last executing test programs: 9.829210996s ago: executing program 1 (id=6880): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a0000ffffffffffff00000008000400", @ANYRES32=r3, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r2], 0x38}}, 0x10) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f00000000c0)) 9.686119456s ago: executing program 1 (id=6882): arch_prctl$ARCH_SHSTK_DISABLE(0x5002, 0x2) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x100000000, &(0x7f0000000000)) arch_prctl$ARCH_SHSTK_DISABLE(0x5002, 0x1) arch_prctl$ARCH_SHSTK_DISABLE(0x5002, 0x1) arch_prctl$ARCH_SHSTK_DISABLE(0x5002, 0x1) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x9, @ipv4={'\x00', '\xff\xff', @loopback}, 0x8c1b}, {0xa, 0x4e24, 0x84d9, @empty, 0x6}, r1, 0x4}}, 0x48) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x80089419, &(0x7f0000000180)) socket$inet(0x2, 0x100a, 0xff) r2 = syz_open_dev$mouse(&(0x7f00000001c0), 0x7, 0x1) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f0000000200)={0x1, [0x6, 0x80, 0x1, 0x4, 0x7fff, 0x6, 0x1, 0x98, 0x4, 0x1, 0x6d62, 0x2, 0xb17, 0x9, 0xfff0, 0xf000, 0x3, 0x7ff, 0x200, 0x5, 0x2, 0x2800, 0x5, 0x8001, 0x7f, 0x9e, 0x8, 0x101, 0x8b, 0x7, 0x2, 0x1, 0x2, 0x101, 0x0, 0x10, 0x3, 0x7, 0x4, 0x3, 0x1, 0x0, 0x77e, 0x7, 0xb9, 0xa, 0x8, 0x4], 0x5}) r3 = syz_open_dev$usbmon(&(0x7f0000000280), 0x1, 0x40200) ioctl$MON_IOCQ_URB_LEN(r3, 0x9201) r4 = socket$can_j1939(0x1d, 0x2, 0x7) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r2) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r2, &(0x7f0000000d80)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000d40)={&(0x7f0000000380)={0x980, r5, 0x200, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0xe, 0x21}}}}, [@NL80211_ATTR_FRAME={0x884, 0x33, @data_frame={@a_msdu=@type10={{0x0, 0x2, 0x4, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1}, {0x7}, @random="ef357948a6e5", @device_b, @from_mac=@broadcast, {0x6, 0x100}, "", @void, @value=@ver_80211n={0x0, 0x8, 0x2, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, 0x1}}, @random="8d949e23e4f749078e6ac21e9f94fcd99d7860c2639583313cc0940418aac0e9b3c52d089707283d23865f24308062808ab9294f1bd4950c41ec76bc377aeb01b60f99afc1093a669b26bbdacccc5f34f70c7b714a5ca34fd5f78f807799b1dceebd56c97492480b533d13d3c427b84c68f18d916468689f77f70a6bda661d7c5a3d3a7aaa0f16b1b8e16bb551acf5582baf4529f3954e3935f9864b892cbbc5e2bd10efa0229277e7f2408a3082d173696b396f4588702a3319d5aba2a16e4f779403f27b654a5bab484334788b38ccb943d62f739a5bf20de783189efa66700cd3d64ee1d7c9ee12235f8a111361583fe19b49001b6dcad3bf03b290e9b548f46b85277a2d509f3c743e6165c23c6c079298d76fca991f6e9281e5efbe5c5d5d21359565cd4e435abd2aaef78ce48783f2aaf448b1d91bca685ba0b0cd11b45ba25d82a045dda5dcd6c291d8a191087c906fe2d409a1d84b946ebffca8b7f3859cca2ccda83e2467c5b08ece477bcaf524f7f69595de9342214bc0b323f5d012cfcf723a689091d15cb64056322db5163aaf274d96a7ca0a2127ef4c301c44bf6869e10933a58fd0a273037ca84077865c7b5cd30b968800ee9ebdc45c0092b47c6e2c3ad2ad118defe87765d70bbd424ca81c4a019404fb7cfd3db879f66b005a5df86703fffe31e2949cdd2ec5a06e9114a4fd4bd48f3205ebe4f769fc678b514c8c9b579a8536b5a46d9f34646dc7ad6591d39f8888ff34b95cc00208a40595764fcd9d42d3feb008b895d3de79ccfcc99b120933ef033d723620365aa8fe6ad99be37e2b21c1b0c5d76500cb52e124537fb2ca0193d9f50da3f00ec01e9d1ab454d91d112f430db20d54f982546ce65f2dc151da7be4fbcac8388e312f90232d8efebdd30119a2467c4015a47f893b1eeb47d075d17e4719edbb4234e3c5b0ea703187fc43f0c6fbf3bcac6413513bd9b33dad827a865f23ea9c2d842f35dd25f0ef1b17e9c613c162e47ca86884410dd295a2712508975ac2dd835365fb7cc6532c61b34de667324eeaadd2211a4684518db53c34f7b72d1ec998f3a85d7e81b4c68fc3bb8173901c67c8dc65d2c5c091150b82cd9e0c60470f0e84db01caa0e1f71dfb34d0426831e8f8cfc2e8dbc4e9ea298f4fbb82c8a6b2fc44eb4da24aaa72dcf8451362c7834a828f9a8999b3d9b65149fee1c56255c11a49c0bd674ccdac036a3e07185773652c7bc7b135f1231e733d7fc2c5f3a1ccb057df76a17bc5fb109434380faac1551d16b4213b177540d7d89d697542f64951c9ff22e6bdbe30257551a841d8f18f4d4bb0743492be7ad26047d75f85f89c73a0eaaf1c67a75c7cd2ea4037edf13218f87a532dd4ba86cdaf5a0b12d37486da4dbb3753b4483b26344281bfd8b1f50a396aa0aaa414e9d32bbd6e0d577f7f06f2928a84278e8432450dd76bbba9c60a0f7a04d9db54c05c18c3aa20315478675b91e140f1fb63c21c10bd8783c61f1accc627a9e7eae38b22f6b1cd8020abde63d01d45d32cedea27c131501ea6d4789cb37c614747f6466b2b4bff46beed46e91bebd5254f3151d780b38633028a2687116d23f91f6d358b6a72c07417766ed0805c2784bfc061463c2fca7d8975aa2a23dc3f3d8ece2e009871ab45cbf8b0c6141efad7fbf36cf99a4e2f4da7f714a3ab247565708932b84e47b6e4c9004f6ce8ca28886cdc8b02a455896dd9f21ec70dd00f4a29f836f7b7e60a0026806348889d81bbd37859cec9fc518e14892b5ad7f6563efb18b0f8b2899bac93f329eefe1b8a1bd69ce6171b846a00132be31944cd6437653c07adcb6cfa5558d74b3945582acaca70d846ded76b8315d120cfdfd2ee13879dd4e825a7174a6149737fc743eefc134c96d9085ee31c6ace7d007e16a19660e12a1f1f785e6ee83ec820fa31fd150ed7b902ed9edb1bad87caabbbe0ac663b5bb31f758c14cd42110f0188db0e05f03c686a5caddaf25c104530b85c21106fe850b002bef8713085b99577c626e9b06ac77414fa382f904d884a4fadd2d48e4c3c6adb5fb0840ec241d4611371431273f470c0669e2a49f67b171d1dbc4ca7df190bc569492a398a49fe3daf4cd445398d6a2fc690cb5543961769c3b4f6fcaa50f6383f3e48d765532b7cbeb4156f218d02a0f3628c3ce03ed96333ad4995a9fc2eee7b09639c86cccdc960350b94e10ef1ed035aec8870cfc58d722ce550981f3252f0abe009f01edc073286374eadd2166ae480c83f6c82de2071e802e6e777544716b5629b71c1108a023e301a932637f68a340834f24e4225d30d52d66aef7cac0dcf309415e25b8cfcd2a7cafd78c3dcfd10daec5dddd52932c3f8e87c5f5f1b2a2dfb9d3b74154dfe304dfd591011e252dd9e45a8216c11d80e6edff6d5f3bf1441f71cd636a33625d32105df23bc1e6193b30f344a5242850c90b048ff5ee381dbb6a0b7c7fc7444a27b0c0825563a8fe7d2a0e3b46dda7cecdaa3743a26dcdb0c5bc40609aa36649ab0ea68a4eb44678ce63fec09ff4ff124259ea1d9dc4957d72c8c8c4d27a48cbc192521aba18478e8e355bb4ed99ed8aa5e04cad8c5d8f703806cecb958630e2eff5da966e92ea47ebf6a354bf6d35d71824ffea585a0059113bc685a81f9aa8cbe9eccfe93d8b217c88e7f8a05deee3aa36c2140f2a4f1e08ce0802b939a4f9ed8c2aeb1ce531890e501b4e4c12e7b0f59459ee69d6bf34772235fdca519172fd7447e5567bdff4698c91b3cf22cef94912f27782f8a41c0c5dd0dc91c9e0fee1c4598f9c2919a2fef7ee681f284e28c0e7db9fe9949332fd6c41e36d32e508afdcd19b25b0bbd7338c6e5e87f59955411645db928143300175759792b3400669c446be84f20150a9ca94c505958083829fc27d3804bf5ec9ba880c16b12c034369892129a43e882212208a36a4460d863f83f2c710bcda3226d9eb98c88eaadef989235088b69c359c30303221c17042baaaea09f286dec5625bd60c7b48872e0a3"}}, @NL80211_ATTR_FRAME={0xb0, 0x33, @data_frame={@msdu=@type01={{0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x5}, @device_b, @initial, @device_b, {0x3, 0x8}, "", @void, @value=@ver_80211n={0x0, 0x8, 0x1, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1}}, @a_msdu=[{@device_b, @broadcast, 0x81, "ebbb86dea63efd17011a15bfbcd29d7d7262e2098a2bc7f56a1faf24555f6ebabe4af5b82b50eef0ac61c5863515a6cf61cac30460420eee568a560cf57dda965a0d1c33a2f46005f149727a2c78ce8639b810743bfb367e89e3526a746f9c7af2d246c079c68a04426e4593195ea763620d2672dff0877e2c2a3e0820e4f2e2de"}]}}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x980}, 0x1, 0x0, 0x0, 0x4000}, 0x20000080) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000dc0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x68, @dev={0xfe, 0x80, '\x00', 0x3b}, 0x2}, {0xa, 0x4e24, 0x9, @local, 0x7}, 0xffffffffffffffff, 0x10}}, 0x48) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e80), r2) sendmsg$TIPC_NL_LINK_RESET_STATS(r2, &(0x7f00000010c0)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001080)={&(0x7f0000000ec0)={0x184, r7, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8000000000000}]}, @TIPC_NLA_SOCK={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x40}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x401}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}]}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2e}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x625}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xfffffff8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5}]}, @TIPC_NLA_NODE={0x58, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x43, 0x4, {'gcm(aes)\x00', 0x1b, "ecbb45dbe05df31659e8e1f47232f7dcdd9bc72855ddaa5e8c6549"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_LINK={0x90, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xee}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa0d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}]}]}, 0x184}, 0x1, 0x0, 0x0, 0x4040000}, 0x1) arch_prctl$ARCH_SHSTK_DISABLE(0x5002, 0x1) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000001100)={'batadv_slave_1\x00', 0x0}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001140)={0x1b, 0x0, 0x0, 0x10001, 0x0, r2, 0x4, '\x00', r8, 0xffffffffffffffff, 0x1, 0x3}, 0x50) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f0000001280)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0xa16d492dd8310aaa}, 0xc, &(0x7f0000001240)={&(0x7f0000001200)={0x28, r5, 0x100, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x7, 0x3d}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040804) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000001300)={&(0x7f00000012c0)=[0x0, 0x0, 0x0], 0x3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r2, 0xc06864ce, &(0x7f0000001380)={r9, 0x3, 0x6, 0x86, 0x3, [], [0x9, 0x3, 0x8, 0x3], [0x4, 0x4, 0xd, 0xd], [0x5, 0x1c85, 0x2, 0x8]}) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r2, 0x5761, &(0x7f0000001400)={0x1, 0x0, [{0x5, 0x9, 0x80000000, [0x6, 0x7, 0x6, 0x6, 0x5d, 0x80000000, 0x4, 0x86b2]}]}) ioctl$BTRFS_IOC_RESIZE(r4, 0x50009403, &(0x7f0000001440)={{r2}, {@val, @max}}) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, &(0x7f00000014c0)={r9, 0x1, 0x578, 0x3, 0x1, [], [0x4, 0x3ff, 0x7, 0x80000001], [0xcfe7, 0x9, 0xf, 0x6], [0x37, 0xdd, 0x7, 0xfffffffffffffff9]}) 9.596487793s ago: executing program 1 (id=6884): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x83, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) close(0x3) socket$vsock_stream(0x28, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) syz_io_uring_setup(0x8d4, &(0x7f00000000c0)={0x0, 0xf971, 0x80, 0x1, 0x1000001}, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000024010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240000000", @ANYRES16=r0], 0xc4}}, 0x0) 9.512808737s ago: executing program 1 (id=6885): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xce22, 0x0, @empty}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a04000800ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) syz_clone3(&(0x7f00000007c0)={0x140201100, 0x0, 0x0, 0x0, {0xc}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_mount_image$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x8402, 0x0, 0x0, 0x0, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1000000, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffff9]}, 0x0, 0x8) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) syz_clone(0x10884400, 0x0, 0x0, 0x0, 0x0, 0x0) 8.303139037s ago: executing program 1 (id=6892): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="0203f30216000000001c00000000000002001b0008000000e9000000000000050300060000000000020000000000000000000000000000000200010000000000000003fcff000020030005000000000002000000ac1414aa00000000000000000a00080008"], 0xb0}, 0x1, 0x7}, 0x0) 8.13483577s ago: executing program 1 (id=6893): syz_usb_connect(0x0, 0x1b, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xc5, 0xc8, 0x5b, 0xff, 0x2cb7, 0x112, 0xe379, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9, 0x0, 0x0, 0x73, 0x0, 0x10}}]}}, 0x0) 7.728196922s ago: executing program 32 (id=6893): syz_usb_connect(0x0, 0x1b, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xc5, 0xc8, 0x5b, 0xff, 0x2cb7, 0x112, 0xe379, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9, 0x0, 0x0, 0x73, 0x0, 0x10}}]}}, 0x0) 7.314935994s ago: executing program 2 (id=6897): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000440)={{0x12, 0x1, 0x0, 0x5f, 0x2a, 0xb4, 0x20, 0xc72, 0xd, 0x279b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xdb, 0xa2, 0x92}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000002c0)={0x1c, &(0x7f00000001c0)={0x20, 0x10}, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000180)={0x20, 0x13}, &(0x7f0000000200)={0x0, 0xa, 0x1, 0x3}, 0x0, 0x0, &(0x7f0000000000)={0x40, 0x5, 0x6, "812d8be1a27b"}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 5.076896816s ago: executing program 2 (id=6903): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000e40), 0x80, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r1, 0x3ba0, &(0x7f0000000f00)={0x48}) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) fsopen(&(0x7f0000000180)='exfat\x00', 0x0) shmget(0x1, 0xffffffffff000, 0x200, &(0x7f0000ffb000/0x3000)=nil) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x1d, 0x0, 0x0, 0x7ffc0002}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$sg(&(0x7f0000000140), 0xfffffffffffffff7, 0x28a440) ppoll(0x0, 0x0, &(0x7f0000000040)={0x0, 0x3938700}, 0x0, 0x0) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) r4 = fsopen(&(0x7f0000000000)='sockfs\x00', 0x0) fcntl$lock(r4, 0x5, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r5, &(0x7f0000000000)="f461c5bbd75c3583", 0x8, 0x0, &(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000980)=ANY=[@ANYBLOB="1400000042000b06"], 0x14}}, 0x0) recvmmsg(r6, &(0x7f00000005c0)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000029c0)=""/4093, 0xffd}, {&(0x7f00000003c0)=""/186, 0xba}, {&(0x7f0000000240)=""/129, 0x81}], 0x3}, 0x1005}], 0x1, 0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x31, 0x0, 0x0) recvmmsg(r5, &(0x7f000000e280), 0x58a, 0x42, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}], {0x14}}, 0xbc}}, 0x0) 5.024413994s ago: executing program 3 (id=6904): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x40) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000000c0)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4000}}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='statm\x00') readahead(r4, 0x8, 0x9) write$FUSE_INIT(r3, &(0x7f0000004200)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x0, 0x2066012}}, 0x50) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000007c0)=@newlink={0x2c, 0x10, 0x503, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14615}, [@IFLA_ADDRESS={0xa}]}, 0x2c}}, 0x4000) syz_fuse_handle_req(r4, &(0x7f00000083c0)="000000000000000000000000000000000000000000000000000000000000000090c400000000000000000000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000542d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ea8286a2fba5234400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4ffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000633956a1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007d6ab715107fa1820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6ffffffffffffff0000000000000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000286071480000000000b13bc1e6d970884f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000806318730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3ffffffffffffff00", 0x2000, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x20, 0xfffffffffffffff5, 0xfffffffffffffffd}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x40) getdents64(r6, 0x0, 0x0) write$FUSE_NOTIFY_DELETE(r3, &(0x7f00000008c0)=ANY=[], 0x2a) syz_fuse_handle_req(r3, &(0x7f00000021c0)="7b1713b4c6f02da7493fb6859f0143c68a58166f472c5078104b859bc37f9a49a8f85c9101df3b2736ff9bebcb1a3c2f570b28279b8ff7afdef7451b3d10b4578c2e81784b6e4f410800d997f0689546cee0852e9e9c64c1f95df7b136243cf7aee1b8e7a4e1d6e6fc01337370f0dfc098d975e9a6f90a08f5b845054d1e1fc81adadbf2836ff758bade0484377855b05b3556a91827599638458ad30baea03240b302638b88423ecaba6da1e40f6f1b24d60dde1652f2d5f818af43d49dd55c4eadea945e9b6aa744dca07ec2e00320bef5b045414836941469129670c4cdb953ed61efeeae2ced1b7cb3e7fa4c93cce5623a9e33c69d068b801fd1369aba759e2829c67c705853262fef6669aab956f0f733619dd361be5e1414c7e7ff6218e330156d609fa9f3244a0a4fb678a58e70b86f6dabc3331f755b786c42b4198149941a7a58c83f1f2811209025269c5ffcbe0c34ac98cc091cec2c993bca0aa8400ff9e39cc9fba8dda886f95357957bbad8bb850ab92f7aa9bebcdb0ef188749a1742e5597d199f3ccdc2d807bf757da45acc93e3e9645a1036cb041b3c38dafef367b8dae802bbbc03bacb905d40e1da78591687b416ee380103a670aa8f722c76e13f7f0e3effbb37f15a821b8315fe541e3ffc09289d96db1dfa8861e5da41c812b54ee20ca8b3180f2f46db56954791465cb572de0cce16d789d6fff216ca46977ed724dc0cc8cef7b295ebb2998a5c4662e32ae1001e59f3bfefcd72543bfe1aa6688d65c547089ec0fe1f1d9610095a5a4008b14f46775c368417376ee143856031947db71c455dc40eeeda210fbf258452781ce46e51f6df683a7918770f73d324d9401648d271cb9a7e919401567e400fec420cf363444a78eea03e73176abd6546e1657945aa88f64a21e07fc23edd74512cf89781e8ffe9bb1601ab25d31801332a6c5be9cebb6cb08207bb832106553ea9fc19b4b4f1f0cd55efc2925ffef75e9b12f06b5a7496506a274ca25f88398a1734b7013c3f78a2e49ef0d946a1aff362e37c9b5f5473de11401097722adda87944ee3eeb1bdde60e97484af4d2e5f8b0a9c63bb8bb99461b16edd824add1caf9d5247811cc4f6b48004774f1a4fe4dd125ddbfd8b69ff3ee314aeb445bee9f217a2f5a9e0e84ccd8718471f949086df6cdcbf95e568317e31dd01be1b826cf9a09373b16935fc864794a3886a2f4aacc42135db85f8921916a10aa7111a686979e2a5c9959cafc9774c416c4dfe0b9e06657feb2fbc31e7c11f6e2841680986557c1f2b1ec3c0fcc6a749a3c97a5b370550ab7110e25851b13c0b75a7fb0cd3c4659878209867659c216b467bdcf51e786a59fad084886490fc77e186ab827d844d0ac4682651fc4043f8e87b905532a53017ada44feee1f89f9bc6d2a8b144e721a479f7b90acb91033774f4c12df633548a9097c791ec7e80fa2607c86fce6e9abcae1296528b8488ccf18a4bb0fc9b50c15d294e8d380465465b4eeae26eb6800faba611785cd2ff95ca1923dfa47d5923f89e4eadb612002caceaebbe779c4e3a3833455752eae63689ab8dc03db63d82feeab7f1162eed5909b69ccd5abeb9c071da82cfc76cc692a51d99e0c4bdfa6c81c9878e893a77e1e7105e7910827ddb3353612fa8d5e547b43b5abfe50829c1eb7bfda1731db2a9a1e8f0fc298dfa7009679489f9d9323338b7e59f1e48419ca531d88170a5a1995f576aa125edae9e9ea26f6e9c4bc26323b7db0998c528a7b343ccd87ff44c77e6cfc0a324cc1d4ea79c30015f0caaeccd46e5db580aa5ce8030c2b13b37494557da58abbdc7ce9fc9afa49ce0e8a7a6fa058db210ed654203e7879cf5004ebec57522ed34481b749554b36cd7171209b0763e110096704604f2d3f28c5ddc66c877e3ab63f36137d5a67cbf872aa6af79cb3a66c9040009b5e1c7b718c1b8788156b82d6d800dbe9fc3d16c812a963c73599b79efb89aa74bdbd9b1a2dc0b8ad853f79c0867a3a45d7a1645059171877687a72dd5ed4213c0ab84ef6185e7935346a84450887bdb2b216883e907b13b03c133adc04ab3c5f60209bd90aad3d94443105f08f0ee1b2231e1a1f8cce71de74d5308b78b5d99ce4ad4573faba9fab48bc1615f14d453c67714b99f274de041512b07b885679e6f89f481c28b082084b853c9afcda31def2898284d6ca28fb124df67142821c9705e28093ded60992d9587fb466df839aa2a4973dd48f9372a55da6592646fc918e533955566a2d8dc59277308223aea4dbe0daf839f95516b8995e9eec87df1df9d38693e0824dca7423b08d553b0ae1c5c44533b918eaa02dd17b4c8ce515ae7de410970f670e17b5e3c0a207fb8464d5d442694a271d593fc23ac19619bac32ac17cc6705ce2e6262361eba24277a471602e7ca57cc614ee116e60a9e0b6ac5e3228ea2c650baf1a09e9e5c7a1b25a078d1d11a673d88f6ee33e50d036d7fe4b9c06adc70aede2e35c6738b255690ed3f7a8d2d14e36e360f3bb66978d6cfcfc41887c751c0efc9325d4485a2f561060413fe6af4ce40d87a476201f15a584fc7ba18ddfef5f1d729d5f544c2c6b06befccb444f0408451089f20b06f05ab7d6702b97819b0eff6fb090f21afb3076558e692920053702fc2348f8dade0cb2b007f38d6dcd4ed3bb42553b1bd684791743a1941e5bf2ed234f44be64a95b485a3e949538a40542f25ca4bfce44e291037ab282082f02157a96f4ca0a0c5cd39215fd07461093a4d87a7979f7aa97142bf5b9ef71db537f9acc90f22ca2ded5c1ecd1ba972d05db7f71e8466085c9b3e975fa3a948f2c4049d1a8e46f71157017a3a74ad25e215dcfe7a4c5cb0a7baea0b0ec60c5df82555c553ac60dd39174c721edc0304b836a4de539c3ee55401e13848018f889cc4a0fcd01d9f4978eb730fb1b4a94ede0283f8c95062f01c8c8a3169b2d5c50cdd4f3a248d80a26c950b4036fc6ffefaf5101269fe3594c2cc128220a1d0b5f9f23121f2b184894e129159eaa92d9a30e878839be44d20cbdff3c338cc95795c86121b2b498bd376e895c98d67f6a27eecb46a203aa9de744feedf27b6825cc17aaa098b5ca05cad6bdbe320908ed36bdc8a8f2c777eeb9b037b36c0e36019c264b3e36196501d6cc90e7b1899a72bea5c8a24a5ae62e3684a39a06208bd382cd32acfabd742c76334797fa0c09a2a2a7e1240974afe0f3d6eb44590cf171efb7602009a93bde85cea6701c765dbca7c6a879be41dd08847802d4f59e933df65f727cbb45e3a4a5019f503b6fad7e0338e653f8b2c87aa7f196444e0dc1be6d7c4f0c7ddd663d06ff1365a9c362384a33b0315adbfb2d73359c485cd5410d36d21044bd8d3771c5492803b19f7f3a1a5c3248e66786479fa4416a55855adebeb09528ff5add597790b97bddc16bb9b7b33a1f800701c4293e2c8428dc2684726cfe5539ae0a9bf89e1b6f1989fd0433cc865b308bd0c636402b4b285c290e2439b9ecf0eba156fb6b613ea7f97b04506fe28e9471343c854fdfd48945a7f564acc817e609be8f8a7fdee12e9b592fd8c5c08f51ba8cb95be12cfa497d1539a4b8217818d47ebb3cc669014261530205948fdb9983a0e5759afa9b290ce838102661750ab06d7fe65a39efa6af36c042d2dee36402a6686d58eb144b76033cab4482b8fbdd213a90170939ec98df1fdfca4b37b143a971b9b59fc351098942bba090056c20e8cfbfe8fcbe361d068c98a020f67e807b8db2e45cad83c9970907646c0049c05c1ed657d53d859f1a47bfe6f022be0689de224034d0160b1dbc878ba6dd685911288d7af22ff5eedc1634c36e25f51d0757c7b9c73d7937955da356dea68749d464a75f56c9f6ba36cc1ca8c2f3aa34beae14fba894ca705111cdb19094432c2f6caa0eac78ab09b0cee330f36b1b91a6a5d4896cd15d96c12547826559441cbf578f189f5f04526a4cf76d60144090c2386b747ad50f7962ef2950d2c6f4ff8477ad0681ab24c47ea7ded8c9accff0dfa30489f43f0f3182b88e757fd9a1d82e1c9bb4efe5215518a6e48c688b2dabbd15107c5c6245de0acfd740ea54e0ec212f405f25bc3aafc63009631a4e4749296d47c2bcf25cc95afceb0a1ddb3c6124208f5134981c30489b42eeb864b3123b03106c9b234a465d87c30ef36e00244390de36a5dd93794467ef37bd01b86387855d2ac24e05370212e845082bb22c8fcda0f0bc78ddf971b0b9d69fc50e0d907408e9c9ac4e5099f47db2d0c14d888e363ece768555362a08c408d0119c45f158aad695d455d28e223be2862c19262c9f43eff8855b5a9af4f2cede95e415e2f597bb64c8bb2d608f86b15950ffe2e6bea3cdb221cf8b7eb35e0bdf6638283b09c68cda0bf1ccb9e353a7f0afb58d806923e36b22db68615a7e4e04d0932d928afdc8af3963378ebd5e05058160ac67fadb7a7d9ec498e00f63671b84d880d196c93afb4fc823e7d6576ad824ffb4c90fc780b163a292899ccfcaed81dee2c992787a66800e206df3dfc4a6b441d54ccb1a19a587402a663d510e45a5b1aa96fc467efaf7e71cbbff087f3d2922a133466d5ae9f86b0bc39bb3093b87ac2db941b1fd9e40427402781425d6e8856a2c66cbdd274f4c689758db6dd58ec7d766b177739e8c9173f2b1946be5396aad6d7ed29d058ac231e8c2e6a9077b4a217df4580a2d72bcf0b73e4bd07465deb8798a55ee855b82f1fa7d3748a40485bd90fab94b617d92219c4b65efa022936895e51873058615a19b9d1347120c405c3254f290b4c8b99c8ea9dde3a749ec538421a29d27b48ccd83852abe1a461123e4d36e56508d1827880960362d10835df77f9d4be51f1447cac5ae2017a814de58cd99bcc0c194254b17114ea48f5a0cfe6547686088d527c65180474fd460ffea5d48767ceb65c6fa3d7d3c632591d2d9d65c6c3a35a6ae4dc56322cd84734b0e7a092a4c46c1c607afa6d0e477e8d04e4993e595ba708a0f4466cd8a89fbc06d3cd366007296a9f05b66cfdcd5b30b6745e71d513205d5dbe1e8516d9e9cf133caa994ec0ac2c543d107efd4b9a7d9ee1ee415830a6c2ea17114ea9683726f2c82741f9ad4ac1be6772f0809f18c13f4cfc82fd1b7b3bd29615336003c6784c03fbcae475a58a3c4d68099732c326dfb7643eb150f2354918077bb798b5ecf491cdd0765e3e1ed5d0a37840f1a28f7e188a021781f1896dae7153f9d6639bf66be0c7857d7eccd2a1e6c9fd0cc3594477bb005df9b29f680c966161e37bcec97fc2ef7a2c3bf64e4df5785c9b080c7f9c6d7c515408445d55da499c03ba66369a31157bb03588e84a5303c46cd393c5bd6fbbb8deed94b62d67a9351c259b263c6c4fa65a4dbdd7eee080d82cc5e478c885678edbc9cfce74169ab748d7f4a08aec3e114394fc1d5e361267b8f3fcf38a024928d58158560f7da427680e7611a9f1b8255c67e6ea6b597ebd31bed9fd6f85f9b6ee63d4374c1e50597d1c9f3c56b4266bc632ba66ebecc396f6bead40392dcc138098b4166ab7f8714bd4db0615480705dd200da92dc51ec215844d7599e0a6262e8d5dc6a9452db8994d8b8f19ad4029e0b41b5e13fd6b56230cecea57f3111fe6c78876b3e657fab112968e83a0b64ce9837b89f5dad0d5f0b8b410e3a9a56ab2e9143e90fe371a944989ee206eef777cf4a235333c647e45aab910af492bc7c2213246374251e23accf5818aa2f24823bcba12efe3658e1e2cb49a5d4ffd26453829739647eccd106605921641afe16bbe79c8739062eabeeda4d4a42cb70d84e1e1d3506c7bfba5f5135aaae85b03dc6518eb30d832175cedc5bdca95e600e04902d9eda90c1da4bdd3138ac889398c239068857103ad70b5d1d9fac27c8ccfbcfcf126d9a5441bc963bce4669047ac901a14ca7c7e76f94c77159cdbda5360e04bb539a9d5ccd16a8cc88bacaa5b952c86b163575d7f1cab58f0d612d796b570f3c5debd7d9abde7e24de2c252173f1edc93817192699bddad45eeb41ff398c1bee4d2194f38bf4d2b4ed3a8895476bc441f464753139e204ff5dee7f45ce639d7541c0d396141aeff30cbbfa7157a61993eec98a4356df98665546a1d1e8429fb0c78684000862aac50f7d9a1413e89958f4defd3f087769cafc32bcd6016e496b41b7754cfbe42b352346fd585fb19a80f4af9a19811311b5fc6ea8eb5519a3cf7dbc1a06eed41668e332224c1daa01776e0886044f5a95e5dffc8d9ccce7840eeae97e8cc916db95bdc33fb420e28030c6edb011d5281db1dbeac9bfcaf938a757e3939b025d339e69b9692c8c7352787d399f342e96096e37ca208609e5f93629e36ee442db9fb822ea236683f79875e7dc73ec97f98fe0795f9d83f473cc80a589043a7edd953473684ea4e80f698683a0fc1d8863adc44fc13c27a08921a681ca1ad76207b1a97f8fff7db247ea09b3a6407ea83d82d82d171fc80a8f5fb9f19cd7e94fe121a6a0ef9c4cff7a8689c0abf750dadcc7442c2ca5ed437af5e88e89b0a783a1164cd1eb2a33a64c919d9f08fe5aa7a775352ab6027a7b73d6fef51acebec5516c2a5f2b932b2621bbd2cdb415fce9ba1dbc3de205869fa0423adcedd5570ab0b4b64afafaa458b3840b48f018297aa46426d7893418033f00b5378eac6a70275ec860609b07851b88ecb5da05086adfb80f47c71a77301ca0f1520dfb7a800bc8421abf5eb94942ec818e3a1d45f09ff93e6549b3ef6152c6abe38231b4a82e355e27e363184df51418286d7073cf464eee02310e84b3eccabd2120fcca333130357e1967f67a69f437dcf6a20ca21797230aad086bd4c28348f58b80ec5d27626004533993b9f85897d00bc271a62ab67f92e2eed6d900000000549e8344ad90b47fb5c1ed5908bce94d03bbe98a87a1733b5031f89644c2d35d729e1375969a82f0252859219407c5c87f5d249d5eb8c17001fc7c6dc5d1825851b41e5e937f2c39d7f7196f38f83619da2cddce747bb0e906d0fc13a11fc6c2be3d140ea6da886cd5e194ca9dbff565d2a82e7e82dc5a36084bf02029ea05a9cfe1f3dc80489b426a14372232940ffad8124bd515f0a73fa85c2aa0cd51d76a0cc6e75ccc35b702a4fed4d2e2828d98939406ddc6df1048f0a22611859d6bfcbb0873d102e4b8a86b5d9af8056447f6c1552a603d9f67009fa070db73a01e1b4adbe4e841d0b9a92d148b626c386b25687817e5ec07dbbfa1d62d078578fe21d546414e3c5e29e8e086d7e542a2eb74a67127e7f171e076bbdd62767aae3db467db1df13b3121023bcee33f814d767a9ef14651f76ec89910ed33e9804df8619f69ad06bf0559b00d4efbf6f44e922d50a18ffa25d8ac58dec53a93642186c0ca81b07fe5c14c9c13397649a53ebfcec118e5bb84db053e6e505d07a09bb50f33906e7febac3c85ca337111dbfcb7b9becccaaefa3d857d48f0b3d8646d70fdcf2f1dfb89cc3ba1394cb5de24d999c88235418bc0f20d4036bd0113d298b91c44fe042d3b8e4070e3f828499972524601c4725389122c7fc3e38eb799f7b755f23bd5362880b9275e58eab2c8f42e583890cb84e17f35025d1d76dd28171bee561d21451b4b2ebf23b923221c9ea06b924815889d2b605af66539c3b0ffc30c7170a5581727f0faddb257cb6ab28b3456737d3588fa3bce0ba6a2a5c3c94301fa8a4e6db358731bd3a4a62b42181e04241010d7bc3e973b9fe428175ec8f8e6cbd4e53c8bd957621acb1e42504e6f8a7bb30c382058fc9dcd0cd0ba0b789c316cd58d7b5606cc2a66c872f10e6663346d572ecc37ad1c3d8146a137e35e54096ddc2a5e2d26765d75615fecd09b864b29adfe92763ab54272365f56feeb9b57059744e765485ee322cb879fd3c8fd8bc4727d860995c548bcd41852349f1b2227f5a1f39b24549693fb05c04ba8f190673d11eb27d0bf628489f9b8049f5f3a1e1fed97ba9881da0031ef5960b6b0af825cfae8252b931f6151cba9bf889a5c74051a176c56d3cbb8915d3f28f8f684629bd1e3f87f27909b4e8eca6b88cdd60f3b5bbe0641a469e396080fdd2feeac7a11703b758f1815f100ab2ca4403af34a655f4c35e62778c276c96bb94a3d9f58f3bbd7ae6c4f133f7c4199f18d02d66598a54769415b376bb04b520881f23b22b32685ea1ea0dc179ab2f33f07c7039d1a5eedd1905d2a8c7d3c9686758ba5aafdd74f36da7f5522aff5c40e565b50cdd92ce353c3d6c97ce87f0495bdb95d70ea52c8c26b87cd337fd2283b88d7301c32f26833451b8f7c2ee5f44eec58d9eef2a39b3021a29c8747d36a2dbca6c0c085399bb720000000000000009d67e17060abad89c7d8b8970244c2f11ad2f4ae878a3676659b77178a9b651b12cf9c21e658a32999d596af4648f636df4de8c037d1fa63b1a685e8850156bf99e00666dbc03d3e3b44018659743127f91d44c99b578b86a44f3bcf1523c8cb45accc3c5fedfd7796411eddfc3a7a6b7c57ae10fd4bd3fe9f662dc59747ac4b7cc2584ae3ce2e42a41066dd0d560f1b4c83edc57121dade5e397380bec5f40b5d0beb14aef21b2c68ccfd0eb4959b5e7f5b5779903963298e3c9a2141f145137de1d604d9124c3c4f60a4d54da38a7c32ef2632fe66a8ce8e95ee95a570e18e9fbd44884afe291550839dd61e65c952a3f5c6b61850d1c2a77e18fde734a305b407cf6dbf17afd66da6e42f0e8f66092df46c79b44711f6e8aafa831fa1188beea696672b0e94cc3cae584b30dccf053634f792c2d9f4c87e306991b407949f2870b525d123f9ca23142a0ee13d05f51ed4ff2653727ad5bf16453276b2d5e7d7a8a0a1c4847cb61ac4b08d9abee25165a120d156775a534a62f9af3a3b62726101b94ae1e14352262f017c5361b3341952d194a6a2d470e60df3fde61d343e0af8fdff36ad976af6732b732ceb69344550555174fa280153e08f74d81f4ee69c1eb44a3468e8cf78bf7c1663dae3d31553466faa207b8e9887cb54209fac0b6f6d12d9588351c76e6bad884799afe856a25b5fe737d0ba737a0f1a12b4eb3ede48a0c38e6787ab42fca1c7f2ab42fa6104d5a99aa36b73ac3622ccae122524c28a6557cb7d0a7c7eb5de795647dca0621fc2c9599441dae7cc2a8631252abb5e0f22e9355e0a156a1ab7b1641e345045e8303b5f6dda5c3c1cc2637700cea25c004460d101fc42ad78ae477739a4efbacc57272cfafae15292dc3b2800d9f42002c2062af9a1f329e11140f8317242c04ac1f11cdb45f5f9ab18877daa214c151fb9ac54e3e010b5e7944d7217442d5c4fc29956c1333cb932424096f5b6afe1128db53f7171be4372be8bae538bcb3e4a2eb29608678735a667135e0f2660956e9e2a3ed862209efe65d9ab2fbbf88e5d3384fb3362af00e1ec6b4d3ca40df442b70951026438877189c4b0ae136a9a35c131fdf19115e8dc1ee2b938bfbfdb3808aebbe7dfbbd3510c7070388f5813e8bc63be744b99116c4b84ea37d57c5da7a80cc883aa915d84a249ebfa78ceb124c63b3a0720b19483189ee50824e8581556f0520e434803204cd0f3dd09fc97c979f9a7e3f8e5eca8fccde98fc4939551338235c0c6378faade0d18f7050f29189485e01ec120239373c5478cd19ab27570921415a6680924baf9c5829f3f2115460d1fceb8a026fa1a0a0047fe1cd6fcf1861dd3784e006abfddfe79461c5001e4e32d99c5bc203c21f8c711c5ecccf8941093d95a8db73722bb7511443fb2670244cc1249492e92fc4bf7e06ec6f08c5c6931929d58232b551957b771ea5e4a932b037904b81916e662e3fe95af894e80f699e5c00ab664f381bd9c0bd41322a8b3cf367577429fa52c0f1c44ffc626c215e7103cba05bff4931d9a202c1eb9068f44983d1e0c6d9fb5fed738561651e854a3c1b362ae354a0b4a270386ed2dbef093bd82f07f25edfae31901cb86fd214576b25f769bcb215214c63026b2581a8d17779aae03ba310f3243b3631f4b01c9e3eb342c3bdb44d8e47cdc1683e3b1cfffef72e385cc8831f99425fc406575170e1c106618d5429144a436b9e92d241d8118b5cbe0dca5e8ddd86e671e13080eddcf8dee9e317d192a3a5386378de9b1ecd8cf5439cfbe9f65965e5a5f6c145627ac23fe30c2e06e623b0eca15b225b32b65ce568b656cec0e0d6752fdebffd39c7538472ad7a195b56fcad3fab80016ff006df6b01d785191e4fca143b14ce68b32571476a779515ccb14d35cf9aabd4849c03c9bf12a42cfc2a7146ed6c25892a9d1c48f95314f641142d38cd882e54534d69b3fcc18044309e6debef6dc79d7737956418b955d33737115b44360e0bac14b71e2e64f0c8aea428dce5b65e210c108f832a6041c0aab116488e5863cd1039dc8af537908be3541352bdad303de43387503d19d7c0f0390bdc5b95f1dfb0701fd0e14a22c210837cc0a1cb059de474f4476bfe9bddfe3e7977fb299e82d9eefb18111f7c4a5fbd406fca720fec69340d978f4c9832204d67f6fa5793325e04d4af84acde0b56158e4c606394286a4b3cfc04a426a665529b753e1ce2d6c613159844bd069a67b5b96cb8ec993f05a8e252ed3d8ed63d524af0845f519f9d47b85a773f37031cb91055fb963db50e6a1e368f10a82fa40ac055e0201c6d29661eadb76f8154ef9c1cc210ccf1ccb063e8c00324ed6a14fdefa0167a9abb04debbbf5e7b8a57a7772373c765947f0f67b5130d77a6ca6ab166147d4eba97b4ddf1465d25b02f4430227b5713a29fd84664bfdfa5fc450e48f5263eaca67c16033b79bf1cb819511cf16bae6ffd5d05a7d9cc93067b6f2512fea2424a9c7d178f653ffa7ce1c00924707e3817c7cd461cb2a8cc5eadc40821258eaad7720ee3976c5a60025c317480016e5e5bd884f3646651f3bdc1185ec1a4112eb24ba5b3b6f94ac66322042d4bc48cb5befabfcf950cf8a0165fba3fa019324b53fb56bbfaec7f4ec733e84c22f841c1c9c1dc51dd3ac4887e155ac4095a6b8846c8f401f3c2d48d4de18906193a9f05ed59e3b0add8bc27c0bad8418ccbb842123ce1d39fdeeaa7984dfba9ef121ab4d4d35de076262636f3815708e4bcf31e634a290b13317425b1a4a2e4ebf8537092c7e524c126faa9622bf1337168e003857805dd420a51816fea3cd37c34e483f64a2da3ab67442314ffff40727835a1bc7b9971ccb5f83183cf1a135defd468907b988d97028f904c4d9c712f7d0ed6abe4d80712a7b7e06efcbe6a5b83e32beb1556326af7a97437c35c6a706c6cf4403b98f5134547ac167fd1abcb9245ec3450202ab80e553952412032a6c3cfa64441d4aecabd1e182c50bf67801fd3b44b40648ac9926bbbd7095425a429f2a9550c2fd1267cbf6156897b705255cadf1c7f233f4effd788b3f446dba19e68bbf8b42ff6caf984a4eb51328ab5e2bc28366e8b4df4df967a166470a00", 0x2000, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x750, 0x0, 0x290, 0x450, 0x360, 0x290, 0x680, 0x680, 0x680, 0x680, 0x680, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'pimreg0\x00', 'vlan1\x00', {}, {}, 0x21}, 0x0, 0x188, 0x1b0, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [], [0x0, 0xffffffff], [], 0x0, 0x10}}, @common=@inet=@multiport={{0x50}, {0x0, 0xc}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [], [], 'bridge0\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {}, {0x0, 0xfd}, 0x300, 0x4}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'bridge0\x00', 'bond_slave_0\x00', {0xff}}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@ipv6={@loopback, @local, [0xffffff00, 0x0, 0xff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv6=@private1, 0x0, 0x37}}}, {{@uncond, 0x0, 0x208, 0x230, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, @mcast2, @mcast2, @private0, @empty, @loopback, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @remote, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0]}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7b0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800c000}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x8417f, 0x0) 4.508051201s ago: executing program 4 (id=6906): socket$netlink(0x10, 0x3, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000680)='ns/pid_for_children\x00') r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x181040, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4c, 0x9, 0x6, 0x0, 0x3}, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) openat$apparmor_thread_current(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffffff, 0x0, 0x60) r4 = open(0x0, 0x40000, 0x122) r5 = syz_open_dev$vbi(0x0, 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r5, 0xc004562f, 0x0) getsockname$packet(r4, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000480)=0x14) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x2c, r7, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x844}, 0x4000000) r8 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f0000000500)=ANY=[@ANYBLOB="01000000000000009d000040"]) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x4001, 0x3, 0x2b8, 0x180, 0x0, 0x148, 0x0, 0x148, 0x220, 0x240, 0x240, 0x220, 0x240, 0x7fffffe, 0x0, {[{{@ip={@rand_addr, @local, 0x0, 0x0, 'ip6gretap0\x00', 'veth1_to_batadv\x00', {}, {}, 0x88}, 0x0, 0x118, 0x180, 0x0, {0x0, 0x10000000000000}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x0, 0x1ff, 0x0, 0x0, 0xed, 0x7}}}, @common=@inet=@multiport={{0x50}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x318) 3.766854795s ago: executing program 0 (id=6907): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r0, 0x6, 0xd, &(0x7f00000000c0)=""/212, &(0x7f00000001c0)=0xd4) syz_emit_ethernet(0x82, &(0x7f0000000200)=ANY=[@ANYBLOB="0180c200000e1704b45adbde08004e000074ffff000000019078ac1e0001ac1414aa0500907806000000460000020000000000110000e000000100000000830300070300443c00037f0000890000372cdd457f00000029e9c5fd420000ac1414bbfffffffd0000000000000000ac141400000000000000000000000000ac1414aa00000000ac141400000000000000afa4934e524d92558682c38970315b572cec32625506000001a563964d3a8b8bb60e551f8d114aa347739123028d3b66e8dc96b8964f8a082c900601dbd7bb7b4ed36917b26d8173a80387544375e79a4b0b2c2c20d972d5870e969fa6a6ead83e60e6128821fde234d64f0d48239ad4cc5008e077ebeb6cb5f5e7d1917c195cfc33ca44586011850e26b9d1a41929fdbb0d8fb744c66bac94a82b45d2f9fea312445c7cc0c11e9f3ad58bd52da7802c6ec9ea6a594ef75c25b84b0752ce4874e0d73b86f6442005763d5e423f2c58acfbceb5b3644562cc6dab2716f227206bf2b00d"], 0x0) (async) syz_emit_ethernet(0x82, &(0x7f0000000200)=ANY=[@ANYBLOB="0180c200000e1704b45adbde08004e000074ffff000000019078ac1e0001ac1414aa0500907806000000460000020000000000110000e000000100000000830300070300443c00037f0000890000372cdd457f00000029e9c5fd420000ac1414bbfffffffd0000000000000000ac141400000000000000000000000000ac1414aa00000000ac141400000000000000afa4934e524d92558682c38970315b572cec32625506000001a563964d3a8b8bb60e551f8d114aa347739123028d3b66e8dc96b8964f8a082c900601dbd7bb7b4ed36917b26d8173a80387544375e79a4b0b2c2c20d972d5870e969fa6a6ead83e60e6128821fde234d64f0d48239ad4cc5008e077ebeb6cb5f5e7d1917c195cfc33ca44586011850e26b9d1a41929fdbb0d8fb744c66bac94a82b45d2f9fea312445c7cc0c11e9f3ad58bd52da7802c6ec9ea6a594ef75c25b84b0752ce4874e0d73b86f6442005763d5e423f2c58acfbceb5b3644562cc6dab2716f227206bf2b00d"], 0x0) 3.616685194s ago: executing program 0 (id=6908): bind$inet6(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040), 0x111}}, 0x20) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept$alg(r2, 0x0, 0x0) write$binfmt_script(r3, &(0x7f0000000600), 0xfec8) recvmmsg(r3, &(0x7f0000000dc0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)=""/64, 0x40}, {&(0x7f0000000040)=""/97, 0x61}, {&(0x7f00000000c0)=""/60, 0x3c}], 0x3}, 0x2}, {{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000240)=""/188, 0xbc}, {&(0x7f0000000300)=""/99, 0x63}], 0x2}, 0x5}, {{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000640)=""/246, 0xf6}, {&(0x7f0000000740)=""/248, 0xf8}], 0x2, 0x0, 0x0, 0x8d}, 0x10}, {{0x0, 0x0, &(0x7f0000000cc0)=[{&(0x7f0000000900)=""/43, 0x2b}, {&(0x7f0000000a40)=""/192, 0xc0}, {&(0x7f0000000b00)=""/51, 0x33}, {&(0x7f0000000b40)=""/19, 0x13}, {&(0x7f0000000b80)=""/44, 0x2c}, {&(0x7f00000001c0)=""/119, 0x77}, {&(0x7f0000002680)=""/4085, 0xff5}], 0x7}, 0x1ff}], 0x4, 0x400120cb, 0x0) 3.598290788s ago: executing program 2 (id=6909): bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x1, 0x353a, 0x1}}, 0x20) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x894}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, 0x500) socket$nl_netfilter(0x10, 0x3, 0xc) lsm_set_self_attr(0x65, 0x0, 0x20, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000140)={'icmp\x00'}, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x9, 0x6, 0x0, 0x7}, 0x0) syz_open_dev$usbfs(0x0, 0x76, 0x101301) r2 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_dev$vim2m(0x0, 0x3, 0x2) ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000180)=@multiplanar_mmap={0x0, 0x2, 0x4, 0x0, 0x0, {0x77359400}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'y)\x00'}, 0x0, 0x1, {0x0}, 0xea}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000bc0), 0x380, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x3416, 0x13100}, 0x0, &(0x7f0000000000)) close_range(r2, 0xffffffffffffffff, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89101) ioctl$SOUND_MIXER_READ_DEVMASK(0xffffffffffffffff, 0x80044dfe, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000dfc0ff00bfa300000000000007030000f0ffffff720af0fff8ffffff71a4f0ff000000005d040200000000001d400500000000004704000001ed000062030000000000003f440000000000007a0a00fe00ffffffd704000020000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a1074649c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c0dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6acdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fed000000007baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca485683252b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a0032f37ff559be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee07751532d5e7d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e2fa3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef907000000f01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e015cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb581012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a0000000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) 2.347158219s ago: executing program 4 (id=6910): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, 0x0, 0x0) 2.230595892s ago: executing program 4 (id=6911): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000680)=ANY=[@ANYBLOB="70010000100033060000000000000000e0000001000000000000000000000000ac1414aa000000000000000000050000ffff400000007fff0000200000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414fd000000000000000000000000000004d432000000fe80000000000000000000000000000b23030000000000000000000100000000000000000000000003000000000000000d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000029bd7000000000000a00000001000000000000004800020070636263286663727970742900000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00200000004e1e00000000fe8800000000000000000000000000011c0004"], 0x170}}, 0x0) 2.069841703s ago: executing program 3 (id=6912): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0xc00, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x30, 0x5, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x4}]}, @NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xe0}}, 0x200000d4) 1.914986526s ago: executing program 4 (id=6913): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000380)={0x353, 0x78, 0x300, 0x0, 0xa, 0x0, 0x0, 0x0, {0x0, 0x300}, {}, {}, {}, 0x0, 0x0, 0x0, 0x1, 0x1, 0x4, 0x9f6, 0x3, 0x1ff, 0x803d, 0x1, 0x7, 0x5f, 0x202, 0x1, 0xc}) 1.774871027s ago: executing program 4 (id=6914): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="0203f30216000000001c00000000000002001b0008000000e9000000000000190300060000000000020000000000000000000000000000000200010000000000000003fcff000020030005000000000002000000ac1414aa00000000000000000a00080008"], 0xb0}, 0x1, 0x7}, 0x0) 1.77077393s ago: executing program 3 (id=6915): rt_sigaction(0x40, &(0x7f0000000500)={&(0x7f0000000380)="2437460f1c2bdfd5c4a2f10027460f38e7418f69d8909ca3000810ffa5c43b3be5c436fe0d4e486df513bb559a00000f75bed5370b1c2665d2950e000000dbf5", 0x4000000, 0x0}, 0x0, 0x8, &(0x7f0000001540)) r0 = semget$private(0x0, 0x4000000009, 0x42a) semop(r0, &(0x7f00000002c0)=[{0x0, 0x9b6a}, {0x4, 0x202}], 0x2) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000002240)={{0x2, 0x0, 0x0, 0x0, 0x0, 0x10a, 0x3}, 0x2, 0x6, 0x0, 0x0, 0x0, 0x0, 0x3}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') io_uring_enter(r1, 0xe0b, 0x9e1a, 0x40, &(0x7f0000000040)={[0x4]}, 0x8) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000004c0), 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="dc00000000010104000000000000000002000000240002801400018008000100e000000108000200e00000010c000280050001000000000008000480040003800800084000000000080008400000000734000f"], 0xdc}}, 0x0) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x8000, 0x0) ioctl$FBIO_WAITFORVSYNC(r4, 0x40044620, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) r5 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000340)={@random="cf702e8cf675", @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @dev, @dev, [{0x4, 0x1, "703b744dc5c6"}, {0x4, 0x1, "5cadf7451800"}]}}}}}}, 0x0) recvmsg$can_raw(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)=""/165, 0xa5}], 0x1}, 0x20) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000001c0)={0xffffffffffffffff}, 0x13f, 0x8}}, 0x20) fsetxattr$security_ima(r3, &(0x7f0000000080), &(0x7f00000000c0)=@sha1={0x1, "d6c6f277899fd570c55bc4d0c1c63fb1b7ba311f"}, 0x15, 0x1) write$RDMA_USER_CM_CMD_SET_OPTION(r6, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), r7, 0x0, 0x1, 0x4}}, 0x20) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000022c0)={0x1, @pix_mp={0x7, 0x400, 0x3147504d, 0x7, 0x5, [{0x9, 0x8}, {0x11, 0x8}, {0x5, 0x2}, {0x3}, {0x7, 0x100}, {0x5, 0x4}, {0x4, 0x7}, {0x401, 0x4}], 0x4d, 0x19, 0x2, 0x0, 0x3}}) semctl$GETZCNT(r0, 0x0, 0xf, &(0x7f00000023c0)=""/184) 1.714908637s ago: executing program 0 (id=6916): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002c00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3cb140bb}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_POLICY={0x8}]}], {0xfffffe62, 0x11, 0x1, 0x0, 0x2000000, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) 1.622200385s ago: executing program 2 (id=6917): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x20028802) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a0b040000000000000000070000002c0004802800018007000100637400001c0002800500060000000000080001400000000108000240000000140900010073797a30000000000900020073797a32"], 0x80}}, 0x0) 1.602438536s ago: executing program 4 (id=6918): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x2, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x1, &(0x7f0000000200)) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = mq_open(&(0x7f00000002c0)='mptcp_pm\x00', 0x40, 0x0, &(0x7f0000000300)={0x4, 0x1000, 0x6, 0xffffffff}) mq_notify(r6, &(0x7f0000000440)={0x0, 0x3c, 0x2, @thr={&(0x7f0000000340)="0ad6a6b4acb3bda0cb203fec7ff6080d1c8cc978", &(0x7f0000000380)="ec3662cf4deb6245b0464adf5fa427ea69feb9c0f8ff08b5650561803f99e7348cdec7b3bd7d4bd6504bee41ea531694252b9bbe22d27cd3fbef66d86db2e8b6961492a2c4cecfc5cca2499520f074b8b46fb32fe2284f59608395402bbc1e33a96ab39a36950113168031e603a0a33fbac407c00f140d64d86c3695f7621fc8273e40d85fe7a58815f97198052b592ad283d55fb82a9baecb6d26b10d49925e4809f09aeb2fdc7463"}}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r7, {0xf000, 0xffff}, {}, {0xfff3}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0x7, 0xfff1}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20040810) ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f00000001c0)) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r9, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x40d, 0x70bd2c, 0x3, {0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x5}, @IFLA_BOND_TLB_DYNAMIC_LB={0x5}]}}}]}, 0x44}, 0x1, 0xeaffffff}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={0x0}, 0x1, 0x0, 0x0, 0x4000041}, 0x0) 1.510873421s ago: executing program 0 (id=6919): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f0000002c00)=[{{0x0, 0x0, 0x0}, 0x1ff001}, {{0x0, 0x0, 0x0}, 0x10000001}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000800)=""/202, 0xca}, {&(0x7f0000000900)=""/230, 0xe6}, {&(0x7f0000003e00)=""/4111, 0x100f}, {&(0x7f00000001c0)=""/229, 0xe5}], 0x4}, 0x8101}, {{0x0, 0x0, 0x0}, 0x40}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000b80)=""/223, 0xdf}, {&(0x7f0000001a00)=""/4096, 0x1000}, {&(0x7f0000002e00)=""/4087, 0xff7}, {&(0x7f0000000440)=""/117, 0x75}, {&(0x7f0000000500)=""/90, 0x5a}, {&(0x7f0000000a00)=""/166, 0xa6}], 0x6}, 0x4db}, {{0x0, 0x0, 0x0}, 0x8}], 0x8, 0x1000000, 0x0) 1.482095036s ago: executing program 2 (id=6920): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, 0x0, 0x0) 1.428506841s ago: executing program 0 (id=6921): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0) fcntl$setlease(r2, 0x400, 0x1) r3 = add_key$keyring(0x0, &(0x7f0000001100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0xe501, 0x3, 0x208, 0xb8, 0xa, 0x1000000, 0x0, 0x0, 0x170, 0x230, 0x230, 0x170, 0x223, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3b9, 'syz0\x00'}}}, {{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x3c0, 'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x268) r4 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000300)="300e308002", 0x1001, r3) close(r2) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x32) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r5 = socket(0x10, 0x2, 0x0) write(r5, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r5, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0300000004000000040000000900000000000000", @ANYRES32=0x1, @ANYRES8, @ANYRES32=0x0, @ANYRESOCT=r3, @ANYBLOB='\x00'/28, @ANYBLOB="4a1304e76a1d8750b27c847ea745bf4f8b51d2d707ee2d17324984a97eac7d8fcb86054dac8af3baa82831733e79dcfef482097163c9af2065278931a012b63209d402367e593a92477091a84f9f61744859fbde04fa6d83e835aeff79c5874d5727da3e4f37adc807f543e82558c9186ef7cbda6aceafcf1bc3ddda8b567d98eb7c4b9831135639a20bf7eae99f7157a070cbe666fe86044c75cb70442a76e32d75b702e606bfd9f694b08a7cf3e6c9a1e8cb7d9cdf9ddb8cf979d3fc4779f152748d149ef63aa73331bc8134f39c0448bd1cbcf60151bfad55d0ad463df3fd0a207bc985026abe9e119ade2b50a9add7aeaf314d6744", @ANYRES32=r1, @ANYRES32=r4, @ANYRESOCT=r2, @ANYRES16=r2], 0x48) preadv2(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x40000, 0x0, 0x8) dup(r5) r6 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) ioctl$SG_IO(r7, 0x2285, &(0x7f0000000680)={0x507b2ed28dbb6a8f, 0x0, 0x0, 0x0, @buffer={0x2, 0x0, 0x0}, 0x0, 0x0, 0xee9, 0x0, 0xfffffffd, 0x0}) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r9 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) ioctl$LOOP_CONFIGURE(r9, 0x4c0a, &(0x7f0000001ac0)={r8, 0x0, {0xffffffffffffbeda, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1c, "ff9f020bbe82b398b1c4369d03740250ceaac594b1b3d741dd17c1ac0d38ef2a565ef1e8336300", "a9103939c787a16c1ca43f80026d1f3c4da06963dd89d130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b7e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200", [0xfffffffffffffffe]}}) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000005200110300000000000000000200000089d4a06b4aa1e85d2215218e1caaa125dfe97e7524a361db519608c07a4534c7de5a66088c4c8982f390901eeeaeb4ad8a6e1657ad45c6fcca1597998ac05cfa207f04176bec5895fd7a0ed8e7697e583b2468ec5d12c203795ed8f6d9a824843ea2c9d6d5082c5d4b793a03b8b474c0abe82fde6bce29c712"], 0x14}}, 0x0) ioctl$LOOP_SET_STATUS64(r9, 0x4c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2ac, 0x0, 0x1, 0x55, 0x0, "89753015418ab0cb0900245518580ce0c8bf604cca41f31c108938fcfa393ef569e0bcf244bb4b23555b130900000000000000d0f08e8ad896ba67a07673defa", "8b6090092aa722681a1ee3f88792f688a9e306ee1dba533f02e1b69da6e26ec889fee40080000027cc7d24d796682495d702020000e4b8fb1703e47463b969e4", "ca1bf5ffffc92915ff6e000000abf60400", [0xc]}) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="3c010000100013040000000000000000fe8000000000000000000000000000aa20010000000000000000000000000000fffd00004e2400020200002000000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="640101000000000000000000000000000000000032000000fc0000000000000000000000000000010002000000000000070000000000000000000000000000000400000000000000ffffffffffffffff04000000000000000800000000020000000000000000000001000000010000000800000000000000cc000000000000000000000000000000f6000000000000000000000000000000000000000200000100000000000000004c001200726663343330392863636d286165732929000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000003c1aae202c0ab0557f70478ba9445abf24e50c89137dcb4eb081e4073da3b8eb0d80a30e8b0ccdf9bff315e2bd92531a49e48c8b5c9a48bbcb73ef284e2763c72ccf0e616684b17eeebe00107c1909799387dc"], 0x13c}}, 0x804) 1.250664234s ago: executing program 2 (id=6922): r0 = socket$inet(0x2, 0x800, 0x6c32) setsockopt$inet_group_source_req(r0, 0x0, 0x2f, &(0x7f0000000080)={0x5, {{0x2, 0x4e22, @multicast1}}, {{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, 0x108) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x78, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x28}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x1c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_NAT_SRC={0x4}]}, 0x78}}, 0x0) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0xc0, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x2c, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MAXIP={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x31}}, @CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0xc0}}, 0x0) (async) r3 = getpgid(0x0) sched_setattr(r3, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa0d, 0x7fff}, 0x0) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000240)={&(0x7f0000000380)={0x150, 0x32, 0x100, 0x70bd27, 0x25dfdbfc, {0x3}, [@nested={0xc, 0xe0, 0x0, 0x1, [@typed={0x8, 0x20, 0x0, 0x0, @pid=r3}]}, @nested={0x10, 0x4e, 0x0, 0x1, [@nested={0x4, 0xf7}, @typed={0x8, 0xa5, 0x0, 0x0, @fd=r2}]}, @generic="10e4f2accd9b996e1fe4", @nested={0x61, 0xf8, 0x0, 0x1, [@nested={0x4, 0x9e}, @nested={0x4, 0xd5}, @generic="709c2afddb912ac9bccaceb184c6ef9e999104a786a618e9b1118338775180840408a9d140838ed1594d62f8a643255c459e2ccfc70857db988e0ae9790e39a6c31fb19bc5a290eafb2e412c8932a1d3b2a990e6aa"]}, @typed={0x14, 0x4c, 0x0, 0x0, @ipv6=@local}, @nested={0x20, 0x69, 0x0, 0x1, [@typed={0x8, 0x9e, 0x0, 0x0, @fd=r1}, @nested={0x4, 0xfb}, @typed={0xd, 0x2b, 0x0, 0x0, @str='}^-.\\y(%\x00'}]}, @nested={0x7a, 0x12b, 0x0, 0x1, [@generic="530f94d0fa9a58261e05c25cb5d8c9452e72dc75022ea7744018d619a384c43ab2a6ce732b0d6729ae8e1984040439df1592a243ca4e88f239b4cae7aa392bc4abc6b61a212fac7c20005af3d2b7264f6c9603f05cf28ecd3b7e5bfd7e35fdac5527d8f5d61b9d6cda57068159cc582de227be7028bb"]}]}, 0x150}, 0x1, 0x0, 0x0, 0x801}, 0x14040020) (async) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYRESHEX=0x0], 0x0) 714.389466ms ago: executing program 3 (id=6923): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x64, 0x3, 0x2d8, 0x6e, 0xffffffad, 0x190, 0x190, 0x190, 0x268, 0x268, 0x268, 0x268, 0x268, 0x3, 0x0, {[{{@ip={@remote, @local={0xac, 0x14, 0xd}, 0x0, 0x0, 'caif0\x00', 'ip6tnl0\x00'}, 0x0, 0x130, 0x190, 0xffffffc5, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "bdc74c01369df17d17ac76fa5f9b3bfa0c34430d864040bc25b2b73a59aa6ecab6b1d2cc05e3182f64694d7d05fb8b8c8f56627a54f905d564eeeb8334f650ca0f3c44f7fda4d20a55050342ea85ecc8838e7088de33582f36a0a375bb7008adc297a5ece1bb2df53d17bef26bb6f800", 0x7f, 0x2}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x6802]}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, 0x0, 0x0, 'team0\x00', 'team0\x00'}, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x338) 393.994737ms ago: executing program 3 (id=6924): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x38, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0x9, 0x1, 'l2tp\x00'}]}}}]}]}], {0x14}}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010400002400000000000500fffe0900010073797a30000000002c000000030a01020000000000000000050000000900010073797a30000000000900030073797a3200000000e4040000060a010400000000000000000500000008000b40000000000900010073797a300000000008000940000000020c0005800800014000000000c4000740ab487b1b512f33a8dbd67a8b35f2405127f309901ea13e31d5810f85eae8f528c938c24abb1b1abbda2e7fa6e0758629bb09ed64a8ba5b2ef3c3591fd06d7e10d93c0857ecac854ac51ad69639d98adb2c1464e444cc1a6a2e7ee244622433b51f58606b063f4938101a7e764c957eba2e913b2ac10435471fa769740a1275cb467e5264b71bc8727fc12e9aba46e4a8abf3dda91e0da608d6a0a35573d5524fb25451cc23051887de4df85c8e771260c4943e78905aa1e7493027366ed1bea0d80304804800018008000100667764003c0002800800"], 0x558}}, 0x40) 317.631627ms ago: executing program 5 (id=6894): openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) openat$sysfs(0xffffff9c, &(0x7f0000000000)='/sys/kernel/kexec_crash_size', 0x200, 0x228) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x6, 0x24, &(0x7f00000006c0)={{0x12, 0x1, 0x250, 0xef, 0x8d, 0x71, 0x40, 0x22de, 0x9051, 0x248e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x2, 0x80, 0x2c, [{{0x9, 0x4, 0x2, 0x5, 0x0, 0x3c, 0xa6, 0xa8, 0x5}}]}}]}}, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) socket$unix(0x1, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$inet6(0xa, 0x80001, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200200000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x64}}, 0x0) 3.556899ms ago: executing program 3 (id=6925): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300030e0000002cbd7000fbdbdf2503000900800000001cdc0dca1d9f68846960e58ee42944af030006000000000002004e20ac1414bb000000000000030002000100000000000000070c00000000030005000000000002004e20ac1e010100000000000000000100140007"], 0x70}, 0x1, 0x7}, 0x0) 0s ago: executing program 0 (id=6926): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000002060101000000000500000000a67b057e6bda626f0000000900020073797a300000000005000100"], 0x30}}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000240)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000001540), 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000f80)={0x84, &(0x7f0000000b00)={0x0, 0x0, 0x1, '6'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCGLED(r0, 0x5452, &(0x7f0000000240)=""/77) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x78, 0x822b01) write$char_usb(r1, &(0x7f0000000040)="e2", 0x1068) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001d0001000000000004086aa42d"], 0x30}}, 0x0) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100001d906e20501dc6609b620103000109021b0001000010000904f7000176246700090582020002"], 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x2ae) syz_usb_disconnect(r3) preadv(r4, &(0x7f0000000100)=[{&(0x7f00000001c0)=""/178, 0xb2}], 0x1, 0x1ff, 0x401) kernel console output (not intermixed with test programs): USB disconnect, device number 87 [ 1331.616472][T27860] trusted_key: encrypted_key: insufficient parameters specified [ 1332.062633][T27874] xt_TCPMSS: Only works on TCP SYN packets [ 1332.402059][T27860] netlink: 'syz.1.6339': attribute type 12 has an invalid length. [ 1332.762413][T27877] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6341'. [ 1334.834404][ T5832] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 1334.944666][T27914] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6356'. [ 1334.955023][T27914] netlink: 'syz.3.6356': attribute type 1 has an invalid length. [ 1335.005381][ T5832] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1335.029850][ T5832] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1335.041058][ T5832] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1335.051144][ T5832] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1335.065922][ T5832] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1335.079897][ T5832] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1335.090241][ T5832] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1335.109212][ T5832] usb 2-1: Product: syz [ 1335.118960][ T5832] usb 2-1: Manufacturer: syz [ 1335.137324][ T5832] cdc_wdm 2-1:1.0: skipping garbage [ 1335.142583][ T5832] cdc_wdm 2-1:1.0: skipping garbage [ 1335.151984][ T5832] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1335.194192][ T5832] cdc_wdm 2-1:1.0: Unknown control protocol [ 1335.297806][T27928] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 1335.574888][ T5917] hid_parser_main: 10 callbacks suppressed [ 1335.574911][ T5917] hid-generic 00A0:0006:0003.003F: unknown main item tag 0x0 [ 1335.631162][ T5917] hid-generic 00A0:0006:0003.003F: unknown main item tag 0x0 [ 1335.666858][ T5917] hid-generic 00A0:0006:0003.003F: unknown main item tag 0x0 [ 1335.682158][ T5917] hid-generic 00A0:0006:0003.003F: unknown main item tag 0x0 [ 1335.690194][ T5917] hid-generic 00A0:0006:0003.003F: unknown main item tag 0x0 [ 1335.712281][ T5917] hid-generic 00A0:0006:0003.003F: unknown main item tag 0x0 [ 1335.735668][ T5917] hid-generic 00A0:0006:0003.003F: unknown main item tag 0x0 [ 1335.747886][ T5917] hid-generic 00A0:0006:0003.003F: unknown main item tag 0x0 [ 1335.748924][T27941] kvm: user requested TSC rate below hardware speed [ 1335.763472][ T5913] usb 5-1: new full-speed USB device number 67 using dummy_hcd [ 1335.772337][T27942] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1335.800916][ T2153] usb 4-1: new full-speed USB device number 88 using dummy_hcd [ 1335.810803][ T5917] hid-generic 00A0:0006:0003.003F: unknown main item tag 0x0 [ 1335.835642][ T5917] hid-generic 00A0:0006:0003.003F: unknown main item tag 0x0 [ 1335.906356][ T5917] hid-generic 00A0:0006:0003.003F: hidraw0: HID v0.05 Device [syz1] on syz0 [ 1335.955104][ T5913] usb 5-1: not running at top speed; connect to a high speed hub [ 1335.965440][ T5913] usb 5-1: config 1 interface 0 has no altsetting 0 [ 1335.991319][ T2153] usb 4-1: config 0 has no interfaces? [ 1336.001905][ T5913] usb 5-1: string descriptor 0 read error: -22 [ 1336.012773][ T5913] usb 5-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 1336.026356][ T2153] usb 4-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 1336.060250][ T2153] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1336.081175][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1336.142971][ T2153] usb 4-1: config 0 descriptor?? [ 1336.170825][ T5913] usblp0: Disabling reads from problematic bidirectional printer [ 1336.346193][T27937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1336.368527][T27937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1336.453085][T27937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1336.469582][T27937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1336.578972][T27937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1336.644010][T27937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1336.706568][T27937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1336.718893][T27937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1336.811827][ T5913] usblp 5-1:1.0: usblp1: USB Unidirectional printer dev 67 if 0 alt 7 proto 1 vid 0x03F0 pid 0x0004 [ 1336.868720][ T5913] usb 5-1: USB disconnect, device number 67 [ 1336.953917][ T5913] usblp1: removed [ 1336.969534][T27959] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6371'. [ 1337.024568][T27959] vlan2: entered promiscuous mode [ 1337.029775][T27959] batadv0: entered promiscuous mode [ 1337.583839][T25684] usb 2-1: USB disconnect, device number 127 [ 1338.470433][T27987] binder: 27977:27987 ioctl 400c620e 200000000380 returned -22 [ 1338.590755][T27991] dummy0: entered promiscuous mode [ 1338.596365][T27991] macsec1: entered promiscuous mode [ 1338.604925][T27991] dummy0: left promiscuous mode [ 1338.773872][ T5913] usb 3-1: new full-speed USB device number 62 using dummy_hcd [ 1338.893287][ T10] usb 4-1: USB disconnect, device number 88 [ 1338.976214][ T5913] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 1339.032432][ T5913] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1339.073449][ T5913] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 1339.090935][ T5913] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1339.127868][T28003] xt_TCPMSS: Only works on TCP SYN packets [ 1339.217574][ T5913] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1339.241745][ T5913] usb 3-1: Product: syz [ 1339.288024][ T5913] usb 3-1: Manufacturer: syz [ 1339.303199][ T5913] usb 3-1: SerialNumber: syz [ 1339.330010][ T5913] usb 3-1: config 0 descriptor?? [ 1339.358732][T27989] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1339.458235][T27989] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1339.523214][ T5913] usb 3-1: ucan: probing device on interface #0 [ 1339.737608][T27989] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1339.748152][T28016] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6388'. [ 1339.759808][T27989] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1340.113649][ T5913] usb 3-1: ucan: failed to retrieve device info [ 1340.196861][ T5913] usb 3-1: ucan: probe failed; try to update the device firmware [ 1340.238339][ T5913] usb 3-1: USB disconnect, device number 62 [ 1340.505039][T28031] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6393'. [ 1340.955492][T28038] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1341.543786][ T5917] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 1341.558868][T28058] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6401'. [ 1341.814208][ T5917] usb 1-1: too many configurations: 17, using maximum allowed: 8 [ 1341.857279][ T5917] usb 1-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 1341.866665][ T5917] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1341.875281][ T5917] usb 1-1: Product: syz [ 1341.879561][ T5917] usb 1-1: Manufacturer: syz [ 1341.887487][ T5917] usb 1-1: SerialNumber: syz [ 1341.897664][ T5917] usb 1-1: config 0 descriptor?? [ 1341.907374][ T5917] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 1342.021215][ T5917] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1342.079428][ T5917] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) error while loading driver (-23) [ 1342.090519][ T5917] dvb_usb_digitv 1-1:0.0: probe with driver dvb_usb_digitv failed with error -23 [ 1342.137415][T28047] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1342.163955][ T5832] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 1342.185522][T28047] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1342.330064][ T5832] usb 4-1: Using ep0 maxpacket: 8 [ 1342.360662][ T5832] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1342.381163][ T5832] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1342.396643][T28047] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3089888063 (3089888063 ns) > initial count (2126324423 ns). Using initial count to start timer. [ 1342.406186][ T5832] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1342.430599][ T5832] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1342.445868][ T5832] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1342.473526][ T5832] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1342.495377][ T5832] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1342.514830][ T5832] usb 4-1: config 168 interface 0 has no altsetting 0 [ 1342.538110][ T5832] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1342.547455][ T5832] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1342.580136][ T5832] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1342.633000][ T5832] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1342.678975][ T5832] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1342.705690][T25684] usb 1-1: USB disconnect, device number 42 [ 1342.731794][ T5832] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1342.764670][ T5832] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1342.798716][ T5832] usb 4-1: config 168 interface 0 has no altsetting 0 [ 1342.825446][ T5832] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1342.833083][ T5832] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1342.870909][T28080] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6407'. [ 1342.884441][ T5832] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1342.920276][ T5832] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1342.934672][ T5832] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1342.950918][ T5832] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1343.006450][ T5832] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1343.066699][ T5832] usb 4-1: config 168 interface 0 has no altsetting 0 [ 1343.165578][ T5832] usb 4-1: string descriptor 0 read error: -22 [ 1343.172120][ T5832] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1343.201948][ T5832] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1343.281414][ T5832] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1343.611465][ T5832] usb 4-1: USB disconnect, device number 89 [ 1343.801927][T28109] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6410'. [ 1344.103468][ T5832] usb 4-1: new full-speed USB device number 90 using dummy_hcd [ 1344.331804][ T5832] usb 4-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 1344.344834][ T5832] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1344.385796][ T5832] usb 4-1: Product: syz [ 1344.390005][ T5832] usb 4-1: Manufacturer: syz [ 1344.422474][ T5832] usb 4-1: SerialNumber: syz [ 1344.488096][ T5832] usb 4-1: config 0 descriptor?? [ 1344.856596][T28136] loop6: detected capacity change from 0 to 2 [ 1344.883960][T25684] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1344.965401][T28136] Dev loop6: unable to read RDB block 2 [ 1344.971268][T28136] loop6: unable to read partition table [ 1344.998317][T28136] loop6: partition table beyond EOD, truncated [ 1345.005262][T28136] loop_reread_partitions: partition scan of loop6 ( 6tPΪŔA8*V^3c) failed (rc=-5) [ 1345.130653][T25684] usb 2-1: Using ep0 maxpacket: 16 [ 1345.138200][T25684] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1345.148753][T25684] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x2 has an invalid bInterval 129, changing to 11 [ 1345.166175][T25684] usb 2-1: config 0 interface 0 altsetting 16 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1345.181365][T25684] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1345.260699][T28135] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1345.331228][T25684] usb 2-1: New USB device found, idVendor=1e71, idProduct=2010, bcdDevice= 0.00 [ 1345.366211][T25684] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1345.406808][T25684] usb 2-1: config 0 descriptor?? [ 1345.748486][ T5200] Dev loop6: unable to read RDB block 2 [ 1345.765735][ T5200] loop6: unable to read partition table [ 1345.765781][ T5832] airspy 4-1:0.0: usb_control_msg() failed -110 request 0a [ 1345.793589][ T5200] loop6: partition table beyond EOD, truncated [ 1345.821303][ T5832] airspy 4-1:0.0: Could not detect board [ 1345.866033][ T5832] airspy 4-1:0.0: probe with driver airspy failed with error -110 [ 1345.944867][T25684] hid_parser_main: 5 callbacks suppressed [ 1345.944883][T25684] nzxt-smart2 0003:1E71:2010.0040: unknown main item tag 0x0 [ 1345.996429][T25684] nzxt-smart2 0003:1E71:2010.0040: unknown main item tag 0x0 [ 1346.020355][ T5913] hid-generic 0002:0001:000A.0041: item fetching failed at offset 0/19 [ 1346.038134][ T5913] hid-generic 0002:0001:000A.0041: probe with driver hid-generic failed with error -22 [ 1346.048013][T25684] nzxt-smart2 0003:1E71:2010.0040: unknown main item tag 0x0 [ 1346.096370][ T5832] usb 4-1: USB disconnect, device number 90 [ 1346.110734][T25684] nzxt-smart2 0003:1E71:2010.0040: unknown main item tag 0x0 [ 1346.160940][T28126] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1346.169654][T28126] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1346.243544][T25684] nzxt-smart2 0003:1E71:2010.0040: unknown main item tag 0x0 [ 1346.265938][T25684] nzxt-smart2 0003:1E71:2010.0040: hidraw0: USB HID v0.05 Device [HID 1e71:2010] on usb-dummy_hcd.1-1/input0 [ 1346.473492][T25684] usb 2-1: USB disconnect, device number 2 [ 1346.486601][T28156] binder: 28146:28156 ioctl 400c620e 200000000380 returned -22 [ 1346.562703][ T5917] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 1346.626135][T28152] fido_id[28152]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 1346.674229][T20151] usb 1-1: new full-speed USB device number 43 using dummy_hcd [ 1346.715789][ T5917] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1346.726831][ T5917] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1346.737651][ T5917] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1346.751005][ T5917] usb 5-1: config 0 descriptor?? [ 1346.804918][ T5917] pwc: Askey VC010 type 2 USB webcam detected. [ 1346.835553][T20151] usb 1-1: config 0 has an invalid interface number: 151 but max is 1 [ 1346.845108][T20151] usb 1-1: config 0 has no interface number 1 [ 1346.851391][T20151] usb 1-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1346.869064][T20151] usb 1-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1346.892207][T20151] usb 1-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1346.948912][T20151] usb 1-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1347.173477][ T5917] pwc: recv_control_msg error -71 req 02 val 2b00 [ 1347.190386][T20151] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1347.209688][ T5917] pwc: recv_control_msg error -71 req 02 val 2700 [ 1347.221874][T20151] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1347.223898][T28168] AppArmor: change_hat: Invalid input '0' [ 1347.233180][ T5917] pwc: recv_control_msg error -71 req 02 val 2c00 [ 1347.249570][ T5917] pwc: recv_control_msg error -71 req 04 val 1000 [ 1347.263138][T20151] usb 1-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1347.272591][T20151] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1347.288592][T20151] usb 1-1: Product: syz [ 1347.295239][ T5917] pwc: recv_control_msg error -71 req 04 val 1300 [ 1347.306173][T20151] usb 1-1: Manufacturer: syz [ 1347.320848][ T5917] pwc: recv_control_msg error -71 req 04 val 1400 [ 1347.333457][T20151] usb 1-1: SerialNumber: syz [ 1347.351781][ T5917] pwc: recv_control_msg error -71 req 02 val 2000 [ 1347.360350][ T5917] pwc: recv_control_msg error -71 req 02 val 2100 [ 1347.366949][T20151] usb 1-1: config 0 descriptor?? [ 1347.372945][T28151] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1347.389194][T20151] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1347.396791][ T5917] pwc: recv_control_msg error -71 req 04 val 1500 [ 1347.414363][ T5917] pwc: recv_control_msg error -71 req 02 val 2500 [ 1347.428259][T20151] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1347.438806][ T5917] pwc: recv_control_msg error -71 req 02 val 2400 [ 1347.448235][ T5917] pwc: recv_control_msg error -71 req 02 val 2600 [ 1347.473191][ T5917] pwc: recv_control_msg error -71 req 02 val 2900 [ 1347.516243][ T5917] pwc: recv_control_msg error -71 req 02 val 2800 [ 1347.525095][T20151] snd-usb-audio 1-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1347.534649][ T5917] pwc: recv_control_msg error -71 req 04 val 1100 [ 1347.600216][ T5917] pwc: recv_control_msg error -71 req 04 val 1200 [ 1347.607191][T20151] usb 1-1: USB disconnect, device number 43 [ 1347.631979][T28177] xt_TCPMSS: Only works on TCP SYN packets [ 1347.838105][ T5917] pwc: Registered as video103. [ 1347.996112][ T5917] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input133 [ 1348.150579][T28185] udevd[28185]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1348.220307][ T5917] usb 5-1: USB disconnect, device number 68 [ 1348.635724][T28188] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6428'. [ 1349.194044][ T24] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 1349.454457][T28216] loop6: detected capacity change from 0 to 2 [ 1349.481427][T28216] Dev loop6: unable to read RDB block 2 [ 1349.492153][T28216] loop6: unable to read partition table [ 1349.501072][T28216] loop6: partition table beyond EOD, truncated [ 1349.510183][ T5917] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 1349.528667][T28218] netlink: 'syz.1.6432': attribute type 5 has an invalid length. [ 1349.537380][T28216] loop_reread_partitions: partition scan of loop6 ( 6tPΪŔA8*V^3c) failed (rc=-5) [ 1349.553599][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 1349.587448][ T24] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1349.613016][ T24] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1349.706311][ T24] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1349.767104][ T5917] usb 5-1: config 1 interface 0 altsetting 5 bulk endpoint 0x1 has invalid maxpacket 1023 [ 1349.779441][ T24] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1349.822776][ T5917] usb 5-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1349.867688][T28225] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1349.889449][ T24] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1349.910696][ T5917] usb 5-1: config 1 interface 0 has no altsetting 0 [ 1349.933453][ T24] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1349.963224][ T5917] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1349.986137][T28226] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6433'. [ 1350.011416][ T5917] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1350.019657][ T24] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1350.043498][ T5917] usb 5-1: Product: syz [ 1350.147007][ T5917] usb 5-1: Manufacturer: syz [ 1350.151954][ T24] usb 4-1: config 168 interface 0 has no altsetting 0 [ 1350.163526][ T5917] usb 5-1: SerialNumber: syz [ 1350.181137][ T24] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1350.204254][T28209] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1350.211563][T28209] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1350.223464][ T24] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1350.243871][ T24] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1350.281183][ T24] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1350.294822][T28230] batadv_slave_0: entered promiscuous mode [ 1350.300811][T28230] batadv_slave_0: left promiscuous mode [ 1350.306502][ T24] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1350.350860][ T24] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1350.396027][ T24] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1350.447020][ T24] usb 4-1: config 168 interface 0 has no altsetting 0 [ 1350.540272][ T24] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1350.603982][ T24] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1350.663509][ T24] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1350.710105][ T24] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1350.770960][ T24] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1350.833459][ T24] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1350.862456][ T24] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1350.896259][ T24] usb 4-1: config 168 interface 0 has no altsetting 0 [ 1350.909631][ T24] usb 4-1: string descriptor 0 read error: -22 [ 1350.925527][ T24] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1350.936084][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1350.968389][ T24] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1351.118967][ T30] audit: type=1326 audit(1760357885.409:1458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28178 comm="syz.4.6427" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7efcb7d8eec9 code=0x0 [ 1351.305345][ T5917] usb 5-1: USB disconnect, device number 69 [ 1351.313789][T25684] usb 4-1: USB disconnect, device number 91 [ 1351.597640][T28242] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6439'. [ 1351.813584][T25684] usb 4-1: new full-speed USB device number 92 using dummy_hcd [ 1351.988138][T25684] usb 4-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 1352.005175][T25684] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1352.052999][T25684] usb 4-1: Product: syz [ 1352.074741][T25684] usb 4-1: Manufacturer: syz [ 1352.088463][T25684] usb 4-1: SerialNumber: syz [ 1352.134497][T25684] usb 4-1: config 0 descriptor?? [ 1352.286630][T28274] binder: 28263:28274 ioctl c0306201 0 returned -14 [ 1352.737218][T28284] FAULT_INJECTION: forcing a failure. [ 1352.737218][T28284] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1352.753226][T28284] CPU: 1 UID: 0 PID: 28284 Comm: syz.2.6450 Not tainted syzkaller #0 PREEMPT(full) [ 1352.753254][T28284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1352.753266][T28284] Call Trace: [ 1352.753275][T28284] [ 1352.753286][T28284] dump_stack_lvl+0x189/0x250 [ 1352.753313][T28284] ? __pfx____ratelimit+0x10/0x10 [ 1352.753342][T28284] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1352.753371][T28284] ? __pfx__printk+0x10/0x10 [ 1352.753389][T28284] ? __might_fault+0xb0/0x130 [ 1352.753415][T28284] should_fail_ex+0x414/0x560 [ 1352.753445][T28284] _copy_from_user+0x2d/0xb0 [ 1352.753467][T28284] ___sys_sendmsg+0x158/0x2a0 [ 1352.753486][T28284] ? __pfx____sys_sendmsg+0x10/0x10 [ 1352.753546][T28284] ? __fget_files+0x2a/0x420 [ 1352.753566][T28284] ? __fget_files+0x3a0/0x420 [ 1352.753594][T28284] __x64_sys_sendmsg+0x19b/0x260 [ 1352.753613][T28284] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1352.753639][T28284] ? __pfx_ksys_write+0x10/0x10 [ 1352.753662][T28284] ? do_syscall_64+0xbe/0xfa0 [ 1352.753683][T28284] do_syscall_64+0xfa/0xfa0 [ 1352.753700][T28284] ? lockdep_hardirqs_on+0x9c/0x150 [ 1352.753718][T28284] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1352.753737][T28284] ? clear_bhb_loop+0x60/0xb0 [ 1352.753759][T28284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1352.753776][T28284] RIP: 0033:0x7f9c2778eec9 [ 1352.753793][T28284] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1352.753808][T28284] RSP: 002b:00007f9c2862b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1352.753829][T28284] RAX: ffffffffffffffda RBX: 00007f9c279e5fa0 RCX: 00007f9c2778eec9 [ 1352.753844][T28284] RDX: 0000000024000840 RSI: 0000200000009b40 RDI: 0000000000000003 [ 1352.753856][T28284] RBP: 00007f9c2862b090 R08: 0000000000000000 R09: 0000000000000000 [ 1352.753868][T28284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1352.753880][T28284] R13: 00007f9c279e6038 R14: 00007f9c279e5fa0 R15: 00007f9c27b0fa28 [ 1352.753910][T28284] [ 1352.954327][ C1] vkms_vblank_simulate: vblank timer overrun [ 1353.233625][ T5917] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 1353.433493][T25684] airspy 4-1:0.0: usb_control_msg() failed -110 request 0a [ 1353.444450][T25684] airspy 4-1:0.0: Could not detect board [ 1353.483472][T25684] airspy 4-1:0.0: probe with driver airspy failed with error -110 [ 1353.513551][ T5917] usb 5-1: Using ep0 maxpacket: 16 [ 1353.649027][ T5917] usb 5-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 1353.658322][ T5917] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1353.821627][ T5917] usb 5-1: config 0 descriptor?? [ 1353.827316][T25684] usb 4-1: USB disconnect, device number 92 [ 1353.840591][ T5917] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 1354.242557][ T5917] gspca_sonixj: reg_r err -32 [ 1354.247431][ T5917] sonixj 5-1:0.0: probe with driver sonixj failed with error -32 [ 1354.292268][T28302] xt_TCPMSS: Only works on TCP SYN packets [ 1354.465282][ T5832] usb 5-1: USB disconnect, device number 70 [ 1354.472380][T28303] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6455'. [ 1354.884827][T28313] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6459'. [ 1354.901641][T28313] netlink: 'syz.3.6459': attribute type 1 has an invalid length. [ 1354.986723][T28315] IPv6: NLM_F_CREATE should be specified when creating new route [ 1355.063953][T28315] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1355.071201][T28315] IPv6: NLM_F_CREATE should be set when creating new route [ 1355.493211][T28322] netlink: 'syz.3.6462': attribute type 10 has an invalid length. [ 1355.539423][T28322] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1355.987455][T28322] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1356.040828][T28322] bond0: (slave batadv_slave_0): Enslaving as an active interface with an up link [ 1356.313890][T28332] netlink: 'syz.2.6464': attribute type 32 has an invalid length. [ 1356.321912][T28332] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6464'. [ 1356.516203][ T30] audit: type=1326 audit(1760357890.809:1459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28333 comm="syz.1.6466" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05ee98eec9 code=0x7ffc0000 [ 1356.582659][ T30] audit: type=1326 audit(1760357890.809:1460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28333 comm="syz.1.6466" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05ee98eec9 code=0x7ffc0000 [ 1356.606602][ T30] audit: type=1326 audit(1760357890.809:1461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28333 comm="syz.1.6466" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f05ee98eec9 code=0x7ffc0000 [ 1356.654025][T28340] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6469'. [ 1356.732964][T28343] i2c i2c-0: Invalid block read size 255 [ 1356.878685][ T30] audit: type=1326 audit(1760357890.809:1462): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28333 comm="syz.1.6466" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05ee98eec9 code=0x7ffc0000 [ 1356.901859][ T30] audit: type=1326 audit(1760357890.809:1463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28333 comm="syz.1.6466" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05ee98eec9 code=0x7ffc0000 [ 1356.960009][ T30] audit: type=1326 audit(1760357890.829:1464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28333 comm="syz.1.6466" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05ee98eec9 code=0x7ffc0000 [ 1357.282578][T28358] netlink: 'syz.4.6473': attribute type 1 has an invalid length. [ 1357.625929][T28358] netlink: 68 bytes leftover after parsing attributes in process `syz.4.6473'. [ 1357.733950][T28360] tipc: Enabling of bearer rejected, failed to enable media [ 1358.383502][ T30] audit: type=1326 audit(1760357892.649:1465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28371 comm="syz.3.6481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996df8eec9 code=0x7ffc0000 [ 1358.391069][T28375] dummy0: entered promiscuous mode [ 1358.414318][T28376] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6479'. [ 1358.433850][T28375] macsec0: entered promiscuous mode [ 1358.516538][ T30] audit: type=1326 audit(1760357892.649:1466): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28371 comm="syz.3.6481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996df8eec9 code=0x7ffc0000 [ 1358.581586][T28375] dummy0: left promiscuous mode [ 1358.656442][T28385] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6485'. [ 1358.700364][T28386] netlink: 27 bytes leftover after parsing attributes in process `syz.0.6484'. [ 1358.716987][ T30] audit: type=1326 audit(1760357892.649:1467): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28371 comm="syz.3.6481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f996df8eec9 code=0x7ffc0000 [ 1358.807260][ T30] audit: type=1326 audit(1760357892.649:1468): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28371 comm="syz.3.6481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996df8eec9 code=0x7ffc0000 [ 1359.087172][T28402] netlink: 'syz.4.6491': attribute type 32 has an invalid length. [ 1359.153483][T25684] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1359.173924][ T24] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 1359.205393][T28404] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6492'. [ 1359.222626][T28404] vlan3: entered promiscuous mode [ 1359.230179][T28404] batadv0: entered promiscuous mode [ 1359.315134][T25684] usb 2-1: config 0 has an invalid interface number: 255 but max is 0 [ 1359.351340][T25684] usb 2-1: config 0 has no interface number 0 [ 1359.358482][T25684] usb 2-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 1359.373488][T25684] usb 2-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1359.384417][ T24] usb 1-1: config 0 interface 0 altsetting 185 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1359.393789][T25684] usb 2-1: config 0 interface 255 has no altsetting 0 [ 1359.414149][T25684] usb 2-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 1359.416334][ T24] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1359.423229][T25684] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1359.453549][ T24] usb 1-1: New USB device found, idVendor=04d8, idProduct=00df, bcdDevice= 0.00 [ 1359.462631][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1359.471852][T25684] usb 2-1: config 0 descriptor?? [ 1359.489738][T25684] ums-realtek 2-1:0.255: USB Mass Storage device detected [ 1359.494038][ T24] usb 1-1: config 0 descriptor?? [ 1359.753354][T25684] usb 2-1: USB disconnect, device number 3 [ 1359.969336][ T24] usbhid 1-1:0.0: can't add hid device: -71 [ 1359.993676][ T24] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1360.103956][ T24] usb 1-1: USB disconnect, device number 44 [ 1360.878652][T28443] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6502'. [ 1361.306892][T28454] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6509'. [ 1361.327558][T28454] netlink: 'syz.0.6509': attribute type 2 has an invalid length. [ 1361.342664][T28454] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6509'. [ 1361.380739][T28457] loop6: detected capacity change from 0 to 7 [ 1361.437689][T28457] Dev loop6: unable to read RDB block 7 [ 1361.447669][T28457] loop6: unable to read partition table [ 1361.628874][T28457] loop6: partition table beyond EOD, truncated [ 1361.659236][T28457] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 1361.689946][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.703061][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.788880][T28462] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6511'. [ 1362.152850][T28467] fuse: Bad value for 'user_id' [ 1362.170521][T28467] fuse: Bad value for 'user_id' [ 1362.510693][T28472] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 1362.558267][T28473] xt_TCPMSS: Only works on TCP SYN packets [ 1363.029863][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 1363.029916][ T30] audit: type=1326 audit(1760357897.319:1482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28480 comm="syz.1.6518" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05ee98eec9 code=0x7ffc0000 [ 1363.181000][T28493] netlink: 'syz.3.6522': attribute type 3 has an invalid length. [ 1363.195438][ T30] audit: type=1326 audit(1760357897.319:1483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28480 comm="syz.1.6518" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05ee98eec9 code=0x7ffc0000 [ 1363.619028][ T30] audit: type=1326 audit(1760357897.319:1484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28480 comm="syz.1.6518" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f05ee98eec9 code=0x7ffc0000 [ 1363.627125][T28503] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1363.821651][T28507] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6524'. [ 1363.912072][ T30] audit: type=1326 audit(1760357897.359:1485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28480 comm="syz.1.6518" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05ee98eec9 code=0x7ffc0000 [ 1364.325245][ T30] audit: type=1326 audit(1760357897.359:1486): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28480 comm="syz.1.6518" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05ee98eec9 code=0x7ffc0000 [ 1364.482623][ T30] audit: type=1326 audit(1760357897.369:1487): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28480 comm="syz.1.6518" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05ee98eec9 code=0x7ffc0000 [ 1364.526539][T28516] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6528'. [ 1364.537405][T28516] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6528'. [ 1364.549179][T28516] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 1364.565693][ T30] audit: type=1326 audit(1760357897.369:1488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28480 comm="syz.1.6518" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f05ee98eec9 code=0x7ffc0000 [ 1364.818448][T28518] netlink: 'syz.2.6529': attribute type 32 has an invalid length. [ 1365.036143][T28531] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6534'. [ 1365.126355][T28534] netlink: 'syz.2.6535': attribute type 5 has an invalid length. [ 1365.152243][T28535] netlink: 196 bytes leftover after parsing attributes in process `syz.1.6536'. [ 1365.315420][T28539] kvm: user requested TSC rate below hardware speed [ 1365.448472][T28550] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6541'. [ 1365.695425][T28555] FAULT_INJECTION: forcing a failure. [ 1365.695425][T28555] name failslab, interval 1, probability 0, space 0, times 0 [ 1365.709421][T28555] CPU: 1 UID: 0 PID: 28555 Comm: syz.4.6543 Not tainted syzkaller #0 PREEMPT(full) [ 1365.709448][T28555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1365.709459][T28555] Call Trace: [ 1365.709468][T28555] [ 1365.709477][T28555] dump_stack_lvl+0x189/0x250 [ 1365.709504][T28555] ? __pfx____ratelimit+0x10/0x10 [ 1365.709531][T28555] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1365.709558][T28555] ? __pfx__printk+0x10/0x10 [ 1365.709583][T28555] ? __pfx___might_resched+0x10/0x10 [ 1365.709606][T28555] ? fs_reclaim_acquire+0x7d/0x100 [ 1365.709633][T28555] should_fail_ex+0x414/0x560 [ 1365.709664][T28555] should_failslab+0xa8/0x100 [ 1365.709688][T28555] kmem_cache_alloc_node_noprof+0x77/0x710 [ 1365.709710][T28555] ? __alloc_skb+0x112/0x2d0 [ 1365.709741][T28555] __alloc_skb+0x112/0x2d0 [ 1365.709769][T28555] netlink_dump+0x1b7/0xe90 [ 1365.709806][T28555] ? __pfx_netlink_dump+0x10/0x10 [ 1365.709856][T28555] __netlink_dump_start+0x5cb/0x7e0 [ 1365.709885][T28555] ? nft_netlink_dump_start_rcu+0xb6/0x1a0 [ 1365.709915][T28555] nft_netlink_dump_start_rcu+0xdb/0x1a0 [ 1365.709941][T28555] nf_tables_getsetelem+0x272/0x580 [ 1365.709963][T28555] ? __pfx_nf_tables_getsetelem+0x10/0x10 [ 1365.709990][T28555] ? nfnl_pernet+0x23/0x240 [ 1365.710010][T28555] ? __pfx_nf_tables_dump_set_start+0x10/0x10 [ 1365.710033][T28555] ? __pfx_nf_tables_dump_set+0x10/0x10 [ 1365.710056][T28555] ? __pfx_nf_tables_dump_set_done+0x10/0x10 [ 1365.710088][T28555] ? __nla_parse+0x40/0x60 [ 1365.710109][T28555] ? __pfx_nf_tables_getsetelem+0x10/0x10 [ 1365.710131][T28555] nfnetlink_rcv_msg+0x80e/0x1130 [ 1365.710154][T28555] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 1365.710195][T28555] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 1365.710215][T28555] ? kasan_save_track+0x4f/0x80 [ 1365.710283][T28555] netlink_rcv_skb+0x208/0x470 [ 1365.710305][T28555] ? lockdep_hardirqs_on+0x9c/0x150 [ 1365.710324][T28555] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 1365.710348][T28555] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1365.710384][T28555] ? bpf_lsm_capable+0x9/0x20 [ 1365.710401][T28555] ? security_capable+0x7e/0x2e0 [ 1365.710428][T28555] nfnetlink_rcv+0x282/0x2590 [ 1365.710454][T28555] ? __dev_queue_xmit+0x27b/0x3b50 [ 1365.710474][T28555] ? __dev_queue_xmit+0x1d79/0x3b50 [ 1365.710492][T28555] ? kasan_save_track+0x3e/0x80 [ 1365.710509][T28555] ? __kasan_slab_alloc+0x6c/0x80 [ 1365.710539][T28555] ? __dev_queue_xmit+0x27b/0x3b50 [ 1365.710571][T28555] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1365.710592][T28555] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1365.710624][T28555] ? ref_tracker_free+0x63a/0x7d0 [ 1365.710644][T28555] ? __asan_memcpy+0x40/0x70 [ 1365.710662][T28555] ? __pfx_ref_tracker_free+0x10/0x10 [ 1365.710679][T28555] ? __skb_clone+0x63/0x7a0 [ 1365.710702][T28555] ? __skb_clone+0x483/0x7a0 [ 1365.710727][T28555] ? skb_clone+0x246/0x3a0 [ 1365.710749][T28555] ? __netlink_deliver_tap+0x807/0x850 [ 1365.710773][T28555] ? netlink_deliver_tap+0x2e/0x1b0 [ 1365.710804][T28555] ? netlink_deliver_tap+0x2e/0x1b0 [ 1365.710837][T28555] netlink_unicast+0x82f/0x9e0 [ 1365.710868][T28555] ? __pfx_netlink_unicast+0x10/0x10 [ 1365.710900][T28555] ? netlink_sendmsg+0x642/0xb30 [ 1365.710922][T28555] ? skb_put+0x11b/0x210 [ 1365.710949][T28555] netlink_sendmsg+0x805/0xb30 [ 1365.710984][T28555] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1365.711012][T28555] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1365.711035][T28555] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1365.711057][T28555] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1365.711082][T28555] __sock_sendmsg+0x21c/0x270 [ 1365.711107][T28555] ____sys_sendmsg+0x505/0x830 [ 1365.711140][T28555] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1365.711176][T28555] ? import_iovec+0x74/0xa0 [ 1365.711203][T28555] ___sys_sendmsg+0x21f/0x2a0 [ 1365.711224][T28555] ? __pfx____sys_sendmsg+0x10/0x10 [ 1365.711285][T28555] ? __fget_files+0x2a/0x420 [ 1365.711306][T28555] ? __fget_files+0x3a0/0x420 [ 1365.711339][T28555] __x64_sys_sendmsg+0x19b/0x260 [ 1365.711360][T28555] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1365.711389][T28555] ? __pfx_ksys_write+0x10/0x10 [ 1365.711414][T28555] ? do_syscall_64+0xbe/0xfa0 [ 1365.711436][T28555] do_syscall_64+0xfa/0xfa0 [ 1365.711452][T28555] ? lockdep_hardirqs_on+0x9c/0x150 [ 1365.711467][T28555] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1365.711484][T28555] ? clear_bhb_loop+0x60/0xb0 [ 1365.711503][T28555] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1365.711519][T28555] RIP: 0033:0x7efcb7d8eec9 [ 1365.711536][T28555] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1365.711552][T28555] RSP: 002b:00007efcb8c84038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1365.711578][T28555] RAX: ffffffffffffffda RBX: 00007efcb7fe5fa0 RCX: 00007efcb7d8eec9 [ 1365.711591][T28555] RDX: 0000000000008000 RSI: 00002000000002c0 RDI: 0000000000000004 [ 1365.711604][T28555] RBP: 00007efcb8c84090 R08: 0000000000000000 R09: 0000000000000000 [ 1365.711616][T28555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1365.711627][T28555] R13: 00007efcb7fe6038 R14: 00007efcb7fe5fa0 R15: 00007efcb810fa28 [ 1365.711657][T28555] [ 1365.743524][T25684] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 1366.374666][T25684] usb 2-1: Using ep0 maxpacket: 32 [ 1366.382513][T25684] usb 2-1: config 0 has an invalid interface number: 247 but max is 0 [ 1366.391009][T25684] usb 2-1: config 0 has no interface number 0 [ 1366.401657][T25684] usb 2-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 1366.419148][T25684] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 1366.493479][T25684] usb 2-1: Product: syz [ 1366.498324][T25684] usb 2-1: Manufacturer: syz [ 1366.598482][T28569] netlink: 144 bytes leftover after parsing attributes in process `syz.0.6546'. [ 1366.638839][T25684] usb 2-1: config 0 descriptor?? [ 1367.176696][T28572] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6549'. [ 1367.643032][T28581] netlink: 100 bytes leftover after parsing attributes in process `syz.3.6553'. [ 1367.981515][T28587] kvm: user requested TSC rate below hardware speed [ 1367.990374][ T5917] usb 2-1: USB disconnect, device number 4 [ 1368.109222][T28603] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6561'. [ 1368.157226][T28605] batadv_slave_0: entered promiscuous mode [ 1368.165645][T28605] batadv_slave_0: left promiscuous mode [ 1368.341518][T28615] netlink: 188 bytes leftover after parsing attributes in process `syz.4.6564'. [ 1368.555857][ T5917] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1368.625981][T28619] netlink: 'syz.3.6567': attribute type 32 has an invalid length. [ 1368.753545][ T5917] usb 3-1: Using ep0 maxpacket: 16 [ 1368.769378][ T5917] usb 3-1: config 0 has an invalid interface number: 214 but max is 0 [ 1368.773911][T13221] Bluetooth: hci0: command 0x0406 tx timeout [ 1368.784730][T28624] program syz.0.6570 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1368.795755][ T5917] usb 3-1: config 0 has no interface number 0 [ 1368.803886][ T5917] usb 3-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 1368.814587][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1368.822824][ T5917] usb 3-1: Product: syz [ 1368.831347][ T5917] usb 3-1: Manufacturer: syz [ 1368.862151][ T5917] usb 3-1: SerialNumber: syz [ 1368.905292][ T5917] usb 3-1: config 0 descriptor?? [ 1368.980620][T28632] netlink: 'syz.1.6572': attribute type 5 has an invalid length. [ 1369.101179][T25684] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 1369.223457][ T5917] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 1369.343479][T25684] usb 1-1: Using ep0 maxpacket: 32 [ 1369.353081][T25684] usb 1-1: config 0 interface 0 altsetting 13 endpoint 0x81 has an invalid bInterval 238, changing to 11 [ 1369.353634][ T5917] usb 4-1: device descriptor read/64, error -71 [ 1369.373353][T25684] usb 1-1: config 0 interface 0 altsetting 13 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1369.384108][T25684] usb 1-1: config 0 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1369.399969][T25684] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1369.419656][T25684] usb 1-1: New USB device found, idVendor=05ac, idProduct=0254, bcdDevice= 0.00 [ 1369.434132][T25684] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1369.448551][T25684] usb 1-1: config 0 descriptor?? [ 1369.675321][T28645] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6576'. [ 1369.684616][ T5917] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 1369.692671][T28645] netlink: 'syz.1.6576': attribute type 1 has an invalid length. [ 1369.777523][T25684] usb 1-1: string descriptor 0 read error: -71 [ 1369.800197][T25684] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input134 [ 1369.823478][ T5917] usb 4-1: device descriptor read/64, error -71 [ 1369.837047][ T5185] bcm5974 1-1:0.0: could not read from device [ 1369.839644][ T5185] bcm5974 1-1:0.0: could not read from device [ 1369.842754][ T5185] bcm5974 1-1:0.0: could not read from device [ 1369.844642][ T5185] bcm5974 1-1:0.0: could not read from device [ 1369.847558][T25684] usb 1-1: USB disconnect, device number 45 [ 1369.934006][ T5917] usb usb4-port1: attempt power cycle [ 1370.123272][T28656] FAULT_INJECTION: forcing a failure. [ 1370.123272][T28656] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1370.136971][T28656] CPU: 0 UID: 0 PID: 28656 Comm: syz.0.6581 Not tainted syzkaller #0 PREEMPT(full) [ 1370.137006][T28656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1370.137018][T28656] Call Trace: [ 1370.137026][T28656] [ 1370.137034][T28656] dump_stack_lvl+0x189/0x250 [ 1370.137058][T28656] ? __pfx____ratelimit+0x10/0x10 [ 1370.137084][T28656] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1370.137101][T28656] ? __pfx__printk+0x10/0x10 [ 1370.137119][T28656] ? __might_fault+0xb0/0x130 [ 1370.137149][T28656] should_fail_ex+0x414/0x560 [ 1370.137179][T28656] _copy_from_iter+0x1de/0x1790 [ 1370.137206][T28656] ? rcu_is_watching+0x15/0xb0 [ 1370.137234][T28656] ? kmalloc_reserve+0xbd/0x290 [ 1370.137257][T28656] ? __pfx__copy_from_iter+0x10/0x10 [ 1370.137280][T28656] ? __build_skb_around+0x262/0x3f0 [ 1370.137306][T28656] ? netlink_sendmsg+0x642/0xb30 [ 1370.137328][T28656] ? skb_put+0x11b/0x210 [ 1370.137355][T28656] netlink_sendmsg+0x6b2/0xb30 [ 1370.137388][T28656] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1370.137415][T28656] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1370.137441][T28656] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1370.137463][T28656] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1370.137489][T28656] __sock_sendmsg+0x21c/0x270 [ 1370.137513][T28656] ____sys_sendmsg+0x505/0x830 [ 1370.137545][T28656] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1370.137579][T28656] ? import_iovec+0x74/0xa0 [ 1370.137604][T28656] ___sys_sendmsg+0x21f/0x2a0 [ 1370.137623][T28656] ? __pfx____sys_sendmsg+0x10/0x10 [ 1370.137688][T28656] ? __fget_files+0x2a/0x420 [ 1370.137710][T28656] ? __fget_files+0x3a0/0x420 [ 1370.137741][T28656] __x64_sys_sendmsg+0x19b/0x260 [ 1370.137762][T28656] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1370.137789][T28656] ? __pfx_ksys_write+0x10/0x10 [ 1370.137812][T28656] ? do_syscall_64+0xbe/0xfa0 [ 1370.137833][T28656] do_syscall_64+0xfa/0xfa0 [ 1370.137849][T28656] ? lockdep_hardirqs_on+0x9c/0x150 [ 1370.137864][T28656] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1370.137880][T28656] ? clear_bhb_loop+0x60/0xb0 [ 1370.137900][T28656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1370.137916][T28656] RIP: 0033:0x7f59c878eec9 [ 1370.137932][T28656] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1370.137946][T28656] RSP: 002b:00007f59c9691038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1370.137965][T28656] RAX: ffffffffffffffda RBX: 00007f59c89e5fa0 RCX: 00007f59c878eec9 [ 1370.137976][T28656] RDX: 0000000024000840 RSI: 0000200000009b40 RDI: 0000000000000003 [ 1370.137987][T28656] RBP: 00007f59c9691090 R08: 0000000000000000 R09: 0000000000000000 [ 1370.137999][T28656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1370.138009][T28656] R13: 00007f59c89e6038 R14: 00007f59c89e5fa0 R15: 00007f59c8b0fa28 [ 1370.138035][T28656] [ 1370.273593][ T5917] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 1370.276376][ C0] vkms_vblank_simulate: vblank timer overrun [ 1370.430125][ C0] vkms_vblank_simulate: vblank timer overrun [ 1370.436114][ C0] hrtimer: interrupt took 292745001 ns [ 1370.446315][ T5917] usb 4-1: device descriptor read/8, error -71 [ 1370.536155][ C0] vkms_vblank_simulate: vblank timer overrun [ 1370.683557][ T5917] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 1370.714225][ T5917] usb 4-1: device descriptor read/8, error -71 [ 1370.794808][T28667] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1370.833877][ T5917] usb usb4-port1: unable to enumerate USB device [ 1371.722109][ T24] usb 3-1: USB disconnect, device number 63 [ 1372.258190][T28685] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6588'. [ 1372.276964][T28685] vlan3: entered promiscuous mode [ 1372.282601][T28685] batadv0: entered promiscuous mode [ 1372.514643][T28687] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6589'. [ 1372.533678][ T24] usb 3-1: new full-speed USB device number 64 using dummy_hcd [ 1372.695126][ T24] usb 3-1: not running at top speed; connect to a high speed hub [ 1372.704134][ T24] usb 3-1: config 1 interface 0 has no altsetting 0 [ 1372.716723][ T24] usb 3-1: string descriptor 0 read error: -22 [ 1372.723169][ T24] usb 3-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 1372.752252][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1372.811938][ T24] usblp0: Disabling reads from problematic bidirectional printer [ 1373.036957][T28683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1373.045778][T28683] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1373.056735][T28683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1373.066627][T28683] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1373.121125][T28700] i2c i2c-0: Invalid block read size 255 [ 1373.161837][T28683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1373.173305][T28683] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1373.186077][T28683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1373.197143][T28683] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1373.554693][ T24] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 64 if 0 alt 7 proto 1 vid 0x03F0 pid 0x0004 [ 1373.581114][ T24] usb 3-1: USB disconnect, device number 64 [ 1373.606070][ T24] usblp0: removed [ 1373.854593][T28707] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1374.146698][T28722] xt_TCPMSS: Only works on TCP SYN packets [ 1374.273606][T25684] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 1374.329818][T28724] binder: 28723:28724 ioctl c020f509 200000000480 returned -22 [ 1374.356892][T28724] binder: 28723:28724 ioctl c0306201 200000000440 returned -11 [ 1374.446521][T25684] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1374.477040][T25684] usb 4-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 1374.570292][T28730] tipc: Enabling of bearer rejected, failed to enable media [ 1374.661487][T25684] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1374.706639][T25684] usb 4-1: config 0 descriptor?? [ 1375.080024][T28741] binder: 28740:28741 unknown command 0 [ 1375.095122][T28741] binder: 28740:28741 ioctl c0306201 200000000080 returned -22 [ 1375.116550][T28741] binder: BINDER_SET_CONTEXT_MGR already set [ 1375.122542][T28741] binder: 28740:28741 ioctl 4018620d 200000000040 returned -16 [ 1375.862017][T28753] i2c i2c-0: Invalid block read size 255 [ 1376.665165][T28763] lo: entered allmulticast mode [ 1376.670565][T28763] lo: left allmulticast mode [ 1376.677719][T28763] netlink: 'syz.1.6613': attribute type 1 has an invalid length. [ 1376.704618][T28765] i2c i2c-0: Invalid block read size 255 [ 1376.742359][T28763] bond3: (slave bridge2): making interface the new active one [ 1376.750715][T28763] bond3: (slave bridge2): Enslaving as an active interface with an up link [ 1376.950172][T20151] usb 4-1: USB disconnect, device number 97 [ 1377.007441][ T5917] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 1377.218997][ T5917] usb 3-1: config 1 interface 0 altsetting 5 bulk endpoint 0x1 has invalid maxpacket 1023 [ 1377.252807][ T5917] usb 3-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1377.270554][T28781] netlink: 196 bytes leftover after parsing attributes in process `syz.3.6617'. [ 1377.373287][ T5917] usb 3-1: config 1 interface 0 has no altsetting 0 [ 1377.384962][ T5917] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1377.408780][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1377.433614][ T5917] usb 3-1: Product: syz [ 1377.437867][ T5917] usb 3-1: Manufacturer: syz [ 1377.442582][ T5917] usb 3-1: SerialNumber: syz [ 1377.489775][T28767] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1377.508657][T28792] xt_TCPMSS: Only works on TCP SYN packets [ 1377.518683][T28767] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1377.872468][T20151] usb 5-1: new full-speed USB device number 71 using dummy_hcd [ 1378.002776][T28803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1378.012420][T28803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1378.024429][T25684] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 1378.064171][ T5917] usb 3-1: USB disconnect, device number 65 [ 1378.246227][T25684] usb 2-1: config 0 has an invalid interface number: 92 but max is 0 [ 1378.265894][T25684] usb 2-1: config 0 has no interface number 0 [ 1378.272055][T25684] usb 2-1: config 0 interface 92 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1378.335981][T20151] usb 5-1: config 0 has no interfaces? [ 1378.351815][T20151] usb 5-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 1378.389410][T25684] usb 2-1: config 0 interface 92 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 1378.389993][T20151] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1378.413149][T25684] usb 2-1: config 0 interface 92 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 1378.447404][T20151] usb 5-1: config 0 descriptor?? [ 1378.616298][T25684] usb 2-1: config 0 interface 92 altsetting 0 endpoint 0x84 has invalid maxpacket 49879, setting to 1024 [ 1378.745537][T28813] No buffer was provided with the request [ 1378.890130][T25684] usb 2-1: config 0 interface 92 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1379.013030][T25684] usb 2-1: New USB device found, idVendor=093b, idProduct=a005, bcdDevice= 9.81 [ 1379.028366][T25684] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1379.081444][T25684] usb 2-1: config 0 descriptor?? [ 1379.141646][T28798] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1379.152464][T25684] em28xx 2-1:0.92: New device @ 480 Mbps (093b:a005, interface 92, class 92) [ 1379.175435][T25684] em28xx 2-1:0.92: DVB interface 92 found: isoc [ 1379.407798][T28817] macsec1: entered allmulticast mode [ 1379.425858][T28817] macvlan0: entered allmulticast mode [ 1379.440654][T28817] veth1_vlan: entered allmulticast mode [ 1379.472139][T28817] macvlan0: left allmulticast mode [ 1379.492545][T28817] veth1_vlan: left allmulticast mode [ 1379.890715][T28798] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1380.003611][T25684] em28xx 2-1:0.92: unknown em28xx chip ID (0) [ 1380.105067][T25684] em28xx 2-1:0.92: reading from i2c device at 0xa0 failed (error=-5) [ 1380.148203][T25684] em28xx 2-1:0.92: board has no eeprom [ 1380.244399][T25684] em28xx 2-1:0.92: Identified as Plextor ConvertX PX-TV100U (card=40) [ 1380.279570][T25684] em28xx 2-1:0.92: dvb set to isoc mode. [ 1380.351378][ T5832] em28xx 2-1:0.92: Remote control support is not available for this card. [ 1380.361684][T25684] usb 2-1: USB disconnect, device number 5 [ 1380.374137][T25684] em28xx 2-1:0.92: Disconnecting em28xx [ 1380.379898][T25684] em28xx 2-1:0.92: Closing input extension [ 1380.380401][T28829] Cannot find add_set index 0 as target [ 1380.508472][ T24] usb 5-1: USB disconnect, device number 71 [ 1380.683913][T28844] i2c i2c-0: Invalid block read size 255 [ 1380.998002][T25684] em28xx 2-1:0.92: Freeing device [ 1381.517708][T28850] IPv6: sit2: Disabled Multicast RS [ 1381.574627][T28850] sit2: entered allmulticast mode [ 1382.063628][ T5917] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 1382.235161][ T5917] usb 5-1: config 1 has an invalid interface number: 7 but max is 0 [ 1382.249955][ T5917] usb 5-1: config 1 has no interface number 0 [ 1382.347418][T28868] FAULT_INJECTION: forcing a failure. [ 1382.347418][T28868] name failslab, interval 1, probability 0, space 0, times 0 [ 1382.364373][ T5917] usb 5-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 1382.378088][ T5917] usb 5-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 1382.388342][ T5917] usb 5-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1382.414750][T28871] netlink: 144 bytes leftover after parsing attributes in process `syz.1.6638'. [ 1382.434386][T28868] CPU: 0 UID: 0 PID: 28868 Comm: syz.3.6642 Not tainted syzkaller #0 PREEMPT(full) [ 1382.434411][T28868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1382.434422][T28868] Call Trace: [ 1382.434429][T28868] [ 1382.434438][T28868] dump_stack_lvl+0x189/0x250 [ 1382.434464][T28868] ? __pfx____ratelimit+0x10/0x10 [ 1382.434491][T28868] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1382.434510][T28868] ? __pfx__printk+0x10/0x10 [ 1382.434534][T28868] ? __lock_acquire+0xab9/0xd20 [ 1382.434563][T28868] should_fail_ex+0x414/0x560 [ 1382.434595][T28868] should_failslab+0xa8/0x100 [ 1382.434623][T28868] kmem_cache_alloc_noprof+0x74/0x6e0 [ 1382.434643][T28868] ? skb_clone+0x212/0x3a0 [ 1382.434667][T28868] skb_clone+0x212/0x3a0 [ 1382.434688][T28868] __netlink_deliver_tap+0x404/0x850 [ 1382.434727][T28868] ? netlink_deliver_tap+0x2e/0x1b0 [ 1382.434753][T28868] netlink_deliver_tap+0x19c/0x1b0 [ 1382.434778][T28868] netlink_broadcast_filtered+0xbf5/0x1000 [ 1382.434822][T28868] ? __pfx_netlink_broadcast_filtered+0x10/0x10 [ 1382.434845][T28868] ? __asan_memcpy+0x40/0x70 [ 1382.434865][T28868] ? nla_put+0xd0/0x150 [ 1382.434888][T28868] mptcp_event+0x6e6/0x910 [ 1382.434917][T28868] ? __pfx_mptcp_event+0x10/0x10 [ 1382.434939][T28868] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1382.434962][T28868] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1382.434985][T28868] ? __mptcp_close+0x548/0xa10 [ 1382.435016][T28868] __mptcp_close+0x665/0xa10 [ 1382.435041][T28868] ? mptcp_close+0x28/0x1a0 [ 1382.435066][T28868] mptcp_close+0x28/0x1a0 [ 1382.435085][T28868] inet_release+0x144/0x190 [ 1382.435111][T28868] sock_close+0xc3/0x240 [ 1382.435132][T28868] ? __pfx_sock_close+0x10/0x10 [ 1382.435159][T28868] __fput+0x44c/0xa70 [ 1382.435196][T28868] fput_close_sync+0x119/0x200 [ 1382.435222][T28868] ? dnotify_flush+0x1db/0x5e0 [ 1382.435247][T28868] ? __pfx_fput_close_sync+0x10/0x10 [ 1382.435271][T28868] ? do_raw_spin_unlock+0x122/0x240 [ 1382.435296][T28868] __x64_sys_close+0x7f/0x110 [ 1382.435321][T28868] do_syscall_64+0xfa/0xfa0 [ 1382.435338][T28868] ? lockdep_hardirqs_on+0x9c/0x150 [ 1382.435355][T28868] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1382.435374][T28868] ? clear_bhb_loop+0x60/0xb0 [ 1382.435395][T28868] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1382.435413][T28868] RIP: 0033:0x7f996df8eec9 [ 1382.435429][T28868] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1382.435445][T28868] RSP: 002b:00007f996ee5f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1382.435465][T28868] RAX: ffffffffffffffda RBX: 00007f996e1e5fa0 RCX: 00007f996df8eec9 [ 1382.435478][T28868] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 1382.435490][T28868] RBP: 00007f996ee5f090 R08: 0000000000000000 R09: 0000000000000000 [ 1382.435501][T28868] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1382.435512][T28868] R13: 00007f996e1e6038 R14: 00007f996e1e5fa0 R15: 00007f996e30fa28 [ 1382.435543][T28868] [ 1382.449091][ T5917] usb 5-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 1382.801961][ T5917] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1382.810871][ T5917] usb 5-1: Product: syz [ 1382.817368][ T5917] usb 5-1: Manufacturer: syz [ 1382.822267][ T5917] usb 5-1: SerialNumber: syz [ 1382.830385][T28875] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1382.868099][T28853] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1383.044600][T28880] loop6: detected capacity change from 0 to 7 [ 1383.053066][T19588] Dev loop6: unable to read RDB block 7 [ 1383.061516][T19588] loop6: unable to read partition table [ 1383.068553][T19588] loop6: partition table beyond EOD, truncated [ 1383.086207][T28880] Dev loop6: unable to read RDB block 7 [ 1383.093126][T28853] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1383.103597][T28880] loop6: unable to read partition table [ 1383.130129][T28880] loop6: partition table beyond EOD, truncated [ 1383.151853][T28880] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 1383.194846][T20151] usb 4-1: new full-speed USB device number 98 using dummy_hcd [ 1383.327648][ T5917] sierra_net 5-1:1.7 wwan0: register 'sierra_net' at usb-dummy_hcd.4-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:01:07 [ 1383.382637][T20151] usb 4-1: config 0 has no interfaces? [ 1383.389279][T20151] usb 4-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 1383.400769][T20151] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1383.411591][T20151] usb 4-1: config 0 descriptor?? [ 1384.141661][ T5832] usb 5-1: USB disconnect, device number 72 [ 1384.178105][ T5832] sierra_net 5-1:1.7 wwan0: unregister 'sierra_net' usb-dummy_hcd.4-1, Sierra Wireless USB-to-WWAN Modem [ 1384.471205][T28911] binder: 28902:28911 ioctl 400c620e 200000000380 returned -22 [ 1384.625065][ T5832] sierra_net 5-1:1.7 wwan0 (unregistered): usb_control_msg failed, status -19 [ 1386.066855][ T5917] usb 4-1: USB disconnect, device number 98 [ 1386.349185][T28943] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6659'. [ 1387.073462][ T5917] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 1387.263583][ T5917] usb 4-1: Using ep0 maxpacket: 32 [ 1387.272594][ T5917] usb 4-1: config 2 has an invalid interface number: 91 but max is 0 [ 1387.281364][ T5917] usb 4-1: config 2 has no interface number 0 [ 1387.288018][ T5917] usb 4-1: config 2 interface 91 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1387.302254][ T5917] usb 4-1: config 2 interface 91 has no altsetting 0 [ 1387.329175][ T5917] usb 4-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=98.5f [ 1387.339392][ T5917] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1387.351960][ T5917] usb 4-1: Product: syz [ 1387.367431][ T5917] usb 4-1: Manufacturer: syz [ 1387.379958][ T5917] usb 4-1: SerialNumber: syz [ 1387.803543][T20151] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 1388.091815][ T5917] vmk80xx 4-1:2.91: driver 'vmk80xx' failed to auto-configure device. [ 1388.113493][T20151] usb 1-1: Using ep0 maxpacket: 8 [ 1388.120749][T20151] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 1388.129393][ T5917] usb 4-1: USB disconnect, device number 99 [ 1388.145033][T20151] usb 1-1: config 0 has no interface number 0 [ 1388.171610][T20151] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1388.212588][T20151] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1388.245301][T20151] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1388.256835][T20151] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1388.270546][T20151] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1388.282035][T20151] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1388.522456][T28992] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6668'. [ 1388.684280][T20151] usb 1-1: config 0 descriptor?? [ 1388.746960][T20151] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1389.673566][ T5917] usb 4-1: new full-speed USB device number 100 using dummy_hcd [ 1389.783838][T29004] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6671'. [ 1389.898153][ T5917] usb 4-1: config 0 has no interfaces? [ 1389.936785][ T5917] usb 4-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 1389.941639][T29007] tipc: Started in network mode [ 1389.969378][T29007] tipc: Node identity 4e1685fd3a22, cluster identity 4711 [ 1389.979214][T29007] tipc: Enabled bearer , priority 0 [ 1389.991678][T29007] syzkaller0: entered promiscuous mode [ 1389.998575][T29007] syzkaller0: entered allmulticast mode [ 1390.026028][T29007] tipc: Resetting bearer [ 1390.104704][ T5917] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1390.148644][ T5917] usb 4-1: config 0 descriptor?? [ 1390.178085][T29012] netlink: 144 bytes leftover after parsing attributes in process `syz.1.6673'. [ 1390.324857][ T5832] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 1390.490240][ T5832] usb 5-1: config 0 interface 0 altsetting 15 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1390.511169][ T5832] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1390.523345][ T5832] usb 5-1: New USB device found, idVendor=1b1c, idProduct=0a1a, bcdDevice= 0.00 [ 1390.541800][ T5832] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1390.597466][ T5832] usb 5-1: config 0 descriptor?? [ 1390.648802][T20152] usb 1-1: USB disconnect, device number 47 [ 1390.648814][ C1] ldusb 1-1:0.55: usb_submit_urb failed (-19) [ 1390.670487][T20152] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 1390.806996][T29007] IPVS: length: 18 != 1048 [ 1390.815019][ T5832] usb 5-1: string descriptor 0 read error: -71 [ 1390.819836][T29017] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1390.845645][ T5832] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 1390.872397][T29017] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 1390.885548][ T5832] usb 5-1: USB disconnect, device number 73 [ 1390.911743][T29017] kvm: requested 98895 ns i8254 timer period limited to 200000 ns [ 1390.974125][T29017] kvm: requested 31009 ns i8254 timer period limited to 200000 ns [ 1391.013679][T25684] tipc: Node number set to 1949599229 [ 1391.054112][T29017] kvm: requested 59504 ns i8254 timer period limited to 200000 ns [ 1391.081639][T29017] kvm: requested 13409 ns i8254 timer period limited to 200000 ns [ 1391.091388][T29027] netlink: 'syz.2.6677': attribute type 13 has an invalid length. [ 1391.131474][T29017] kvm: requested 53638 ns i8254 timer period limited to 200000 ns [ 1391.187750][T29017] kvm: requested 41904 ns i8254 timer period limited to 200000 ns [ 1391.244306][T29017] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 1391.268741][T29017] kvm: requested 53638 ns i8254 timer period limited to 200000 ns [ 1391.738412][T29037] binder: 29031:29037 ioctl 400c620e 200000000380 returned -22 [ 1391.949998][ T5832] usb 4-1: USB disconnect, device number 100 [ 1392.219546][T29045] xt_TCPMSS: Only works on TCP SYN packets [ 1392.835350][T29053] netlink: 'syz.2.6687': attribute type 10 has an invalid length. [ 1392.852288][T29053] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1392.881331][T29053] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1393.040630][T29053] bond0: (slave batadv_slave_0): Enslaving as an active interface with an up link [ 1393.456426][T29062] macsec0: entered allmulticast mode [ 1393.465517][T29062] macvlan0: entered allmulticast mode [ 1393.471001][T29062] veth1_vlan: entered allmulticast mode [ 1393.866174][T29062] macvlan0: left allmulticast mode [ 1393.871529][T29062] veth1_vlan: left allmulticast mode [ 1394.067926][T29073] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1394.375215][T29079] batadv_slave_0: entered promiscuous mode [ 1394.518348][T29079] batadv_slave_0: left promiscuous mode [ 1394.593483][ T5917] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 1394.615935][T29086] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6697'. [ 1394.708698][T29086] vlan3: entered promiscuous mode [ 1394.784642][ T5917] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1394.795195][ T5917] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1394.810780][T29091] netlink: 152 bytes leftover after parsing attributes in process `syz.2.6699'. [ 1394.820835][ T5917] usb 4-1: Product: syz [ 1394.825209][ T5917] usb 4-1: Manufacturer: syz [ 1394.837499][ T5917] usb 4-1: SerialNumber: syz [ 1394.857570][ T5917] usb 4-1: config 0 descriptor?? [ 1395.523652][T20152] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 1395.642033][ T5917] usb 4-1: Firmware: major: 0, minor: 0, hardware type: ATUSB (0) [ 1395.663994][ T5917] usb 4-1: Firmware version (0.0) predates our first public release. [ 1395.672121][ T5917] usb 4-1: Please update to version 0.2 or newer [ 1395.699874][T20152] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1395.733932][T20152] usb 5-1: config 0 has no interfaces? [ 1395.739514][T20152] usb 5-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 1395.926556][T20152] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1395.937616][T20152] usb 5-1: config 0 descriptor?? [ 1396.034413][ T5917] usb 4-1: USB disconnect, device number 101 [ 1396.193135][T29098] vivid-007: ================= START STATUS ================= [ 1396.212759][T29098] vivid-007: Enable Output Cropping: true [ 1396.224376][T29098] vivid-007: Enable Output Composing: true [ 1396.232489][T29098] vivid-007: Enable Output Scaler: true [ 1396.241731][T29098] vivid-007: Tx RGB Quantization Range: Automatic [ 1396.281236][T29098] vivid-007: Transmit Mode: HDMI [ 1396.286573][T29098] vivid-007: Hotplug Present: 0x00000000 [ 1396.301790][T29098] vivid-007: RxSense Present: 0x00000000 [ 1396.307816][T29098] vivid-007: EDID Present: 0x00000000 [ 1396.317071][T29098] vivid-007: ================== END STATUS ================== [ 1396.474604][T29114] netlink: 'syz.1.6704': attribute type 5 has an invalid length. [ 1396.493438][T29115] dummy0: entered promiscuous mode [ 1396.613940][T20151] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1396.671793][T29127] netlink: 196 bytes leftover after parsing attributes in process `syz.3.6708'. [ 1396.767016][T20151] usb 3-1: config 0 has no interfaces? [ 1396.777846][T20151] usb 3-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1396.787202][T20151] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1396.795687][T20151] usb 3-1: Product: syz [ 1396.800004][T20151] usb 3-1: Manufacturer: syz [ 1396.805089][T20151] usb 3-1: SerialNumber: syz [ 1396.812621][T20151] usb 3-1: config 0 descriptor?? [ 1397.022882][T29131] binder: 29128:29131 ioctl c0306201 0 returned -14 [ 1397.470256][T29137] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6711'. [ 1397.479958][T29137] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6711'. [ 1397.491759][T29137] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 1397.696200][T25684] usb 5-1: USB disconnect, device number 74 [ 1397.717677][T29143] xt_TCPMSS: Only works on TCP SYN packets [ 1398.254138][ T5917] usb 3-1: USB disconnect, device number 66 [ 1398.452408][T29148] binder: 29140:29148 ioctl c0306201 0 returned -14 [ 1399.613555][T25684] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 1399.943752][T25684] usb 1-1: Using ep0 maxpacket: 32 [ 1399.966063][T25684] usb 1-1: config 0 has an invalid descriptor of length 64, skipping remainder of the config [ 1400.230897][T25684] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1400.250349][T25684] usb 1-1: New USB device found, idVendor=12d8, idProduct=8001, bcdDevice=de.79 [ 1400.278578][T25684] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1400.291283][T25684] usb 1-1: Product: syz [ 1400.304982][T25684] usb 1-1: Manufacturer: syz [ 1400.310033][T25684] usb 1-1: SerialNumber: syz [ 1400.347774][T25684] usb 1-1: config 0 descriptor?? [ 1400.623507][ T5832] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 1400.689719][ T5917] usb 1-1: USB disconnect, device number 48 [ 1400.804683][ T5832] usb 4-1: Using ep0 maxpacket: 8 [ 1400.813895][T25684] usb 2-1: new low-speed USB device number 6 using dummy_hcd [ 1400.823594][ T5832] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1400.835177][ T5832] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1400.864785][ T5832] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1400.914261][T29155] can: request_module (can-proto-4) failed. [ 1400.930672][ T5832] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 1400.933866][T29192] netlink: 'syz.2.6725': attribute type 32 has an invalid length. [ 1400.952141][T29192] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6725'. [ 1400.952704][ T5832] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1400.972106][ T5832] usb 4-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1400.983664][T25684] usb 2-1: Invalid ep0 maxpacket: 16 [ 1400.994877][ T5832] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1401.037524][ T5832] usb 4-1: config 0 descriptor?? [ 1401.045217][T29184] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1401.183485][T25684] usb 2-1: new low-speed USB device number 7 using dummy_hcd [ 1401.298348][T29198] team0: Caught tx_queue_len zero misconfig [ 1401.360881][T25684] usb 2-1: Invalid ep0 maxpacket: 16 [ 1401.368833][T25684] usb usb2-port1: attempt power cycle [ 1401.589058][ T5832] usb 4-1: USB disconnect, device number 102 [ 1401.608750][T19156] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 1401.664724][ T10] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 1401.741480][T25684] usb 2-1: new low-speed USB device number 8 using dummy_hcd [ 1401.774560][T25684] usb 2-1: Invalid ep0 maxpacket: 16 [ 1401.903751][T25684] usb 2-1: new low-speed USB device number 9 using dummy_hcd [ 1401.916010][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1401.926966][ T10] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1401.934684][T25684] usb 2-1: Invalid ep0 maxpacket: 16 [ 1401.940654][T25684] usb usb2-port1: unable to enumerate USB device [ 1402.020699][ T10] usb 3-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=b1.f9 [ 1402.041701][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1402.135294][ T10] usb 3-1: Product: syz [ 1402.142538][ T10] usb 3-1: Manufacturer: syz [ 1402.159399][ T10] usb 3-1: SerialNumber: syz [ 1402.199997][ T10] usb 3-1: config 0 descriptor?? [ 1402.220328][ T10] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 1402.242655][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1402.291196][ T10] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 error while loading driver (-23) [ 1402.355590][ T5917] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1402.613498][ T5917] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 1402.808420][ T5917] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1402.979822][ T5917] usb 5-1: config 0 has no interface number 0 [ 1402.999838][ T5917] usb 5-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=83.9c [ 1403.023562][ T5917] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1403.043190][ T5917] usb 5-1: Product: syz [ 1403.050742][ T5917] usb 5-1: Manufacturer: syz [ 1403.062777][ T5917] usb 5-1: SerialNumber: syz [ 1403.079332][ T5917] usb 5-1: config 0 descriptor?? [ 1403.101565][ T5917] ims_pcu 5-1:0.41: Missing CDC union descriptor [ 1403.142246][ T5917] ims_pcu 5-1:0.41: probe with driver ims_pcu failed with error -22 [ 1404.178368][T29237] No such timeout policy "syz0" [ 1404.961224][ T10] usb 3-1: USB disconnect, device number 67 [ 1405.373670][T20151] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 1405.427947][ T2153] usb 5-1: USB disconnect, device number 75 [ 1405.523885][T20151] usb 3-1: device descriptor read/64, error -71 [ 1405.623481][ T5917] usb 1-1: new full-speed USB device number 49 using dummy_hcd [ 1405.718217][T29256] Cannot find add_set index 0 as target [ 1405.763585][ T5917] usb 1-1: device descriptor read/64, error -71 [ 1405.783487][T20151] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 1405.853610][ T2153] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 1405.930638][T20151] usb 3-1: device descriptor read/64, error -71 [ 1406.013469][ T5917] usb 1-1: new full-speed USB device number 50 using dummy_hcd [ 1406.043709][T20151] usb usb3-port1: attempt power cycle [ 1406.050779][ T2153] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1406.062352][ T2153] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1406.080115][ T2153] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1406.149474][ T2153] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1406.158786][ T5917] usb 1-1: device descriptor read/64, error -71 [ 1406.172550][ T2153] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1406.195327][ T2153] usb 5-1: config 0 descriptor?? [ 1406.274069][ T5917] usb usb1-port1: attempt power cycle [ 1406.383652][T20151] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 1406.404875][T20151] usb 3-1: device descriptor read/8, error -71 [ 1406.715027][T29253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1406.733876][T29253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1406.795013][ T2153] plantronics 0003:047F:FFFF.0042: ignoring exceeding usage max [ 1406.812923][ T5917] usb 1-1: new full-speed USB device number 51 using dummy_hcd [ 1406.828450][ T2153] plantronics 0003:047F:FFFF.0042: unknown main item tag 0x5 [ 1406.836875][ T2153] plantronics 0003:047F:FFFF.0042: item fetching failed at offset 13/15 [ 1406.846185][ T2153] plantronics 0003:047F:FFFF.0042: parse failed [ 1406.852633][ T2153] plantronics 0003:047F:FFFF.0042: probe with driver plantronics failed with error -22 [ 1406.864221][ T5917] usb 1-1: device descriptor read/8, error -71 [ 1406.923509][T20151] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 1406.954267][T20151] usb 3-1: device descriptor read/8, error -71 [ 1406.958601][ T10] usb 5-1: USB disconnect, device number 76 [ 1407.069358][T20151] usb usb3-port1: unable to enumerate USB device [ 1407.233537][ T5917] usb 1-1: new full-speed USB device number 52 using dummy_hcd [ 1407.256096][ T5917] usb 1-1: device descriptor read/8, error -71 [ 1407.363806][ T5917] usb usb1-port1: unable to enumerate USB device [ 1407.987920][T29276] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6745'. [ 1408.241256][T29287] netlink: 'syz.3.6749': attribute type 10 has an invalid length. [ 1409.327652][T29305] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6753'. [ 1409.505692][T29305] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6753'. [ 1409.524217][T29305] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 1409.756347][T29311] i2c i2c-0: Invalid block read size 255 [ 1409.772509][T19156] Bluetooth: hci2: command 0x0406 tx timeout [ 1409.963024][T29310] netlink: 'syz.4.6755': attribute type 5 has an invalid length. [ 1410.043624][T29310] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6755'. [ 1410.381463][T29320] netlink: 144 bytes leftover after parsing attributes in process `syz.0.6756'. [ 1410.523513][ T2153] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 1410.553507][ T10] usb 5-1: new full-speed USB device number 77 using dummy_hcd [ 1410.651249][T29322] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1410.658119][T29322] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1410.666721][T29322] Cannot find map_set index 0 as target [ 1410.700744][ T2153] usb 3-1: config 1 interface 0 altsetting 5 bulk endpoint 0x1 has invalid maxpacket 1023 [ 1410.711522][ T2153] usb 3-1: config 1 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1410.712645][ T10] usb 5-1: not running at top speed; connect to a high speed hub [ 1410.734199][ T10] usb 5-1: config 1 interface 0 has no altsetting 0 [ 1410.744094][ T2153] usb 3-1: config 1 interface 0 has no altsetting 0 [ 1410.751108][ T10] usb 5-1: string descriptor 0 read error: -22 [ 1410.757986][ T10] usb 5-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 1410.767102][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1410.787963][ T10] usblp0: Disabling reads from problematic bidirectional printer [ 1411.001263][T29319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1411.043816][T29319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1411.071799][T29319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1411.086294][T29319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1411.094891][ T2153] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1411.106077][T29319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1411.106074][ T2153] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1411.106100][ T2153] usb 3-1: Product: syz [ 1411.106116][ T2153] usb 3-1: Manufacturer: syz [ 1411.106130][ T2153] usb 3-1: SerialNumber: syz [ 1411.126194][T29319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1411.197306][T29319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1411.216823][T29319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1411.230201][T29316] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1411.238346][T29316] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1411.296134][ T10] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 77 if 0 alt 7 proto 1 vid 0x03F0 pid 0x0004 [ 1411.385492][ T10] usb 5-1: USB disconnect, device number 77 [ 1411.405532][T29332] xt_hashlimit: max too large, truncated to 1048576 [ 1411.412441][ T10] usblp0: removed [ 1411.465979][T29334] C: renamed from team_slave_0 (while UP) [ 1411.491309][T29334] netlink: 'syz.3.6761': attribute type 2 has an invalid length. [ 1411.551250][T29334] netlink: 116 bytes leftover after parsing attributes in process `syz.3.6761'. [ 1411.653572][T29334] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1411.786427][T29337] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6762'. [ 1411.823510][T29337] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6762'. [ 1411.958985][ T2153] usb 3-1: USB disconnect, device number 72 [ 1413.244091][T29359] IPVS: set_ctl: invalid protocol: 47 100.1.1.2:20003 [ 1413.362445][T29359] syzkaller0: entered promiscuous mode [ 1413.379624][T29359] syzkaller0: entered allmulticast mode [ 1413.494633][T29361] netlink: 'syz.2.6767': attribute type 5 has an invalid length. [ 1413.537484][T29361] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6767'. [ 1413.780046][T29365] netlink: 'syz.0.6768': attribute type 32 has an invalid length. [ 1413.813581][T29365] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6768'. [ 1414.078629][T29369] i2c i2c-0: Invalid block read size 255 [ 1414.121777][T29373] netlink: 56 bytes leftover after parsing attributes in process `syz.3.6771'. [ 1414.229716][ T30] audit: type=1326 audit(1760357948.519:1489): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29370 comm="syz.0.6772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f59c878eec9 code=0x7ffc0000 [ 1414.299977][ T30] audit: type=1326 audit(1760357948.519:1490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29370 comm="syz.0.6772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f59c878eec9 code=0x7ffc0000 [ 1414.348068][ T30] audit: type=1326 audit(1760357948.519:1491): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29370 comm="syz.0.6772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f59c878eec9 code=0x7ffc0000 [ 1414.446629][ T30] audit: type=1326 audit(1760357948.519:1492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29370 comm="syz.0.6772" exe="/root/syz-executor" sig=0 arch=40000003 syscall=15 compat=1 ip=0x200000000006 code=0x7ffc0000 [ 1414.475884][ T2153] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 1414.504600][ T30] audit: type=1326 audit(1760357948.519:1493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29370 comm="syz.0.6772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f59c878eec9 code=0x7ffc0000 [ 1414.809109][ T2153] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1414.953335][ T2153] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1414.953341][ T30] audit: type=1326 audit(1760357948.559:1494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29370 comm="syz.0.6772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f59c878eec9 code=0x7ffc0000 [ 1414.998990][ T30] audit: type=1326 audit(1760357948.559:1495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29370 comm="syz.0.6772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f59c878eec9 code=0x7ffc0000 [ 1415.032102][ T2153] usb 5-1: Product: syz [ 1415.093811][ T2153] usb 5-1: Manufacturer: syz [ 1415.103924][ T2153] usb 5-1: SerialNumber: syz [ 1415.153775][ T30] audit: type=1326 audit(1760357948.569:1496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29370 comm="syz.0.6772" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f59c878eec9 code=0x7ffc0000 [ 1415.189053][ T2153] usb 5-1: config 0 descriptor?? [ 1415.213538][ T5917] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 1415.413530][ T5917] usb 1-1: Using ep0 maxpacket: 16 [ 1415.422285][ T5917] usb 1-1: config 0 has no interfaces? [ 1415.430198][ T5917] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1415.439449][ T5917] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1415.447526][ T5917] usb 1-1: Manufacturer: syz [ 1415.494679][ T5917] usb 1-1: config 0 descriptor?? [ 1415.608376][ T2153] usb 5-1: Firmware version (0.0) predates our first public release. [ 1415.616732][ T2153] usb 5-1: Please update to version 0.2 or newer [ 1416.595257][ T2153] usb 5-1: USB disconnect, device number 78 [ 1416.621006][T29413] netlink: 'syz.4.6780': attribute type 5 has an invalid length. [ 1416.694576][T29413] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6780'. [ 1416.986407][T29422] loop6: detected capacity change from 0 to 7 [ 1416.994397][T28185] Dev loop6: unable to read RDB block 7 [ 1417.000059][T28185] loop6: unable to read partition table [ 1417.008177][T28185] loop6: partition table beyond EOD, truncated [ 1417.032790][T29422] Dev loop6: unable to read RDB block 7 [ 1417.039377][T29422] loop6: unable to read partition table [ 1417.048120][T29422] loop6: partition table beyond EOD, truncated [ 1417.060194][T29422] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 1417.612360][T29436] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6787'. [ 1417.723945][ T2153] usb 1-1: USB disconnect, device number 53 [ 1417.849708][T29435] netlink: 144 bytes leftover after parsing attributes in process `syz.1.6786'. [ 1418.687254][T29453] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6792'. [ 1418.712469][T29453] bridge_slave_1: left allmulticast mode [ 1418.753532][T29453] bridge_slave_1: left promiscuous mode [ 1418.800437][T29453] bridge0: port 2(bridge_slave_1) entered disabled state [ 1418.834543][T29453] bridge_slave_0: left allmulticast mode [ 1418.863713][T29453] bridge_slave_0: left promiscuous mode [ 1418.898807][T29453] bridge0: port 1(bridge_slave_0) entered disabled state [ 1419.053054][T29451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1419.061543][T25684] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 1419.072537][T29451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1419.151113][T29462] tipc: Enabling of bearer rejected, failed to enable media [ 1419.213509][T25684] usb 5-1: Using ep0 maxpacket: 16 [ 1419.220590][T25684] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1419.230253][T29466] macsec0: entered allmulticast mode [ 1419.237659][T29466] macvlan0: entered allmulticast mode [ 1419.243269][T25684] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1419.263029][T25684] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1419.272645][T25684] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1419.273197][T29466] macvlan0: left allmulticast mode [ 1419.283606][T25684] usb 5-1: config 0 descriptor?? [ 1419.316543][ T10] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 1419.383827][T29472] xt_TCPMSS: Only works on TCP SYN packets [ 1419.526948][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 1419.584813][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1419.595831][ T10] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1419.605046][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1419.629967][ T10] usb 3-1: config 0 descriptor?? [ 1419.726664][T25684] mcp2221 0003:04D8:00DD.0043: unknown main item tag 0x0 [ 1419.768470][T25684] mcp2221 0003:04D8:00DD.0043: unknown main item tag 0x0 [ 1419.768519][T25684] mcp2221 0003:04D8:00DD.0043: unknown main item tag 0x0 [ 1419.768546][T25684] mcp2221 0003:04D8:00DD.0043: unknown main item tag 0x0 [ 1419.774837][T25684] mcp2221 0003:04D8:00DD.0043: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 1419.891364][T25684] usb 5-1: USB disconnect, device number 79 [ 1420.283195][T29481] batadv_slave_0: entered promiscuous mode [ 1420.342714][T29481] batadv_slave_0: left promiscuous mode [ 1420.674700][T20152] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 1420.746060][ T10] mcp2221 0003:04D8:00DD.0044: unknown main item tag 0x0 [ 1420.887792][T29491] netlink: 'syz.1.6805': attribute type 5 has an invalid length. [ 1420.956722][ T10] mcp2221 0003:04D8:00DD.0044: unknown main item tag 0x0 [ 1420.993727][ T10] mcp2221 0003:04D8:00DD.0044: unknown main item tag 0x0 [ 1421.009100][ T10] mcp2221 0003:04D8:00DD.0044: unknown main item tag 0x0 [ 1421.029432][ T10] mcp2221 0003:04D8:00DD.0044: unknown main item tag 0x0 [ 1421.048261][T20152] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1421.070362][ T10] mcp2221 0003:04D8:00DD.0044: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 1421.100014][ T2153] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 1421.145043][T20152] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1421.181685][T20152] usb 1-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=b1.f9 [ 1421.255167][T20152] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1421.263593][ T2153] usb 5-1: Using ep0 maxpacket: 8 [ 1421.274964][T20152] usb 1-1: Product: syz [ 1421.277686][ T2153] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 1421.280643][T20152] usb 1-1: Manufacturer: syz [ 1421.297714][ T2153] usb 5-1: config 0 has an invalid descriptor of length 233, skipping remainder of the config [ 1421.417625][ T2153] usb 5-1: config 0 has no interface number 0 [ 1421.425494][T20152] usb 1-1: SerialNumber: syz [ 1421.440358][ T2153] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1421.450420][ T2153] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1421.471577][ T2153] usb 5-1: Product: syz [ 1421.474199][T20152] usb 1-1: config 0 descriptor?? [ 1421.486669][ T2153] usb 5-1: Manufacturer: syz [ 1421.496150][ T2153] usb 5-1: SerialNumber: syz [ 1421.540039][T20152] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 1421.561297][ T2153] usb 5-1: config 0 descriptor?? [ 1421.569502][T20152] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1421.626026][T20152] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 error while loading driver (-23) [ 1421.802499][ T2153] uvcvideo 5-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 1421.812366][ T2153] uvcvideo 5-1:0.31: No valid video chain found. [ 1422.024465][T29488] fuse: Unknown parameter 'default_permissionsɫf6︁ UZG?(1Ck4**|di.#O:+ a+' [ 1422.048598][T20152] usb 5-1: USB disconnect, device number 80 [ 1422.191527][ T10] usb 3-1: USB disconnect, device number 73 [ 1422.786995][T29510] netlink: 84 bytes leftover after parsing attributes in process `syz.2.6811'. [ 1422.953842][ T10] usb 1-1: USB disconnect, device number 54 [ 1423.029004][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.035417][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.342878][T29522] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6817'. [ 1423.367472][T29522] netlink: 56 bytes leftover after parsing attributes in process `syz.4.6817'. [ 1423.451919][T29525] ucma_write: process 1119 (syz.4.6818) changed security contexts after opening file descriptor, this is not allowed. [ 1423.543619][ T10] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 1423.603637][ T5917] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 1423.693957][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 1423.700922][ T10] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1423.712104][ T10] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1423.722159][ T10] usb 1-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 1423.735290][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1423.742854][ T10] usb 1-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 1423.752175][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1423.766779][ T10] usb 1-1: config 0 descriptor?? [ 1423.773652][T20151] usb 5-1: new full-speed USB device number 81 using dummy_hcd [ 1423.786264][ T5917] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1423.798832][ T5917] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1423.812951][ T5917] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1423.828560][ T5917] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1423.840255][ T5917] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1423.854177][ T5917] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1423.864593][ T5917] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1423.874372][ T5917] usb 4-1: Product: syz [ 1423.878928][ T5917] usb 4-1: Manufacturer: syz [ 1423.902199][ T5917] cdc_wdm 4-1:1.0: skipping garbage [ 1423.908307][ T5917] cdc_wdm 4-1:1.0: skipping garbage [ 1423.927643][ T5917] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 1423.934443][ T5917] cdc_wdm 4-1:1.0: Unknown control protocol [ 1423.945688][T20151] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1423.954407][T20151] usb 5-1: not running at top speed; connect to a high speed hub [ 1423.965093][T20151] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1423.972929][T20151] usb 5-1: can't read configurations, error -61 [ 1424.103724][T20151] usb 5-1: new full-speed USB device number 82 using dummy_hcd [ 1424.204793][T29553] netlink: 'syz.2.6825': attribute type 32 has an invalid length. [ 1424.230206][ T10] hid (null): invalid report_size 26978 [ 1424.244656][ T10] hid (null): unknown global tag 0xe [ 1424.290102][T20151] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1424.298968][T20151] usb 5-1: not running at top speed; connect to a high speed hub [ 1424.310744][T20151] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1424.326295][T20151] usb 5-1: can't read configurations, error -61 [ 1424.352044][T20151] usb usb5-port1: attempt power cycle [ 1424.473603][ T5917] usb 1-1: USB disconnect, device number 55 [ 1424.590629][T29561] i2c i2c-0: Invalid block read size 255 [ 1424.742120][T20151] usb 5-1: new full-speed USB device number 83 using dummy_hcd [ 1424.777076][T20151] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1424.787491][T20151] usb 5-1: not running at top speed; connect to a high speed hub [ 1424.800393][T20151] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1424.809624][T20151] usb 5-1: can't read configurations, error -61 [ 1424.849902][T29560] kvm: user requested TSC rate below hardware speed [ 1424.920111][ T5917] usb 4-1: USB disconnect, device number 103 [ 1424.953668][T20151] usb 5-1: new full-speed USB device number 84 using dummy_hcd [ 1425.027593][T20151] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1425.059055][T20151] usb 5-1: not running at top speed; connect to a high speed hub [ 1425.388410][T20151] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1425.396577][T20151] usb 5-1: can't read configurations, error -61 [ 1425.396867][T20151] usb usb5-port1: unable to enumerate USB device [ 1426.096819][T29585] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6834'. [ 1426.251584][T29585] vlan3: entered promiscuous mode [ 1426.307289][T29589] pim6reg: entered allmulticast mode [ 1426.392890][T29589] pim6reg: left allmulticast mode [ 1426.471697][T29594] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6835'. [ 1426.490126][T29593] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1427.328196][T29612] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6842'. [ 1427.446776][T29616] syzkaller0: left promiscuous mode [ 1427.452031][T29616] syzkaller0: left allmulticast mode [ 1427.533489][ T2153] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 1427.714812][ T2153] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1427.723668][ T2153] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1427.743518][ T2153] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1427.839576][ T2153] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1427.850965][ T2153] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1427.870073][T29631] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6845'. [ 1427.915083][ T2153] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1427.930334][ T2153] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1427.961995][ T2153] usb 1-1: Product: syz [ 1427.968549][ T2153] usb 1-1: Manufacturer: syz [ 1427.990028][ T2153] cdc_wdm 1-1:1.0: skipping garbage [ 1428.020056][ T2153] cdc_wdm 1-1:1.0: skipping garbage [ 1428.043353][ T2153] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1428.063252][ T2153] cdc_wdm 1-1:1.0: Unknown control protocol [ 1428.806093][T29638] kvm: user requested TSC rate below hardware speed [ 1428.908022][T20152] usb 1-1: USB disconnect, device number 56 [ 1429.069073][T29649] No such timeout policy "syz0" [ 1429.129800][T29650] tipc: Enabling of bearer rejected, failed to enable media [ 1429.167488][T29650] syzkaller0: Caught tx_queue_len zero misconfig [ 1429.808976][T29661] loop6: detected capacity change from 0 to 2 [ 1429.824033][T29661] Dev loop6: unable to read RDB block 2 [ 1429.829969][T29661] loop6: unable to read partition table [ 1429.836684][T29661] loop6: partition table beyond EOD, truncated [ 1429.843195][T29661] loop_reread_partitions: partition scan of loop6 ( 6tPΪŔA8*V^3c) failed (rc=-5) [ 1430.005175][T29666] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6856'. [ 1430.914144][T29677] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6859'. [ 1431.326056][T29690] binder: 29679:29690 ioctl c0306201 0 returned -14 [ 1431.643792][ T10] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 1431.858040][T29702] Cannot find add_set index 400 as target [ 1432.035321][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1432.047309][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1432.113888][ T10] usb 2-1: New USB device found, idVendor=060b, idProduct=700a, bcdDevice= 0.00 [ 1432.133792][ T10] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 1432.141813][ T10] usb 2-1: Manufacturer: syz [ 1432.227420][ T10] usb 2-1: config 0 descriptor?? [ 1432.313530][T20151] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 1432.475792][T20151] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1432.484779][T20151] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1432.495265][T20151] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1432.519588][T20151] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1432.561881][T20151] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1432.603699][T20151] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1432.617474][T20151] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1432.633454][T20151] usb 3-1: Product: syz [ 1432.647171][T20151] usb 3-1: Manufacturer: syz [ 1432.664848][ T10] cougar 0003:060B:700A.0046: unknown main item tag 0x0 [ 1432.665793][T20151] cdc_wdm 3-1:1.0: skipping garbage [ 1432.671862][ T10] cougar 0003:060B:700A.0046: unknown main item tag 0x0 [ 1432.678056][T20151] cdc_wdm 3-1:1.0: skipping garbage [ 1432.695088][T20151] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 1432.711434][T20151] cdc_wdm 3-1:1.0: Unknown control protocol [ 1432.729312][ T10] cougar 0003:060B:700A.0046: unknown main item tag 0x0 [ 1432.792762][ T10] cougar 0003:060B:700A.0046: unknown main item tag 0x0 [ 1432.827697][ T10] cougar 0003:060B:700A.0046: unknown main item tag 0x0 [ 1432.910705][ T10] cougar 0003:060B:700A.0046: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.1-1/input0 [ 1433.018140][ T10] usb 2-1: USB disconnect, device number 10 [ 1433.082476][T29721] netlink: zone id is out of range [ 1433.095078][T29721] netlink: zone id is out of range [ 1433.122889][T29721] netlink: zone id is out of range [ 1433.135789][T29721] netlink: zone id is out of range [ 1433.149336][T29719] fido_id[29719]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 1433.298027][T29721] netlink: zone id is out of range [ 1433.324290][T29721] netlink: zone id is out of range [ 1433.337236][T29721] netlink: zone id is out of range [ 1433.355084][T29721] netlink: zone id is out of range [ 1433.360243][T29721] netlink: zone id is out of range [ 1433.369292][T29721] netlink: zone id is out of range [ 1433.438792][T29705] kvm: user requested TSC rate below hardware speed [ 1433.537780][ T10] usb 3-1: USB disconnect, device number 74 [ 1433.613780][T20152] usb 1-1: new full-speed USB device number 57 using dummy_hcd [ 1433.795215][T20152] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1433.807158][T20152] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1433.821533][T20152] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1433.831210][T20152] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1433.849564][T20152] usb 1-1: Product: syz [ 1433.873792][T20152] usb 1-1: Manufacturer: syz [ 1433.883826][T20152] usb 1-1: SerialNumber: syz [ 1434.434153][ T10] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 1434.460377][T29748] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6878'. [ 1434.469699][T29748] bridge_slave_1: left allmulticast mode [ 1434.479785][T29748] bridge_slave_1: left promiscuous mode [ 1434.486196][T29748] bridge0: port 2(bridge_slave_1) entered disabled state [ 1434.496793][T29748] bridge_slave_0: left allmulticast mode [ 1434.502594][T29748] bridge_slave_0: left promiscuous mode [ 1434.509566][T29748] bridge0: port 1(bridge_slave_0) entered disabled state [ 1434.668617][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1434.681832][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1434.709119][ T10] usb 3-1: New USB device found, idVendor=07b5, idProduct=0312, bcdDevice= 0.00 [ 1434.737369][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1434.871262][ T10] usb 3-1: config 0 descriptor?? [ 1435.280226][T29750] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6879'. [ 1435.306346][ T10] hid (null): report_id 1688554005 is invalid [ 1435.316682][T29750] netlink: 'syz.3.6879': attribute type 2 has an invalid length. [ 1435.346776][ T10] megaworld 0003:07B5:0312.0047: report_id 1688554005 is invalid [ 1435.367720][T29750] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6879'. [ 1435.382874][ T10] megaworld 0003:07B5:0312.0047: item 0 4 1 8 parsing failed [ 1435.409242][ T10] megaworld 0003:07B5:0312.0047: parse failed [ 1435.450516][ T10] megaworld 0003:07B5:0312.0047: probe with driver megaworld failed with error -22 [ 1435.520488][ T10] usb 3-1: USB disconnect, device number 75 [ 1435.632998][T29758] netlink: 'syz.4.6883': attribute type 32 has an invalid length. [ 1435.642028][T29758] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6883'. [ 1435.654691][T29760] IPVS: set_ctl: invalid protocol: 2 255.255.255.255:20002 [ 1436.152425][T20152] usb 1-1: cannot find UAC_HEADER [ 1436.163812][ T2153] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 1436.233273][T20152] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1436.272432][T20152] usb 1-1: USB disconnect, device number 57 [ 1436.300871][T28185] udevd[28185]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1436.355648][ T2153] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1436.378691][ T2153] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1436.403750][ T2153] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1436.412797][ T2153] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1436.423867][ T2153] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1436.444661][ T2153] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1436.460347][ T2153] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1436.483501][ T10] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 1436.568774][ T2153] usb 5-1: Product: syz [ 1436.572973][ T2153] usb 5-1: Manufacturer: syz [ 1436.687891][ T2153] cdc_wdm 5-1:1.0: skipping garbage [ 1436.732851][ T2153] cdc_wdm 5-1:1.0: skipping garbage [ 1436.747659][ T2153] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 1436.754631][ T2153] cdc_wdm 5-1:1.0: Unknown control protocol [ 1436.762915][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1436.848169][ T10] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1436.862675][ T10] usb 3-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=b1.f9 [ 1436.871975][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1436.880506][ T10] usb 3-1: Product: syz [ 1436.886350][ T10] usb 3-1: Manufacturer: syz [ 1436.928960][ T10] usb 3-1: SerialNumber: syz [ 1436.954295][ T10] usb 3-1: config 0 descriptor?? [ 1436.963542][T20152] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 1436.979554][ T10] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 1436.999864][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1437.033670][ T10] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 error while loading driver (-23) [ 1437.123484][T20152] usb 4-1: Using ep0 maxpacket: 8 [ 1437.133255][T20152] usb 4-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1437.163784][T20152] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1437.202640][T20152] usb 4-1: Product: syz [ 1437.215791][T20152] usb 4-1: Manufacturer: syz [ 1437.273479][T20152] usb 4-1: SerialNumber: syz [ 1437.291462][T20152] usb 4-1: config 0 descriptor?? [ 1437.312640][T20152] gspca_main: se401-2.14.0 probing 047d:5003 [ 1437.523101][T29768] kvm: user requested TSC rate below hardware speed [ 1437.581802][ T5832] usb 3-1: USB disconnect, device number 76 [ 1437.624498][ T5917] usb 5-1: USB disconnect, device number 85 [ 1437.719916][T29794] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6896'. [ 1437.737122][T20152] input: se401 as /devices/platform/dummy_hcd.3/usb4/4-1/input/input135 [ 1437.984586][T29801] FAULT_INJECTION: forcing a failure. [ 1437.984586][T29801] name failslab, interval 1, probability 0, space 0, times 0 [ 1438.024447][T29801] CPU: 1 UID: 0 PID: 29801 Comm: syz.0.6898 Not tainted syzkaller #0 PREEMPT(full) [ 1438.024472][T29801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1438.024483][T29801] Call Trace: [ 1438.024492][T29801] [ 1438.024501][T29801] dump_stack_lvl+0x189/0x250 [ 1438.024528][T29801] ? __pfx____ratelimit+0x10/0x10 [ 1438.024556][T29801] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1438.024582][T29801] ? __pfx__printk+0x10/0x10 [ 1438.024607][T29801] ? __pfx___might_resched+0x10/0x10 [ 1438.024630][T29801] ? fs_reclaim_acquire+0x7d/0x100 [ 1438.024657][T29801] should_fail_ex+0x414/0x560 [ 1438.024688][T29801] should_failslab+0xa8/0x100 [ 1438.024712][T29801] kmem_cache_alloc_node_noprof+0x77/0x710 [ 1438.024732][T29801] ? __alloc_skb+0x112/0x2d0 [ 1438.024761][T29801] __alloc_skb+0x112/0x2d0 [ 1438.024787][T29801] netlink_sendmsg+0x5c6/0xb30 [ 1438.024819][T29801] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1438.024847][T29801] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1438.024869][T29801] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1438.024891][T29801] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1438.024917][T29801] __sock_sendmsg+0x21c/0x270 [ 1438.024941][T29801] ____sys_sendmsg+0x505/0x830 [ 1438.024971][T29801] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1438.025005][T29801] ? import_iovec+0x74/0xa0 [ 1438.025027][T29801] ___sys_sendmsg+0x21f/0x2a0 [ 1438.025043][T29801] ? __pfx____sys_sendmsg+0x10/0x10 [ 1438.025094][T29801] ? __fget_files+0x2a/0x420 [ 1438.025113][T29801] ? __fget_files+0x3a0/0x420 [ 1438.025142][T29801] __x64_sys_sendmsg+0x19b/0x260 [ 1438.025159][T29801] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1438.025184][T29801] ? __pfx_ksys_write+0x10/0x10 [ 1438.025206][T29801] ? do_syscall_64+0xbe/0xfa0 [ 1438.025225][T29801] do_syscall_64+0xfa/0xfa0 [ 1438.025240][T29801] ? lockdep_hardirqs_on+0x9c/0x150 [ 1438.025256][T29801] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1438.025273][T29801] ? clear_bhb_loop+0x60/0xb0 [ 1438.025294][T29801] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1438.025312][T29801] RIP: 0033:0x7f59c878eec9 [ 1438.025328][T29801] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1438.025344][T29801] RSP: 002b:00007f59c9691038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1438.025364][T29801] RAX: ffffffffffffffda RBX: 00007f59c89e5fa0 RCX: 00007f59c878eec9 [ 1438.025389][T29801] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1438.025400][T29801] RBP: 00007f59c9691090 R08: 0000000000000000 R09: 0000000000000000 [ 1438.025412][T29801] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1438.025423][T29801] R13: 00007f59c89e6038 R14: 00007f59c89e5fa0 R15: 00007f59c8b0fa28 [ 1438.025448][T29801] [ 1438.110566][T19156] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1438.314520][T19156] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1438.323205][T19156] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1438.331387][T19156] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1438.339132][T19156] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1438.363490][ T5832] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 1438.523616][ T5832] usb 3-1: Using ep0 maxpacket: 32 [ 1438.538769][ T5832] usb 3-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 1438.558811][ T5832] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1438.581727][ T5832] usb 3-1: Product: syz [ 1438.589277][ T5832] usb 3-1: Manufacturer: syz [ 1438.594254][ T5832] usb 3-1: SerialNumber: syz [ 1438.606291][ T5832] usb 3-1: config 0 descriptor?? [ 1438.653670][ T2153] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 1438.688913][T29813] Cannot find add_set index 616 as target [ 1438.757805][T29806] chnl_net:caif_netlink_parms(): no params data found [ 1438.823582][ T2153] usb 5-1: Using ep0 maxpacket: 16 [ 1438.838108][ T2153] usb 5-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 1438.847554][ T2153] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1438.875467][ T2153] usb 5-1: Product: syz [ 1438.971887][ T2153] usb 5-1: Manufacturer: syz [ 1439.021379][ T2153] usb 5-1: SerialNumber: syz [ 1439.041208][ T2153] usb 5-1: config 0 descriptor?? [ 1439.105753][ T2153] ssu100 5-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 1439.190454][T29806] bridge0: port 1(bridge_slave_0) entered blocking state [ 1439.212955][T29806] bridge0: port 1(bridge_slave_0) entered disabled state [ 1439.220711][ T5832] peak_usb 3-1:0.0: PEAK-System PCAN-USB Pro hwrev 0 serial 00000000.00000000 (2 channels) [ 1439.246213][T29806] bridge_slave_0: entered allmulticast mode [ 1439.251619][ T5832] peak_usb 3-1:0.0 can0: sending command failure: -22 [ 1439.266380][T29806] bridge_slave_0: entered promiscuous mode [ 1439.272531][ T5832] peak_usb 3-1:0.0 can0: sending command failure: -22 [ 1439.312931][T29806] bridge0: port 2(bridge_slave_1) entered blocking state [ 1439.330598][T29806] bridge0: port 2(bridge_slave_1) entered disabled state [ 1439.341145][T29806] bridge_slave_1: entered allmulticast mode [ 1439.351735][ T5832] peak_usb 3-1:0.0: probe with driver peak_usb failed with error -22 [ 1439.367088][T29806] bridge_slave_1: entered promiscuous mode [ 1439.446103][T20151] usb 3-1: USB disconnect, device number 77 [ 1439.493159][T29806] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1439.591973][T29806] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1439.674545][T29806] team0: Port device team_slave_0 added [ 1439.692265][T29806] team0: Port device team_slave_1 added [ 1439.842849][T29806] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1439.856401][T29806] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1439.886325][T29806] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1439.917151][ T2153] ssu100 5-1:0.0: probe with driver ssu100 failed with error -71 [ 1439.920584][T29806] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1439.932517][ T2153] usb 5-1: USB disconnect, device number 86 [ 1439.934735][T29806] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1439.967724][T29806] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1440.135124][ T5832] usb 4-1: USB disconnect, device number 104 [ 1440.260421][T29806] hsr_slave_0: entered promiscuous mode [ 1440.403477][T13221] Bluetooth: hci1: command tx timeout [ 1440.519074][T29806] hsr_slave_1: entered promiscuous mode [ 1440.545363][T29806] debugfs: 'hsr0' already exists in 'hsr' [ 1440.571679][T29806] Cannot create hsr debugfs directory [ 1440.869704][T29832] batadv_slave_0: entered promiscuous mode [ 1440.906994][T29832] batadv_slave_0: left promiscuous mode [ 1441.242199][T29836] No such timeout policy "syz0" [ 1441.929082][T29851] SET target dimension over the limit! [ 1442.122352][T29806] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1442.139074][T29806] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1442.323669][T29806] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1442.352130][T29806] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1442.463541][T13221] Bluetooth: hci1: command tx timeout [ 1442.911418][T29806] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1442.994221][T29806] 8021q: adding VLAN 0 to HW filter on device team0 [ 1443.104796][T11387] bridge0: port 1(bridge_slave_0) entered blocking state [ 1443.111923][T11387] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1443.127709][T29864] netlink: 'syz.4.6911': attribute type 32 has an invalid length. [ 1443.209892][T29536] bridge0: port 2(bridge_slave_1) entered blocking state [ 1443.217125][T29536] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1443.556664][T29806] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1443.574754][T29875] netlink: 88 bytes leftover after parsing attributes in process `syz.3.6915'. [ 1443.603613][T29875] netlink: 48 bytes leftover after parsing attributes in process `syz.3.6915'. [ 1443.662259][T29878] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6917'. [ 1443.692710][T29806] veth0_vlan: entered promiscuous mode [ 1443.710798][T29806] veth1_vlan: entered promiscuous mode [ 1443.776744][T29806] veth0_macvtap: entered promiscuous mode [ 1443.830263][T29806] veth1_macvtap: entered promiscuous mode [ 1443.859197][T29806] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1443.897127][T29806] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1443.918414][T11387] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1444.094033][T11387] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1444.130970][T29894] loop6: detected capacity change from 0 to 2 [ 1444.172749][T11387] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1444.186317][T11387] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1444.239143][T28185] Dev loop6: unable to read RDB block 2 [ 1444.251290][T28185] loop6: unable to read partition table [ 1444.257108][ T5832] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 1444.265820][T28185] loop6: partition table beyond EOD, truncated [ 1444.354749][T29895] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1444.400651][T29536] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1444.413497][ T5832] usb 3-1: device descriptor read/64, error -71 [ 1444.438961][T29536] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1444.465211][T29894] Dev loop6: unable to read RDB block 2 [ 1444.470916][T29894] loop6: unable to read partition table [ 1444.483904][T29894] loop6: partition table beyond EOD, truncated [ 1444.539716][T13221] Bluetooth: hci1: command tx timeout [ 1444.545795][T23330] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1444.548145][T29894] loop_reread_partitions: partition scan of loop6 ( 6tPΪŔA8*V^3c) failed (rc=-5) [ 1444.585510][T23330] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1444.783524][ T5832] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 1444.949649][ T5832] usb 3-1: device descriptor read/64, error -71 [ 1445.004922][T29905] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6924'. [ 1445.054392][T29904] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6894'. [ 1445.083504][T29905] netlink: 'syz.3.6924': attribute type 2 has an invalid length. [ 1445.090597][T29904] vlan2: entered promiscuous mode [ 1445.101614][T29905] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6924'. [ 1445.102032][ T5832] usb usb3-port1: attempt power cycle [ 1445.134425][T29904] batadv0: entered promiscuous mode [ 1445.285638][T29909] [ 1445.288020][T29909] ===================================================== [ 1445.294963][T29909] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [ 1445.302441][T29909] syzkaller #0 Not tainted [ 1445.306859][T29909] ----------------------------------------------------- [ 1445.313914][T29909] syz.0.6926/29909 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 1445.321726][T29909] ffff88802abd38a0 (&new->fa_lock){...-}-{3:3}, at: kill_fasync+0x199/0x4d0 [ 1445.330550][T29909] [ 1445.330550][T29909] and this task is already holding: [ 1445.337928][T29909] ffff888064e85028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 1445.347687][T29909] which would create a new lock dependency: [ 1445.353557][T29909] (&client->buffer_lock){..-.}-{3:3} -> (&new->fa_lock){...-}-{3:3} [ 1445.361627][T29909] [ 1445.361627][T29909] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 1445.371057][T29909] (&client->buffer_lock){..-.}-{3:3} [ 1445.371078][T29909] [ 1445.371078][T29909] ... which became SOFTIRQ-irq-safe at: [ 1445.384228][T29909] lock_acquire+0x120/0x360 [ 1445.388806][T29909] _raw_spin_lock+0x2e/0x40 [ 1445.393382][T29909] evdev_pass_values+0xb9/0xbd0 [ 1445.398308][T29909] evdev_events+0x1e6/0x340 [ 1445.402877][T29909] input_pass_values+0x288/0x890 [ 1445.407880][T29909] input_event_dispose+0x330/0x6b0 [ 1445.413065][T29909] input_event+0x89/0xe0 [ 1445.417384][T29909] xpad360_process_packet+0x641/0xdd0 [ 1445.422829][T29909] xpad_irq_in+0x14e/0x2590 [ 1445.427409][T29909] __usb_hcd_giveback_urb+0x376/0x540 [ 1445.432937][T29909] dummy_timer+0x85f/0x44c0 [ 1445.437531][T29909] __hrtimer_run_queues+0x52c/0xc60 [ 1445.442849][T29909] hrtimer_run_softirq+0x187/0x2b0 [ 1445.448038][T29909] handle_softirqs+0x286/0x870 [ 1445.452881][T29909] __irq_exit_rcu+0xca/0x1f0 [ 1445.457568][T29909] irq_exit_rcu+0x9/0x30 [ 1445.461886][T29909] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1445.467586][T29909] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1445.473632][T29909] pv_native_safe_halt+0x13/0x20 [ 1445.478633][T29909] default_idle+0x13/0x20 [ 1445.483030][T29909] default_idle_call+0x73/0xb0 [ 1445.487860][T29909] do_idle+0x1e7/0x510 [ 1445.492088][T29909] cpu_startup_entry+0x44/0x60 [ 1445.496920][T29909] start_secondary+0x101/0x110 [ 1445.501756][T29909] common_startup_64+0x13e/0x147 [ 1445.506761][T29909] [ 1445.506761][T29909] to a SOFTIRQ-irq-unsafe lock: [ 1445.513754][T29909] (tasklist_lock){.+.+}-{3:3} [ 1445.513775][T29909] [ 1445.513775][T29909] ... which became SOFTIRQ-irq-unsafe at: [ 1445.526361][T29909] ... [ 1445.526369][T29909] lock_acquire+0x120/0x360 [ 1445.533590][T29909] _raw_read_lock+0x36/0x50 [ 1445.538185][T29909] __do_wait+0xde/0x740 [ 1445.542409][T29909] do_wait+0x1f8/0x510 [ 1445.546543][T29909] kernel_wait+0xab/0x170 [ 1445.550942][T29909] call_usermodehelper_exec_work+0xbe/0x230 [ 1445.556906][T29909] process_scheduled_works+0xae1/0x17b0 [ 1445.562613][T29909] worker_thread+0x8a0/0xda0 [ 1445.567271][T29909] kthread+0x711/0x8a0 [ 1445.571404][T29909] ret_from_fork+0x4bc/0x870 [ 1445.576059][T29909] ret_from_fork_asm+0x1a/0x30 [ 1445.580900][T29909] [ 1445.580900][T29909] other info that might help us debug this: [ 1445.580900][T29909] [ 1445.591115][T29909] Chain exists of: [ 1445.591115][T29909] &client->buffer_lock --> &new->fa_lock --> tasklist_lock [ 1445.591115][T29909] [ 1445.604241][T29909] Possible interrupt unsafe locking scenario: [ 1445.604241][T29909] [ 1445.612544][T29909] CPU0 CPU1 [ 1445.617982][T29909] ---- ---- [ 1445.623342][T29909] lock(tasklist_lock); [ 1445.627569][T29909] local_irq_disable(); [ 1445.634307][T29909] lock(&client->buffer_lock); [ 1445.641664][T29909] lock(&new->fa_lock); [ 1445.648443][T29909] [ 1445.651964][T29909] lock(&client->buffer_lock); [ 1445.656968][T29909] [ 1445.656968][T29909] *** DEADLOCK *** [ 1445.656968][T29909] [ 1445.665089][T29909] 7 locks held by syz.0.6926/29909: [ 1445.670348][T29909] #0: ffff8880293ce118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_write+0x1a1/0x480 [ 1445.679461][T29909] #1: ffff8881476db230 (&dev->event_lock#2){..-.}-{3:3}, at: input_inject_event+0xa5/0x340 [ 1445.689622][T29909] #2: ffffffff8e13d2e0 (rcu_read_lock){....}-{1:3}, at: input_inject_event+0xb6/0x340 [ 1445.699351][T29909] #3: ffffffff8e13d2e0 (rcu_read_lock){....}-{1:3}, at: input_pass_values+0x8d/0x890 [ 1445.708903][T29909] #4: ffffffff8e13d2e0 (rcu_read_lock){....}-{1:3}, at: evdev_events+0x79/0x340 [ 1445.718012][T29909] #5: ffff888064e85028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 1445.728158][T29909] #6: ffffffff8e13d2e0 (rcu_read_lock){....}-{1:3}, at: kill_fasync+0x53/0x4d0 [ 1445.737183][T29909] [ 1445.737183][T29909] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 1445.747566][T29909] -> (&client->buffer_lock){..-.}-{3:3} { [ 1445.753276][T29909] IN-SOFTIRQ-W at: [ 1445.757243][T29909] lock_acquire+0x120/0x360 [ 1445.763380][T29909] _raw_spin_lock+0x2e/0x40 [ 1445.769562][T29909] evdev_pass_values+0xb9/0xbd0 [ 1445.776038][T29909] evdev_events+0x1e6/0x340 [ 1445.782172][T29909] input_pass_values+0x288/0x890 [ 1445.788756][T29909] input_event_dispose+0x330/0x6b0 [ 1445.795523][T29909] input_event+0x89/0xe0 [ 1445.801399][T29909] xpad360_process_packet+0x641/0xdd0 [ 1445.808489][T29909] xpad_irq_in+0x14e/0x2590 [ 1445.814710][T29909] __usb_hcd_giveback_urb+0x376/0x540 [ 1445.821711][T29909] dummy_timer+0x85f/0x44c0 [ 1445.827839][T29909] __hrtimer_run_queues+0x52c/0xc60 [ 1445.834670][T29909] hrtimer_run_softirq+0x187/0x2b0 [ 1445.841415][T29909] handle_softirqs+0x286/0x870 [ 1445.847809][T29909] __irq_exit_rcu+0xca/0x1f0 [ 1445.854030][T29909] irq_exit_rcu+0x9/0x30 [ 1445.859915][T29909] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1445.867185][T29909] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1445.874794][T29909] pv_native_safe_halt+0x13/0x20 [ 1445.881353][T29909] default_idle+0x13/0x20 [ 1445.887308][T29909] default_idle_call+0x73/0xb0 [ 1445.893700][T29909] do_idle+0x1e7/0x510 [ 1445.899396][T29909] cpu_startup_entry+0x44/0x60 [ 1445.905805][T29909] start_secondary+0x101/0x110 [ 1445.912206][T29909] common_startup_64+0x13e/0x147 [ 1445.918774][T29909] INITIAL USE at: [ 1445.922660][T29909] lock_acquire+0x120/0x360 [ 1445.928702][T29909] _raw_spin_lock_irq+0xa2/0xf0 [ 1445.935102][T29909] evdev_read+0x370/0xca0 [ 1445.940978][T29909] vfs_readv+0x5aa/0x850 [ 1445.946851][T29909] do_readv+0x14d/0x2d0 [ 1445.952548][T29909] do_syscall_64+0xfa/0xfa0 [ 1445.958587][T29909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1445.966021][T29909] } [ 1445.968500][T29909] ... key at: [] evdev_open.__key.25+0x0/0x20 [ 1445.976675][T29909] [ 1445.976675][T29909] the dependencies between the lock to be acquired [ 1445.976683][T29909] and SOFTIRQ-irq-unsafe lock: [ 1445.990324][T29909] -> (tasklist_lock){.+.+}-{3:3} { [ 1445.995600][T29909] HARDIRQ-ON-R at: [ 1445.999728][T29909] lock_acquire+0x120/0x360 [ 1446.006203][T29909] _raw_read_lock+0x36/0x50 [ 1446.012791][T29909] __do_wait+0xde/0x740 [ 1446.018927][T29909] do_wait+0x1f8/0x510 [ 1446.024978][T29909] kernel_wait+0xab/0x170 [ 1446.031371][T29909] call_usermodehelper_exec_work+0xbe/0x230 [ 1446.039268][T29909] process_scheduled_works+0xae1/0x17b0 [ 1446.046795][T29909] worker_thread+0x8a0/0xda0 [ 1446.053364][T29909] kthread+0x711/0x8a0 [ 1446.059417][T29909] ret_from_fork+0x4bc/0x870 [ 1446.065987][T29909] ret_from_fork_asm+0x1a/0x30 [ 1446.072727][T29909] SOFTIRQ-ON-R at: [ 1446.076855][T29909] lock_acquire+0x120/0x360 [ 1446.083353][T29909] _raw_read_lock+0x36/0x50 [ 1446.089854][T29909] __do_wait+0xde/0x740 [ 1446.095998][T29909] do_wait+0x1f8/0x510 [ 1446.102051][T29909] kernel_wait+0xab/0x170 [ 1446.108353][T29909] call_usermodehelper_exec_work+0xbe/0x230 [ 1446.116224][T29909] process_scheduled_works+0xae1/0x17b0 [ 1446.123746][T29909] worker_thread+0x8a0/0xda0 [ 1446.130312][T29909] kthread+0x711/0x8a0 [ 1446.136357][T29909] ret_from_fork+0x4bc/0x870 [ 1446.143016][T29909] ret_from_fork_asm+0x1a/0x30 [ 1446.149757][T29909] INITIAL USE at: [ 1446.153802][T29909] lock_acquire+0x120/0x360 [ 1446.160196][T29909] _raw_write_lock_irq+0xa2/0xf0 [ 1446.167022][T29909] copy_process+0x224f/0x3c00 [ 1446.173677][T29909] kernel_clone+0x21e/0x840 [ 1446.180069][T29909] user_mode_thread+0xdd/0x140 [ 1446.186735][T29909] rest_init+0x23/0x300 [ 1446.192782][T29909] start_kernel+0x3ae/0x410 [ 1446.199254][T29909] x86_64_start_reservations+0x24/0x30 [ 1446.206670][T29909] x86_64_start_kernel+0x143/0x1c0 [ 1446.213774][T29909] common_startup_64+0x13e/0x147 [ 1446.220616][T29909] INITIAL READ USE at: [ 1446.225098][T29909] lock_acquire+0x120/0x360 [ 1446.231927][T29909] _raw_read_lock+0x36/0x50 [ 1446.238764][T29909] __do_wait+0xde/0x740 [ 1446.245252][T29909] do_wait+0x1f8/0x510 [ 1446.251648][T29909] kernel_wait+0xab/0x170 [ 1446.258299][T29909] call_usermodehelper_exec_work+0xbe/0x230 [ 1446.266514][T29909] process_scheduled_works+0xae1/0x17b0 [ 1446.274388][T29909] worker_thread+0x8a0/0xda0 [ 1446.281307][T29909] kthread+0x711/0x8a0 [ 1446.287697][T29909] ret_from_fork+0x4bc/0x870 [ 1446.294613][T29909] ret_from_fork_asm+0x1a/0x30 [ 1446.301700][T29909] } [ 1446.304349][T29909] ... key at: [] tasklist_lock+0x18/0x40 [ 1446.312311][T29909] ... acquired at: [ 1446.316260][T29909] lock_acquire+0x120/0x360 [ 1446.320927][T29909] _raw_read_lock+0x36/0x50 [ 1446.325588][T29909] send_sigurg+0x12b/0x420 [ 1446.330160][T29909] sk_send_sigurg+0x6c/0x2e0 [ 1446.334902][T29909] tcp_check_urg+0x200/0x760 [ 1446.339645][T29909] tcp_urg+0x164/0x3f0 [ 1446.343863][T29909] tcp_rcv_established+0x132a/0x2670 [ 1446.349299][T29909] tcp_v4_do_rcv+0xa23/0xce0 [ 1446.354037][T29909] __release_sock+0x265/0x3a0 [ 1446.358863][T29909] release_sock+0x5f/0x1f0 [ 1446.363432][T29909] tcp_sendmsg+0x39/0x50 [ 1446.367842][T29909] __sock_sendmsg+0xe5/0x270 [ 1446.372614][T29909] __sys_sendto+0x3bd/0x520 [ 1446.377280][T29909] __x64_sys_sendto+0xde/0x100 [ 1446.382205][T29909] do_syscall_64+0xfa/0xfa0 [ 1446.386961][T29909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1446.393012][T29909] [ 1446.395315][T29909] -> (&f_owner->lock){...-}-{3:3} { [ 1446.400594][T29909] IN-SOFTIRQ-R at: [ 1446.404639][T29909] lock_acquire+0x120/0x360 [ 1446.410961][T29909] _raw_read_lock_irqsave+0xaf/0x100 [ 1446.418161][T29909] send_sigio+0x38/0x370 [ 1446.424221][T29909] kill_fasync+0x24d/0x4d0 [ 1446.430537][T29909] tun_net_xmit+0x10af/0x1610 [ 1446.437028][T29909] dev_hard_start_xmit+0x2d7/0x830 [ 1446.443961][T29909] sch_direct_xmit+0x241/0x4b0 [ 1446.450541][T29909] __dev_queue_xmit+0x1857/0x3b50 [ 1446.457371][T29909] tipc_l2_send_msg+0x337/0x400 [ 1446.464044][T29909] tipc_bearer_xmit_skb+0x2b3/0x400 [ 1446.471044][T29909] tipc_disc_timeout+0x580/0x6d0 [ 1446.477787][T29909] call_timer_fn+0x17e/0x5f0 [ 1446.484195][T29909] __run_timer_base+0x61a/0x860 [ 1446.490857][T29909] run_timer_softirq+0xb7/0x180 [ 1446.497510][T29909] handle_softirqs+0x286/0x870 [ 1446.504081][T29909] __irq_exit_rcu+0xca/0x1f0 [ 1446.510649][T29909] irq_exit_rcu+0x9/0x30 [ 1446.516699][T29909] sysvec_apic_timer_interrupt+0x57/0xc0 [ 1446.524139][T29909] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1446.531924][T29909] INITIAL USE at: [ 1446.535970][T29909] lock_acquire+0x120/0x360 [ 1446.542277][T29909] _raw_write_lock_irq+0xa2/0xf0 [ 1446.548926][T29909] __f_setown+0x67/0x370 [ 1446.554884][T29909] generic_setlease+0xd60/0x1240 [ 1446.561538][T29909] fcntl_setlease+0x3a2/0x4c0 [ 1446.567935][T29909] do_fcntl+0x6a9/0x1910 [ 1446.573985][T29909] __se_sys_fcntl+0xc8/0x150 [ 1446.580303][T29909] do_syscall_64+0xfa/0xfa0 [ 1446.586526][T29909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1446.594139][T29909] INITIAL READ USE at: [ 1446.598533][T29909] lock_acquire+0x120/0x360 [ 1446.605205][T29909] _raw_read_lock_irqsave+0xaf/0x100 [ 1446.612641][T29909] send_sigio+0x38/0x370 [ 1446.619040][T29909] kill_fasync+0x24d/0x4d0 [ 1446.625608][T29909] fsnotify_insert_event+0x32e/0x3e0 [ 1446.633040][T29909] inotify_handle_inode_event+0x3ea/0x5f0 [ 1446.640911][T29909] inotify_ignored_and_remove_idr+0x29/0x70 [ 1446.648961][T29909] fsnotify_destroy_marks+0x155/0x330 [ 1446.656486][T29909] dentry_unlink_inode+0x2c2/0x3f0 [ 1446.663748][T29909] vfs_rmdir+0x262/0x520 [ 1446.670139][T29909] do_rmdir+0x25f/0x550 [ 1446.676456][T29909] __x64_sys_rmdir+0x47/0x50 [ 1446.683212][T29909] do_syscall_64+0xfa/0xfa0 [ 1446.689956][T29909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1446.698004][T29909] } [ 1446.700566][T29909] ... key at: [] file_f_owner_allocate.__key+0x0/0x20 [ 1446.709513][T29909] ... acquired at: [ 1446.713380][T29909] lock_acquire+0x120/0x360 [ 1446.718051][T29909] _raw_read_lock_irqsave+0xaf/0x100 [ 1446.723497][T29909] send_sigio+0x38/0x370 [ 1446.727912][T29909] kill_fasync+0x24d/0x4d0 [ 1446.732479][T29909] fsnotify_insert_event+0x32e/0x3e0 [ 1446.737916][T29909] inotify_handle_inode_event+0x3ea/0x5f0 [ 1446.743793][T29909] inotify_ignored_and_remove_idr+0x29/0x70 [ 1446.749839][T29909] fsnotify_destroy_marks+0x155/0x330 [ 1446.755361][T29909] dentry_unlink_inode+0x2c2/0x3f0 [ 1446.760630][T29909] vfs_rmdir+0x262/0x520 [ 1446.765023][T29909] do_rmdir+0x25f/0x550 [ 1446.769328][T29909] __x64_sys_rmdir+0x47/0x50 [ 1446.774069][T29909] do_syscall_64+0xfa/0xfa0 [ 1446.778722][T29909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1446.784767][T29909] [ 1446.787081][T29909] -> (&new->fa_lock){...-}-{3:3} { [ 1446.792181][T29909] IN-SOFTIRQ-R at: [ 1446.796140][T29909] lock_acquire+0x120/0x360 [ 1446.802272][T29909] _raw_read_lock_irqsave+0xaf/0x100 [ 1446.809197][T29909] kill_fasync+0x199/0x4d0 [ 1446.815247][T29909] tun_net_xmit+0x10af/0x1610 [ 1446.821559][T29909] dev_hard_start_xmit+0x2d7/0x830 [ 1446.828295][T29909] sch_direct_xmit+0x241/0x4b0 [ 1446.834689][T29909] __dev_queue_xmit+0x1857/0x3b50 [ 1446.841344][T29909] tipc_l2_send_msg+0x337/0x400 [ 1446.847998][T29909] tipc_bearer_xmit_skb+0x2b3/0x400 [ 1446.854823][T29909] tipc_disc_timeout+0x580/0x6d0 [ 1446.861518][T29909] call_timer_fn+0x17e/0x5f0 [ 1446.867766][T29909] __run_timer_base+0x61a/0x860 [ 1446.874341][T29909] run_timer_softirq+0xb7/0x180 [ 1446.880827][T29909] handle_softirqs+0x286/0x870 [ 1446.887227][T29909] __irq_exit_rcu+0xca/0x1f0 [ 1446.893547][T29909] irq_exit_rcu+0x9/0x30 [ 1446.899428][T29909] sysvec_apic_timer_interrupt+0x57/0xc0 [ 1446.906692][T29909] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1446.914298][T29909] INITIAL USE at: [ 1446.918172][T29909] lock_acquire+0x120/0x360 [ 1446.924222][T29909] _raw_write_lock_irq+0xa2/0xf0 [ 1446.930699][T29909] fasync_remove_entry+0xf1/0x1c0 [ 1446.937267][T29909] lease_modify+0x1ca/0x3c0 [ 1446.943319][T29909] locks_remove_file+0x4bf/0xea0 [ 1446.949799][T29909] __fput+0x3ab/0xa70 [ 1446.955328][T29909] task_work_run+0x1d4/0x260 [ 1446.961462][T29909] exit_to_user_mode_loop+0xe9/0x130 [ 1446.968288][T29909] do_syscall_64+0x2bd/0xfa0 [ 1446.974423][T29909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1446.981941][T29909] INITIAL READ USE at: [ 1446.986254][T29909] lock_acquire+0x120/0x360 [ 1446.992739][T29909] _raw_read_lock_irqsave+0xaf/0x100 [ 1447.000025][T29909] kill_fasync+0x199/0x4d0 [ 1447.006447][T29909] fsnotify_insert_event+0x32e/0x3e0 [ 1447.013713][T29909] inotify_handle_inode_event+0x3ea/0x5f0 [ 1447.021418][T29909] inotify_ignored_and_remove_idr+0x29/0x70 [ 1447.029298][T29909] fsnotify_destroy_marks+0x155/0x330 [ 1447.036658][T29909] dentry_unlink_inode+0x2c2/0x3f0 [ 1447.043751][T29909] vfs_rmdir+0x262/0x520 [ 1447.049966][T29909] do_rmdir+0x25f/0x550 [ 1447.056092][T29909] __x64_sys_rmdir+0x47/0x50 [ 1447.062656][T29909] do_syscall_64+0xfa/0xfa0 [ 1447.069132][T29909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1447.076997][T29909] } [ 1447.079471][T29909] ... key at: [] fasync_insert_entry.__key+0x0/0x20 [ 1447.088124][T29909] ... acquired at: [ 1447.091909][T29909] lock_acquire+0x120/0x360 [ 1447.096563][T29909] _raw_read_lock_irqsave+0xaf/0x100 [ 1447.102004][T29909] kill_fasync+0x199/0x4d0 [ 1447.106577][T29909] evdev_pass_values+0x627/0xbd0 [ 1447.111662][T29909] evdev_events+0x1e6/0x340 [ 1447.116313][T29909] input_pass_values+0x288/0x890 [ 1447.121415][T29909] input_event_dispose+0x330/0x6b0 [ 1447.126852][T29909] input_inject_event+0x1dd/0x340 [ 1447.132027][T29909] evdev_write+0x2fc/0x480 [ 1447.136596][T29909] vfs_write+0x27e/0xb30 [ 1447.141078][T29909] ksys_write+0x145/0x250 [ 1447.145558][T29909] do_syscall_64+0xfa/0xfa0 [ 1447.150208][T29909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1447.156246][T29909] [ 1447.158543][T29909] [ 1447.158543][T29909] stack backtrace: [ 1447.164411][T29909] CPU: 0 UID: 0 PID: 29909 Comm: syz.0.6926 Not tainted syzkaller #0 PREEMPT(full) [ 1447.164425][T29909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1447.164432][T29909] Call Trace: [ 1447.164438][T29909] [ 1447.164444][T29909] dump_stack_lvl+0x189/0x250 [ 1447.164458][T29909] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1447.164468][T29909] ? __pfx__printk+0x10/0x10 [ 1447.164480][T29909] validate_chain+0x1f05/0x2140 [ 1447.164499][T29909] __lock_acquire+0xab9/0xd20 [ 1447.164512][T29909] ? kill_fasync+0x199/0x4d0 [ 1447.164526][T29909] lock_acquire+0x120/0x360 [ 1447.164539][T29909] ? kill_fasync+0x199/0x4d0 [ 1447.164554][T29909] _raw_read_lock_irqsave+0xaf/0x100 [ 1447.164570][T29909] ? kill_fasync+0x199/0x4d0 [ 1447.164583][T29909] ? __pfx__raw_read_lock_irqsave+0x10/0x10 [ 1447.164597][T29909] ? do_raw_spin_lock+0x121/0x290 [ 1447.164609][T29909] kill_fasync+0x199/0x4d0 [ 1447.164623][T29909] ? kill_fasync+0x53/0x4d0 [ 1447.164636][T29909] evdev_pass_values+0x627/0xbd0 [ 1447.164650][T29909] ? evdev_pass_values+0x641/0xbd0 [ 1447.164662][T29909] evdev_events+0x1e6/0x340 [ 1447.164672][T29909] ? evdev_events+0x79/0x340 [ 1447.164682][T29909] ? input_pass_values+0x8d/0x890 [ 1447.164692][T29909] input_pass_values+0x288/0x890 [ 1447.164704][T29909] ? input_handle_event+0x70c/0xf30 [ 1447.164718][T29909] input_event_dispose+0x330/0x6b0 [ 1447.164732][T29909] input_inject_event+0x1dd/0x340 [ 1447.164746][T29909] ? input_inject_event+0xb6/0x340 [ 1447.164760][T29909] evdev_write+0x2fc/0x480 [ 1447.164772][T29909] ? __pfx_evdev_write+0x10/0x10 [ 1447.164783][T29909] ? bpf_lsm_file_permission+0x9/0x20 [ 1447.164797][T29909] ? security_file_permission+0x75/0x290 [ 1447.164812][T29909] ? rw_verify_area+0x255/0x4d0 [ 1447.164822][T29909] ? __lock_acquire+0xab9/0xd20 [ 1447.164833][T29909] ? __pfx_evdev_write+0x10/0x10 [ 1447.164844][T29909] vfs_write+0x27e/0xb30 [ 1447.164856][T29909] ? __pfx_vfs_write+0x10/0x10 [ 1447.164866][T29909] ? __fget_files+0x2a/0x420 [ 1447.164878][T29909] ? __fget_files+0x2a/0x420 [ 1447.164889][T29909] ? __fget_files+0x3a0/0x420 [ 1447.164900][T29909] ? __fget_files+0x2a/0x420 [ 1447.164913][T29909] ksys_write+0x145/0x250 [ 1447.164924][T29909] ? __pfx_ksys_write+0x10/0x10 [ 1447.164934][T29909] ? do_syscall_64+0xbe/0xfa0 [ 1447.164945][T29909] do_syscall_64+0xfa/0xfa0 [ 1447.164954][T29909] ? lockdep_hardirqs_on+0x9c/0x150 [ 1447.164964][T29909] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1447.164974][T29909] ? clear_bhb_loop+0x60/0xb0 [ 1447.164985][T29909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1447.164995][T29909] RIP: 0033:0x7f59c878eec9 [ 1447.165006][T29909] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1447.165015][T29909] RSP: 002b:00007f59c9691038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1447.165027][T29909] RAX: ffffffffffffffda RBX: 00007f59c89e5fa0 RCX: 00007f59c878eec9 [ 1447.165034][T29909] RDX: 0000000000001068 RSI: 0000200000000040 RDI: 0000000000000004 [ 1447.165041][T29909] RBP: 00007f59c8811f91 R08: 0000000000000000 R09: 0000000000000000 [ 1447.165047][T29909] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1447.165054][T29909] R13: 00007f59c89e6038 R14: 00007f59c89e5fa0 R15: 00007f59c8b0fa28 [ 1447.165065][T29909] [ 1447.485046][ C0] vkms_vblank_simulate: vblank timer overrun [ 1447.505797][T13221] Bluetooth: hci1: command tx timeout [ 1447.563482][ T5832] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 1447.763474][ T2153] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 1447.773444][ T5832] usb 3-1: device not accepting address 80, error -71 [ 1447.791527][T29918] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6928'. [ 1448.139957][ T2153] usb 1-1: Using ep0 maxpacket: 32 [ 1448.146403][ T2153] usb 1-1: config 0 has an invalid interface number: 247 but max is 0 [ 1448.159788][ T2153] usb 1-1: config 0 has no interface number 0 [ 1448.168172][ T2153] usb 1-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 1448.177485][ T2153] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 1448.190317][ T2153] usb 1-1: Product: syz [ 1448.194703][ T2153] usb 1-1: Manufacturer: syz [ 1448.208255][ T2153] usb 1-1: config 0 descriptor?? [ 1448.418577][ T2153] usb 1-1: USB disconnect, device number 58