last executing test programs: 10m7.776124247s ago: executing program 2 (id=180): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80b00, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000100)=0x9) 10m7.597998486s ago: executing program 2 (id=182): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000004400)=@newtfilter={0x8b0, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x87c, 0x2, [@TCA_MATCHALL_ACT={0x878, 0x2, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x1ff, 0x3, 0x10000, 0x81, 0x7f, 0xfffffffb, 0x4, 0x2, 0xffffffc0, 0x5, 0x2234, 0x7f, 0x81b, 0x800, 0x8, 0x0, 0x3, 0x7ed53619, 0x1, 0x7, 0x9644, 0x4, 0x58b, 0x85a, 0x3ff, 0x46, 0x2, 0x1, 0x0, 0x80000000, 0x10001, 0x790, 0x9, 0xab2, 0xfffffff9, 0x1a77, 0x9, 0x3, 0x400, 0x63c, 0x4, 0xffffffff, 0x1, 0x5, 0x1, 0x5b1f, 0x7b0, 0x7, 0x100, 0x6, 0xd, 0xff, 0x3, 0x10000, 0x6, 0x6b7, 0x1ff, 0x80, 0x4, 0x7, 0x3, 0xa14, 0x3, 0x2, 0x80000000, 0x81, 0x7, 0x8, 0x5, 0x10001, 0xf7, 0x3, 0xfffffff9, 0x9, 0x4, 0x8, 0xfff, 0x3, 0x1, 0x6, 0x7, 0x0, 0x100, 0xc0000000, 0x6, 0x20, 0x6, 0x8, 0x80000001, 0x8, 0x1d24, 0x2, 0x9, 0x0, 0x7f, 0x7, 0x63c, 0xff, 0x24, 0x3, 0x7, 0x6, 0x7a, 0x8, 0x0, 0x7, 0x470, 0x7f, 0x6, 0x0, 0x1, 0x0, 0x4, 0x9, 0x61, 0x200, 0x6, 0x2, 0x2, 0x800, 0x10001, 0x8, 0x7, 0xf, 0xda56, 0x80000000, 0x80, 0x2f0cb955, 0x7, 0xfed, 0xf, 0x6ae, 0x2, 0x1, 0x9, 0x8001, 0x0, 0xec000, 0x0, 0x1, 0x2, 0xfffffffb, 0x7, 0x8, 0x4, 0x1, 0xffffcf1b, 0x282, 0x5517bc7b, 0x3, 0x4, 0xb6d, 0x5, 0x0, 0xac, 0x9, 0x6, 0x10, 0x9, 0x8, 0x80000001, 0x0, 0x74, 0x2, 0x7fffffff, 0xfffffff9, 0xa, 0x6, 0xffffffff, 0x8, 0x2, 0x7, 0x7f, 0x5, 0x3, 0xa, 0x1, 0x0, 0x9, 0x300, 0x5, 0x3, 0x0, 0xffffffff, 0xffb, 0xff, 0x5, 0x8, 0x3, 0x2, 0x5, 0xfca, 0x399d, 0x6, 0x8ab6, 0x18000, 0x2, 0xfffffff9, 0x2, 0x2, 0x528c, 0x5, 0x200, 0xac, 0xf, 0xd05, 0x9a2ce73, 0x4, 0x6, 0xe074, 0x6b10, 0x5, 0x1, 0x6, 0xb, 0xa26, 0xaf6, 0x0, 0xec, 0x8, 0xde16, 0xc418, 0xffffffff, 0xffffffff, 0x9, 0x400, 0x1, 0x5, 0x354d, 0x5, 0x2, 0x1, 0x7, 0x1, 0x177, 0x7, 0x3, 0x80, 0x5, 0x8, 0xfffffffb, 0x9, 0xe7b, 0x0, 0x7, 0x42bf, 0x10000, 0x9, 0x9, 0x6, 0x4b75, 0x80000001, 0x1000, 0x5915, 0x10001, 0x1]}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1000, 0x8, 0xec2, 0x6, 0x8, 0x400, 0x5, 0x1, 0x7, 0x470, 0x487, 0x100, 0xa99, 0xffffff01, 0x5, 0x37f, 0x8, 0x6, 0x3, 0x3, 0x800, 0xd2f5, 0x40, 0x4, 0x4, 0x5, 0x7, 0xe, 0x2, 0x8, 0x101, 0xffffffff, 0x2, 0x10000, 0xa6, 0x3, 0x10000, 0x5, 0x4, 0x0, 0x3, 0x0, 0xd, 0x8000, 0x98, 0x8, 0x6, 0x9, 0x1000, 0xb3000, 0xf, 0x3, 0x9, 0xb4, 0x94d, 0x9, 0x8, 0x6, 0x100, 0xec0, 0xffff, 0x4, 0x2, 0x3ff, 0x3e, 0xb828, 0x0, 0x0, 0x365, 0x8, 0x8, 0xf, 0x1, 0xfffffffe, 0xfffffff6, 0x93, 0x7ff, 0x92, 0x0, 0x7, 0xfffffffc, 0x7ff, 0x9, 0x2, 0x800, 0x2, 0x8, 0x4, 0x3, 0x9, 0xc, 0x0, 0x3, 0x3, 0x400, 0x100000, 0x7f, 0x2, 0x8, 0x4, 0x7, 0x4, 0x6, 0xfffffffa, 0x101, 0xadd9, 0x1, 0x0, 0x7, 0x7fffffff, 0x2, 0x4, 0x0, 0x5, 0x4, 0x3, 0x8, 0x9, 0x6, 0x6, 0xe, 0xb, 0x3, 0x7f, 0xffff, 0x401, 0x1685, 0xa252, 0x2, 0x200, 0x3, 0x1, 0x400, 0xfffffffc, 0xfffffffc, 0x1000, 0x7ff, 0x1, 0x1f6, 0x751, 0x7, 0x40000000, 0x4, 0x1ff8000, 0x50, 0xf, 0xf, 0xe, 0x3, 0x0, 0x81, 0xfff80000, 0x7a7, 0x1, 0x6, 0x3, 0x8, 0x7, 0x5, 0x2, 0x0, 0x4e9, 0x80, 0x3, 0x8, 0x5, 0x0, 0x5, 0x7fff, 0x7, 0x8, 0x6a4941c5, 0x2ea567b4, 0x8, 0x80000000, 0x6, 0x40, 0x2, 0xfff, 0x8, 0x3, 0x1, 0x1, 0x0, 0x0, 0xd3bed341, 0x691f, 0x0, 0x2, 0x9, 0x6, 0x0, 0x1ff, 0x3, 0x3, 0x6, 0x5fc8462f, 0x0, 0x7, 0xffff, 0xfffffffc, 0x5, 0x0, 0xb9a6, 0x522, 0x2, 0x2, 0x900, 0x8, 0xbb99, 0xb8000000, 0x8, 0x3, 0xc0a1, 0x5, 0x8, 0x7, 0x59, 0x9, 0x2, 0xa3, 0x5f502dc7, 0x7, 0x0, 0x4, 0x6, 0x80000001, 0x3, 0xffffff97, 0x2, 0xfff, 0x1, 0x40, 0x8, 0x3, 0x70c, 0x8, 0x1, 0xfffff339, 0x3, 0x8001, 0x1, 0x8001, 0x9, 0x8, 0xfffffffa, 0x8, 0x9, 0x3, 0xe, 0x10000, 0x9, 0x9, 0x7, 0xfffffff8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xfffffe00, 0x2, 0x5, 0x1, 0xdbec, {0x8, 0x0, 0xb55, 0x5, 0x7, 0x5}, {0x6, 0x0, 0xd, 0x5, 0x1, 0x5d17}, 0x2, 0x0, 0x6}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8b0}, 0x1, 0x0, 0x0, 0x10}, 0x0) 10m7.468854611s ago: executing program 2 (id=183): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) close_range(r0, 0xffffffffffffffff, 0x2) socket$inet_sctp(0x2, 0x5, 0x84) (async) r2 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) write$binfmt_register(r2, &(0x7f0000000040)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x8, 0x3a, '-:', 0x3a, ':', 0x3a, './file0'}, 0x2a) (async) syz_open_dev$media(&(0x7f0000000a80), 0xffff, 0xa0200) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x10000, @value=r1}, 0x28) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x2fc141, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x1fd, 0x1, 0x0, 0x2000, &(0x7f0000bd3000/0x2000)=nil}) (async) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_GET_VCPU_EVENTS(r6, 0x4048aecb, &(0x7f0000000380)) (async) syz_emit_ethernet(0x52, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004c000078ac1414000a0101004414050300000000000000000a010101000000008903ce0702000000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x72080, 0x0) (async) r7 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000280)="d3117d07bb30", 0x6, 0xfffffffffffffff9) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='H'], 0x48}, 0x1, 0x0, 0x0, 0x4000011}, 0x20048000) r8 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440)={'syz', 0x2}, &(0x7f00000000c0), 0x0, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000140)={r7, r8, r7}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) (async) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) (async) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) (async) dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r10, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) (async) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x8, 0x0, 0x5, 0x0, &(0x7f00000001c0)="b7c58d76b8ac7b9d3b4db3addbe21d0011d5", 0x101, 0x0, 0x0, {0x2}}) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) (async) r11 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r11, 0x5393, &(0x7f0000000000)) 10m7.255983801s ago: executing program 2 (id=186): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x9, 0x51ba0380, 0x7}, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r6, 0x54a2) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x0, 'queue1\x00', 0x200000}) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f0000000300)={{0x0, 0x2, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r7, 0x54a2) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r8, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3}, 0x76e0}) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) write$sndseq(r9, &(0x7f0000000000)=[{0x1e, 0x0, 0x8, 0xfd, @tick=0xe029, {}, {0x0, 0x6b}, @raw32={[0x10000, 0x5, 0x80]}}], 0x1c) write$dsp(0xffffffffffffffff, &(0x7f0000000200)='m', 0x1) ioctl$SNDCTL_DSP_SYNC(0xffffffffffffffff, 0x5001, 0x0) lsetxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x2) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x280000, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$HIDIOCGUSAGES(0xffffffffffffffff, 0xd01c4813, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="c0260000410007010000000007000000017c00000400fc80a72601"], 0x26c0}}, 0x4010) 10m5.852948939s ago: executing program 2 (id=193): r0 = socket$inet6(0xa, 0x3, 0x8) sendmmsg$inet6(r0, &(0x7f0000004580)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00\x00\x00(\x00\x00)\x00\x00\x002'], 0x28}}], 0x1, 0x0) 10m5.742965784s ago: executing program 2 (id=195): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r1, 0x0, 0x0) (async) syz_usb_connect$uac1(0x5, 0x0, 0x0, &(0x7f0000000140)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x200, 0xc3, 0x4, 0x4, 0x10, 0xe}, 0x0, 0x0}) (async, rerun: 32) r2 = syz_io_uring_setup(0x9e, 0x0, 0x0, 0x0) (async, rerun: 32) r3 = syz_io_uring_setup(0x499, &(0x7f0000000400)={0x0, 0x707b, 0x0, 0xc, 0x288}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x20, 0x0, @fd=r1, 0x2000000001000, 0x0, 0x6, 0x4}) (async) io_uring_enter(r3, 0x3516, 0x0, 0x4, 0x0, 0x0) (async) r6 = creat(0x0, 0x2a) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000001200)=ANY=[], 0x0) (async) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) r8 = socket$netlink(0x10, 0x3, 0x0) (async) r9 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r9, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async, rerun: 64) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (rerun: 64) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r10, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async) r11 = io_uring_setup(0x4126, &(0x7f0000000680)={0x0, 0xa74f, 0x2, 0x0, 0x243}) io_uring_register$IORING_REGISTER_RING_FDS(r11, 0x13, &(0x7f0000001bc0), 0x2) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000078000000030a01030000000000000000050000000900010073797a300000000008000540000000001c0008800c00024000000000000000000c0001"], 0xd4}, 0x1, 0x0, 0x0, 0xfaf857106adac438}, 0x4000010) (async) r12 = socket$nl_route(0x10, 0x3, 0x0) (async) r13 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r13) (async) getsockname$packet(r13, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r14], 0x3c}}, 0x0) (async, rerun: 64) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180)={0x0, r7}, 0x8) (async, rerun: 64) copy_file_range(r6, &(0x7f00000001c0)=0x8000, r11, &(0x7f0000000240)=0x81, 0x6, 0x0) write$char_usb(r7, 0x0, 0x0) (async) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) (async) syz_usb_disconnect(r0) 9m50.341365624s ago: executing program 32 (id=195): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r1, 0x0, 0x0) (async) syz_usb_connect$uac1(0x5, 0x0, 0x0, &(0x7f0000000140)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x200, 0xc3, 0x4, 0x4, 0x10, 0xe}, 0x0, 0x0}) (async, rerun: 32) r2 = syz_io_uring_setup(0x9e, 0x0, 0x0, 0x0) (async, rerun: 32) r3 = syz_io_uring_setup(0x499, &(0x7f0000000400)={0x0, 0x707b, 0x0, 0xc, 0x288}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x20, 0x0, @fd=r1, 0x2000000001000, 0x0, 0x6, 0x4}) (async) io_uring_enter(r3, 0x3516, 0x0, 0x4, 0x0, 0x0) (async) r6 = creat(0x0, 0x2a) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000001200)=ANY=[], 0x0) (async) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) r8 = socket$netlink(0x10, 0x3, 0x0) (async) r9 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r9, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async, rerun: 64) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (rerun: 64) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r10, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async) r11 = io_uring_setup(0x4126, &(0x7f0000000680)={0x0, 0xa74f, 0x2, 0x0, 0x243}) io_uring_register$IORING_REGISTER_RING_FDS(r11, 0x13, &(0x7f0000001bc0), 0x2) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000078000000030a01030000000000000000050000000900010073797a300000000008000540000000001c0008800c00024000000000000000000c0001"], 0xd4}, 0x1, 0x0, 0x0, 0xfaf857106adac438}, 0x4000010) (async) r12 = socket$nl_route(0x10, 0x3, 0x0) (async) r13 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r13) (async) getsockname$packet(r13, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r14], 0x3c}}, 0x0) (async, rerun: 64) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180)={0x0, r7}, 0x8) (async, rerun: 64) copy_file_range(r6, &(0x7f00000001c0)=0x8000, r11, &(0x7f0000000240)=0x81, 0x6, 0x0) write$char_usb(r7, 0x0, 0x0) (async) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) (async) syz_usb_disconnect(r0) 13.810982802s ago: executing program 0 (id=3500): fanotify_init(0x200, 0x0) pipe(&(0x7f0000001180)) syz_open_procfs(0x0, &(0x7f0000002180)='net/icmp\x00') openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc8001, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) open(&(0x7f0000000180)='./bus\x00', 0x4a37e, 0x4) open(&(0x7f0000000040)='./bus\x00', 0x42b42, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}, 0x1, 0x0, 0xef}, 0x0) 13.747886624s ago: executing program 0 (id=3501): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x8, 0x0, 0x3}, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, &(0x7f0000000000)={0x0, &(0x7f0000000140)}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002d40)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff48700070020000005c0000000000000095000000000000002ba728041598d6fbd307ce99e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f071326bd9174842fa9ea4318123341cf9d90a0e168c1884d005d94f204e345c652fbc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc84e974a22a550d6f97181980400003e05df3ceb9f1feae5737ecaa81d666963c474c2a19eed87b277be335c75e04ad6ee1cbf9b0a4def23d410f6296b32ae343881dcc7b1b85f3c3d44aeaced3641110bec4e90a634196508000000000000f0f4ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d4dcecb0c005d2a1bcf9436e101040000f73902ebcf0200822775985b231f000000ccb0ecf31b715f5888b2a858ab3f11afc9bd08c676d2b89432fb465b3dad9d2aa7f1521bc9901de2eb879a15943b6dc8ea15aab9dd6968698e3095c4c5c7a156cec33a7bb727667d81ff2757ca1e6bfdd4c968dacf81e65998b9091957d1d11a5730baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba165d876defd3541772f26e27c44cfd7bb5097379cf1756869cebc7b0b2d85d6d29983e830a9cdd1d0a017c100344c52a6f387a1340a1c8889464f90c284a4db539621fbb70f01a2c02dec4cd1f570dd39877dfb2ff1ae66e1ce917474b2e650ae610afd01409d9a337ac5d58bcb5e5fc231514952c5255f22bd8b325d9b76e57f041b665ab0249886c0a65cc99d5893521372c8d8b7bacac24000020a4a24d8dbd75062e1daef9dead619cc6e7baa72706287793c3d2a2661edcd3545236c204682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b993508000000e480cd9d4850a049ee19b67d17ef0477aeb12b1d2502000000d9051f22614d1f62734d678039a97d2b74f9e8e97f4e8e7025123e783df8b8a17e3aa9fe9c502f9acee4f1b56e1f23128d743792cead3c058a5b700d64d160abe33df726608510136ce8bf239414a1d98ea93e3d35dbb6c23b90cf36e83b8a4309b402d264b09f2779a0bcd7cd6dfc06b02e69d384146056d125cf4aadd80800000000000000e88d10acd06864eac44c42fbe334bdc3e9768fc360b130dc6111fe3293e8e02f819a2aa34dba1c25be27945507a3477b437525b81aef2f0b4c4f63483026b5e34d44705b76ef29f7f6e0a2be625eae975e02069f6f24e1e1bc976d965ddabb01085f16bff63a06578d6d184f5de7bfb6aaa75f16996d8d60bd0111a8a237a1536256c02284cb1d3a6fb8eae87691fae365a70c3f15871565bba8dd8a8ca049f798bbe646f738bebdfc9d8a5edd7a19ca6a42bc3f1db37c17f22a287c6d31a13db5dfef409eb1d3c91c6e6f80d215c9e16e0c4736c81936315418f26770cca4e2f89800d18c89d7f46f679df6c9e2005f209dda94302a30003b952ae1ebfd0ca88368ee6ce139e8b5822422cf4c9dde943d34c432e1001171792c65986146666a549092398af45ba38c41df7e0fffeac41824ca1fd0eb68aa243c9035c788d5480e5aee9cde5f2e5a3628995b1531bd20360d33d8f9ffffff5f4bf6ea8a1850c4f83306dbca02ee3686da707b6d85db491ba0cc33f6be92c55969a2b52a25419d1476c73132ca7ca26ce8a7e3ffb700f09e157f9bc31f09834b4788be2a442aa81b259e9eb1bf5314844051f3a642aca9ff98c9036471ccff0522903e7bcf62e18f7796bbc280b95e8e0d6fd5644b0ebde330289d6348d183ed9d3dae3cccf109f7c78e8479a345e805e47dfa82cafc6b64b1f4659834aecbeded44b11a443c5ba92a326dd10921aa79c62800844c7a59f55ee205a11ab50fb402e7da6ada561ec1117cc186b01fd5c2061d22156b1b7d5f80c580dc31b0963ff953ce09148e8dfea9d03a61bbd2bb173518507a3cd0e37c4da0a71eee31071d5d642498181c69cee3b2e414ddd6a12ff4bdf6e96c247b6025d4376067e25357d3b521a5b927d3392a7503718aea24179528f6a0c6de4e61b49cad1e4d6b000000000000005b2d16877299acefc0655bc1422c3d425d988eedebcf242b780a687c9acae2a5a71c2a16a32ceb377f5d54f9b2fa90b2905925e611be56e9ebe20cab20c290a1f6c09272dbc3b2c0ab2b5baa1b07b16e81f278e54a479f1a06bc06e3656cfa196d6c050000000000000000814955c62a7d72b317399e572a7f6a4d57b741eb66c9179ffd097d61fcfd0fa1d46cfb110e3e8cff5579e83f2820f95eaa0c609f666950c24311740e36de8f65708cfffce788c99ef8f62fd2398e999b220125da8eb07947512365abbc5b84ef524bdf184727c67910051f204662264607d548dbdffe14b41dd0843cf3d85bb820656a88a9e52a4cd7b3eeadfe00007267f226019ef0a25bc15da71e893856a2182c3167d8ba73f709294b159a426ce44cd73f000000a66fc501eae0c3504c1400697ba69fd9b7eaf49aff6a6aea529610db8dfef86c3cc698e9fddf1b132876159972281a90c3a4cf415df25fbcdd35cf8368f068c4481844bdd0dda553e1cb0966d5686013d382956d50055dce0d1bc225c1d77612b1ec52e743dbc51f25cc07a202b704577316913cf067fa65e476f688de2d6c54ea192a569eed05d0d7536b3205c68d4ee0fe318ed3112c76dcf128a1d5595b773ef4c8a7ba4e10381de8808ff02dd0a7b996ecf1c65e6d9db90c87123d9cb3945330f7a270ee0cca35b1331ca8fec0b2f39f505140751b60f29a83e4bc0ef2ffea443e4aa221cc38a503add16a2c98cb589e1dac1912b4142a3be30f50b2d9479c5bde0beb38030d0c0ce0598700130000000000000000000000554361e1628ee0017ad19ca787f2c078aa260701ce0800000080623902000000000000000000003d118a04fa6a80c4928c01ccab57b5f4eb265ad15004f967543fe6e6ddc2a12165fe3a08bf9475ee0eee3539369b0e566fedbd215a6ddd4fe03dcc7a922e16410d820747b7e806c0f3b6f14c884d150a0ff07f2e0000bfb083c56d3bed0a61fab880f8885c612ebff8523d14cfb12aca274c000000005e5155611969f6e67dd83b20206207cb8b2cd2fab6fa6d7fdaed6a27a2e4db1d5adc80014ff11d9dbceba41d8dfce410333a054e82b1d050331ce0aeacb843b94d67f69f49eb4dd3b1b85b018359c32df01db8ebce0dbc36cade09c6b44f6bb956fac1ae4db5624d8a02f7be91bec65e4b3373059587dd6528bbc48e3379d477d482faff738c39c61cac1195043bd5b70cea5fc1083a169a8263e9aec56b9f7795fa27634a7f06359e3058d2dd69c4e5cc11b36d9ed9c4b2867f583de6fc582f789722bd1500e64c495abdb72de2c739d38c72f6f4fb1946081dcc825d5b5b747e9fa1b5226cd31e131263f1fcd7d45a630b46d04af906f0be464d829dd2dfcf7400002b7827f6d957e51bb1f1b44a50200c9dfadfaff2e32baa9c0edaac7144e174dba582a951d2b03c27219cec4fbc7b6e99c3f00188941e3fbf008cbace177ae250fd757a22e21ec05aa45c91e1345ca936184c3fc28153283e13654123cfaf4e661f4b6d430adad1e2116bc385f888405d48f0d386da0cc6747b33395772a68f2ea3fb7e7207000000b24088014c8e64f03d053c4e02ddd08b262e422eff1c9f124b892b0a9462b07d4f88c0693bd9c54ad2ab5227aa59ef2b53ac528c0800000000000000ebfde0c4a37c2d55c176680c4207000000e4aa467f995c9bc99e60441d4dbebead3b436427762618810bac7308c6d3298ea932b66572825e62d18462d3b2342ba48c145ff4674a94fa078cc552d064da2bb69a0d269076f8955076578f44ffb8895f11bd5e06840f8848df72230a28e0304569bfa0350b6dde9e96273de1758505aa1ba89dfb12be7a7c6dd18f6148354df7e60a489dc543ccdee1fff9d8f8d78844de27a77ef1181d5055c2a193a5763ed7749a17296c76818b60426082c86619dacc8a884c4de8572a044faf0c8e4377776c8703ecf2e3f1c3d64100cc000000008369f062639e3ddcf725be54f626448fb7bfc74c183b26e31b71a390ccea4be07278dd12fa16848797397b76908fa03613cd961b98b26a0879ccba4a78c82958764bce07a7f70df1cef6d4db1ddbda1db18e4f41c390fd3cb862216ece39a9ec60bd3be5f9329dcaf33bf2c87cc510557460d14421e1d26322ab64388f2ceae70922989f66827fe9acd2ec3ece39f3b4ffdc4dfea3da6ddb002512e2313253801044e751168e32d7bd6800000000a21008b8d26dabe977c503c30ef7c489e5ea1fff041e54de54cfeb258f2387dad096b72a78d91134927492cfc773c731cca9b13b3f6e7760ab0929c46f51ea5643f3df4f4044f3ad0a6ba739e72d8b8b2935d81534bea8372bc590c111d573e04280659a096eaa495a4154daae7d1800c130d920964845c50c8ba4763b19b6008f6d7a5091895c7a4b7816ab706503be879b18b778b0f61ecfde2f8bbb32cfeb766ec4430ee0ad45a0a263ddc4b2f47680c8d53439f8d388dab87112c83997c83e178be287eb6e8c95badaf8ed85cd5b03a7352a0fb83398566d1bc133582ce2d9f601cd23eba4432180b2d5c3019879cd949a5be1b241b3d0d0d52a3529cc9e704a9d8d54f4f7b776a969a4505e18fe5284985ca7d112c397d776e3baba918b7df456bd970e761e00f3b0efa5ce4246d9f08ba60da3be556c518a1f19504c7cea1491a9eadd27d747ca9cc5f92e30b2ca3cf0b142a8554c87e8026d4e586cf5f7c9d412e6eb4f66a076c8bca6b294305969dabb6c932b57a5dd4234bf1ed3bd095229ee3cbb86883d574c5af4bb78370561de3fbf55bfcd2db3979eb1be120b5795443324023353c959fd965702f1cd5bcb3c16d4b8bdd9fc87c862c247e140379ef098c7b3fa79a6638a245b6a74f14dde9bd4ee48e62cdc70f486ce38641e4e4309aa9f4bd097fa1530db966d9919544ab4890301e51f9525436f5d9591460340f5093161a78a249783945407f2576d6f35a99e3521d7991e3fdfde5ee7f6a8ff8181a68ef15a2ebfe9e22d7c745949ab5cc15b9f5659799b5e00debbf9f623f75bfd4d83c4859ca9b652cea33daeeef07b60c78a21965bcf91919071c7ded19317dc0b7587d9322f8cec9e32675a187465bdfa101bcd9ac680839b375af12c160247dd960e70eb7ee60c52a900440aa9bd9a6b15a4a34dc73c3c4936d8986300fdc264b28537df387e6442c3355fa2a31d24c1ed888a57fcc50400a084a38a3630ffc465f36a4b770fab0946148161184be39134542e934f3a538b011cb3928b430630b8ccc800000000881d4361e7fbd1fc2331b4e34733480bc497662a8234a7eeab3e65d6b0f5d92edff04416eedcd15b9ddbcb3cf9228afda6b17d44a276b205eabd0069f7e26aea50f537dc77b683ed83d2f9110e00a705f48e9d13378cf09bca22e8f45c4f360d5fff8ba35f21c4513bcc0800000000000000dc5cc7ad7290c60bc609bff9be7cd922f474c3faa78fd42cba7c78d6d912656b6313497625e2f9afaba05b17ca242b7ca8d6556175aee38142a8aac5f677c2f8a6967f2cb5e97aae97a5e5579a706243688ac4d38a4601b4aadb2d319fe7d6bf1272fa3fa701338d7bce390e8bf959081ed39e63a431901d615a26ff95e1620a6c26eda4f92d83499a173e7217001f58ed5406bdb59acbc997e8fd3d53b4c2c2a1b314bfe611e5958458af7b3c5319fdb4c40b8d01365fdee93af6fad7c7a8da86460f45c9e99d43264c921b090000000000000000000000000000000000007cf90000008f8a9da7a8a167815c6ffcd1b6863cde9ab45ecd8f06423198bb00cdf76877f407be46b000000000afbb4cb3a8de259a8beb2223f28b855e2bdf4b31b91e5062a42a55bd95e93f77f2499391cf0000000000000000000000000000195007ad27d1d61dc4d5512f117f0ed554c2c88c1713000000000000bb1ff447d6e12da22ee9f0422a84f361684861169f498909c4841f4d5a0f5807a3b7d833075fdcd9c1d169b03d7df7f4150fad8b9e92eaf86992adbda360dd91de51c6df335445492608162fb0804dabdeac6fb71042f906eefd37f1d190a1c8a0d9de7f34dcc8cbd7b565fc675f3bf7aac559411808ee703ec3ad461c6ddc571994cb504c46eabbc2ff4b97df394bc75b5e7f45b4450753b5d2b8b8414a7fe6a17661bdb5b1d080cfd974811e1d60763d8d9509c75aa729a334b55ee76b0c2d5027e81ceec1a6d7441d0b538d7a4d048d156ebcff102e45c15d2a73b40d74807f5182a319d50edbf430f00b1c29a9e4bd92111caacbb1d4541545c2d262646070da42f76e3f3c6d139eed89cc9300000000000000000000000000000000000072d7e605eb8e978d76796d9d3a728c51a3145da8e1ca4973aa8fed855328e9d2509335c5386cac74e862eac50e9ba95b6a2a29e8ef08a9ae29792e77fb9952b1ac5c816db5c23a656d9a28f81f6a9465aec94d701ee8646b30650c84b9510a337e82702baf368d29281d3d54b39014756ca5a1be184d4ebb942f99581a6fbac0b9c9f97c920dfac7e2379ef6bb076118aa9bbb4ee12e64aa530f852bf4f970a08a55531934e39fbae483129949a918115571d76740ca6a1cea59df290f2e63675ca30a289775825fe3e5d6f206f3f395346c0738035dc74368bb035fc65a40f8124369b8950ded31af64855cb18b23517ca935a0fa1b630d70c4ca9acbaf0f08910f327fba506d834029a90d47701102045fff90675adb3c83983d125ae730b9497c681a912a6bb70300a2d7fba051f82b9d6f710426b5bd0d0bc0b08a0f801276789613da406905011bd6ebbac91ff17a21d1ed0882e73394025772f31dc8a3048789c703f920c55746f6fc955046f9332d72150be23c26cbb08d1b438e84b83fefc6a16958fd46dc7b8cbea1da2d541324e373e9157696d698a0b4bc84d7cc2fdb069db8a5a491a9d2bbc0a61b73f75d81d07d778a1577db3b06d20a21b19ea17ecd996d7dea947ee8ce55fa2dea5a000000000000000000000000006f0143d8d4038ef9f57d9e9336f3559558710d1febe7394cf8b02f59dab24d07db3d3c1ebff58f973ba3fc0c3e2fb2c2a674a188614520ecb1d22b49e3550263bf9d669fba198b65ee3512db0e710d2070b5847face7ada12c83f0aea3a8c9e84e6c7406732c952c5695d43bca33d481ef9d442697875e114f4c759af306b3fc8224fdec89bf199234bff488b81438cbe89e4cabdc007139352b5cb69d7987cdf37ab549b7639eeadafd5315d9c9f0e8c9223102e6deaca4ae9cb943a3ad188bcad95e8f97d7fee7c47ea50d222fe67085b4fb3fecfb67dec23b6ab5ee19a5ca5367bff058149acf90a6c4014dea2b763389f77301ea8574d112625300906f480c36f41f82f84991800c37863de349f7"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe89}, 0x48) rt_sigaction(0x11, &(0x7f00000000c0)={0x0, 0x1d0000003, 0x0, {[0x2]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYBLOB="2c726f6f746d6f64653d30303030303030103030303030303030303034303030302c757365725f69643d", @ANYBLOB=',group_id=']) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a45320, &(0x7f00000000c0)={{0x80}, 'port0\x00', 0x3eb, 0x21e2f, 0x3, 0x0, 0x0, 0xc, 0x400, 0x0, 0x9}) openat$sequencer2(0xffffff9c, 0x0, 0x4011, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r3 = dup(r2) write$UHID_INPUT(r3, &(0x7f0000001c00)={0x8, {"b0476b76ba5d044f65271519727e4ff1ff0d12c0e6bdf3ea1f52e24f60ca698457b32832b83d7e96694c1feb5809bd67002f71e0b97c0d5270c04ffa64f63b2e18ee4b7b572fe2f4d03cad38bcd106ff12f53b443ac6fc81da518f54b9004a44859529c07a2b1b8feddc0180a0f37b13babba1dd0813b7ea56dac4b7ffe9a2ef54221439ecc55223ef2d40f4ba8108c10387ddffbaed25d41e7692bf26ddfa747a666caff49843e38c86cac7323f784a17df6beaa49c3f4a98fb4013f4e573e2ef77b0965d4bfbdf7d5eada69406ca93f422495e00addfca1518085a40f10284ff59388ecf476a12ef1a540163922098d600519ae8cf3ef544344e9d968f341af618503b455f3976b76975270e94d714302382c63de5b7c1fad1fa373b369916cb3b4d583a9ebbaeb262884d25a0e1d9fb141de60df7e64cb38b6f7167991f8fba06bffe2d49133bbb462cd8a9493177eee5f03875b15c7a92c3cd6a3fdfc64f236e14fa05a0e8d3c45f13eecd22e13528c74186dc50e0e2af44177e26bded1161e5533375508dadb83db5126cc810f4e30d4e24ec12c3b99e5220aacf42c58f2960bd43c337dbd318aeeb5c9a6cd5ffd3bf1497bb48ab7bcb32c9c33c9f5b9bc4645b96f23f9e0d826b780030444ffb925f55df587ef5ca5ea74ccd66afc7981da496d6f037efbb0b08f3f5078c60ffb4db18d1b59996bd9b1513442785bf4ece8587b39d8176dc9c735d5ea25133b2053bba227b81faab7220326f8814a9df4eba4ecc6acdd82f70b653b56a18cc9dfa4deb0a112c797ab89a51a103c3a9085d828523370c4d79d9484f4dc910735a2c9b5b85197cd9c073df7a54b40df8e1bf595bab957900c2a1a7dc40e88ed0c55c362ffbb7f88a0725a6ae73b936a639e951faf9c45ae74a2ece2f6f88e425ee41d2c60cb083a2fd6d07381908a7f629e32f89a553cf0794f54b8bdc7bd541d88464a4f80ac0b8b625a803a55de4b05a95fc7f8fc3d6d79858ccb269b7b8b21657654164a9aa29f4e8462377e9d234a41ea69841a4aaa1e5f89f9b074f6f71cb1ffaa450c3160b0e319ec81ad30101db66218b0c69f97c234465dc45849fcfd62d396f2b50ddcc0ed7dd8651431534232ab6d1186d7760770a1fc6c77553a79d0297194f794997ee47781094a76d9dccf632dcbb527b3e68950d9bb534245c7f08ae1d6ef2750292ae28e5e6dcfe2a69737dd7a1e453f3902ae90789e98c212905422099904d3bfb949bde187682a59c01aa8e6a9972a63d6aaef4d4139b10a24e063707f1aba79bd59e3f9709a873dff401d1f356c4be5e449ae0e2633a1fe50ed367fe56b0499957c3b6cabb42256547995ea998f3937d153897d1c83f1ad922d6835bdfa3b986dc6f4bd927a4ca13fbaa99b7b43758e2329d588f40fac718b16cca855468643f3818496b4915fe9a2bdd3e68889fea24bc1dfa6287a801d49a7bb84654147448550d2919e4df3a943a88cf616befea4e7a4fddb7969311c6837f9529966241be1e57ed2d773debc542986d09866905a3f63b6e1820086d52a70f039154e839da7ea852c33bf3722a048f61bbf068519e050b8788370fb130a42e9f5322dfff65b15d588f9e926b70e4530e8b66697cabb1e8514831431fa0eaecb49f9613ed5fd7bc50f897bda36d24d4296e143e2480e325ec09a77c03a07b4f86eb703085313ebeee94ef5b1cde3f6a7efd785772eb4034039f598c07819b769416a223fab824c4ac50086e78042a1ccf47b6c7ede8540cded4bd4c920ce6c2b7493a5634c5e96bb761373623ab473b121d555bfd5a8bc3f5c5418bed83ffd0d6492840550fccc0c35746370396d0190b7b1d2cadcc150877e0d197f692f97cec790c95e3d3959dc7c68aca37306c1bc13ad33848395dba5e3c9ce8090bc0e7e8312091773641be56411921e3d473321c6d8bd10b7d3f5aedd6620bcaa06474bbb298bc77297b8b5dcb9e6b33dbe676460cca825609857724cee245306d07fda287d5fe57c424c27cf9b6cf0f16d2c6a8071bd57c826d7371841cf43dab1b42421ce416d0d3a9c80bc807d2e6761e53f06b3e63c0af1b4548d820118421205f040f4ab35307871e4c7a21ff28082c29e02e89486064661898c0eb1811c70a6124c1f25d62c38794a3e87c312c870db7b60d0df8b57860c94d1a9c561b327fae3a68ce9ff4551e418eb00766f0341c5e796e3cbbbe6b4864928b966110256d5475eb1fd7b2893b60e19e859baaf23c9233a1b064771671ee2d07c151e2e99c37a116a338788052a726a8519b8335e9ff4f71d00ab634543c20ddea1bf57d4f2b797182ff19618b6974d2b69d9f052934d527a1830bf2785842f35eaf32b65b7c9fdd6f0c41756072a59c0cce0b7305740729f1daa14e0092da9d022321b726d658fcef55affa2bbf36ad788f1f423b7dfd328435b4d5df315143d8b8028ba4bea6134a3dc9720c73d5e66b8b8168752eea6b78c75f04efd9677dbe419f13f5e1c9764276a83821b710307d8f85359b34d038ff17de45e8739d4b647fd1a8d794a3273d922af3374f5d3c75b8345b9dfdabb2c0418a358921e0e73d0fe88caab1741b913673e22ff4b59afa0f653a423d9b2bb20cbf07951a349eea18a891b4f4dc6df8e42a6181284f643de5fd2924ae54f672a1920343476c67333e1e8205bf4877b1251a83f417936714edb1c6975ba7969d2fcc2e69024a4669ac2f998116ade1bd8456a18f3f1fccbe95df9ed21db77315b7469f30bfae418415d9cb5aeea627ba6811e30d56d4f4bfe5f794ea4243e3cdfad3ef55199699b8433083b6f72f95effc5f2f613cfcefaf0b94e801ebcb7095a1474ee93142b82c9bf9886617b6bf69d08c83c76cd21d4cce5872d99de8e54bbff915ab923b2d24bb3aa178dd50b44fd0eb880ef33ca51d4bf5f0fbc8ffe18afe4245397f277e4efad955baa10cf56613481253d69c02e7661714b68be0fd64f29bdafbc8b4a0b30bd6709c67fe8e8915d0479b3902b1d0169fb5486b02e966ad5d8a2bcf42ecba59177cd85e17239667f6b045d1f873ce24733ae17e2d8432709062e786a32ac925121f1b0d46c66d4fb9088f4aa0cfe2149f6c2cb5b75d45349bc88fbd47e01ea07e7cd573335aab8d389846566800dd084bc3caa95f7632719c651f2d33be0fb56347c063b3c6e3e75c5e58caeb4c37574859b78c1ed018fbeed788a4305a9ee1c1ef65a0c83a7cd717a8c08ecd4e86370ffffd6d40a89a0b1e8c15a10ad5406e867e49319ad83bfbb925d5e240b4bd44fd751e7510d5ea03a6cab95f37155d1fd69aaea1db4a1f53714eb90e669209cf634f84a50c85bdc51838ebbb545b4387790df67f0122740c2abc910cf83230394172a56c9ffda6675bb8bb39846730a1bf764aeb92407c90a194da880cb8a4efb5b57a8311d864209c7fd226b93582b6b11eec559abfbba653c0569c219d3a2e60555cb739f9d32d564f23c4e98be78aa553610822af426f961df0df2185c61ccaa22b2a6aa6fb3e917bdfb2be9c3ffb8a50821321119c4cf4917db39548abc17bfba267fa50f6af15c560a21055f967f1ca6f656ddb556f9c7e17a771eeef7e80940d1c14ddf2c27647686fd0526460036aeea395fb10abef2be2ea96c9bb380370c08d1568d30eea0f3e6b7cf8f7edc7b36d4d0affd249330707b54ee620f208d885791171eb67a25a80fcc6922e0258c9673b6576564949dfa5bed9a0299bf952aade654de16e22d54fcd391ded6adab94ff621efcd91ef69acf8dfa1b22692ba3e49cd1d3fbed6db1402065ab37e457056877977ebac33ef566f28a19b9acb67a9cc53feb156814e880b3dd5a9119ffdbc5a45c20ea375f2882575b9a28740eebf63f2895d9ffac1ec33cbdcdede98a201424d000df1efd64dd7268cc1b2366ccfb09754822dafdb1821de5e6ebee09608e82e679fafb7a5100172f26998d31d7f27c2b310f0372c3b5e888f8e6efb56074177bf6a2a5bbd9ed070ad5aaf23ce144d1ac86cad110e5916a8a57e1e7fc3d37353f84f2f6d43d92ab8b35040467f3f8b1d23fac021bbac3710edc8e2e26d794db38e48020f63e94d4b4dca3e015537a8e3008274d55f81af931a0faf1a438444b6a0489b93f7b88f81f761eae0f82e60cb0cf2745ca8c9e30d3cc189c1405b1994ed71b00d90ea7a94102916cdc915620c363d04e51eabaaca6c2814a7c1e7aaeec80bdc13135b813e6d0eea83446a5c57ec29695c302c0d8da65b61fe8ada51a36e1aff34d449f9eb70cb94931226121ab121a971c2fc070ca84272d122c1696f52fbd5ed06783abe188dcf133c4d41e10295f6ffda69fa8c5a7c0fec3425a2d60523a60d280b5ce34eac5911268172e772fefba63a6f5c6dafa9e500a5e1355fb614613f8fc1ef5e5466fa19212bcdc349a865f4cee6ea80b11a410bb6e4ad677393973e38621d25ff6c4876ef8a8d2ba651be4a78d2ba9fafadcea8eff9cca3f4ab71a0b84917794e521220dad099ac8aaf32abd162348879e4299e4d46395f9d55267b635e18ca2e2fc96146b96c8a8055130b8d8cb10cc31382df34057bd8637f86e48adc854af408226752a04df8d0362db263e0959f2bd7e8a4d33a8c4b257e19d308280baf40cced1b3cd3a86ee22df0da49d750539eee1104e99a9f8a065e5499c73125a8a8430eda7aee156821a97c237611b50f682a2cccd0969304f0a50ae98800dfb32ee1bcfeab98182c34a51e67fa5bd738c22c44fc1269ce73f464edd2f31296e92e62df51cf55798ae2e3c33c57b09f4ecd13469122095a3563f95f0a04cf58dcea4aed5e8bdda7617863cbc37a97ebadb46d679f7e30014d96d0ac7ce9484368fa5fd19cbc3d139410a2bd7ffacef1bdf76dd1d5f34d2392fcb91c7585fc1ae7d8ba2aa8ded9645d5a5e76e2279b6e0692101137da946dfbd3836476f5dad7fed70115d716dce87b5ad755e5653a709f5aa42265ec9657ed406cc9256af3628c0116b8e1d23306983e9adbc19dec354870c98e2e76566895df933a80c4c36b617db4bbda1a4ca7d6c80a43734471fc92d0bdeacfc125dddd73febd8f7ef84f221d52ae71372cee802d59013a15958e850f8fdf46d8fd3b874633daf3b1f346470456c05722258480959dd6afcffa1f3f2ca033011339c5cb85b7d1c9b5916fb8dc9c2783df64eb5cca5af83a74fe5bb259f93722842eb4ac851e71f3cfd67a39590e7f8e20f018744b9277e6eb46b5f211df5f767ef29dc9a972e14c40ea2d4624f187f301c1116d3a61adeb5c6f7ccc021ac5e18d8b40d7f1f19daf4445c06e72db8701c267c0144c92cddd49af7a87aca5aa05d0e380dd27cc780d2f7db3bef26cc4fd358543e19d73179b879f7bdc702ab405270c93a3ed64153e20b5b663773a2ad4e8e3e1e8eaf39ec80d75d02f74ff94f0e095240a564eeece4fc9bcf19bf2243c700e1dae14a1b0217013977bfa05f681abc37714fe462d0a632044ce52fdaa1c1a806b1eb4370e23ca0247e536165aa9f1c2af8adfea369ee1f4a2c7823a7baef028a1e77501db48db6aa0d7e30969f7197368db02d443803b53b2899315f7e2ba9c5ae952a3866b4ea60f3d669e0a91f7ef640cd938646bf8822fe455f0302fccf87c7fad6daf38fde038fa596b83a9fd5bf675669a6cb2bab44c6617f07950bf34edb93bbcb4174630f275dbda7a0631c4b456e5f80eb6258c1874e77d426743e478917fe44b73dc203baa2cc442b84b5818409abae99d97a28754969bd393df", 0x1000}}, 0x2000) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000040)={&(0x7f0000000380)="923803b820e2a4778a4bf346e19799be8dd46bec2bee4994c321703cd0623a580aea0db63ef24d012c9b86fa4e8dd337ee7518b8d05f0cd66d285af29c70cc9699ba1485253766dadddd1d914f6fb6d5baaa3e243434b2cb0ecd1a4db856ceedc11946ae99965e8a06b56862badef85c94111349eec1fc9ae635c00bc272b40687f7a028725bfef5e71fa1", &(0x7f0000000580)=""/138, &(0x7f0000000640)="b9046d2e973c4172be418719980dfd9cafd132cd7af528e49c1f0f71be7faf8229cee5a1d5866e07d9c0e9b47bea622d2e8709bdcd91d2cba0dd3f596897037227b6ebfaea721a13eaac8f9d22ea7edb2d474f740a4dcda4cb0b0768a9c36e93452f5b8f91538a8e81be123e11195a318f97ffb09eea799640e43824910b2f0f2c39c43aa27970ad93247fbb4786372affc08bfc19821626b3bf846ca2fc676c60237c5577ac855ee96dfd29cb0f4a62b28a3b2cb1a3", &(0x7f0000000740)="aeecdb5da7af35bd220b74b50a20abe36e7ecb4ccf07bc79bf35f11adfb29485b32031eb1204a6db56e2484917a6154673b716977d9c51d8b60e3afee96b770e3a21a3667eb427026b540e02ff7398ee7530fb7b7d50798c92bbb32314b3e7cbbe913a650e104c1b41757c791b134713f5ad10d87a5768aebff691132281bb7579ec5e890dc551e6094bce5079866ce92a8af33f56ae0f8a2b", 0x8, r3, 0x4}, 0x38) 12.376038558s ago: executing program 0 (id=3504): r0 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f00000004c0)={0x6, "54872f90109b0df4cb75ef8a791099620b70fe0d59a325acc349d73723ae1942d4c5123e1b1fad7f88e725d5089a539b4a25d729e0756127d50a31f8b6b05a98bed92e3e3c0c2aa300bd93fa886df4273ab884b153724b15224828221e70fda8df51f2f54db3a8606dcd3884940bdb6a860a2a52364121d6a573f925472ad32f8362c5c0ea19aa3463afb86aa5e6e14440dbabef15fe2c44daff55fa78c023bd6fa4c4dc1403048dbaa98400070a2f86c9ff15b49ffe1bcfeea8fd4f5bd2ca391018b0f5f5f4bb391ed9e4e0663a760b98ac5ed1ad01e372e205b2231ff9b300ae39138b15bd98ee9281452c10b212075eeea30f4a675461a959aba58e8c61e03289a1468a5c79ec888d20592e279460ceabf2d1fcf33ae7144c8a8bf83fbe7c9a7b39db29bcf0d64766bf75a8930fd36a540c0089ffbac5944b971cf92f4e90b864629f6c44f32830114f5962e9109a9647367182ba10c2a5987686f4bb142afbe7b7bf017bb80ce22ba0716c3e577b0d73762eaef3b70d20f9d8d5d4b290b19cc29ceb1a9c37e5f0153ecdb3b5dfdf2b31347b66799f7a5de11468fdfb218fe132370609f388633600174bdc7f9e39bf6aff9de32bc37eadfd85977c0b4ceebb09a5a120309c92deaaf21b14510aa108b3ad611b530c02f2c1ef4deb3836ad5bf43c19bde185a462df0733632176c680de00fad418e380cbd1e6ebc5dca872"}) mknod$loop(&(0x7f0000000040)='./bus\x00', 0x200, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000400)=ANY=[], 0x1df) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000, 0x5000000, 0x0, 0x18, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 12.270357673s ago: executing program 0 (id=3505): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000000b80)=[{{&(0x7f0000000000)={0xa, 0x4e20, 0x9, @empty, 0x1}, 0x1c, 0x0}}, {{&(0x7f00000003c0)={0xa, 0x4e20, 0x6, @dev={0xfe, 0x80, '\x00', 0x44}, 0xfffffffd}, 0x1c, 0x0, 0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="180000000000000029000000040000006c00000000000000180000000000000029001200040000002b0b"], 0x30}}], 0x2, 0x80080) 12.204976719s ago: executing program 0 (id=3506): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/mdstat\x00', 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="400000001000010429bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="2b030000000000002000128008000100677470001400028008000300010000000800010036f72c71512ea09dc55bc01586a9a80fcccea76a7303316fd0697f7982f0efa965f23917a49d2f6901f2259d5d08a8dcd43540fcdbc6608759559242241e290cdb389905c8111eceecbf54b5de9957b48b0ed6a28cb3ecea327e347dfaa90de4ce8c7c7f8d09f7054fc5910775d8be0001e8e09297cb56ff3a76927f2cd2a90b01cab0aa82d319cc54dbcb7a31c1ffb30a2a1b55481ef1dc44a007723d6379980d2e7e4456e9d273ec08d3cddd7ee87254dfb2665cd03e9f3545ab304adc38976d657ce41189e74259daebf753316cbdaca7c6863eda6ee758d4e74fa8bae1a12153bdcc15a1759eef195681647f16098b94f081bdb45442b75ceb4181655d87768bf7f3ecc4b44f0f83bc09d1", @ANYRES32=r2], 0x40}, 0x1, 0x0, 0x0, 0x20}, 0x20000000) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r3, 0x5) shutdown(r3, 0x0) connect$unix(r3, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) syz_genetlink_get_family_id$nl80211(&(0x7f0000001b80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r0, 0x0, 0x48000) 12.108997678s ago: executing program 0 (id=3507): r0 = socket$key(0xf, 0x3, 0x2) syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000001dc0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000380)="2613dc7cf847b203d92b0e760ad067a2757e1385107318ee55b21a088ef6e81871b78f00f774361adfac106a86db34bc17c9a3b562efcf51f0b0", 0x3a}], 0x1, &(0x7f0000000440)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000000540)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000640), 0x0, &(0x7f00000003c0)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r2, r1]}}, @rights={{0x28, 0x1, 0x1, [r0, r0, r1, r1, r2, r1]}}, @rights={{0x28, 0x1, 0x1, [r0, r0, 0xffffffffffffffff, r1, r2, r2]}}], 0x70, 0x8d0}}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000780)="e296e56d58f3d8ce806a32e17d889c054cb1d0ed9b54b274100f", 0x1a}], 0x1, &(0x7f0000000c80)=ANY=[@ANYBLOB="24000000000000000100000001000000", @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32, @ANYRES32=r2, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32=r2, @ANYBLOB="1c0000000000000000080000000000006a83cb4dcb12ba4ce6400f2b9ac5d3038987cc45c35f9f3501fad570ab041319e5302e19c0dd2a51ed5c5e48f23acb13d9418d5d52b5cb53fad1afa4125a5be828479eb3bcb71622f1da32ca1bbd", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], 0x60, 0x40}}, {{&(0x7f0000000880)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000c00)=[{&(0x7f0000000900)="7fd9e32199b0428ec84382e1c23c2c24707da363607829e8a6d25604888d9f4687284b1717ee4ecb1792614f282b3aa38bacf59b19dd4d724960287e26eb082d", 0x40}, {&(0x7f0000000940)="9a54354dffb879478d3e131e9fb5f54afa01ffde2640b851afcb3e08af4ab42e0a7bdc620cd62ca96d6b6ed2fe9c5c900fcee99e8d10f00fe29178c4ca05fdefcacd801111f9208733ade20a847439961dcf246d5c9441047e2abba88a0629b366b6acfaeaa9f696b397c887589dbbf8440a0a9c58542d4c09457adb4e0d947a247a8cf65df313e8ad8eb467c006b940981852a49ebdf1444527f04f7450000656708e79fd0db6f299f7de56a1a5a49a914482091c6645a44c7bb4865de88cc813aa54f1fe6339", 0xc7}, {&(0x7f0000000a40)="3da0de80b504377e5b955459acaa0b623e5b255d4a6e5292faa66aea0f8707e348a3d08ca989c303f3560263da3dbcdb39a2e5608dbe871bcb58c588413bdf507e76a3e4bd706216dbeb60f1d3d7da46ddbdb28418d887aa5eb52939dfe89aa80ca08e9bd72d6ab6ced27efcf7250f61d3a6f18faca5fae06500d6274bb578fbb20fd54807007e4e805b7d78bb7712e1398bd3e6ebb3a8e1f084", 0x9a}, {&(0x7f0000000b00)="d92db057ef9f342c408b4cd419c647ddd92d9805207a316c3c6376ec8725f45a7afdd93215300082a489caea3850007493491cef439a1e077120229119b054b0103a7c35b5c205cff576cd530415fb09859bcd3a1f20d4", 0x57}, {0x0}], 0x5, &(0x7f00000004c0)=ANY=[@ANYBLOB="30000000000000000100000001000000", @ANYRES32=r1, @ANYRES32, @ANYRES32=r2, @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32, @ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32=r2, @ANYRES32=r0, @ANYRES32=r2, @ANYBLOB="65d5402b140612c8acebe6bffbdf0e180000"], 0x68, 0x810}}, {{&(0x7f0000000d40)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000f40)=[{&(0x7f0000000dc0)="7c16fac4affba735861bde", 0xb}, {&(0x7f0000000e00)="af95eb1120cfe7d599b18e019d77b5817fff7c6bf4683c22a17c5d1f15e44c929402649b2ab33417e7c88dfa1ac6d83fac81ff5e65a8adc3604e7f17d873975f779f7a0d33a63e316b8397c7b9cc18e0d040aaf139af07fcc44e192287dd81d7bf5d0b638a30f2608b722f1b5adaa6c5d37472b9309ffc70e6ce9b8f94e2b25d58a1b890135de951a42e4cb4b10b47a21181cded8b3a2cdde71800ab18425d92697cbb5b704deba2e4cb7d37be857246222e6e9bf2655975eee899897ab7fb5aa4865d0631c91c4e0acb86df92e5c3f3e82c4482803c8e858ce4bf552285cec429193027fd372428f1e4b4d6d7f64a8cf543", 0xf2}, {&(0x7f0000000f00)="116bd9e285f865161506cf56262c9ea8137404abb86f02519418d3c2a50cb96425e4e3de1f4c5b3bbc988aee85a5df4536a4a61501e39b5d7aefe2906e4e8916", 0x40}], 0x3, &(0x7f0000000f80), 0x0, 0xc405}}, {{&(0x7f0000000fc0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001380)=[{&(0x7f0000001040)="89489722f2aea7e23b9e9a7556c583213772785036379fbe8853f7c48b8a3b05c6488e62ff166ff298982017561fe8ac31612c8176d7295bc12642a585a4247d3c77cf3a2c2df02a73d411787c42b6a3ca3d43dc618ac6248c8acdda837c66722e95c1665edbf365271051038cf8512f81a2d3f0759b3cb1afcf7975579f9755de78cd0e5d12a5c4b5eaed8df2b3c427a5ef14", 0x93}, {&(0x7f00000011c0)="a6b8ff9bb177afa0bf24e31f9e06d38b701bdc3f6cd1bce02950a0decf23aeb476df2f9217267c4863a6714d16ac5b6b88c55c5dc479bd8d4c5d81ce54c6d1cbe66a1aee597da48d11e42dc05eb3ee64b3412699f58882ffe10d5ea28b24697850584114e4033d34f1ffd4f921e98c5450ee17c86733582214c6c47ca8229521c902bce1636ee9c97eb3c033e25f1fd1c733a13bb15066431b4e63af9932904ccb21fddf3b3198240c74e75d3e14997683429d1eb8ac2241ff95cb281ab406aa65aeafe51a33a7eadda80823b231c5fa1341db87e57161e182973b4be4cc31e4bb854beb043a2fd07ad16c102760d535f15f367e93a28e88c795", 0xfa}, {&(0x7f00000012c0)="bff211e87dbbff76e3d18ca1053811c9f609a35fbdce066a089ddb3f673758244abe438ec1b0f4132e76c9998e7685c1ae42fb0fb29cc81d05ac2127a8dd16f32cad3e06e6404b3f55e80c17620313ca0646b75dd0cddc917c26ceac80878c5e63082ae925bb48c0eaa1b2d0d808e79fb199ab302dede891b0fbef3d03f4e0d82f523ccb6220fd8391e48bf0ae04a384e60ee576de1b8d04f121684e914e13d3", 0xa0}], 0x3, 0x0, 0x0, 0x44008040}}, {{&(0x7f00000013c0)=@file={0x0, './file1\x00'}, 0x6e, &(0x7f0000001900)=[{&(0x7f0000001440)="624a0c62ad8ca04d4a5b71f82a0c141a8174e86964b99c95d34c70fc9ce649e0caade3e3a1d6541e6b035a59187cab3298929d37fe91b38579241947b306040d5c3ecdede23c5c52cd77f325872f6b427ced2a81d0c8ec479ce0ed84044d6efdf9be8225b1a8b6d201f89f26c8f91b304975374a7facbf81163d74a544770621aa24513f5303bcd02ed93209ac33bc5218977500ed705d6b7e54401de6f290a0269332ee7846c664271a7dcaca0370b6d80a4e65108b60bf040f0ef85f95af500b8d339bdb0228bfe576401e30e9727d586955b1f44f91cc740aa97e324c", 0xde}, {&(0x7f0000001540)="c7c12bafc9aa62bf3aa036054e59233341fef30c8702dc09341af8235f1ef8baf628cc93efc8933a4572f273239a058685df2d2cb04982b1b8453a77decd47fde194ba31975bd74623b2b418eb4af87afd3d2faec2d433599d9c7e668c640970ac2b13ba402fd13e25465a4749d12c271144785291eb416c001ede0330378ff4aeb2259512a4742c0d41ce079b89b9e1c5f066e037f4a1d63b2870a199652c58aa4a6d3cdee23e15b9ccfd6c", 0xac}, {&(0x7f0000001600)="c26a176328d1bebb4711", 0xa}, {&(0x7f0000001640)="b16bcd1c0fa01960aa3f63d587f11c5c4e2ae8c47052757d3af7ba78559147635979f578864d4975c22728dc0abc2f200872c544383b72a2c24274ff3a5e4c3693ed85475fb00d0fc41c6d5ef131782ab3d409af0fcfec15d584f323a9db5306de5640c2e5daa9233975ea6eba300a362653ffd1ea486498f510c517cb29fee321273d896c93c5a40bcbd787a2d9ad89082ce01ac4dd1c3efa610df67d48f2af9893678ef5b86df076e8", 0xaa}, {&(0x7f0000001700)="cefbc8652570a6e9ef2cc4851341eb0e84a430d02734763373f205f3", 0x1c}, {&(0x7f0000001740)="f949eb174bb903dd1717de31a778c09d09deb5507c5367c5a9923d34555fa5319540ed4dccfdbef5e149feef645b622e007f0470e660489057fa9f84238b333b3733ee16f4e8bb469070e14cf2db43c30cf569cb", 0x54}, {&(0x7f0000001840)="4e4109bbc7a88ce8c5f4f252f23a2b16f25ae75ee066ceb6821b8d184d875e00f7c8cad6adb95661a0a24e758feee2197027b85f489a989748af3a09ee9c725121c90049f650a5f557551168aefc41b0fbcd51573daaea099c8a2ec0a281a88948c9d59c0d718d08aa8b8ac6908c511a3a6325a5e8966e6b258286c01ee885921491f3842ee998ac773b12d6e234db871df3a5abe26db61d0dabd7735af8314f1bd9aa31ec8701f8a05f341ada83faf0eebcebc1", 0xb4}], 0x7, 0x0, 0x0, 0x4000050}}, {{&(0x7f00000019c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000001b00)=[{&(0x7f0000001a40)="dc81cb23ebbb2c974a7eac83360bfe69ddc0ac6a354c19aee630cbaf334e782b532f18b05de319ef085f1a4d1b05ab6e26fc32c890a27954997a0c77b4d5431047006ce46501ba5c67d7eb0912e5cd3d1779cccb3c7861f3c1fd269916cd219d6facb0054cb918f00913", 0x6a}, {&(0x7f0000001ac0)}], 0x2, &(0x7f0000001b40)=ANY=[@ANYBLOB="28000000000000000100000001000000", @ANYRES32=r1, @ANYRES32, @ANYRES32=r1, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1cebffffff0000194000020000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x48, 0x4041}}], 0x8, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r3, 0x0, 0x0, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = epoll_create1(0x80000) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f00000000c0)={'geneve0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x18}}) r6 = fcntl$dupfd(r0, 0x406, r5) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f00000001c0)={0x10000014}) r7 = getpid() r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x8082, 0x0) sendfile(r8, r8, 0x0, 0x400000000003f) r9 = dup(r8) fallocate(r9, 0x10, 0x0, 0x400) inotify_add_watch(r9, &(0x7f0000000200)='./file1\x00', 0x1000000) r10 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r7, r10, 0x7, r6, &(0x7f0000000100)={r5, r6}) getpgid(r10) connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e21}, 0x6e) syz_emit_ethernet(0x7a, 0x0, 0x0) r11 = socket$key(0xf, 0x3, 0x2) fcntl$setlease(r0, 0x400, 0x2) sendmsg$key(r11, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) 5.454957861s ago: executing program 1 (id=3548): socket$inet_udp(0x2, 0x2, 0x0) creat(&(0x7f00000001c0)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) fgetxattr(r2, 0x0, &(0x7f0000000040)=""/111, 0x6f) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r4, 0xae03, 0xea) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x22000, 0x0) io_uring_setup(0x5bdd, &(0x7f00000005c0)={0x0, 0x3428, 0x200, 0x3, 0x40000}) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f00000001c0)) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r5, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x140, 0x800, 0x3ff, 0x0, 0x0, 0x0, {0x4, 0x4}, {0xfffffffd}, {0x0, 0x4}, {0x0, 0x4, 0x8}, 0x0, 0x3f0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, 0x0, 0x0, 0x0, 0x69, 0x0, 0x100, 0x2, 0xc}) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) add_key$fscrypt_provisioning(&(0x7f0000000200), &(0x7f0000000280)={'syz', 0x1}, &(0x7f0000000480)=ANY=[], 0x48, 0xfffffffffffffffa) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x60}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001000000000000000000e0000002000000000000000000000000ac1414aa00000000000000000000000000000000000000000a0000000000c000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400002000000000000080000000000000000000100000000000044000500ac1414aa000000000000000000000000000000003c00000000000000ffffffff00000000000000"], 0xfc}}, 0x0) sendmsg$NFNL_MSG_ACCT_NEW(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000180)={0x2c, 0x0, 0x7, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x8a}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x810}, 0x4004090) 4.708424232s ago: executing program 3 (id=3552): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0xbe, &(0x7f0000000140)={@broadcast, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x67, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x3, 0x24, 0x0, {0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @local, @rand_addr=0x64010102, {[@cipso={0x86, 0x77, 0x0, [{0x5, 0xc, "e256b28c59881681fb52"}, {0x0, 0x9, "789607671442eb"}, {0x0, 0xe, "7434954373561de584b703c8"}, {0x0, 0x12, "e706d30bd224010000000000000038c2"}, {0x0, 0x7, "cfa1e7ab1a"}, {0x0, 0xf, "c6000000000100000000000000"}, {0x0, 0xa, "6580a5e97612fe86"}, {0x0, 0x10, "73bc2300ad9d19a3000000000000"}, {0x0, 0xc, "c8f46976e79e56c7a95e"}]}, @cipso={0x86, 0x6}]}}}}}}}, 0x0) 4.695916115s ago: executing program 3 (id=3553): r0 = socket$nl_route(0x10, 0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01090000000000000f478e"]) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x5}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0xb0, 0x4002004c4, 0x1000, 0x0, 0x0, 0x0, 0x5, 0x0, 0x9, 0x0, 0x7], 0xeeee8000, 0x2113c0}) ppoll(&(0x7f00000000c0)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000000)) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newlink={0x48, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x4, 0x0, 0x300}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gre={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @private=0xa010101}, @IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x2}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x81}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40084}, 0x0) 4.281247718s ago: executing program 1 (id=3556): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x401, 0xfffffffc, 0x7c, {0x0, 0x0, 0x0, 0x0, 0x15703}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}, 0x1, 0xc3ffffffffffffff, 0x0, 0x2004d099}, 0x0) 4.09211284s ago: executing program 1 (id=3558): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/mdstat\x00', 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="400000001000010429bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="2b030000000000002000128008000100677470001400028008000300010000000800010036f72c71512ea09dc55bc01586a9a80fcccea76a7303316fd0697f7982f0efa965f23917a49d2f6901f2259d5d08a8dcd43540fcdbc6608759559242241e290cdb389905c8111eceecbf54b5de9957b48b0ed6a28cb3ecea327e347dfaa90de4ce8c7c7f8d09f7054fc5910775d8be0001e8e09297cb56ff3a76927f2cd2a90b01cab0aa82d319cc54dbcb7a31c1ffb30a2a1b55481ef1dc44a007723d6379980d2e7e4456e9d273ec08d3cddd7ee87254dfb2665cd03e9f3545ab304adc38976d657ce41189e74259daebf753316cbdaca7c6863eda6ee758d4e74fa8bae1a12153bdcc15a1759eef195681647f16098b94f081bdb45442b75ceb4181655d87768bf7f3ecc4b44f0f83bc09d1", @ANYRES32=r2], 0x40}, 0x1, 0x0, 0x0, 0x500}, 0x20000000) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r3, 0x5) shutdown(r3, 0x0) connect$unix(r3, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) syz_genetlink_get_family_id$nl80211(&(0x7f0000001b80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r0, 0x0, 0x48000) 4.085105527s ago: executing program 4 (id=3559): socket$nl_netfilter(0x10, 0x3, 0xc) setuid(0xee01) tkill(0x0, 0x13) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1800800000000000b80000003600"/24], 0x18}, 0x800) connect$inet6(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fsopen(&(0x7f0000000000)='logfs\x00', 0x1) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0x0, 0x2, 0x7, 0x8, 0x40, 0x3}, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(0xffffffffffffffff, 0x40086602, 0x0) openat$sysfs(0xffffff9c, 0x0, 0x42, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r2, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f00000000c0), 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000680)=ANY=[@ANYBLOB="b7000000df000000bfa300000000000007030000f8ffffff720af0fff8ffffff71a4f0ff000000005d040200000000001d400500000000004704000001ed000062030000000000f53e440000000000007a0a00fe00ffffffc3030000f1000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c500000057bd81cb2af0b176275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e5b5b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb9134658fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9a958f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f94fefe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a1074649c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c0dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6acdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e924d6b1594af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fed000000007baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e70300000000000000fee18a22da19fcdb4c2890cda1f96b952511e34cb14ea4a10a6f1dbaa69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca485683252b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a0032f37ff559be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee07751532d5e7d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e2fa3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde20300accc5bd40a2968b59c93d35f8e42366fdef907000000f01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e015cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933f638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb581012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00000000000000003542591d17b5e8d9be772914cf4e3129e7929aa238bd99c3ddd895e33d8cf6c3d6cc883f0319aec94fb4cffde7a6d1fa1bcc03ead3912c2a68ca172adf3f9417207ea83d03a108d2ae15ee38c06dc98a0d1696b7c7fe142440776889154a93888972462439ae33b24c90e13c8f80d4e32716e96825d7bbdd97e4bae368d009b4611619a778f547fa1c92cc656a89728a6a1758b98fd27e1f5e1b446506d8947ca82bac7c2f00"/2663], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) r3 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x101121) r4 = dup(r3) unshare(0x22020400) bind$alg(r4, 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000080)="b1", 0x1, 0x400c0d4, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) 4.067709895s ago: executing program 1 (id=3560): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000004400)=@newtfilter={0x8b0, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x87c, 0x2, [@TCA_MATCHALL_ACT={0x878, 0x2, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x1ff, 0x3, 0x10000, 0x81, 0x7f, 0xfffffffb, 0x4, 0x2, 0xffffffc0, 0x5, 0x2234, 0x7f, 0x81b, 0x800, 0x8, 0x0, 0x3, 0x7ed53619, 0x1, 0x7, 0x9644, 0x4, 0x58b, 0x85a, 0x3ff, 0x46, 0x2, 0x1, 0x0, 0x80000000, 0x10001, 0x790, 0x9, 0xab2, 0xfffffff9, 0x1a77, 0x9, 0x3, 0x400, 0x63c, 0x4, 0xffffffff, 0x1, 0x5, 0x1, 0x5b1f, 0x7b0, 0x7, 0x100, 0x6, 0xd, 0xff, 0x3, 0x10000, 0x6, 0x6b7, 0x1ff, 0x80, 0x4, 0x7, 0x3, 0xa14, 0x3, 0x2, 0x80000000, 0x81, 0x7, 0x8, 0x5, 0x10001, 0xf7, 0x3, 0xfffffff9, 0x9, 0x4, 0x8, 0xfff, 0x3, 0x1, 0x6, 0x7, 0x0, 0x100, 0xc0000000, 0x6, 0x6, 0x6, 0x8, 0x80000001, 0x8, 0x1d24, 0x2, 0x9, 0x0, 0x7f, 0x7, 0x63c, 0xff, 0x24, 0x3, 0x7, 0x6, 0x7a, 0x8, 0x0, 0x7, 0x470, 0x7f, 0x6, 0x0, 0x1, 0xffffffe4, 0x4, 0x9, 0x61, 0x200, 0x6, 0x2, 0x2, 0x800, 0x10001, 0x8, 0x7, 0xf, 0xda56, 0x80000000, 0x80, 0x2f0cb955, 0x7, 0xfed, 0xf, 0x6ae, 0x2, 0x1, 0x9, 0x8001, 0x0, 0xec000, 0x0, 0x1, 0x2, 0xfffffffb, 0x7, 0x8, 0x4, 0x1, 0xffffcf1b, 0x282, 0x5517bc7b, 0x3, 0x4, 0xb6d, 0x5, 0x0, 0xac, 0x9, 0x6, 0x10, 0x9, 0x8, 0x80000001, 0x0, 0x74, 0x2, 0x7fffffff, 0xfffffff9, 0xa, 0x6, 0xffffffff, 0x8, 0x2, 0x7, 0x7f, 0x5, 0x3, 0xa, 0x1, 0x0, 0x9, 0x300, 0x5, 0x3, 0x0, 0xffffffff, 0xffb, 0xff, 0x5, 0x8, 0x3, 0x2, 0x5, 0xfca, 0x399d, 0x6, 0x8ab6, 0x18000, 0x2, 0xfffffff9, 0x2, 0x2, 0x528c, 0x5, 0x200, 0xac, 0xf, 0xd05, 0x9a2ce73, 0x4, 0x6, 0xe074, 0x6b10, 0x5, 0x1, 0x6, 0xb, 0xa26, 0xaf6, 0x0, 0xec, 0x8, 0xde16, 0xc418, 0xffffffff, 0xffffffff, 0x9, 0x400, 0x1, 0x5, 0x354d, 0x5, 0x2, 0x1, 0x7, 0x1, 0x177, 0x7, 0x3, 0x80, 0x5, 0x8, 0xfffffffb, 0x9, 0xe7b, 0x0, 0x7, 0x42bf, 0x10000, 0x9, 0x9, 0x6, 0x4b75, 0x80000001, 0x1000, 0x5915, 0x10001, 0x1]}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1000, 0x8, 0xec2, 0x6, 0x8, 0x400, 0x5, 0x1, 0x7, 0x470, 0x487, 0x100, 0xa99, 0xffffff01, 0x5, 0x37f, 0x8, 0x6, 0x3, 0x3, 0x800, 0xd2f5, 0x40, 0x4, 0x4, 0x5, 0x7, 0xe, 0x2, 0x8, 0x101, 0xffffffff, 0x2, 0x10000, 0xa6, 0x3, 0x10000, 0x5, 0x4, 0x0, 0x3, 0x0, 0xd, 0x8000, 0x98, 0x8, 0x6, 0x9, 0x1000, 0xb3000, 0xf, 0x3, 0x9, 0xb4, 0x94d, 0x9, 0x8, 0x6, 0x100, 0xec0, 0xffff, 0x4, 0x2, 0x3ff, 0x3e, 0xb828, 0x0, 0x0, 0x365, 0x8, 0x8, 0xf, 0x1, 0xfffffffe, 0xfffffff6, 0x93, 0x7ff, 0x92, 0x0, 0x7, 0xfffffffc, 0x7ff, 0x9, 0x2, 0x800, 0x2, 0x8, 0x4, 0x3, 0x9, 0xc, 0x0, 0x3, 0x3, 0x400, 0x100000, 0x7f, 0x2, 0x8, 0x4, 0x7, 0x4, 0x6, 0xfffffffa, 0x101, 0xadd9, 0x1, 0x0, 0x7, 0x7fffffff, 0x2, 0x4, 0x0, 0x5, 0x4, 0x3, 0x8, 0x9, 0x6, 0x6, 0xe, 0xb, 0x3, 0x7f, 0xffff, 0x401, 0x1685, 0xa252, 0x2, 0x200, 0x3, 0x1, 0x400, 0xfffffffc, 0xfffffffc, 0x1000, 0x7ff, 0x1, 0x1f6, 0x751, 0x7, 0x40000000, 0x4, 0x1ff8000, 0x50, 0xf, 0xf, 0xe, 0x3, 0x0, 0x81, 0xfff80000, 0x7a7, 0x1, 0x6, 0x3, 0x8, 0x7, 0x5, 0x2, 0x0, 0x4e9, 0x80, 0x3, 0x8, 0x5, 0x0, 0x5, 0x7fff, 0x7, 0x8, 0x6a4941c5, 0x2ea567b4, 0x8, 0x80000000, 0x6, 0x40, 0x2, 0xfff, 0x8, 0x3, 0x1, 0x1, 0x0, 0x0, 0xd3bed341, 0x691f, 0x0, 0x2, 0x9, 0x6, 0x0, 0x1ff, 0x3, 0x3, 0x6, 0x5fc8462f, 0x0, 0x7, 0xffff, 0xfffffffc, 0x5, 0x0, 0xb9a6, 0x522, 0x2, 0x2, 0x900, 0x8, 0xbb99, 0xb8000000, 0x8, 0x3, 0xc0a1, 0x5, 0x8, 0x7, 0x59, 0x9, 0x2, 0xa3, 0x5f502dc7, 0x7, 0x0, 0x4, 0x6, 0x80000001, 0x3, 0xffffff97, 0x2, 0xfff, 0x1, 0x40, 0x8, 0x3, 0x70c, 0x8, 0x1, 0xfffff339, 0x3, 0x8001, 0x1, 0x8001, 0x9, 0x8, 0xfffffffa, 0x8, 0x9, 0x3, 0xe, 0x10000, 0x9, 0x9, 0x7, 0xfffffff8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xfffffe00, 0x2, 0x5, 0x1, 0xdbec, {0x8, 0x0, 0xb55, 0x5, 0x7, 0x5}, {0x6, 0x0, 0xd, 0x5, 0x1, 0x5d17}, 0x2, 0x0, 0x6}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8b0}, 0x1, 0x0, 0x0, 0x10}, 0x0) 3.992796307s ago: executing program 5 (id=3561): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r0 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) close(r0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$IP_VS_SO_GET_SERVICE(r2, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000180)=0x68) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000100)=[0x0], 0x0, 0x0, 0x0, 0x1}) r4 = syz_open_dev$vim2m(&(0x7f0000000080), 0x9, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x20000890, &(0x7f0000000140)={0x0, 0xaae2, 0x0, 0x2, 0xbfdffffc}, 0x0, &(0x7f0000000040)=0x0) syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @hci_ev_role_change={{0x12, 0x8}, {0x4, @none, 0x7e}}}, 0xb) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$ENABLE_STATS(0x20, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) syz_io_uring_submit(0x0, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x85c3}}) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000040)={0x7, 0x1, 0x2, 0x0, 0x5}) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000140)={0x1, 0x101}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000740)={0x0, 0x0, r3, 0x0, 0x0, 0x44, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, "f3bf0a71b5d0c19323a26000000000000000000200000000899400"}}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) 3.43587538s ago: executing program 1 (id=3562): syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc08a, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x6}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x2, 0xc, 0x8}}]}}}]}}]}}, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_io_uring_setup(0xbda, &(0x7f0000000640)={0x0, 0xec25, 0x8, 0x1, 0x40000333}, &(0x7f0000000dc0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0x0) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r6, 0x3, 0xffffffffffffffff, &(0x7f0000000c40)={0x2000000b}) openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 3.434073379s ago: executing program 3 (id=3563): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x8, &(0x7f0000001a00)=0xf2b, 0x37) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000016c0)=[{{&(0x7f00000010c0)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10}, 0x80, &(0x7f0000001580)=[{&(0x7f0000001a40)=""/4096, 0x1000}, {&(0x7f0000002a40)=""/4096, 0x1000}, {&(0x7f0000001140)=""/16, 0x10}, {&(0x7f0000001180)=""/165, 0xa5}, {&(0x7f0000001240)=""/236, 0xec}, {&(0x7f0000001340)=""/209, 0xd1}, {&(0x7f0000001440)=""/60, 0x3c}, {&(0x7f0000003a40)=""/4096, 0x1000}, {&(0x7f0000001480)=""/147, 0x93}, {&(0x7f0000001540)=""/64, 0x40}], 0xa, &(0x7f0000001640)=""/95, 0x5f}, 0x10000}], 0x1, 0x40000261, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) syz_io_uring_setup(0x238, 0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="7000000002060500000000000000000000000000120003006269746d61703a69702c6d6163000000050004000000000009000200f3797a3000000000240007800c0002800800014000008e020c0001800800014000000000080008400000001005000500020000000500010006"], 0x70}}, 0x800) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x3, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x6, 0xfffffffffffffffd, &(0x7f00000000c0)=0xa4) write$dsp(0xffffffffffffffff, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) clock_nanosleep(0x9, 0x2000000, &(0x7f0000000080)={0x0, 0x3938700}, 0x0) ioctl$KVM_GET_IRQCHIP(r3, 0xc208ae62, &(0x7f00000001c0)={0x1, 0x0, @pic={0xd5, 0x6, 0x6, 0x4, 0x8, 0x3c, 0x9, 0x6c, 0x6, 0xe4, 0x39, 0xb8, 0xa9, 0x81, 0x5f, 0xd}}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x1, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x40938, 0x29225}, [@IFLA_IFNAME={0x14, 0x3, 'team0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4044800}, 0x4000000) socket$inet6_sctp(0xa, 0x5, 0x84) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r6 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x4c, 0x12, 0x1, 0xfffffffd, 0x0, {0xa, 0x5, 0x0, 0x0, {0x0, 0x5e22, [0x0, 0xffffffff, 0xfffffffe], [0x0, 0x0, 0xfffffffd], 0x0, [0x1, 0x3]}, 0x0, 0xfffffffe}}, 0x4c}}, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2f) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001080)='net/igmp\x00') read$char_usb(r7, &(0x7f0000000040)=""/4109, 0x100d) r8 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r8, &(0x7f0000000080)=ANY=[], 0xb0) 3.067622467s ago: executing program 5 (id=3564): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xc931e000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x28, {[@timestamp={0x5, 0xa, 0x0, 0x700}, @generic={0x0, 0x2}]}}}}}}, 0x42) syz_clone3(0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16, @ANYBLOB="0100ffff7fff0000000018000000080001007063690011000200303030303a30304a31302e3000000000080003000200000008000b000700000006001600d3000000050012000000000006001100000800000800"], 0x60}, 0x1, 0x0, 0x0, 0x20004090}, 0x0) munlock(&(0x7f0000ffb000/0x4000)=nil, 0x4000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c00000000010104000000000000000002000000240002801400018008000100e000000108000200e00000010c0002800500010084000000080008400000000814000580080001"], 0x5c}}, 0x0) 2.945723507s ago: executing program 4 (id=3565): syz_open_dev$vim2m(0x0, 0xc74, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0xfffffffe, 0x0, 0xd, 0x400009, 0x8, 0xa}, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x40) socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="2000000069000b080000000000000000000000baec82c400080001"], 0x20}}, 0x4000000) r3 = socket$can_raw(0x1d, 0x3, 0x1) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002280)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r5, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_raw(r3, &(0x7f0000000000)={0x1d, r6}, 0x10) setsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, &(0x7f00000000c0), 0xf00) bind$can_raw(r3, &(0x7f0000000080), 0x10) 2.031787819s ago: executing program 3 (id=3566): socket$inet_udp(0x2, 0x2, 0x0) creat(&(0x7f00000001c0)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) fgetxattr(r2, 0x0, &(0x7f0000000040)=""/111, 0x6f) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r4, 0xae03, 0xea) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x22000, 0x0) io_uring_setup(0x5bdd, &(0x7f00000005c0)={0x0, 0x3428, 0x200, 0x3, 0x40000}) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f00000001c0)) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r5, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x140, 0x800, 0x3ff, 0x0, 0x0, 0x0, {0x4, 0x4}, {0xfffffffd}, {0x0, 0x4}, {0x0, 0x4, 0x8}, 0x0, 0x3f0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, 0x0, 0x0, 0x0, 0x69, 0x0, 0x100, 0x2, 0xc}) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) add_key$fscrypt_provisioning(&(0x7f0000000200), &(0x7f0000000280)={'syz', 0x1}, &(0x7f0000000480)=ANY=[], 0x48, 0xfffffffffffffffa) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x60}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001000000000000000000e0000002000000000000000000000000ac1414aa00000000000000000000000000000000000000000a0000000000c000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400002000000000000080000000000000000000100000000000044000500ac1414aa000000000000000000000000000000003c00000000000000ffffffff00000000000000"], 0xfc}}, 0x0) sendmsg$NFNL_MSG_ACCT_NEW(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000180)={0x2c, 0x0, 0x7, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x8a}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x810}, 0x4004090) 909.367687ms ago: executing program 4 (id=3567): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000020000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5c0100001000130700000000fcdbdf252001000000000000000000000000000420010000000000000000000000000001000000004e210002000000006c000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fc010000000000000000000000000000000000fe32000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000010000800000000043050000000000000400000000000000ffffffffffffff7f000000000000000001000000000000000000000000000000000000002cbd7000003500000a000000500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000060000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r2], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2000) 733.477812ms ago: executing program 5 (id=3568): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00', @ANYRES16=r1, @ANYBLOB="000238bd7000f8dbdf2502000d00000000000000000008003f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x41) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @void}}}, 0x28}}, 0x0) 623.487514ms ago: executing program 5 (id=3569): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="0203f3021600000000000000200000000200090008000000e9000000000000000300060000000005020000000000000000000000000000000200010000000000000003fcff000020030005000000000002000000ac1414aa00000000000000000a00080008"], 0xb0}, 0x1, 0x7}, 0x0) 503.702982ms ago: executing program 4 (id=3570): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000100050005e407000000000008000900030000001400200000000000000000000000e1ffe000000108000a0000000000060002000100000014001f"], 0x5c}, 0x1, 0x6c}, 0x0) 483.806503ms ago: executing program 4 (id=3571): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x1, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) syz_emit_ethernet(0x66, &(0x7f0000000340)={@multicast, @link_local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @private=0xe0, @multicast1=0xe000c800}, {{0x0, 0x0, 0x1, 0x0, 0xb, 0x0, 0x0, 0x4, 0x6558}, {0x0, 0x0, 0x0, 0x0, 0x11}, {}, {0x8, 0x88be, 0x0, {{}, 0xfffff788}}, {}, {0x8, 0x6558, 0xfff4}}}}}}, 0x0) 371.684835ms ago: executing program 1 (id=3572): socket$nl_route(0x10, 0x3, 0x0) write(0xffffffffffffffff, &(0x7f0000000080), 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x141000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$IOCTL_VMCI_GET_CONTEXT_ID(r2, 0x7b3, &(0x7f0000000140)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r3, &(0x7f0000000280)='2', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="2c00000068000100030010000000008000000000000000000c000200010000001500000006000700030000002a7361e0f769a198c1e5d99d1d0c3d07f017544737b8b34bff41533f2d9327e4cc0619f46c39315e03569dec27411b46b041cc8e7b08c86aab61ad69f8858d51b22c7adaa6a40a62bae2e8bfea517ca20e08f5f185850668e17859dcd8a7c1571c6ca196b3c04e82a47b4c8d3455487f8d49fc468e29d10ba2d87afbdc7f7c78532ced3afb95153056b40665916239ad50a654941d28158eb1a22a3a0657e3bd74b2db50812c041eb74dd3647f5d692c51"], 0x2c}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000) syz_usb_connect(0x0, 0x64, &(0x7f0000000940)={{0x12, 0x1, 0x110, 0x7, 0xdb, 0xe2, 0x8, 0xb48, 0x2003, 0xd41b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x52, 0x2, 0x5, 0x9, 0x30, 0x2, [{{0x9, 0x4, 0x23, 0xa, 0x3, 0x2e, 0xb9, 0x69, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x6, 0x52}, [@mixer_unit={0x5, 0x24, 0x4, 0x4, 0x9}, @selector_unit={0x7, 0x24, 0x5, 0x1, 0xc3, "451d"}, @extension_unit={0x7, 0x24, 0x8, 0x3, 0xd9c, 0x8}]}], [{{0x9, 0x5, 0xa, 0x10, 0x8, 0x0, 0x8, 0xf8}}, {{0x9, 0x5, 0xe, 0x1, 0x3ff, 0x3, 0x2, 0x8}}, {{0x9, 0x5, 0x5, 0x3, 0x200, 0x40, 0xbf, 0x8}}]}}, {{0x9, 0x4, 0x4, 0xc0, 0x0, 0xe6, 0x63, 0xe8, 0x80}}]}}]}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) r5 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r5, 0x80845663, 0x0) r6 = socket$inet6(0xa, 0x80003, 0xff) r7 = socket$inet6(0xa, 0x1, 0x101) setsockopt$inet6_int(r7, 0x29, 0x16, &(0x7f0000fcb000), 0x4) setsockopt$inet6_int(r6, 0x29, 0x16, &(0x7f0000fcb000), 0x4) setsockopt$inet6_int(r6, 0x29, 0x16, &(0x7f0000000040), 0x4) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) pipe2(0x0, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f00000001c0)=ANY=[@ANYBLOB="2a01000020000040b708000000000000430109029200030172e500090400000001010000", @ANYRES16], 0x0) 244.06276ms ago: executing program 3 (id=3573): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x34, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}, @NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}, {0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x9000000, {0x0, 0x84}}}, 0x100}}, 0x0) 243.703938ms ago: executing program 5 (id=3574): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300030e000000000700000000000004000900a0000000015204f089b96478db1d8a5f756509e977fb1a03000000000200010000000000000006161600003f030006000000000002004e21000000800000000000000000030005003200000002"], 0x70}, 0x1, 0x7}, 0x0) 205.558271ms ago: executing program 4 (id=3575): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="c80300001600010000000100fcffffff0a01010000000000000000000000000000000000003000000000ffff000000000000000000000000000080201d000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="ff0200000000000000000000000000010000000033000000ac1414450000000000000000000000000000000000000000010000000000000000000000000000000000000000000000fffffffffffffffff1ffffffffffffff03000000000000000000000000000000000000000000000000000000000000000200000000000000feffffffffffffff00000000000000009607000000000000043d000000000000ef0000000000000000000000060000002c00130020010000000000000000000000000002ac141430000000000000000000000000000000000a000000e40006007f000001000000000000000000000000ff0100000000000000000000000000014e2303ff4e24000e0200200088000000", @ANYRES32, @ANYRES32, @ANYBLOB="00000000000000000000000000000001000004d332000000ff020000000000000000000000000001040000000000000001000000000000000800000000000000070000000000000002000000000000000100000000000000070000000000000035000000000000000100000000000000ffffffffffffff7f0100010000000000264a000000000000dd52000078070000bcbc00002abd7000063500000a0000ff61000000000000001f0102007863686163686131322d67656e657269630000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8060000de36d16a4d3d3133db0c2db4721a0b1bf4670216ed84807f707f71ce0286f3cbc3604abbaea1ec0fdb659c3e827a9de929a80b6fec8db684a855ea16fe88fcf3f18869e1da3ffe7cb218a17a640d4080a351551a8093c68b475b42e373c240f8165988c339587cc95b34cf32eacc2b008c96a4a85a1105f0e2ff97163bfaf69fe23e5632608f14a90b1d742c44d4014528a79cc7c983bcfe7c301daf6873d65ac80dcee02ec890005ca87ca7c725fa238e5ded18f34eb38bd6dc4e20fc4a571dd25bf1a16f3573cc1412e46263fe4ca927fed06cdc2659006f"], 0x3c8}}, 0x0) 95.462326ms ago: executing program 5 (id=3576): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={0x0, 0xa0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="3800000011140113000000000008000008004a0002000000080003000400000008004b"], 0x38}, 0x1, 0x0, 0x0, 0x480d1}, 0x40800) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0) fcntl$setlease(r4, 0x400, 0x1) close(r4) write$RDMA_USER_CM_CMD_CREATE_ID(r4, 0x0, 0x32) sched_setattr(0x0, 0x0, 0x0) r5 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r5, 0xc0d05640, &(0x7f00000003c0)={0x7, @raw_data="0c5437bed847eec15191c0b05624fbe7871efd881b0976db41ff036c861567207380568f2eda6f25af8c7e186c0266e4f10bc97bb2e4d5428abddf7b8089b22c804b88b3203c471c8128c9aa7cc3d71195867dfbdcc36d715c94893dcf1f86d0842741092051ba71482bcaf7a7571905ed4eb860307226b575af7320e3ed63b08f6ac4c415fcb877491444e4b35dfff1a10f9a5c67484ba4a3afdeedc436eba67623daf4dbdd005d9db7a69e2bdcc4d5f34bb6803b800554edf9f81d739db7d187e933f7763681bb"}) r6 = socket(0x10, 0x2, 0x0) write(r6, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r6, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) syz_usb_connect(0x6, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000140), 0x400000, 0x0) preadv2(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000002200)=""/4079, 0xfef}], 0x1, 0x4, 0x3, 0x5) r7 = syz_open_dev$sg(0x0, 0x0, 0x14080) r8 = fcntl$dupfd(r7, 0x0, r7) ioctl$SG_IO(r8, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffc, 0x6, 0x0, @buffer={0x2, 0x41001, &(0x7f00000000c0)=""/81}, &(0x7f0000000380)="259374c96ee3", 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r10 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) ioctl$LOOP_CONFIGURE(r10, 0x4c0a, &(0x7f0000001ac0)={r9, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1c, "ff9f020bbe82b398b1c4369d03740250ceaac594b1b3d741dd17c1ac0d38ef2a565ef1e8336300", "a9103939c787a16c1ca43f80026d1f3c4da06963dd89d130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b7e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200", [0xfffffffffffffffe]}}) ioctl$LOOP_SET_STATUS64(r10, 0x4c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2ac, 0x0, 0x1, 0x15, 0x0, "89753015418ab0cb0900245518580ce0c8bf604cca41f31c108938fcfa393ef569e0bcf244bb4b23555b130900000000000000d0f08e8ad896ba67a07673defa", "8b609009aaa722681a1e2513d754f688a9e306ee1dba533f02e1b69da6e26ec889fee40080000027cc7d24fdc26f1a95d702020000e4b8fb1703e47463b969e4", "ca1bf5ffffffffffffff6570128218a0d22915ff6eddb10000800400", [0xc]}) 0s ago: executing program 3 (id=3577): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000380)={0x2, 0x102000, 0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0xfffffffffffffffc) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000002340)={0x0, 0x0, @pic={0x7, 0x10, 0x4, 0x81, 0x0, 0xb, 0x81, 0x9, 0x5d, 0x1, 0x8, 0x40, 0x9, 0x0, 0x3, 0x4b}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000000c0)={0x3}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000140)={[{0x5, 0xc, 0x6, 0x3, 0x40, 0x2, 0x2, 0x9, 0x1, 0x4, 0x2, 0x9, 0x4}, {0xfffffffe, 0xc0, 0x7, 0x0, 0x1, 0x6, 0x9, 0xff, 0x1, 0x1, 0x4, 0x2f, 0xd}, {0x2, 0x5, 0x5, 0x84, 0x8, 0x7, 0x0, 0xc8, 0x5, 0x5, 0x2, 0x3}], 0xf87}) kernel console output (not intermixed with test programs): n up link [ 597.477940][T11317] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 597.492571][T16823] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 597.537575][T11317] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input28 [ 597.590568][T11317] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 597.623361][T16823] team0: Port device team_slave_0 added [ 597.624800][T11317] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 597.636488][ T5935] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 597.652169][T16823] team0: Port device team_slave_1 added [ 597.665132][ T5935] usb 4-1: device descriptor read/8, error -71 [ 597.673423][T11317] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 597.696675][T11317] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 597.745997][T11317] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 597.774042][ T3001] hsr_slave_0: left promiscuous mode [ 597.781361][ T3001] hsr_slave_1: left promiscuous mode [ 597.788588][T11317] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 597.791110][ T3001] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 597.804112][T16884] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2965'. [ 597.816663][T11317] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 597.825213][ T3001] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 597.836673][T11317] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 597.850795][ T3001] team0: left allmulticast mode [ 597.856500][ T3001] team_slave_0: left allmulticast mode [ 597.862506][ T3001] team_slave_1: left allmulticast mode [ 597.867938][T11317] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 597.878305][ T3001] batadv1: left allmulticast mode [ 597.893700][ T3001] team0: left promiscuous mode [ 597.898581][ T3001] team_slave_0: left promiscuous mode [ 597.906354][ T3001] team_slave_1: left promiscuous mode [ 597.906723][T11317] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 597.916574][ T3001] dummy0: left allmulticast mode [ 597.934558][ T5935] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 597.951156][ T3001] team0 (unregistering): Port device batadv1 removed [ 597.969815][T11317] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 597.982229][ T5935] usb 4-1: device descriptor read/8, error -71 [ 597.996507][ T5932] usb 5-1: new full-speed USB device number 103 using dummy_hcd [ 598.008497][T11317] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 598.035369][T11317] usb 6-1: USB disconnect, device number 70 [ 598.116782][ T5935] usb usb4-port1: unable to enumerate USB device [ 598.159110][ T5932] usb 5-1: config index 0 descriptor too short (expected 69, got 36) [ 598.170739][ T5932] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 598.184244][ T3001] team0 (unregistering): Port device team_slave_1 removed [ 598.190433][ T5932] usb 5-1: config 0 has no interfaces? [ 598.199821][ T5932] usb 5-1: New USB device found, idVendor=093a, idProduct=2622, bcdDevice=b7.89 [ 598.209297][ T5932] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.219878][ T5932] usb 5-1: Product: syz [ 598.219983][ T3001] team0 (unregistering): Port device team_slave_0 removed [ 598.224110][ T5932] usb 5-1: Manufacturer: syz [ 598.238590][ T5932] usb 5-1: SerialNumber: syz [ 598.244956][ T5932] usb 5-1: config 0 descriptor?? [ 598.308019][T16823] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 598.326704][T16823] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 598.355893][T16823] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 598.367831][T16823] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 598.375572][T16823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 598.402563][T16823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 598.447329][T16823] hsr_slave_0: entered promiscuous mode [ 598.453572][T16823] hsr_slave_1: entered promiscuous mode [ 598.472785][ T5932] usb 5-1: USB disconnect, device number 103 [ 598.488019][T16823] debugfs: 'hsr0' already exists in 'hsr' [ 598.493826][T16823] Cannot create hsr debugfs directory [ 599.052612][T16924] batadv0: entered promiscuous mode [ 599.058002][T16924] vlan2: entered promiscuous mode [ 599.091121][T16823] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 599.121334][T16823] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 599.406116][T16193] Bluetooth: hci4: command tx timeout [ 599.486309][ T5935] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 599.511953][T16823] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 599.551149][T16823] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 599.621534][T16943] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 599.654353][ T5935] usb 1-1: Using ep0 maxpacket: 32 [ 599.707984][ T5935] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 599.730908][T16823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 599.751886][ T5935] usb 1-1: config 0 has no interface number 0 [ 599.769302][T16823] 8021q: adding VLAN 0 to HW filter on device team0 [ 599.793358][ T3554] bridge0: port 1(bridge_slave_0) entered blocking state [ 599.800528][ T3554] bridge0: port 1(bridge_slave_0) entered forwarding state [ 599.835537][T16947] loop6: detected capacity change from 0 to 7 [ 599.843008][ T3554] bridge0: port 2(bridge_slave_1) entered blocking state [ 599.850113][ T3554] bridge0: port 2(bridge_slave_1) entered forwarding state [ 599.864504][ T5935] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 599.897604][T16947] Dev loop6: unable to read RDB block 7 [ 599.921630][T16823] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 599.962432][T16947] loop6: AHDI p2 p3 [ 599.975795][ T5935] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 599.986429][T16823] veth0_vlan: entered promiscuous mode [ 600.137137][T16823] veth1_vlan: entered promiscuous mode [ 600.155506][T16947] loop6: partition table partially beyond EOD, truncated [ 600.170681][T16823] veth0_macvtap: entered promiscuous mode [ 600.183079][T16823] veth1_macvtap: entered promiscuous mode [ 600.189282][ T5935] usb 1-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 600.201264][T16947] loop6: p2 start 3876867210 is beyond EOD, truncated [ 600.208622][T16823] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 600.231212][T16823] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 600.231653][ T5935] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 600.312814][ T3554] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.325025][ T5935] usb 1-1: config 0 descriptor?? [ 600.524501][ T3554] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.565153][ T3554] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.582493][ T3554] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.703130][T13419] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 600.717345][T13419] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 600.763036][T16921] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 600.777790][T16921] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 600.798255][ T5935] usbhid 1-1:0.1: can't add hid device: -71 [ 600.820338][ T5935] usbhid 1-1:0.1: probe with driver usbhid failed with error -71 [ 600.849871][ T5935] usb 1-1: USB disconnect, device number 103 [ 600.859048][T16972] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2981'. [ 600.881154][T16972] dummy0: entered promiscuous mode [ 600.896668][T16972] macsec1: entered promiscuous mode [ 600.902157][T16972] macsec1: entered allmulticast mode [ 600.908804][T16972] dummy0: entered allmulticast mode [ 600.940760][T16954] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 600.959242][T16954] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 600.983981][T16954] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 600.997487][T16954] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 601.010044][T16954] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 601.029406][T16954] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 601.065727][T16954] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 601.073122][T16954] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 601.123499][T16954] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 601.148407][T16954] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 601.274706][T11317] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 601.436263][T11317] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 601.453836][T11317] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 601.465048][T11317] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 601.476010][T11317] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 601.832198][T11317] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 601.844644][T11317] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 601.870071][T11317] usb 4-1: Manufacturer: syz [ 601.910558][T11317] usb 4-1: config 0 descriptor?? [ 602.054522][ T5935] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 602.227386][ T5935] usb 5-1: config 0 has no interfaces? [ 602.238478][ T5935] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 602.258459][ T5935] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 602.304356][ T5935] usb 5-1: Product: syz [ 602.322708][ T5935] usb 5-1: Manufacturer: syz [ 602.348110][ T5935] usb 5-1: SerialNumber: syz [ 602.354909][T11317] hid_parser_main: 1260 callbacks suppressed [ 602.354929][T11317] appleir 0003:05AC:8243.0017: unknown main item tag 0x0 [ 602.399749][ T5935] usb 5-1: config 0 descriptor?? [ 602.454477][T11317] appleir 0003:05AC:8243.0017: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 602.639124][ T1010] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.951987][ T5869] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 602.960575][ T5869] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 602.969854][ T5869] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 602.979865][ T5869] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 602.987618][ T5869] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 603.000298][T17046] RDS: rds_bind could not find a transport for fe80::1b, load rds_tcp or rds_rdma? [ 603.010371][T16193] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 603.018418][T16193] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 603.026068][T16193] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 603.033610][T16193] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 603.041370][T16193] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 603.182564][T17049] chnl_net:caif_netlink_parms(): no params data found [ 603.190817][ T5942] usb 4-1: USB disconnect, device number 95 [ 603.260087][T17049] bridge0: port 1(bridge_slave_0) entered blocking state [ 603.273441][T17049] bridge0: port 1(bridge_slave_0) entered disabled state [ 603.281221][T17049] bridge_slave_0: entered allmulticast mode [ 603.289897][T17049] bridge_slave_0: entered promiscuous mode [ 603.298250][T17049] bridge0: port 2(bridge_slave_1) entered blocking state [ 603.305916][T17049] bridge0: port 2(bridge_slave_1) entered disabled state [ 603.313300][T17049] bridge_slave_1: entered allmulticast mode [ 603.320928][T17049] bridge_slave_1: entered promiscuous mode [ 603.343757][T17049] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 603.355825][T17049] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 603.384033][T17049] team0: Port device team_slave_0 added [ 603.391114][T17049] team0: Port device team_slave_1 added [ 603.418795][T17049] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 603.426175][T17049] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 603.463424][T17049] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 603.480379][T17049] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 603.496052][T17049] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 603.547288][T17049] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 603.583779][T17049] hsr_slave_0: entered promiscuous mode [ 603.590614][T17049] hsr_slave_1: entered promiscuous mode [ 603.596993][T17049] debugfs: 'hsr0' already exists in 'hsr' [ 603.602733][T17049] Cannot create hsr debugfs directory [ 603.660943][ T1010] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 603.750816][ T1010] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 603.852820][ T1010] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 604.192708][ T1010] bridge_slave_1: left allmulticast mode [ 604.240222][ T1010] bridge_slave_1: left promiscuous mode [ 604.255251][T11317] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 604.285956][ T1010] bridge0: port 2(bridge_slave_1) entered disabled state [ 604.315345][ T1010] bridge_slave_0: left allmulticast mode [ 604.331097][ T1010] bridge_slave_0: left promiscuous mode [ 604.383340][ T1010] bridge0: port 1(bridge_slave_0) entered disabled state [ 604.424360][T11317] usb 4-1: Using ep0 maxpacket: 16 [ 604.431495][T11317] usb 4-1: unable to get BOS descriptor or descriptor too short [ 604.479334][T11317] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 604.511195][ T5935] usb 5-1: USB disconnect, device number 104 [ 604.519611][T11317] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 604.546638][T11317] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 604.601171][T11317] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 604.620990][T11317] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.646138][T11317] usb 4-1: Product: syz [ 604.655374][T11317] usb 4-1: Manufacturer: syz [ 604.756292][T11317] usb 4-1: SerialNumber: syz [ 604.943987][ T1010] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 604.977756][ T1010] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 604.982046][T17072] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2996'. [ 605.026791][ T1010] bond0 (unregistering): Released all slaves [ 605.045708][T11317] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 605.065829][T17098] bridge0: port 2(bridge_slave_1) entered disabled state [ 605.073094][T17098] bridge0: port 1(bridge_slave_0) entered disabled state [ 605.083167][T16193] Bluetooth: hci0: command tx timeout [ 605.142091][T11317] cdc_ncm 4-1:1.0: bind() failure [ 605.206731][T11317] usb 4-1: USB disconnect, device number 96 [ 605.372573][ T1010] hsr_slave_0: left promiscuous mode [ 605.383136][ T1010] hsr_slave_1: left promiscuous mode [ 605.391920][ T1010] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 605.406202][ T1010] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 605.414159][ T1010] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 605.455320][ T1010] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 605.495866][ T1010] veth1_macvtap: left promiscuous mode [ 605.504721][ T1010] veth0_macvtap: left promiscuous mode [ 605.529983][T17128] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3006'. [ 605.552538][ T1010] veth1_vlan: left promiscuous mode [ 605.566518][ T1010] veth0_vlan: left promiscuous mode [ 605.933739][T17147] netlink: 'syz.0.3008': attribute type 11 has an invalid length. [ 606.029212][ T1010] team0 (unregistering): Port device team_slave_1 removed [ 606.060558][ T1010] team0 (unregistering): Port device team_slave_0 removed [ 606.752843][T17049] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 606.781316][T17049] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 606.996813][T17049] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 607.017703][T17049] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 607.047823][ T30] audit: type=1326 audit(1755755706.986:1631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17165 comm="syz.5.3010" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa517d8ebe9 code=0x7ffc0000 [ 607.076918][ T30] audit: type=1326 audit(1755755706.986:1632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17165 comm="syz.5.3010" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa517d8ebe9 code=0x7ffc0000 [ 607.101945][ T30] audit: type=1326 audit(1755755707.026:1633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17165 comm="syz.5.3010" exe="/root/syz-executor" sig=0 arch=c000003e syscall=433 compat=0 ip=0x7fa517d8ebe9 code=0x7ffc0000 [ 607.129175][ T30] audit: type=1326 audit(1755755707.026:1634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17165 comm="syz.5.3010" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa517d8ebe9 code=0x7ffc0000 [ 607.184490][T16193] Bluetooth: hci0: command tx timeout [ 607.289837][T17188] loop6: detected capacity change from 0 to 7 [ 607.296783][T17188] Dev loop6: unable to read RDB block 7 [ 607.324951][T17189] input: syz1 as /devices/virtual/input/input30 [ 607.476287][ T30] audit: type=1326 audit(1755755707.026:1635): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17165 comm="syz.5.3010" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fa517d8ebe9 code=0x7ffc0000 [ 607.498776][ C0] vkms_vblank_simulate: vblank timer overrun [ 607.515983][T17188] loop6: unable to read partition table [ 607.534183][T17188] loop6: partition table beyond EOD, truncated [ 607.570175][T17188] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 607.571506][T17049] 8021q: adding VLAN 0 to HW filter on device bond0 [ 607.604453][ T30] audit: type=1326 audit(1755755707.026:1636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17165 comm="syz.5.3010" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa517d8ebe9 code=0x7ffc0000 [ 607.626909][ C0] vkms_vblank_simulate: vblank timer overrun [ 607.694383][ T30] audit: type=1326 audit(1755755707.026:1637): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17165 comm="syz.5.3010" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa517d8ebe9 code=0x7ffc0000 [ 607.856131][ T30] audit: type=1326 audit(1755755707.056:1638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17165 comm="syz.5.3010" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fa517d8ebe9 code=0x7ffc0000 [ 607.869865][T17049] 8021q: adding VLAN 0 to HW filter on device team0 [ 608.184281][T17204] binder: 17202:17204 ioctl 400c620e 0 returned -14 [ 608.214405][T17206] binder: 17202:17206 ioctl c0046209 0 returned -22 [ 608.500245][ T76] bridge0: port 1(bridge_slave_0) entered blocking state [ 608.507357][ T76] bridge0: port 1(bridge_slave_0) entered forwarding state [ 608.663499][ T76] bridge0: port 2(bridge_slave_1) entered blocking state [ 608.671139][ T76] bridge0: port 2(bridge_slave_1) entered forwarding state [ 608.747214][T17222] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3017'. [ 608.761410][T17215] syz_tun: entered allmulticast mode [ 608.948205][T17214] syz_tun: left allmulticast mode [ 608.957803][T17049] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 609.016710][T17049] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 609.054782][ T5942] usb 4-1: new low-speed USB device number 97 using dummy_hcd [ 609.219319][ T5942] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 609.231366][ T5942] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 609.269044][ T5942] usb 4-1: New USB device found, idVendor=05ac, idProduct=024b, bcdDevice= 0.00 [ 609.274358][T16193] Bluetooth: hci0: command tx timeout [ 609.289680][ T5942] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.323301][T17049] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 609.393481][ T5942] usb 4-1: config 0 descriptor?? [ 609.498951][T17049] veth0_vlan: entered promiscuous mode [ 609.525358][T17243] syzkaller0: entered allmulticast mode [ 609.541356][T17049] veth1_vlan: entered promiscuous mode [ 609.645020][T17049] veth0_macvtap: entered promiscuous mode [ 609.684117][T17049] veth1_macvtap: entered promiscuous mode [ 609.720284][T17049] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 609.741724][T17049] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 609.768988][T13419] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.785152][ T76] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.993179][ T76] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.083937][ T76] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.286788][T17271] netlink: zone id is out of range [ 610.292008][T17271] netlink: zone id is out of range [ 610.297664][T17271] netlink: zone id is out of range [ 610.340076][T17272] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3031'. [ 610.350125][ T76] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 610.360501][ T76] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 610.433478][ T3001] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 610.450067][ T3001] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 611.334384][T16193] Bluetooth: hci0: command tx timeout [ 611.366184][ T5942] usb 4-1: string descriptor 0 read error: -71 [ 611.374077][ T5942] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input31 [ 611.418523][ T5218] bcm5974 4-1:0.0: could not read from device [ 611.488210][ T5218] bcm5974 4-1:0.0: could not read from device [ 611.515745][ T5942] usb 4-1: USB disconnect, device number 97 [ 611.516102][ T5218] bcm5974 4-1:0.0: could not read from device [ 612.269190][T17317] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3043'. [ 612.288083][T11313] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 612.348625][T17323] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3046'. [ 612.407070][T17326] fuse: Bad value for 'rootmode' [ 612.508067][T11313] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 612.532362][T17336] binfmt_misc: register: failed to install interpreter file ./file0 [ 612.562160][T11313] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 612.572863][T11313] usb 4-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 612.583379][T11313] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 612.599939][T11313] usb 4-1: config 0 descriptor?? [ 612.602274][T17335] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3049'. [ 612.688820][T17338] pimreg3: entered allmulticast mode [ 612.718921][T17335] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3049'. [ 612.814507][ T5942] usb 5-1: new full-speed USB device number 105 using dummy_hcd [ 612.859661][T17342] vlan2: entered promiscuous mode [ 612.886829][T17344] syz_tun: entered allmulticast mode [ 612.893790][T17343] syz_tun: left allmulticast mode [ 612.954693][ T5935] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 613.026925][ T5942] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 613.038309][ T5942] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 613.044202][T11313] hid-steam 0003:28DE:1142.0018: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.3-1/input0 [ 613.050441][ T5942] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 613.068573][ T5942] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 613.077895][T17346] loop6: detected capacity change from 0 to 7 [ 613.084951][T17346] Dev loop6: unable to read RDB block 7 [ 613.089010][ T5942] usb 5-1: SerialNumber: syz [ 613.090537][T17346] loop6: AHDI p2 p3 [ 613.099120][ T5935] usb 6-1: device descriptor read/64, error -71 [ 613.111285][T17346] loop6: partition table partially beyond EOD, truncated [ 613.112161][ T5942] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 613.129219][ T5942] usb-storage 5-1:1.0: USB Mass Storage device detected [ 613.149706][ T5942] usb-storage 5-1:1.0: Quirks match for vid 0525 pid a4a5: 10000 [ 613.165763][T11313] hid-steam 0003:28DE:1142.0018: Steam wireless receiver connected [ 613.177955][T17346] loop6: p2 start 3876867210 is beyond EOD, truncated [ 613.186151][ T5942] scsi host1: usb-storage 5-1:1.0 [ 613.253821][T11313] hid-steam 0003:28DE:1142.0019: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.3-1/input0 [ 613.357246][ T5935] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 613.429978][T17353] syz_tun: entered allmulticast mode [ 613.460517][T17350] syz_tun: left allmulticast mode [ 613.504528][ T5935] usb 6-1: device descriptor read/64, error -71 [ 613.614778][ T5935] usb usb6-port1: attempt power cycle [ 613.755732][T17365] netlink: 'syz.4.3045': attribute type 3 has an invalid length. [ 613.763710][T17365] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3045'. [ 613.945717][ T8700] usb 4-1: USB disconnect, device number 98 [ 613.954403][ T5935] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 613.971500][ T8700] hid-steam 0003:28DE:1142.0018: Steam wireless receiver disconnected [ 613.979815][ T5942] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 613.984854][ T5935] usb 6-1: device descriptor read/8, error -71 [ 614.124437][ T5942] usb 1-1: device descriptor read/64, error -71 [ 614.234372][ T5935] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 614.264923][ T5935] usb 6-1: device descriptor read/8, error -71 [ 614.374418][ T5942] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 614.384796][ T5935] usb usb6-port1: unable to enumerate USB device [ 614.507980][ T5942] usb 1-1: device descriptor read/64, error -71 [ 614.634783][ T5942] usb usb1-port1: attempt power cycle [ 615.005310][ T5942] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 615.035962][ T5942] usb 1-1: device descriptor read/8, error -71 [ 615.080513][T17385] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3067'. [ 615.274412][ T5942] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 615.295094][ T5942] usb 1-1: device descriptor read/8, error -71 [ 615.364734][ T5932] usb 2-1: new full-speed USB device number 92 using dummy_hcd [ 615.405636][ T5942] usb usb1-port1: unable to enumerate USB device [ 615.513115][ T5935] usb 5-1: USB disconnect, device number 105 [ 615.530076][ T5932] usb 2-1: config index 0 descriptor too short (expected 69, got 36) [ 615.544428][ T5932] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 615.555540][ T5932] usb 2-1: config 0 has no interfaces? [ 615.563088][ T5932] usb 2-1: New USB device found, idVendor=093a, idProduct=2622, bcdDevice=b7.89 [ 615.577236][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.595147][ T5932] usb 2-1: Product: syz [ 615.599332][ T5932] usb 2-1: Manufacturer: syz [ 615.603923][ T5932] usb 2-1: SerialNumber: syz [ 615.614736][ T5932] usb 2-1: config 0 descriptor?? [ 615.836828][T17407] netlink: 'syz.3.3073': attribute type 27 has an invalid length. [ 615.957342][ T5932] usb 2-1: USB disconnect, device number 92 [ 616.110593][T17409] delete_channel: no stack [ 616.157525][T17407] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 616.178551][T17407] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 616.358861][T17407] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 616.417842][T17407] dummy0: left allmulticast mode [ 616.423091][T17407] macsec1: left promiscuous mode [ 616.438588][T17407] macsec1: left allmulticast mode [ 616.472915][T17410] 8021q: adding VLAN 0 to HW filter on device bond0 [ 616.495604][T17410] 8021q: adding VLAN 0 to HW filter on device team0 [ 616.513881][T17410] dummy0: left promiscuous mode [ 616.553192][T17410] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 616.583143][ T3554] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 616.594820][ T3554] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 616.638896][ T3554] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 616.715776][ T3554] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 616.755146][ T5913] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 616.922003][T17430] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3075'. [ 616.935328][ T5913] usb 4-1: Using ep0 maxpacket: 16 [ 616.942369][ T5913] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 616.951634][ T5913] usb 4-1: config 0 has no interface number 0 [ 616.965341][ T5913] usb 4-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 616.975860][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 616.984198][T17427] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3079'. [ 616.996206][ T5913] usb 4-1: Product: syz [ 617.001914][ T5913] usb 4-1: Manufacturer: syz [ 617.018907][ T5913] usb 4-1: SerialNumber: syz [ 617.033762][ T5913] usb 4-1: config 0 descriptor?? [ 617.069010][ T5913] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 617.644785][ T5913] gspca_spca1528: reg_w err -110 [ 617.714849][ T5913] spca1528 4-1:0.1: probe with driver spca1528 failed with error -110 [ 617.853286][T17440] batadv0: entered promiscuous mode [ 617.858993][T17440] vlan2: entered promiscuous mode [ 617.892159][T17442] loop6: detected capacity change from 0 to 7 [ 617.921781][T17442] Dev loop6: unable to read RDB block 7 [ 617.958700][T17442] loop6: AHDI p2 p3 [ 617.973593][T17442] loop6: partition table partially beyond EOD, truncated [ 617.982610][T17442] loop6: p2 start 3876867210 is beyond EOD, truncated [ 618.040659][T17446] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3086'. [ 618.194651][ T5913] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 618.376164][ T5913] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 618.389898][ T5913] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 618.399530][ T5913] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 618.407689][ T5913] usb 1-1: Product: syz [ 618.412182][ T5913] usb 1-1: Manufacturer: syz [ 618.417121][ T5913] usb 1-1: SerialNumber: syz [ 618.584904][ T5913] usb 1-1: config 0 descriptor?? [ 618.642266][ T5913] garmin_gps 1-1:0.0: Garmin GPS usb/tty converter detected [ 618.654867][ T5913] garmin_gps ttyUSB0: failed to submit interrupt urb: -22 [ 618.679285][ T5913] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -22 [ 618.806483][ T5913] usb 4-1: USB disconnect, device number 99 [ 619.059401][T17474] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3094'. [ 619.079318][T17474] loop6: detected capacity change from 0 to 524288000 [ 619.185568][T17476] support for the xor transformation has been removed. [ 620.254367][T11318] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 620.300415][T17488] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3098'. [ 620.396779][T17492] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3099'. [ 620.434419][T11318] usb 6-1: Using ep0 maxpacket: 16 [ 620.444703][T11318] usb 6-1: config 0 has an invalid interface number: 251 but max is 0 [ 620.453629][T11318] usb 6-1: config 0 has no interface number 0 [ 620.460071][T11318] usb 6-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 620.507286][T11318] usb 6-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 620.527811][T11318] usb 6-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 620.547847][T11318] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.571643][T11318] usb 6-1: Product: syz [ 620.582558][T11318] usb 6-1: Manufacturer: syz [ 620.595472][T11318] usb 6-1: SerialNumber: syz [ 620.608435][T11318] usb 6-1: config 0 descriptor?? [ 620.617527][T17480] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 620.625330][T17480] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 620.871943][T17479] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 620.881767][T17479] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 620.900725][T11318] asix 6-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 620.911069][T11318] asix 6-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -32 [ 620.921828][T11318] asix 6-1:0.251: probe with driver asix failed with error -5 [ 621.001130][T11318] usb 1-1: USB disconnect, device number 108 [ 621.135507][T11318] garmin_gps 1-1:0.0: device disconnected [ 621.356365][ T8700] usb 6-1: USB disconnect, device number 75 [ 621.444547][T11318] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 621.472646][T17513] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3106'. [ 621.594555][T11318] usb 1-1: Using ep0 maxpacket: 8 [ 621.601262][T11318] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 621.623119][T11318] usb 1-1: config 0 has no interface number 0 [ 621.630740][T11318] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 621.643527][T11318] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 621.692765][T11318] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 621.751395][T11318] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 621.772680][T11318] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 621.832721][T11318] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 621.849315][T11318] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 621.985016][T11318] usb 1-1: config 0 descriptor?? [ 622.026877][T11318] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 622.226271][T17507] ldusb 1-1:0.55: Couldn't submit interrupt_in_urb -90 [ 622.236935][ T1211] usb 1-1: USB disconnect, device number 109 [ 622.245604][ T1211] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 622.762937][T17548] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3112'. [ 622.874010][T17550] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3113'. [ 623.111049][T17559] loop6: detected capacity change from 0 to 7 [ 623.119956][T17559] Dev loop6: unable to read RDB block 7 [ 623.127109][T17559] loop6: AHDI p2 p3 [ 623.131301][T17559] loop6: partition table partially beyond EOD, truncated [ 623.140220][T17559] loop6: p2 start 3876867210 is beyond EOD, truncated [ 623.409496][T17563] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3117'. [ 623.459995][T17563] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3117'. [ 623.665931][T17568] vlan2: entered promiscuous mode [ 623.670987][T17568] batadv0: entered promiscuous mode [ 624.357249][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.363596][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.704692][ T5913] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 624.867167][ T5913] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 624.877766][ T5913] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 624.901985][ T5913] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 624.937679][ T5913] usb 6-1: config 0 descriptor?? [ 624.956428][ T5913] pwc: Askey VC010 type 2 USB webcam detected. [ 625.383658][ T5913] pwc: recv_control_msg error -32 req 02 val 2b00 [ 625.401365][ T5913] pwc: recv_control_msg error -32 req 02 val 2700 [ 625.425174][ T5913] pwc: recv_control_msg error -32 req 02 val 2c00 [ 625.439267][ T5913] pwc: recv_control_msg error -32 req 04 val 1000 [ 625.587839][T17615] binder: 17613:17615 ioctl 400c620e 200000001940 returned -22 [ 625.672234][T17584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 625.684173][T17584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 625.739707][ T5913] pwc: recv_control_msg error -71 req 04 val 1400 [ 625.747809][ T5913] pwc: recv_control_msg error -71 req 02 val 2000 [ 625.755170][ T5913] pwc: recv_control_msg error -71 req 02 val 2100 [ 625.856580][ T5913] pwc: recv_control_msg error -71 req 04 val 1500 [ 625.863474][ T5913] pwc: recv_control_msg error -71 req 02 val 2500 [ 625.871167][ T5913] pwc: recv_control_msg error -71 req 02 val 2400 [ 625.881775][ T5913] pwc: recv_control_msg error -71 req 02 val 2600 [ 625.888810][ T5913] pwc: recv_control_msg error -71 req 02 val 2900 [ 625.896122][ T5913] pwc: recv_control_msg error -71 req 02 val 2800 [ 625.903166][ T5913] pwc: recv_control_msg error -71 req 04 val 1100 [ 625.930855][ T5913] pwc: recv_control_msg error -71 req 04 val 1200 [ 625.941419][ T5913] pwc: Registered as video103. [ 625.977570][ T5913] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input32 [ 626.043955][ T5913] usb 6-1: USB disconnect, device number 76 [ 626.263096][T17636] loop6: detected capacity change from 0 to 7 [ 626.270755][T17636] Dev loop6: unable to read RDB block 7 [ 626.277638][T17636] loop6: unable to read partition table [ 626.283382][T17636] loop6: partition table beyond EOD, truncated [ 626.290922][T17636] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 626.374764][T17640] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3145'. [ 626.424197][T17644] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3147'. [ 626.433726][T17644] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3147'. [ 626.452209][T17644] team0: entered promiscuous mode [ 626.540172][T17644] team_slave_0: entered promiscuous mode [ 626.581473][T17644] team_slave_1: entered promiscuous mode [ 626.615025][T17644] debugfs: 'hsr1' already exists in 'hsr' [ 626.635617][T17644] Cannot create hsr debugfs directory [ 626.641575][T17644] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 626.714503][ T5913] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 626.747166][T17652] pim6reg: entered allmulticast mode [ 626.895332][ T5913] usb 6-1: Using ep0 maxpacket: 8 [ 626.930515][ T5913] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 626.956346][ T5913] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 626.992618][ T5913] usb 6-1: Product: syz [ 626.999410][ T5913] usb 6-1: Manufacturer: syz [ 627.004199][ T5913] usb 6-1: SerialNumber: syz [ 627.025688][ T5913] usb 6-1: config 0 descriptor?? [ 627.102732][T17663] vlan2: entered promiscuous mode [ 627.236261][T17670] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3155'. [ 627.296956][ T5913] usb 6-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 628.233519][ T30] audit: type=1326 audit(1755755728.076:1639): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17637 comm="syz.5.3143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa517d8ebe9 code=0x7ffc0000 [ 628.321909][ T30] audit: type=1326 audit(1755755728.076:1640): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17637 comm="syz.5.3143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=428 compat=0 ip=0x7fa517d8ebe9 code=0x7ffc0000 [ 628.565023][ T30] audit: type=1326 audit(1755755728.076:1641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17637 comm="syz.5.3143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa517d8ebe9 code=0x7ffc0000 [ 628.654763][ T30] audit: type=1326 audit(1755755728.076:1642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17637 comm="syz.5.3143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa517d8e7eb code=0x7ffc0000 [ 628.677112][ C1] vkms_vblank_simulate: vblank timer overrun [ 628.764388][ T5942] usb 5-1: new full-speed USB device number 106 using dummy_hcd [ 628.808225][ T30] audit: type=1326 audit(1755755728.076:1643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17637 comm="syz.5.3143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa517d8e7eb code=0x7ffc0000 [ 628.916224][ T5942] usb 5-1: config 0 has an invalid interface number: 158 but max is 0 [ 628.924706][ T5942] usb 5-1: config 0 has no interface number 0 [ 628.931077][ T5942] usb 5-1: config 0 interface 158 altsetting 129 endpoint 0xB has invalid wMaxPacketSize 0 [ 628.987504][ T5942] usb 5-1: config 0 interface 158 altsetting 129 endpoint 0xC has invalid maxpacket 512, setting to 64 [ 629.002389][ T30] audit: type=1326 audit(1755755728.076:1644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17637 comm="syz.5.3143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fa517dc14a5 code=0x7ffc0000 [ 629.004703][ T5942] usb 5-1: config 0 interface 158 has no altsetting 0 [ 629.025027][ C1] vkms_vblank_simulate: vblank timer overrun [ 629.038730][ T30] audit: type=1326 audit(1755755728.276:1645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17637 comm="syz.5.3143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa517d8ebe9 code=0x7ffc0000 [ 629.061180][ C1] vkms_vblank_simulate: vblank timer overrun [ 629.067449][T17710] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3170'. [ 629.079803][ T30] audit: type=1326 audit(1755755728.276:1646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17637 comm="syz.5.3143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa517d8e7eb code=0x7ffc0000 [ 629.107197][ T30] audit: type=1326 audit(1755755728.486:1647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17637 comm="syz.5.3143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa517d8e7eb code=0x7ffc0000 [ 629.129538][ C1] vkms_vblank_simulate: vblank timer overrun [ 629.137839][ T5942] usb 5-1: New USB device found, idVendor=110a, idProduct=1653, bcdDevice=22.aa [ 629.149057][ T5942] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 629.149575][ T5913] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 629.157261][ T5942] usb 5-1: Product: syz [ 629.171550][ T5942] usb 5-1: Manufacturer: syz [ 629.180269][ T5942] usb 5-1: SerialNumber: syz [ 629.192693][ T5942] usb 5-1: config 0 descriptor?? [ 629.198491][T17704] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 629.232176][ T5913] dvbdev: DVB: registering new adapter (Terratec H7) [ 629.248876][ T5913] usb 6-1: media controller created [ 629.255784][ T30] audit: type=1326 audit(1755755728.486:1648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17637 comm="syz.5.3143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fa517dc14a5 code=0x7ffc0000 [ 629.278211][ C1] vkms_vblank_simulate: vblank timer overrun [ 629.340866][ T5913] usb read operation failed. (-71) [ 629.352389][T17722] netlink: 'syz.1.3173': attribute type 27 has an invalid length. [ 629.454467][ T5942] mxuport 5-1:0.158: mxuport_send_ctrl_data_urb - usb_control_msg failed (-71) [ 629.470514][ T5913] dvb_usb_az6007 6-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 629.495975][ T5942] mxuport 5-1:0.158: mxuport_send_ctrl_data_urb - usb_control_msg failed (-71) [ 629.569942][T17722] bridge0: port 2(bridge_slave_1) entered disabled state [ 629.577421][T17722] bridge0: port 1(bridge_slave_0) entered disabled state [ 629.585010][ T5913] usb 6-1: USB disconnect, device number 77 [ 629.616149][ T5942] mxuport 5-1:0.158: probe with driver mxuport failed with error -71 [ 629.730210][ T5942] usb 5-1: USB disconnect, device number 106 [ 629.831685][T17722] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 629.852794][T17722] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 629.907841][T11318] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 630.086552][T11318] usb 2-1: Using ep0 maxpacket: 16 [ 630.136364][T11318] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 630.160832][T11318] usb 2-1: config 0 has no interface number 0 [ 630.204709][T11318] usb 2-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 630.214275][T11318] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 630.222507][T11318] usb 2-1: Product: syz [ 630.232672][T11318] usb 2-1: Manufacturer: syz [ 630.248987][T11318] usb 2-1: SerialNumber: syz [ 630.285027][T11318] usb 2-1: config 0 descriptor?? [ 630.306095][ T5869] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 630.314927][ T3554] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.326121][T11318] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 630.332957][ T3554] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.342459][ T5869] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 630.353055][ T3554] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.362989][ T5869] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 630.371421][ T3554] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.381499][ T5869] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 630.389221][ T5869] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 630.641818][T17747] loop6: detected capacity change from 0 to 7 [ 630.652561][T17747] Dev loop6: unable to read RDB block 7 [ 630.666259][T17747] loop6: unable to read partition table [ 630.712252][T17743] chnl_net:caif_netlink_parms(): no params data found [ 630.750197][T17747] loop6: partition table beyond EOD, truncated [ 630.776945][T17747] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 630.937763][T17743] bridge0: port 1(bridge_slave_0) entered blocking state [ 630.945326][T17743] bridge0: port 1(bridge_slave_0) entered disabled state [ 631.163240][T17743] bridge_slave_0: entered allmulticast mode [ 631.205685][T17743] bridge_slave_0: entered promiscuous mode [ 631.218669][T17743] bridge0: port 2(bridge_slave_1) entered blocking state [ 631.231735][T17743] bridge0: port 2(bridge_slave_1) entered disabled state [ 631.242290][T17743] bridge_slave_1: entered allmulticast mode [ 631.281779][T17743] bridge_slave_1: entered promiscuous mode [ 631.332514][T17759] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3182'. [ 631.455094][T17760] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 631.510532][T17762] loop6: detected capacity change from 0 to 524288000 [ 631.626150][T17762] support for the xor transformation has been removed. [ 631.752411][T17743] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 631.766275][T17743] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 631.829997][T17743] team0: Port device team_slave_0 added [ 631.837865][T17743] team0: Port device team_slave_1 added [ 631.874254][T17743] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 631.894187][T17743] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 632.058164][T17764] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3183'. [ 632.169059][T17743] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 632.244548][T17743] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 632.271869][T17743] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 632.300999][T17743] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 632.314698][T11318] gspca_spca1528: reg_w err -110 [ 632.319779][T11318] spca1528 2-1:0.1: probe with driver spca1528 failed with error -110 [ 632.443520][T16193] Bluetooth: hci1: command tx timeout [ 632.511939][T17743] hsr_slave_0: entered promiscuous mode [ 632.541775][T17743] hsr_slave_1: entered promiscuous mode [ 632.548090][T17743] debugfs: 'hsr0' already exists in 'hsr' [ 632.553916][T17743] Cannot create hsr debugfs directory [ 632.560184][ T3001] macsec2: left allmulticast mode [ 632.581421][ T3001] geneve1: left allmulticast mode [ 632.594264][ T3001] macsec2: left promiscuous mode [ 632.600653][ T3001] geneve1: left promiscuous mode [ 632.606401][ T3001] bridge0: port 1(macsec2) entered disabled state [ 632.747739][ T3001] bond0 (unregistering): left promiscuous mode [ 632.754578][ T3001] bond0 (unregistering): Released all slaves [ 632.763908][ T3001] bond1 (unregistering): Released all slaves [ 632.776644][ T3001] bond2 (unregistering): Released all slaves [ 632.787181][ T3001] bond3 (unregistering): Released all slaves [ 632.797495][ T3001] bond4 (unregistering): Released all slaves [ 632.807924][ T3001] bond5 (unregistering): Released all slaves [ 632.819619][ T3001] bond6 (unregistering): (slave vxcan3): Releasing backup interface [ 632.831533][ T3001] vxcan3: left promiscuous mode [ 632.839454][ T3001] bond6 (unregistering): Released all slaves [ 632.848455][ T3001] bond7 (unregistering): Released all slaves [ 632.884469][ T8700] usb 5-1: new full-speed USB device number 107 using dummy_hcd [ 632.937385][ T3001] tipc: Left network mode [ 633.050069][T11318] usb 2-1: USB disconnect, device number 93 [ 633.050124][ T8700] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 633.103308][ T8700] usb 5-1: New USB device found, idVendor=046d, idProduct=c08a, bcdDevice= 0.00 [ 633.132376][ T8700] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 633.153711][ T8700] usb 5-1: config 0 descriptor?? [ 633.190538][ T3001] hsr_slave_0: left promiscuous mode [ 633.203959][ T3001] hsr_slave_1: left promiscuous mode [ 634.229560][T17743] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 634.408638][T17743] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 634.461672][T17743] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 634.516373][T16193] Bluetooth: hci1: command tx timeout [ 634.591422][T17743] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 634.994646][T11314] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 635.034048][T17743] 8021q: adding VLAN 0 to HW filter on device bond0 [ 635.072254][T17743] 8021q: adding VLAN 0 to HW filter on device team0 [ 635.101294][ T1010] bridge0: port 1(bridge_slave_0) entered blocking state [ 635.108418][ T1010] bridge0: port 1(bridge_slave_0) entered forwarding state [ 635.132441][ T76] bridge0: port 2(bridge_slave_1) entered blocking state [ 635.139566][ T76] bridge0: port 2(bridge_slave_1) entered forwarding state [ 635.165993][T11314] usb 4-1: Using ep0 maxpacket: 32 [ 635.173046][T11314] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 635.242711][T11314] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 635.353540][T11314] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 635.379267][T11314] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 2763, setting to 1024 [ 635.410071][T17743] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 635.417770][T11314] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 635.446485][T11314] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 635.470902][T17743] veth0_vlan: entered promiscuous mode [ 635.480516][T11314] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 635.499440][T17743] veth1_vlan: entered promiscuous mode [ 635.506327][T11314] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 635.539265][T11314] usb 4-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 635.629123][T17743] veth0_macvtap: entered promiscuous mode [ 635.787069][ T8700] usbhid 5-1:0.0: can't add hid device: -71 [ 635.793081][ T8700] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 635.819908][T11314] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 635.840943][T17743] veth1_macvtap: entered promiscuous mode [ 636.015244][T11314] usb 4-1: config 0 descriptor?? [ 636.021547][T17835] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 636.039453][T17743] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 636.055982][T11314] usblp0: Disabling reads from problematic bidirectional printer [ 636.056026][ T8700] usb 5-1: USB disconnect, device number 107 [ 636.077555][T17743] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 636.216090][ T3554] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.235821][ T3554] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.251592][ T3554] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.305093][ T3554] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 636.371276][T17860] loop6: detected capacity change from 0 to 7 [ 636.380487][ T5995] Dev loop6: unable to read RDB block 7 [ 636.392974][ T5995] loop6: unable to read partition table [ 636.405270][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 636.413382][ T5995] loop6: partition table beyond EOD, truncated [ 636.419179][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 636.440759][T17860] Dev loop6: unable to read RDB block 7 [ 636.447770][T17860] loop6: unable to read partition table [ 636.464203][ T1010] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 636.477631][T17860] loop6: partition table beyond EOD, truncated [ 636.486474][T17860] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 636.508104][ T1010] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 636.583354][T17862] : entered promiscuous mode [ 636.594529][T16193] Bluetooth: hci1: command tx timeout [ 636.717375][T17875] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3206'. [ 636.994477][ T5913] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 637.074407][ T8700] usb 5-1: new full-speed USB device number 108 using dummy_hcd [ 637.166427][ T5913] usb 6-1: config 7 descriptor has 1 excess byte, ignoring [ 637.173783][ T5913] usb 6-1: config 7 has 1 interface, different from the descriptor's value: 2 [ 637.195716][ T5913] usb 6-1: New USB device found, idVendor=19d2, idProduct=1275, bcdDevice= 7.84 [ 637.208603][ T5913] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 637.218434][ T5913] usb 6-1: Product: syz [ 637.223235][ T5913] usb 6-1: Manufacturer: syz [ 637.230914][ T5913] usb 6-1: SerialNumber: syz [ 637.241954][ T5913] rndis_host 6-1:7.0: skipping garbage [ 637.248450][ T5913] usb 6-1: bad CDC descriptors [ 637.250038][ T8700] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 637.263728][ T5913] option 6-1:7.0: GSM modem (1-port) converter detected [ 637.263747][ T8700] usb 5-1: New USB device found, idVendor=046d, idProduct=c08a, bcdDevice= 0.00 [ 637.263772][ T8700] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 637.309230][ T8700] usb 5-1: config 0 descriptor?? [ 637.419959][T17885] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 637.444514][T17872] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 637.476132][T17872] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 637.503287][T17872] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3207'. [ 637.512404][T17872] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3207'. [ 637.628577][ T5913] usb 6-1: USB disconnect, device number 78 [ 637.648316][ T5913] option 6-1:7.0: device disconnected [ 637.764578][T11314] usblp 4-1:0.0: usblp0: USB Unidirectional printer dev 100 if 0 alt 0 proto 3 vid 0x03F0 pid 0x0004 [ 637.796560][T11314] usb 4-1: USB disconnect, device number 100 [ 637.815740][T11314] usblp0: removed [ 637.874601][ T5932] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 638.198022][T17898] loop6: detected capacity change from 0 to 7 [ 638.217056][T17898] Dev loop6: unable to read RDB block 7 [ 638.222761][T17898] loop6: AHDI p2 p3 [ 638.234542][ T5932] usb 2-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 638.247585][ T5932] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 638.288407][ T5932] usb 2-1: config 0 descriptor?? [ 638.304683][T17898] loop6: partition table partially beyond EOD, truncated [ 638.329231][T17898] loop6: p2 start 3876867210 is beyond EOD, truncated [ 638.531209][ T5932] hackrf 2-1:0.0: usb_control_msg() failed -71 request 0e [ 638.583819][ T5932] hackrf 2-1:0.0: Could not detect board [ 638.614517][ T5932] hackrf 2-1:0.0: probe with driver hackrf failed with error -71 [ 638.639972][ T5932] usb 2-1: USB disconnect, device number 94 [ 638.653001][T17914] team_slave_0: entered promiscuous mode [ 638.658779][T17914] team_slave_1: entered promiscuous mode [ 638.675114][T16193] Bluetooth: hci1: command tx timeout [ 638.676374][T17914] macsec1: entered promiscuous mode [ 638.697003][T17914] team0: entered promiscuous mode [ 638.703635][T17914] macsec1: entered allmulticast mode [ 638.716006][T17914] team0: entered allmulticast mode [ 638.723445][T17914] team_slave_0: entered allmulticast mode [ 638.730601][T17914] team_slave_1: entered allmulticast mode [ 638.736135][T17916] kvm: kvm [17915]: vcpu2, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x7 [ 638.748565][T17916] kvm: kvm [17915]: vcpu2, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x7 [ 639.019559][T17925] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3224'. [ 639.083365][T17928] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3225'. [ 639.117694][T17929] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3226'. [ 639.614472][ T5932] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 639.735120][T17954] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3233'. [ 639.750399][T17954] hub 9-0:1.0: USB hub found [ 639.755462][T17954] hub 9-0:1.0: 1 port detected [ 640.173529][ T5932] usb 6-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 640.201658][ T5932] usb 6-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 640.215461][ T8700] usbhid 5-1:0.0: can't add hid device: -71 [ 640.225158][ T8700] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 640.237700][ T5932] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 640.253257][ T8700] usb 5-1: USB disconnect, device number 108 [ 640.270442][ T5932] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 641.384568][ T5942] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 641.590713][ T5942] usb 5-1: Using ep0 maxpacket: 8 [ 641.602040][ T5942] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 641.757675][ T5942] usb 5-1: config 0 has no interface number 0 [ 641.769965][ T5942] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 641.793791][ T5942] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 641.821865][ T5942] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 641.851037][ T5942] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 641.892996][ T5942] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 641.916802][ T5942] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 641.941637][ T5942] usb 5-1: config 0 descriptor?? [ 642.024106][ T5942] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 642.313213][T17976] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 642.336423][ T43] usb 6-1: USB disconnect, device number 79 [ 642.349671][T17976] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 642.391513][T18002] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3247'. [ 642.408869][T11314] usb 5-1: USB disconnect, device number 109 [ 642.498331][T11314] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 642.498727][T18004] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3248'. [ 643.717897][T18039] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3258'. [ 643.799040][T18039] vlan2: entered allmulticast mode [ 643.805290][T18039] bridge0: entered allmulticast mode [ 644.504519][T11314] usb 6-1: new full-speed USB device number 80 using dummy_hcd [ 644.761413][T11314] usb 6-1: too many configurations: 32, using maximum allowed: 8 [ 644.775346][T11314] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 644.783149][T11314] usb 6-1: can't read configurations, error -61 [ 645.007923][T11314] usb 6-1: new full-speed USB device number 81 using dummy_hcd [ 645.164965][T11314] usb 6-1: too many configurations: 32, using maximum allowed: 8 [ 645.365726][T11314] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 645.373690][T11314] usb 6-1: can't read configurations, error -61 [ 645.430861][T11314] usb usb6-port1: attempt power cycle [ 645.459229][T18084] vlan2: entered promiscuous mode [ 645.616941][T18086] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3276'. [ 645.787994][T11314] usb 6-1: new full-speed USB device number 82 using dummy_hcd [ 645.827071][T11314] usb 6-1: too many configurations: 32, using maximum allowed: 8 [ 645.836280][T11314] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 645.844010][T11314] usb 6-1: can't read configurations, error -61 [ 645.946797][T18105] syz_tun: entered allmulticast mode [ 645.953424][T18104] syz_tun: left allmulticast mode [ 645.976625][T11314] usb 6-1: new full-speed USB device number 83 using dummy_hcd [ 646.006209][T11314] usb 6-1: too many configurations: 32, using maximum allowed: 8 [ 646.019388][T11314] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 646.032704][T11314] usb 6-1: can't read configurations, error -61 [ 646.045211][T11314] usb usb6-port1: unable to enumerate USB device [ 646.084457][ T5942] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 646.198016][T18109] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3285'. [ 646.207132][T18109] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3285'. [ 646.234441][ T5942] usb 2-1: Using ep0 maxpacket: 8 [ 646.248962][ T5942] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 646.264210][ T5942] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.273310][ T5942] usb 2-1: Product: syz [ 646.279708][ T5942] usb 2-1: Manufacturer: syz [ 646.288441][ T5942] usb 2-1: SerialNumber: syz [ 646.298790][ T5942] usb 2-1: config 0 descriptor?? [ 646.429991][T18111] loop6: detected capacity change from 0 to 7 [ 646.437768][T18111] Dev loop6: unable to read RDB block 7 [ 646.443557][T18111] loop6: unable to read partition table [ 646.451158][T18111] loop6: partition table beyond EOD, truncated [ 646.457993][T18111] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 646.516360][ T5942] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 646.613793][T18117] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3290'. [ 646.803847][T18122] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3291'. [ 647.740661][T18155] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3299'. [ 647.989139][ T5942] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 648.004414][ T5942] usb 2-1: USB disconnect, device number 95 [ 648.524369][ T5942] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 648.565929][T18182] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3311'. [ 648.664546][ T5913] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 648.685601][ T5942] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 648.695557][ T5942] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 648.709327][ T5942] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 648.718606][ T5942] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 648.814202][ T5942] usb 5-1: config 0 descriptor?? [ 648.864466][ T5932] usb 4-1: new full-speed USB device number 101 using dummy_hcd [ 648.885421][ T5913] usb 1-1: Using ep0 maxpacket: 8 [ 648.894289][ T5913] usb 1-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 648.913980][ T5913] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 648.926265][ T5913] usb 1-1: Product: syz [ 648.930578][ T5913] usb 1-1: Manufacturer: syz [ 648.935809][ T5913] usb 1-1: SerialNumber: syz [ 648.944897][ T5913] usb 1-1: config 0 descriptor?? [ 648.953146][ T5913] radio-usb-si4713 1-1:0.0: Si4713 development board discovered: (10C4:8244) [ 649.027352][ T5932] usb 4-1: config 5 has an invalid interface number: 123 but max is 0 [ 649.036011][ T5932] usb 4-1: config 5 has no interface number 0 [ 649.042594][ T5932] usb 4-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 649.056229][ T5932] usb 4-1: config 5 interface 123 altsetting 7 endpoint 0x4 has invalid wMaxPacketSize 0 [ 649.066697][ T5932] usb 4-1: config 5 interface 123 has no altsetting 0 [ 649.076878][ T5932] usb 4-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 649.086164][ T5932] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 649.100589][ T5932] usb 4-1: Product: syz [ 649.105043][ T5932] usb 4-1: Manufacturer: syz [ 649.111838][ T5932] usb 4-1: SerialNumber: syz [ 649.251519][ T5942] kovaplus 0003:1E7D:2D50.001A: hidraw0: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.4-1/input0 [ 649.329255][T18177] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 649.339015][T18177] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 649.353656][T18177] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 649.363432][T18177] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 649.382525][ T5932] ni6501 4-1:5.123: driver 'ni6501' failed to auto-configure device. [ 649.395391][ T5932] usb 4-1: USB disconnect, device number 101 [ 649.452527][ T5942] kovaplus 0003:1E7D:2D50.001A: couldn't init struct kovaplus_device [ 649.490407][ T5942] kovaplus 0003:1E7D:2D50.001A: couldn't install mouse [ 649.492377][ T43] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 649.510008][ T5942] kovaplus 0003:1E7D:2D50.001A: probe with driver kovaplus failed with error -71 [ 649.531108][ T5942] usb 5-1: USB disconnect, device number 110 [ 649.561539][ T5913] radio-usb-si4713 1-1:0.0: probe with driver radio-usb-si4713 failed with error -71 [ 649.571647][ T5913] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 649.582303][ T5913] usb 1-1: USB disconnect, device number 110 [ 649.665353][ T43] usb 2-1: Using ep0 maxpacket: 32 [ 649.721968][ T43] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 649.731218][ T43] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 649.740021][ T43] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 649.749631][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 649.765067][ T43] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 649.775190][ T43] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 649.789522][ T43] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 649.799311][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 649.813588][ T43] usb 2-1: config 0 descriptor?? [ 649.904459][ T5932] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 650.004012][T18195] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3316'. [ 650.086596][ T5932] usb 6-1: Using ep0 maxpacket: 32 [ 650.116325][ T5932] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 650.152119][ T5932] usb 6-1: config 0 has no interface number 0 [ 650.160215][ T5932] usb 6-1: config 0 interface 184 has no altsetting 0 [ 650.175009][ T5932] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 650.184118][ T5932] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 650.192893][ T5932] usb 6-1: Product: syz [ 650.197309][ T5932] usb 6-1: Manufacturer: syz [ 650.201982][ T5932] usb 6-1: SerialNumber: syz [ 650.232046][ T5932] usb 6-1: config 0 descriptor?? [ 650.258982][ T5932] smsc75xx v1.0.0 [ 650.264073][T18202] syz_tun: entered allmulticast mode [ 650.272855][ T5932] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 650.305301][T18201] syz_tun: left allmulticast mode [ 650.310586][ T5932] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -22 [ 650.354557][ T43] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 96 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 650.368384][ T43] usb 2-1: USB disconnect, device number 96 [ 650.377216][ T43] usblp0: removed [ 650.454477][ T8700] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 650.488729][T18192] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 650.500487][T18192] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 650.634979][ T8700] usb 1-1: Using ep0 maxpacket: 16 [ 650.672142][ T8700] usb 1-1: unable to get BOS descriptor or descriptor too short [ 650.695519][ T8700] usb 1-1: config 0 has an invalid interface number: 161 but max is 0 [ 650.714591][ T43] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 650.741306][ T8700] usb 1-1: config 0 has no interface number 0 [ 650.771493][ T8700] usb 1-1: config 0 interface 161 has no altsetting 0 [ 650.796960][ T8700] usb 1-1: string descriptor 0 read error: -22 [ 650.805374][ T8700] usb 1-1: New USB device found, idVendor=16d8, idProduct=7002, bcdDevice= 1.79 [ 650.819789][ T8700] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 650.846143][ T8700] usb 1-1: config 0 descriptor?? [ 650.852979][T18222] loop6: detected capacity change from 0 to 7 [ 650.859594][T18222] Dev loop6: unable to read RDB block 7 [ 650.866290][T18222] loop6: unable to read partition table [ 650.872002][T18222] loop6: partition table beyond EOD, truncated [ 650.880998][ T43] usb 2-1: device descriptor read/64, error -71 [ 650.885289][ T8700] option 1-1:0.161: GSM modem (1-port) converter detected [ 650.907458][T18222] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 651.102125][ T8700] usb 1-1: USB disconnect, device number 111 [ 651.111976][ T8700] option 1-1:0.161: device disconnected [ 651.184404][ T43] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 651.284385][ T5932] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 651.310743][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 651.310756][ T30] audit: type=1400 audit(1755755751.256:1656): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name="://&aaaaa" pid=18219 comm="syz.3.3323" [ 651.336582][ C1] vkms_vblank_simulate: vblank timer overrun [ 651.342875][ T43] usb 2-1: device descriptor read/64, error -71 [ 651.504485][ T5932] usb 5-1: Using ep0 maxpacket: 32 [ 651.679032][ T5932] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 651.732068][ T43] usb usb2-port1: attempt power cycle [ 651.754448][ T5932] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 651.773618][ T5932] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 651.797460][ T5932] usb 5-1: config 1 has no interface number 0 [ 651.813727][ T5932] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 651.858513][ T5932] usb 5-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 651.918559][ T5932] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 652.245333][ T5932] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 652.276692][ T43] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 652.302301][ T5932] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 652.495265][T11314] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 652.522379][ T5932] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now attached [ 652.658400][ T5932] usb 6-1: USB disconnect, device number 84 [ 652.705804][T11314] usb 4-1: New USB device found, idVendor=05ac, idProduct=0290, bcdDevice=dc.1b [ 652.733880][T18236] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3328'. [ 652.744474][T11314] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 652.757180][T11314] usb 4-1: config 0 descriptor?? [ 652.769523][T11314] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input34 [ 652.902647][ T43] usb 2-1: device descriptor read/8, error -71 [ 652.951597][T11314] usb 5-1: USB disconnect, device number 111 [ 652.959234][T11314] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 652.970083][ T5913] usb 4-1: USB disconnect, device number 102 [ 653.114531][ T5932] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 653.274463][ T5932] usb 1-1: Using ep0 maxpacket: 16 [ 653.283950][ T5932] usb 1-1: config 5 has an invalid interface number: 168 but max is 0 [ 653.294440][ T5932] usb 1-1: config 5 has no interface number 0 [ 653.300672][ T5932] usb 1-1: config 5 interface 168 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 653.330200][ T5932] usb 1-1: config 5 interface 168 altsetting 7 bulk endpoint 0x8B has invalid maxpacket 1024 [ 653.352888][ T5932] usb 1-1: config 5 interface 168 altsetting 7 bulk endpoint 0x4 has invalid maxpacket 1023 [ 653.363974][ T5932] usb 1-1: config 5 interface 168 has no altsetting 0 [ 653.377146][ T5932] usb 1-1: New USB device found, idVendor=04cc, idProduct=2533, bcdDevice=fc.58 [ 653.390651][ T5932] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 653.399609][ T5932] usb 1-1: Product: syz [ 653.403865][ T5932] usb 1-1: Manufacturer: syz [ 653.409458][ T5932] usb 1-1: SerialNumber: syz [ 653.417212][T18240] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 653.424800][T18240] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 653.640443][ C0] usb 1-1: NFC: Urb failure (status -71) [ 653.646427][ C0] usb 1-1: NFC: Urb failure (status -71) [ 653.652308][ T5932] usb 1-1: NFC: Unable to get FW version [ 653.658507][ T5932] pn533_usb 1-1:5.168: probe with driver pn533_usb failed with error -71 [ 653.670603][ T5932] usb 1-1: USB disconnect, device number 112 [ 653.784708][T11314] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 653.915044][T11314] usb 5-1: device descriptor read/64, error -71 [ 653.944420][ T5913] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 653.949421][T18264] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3340'. [ 654.047714][T18268] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3341'. [ 654.059309][T18268] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 654.096025][ T5913] usb 4-1: Using ep0 maxpacket: 8 [ 654.104913][ T5913] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 654.115847][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 654.125902][ T5913] usb 4-1: Product: syz [ 654.130079][ T5913] usb 4-1: Manufacturer: syz [ 654.140441][ T5913] usb 4-1: SerialNumber: syz [ 654.152806][ T5913] usb 4-1: config 0 descriptor?? [ 654.158498][T11314] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 654.305357][T11314] usb 5-1: device descriptor read/64, error -71 [ 654.380796][ T5913] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 654.390001][T18291] batadv0: entered promiscuous mode [ 654.397468][T18291] vlan2: entered promiscuous mode [ 654.406647][ T5913] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 654.429402][ T5913] usb 4-1: USB disconnect, device number 103 [ 654.438422][T11314] usb usb5-port1: attempt power cycle [ 654.673361][T18299] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.3347'. [ 654.784470][T11314] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 654.815199][T11314] usb 5-1: device descriptor read/8, error -71 [ 655.079626][T18307] loop6: detected capacity change from 0 to 7 [ 655.086661][T11314] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 655.094927][T18307] Dev loop6: unable to read RDB block 7 [ 655.100666][T18307] loop6: unable to read partition table [ 655.106482][T18307] loop6: partition table beyond EOD, truncated [ 655.112774][T18307] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 655.135833][T11314] usb 5-1: device descriptor read/8, error -71 [ 655.245914][T11314] usb usb5-port1: unable to enumerate USB device [ 655.618693][T18323] input: syz1 as /devices/virtual/input/input36 [ 655.684379][T11314] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 655.856025][T11314] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 655.872677][T11314] usb 4-1: config 0 interface 0 has no altsetting 0 [ 655.883310][T11314] usb 4-1: New USB device found, idVendor=044e, idProduct=1215, bcdDevice= 0.00 [ 655.898497][T11314] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 655.919099][T11314] usb 4-1: config 0 descriptor?? [ 656.054416][T11318] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 656.173186][T18328] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3359'. [ 656.205326][T11318] usb 1-1: Using ep0 maxpacket: 16 [ 656.216609][T11318] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 656.229372][T11318] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 656.242639][T11318] usb 1-1: New USB device found, idVendor=056e, idProduct=00fe, bcdDevice= 0.00 [ 656.261296][T11318] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 656.271603][T11318] usb 1-1: config 0 descriptor?? [ 656.336438][T11314] hid-alps 0003:044E:1215.001B: hidraw0: USB HID v0.04 Device [HID 044e:1215] on usb-dummy_hcd.3-1/input0 [ 656.514454][T11314] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 656.532900][T18319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 656.542194][T18319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 656.555524][T18319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 656.565264][T18319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 656.592028][ T5913] usb 4-1: USB disconnect, device number 104 [ 656.664480][T11314] usb 2-1: Using ep0 maxpacket: 32 [ 656.673351][T11314] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 656.695397][T11318] elecom 0003:056E:00FE.001C: item fetching failed at offset 6/7 [ 656.703469][T11318] elecom 0003:056E:00FE.001C: probe with driver elecom failed with error -22 [ 656.780188][T11314] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 656.806770][T11314] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 656.825986][T11314] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 656.839538][T11314] usb 2-1: config 0 interface 0 has no altsetting 0 [ 656.849125][T11314] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 656.859068][T11314] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 656.868329][T11314] usb 2-1: Product: syz [ 656.872641][T11314] usb 2-1: Manufacturer: syz [ 656.877445][T11314] usb 2-1: SerialNumber: syz [ 656.890762][T11314] usb 2-1: config 0 descriptor?? [ 656.899553][T11314] ldusb 2-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 656.926148][T11314] ldusb 2-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 656.926161][T18326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 656.926395][T18326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 656.984561][ T5913] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 657.028578][T11314] usb 1-1: USB disconnect, device number 113 [ 657.109163][T11318] usb 2-1: USB disconnect, device number 101 [ 657.116636][T11318] ldusb 2-1:0.0: LD USB Device #0 now disconnected [ 657.145604][ T5913] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 657.155987][ T5913] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 657.167265][ T5913] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 657.180527][ T5913] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 657.211346][ T5913] usb 4-1: SerialNumber: syz [ 657.264287][ T1010] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.309106][ T1010] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.366920][ T1010] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.384808][ T5869] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 657.392778][ T5869] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 657.400215][ T5869] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 657.407983][ T5869] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 657.415458][ T5869] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 657.469550][ T1010] bond0: (slave netdevsim0): Releasing backup interface [ 657.477944][ T1010] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.650781][T18351] FAULT_INJECTION: forcing a failure. [ 657.650781][T18351] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 657.666211][T18351] CPU: 1 UID: 0 PID: 18351 Comm: syz.0.3366 Not tainted syzkaller #0 PREEMPT(full) [ 657.666236][T18351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 657.666248][T18351] Call Trace: [ 657.666255][T18351] [ 657.666263][T18351] dump_stack_lvl+0x189/0x250 [ 657.666303][T18351] ? __pfx____ratelimit+0x10/0x10 [ 657.666325][T18351] ? __pfx_dump_stack_lvl+0x10/0x10 [ 657.666344][T18351] ? __pfx__printk+0x10/0x10 [ 657.666364][T18351] ? __might_fault+0xb0/0x130 [ 657.666387][T18351] ? preempt_count_add+0x91/0x1a0 [ 657.666412][T18351] ? rcu_is_watching+0x15/0xb0 [ 657.666431][T18351] should_fail_ex+0x414/0x560 [ 657.666455][T18351] _copy_from_user+0x2d/0xb0 [ 657.666476][T18351] __sys_bpf+0x1ed/0x870 [ 657.666497][T18351] ? __pfx___sys_bpf+0x10/0x10 [ 657.666522][T18351] ? ksys_write+0x1e1/0x250 [ 657.666544][T18351] ? __pfx_ksys_write+0x10/0x10 [ 657.666563][T18351] ? rcu_is_watching+0x15/0xb0 [ 657.666581][T18351] __x64_sys_bpf+0x7c/0x90 [ 657.666600][T18351] do_syscall_64+0xfa/0x3b0 [ 657.666624][T18351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 657.666642][T18351] ? clear_bhb_loop+0x60/0xb0 [ 657.666662][T18351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 657.666679][T18351] RIP: 0033:0x7f324578ebe9 [ 657.666695][T18351] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 657.666712][T18351] RSP: 002b:00007f3246523038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 657.666732][T18351] RAX: ffffffffffffffda RBX: 00007f32459b5fa0 RCX: 00007f324578ebe9 [ 657.666747][T18351] RDX: 0000000000000020 RSI: 0000200000000240 RDI: 0000000000000004 [ 657.666759][T18351] RBP: 00007f3246523090 R08: 0000000000000000 R09: 0000000000000000 [ 657.666771][T18351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 657.666782][T18351] R13: 00007f32459b6038 R14: 00007f32459b5fa0 R15: 00007f3245adfa28 [ 657.666802][T18351] [ 657.810677][T18345] chnl_net:caif_netlink_parms(): no params data found [ 657.879262][ T1010] macsec5: left allmulticast mode [ 657.886288][ T1010] macsec5: left promiscuous mode [ 657.891382][ T1010] bridge0: port 3(macsec5) entered disabled state [ 657.899547][ T1010] bridge_slave_1: left allmulticast mode [ 657.925242][ T1010] bridge_slave_1: left promiscuous mode [ 657.931312][ T1010] bridge0: port 2(bridge_slave_1) entered disabled state [ 657.938657][ T5932] usb 5-1: new full-speed USB device number 116 using dummy_hcd [ 657.975587][ T1010] : left allmulticast mode [ 657.980212][ T1010] : left promiscuous mode [ 657.985986][ T1010] bridge0: port 1() entered disabled state [ 658.065995][ T5913] usb 4-1: 0:2 : does not exist [ 658.073049][ T5913] usb 4-1: unit 5 not found! [ 658.089465][ T5913] usb 4-1: USB disconnect, device number 105 [ 658.111262][ T5932] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 658.114152][ T5995] udevd[5995]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 658.122592][ T5932] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 658.166650][ T5932] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 658.177752][ T5932] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 658.203069][ T5932] usb 5-1: config 0 descriptor?? [ 658.220120][ T5932] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 658.228031][ T5932] dvb-usb: bulk message failed: -22 (3/0) [ 658.237323][ T5932] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 658.247767][ T5932] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 658.254855][ T5932] usb 5-1: media controller created [ 658.260637][ T5932] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 658.273292][ T5932] dvb-usb: bulk message failed: -22 (6/0) [ 658.279521][ T8700] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 658.279678][ T1010] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 658.288435][ T5932] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 658.304190][ T1010] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 658.306369][ T5932] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input37 [ 658.325387][ T5932] dvb-usb: schedule remote query interval to 150 msecs. [ 658.325512][ T1010] bond0 (unregistering): Released all slaves [ 658.332341][ T5932] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 658.353561][ T1010] bond1 (unregistering): Released all slaves [ 658.362600][ T1010] bond2 (unregistering): Released all slaves [ 658.408449][T18375] binder: 18374:18375 ioctl c0046209 200000000000000 returned -22 [ 658.435459][T18348] dvb-usb: bulk message failed: -22 (2/0) [ 658.464436][ T8700] usb 1-1: Using ep0 maxpacket: 32 [ 658.471008][ T8700] usb 1-1: config 0 has an invalid interface number: 202 but max is 1 [ 658.479475][ T5913] usb 5-1: USB disconnect, device number 116 [ 658.489512][ T8700] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 658.502848][ T8700] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 658.512714][ T1010] : left promiscuous mode [ 658.517825][ T8700] usb 1-1: config 0 has no interface number 0 [ 658.523995][ T8700] usb 1-1: too many endpoints for config 0 interface 202 altsetting 87: 182, using maximum allowed: 30 [ 658.535541][ T8700] usb 1-1: config 0 interface 202 altsetting 87 endpoint 0x2 has invalid maxpacket 255, setting to 64 [ 658.547656][ T8700] usb 1-1: config 0 interface 202 altsetting 87 has 1 endpoint descriptor, different from the interface descriptor's value: 182 [ 658.553082][ T5913] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 658.560956][ T8700] usb 1-1: config 0 interface 202 has no altsetting 0 [ 658.579052][ T8700] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.2b [ 658.588216][ T8700] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 658.597193][ T8700] usb 1-1: Product: syz [ 658.601364][ T8700] usb 1-1: Manufacturer: syz [ 658.619768][ T8700] usb 1-1: SerialNumber: syz [ 658.627644][ T8700] usb 1-1: config 0 descriptor?? [ 658.663097][ T1010] tipc: Left network mode [ 658.663181][T18345] bridge0: port 1(bridge_slave_0) entered blocking state [ 658.678130][ T8700] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 658.701250][T18345] bridge0: port 1(bridge_slave_0) entered disabled state [ 658.723460][T18345] bridge_slave_0: entered allmulticast mode [ 658.733397][T18345] bridge_slave_0: entered promiscuous mode [ 658.748355][T18345] bridge0: port 2(bridge_slave_1) entered blocking state [ 658.764468][T18345] bridge0: port 2(bridge_slave_1) entered disabled state [ 658.768792][T18390] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3373'. [ 658.781302][T18345] bridge_slave_1: entered allmulticast mode [ 658.793960][T18345] bridge_slave_1: entered promiscuous mode [ 658.906473][T18345] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 658.937032][T18345] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 659.103533][T18345] team0: Port device team_slave_0 added [ 659.120599][T18408] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3376'. [ 659.137772][T18345] team0: Port device team_slave_1 added [ 659.190321][T18408] macsec1: entered promiscuous mode [ 659.211239][T18408] dummy0: entered promiscuous mode [ 659.233265][T18408] macsec1: entered allmulticast mode [ 659.242989][T18408] dummy0: entered allmulticast mode [ 659.261795][T18415] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3377'. [ 659.297245][T18345] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 659.315371][T18345] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 659.351057][T18345] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 659.475113][ T5869] Bluetooth: hci4: command tx timeout [ 659.488386][ T1010] hsr_slave_0: left promiscuous mode [ 659.502233][ T1010] hsr_slave_1: left promiscuous mode [ 659.516214][ T1010] pimreg3 (unregistering): left allmulticast mode [ 659.714554][T13419] usb 1-1: Failed to submit usb control message: -110 [ 659.721403][T13419] usb 1-1: unable to send the bmi data to the device: -110 [ 659.729901][T13419] usb 1-1: unable to get target info from device [ 659.736588][T13419] usb 1-1: could not get target info (-110) [ 659.742730][ T1010] team_slave_1 (unregistering): left promiscuous mode [ 659.757125][T13419] usb 1-1: could not probe fw (-110) [ 659.762841][ T1010] team0 (unregistering): Port device team_slave_1 removed [ 659.785887][ T1010] team_slave_0 (unregistering): left promiscuous mode [ 659.793430][T18427] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3380'. [ 659.803027][ T1010] team0 (unregistering): Port device team_slave_0 removed [ 659.848461][T18429] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3380'. [ 659.869811][T18415] dummy0: entered promiscuous mode [ 659.877583][T18415] macsec1: entered promiscuous mode [ 659.882865][T18415] macsec1: entered allmulticast mode [ 659.888509][T18415] dummy0: entered allmulticast mode [ 659.901855][T18430] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3380'. [ 659.912791][T18345] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 659.940150][T18345] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 659.967870][T18345] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 660.021555][T18345] hsr_slave_0: entered promiscuous mode [ 660.032658][T18345] hsr_slave_1: entered promiscuous mode [ 660.043961][T18345] debugfs: 'hsr0' already exists in 'hsr' [ 660.055716][T18345] Cannot create hsr debugfs directory [ 660.456160][T18345] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 660.472739][T18345] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 660.489407][T18345] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 660.500660][T18345] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 660.560401][T18457] syz_tun: entered allmulticast mode [ 660.568499][T18456] syz_tun: left allmulticast mode [ 660.627607][T18345] 8021q: adding VLAN 0 to HW filter on device bond0 [ 660.660078][T18345] 8021q: adding VLAN 0 to HW filter on device team0 [ 660.676335][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 660.683464][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 660.706777][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 660.713873][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 660.763617][T18345] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 660.879316][T18345] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 660.989871][T18345] veth0_vlan: entered promiscuous mode [ 661.010311][ T8700] usb 1-1: USB disconnect, device number 114 [ 661.030274][T18345] veth1_vlan: entered promiscuous mode [ 661.129466][T18345] veth0_macvtap: entered promiscuous mode [ 661.161116][T18345] veth1_macvtap: entered promiscuous mode [ 661.200116][T18345] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 661.221688][T18345] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 661.238084][ T1010] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 661.267136][ T1010] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 661.292311][ T1010] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 661.309521][T18486] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3388'. [ 661.319613][ T5932] usb 5-1: new full-speed USB device number 117 using dummy_hcd [ 661.337500][ T1010] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 661.340361][T18486] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3388'. [ 661.384266][T18486] team0: entered promiscuous mode [ 661.390658][T18486] team_slave_0: entered promiscuous mode [ 661.397421][T18486] team_slave_1: entered promiscuous mode [ 661.405553][T18486] bond0: entered promiscuous mode [ 661.410662][T18486] bond_slave_0: entered promiscuous mode [ 661.416939][T18486] bond_slave_1: entered promiscuous mode [ 661.423819][T18486] hsr1: Slave A (team0) is not up; please bring it up to get a fully working HSR network [ 661.434159][T18486] hsr1: Slave B (bond0) is not up; please bring it up to get a fully working HSR network [ 661.444234][ T8700] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 661.453419][T18486] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 661.482605][ T1010] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 661.496283][ T5932] usb 5-1: unable to get BOS descriptor or descriptor too short [ 661.517274][ T5932] usb 5-1: not running at top speed; connect to a high speed hub [ 661.529524][ T1010] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 661.542769][ T5932] usb 5-1: config 1 interface 0 altsetting 110 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 661.556186][ T5869] Bluetooth: hci4: command tx timeout [ 661.574682][ T8700] usb 1-1: device descriptor read/64, error -71 [ 661.585470][ T5932] usb 5-1: config 1 interface 0 has no altsetting 0 [ 661.599784][T13419] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 661.601438][ T5932] usb 5-1: New USB device found, idVendor=056a, idProduct=0035, bcdDevice= 0.40 [ 661.629825][ T5932] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 661.633305][T13419] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 661.663857][ T5932] usb 5-1: Product: syz [ 661.687610][ T5932] usb 5-1: Manufacturer: syz [ 661.692254][ T5932] usb 5-1: SerialNumber: syz [ 661.834544][ T8700] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 661.982713][ T5932] usbhid 5-1:1.0: can't add hid device: -71 [ 661.990429][ T5932] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 662.012199][ T5932] usb 5-1: USB disconnect, device number 117 [ 662.024426][ T8700] usb 1-1: device descriptor read/64, error -71 [ 662.024786][T11318] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 662.162463][ T8700] usb usb1-port1: attempt power cycle [ 662.244456][T11318] usb 6-1: Using ep0 maxpacket: 16 [ 662.245730][T11318] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 662.252250][T11318] usb 6-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 662.252277][T11318] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.252292][T11318] usb 6-1: Product: syz [ 662.252300][T11318] usb 6-1: Manufacturer: syz [ 662.252308][T11318] usb 6-1: SerialNumber: syz [ 662.253314][T11318] usb 6-1: config 0 descriptor?? [ 662.256507][T11318] hub 6-1:0.0: bad descriptor, ignoring hub [ 662.256522][T11318] hub 6-1:0.0: probe with driver hub failed with error -5 [ 662.257716][T11318] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input38 [ 662.624538][ T8700] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 662.860166][ T8700] usb 1-1: device descriptor read/8, error -71 [ 663.066927][T11317] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 663.124443][ T8700] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 663.148323][ T8700] usb 1-1: device descriptor read/8, error -71 [ 663.224576][T11317] usb 5-1: Using ep0 maxpacket: 32 [ 663.247686][T11317] usb 5-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 663.258254][T11317] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 663.276062][T11317] usb 5-1: config 0 descriptor?? [ 663.284824][ T8700] usb usb1-port1: unable to enumerate USB device [ 663.287961][T11317] gspca_main: sq930x-2.14.0 probing 041e:403c [ 663.495317][T11318] usb 6-1: USB disconnect, device number 85 [ 663.508992][T18558] bridge1: entered promiscuous mode [ 663.682719][ T5869] Bluetooth: hci4: command tx timeout [ 663.856854][ T9] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 663.864612][ T8700] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 664.014581][ T9] usb 4-1: device descriptor read/64, error -71 [ 664.023800][ T8700] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 664.045073][ T8700] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 664.059411][ T8700] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 664.069307][ T8700] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 664.084835][ T8700] usb 2-1: config 0 descriptor?? [ 664.145321][T18567] FAULT_INJECTION: forcing a failure. [ 664.145321][T18567] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 664.168499][T18567] CPU: 1 UID: 0 PID: 18567 Comm: syz.0.3401 Not tainted syzkaller #0 PREEMPT(full) [ 664.168532][T18567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 664.168543][T18567] Call Trace: [ 664.168551][T18567] [ 664.168559][T18567] dump_stack_lvl+0x189/0x250 [ 664.168584][T18567] ? __pfx____ratelimit+0x10/0x10 [ 664.168606][T18567] ? __pfx_dump_stack_lvl+0x10/0x10 [ 664.168624][T18567] ? __pfx__printk+0x10/0x10 [ 664.168644][T18567] ? __might_fault+0xb0/0x130 [ 664.168670][T18567] ? rcu_is_watching+0x15/0xb0 [ 664.168688][T18567] should_fail_ex+0x414/0x560 [ 664.168712][T18567] _copy_from_user+0x2d/0xb0 [ 664.168731][T18567] __sys_bpf+0x1ed/0x870 [ 664.168754][T18567] ? __pfx___sys_bpf+0x10/0x10 [ 664.168778][T18567] ? ksys_write+0x22a/0x250 [ 664.168801][T18567] ? __pfx_ksys_write+0x10/0x10 [ 664.168824][T18567] __x64_sys_bpf+0x7c/0x90 [ 664.168844][T18567] do_syscall_64+0xfa/0x3b0 [ 664.168869][T18567] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.168892][T18567] ? clear_bhb_loop+0x60/0xb0 [ 664.168911][T18567] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.168928][T18567] RIP: 0033:0x7f324578ebe9 [ 664.168942][T18567] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 664.168957][T18567] RSP: 002b:00007f3246523038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 664.168976][T18567] RAX: ffffffffffffffda RBX: 00007f32459b5fa0 RCX: 00007f324578ebe9 [ 664.168989][T18567] RDX: 0000000000000094 RSI: 00002000000000c0 RDI: 0000000000000005 [ 664.169001][T18567] RBP: 00007f3246523090 R08: 0000000000000000 R09: 0000000000000000 [ 664.169013][T18567] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 664.169024][T18567] R13: 00007f32459b6038 R14: 00007f32459b5fa0 R15: 00007f3245adfa28 [ 664.169041][T18567] [ 664.414399][ T9] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 664.549455][T18577] FAULT_INJECTION: forcing a failure. [ 664.549455][T18577] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 664.562916][T18577] CPU: 1 UID: 0 PID: 18577 Comm: syz.0.3404 Not tainted syzkaller #0 PREEMPT(full) [ 664.562942][T18577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 664.562953][T18577] Call Trace: [ 664.562962][T18577] [ 664.562970][T18577] dump_stack_lvl+0x189/0x250 [ 664.562998][T18577] ? __pfx____ratelimit+0x10/0x10 [ 664.563013][T18577] ? __pfx_dump_stack_lvl+0x10/0x10 [ 664.563024][T18577] ? __pfx__printk+0x10/0x10 [ 664.563037][T18577] ? rcu_is_watching+0x15/0xb0 [ 664.563048][T18577] should_fail_ex+0x414/0x560 [ 664.563064][T18577] _copy_to_user+0x31/0xb0 [ 664.563084][T18577] simple_read_from_buffer+0xe1/0x170 [ 664.563110][T18577] proc_fail_nth_read+0x1b3/0x220 [ 664.563131][T18577] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 664.563148][T18577] ? rw_verify_area+0x2a6/0x4d0 [ 664.563160][T18577] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 664.563170][T18577] vfs_read+0x200/0xa30 [ 664.563182][T18577] ? map_get_next_key+0x4d4/0x5f0 [ 664.563195][T18577] ? __pfx_vfs_read+0x10/0x10 [ 664.563213][T18577] ? __sys_bpf+0x65e/0x870 [ 664.563235][T18577] ? __pfx___sys_bpf+0x10/0x10 [ 664.563261][T18577] ksys_read+0x145/0x250 [ 664.563282][T18577] ? __pfx_ksys_read+0x10/0x10 [ 664.563297][T18577] ? rcu_is_watching+0x15/0xb0 [ 664.563307][T18577] ? rcu_is_watching+0x15/0xb0 [ 664.563316][T18577] do_syscall_64+0xfa/0x3b0 [ 664.563331][T18577] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.563340][T18577] ? clear_bhb_loop+0x60/0xb0 [ 664.563350][T18577] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.563366][T18577] RIP: 0033:0x7f324578d5fc [ 664.563382][T18577] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 664.563398][T18577] RSP: 002b:00007f3246523030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 664.563418][T18577] RAX: ffffffffffffffda RBX: 00007f32459b5fa0 RCX: 00007f324578d5fc [ 664.563432][T18577] RDX: 000000000000000f RSI: 00007f32465230a0 RDI: 0000000000000005 [ 664.563440][T18577] RBP: 00007f3246523090 R08: 0000000000000000 R09: 0000000000000000 [ 664.563446][T18577] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 664.563452][T18577] R13: 00007f32459b6038 R14: 00007f32459b5fa0 R15: 00007f3245adfa28 [ 664.563463][T18577] [ 664.787118][ T9] usb 4-1: device descriptor read/64, error -71 [ 664.846599][T11317] gspca_sq930x: ucbus_write failed -71 [ 664.852124][T11317] sq930x 5-1:0.0: probe with driver sq930x failed with error -71 [ 664.860978][T11317] usb 5-1: USB disconnect, device number 118 [ 664.894636][ T9] usb usb4-port1: attempt power cycle [ 664.933127][ T8700] usbhid 2-1:0.0: can't add hid device: -71 [ 664.939158][ T8700] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 664.950102][ T8700] usb 2-1: USB disconnect, device number 102 [ 665.234391][ T9] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 665.254797][ T9] usb 4-1: device descriptor read/8, error -71 [ 665.494446][ T9] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 665.532736][ T9] usb 4-1: device descriptor read/8, error -71 [ 665.560520][T18591] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3408'. [ 665.645501][ T9] usb usb4-port1: unable to enumerate USB device [ 665.714745][ T5869] Bluetooth: hci4: command tx timeout [ 665.742966][T18596] vlan3: entered promiscuous mode [ 665.775593][T18598] loop6: detected capacity change from 0 to 7 [ 665.782413][T18598] Dev loop6: unable to read RDB block 7 [ 665.811368][T18598] loop6: unable to read partition table [ 665.824512][T18598] loop6: partition table beyond EOD, truncated [ 665.839214][T18598] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 666.011388][T18608] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3416'. [ 666.079458][T18610] fuse: Bad value for 'rootmode' [ 666.375225][T11317] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 666.566446][T11317] usb 5-1: config 0 has no interfaces? [ 666.573806][T11317] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 666.584030][T11317] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.593058][T11317] usb 5-1: Product: syz [ 666.598647][T11317] usb 5-1: Manufacturer: syz [ 666.607230][T11317] usb 5-1: SerialNumber: syz [ 666.626223][T11317] usb 5-1: config 0 descriptor?? [ 667.099636][T18635] loop6: detected capacity change from 0 to 7 [ 667.109234][T18635] Dev loop6: unable to read RDB block 7 [ 667.139030][T18635] loop6: AHDI p2 p3 [ 667.149496][T18635] loop6: partition table partially beyond EOD, truncated [ 667.226193][T18635] loop6: p2 start 3876867210 is beyond EOD, truncated [ 667.644390][ T9] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 667.794652][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 667.803138][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 667.830042][ T9] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 667.839228][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 667.862106][ T9] usb 1-1: config 0 descriptor?? [ 668.291780][ T9] mcp2221 0003:04D8:00DD.001D: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 668.504224][T18664] bridge1: entered promiscuous mode [ 668.694417][ T8700] usb 1-1: USB disconnect, device number 119 [ 668.755063][T18641] syz.1.3425 (18641): drop_caches: 1 [ 668.766021][T18637] syz.1.3425 (18637): drop_caches: 1 [ 668.804417][ T9] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 668.964784][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 668.972232][ T9] usb 6-1: config index 0 descriptor too short (expected 28277, got 36) [ 668.981038][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 668.991190][ T9] usb 6-1: config 0 has no interfaces? [ 668.996867][ T9] usb 6-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 669.005948][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 669.015907][ T9] usb 6-1: config 0 descriptor?? [ 669.109484][T11317] usb 5-1: USB disconnect, device number 119 [ 669.143515][ T5869] Bluetooth: hci0: Malformed HCI Event: 0x22 [ 669.465042][T11317] usb 6-1: USB disconnect, device number 86 [ 669.744461][ T1211] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 669.897672][ T1211] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 669.911298][ T1211] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 669.931422][ T1211] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 669.951830][ T1211] usb 2-1: New USB device found, idVendor=0eef, idProduct=72d0, bcdDevice= 0.00 [ 669.965103][ T1211] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 670.088637][ T1211] usb 2-1: config 0 descriptor?? [ 670.154441][ T8700] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 670.284442][ T8700] usb 1-1: device descriptor read/64, error -71 [ 670.521286][ T1211] usbhid 2-1:0.0: can't add hid device: -71 [ 670.529787][ T8700] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 670.537656][ T1211] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 670.561999][ T1211] usb 2-1: USB disconnect, device number 103 [ 670.684580][ T8700] usb 1-1: device descriptor read/64, error -71 [ 670.701764][T18715] FAULT_INJECTION: forcing a failure. [ 670.701764][T18715] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 670.717423][T18715] CPU: 1 UID: 0 PID: 18715 Comm: syz.4.3447 Not tainted syzkaller #0 PREEMPT(full) [ 670.717440][T18715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 670.717446][T18715] Call Trace: [ 670.717450][T18715] [ 670.717455][T18715] dump_stack_lvl+0x189/0x250 [ 670.717471][T18715] ? __pfx____ratelimit+0x10/0x10 [ 670.717486][T18715] ? __pfx_dump_stack_lvl+0x10/0x10 [ 670.717497][T18715] ? __pfx__printk+0x10/0x10 [ 670.717509][T18715] ? __might_fault+0xb0/0x130 [ 670.717523][T18715] ? rcu_is_watching+0x15/0xb0 [ 670.717534][T18715] should_fail_ex+0x414/0x560 [ 670.717547][T18715] _copy_from_user+0x2d/0xb0 [ 670.717559][T18715] vmemdup_user+0x59/0xd0 [ 670.717570][T18715] map_get_next_key+0x1be/0x5f0 [ 670.717583][T18715] ? bpf_lsm_bpf+0x9/0x20 [ 670.717595][T18715] ? security_bpf+0x7e/0x300 [ 670.717608][T18715] __sys_bpf+0x65e/0x870 [ 670.717620][T18715] ? __pfx___sys_bpf+0x10/0x10 [ 670.717634][T18715] ? ksys_write+0x1e1/0x250 [ 670.717647][T18715] ? __pfx_ksys_write+0x10/0x10 [ 670.717660][T18715] __x64_sys_bpf+0x7c/0x90 [ 670.717671][T18715] do_syscall_64+0xfa/0x3b0 [ 670.717685][T18715] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 670.717694][T18715] ? clear_bhb_loop+0x60/0xb0 [ 670.717705][T18715] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 670.717715][T18715] RIP: 0033:0x7f0b7fd8ebe9 [ 670.717728][T18715] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 670.717742][T18715] RSP: 002b:00007f0b80b77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 670.717762][T18715] RAX: ffffffffffffffda RBX: 00007f0b7ffb5fa0 RCX: 00007f0b7fd8ebe9 [ 670.717774][T18715] RDX: 0000000000000020 RSI: 0000200000000240 RDI: 0000000000000004 [ 670.717785][T18715] RBP: 00007f0b80b77090 R08: 0000000000000000 R09: 0000000000000000 [ 670.717796][T18715] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 670.717802][T18715] R13: 00007f0b7ffb6038 R14: 00007f0b7ffb5fa0 R15: 00007f0b800dfa28 [ 670.717813][T18715] [ 670.925219][ C1] vkms_vblank_simulate: vblank timer overrun [ 670.934486][ T8700] usb usb1-port1: attempt power cycle [ 671.006434][T18721] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3450'. [ 671.285717][ T8700] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 671.319976][T18732] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3451'. [ 671.331364][ T8700] usb 1-1: device descriptor read/8, error -71 [ 671.584583][ T8700] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 671.625270][ T8700] usb 1-1: device descriptor read/8, error -71 [ 671.734657][ T8700] usb usb1-port1: unable to enumerate USB device [ 673.456584][T18769] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3463'. [ 673.615039][T18771] loop6: detected capacity change from 0 to 7 [ 673.641041][T18771] Dev loop6: unable to read RDB block 7 [ 673.662161][T18771] loop6: AHDI p2 p3 [ 673.695466][T18771] loop6: partition table partially beyond EOD, truncated [ 673.708931][T18771] loop6: p2 start 3876867210 is beyond EOD, truncated [ 674.641759][T18793] sctp: [Deprecated]: syz.5.3469 (pid 18793) Use of int in maxseg socket option. [ 674.641759][T18793] Use struct sctp_assoc_value instead [ 674.828960][T18804] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3474'. [ 675.130336][T18822] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 675.141378][T18822] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 675.246229][T18822] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 675.341086][T18822] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 675.384837][ T1211] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 675.812488][T18841] input: syz0 as /devices/virtual/input/input39 [ 676.465712][T18852] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3489'. [ 676.502595][T18852] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3489'. [ 676.513809][T18854] loop6: detected capacity change from 0 to 7 [ 676.522549][T18854] Dev loop6: unable to read RDB block 7 [ 676.542115][T18854] loop6: unable to read partition table [ 676.584758][T18854] loop6: partition table beyond EOD, truncated [ 676.600369][T18854] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 676.859447][T18858] vlan2: entered promiscuous mode [ 677.991733][ T9] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 678.154349][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 678.176083][T18883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 678.187048][T18883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 678.202851][T18883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 678.213074][T18883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 679.114874][ T5913] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 679.237501][T18913] loop6: detected capacity change from 0 to 7 [ 679.250628][T18913] Dev loop6: unable to read RDB block 7 [ 679.256617][T18913] loop6: AHDI p2 p3 [ 679.260682][T18913] loop6: partition table partially beyond EOD, truncated [ 679.268243][T18913] loop6: p2 start 3876867210 is beyond EOD, truncated [ 679.488679][ T5913] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 679.505692][ T5913] usb 6-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice=ca.f3 [ 679.522567][ T5913] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.546137][ T5913] usb 6-1: Product: syz [ 679.552416][ T5913] usb 6-1: Manufacturer: syz [ 679.557966][ T5913] usb 6-1: SerialNumber: syz [ 679.600252][ T5913] usb 6-1: config 0 descriptor?? [ 679.610145][ T5913] ljca 6-1:0.0: bulk endpoints not found [ 679.827745][ T5913] usb 6-1: USB disconnect, device number 87 [ 680.544391][ T5913] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 680.706797][ T5913] usb 5-1: device descriptor read/64, error -71 [ 680.721989][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 680.730988][ T9] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 680.753259][ T9] usb 2-1: can't read configurations, error -71 [ 680.769217][T18953] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3514'. [ 680.833772][T18959] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3516'. [ 680.856429][T18959] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3516'. [ 681.047770][ T5913] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 681.225773][ T5913] usb 5-1: device descriptor read/64, error -71 [ 681.364594][ T5913] usb usb5-port1: attempt power cycle [ 681.615696][T11317] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 681.714387][ T5913] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 681.719504][T18975] bridge0: port 2(bridge_slave_1) entered disabled state [ 681.729553][T18975] bridge0: port 1(bridge_slave_0) entered disabled state [ 681.744921][ T5913] usb 5-1: device descriptor read/8, error -71 [ 681.787628][T11317] usb 4-1: Using ep0 maxpacket: 32 [ 681.801568][T11317] usb 4-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 681.812554][T11317] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 681.866280][T11317] usb 4-1: config 0 descriptor?? [ 681.936617][T11317] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 682.012090][ T5913] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 682.106516][ T5913] usb 5-1: device descriptor read/8, error -71 [ 682.254639][ T5913] usb usb5-port1: unable to enumerate USB device [ 682.424643][T18987] vlan2: entered promiscuous mode [ 682.954052][T18993] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3526'. [ 683.724853][T11317] gspca_vc032x: reg_w err -110 [ 683.729697][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 683.735318][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 683.752082][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 683.773373][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 683.791380][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 683.848676][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 683.866786][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 683.914214][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 683.982175][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 684.008900][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 684.063448][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 684.088286][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 684.106870][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 684.141445][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 684.176885][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 684.199930][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 684.219646][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 684.244960][T11317] gspca_vc032x: I2c Bus Busy Wait 00 [ 684.275761][T11317] gspca_vc032x: Unknown sensor... [ 684.314928][T11317] vc032x 4-1:0.0: probe with driver vc032x failed with error -22 [ 684.546697][T11314] usb 4-1: USB disconnect, device number 110 [ 684.740630][T19046] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 684.774062][T19046] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 685.104507][T11314] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 685.192305][T19054] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3543'. [ 685.284429][T19054] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3543'. [ 685.353558][T11314] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 685.363924][T11314] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 685.501031][T11314] usb 4-1: New USB device found, idVendor=0499, idProduct=5ae2, bcdDevice= 9.0f [ 685.514367][T11314] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=7 [ 685.532537][T11314] usb 4-1: Product: syz [ 685.546439][T11314] usb 4-1: Manufacturer: syz [ 685.561395][T11314] usb 4-1: SerialNumber: syz [ 685.572468][T11314] usb 4-1: config 0 descriptor?? [ 685.763942][T19057] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3544'. [ 685.813127][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.823589][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.911481][T19048] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 685.921333][T19048] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 686.720082][T19075] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3550'. [ 687.113987][T19083] gre2: entered promiscuous mode [ 687.142850][T19083] gre2: entered allmulticast mode [ 687.251452][T19089] loop6: detected capacity change from 0 to 7 [ 687.262867][ T5966] Dev loop6: unable to read RDB block 7 [ 687.279174][ T5966] loop6: AHDI p2 p3 [ 687.293474][ T5966] loop6: partition table partially beyond EOD, truncated [ 687.344923][ T5966] loop6: p2 start 3876867210 is beyond EOD, truncated [ 687.376577][T19089] Dev loop6: unable to read RDB block 7 [ 687.382538][T19089] loop6: AHDI p2 p3 [ 687.386640][T19089] loop6: partition table partially beyond EOD, truncated [ 687.393866][T19089] loop6: p2 start 3876867210 is beyond EOD, truncated [ 688.430490][ T9] usb 2-1: new full-speed USB device number 106 using dummy_hcd [ 688.606697][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 688.625784][ T9] usb 2-1: New USB device found, idVendor=046d, idProduct=c08a, bcdDevice= 0.00 [ 688.671764][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 688.714869][ T9] usb 2-1: config 0 descriptor?? [ 689.086988][T19110] ALSA: mixer_oss: invalid OSS volume ':' [ 689.093164][T19110] ALSA: mixer_oss: invalid OSS volume '010000E0' [ 689.099834][T19110] ALSA: mixer_oss: invalid OSS volume '2' [ 689.110385][T19110] ALSA: mixer_oss: invalid OSS volume '010000E0' [ 689.203177][T19110] ALSA: mixer_oss: invalid OSS volume '3' [ 689.222056][T19110] ALSA: mixer_oss: invalid OSS volume '010000E0' [ 689.845433][T19130] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3564'. [ 690.686991][ T5995] udevd[5995]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 690.797795][T19134] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3567'. [ 690.944113][T19137] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3568'. [ 691.113564][T19141] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3570'. [ 691.198342][T19143] syz_tun: entered allmulticast mode [ 691.211531][T19142] syz_tun: left allmulticast mode [ 691.310624][ T9] usbhid 2-1:0.0: can't add hid device: -71 [ 691.321393][ T9] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 691.414423][ T9] usb 2-1: USB disconnect, device number 106 [ 691.569922][T19152] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3575'. [ 692.989954][T19164] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3576'. [ 797.854318][ C0] rcu: INFO: rcu_preempt self-detected stall on CPU [ 797.860945][ C0] rcu: 0-...!: (1 GPs behind) idle=e6d4/1/0x4000000000000000 softirq=121886/121896 fqs=69 [ 797.870912][ C0] rcu: (t=10500 jiffies g=91677 q=204 ncpus=2) [ 797.877144][ C0] rcu: rcu_preempt kthread timer wakeup didn't happen for 10181 jiffies! g91677 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 [ 797.889435][ C0] rcu: Possible timer handling issue on cpu=1 timer-softirq=38942 [ 797.897295][ C0] rcu: rcu_preempt kthread starved for 10182 jiffies! g91677 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1 [ 797.908635][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 797.918574][ C0] rcu: RCU grace-period kthread stack dump: [ 797.924437][ C0] task:rcu_preempt state:I stack:27656 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00004000 [ 797.936341][ C0] Call Trace: [ 797.939596][ C0] [ 797.942504][ C0] __schedule+0x1798/0x4cc0 [ 797.946998][ C0] ? rcu_is_watching+0x15/0xb0 [ 797.951745][ C0] ? __pfx___schedule+0x10/0x10 [ 797.956570][ C0] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 797.962451][ C0] ? schedule+0x91/0x360 [ 797.966664][ C0] ? rcu_is_watching+0x15/0xb0 [ 797.971400][ C0] ? lock_release+0x4b/0x3e0 [ 797.975975][ C0] schedule+0x165/0x360 [ 797.980106][ C0] schedule_timeout+0x12b/0x270 [ 797.984935][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 797.990285][ C0] ? rcu_is_watching+0x15/0xb0 [ 797.995022][ C0] ? __pfx_process_timeout+0x10/0x10 [ 798.000303][ C0] ? prepare_to_swait_event+0x341/0x380 [ 798.005823][ C0] rcu_gp_fqs_loop+0x301/0x1540 [ 798.010654][ C0] ? __pfx_rcu_watching_snap_recheck+0x10/0x10 [ 798.016784][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 798.022044][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 798.027653][ C0] ? finish_swait+0xcd/0x1f0 [ 798.032222][ C0] rcu_gp_kthread+0x99/0x390 [ 798.036792][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 798.041962][ C0] ? __kthread_parkme+0x7b/0x200 [ 798.046899][ C0] ? __kthread_parkme+0x1a1/0x200 [ 798.051901][ C0] kthread+0x70e/0x8a0 [ 798.056032][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 798.061205][ C0] ? __pfx_kthread+0x10/0x10 [ 798.065770][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 798.070944][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 798.076117][ C0] ? __pfx_kthread+0x10/0x10 [ 798.080701][ C0] ret_from_fork+0x3f9/0x770 [ 798.085292][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 798.090378][ C0] ? __switch_to_asm+0x39/0x70 [ 798.095120][ C0] ? __switch_to_asm+0x33/0x70 [ 798.099878][ C0] ? __pfx_kthread+0x10/0x10 [ 798.104462][ C0] ret_from_fork_asm+0x1a/0x30 [ 798.109210][ C0] [ 798.112206][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 798.118506][ C0] Sending NMI from CPU 0 to CPUs 1: [ 798.123705][ C1] NMI backtrace for cpu 1 [ 798.123723][ C1] CPU: 1 UID: 0 PID: 5995 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 798.123743][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 798.123753][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 798.123778][ C1] Code: 53 e7 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 b6 0e 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 798.123792][ C1] RSP: 0018:ffffc90000a087b8 EFLAGS: 00000246 [ 798.123808][ C1] RAX: ffffffff8172213d RBX: 0000000000000003 RCX: ffff888025963c00 [ 798.123820][ C1] RDX: 0000000000000100 RSI: ffffffff8be33660 RDI: ffffffff8172210b [ 798.123832][ C1] RBP: ffffc90000a08890 R08: ffffffff8fa38337 R09: 1ffffffff1f47066 [ 798.123845][ C1] R10: dffffc0000000000 R11: fffffbfff1f47067 R12: dffffc0000000000 [ 798.123857][ C1] R13: 0000000000000200 R14: 0000000000000003 R15: 1ffff920001410fc [ 798.123869][ C1] FS: 0000000000000000(0000) GS:ffff888125d1b000(0000) knlGS:0000000000000000 [ 798.123882][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 798.123894][ C1] CR2: 00005559a35d4840 CR3: 000000000df36000 CR4: 00000000003526f0 [ 798.123910][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 798.123920][ C1] DR3: 000000000000e58e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 798.123932][ C1] Call Trace: [ 798.123939][ C1] [ 798.123946][ C1] kvm_wait+0x232/0x290 [ 798.123967][ C1] ? __pfx_kvm_wait+0x10/0x10 [ 798.123996][ C1] __pv_queued_spin_lock_slowpath+0x7bf/0xb60 [ 798.124021][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 798.124040][ C1] ? __pfx___pv_queued_spin_lock_slowpath+0x10/0x10 [ 798.124067][ C1] queued_spin_lock_slowpath+0x43/0x50 [ 798.124087][ C1] do_raw_spin_lock+0x21f/0x290 [ 798.124106][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 798.124128][ C1] __xfrm_state_delete+0xba/0xca0 [ 798.124150][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 798.124168][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 798.124185][ C1] ? page_table_check_clear+0x21/0x700 [ 798.124208][ C1] xfrm_timer_handler+0x18f/0xa00 [ 798.124232][ C1] ? __pfx_xfrm_timer_handler+0x10/0x10 [ 798.124252][ C1] ? rcu_is_watching+0x15/0xb0 [ 798.124269][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 798.124288][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 798.124313][ C1] ? __pfx_xfrm_timer_handler+0x10/0x10 [ 798.124334][ C1] ? __pfx_xfrm_timer_handler+0x10/0x10 [ 798.124355][ C1] __hrtimer_run_queues+0x52c/0xc60 [ 798.124377][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 798.124392][ C1] ? read_tsc+0x9/0x20 [ 798.124413][ C1] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 798.124432][ C1] hrtimer_run_softirq+0x187/0x2b0 [ 798.124450][ C1] handle_softirqs+0x283/0x870 [ 798.124467][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 798.124484][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 798.124503][ C1] __irq_exit_rcu+0xca/0x1f0 [ 798.124519][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 798.124538][ C1] irq_exit_rcu+0x9/0x30 [ 798.124551][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 798.124571][ C1] [ 798.124577][ C1] [ 798.124584][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 798.124601][ C1] RIP: 0010:anon_vma_interval_tree_remove+0x386/0xa00 [ 798.124618][ C1] Code: 80 3c 28 00 74 08 4c 89 ff e8 46 82 1c 00 4d 8b 27 4d 85 e4 74 2b e8 e9 18 b9 ff 49 83 c4 18 4c 89 e0 48 c1 e8 03 80 3c 28 00 <74> 08 4c 89 e7 e8 20 82 1c 00 49 8b 04 24 4c 39 e8 4c 0f 47 e8 eb [ 798.124632][ C1] RSP: 0018:ffffc9000ad6f810 EFLAGS: 00000246 [ 798.124646][ C1] RAX: 1ffff11006e04b03 RBX: ffff888032f9cb80 RCX: ffff888025963c00 [ 798.124659][ C1] RDX: 0000000000000000 RSI: ffff888027465e90 RDI: ffff88802e5e2148 [ 798.124671][ C1] RBP: dffffc0000000000 R08: ffffffff8fa38337 R09: 1ffffffff1f47066 [ 798.124684][ C1] R10: dffffc0000000000 R11: fffffbfff1f47067 R12: ffff888037025818 [ 798.124696][ C1] R13: 000000000000005f R14: ffff888078683b80 R15: ffff888032f9cb88 [ 798.124719][ C1] unlink_anon_vmas+0x122/0x670 [ 798.124743][ C1] free_pgtables+0x72b/0x9c0 [ 798.124762][ C1] ? __pfx_free_pgtables+0x10/0x10 [ 798.124780][ C1] ? __pfx_down_write+0x10/0x10 [ 798.124795][ C1] ? __mas_set_range+0x12f/0x3c0 [ 798.124818][ C1] exit_mmap+0x444/0xb50 [ 798.124840][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 798.124858][ C1] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 798.124884][ C1] ? __pfx_exit_aio+0x10/0x10 [ 798.124909][ C1] ? uprobe_clear_state+0x274/0x290 [ 798.124929][ C1] __mmput+0x118/0x420 [ 798.124945][ C1] exit_mm+0x1da/0x2c0 [ 798.124964][ C1] ? __pfx_exit_mm+0x10/0x10 [ 798.124987][ C1] ? hrtimer_try_to_cancel+0x3d9/0x420 [ 798.125010][ C1] ? rcu_is_watching+0x15/0xb0 [ 798.125028][ C1] do_exit+0x648/0x2300 [ 798.125048][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 798.125066][ C1] ? __vm_munmap+0x301/0x3d0 [ 798.125084][ C1] ? __pfx_do_exit+0x10/0x10 [ 798.125103][ C1] ? rcu_is_watching+0x15/0xb0 [ 798.125120][ C1] ? rcu_is_watching+0x15/0xb0 [ 798.125137][ C1] do_group_exit+0x21c/0x2d0 [ 798.125158][ C1] __x64_sys_exit_group+0x3f/0x40 [ 798.125177][ C1] x64_sys_call+0x21f7/0x2200 [ 798.125197][ C1] do_syscall_64+0xfa/0x3b0 [ 798.125219][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.125234][ C1] ? clear_bhb_loop+0x60/0xb0 [ 798.125251][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.125267][ C1] RIP: 0033:0x7fce6c6f16c5 [ 798.125281][ C1] Code: Unable to access opcode bytes at 0x7fce6c6f169b. [ 798.125289][ C1] RSP: 002b:00007ffd9bb2bd28 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 798.125306][ C1] RAX: ffffffffffffffda RBX: 00005559a35b6ad0 RCX: 00007fce6c6f16c5 [ 798.125318][ C1] RDX: 00000000000000e7 RSI: fffffffffffffe68 RDI: 0000000000000000 [ 798.125330][ C1] RBP: 00005559a35a3910 R08: 0000000000000000 R09: 0000000000000000 [ 798.125341][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 798.125351][ C1] R13: 00007ffd9bb2bd70 R14: 0000000000000000 R15: 0000000000000000 [ 798.125368][ C1] [ 798.125729][ C0] CPU: 0 UID: 0 PID: 19152 Comm: syz.4.3575 Not tainted syzkaller #0 PREEMPT(full) [ 798.125748][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 798.125759][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x46/0x70 [ 798.125781][ C0] Code: ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 3c 16 00 00 00 74 2c 8b 91 18 16 00 00 83 fa 02 75 21 48 8b 91 20 16 00 00 48 8b 32 <48> 8d 7e 01 8b 89 1c 16 00 00 48 39 cf 73 08 48 89 3a 48 89 44 f2 [ 798.125795][ C0] RSP: 0018:ffffc90004a970d8 EFLAGS: 00000246 [ 798.125810][ C0] RAX: ffffffff8a21a364 RBX: 0000000004000000 RCX: ffff888056535a00 [ 798.125823][ C0] RDX: ffffc9001a761000 RSI: 000000000007ffff RDI: 0000000000080000 [ 798.125834][ C0] RBP: ffffc90004a97230 R08: 0000000000000000 R09: 0000000000000000 [ 798.125846][ C0] R10: dffffc0000000000 R11: fffff52000952e0c R12: dffffc0000000000 [ 798.125859][ C0] R13: ffff88803ed5ccc0 R14: 0000000001000000 R15: ffffc90004a976a0 [ 798.125871][ C0] FS: 00007f0b80b776c0(0000) GS:ffff888125c1b000(0000) knlGS:0000000000000000 [ 798.125887][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 798.125899][ C0] CR2: 0000555570d2d5c8 CR3: 000000002a798000 CR4: 00000000003526f0 [ 798.125914][ C0] Call Trace: [ 798.125920][ C0] [ 798.125926][ C0] xfrm_alloc_spi+0x534/0xf30 [ 798.125944][ C0] ? xfrm_alloc_spi+0x2a0/0xf30 [ 798.125967][ C0] ? __pfx_xfrm_alloc_spi+0x10/0x10 [ 798.125983][ C0] ? xfrm_find_acq+0x87/0xa0 [ 798.126002][ C0] xfrm_alloc_userspi+0x70b/0xc90 [ 798.126027][ C0] ? apparmor_capable+0x137/0x1b0 [ 798.126045][ C0] ? __pfx_xfrm_alloc_userspi+0x10/0x10 [ 798.126065][ C0] ? __nla_parse+0x40/0x60 [ 798.126088][ C0] xfrm_user_rcv_msg+0x7a0/0xab0 [ 798.126109][ C0] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 798.126139][ C0] ? __pfx___mutex_trylock_common+0x10/0x10 [ 798.126159][ C0] ? rcu_is_watching+0x15/0xb0 [ 798.126175][ C0] ? trace_contention_end+0x39/0x120 [ 798.126192][ C0] ? __mutex_lock+0x335/0x1350 [ 798.126216][ C0] netlink_rcv_skb+0x208/0x470 [ 798.126238][ C0] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 798.126257][ C0] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 798.126283][ C0] ? lock_release+0x4b/0x3e0 [ 798.126305][ C0] ? netlink_deliver_tap+0x2e/0x1b0 [ 798.126327][ C0] xfrm_netlink_rcv+0x79/0x90 [ 798.126345][ C0] netlink_unicast+0x82c/0x9e0 [ 798.126368][ C0] ? __pfx_netlink_unicast+0x10/0x10 [ 798.126388][ C0] ? netlink_sendmsg+0x642/0xb30 [ 798.126408][ C0] ? skb_put+0x11b/0x210 [ 798.126424][ C0] netlink_sendmsg+0x805/0xb30 [ 798.126449][ C0] ? __pfx_netlink_sendmsg+0x10/0x10 [ 798.126472][ C0] ? futex_unqueue+0x22/0x240 [ 798.126489][ C0] ? aa_sock_msg_perm+0xf1/0x1d0 [ 798.126504][ C0] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 798.126521][ C0] ? __pfx_netlink_sendmsg+0x10/0x10 [ 798.126543][ C0] __sock_sendmsg+0x219/0x270 [ 798.126564][ C0] ____sys_sendmsg+0x505/0x830 [ 798.126582][ C0] ? __pfx_____sys_sendmsg+0x10/0x10 [ 798.126601][ C0] ? import_iovec+0x74/0xa0 [ 798.126620][ C0] ___sys_sendmsg+0x21f/0x2a0 [ 798.126636][ C0] ? __pfx____sys_sendmsg+0x10/0x10 [ 798.126655][ C0] ? futex_wait+0x285/0x360 [ 798.126686][ C0] ? __fget_files+0x2a/0x420 [ 798.126708][ C0] ? __fget_files+0x3a0/0x420 [ 798.126739][ C0] __x64_sys_sendmsg+0x19b/0x260 [ 798.126756][ C0] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 798.126776][ C0] ? rcu_is_watching+0x15/0xb0 [ 798.126794][ C0] ? rcu_is_watching+0x15/0xb0 [ 798.126810][ C0] do_syscall_64+0xfa/0x3b0 [ 798.126831][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.126848][ C0] ? clear_bhb_loop+0x60/0xb0 [ 798.126865][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.126882][ C0] RIP: 0033:0x7f0b7fd8ebe9 [ 798.126898][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 798.126913][ C0] RSP: 002b:00007f0b80b77038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 798.126928][ C0] RAX: ffffffffffffffda RBX: 00007f0b7ffb5fa0 RCX: 00007f0b7fd8ebe9 [ 798.126941][ C0] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000003 [ 798.126952][ C0] RBP: 00007f0b7fe11e19 R08: 0000000000000000 R09: 0000000000000000 [ 798.126963][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 798.126973][ C0] R13: 00007f0b7ffb6038 R14: 00007f0b7ffb5fa0 R15: 00007f0b800dfa28 [ 798.126990][ C0] [ 799.138532][ C1] sched: DL replenish lagged too much [ 799.138578][ C1] vkms_vblank_simulate: vblank timer overrun