040)={@dev={0xfe, 0x80, '\x00', 0x37}, 0x15, r4}) r8 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000002c0)=0xffffffffffffffff, 0x4) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0xb, &(0x7f00000006c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x18d5}, [@btf_id={0x18, 0xb, 0x3, 0x0, 0x4}, @alu={0x7, 0x0, 0x7, 0x2, 0x9, 0xfffffffffffffff0, 0x8}, @tail_call]}, &(0x7f0000000380)='syzkaller\x00', 0x3, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000003c0)={0x0, 0xf, 0xc402, 0x4}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000400)=[0x1, 0x1], &(0x7f0000000440)=[{0x1, 0x5, 0xf, 0x5}], 0x10, 0x1, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x13, 0x19, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xeb2c}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @tail_call, @btf_id={0x18, 0x5, 0x3, 0x0, 0x3}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0x8, 0x0, 0x0, 0x0, 0x6}]}, &(0x7f0000000100)='syzkaller\x00', 0xfffffff7, 0x0, &(0x7f0000000140), 0x41000, 0x18, '\x00', r4, @fallback=0x22, r8, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r9, 0x6, &(0x7f0000000540), &(0x7f0000000580)=[{0x2, 0x5, 0x3, 0x9}, {0x4, 0x2, 0xe, 0x4}, {0x0, 0x5, 0x2, 0x5}, {0x4, 0x3, 0x4, 0xb}, {0x3, 0x5, 0x2, 0x3}, {0x5, 0x3, 0x1, 0x6}], 0x10, 0x8, @void, @value}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r1) setsockopt$inet6_tcp_int(r1, 0x6, 0x9, &(0x7f0000000180)=0x1, 0x19) getsockopt$inet6_tcp_int(r1, 0x6, 0x9, 0x0, &(0x7f0000000040)) r10 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r0, &(0x7f0000000080)) 8.314776492s ago: executing program 2 (id=1898): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x62402, 0x0) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$swradio(0x0, 0x1, 0x2) r5 = syz_io_uring_setup(0x117, &(0x7f0000000300), &(0x7f0000000280)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x7, 0x0, 0x0, 0x0, 0xc}) io_uring_enter(r5, 0x47f6, 0x0, 0x0, 0x0, 0x0) 8.196551259s ago: executing program 6 (id=1899): ioctl$HIDIOCGRDESC(0xffffffffffffffff, 0x90044802, &(0x7f0000000200)={0x40, "fe799809b15b38670a7d96e5f1f06d163befb527c31f632e66567f957aac8aa393de06ac537573829e8958305cd11c49167e8daf79dc4e00a9685b808231e9c5"}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) socket$netlink(0x10, 0x3, 0x0) socket(0x1, 0x2, 0x0) socket(0x27, 0x2, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240), 0x8042, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x143101) r1 = dup(r0) syz_io_uring_setup(0x5cb2, &(0x7f0000000240)={0x0, 0x4533, 0x10000, 0x2, 0x81e1, 0x0, r1}, 0x0, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000000500)={[0x5]}, 0x8) socket$inet6(0xa, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0xfffffffe) socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket(0x11, 0x800000003, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800060000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r2], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f0000001d40)=[{{&(0x7f0000000180)=@alg, 0x80, &(0x7f00000017c0)=[{&(0x7f0000000000)=""/62, 0x3e}, {&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)}, {&(0x7f00000003c0)=""/178, 0xb2}, {&(0x7f0000000480)=""/93, 0x5d}, {&(0x7f0000000580)=""/241, 0xf1}, {&(0x7f0000000680)=""/106, 0x6a}, {&(0x7f0000003300)=""/4105, 0x1009}, {&(0x7f0000001700)=""/186, 0xba}], 0x9, &(0x7f0000001840)=""/64, 0x40}, 0x199e}, {{&(0x7f0000001880)=@vsock={0x28, 0x0, 0x0, @host}, 0x80, &(0x7f0000001b00)=[{&(0x7f0000001900)=""/210, 0xd2}, {&(0x7f0000001a00)=""/39, 0x27}, {&(0x7f0000001a40)=""/154, 0x9a}], 0x3, &(0x7f0000001b40)=""/8, 0x8}, 0x4}, {{&(0x7f0000001b80)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000001d00)=[{&(0x7f0000001c00)=""/21, 0x15}, {&(0x7f0000000380)=""/16, 0x10}, {&(0x7f0000001c80)=""/102, 0x66}], 0x3, &(0x7f0000002300)=""/4096, 0x1000}, 0x6}], 0x3, 0x100, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001e00)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000000000480000000000e1ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f51ee988e6e06c8206ac6939fc404000000c788b277be1cb79b0a4dcf23d410f6accd3641110bec4e90a634199e07f8f6eb968f200e011ea665c45a3449abe802f5ab3e89cf6cfdffffffb8580218ce740068720000074e8b1715807ea0ca469e46968eea3fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000000000000005335000000143ea70c2ab40c7cb70c943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a33e680846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850af895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2200af6c7784a1975fa807de38a3a61e44a9ecab19bdfb15a32a4fd67ce446adb431d07db79240acaf091231b986e77d05d988d6efdffdf48dca02113a38300cabf2b5543ffc166955709009e000000000061629d1822f720ec23812770d72c700a44e113d17088fdd00600000f7889b8c7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f747c08f4010586903500000000000000000000be34cf652e28e700000000000000b24478a78a0f9d640dd782ac0cbc46903243d0d0f4bc7f253d0500000032daaf281c450e64c33aac8ff7e7d1c94c450503009688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0000f5e1671bc5eb7739daa7820a91cb0e732df2ae1d39c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b4cbaf5a6b649dd5f13cd776e6c7c4b5c4b0de20e033b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13e434aae9df81ecaf5f744f22f2e45afe2c9e8632276cffe5f1fc215c0797d0244cf1ce269d10525745caaa3f77d1b80116cb9a384002421d898913c45a9ac091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025e2a9a135c045a17e9a61c3b064e679508af1aec2926627b43bba1229a7466bdca64f514b7911458da09fe8681916d408d753226a83ae2434ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd911e0e5f00019be25b5910a3193e90be231a05fd82e6003969c3f081ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f5513662809073710937ed0055b238f466e1442f8ec7a5b"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r9, 0x18000000000002a0, 0x14, 0x0, &(0x7f0000000340)="b9e403c6630d698cb8a00b04339c07f7c9768bf6", 0x0, 0xfa, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) 7.648202811s ago: executing program 6 (id=1901): mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file3\x00', 0xc1c0, 0x0) r0 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) linkat(0xffffffffffffff9c, &(0x7f0000000800)='./file3\x00', 0xffffffffffffff9c, &(0x7f0000000840)='./file7\x00', 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001140)='net\x00') r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000000140)=0xfffffdfb) ioctl$TCSETSF(r4, 0x5404, &(0x7f0000000000)={0xffffffff, 0xc9a, 0xfffff001, 0x6, 0x18, "5cadf0fa59ebc3cef90ac43c5c135252e5d962"}) ioctl$TCSETSF(r4, 0x5404, &(0x7f0000000040)={0x3ff, 0xf7af, 0x8000, 0x8, 0x0, "4cb8b210acdc716f64cf76062d59a56f2584c4"}) r5 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0xffffffffffffffff, 0x2000, 0x0, r1, 0x8}) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000000)={0x0, 0x0, 0x0, r5}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@ipv4_newaddr={0x34, 0x14, 0x1, 0x0, 0x25dfdbfc, {0x2, 0x1f, 0x49, 0xcb, r7}, [@IFA_LOCAL={0x8, 0x2, @multicast2}, @IFA_LABEL={0x14}]}, 0x34}}, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r9, 0x4104aec6, &(0x7f0000000000)={0x25a, 0x0, 0x0, 0xffffffffffffffff, 0x5}) close_range(r1, 0xffffffffffffffff, 0x0) 7.337039878s ago: executing program 6 (id=1902): ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0xffffffff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xc65, 0x5, &(0x7f0000006680)) r0 = gettid() timer_create(0x3, &(0x7f0000000200)={0x0, 0x32, 0x800000000004, @tid=r0}, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0xd, 0x0, 0x0, 0x0, 0xfffffffc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='blkio.bfq.io_service_time\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) r2 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0xfffffeffffff7f7e, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000000180)="a5", 0x1, 0x10, 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000840)="9f", 0x1, 0x4080, 0x0, 0x0) sendmmsg$inet6(r2, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="a6", 0x1}], 0x1}}], 0x1, 0xc081) prctl$PR_GET_FPEMU(0x9, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000006480)={&(0x7f0000c2b000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000005380)=""/231, 0x107f, 0x0, 0x0}, &(0x7f00000064c0)=0x40) mknod$loop(0x0, 0xfff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={0xffffffffffffffff, 0x0, 0x0}, 0x10) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000480)={'syztnl0\x00', &(0x7f00000006c0)={'erspan0\x00', 0x0, 0x80, 0x10, 0x0, 0x5c8cff7d, {{0x5, 0x4, 0x3, 0x7, 0x14, 0x67, 0x0, 0x4, 0x29, 0x0, @private=0xa010102, @private=0x8010102}}}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000040)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl1\x00', r3, 0x20, 0x700, 0x1e, 0x889c, {{0x5, 0x4, 0x1, 0x1f, 0x14, 0x68, 0x0, 0xfa, 0x29, 0x0, @multicast1, @broadcast}}}}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000180)={0x8, 0xffffffffffffffff, 0x1}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) 5.324949419s ago: executing program 0 (id=1907): socket$inet6_tcp(0xa, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYRES16], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x10) pselect6(0x8a, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x0, 0x57d, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002800500010000000000080007"], 0x98}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[], 0x98}, 0xff0c, 0x0, 0x0, 0x4004}, 0x40000c0) 5.079939739s ago: executing program 2 (id=1908): bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, 0x0, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000240)=0x9) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getuid() sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) socket$kcm(0x2, 0x3, 0x2) socket$inet_smc(0x2b, 0x1, 0x0) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x7, 0x8002) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x3c, r4, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0x5, 0x34, @random="fe"}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}], @NL80211_ATTR_KEYS={0x4}]}, 0x3c}}, 0x40080) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000003fc0), 0x20000, 0x0) ioctl$SOUND_MIXER_READ_DEVMASK(r6, 0xc0044dff, &(0x7f0000004000)) timerfd_create(0x0, 0x800) r7 = fcntl$dupfd(r2, 0x0, r2) write$sndseq(r7, 0x0, 0x0) readv(r7, &(0x7f0000000000)=[{&(0x7f0000001140)=""/136, 0x88}], 0x1) ioctl$I2C_RDWR(r7, 0x707, &(0x7f00000001c0)={&(0x7f00000000c0)}) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r8 = openat$vimc1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_QBUF(r8, 0xc04c560f, &(0x7f00000002c0)=@mmap={0x7f, 0xa, 0x4, 0x4000, 0x9, {0x77359400}, {0x5, 0x0, 0x7, 0x2, 0x9, 0x7, "c6ce5046"}, 0x9, 0x1, {}, 0x2}) mmap(&(0x7f0000bde000/0x2000)=nil, 0x2000, 0x4, 0x50, r8, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000008c0)=ANY=[@ANYBLOB="48010000100013070000000000000000fe80000000000000000000000000003a00000000000000000000ffffac1414aa00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000003200000000000000000000000000ffff640101010000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000048000200656362286369706865725f6e756c6c290000000000000000000000007dfd9c4f0332b1dd000000000000000000000000000000000000000000000000000000000000000008000c000000000008000b0000000000"], 0x148}}, 0x0) 5.006048974s ago: executing program 0 (id=1909): r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x3, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x3a) connect$pppl2tp(r0, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x101, 0x0, 0x0, 0x0, {0xa, 0x0, 0x4, @private1, 0xd8}}}, 0x32) 4.866456559s ago: executing program 0 (id=1910): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x2, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4048aecb, &(0x7f0000000000)) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x62402, 0x0) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) r5 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cgroup_int(r5, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = syz_io_uring_setup(0x117, &(0x7f0000000300), &(0x7f0000000280)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffc00, 0x0, 0x4) socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_submit(r9, 0x0, &(0x7f00000000c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x7, 0x0, 0x0, 0x0, 0xc}) io_uring_enter(r8, 0x47f6, 0x0, 0x0, 0x0, 0x0) dup3(r4, r3, 0x80000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) r10 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) write$tcp_congestion(r10, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r10, 0xc01064b3, &(0x7f0000000040)) 4.159889349s ago: executing program 6 (id=1911): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="850000002e000000662100000000000016000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x8, 0x9b, &(0x7f0000000280)=""/155, 0x0, 0x24, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000001ec0)={0x2020}, 0x2020) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$inet6_IPV6_RTHDRDSTOPTS(0xffffffffffffffff, 0x29, 0x37, 0x0, 0x8) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x1d}}, 0x1c) syz_emit_ethernet(0x66, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffff0180c200000e86dd6012000800303a00fe8000400000000000000000000000bbfe8000000000000000000000000000aa0802907800000000600008100000000000000000000000000000ffff00000000fc0200"/102], 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x13, &(0x7f0000000740)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x262001, 0x0) r4 = socket(0x2, 0x3, 0x100000001) bind$inet(r4, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r6 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x1}, &(0x7f0000000140)="bb", 0x1, 0xfffffffffffffffe) r7 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x1}, &(0x7f0000000600)="3e13d23d346cfdeb1716f738274bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d2a43eba0b67b516bdc4a8b51a75bfd611b2d7ae6a21d056c2c5116a416987e082a8f5d67aa4a8e5a4526a76b0204dc55ea62cd300da54026d943a0b16aa0d43c809e0ed6e56163fdab317afd0d34d614367e549eed5aaa86dbe646fc0000000000000000000000009f4bce6cbc92b594d81e2ad9971b00468e826021bc0d74f363eb05abb4fc498eb7adfa01e94e64eb19a9ddd7fe7bf509542ebba62ac886217ec23d7c3dd18f7b59b59e82853747d004a77ab0568626fd93290673eaea5991ff845ebc7e4756999bfdd95368ba3edb6900c59c1607264dc977cf00e5c3a44158013fa8f85d75ee2d5346db18671fc439446a16cba014337897631957f86648458a1959bb7c5984c25af6481cc8e35055fc077bda357fe0728e27152116ac2423e3611dfa581f8cbb6bc5866d38bb7d9ef2322b8358fcf17fe749e9072c303bf6191681af2386c4f50a2efbd0afb185b122cccefcd84d34190e0f40671f44a97ae9fd186dbf8bbc473334654e0a7773f122edbc202d12ff0000000000000000000000000000a56aab46829087da307e7b4f65fdc9e322", 0x1d8, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={r7, r6, r7}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'hmac(sha1-avx2)\x00'}}) ioctl$KVM_SET_CLOCK(r5, 0x4188aec6, &(0x7f0000000040)={0x8000000000000000, 0x0, 0x0, 0x7fff, 0xf3}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'bridge_slave_1\x00'}) setsockopt$netlink_NETLINK_PKTINFO(0xffffffffffffffff, 0x10e, 0x3, 0x0, 0x0) r8 = openat$bsg(0xffffff9c, &(0x7f00000001c0), 0x200000, 0x0) ioctl$SNDRV_PCM_IOCTL_PREPARE(r8, 0x4140, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001e00)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000800000000000000100000094"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 4.126268359s ago: executing program 2 (id=1912): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) read$dsp(r0, &(0x7f0000000440)=""/154, 0x9a) epoll_create(0x7fffffff) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000080)=0x8001) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000001, 0x2010, 0xffffffffffffffff, 0x1000) syz_clone(0x0, &(0x7f0000000500)="29940656e07f07e35355b911fd73b1265942a25ada63cbd1432a4248ceb9068cb2370f246f74863958621472e0bf83d09d71e2cb9c0ac179e57862d39a3fc69fc8628bfea7a6628490eed0f1ef95b54d7f9706c5fba85664f72c42be172f17959a9edac693cb8e61468250b04a248d2610150253c738cb4cf174c38228455a035121e370cb14b63a4f37ba821f2d06c2b95501e06b39d4f4ffc7351b1529f871f9d3f52516bfe048170d929422ad36ee5d060f7f8891477d14b2a7ec7e00"/204, 0xcc, &(0x7f0000000000), &(0x7f00000001c0), &(0x7f0000000300)="d92ae79febc8ef52684509a034407e0ffaf6ab3c52324d9fab6b493196cc08db4cb72e676ffd17a9f7236ebb3760d3a0a9029fa446791fd8a9c90f72e370cae69febd652e0e2d4d13d82f29879e7818dc1bb3d924e6a77430f2dbe62582d8217c03e248a5b984d4598ec1843bd1491b03a793326dbfab95464a70370feec4a15cbee61d5924d4a286d3a923659dc1287bd4c9ab765939612e838a448cf4bf8a8882d4f799521a1f25891f50c8896a19ae3d5b474a56cd489c84d4f99c9182d152364e3aa18b413b5b399c57694782e4c899213a013aaf9307d0331d9b20e536499415a2585bb534bb14684dfe8b4fb3200") 4.049616206s ago: executing program 3 (id=1913): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) (async) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000280)={0x3}, 0x10) (async, rerun: 64) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="200000001600010000000000000000000a000000", @ANYRES32=0x0, @ANYBLOB="080009000100000006d5a60d03c0011ceb60d15ca8a8c9922da7d3b91dc84f910946b235bec94c68202e445c1e29ead1df3339d4ff9001318a45bff281be85faaa167113f33a9fc1f3503fb6da5a3e0337978f78eaeb76bbd3303f408f25ea08a89534cb69e3"], 0x20}, 0x1, 0x0, 0x0, 0x24008001}, 0x0) (async, rerun: 64) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000200)={'vxcan1\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000000)={0x1d, r3}, 0x18) (async, rerun: 64) r4 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x10100, 0x0, 0x3}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) (async, rerun: 64) r7 = openat$fb0(0xffffff9c, &(0x7f0000000040), 0x82800, 0x0) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r7, 0xffffffffffffffff, 0x0, 0x0, 0x22}) (async) io_uring_enter(r4, 0x48e9, 0x0, 0x2, 0x0, 0x0) sendmsg$can_j1939(r2, &(0x7f00000002c0)={&(0x7f00000000c0)={0x1d, 0x0, 0x2, {0x0, 0x1ee}}, 0x18, &(0x7f00000004c0)={&(0x7f0000000140)='\x00', 0x8}}, 0x0) (async) r8 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSBRK(r8, 0x5427) (async) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='illinois\x00', 0x9) (async, rerun: 32) epoll_create(0xffff) (rerun: 32) r9 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000240), 0x35c, 0x0) preadv(r9, &(0x7f0000000040)=[{&(0x7f00000013c0)=""/4096, 0x5}], 0x1, 0x5, 0x0) (async) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000002040), 0x410281, 0x0) r10 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(r10, &(0x7f0000000b40)={&(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10, 0x0}, 0xa900) (async, rerun: 64) close(0x3) (rerun: 64) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) 2.534664414s ago: executing program 2 (id=1915): socket$inet6_sctp(0xa, 0x1, 0x84) (async) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x3, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000180)="1a", 0x1, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x1, @loopback}, 0x1c) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000280)) (async) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000280)=0x0) rt_sigqueueinfo(r1, 0x5, &(0x7f00000002c0)={0xd, 0x0, 0x2000000}) (async) rt_sigqueueinfo(r1, 0x5, &(0x7f00000002c0)={0xd, 0x0, 0x2000000}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r2, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x2c, 0xd, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x3}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000040)=@int=0x81, 0x4) r3 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e22, 0x6, @mcast1, 0x8001}, 0x18) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000080), &(0x7f00000000c0)=0x8) 2.385244202s ago: executing program 5 (id=1916): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x20000000, 0x0, {0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}]}]}, @NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x801, 0x0, 0x0, {0x3, 0x0, 0x3}, @NFT_OBJECT_CT_EXPECT=@NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}}], {0x14}}, 0xa8}}, 0x0) 1.963792174s ago: executing program 5 (id=1917): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0002, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000d00)=@base={0x2, 0x4, 0x4, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x1, 0x0, r1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x0, 0x0, @void, @value, @void, @value}, 0x48) write$vga_arbiter(r0, &(0x7f0000000100)=@unlock_all, 0xb) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/time\x00') fchdir(r4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) readlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/211, 0xd3) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_SET_IRQCHIP(r3, 0x4048aec9, &(0x7f0000000140)={0x6, 0x0, @ioapic={0x1, 0x9fc, 0x0, 0x8000, 0x0, [{0x4, 0x1, 0xc7, '\x00', 0x81}, {0x4, 0x4, 0x4, '\x00', 0xc}, {0x0, 0x8, 0xf0, '\x00', 0xd}, {0x2, 0xe, 0x6, '\x00', 0x1f}, {0xf, 0xff, 0x2, '\x00', 0x3}, {0x0, 0x3, 0x7, '\x00', 0x78}, {0xb, 0x6, 0x7, '\x00', 0x4c}, {0x8, 0x6, 0x9, '\x00', 0x1}, {0x2, 0x8, 0x40, '\x00', 0x6}, {0x9, 0x3, 0x1, '\x00', 0x3}, {0x7f, 0x9, 0xff, '\x00', 0x2c}, {0x6, 0x1, 0x6, '\x00', 0x7f}, {0x5, 0x6, 0x7, '\x00', 0x2}, {0x7, 0x10, 0xc, '\x00', 0x9}, {0xe9, 0x8, 0x4c, '\x00', 0x7}, {0xe, 0x5, 0x4}, {0x4, 0x2, 0x4f, '\x00', 0xc}, {0x5, 0x4, 0x2, '\x00', 0x40}, {0x2, 0x6, 0x8e, '\x00', 0x81}, {0x7f, 0x0, 0x12, '\x00', 0x8}, {0x2, 0x2, 0x99, '\x00', 0x85}, {0x6, 0x8, 0xe1, '\x00', 0x4}, {0x7f, 0x3, 0x7d, '\x00', 0xd3}, {0x0, 0x8, 0x3a, '\x00', 0x5}]}}) 1.591189836s ago: executing program 5 (id=1918): r0 = syz_io_uring_setup(0x117, &(0x7f0000000300), &(0x7f0000000280)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffc00, 0x0, 0x4) r3 = socket(0x40000000002, 0x3, 0x80000000002) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000240)='wg1\x00', 0x10) sendto$unix(r3, 0x0, 0x0, 0x0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r3, 0x0, 0x0, 0x0, 0xc}) io_uring_enter(r0, 0x47f6, 0x2000, 0x0, 0x0, 0x2000) 1.427496812s ago: executing program 2 (id=1919): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x9b69, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008000400699b000008001b"], 0x30}}, 0x0) 1.208081595s ago: executing program 3 (id=1920): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, 0x0, 0x0) connect$pppl2tp(r1, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x101, 0x0, 0x0, 0x0, {0xa, 0x0, 0x4, @private1, 0xd8}}}, 0x32) 1.097820754s ago: executing program 5 (id=1921): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="d8000000180081054e81f782db4cb904021d0800fe007c05e8fe55a10a0015000200142603600e12087c05007f370401a8001600200006000500027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2e98a61e284ce5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e970392", 0xd8}], 0x1}, 0x0) 957.335217ms ago: executing program 3 (id=1922): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x80}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x400008a, 0x0) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x38e38e38e38e3ed, [{{0x9, 0x2, 0x32}}]}}, 0x0) syz_usb_connect(0x6, 0x274, &(0x7f0000000180)={{0x12, 0x1, 0x110, 0x3b, 0x4b, 0x15, 0x8, 0x5e0, 0x600, 0xa95f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x262, 0x2, 0x1, 0x0, 0x30, 0x0, [{{0x9, 0x4, 0xae, 0x9, 0x7, 0x2b, 0xbb, 0x26, 0x2, [@generic={0xc9, 0x24, "c7ba75c7eb2442c0139b879b7c5ada3b4a2125fb8757577d498affe732fc7c0e4ef1d363b00df7a6251e2e491c5af81b898e4db50ed56f5299deb6115a0146c11a006893f74672bb53a8044f49629387de8b5b458f4e05949454986af0f0ce21ec1dedb0be90750faf04b9abc73fbcb0452b06345078c1cb788d1f375c0a00c6f874243fa0ea26fb46a59cf82c06eadb8f5fa68913b07384c6e311dbae4c8921399aa5d69ee17be28fff406190b1c3b125931b5e60f5ecfa7e0bde66800373b9988dd6b07f7cab"}], [{{0x9, 0x5, 0xd, 0x8, 0x20, 0x1, 0x8, 0xbf}}, {{0x9, 0x5, 0x6, 0x10, 0x400, 0x80, 0xb, 0x7f}}, {{0x9, 0x5, 0xc, 0x0, 0x433d4feed789444c, 0xa, 0x3, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0xf, 0x6}]}}, {{0x9, 0x5, 0xd, 0x1, 0x10, 0x0, 0x1, 0x1}}, {{0x9, 0x5, 0x80, 0x0, 0x400, 0x8, 0x34, 0x80, [@generic={0x32, 0x23, "c5662d673cab8a4363f0f98d65d14f4db8690c294f1415f663acf4c0d602283dc3561a7444129d071e8ea46dc54d6ff2"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x40, 0x2, 0x4, 0x8, [@generic={0x1f, 0x11, "bd23b3c3c6c7080047711bd639c0d8d774135562f846e77b88a78ac0ea"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x1, 0x800}]}}, {{0x9, 0x5, 0x7, 0x4, 0x40, 0xa, 0xb2, 0xa, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x3, 0x6}]}}]}}, {{0x9, 0x4, 0xcb, 0x3, 0x1, 0xff, 0xff, 0xff, 0x69, [@cdc_ncm={{0x6, 0x24, 0x6, 0x0, 0x1, "c0"}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x4, 0x1ff, 0x5, 0x78}, {0x6, 0x24, 0x1a, 0x4, 0x2}, [@call_mgmt={0x5, 0x24, 0x1, 0x1, 0x7}, @obex={0x5, 0x24, 0x15, 0x7f}, @call_mgmt={0x5, 0x24, 0x1, 0x1, 0x8}, @country_functional={0xc, 0x24, 0x7, 0x9, 0x3f3, [0x3dec, 0x0, 0x40]}, @dmm={0x7, 0x24, 0x14, 0x4, 0x9}, @mdlm={0x15, 0x24, 0x12, 0x49}]}], [{{0x9, 0x5, 0x1, 0x10, 0x10, 0x7, 0x3a, 0x4, [@generic={0x7b, 0xa, "e54016daaafed3bbb8f25b254cd15617073149fd55886f90f44925bfdad60bdabca2ab0362863ab4f434e6ae351b3307cc643b84ef25a4bd232034ba1e68027433c9840e5779aa7741050cce40144ca5a666772c8823f163b11c56504c22108f8618127fd95b0ab9ddfa644dda8265ed54c7006481726a5029"}]}}]}}]}}]}}, &(0x7f0000000940)={0xa, &(0x7f0000000400)={0xa, 0x6, 0x200, 0x81, 0x1, 0x6, 0xff, 0x10}, 0x5, &(0x7f0000000440)={0x5, 0xf, 0x5}, 0x9, [{0x49, &(0x7f0000000480)=@string={0x49, 0x3, "c7bb63e3f16055eb4ed78c8b4b96bd27a7eb1ad44a6fb9c59fe8d859bf073d5006276060e6a792e77e7cab84f6616ca6b9afd837aa1218b8fc37d5dff2986e9773e75326a1d2ae"}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x423}}, {0x3d, &(0x7f0000000540)=@string={0x3d, 0x3, "ca6e10cc3978572d147fefe4a80aef7ea997314fee1071c2d780ff93121fc60a68a954d49788ce294d47b0214846de9d68838e92d5e626c540edb2"}}, {0x52, &(0x7f0000000580)=@string={0x52, 0x3, "1fd4defaad485780eae83cba66d91e4a6d895de6cb8c00da3a4cf34ac8bcd766900c8b17533428aec3aaa23aed440c64eb991dd7ff4fff3efb7fbbcfbcbbadca78c1380fbf8aac1d632a2f93f0d2aefb"}}, {0x80, &(0x7f0000000600)=@string={0x80, 0x3, "70678a3b7086aecb93196a1033abd050695a6a806b77b3fcd0c3eb78136dda40f7c430841a7be808802a1a0186d728ca5976b4663fe81631dd22ce2aa2a946d4586bb3ce566cce8a931fff24a9533e559bdd54fb18c070963235a3b55ffd73b2b2ea8d7f88c45cf63cc736d6c89ac6e010cee1f247e0a7484dbb90c690ad"}}, {0xab, &(0x7f0000000680)=@string={0xab, 0x3, "36d22e2966990e804f6335be7f87cb13193f703788b7f890425870633f6cdcc52d973609a5a3d49e11d3f5e730f74acb8053e53b43df1438dac1be433ce4f92a7a0db94481a6bf5f6148345bb98645f2355f99c5a1e0c409af8d621387e42872d383847946c700af0feffca412b3433424aab4d703c4881106fcb05db47caecd511d489896640678804b90bd47f1b26d960ab09bfa713a7fe13cbccfc1b41b77c0d1b79ac38b57dbfe"}}, {0x90, &(0x7f0000000740)=@string={0x90, 0x3, "d5be95d2f5fe4df6d4f11a660749931a8385f0b15514d2588c81441e81cb1192fecdb7207388aff5ad4950b745fbd5bcfddaeee0493aa4051bdc92bebb117309208e34a76dabb7bef72a19c829f0b22fe75b6c3dde9ecff038d56511006752e70b447df5d96b796dc06ee0360bc7a6fe0376970fa1dddd4166d1c8ec6b881c3ca4b2a51f30a4a1188b27c5b3a6a3"}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x80a}}, {0xe2, &(0x7f0000000840)=@string={0xe2, 0x3, "dea7ea8df8bc93110eaa69f1624f702568f69297226b2a481d7234f2ace468ea2cb20461f99c550e76b983a4cdbf256468339e81d18a38788421d64a1cd8369ba7e6e5f65ea60cfc98b58dd8ae71b5af7302dd315b4947cbecb989547858d2d7ca8c6d541004ea62de22630ba4dfd0ef42751ccfec18e438d13d51a2b2b9fac14cb35375c7d43f37e6af204546e68153c9bb88bbfb3b781c3a3d3ece3f1bc85fbd7dfc87966530277e456693450b67f194f00098fb09373aa5a9af8f762be1d8f8b1f0f0f34a28e44d9a55540f7cf2be62780e57d4bfbd9bd99ae9c463ff996c"}}]}) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f00000000c0)={0x2, 0x1, 0xfffff000, 0x0, 0xfff}) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, &(0x7f0000000b40)='wg1\x00', 0x4) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x1c, &(0x7f0000000080)=ANY=[@ANYBLOB="1800004e102fccd8a5ef8ccec11b0d08aba7b6baafb912b8daa5cde5aee8938f47dd4faf19da3d2b73122c9302a3fccd2b4f845f8e6fce9fa8797ca8ac367a935e364ec525149f078c62d8d9d753497dd68cbc63cb0262454e32dbd45aeba2c079f1ab400600000001d181c4918cdad276ecafb322e6b18a113a0cef90e308804b786a6181224da9be544315c837b844bbe8a17f44fd623dace92757f768538605dca74156169ac8bc779cb44b47839b2034fab8c3dcbb1135f67468b817bcaf224ecc4b7d8ba41268028a8bdf990ee7"]) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r6], 0x5c}}, 0x40) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)=@getchain={0x44, 0x66, 0x4, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xb, 0x2}, {0x3, 0x3}, {0xffe0, 0x9}}, [{0x8, 0xb, 0x7}, {0x8, 0xb, 0x7}, {0x8, 0xb, 0x4}, {0x8, 0xb, 0x6}]}, 0x44}, 0x1, 0x0, 0x0, 0x14}, 0xc050) 812.67935ms ago: executing program 2 (id=1923): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141121) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x38fe, &(0x7f0000000300)={0x0, 0x1fffff, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r0}) io_uring_enter(r2, 0x2def, 0x4000, 0x0, 0x0, 0x0) r5 = socket$isdn(0x22, 0x2, 0x26) r6 = socket$isdn(0x22, 0x2, 0x2) dup3(r6, r5, 0x0) r7 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r8 = userfaultfd(0x80801) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x10c}) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r7, 0x20, &(0x7f0000000000)="1eb3bf65654102f4af4d221c8bd458d1e7cbdaf3657d0f34e790c85bdba7931791f6d15c3e681411f7a496c0dace6a3c242f5b016f64b4ef8a9cedaf6bec340dee49474360b24cb8", 0x0, 0x48) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000300)=ANY=[@ANYBLOB="000000000800020004000000"], 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, 0x0, 0x0) r10 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r10, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/65, 0x328000, 0x1000}, 0x20) r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xe, 0x7fff0000}]}) close_range(r11, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000080)=[@in={0x2, 0x4e24, @broadcast}], 0x10) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(0xffffffffffffffff, 0x0, 0x0) 812.210993ms ago: executing program 0 (id=1924): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)=@migrate={0xa0, 0x21, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@migrate={0x50, 0x11, [{@in=@rand_addr=0x64010102, @in6=@dev={0xfe, 0x80, '\x00', 0x44}, @in=@rand_addr=0x64010102, @in6=@rand_addr=' \x01\x00', 0x3c, 0x0, 0x0, 0x0, 0x8, 0x2}]}]}, 0xa0}}, 0x0) 640.176663ms ago: executing program 5 (id=1925): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x3c, 0x24, 0xd0f, 0xfff1, 0x0, {0x60, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8}]}}]}, 0x3c}}, 0x0) 502.156489ms ago: executing program 0 (id=1926): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f00000004c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r1, 0x0, 0xa, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000002940)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback}, 0x1c, &(0x7f0000000340)=[{&(0x7f0000000780)='\x00', 0x1}], 0x1}}], 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, 0x0, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) ptrace(0x10, r2) 301.755366ms ago: executing program 5 (id=1927): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xb, 0x8000}}, './file0\x00'}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r2) bind$inet(r1, &(0x7f00000006c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x43}}, 0x10) sendmmsg$inet(r1, &(0x7f0000000b00)=[{{&(0x7f0000000c00)={0x2, 0x4e20, @multicast1}, 0x10, 0x0}}, {{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000800)="e3f806d514c621da18f05a9d5eec1ee7e2027d6e89a1c892b469c6ff3e014a164e0313e7e4ccf8d53441ef09359abb851b03c12ea2827a34cfe17d1a235f593d7c1b993859b93fc6976b017f8b9378a03975e4c177350382c8ffe24faaa1c9905bbb370e22892e90351cd256bd50b08c6ed207edb32b5b0a4756385bb5eedbcdba4fabebfbecbba4248eb3cd27df89f0", 0x90}, {&(0x7f00000008c0)="76fbdea555954d6c2bdadcbca5bab7e2c0d843938f424e92da7e067cec01424455e14ae8eb3eff5758a4554ed267df117eea923971270a15d0aafd881dfeebcff003a164a403c721b8220805b96e1b0ead813956c8baa5634f2837b99e42367ccdd4bcdf7a1b78e6e578bd0f03f5eb2971444d16a2a821b7754318ee1f8356b58530d0629987fad59bcaceeb40298b70b811c0", 0x93}, {&(0x7f0000000d00)="d3db3eeae6e6279e7b7a5e2f846ed8f2b7feeec7f3ecd9f9e34d05f26f61e2de2adbd809a1c9258ecbeb84aeb47b98f89acd078d10bc429b9e43023be3ba52d3ee372808ea179cb40174d345e73cdf10b7ee065c5c0b86c0a64a453fde3365bc15f0e8a2e2d2f04c26a2162653bdb5", 0x6f}, {&(0x7f0000000980)="b6090017a45aefc247a87516fda7f33aaa14a849adf632b00bfa6d2936", 0x1d}, {&(0x7f0000002c40)="8727802a78a28f1e8bdabcb65e0d1e087aabe434642e40b8d987cdd07d6f51d6b1f516f1fcd42749651416cebf08676d66003db3188f1032ad1e95a0004bcf8e948953382cf4abf79e44180dcda304766fbb9aee762a530066a0c7e9599f3dbd712100c024a118e2278a81d5ecc7b9120247392f1448fc1f4f0be55ffbcf661a552141cb154a82a050193fb0397cabf8dffd8a42e54bde38a4682d40d39429fe5f52af2f10725e2346c2cc5a4fd69bd899c767efb2c3c38bb9547226988fb5c6019284a36fa42126798305bbea739c168fd8ca7c59d778af21e101d266a0a9e7d07d3c0aa49555102ea13de4931a127f5d3415dadc5dd943516d610f24644608d28791d94add295aafae8244c23b1377b14e48384c80a8498da6e869389863e7c3200e345d9be8dffa0f049aa43a4ecbf229dcfb6abae32b3f503e88120d1e0a1687b8b3f7307e30b504d41ad1d1ae69168e5fef02fbdfec2129b5d11f8dcff0e54397d8d85c107a9fe21a2618dd0d16af281fee88178df1dc0ad787c85b299cf12d221139b61122ad1af76a0eaf4bff13f0ef49592506c53bee5d41ec1d37feccce35b34bcf637beda6dc0085bad0090e1640b68c6d7de5e3ed0d119a2d090195aeb84f919495b4d8e0f6894ceb4c6b064d1b3bad6fbbc58069464d63608a99be83127590022125a654920dcdd4c9dfc5a9d15eb83c6c45d59b3ee825616c83aef130eac29a5cde0b8c0a040a46414ad9a8ce577180044dccf49e163b83359ed602cd43f456e7d1689e35447f91279291f3479d0d80c846d78ac1d4c4385a83897362e486dca3717bd08a0f95aab79b861f27985534e142e20ac36ec9a47f359096b9d791921a6ac6dee014de3d964a9bca77fb071915e9016cb298956ab4be0cc51a1cc3b061f306f3d9978f30c98f9d2fe13ba14ae8bf4142baf7b6de3ddf8867281c3d041da40954fc2ae5f094a7b966bcabdd9ed0ca1cb48f369fc377412a0ed76457a44fa47065c3f9d9533f0c48cedecc988eb4e4c0be3ff159b305a28d4818308530100cdfc01980ca0f586a9648c6f8c06f3ac58ed39465a1f6d3283175d9e1d0175fb308a1f68dbfc13a054a15e0e3ad852616337eb2a294c00d42dc5e4b3dfb92a77dd1d1af898ad79ac576a07f271b6d0609b26a719ce52878f710cdfdeb326391f6e8156f55eed6b8b7b79f4e3e416020f5dfdde0ae74dbb28a2218f872767f8e91f0644f86a9dd1b3084d9cf055839dba711ae4818ac4124596aaafed497eff810f8050757d3e435a6e8e8c184d6a6dba043457ceba4ae3ae01655e2d86b207a9ec3155c8cc86447546ee7562a171cf13fcdbe251bb8b4e179ea", 0x3c1}], 0x5}}], 0x2, 0x2004c044) sendto$inet(r1, &(0x7f00000000c0)="86", 0x1, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000180)={r3, 0x7}, &(0x7f00000001c0)=0x8) 0s ago: executing program 0 (id=1928): sendmsg$tipc(0xffffffffffffffff, &(0x7f0000001840)={0x0, 0x0, &(0x7f00000016c0)=[{0x0}, {0x0}, {&(0x7f00000005c0)="baa6f9b4a49090ef8cf9e698cfe9a693373d5a777492f222b12b85a975f6da0722f1360f3734f38c8fcb5221cf36c73d975b8a0965b77c7ab6ecc0775f7c8e93766923568a96a7d5814549f8f7c9dfb23859bce4a864f3bc4d231444bc008f78da4882e17fdaa7ed7ae83aa032c240bca73c40ef971639e6b231fbf71049131216eac8d918bfab453d7dc38ccf46c56ca6649b38fafb9bb73d9d8c12ca69b3624e3a9133f55a88c32e2a04bcde603c9e679e62f91b6661bb1778c093d03642f6fec07f92fcaee5a497c544fc72e8953ddfa4d30a23bf60644f2bc64856628b96dc7e1fc2c1e5eebe0f89642e4b1c3ce0050d577d15c91ead8cb5339f9fd43c310c6872cd1845196bdbf3414d483b93ccef01f3e9ad0612120df49a7e152f031e99657284a3d286c825820455eea812b727c1109a55f335ab83532f151eefd72567ffd85292598b7bacd8082bd59eeb5ebd5f43e658143453859d68d3f3b6493bdfadb8e89463ef17da7e8f890d9f751cf2f92c68cc5d89930eb69c2782f12602e958af3aae4894a356e32b63c8448b0b555c446029a9bbf1b6d1abfec6b793254dadfb0181067a22589cf20d31d72851e67f5389ef360d9107ba977d7c0dd2cac65eca38a7652bcc9669b684a27c6e8f0d0c54697ed619baf1ad7b62cf41dd4d9b6c56aae0d6e1240439a21f5211245c992015cb2a03c6fe0e123331bd352fa9f54a71add924952bd0aafc9e181824fbe7029f29fe34723746eecd4dd4fe42f6ac41aa0a34eedba5c6678de04891d9a9f324d27a405607c8a2169d000b246a32d450533c9bed96a3736d67fcc58241fd3624476d3157ec02ab5ebdc19cc442a504b614e876e803c14d6b3538bc9a4a80793a252d7a8786a1425f270580e7a6980d2908649cbfe9195f60d86b5d492fbe5e746115f12ac34a8f175a8be057d7017479b2cef6d07e3c37ffc9a2c7a66acb7f0992a46575c2c7456de0af0dc04f03996860d36397248779415bca40bdc97907064e614ee14bdefd9261c6ceb58f847ad5e56c29291b5737b53a4aa895ad84b136a451a57b8d1ec1914c6d89067373962b530a26b2c7f52813ce1192fad3974857438c133be0ada3903dcdd55a0e22bb67949cd8e3d80afd8beb3f36693b229b7f4ccdc994522bd08cafe342d428b62812e6935f2f1517510745e91c4805703f2bce6805b99a2358a60d07d001b44d66a8f160b24ac3c7f5ecab05fd309031a7f79fc2ee89fb11b6e8ea4b67c0b8e4e6ebbfc8ff0150ac2347b516ad939fce591dc35e57d26b6c6c8e76f65a356f96bd36c6f46f7da66f2398422f29cbb59561b8600ae22b2403d99fd2bd5911e24a7937f22608558c9d45d5f7ee4e82dc41fcc6d12d30ed2b323d1568ddbc67c0b3d1b640fdaae285a2c128f6290b59c0e5e0be360f15e41bd129e2b300023bbbfa31ad3726571f9de6bab49e7d44b1575af2eab443413343ceb0bf904b1f65c599f6128febf23f0777165a15e04943e91c2f0fd01372f29dcab778eebb8114b6d78ef22a2ca3aab9576472ac02f56730c1d63dde1097262d232a8539021e4cf1fabab1d9a78d9be56acd5545251ff4fd9c5006d2f09425820ab6c33a80043f263c735102d4b0c92ec17843c833dc416aab08b966001e07c9f3c2c148c13a17c5741fad5a5f4bee75dedad48b3b789c33a5bb05a3f84b5b7f51cde05adff46b71ba4c75a0d6f3e6ec726f0fd88f57a4915b849e646cae8ef6cffd6ddb77d6f51bea6b052a6eed1a068a921580c627eb251e2733", 0x4f2}], 0x3, 0x0, 0x0, 0x8081}, 0x1) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="20010000", @ANYRES16=r1, @ANYBLOB="050000000000030000000f00000008000300", @ANYRES32=r3, @ANYBLOB="47000e00800000000802110000000802110000015050505050500000000000000000000064000000000602020202020204060000000000000602000025030034003c040106b80400080026006c09000008000c006400000008000d0000000000a2000f00019c"], 0x120}, 0x1, 0x0, 0x0, 0x90}, 0x0) kernel console output (not intermixed with test programs): ][ T978] usb 3-1: USB disconnect, device number 83 [ 445.629865][T10465] FAULT_INJECTION: forcing a failure. [ 445.629865][T10465] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 445.668270][T10465] CPU: 1 UID: 0 PID: 10465 Comm: syz.6.1492 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 445.668304][T10465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 445.668319][T10465] Call Trace: [ 445.668328][T10465] [ 445.668337][T10465] dump_stack_lvl+0x241/0x360 [ 445.668378][T10465] ? __pfx_dump_stack_lvl+0x10/0x10 [ 445.668410][T10465] ? __pfx__printk+0x10/0x10 [ 445.668452][T10465] should_fail_ex+0x424/0x570 [ 445.668482][T10465] prepare_alloc_pages+0x220/0x610 [ 445.668516][T10465] __alloc_frozen_pages_noprof+0x162/0x5b0 [ 445.668545][T10465] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 445.668592][T10465] alloc_pages_mpol+0x339/0x690 [ 445.668628][T10465] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 445.668668][T10465] vma_alloc_folio_noprof+0x12d/0x260 [ 445.668703][T10465] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 445.668735][T10465] ? __pfx___pte_alloc+0x10/0x10 [ 445.668766][T10465] folio_prealloc+0x2e/0x170 [ 445.668788][T10465] handle_pte_fault+0x2e45/0x61c0 [ 445.668833][T10465] ? __pfx_handle_pte_fault+0x10/0x10 [ 445.668855][T10465] ? is_bpf_text_address+0x26/0x2a0 [ 445.668886][T10465] ? is_bpf_text_address+0x288/0x2a0 [ 445.668909][T10465] ? is_bpf_text_address+0x26/0x2a0 [ 445.668935][T10465] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 445.668969][T10465] ? kernel_text_address+0xa7/0xe0 [ 445.668991][T10465] ? __kernel_text_address+0xd/0x40 [ 445.669010][T10465] ? unwind_get_return_address+0x4d/0x90 [ 445.669039][T10465] ? arch_stack_walk+0xff/0x150 [ 445.669123][T10465] handle_mm_fault+0x1129/0x1bf0 [ 445.669184][T10465] ? __pfx_handle_mm_fault+0x10/0x10 [ 445.669233][T10465] ? __pfx_find_vma+0x10/0x10 [ 445.669266][T10465] ? vma_is_secretmem+0xd/0x50 [ 445.669293][T10465] ? check_vma_flags+0x51b/0x590 [ 445.669331][T10465] __get_user_pages+0x1adc/0x4180 [ 445.669403][T10465] ? __pfx___get_user_pages+0x10/0x10 [ 445.669433][T10465] ? __gup_longterm_locked+0xd86/0x1850 [ 445.669470][T10465] ? __pfx_down_read_killable+0x10/0x10 [ 445.669504][T10465] ? __lock_acquire+0xad5/0xd80 [ 445.669544][T10465] __gup_longterm_locked+0xec1/0x1850 [ 445.669601][T10465] ? __pfx___gup_longterm_locked+0x10/0x10 [ 445.669636][T10465] ? sanity_check_pinned_pages+0x11b9/0x12a0 [ 445.669670][T10465] ? gup_fast_fallback+0x203f/0x2980 [ 445.669706][T10465] gup_fast_fallback+0x2227/0x2980 [ 445.669748][T10465] ? __pfx_stack_trace_save+0x10/0x10 [ 445.669798][T10465] ? rds_info_getsockopt+0x201/0x620 [ 445.669828][T10465] ? __pfx_gup_fast_fallback+0x10/0x10 [ 445.669857][T10465] ? do_fast_syscall_32+0x34/0x80 [ 445.669882][T10465] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 445.669949][T10465] ? is_valid_gup_args+0x124/0x200 [ 445.669984][T10465] pin_user_pages_fast+0xd2/0x160 [ 445.670020][T10465] ? __pfx_pin_user_pages_fast+0x10/0x10 [ 445.670049][T10465] ? rcu_is_watching+0x15/0xb0 [ 445.670077][T10465] ? trace_kmalloc+0x1f/0xd0 [ 445.670107][T10465] ? rds_info_getsockopt+0x201/0x620 [ 445.670146][T10465] rds_info_getsockopt+0x228/0x620 [ 445.670183][T10465] ? __pfx_rds_info_getsockopt+0x10/0x10 [ 445.670215][T10465] ? __might_fault+0xaa/0x120 [ 445.670252][T10465] ? rds_getsockopt+0x2d3/0x530 [ 445.670274][T10465] ? __pfx_rds_getsockopt+0x10/0x10 [ 445.670298][T10465] do_sock_getsockopt+0x391/0x740 [ 445.670328][T10465] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 445.670349][T10465] ? __fget_files+0x2a/0x420 [ 445.670373][T10465] ? __fget_files+0x39d/0x420 [ 445.670391][T10465] ? __fget_files+0x2a/0x420 [ 445.670420][T10465] __ia32_sys_getsockopt+0x2a1/0x370 [ 445.670452][T10465] ? __pfx___ia32_sys_getsockopt+0x10/0x10 [ 445.670479][T10465] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 445.670506][T10465] ? lockdep_hardirqs_on+0x9d/0x150 [ 445.670536][T10465] __do_fast_syscall_32+0xb4/0x110 [ 445.670562][T10465] ? exc_page_fault+0x5f8/0x920 [ 445.670593][T10465] do_fast_syscall_32+0x34/0x80 [ 445.670621][T10465] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 445.670647][T10465] RIP: 0023:0xf7f91579 [ 445.670667][T10465] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 445.670686][T10465] RSP: 002b:00000000f50b655c EFLAGS: 00000206 ORIG_RAX: 000000000000016d [ 445.670708][T10465] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000114 [ 445.670723][T10465] RDX: 000000000000271b RSI: 0000000080c35fff RDI: 0000000080000000 [ 445.670737][T10465] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 445.670749][T10465] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 445.670762][T10465] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 445.670794][T10465] [ 447.318999][T10473] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1495'. [ 447.917011][ T9] usbhid 1-1:1.0: can't add hid device: -71 [ 447.952192][ T9] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 447.963328][ T5898] usb 6-1: USB disconnect, device number 38 [ 448.023193][ T9] usb 1-1: USB disconnect, device number 65 [ 448.465343][ T96] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 448.623472][ T96] usb 6-1: Using ep0 maxpacket: 16 [ 448.640173][ T96] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 448.659452][ T96] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8422, setting to 1024 [ 448.683467][ T96] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 448.715575][ T96] usb 6-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice= 0.00 [ 448.752088][ T10] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 448.790182][ T96] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 448.842749][ T96] usb 6-1: config 0 descriptor?? [ 448.924096][ T10] usb 1-1: config 0 has no interfaces? [ 448.943892][ T10] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 448.954729][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.965458][ T10] usb 1-1: Product: syz [ 448.983314][ T10] usb 1-1: Manufacturer: syz [ 448.996238][ T10] usb 1-1: SerialNumber: syz [ 449.015108][ T10] usb 1-1: config 0 descriptor?? [ 449.303597][T10490] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1502'. [ 449.336448][ T96] elecom 0003:056E:00FD.0031: report_id 0 is invalid [ 449.364513][ T96] elecom 0003:056E:00FD.0031: item 0 1 1 8 parsing failed [ 449.386922][ T96] elecom 0003:056E:00FD.0031: probe with driver elecom failed with error -22 [ 449.461465][ T24] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 449.536532][T10484] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1500'. [ 449.660194][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 44, changing to 9 [ 449.682599][ T24] usb 3-1: New USB device found, idVendor=18d1, idProduct=5030, bcdDevice= 0.00 [ 449.745808][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.820143][ T96] usb 6-1: USB disconnect, device number 39 [ 449.864022][ T24] usb 3-1: config 0 descriptor?? [ 450.318068][ T24] hid (null): nested delimiters [ 450.325927][ T24] hid-generic 0003:18D1:5030.0032: nested delimiters [ 450.334060][ T24] hid-generic 0003:18D1:5030.0032: item 0 1 2 10 parsing failed [ 450.355747][ T24] hid-generic 0003:18D1:5030.0032: probe with driver hid-generic failed with error -22 [ 450.372837][T10505] FAULT_INJECTION: forcing a failure. [ 450.372837][T10505] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 450.411729][T10505] CPU: 1 UID: 0 PID: 10505 Comm: syz.6.1507 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 450.411762][T10505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 450.411777][T10505] Call Trace: [ 450.411786][T10505] [ 450.411795][T10505] dump_stack_lvl+0x241/0x360 [ 450.411835][T10505] ? __pfx_dump_stack_lvl+0x10/0x10 [ 450.411866][T10505] ? __pfx__printk+0x10/0x10 [ 450.411910][T10505] should_fail_ex+0x424/0x570 [ 450.411937][T10505] _copy_from_user+0x2d/0xb0 [ 450.411969][T10505] get_compat_msghdr+0xb3/0x730 [ 450.412004][T10505] ? __fget_files+0x2a/0x420 [ 450.412026][T10505] ? __pfx_get_compat_msghdr+0x10/0x10 [ 450.412078][T10505] __sys_sendmsg+0x23b/0x360 [ 450.412109][T10505] ? __pfx___sys_sendmsg+0x10/0x10 [ 450.412185][T10505] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 450.412212][T10505] ? lockdep_hardirqs_on+0x9d/0x150 [ 450.412239][T10505] __do_fast_syscall_32+0xb4/0x110 [ 450.412267][T10505] ? exc_page_fault+0x5f8/0x920 [ 450.412296][T10505] do_fast_syscall_32+0x34/0x80 [ 450.412324][T10505] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 450.412350][T10505] RIP: 0023:0xf7f91579 [ 450.412367][T10505] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 450.412386][T10505] RSP: 002b:00000000f50b655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 450.412410][T10505] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300 [ 450.412425][T10505] RDX: 0000000000000800 RSI: 0000000000000000 RDI: 0000000000000000 [ 450.412438][T10505] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 450.412451][T10505] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 450.412464][T10505] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 450.412494][T10505] [ 450.643142][T10498] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 450.681706][T10498] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 450.969529][ T978] usb 3-1: USB disconnect, device number 84 [ 451.441012][ T24] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 451.460284][T10514] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1508'. [ 451.632561][ T24] usb 6-1: Using ep0 maxpacket: 16 [ 451.680314][ T9] usb 1-1: USB disconnect, device number 66 [ 451.752487][ T978] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 451.847438][ T24] usb 6-1: config 1 interface 0 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 451.967140][ T24] usb 6-1: config 1 interface 0 has no altsetting 0 [ 452.020378][T10517] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1510'. [ 452.074453][T10517] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1510'. [ 452.128783][ T978] usb 7-1: Using ep0 maxpacket: 16 [ 452.141081][ T24] usb 6-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 452.222992][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.246167][ T24] usb 6-1: Product: syz [ 452.255001][ T24] usb 6-1: Manufacturer: syz [ 452.266280][ T24] usb 6-1: SerialNumber: syz [ 452.283849][ T978] usb 7-1: config 1 interface 0 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 452.298982][ T978] usb 7-1: config 1 interface 0 has no altsetting 0 [ 452.363514][ T978] usb 7-1: string descriptor 0 read error: -22 [ 452.378114][ T978] usb 7-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 452.405457][ T978] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.614205][T10512] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1509'. [ 454.556707][T10540] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 455.412557][ T10] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 455.438488][T10538] xt_CT: No such helper "syz0" [ 455.555167][ T24] usbhid 6-1:1.0: can't add hid device: -71 [ 455.575863][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 455.577990][ T24] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 455.597604][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 455.658450][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 455.658720][ T24] usb 6-1: USB disconnect, device number 40 [ 455.785653][ T10] usb 3-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 455.802307][ T978] usbhid 7-1:1.0: can't add hid device: -71 [ 455.826120][ T978] usbhid 7-1:1.0: probe with driver usbhid failed with error -71 [ 455.832361][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 455.895898][ T10] usb 3-1: Product: syz [ 455.900122][ T10] usb 3-1: Manufacturer: syz [ 455.906507][ T978] usb 7-1: USB disconnect, device number 3 [ 455.982649][ T10] usb 3-1: SerialNumber: syz [ 456.003752][T10555] x_tables: duplicate underflow at hook 1 [ 456.043596][ T10] usb 3-1: config 0 descriptor?? [ 456.191270][T10559] fuse: Unknown parameter 'Û"PžŠ"ÝœjÉóÁm†» Þè¯ [ 456.191270][T10559] ;' [ 456.245682][ T24] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 456.363016][ T10] appledisplay 3-1:0.0: Error while getting initial brightness: -110 [ 456.376331][ T10] appledisplay 3-1:0.0: probe with driver appledisplay failed with error -110 [ 456.461622][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 44, changing to 9 [ 456.481166][ T24] usb 6-1: New USB device found, idVendor=18d1, idProduct=5030, bcdDevice= 0.00 [ 456.501324][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 456.509911][ T10] usb 3-1: USB disconnect, device number 85 [ 456.568914][ T24] usb 6-1: config 0 descriptor?? [ 457.106688][ T24] hid (null): nested delimiters [ 457.129328][ T24] hid-generic 0003:18D1:5030.0033: nested delimiters [ 457.180928][ T24] hid-generic 0003:18D1:5030.0033: item 0 1 2 10 parsing failed [ 457.211878][ T24] hid-generic 0003:18D1:5030.0033: probe with driver hid-generic failed with error -22 [ 457.323750][T10552] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 457.370172][T10552] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 457.474348][T10581] snd_dummy snd_dummy.0: control 5:65279:0:syz0:0 is already present [ 457.574485][ T10] usb 6-1: USB disconnect, device number 41 [ 458.292084][ T24] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 458.385981][T10581] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 458.393062][T10581] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 458.641066][ T24] usb 1-1: Using ep0 maxpacket: 16 [ 458.767633][ T24] usb 1-1: config 1 interface 0 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 458.846024][ T24] usb 1-1: config 1 interface 0 has no altsetting 0 [ 458.913247][T10581] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 458.919220][T10581] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 458.960445][ T24] usb 1-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 458.998238][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.038940][ T24] usb 1-1: Product: syz [ 459.112828][ T24] usb 1-1: Manufacturer: syz [ 459.117492][ T24] usb 1-1: SerialNumber: syz [ 462.165439][ T24] usbhid 1-1:1.0: can't add hid device: -71 [ 462.241076][ T24] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 462.300172][ T24] usb 1-1: USB disconnect, device number 67 [ 463.212308][ T9] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 463.385801][ T9] usb 6-1: device descriptor read/64, error -71 [ 463.520196][T10625] veth0_macvtap: left promiscuous mode [ 463.574686][T10625] macvtap0: entered promiscuous mode [ 463.614216][T10625] veth0_macvtap: entered promiscuous mode [ 463.622736][ T9] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 463.699830][T10625] team0: Device macvtap0 failed to register rx_handler [ 463.747984][T10625] veth0_macvtap: left promiscuous mode [ 463.792084][ T9] usb 6-1: device descriptor read/64, error -71 [ 463.829531][T10627] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1544'. [ 463.913842][ T9] usb usb6-port1: attempt power cycle [ 464.064849][T10633] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1546'. [ 464.282897][ T9] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 464.327169][ T9] usb 6-1: device descriptor read/8, error -71 [ 464.572396][ T9] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 464.592085][ T10] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 464.645602][ T9] usb 6-1: device descriptor read/8, error -71 [ 464.772597][ T9] usb usb6-port1: unable to enumerate USB device [ 464.832238][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 464.934461][ T10] usb 4-1: config 1 interface 0 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 465.020607][ T10] usb 4-1: config 1 interface 0 has no altsetting 0 [ 465.125457][ T10] usb 4-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 465.162052][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.170156][ T10] usb 4-1: Product: syz [ 465.231954][ T10] usb 4-1: Manufacturer: syz [ 465.236659][ T10] usb 4-1: SerialNumber: syz [ 465.272445][ T96] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 465.432107][ T96] usb 7-1: device descriptor read/64, error -71 [ 465.682519][ T96] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 465.804042][T10637] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1547'. [ 465.832110][ T96] usb 7-1: device descriptor read/64, error -71 [ 466.312524][ T96] usb usb7-port1: attempt power cycle [ 466.712238][ T96] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 466.737172][ T96] usb 7-1: device descriptor read/8, error -71 [ 466.982352][ T96] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 467.002876][ T96] usb 7-1: device descriptor read/8, error -71 [ 467.122244][ T96] usb usb7-port1: unable to enumerate USB device [ 467.754006][ T10] usbhid 4-1:1.0: can't add hid device: -71 [ 467.776787][ T10] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 467.804665][ T10] usb 4-1: USB disconnect, device number 70 [ 468.971651][ T6062] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 469.162239][ T6062] usb 3-1: Using ep0 maxpacket: 16 [ 469.198219][ T6062] usb 3-1: config 0 has an invalid interface number: 105 but max is 0 [ 469.262097][ T6062] usb 3-1: config 0 has an invalid descriptor of length 194, skipping remainder of the config [ 469.305823][ T6062] usb 3-1: config 0 has no interface number 0 [ 469.342991][ T6062] usb 3-1: New USB device found, idVendor=046c, idProduct=14e8, bcdDevice= b.28 [ 469.374601][ T6062] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.422336][ T6062] usb 3-1: Product: syz [ 469.445053][ T6062] usb 3-1: Manufacturer: syz [ 469.472760][ T6062] usb 3-1: SerialNumber: syz [ 469.501628][ T6062] usb 3-1: config 0 descriptor?? [ 470.122038][ T10] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 470.245765][ T6062] usb 3-1: USB disconnect, device number 86 [ 470.336326][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 470.894732][ T9] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 471.061656][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 471.069991][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 471.103296][ T9] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 471.152230][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 471.209874][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.320490][ T9] usb 1-1: config 0 descriptor?? [ 472.842677][ T10] usb 7-1: unable to get BOS descriptor or descriptor too short [ 472.854020][ T10] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 472.872177][ T10] usb 7-1: can't read configurations, error -71 [ 473.119731][T10703] openvswitch: netlink: Port 10289405 exceeds max allowable 65535 [ 473.822072][ T9] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 473.973564][ T9] usb 3-1: device descriptor read/64, error -71 [ 474.273307][ T9] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 474.322668][ T6062] usb 1-1: USB disconnect, device number 68 [ 474.443793][ T9] usb 3-1: device descriptor read/64, error -71 [ 474.566811][ T9] usb usb3-port1: attempt power cycle [ 474.752200][T10728] netlink: 88 bytes leftover after parsing attributes in process `syz.5.1577'. [ 474.952688][ T9] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 475.014730][ T9] usb 3-1: device descriptor read/8, error -71 [ 475.032232][ T10] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 475.389534][ T9] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 475.434505][ T9] usb 3-1: device descriptor read/8, error -71 [ 475.462250][ T10] usb 6-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 475.501880][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.520344][ T10] usb 6-1: Product: syz [ 475.532274][ T10] usb 6-1: Manufacturer: syz [ 475.536933][ T10] usb 6-1: SerialNumber: syz [ 475.563188][ T10] usb 6-1: config 0 descriptor?? [ 475.602506][ T9] usb usb3-port1: unable to enumerate USB device [ 476.125872][ T10] mos7840 6-1:0.0: required endpoints missing [ 476.306161][ T10] usb 6-1: USB disconnect, device number 46 [ 477.129334][T10748] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1583'. [ 477.170446][T10747] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1584'. [ 477.232692][T10747] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1584'. [ 477.859186][T10751] RDS: rds_bind could not find a transport for ae0c:91e3:ccfb:11d2:0:5efe:150.125.240.108, load rds_tcp or rds_rdma? [ 478.512260][ T5898] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 478.691149][ T5898] usb 6-1: Using ep0 maxpacket: 16 [ 478.736978][ T5898] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 478.770594][ T5898] usb 6-1: New USB device found, idVendor=046d, idProduct=c626, bcdDevice= 0.00 [ 478.860967][ T6062] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 479.051745][ T5898] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.081424][ T5898] usb 6-1: config 0 descriptor?? [ 479.863313][ T5898] logitech 0003:046D:C626.0034: unbalanced delimiter at end of report description [ 479.875252][ T5898] logitech 0003:046D:C626.0034: parse failed [ 479.886399][ T5898] logitech 0003:046D:C626.0034: probe with driver logitech failed with error -22 [ 480.118185][T10768] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 480.222765][T10768] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 480.603199][ T5898] usb 6-1: USB disconnect, device number 47 [ 481.350977][ T24] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 481.501176][ T6062] usb 7-1: device descriptor read/64, error -71 [ 481.564137][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 44, changing to 9 [ 481.658827][ T24] usb 4-1: New USB device found, idVendor=18d1, idProduct=5030, bcdDevice= 0.00 [ 481.700996][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.735768][ T24] usb 4-1: config 0 descriptor?? [ 481.781829][ T6062] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 481.976161][ T6062] usb 7-1: config 0 has an invalid interface number: 29 but max is 0 [ 482.001251][ T5898] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 482.080384][ T6062] usb 7-1: config 0 has no interface number 0 [ 482.122527][ T6062] usb 7-1: config 0 interface 29 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 482.148100][T10783] bridge0: port 1(bridge_slave_0) entered disabled state [ 482.151181][ T6062] usb 7-1: config 0 interface 29 altsetting 0 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 482.180964][ T5898] usb 6-1: Using ep0 maxpacket: 32 [ 482.194819][ T5898] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 482.208674][ T6062] usb 7-1: New USB device found, idVendor=07fa, idProduct=0847, bcdDevice=60.e8 [ 482.222718][ T6062] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.233273][ T5898] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 482.255285][ T6062] usb 7-1: Product: syz [ 482.277471][ T6062] usb 7-1: Manufacturer: syz [ 482.285721][ T5898] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 482.317513][ T6062] usb 7-1: SerialNumber: syz [ 482.339558][ T6062] usb 7-1: config 0 descriptor?? [ 482.352509][ T24] hid (null): nested delimiters [ 482.358789][ T5898] usb 6-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 482.396723][T10773] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 482.406782][ T24] hid-generic 0003:18D1:5030.0035: nested delimiters [ 482.418429][ T5898] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.437360][ T6062] HFC-S_USB 7-1:0.29: probe with driver HFC-S_USB failed with error -5 [ 482.446482][ T24] hid-generic 0003:18D1:5030.0035: item 0 1 2 10 parsing failed [ 482.466473][ T5898] usb 6-1: config 0 descriptor?? [ 482.474790][ T24] hid-generic 0003:18D1:5030.0035: probe with driver hid-generic failed with error -22 [ 482.495067][T10781] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 482.533211][ T5898] hub 6-1:0.0: USB hub found [ 482.564579][T10771] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 482.647308][T10771] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 482.744477][ T5898] hub 6-1:0.0: config failed, hub has too many ports! (err -19) [ 482.766304][ T24] usb 4-1: USB disconnect, device number 71 [ 482.835417][ T9] usb 7-1: USB disconnect, device number 11 [ 482.944909][T10781] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1591'. [ 482.983453][ T5898] usbhid 6-1:0.0: can't add hid device: -71 [ 483.010710][ T5898] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 483.065198][ T5898] usb 6-1: USB disconnect, device number 48 [ 483.896332][T10796] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1596'. [ 484.045979][T10798] : entered promiscuous mode [ 484.101216][ T24] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 484.254651][ T24] usb 4-1: device descriptor read/64, error -71 [ 484.511109][ T24] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 484.658250][T10809] fuse: Unknown parameter 'user_i00000000000000000000' [ 484.709700][ T24] usb 4-1: device descriptor read/64, error -71 [ 484.742071][T10809] FAULT_INJECTION: forcing a failure. [ 484.742071][T10809] name failslab, interval 1, probability 0, space 0, times 0 [ 484.810279][T10809] CPU: 1 UID: 0 PID: 10809 Comm: syz.2.1601 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 484.810313][T10809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 484.810327][T10809] Call Trace: [ 484.810335][T10809] [ 484.810345][T10809] dump_stack_lvl+0x241/0x360 [ 484.810386][T10809] ? __pfx_dump_stack_lvl+0x10/0x10 [ 484.810417][T10809] ? __pfx__printk+0x10/0x10 [ 484.810451][T10809] ? __pfx___might_resched+0x10/0x10 [ 484.810482][T10809] should_fail_ex+0x424/0x570 [ 484.810510][T10809] should_failslab+0xac/0x100 [ 484.810541][T10809] __kmalloc_cache_noprof+0x73/0x370 [ 484.810570][T10809] ? alloc_fs_context+0x63/0x800 [ 484.810594][T10809] alloc_fs_context+0x63/0x800 [ 484.810614][T10809] ? do_raw_read_unlock+0x3c/0x80 [ 484.810644][T10809] ? _raw_read_unlock+0x28/0x50 [ 484.810667][T10809] ? get_fs_type+0x3fd/0x480 [ 484.810694][T10809] do_new_mount+0x160/0xb70 [ 484.810731][T10809] ? __pfx_do_new_mount+0x10/0x10 [ 484.810773][T10809] __se_sys_mount+0x38c/0x400 [ 484.810809][T10809] ? __pfx___se_sys_mount+0x10/0x10 [ 484.810858][T10809] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 484.810903][T10809] ? lockdep_hardirqs_on+0x9d/0x150 [ 484.810925][T10809] ? __ia32_sys_mount+0x20/0xc0 [ 484.810960][T10809] __do_fast_syscall_32+0xb4/0x110 [ 484.810987][T10809] ? exc_page_fault+0x5f8/0x920 [ 484.811017][T10809] do_fast_syscall_32+0x34/0x80 [ 484.811044][T10809] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 484.811070][T10809] RIP: 0023:0xf746d579 [ 484.811088][T10809] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 484.811107][T10809] RSP: 002b:00000000f50f655c EFLAGS: 00000206 ORIG_RAX: 0000000000000015 [ 484.811130][T10809] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000000 [ 484.811145][T10809] RDX: 0000000080002100 RSI: 0000000000000000 RDI: 0000000080002140 [ 484.811159][T10809] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 484.811172][T10809] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 484.811185][T10809] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 484.811215][T10809] [ 485.109382][ T96] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 485.292890][ T96] usb 7-1: Using ep0 maxpacket: 32 [ 485.304495][ T24] usb usb4-port1: attempt power cycle [ 485.320775][ T96] usb 7-1: config 0 has an invalid interface number: 85 but max is 0 [ 485.349893][ T96] usb 7-1: config 0 has no interface number 0 [ 485.377215][ T96] usb 7-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 485.468056][ T96] usb 7-1: config 0 interface 85 has no altsetting 0 [ 485.529184][ T96] usb 7-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 485.572255][ T96] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.635149][ T96] usb 7-1: Product: syz [ 485.649874][ T96] usb 7-1: Manufacturer: syz [ 485.659779][ T96] usb 7-1: SerialNumber: syz [ 485.669825][ T96] usb 7-1: config 0 descriptor?? [ 485.705925][ T24] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 485.758132][ T24] usb 4-1: device descriptor read/8, error -71 [ 485.944524][T10821] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1604'. [ 486.000966][ T24] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 486.022548][ T24] usb 4-1: device descriptor read/8, error -71 [ 486.102707][ T5898] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 486.130041][T10823] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1607'. [ 486.143270][ T24] usb usb4-port1: unable to enumerate USB device [ 486.183604][T10823] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1607'. [ 486.199615][ T96] appletouch 7-1:0.85: Geyser mode initialized. [ 486.240799][ T96] input: appletouch as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.85/input/input24 [ 486.333759][ T5898] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 44, changing to 9 [ 486.397574][ T5898] usb 1-1: New USB device found, idVendor=18d1, idProduct=5030, bcdDevice= 0.00 [ 486.430768][ T5898] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.455214][T10821] team0 (unregistering): Port device team_slave_0 removed [ 486.467254][ T5898] usb 1-1: config 0 descriptor?? [ 486.555744][T10821] team0 (unregistering): Port device team_slave_1 removed [ 486.659220][ T9] usb 7-1: USB disconnect, device number 12 [ 486.777975][ T9] appletouch 7-1:0.85: input: appletouch disconnected [ 486.883384][T10826] FAULT_INJECTION: forcing a failure. [ 486.883384][T10826] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 486.913484][T10823] geneve2: entered promiscuous mode [ 486.921220][T10826] CPU: 1 UID: 0 PID: 10826 Comm: syz.3.1608 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 486.921252][T10826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 486.921266][T10826] Call Trace: [ 486.921276][T10826] [ 486.921286][T10826] dump_stack_lvl+0x241/0x360 [ 486.921325][T10826] ? __pfx_dump_stack_lvl+0x10/0x10 [ 486.921357][T10826] ? __pfx__printk+0x10/0x10 [ 486.921407][T10826] should_fail_ex+0x424/0x570 [ 486.921435][T10826] _copy_from_user+0x2d/0xb0 [ 486.921468][T10826] get_compat_msghdr+0xb3/0x730 [ 486.921502][T10826] ? __fget_files+0x2a/0x420 [ 486.921524][T10826] ? __pfx_get_compat_msghdr+0x10/0x10 [ 486.921570][T10826] __sys_sendmsg+0x23b/0x360 [ 486.921600][T10826] ? __pfx___sys_sendmsg+0x10/0x10 [ 486.921678][T10826] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 486.921705][T10826] ? lockdep_hardirqs_on+0x9d/0x150 [ 486.921734][T10826] __do_fast_syscall_32+0xb4/0x110 [ 486.921760][T10826] ? exc_page_fault+0x5f8/0x920 [ 486.921790][T10826] do_fast_syscall_32+0x34/0x80 [ 486.921817][T10826] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 486.921843][T10826] RIP: 0023:0xf73fd579 [ 486.921861][T10826] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 486.921879][T10826] RSP: 002b:00000000f508655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 486.921902][T10826] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 486.921917][T10826] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 486.921930][T10826] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 486.921943][T10826] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 486.921956][T10826] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 486.921987][T10826] [ 486.994196][T10823] geneve2: entered allmulticast mode [ 487.068202][ C0] vkms_vblank_simulate: vblank timer overrun [ 487.161753][ T5898] hid (null): nested delimiters [ 487.252187][ T5898] hid-generic 0003:18D1:5030.0036: nested delimiters [ 487.258949][ T5898] hid-generic 0003:18D1:5030.0036: item 0 1 2 10 parsing failed [ 487.327228][T10827] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 487.338740][T10827] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.348492][ T5898] hid-generic 0003:18D1:5030.0036: probe with driver hid-generic failed with error -22 [ 487.422397][ T5898] usb 1-1: USB disconnect, device number 69 [ 487.528019][T10832] fuse: Bad value for 'fd' [ 487.691421][ T978] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 487.828363][T10839] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1612'. [ 487.871108][ T978] usb 7-1: Using ep0 maxpacket: 32 [ 487.885232][ T978] usb 7-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 487.906495][ T978] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.928756][ T978] usb 7-1: Product: syz [ 487.938436][ T978] usb 7-1: Manufacturer: syz [ 487.954682][ T978] usb 7-1: SerialNumber: syz [ 487.973040][ T978] usb 7-1: config 0 descriptor?? [ 488.651998][T10845] xt_CT: No such helper "syz0" [ 488.768961][T10854] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1617'. [ 488.944132][T10850] xt_CT: No such helper "syz0" [ 489.003848][T10858] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1618'. [ 490.056849][T10881] FAULT_INJECTION: forcing a failure. [ 490.056849][T10881] name failslab, interval 1, probability 0, space 0, times 0 [ 490.069776][ T6062] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 490.072932][T10880] Cannot find del_set index 0 as target [ 490.095191][T10881] CPU: 1 UID: 0 PID: 10881 Comm: syz.2.1626 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 490.095228][T10881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 490.095243][T10881] Call Trace: [ 490.095252][T10881] [ 490.095262][T10881] dump_stack_lvl+0x241/0x360 [ 490.095302][T10881] ? __pfx_dump_stack_lvl+0x10/0x10 [ 490.095335][T10881] ? __pfx__printk+0x10/0x10 [ 490.095371][T10881] ? __pfx___might_resched+0x10/0x10 [ 490.095403][T10881] should_fail_ex+0x424/0x570 [ 490.095432][T10881] should_failslab+0xac/0x100 [ 490.095472][T10881] kmem_cache_alloc_node_noprof+0x7d/0x3b0 [ 490.095504][T10881] ? __alloc_skb+0x1c2/0x480 [ 490.095530][T10881] __alloc_skb+0x1c2/0x480 [ 490.095550][T10881] ? rcu_is_watching+0x15/0xb0 [ 490.095583][T10881] ? __pfx___alloc_skb+0x10/0x10 [ 490.095602][T10881] ? fib_table_lookup+0x1325/0x1880 [ 490.095644][T10881] __ip_append_data+0x3161/0x4750 [ 490.095694][T10881] ? __pfx_raw_getfrag+0x10/0x10 [ 490.095738][T10881] ? ipv4_mtu+0x23/0x5b0 [ 490.095757][T10881] ? __pfx___ip_append_data+0x10/0x10 [ 490.095778][T10881] ? ipv4_mtu+0x23/0x5b0 [ 490.095801][T10881] ? ip_setup_cork+0x580/0x9a0 [ 490.095829][T10881] ip_append_data+0x14c/0x190 [ 490.095852][T10881] ? __pfx_raw_getfrag+0x10/0x10 [ 490.095879][T10881] raw_sendmsg+0x1a49/0x2660 [ 490.095931][T10881] ? __pfx_raw_sendmsg+0x10/0x10 [ 490.095994][T10881] ? inet_sendmsg+0x330/0x390 [ 490.096023][T10881] __sock_sendmsg+0x1a6/0x270 [ 490.096056][T10881] ____sys_sendmsg+0x523/0x860 [ 490.096090][T10881] ? __pfx_____sys_sendmsg+0x10/0x10 [ 490.096124][T10881] ? __sys_sendmmsg+0x4d4/0x7b0 [ 490.096152][T10881] __sys_sendmmsg+0x4a3/0x7b0 [ 490.096189][T10881] ? __pfx___sys_sendmmsg+0x10/0x10 [ 490.096219][T10881] ? __lock_acquire+0xad5/0xd80 [ 490.096284][T10881] ? vfs_write+0xb29/0xd10 [ 490.096327][T10881] ? __mutex_unlock_slowpath+0x229/0x800 [ 490.096378][T10881] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 490.096403][T10881] ? __fget_files+0x2a/0x420 [ 490.096436][T10881] ? fput+0x9b/0xd0 [ 490.096464][T10881] ? ksys_write+0x275/0x2d0 [ 490.096498][T10881] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 490.096535][T10881] __do_fast_syscall_32+0xb4/0x110 [ 490.096560][T10881] ? exc_page_fault+0x5f8/0x920 [ 490.096590][T10881] do_fast_syscall_32+0x34/0x80 [ 490.096616][T10881] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 490.096641][T10881] RIP: 0023:0xf746d579 [ 490.096658][T10881] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 490.096676][T10881] RSP: 002b:00000000f50f655c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 490.096699][T10881] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080005240 [ 490.096713][T10881] RDX: 0000000004000095 RSI: 0000000000000000 RDI: 0000000000000000 [ 490.096726][T10881] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 490.096738][T10881] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 490.096751][T10881] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 490.096781][T10881] [ 490.099831][T10881] netlink: 'syz.2.1626': attribute type 4 has an invalid length. [ 490.761995][ T978] peak_usb 7-1:0.0 can0: unable to request usb[type=2 value=5] err=-71 [ 490.805912][ T6062] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 44, changing to 9 [ 490.831231][ T6062] usb 1-1: New USB device found, idVendor=18d1, idProduct=5030, bcdDevice= 0.00 [ 490.871771][ T6062] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.932043][ T6062] usb 1-1: config 0 descriptor?? [ 490.992347][ T978] peak_usb 7-1:0.0: probe with driver peak_usb failed with error -71 [ 491.024709][ T978] usb 7-1: USB disconnect, device number 13 [ 491.339972][T10889] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1627'. [ 491.436319][ T6062] hid (null): nested delimiters [ 491.477009][ T6062] hid-generic 0003:18D1:5030.0037: nested delimiters [ 491.499143][ T6062] hid-generic 0003:18D1:5030.0037: item 0 1 2 10 parsing failed [ 491.628937][ T6062] hid-generic 0003:18D1:5030.0037: probe with driver hid-generic failed with error -22 [ 491.651398][T10873] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.685485][T10873] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.785842][ T6062] usb 1-1: USB disconnect, device number 70 [ 491.877963][ T10] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 491.961922][T10892] xt_CT: No such helper "syz0" [ 492.024240][T10901] : entered promiscuous mode [ 492.162304][ T10] usb 3-1: config 0 has no interfaces? [ 492.182524][ T10] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 492.232302][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.282326][ T10] usb 3-1: Product: syz [ 492.286585][ T10] usb 3-1: Manufacturer: syz [ 492.315606][ T10] usb 3-1: SerialNumber: syz [ 492.394707][ T10] usb 3-1: config 0 descriptor?? [ 493.038239][T10912] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1635'. [ 493.411640][T10910] netlink: 'syz.3.1634': attribute type 4 has an invalid length. [ 493.460123][T10910] netlink: 'syz.3.1634': attribute type 4 has an invalid length. [ 494.582108][ T96] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 494.758347][ T96] usb 1-1: config 0 has no interfaces? [ 494.872279][ T96] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 494.927694][ T96] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.992137][ T9] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 495.092134][ T96] usb 1-1: Product: syz [ 495.097438][ T96] usb 1-1: Manufacturer: syz [ 495.112087][ T96] usb 1-1: SerialNumber: syz [ 495.152049][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 495.177231][ T96] usb 1-1: config 0 descriptor?? [ 495.213354][ T9] usb 6-1: config 1 interface 0 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 495.232163][ T5898] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 495.337153][ T9] usb 6-1: config 1 interface 0 has no altsetting 0 [ 495.364546][ T9] usb 6-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 495.376182][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.386650][ T9] usb 6-1: Product: syz [ 495.393850][ T9] usb 6-1: Manufacturer: syz [ 495.398579][ T9] usb 6-1: SerialNumber: syz [ 495.411071][ T5898] usb 4-1: Using ep0 maxpacket: 32 [ 495.478342][ T5898] usb 4-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 495.598519][ T10] usb 3-1: USB disconnect, device number 91 [ 495.608038][ T5898] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.653199][T10938] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1642'. [ 495.939916][ T5898] usb 4-1: config 0 descriptor?? [ 495.972579][T10927] netlink: 'syz.0.1639': attribute type 10 has an invalid length. [ 496.024899][ T5898] gspca_main: sunplus-2.14.0 probing 041e:400b [ 496.239621][T10940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 496.257195][T10927] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 496.294369][T10940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 496.439258][T10940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 496.494516][T10940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 496.942508][T10940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 496.953982][T10940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 497.242105][ T5898] gspca_sunplus: reg_r err -110 [ 497.247181][ T5898] sunplus 4-1:0.0: probe with driver sunplus failed with error -110 [ 497.259919][T10940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 497.305243][T10940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 498.086561][ T9] usbhid 6-1:1.0: can't add hid device: -71 [ 498.108307][ T9] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 498.171685][ T9] usb 6-1: USB disconnect, device number 49 [ 498.429441][ T10] usb 4-1: USB disconnect, device number 76 [ 498.496653][ T6062] usb 1-1: USB disconnect, device number 71 [ 499.260293][T10972] xt_CT: No such helper "syz0" [ 499.362208][ T9] usb 7-1: new full-speed USB device number 14 using dummy_hcd [ 499.552230][ T9] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.564552][ T9] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 499.576369][ T9] usb 7-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 499.587165][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 499.609280][ T9] usb 7-1: config 0 descriptor?? [ 499.620436][ T9] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 499.645003][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 499.668214][ T9] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 499.697113][ T9] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 499.706610][ T9] usb 7-1: media controller created [ 499.744043][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 499.827313][T10974] dvb-usb: bulk message failed: -22 (4/0) [ 499.867105][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 499.915528][ T9] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 500.006968][ T9] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.6/usb7/7-1/input/input25 [ 500.094871][ T9] dvb-usb: schedule remote query interval to 150 msecs. [ 500.142766][ T9] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 500.302576][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 500.326024][ T10] dvb-usb: error while querying for an remote control event. [ 500.465918][ T9] usb 4-1: new full-speed USB device number 77 using dummy_hcd [ 500.592987][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 500.599076][ T10] dvb-usb: error while querying for an remote control event. [ 500.637515][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 500.648256][ T96] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 500.684002][ T9] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 500.738070][ T9] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 500.762206][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 500.768102][ T10] dvb-usb: error while querying for an remote control event. [ 500.789470][T10995] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 500.812478][ T96] usb 3-1: Using ep0 maxpacket: 16 [ 500.829223][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 500.882322][ T96] usb 3-1: config 1 interface 0 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 500.941961][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 500.947909][ T10] dvb-usb: error while querying for an remote control event. [ 500.974530][ T9] usb 4-1: config 0 descriptor?? [ 500.988038][ T96] usb 3-1: config 1 interface 0 has no altsetting 0 [ 501.030382][ T9] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 501.112442][ T96] usb 3-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 501.130309][ T96] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.162207][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 501.168127][ T10] dvb-usb: error while querying for an remote control event. [ 501.177764][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 501.187162][T10999] netlink: 120 bytes leftover after parsing attributes in process `syz.5.1660'. [ 501.212031][ T96] usb 3-1: Product: syz [ 501.225656][T10987] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1656'. [ 501.235645][T10987] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1656'. [ 501.268453][ T9] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 501.279291][ T96] usb 3-1: Manufacturer: syz [ 501.314190][T11001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 501.324222][ T96] usb 3-1: SerialNumber: syz [ 501.347708][ T9] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 501.362201][ T5894] dvb-usb: bulk message failed: -22 (1/0) [ 501.368299][ T5894] dvb-usb: error while querying for an remote control event. [ 501.417678][T11001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 501.427134][ T9] usb 4-1: media controller created [ 501.448529][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 501.494424][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.503427][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.538207][T10987] dibusb: i2c wr: len=65 is too big! [ 501.538207][T10987] [ 501.560686][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 501.567852][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 501.574460][ T10] dvb-usb: error while querying for an remote control event. [ 501.586016][ T9] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 501.615994][ T9] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input26 [ 501.648672][ T9] dvb-usb: schedule remote query interval to 150 msecs. [ 501.703583][T10989] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1655'. [ 502.264248][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 502.320152][ T10] dvb-usb: error while querying for an remote control event. [ 502.363530][ T9] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 502.398161][ T9] usb 4-1: USB disconnect, device number 77 [ 502.459713][ T5898] usb 7-1: USB disconnect, device number 14 [ 502.640013][ T9] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 502.658323][ T5898] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 502.787897][T11014] tipc: Started in network mode [ 502.818456][T11014] tipc: Node identity 7f000001, cluster identity 4711 [ 502.858804][T11014] tipc: Enabled bearer , priority 10 [ 503.030648][T11014] tipc: Enabled bearer , priority 0 [ 503.438821][T11026] tipc: Started in network mode [ 503.477510][T11026] tipc: Node identity aaaaaaaaaa17, cluster identity 4711 [ 503.572754][T11034] netlink: 14 bytes leftover after parsing attributes in process `syz.5.1666'. [ 503.634181][T11026] tipc: Enabled bearer , priority 10 [ 503.737020][ T96] usbhid 3-1:1.0: can't add hid device: -71 [ 503.751642][T11034] tipc: Resetting bearer [ 503.772842][ T96] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 503.815107][ T96] usb 3-1: USB disconnect, device number 92 [ 503.977178][T11034] bond0: (slave syz_tun): Releasing backup interface [ 504.018940][ T30] audit: type=1326 audit(1744534421.748:200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11037 comm="syz.2.1670" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d579 code=0x7ffc0000 [ 504.113562][ T5898] tipc: Node number set to 2130706433 [ 504.140194][T11034] tipc: Resetting bearer [ 504.231022][ T30] audit: type=1326 audit(1744534421.748:201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11037 comm="syz.2.1670" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf746d579 code=0x7ffc0000 [ 504.262321][T11034] tipc: Disabling bearer [ 504.448514][ T30] audit: type=1326 audit(1744534421.768:202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11037 comm="syz.2.1670" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d579 code=0x7ffc0000 [ 504.600912][ T30] audit: type=1326 audit(1744534421.788:203): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11037 comm="syz.2.1670" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d579 code=0x7ffc0000 [ 504.704215][ T30] audit: type=1326 audit(1744534421.798:204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11037 comm="syz.2.1670" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf746d579 code=0x7ffc0000 [ 504.758027][ T30] audit: type=1326 audit(1744534421.798:205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11037 comm="syz.2.1670" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf746d579 code=0x7ffc0000 [ 504.884149][ T30] audit: type=1326 audit(1744534421.808:206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11037 comm="syz.2.1670" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d579 code=0x7ffc0000 [ 504.972120][ T96] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 505.003112][ T30] audit: type=1326 audit(1744534421.808:207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11037 comm="syz.2.1670" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d579 code=0x7ffc0000 [ 505.088137][ T30] audit: type=1326 audit(1744534421.838:208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11037 comm="syz.2.1670" exe="/root/syz-executor" sig=0 arch=40000003 syscall=19 compat=1 ip=0xf746d579 code=0x7ffc0000 [ 505.152164][ T96] usb 3-1: Using ep0 maxpacket: 32 [ 505.162984][ T96] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 505.189020][ T30] audit: type=1326 audit(1744534421.838:209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11037 comm="syz.2.1670" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d579 code=0x7ffc0000 [ 505.217533][ T96] usb 3-1: config 0 has no interface number 0 [ 505.225851][ T96] usb 3-1: config 0 interface 51 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 505.259056][ T96] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 505.285408][ T96] usb 3-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 505.312757][ T96] usb 3-1: Product: syz [ 505.320013][ T96] usb 3-1: Manufacturer: syz [ 505.326730][ T96] usb 3-1: SerialNumber: syz [ 505.359570][ T96] usb 3-1: config 0 descriptor?? [ 505.364689][ T96] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 505.578692][ T96] usb 3-1: qt2_setup_urbs - submit read urb failed -8 [ 505.657834][ T96] quatech2 3-1:0.51: probe with driver quatech2 failed with error -8 [ 506.399473][T11084] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1681'. [ 506.756831][ T96] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 507.373843][ T96] usb 1-1: Using ep0 maxpacket: 16 [ 507.400703][ T96] usb 1-1: config 1 interface 0 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 507.430275][ T96] usb 1-1: config 1 interface 0 has no altsetting 0 [ 507.473427][ T96] usb 1-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 507.490614][ T96] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.519802][ T96] usb 1-1: Product: syz [ 507.538462][ T96] usb 1-1: Manufacturer: syz [ 507.548579][ T96] usb 1-1: SerialNumber: syz [ 507.567521][ T5895] usb 3-1: USB disconnect, device number 93 [ 508.712270][ T5895] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 508.924771][ T5895] usb 3-1: config 2 has an invalid interface number: 174 but max is 0 [ 508.965904][ T5895] usb 3-1: config 2 has no interface number 0 [ 509.003128][ T5895] usb 3-1: config 2 interface 174 altsetting 0 has an endpoint descriptor with address 0x9E, changing to 0x8E [ 509.044333][ T5895] usb 3-1: config 2 interface 174 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 1023 [ 509.087026][ T5895] usb 3-1: config 2 interface 174 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 255 [ 509.135269][ T5895] usb 3-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=22.7e [ 509.173308][ T5895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.196888][ T5895] usb 3-1: Product: syz [ 509.210644][ T5895] usb 3-1: Manufacturer: syz [ 509.227183][ T5895] usb 3-1: SerialNumber: syz [ 509.257475][T11103] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 509.282300][T11103] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 509.553243][ T5895] usb 3-1: probing VID:PID(0424:012C) [ 509.613994][ T5895] usb 3-1: vub300 testing BULK IN EndPoint(0) 8E [ 509.631022][ T978] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 509.658945][ T5895] usb 3-1: vub300 testing BULK IN EndPoint(1) 82 [ 509.699583][ T5895] usb 3-1: Could not find two sets of bulk-in/out endpoint pairs [ 509.784685][ T5895] vub300 3-1:2.174: probe with driver vub300 failed with error -22 [ 509.812078][ T978] usb 6-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 509.836443][ T5895] usb 3-1: USB disconnect, device number 94 [ 509.890800][ T978] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.899048][ T978] usb 6-1: Product: syz [ 509.960959][ T978] usb 6-1: Manufacturer: syz [ 509.965622][ T978] usb 6-1: SerialNumber: syz [ 510.059794][ T978] usb 6-1: config 0 descriptor?? [ 510.194877][ T96] usbhid 1-1:1.0: can't add hid device: -71 [ 510.232186][ T96] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 510.262730][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 510.262755][ T30] audit: type=1800 audit(1744534427.988:230): pid=11116 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1693" name="SYSV798dd820" dev="tmpfs" ino=0 res=0 errno=0 [ 510.312192][ T96] usb 1-1: USB disconnect, device number 72 [ 510.345805][ T978] usb-storage 6-1:0.0: USB Mass Storage device detected [ 510.586922][T11125] netlink: 'syz.3.1693': attribute type 29 has an invalid length. [ 510.627386][T11124] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 510.691094][ T978] usb 6-1: USB disconnect, device number 50 [ 510.733399][T11125] netlink: 'syz.3.1693': attribute type 29 has an invalid length. [ 512.411358][ T5898] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 512.591168][ T5898] usb 3-1: Using ep0 maxpacket: 32 [ 512.717211][ T5898] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 512.738136][ T5898] usb 3-1: config 0 has no interface number 0 [ 512.766306][ T5898] usb 3-1: config 0 interface 51 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 512.880932][ T5898] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 512.960093][ T5898] usb 3-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 513.009021][ T5898] usb 3-1: Product: syz [ 513.022190][ T5898] usb 3-1: Manufacturer: syz [ 513.053913][ T5898] usb 3-1: SerialNumber: syz [ 513.084174][ T5898] usb 3-1: config 0 descriptor?? [ 513.144145][ T5898] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 513.411061][ T5898] usb 3-1: qt2_setup_urbs - submit read urb failed -8 [ 513.461150][ T5898] quatech2 3-1:0.51: probe with driver quatech2 failed with error -8 [ 513.730461][ T10] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 514.132826][ T10] usb 1-1: config 0 has no interfaces? [ 514.149183][ T10] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 514.165624][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.199163][ T10] usb 1-1: Product: syz [ 514.219052][ T10] usb 1-1: Manufacturer: syz [ 514.246671][ T10] usb 1-1: SerialNumber: syz [ 514.277061][ T10] usb 1-1: config 0 descriptor?? [ 514.473113][T11151] xt_CT: No such helper "syz0" [ 515.691453][ T5898] usb 3-1: USB disconnect, device number 95 [ 516.000932][ T6062] usb 6-1: new full-speed USB device number 51 using dummy_hcd [ 516.705771][ T6062] usb 6-1: device descriptor read/64, error -71 [ 516.747645][T11170] xt_CT: No such helper "syz0" [ 516.980898][ T6062] usb 6-1: new full-speed USB device number 52 using dummy_hcd [ 517.140662][ T5895] usb 1-1: USB disconnect, device number 73 [ 517.182778][ T6062] usb 6-1: device descriptor read/64, error -71 [ 517.321297][ T6062] usb usb6-port1: attempt power cycle [ 517.434747][T11184] FAULT_INJECTION: forcing a failure. [ 517.434747][T11184] name failslab, interval 1, probability 0, space 0, times 0 [ 517.485471][T11184] CPU: 0 UID: 0 PID: 11184 Comm: syz.0.1710 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 517.485502][T11184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 517.485517][T11184] Call Trace: [ 517.485525][T11184] [ 517.485535][T11184] dump_stack_lvl+0x241/0x360 [ 517.485597][T11184] ? __pfx_dump_stack_lvl+0x10/0x10 [ 517.485628][T11184] ? __pfx__printk+0x10/0x10 [ 517.485676][T11184] ? __pfx___might_resched+0x10/0x10 [ 517.485704][T11184] should_fail_ex+0x424/0x570 [ 517.485729][T11184] should_failslab+0xac/0x100 [ 517.485758][T11184] __kmalloc_noprof+0xdf/0x4d0 [ 517.485785][T11184] ? tomoyo_encode+0x26f/0x540 [ 517.485820][T11184] tomoyo_encode+0x26f/0x540 [ 517.485854][T11184] tomoyo_realpath_from_path+0x59e/0x5e0 [ 517.485898][T11184] tomoyo_path_number_perm+0x245/0x790 [ 517.485923][T11184] ? __lock_acquire+0xad5/0xd80 [ 517.485945][T11184] ? tomoyo_path_number_perm+0x215/0x790 [ 517.485973][T11184] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 517.486035][T11184] ? __fget_files+0x2a/0x420 [ 517.486053][T11184] ? __fget_files+0x2a/0x420 [ 517.486074][T11184] ? __fget_files+0x2a/0x420 [ 517.486097][T11184] security_file_ioctl_compat+0xc6/0x2a0 [ 517.486124][T11184] __se_compat_sys_ioctl+0xd8/0xc30 [ 517.486147][T11184] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 517.486174][T11184] ? __pfx___se_compat_sys_ioctl+0x10/0x10 [ 517.486199][T11184] ? __fget_files+0x2a/0x420 [ 517.486223][T11184] ? fput+0x9b/0xd0 [ 517.486241][T11184] ? ksys_write+0x275/0x2d0 [ 517.486271][T11184] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 517.486295][T11184] ? lockdep_hardirqs_on+0x9d/0x150 [ 517.486322][T11184] __do_fast_syscall_32+0xb4/0x110 [ 517.486347][T11184] ? exc_page_fault+0x5f8/0x920 [ 517.486374][T11184] do_fast_syscall_32+0x34/0x80 [ 517.486399][T11184] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 517.486423][T11184] RIP: 0023:0xf746d579 [ 517.486440][T11184] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 517.486457][T11184] RSP: 002b:00000000f50f655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 517.486478][T11184] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0106442 [ 517.486492][T11184] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 517.486504][T11184] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 517.486519][T11184] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 517.486548][T11184] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 517.486585][T11184] [ 517.487857][T11184] ERROR: Out of memory at tomoyo_realpath_from_path. [ 517.865292][ T6062] usb 6-1: new full-speed USB device number 53 using dummy_hcd [ 517.895319][ T6062] usb 6-1: device descriptor read/8, error -71 [ 518.182111][ T6062] usb 6-1: new full-speed USB device number 54 using dummy_hcd [ 518.222998][T11188] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1711'. [ 518.273297][ T6062] usb 6-1: device descriptor read/8, error -71 [ 518.392436][ T6062] usb usb6-port1: unable to enumerate USB device [ 518.548344][T11194] netlink: 'syz.0.1713': attribute type 29 has an invalid length. [ 519.189299][T11199] netlink: 'syz.0.1713': attribute type 29 has an invalid length. [ 519.641158][ T5898] usb 3-1: new full-speed USB device number 96 using dummy_hcd [ 519.702126][ T96] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 519.803726][ T5898] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 519.820518][ T5898] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 519.839677][ T5898] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 519.910152][ T96] usb 6-1: config 0 has no interfaces? [ 519.980994][ T6062] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 519.989825][ T5898] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 520.036504][ T5898] usb 3-1: config 0 descriptor?? [ 520.064759][ T5898] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 520.089571][ T5898] dvb-usb: bulk message failed: -22 (3/0) [ 520.103811][ T5898] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 520.161382][ T6062] usb 4-1: Using ep0 maxpacket: 32 [ 520.168533][ T6062] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 520.187771][ T5898] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 520.200158][ T6062] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 520.229978][ T5898] usb 3-1: media controller created [ 520.245270][ T5898] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 520.248202][ T96] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 520.289504][ T6062] usb 4-1: config 0 descriptor?? [ 520.297969][T11205] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1717'. [ 520.311825][T10152] syz.1.1389: vmalloc error: size 8388608, failed to allocated page array size 16384, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 520.327579][T11205] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1717'. [ 520.339099][ T96] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.339136][ T96] usb 6-1: Product: syz [ 520.339153][ T96] usb 6-1: Manufacturer: syz [ 520.339170][ T96] usb 6-1: SerialNumber: syz [ 520.354044][ T96] usb 6-1: config 0 descriptor?? [ 520.379848][ T5898] dvb-usb: bulk message failed: -22 (6/0) [ 520.397537][ T5898] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 520.438704][T10152] CPU: 0 UID: 0 PID: 10152 Comm: syz.1.1389 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 520.438740][T10152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 520.438760][T10152] Call Trace: [ 520.438770][T10152] [ 520.438781][T10152] dump_stack_lvl+0x241/0x360 [ 520.438823][T10152] ? __pfx_dump_stack_lvl+0x10/0x10 [ 520.438856][T10152] ? __pfx__printk+0x10/0x10 [ 520.438887][T10152] ? cpuset_print_current_mems_allowed+0x1f/0x350 [ 520.438925][T10152] ? cpuset_print_current_mems_allowed+0x1f/0x350 [ 520.438958][T10152] ? cpuset_print_current_mems_allowed+0x31e/0x350 [ 520.438995][T10152] warn_alloc+0x27c/0x410 [ 520.439026][T10152] ? __pfx_warn_alloc+0x10/0x10 [ 520.439057][T10152] ? relay_open_buf+0x231/0xd30 [ 520.439087][T10152] ? __get_vm_area_node+0x1c8/0x2d0 [ 520.439127][T10152] ? __get_vm_area_node+0x25c/0x2d0 [ 520.439169][T10152] __vmalloc_node_range_noprof+0x634/0x1390 [ 520.439226][T10152] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 520.439249][T10152] ? __kasan_kmalloc_large+0x1a/0xa0 [ 520.439284][T10152] ? relay_open_buf+0x231/0xd30 [ 520.439315][T10152] __kvmalloc_node_noprof+0x3b2/0x5a0 [ 520.439349][T10152] ? relay_open_buf+0x231/0xd30 [ 520.439378][T10152] ? trace_kmalloc+0x1f/0xd0 [ 520.439420][T10152] ? relay_open_buf+0x231/0xd30 [ 520.439448][T10152] ? relay_open_buf+0x18c/0xd30 [ 520.439483][T10152] relay_open_buf+0x231/0xd30 [ 520.439528][T10152] relay_open+0x44b/0x960 [ 520.439567][T10152] do_blk_trace_setup+0x57b/0x9c0 [ 520.439602][T10152] blk_trace_setup+0x118/0x1f0 [ 520.439631][T10152] ? __pfx_blk_trace_setup+0x10/0x10 [ 520.439653][T10152] ? tomoyo_path_number_perm+0x215/0x790 [ 520.439703][T10152] sg_ioctl+0xa12/0x2ea0 [ 520.439759][T10152] ? __pfx_sg_ioctl+0x10/0x10 [ 520.439789][T10152] ? __fget_files+0x2a/0x420 [ 520.439810][T10152] ? __fget_files+0x2a/0x420 [ 520.439835][T10152] ? __fget_files+0x2a/0x420 [ 520.439866][T10152] __se_compat_sys_ioctl+0x50e/0xc30 [ 520.439899][T10152] ? __pfx___se_compat_sys_ioctl+0x10/0x10 [ 520.439957][T10152] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 520.439987][T10152] ? lockdep_hardirqs_on+0x9d/0x150 [ 520.440018][T10152] __do_fast_syscall_32+0xb4/0x110 [ 520.440046][T10152] ? ret_from_fork_asm+0x1a/0x30 [ 520.440066][T10152] ? lockdep_hardirqs_on+0x9d/0x150 [ 520.440111][T10152] do_fast_syscall_32+0x34/0x80 [ 520.440146][T10152] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 520.440173][T10152] RIP: 0023:0xf7ff3579 [ 520.440191][T10152] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 520.440210][T10152] RSP: 002b:00000000f50d455c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 520.440235][T10152] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 00000000c0481273 [ 520.440251][T10152] RDX: 0000000080000b40 RSI: 0000000000000000 RDI: 0000000000000000 [ 520.440265][T10152] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 520.440277][T10152] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 520.440290][T10152] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 520.440322][T10152] [ 520.763659][ T5898] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input27 [ 520.779533][ T6062] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 520.816302][T10152] Mem-Info: [ 520.819466][T10152] active_anon:15775 inactive_anon:1 isolated_anon:0 [ 520.819466][T10152] active_file:13637 inactive_file:174 isolated_file:0 [ 520.819466][T10152] unevictable:768 dirty:171 writeback:0 [ 520.819466][T10152] slab_reclaimable:6110 slab_unreclaimable:119884 [ 520.819466][T10152] mapped:39976 shmem:14508 pagetables:1003 [ 520.819466][T10152] sec_pagetables:0 bounce:0 [ 520.819466][T10152] kernel_misc_reclaimable:0 [ 520.819466][T10152] free:420927 free_pcp:2000 free_cma:0 [ 520.892642][T10152] Node 0 active_anon:1252kB inactive_anon:4kB active_file:508kB inactive_file:92kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:139436kB dirty:72kB writeback:0kB shmem:2600kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11024kB pagetables:3340kB sec_pagetables:0kB all_unreclaimable? yes Balloon:0kB [ 520.901288][T11210] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 520.961523][ T5898] dvb-usb: schedule remote query interval to 150 msecs. [ 520.968525][ T5898] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 520.977889][ T6062] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 521.025648][T11210] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 521.054602][ T6062] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 521.086282][ T6062] usb 4-1: media controller created [ 521.123406][T10152] Node 1 active_anon:60792kB inactive_anon:0kB active_file:54040kB inactive_file:604kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:20532kB dirty:668kB writeback:0kB shmem:54192kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:628kB pagetables:572kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 521.130983][ T5898] dvb-usb: bulk message failed: -22 (1/0) [ 521.191796][T11205] dibusb: i2c wr: len=65 is too big! [ 521.191796][T11205] [ 521.226363][T10152] Node 0 DMA free:10148kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:124kB local_pcp:124kB free_cma:0kB [ 521.245850][ T6062] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 521.275848][ T5898] dvb-usb: error while querying for an remote control event. [ 521.310345][ T5898] usb 3-1: USB disconnect, device number 96 [ 521.374324][ T6062] az6027: usb out operation failed. (-71) [ 521.386082][ T6062] az6027: usb out operation failed. (-71) [ 521.400646][ T6062] stb0899_attach: Driver disabled by Kconfig [ 521.424234][ T6062] az6027: no front-end attached [ 521.424234][ T6062] [ 521.481402][ T6062] az6027: usb out operation failed. (-71) [ 521.496100][ T5898] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 521.508245][ T6062] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 521.530269][ T6062] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input28 [ 521.557453][ T6062] dvb-usb: schedule remote query interval to 400 msecs. [ 521.566221][ T6062] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 521.579276][ T6062] usb 4-1: USB disconnect, device number 78 [ 521.585627][T11220] netlink: 'syz.6.1720': attribute type 4 has an invalid length. [ 521.627776][T10152] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 521.660086][T10152] Node 0 DMA32 free:42596kB boost:0kB min:34152kB low:42688kB high:51224kB reserved_highatomic:2048KB active_anon:1252kB inactive_anon:4kB active_file:508kB inactive_file:92kB unevictable:1536kB writepending:72kB present:3129332kB managed:2547232kB mlocked:0kB bounce:0kB free_pcp:1684kB local_pcp:384kB free_cma:0kB [ 521.856795][ T6062] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 521.915321][T11221] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1715'. [ 522.199513][T10152] lowmem_reserve[]: 0 0 0 0 0 [ 522.225296][T10152] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:8kB free_cma:0kB [ 522.341809][T10152] lowmem_reserve[]: 0 0 0 0 0 [ 522.346616][T10152] Node 1 Normal free:1647064kB boost:0kB min:55748kB low:69684kB high:83620kB reserved_highatomic:0KB active_anon:19072kB inactive_anon:0kB active_file:54168kB inactive_file:604kB unevictable:1536kB writepending:120kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:33336kB local_pcp:1308kB free_cma:0kB [ 522.509963][T10152] lowmem_reserve[]: 0 0 0 0 0 [ 522.530383][T10152] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 0*64kB 1*128kB (U) 1*256kB (U) 1*512kB (U) 1*1024kB (U) 2*2048kB (UM) 1*4096kB (M) = 10148kB [ 522.655655][T10152] Node 0 DMA32: 103*4kB (UME) 51*8kB (ME) 137*16kB (UE) 76*32kB (UME) 79*64kB (UME) 42*128kB (UME) 22*256kB (ME) 15*512kB (M) 9*1024kB (M) 2*2048kB (M) 0*4096kB = 42500kB [ 522.725790][T10152] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 522.739197][T10152] Node 1 Normal: 702*4kB (UME) 748*8kB (UME) 590*16kB (UME) 385*32kB (UME) 231*64kB (UM) 26*128kB (UME) 26*256kB (UME) 6*512kB (UME) 3*1024kB (UE) 1*2048kB (U) 391*4096kB (UM) = 1665048kB [ 522.745122][T11230] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1723'. [ 522.809318][T10152] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 522.868621][T11230] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1723'. [ 522.889896][T10152] Node 0 hugepages_total=7 hugepages_free=7 hugepages_surp=4 hugepages_size=2048kB [ 522.961436][T11230] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1723'. [ 522.980758][T10152] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 523.018871][T11237] FAULT_INJECTION: forcing a failure. [ 523.018871][T11237] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 523.097025][T11237] CPU: 0 UID: 0 PID: 11237 Comm: syz.2.1726 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 523.097047][T11237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 523.097056][T11237] Call Trace: [ 523.097062][T11237] [ 523.097068][T11237] dump_stack_lvl+0x241/0x360 [ 523.097095][T11237] ? __pfx_dump_stack_lvl+0x10/0x10 [ 523.097115][T11237] ? __pfx__printk+0x10/0x10 [ 523.097143][T11237] should_fail_ex+0x424/0x570 [ 523.097161][T11237] _copy_from_user+0x2d/0xb0 [ 523.097182][T11237] snd_seq_oss_write+0x5dc/0xc10 [ 523.097237][T11237] ? __pfx_snd_seq_oss_write+0x10/0x10 [ 523.097257][T11237] ? end_current_label_crit_section+0x151/0x180 [ 523.097280][T11237] ? common_file_perm+0x1a6/0x210 [ 523.097316][T11237] ? bpf_lsm_file_permission+0x9/0x10 [ 523.097335][T11237] odev_write+0x5b/0x80 [ 523.097351][T11237] ? __pfx_odev_write+0x10/0x10 [ 523.097367][T11237] vfs_write+0x2bc/0xd10 [ 523.097391][T11237] ? __pfx_vfs_write+0x10/0x10 [ 523.097407][T11237] ? __fget_files+0x2a/0x420 [ 523.097419][T11237] ? __fget_files+0x2a/0x420 [ 523.097432][T11237] ? __fget_files+0x39d/0x420 [ 523.097443][T11237] ? __fget_files+0x2a/0x420 [ 523.097461][T11237] ksys_write+0x19d/0x2d0 [ 523.097478][T11237] ? __pfx_ksys_write+0x10/0x10 [ 523.097496][T11237] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 523.097514][T11237] ? lockdep_hardirqs_on+0x9d/0x150 [ 523.097532][T11237] __do_fast_syscall_32+0xb4/0x110 [ 523.097549][T11237] ? exc_page_fault+0x5f8/0x920 [ 523.097568][T11237] do_fast_syscall_32+0x34/0x80 [ 523.097586][T11237] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 523.097606][T11237] RIP: 0023:0xf746d579 [ 523.097618][T11237] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 523.097630][T11237] RSP: 002b:00000000f50f655c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 523.097644][T11237] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000bc0 [ 523.097654][T11237] RDX: 00000000000002a7 RSI: 0000000000000000 RDI: 0000000000000000 [ 523.097663][T11237] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 523.097675][T11237] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 523.097687][T11237] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 523.097714][T11237] [ 523.335134][T10152] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 523.346096][T10152] 16150 total pagecache pages [ 523.353392][T10152] 1466 pages in swap cache [ 523.357820][T10152] Free swap = 105188kB [ 523.363238][T10152] Total swap = 124996kB [ 523.367396][T10152] 2097051 pages RAM [ 523.372097][T10152] 0 pages HighMem/MovableOnly [ 523.376768][T10152] 428585 pages reserved [ 523.382134][T10152] 0 pages cma reserved [ 523.502137][ T6062] usb 6-1: USB disconnect, device number 55 [ 523.891185][ T24] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 524.110903][ T24] usb 7-1: Using ep0 maxpacket: 16 [ 524.148353][ T24] usb 7-1: config index 0 descriptor too short (expected 1828, got 36) [ 524.156728][ T24] usb 7-1: config 0 has an invalid interface number: 0 but max is -1 [ 524.169462][ T24] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 524.178791][ T24] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 524.189496][ T24] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 524.208550][ T24] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 524.451444][ T24] usb 7-1: New USB device found, idVendor=06cd, idProduct=0115, bcdDevice=1a.1e [ 524.460549][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 524.562481][ T24] usb 7-1: Product: syz [ 524.581203][ T24] usb 7-1: Manufacturer: syz [ 524.601030][ T24] usb 7-1: SerialNumber: syz [ 524.631073][ T24] usb 7-1: config 0 descriptor?? [ 524.650075][ T24] keyspan 7-1:0.0: Keyspan 2 port adapter converter detected [ 524.775069][ T24] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 87 [ 524.954941][T11233] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 524.962966][ T24] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 7 [ 524.980403][ T24] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 81 [ 524.988876][T11233] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 525.052372][T11258] input: syz0 as /devices/virtual/input/input29 [ 525.081271][ T24] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 1 [ 525.130328][ T24] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 2 [ 525.163529][ T24] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 85 [ 525.171396][ T24] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 5 [ 525.184154][ T24] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 525.195740][ T24] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 83 [ 525.203598][ T24] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 4 [ 525.212508][ T24] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 86 [ 525.268466][ T24] keyspan 7-1:0.0: found no endpoint descriptor for endpoint 6 [ 525.347926][ T24] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 526.081592][ T5895] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 526.102058][ T96] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 526.186425][T11275] RDS: rds_bind could not find a transport for 0:0:ffff:ffe0::1, load rds_tcp or rds_rdma? [ 526.232954][ T5895] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 526.251209][ T6062] usb 7-1: USB disconnect, device number 15 [ 526.262103][ T96] usb 4-1: Using ep0 maxpacket: 16 [ 526.277285][ T5895] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 526.285051][ T6062] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 526.288919][ T96] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 526.362742][ T5895] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 526.373249][ T96] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 526.374948][ T6062] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 526.414654][ T5895] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.432336][ T96] usb 4-1: New USB device found, idVendor=054c, idProduct=05c4, bcdDevice= 0.00 [ 526.472270][ T96] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.497959][ T6062] keyspan 7-1:0.0: device disconnected [ 526.517660][T11273] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 526.542954][ T96] usb 4-1: config 0 descriptor?? [ 526.559354][ T5895] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 526.679748][T11282] netlink: 116 bytes leftover after parsing attributes in process `syz.6.1737'. [ 526.823791][ T96] usbhid 4-1:0.0: can't add hid device: -71 [ 526.830187][ T96] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 526.936519][ T96] usb 4-1: USB disconnect, device number 79 [ 526.938919][ T978] usb 6-1: USB disconnect, device number 56 [ 527.016530][T11286] usb usb5: usbfs: process 11286 (syz.0.1739) did not claim interface 0 before use [ 527.252095][ T10] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 527.417046][ T10] usb 7-1: config 0 has an invalid interface number: 239 but max is 0 [ 527.452201][ T30] audit: type=1326 audit(1744534445.188:231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.0.1741" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf746d579 code=0x0 [ 527.473692][ C0] vkms_vblank_simulate: vblank timer overrun [ 527.491972][ T10] usb 7-1: config 0 has no interface number 0 [ 527.558505][ T10] usb 7-1: New USB device found, idVendor=6189, idProduct=182d, bcdDevice= 1.73 [ 527.582030][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.612166][ T10] usb 7-1: Product: syz [ 527.627185][ T10] usb 7-1: Manufacturer: syz [ 527.644723][ T10] usb 7-1: SerialNumber: syz [ 527.670291][ T10] usb 7-1: config 0 descriptor?? [ 528.497648][T11287] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1740'. [ 528.620960][ T6062] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 528.710764][T11310] xt_CT: No such helper "syz0" [ 528.805903][ T6062] usb 6-1: Using ep0 maxpacket: 16 [ 528.807286][T11287] pim6reg: entered allmulticast mode [ 528.853820][ T6062] usb 6-1: config 1 interface 0 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 528.870487][T11287] pim6reg: left allmulticast mode [ 528.877725][ T6062] usb 6-1: config 1 interface 0 has no altsetting 0 [ 528.952204][ T6062] usb 6-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 528.963016][ T6062] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.995837][ T6062] usb 6-1: Product: syz [ 529.025102][ T6062] usb 6-1: Manufacturer: syz [ 529.045665][ T6062] usb 6-1: SerialNumber: syz [ 529.159257][T11321] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1750'. [ 529.317819][T11308] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1747'. [ 529.627177][T11323] usb usb5: usbfs: process 11323 (syz.0.1751) did not claim interface 0 before use [ 529.700222][ T10] asix 7-1:0.239 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 529.723367][ T10] asix 7-1:0.239: probe with driver asix failed with error -71 [ 529.797880][ T10] usb 7-1: USB disconnect, device number 16 [ 530.305593][T11332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.323358][T11332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.621049][ T978] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 530.802538][ T978] usb 1-1: Using ep0 maxpacket: 8 [ 530.832347][ T978] usb 1-1: config 8 has an invalid interface number: 188 but max is 0 [ 530.885793][ T978] usb 1-1: config 8 has no interface number 0 [ 530.935808][ T978] usb 1-1: config 8 interface 188 altsetting 0 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 530.992923][ T978] usb 1-1: config 8 interface 188 altsetting 0 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 531.108225][ T978] usb 1-1: config 8 interface 188 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 531.181647][ T978] usb 1-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 531.196531][ T978] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.237822][ T978] usb 1-1: Product: syz [ 531.271010][ T978] usb 1-1: Manufacturer: syz [ 531.289966][ T6062] usbhid 6-1:1.0: can't add hid device: -71 [ 531.324943][T11350] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1762'. [ 531.353553][ T978] usb 1-1: SerialNumber: syz [ 531.358475][ T6062] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 531.361644][ T5894] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 531.427513][ T6062] usb 6-1: USB disconnect, device number 57 [ 531.484034][T11352] usb usb5: usbfs: process 11352 (syz.5.1763) did not claim interface 0 before use [ 531.585514][ T5894] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 44, changing to 9 [ 531.624266][ T5894] usb 4-1: New USB device found, idVendor=18d1, idProduct=5030, bcdDevice= 0.00 [ 531.696424][T11353] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1755'. [ 531.702753][ T5894] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 531.765365][T11355] netlink: 'syz.6.1764': attribute type 33 has an invalid length. [ 531.775618][ T5894] usb 4-1: config 0 descriptor?? [ 531.799712][T11355] netlink: 152 bytes leftover after parsing attributes in process `syz.6.1764'. [ 531.823978][T11356] SET target dimension over the limit! [ 531.867527][T11356] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 531.897921][T11353] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 531.907213][T11353] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 531.916067][T11353] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 531.924905][T11353] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 531.930354][T11356] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 532.069994][T11353] vxlan0: entered promiscuous mode [ 532.296132][ T5894] hid (null): nested delimiters [ 532.335442][ T5894] hid-generic 0003:18D1:5030.0038: nested delimiters [ 532.397809][T11362] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1766'. [ 532.413212][ T5894] hid-generic 0003:18D1:5030.0038: item 0 1 2 10 parsing failed [ 532.433702][T11361] delete_channel: no stack [ 532.497292][T11347] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 532.504789][ T5894] hid-generic 0003:18D1:5030.0038: probe with driver hid-generic failed with error -22 [ 532.512467][T11347] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 532.731496][ T5898] usb 4-1: USB disconnect, device number 80 [ 533.599910][ T978] vmk80xx 1-1:8.188: driver 'vmk80xx' failed to auto-configure device. [ 533.619841][ T978] vmk80xx 1-1:8.188: probe with driver vmk80xx failed with error -22 [ 533.687389][ T978] usb 1-1: USB disconnect, device number 74 [ 533.723474][T11375] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1769'. [ 533.966691][T11380] input: syz0 as /devices/virtual/input/input30 [ 534.157562][T11380] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 534.669095][T11390] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1773'. [ 536.081226][T11420] FAULT_INJECTION: forcing a failure. [ 536.081226][T11420] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 536.143502][T11420] CPU: 1 UID: 0 PID: 11420 Comm: syz.0.1784 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 536.143535][T11420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 536.143548][T11420] Call Trace: [ 536.143558][T11420] [ 536.143567][T11420] dump_stack_lvl+0x241/0x360 [ 536.143605][T11420] ? __pfx_dump_stack_lvl+0x10/0x10 [ 536.143637][T11420] ? __pfx__printk+0x10/0x10 [ 536.143680][T11420] should_fail_ex+0x424/0x570 [ 536.143709][T11420] _copy_from_user+0x2d/0xb0 [ 536.143741][T11420] snd_rawmidi_kernel_write1+0x390/0x620 [ 536.143794][T11420] snd_rawmidi_write+0x5f2/0xc00 [ 536.143833][T11420] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 536.143866][T11420] ? __pfx_default_wake_function+0x10/0x10 [ 536.143892][T11420] ? common_file_perm+0x1a6/0x210 [ 536.143927][T11420] ? bpf_lsm_file_permission+0x9/0x10 [ 536.143953][T11420] ? rw_verify_area+0x246/0x630 [ 536.143977][T11420] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 536.144000][T11420] vfs_write+0x2bc/0xd10 [ 536.144036][T11420] ? __pfx_vfs_write+0x10/0x10 [ 536.144061][T11420] ? __fget_files+0x2a/0x420 [ 536.144081][T11420] ? __fget_files+0x2a/0x420 [ 536.144101][T11420] ? __fget_files+0x39d/0x420 [ 536.144119][T11420] ? __fget_files+0x2a/0x420 [ 536.144155][T11420] ksys_write+0x19d/0x2d0 [ 536.144183][T11420] ? __pfx_ksys_write+0x10/0x10 [ 536.144210][T11420] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 536.144252][T11420] ? lockdep_hardirqs_on+0x9d/0x150 [ 536.144280][T11420] __do_fast_syscall_32+0xb4/0x110 [ 536.144306][T11420] ? exc_page_fault+0x5f8/0x920 [ 536.144333][T11420] do_fast_syscall_32+0x34/0x80 [ 536.144360][T11420] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 536.144391][T11420] RIP: 0023:0xf746d579 [ 536.144408][T11420] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 536.144425][T11420] RSP: 002b:00000000f50f655c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 536.144447][T11420] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000000 [ 536.144461][T11420] RDX: 00000000fffffd2c RSI: 0000000000000000 RDI: 0000000000000000 [ 536.144474][T11420] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 536.144486][T11420] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 536.144498][T11420] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 536.144528][T11420] [ 538.012071][ T96] usb 4-1: new full-speed USB device number 81 using dummy_hcd [ 538.173688][ T96] usb 4-1: unable to get BOS descriptor or descriptor too short [ 538.187047][ T96] usb 4-1: not running at top speed; connect to a high speed hub [ 538.201642][ T5895] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 538.220120][ T96] usb 4-1: config 8 interface 0 altsetting 7 endpoint 0x3 has invalid wMaxPacketSize 0 [ 538.263206][ T96] usb 4-1: config 8 interface 0 has no altsetting 0 [ 538.329714][ T96] usb 4-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 538.369232][ T96] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 538.378608][ T5895] usb 3-1: Using ep0 maxpacket: 16 [ 538.392647][ T5895] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 538.410746][ T5895] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 538.452641][ T96] usb 4-1: Product: syz [ 538.461992][ T96] usb 4-1: Manufacturer: syz [ 538.466676][ T96] usb 4-1: SerialNumber: syz [ 538.483088][ T5895] usb 3-1: New USB device found, idVendor=05ac, idProduct=027c, bcdDevice=17.00 [ 538.509074][ T5895] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 538.653450][ T5895] usb 3-1: config 0 descriptor?? [ 538.734895][T11453] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 538.744521][T11453] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 539.074641][ T5895] apple 0003:05AC:027C.0039: hidraw0: USB HID v0.00 Device [HID 05ac:027c] on usb-dummy_hcd.2-1/input0 [ 539.092219][T11458] xt_CT: No such helper "syz0" [ 539.177838][T11463] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1799'. [ 539.289767][ T5895] usb 3-1: USB disconnect, device number 97 [ 540.230364][T11477] tipc: Trying to set illegal importance in message [ 540.388520][T11479] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1804'. [ 540.531421][ T5895] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 540.697813][ T5895] usb 3-1: config 0 interface 0 altsetting 60 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 540.712462][ T5895] usb 3-1: config 0 interface 0 has no altsetting 0 [ 540.724878][ T5895] usb 3-1: New USB device found, idVendor=2294, idProduct=425a, bcdDevice=ae.ad [ 540.776647][ T5895] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 540.794149][ T96] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 540.836066][ T96] usb 4-1: selecting invalid altsetting 0 [ 540.852756][ T5895] usb 3-1: config 0 descriptor?? [ 541.338596][ T96] snd-usb-audio 4-1:8.0: probe with driver snd-usb-audio failed with error -12 [ 541.398218][ T96] usb 4-1: USB disconnect, device number 81 [ 541.764966][ T6047] udevd[6047]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:8.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 542.421864][ T6062] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 542.645126][ T6062] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 44, changing to 9 [ 542.670017][ T6062] usb 6-1: New USB device found, idVendor=18d1, idProduct=5030, bcdDevice= 0.00 [ 542.715484][ T6062] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.766854][ T6062] usb 6-1: config 0 descriptor?? [ 542.953987][T11515] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 542.993872][T11515] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 543.173328][ T10] usb 7-1: new low-speed USB device number 17 using dummy_hcd [ 543.296521][ T6062] hid (null): nested delimiters [ 543.368470][ T6062] hid-generic 0003:18D1:5030.003A: nested delimiters [ 543.411344][ T6062] hid-generic 0003:18D1:5030.003A: item 0 1 2 10 parsing failed [ 543.461215][ T6062] hid-generic 0003:18D1:5030.003A: probe with driver hid-generic failed with error -22 [ 543.529499][T11508] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.550368][T11508] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 543.670908][ T5898] usb 1-1: new full-speed USB device number 75 using dummy_hcd [ 543.840549][ T5898] usb 1-1: unable to get BOS descriptor or descriptor too short [ 543.850470][ T5898] usb 1-1: not running at top speed; connect to a high speed hub [ 543.860644][ T5898] usb 1-1: config 1 has an invalid descriptor of length 230, skipping remainder of the config [ 543.875575][ T5898] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 543.885002][ T5898] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.893521][ T5898] usb 1-1: Product: syz [ 543.904771][ T5898] usb 1-1: Manufacturer: syz [ 543.918571][ T6062] usb 6-1: USB disconnect, device number 58 [ 543.987958][ T5898] usb 1-1: SerialNumber: syz [ 544.093412][ T5898] usb 1-1: bad CDC descriptors [ 544.105461][ T5895] usb 3-1: string descriptor 0 read error: -71 [ 544.162868][ T5895] usb 3-1: ucan: probing device on interface #0 [ 544.169376][ T5895] usb 3-1: ucan: invalid endpoint configuration [ 544.177422][ T5895] usb 3-1: ucan: probe failed; try to update the device firmware [ 544.197847][ T5895] usb 3-1: USB disconnect, device number 98 [ 545.308594][T11543] netlink: 'syz.2.1826': attribute type 12 has an invalid length. [ 545.352767][T11543] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1826'. [ 545.652176][ T10] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 545.802241][ T10] usb 3-1: device descriptor read/64, error -71 [ 545.901406][ T5898] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 546.042691][ T10] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 546.120916][ T5898] usb 6-1: Using ep0 maxpacket: 32 [ 546.182174][ T10] usb 3-1: device descriptor read/64, error -71 [ 546.263886][ T5898] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 546.292205][ T10] usb usb3-port1: attempt power cycle [ 546.377366][ T5898] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 546.420596][ T5898] usb 6-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 546.447406][ T96] usb 1-1: USB disconnect, device number 75 [ 546.551109][ T5898] usb 6-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 546.561988][ T5898] usb 6-1: Product: syz [ 546.566201][ T5898] usb 6-1: Manufacturer: syz [ 546.621446][ T5898] hub 6-1:4.0: USB hub found [ 546.631732][ T10] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 546.737053][ T10] usb 3-1: device descriptor read/8, error -71 [ 546.752428][T11554] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1830'. [ 546.808300][T11549] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 546.823803][T11549] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 547.002548][ T10] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 547.022615][ T10] usb 3-1: device descriptor read/8, error -71 [ 547.115625][ T5898] hub 6-1:4.0: config failed, can't read hub descriptor (err -22) [ 547.203734][ T10] usb usb3-port1: unable to enumerate USB device [ 547.433912][ T5898] usb 6-1: USB disconnect, device number 59 [ 548.191007][ T6062] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 548.281544][ T10] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 548.352769][ T6062] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 44, changing to 9 [ 548.409291][ T6062] usb 6-1: New USB device found, idVendor=18d1, idProduct=5030, bcdDevice= 0.00 [ 548.454643][ T6062] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 548.512690][ T6062] usb 6-1: config 0 descriptor?? [ 548.513839][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 548.554243][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 548.608871][ T10] usb 7-1: New USB device found, idVendor=05ac, idProduct=024c, bcdDevice= 0.00 [ 548.662292][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 548.723210][ T10] usb 7-1: config 0 descriptor?? [ 548.977432][ T6062] hid (null): nested delimiters [ 549.012817][ T6062] hid-generic 0003:18D1:5030.003B: nested delimiters [ 549.050395][ T6062] hid-generic 0003:18D1:5030.003B: item 0 1 2 10 parsing failed [ 549.147833][ T6062] hid-generic 0003:18D1:5030.003B: probe with driver hid-generic failed with error -22 [ 549.178860][T11566] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 549.192508][ T10] apple 0003:05AC:024C.003C: hidraw0: USB HID v0.05 Device [HID 05ac:024c] on usb-dummy_hcd.6-1/input0 [ 549.212849][T11566] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 549.216209][T11577] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 549.374753][ T6062] usb 6-1: USB disconnect, device number 60 [ 549.708555][ T10] usb 7-1: USB disconnect, device number 18 [ 550.058452][T11583] kvm: Disabled LAPIC found during irq injection [ 550.322682][ T10] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 550.524435][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 550.544041][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 550.556882][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 550.609906][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 59152, setting to 1024 [ 550.650987][ T5898] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 550.699834][ T10] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 550.756148][ T10] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 550.781664][ T10] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 550.803715][ T10] usb 6-1: Manufacturer: syz [ 550.823000][ T5898] usb 7-1: New USB device found, idVendor=077b, idProduct=2226, bcdDevice=ca.8b [ 550.837617][ T10] usb 6-1: config 0 descriptor?? [ 550.860866][ T5898] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 550.916749][ T5898] usb 7-1: config 0 descriptor?? [ 551.270940][ T6062] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 551.284449][ T10] rc_core: IR keymap rc-hauppauge not found [ 551.290521][ T10] Registered IR keymap rc-empty [ 551.315164][ T10] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 551.357264][ T10] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 551.390618][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 551.437782][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input31 [ 551.460455][ T10] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 551.516290][ T10] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 551.540927][ T6062] usb 1-1: device descriptor read/64, error -71 [ 551.548908][ T5898] asix 7-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 551.584488][ T10] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 551.609207][ T5898] asix 7-1:0.0: probe with driver asix failed with error -32 [ 551.632591][ T10] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 551.674949][ T10] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 551.705088][ T10] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 551.794789][ T10] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 551.833718][ T10] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 551.877306][ T10] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 551.904827][ T10] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 551.913652][ T6062] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 551.949356][ T10] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 551.978070][ T10] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 552.070768][ T10] usb 6-1: USB disconnect, device number 61 [ 552.213405][ T6062] usb 1-1: device descriptor read/64, error -71 [ 552.357056][ T6062] usb usb1-port1: attempt power cycle [ 552.772896][T11613] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3937406371 (7874812742 ns) > initial count (138880 ns). Using initial count to start timer. [ 552.812305][ T6062] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 552.863681][ T6062] usb 1-1: device descriptor read/8, error -71 [ 552.871475][ T5898] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 553.020991][ T5898] usb 3-1: device descriptor read/64, error -71 [ 553.161247][ T6062] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 553.194964][ T6062] usb 1-1: device descriptor read/8, error -71 [ 553.281180][ T5898] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 553.313395][ T6062] usb usb1-port1: unable to enumerate USB device [ 553.332654][ T10] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 553.380275][ T6062] usb 7-1: USB disconnect, device number 19 [ 553.431125][ T5898] usb 3-1: device descriptor read/64, error -71 [ 553.492042][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 553.499120][ T10] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 553.532234][ T10] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 553.557580][ T5898] usb usb3-port1: attempt power cycle [ 553.573858][ T10] usb 6-1: config 0 interface 0 has no altsetting 0 [ 553.594451][ T10] usb 6-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 553.622564][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 553.643931][ T10] usb 6-1: config 0 descriptor?? [ 553.891269][ T6062] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 553.921024][ T5898] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 554.041736][ T5898] usb 3-1: device descriptor read/8, error -71 [ 554.088020][ T10] hid (null): unknown global tag 0xd [ 554.137343][ T10] hid (null): unknown global tag 0xc [ 554.182927][ T6062] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 554.207758][ T6062] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 554.261196][ T6062] usb 7-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 554.278370][ T978] usb 6-1: USB disconnect, device number 62 [ 554.302031][ T6062] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 554.311216][ T5898] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 554.353526][ T6062] usb 7-1: config 0 descriptor?? [ 554.363126][ T5898] usb 3-1: device descriptor read/8, error -71 [ 554.471647][ T5898] usb usb3-port1: unable to enumerate USB device [ 554.512119][T11630] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3097856679 (6195713358 ns) > initial count (1172152938 ns). Using initial count to start timer. [ 554.887539][T11628] netlink: 'syz.3.1858': attribute type 1 has an invalid length. [ 554.899074][T11628] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1858'. [ 555.182107][ T5898] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 555.191978][ T6062] hid-led 0003:0FC5:B080.003E: probe with driver hid-led failed with error -71 [ 555.231254][ T6062] usb 7-1: USB disconnect, device number 20 [ 555.463987][ T5898] usb 1-1: Using ep0 maxpacket: 16 [ 555.498220][ T5898] usb 1-1: config 1 interface 0 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 555.516680][ T5898] usb 1-1: config 1 interface 0 has no altsetting 0 [ 555.547213][ T5898] usb 1-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 555.562163][ T5898] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 555.600017][ T5898] usb 1-1: Product: syz [ 555.617657][ T5898] usb 1-1: Manufacturer: syz [ 555.642213][ T5898] usb 1-1: SerialNumber: syz [ 556.922012][ T10] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 557.082540][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 557.089502][ T10] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 557.106645][ T10] usb 4-1: config 0 has no interface number 0 [ 557.122030][ T10] usb 4-1: config 0 interface 41 has no altsetting 0 [ 557.137852][ T10] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 557.152487][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 557.177867][ T10] usb 4-1: Product: syz [ 557.192160][ T10] usb 4-1: Manufacturer: syz [ 557.208323][ T10] usb 4-1: SerialNumber: syz [ 557.242958][ T10] usb 4-1: config 0 descriptor?? [ 557.266704][ T10] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -22 [ 557.499187][ T10] usb 4-1: USB disconnect, device number 82 [ 558.138215][ T5898] usbhid 1-1:1.0: can't add hid device: -71 [ 558.181544][ T5898] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 558.252612][ T5898] usb 1-1: USB disconnect, device number 80 [ 558.442535][ T10] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 558.533751][T11679] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 558.579071][T11669] xt_CT: No such helper "syz0" [ 558.662078][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 558.670033][ T10] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 558.697960][ T10] usb 7-1: can't read configurations, error -61 [ 558.871843][ T10] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 559.041477][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 559.049620][ T10] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 559.059309][ T10] usb 7-1: can't read configurations, error -61 [ 559.110449][ T10] usb usb7-port1: attempt power cycle [ 559.493158][ T10] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 559.532044][ T5895] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 559.543993][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 559.557175][ T10] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 559.569945][ T10] usb 7-1: can't read configurations, error -61 [ 559.693266][ T5895] usb 6-1: Using ep0 maxpacket: 32 [ 559.700667][ T5895] usb 6-1: config 0 has no interfaces? [ 559.708623][ T5895] usb 6-1: New USB device found, idVendor=2040, idProduct=c602, bcdDevice= 1.8e [ 559.732085][ T10] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 559.767230][ T5895] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.777934][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 559.809413][ T10] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 559.870003][ T10] usb 7-1: can't read configurations, error -61 [ 559.892632][ T5895] usb 6-1: config 0 descriptor?? [ 559.907597][ T10] usb usb7-port1: unable to enumerate USB device [ 560.112969][ T5895] usb 6-1: USB disconnect, device number 63 [ 560.919812][T11697] FAULT_INJECTION: forcing a failure. [ 560.919812][T11697] name failslab, interval 1, probability 0, space 0, times 0 [ 560.992043][T11697] CPU: 1 UID: 0 PID: 11697 Comm: syz.3.1880 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 560.992075][T11697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 560.992090][T11697] Call Trace: [ 560.992099][T11697] [ 560.992108][T11697] dump_stack_lvl+0x241/0x360 [ 560.992149][T11697] ? __pfx_dump_stack_lvl+0x10/0x10 [ 560.992181][T11697] ? __pfx__printk+0x10/0x10 [ 560.992216][T11697] ? __pfx___might_resched+0x10/0x10 [ 560.992248][T11697] should_fail_ex+0x424/0x570 [ 560.992277][T11697] should_failslab+0xac/0x100 [ 560.992309][T11697] __kmalloc_node_track_caller_noprof+0xe2/0x4d0 [ 560.992342][T11697] ? ima_collect_measurement+0x5cf/0xb20 [ 560.992366][T11697] ? ima_collect_measurement+0x5cf/0xb20 [ 560.992389][T11697] krealloc_noprof+0x10f/0x300 [ 560.992429][T11697] ima_collect_measurement+0x5cf/0xb20 [ 560.992466][T11697] ? __pfx_ima_collect_measurement+0x10/0x10 [ 560.992488][T11697] ? __lock_acquire+0xad5/0xd80 [ 560.992530][T11697] ? simple_xattr_get+0xf1/0x170 [ 560.992573][T11697] ? ima_get_hash_algo+0x157/0x520 [ 560.992613][T11697] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 560.992652][T11697] process_measurement+0x13a3/0x1fe0 [ 560.992705][T11697] ? __pfx_process_measurement+0x10/0x10 [ 560.992778][T11697] ? kfree+0x198/0x430 [ 560.992802][T11697] ? tomoyo_find_next_domain+0x1939/0x1dd0 [ 560.992827][T11697] ? tomoyo_profile+0x11/0x50 [ 560.992850][T11697] ? tomoyo_find_next_domain+0x1939/0x1dd0 [ 560.992887][T11697] ? apparmor_current_getlsmprop_subj+0xde/0x160 [ 560.992919][T11697] ima_bprm_check+0xff/0x200 [ 560.992953][T11697] ? __pfx_ima_bprm_check+0x10/0x10 [ 560.992986][T11697] ? bprm_execve+0x240/0x1430 [ 560.993008][T11697] ? tomoyo_bprm_check_security+0xee/0x180 [ 560.993031][T11697] ? bprm_execve+0x240/0x1430 [ 560.993056][T11697] security_bprm_check+0xd2/0x250 [ 560.993085][T11697] bprm_execve+0x903/0x1430 [ 560.993126][T11697] ? __pfx_bprm_execve+0x10/0x10 [ 560.993150][T11697] ? copy_string_kernel+0x1d3/0x240 [ 560.993176][T11697] ? put_arg_page+0x10f/0x240 [ 560.993198][T11697] ? copy_string_kernel+0x200/0x240 [ 560.993226][T11697] do_execveat_common+0x57c/0x710 [ 560.993264][T11697] __ia32_compat_sys_execveat+0xca/0xe0 [ 560.993295][T11697] __do_fast_syscall_32+0xb4/0x110 [ 560.993322][T11697] ? exc_page_fault+0x5f8/0x920 [ 560.993352][T11697] do_fast_syscall_32+0x34/0x80 [ 560.993378][T11697] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 560.993403][T11697] RIP: 0023:0xf73fd579 [ 560.993421][T11697] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 560.993438][T11697] RSP: 002b:00000000f508655c EFLAGS: 00000206 ORIG_RAX: 0000000000000166 [ 560.993461][T11697] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000180 [ 560.993476][T11697] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 560.993489][T11697] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 560.993501][T11697] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 560.993514][T11697] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 560.993544][T11697] [ 561.032675][ T30] audit: type=1800 audit(1744534478.778:232): pid=11697 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1880" name="file1" dev="tmpfs" ino=1994 res=0 errno=0 [ 561.998577][T11715] FAULT_INJECTION: forcing a failure. [ 561.998577][T11715] name failslab, interval 1, probability 0, space 0, times 0 [ 562.022750][T11715] CPU: 0 UID: 0 PID: 11715 Comm: syz.0.1887 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 562.022782][T11715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 562.022796][T11715] Call Trace: [ 562.022805][T11715] [ 562.022813][T11715] dump_stack_lvl+0x241/0x360 [ 562.022850][T11715] ? __pfx_dump_stack_lvl+0x10/0x10 [ 562.022880][T11715] ? __pfx__printk+0x10/0x10 [ 562.022913][T11715] ? __pfx___might_resched+0x10/0x10 [ 562.022944][T11715] should_fail_ex+0x424/0x570 [ 562.022972][T11715] should_failslab+0xac/0x100 [ 562.023004][T11715] __kmalloc_cache_noprof+0x73/0x370 [ 562.023034][T11715] ? device_add+0xc1/0xbf0 [ 562.023064][T11715] device_add+0xc1/0xbf0 [ 562.023090][T11715] ? device_initialize+0x266/0x460 [ 562.023119][T11715] netdev_register_kobject+0x157/0x2f0 [ 562.023148][T11715] register_netdevice+0x12b0/0x1b80 [ 562.023173][T11715] ? rcu_is_watching+0x15/0xb0 [ 562.023232][T11715] ? __pfx_register_netdevice+0x10/0x10 [ 562.023257][T11715] ? dev_addr_mod+0xf4/0x430 [ 562.023280][T11715] ? __asan_memset+0x23/0x50 [ 562.023308][T11715] ? netif_inherit_tso_max+0x1f3/0x340 [ 562.023334][T11715] veth_newlink+0x4c3/0xb80 [ 562.023371][T11715] ? __pfx_veth_newlink+0x10/0x10 [ 562.023398][T11715] ? rtnetlink_rcv_msg+0x80f/0xd70 [ 562.023427][T11715] ? netlink_rcv_skb+0x208/0x480 [ 562.023456][T11715] ? netlink_unicast+0x7f8/0x9a0 [ 562.023481][T11715] ? netlink_sendmsg+0x8c3/0xcd0 [ 562.023510][T11715] ? __sock_sendmsg+0x221/0x270 [ 562.023537][T11715] ? __sys_sendmsg+0x271/0x360 [ 562.023557][T11715] ? __do_fast_syscall_32+0xb4/0x110 [ 562.023585][T11715] ? do_fast_syscall_32+0x34/0x80 [ 562.023705][T11715] ? rtnl_create_link+0xb36/0xea0 [ 562.023735][T11715] ? nla_strscpy+0x115/0x180 [ 562.023766][T11715] ? __pfx_veth_newlink+0x10/0x10 [ 562.023797][T11715] rtnl_newlink_create+0x39b/0xcb0 [ 562.023821][T11715] ? __mutex_lock+0x380/0x10c0 [ 562.023852][T11715] ? __pfx_aa_get_newest_label+0x10/0x10 [ 562.023887][T11715] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 562.023913][T11715] ? __pfx___mutex_lock+0x10/0x10 [ 562.023947][T11715] ? nla_strscpy+0x102/0x180 [ 562.023974][T11715] ? full_name_hash+0x89/0xe0 [ 562.023999][T11715] rtnl_newlink+0x18b0/0x1fe0 [ 562.024033][T11715] ? stack_depot_save_flags+0x44/0x940 [ 562.024073][T11715] ? __pfx_rtnl_newlink+0x10/0x10 [ 562.024102][T11715] ? __netlink_deliver_tap+0x561/0x7f0 [ 562.024207][T11715] ? aa_get_newest_label+0x101/0x6f0 [ 562.024245][T11715] ? __lock_acquire+0xad5/0xd80 [ 562.024292][T11715] ? __pfx_rtnl_newlink+0x10/0x10 [ 562.024325][T11715] rtnetlink_rcv_msg+0x80f/0xd70 [ 562.024355][T11715] ? rtnetlink_rcv_msg+0x1ba/0xd70 [ 562.024391][T11715] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 562.024431][T11715] ? ref_tracker_free+0x63e/0x7e0 [ 562.024463][T11715] netlink_rcv_skb+0x208/0x480 [ 562.024496][T11715] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 562.024529][T11715] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 562.024581][T11715] ? netlink_deliver_tap+0x2e/0x1b0 [ 562.024623][T11715] ? netlink_deliver_tap+0x2e/0x1b0 [ 562.024665][T11715] netlink_unicast+0x7f8/0x9a0 [ 562.024703][T11715] ? __pfx_netlink_unicast+0x10/0x10 [ 562.024734][T11715] ? skb_put+0x114/0x1f0 [ 562.024762][T11715] netlink_sendmsg+0x8c3/0xcd0 [ 562.024808][T11715] ? __pfx_netlink_sendmsg+0x10/0x10 [ 562.024843][T11715] ? __import_iovec+0x585/0x830 [ 562.024873][T11715] ? aa_sock_msg_perm+0x91/0x160 [ 562.024931][T11715] ? __pfx_netlink_sendmsg+0x10/0x10 [ 562.024961][T11715] __sock_sendmsg+0x221/0x270 [ 562.024995][T11715] ____sys_sendmsg+0x523/0x860 [ 562.025030][T11715] ? __pfx_____sys_sendmsg+0x10/0x10 [ 562.025073][T11715] __sys_sendmsg+0x271/0x360 [ 562.025104][T11715] ? __pfx___sys_sendmsg+0x10/0x10 [ 562.025185][T11715] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 562.025213][T11715] ? lockdep_hardirqs_on+0x9d/0x150 [ 562.025243][T11715] __do_fast_syscall_32+0xb4/0x110 [ 562.025270][T11715] ? exc_page_fault+0x5f8/0x920 [ 562.025302][T11715] do_fast_syscall_32+0x34/0x80 [ 562.025330][T11715] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 562.025357][T11715] RIP: 0023:0xf746d579 [ 562.025375][T11715] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 562.025395][T11715] RSP: 002b:00000000f50f655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 562.025418][T11715] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000280 [ 562.025434][T11715] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 562.025447][T11715] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 562.025460][T11715] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 562.025473][T11715] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 562.025505][T11715] [ 562.897331][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.904484][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.004440][T11726] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0x3 [ 563.242483][T11729] geneve1: entered promiscuous mode [ 563.291065][ T24] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 563.400320][T11733] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 563.554417][ T24] usb 1-1: config 0 has no interfaces? [ 563.583623][ T24] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 563.592917][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.613317][ T24] usb 1-1: Product: syz [ 563.661312][ T24] usb 1-1: Manufacturer: syz [ 563.692537][ T24] usb 1-1: SerialNumber: syz [ 563.726182][ T24] usb 1-1: config 0 descriptor?? [ 563.749495][T11738] openvswitch: netlink: IP tunnel dst address not specified [ 564.472368][ T5898] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 564.704662][ T5898] usb 4-1: config 0 has an invalid interface number: 168 but max is 0 [ 564.840844][ T5898] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 564.962172][ T5898] usb 4-1: config 0 has no interface number 0 [ 565.132834][ T5898] usb 4-1: config 0 interface 168 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 565.204913][ T5898] usb 4-1: config 0 interface 168 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 565.246518][ T5898] usb 4-1: config 0 interface 168 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 16 [ 565.353369][ T5898] usb 4-1: New USB device found, idVendor=0959, idProduct=2bd0, bcdDevice=48.98 [ 565.390255][ T5898] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 565.445350][ T5898] usb 4-1: config 0 descriptor?? [ 565.467616][ T5898] HFC-S_USB 4-1:0.168: probe with driver HFC-S_USB failed with error -5 [ 566.125781][T11771] batadv0: entered promiscuous mode [ 566.169028][T11771] batadv_slave_0: entered promiscuous mode [ 566.207078][T11771] batadv_slave_0: left promiscuous mode [ 566.267198][T11771] batadv0: left promiscuous mode [ 566.541302][ T6062] usb 1-1: USB disconnect, device number 81 [ 567.010951][ T24] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 567.170928][ T24] usb 6-1: Using ep0 maxpacket: 16 [ 567.206477][ T24] usb 6-1: config index 0 descriptor too short (expected 69, got 36) [ 567.275404][ T24] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 567.352728][ T24] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x31, changing to 0x1 [ 567.422196][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 567.493962][ T24] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 567.598944][ T24] usb 6-1: New USB device found, idVendor=093a, idProduct=2622, bcdDevice=b7.89 [ 567.616955][T11788] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1908'. [ 567.630923][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.638988][ T24] usb 6-1: Product: syz [ 567.684992][ T24] usb 6-1: Manufacturer: syz [ 567.722375][ T24] usb 6-1: SerialNumber: syz [ 567.750061][ T24] usb 6-1: config 0 descriptor?? [ 567.780715][ T24] gspca_main: gspca_pac7302-2.14.0 probing 093a:2622 [ 568.392126][ T96] usb 4-1: USB disconnect, device number 83 [ 569.790042][ T24] gspca_pac7302: reg_w() failed i: 78 v: 40 error -110 [ 569.820756][ T24] gspca_pac7302 6-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 569.883468][ T24] usb 6-1: USB disconnect, device number 64 [ 570.387522][T11811] sctp: [Deprecated]: syz.2.1915 (pid 11811) Use of int in max_burst socket option deprecated. [ 570.387522][T11811] Use struct sctp_assoc_value instead [ 571.670265][T11825] netlink: 'syz.5.1921': attribute type 21 has an invalid length. [ 571.757825][T11825] netlink: 176 bytes leftover after parsing attributes in process `syz.5.1921'. [ 571.980925][ T6062] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 572.039901][T11832] delete_channel: no stack [ 572.194655][ T6062] usb 4-1: too many configurations: 237, using maximum allowed: 8 [ 572.266123][ T6062] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 572.400900][ T6062] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 572.495409][ T6062] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 572.505940][ T31] INFO: task syz.1.1389:10154 blocked for more than 143 seconds. [ 572.530880][ T31] Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 [ 572.540901][ T6062] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 572.572343][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 572.597553][ T31] task:syz.1.1389 state:D stack:28440 pid:10154 tgid:10124 ppid:5856 task_flags:0x400040 flags:0x20000004 [ 572.643651][ T6062] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 572.654717][ T31] Call Trace: [ 572.678721][ T31] [ 572.691998][ T6062] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 572.710342][ T31] __schedule+0x1b88/0x5240 [ 572.752432][ T6062] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 572.763262][ T6062] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 572.786408][ T31] ? schedule+0x163/0x360 [ 572.787387][ T6062] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 572.805922][ T6062] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 572.824760][ T6062] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 572.839129][ T6062] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 572.852540][ T31] ? __pfx___schedule+0x10/0x10 [ 572.875335][ T31] ? schedule+0x90/0x360 [ 572.879767][ T31] ? schedule+0x90/0x360 [ 572.914096][ T6062] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 572.930455][ T6062] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 572.944922][ T6062] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 572.953651][ T31] schedule+0x163/0x360 [ 572.955373][ T6062] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 572.959145][ T31] ? __mutex_lock+0x5f3/0x10c0 [ 572.975146][ T6062] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 572.988676][ T6062] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 572.997970][ T6062] usb 4-1: Product: syz [ 573.002366][ T6062] usb 4-1: Manufacturer: syz [ 573.008187][ T6062] usb 4-1: SerialNumber: syz [ 573.055730][ T6062] usb 4-1: ath9k_htc: Device endpoint numbers are not the expected ones [ 573.096217][ T31] schedule_preempt_disabled+0x13/0x30 [ 573.103230][ T31] __mutex_lock+0x805/0x10c0 [ 573.107873][ T31] ? __mutex_lock+0x5f3/0x10c0 [ 573.115345][ T31] ? blk_trace_remove+0x20/0x40 [ 573.120227][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 573.126517][ T31] ? tomoyo_path_number_perm+0x215/0x790 [ 573.143232][ T31] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 573.149398][ T31] blk_trace_remove+0x20/0x40 [ 573.156055][ T31] sg_ioctl+0x4a3/0x2ea0 [ 573.161351][ T31] ? __pfx_sg_ioctl+0x10/0x10 [ 573.167953][ T31] ? __fget_files+0x2a/0x420 [ 573.176389][ T31] ? __fget_files+0x2a/0x420 [ 573.181304][ T31] ? __fget_files+0x2a/0x420 [ 573.185984][ T31] __se_compat_sys_ioctl+0x50e/0xc30 [ 573.196077][ T31] ? __pfx___se_compat_sys_ioctl+0x10/0x10 [ 573.207660][ T31] ? _copy_from_user+0x95/0xb0 [ 573.223098][ T31] ? __se_compat_sys_rt_sigprocmask+0x365/0x3d0 [ 573.272313][ T31] ? __pfx___se_compat_sys_rt_sigprocmask+0x10/0x10 [ 573.280672][ T31] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 573.317304][ T31] ? lockdep_hardirqs_on+0x9d/0x150 [ 573.335533][ T31] __do_fast_syscall_32+0xb4/0x110 [ 573.357858][ T31] ? ret_from_fork_asm+0x1a/0x30 [ 573.406526][ T31] ? lockdep_hardirqs_on+0x9d/0x150 [ 573.417747][ T31] do_fast_syscall_32+0x34/0x80 [ 573.428267][ T31] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 573.441739][ T31] RIP: 0023:0xf7ff3579 [ 573.449613][ T31] RSP: 002b:00000000f4cb155c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 573.525349][ T31] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000000001276 [ 573.553982][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 573.584196][ T31] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 573.610937][ T31] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 573.624637][ T31] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 573.648164][ T31] [ 573.674956][ T31] [ 573.674956][ T31] Showing all locks held in the system: [ 573.697243][ T31] 1 lock held by khungtaskd/31: [ 573.732160][ T31] #0: ffffffff8ed3dfa0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x30/0x180 [ 573.780920][ T31] 2 locks held by getty/5597: [ 573.786862][ T31] #0: ffff888034ed10a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 573.810935][ T31] #1: ffffc900036c62f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x5bb/0x1700 [ 573.832153][ T31] 2 locks held by syz.1.1389/10152: [ 573.837388][ T31] 1 lock held by syz.1.1389/10154: [ 573.852372][ T31] #0: ffff8881437c39d8 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x20/0x40 [ 573.892999][ T31] [ 573.895382][ T31] ============================================= [ 573.895382][ T31] [ 573.939083][ T31] NMI backtrace for cpu 0 [ 573.939104][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 573.939130][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 573.939143][ T31] Call Trace: [ 573.939152][ T31] [ 573.939162][ T31] dump_stack_lvl+0x241/0x360 [ 573.939199][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 573.939230][ T31] ? __pfx__printk+0x10/0x10 [ 573.939270][ T31] nmi_cpu_backtrace+0x4ab/0x4e0 [ 573.939298][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 573.939317][ T31] ? _printk+0xd5/0x120 [ 573.939346][ T31] ? __wake_up_klogd+0xcc/0x110 [ 573.939377][ T31] ? __pfx__printk+0x10/0x10 [ 573.939409][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 573.939433][ T31] nmi_trigger_cpumask_backtrace+0x198/0x320 [ 573.939458][ T31] watchdog+0x1058/0x10a0 [ 573.939482][ T31] ? watchdog+0x1ea/0x10a0 [ 573.939509][ T31] ? __pfx_watchdog+0x10/0x10 [ 573.939531][ T31] kthread+0x7b7/0x940 [ 573.939562][ T31] ? __pfx_watchdog+0x10/0x10 [ 573.939584][ T31] ? __pfx_kthread+0x10/0x10 [ 573.939611][ T31] ? __pfx_kthread+0x10/0x10 [ 573.939639][ T31] ? __pfx_kthread+0x10/0x10 [ 573.939667][ T31] ? __pfx_kthread+0x10/0x10 [ 573.939695][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 573.939717][ T31] ? lockdep_hardirqs_on+0x9d/0x150 [ 573.939742][ T31] ? __pfx_kthread+0x10/0x10 [ 573.939771][ T31] ret_from_fork+0x4b/0x80 [ 573.939805][ T31] ? __pfx_kthread+0x10/0x10 [ 573.939832][ T31] ret_from_fork_asm+0x1a/0x30 [ 573.939873][ T31] [ 573.939881][ T31] Sending NMI from CPU 0 to CPUs 1: [ 574.125903][ C1] NMI backtrace for cpu 1 [ 574.125920][ C1] CPU: 1 UID: 0 PID: 3001 Comm: kworker/u8:7 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 574.125943][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 574.125956][ C1] Workqueue: bat_events batadv_nc_worker [ 574.125980][ C1] RIP: 0010:lock_acquire+0x152/0x2f0 [ 574.126001][ C1] Code: ff ff ff 65 0f c1 05 9d 0d ca 11 83 f8 01 0f 85 f9 00 00 00 48 c7 44 24 10 00 00 00 00 9c 8f 44 24 10 f7 44 24 10 00 02 00 00 <0f> 85 fd 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 65 48 8b 45 00 48 [ 574.126016][ C1] RSP: 0018:ffffc9000b3bfa38 EFLAGS: 00000046 [ 574.126031][ C1] RAX: 0000000000000001 RBX: ffffffff8ed3dfa0 RCX: 129bdb61c5744100 [ 574.126044][ C1] RDX: 0000000000000000 RSI: ffffffff8e4fde5e RDI: ffffffff8ca1b4a0 [ 574.126057][ C1] RBP: ffffffff9368c020 R08: 0000000000000000 R09: 0000000000000000 [ 574.126068][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 574.126079][ C1] R13: 0000000000000002 R14: 0000000000000246 R15: 0000000000000000 [ 574.126090][ C1] FS: 0000000000000000(0000) GS:ffff888125094000(0000) knlGS:0000000000000000 [ 574.126104][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 574.126117][ C1] CR2: 0000000030d06ffc CR3: 000000006d170000 CR4: 00000000003526f0 [ 574.126134][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 574.126145][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 574.126156][ C1] Call Trace: [ 574.126164][ C1] [ 574.126174][ C1] ? batadv_nc_worker+0xcb/0x610 [ 574.126197][ C1] batadv_nc_worker+0xec/0x610 [ 574.126214][ C1] ? batadv_nc_worker+0xcb/0x610 [ 574.126231][ C1] ? batadv_nc_worker+0xcb/0x610 [ 574.126251][ C1] ? process_scheduled_works+0x9cb/0x18e0 [ 574.126271][ C1] process_scheduled_works+0xac3/0x18e0 [ 574.126305][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 574.126330][ C1] ? assign_work+0x367/0x3d0 [ 574.126351][ C1] worker_thread+0x870/0xd50 [ 574.126380][ C1] ? __kthread_parkme+0x1a8/0x200 [ 574.126403][ C1] ? __pfx_worker_thread+0x10/0x10 [ 574.126424][ C1] kthread+0x7b7/0x940 [ 574.126448][ C1] ? __pfx_worker_thread+0x10/0x10 [ 574.126469][ C1] ? __pfx_kthread+0x10/0x10 [ 574.126490][ C1] ? __pfx_kthread+0x10/0x10 [ 574.126513][ C1] ? __pfx_kthread+0x10/0x10 [ 574.126536][ C1] ? __pfx_kthread+0x10/0x10 [ 574.126559][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 574.126576][ C1] ? lockdep_hardirqs_on+0x9d/0x150 [ 574.126603][ C1] ? __pfx_kthread+0x10/0x10 [ 574.126627][ C1] ret_from_fork+0x4b/0x80 [ 574.126645][ C1] ? __pfx_kthread+0x10/0x10 [ 574.126668][ C1] ret_from_fork_asm+0x1a/0x30 [ 574.126692][ C1] [ 574.134414][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 574.134437][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 574.134464][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 574.134478][ T31] Call Trace: [ 574.134488][ T31] [ 574.134498][ T31] dump_stack_lvl+0x241/0x360 [ 574.134538][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 574.134587][ T31] ? __pfx__printk+0x10/0x10 [ 574.134624][ T31] ? vscnprintf+0x5d/0x90 [ 574.134650][ T31] panic+0x349/0x880 [ 574.134679][ T31] ? __pfx_preempt_schedule+0x10/0x10 [ 574.134705][ T31] ? nmi_trigger_cpumask_backtrace+0x244/0x320 [ 574.134730][ T31] ? __pfx_panic+0x10/0x10 [ 574.134765][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 574.134792][ T31] ? nmi_trigger_cpumask_backtrace+0x244/0x320 [ 574.134815][ T31] ? nmi_trigger_cpumask_backtrace+0x2d4/0x320 [ 574.134850][ T31] ? nmi_trigger_cpumask_backtrace+0x2d9/0x320 [ 574.134877][ T31] watchdog+0x1097/0x10a0 [ 574.134904][ T31] ? watchdog+0x1ea/0x10a0 [ 574.134934][ T31] ? __pfx_watchdog+0x10/0x10 [ 574.134957][ T31] kthread+0x7b7/0x940 [ 574.134991][ T31] ? __pfx_watchdog+0x10/0x10 [ 574.135015][ T31] ? __pfx_kthread+0x10/0x10 [ 574.135044][ T31] ? __pfx_kthread+0x10/0x10 [ 574.135076][ T31] ? __pfx_kthread+0x10/0x10 [ 574.135107][ T31] ? __pfx_kthread+0x10/0x10 [ 574.532439][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 574.537648][ T31] ? lockdep_hardirqs_on+0x9d/0x150 [ 574.542855][ T31] ? __pfx_kthread+0x10/0x10 [ 574.547461][ T31] ret_from_fork+0x4b/0x80 [ 574.551887][ T31] ? __pfx_kthread+0x10/0x10 [ 574.556499][ T31] ret_from_fork_asm+0x1a/0x30 [ 574.561300][ T31] [ 574.564725][ T31] Kernel Offset: disabled [ 574.569070][ T31] Rebooting in 86400 seconds..