last executing test programs: 9m1.91554165s ago: executing program 1 (id=980): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x2c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x90}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 9m1.826185861s ago: executing program 1 (id=981): openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x28841, &(0x7f0000001100)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x16}}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_procfs(0x0, &(0x7f0000000080)='mountstats\x00') connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000540)={'syz_tun\x00', &(0x7f0000000500)=@ethtool_link_settings={0x1, 0x400, 0xf, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, [0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1]}}) fsetxattr$security_capability(r1, 0x0, 0x0, 0xfffffe04, 0x1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = syz_open_dev$vim2m(&(0x7f0000000200), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000400)={0xa00965, 0x2}) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000000)={0x0, 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="010725bd7000fcdbdfb30300"], 0x14}, 0x1, 0x0, 0x0, 0x20000090}, 0x24048880) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) syz_io_uring_setup(0x2b51, 0x0, 0x0, &(0x7f0000000140)) socket$nl_xfrm(0x10, 0x3, 0x6) gettid() setsockopt$MRT6_INIT(0xffffffffffffffff, 0x29, 0xc8, 0x0, 0x0) r6 = fsopen(&(0x7f00000002c0)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000240)={'wg0\x00', 0x0}) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f00000001c0)={0x1, 0x1, 0x40, r7, 0x2}, 0xc) 8m59.603328649s ago: executing program 1 (id=986): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x41, 0x3f, 0x5f, 0x20, 0x61d, 0xc150, 0xce6f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x33, 0x0, 0x1, 0x18, 0x70, 0xfd, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x4}}]}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f00000000c0)={0x20, 0x6, 0x22, {0x22, 0x23, "8e47b06ffb1acda98a7a2041b482ca97b8ca657f7cf0af40f381462e796682e5"}}, &(0x7f0000000280)={0x0, 0x3, 0x81, @string={0x81, 0x3, "43744510ed49a9a7d00b6eeac0e200639df8822d6cd78db1680b58fa74e0940826cafd5bab46aa6f359b6813bd2ab7626723d42bd407872b9bb4c1016ff4f7315dc86594b1eebd430aa6b87a1f155f621d82d499b82bb4f92d294bbe0fcf4a479e32d5f8915bfe86114b76d748cac1249da8cda0951034ac3254d65f10d279"}}, &(0x7f00000001c0)={0x0, 0xf, 0x34, {0x5, 0xf, 0x34, 0x3, [@ssp_cap={0x10, 0x10, 0xa, 0x4, 0x1, 0x3d3, 0xee0f, 0x8, [0x30]}, @ssp_cap={0x1c, 0x10, 0xa, 0x7f, 0x4, 0x2, 0xf, 0x5, [0x30, 0xcf, 0xff00ff, 0xffc0]}, @ptm_cap={0x3}]}}, &(0x7f0000000340)={0x20, 0x29, 0xf, {0xf, 0x29, 0x2, 0x3, 0xc, 0xf2, "de2aa8f1", "054a2424"}}, &(0x7f0000000380)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x1, 0x1, 0x7, 0x4, 0x1, 0x9, 0x9}}}, &(0x7f0000000800)={0x84, &(0x7f0000000400)={0x40, 0x1, 0x9, "0db74235a4ae57732e"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x80}, &(0x7f00000004c0)={0x20, 0x0, 0x4, {0x0, 0x1}}, &(0x7f0000000500)={0x20, 0x0, 0x4, {0x160, 0x1}}, &(0x7f0000000540)={0x40, 0x7, 0x2, 0x7}, &(0x7f0000000580)={0x40, 0x9, 0x1, 0x2}, &(0x7f00000005c0)={0x40, 0xb, 0x2, "dd70"}, &(0x7f0000000600)={0x40, 0xf, 0x2, 0x8}, &(0x7f0000000640)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000680)={0x40, 0x17, 0x6, @multicast}, &(0x7f00000006c0)={0x40, 0x19, 0x2, 'l]'}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x8}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x5}, &(0x7f0000000780)={0x40, 0x1e, 0x1}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x7}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c1f0000002000010300"], 0x1c}}, 0x4044814) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) r1 = socket$netlink(0x10, 0x3, 0x400000000000004) r2 = creat(&(0x7f0000000280)='./file0\x00', 0x0) close(r2) ioctl$DRM_IOCTL_MODE_ADDFB2(r2, 0xc06864b8, &(0x7f0000002140)={0x0, 0xae, 0x3ff, 0x30315559, 0x2, [], [0x0, 0x0, 0xfffffffe, 0x4], [], [0x8000000000000000, 0x0, 0x4000]}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000009c0)={'syztnl2\x00', &(0x7f0000000980)={'syztnl1\x00', 0x0, 0x1, 0x10, 0x8, 0x52, {{0x7, 0x4, 0x0, 0x2, 0x1c, 0x65, 0x0, 0xa, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, {[@lsrr={0x83, 0x7, 0x6c, [@private=0xa010100]}]}}}}}) r4 = dup3(r1, r1, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000180)}, 0x20) r7 = syz_open_procfs(0x0, &(0x7f0000000400)='net/tcp6\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001740)={r5, 0x20, &(0x7f00000004c0)={&(0x7f0000000680)=""/128, 0x80, 0x0, &(0x7f0000000740)=""/4096, 0x1000}}, 0x10) r9 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000001780), 0x800, 0x0) r10 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000001800)=@generic={&(0x7f00000017c0)='./file0\x00', 0x0, 0x8}, 0x18) r11 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r11, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x2, @empty, 0xa098}, {0xa, 0x4e21, 0x8000009, @mcast1}, r12, 0x4040099d}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f0000001880)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x8, @empty, 0x80000000}, {0xa, 0x4e23, 0x6, @loopback, 0xfffffffd}, r12, 0x2}}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001940)={0xe, 0xc, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000000000000d428000018400000fcffffff000000000000000018120000", @ANYRES32=r6, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000007580500008000000850000003d0000009500000000000000e8b01ffdfd7193fe96c15984328f6578c82cff21c69fddccb0cc48464fd46d975353431101e437e36dc43953af8b87e757fd63e7d143f5a95233db2aac69b125dc66b0ebce1ca383b868289ecfff8b20f40028f1baee3cbe50591dd81b5c7c3e0e369ad611ce5600ae1045baed835dc1b64bac6963c4b3d76419c20359a76d6c796a02e3aa624b74e6cad02474c28f2cd1a31b81b8154aef9aa737be123c2ae3db27516ae6650619d3437f21d91fc7dded39fab17fe2718a63d0610552"], &(0x7f0000000280)='GPL\x00', 0x7f, 0x0, 0x0, 0x41000, 0xa5, '\x00', 0x0, @fallback=0x3c, r7, 0x8, &(0x7f0000000440)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000480)={0x2, 0x3, 0x3, 0x7}, 0x10, r8, 0xffffffffffffffff, 0x0, &(0x7f0000001840)=[r9, 0xffffffffffffffff, 0x1, r10], 0x0, 0x10, 0x667}, 0x94) r13 = openat$null(0xffffffffffffff9c, &(0x7f0000000a40), 0x3a90c1, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000ac0)=@bpf_lsm={0x1d, 0xb, &(0x7f00000008c0)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x9}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8001}}], &(0x7f0000000940)='GPL\x00', 0xfffffff9, 0x0, 0x0, 0x41100, 0x60, '\x00', r3, 0x1b, r4, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000a00)={0x4, 0x9, 0x3, 0x3}, 0x10, r8, 0x0, 0x0, &(0x7f0000000a80)=[r13], 0x0, 0x10, 0x3}, 0x94) r14 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r14) r15 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200), 0x88081, 0x0) ioctl$TUNSETOFFLOAD(r15, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r14, 0x4010744d, &(0x7f0000000180)) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80ffe0090f000000000000a2bc5603ca00000f7f89000000200000004a2471083ec6991778581acb6c0101ff0000000309", 0x48}], 0x1) 8m56.349028272s ago: executing program 1 (id=997): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000300)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000001c0)="ec4969ce12aee5cbcb87448d7b8d39e591f0817d13f230e3603631a855802b483c", 0x21}], 0x1}}], 0x1, 0x20000800) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002200)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) (async) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) (async) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x24) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) move_mount(r2, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x226) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f000067c000/0x4000)=nil, &(0x7f0000711000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000e3000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0xc0686611, &(0x7f0000000180)={0x68, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) 8m54.285084142s ago: executing program 1 (id=1001): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = open(&(0x7f0000000280)='.\x00', 0x40000, 0x43) getdents(r0, &(0x7f0000000140)=""/48, 0x30) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r1, &(0x7f0000002400)=[{{&(0x7f0000000140)={0xa, 0x4e21, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffd}, 0x1c, &(0x7f0000000080)=[{&(0x7f0000000040)="7f", 0x1}], 0x100001ce}}, {{&(0x7f0000000180)={0xa, 0x4e22, 0x100, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1}, 0x1c, &(0x7f00000003c0)=[{&(0x7f00000001c0)="5f03", 0x2}], 0x1}}], 0x2, 0x20040184) listen(r1, 0xfff) accept(r1, 0xfffffffffffffffd, &(0x7f0000000680)) 8m53.885014162s ago: executing program 1 (id=1004): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x9, 0x8001, 0x0, 0x9, 0x0, 0xc0, 0xcf68, 0xffffffff}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'geneve0\x00', 0x0}) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x11, 0x88a8, r3}, 0x14) r4 = accept4(r2, 0x0, 0x0, 0x800) sendto$inet6(r4, &(0x7f0000000100), 0xffffffe3, 0x4004840, 0x0, 0xfffffffffffffe1b) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000006, 0x4132, 0xffffffffffffffff, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) syz_open_dev$vim2m(&(0x7f0000000680), 0x7fd, 0x2) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r5, 0x0) pipe(&(0x7f0000002740)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x9, 0x8001, 0x0, 0x9, 0x0, 0xc0, 0xcf68, 0xffffffff}, 0x0) (async) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r2, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-avx2\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) (async) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'geneve0\x00'}) (async) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x11, 0x88a8, r3}, 0x14) (async) accept4(r2, 0x0, 0x0, 0x800) (async) sendto$inet6(r4, &(0x7f0000000100), 0xffffffe3, 0x4004840, 0x0, 0xfffffffffffffe1b) (async) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000006, 0x4132, 0xffffffffffffffff, 0x0) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) syz_open_dev$vim2m(&(0x7f0000000680), 0x7fd, 0x2) (async) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r5, 0x0) (async) pipe(&(0x7f0000002740)) (async) 8m53.319502554s ago: executing program 32 (id=1004): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x9, 0x8001, 0x0, 0x9, 0x0, 0xc0, 0xcf68, 0xffffffff}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'geneve0\x00', 0x0}) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x11, 0x88a8, r3}, 0x14) r4 = accept4(r2, 0x0, 0x0, 0x800) sendto$inet6(r4, &(0x7f0000000100), 0xffffffe3, 0x4004840, 0x0, 0xfffffffffffffe1b) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000006, 0x4132, 0xffffffffffffffff, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) syz_open_dev$vim2m(&(0x7f0000000680), 0x7fd, 0x2) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r5, 0x0) pipe(&(0x7f0000002740)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x9, 0x8001, 0x0, 0x9, 0x0, 0xc0, 0xcf68, 0xffffffff}, 0x0) (async) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r2, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-avx2\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) (async) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'geneve0\x00'}) (async) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x11, 0x88a8, r3}, 0x14) (async) accept4(r2, 0x0, 0x0, 0x800) (async) sendto$inet6(r4, &(0x7f0000000100), 0xffffffe3, 0x4004840, 0x0, 0xfffffffffffffe1b) (async) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000006, 0x4132, 0xffffffffffffffff, 0x0) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) syz_open_dev$vim2m(&(0x7f0000000680), 0x7fd, 0x2) (async) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r5, 0x0) (async) pipe(&(0x7f0000002740)) (async) 13.567318592s ago: executing program 4 (id=3117): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000001c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r2, 0xc02064b9, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="e80000003495818729a18e8faa4e693a51cd85ec0c706e02ce63a73db34fa9b5c3d6934d7191a8da46f4ef2e44e06db432e0869c6919451d11ae437ea64756b8029253e4172e4e14d164e03b8213817bffd1727952392de0b914e5d71b2d87f9903231cab6270ecd977262ea3f92498cfb62d722b7b3ce07a8f062db74334fa687459e2dbb93dcc7344507e202acbe2713d744a94aef8e13706d9fe7b8c18bfd89efcdab849ecf54714c06eef638a661bf78c64296cfd41f25ac152684e3019c2b37d5cd2acbe0854db4b3ae3c7fdd87026c744cd169900ebb3c13de0b750353221d4006fe564c75cdea4611163f7f951cb7d3b7be3bbfaedfc0c14d5dd35f07b416668661359f620c423b25619c4b60fb648e2d24b13f64f0006fe56b09cf10238096501e39e8d2c1cd1fcac3a9", @ANYRES16=r5, @ANYBLOB="01000000000000000000010000009c0008809800008044000980400000800600010002000000080002007f0000010500030000000000060001000a0000001400020000000000000000000000000000000000050003000200000008000a000100000024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c24000200eff93d58460ea431f2cb4a6894ddb2834088d7445bf5afdd0619ce173f1db71724000300b08073e8d44e91e3da922c22438244bb885c69e269c8e9d835b114293a4ddc6e1400020077673000"/226], 0xe8}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) ioctl$BTRFS_IOC_BALANCE(r0, 0x5000940c, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = syz_io_uring_setup(0x239, &(0x7f00000000c0)={0x0, 0x1ffff9, 0x10100, 0x0, 0xd3}, &(0x7f0000000080), &(0x7f00000001c0)) io_uring_register$IORING_REGISTER_FILES_UPDATE(r7, 0x6, &(0x7f0000000480)={0xfffffffe, 0x0, &(0x7f00000003c0)=[0xffffffffffffffff, 0xffffffffffffffff]}, 0x2) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0000004800010000000000000000000a00806e0800000000000000140001800d2a79075827af5aa534d6815c2e93f10c000280", @ANYRES32=0x0], 0x3c}}, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0xa0000, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r10, 0x4068aea3, &(0x7f0000000000)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r10, 0x4008ae89, &(0x7f00000002c0)=ANY=[@ANYBLOB="010000"]) socket(0x80000000000000a, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x48) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$sock_linger(r11, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) 11.977258341s ago: executing program 4 (id=3121): openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x32c180) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2}}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_encrypt_change={{0x8, 0x4}, {0xc, 0xc8, 0xfa}}}, 0x7) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f00000001c0)={&(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001580), &(0x7f0000001680), &(0x7f00000016c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0, 0x6}) r5 = socket(0x1e, 0x5, 0x6) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x25dedbff, {0x60, 0x0, 0x0, r7, {0x0, 0xc}, {0xffff, 0xffff}, {0x2, 0x7}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x5}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}]}}]}, 0x48}}, 0x40440c0) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, 0x0) sendmsg$NFT_BATCH(r4, 0x0, 0x0) syz_emit_vhci(0x0, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_REORDERTO(0xffffffffffffffff, 0x111, 0x5, 0x9c, 0x4) r8 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) 10.208928497s ago: executing program 4 (id=3123): socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x40040011, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xa) unshare(0x20000400) syz_open_dev$evdev(0x0, 0x1, 0x8c2b01) r0 = syz_io_uring_setup(0x222f, 0x0, 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000005c0)={'#! ', './file1/../file0', [{0x20, '\x00.\x11U!\xac\xb2\x80\x9f4Lg\x1d\xbek\xefL !\t\xa8\x81\x1a\x84O\xcb\x9b5\x0e^\xe8\xd72L\xba\x06\xef7m\xb6z\xa2\xfev 2\x12X\xbb\xe3-1\xac\xdc\xeaX\xb8\xdb\x88\x80;\xd2\xf7\x11\xcd\xc1\x81\x144\x96tJ&\xaa\x8e\x111HX\xc2Z\xdc\xa5\xe1\xc2p/\xc1\xa7\x82*\v\xbfk\x12S\x92\xa3\x87\xa8v\xa0\x01\xca\xab\xa1\x19\'j\x8a\xbdf \xf5@\xb1\x8aE <\xa7K\xe3\xedG\xffM\xd2e\xadfi\xba\x121\x175\x1a\xee+X*\x8a\x82\x8aNm9\x96\x11\x15\xe9\xb5;3\t\x06-\xe6\xf2\xdf%[C6,\x91\xe6\xfb\xef\xcd\xd3\x0fg\x8e;p\xa7_\x98\xcen\xb2\a\xfb7y\xec\xd1\xdb\xd3\x1e\xd1\xcc\xc7e\x82\xf6\xe0\xbb\xeftD\x7f\x89\xb7\xf8\xc1\x1f\xfbz9\xa8\xc9\x87\x0f\xb8!\xb5\x93\xf6\xe9m\xb4\x13M\xf9E\x06\x85\x1f]\xd7\n3\x0e\x1f\x1aT\x05\xc7\x81\xdfs\'UJ\x92\xc3\x9a\xfe\xa8\xa7\xa9G\xd3'}], 0xa, "0002783348b29e7bcaf3e29c2593b929f38db16e33ea96f57d49c226f35df5a073e47a165b0074fbf80de701b0728381f07c35183b8242af6ed8d42a819bf58c54c07408000c6cfa4ae3c32d"}, 0x161) write$UHID_INPUT(r2, &(0x7f00000007c0)={0x8, {"dc5d3b0169633d3eba3eabbc09167be55101d4af4b22a373236464d2dbfaa84399b77bd438a54364a7ebc5bdaab4f9decb7c044318cd59a0af8279bcab35dd7daf7a0ceb381df2c32eff45b13e2c8f40e1895355bf6f165200cb1ca41a155730ee2e9f83183f9fafe029d0401b0770618254a8b2dc87b630072b1e2de160d1afed51b74c14b71ec1b226a324482d14ad586b1a4ce80e458fe45244c01eddeddf3564af838d6d5324f8a77023d6eb7aa14397a0e1413ea1c3dfdf063a35b709e627f36fe403ee3117365be5017682f53595f28543062c740a94a794312f5cebc315044b8ea000a5d0f27812ab0ce149d11e6f6f7620c5f3e250bf67d13a1ca39dbb7b8b5a31e3d7ba7ebe5849a7a09b61fc9f2cfc54b89e9cd0105bca49483ce55e0187ce2ad692a18219d881057c838587b915337169ee054655f26a04df913a658fccbf4def6aad750ca4796b74d322c67e9d4ee6a530a22dcc35db850b424d6ec9f62495b9f9fd2b000feadd57d26dbd505798c208d91eb0aab0fd97537631b8bf81ce0e2241c4272be4ff69b390e4485d574146b76d1fdbf7fc5334906805534cdae1e47240af7761a18fc8bd0a694be47529da98bc0f98eb7db3fc4a74cbb6e486f4de90fbf2452e72c2e1dca44543ad9ad094b8bc861eef1e814662d0b350339e3a510d459c6f83aabd5fd3dcb38224056d761e7df9b482b9905f1e2135c1929be328ecdb69c007a3efd548502c83106f6df1ab1178fac499eda92ad4373155227ec2df150c919d322ecb3ea37e659285f18a3e2f79b59900ca438df3a1381380a12d3ad7678e0a8d3bdfb40651389b4ac8c66138d442d70eafdc2df8b080028006b124e4ebe0d9883ef100f1934e42794146382c1d628fd2ebe5859b6c243824903d056d800975675bb1913142adbc039a9c68c2f146a0e8903447313f5e5549905f397a9b1f21a93b80c4d04a8ea7a29a50fbc5407a9305bba420edf898ea678d6879489c39692c99bb6dacf61f5f97637b94c1031d635b5423b38b9196fafaaf87b2796eadc21466af5a10281e6a808748969d29efb444c99a4cb2111732a792dbca4376a125a68f7cdac065cc6173dc21caafba48c742d9a7df2f771ff2f5725b22c247d4e0c6106f9f5f6929b69929ab37e9a9b326ce618bb702b883b12026f1300f21f2c7440cac8c5f1210a78aa067211d2827f5dcc7578252c2ccc3f67bab9d1bb6939b21b550788ef550acfed4bf50c0b4fb3ca4d2872ee64f95d611a317d9daaf373a10d868680b2226396c95fa2b0ab4d6fce06c3b42cb97d17a7b5089061537fdeb1a53040869f7befca330358fdba86754fc2e46c2113e1484cb37534af8f0408a7ee313778dab49f08229964298f847ea66c4ec319f64b6a12da585bc59e82e0263c507b397d3efee3b4066f4d25566aa1549f6185f6375f84b65fa8945148b90430c86a5b6fdf58d5c812b98d9dc621fd9a3d9f1a577495356516d1cbcf5e8bb8923b54b247225b9c3892b18a9e137f3620c734052af9dc8f1ea36f0d4592d5ee32e35676a84dc891f97456f2ac3a4ab58a42bcdc221a4ac8bb28d428add2fcbe5b110a8afd5d23b31e827bd16167b2d88cae024afc04a722ac0b4d45c52512e6b6f102aac4be21bc89ce246539048370553665b0a4336a6db99d0d19399be6437bf21419304331b4342b2c1db580f0c9bf681fdb8e9fa3e025454197bbc82ef93ee2f385660818ec5127080675a8013766469afe3b1e36e81bf2f04c3a26eaf4517551e734d21ba3bc90e48aea0891792970c39f3f528397e9b7ae190f1760fe5960dc763ee0a17939c60bfcac0a8914be82c749e4fe85d1ac5fa733413468fb8941085e8c4d6e0b6d1e62e20da58440facd640ddbb6c1f694b3ca48757a34c5a11668368711a1d4f3a81d31ac30d71277d7ae77882b6841cfa6289e6cce84a3ad57eeb328f831888ac7d3cfcd3a472a48d903f20cec8c8ae8d0bea04ebf7413ef7693f8ed876e49bd5f89d7e1078208ff62712e330fc0341b9ccf26845578d44b1e0c66d1bebc14742baedfabb8e9a2c8f42730360c72997efe0ce786ff330c2eb6e0ff20896f813c2a515ce76f826c11a1c1588eb369231ddeb4a2f9f9591ecdecc74d20aeb50047beb3ab89a9e4e1b805a20b645c79d0bc5d0247fab8ba46a97a07630b1f1cb69b42b568af746733d2c581f057873d64fe6e659b00b4a26745f5fba1fe7406a86b007936c7cfdac53a4c5b0ea9f6604863c8e3f174eddbb09175f6e13cda9a860cf400ef9ed02b895502ac6e6de6a658249c3c6e8a653517eae2231e56e0f120547923c6549ebc1ed14c623637ce3d96af5c93a32e58e2d9659d8b5b145888b52d9a5b5cb3cdf594eb137bcef2ba068cfd2c6ccf7ab6e5b4ec55e9197bfb91c9b8729f7b50cf0b0326f7ea3e712c77674d48545ca2a86744c3c38f149d69cf811beacf7e5f49c7bfba20f1dcf3d7bc0b9c796016820a46495d244c9606a06fe2e14233eda78d69ae4523ad7b708b0c7ead44d7fd376fed60e3cc2ee25e9600adfbe87ac7c8fb8269aec9459602af0f420becda6120ce7d9626c65ae7f860639e8bf664eb4301ec18add0e436c0356c12ab6b4ca35da2b43c4a8c239fd0b59a2ce94843cdfa1667053165053633b062844dbb0d00070fde74fa3178eb5f1f5fd02e2088d8690379f39ab22c080cdcb29d700bac74fabd8a356fe99afe83a5d99aa5024e9158a299eda6c99b6701e64f1d68e7e2c0c6e88396bb535a02d0948f0a250a6e090041c96d9c9acd6134d44d516fd1010c39e572b86b05bb1326a2a4f23f11181186f9c2a01dc7b58c0129f4b851ca9b1e3dc35db7364e29ef646211796b1651511e041345abce427fa5d6e48b8fb078c8432061a4cc518a8f2a2caf709a5c1473a62112a6650afc64eec12f8f9c08cff1b6fbf7a1209fc8661f62303b7c5d49c1d0b32a9f37e81ed9ab6193816d40995ed49c10b9f5752e04d57535a3d16f06c65d32846c31ec9787ec4a965679eb804e86b45d007f38d8104550770dc6f313bc846e43a14a8c21d0628c744e3e83cb998d1b7acfe996541a8c03852dadf9326444c582b481cae844e4f3fe3d638903b38f24633b63adbad841ac6c4c1169d781a0e271e8a967b1c7e986fcb3a66168e86e3559a44fcfa92452260491da9397659af60453f4cd4be2d15439445ec2b4366a79d3283da912d9d499df1242bd174edc235848caa21d2c997aff0e95c7e5cc0803c90fab84e7be7b37909d0e2f3bc9974e3388acb6800baba183ecc8eea8c71c0d65d669e41f99ceae523b7a6b772f3b8ebba1d2127ccc3ddb7ddcb4ec73cbdc26fc87c3848e258a0b5484d3a13e40ec4e4a65dd92f09e9fe1e3e2f8b96c4e363aa3683860dee62dfcf8823ee4a3593a092e0bd9c4cedacf44a272faa164447b01f46a7795642a40c61b0034a37f0e9b792428a0ddcd144fe8263088eaac8016f8f1cd30b55ac90a8f10d785b7570dd9e639a4a068d3fe98a420b9f72e79de817f676c2a224300d749571ad43f49d1fbe838f4566bc7b5f104c384ad87189213152b644d9fcbdf98bafeee569d640ce9045779f1d90024c023a7480a358dee276fba139c14b4fdb12885240903d0e61dc161659a68f62c92b899007e0f2b65bf0a069e9e57c9b6ae50a3b30dd1003fb0eead73ae2f6010b3b356b4060579a4f29935e1f00c01d12e5f44e8e3163d81dfef7ca8560604240c7e96e4454c6971614df306c768121abb3f628e3f1d2d026f58d1087334c5bdb74d7c949b0ee66a4531ba4e9b922aee3d0f802ed034734507a5913c52966f1f8bd4577840de0253aabc23299dced2a299859c07af9fb0f9c29b6533b9d84d471390d59ab315f5ddb226f6b8dd7889295f0fb1f7bd1adafe4cc520a1e84bf2a59d5b9795aeafc8d6fd66a8228aba8653b98622617ddfeb5d6795c9bd2f35d4a0c386e862675a50e3314c3fbb17aca151c13c7fc8b1d1b72ed0a958537b5ddc9e74bddc2b9571ec3f2b7775b125338d4852a75a63941564c65bb36dfb6bea4aab1ae7a4f285c2177aa98406eb2cc10934aa92d5a9612d4455c84ad200841d289b5c2d5deab0d8e2459598ef183d3dc47f6bad0b9513710600cfa4d69fcd5763cdcc4f2c2b7cd7d4491fd52f4aec82ce846c0988f6f0123e21e900d39c61085e68c9badc350b44004f6c042d64b0d0cbf91ad0592b198f1eeea1e52200bc8e6d62848d6884b10bdde72466039da488be6b340c23148f666f2fe6e032c07dac43586df182aca9116f4600313fa8375c76337ba86bdc391dae6450218f58f047ced64befc6bb5c2a60024669630a6279fedf2fe45e7e19ce582ad96ae0d023eb9b39f5f1e666e73bb038ae38157275be5eb3e7cbc8b05adf53e817646bdc2cfce98e5d162bf7faaca787db8717ab8b27b9e35609c5fb9fe9def07f010df8b43cf5c96851eadfdeff0b7bc5826e7e15490ae9c3d14166ee81bef007070e7981235a673804ad89943ee6b51ac63364f7870e121e6ff23a0c7d179527cd58dd7a4ca37247c2bd9efc79b720bb1ee2d39862e98cb81e93cf5b48d5d02ee8ac737ab504c867a1c49e678300803c94fbe978dea918a1e71b9791ee1e4d30056e86c26a4675a8b090be2365c0b451a13ece52a89a7057fe2052e11c6666eb916d823ea66bf217c320acba3b714910734b2d27c2fa586bd7f7664b0d1422adabad2ce2afc10270057f11940fac1a51d023ce48bd04ea39b7f99381b239fd0ddeea0dce7863ec1f8f61775013b6414ecf86e686a340a3148f87a9d7d60a1f2da53436d16fc88d6a4e7c3d55e0dd004cbecc15a5558eb705d82aacb1862ddc251dd5d9cbf1d78f97900ce6e8dab0ea678cb823bd1e7bbd1e927841af08f5427878c19f4f322228f9b36287fc13e7c1293ea875ae73815e052d6c2ebc40df8f7b9d1f76e0b10e35aa160944983d8e6b790df0d9b13f3460657336d81f7d83c0350324b930ec9c7557ce12887f76372e126f504b0980fea27f31a780c05187b9b5353dafc6b101543b24332b96e15bc26b19062e52fa9f86d260ee3a3bc92a133e328407bb85357ee5c45cb87228f44888b14941b5911b050e9319fe88033f830a8490917a9c0572ebbc5492b4e1083a2e3d77215a34abef947b5b9a950e780662de18873e55899c92db3ad3d437e8407890afa6b0c04ef861b8bc85fbbe1bb67b3d9ef001409f84b8ec4f01d861cecc143a805b981ab5cf5b605057b63cb2c84ec358e510a69cd8c33a8a62fe4680d0c980145cc709157832bfaef261cb0466c237376ca2944ce9affffd4b1dc7cc9511da0b34bffb9ac216fb8cf7c6572d95627787720d1ba67c6512fcdb16f6329e9668681c404efebad559f81f05971b5efb6b4cca97ad0346753cc0a40a877242d8a808c602b03dc962cee38e646cb18abb079c70d357c30738a70f55cd3c5956a83a1bfcd6649dd765f16bfe968066345df7380bbc0c16b3b5af513d6458c791343952f33a051c5d711c1f35af1b47f3db9bbfb5c7c636b3a2b52805d606479879be0b404a28ade5649a3185e0f85a85fc15cd824671c2befdd0da509597c87d869f0bd7ad163ad93ca28fc0c4025eccaafe385ec3fc06c54ebcd7b07b6c7e0197c5b9ef886159a1585ae45248f865be760db6f5bc8f868fc6aefd04e34ecb51159e4cdcc2214b42b1ca9caec13ba3e1b2e7a3c736977b226213d265c2873195122a9b448088c8b50edd549be41c38ab176807b75e7267f86e4", 0x1000}}, 0x1006) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x1e, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea8a1d91bec8d4b5a6d80b8785d9600010000000000000094d75396dccd0ff600000000a81b00", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac0000000000000000000900", "9001001c551265406c7f306003d8a0f4bd0000000300", [0x1]}}) io_uring_enter(r0, 0x53d1, 0x0, 0x4, 0x0, 0x0) 9.785234374s ago: executing program 4 (id=3124): r0 = syz_open_dev$vbi(&(0x7f00000001c0), 0x0, 0x2) r1 = socket(0x10, 0x3, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001000ffff27bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="1503000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r2], 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000100)={&(0x7f0000000000)=""/205, 0x208000, 0x800, 0x3, 0x3}, 0x20) ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000480)=@multiplanar_fd={0x7, 0xa, 0x4, 0x100000, 0xcd, {}, {0x1, 0x1, 0x2c, 0x5, 0x8, 0xa, "aa511c0a"}, 0x3, 0x4, {0x0}, 0xffffffff}) syz_usb_connect(0x5, 0x24, &(0x7f0000000500)={{0x12, 0x1, 0x0, 0x58, 0x2b, 0x3e, 0x40, 0x103d, 0x100, 0xfeea, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xee, 0x41, 0xf6}}]}}]}}, 0x0) 8.794348125s ago: executing program 3 (id=3128): socket$netlink(0x10, 0x3, 0x0) openat2(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000440)={0x202100, 0x1c2, 0x36}, 0x18) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r0, 0x80047210, &(0x7f0000000400)) openat2$dir(0xffffffffffffff9c, &(0x7f00000016c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000040)={0x40}, 0x18) syz_open_procfs(0x0, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mincore(&(0x7f0000000000/0x3000)=nil, 0x3000, &(0x7f0000000340)=""/65) 8.387089946s ago: executing program 3 (id=3130): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000005140500000000000000000008003d0000000000080003000000000008003d0000000000080003000000000008001d"], 0x50}}, 0x0) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40002000}, 0xc, &(0x7f0000000040)={&(0x7f00000000c0)={0x44, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x10}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x97d}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x2}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040}, 0x1) 8.314041786s ago: executing program 3 (id=3131): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000002484000000060a010400000000000000000100000008000b40000000005c0004802c000180090001007866726d000000001c0002800800024000000004050003000000000008000140000000092c00018008000100636d7000200002800c00038005000100ac000000080001400000000c08000240000000000900010073797a300000000014000000110001"], 0xf8}, 0x1, 0x0, 0x0, 0x40010}, 0x0) 7.960996612s ago: executing program 3 (id=3132): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x400001, 0x4) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000140)={0x0, r1, 0x7, 0x8, 0x1, 0x2}) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e23, 0xdb, @empty}}, 0xffb, 0x203, 0xffff18b6, 0x6, 0x330, 0x80000001, 0xdb}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, &(0x7f00000012c0)={0x0, @in={{0x2, 0x4c24, @empty}}, 0x6, 0x6}, 0x90) sendmsg$inet6(r2, &(0x7f0000000540)={&(0x7f0000000000)={0xa, 0x4e24, 0x7fff, @loopback, 0x6}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000040)="f0", 0x1}], 0x1}, 0x54) syz_usb_connect(0x3, 0x24, &(0x7f00000014c0)={{0x12, 0x1, 0x0, 0xf9, 0xde, 0x50, 0x8, 0x1b3d, 0x1cd, 0x800, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x5, 0xc, 0x190, 0x6, [{{0x9, 0x4, 0x48, 0xfa, 0x0, 0xcc, 0x6a, 0xec, 0x61}}]}}]}}, 0x0) ioctl$RTC_WIE_ON(r2, 0x700f) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r3, 0x400454cd, 0x324) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x0) set_mempolicy_home_node(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x0) syz_usb_connect(0x0, 0x1b, &(0x7f0000000080)=ANY=[@ANYBLOB="125d0d07000000d1d3ec130332010902090000000010c76574cb840c6900"], 0x0) 7.877687255s ago: executing program 4 (id=3133): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r0, &(0x7f0000000340), 0x0, 0x4000041) syz_usbip_server_init(0x4) syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) socket$inet_udp(0x2, 0x2, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4004550c, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x40e802, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001780)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) r5 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r5, &(0x7f00000002c0)={'#! ', '', [{0x20, '\xd9m\xf4\f00\xf4\xfa\t\tx\x8a\fx\x92\xac?!h\xef\xda/\xb1\xddArd\f\xccyJn\x04i\xbai\xe9\xb0\x91\x84,\x1dkfL\xe0\x05\x10\xc5O\xd4$\xc6\xa5\x16\xc9a\x8d\xedq\xe4\xca\xa5\x00\xa8\xf3J\x9a\xaa\xd2\xf9\x12\x1buw\xa9\xd0\xe2\xe7\x0f\xd4YN\xe4\xf3\xe0\xe7\xb3\xa3\xf2\xd1O\x15N\xdau\\\xc5\xad\x87b\x9f\xb3\xb8\xbb8\x95rfp\xb4\xd4\xae\x97|\x1b\xa3\xcb\xce\xa6~3>\x97\x1e\xdd\x05\x88\xcbNe\xb2H\xf3I\x1d\x1a\x11u\xc0\xdcA,\x16<\xa6\xb5\xea\x13tUA0h\xf9/S \xb4\xb5\xe98T\xac/\xac\xe4\xcb\n\x18\xf6\xaa\xcd\x8e\xc8>E\xb8\x11\x14\x87\xaa\xe5v\x95\x81\xe4\t\xd9\xc5\x9cQ\xe1\x02\"\xeeC\xd8\x95<\x05l\x8c\xb0\x8e_\x1b\xf2\xe1\x17\xe7o\r6DM/w\xe9I\xce\xb9\xf7\xdc\xc4\x11\xbaG\xcb\xa7\xbcj[~\x06\x87|8r|f\xcdIY\xa5]\xcc\x80AV\xe6\x9b\xa8\x90I\xc4\xc7'}]}, 0x106) close(r5) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x4e24, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x2}, 0x1c) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="100000001e1c010a0000009004006010a649fce8514b04f4820a7b76000000a3a2d22109625b907a2f92150d4ac73e9e55d124b3c7ef71841dc278046d2faf2879f2e7b0bc4bd524580e2329f59dab0c4c6be6bf3f97400c4dee84659c36d5f9e04544d380738decf8b454e5d5eccf88874125b379429e1bd61fe1e540d5e2e2f4294d4450a8c59894fb7fdfdfa8b8a70000000081f619dc9a7944c6269ddfd3212bfab7399025b19f71d0b2033283775814300e444ab228bfb6a0adb5e16c93a77c078e17e9f67f3b0780af52a6aa43873574b1779468bc8abcd8c2c7c32fc593e8645246e397f9bbb14a58076cc468a814061fbe67a133"], 0x1c}, 0x1, 0x0, 0x0, 0x800d1}, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x103241, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) 5.727831271s ago: executing program 2 (id=3134): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, &(0x7f0000000040)={0x2b}, 0x8) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)={0x34, r2, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008802}, 0x30) connect$pppl2tp(r0, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x3, {0xa, 0x4e21, 0x14000, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x7f}}}, 0x32) 5.593130767s ago: executing program 5 (id=3135): r0 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x300, 0x0, &(0x7f00000004c0)={0x0, 0x3, 0x17, 0x2}, 0x8, 0xbb, 0x8, 0x0, 0x0, 0x0, 0x0}) 5.469423469s ago: executing program 4 (id=3136): r0 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000005c0)={'#! ', './file1/../file0', [{0x20, '\x00.\x11U!\xac\xb2\x80\x9f4Lg\x1d\xbek\xefL !\t\xa8\x81\x1a\x84O\xcb\x9b5\x0e^\xe8\xd72L\xba\x06\xef7m\xb6z\xa2\xfev 2\x12X\xbb\xe3-1\xac\xdc\xeaX\xb8\xdb\x88\x80;\xd2\xf7\x11\xcd\xc1\x81\x144\x96tJ&\xaa\x8e\x111HX\xc2Z\xdc\xa5\xe1\xc2p/\xc1\xa7\x82*\v\xbfk\x12S\x92\xa3\x87\xa8v\xa0\x01\xca\xab\xa1\x19\'j\x8a\xbdf \xf5@\xb1\x8aE <\xa7K\xe3\xedG\xffM\xd2e\xadfi\xba\x121\x175\x1a\xee+X*\x8a\x82\x8aNm9\x96\x11\x15\xe9\xb5;3\t\x06-\xe6\xf2\xdf%[C6,\x91\xe6\xfb\xef\xcd\xd3\x0fg\x8e;p\xa7_\x98\xcen\xb2\a\xfb7y\xec\xd1\xdb\xd3\x1e\xd1\xcc\xc7e\x82\xf6\xe0\xbb\xeftD\x7f\x89\xb7\xf8\xc1\x1f\xfbz9\xa8\xc9\x87\x0f\xb8!\xb5\x93\xf6\xe9m\xb4\x13M\xf9E\x06\x85\x1f]\xd7\n3\x0e\x1f\x1aT\x05\xc7\x81\xdfs\'UJ\x92\xc3\x9a\xfe\xa8\xa7\xa9G\xd3'}], 0xa, "0002783348b29e7bcaf3e29c2593b929f38db16e33ea96f57d49c226f35df5a073e47a165b0074fbf80de701b0728381f07c35183b8242af6ed8d42a819bf58c54c07408000c6cfa"}, 0x15d) write$UHID_INPUT(r1, &(0x7f00000007c0)={0x8, {"dc5d3b0169633d3eba3eabbc09167be55101d4af4b22a373236464d2dbfaa84399b77bd438a54364a7ebc5bdaab4f9decb7c044318cd59a0af8279bcab35dd7daf7a0ceb381df2c32eff45b13e2c8f40e1895355bf6f165200cb1ca41a155730ee2e9f83183f9fafe029d0401b0770618254a8b2dc87b630072b1e2de160d1afed51b74c14b71ec1b226a324482d14ad586b1a4ce80e458fe45244c01eddeddf3564af838d6d5324f8a77023d6eb7aa14397a0e1413ea1c3dfdf063a35b709e627f36fe403ee3117365be5017682f53595f28543062c740a94a794312f5cebc315044b8ea000a5d0f27812ab0ce149d11e6f6f7620c5f3e250bf67d13a1ca39dbb7b8b5a31e3d7ba7ebe5849a7a09b61fc9f2cfc54b89e9cd0105bca49483ce55e0187ce2ad692a18219d881057c838587b915337169ee054655f26a04df913a658fccbf4def6aad750ca4796b74d322c67e9d4ee6a530a22dcc35db850b424d6ec9f62495b9f9fd2b000feadd57d26dbd505798c208d91eb0aab0fd97537631b8bf81ce0e2241c4272be4ff69b390e4485d574146b76d1fdbf7fc5334906805534cdae1e47240af7761a18fc8bd0a694be47529da98bc0f98eb7db3fc4a74cbb6e486f4de90fbf2452e72c2e1dca44543ad9ad094b8bc861eef1e814662d0b350339e3a510d459c6f83aabd5fd3dcb38224056d761e7df9b482b9905f1e2135c1929be328ecdb69c007a3efd548502c83106f6df1ab1178fac499eda92ad4373155227ec2df150c919d322ecb3ea37e659285f18a3e2f79b59900ca438df3a1381380a12d3ad7678e0a8d3bdfb40651389b4ac8c66138d442d70eafdc2df8b080028006b124e4ebe0d9883ef100f1934e42794146382c1d628fd2ebe5859b6c243824903d056d800975675bb1913142adbc039a9c68c2f146a0e8903447313f5e5549905f397a9b1f21a93b80c4d04a8ea7a29a50fbc5407a9305bba420edf898ea678d6879489c39692c99bb6dacf61f5f97637b94c1031d635b5423b38b9196fafaaf87b2796eadc21466af5a10281e6a808748969d29efb444c99a4cb2111732a792dbca4376a125a68f7cdac065cc6173dc21caafba48c742d9a7df2f771ff2f5725b22c247d4e0c6106f9f5f6929b69929ab37e9a9b326ce618bb702b883b12026f1300f21f2c7440cac8c5f1210a78aa067211d2827f5dcc7578252c2ccc3f67bab9d1bb6939b21b550788ef550acfed4bf50c0b4fb3ca4d2872ee64f95d611a317d9daaf373a10d868680b2226396c95fa2b0ab4d6fce06c3b42cb97d17a7b5089061537fdeb1a53040869f7befca330358fdba86754fc2e46c2113e1484cb37534af8f0408a7ee313778dab49f08229964298f847ea66c4ec319f64b6a12da585bc59e82e0263c507b397d3efee3b4066f4d25566aa1549f6185f6375f84b65fa8945148b90430c86a5b6fdf58d5c812b98d9dc621fd9a3d9f1a577495356516d1cbcf5e8bb8923b54b247225b9c3892b18a9e137f3620c734052af9dc8f1ea36f0d4592d5ee32e35676a84dc891f97456f2ac3a4ab58a42bcdc221a4ac8bb28d428add2fcbe5b110a8afd5d23b31e827bd16167b2d88cae024afc04a722ac0b4d45c52512e6b6f102aac4be21bc89ce246539048370553665b0a4336a6db99d0d19399be6437bf21419304331b4342b2c1db580f0c9bf681fdb8e9fa3e025454197bbc82ef93ee2f385660818ec5127080675a8013766469afe3b1e36e81bf2f04c3a26eaf4517551e734d21ba3bc90e48aea0891792970c39f3f528397e9b7ae190f1760fe5960dc763ee0a17939c60bfcac0a8914be82c749e4fe85d1ac5fa733413468fb8941085e8c4d6e0b6d1e62e20da58440facd640ddbb6c1f694b3ca48757a34c5a11668368711a1d4f3a81d31ac30d71277d7ae77882b6841cfa6289e6cce84a3ad57eeb328f831888ac7d3cfcd3a472a48d903f20cec8c8ae8d0bea04ebf7413ef7693f8ed876e49bd5f89d7e1078208ff62712e330fc0341b9ccf26845578d44b1e0c66d1bebc14742baedfabb8e9a2c8f42730360c72997efe0ce786ff330c2eb6e0ff20896f813c2a515ce76f826c11a1c1588eb369231ddeb4a2f9f9591ecdecc74d20aeb50047beb3ab89a9e4e1b805a20b645c79d0bc5d0247fab8ba46a97a07630b1f1cb69b42b568af746733d2c581f057873d64fe6e659b00b4a26745f5fba1fe7406a86b007936c7cfdac53a4c5b0ea9f6604863c8e3f174eddbb09175f6e13cda9a860cf400ef9ed02b895502ac6e6de6a658249c3c6e8a653517eae2231e56e0f120547923c6549ebc1ed14c623637ce3d96af5c93a32e58e2d9659d8b5b145888b52d9a5b5cb3cdf594eb137bcef2ba068cfd2c6ccf7ab6e5b4ec55e9197bfb91c9b8729f7b50cf0b0326f7ea3e712c77674d48545ca2a86744c3c38f149d69cf811beacf7e5f49c7bfba20f1dcf3d7bc0b9c796016820a46495d244c9606a06fe2e14233eda78d69ae4523ad7b708b0c7ead44d7fd376fed60e3cc2ee25e9600adfbe87ac7c8fb8269aec9459602af0f420becda6120ce7d9626c65ae7f860639e8bf664eb4301ec18add0e436c0356c12ab6b4ca35da2b43c4a8c239fd0b59a2ce94843cdfa1667053165053633b062844dbb0d00070fde74fa3178eb5f1f5fd02e2088d8690379f39ab22c080cdcb29d700bac74fabd8a356fe99afe83a5d99aa5024e9158a299eda6c99b6701e64f1d68e7e2c0c6e88396bb535a02d0948f0a250a6e090041c96d9c9acd6134d44d516fd1010c39e572b86b05bb1326a2a4f23f11181186f9c2a01dc7b58c0129f4b851ca9b1e3dc35db7364e29ef646211796b1651511e041345abce427fa5d6e48b8fb078c8432061a4cc518a8f2a2caf709a5c1473a62112a6650afc64eec12f8f9c08cff1b6fbf7a1209fc8661f62303b7c5d49c1d0b32a9f37e81ed9ab6193816d40995ed49c10b9f5752e04d57535a3d16f06c65d32846c31ec9787ec4a965679eb804e86b45d007f38d8104550770dc6f313bc846e43a14a8c21d0628c744e3e83cb998d1b7acfe996541a8c03852dadf9326444c582b481cae844e4f3fe3d638903b38f24633b63adbad841ac6c4c1169d781a0e271e8a967b1c7e986fcb3a66168e86e3559a44fcfa92452260491da9397659af60453f4cd4be2d15439445ec2b4366a79d3283da912d9d499df1242bd174edc235848caa21d2c997aff0e95c7e5cc0803c90fab84e7be7b37909d0e2f3bc9974e3388acb6800baba183ecc8eea8c71c0d65d669e41f99ceae523b7a6b772f3b8ebba1d2127ccc3ddb7ddcb4ec73cbdc26fc87c3848e258a0b5484d3a13e40ec4e4a65dd92f09e9fe1e3e2f8b96c4e363aa3683860dee62dfcf8823ee4a3593a092e0bd9c4cedacf44a272faa164447b01f46a7795642a40c61b0034a37f0e9b792428a0ddcd144fe8263088eaac8016f8f1cd30b55ac90a8f10d785b7570dd9e639a4a068d3fe98a420b9f72e79de817f676c2a224300d749571ad43f49d1fbe838f4566bc7b5f104c384ad87189213152b644d9fcbdf98bafeee569d640ce9045779f1d90024c023a7480a358dee276fba139c14b4fdb12885240903d0e61dc161659a68f62c92b899007e0f2b65bf0a069e9e57c9b6ae50a3b30dd1003fb0eead73ae2f6010b3b356b4060579a4f29935e1f00c01d12e5f44e8e3163d81dfef7ca8560604240c7e96e4454c6971614df306c768121abb3f628e3f1d2d026f58d1087334c5bdb74d7c949b0ee66a4531ba4e9b922aee3d0f802ed034734507a5913c52966f1f8bd4577840de0253aabc23299dced2a299859c07af9fb0f9c29b6533b9d84d471390d59ab315f5ddb226f6b8dd7889295f0fb1f7bd1adafe4cc520a1e84bf2a59d5b9795aeafc8d6fd66a8228aba8653b98622617ddfeb5d6795c9bd2f35d4a0c386e862675a50e3314c3fbb17aca151c13c7fc8b1d1b72ed0a958537b5ddc9e74bddc2b9571ec3f2b7775b125338d4852a75a63941564c65bb36dfb6bea4aab1ae7a4f285c2177aa98406eb2cc10934aa92d5a9612d4455c84ad200841d289b5c2d5deab0d8e2459598ef183d3dc47f6bad0b9513710600cfa4d69fcd5763cdcc4f2c2b7cd7d4491fd52f4aec82ce846c0988f6f0123e21e900d39c61085e68c9badc350b44004f6c042d64b0d0cbf91ad0592b198f1eeea1e52200bc8e6d62848d6884b10bdde72466039da488be6b340c23148f666f2fe6e032c07dac43586df182aca9116f4600313fa8375c76337ba86bdc391dae6450218f58f047ced64befc6bb5c2a60024669630a6279fedf2fe45e7e19ce582ad96ae0d023eb9b39f5f1e666e73bb038ae38157275be5eb3e7cbc8b05adf53e817646bdc2cfce98e5d162bf7faaca787db8717ab8b27b9e35609c5fb9fe9def07f010df8b43cf5c96851eadfdeff0b7bc5826e7e15490ae9c3d14166ee81bef007070e7981235a673804ad89943ee6b51ac63364f7870e121e6ff23a0c7d179527cd58dd7a4ca37247c2bd9efc79b720bb1ee2d39862e98cb81e93cf5b48d5d02ee8ac737ab504c867a1c49e678300803c94fbe978dea918a1e71b9791ee1e4d30056e86c26a4675a8b090be2365c0b451a13ece52a89a7057fe2052e11c6666eb916d823ea66bf217c320acba3b714910734b2d27c2fa586bd7f7664b0d1422adabad2ce2afc10270057f11940fac1a51d023ce48bd04ea39b7f99381b239fd0ddeea0dce7863ec1f8f61775013b6414ecf86e686a340a3148f87a9d7d60a1f2da53436d16fc88d6a4e7c3d55e0dd004cbecc15a5558eb705d82aacb1862ddc251dd5d9cbf1d78f97900ce6e8dab0ea678cb823bd1e7bbd1e927841af08f5427878c19f4f322228f9b36287fc13e7c1293ea875ae73815e052d6c2ebc40df8f7b9d1f76e0b10e35aa160944983d8e6b790df0d9b13f3460657336d81f7d83c0350324b930ec9c7557ce12887f76372e126f504b0980fea27f31a780c05187b9b5353dafc6b101543b24332b96e15bc26b19062e52fa9f86d260ee3a3bc92a133e328407bb85357ee5c45cb87228f44888b14941b5911b050e9319fe88033f830a8490917a9c0572ebbc5492b4e1083a2e3d77215a34abef947b5b9a950e780662de18873e55899c92db3ad3d437e8407890afa6b0c04ef861b8bc85fbbe1bb67b3d9ef001409f84b8ec4f01d861cecc143a805b981ab5cf5b605057b63cb2c84ec358e510a69cd8c33a8a62fe4680d0c980145cc709157832bfaef261cb0466c237376ca2944ce9affffd4b1dc7cc9511da0b34bffb9ac216fb8cf7c6572d95627787720d1ba67c6512fcdb16f6329e9668681c404efebad559f81f05971b5efb6b4cca97ad0346753cc0a40a877242d8a808c602b03dc962cee38e646cb18abb079c70d357c30738a70f55cd3c5956a83a1bfcd6649dd765f16bfe968066345df7380bbc0c16b3b5af513d6458c791343952f33a051c5d711c1f35af1b47f3db9bbfb5c7c636b3a2b52805d606479879be0b404a28ade5649a3185e0f85a85fc15cd824671c2befdd0da509597c87d869f0bd7ad163ad93ca28fc0c4025eccaafe385ec3fc06c54ebcd7b07b6c7e0197c5b9ef886159a1585ae45248f865be760db6f5bc8f868fc6aefd04e34ecb51159e4cdcc2214b42b1ca9caec13ba3e1b2e7a3c736977b226213d265c2873195122a9b448088c8b50edd549be41c38ab176807b75e7267f86e4", 0x1000}}, 0x1006) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x1e, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea8a1d91bec8d4b5a6d80b8785d9600010000000000000094d75396dccd0ff600000000a81b00", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac0000000000002200", "9001001c551265406c7f306003d8a0f4bd0000000300", [0x1]}}) 5.394779831s ago: executing program 2 (id=3137): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e) r2 = syz_io_uring_setup(0x111, &(0x7f0000000140)={0x0, 0x0, 0x800, 0x3, 0x1}, &(0x7f0000000340)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x80}) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000001c0)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}]}}, 0xfe, 0x0, 0x0) read$FUSE(r5, &(0x7f0000004940)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000002200)={0x50, 0x0, r6, {0x7, 0x8, 0x2000800, 0x238d117e660ceb5b, 0x401, 0x6, 0x7f, 0x2bf, 0x0, 0x0, 0x100, 0x27}}, 0x50) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x34, r7, 0x1, 0x0, 0x0, {{}, {}, {0x18, 0x17, {0x16, 0x0, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}}, 0x0) 5.289195783s ago: executing program 5 (id=3138): r0 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f00000004c0)={0x0, 0x3, 0x17, 0x2}, 0x8, 0xbb, 0x8, 0x0, 0x0, 0x0, 0x0}) (fail_nth: 5) 4.612331943s ago: executing program 3 (id=3140): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x8, 0x0, 0x3}, 0x0) r2 = socket(0x1d, 0x2, 0x6) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) getsockopt$SO_COOKIE(r2, 0x1, 0x39, &(0x7f0000000140), &(0x7f0000000300)=0x8) sendmmsg$sock(r2, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)}], 0x1}}], 0x1, 0x0) sendmsg$can_j1939(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20048000}, 0x810) socket(0x400000000010, 0x3, 0x0) r3 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) r4 = fsopen(&(0x7f0000000280)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x1, 0x0) unlinkat(r5, &(0x7f00000000c0)='./bus\x00', 0x200) poll(&(0x7f0000000200), 0x51, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@private0, 0x8000000, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000000)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x2, 0x9}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@mcast1, 0x80ffffd, 0x0, 0x1, 0xa, 0x7f, 0x7}, 0x20) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000200)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0xf0f041, 0x0, '\x00', @value=0x100}}) r6 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x3c1, 0x3, 0x380, 0x0, 0x12, 0x60a, 0x0, 0x202, 0x2b0, 0x2e8, 0x2e8, 0x2b0, 0x2c0, 0x4, 0x0, {[{{@ipv6={@private0, @ipv4={'\x00', '\xff\xff', @multicast2}, [], [], 'veth1_to_bond\x00', 'geneve1\x00'}, 0x0, 0x190, 0x1c0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "000000000000000617ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e6726401fe4b124e0f7323a587d2a1fcf07000000eca0a7b66c60c527bac2b5", 0x2, 0x3}}, @common=@inet=@socket2={{0x28}, 0x2}]}, @common=@unspec=@CONNMARK={0x30}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e0) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b7020000b96871dfbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a9a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c048d46362ea0d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337dbcf3456ff6cd0d6b98a258e3509a7d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f009db49c6b8b19613e4d792cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19, 0x0, 0xffffffffffffffff, 0x54}, 0x42) 4.572796856s ago: executing program 5 (id=3141): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000004084000000060a010400000000000000000100000008000b40000000005c0004802c000180090001007866726d000000001c0002800800024000000004050003000000000008000140000000092c00018008000100636d7000200002800c00038005000100ac000000080001400000000c08000240000000000900010073797a300000000014000000110001"], 0xf8}, 0x1, 0x0, 0x0, 0x40010}, 0x0) 4.363331133s ago: executing program 2 (id=3142): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) syz_clone(0x4400, &(0x7f0000000200)="ecb4127a36fa", 0x6, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)="d0376b0a4eda674f1d1f8c1e2afabcbb591345287ac72ae435357f1ee9d89bf4c2260cd2c8a8d4af7904d6c3f12332caeb975a6ca36201af05cc17285592ddb573eaf5507a300c881b7b3e339cdc3840d2cec9024c522e8885fdff0dba9ab69aaa91e3264da43dc36b66756b163ee4daf36c90758f") sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffe8f, &(0x7f0000000180)={&(0x7f0000000040)=@newlinkprop={0x50, 0x6c, 0x20, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0x20000, 0xa060}, [@IFLA_TARGET_NETNSID={0x8, 0x2e, 0x2}, @IFLA_LINKMODE={0x5}, @IFLA_TXQLEN={0x8, 0xd, 0x8000}, @IFLA_BROADCAST={0xa, 0x2, @multicast}, @IFLA_ADDRESS={0xa}]}, 0x50}, 0x1, 0x0, 0x0, 0x1}, 0x8010002) socket$vsock_stream(0x28, 0x1, 0x0) (async) socket$vsock_stream(0x28, 0x1, 0x0) sendmsg$NFT_MSG_GETGEN(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x10, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x5}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x200000c4}, 0x40010) 4.362694634s ago: executing program 0 (id=3143): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1, 0xb, &(0x7f0000001580)=ANY=[@ANYBLOB="18000000010000000000000008000000180500002020702500000000002020207b1af8ff00000000bfa100000000010207010000f8ffffffb702000008000020b703000001000000850000006900000095"], &(0x7f0000000000)='syzkaller\x00', 0x6, 0xff5, &(0x7f00000003c0)=""/4085}, 0x94) 4.188803272s ago: executing program 5 (id=3144): socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x70bd27, 0x25d7dbfe, {0xa, 0x0, 0x10, 0x4, 0x7, 0x0, 0x0, 0x2, 0x8}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x4, 0xd3b8}, @FRA_SRC={0x14, 0x2, @remote}, @FIB_RULE_POLICY=@FRA_IIFNAME={0x14, 0x3, 'nr0\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8081}, 0x20040000) socket$netlink(0x10, 0x3, 0xf) (async) r2 = socket$netlink(0x10, 0x3, 0xf) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x30, 0x18, 0x209, 0x0, 0x0, {0x2}, [@typed={0x8, 0x800, 0x0, 0x0, @u32}, @typed={0x14, 0x8d, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @multicast2}}]}, 0x30}}, 0x0) ioctl$NBD_SET_FLAGS(r0, 0xab0a, 0x4) syz_open_dev$tty1(0xc, 0x4, 0x1) (async) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1b1c, 0x1b25, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x3, 0x4}}}}}]}}]}}, 0x0) (async) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1b1c, 0x1b25, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x1}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x3, 0x4}}}}}]}}]}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0xa, 0x922000000003, 0x11) (async) socket$kcm(0xa, 0x922000000003, 0x11) eventfd2(0x8, 0x0) socket$kcm(0x10, 0x400000002, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0xe}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000180), 0xfea7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) (async) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="00008000", @ANYRES16, @ANYBLOB="2d01620000000900509072fb60cb080003"], 0x2c}}, 0x4000) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r7, @ANYBLOB="ff830500000700ffffff", @ANYRES8=r3], 0x4}}, 0x0) sendfile(r6, r4, 0x0, 0x100000082) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) 4.169405798s ago: executing program 0 (id=3145): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="033f0000000000001c0012800b0001006970766c616e00000c000280060001000200000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r2], 0x4c}}, 0x0) 3.648713838s ago: executing program 0 (id=3146): pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cecb94b46fe0000000a00020025", 0x45) write$cgroup_int(r0, &(0x7f00000001c0)=0x3, 0x12) (async) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r1, 0x84, 0x7e, &(0x7f0000000280)="1a00000002000000", 0x8) (async) close(r1) (async, rerun: 64) r2 = socket$inet_udp(0x2, 0x2, 0x0) (rerun: 64) close(r2) r3 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0x208300) r4 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0, &(0x7f0000000300)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) 3.168802139s ago: executing program 2 (id=3147): syz_io_uring_setup(0x31c7, &(0x7f0000000140)={0x0, 0x0, 0x2, 0x0, 0xfffffffc}, &(0x7f00000001c0), &(0x7f00000005c0)) (async) r0 = syz_io_uring_setup(0x31c7, &(0x7f0000000140)={0x0, 0x0, 0x2, 0x0, 0xfffffffc}, &(0x7f00000001c0), &(0x7f00000005c0)) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @multicast1}, 0x10) (async) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @multicast1}, 0x10) sendmmsg$inet(r2, &(0x7f0000000440)=[{{&(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, 0x0}}], 0x1, 0x28000000) (async) sendmmsg$inet(r2, &(0x7f0000000440)=[{{&(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x3f}}, 0x10, 0x0}}], 0x1, 0x28000000) close(0x3) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) (async) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UFFDIO_WRITEPROTECT(r3, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) mbind(&(0x7f00005b4000/0x4000)=nil, 0x4000, 0x1, 0x0, 0x100000000000041, 0x2) (async) mbind(&(0x7f00005b4000/0x4000)=nil, 0x4000, 0x1, 0x0, 0x100000000000041, 0x2) syz_usb_control_io(r1, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket$netlink(0x10, 0x3, 0x0) writev(r4, &(0x7f0000000100)=[{&(0x7f0000000140)="290000001600190f00f43fff0800da060200000000e80003dd08000401000000000000000005000000", 0x29}], 0x1) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001080)=ANY=[@ANYBLOB="1b00"/20, @ANYRES32, @ANYBLOB="0200"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0200000000000000a3cd78"], 0x50) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="240000001800090000000000000000001c140000fe000001000000000800010000000101"], 0x24}}, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)}, {&(0x7f0000000000)="ac1fb4bb3a64e95c4972bdac0ece65870e58f520ec14a241e41410a4ad0fa6f1c34e8049cb050ad736a259fbd70e40acd1b1fadbddd6bef6", 0x38}, {&(0x7f0000000040)="499fb1960cbb33eb8d48f4b9ebee86baeb1913e6471154da51eeb75276", 0x1d}], 0x3, 0xffffff00, 0x6) 3.168500001s ago: executing program 0 (id=3148): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sm3\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x800) recvmmsg$unix(r3, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500, 0xf0ff}}], 0x600, 0x0, 0x0) 2.84085003s ago: executing program 3 (id=3149): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f0000000080)=0x1, 0x4) socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000000)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @multicast1}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x86dd}, {0x0, 0x0, 0x0, 0x0, 0x11}}}}}}, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0xf, 0x9}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000140)={0xa, 0x4e21, 0xfffffff8, @ipv4={'\x00', '\xff\xff', @local}, 0x7}, 0x1c) setsockopt$inet6_buf(r3, 0x29, 0x6, 0x0, 0x0) syz_open_dev$sg(0x0, 0x0, 0x2) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r4 = fsopen(&(0x7f0000000080)='binder\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x9, 0x2) process_vm_readv(0x0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640), 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) bind$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast1}, 0x10) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000790000000000000000e50000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x3000000}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={r5, 0xffffffffffffffff, 0x13, 0x0, @val=@netkit={@void, @value=r5}}, 0x1c) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000080)=""/43) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)="1f", 0x1}], 0x1}, 0x8c0) socket$netlink(0x10, 0x3, 0x4) 2.307650085s ago: executing program 5 (id=3150): r0 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f00000004c0)={0x0, 0x3, 0x17, 0x2}, 0x8, 0xbb, 0x8, 0x0, 0x0, 0x0, 0x0}) (fail_nth: 6) 1.357698428s ago: executing program 5 (id=3151): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="1201000000000010ac05470200000000000109022400010000500009040002010300010009210000000122f80409058103"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000240)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000001540), 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000f80)={0x84, &(0x7f0000000b00)={0x0, 0x0, 0x1, '6'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCGLED(r1, 0x5452, &(0x7f0000000240)=""/77) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x78, 0x822b01) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000240)={0x18, 0x5e, 0x1, 0x0, 0x25dfdbfd, "", [@typed={0x8, 0x0, 0x0, 0x0, @u32=0x1}]}, 0x18}], 0x1}, 0x0) write$char_usb(r2, &(0x7f0000000040)="e2", 0x1068) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x62081, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="1201000000000010ac05470200000000000109022400010000500009040002010300010009210000000122f80409058103"], 0x0) (async) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000240)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_open_dev$evdev(&(0x7f0000001540), 0x0, 0x0) (async) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000f80)={0x84, &(0x7f0000000b00)={0x0, 0x0, 0x1, '6'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$EVIOCGLED(r1, 0x5452, &(0x7f0000000240)=""/77) (async) syz_open_dev$evdev(&(0x7f00000000c0), 0x78, 0x822b01) (async) socket$netlink(0x10, 0x3, 0x0) (async) sendmsg$netlink(r3, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000240)={0x18, 0x5e, 0x1, 0x0, 0x25dfdbfd, "", [@typed={0x8, 0x0, 0x0, 0x0, @u32=0x1}]}, 0x18}], 0x1}, 0x0) (async) write$char_usb(r2, &(0x7f0000000040)="e2", 0x1068) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x62081, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) (async) 427.756725ms ago: executing program 0 (id=3152): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x803, 0x0) socket$alg(0x26, 0x5, 0x0) (async) sendmsg$NL80211_CMD_GET_WOWLAN(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x28}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) (async) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x34, 0x10, 0x439, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r2, 0x10681, 0x200}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}]}, 0x34}}, 0x20044002) r3 = socket(0x1, 0x803, 0x0) r4 = socket(0x10, 0x803, 0x0) (async) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x682}]}, 0x34}, 0x1, 0x0, 0x0, 0x844}, 0x0) (async) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff}) (async) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000340)={&(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0], 0x6, 0x0, 0xb0b0b0b0}) (async) r8 = socket$can_bcm(0x1d, 0x2, 0x2) (async) r9 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x8042, 0x0) fcntl$setlease(r9, 0x400, 0x1) (async) renameat2(0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file3\x00', 0x4) (async) execve(&(0x7f0000000540)='./file3/file0\x00', &(0x7f00000006c0)={[&(0x7f0000000580)='.-:-&\x00', &(0x7f0000000600)='bridge\x00', &(0x7f0000000640)='$\x00', &(0x7f0000000680)='{\x00']}, &(0x7f0000000840)={[&(0x7f0000000700)='\xff\xff', &(0x7f0000000740)='\xff\xff', &(0x7f0000000780)='\xff\xff', &(0x7f0000000800)='\xff\xff']}) (async) connect$can_bcm(r8, &(0x7f0000000040), 0x10) (async) sendmsg$can_bcm(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="050000001b0800"/16, @ANYRES64=0x0, @ANYRES64=r8], 0x80}}, 0x0) (async) sendmsg$can_bcm(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="050000000208"], 0x80}}, 0x0) (async, rerun: 32) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000004c0)={&(0x7f0000000380)=[0x0], &(0x7f0000000400)=[0x0, 0x0], &(0x7f0000000440)=[0x0, 0x0, 0x0], &(0x7f0000000480)=[0x0, 0x0], 0x1, 0x2, 0x3, 0x2}) (rerun: 32) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r6, 0xc01064ab, &(0x7f0000000500)={0x3, r7, r10}) 292.994796ms ago: executing program 2 (id=3153): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000fff584000000060a010400000000000000000100000008000b40000000005c0004802c000180090001007866726d000000001c0002800800024000000004050003000000000008000140000000092c00018008000100636d7000200002800c00038005000100ac000000080001400000000c08000240000000000900010073797a300000000014000000110001"], 0xf8}, 0x1, 0x0, 0x0, 0x40010}, 0x0) 68.591711ms ago: executing program 0 (id=3154): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r0, &(0x7f0000000600)=ANY=[@ANYBLOB="7f454c4600000000000000000000000003003e0000000000000000000000000040000000000000000000000000000000000000000000380002"], 0x78) close(r0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r3 = socket$inet(0x2b, 0x801, 0x0) connect$inet(r3, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f00000000c0)=0x9, 0x4) r6 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r6, 0x6, 0x23, 0x0, &(0x7f0000000080)) socket$packet(0x11, 0x1, 0x300) socket(0x1000000010, 0x80002, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'gretap0\x00'}) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0xb2}, 0x9c) bind$inet6(r7, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r7, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r7, 0x2) socket$inet6_udp(0xa, 0x2, 0x0) unshare(0x42000000) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="b40000000000000069105d000000000004000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x2, 0x3f7, &(0x7f000000cf3d)=""/195}, 0x48) 0s ago: executing program 2 (id=3155): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="03410000000000001c0012800b0001006970766c616e00000c000280060001000200000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r2], 0x4c}}, 0x0) kernel console output (not intermixed with test programs): truncated [ 834.503184][T16313] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2760'. [ 834.513526][T16313] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 834.571298][T16308] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 834.597259][T15600] usb 6-1: Using ep0 maxpacket: 16 [ 834.605317][T15600] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 834.616486][T15600] usb 6-1: config 0 has no interfaces? [ 834.631810][T15600] usb 6-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 834.642183][T15600] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 834.655136][T15600] usb 6-1: Product: syz [ 834.678578][T15600] usb 6-1: Manufacturer: syz [ 834.690808][T15600] usb 6-1: SerialNumber: syz [ 834.740203][T15600] usb 6-1: config 0 descriptor?? [ 835.140506][T11413] usbhid 3-1:0.0: can't add hid device: -71 [ 835.149776][T11413] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 835.171393][T11413] usb 3-1: USB disconnect, device number 2 [ 835.684183][ T30] kauditd_printk_skb: 28 callbacks suppressed [ 835.684201][ T30] audit: type=1326 audit(1760575106.251:12185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16322 comm="syz.0.2770" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f850d98eec9 code=0x10000 [ 836.177062][T15600] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 836.347071][T15600] usb 3-1: Using ep0 maxpacket: 8 [ 836.358938][T15600] usb 3-1: unable to get BOS descriptor or descriptor too short [ 836.377359][T15600] usb 3-1: config 4 has an invalid interface number: 147 but max is 0 [ 836.395844][T15600] usb 3-1: config 4 contains an unexpected descriptor of type 0x2, skipping [ 836.417050][T15600] usb 3-1: config 4 has no interface number 0 [ 836.433557][T15600] usb 3-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 836.461969][T15600] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.480653][T15600] usb 3-1: Product: syz [ 836.491890][T15600] usb 3-1: Manufacturer: syz [ 836.507794][T15600] usb 3-1: SerialNumber: syz [ 836.565529][ T5914] usbhid 5-1:0.0: can't add hid device: -71 [ 836.581315][ T5914] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 836.600631][ T5914] usb 5-1: USB disconnect, device number 9 [ 836.746771][T15600] uvcvideo 3-1:4.147: Found UVC 0.02 device syz (04f2:b746) [ 836.754338][T15600] uvcvideo 3-1:4.147: No valid video chain found. [ 836.769654][T15600] usb 3-1: USB disconnect, device number 3 [ 836.957374][ T5914] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 837.082311][ T5901] usb 6-1: USB disconnect, device number 73 [ 837.137261][ T5914] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 837.178546][ T5914] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 837.198759][ T5914] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 837.218677][ T5914] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 837.228940][ T5914] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 837.248025][ T5914] usb 5-1: config 0 descriptor?? [ 837.477992][T16330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 837.488007][T16330] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 837.527109][ T5901] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 837.708516][T16330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 837.718616][ T5901] usb 6-1: Using ep0 maxpacket: 8 [ 837.729597][ T5901] usb 6-1: config 1 interface 0 has no altsetting 0 [ 837.736806][T16330] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 837.750051][ T5901] usb 6-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.40 [ 837.761041][ T5901] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 837.771814][ T5901] usb 6-1: Product: syz [ 837.778719][ T5914] usbhid 5-1:0.0: can't add hid device: -71 [ 837.787022][ T5914] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 837.795406][ T5901] usb 6-1: Manufacturer: syz [ 837.801162][ T5901] usb 6-1: SerialNumber: syz [ 837.809191][ T5914] usb 5-1: USB disconnect, device number 10 [ 838.077768][ T5901] usbhid 6-1:1.0: can't add hid device: -71 [ 838.084716][ T5901] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 838.102507][ T5901] usb 6-1: USB disconnect, device number 74 [ 838.587091][ T5901] usb 6-1: new full-speed USB device number 75 using dummy_hcd [ 838.888031][ T5901] usb 6-1: not running at top speed; connect to a high speed hub [ 838.897779][ T5901] usb 6-1: config 1 interface 0 altsetting 3 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 839.207193][ T5901] usb 6-1: config 1 interface 0 altsetting 3 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 839.436910][ T5901] usb 6-1: config 1 interface 0 has no altsetting 0 [ 839.449324][ T5901] usb 6-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.40 [ 839.458920][ T5901] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 839.487045][ T5901] usb 6-1: Product: syz [ 839.499087][ T5901] usb 6-1: Manufacturer: ĕ䰯敇⯑乊桴èƒï­§ç¬Šäƒ¼îª•ã‡½ï¤éŽ¿ã¿è¨½î£·ã±ƒî±¦å„©ãŒšî›ãŸ¼à¾¬â®¹æ²ë®á€„ [ 839.554307][ T5901] usb 6-1: SerialNumber: syz [ 839.600185][T16333] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 839.638114][T16333] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 839.864572][T16332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 839.874399][T16333] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 839.887776][T16332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 839.927553][T16333] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 840.006426][ T5901] usbhid 6-1:1.0: can't add hid device: -71 [ 840.028227][ T5901] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 840.046684][ T5901] usb 6-1: USB disconnect, device number 75 [ 840.422790][T16380] loop8: detected capacity change from 0 to 8 [ 840.446451][T16380] loop8: [CUMANA/ADFS] p1 [ADFS] p1 [ 840.477316][T16380] loop8: partition table partially beyond EOD, truncated [ 840.516471][T16380] loop8: p1 size 3004527350 extends beyond EOD, truncated [ 840.767133][T15601] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 840.927211][T15601] usb 6-1: Using ep0 maxpacket: 8 [ 840.941722][T15601] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 840.996168][T15601] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 841.075821][T16397] vivid-000: disconnect [ 841.281030][ T5901] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 841.287013][T15601] usb 6-1: Product: syz [ 841.293087][T15601] usb 6-1: Manufacturer: syz [ 841.309235][T15601] usb 6-1: SerialNumber: syz [ 841.448315][T16379] vivid-000: reconnect [ 841.454511][T15601] usb 6-1: config 0 descriptor?? [ 841.479859][ T5901] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 841.527055][ T5901] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 841.547160][ T5901] usb 1-1: New USB device found, idVendor=06a3, idProduct=0cfa, bcdDevice= 0.00 [ 841.556375][ T5901] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 841.581542][ T5901] usb 1-1: config 0 descriptor?? [ 842.015134][ T5901] hid_parser_main: 4 callbacks suppressed [ 842.015157][ T5901] saitek 0003:06A3:0CFA.002E: unknown main item tag 0x0 [ 842.029638][T16384] veth0: entered promiscuous mode [ 842.038521][T16384] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2788'. [ 842.050299][ T5901] saitek 0003:06A3:0CFA.002E: hidraw0: USB HID v0.00 Device [HID 06a3:0cfa] on usb-dummy_hcd.0-1/input0 [ 842.069808][T15600] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 842.078388][T16408] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 842.088282][T16408] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 842.216870][T11413] usb 1-1: USB disconnect, device number 21 [ 842.250147][T15600] usb 3-1: device descriptor read/64, error -71 [ 842.252221][T16410] fido_id[16410]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 842.311874][T15601] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 842.337074][ T5901] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 842.487125][T15600] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 842.617139][T15600] usb 3-1: device descriptor read/64, error -71 [ 842.728230][T15600] usb usb3-port1: attempt power cycle [ 842.830085][T16413] input: syz1 as /devices/virtual/input/input64 [ 842.859635][T16413] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2796'. [ 842.887362][T16413] vlan1: entered promiscuous mode [ 842.892713][T16413] vlan1: entered allmulticast mode [ 842.900241][T16413] hsr_slave_1: entered allmulticast mode [ 843.077508][T15600] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 843.098503][T15600] usb 3-1: device descriptor read/8, error -71 [ 843.337117][T15600] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 843.347437][ T5914] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 843.367632][T15600] usb 3-1: device descriptor read/8, error -71 [ 843.487205][T15600] usb usb3-port1: unable to enumerate USB device [ 843.511893][ T5914] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 843.523009][ T5914] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 843.532377][ T5914] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 843.548398][ T5914] usb 1-1: config 0 descriptor?? [ 843.560396][ T5914] pwc: Askey VC010 type 2 USB webcam detected. [ 843.678774][T16418] IPVS: set_ctl: invalid protocol: 41 127.0.0.1:20001 [ 843.685718][T16419] IPVS: set_ctl: invalid protocol: 41 127.0.0.1:20001 [ 843.772757][T15601] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 843.784744][T15601] usb 6-1: USB disconnect, device number 76 [ 843.965631][ T5914] pwc: recv_control_msg error -32 req 02 val 2b00 [ 843.977531][ T5914] pwc: recv_control_msg error -32 req 02 val 2700 [ 843.985642][ T5914] pwc: recv_control_msg error -32 req 02 val 2c00 [ 843.998125][ T5914] pwc: recv_control_msg error -32 req 04 val 1000 [ 844.008017][ T5914] pwc: recv_control_msg error -32 req 04 val 1300 [ 844.015168][ T5914] pwc: recv_control_msg error -32 req 04 val 1400 [ 844.028475][ T5914] pwc: recv_control_msg error -32 req 02 val 2000 [ 844.212809][T16439] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2806'. [ 844.356290][ T5914] pwc: recv_control_msg error -71 req 04 val 1500 [ 844.376215][ T5914] pwc: recv_control_msg error -71 req 02 val 2500 [ 844.383424][ T5914] pwc: recv_control_msg error -71 req 02 val 2400 [ 844.400275][ T5914] pwc: recv_control_msg error -71 req 02 val 2600 [ 844.423489][ T5914] pwc: recv_control_msg error -71 req 02 val 2900 [ 844.453873][ T5914] pwc: recv_control_msg error -71 req 02 val 2800 [ 844.479236][ T5914] pwc: recv_control_msg error -71 req 04 val 1100 [ 844.520511][ T5914] pwc: recv_control_msg error -71 req 04 val 1200 [ 844.639307][ T5914] pwc: Registered as video103. [ 844.656804][ T5914] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input65 [ 844.763441][T16448] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2808'. [ 844.817243][ T5914] usb 1-1: USB disconnect, device number 22 [ 845.827430][T15601] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 846.038183][T15601] usb 3-1: Using ep0 maxpacket: 16 [ 846.045480][T15601] usb 3-1: config 8 has an invalid interface number: 223 but max is 0 [ 846.057430][ T5914] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 846.061883][T15601] usb 3-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 846.095331][T15601] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 846.165336][T15601] usb 3-1: config 8 has no interface number 0 [ 846.211687][T15601] usb 3-1: config 8 interface 223 altsetting 2 bulk endpoint 0xC has invalid maxpacket 32 [ 846.230865][T15601] usb 3-1: config 8 interface 223 altsetting 2 endpoint 0x7 has invalid maxpacket 15872, setting to 64 [ 846.237005][ T5914] usb 1-1: Using ep0 maxpacket: 8 [ 846.242669][T15601] usb 3-1: config 8 interface 223 altsetting 2 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 846.259021][ T5914] usb 1-1: config 1 interface 0 altsetting 111 endpoint 0x81 has an invalid bInterval 247, changing to 11 [ 846.263730][T15601] usb 3-1: config 8 interface 223 has no altsetting 0 [ 846.307467][T16462] netlink: 9 bytes leftover after parsing attributes in process `syz.5.2812'. [ 846.320272][ T5914] usb 1-1: config 1 interface 0 has no altsetting 0 [ 846.329520][T15601] usb 3-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d [ 846.339538][T16464] netlink: 5 bytes leftover after parsing attributes in process `syz.5.2812'. [ 846.350352][T16464] 0ªî{X¹¦: renamed from gretap0 (while UP) [ 846.357139][T15601] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.399620][T16464] 0ªî{X¹¦: entered allmulticast mode [ 846.412607][T15601] usb 3-1: Product: syz [ 846.417169][T15601] usb 3-1: Manufacturer: syz [ 846.417947][T16464] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 846.421781][T15601] usb 3-1: SerialNumber: syz [ 846.457363][T16457] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 846.462615][ T5914] usb 1-1: New USB device found, idVendor=05ac, idProduct=024d, bcdDevice= 0.40 [ 846.484875][T16462] 0ªî{X¹¦: entered promiscuous mode [ 846.490810][T16462] 0ªî{X¹¦: left allmulticast mode [ 846.534521][ T5914] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.543428][ T5914] usb 1-1: Product: syz [ 846.549065][ T5914] usb 1-1: Manufacturer: syz [ 846.553914][ T5914] usb 1-1: SerialNumber: syz [ 846.691314][T15601] usb 3-1: USB disconnect, device number 8 [ 846.781500][ T5914] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input66 [ 846.793849][ T5185] bcm5974 1-1:1.0: could not read from device [ 846.802304][ T5185] bcm5974 1-1:1.0: could not read from device [ 846.818805][ T5914] usb 1-1: USB disconnect, device number 23 [ 846.841050][ T5185] bcm5974 1-1:1.0: could not read from device [ 846.978258][ T5185] bcm5974 1-1:1.0: could not read from device [ 847.191354][T16471] loop8: detected capacity change from 0 to 8 [ 847.200295][T16471] Dev loop8: unable to read RDB block 8 [ 847.205892][T16471] loop8: unable to read partition table [ 847.212099][T16471] loop8: partition table beyond EOD, truncated [ 847.218475][T16471] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 847.564876][ T30] audit: type=1326 audit(1760575118.091:12186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16478 comm="syz.2.2818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7fa18eec9 code=0x7ffc0000 [ 847.637096][ T30] audit: type=1326 audit(1760575118.091:12187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16478 comm="syz.2.2818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=31 compat=0 ip=0x7fe7fa18eec9 code=0x7ffc0000 [ 847.766103][ T30] audit: type=1326 audit(1760575118.091:12188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16478 comm="syz.2.2818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7fa18eec9 code=0x7ffc0000 [ 847.795193][ T30] audit: type=1326 audit(1760575118.091:12189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16478 comm="syz.2.2818" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7fa18eec9 code=0x7ffc0000 [ 848.181213][ T30] audit: type=1326 audit(1760575118.751:12190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16499 comm="syz.2.2822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7fa18eec9 code=0x7ffc0000 [ 848.777094][ T30] audit: type=1326 audit(1760575118.751:12191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16499 comm="syz.2.2822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7fa18eec9 code=0x7ffc0000 [ 848.852681][ T30] audit: type=1326 audit(1760575118.751:12192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16499 comm="syz.2.2822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7fa18eec9 code=0x7ffc0000 [ 849.011697][ T30] audit: type=1326 audit(1760575118.751:12193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16499 comm="syz.2.2822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe7fa18eec9 code=0x7ffc0000 [ 849.112934][ T30] audit: type=1326 audit(1760575118.751:12195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16499 comm="syz.2.2822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7fa18eec9 code=0x7ffc0000 [ 849.150813][ T30] audit: type=1326 audit(1760575118.751:12196): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16499 comm="syz.2.2822" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7fa18eec9 code=0x7ffc0000 [ 849.255340][T16515] loop8: detected capacity change from 0 to 8 [ 849.265216][T16515] Dev loop8: unable to read RDB block 8 [ 849.275859][T16515] loop8: unable to read partition table [ 849.290039][T16515] loop8: partition table beyond EOD, truncated [ 849.297414][T16515] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 849.889861][T16526] ipip1: entered promiscuous mode [ 849.894973][T16526] ipip1: entered allmulticast mode [ 850.479000][T16537] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2834'. [ 850.717074][T11413] usb 4-1: new full-speed USB device number 126 using dummy_hcd [ 850.911248][T11413] usb 4-1: unable to get BOS descriptor or descriptor too short [ 851.072348][T11413] usb 4-1: not running at top speed; connect to a high speed hub [ 851.099952][T11413] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 147, changing to 4 [ 851.123408][T11413] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 851.123437][T11413] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 851.123456][T11413] usb 4-1: Product: syz [ 851.123470][T11413] usb 4-1: Manufacturer: syz [ 851.123484][T11413] usb 4-1: SerialNumber: syz [ 851.342809][T16536] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 851.367759][T16536] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 851.392697][T11413] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 851.423060][T11413] usb 4-1: unit 2 not found! [ 851.490858][T11413] usb 4-1: USB disconnect, device number 126 [ 852.034950][ T5828] udevd[5828]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 852.144747][T16545] misc userio: The device must be registered before sending interrupts [ 852.156692][T16545] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2837'. [ 852.231029][T16549] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.2835'. [ 853.259749][T16564] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2843'. [ 853.457123][T15600] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 853.629243][T15600] usb 1-1: config 9 has an invalid interface number: 51 but max is 1 [ 853.645489][T15600] usb 1-1: config 9 has an invalid interface number: 73 but max is 1 [ 853.655603][T15600] usb 1-1: config 9 has no interface number 0 [ 853.662337][T15600] usb 1-1: config 9 has no interface number 1 [ 853.669961][T15600] usb 1-1: config 9 interface 51 has no altsetting 0 [ 853.676801][T15600] usb 1-1: config 9 interface 73 has no altsetting 0 [ 853.698901][T15600] usb 1-1: New USB device found, idVendor=0499, idProduct=1001, bcdDevice=c4.19 [ 853.799051][T15600] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 853.819433][T15600] usb 1-1: Product: syz [ 853.829260][T15600] usb 1-1: Manufacturer: syz [ 853.840813][T15600] usb 1-1: SerialNumber: syz [ 853.879065][T16574] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2846'. [ 854.027188][ T5901] usb 6-1: new full-speed USB device number 77 using dummy_hcd [ 854.117313][T15600] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 854.124829][T15600] usb 1-1: invalid MIDI in EP 0 [ 854.158672][T15600] snd-usb-audio 1-1:9.51: probe with driver snd-usb-audio failed with error -22 [ 854.204164][T15600] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 854.208913][ T5901] usb 6-1: config index 0 descriptor too short (expected 37, got 36) [ 854.394312][ T5901] usb 6-1: config 0 has an invalid interface number: 161 but max is 0 [ 854.413057][ T5901] usb 6-1: config 0 has no interface number 0 [ 854.439951][T15600] snd-usb-audio 1-1:9.73: probe with driver snd-usb-audio failed with error -2 [ 854.455964][ T5901] usb 6-1: New USB device found, idVendor=067b, idProduct=331a, bcdDevice=4a.31 [ 854.472577][ T5901] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 854.487014][ T5901] usb 6-1: Product: syz [ 854.529505][ T5901] usb 6-1: Manufacturer: syz [ 854.537308][ T5901] usb 6-1: SerialNumber: syz [ 854.565184][ T5901] usb 6-1: config 0 descriptor?? [ 854.670088][T15600] usb 1-1: USB disconnect, device number 24 [ 854.987347][T15601] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 855.084753][ T5828] udevd[5828]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:9.73/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 855.267889][T15601] usb 5-1: Using ep0 maxpacket: 8 [ 855.325746][T15601] usb 5-1: unable to get BOS descriptor or descriptor too short [ 855.354094][T15601] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 855.371606][T15601] usb 5-1: can't read configurations, error -71 [ 855.663427][T16604] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2854'. [ 855.790309][ T5914] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 856.030812][ T5914] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 856.052877][ T5914] usb 1-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 856.276826][ T5914] usb 1-1: Product: syz [ 856.352025][ T5914] usb 1-1: SerialNumber: syz [ 856.420124][ T5914] usb 1-1: config 0 descriptor?? [ 856.650669][ T5914] hso 1-1:0.0: Failed to find BULK IN ep [ 856.869970][ T5914] usb 1-1: USB disconnect, device number 25 [ 857.388871][T16629] ======================================================= [ 857.388871][T16629] WARNING: The mand mount option has been deprecated and [ 857.388871][T16629] and is ignored by this kernel. Remove the mand [ 857.388871][T16629] option from the mount to silence this warning. [ 857.388871][T16629] ======================================================= [ 857.538010][T16629] fuse: Bad value for 'fd' [ 857.558511][ T5901] pl2303 6-1:0.161: required interrupt-in endpoint missing [ 857.615848][ T5901] usb 6-1: USB disconnect, device number 77 [ 858.239944][T16638] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3876794810 (248114867840 ns) > initial count (239572244736 ns). Using initial count to start timer. [ 858.281283][T16638] kvm: Disabled LAPIC found during irq injection [ 858.337107][T15600] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 858.490126][T15600] usb 6-1: Using ep0 maxpacket: 8 [ 858.503805][T15600] usb 6-1: New USB device found, idVendor=0c45, idProduct=614a, bcdDevice=c4.6d [ 858.516744][T15600] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 858.567133][T15600] usb 6-1: Product: syz [ 858.581614][T15600] usb 6-1: Manufacturer: syz [ 858.586272][T15600] usb 6-1: SerialNumber: syz [ 858.618390][T15600] usb 6-1: config 0 descriptor?? [ 858.625973][T16652] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2867'. [ 858.643607][T15600] gspca_main: sonixj-2.14.0 probing 0c45:614a [ 858.677073][ T5901] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 858.758987][T16657] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2868'. [ 858.769400][T16657] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2868'. [ 858.827068][ T5901] usb 1-1: Using ep0 maxpacket: 8 [ 858.888065][ T5901] usb 1-1: unable to get BOS descriptor or descriptor too short [ 858.958291][ T5901] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 858.969250][ T5901] usb 1-1: can't read configurations, error -71 [ 859.738183][T15600] gspca_sonixj: reg_w1 err -110 [ 859.743131][T15600] sonixj 6-1:0.0: probe with driver sonixj failed with error -110 [ 859.753529][ T30] kauditd_printk_skb: 496 callbacks suppressed [ 859.753546][ T30] audit: type=1326 audit(1760575130.331:12692): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16663 comm="syz.3.2870" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 859.852663][T16666] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2870'. [ 859.865381][ T30] audit: type=1326 audit(1760575130.331:12693): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16663 comm="syz.3.2870" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 859.888557][T16666] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2870'. [ 859.925843][ T30] audit: type=1326 audit(1760575130.491:12694): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16663 comm="syz.3.2870" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 860.003553][ T30] audit: type=1326 audit(1760575130.521:12695): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16663 comm="syz.3.2870" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 860.152417][T16666] pim6reg: entered allmulticast mode [ 860.196266][ T30] audit: type=1326 audit(1760575130.521:12696): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16663 comm="syz.3.2870" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 860.337866][T16663] pim6reg: left allmulticast mode [ 861.395107][T16699] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2871'. [ 861.614328][T16699] netlink: 'syz.2.2871': attribute type 3 has an invalid length. [ 862.047331][T16706] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2879'. [ 862.624795][T16712] netlink: 88 bytes leftover after parsing attributes in process `syz.3.2881'. [ 862.673339][ T43] usb 6-1: USB disconnect, device number 78 [ 863.987065][ T5837] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 864.030794][T16733] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 864.043218][T16733] netlink: 'syz.4.2887': attribute type 3 has an invalid length. [ 864.117361][ T5837] usb 3-1: device descriptor read/64, error -71 [ 864.357062][ T5837] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 864.496366][T16744] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2891'. [ 864.507114][ T5837] usb 3-1: device descriptor read/64, error -71 [ 864.599979][T16748] binder: BINDER_SET_CONTEXT_MGR already set [ 864.606018][T16748] binder: 16742:16748 ioctl 4018620d 200000000040 returned -16 [ 864.727510][ T5837] usb usb3-port1: attempt power cycle [ 864.849274][T16751] FAULT_INJECTION: forcing a failure. [ 864.849274][T16751] name failslab, interval 1, probability 0, space 0, times 0 [ 864.867432][T16751] CPU: 1 UID: 0 PID: 16751 Comm: syz.5.2892 Not tainted syzkaller #0 PREEMPT(full) [ 864.867459][T16751] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 864.867470][T16751] Call Trace: [ 864.867478][T16751] [ 864.867488][T16751] dump_stack_lvl+0x189/0x250 [ 864.867513][T16751] ? __pfx____ratelimit+0x10/0x10 [ 864.867541][T16751] ? __pfx_dump_stack_lvl+0x10/0x10 [ 864.867561][T16751] ? __pfx__printk+0x10/0x10 [ 864.867587][T16751] ? __pfx___might_resched+0x10/0x10 [ 864.867616][T16751] should_fail_ex+0x414/0x560 [ 864.867649][T16751] should_failslab+0xa8/0x100 [ 864.867674][T16751] kmem_cache_alloc_node_noprof+0x77/0x710 [ 864.867692][T16751] ? __alloc_skb+0x112/0x2d0 [ 864.867720][T16751] __alloc_skb+0x112/0x2d0 [ 864.867747][T16751] netlink_ack+0x146/0xa50 [ 864.867769][T16751] ? rcu_is_watching+0x15/0xb0 [ 864.867792][T16751] ? trace_contention_end+0x39/0x120 [ 864.867829][T16751] netlink_rcv_skb+0x28c/0x470 [ 864.867852][T16751] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 864.867872][T16751] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 864.867909][T16751] ? netlink_deliver_tap+0x2e/0x1b0 [ 864.867930][T16751] ? netlink_deliver_tap+0x2e/0x1b0 [ 864.867956][T16751] xfrm_netlink_rcv+0x79/0x90 [ 864.867974][T16751] netlink_unicast+0x82f/0x9e0 [ 864.868004][T16751] ? __pfx_netlink_unicast+0x10/0x10 [ 864.868029][T16751] ? netlink_sendmsg+0x642/0xb30 [ 864.868050][T16751] ? skb_put+0x11b/0x210 [ 864.868077][T16751] netlink_sendmsg+0x805/0xb30 [ 864.868111][T16751] ? __pfx_netlink_sendmsg+0x10/0x10 [ 864.868140][T16751] ? aa_sock_msg_perm+0xf1/0x1d0 [ 864.868163][T16751] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 864.868186][T16751] ? __pfx_netlink_sendmsg+0x10/0x10 [ 864.868211][T16751] __sock_sendmsg+0x21c/0x270 [ 864.868234][T16751] ____sys_sendmsg+0x505/0x830 [ 864.868263][T16751] ? __pfx_____sys_sendmsg+0x10/0x10 [ 864.868297][T16751] ? import_iovec+0x74/0xa0 [ 864.868334][T16751] ___sys_sendmsg+0x21f/0x2a0 [ 864.868351][T16751] ? __pfx____sys_sendmsg+0x10/0x10 [ 864.868399][T16751] ? __fget_files+0x2a/0x420 [ 864.868420][T16751] ? __fget_files+0x3a0/0x420 [ 864.868450][T16751] __x64_sys_sendmsg+0x19b/0x260 [ 864.868469][T16751] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 864.868494][T16751] ? __pfx_ksys_write+0x10/0x10 [ 864.868518][T16751] ? do_syscall_64+0xbe/0xfa0 [ 864.868540][T16751] do_syscall_64+0xfa/0xfa0 [ 864.868557][T16751] ? lockdep_hardirqs_on+0x9c/0x150 [ 864.868575][T16751] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 864.868593][T16751] ? clear_bhb_loop+0x60/0xb0 [ 864.868615][T16751] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 864.868633][T16751] RIP: 0033:0x7f9877b8eec9 [ 864.868650][T16751] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 864.868666][T16751] RSP: 002b:00007f9878988038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 864.868686][T16751] RAX: ffffffffffffffda RBX: 00007f9877de5fa0 RCX: 00007f9877b8eec9 [ 864.868701][T16751] RDX: 0000000020000080 RSI: 00002000000000c0 RDI: 0000000000000003 [ 864.868713][T16751] RBP: 00007f9878988090 R08: 0000000000000000 R09: 0000000000000000 [ 864.868724][T16751] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 864.868735][T16751] R13: 00007f9877de6038 R14: 00007f9877de5fa0 R15: 00007f9877f0fa28 [ 864.868767][T16751] [ 865.668640][ T5837] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 865.887179][ T5837] usb 3-1: device descriptor read/8, error -71 [ 866.045712][T16759] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2893'. [ 866.057347][T16759] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2893'. [ 866.148367][ T5837] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 866.183871][ T5837] usb 3-1: device descriptor read/8, error -71 [ 866.301647][ T5837] usb usb3-port1: unable to enumerate USB device [ 866.657840][ T5837] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 866.887008][ T5837] usb 1-1: Using ep0 maxpacket: 8 [ 866.894442][T16772] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 866.903191][ T5837] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 866.933025][ T5837] usb 1-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 867.057259][ T5837] usb 1-1: config 0 interface 0 has no altsetting 0 [ 867.087252][ T5837] usb 1-1: New USB device found, idVendor=0458, idProduct=4018, bcdDevice= 0.00 [ 867.107062][ T5837] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 867.136012][ T5837] usb 1-1: config 0 descriptor?? [ 867.330112][T16748] syz.3.2890 (16748): drop_caches: 2 [ 867.878773][T16781] netlink: 'syz.4.2899': attribute type 10 has an invalid length. [ 867.887261][T16781] dummy0: left allmulticast mode [ 867.904986][T16781] dummy0: entered allmulticast mode [ 867.916249][T16781] team0: Port device dummy0 added [ 868.026698][ T5837] kye 0003:0458:4018.002F: unknown main item tag 0x0 [ 868.082108][ T5837] kye 0003:0458:4018.002F: reserved main item tag 0xe [ 868.089104][ T5837] kye 0003:0458:4018.002F: item fetching failed at offset 15/133 [ 868.112692][T16762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 868.124785][T16762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 868.170702][ T5837] kye 0003:0458:4018.002F: parse failed [ 868.176412][ T5837] kye 0003:0458:4018.002F: probe with driver kye failed with error -22 [ 868.197620][T11413] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 868.299451][T16762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 868.318217][T16762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 868.335287][ T5837] usb 1-1: USB disconnect, device number 28 [ 868.538569][T11413] usb 5-1: Using ep0 maxpacket: 8 [ 868.621126][T11413] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 868.632855][T11413] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 868.656018][T11413] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 868.685548][T11413] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 868.896021][T11413] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 868.957041][ T43] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 869.013455][T11413] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 869.167195][ T43] usb 6-1: Using ep0 maxpacket: 8 [ 869.250200][T11413] usb 5-1: GET_CAPABILITIES returned 0 [ 869.255969][T11413] usbtmc 5-1:16.0: can't read capabilities [ 869.257489][T16794] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2902'. [ 869.328748][ T43] usb 6-1: unable to get BOS descriptor or descriptor too short [ 869.439737][ T43] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 869.466328][ T43] usb 6-1: can't read configurations, error -71 [ 869.539955][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.550930][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.560673][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.569789][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.579640][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.588742][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.597806][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.654632][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.663762][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.672885][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.686177][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.695317][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.704513][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.735671][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.745225][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.754336][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 869.790267][T16803] FAULT_INJECTION: forcing a failure. [ 869.790267][T16803] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 869.812017][T16803] CPU: 1 UID: 0 PID: 16803 Comm: syz.0.2904 Not tainted syzkaller #0 PREEMPT(full) [ 869.812043][T16803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 869.812054][T16803] Call Trace: [ 869.812061][T16803] [ 869.812067][T16803] dump_stack_lvl+0x189/0x250 [ 869.812084][T16803] ? __pfx____ratelimit+0x10/0x10 [ 869.812099][T16803] ? __pfx_dump_stack_lvl+0x10/0x10 [ 869.812110][T16803] ? __pfx__printk+0x10/0x10 [ 869.812127][T16803] should_fail_ex+0x414/0x560 [ 869.812145][T16803] _copy_to_user+0x31/0xb0 [ 869.812160][T16803] simple_read_from_buffer+0xe1/0x170 [ 869.812175][T16803] proc_fail_nth_read+0x1b3/0x220 [ 869.812191][T16803] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 869.812208][T16803] ? rw_verify_area+0x2a6/0x4d0 [ 869.812218][T16803] ? __lock_acquire+0xab9/0xd20 [ 869.812229][T16803] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 869.812244][T16803] vfs_read+0x200/0xa30 [ 869.812254][T16803] ? fdget_pos+0x247/0x320 [ 869.812268][T16803] ? __pfx___mutex_lock+0x10/0x10 [ 869.812279][T16803] ? __pfx_vfs_read+0x10/0x10 [ 869.812290][T16803] ? __fget_files+0x2a/0x420 [ 869.812303][T16803] ? __fget_files+0x3a0/0x420 [ 869.812314][T16803] ? __fget_files+0x2a/0x420 [ 869.812330][T16803] ksys_read+0x145/0x250 [ 869.812342][T16803] ? __pfx_ksys_read+0x10/0x10 [ 869.812354][T16803] ? do_syscall_64+0xbe/0xfa0 [ 869.812366][T16803] do_syscall_64+0xfa/0xfa0 [ 869.812375][T16803] ? lockdep_hardirqs_on+0x9c/0x150 [ 869.812384][T16803] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 869.812394][T16803] ? clear_bhb_loop+0x60/0xb0 [ 869.812406][T16803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 869.812416][T16803] RIP: 0033:0x7f850d98d8dc [ 869.812426][T16803] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 869.812435][T16803] RSP: 002b:00007f850e756030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 869.812447][T16803] RAX: ffffffffffffffda RBX: 00007f850dbe5fa0 RCX: 00007f850d98d8dc [ 869.812455][T16803] RDX: 000000000000000f RSI: 00007f850e7560a0 RDI: 0000000000000004 [ 869.812461][T16803] RBP: 00007f850e756090 R08: 0000000000000000 R09: 0000000000000000 [ 869.812468][T16803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 869.812474][T16803] R13: 00007f850dbe6038 R14: 00007f850dbe5fa0 R15: 00007f850dd0fa28 [ 869.812490][T16803] [ 870.135139][T16781] fuse: Bad value for 'fd' [ 870.164148][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.172030][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.207072][ T5837] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 870.357412][ T5837] usb 4-1: Using ep0 maxpacket: 32 [ 870.366487][ T5837] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 870.376535][ T5837] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 870.385250][ T5837] usb 4-1: Product: syz [ 870.389776][ T5837] usb 4-1: Manufacturer: syz [ 870.416913][ T5837] usb 4-1: SerialNumber: syz [ 870.429883][ T5837] usb 4-1: config 0 descriptor?? [ 870.719539][T16814] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2909'. [ 870.761773][ T5837] RobotFuzz Open Source InterFace, OSIF 4-1:0.0: version d4.15 found at bus 004 address 127 [ 870.914533][T16822] input: syz0 as /devices/virtual/input/input67 [ 870.997670][T16805] delete_channel: no stack [ 871.126346][T16829] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2913'. [ 871.162391][T16822] kvm: pic: non byte write [ 871.328648][ T43] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 871.402413][T16836] dvmrp0: left allmulticast mode [ 871.557257][ T43] usb 1-1: Using ep0 maxpacket: 8 [ 871.570982][ T43] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 871.580318][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 871.612628][ T43] usb 1-1: config 0 descriptor?? [ 871.701590][ T5914] usb 5-1: USB disconnect, device number 13 [ 872.210871][T16844] misc userio: The device must be registered before sending interrupts [ 872.229665][T16844] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2916'. [ 872.347140][ T43] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 872.385678][ T43] asix 1-1:0.0: probe with driver asix failed with error -61 [ 872.510033][T16848] loop8: detected capacity change from 0 to 8 [ 872.519244][T16848] loop8: [CUMANA/ADFS] p1 [ADFS] p1 [ 872.524934][T16848] loop8: partition table partially beyond EOD, truncated [ 872.533990][T16848] loop8: p1 size 3004527350 extends beyond EOD, truncated [ 872.663137][ T5828] udevd[5828]: inotify_add_watch(7, /dev/loop8p1, 10) failed: No such file or directory [ 872.822516][ T5837] usb 4-1: USB disconnect, device number 127 [ 873.835893][T16869] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 873.863932][T16869] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 874.948284][T16881] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2925'. [ 875.428857][T16876] delete_channel: no stack [ 875.534909][T16894] bond4 (unregistering): Released all slaves [ 876.187614][T15600] usb 1-1: USB disconnect, device number 29 [ 877.724332][T16926] loop8: detected capacity change from 0 to 8 [ 877.758429][ T5828] loop8: [CUMANA/ADFS] p1 [ADFS] p1 [ 877.771038][ T5828] loop8: partition table partially beyond EOD, truncated [ 877.795298][ T5828] loop8: p1 size 3004527350 extends beyond EOD, truncated [ 877.834553][T16926] loop8: [CUMANA/ADFS] p1 [ADFS] p1 [ 877.916054][T16926] loop8: partition table partially beyond EOD, truncated [ 877.935995][T16926] loop8: p1 size 3004527350 extends beyond EOD, truncated [ 878.166199][T16931] misc userio: The device must be registered before sending interrupts [ 878.178716][T16931] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2935'. [ 878.242949][ T5828] udevd[5828]: inotify_add_watch(7, /dev/loop8p1, 10) failed: No such file or directory [ 878.447707][ T5828] udevd[5828]: inotify_add_watch(7, /dev/loop8p1, 10) failed: No such file or directory [ 878.727814][T16940] netlink: 112 bytes leftover after parsing attributes in process `syz.3.2939'. [ 879.496150][T16933] delete_channel: no stack [ 879.643269][T16948] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 879.853853][T16957] netlink: 277 bytes leftover after parsing attributes in process `syz.2.2943'. [ 880.790152][T16968] vivid-000: disconnect [ 881.138963][T16962] vivid-000: reconnect [ 882.324176][T16981] loop8: detected capacity change from 0 to 8 [ 882.369269][ T5828] Dev loop8: unable to read RDB block 8 [ 882.382472][ T5828] loop8: unable to read partition table [ 882.407676][ T5828] loop8: partition table beyond EOD, truncated [ 882.527653][T16981] Dev loop8: unable to read RDB block 8 [ 882.533782][T16981] loop8: unable to read partition table [ 882.541662][T16981] loop8: partition table beyond EOD, truncated [ 882.548720][T16981] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 883.790708][T17014] FAULT_INJECTION: forcing a failure. [ 883.790708][T17014] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 883.834086][T17014] CPU: 1 UID: 0 PID: 17014 Comm: syz.0.2957 Not tainted syzkaller #0 PREEMPT(full) [ 883.834113][T17014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 883.834124][T17014] Call Trace: [ 883.834133][T17014] [ 883.834142][T17014] dump_stack_lvl+0x189/0x250 [ 883.834167][T17014] ? __pfx____ratelimit+0x10/0x10 [ 883.834201][T17014] ? __pfx_dump_stack_lvl+0x10/0x10 [ 883.834220][T17014] ? __pfx__printk+0x10/0x10 [ 883.834240][T17014] ? __might_fault+0xb0/0x130 [ 883.834274][T17014] should_fail_ex+0x414/0x560 [ 883.834305][T17014] _copy_from_user+0x2d/0xb0 [ 883.834329][T17014] __sys_connect+0x123/0x440 [ 883.834354][T17014] ? __fget_files+0x3a0/0x420 [ 883.834376][T17014] ? __pfx___sys_connect+0x10/0x10 [ 883.834411][T17014] ? __pfx_ksys_write+0x10/0x10 [ 883.834435][T17014] __x64_sys_connect+0x7a/0x90 [ 883.834460][T17014] do_syscall_64+0xfa/0xfa0 [ 883.834477][T17014] ? lockdep_hardirqs_on+0x9c/0x150 [ 883.834495][T17014] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 883.834513][T17014] ? clear_bhb_loop+0x60/0xb0 [ 883.834535][T17014] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 883.834553][T17014] RIP: 0033:0x7f850d98eec9 [ 883.834571][T17014] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 883.834586][T17014] RSP: 002b:00007f850e756038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 883.834606][T17014] RAX: ffffffffffffffda RBX: 00007f850dbe5fa0 RCX: 00007f850d98eec9 [ 883.834620][T17014] RDX: 0000000000000010 RSI: 0000200000000280 RDI: 0000000000000004 [ 883.834632][T17014] RBP: 00007f850e756090 R08: 0000000000000000 R09: 0000000000000000 [ 883.834643][T17014] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 883.834655][T17014] R13: 00007f850dbe6038 R14: 00007f850dbe5fa0 R15: 00007f850dd0fa28 [ 883.834685][T17014] [ 884.394530][T17022] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2959'. [ 884.408233][T17022] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2959'. [ 884.506870][T17022] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2959'. [ 884.823670][T17028] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2961'. [ 884.860850][T17028] netlink: 'syz.2.2961': attribute type 20 has an invalid length. [ 884.907677][T17028] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2961'. [ 885.607093][ T5837] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 885.658483][T17061] FAULT_INJECTION: forcing a failure. [ 885.658483][T17061] name failslab, interval 1, probability 0, space 0, times 0 [ 885.677197][T17061] CPU: 1 UID: 0 PID: 17061 Comm: syz.5.2969 Not tainted syzkaller #0 PREEMPT(full) [ 885.677224][T17061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 885.677236][T17061] Call Trace: [ 885.677244][T17061] [ 885.677253][T17061] dump_stack_lvl+0x189/0x250 [ 885.677278][T17061] ? __pfx____ratelimit+0x10/0x10 [ 885.677305][T17061] ? __pfx_dump_stack_lvl+0x10/0x10 [ 885.677324][T17061] ? __pfx__printk+0x10/0x10 [ 885.677348][T17061] ? __ip_dev_find+0x444/0x4e0 [ 885.677371][T17061] should_fail_ex+0x414/0x560 [ 885.677402][T17061] should_failslab+0xa8/0x100 [ 885.677427][T17061] kmem_cache_alloc_noprof+0x74/0x6e0 [ 885.677446][T17061] ? dst_alloc+0x105/0x170 [ 885.677470][T17061] dst_alloc+0x105/0x170 [ 885.677494][T17061] ip_route_output_key_hash_rcu+0x1560/0x23e0 [ 885.677527][T17061] ? ip_route_output_key_hash+0xc1/0x280 [ 885.677550][T17061] ip_route_output_key_hash+0x174/0x280 [ 885.677576][T17061] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 885.677609][T17061] ? __lock_acquire+0xab9/0xd20 [ 885.677637][T17061] ip_route_output_flow+0x2a/0x150 [ 885.677655][T17061] ? security_sk_classify_flow+0x70/0x180 [ 885.677684][T17061] __ip4_datagram_connect+0x9a5/0x1270 [ 885.677729][T17061] udp_connect+0x33/0x1f0 [ 885.677750][T17061] __sys_connect+0x316/0x440 [ 885.677773][T17061] ? __fget_files+0x3a0/0x420 [ 885.677797][T17061] ? __pfx___sys_connect+0x10/0x10 [ 885.677834][T17061] ? __pfx_ksys_write+0x10/0x10 [ 885.677861][T17061] __x64_sys_connect+0x7a/0x90 [ 885.677887][T17061] do_syscall_64+0xfa/0xfa0 [ 885.677904][T17061] ? lockdep_hardirqs_on+0x9c/0x150 [ 885.677923][T17061] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 885.677942][T17061] ? clear_bhb_loop+0x60/0xb0 [ 885.677965][T17061] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 885.677983][T17061] RIP: 0033:0x7f9877b8eec9 [ 885.678001][T17061] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 885.678018][T17061] RSP: 002b:00007f9878988038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 885.678050][T17061] RAX: ffffffffffffffda RBX: 00007f9877de5fa0 RCX: 00007f9877b8eec9 [ 885.678064][T17061] RDX: 0000000000000010 RSI: 0000200000000280 RDI: 0000000000000004 [ 885.678076][T17061] RBP: 00007f9878988090 R08: 0000000000000000 R09: 0000000000000000 [ 885.678087][T17061] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 885.678098][T17061] R13: 00007f9877de6038 R14: 00007f9877de5fa0 R15: 00007f9877f0fa28 [ 885.678131][T17061] [ 886.028960][ T5837] usb 3-1: config index 0 descriptor too short (expected 1106, got 82) [ 886.050643][ T5837] usb 3-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 136 [ 886.067250][ T5914] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 886.100967][ T5837] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 886.115891][ T5837] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 886.201155][ T5837] usb 3-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 886.217011][ T5914] usb 4-1: Using ep0 maxpacket: 8 [ 886.223551][ T5914] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 886.239379][ T5914] usb 4-1: New USB device found, idVendor=17ef, idProduct=6062, bcdDevice= 0.00 [ 886.244038][ T5837] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 886.248530][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.265981][ T5914] usb 4-1: config 0 descriptor?? [ 886.277734][ T5837] usb 3-1: Product: syz [ 886.282005][ T5837] usb 3-1: Manufacturer: syz [ 886.286771][ T5837] usb 3-1: SerialNumber: syz [ 886.309954][ T5914] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 886.332547][ T5837] usb 3-1: config 0 descriptor?? [ 886.346663][ T5837] usb-storage 3-1:0.0: USB Mass Storage device detected [ 886.371002][ T5837] usb-storage 3-1:0.0: Quirks match for vid 1908 pid 1315: 20000 [ 886.477115][T15600] usb 1-1: new full-speed USB device number 30 using dummy_hcd [ 886.527088][T15601] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 886.629470][T15600] usb 1-1: config 0 has an invalid interface number: 32 but max is 0 [ 886.638485][T15600] usb 1-1: config 0 has no interface number 0 [ 886.645937][T15600] usb 1-1: config 0 interface 32 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 886.657634][T15600] usb 1-1: config 0 interface 32 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 886.667835][T15600] usb 1-1: New USB device found, idVendor=256c, idProduct=006e, bcdDevice= 0.00 [ 886.677220][T15601] usb 6-1: Using ep0 maxpacket: 16 [ 886.682808][T15600] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.693219][T15601] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 886.716483][T15600] usb 1-1: config 0 descriptor?? [ 886.723930][T15601] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 886.744375][T15601] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 886.772382][T15601] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 886.780810][T15601] usb 6-1: Product: syz [ 886.785244][T15601] usb 6-1: Manufacturer: syz [ 886.790114][T15601] usb 6-1: SerialNumber: syz [ 886.821830][T15601] usb 6-1: config 0 descriptor?? [ 886.835855][T15601] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 886.845322][T15601] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 887.215062][T15600] uclogic 0003:256C:006E.0030: interface is invalid, ignoring [ 887.241381][T15601] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 887.257897][T15601] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 887.274632][T15601] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 887.282199][T15601] em28xx 6-1:0.0: No AC97 audio processor [ 887.407296][T17084] block device autoloading is deprecated and will be removed. [ 887.435736][ T5914] usb 1-1: USB disconnect, device number 30 [ 887.621963][ T43] usb 6-1: USB disconnect, device number 81 [ 887.628990][ T43] em28xx 6-1:0.0: Disconnecting em28xx [ 887.642210][ T43] em28xx 6-1:0.0: Freeing device [ 888.100914][T15601] usb 3-1: USB disconnect, device number 13 [ 888.215835][T17102] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 888.287270][ T43] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 888.453749][T17105] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2981'. [ 888.678547][ T43] usb 6-1: Using ep0 maxpacket: 16 [ 888.691215][ T43] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 888.745232][ T43] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 888.767557][ T43] usb 6-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 888.787200][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 888.802495][ T43] usb 6-1: config 0 descriptor?? [ 889.051807][ T5914] usb 4-1: USB disconnect, device number 2 [ 889.247961][ T43] hid (null): unknown global tag 0xe [ 889.321710][T17114] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2986'. [ 889.455200][T17090] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2977'. [ 889.647475][ T43] usb 6-1: string descriptor 0 read error: -71 [ 889.769487][ T43] usb 6-1: Max retries (5) exceeded reading string descriptor 200 [ 889.777793][ T43] letsketch 0003:6161:4D15.0031: probe with driver letsketch failed with error -32 [ 889.828053][T17120] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 889.875495][T17120] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 889.882576][ T43] usb 6-1: USB disconnect, device number 82 [ 889.901074][T17120] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 889.909432][T17120] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 889.919018][T17120] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 889.940403][ T5150] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 889.973142][ T5150] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 890.000916][ T5150] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 890.015195][ T5150] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 890.024404][ T5150] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 890.383640][T17126] vivid-000: disconnect [ 890.572898][T17117] vivid-000: reconnect [ 890.711395][T14824] dummy0: left allmulticast mode [ 890.723327][T14824] dummy0: left promiscuous mode [ 890.730525][T14824] bridge0: port 3(dummy0) entered disabled state [ 890.761139][T14824] bridge_slave_1: left allmulticast mode [ 890.777326][T14824] bridge_slave_1: left promiscuous mode [ 890.788995][T14824] bridge0: port 2(bridge_slave_1) entered disabled state [ 890.825568][T14824] bridge_slave_0: left allmulticast mode [ 890.863264][T14824] bridge_slave_0: left promiscuous mode [ 890.894717][T14824] bridge0: port 1(bridge_slave_0) entered disabled state [ 891.079691][T17141] netlink: 'syz.5.2991': attribute type 8 has an invalid length. [ 891.447207][T15601] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 891.735728][T15601] usb 4-1: Using ep0 maxpacket: 32 [ 891.750164][T15601] usb 4-1: config 0 has an invalid interface number: 66 but max is 0 [ 891.758856][T15601] usb 4-1: config 0 has no interface number 0 [ 891.768193][T15601] usb 4-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 891.777653][T15601] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 891.852909][T15601] usb 4-1: Product: syz [ 891.873433][T15601] usb 4-1: Manufacturer: syz [ 891.902503][T15601] usb 4-1: SerialNumber: syz [ 891.941408][T15601] usb 4-1: config 0 descriptor?? [ 891.957030][T15601] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 891.977198][T15601] dvb-usb: bulk message failed: -22 (2/0) [ 892.006329][T15601] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 892.065591][T15601] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 892.076282][T17120] Bluetooth: hci4: command tx timeout [ 892.085287][T15601] usb 4-1: media controller created [ 892.127714][T15601] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 892.154097][T17146] cxusb: i2c wr: len=80 is too big! [ 892.154097][T17146] [ 892.223928][T15601] cxusb: set interface failed [ 892.247080][T15601] dvb-usb: bulk message failed: -22 (1/0) [ 892.340457][T15601] DVB: Unable to find symbol lgdt330x_attach() [ 892.346683][T15601] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 892.476604][T15601] rc_core: IR keymap rc-dvico-portable not found [ 892.485858][T15601] Registered IR keymap rc-empty [ 892.491747][T14824] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 892.505226][T15601] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 892.519232][T14824] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 892.530566][T15601] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input68 [ 892.544046][T14824] bond0 (unregistering): Released all slaves [ 892.551398][T15601] dvb-usb: schedule remote query interval to 100 msecs. [ 892.567288][T15601] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 892.579128][T14824] bond1 (unregistering): Released all slaves [ 892.604819][T15601] usb 4-1: USB disconnect, device number 3 [ 892.737079][ T43] usb 1-1: new low-speed USB device number 31 using dummy_hcd [ 892.838645][T15601] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 892.920240][ T43] usb 1-1: Invalid ep0 maxpacket: 32 [ 892.926893][T14824] tipc: Left network mode [ 892.997538][T17177] FAULT_INJECTION: forcing a failure. [ 892.997538][T17177] name failslab, interval 1, probability 0, space 0, times 0 [ 893.022861][T17177] CPU: 0 UID: 0 PID: 17177 Comm: syz.5.2998 Not tainted syzkaller #0 PREEMPT(full) [ 893.022878][T17177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 893.022885][T17177] Call Trace: [ 893.022891][T17177] [ 893.022897][T17177] dump_stack_lvl+0x189/0x250 [ 893.022915][T17177] ? __pfx____ratelimit+0x10/0x10 [ 893.022936][T17177] ? __pfx_dump_stack_lvl+0x10/0x10 [ 893.022947][T17177] ? __pfx__printk+0x10/0x10 [ 893.022958][T17177] ? rcuref_put+0x1b7/0x210 [ 893.022971][T17177] ? __pfx_call_rcu+0x10/0x10 [ 893.022986][T17177] ? percpu_counter_add_batch+0xea/0x1e0 [ 893.023003][T17177] should_fail_ex+0x414/0x560 [ 893.023020][T17177] should_failslab+0xa8/0x100 [ 893.023035][T17177] kmem_cache_alloc_noprof+0x74/0x6e0 [ 893.023046][T17177] ? dst_alloc+0x105/0x170 [ 893.023059][T17177] dst_alloc+0x105/0x170 [ 893.023071][T17177] ipv4_blackhole_route+0x32/0x680 [ 893.023087][T17177] xfrm_lookup_route+0xd7/0x1c0 [ 893.023100][T17177] __ip4_datagram_connect+0x9a5/0x1270 [ 893.023124][T17177] udp_connect+0x33/0x1f0 [ 893.023136][T17177] __sys_connect+0x316/0x440 [ 893.023149][T17177] ? __fget_files+0x3a0/0x420 [ 893.023162][T17177] ? __pfx___sys_connect+0x10/0x10 [ 893.023182][T17177] ? __pfx_ksys_write+0x10/0x10 [ 893.023196][T17177] __x64_sys_connect+0x7a/0x90 [ 893.023210][T17177] do_syscall_64+0xfa/0xfa0 [ 893.023221][T17177] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 893.023231][T17177] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 893.023241][T17177] ? clear_bhb_loop+0x60/0xb0 [ 893.023253][T17177] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 893.023262][T17177] RIP: 0033:0x7f9877b8eec9 [ 893.023273][T17177] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 893.023282][T17177] RSP: 002b:00007f9878988038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 893.023300][T17177] RAX: ffffffffffffffda RBX: 00007f9877de5fa0 RCX: 00007f9877b8eec9 [ 893.023308][T17177] RDX: 0000000000000010 RSI: 0000200000000280 RDI: 0000000000000004 [ 893.023315][T17177] RBP: 00007f9878988090 R08: 0000000000000000 R09: 0000000000000000 [ 893.023321][T17177] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 893.023327][T17177] R13: 00007f9877de6038 R14: 00007f9877de5fa0 R15: 00007f9877f0fa28 [ 893.023343][T17177] [ 893.265188][ T43] usb 1-1: new low-speed USB device number 32 using dummy_hcd [ 893.488547][ T43] usb 1-1: Invalid ep0 maxpacket: 32 [ 893.500008][ T43] usb usb1-port1: attempt power cycle [ 893.513131][T17121] chnl_net:caif_netlink_parms(): no params data found [ 893.987163][ T43] usb 1-1: new low-speed USB device number 33 using dummy_hcd [ 894.140641][ T43] usb 1-1: Invalid ep0 maxpacket: 32 [ 894.147230][T17120] Bluetooth: hci4: command tx timeout [ 894.490025][ T43] usb 1-1: new low-speed USB device number 34 using dummy_hcd [ 894.548728][ T43] usb 1-1: Invalid ep0 maxpacket: 32 [ 894.557060][ T43] usb usb1-port1: unable to enumerate USB device [ 894.659251][T14824] hsr_slave_0: left promiscuous mode [ 894.665326][T14824] hsr_slave_1: left promiscuous mode [ 894.675365][T14824] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 894.686464][T14824] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 895.188929][ T43] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 895.430962][ T43] usb 5-1: too many configurations: 151, using maximum allowed: 8 [ 895.541300][ T43] usb 5-1: New USB device found, idVendor=04d8, idProduct=0082, bcdDevice=ce.b7 [ 895.570356][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=130 [ 895.600254][ T43] usb 5-1: Product: syz [ 895.611702][ T43] usb 5-1: Manufacturer: syz [ 895.621724][ T43] usb 5-1: SerialNumber: syz [ 895.657499][ T43] usb 5-1: config 0 descriptor?? [ 895.667973][T17223] loop8: detected capacity change from 0 to 8 [ 895.674600][ T43] ims_pcu 5-1:0.0: Zero length descriptor [ 895.689585][ T43] ims_pcu 5-1:0.0: probe with driver ims_pcu failed with error -22 [ 895.772852][T17223] loop8: [CUMANA/ADFS] p1 [ADFS] p1 [ 895.812556][T17223] loop8: partition table partially beyond EOD, truncated [ 895.822396][ T30] audit: type=1326 audit(1760575166.391:12697): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17225 comm="syz.3.3005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 895.877892][ T30] audit: type=1326 audit(1760575166.431:12698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17225 comm="syz.3.3005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 895.880805][T17223] loop8: p1 size 3004527350 extends beyond EOD, truncated [ 896.137296][ T43] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 896.194133][ T30] audit: type=1326 audit(1760575166.431:12699): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17225 comm="syz.3.3005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 896.290161][T17120] Bluetooth: hci4: command tx timeout [ 896.326217][ T30] audit: type=1326 audit(1760575166.431:12700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17225 comm="syz.3.3005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 896.357369][ T30] audit: type=1326 audit(1760575166.431:12701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17225 comm="syz.3.3005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 896.412211][ T43] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 896.421893][ T43] usb 4-1: config 220 has an invalid descriptor of length 255, skipping remainder of the config [ 896.435476][ T30] audit: type=1326 audit(1760575166.431:12702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17225 comm="syz.3.3005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 896.478712][ T43] usb 4-1: config 220 has no interface number 2 [ 896.490195][ T5828] udevd[5828]: inotify_add_watch(7, /dev/loop8p1, 10) failed: No such file or directory [ 896.509359][ T43] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 896.592944][ T30] audit: type=1326 audit(1760575166.431:12703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17225 comm="syz.3.3005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 896.625079][ T43] usb 4-1: config 220 interface 0 has no altsetting 0 [ 896.638609][ T43] usb 4-1: config 220 interface 76 has no altsetting 0 [ 896.645704][ T43] usb 4-1: config 220 interface 1 has no altsetting 0 [ 896.653394][ T30] audit: type=1326 audit(1760575166.431:12704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17225 comm="syz.3.3005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 896.677121][ T30] audit: type=1326 audit(1760575166.431:12705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17225 comm="syz.3.3005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 896.702015][T17230] mmap: syz.0.3007 (17230): VmData 37593088 exceed data ulimit 25. Update limits or use boot option ignore_rlimit_data. [ 896.725494][ T43] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 896.738904][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 896.749624][ T43] usb 4-1: Product: syz [ 896.753976][ T43] usb 4-1: Manufacturer: syz [ 896.759474][ T30] audit: type=1326 audit(1760575166.431:12706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17225 comm="syz.3.3005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f9ba158eec9 code=0x7ffc0000 [ 896.787086][ T43] usb 4-1: SerialNumber: syz [ 897.057266][T11413] usb 6-1: new high-speed USB device number 83 using dummy_hcd [ 897.217052][T11413] usb 6-1: Using ep0 maxpacket: 8 [ 897.228910][T11413] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 897.237411][T11413] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 897.262003][T11413] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 897.272180][T11413] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 897.295029][T11413] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 897.319260][T11413] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 897.352491][T11413] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 897.558059][T17121] bridge0: port 1(bridge_slave_0) entered blocking state [ 897.565869][T17121] bridge0: port 1(bridge_slave_0) entered disabled state [ 897.575255][T11413] usb 6-1: usb_control_msg returned -32 [ 897.588678][T11413] usbtmc 6-1:16.0: can't read capabilities [ 897.617251][T17121] bridge_slave_0: entered allmulticast mode [ 897.629243][T17121] bridge_slave_0: entered promiscuous mode [ 897.729967][T17121] bridge0: port 2(bridge_slave_1) entered blocking state [ 897.739153][T17121] bridge0: port 2(bridge_slave_1) entered disabled state [ 897.747077][T17121] bridge_slave_1: entered allmulticast mode [ 897.762114][T17121] bridge_slave_1: entered promiscuous mode [ 898.064570][T15601] usb 5-1: USB disconnect, device number 14 [ 898.080338][T17121] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 898.125880][T17121] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 898.146735][T17233] xt_limit: Overflow, try lower: 268435456/134217728 [ 898.189702][ T5837] usb 6-1: USB disconnect, device number 83 [ 898.326020][T17120] Bluetooth: hci4: command tx timeout [ 898.341451][T17121] team0: Port device team_slave_0 added [ 898.361423][T17121] team0: Port device team_slave_1 added [ 898.509374][T17121] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 898.519013][T14824] IPVS: stop unused estimator thread 0... [ 898.528576][T17121] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 898.636181][T17121] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 898.735412][T17121] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 898.751229][T17251] loop8: detected capacity change from 0 to 8 [ 898.768525][T17251] Dev loop8: unable to read RDB block 8 [ 898.772667][T17121] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 898.778275][T17251] loop8: unable to read partition table [ 898.848604][T17121] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 898.962721][ T43] usb 4-1: selecting invalid altsetting 0 [ 898.968799][T17251] loop8: partition table beyond EOD, truncated [ 899.007125][ T43] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 899.014484][ T43] uvcvideo 4-1:220.0: No valid video chain found. [ 899.034462][T17251] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 899.103738][T17121] hsr_slave_0: entered promiscuous mode [ 899.122816][T17260] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3015'. [ 899.155230][ T43] usb 4-1: selecting invalid altsetting 0 [ 899.173346][T17121] hsr_slave_1: entered promiscuous mode [ 899.182071][ T43] usbtest 4-1:220.1: probe with driver usbtest failed with error -22 [ 899.194569][T17121] debugfs: 'hsr0' already exists in 'hsr' [ 899.209606][T17262] kvm: emulating exchange as write [ 899.215517][ T43] usb 4-1: USB disconnect, device number 4 [ 899.247640][T17121] Cannot create hsr debugfs directory [ 899.278949][T17262] syz.5.3014(17262): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 899.330822][T17268] FAULT_INJECTION: forcing a failure. [ 899.330822][T17268] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 899.366229][T17268] CPU: 1 UID: 0 PID: 17268 Comm: syz.4.3016 Not tainted syzkaller #0 PREEMPT(full) [ 899.366255][T17268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 899.366265][T17268] Call Trace: [ 899.366273][T17268] [ 899.366281][T17268] dump_stack_lvl+0x189/0x250 [ 899.366304][T17268] ? __pfx____ratelimit+0x10/0x10 [ 899.366328][T17268] ? __pfx_dump_stack_lvl+0x10/0x10 [ 899.366345][T17268] ? __pfx__printk+0x10/0x10 [ 899.366372][T17268] should_fail_ex+0x414/0x560 [ 899.366401][T17268] _copy_to_user+0x31/0xb0 [ 899.366424][T17268] simple_read_from_buffer+0xe1/0x170 [ 899.366448][T17268] proc_fail_nth_read+0x1b3/0x220 [ 899.366474][T17268] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 899.366499][T17268] ? rw_verify_area+0x2a6/0x4d0 [ 899.366515][T17268] ? __lock_acquire+0xab9/0xd20 [ 899.366532][T17268] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 899.366556][T17268] vfs_read+0x200/0xa30 [ 899.366572][T17268] ? fdget_pos+0x247/0x320 [ 899.366595][T17268] ? __pfx___mutex_lock+0x10/0x10 [ 899.366614][T17268] ? __pfx_vfs_read+0x10/0x10 [ 899.366631][T17268] ? __fget_files+0x2a/0x420 [ 899.366653][T17268] ? __fget_files+0x3a0/0x420 [ 899.366670][T17268] ? __fget_files+0x2a/0x420 [ 899.366696][T17268] ksys_read+0x145/0x250 [ 899.366715][T17268] ? __pfx_ksys_read+0x10/0x10 [ 899.366735][T17268] ? do_syscall_64+0xbe/0xfa0 [ 899.366755][T17268] do_syscall_64+0xfa/0xfa0 [ 899.366769][T17268] ? lockdep_hardirqs_on+0x9c/0x150 [ 899.366785][T17268] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 899.366800][T17268] ? clear_bhb_loop+0x60/0xb0 [ 899.366819][T17268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 899.366834][T17268] RIP: 0033:0x7f3e6078d8dc [ 899.366882][T17268] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 899.366900][T17268] RSP: 002b:00007f3e616b0030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 899.366918][T17268] RAX: ffffffffffffffda RBX: 00007f3e609e5fa0 RCX: 00007f3e6078d8dc [ 899.366930][T17268] RDX: 000000000000000f RSI: 00007f3e616b00a0 RDI: 0000000000000005 [ 899.366940][T17268] RBP: 00007f3e616b0090 R08: 0000000000000000 R09: 0000000000000000 [ 899.366950][T17268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 899.366959][T17268] R13: 00007f3e609e6038 R14: 00007f3e609e5fa0 R15: 00007f3e60b0fa28 [ 899.366988][T17268] [ 900.090413][T17280] netlink: 1 bytes leftover after parsing attributes in process `syz.4.3018'. [ 900.267413][ T5914] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 900.297940][T17280] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 900.688032][T15601] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 900.746337][ T5914] usb 1-1: device descriptor read/64, error -71 [ 900.919843][T15601] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 900.929064][T15601] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 900.982397][T17121] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 900.989346][T15601] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 901.021202][T15601] usb 4-1: config 1 has no interface number 0 [ 901.026995][ T5914] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 901.039495][T17121] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 901.040075][T15601] usb 4-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 901.093887][T15601] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 901.147559][T15601] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 901.157082][T15601] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.165169][T15601] usb 4-1: Product: syz [ 901.170571][T15601] usb 4-1: Manufacturer: syz [ 901.170930][T17121] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 901.239170][T15601] usb 4-1: SerialNumber: syz [ 901.258016][ T5914] usb 1-1: Using ep0 maxpacket: 32 [ 901.267858][ T5914] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 901.288970][ T5914] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 901.307833][T17121] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 901.312386][ T5914] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 901.592848][ T5914] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 901.626389][ T5914] usb 1-1: config 0 descriptor?? [ 902.002037][T17319] netlink: 6 bytes leftover after parsing attributes in process `syz.3.3025'. [ 902.034010][T17319] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 902.077949][ T5914] ft260 0003:0403:6030.0032: unknown main item tag 0x7 [ 902.277362][ T5914] ft260 0003:0403:6030.0032: chip code: 6424 8183 [ 902.439623][T17121] 8021q: adding VLAN 0 to HW filter on device bond0 [ 902.464426][ T30] kauditd_printk_skb: 473 callbacks suppressed [ 902.464443][ T30] audit: type=1800 audit(1760575173.031:13180): pid=17342 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3028" name="SYSV00000000" dev="tmpfs" ino=3 res=0 errno=0 [ 902.484681][T17121] 8021q: adding VLAN 0 to HW filter on device team0 [ 902.510415][T15601] usb 4-1: USB disconnect, device number 5 [ 902.522120][ T5914] ft260 0003:0403:6030.0032: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.0-1/input0 [ 902.637401][ T3489] bridge0: port 1(bridge_slave_0) entered blocking state [ 902.644576][ T3489] bridge0: port 1(bridge_slave_0) entered forwarding state [ 902.661820][ T3489] bridge0: port 2(bridge_slave_1) entered blocking state [ 902.669264][ T3489] bridge0: port 2(bridge_slave_1) entered forwarding state [ 902.683882][T17346] tipc: Started in network mode [ 902.689645][T17346] tipc: Node identity ac14142f, cluster identity 4711 [ 902.697451][T17346] tipc: Enabling of bearer rejected, failed to enable media [ 902.701256][ T5914] ft260 0003:0403:6030.0032: failed to retrieve status: -32, no wakeup [ 902.786453][T17121] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 902.857328][ T5837] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 902.899597][T17121] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 902.943924][T17121] veth0_vlan: entered promiscuous mode [ 902.955737][T17121] veth1_vlan: entered promiscuous mode [ 902.962205][T17297] ft260 0003:0403:6030.0032: unsupported smbus transaction size 7 [ 902.977744][T17297] i2c i2c-1: adapter quirk: msg too long (addr 0x0000, size 27, write) [ 903.070318][T17121] veth0_macvtap: entered promiscuous mode [ 903.086133][T17121] veth1_macvtap: entered promiscuous mode [ 903.123937][ T5837] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 903.145646][ T5837] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 903.159878][ T5837] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 903.192734][ T5837] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 903.345897][T17121] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 903.369615][ T5837] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 903.391233][T17121] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 903.422275][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.469742][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.470846][ T5837] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 903.512573][ T5837] usb 5-1: config 0 descriptor?? [ 903.651317][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.705446][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 904.066812][ T5901] usb 1-1: USB disconnect, device number 36 [ 904.256665][T17375] bond4: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 904.604687][T17375] bond4 (unregistering): Released all slaves [ 905.185759][ T1085] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 905.193841][ T1085] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 905.483996][ T1085] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 905.514020][ T1085] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 906.016708][ T5837] usbhid 5-1:0.0: can't add hid device: -71 [ 906.054951][ T5837] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 906.150717][ T5837] usb 5-1: USB disconnect, device number 15 [ 906.157000][ T5901] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 906.331642][T17426] syzkaller0: create flow: hash 379320624 index 1 [ 906.347098][ T5901] usb 3-1: Using ep0 maxpacket: 32 [ 906.368079][ T5901] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 906.392509][ T5901] usb 3-1: config 0 has no interface number 0 [ 906.436753][ T1085] syzkaller0: tun_net_xmit 76 [ 906.450913][ T5901] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 906.460719][T15601] syzkaller0: tun_net_xmit 76 [ 906.467185][ T1085] syzkaller0: tun_net_xmit 48 [ 906.497392][ T5901] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 906.517161][ T5901] usb 3-1: Product: syz [ 906.525851][ T5901] usb 3-1: Manufacturer: syz [ 906.544525][ T5901] usb 3-1: SerialNumber: syz [ 906.581370][ T5901] usb 3-1: config 0 descriptor?? [ 906.608952][ T5901] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 906.635271][T17426] syzkaller0: delete flow: hash 379320624 index 1 [ 906.800196][ T5901] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 906.896253][ T5901] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 907.091003][ C1] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 907.108997][T11413] usb 3-1: USB disconnect, device number 14 [ 907.152860][ T5150] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 907.154527][T11413] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 907.174289][ T5150] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 907.197483][ T5150] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 907.223716][ T5150] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 907.231573][ T5150] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 907.306440][T11413] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 907.347840][T11413] quatech2 3-1:0.51: device disconnected [ 907.737901][T11413] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 907.910724][T11413] usb 3-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 907.935152][T11413] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 907.945726][T11413] usb 3-1: Product: syz [ 907.951209][T11413] usb 3-1: Manufacturer: syz [ 907.956233][T11413] usb 3-1: SerialNumber: syz [ 907.987612][T11413] usb 3-1: config 0 descriptor?? [ 908.001070][T11413] hub 3-1:0.0: bad descriptor, ignoring hub [ 908.009705][T11413] hub 3-1:0.0: probe with driver hub failed with error -5 [ 908.017102][T15600] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 908.187157][T15600] usb 1-1: Using ep0 maxpacket: 32 [ 908.194157][T15600] usb 1-1: New USB device found, idVendor=2133, idProduct=0018, bcdDevice= 0.00 [ 908.203458][T15600] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 908.217371][T11413] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 908.221476][T15600] usb 1-1: config 0 descriptor?? [ 908.244851][T11413] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 908.255271][T11413] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 908.268433][T11413] usb 3-1: media controller created [ 908.299866][T11413] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 908.360789][T11413] DVB: Unable to find symbol dib7000p_attach() [ 908.367150][T11413] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 908.497034][T11413] rc_core: IR keymap rc-dib0700-rc5 not found [ 908.503444][T11413] Registered IR keymap rc-empty [ 908.513931][T11413] dvb-usb: could not initialize remote control. [ 908.520518][T11413] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 908.646287][T11413] usb 3-1: USB disconnect, device number 15 [ 908.658507][T15600] viewsonic 0003:2133:0018.0033: item fetching failed at offset 0/4 [ 908.683729][T15600] viewsonic 0003:2133:0018.0033: probe with driver viewsonic failed with error -22 [ 908.719843][T11413] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 908.873192][ T5914] usb 1-1: USB disconnect, device number 37 [ 909.268000][T17120] Bluetooth: hci1: command tx timeout [ 910.403508][T17466] bridge0: port 2(bridge_slave_1) entered disabled state [ 910.411318][T17466] bridge0: port 1(bridge_slave_0) entered disabled state [ 911.273041][T17466] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 911.359694][T17120] Bluetooth: hci1: command tx timeout [ 911.508560][T17466] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 911.972534][T17467] bridge1: entered promiscuous mode [ 912.197869][T14816] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 912.244465][T14810] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 912.289349][T14810] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 912.386224][T14810] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 912.412932][T14810] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 912.474470][T14816] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 912.541090][T17512] netlink: 68 bytes leftover after parsing attributes in process `syz.5.3058'. [ 912.552633][T17512] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3058'. [ 912.738025][T17517] vivid-000: disconnect [ 912.760792][T15600] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 912.779332][T14816] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 912.927103][T15600] usb 5-1: Using ep0 maxpacket: 8 [ 912.933934][T15600] usb 5-1: config 0 has an invalid interface number: 155 but max is 1 [ 912.944971][T15600] usb 5-1: config 0 has an invalid interface number: 245 but max is 1 [ 912.977667][T15600] usb 5-1: config 0 has no interface number 0 [ 912.983928][T15600] usb 5-1: config 0 has no interface number 1 [ 912.990586][T15600] usb 5-1: config 0 interface 155 has no altsetting 0 [ 912.997870][T15600] usb 5-1: config 0 interface 245 has no altsetting 0 [ 913.005163][T15600] usb 5-1: New USB device found, idVendor=04c8, idProduct=0720, bcdDevice=b8.b6 [ 913.137390][T17498] vivid-000: reconnect [ 913.177166][T15600] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 913.215519][T15600] usb 5-1: config 0 descriptor?? [ 913.427244][T17120] Bluetooth: hci1: command tx timeout [ 913.575941][T17520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 913.688502][T17520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 913.719809][T14816] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 914.271294][T17526] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 914.353044][T14816] dummy0: left allmulticast mode [ 914.364548][T14816] dummy0: left promiscuous mode [ 914.382861][T14816] bridge0: port 3(dummy0) entered disabled state [ 914.418703][T14816] bridge_slave_1: left allmulticast mode [ 914.424477][T14816] bridge_slave_1: left promiscuous mode [ 914.432739][T14816] bridge0: port 2(bridge_slave_1) entered disabled state [ 914.445131][T14816] bridge_slave_0: left allmulticast mode [ 914.451410][T14816] bridge_slave_0: left promiscuous mode [ 914.457740][T14816] bridge0: port 1(bridge_slave_0) entered disabled state [ 914.597246][ T5914] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 914.773675][ T5914] usb 3-1: Using ep0 maxpacket: 8 [ 914.807761][ T5914] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 914.846607][ T5914] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 915.012320][ T5914] pvrusb2: Hardware description: Terratec Grabster AV400 [ 915.032061][T14816] erspan0 (unregistering): left allmulticast mode [ 915.099639][ T5914] pvrusb2: ********** [ 915.149746][ T5914] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 915.162765][T14816] bond1 (unregistering): (slave gretap1): Releasing active interface [ 915.270073][T14816] bond3 (unregistering): (slave gretap2): Releasing active interface [ 915.310450][ T5914] pvrusb2: Important functionality might not be entirely working. [ 915.537152][T17120] Bluetooth: hci1: command tx timeout [ 915.587181][ T5914] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 915.599126][ T5914] pvrusb2: ********** [ 915.694891][T15600] usb 5-1: string descriptor 0 read error: -71 [ 915.823615][T15600] usb 5-1: USB disconnect, device number 16 [ 916.593450][ T2345] pvrusb2: Invalid write control endpoint [ 916.607284][ T5837] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 916.636199][ T5914] usb 3-1: USB disconnect, device number 16 [ 916.700762][T14816] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 916.753161][T14816] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 916.772195][ T5837] usb 5-1: config 8 has an invalid interface number: 223 but max is 0 [ 916.780958][ T5837] usb 5-1: config 8 has no interface number 0 [ 916.790741][ T5837] usb 5-1: config 8 interface 223 altsetting 0 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 916.956741][T14816] bond0 (unregistering): Released all slaves [ 916.970067][ T5837] usb 5-1: config 8 interface 223 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 916.970835][ T2345] pvrusb2: Invalid write control endpoint [ 916.989710][ T5837] usb 5-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d [ 916.999239][ T2345] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 917.017943][ T2345] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 917.054676][ T2345] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 917.056201][ T5837] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 917.069723][ T2345] pvrusb2: Device being rendered inoperable [ 917.099673][ T5837] usb 5-1: Product: syz [ 917.127797][ T5837] usb 5-1: Manufacturer: syz [ 917.128558][ T2345] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 917.132527][ T5837] usb 5-1: SerialNumber: syz [ 917.147315][ T2345] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 917.184187][ T2345] pvrusb2: Attached sub-driver cx25840 [ 917.189924][ T2345] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 917.201129][ T2345] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 917.558451][T14816] bond1 (unregistering): Released all slaves [ 917.614361][T14816] bond2 (unregistering): Released all slaves [ 917.706113][T14816] bond3 (unregistering): Released all slaves [ 917.963556][T14816] bond4 (unregistering): Released all slaves [ 918.140298][T14816] bond5 (unregistering): Released all slaves [ 918.196186][T17440] chnl_net:caif_netlink_parms(): no params data found [ 918.397159][T14816] tipc: Left network mode [ 918.801228][T14816] hsr_slave_0: left promiscuous mode [ 918.813249][T14816] hsr_slave_1: left promiscuous mode [ 918.830981][T14816] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 918.847711][T14816] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 918.863623][T14816] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 918.885344][T14816] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 919.010868][T14816] veth1_macvtap: left promiscuous mode [ 919.017786][T14816] veth0_macvtap: left promiscuous mode [ 919.336580][ T5837] usb 5-1: USB disconnect, device number 17 [ 919.682860][T17607] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3073'. [ 919.732831][T17607] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3073'. [ 920.437333][T17619] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3076'. [ 920.455337][T17619] netlink: 'syz.4.3076': attribute type 3 has an invalid length. [ 920.612015][T17619] openvswitch: netlink: Port -1 exceeds max allowable 65535 [ 920.659860][T14816] team0 (unregistering): Port device team_slave_1 removed [ 920.838541][T14816] team0 (unregistering): Port device team_slave_0 removed [ 922.521247][T17440] bridge0: port 1(bridge_slave_0) entered blocking state [ 922.559597][T17440] bridge0: port 1(bridge_slave_0) entered disabled state [ 922.579430][T17440] bridge_slave_0: entered allmulticast mode [ 922.591379][T17440] bridge_slave_0: entered promiscuous mode [ 922.774242][T17440] bridge0: port 2(bridge_slave_1) entered blocking state [ 922.806684][T17440] bridge0: port 2(bridge_slave_1) entered disabled state [ 922.837308][T17440] bridge_slave_1: entered allmulticast mode [ 922.863306][T17440] bridge_slave_1: entered promiscuous mode [ 923.001954][T17440] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 923.120349][T17440] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 923.448842][T17440] team0: Port device team_slave_0 added [ 923.877727][T17440] team0: Port device team_slave_1 added [ 924.093048][T17440] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 924.132145][T17440] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 924.196729][T17440] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 924.232590][T17440] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 924.357253][T17440] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 924.514601][T17440] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 924.787686][T17690] loop8: detected capacity change from 0 to 8 [ 924.817408][T17690] Dev loop8: unable to read RDB block 8 [ 924.829307][T17440] hsr_slave_0: entered promiscuous mode [ 924.839928][T17440] hsr_slave_1: entered promiscuous mode [ 924.845937][T17690] loop8: unable to read partition table [ 924.856649][T17440] debugfs: 'hsr0' already exists in 'hsr' [ 924.865758][T17690] loop8: partition table beyond EOD, truncated [ 924.875431][T17440] Cannot create hsr debugfs directory [ 924.906489][T17690] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 924.959193][T11413] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 925.127717][T11413] usb 1-1: Using ep0 maxpacket: 16 [ 925.135334][T11413] usb 1-1: config index 0 descriptor too short (expected 16456, got 72) [ 925.145373][T11413] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 925.153972][T11413] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 925.224941][T11413] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 925.259262][T11413] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 925.302513][T11413] usb 1-1: config 0 has no interface number 0 [ 925.341321][T11413] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 925.366819][T11413] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 925.378032][T11413] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 925.388586][T11413] usb 1-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 925.402605][T11413] usb 1-1: config 0 interface 125 has no altsetting 0 [ 925.426657][T11413] usb 1-1: config 0 interface 125 has no altsetting 2 [ 925.449929][T11413] usb 1-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 925.459384][T11413] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 925.485591][T11413] usb 1-1: Product: syz [ 925.500551][T11413] usb 1-1: Manufacturer: syz [ 925.516770][T11413] usb 1-1: SerialNumber: syz [ 925.549307][T11413] usb 1-1: config 0 descriptor?? [ 925.571702][T11413] usb 1-1: selecting invalid altsetting 2 [ 925.774357][T17682] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3091'. [ 926.177104][T15601] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 926.461534][T15601] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 926.619120][T15601] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 926.635409][T11413] get_1284_register timeout [ 926.641954][ C1] usb 1-1: async_complete: urb error -104 [ 926.647939][ C1] usb 1-1: async_complete: urb error -104 [ 926.653834][ C1] usb 1-1: async_complete: urb error -104 [ 926.659654][ C1] usb 1-1: async_complete: urb error -104 [ 926.717094][T11413] uss720 1-1:0.125: probe with driver uss720 failed with error -5 [ 926.720071][T15601] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 926.858047][T15601] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 926.961426][T17712] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 927.003940][T15601] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 927.207710][T17712] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 927.218720][T17712] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 927.307219][T17440] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 927.515673][T17712] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 927.524197][ T30] audit: type=1326 audit(1760575198.081:13181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17707 comm="syz.5.3097" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9877b8eec9 code=0x7ffc0000 [ 927.550403][T17712] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 927.574687][ T30] audit: type=1326 audit(1760575198.081:13182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17707 comm="syz.5.3097" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f9877b8d710 code=0x7ffc0000 [ 927.609641][T17440] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 927.623089][ T30] audit: type=1326 audit(1760575198.081:13183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17707 comm="syz.5.3097" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f9877b8eacb code=0x7ffc0000 [ 927.668120][T17440] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 927.730940][ T30] audit: type=1326 audit(1760575198.081:13184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17707 comm="syz.5.3097" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f9877b8eacb code=0x7ffc0000 [ 927.782809][ T30] audit: type=1326 audit(1760575198.131:13185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17707 comm="syz.5.3097" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9877b8eec9 code=0x7ffc0000 [ 927.786499][T15601] usb 1-1: USB disconnect, device number 38 [ 927.846651][T17440] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 927.883397][ T30] audit: type=1326 audit(1760575198.141:13186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17707 comm="syz.5.3097" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9877b8eec9 code=0x7ffc0000 [ 928.177982][T17755] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3104'. [ 928.188199][T17755] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3104'. [ 928.320703][T17440] 8021q: adding VLAN 0 to HW filter on device bond0 [ 928.387947][T17440] 8021q: adding VLAN 0 to HW filter on device team0 [ 928.468025][T14813] bridge0: port 1(bridge_slave_0) entered blocking state [ 928.475247][T14813] bridge0: port 1(bridge_slave_0) entered forwarding state [ 928.506861][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 928.514143][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 928.634801][T17440] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 928.809201][T17440] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 928.863880][ T5914] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 928.897618][T15601] usb 6-1: USB disconnect, device number 84 [ 929.008518][ T5914] usb 5-1: device descriptor read/64, error -71 [ 929.075125][T17440] veth0_vlan: entered promiscuous mode [ 929.190773][T17440] veth1_vlan: entered promiscuous mode [ 929.277433][ T5914] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 929.403913][T17440] veth0_macvtap: entered promiscuous mode [ 929.457063][ T5914] usb 5-1: device descriptor read/64, error -71 [ 929.471483][T17440] veth1_macvtap: entered promiscuous mode [ 929.553991][T17777] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3108'. [ 929.588056][ T5914] usb usb5-port1: attempt power cycle [ 929.651063][T17781] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3108'. [ 929.705845][T17783] fuse: Bad value for 'fd' [ 929.710505][T17781] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3108'. [ 929.720158][T17777] bond4: option updelay: invalid value (18446744073072017407) [ 929.728040][T17777] bond4: option updelay: allowed values 0 - 2147483647 [ 929.737736][T17777] bond4 (unregistering): Released all slaves [ 929.764366][T17440] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 929.826320][T17440] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 929.930450][ T1085] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 929.947536][ T5914] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 929.975771][ T1085] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 929.985535][ T5914] usb 5-1: device descriptor read/8, error -71 [ 930.006568][T17790] netdevsim netdevsim5 : renamed from netdevsim0 (while UP) [ 930.078147][ T1085] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 930.130363][ T1085] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 930.231039][ T5914] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 930.292508][ T5914] usb 5-1: device descriptor read/8, error -71 [ 930.339295][T17799] loop8: detected capacity change from 0 to 8 [ 930.372602][T17799] loop8: [CUMANA/ADFS] p1 [ADFS] p1 [ 930.392907][ T1085] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 930.417980][ T5914] usb usb5-port1: unable to enumerate USB device [ 930.428448][ T1085] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 930.441782][T17799] loop8: partition table partially beyond EOD, truncated [ 930.457286][T17799] loop8: p1 size 3004527350 extends beyond EOD, truncated [ 930.541860][ T5828] udevd[5828]: inotify_add_watch(7, /dev/loop8p1, 10) failed: No such file or directory [ 930.568244][ T1085] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 930.579755][ T1085] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 930.790284][T17806] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3113'. [ 931.592073][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.598490][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.236068][ T5150] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 932.247294][ T5150] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 932.255935][ T5150] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 932.267177][ T5150] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 932.274864][ T5150] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 932.421789][T17836] dummy0: mtu less than device minimum [ 932.526252][T17838] bond1: option packets_per_slave: mode dependency failed, not supported in mode balance-xor(2) [ 932.542666][T17838] bond1 (unregistering): Released all slaves [ 933.158923][T11413] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 933.231223][T17840] chnl_net:caif_netlink_parms(): no params data found [ 933.307694][T11413] usb 6-1: device descriptor read/64, error -71 [ 933.476251][ T5901] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 933.517842][T17840] bridge0: port 1(bridge_slave_0) entered blocking state [ 933.526250][T17840] bridge0: port 1(bridge_slave_0) entered disabled state [ 933.534953][T17840] bridge_slave_0: entered allmulticast mode [ 933.542670][T17840] bridge_slave_0: entered promiscuous mode [ 933.553576][T17840] bridge0: port 2(bridge_slave_1) entered blocking state [ 933.561156][T17840] bridge0: port 2(bridge_slave_1) entered disabled state [ 933.569157][T17840] bridge_slave_1: entered allmulticast mode [ 933.576364][T17840] bridge_slave_1: entered promiscuous mode [ 933.607007][T11413] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 933.628487][ T5901] usb 4-1: config 0 has an invalid interface number: 128 but max is 0 [ 933.637273][ T5901] usb 4-1: config 0 has no interface number 0 [ 933.652309][ T5901] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 933.661918][ T5901] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 933.676819][ T5901] usb 4-1: Product: syz [ 933.683488][T17840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 933.693074][ T5901] usb 4-1: Manufacturer: syz [ 933.698227][ T5901] usb 4-1: SerialNumber: syz [ 933.705724][T17840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 933.718375][ T5901] usb 4-1: config 0 descriptor?? [ 933.737235][T11413] usb 6-1: device descriptor read/64, error -71 [ 933.783019][T17840] team0: Port device team_slave_0 added [ 933.798501][T17840] team0: Port device team_slave_1 added [ 933.847521][T11413] usb usb6-port1: attempt power cycle [ 933.855625][T17840] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 933.875116][T17840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 933.931257][T17855] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 933.950936][T17855] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 934.068982][T17840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 934.084100][T17840] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 934.091998][T17840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 934.187107][T11413] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 934.195495][T17840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 934.208179][T11413] usb 6-1: device descriptor read/8, error -71 [ 934.269783][ T5901] usb 4-1: Firmware version (0.0) predates our first public release. [ 934.283191][ T5901] usb 4-1: Please update to version 0.2 or newer [ 934.307661][T17120] Bluetooth: hci3: command tx timeout [ 934.418250][T17840] hsr_slave_0: entered promiscuous mode [ 934.428152][T17840] hsr_slave_1: entered promiscuous mode [ 934.447062][T11413] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 934.465688][T17840] debugfs: 'hsr0' already exists in 'hsr' [ 934.474084][ T5901] usb 4-1: USB disconnect, device number 6 [ 934.511724][T17840] Cannot create hsr debugfs directory [ 934.530019][T11413] usb 6-1: device descriptor read/8, error -71 [ 934.642605][T11413] usb usb6-port1: unable to enumerate USB device [ 935.092670][T17887] loop8: detected capacity change from 0 to 8 [ 935.121839][T17887] loop8: [CUMANA/ADFS] p1 [ADFS] p1 [ 935.127991][T17887] loop8: partition table partially beyond EOD, truncated [ 935.135706][T17887] loop8: p1 size 3004527350 extends beyond EOD, truncated [ 935.570216][T17897] macvlan2: entered promiscuous mode [ 935.597726][T17897] macvlan2: entered allmulticast mode [ 935.887127][ T5901] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 936.229224][ T5901] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 936.254167][ T5901] usb 5-1: config 0 has no interface number 0 [ 936.287943][ T5901] usb 5-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice=fe.ea [ 936.319730][ T5901] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 936.367344][ T5901] usb 5-1: Product: syz [ 936.378833][ T5901] usb 5-1: Manufacturer: syz [ 936.383481][ T5901] usb 5-1: SerialNumber: syz [ 936.407778][ T5901] usb 5-1: config 0 descriptor?? [ 936.417626][T17120] Bluetooth: hci3: command tx timeout [ 936.435301][ T5901] usb 5-1: unknown interface protocol 0xf6, assuming v1 [ 936.447490][ T5901] usb 5-1: cannot find UAC_HEADER [ 936.535840][ T5901] snd-usb-audio 5-1:0.143: probe with driver snd-usb-audio failed with error -22 [ 936.556537][T17840] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 936.594394][T17840] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 936.633013][ T5828] udevd[5828]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.143/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 936.656426][ T5901] usb 5-1: USB disconnect, device number 22 [ 936.702587][T17916] netlink: 'syz.2.3129': attribute type 6 has an invalid length. [ 936.711659][ T5837] usb 6-1: new high-speed USB device number 89 using dummy_hcd [ 936.771917][T17840] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 936.903618][ T5837] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 936.908095][T17840] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 936.915183][ T5837] usb 6-1: config 27 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 936.956055][ T5837] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 937.012220][ T5837] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 937.053398][ T5837] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 937.064309][ T5837] usb 6-1: invalid MIDI out EP 0 [ 937.351687][T17931] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 937.358239][T17931] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 937.368151][T17931] vhci_hcd vhci_hcd.0: Device attached [ 937.459380][T17910] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 937.472555][T17910] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 937.547470][ T5901] vhci_hcd: vhci_device speed not set [ 937.607138][T11413] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 937.627007][ T5901] usb 41-1: new full-speed USB device number 2 using vhci_hcd [ 937.630843][T17840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 937.711524][ T5837] snd-usb-audio 6-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 937.725565][T17840] 8021q: adding VLAN 0 to HW filter on device team0 [ 937.794024][T14816] bridge0: port 1(bridge_slave_0) entered blocking state [ 937.801233][T14816] bridge0: port 1(bridge_slave_0) entered forwarding state [ 937.828388][T11413] usb 4-1: Using ep0 maxpacket: 8 [ 937.834999][T11413] usb 4-1: config 5 has an invalid interface number: 72 but max is 0 [ 937.844008][T11413] usb 4-1: config 5 has no interface number 0 [ 937.852715][T11413] usb 4-1: config 5 interface 72 has no altsetting 0 [ 937.868845][T11413] usb 4-1: New USB device found, idVendor=1b3d, idProduct=01cd, bcdDevice= 8.00 [ 937.878332][T11413] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 937.888351][T11413] usb 4-1: Product: syz [ 937.892595][T11413] usb 4-1: Manufacturer: syz [ 937.898124][T11413] usb 4-1: SerialNumber: syz [ 937.997941][ T1085] bridge0: port 2(bridge_slave_1) entered blocking state [ 938.005213][ T1085] bridge0: port 2(bridge_slave_1) entered forwarding state [ 938.169517][T17840] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 938.213419][T17840] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 938.283112][T17934] vhci_hcd: connection reset by peer [ 938.430321][ T60] vhci_hcd: stop threads [ 938.442681][ T60] vhci_hcd: release socket [ 938.468086][T17120] Bluetooth: hci3: command tx timeout [ 938.486191][ T60] vhci_hcd: disconnect device [ 938.508900][T17840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 938.746402][T17840] veth0_vlan: entered promiscuous mode [ 938.765279][T17840] veth1_vlan: entered promiscuous mode [ 938.849679][T17840] veth0_macvtap: entered promiscuous mode [ 938.861783][T17840] veth1_macvtap: entered promiscuous mode [ 938.884638][T17840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 938.902441][T17840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 938.971566][ T60] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 938.983157][T17929] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 938.994689][ T60] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 939.030888][T17929] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 939.053820][ T60] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 939.093350][ T60] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 939.134428][T11413] ftdi_sio 4-1:5.72: FTDI USB Serial Device converter detected [ 939.154899][T11413] usb 4-1: Detected FT4232H [ 939.207694][T11413] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 939.365937][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 939.385687][T11413] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 939.402724][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 939.455765][ T5914] usb 6-1: USB disconnect, device number 89 [ 939.466126][T11413] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 939.467364][T14813] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 939.513509][T14813] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 939.525280][T11413] usb 4-1: USB disconnect, device number 7 [ 939.552411][T11413] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 939.609195][T11413] ftdi_sio 4-1:5.72: device disconnected [ 939.792610][T17947] loop8: detected capacity change from 0 to 8 [ 939.813183][T17947] Dev loop8: unable to read RDB block 8 [ 939.831858][T17947] loop8: unable to read partition table [ 939.843428][T17947] loop8: partition table beyond EOD, truncated [ 939.853662][T17947] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 940.006508][T17952] FAULT_INJECTION: forcing a failure. [ 940.006508][T17952] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 940.052267][T17954] tipc: Started in network mode [ 940.065754][T17952] CPU: 1 UID: 0 PID: 17952 Comm: syz.5.3138 Not tainted syzkaller #0 PREEMPT(full) [ 940.065780][T17952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 940.065791][T17952] Call Trace: [ 940.065800][T17952] [ 940.065810][T17952] dump_stack_lvl+0x189/0x250 [ 940.065835][T17952] ? __pfx____ratelimit+0x10/0x10 [ 940.065862][T17952] ? __pfx_dump_stack_lvl+0x10/0x10 [ 940.065882][T17952] ? __pfx__printk+0x10/0x10 [ 940.065915][T17952] should_fail_ex+0x414/0x560 [ 940.065947][T17952] _copy_from_user+0x2d/0xb0 [ 940.065973][T17952] proc_do_submiturb+0xc84/0x37c0 [ 940.066011][T17952] ? proc_do_submiturb+0x4e1/0x37c0 [ 940.066048][T17952] proc_submiturb+0x10e/0x160 [ 940.066074][T17952] ? __pfx_proc_submiturb+0x10/0x10 [ 940.066116][T17952] usbdev_ioctl+0x10d8/0x20b0 [ 940.066144][T17952] ? __fget_files+0x2a/0x420 [ 940.066166][T17952] ? __pfx_usbdev_ioctl+0x10/0x10 [ 940.066188][T17952] ? __fget_files+0x3a0/0x420 [ 940.066208][T17952] ? __fget_files+0x2a/0x420 [ 940.066232][T17952] ? bpf_lsm_file_ioctl+0x9/0x20 [ 940.066257][T17952] ? __pfx_usbdev_ioctl+0x10/0x10 [ 940.066277][T17952] __se_sys_ioctl+0xfc/0x170 [ 940.066298][T17952] do_syscall_64+0xfa/0xfa0 [ 940.066315][T17952] ? lockdep_hardirqs_on+0x9c/0x150 [ 940.066334][T17952] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 940.066355][T17952] ? clear_bhb_loop+0x60/0xb0 [ 940.066378][T17952] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 940.066396][T17952] RIP: 0033:0x7f9877b8eec9 [ 940.066413][T17952] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 940.066429][T17952] RSP: 002b:00007f9878988038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 940.066451][T17952] RAX: ffffffffffffffda RBX: 00007f9877de5fa0 RCX: 00007f9877b8eec9 [ 940.066466][T17952] RDX: 0000200000000000 RSI: 000000008038550a RDI: 0000000000000003 [ 940.066478][T17952] RBP: 00007f9878988090 R08: 0000000000000000 R09: 0000000000000000 [ 940.066495][T17952] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 940.066506][T17952] R13: 00007f9877de6038 R14: 00007f9877de5fa0 R15: 00007f9877f0fa28 [ 940.066537][T17952] [ 940.297627][T17954] tipc: Node identity , cluster identity 4711 [ 940.364967][T17954] tipc: Failed to obtain node identity [ 940.564056][T17120] Bluetooth: hci3: command tx timeout [ 940.569802][T17954] tipc: Enabling of bearer rejected, failed to enable media [ 941.001510][T17970] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 941.007775][ T5150] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 941.022097][ T5150] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 941.025459][T17970] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 941.047453][ T5150] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 941.062831][ T5150] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 941.078750][ T5150] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 941.115864][T17974] ipvlan2: entered promiscuous mode [ 941.197168][T17974] ipvlan2: entered allmulticast mode [ 941.202513][T17974] syz_tun: entered allmulticast mode [ 941.227396][ T5914] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 941.407056][ T5914] usb 6-1: Using ep0 maxpacket: 8 [ 941.413883][ T5914] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 941.449886][ T5914] usb 6-1: New USB device found, idVendor=1b1c, idProduct=1b25, bcdDevice= 0.00 [ 941.456312][T17977] vivid-000: disconnect [ 941.543508][ T5914] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 941.620368][ T5914] usb 6-1: config 0 descriptor?? [ 941.807268][T17958] vivid-000: reconnect [ 942.099499][T14813] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 942.206629][ T5914] usbhid 6-1:0.0: can't add hid device: -71 [ 942.239622][ T5914] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 942.353146][ T5914] usb 6-1: USB disconnect, device number 90 [ 942.397036][T15601] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 942.408785][T14813] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 942.483539][T17996] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 942.607578][T15601] usb 3-1: Using ep0 maxpacket: 8 [ 942.795539][T15601] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 942.811377][T15601] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 942.901819][ T5901] vhci_hcd: vhci_device speed not set [ 942.964488][T17999] FAULT_INJECTION: forcing a failure. [ 942.964488][T17999] name failslab, interval 1, probability 0, space 0, times 0 [ 942.987735][T17999] CPU: 1 UID: 0 PID: 17999 Comm: syz.5.3150 Not tainted syzkaller #0 PREEMPT(full) [ 942.987759][T17999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 942.987766][T17999] Call Trace: [ 942.987771][T17999] [ 942.987777][T17999] dump_stack_lvl+0x189/0x250 [ 942.987794][T17999] ? __pfx____ratelimit+0x10/0x10 [ 942.987809][T17999] ? __pfx_dump_stack_lvl+0x10/0x10 [ 942.987820][T17999] ? __pfx__printk+0x10/0x10 [ 942.987833][T17999] ? __pfx___might_resched+0x10/0x10 [ 942.987849][T17999] should_fail_ex+0x414/0x560 [ 942.987867][T17999] should_failslab+0xa8/0x100 [ 942.987882][T17999] __kmalloc_cache_noprof+0x6f/0x6f0 [ 942.987894][T17999] ? check_ctrlrecip+0x213/0xcc0 [ 942.987907][T17999] ? alloc_async+0x4d/0xc0 [ 942.987922][T17999] alloc_async+0x4d/0xc0 [ 942.987936][T17999] proc_do_submiturb+0xb1a/0x37c0 [ 942.987957][T17999] ? proc_do_submiturb+0x22e0/0x37c0 [ 942.987976][T17999] proc_submiturb+0x10e/0x160 [ 942.987989][T17999] ? __pfx_proc_submiturb+0x10/0x10 [ 942.988011][T17999] usbdev_ioctl+0x10d8/0x20b0 [ 942.988026][T17999] ? __fget_files+0x2a/0x420 [ 942.988038][T17999] ? __pfx_usbdev_ioctl+0x10/0x10 [ 942.988050][T17999] ? __fget_files+0x3a0/0x420 [ 942.988060][T17999] ? __fget_files+0x2a/0x420 [ 942.988074][T17999] ? bpf_lsm_file_ioctl+0x9/0x20 [ 942.988087][T17999] ? __pfx_usbdev_ioctl+0x10/0x10 [ 942.988098][T17999] __se_sys_ioctl+0xfc/0x170 [ 942.988109][T17999] do_syscall_64+0xfa/0xfa0 [ 942.988119][T17999] ? lockdep_hardirqs_on+0x9c/0x150 [ 942.988129][T17999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 942.988139][T17999] ? clear_bhb_loop+0x60/0xb0 [ 942.988154][T17999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 942.988163][T17999] RIP: 0033:0x7f9877b8eec9 [ 942.988174][T17999] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 942.988183][T17999] RSP: 002b:00007f9878988038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 942.988195][T17999] RAX: ffffffffffffffda RBX: 00007f9877de5fa0 RCX: 00007f9877b8eec9 [ 942.988202][T17999] RDX: 0000200000000000 RSI: 000000008038550a RDI: 0000000000000003 [ 942.988209][T17999] RBP: 00007f9878988090 R08: 0000000000000000 R09: 0000000000000000 [ 942.988216][T17999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 942.988222][T17999] R13: 00007f9877de6038 R14: 00007f9877de5fa0 R15: 00007f9877f0fa28 [ 942.988239][T17999] [ 943.272480][T14813] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 943.293628][T15601] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 943.353668][T15601] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 943.381804][ T5150] Bluetooth: hci5: command tx timeout [ 943.764230][T15601] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 943.806258][T15601] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 944.021541][T14813] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 944.128858][T17975] chnl_net:caif_netlink_parms(): no params data found [ 944.426975][ T5837] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 944.657469][ T5837] usb 6-1: Using ep0 maxpacket: 16 [ 944.706264][T17975] bridge0: port 1(bridge_slave_0) entered blocking state [ 944.713856][T17975] bridge0: port 1(bridge_slave_0) entered disabled state [ 944.721333][T17975] bridge_slave_0: entered allmulticast mode [ 944.729630][T17975] bridge_slave_0: entered promiscuous mode [ 944.762647][ T5837] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 944.787604][T15601] usb 3-1: usb_control_msg returned -71 [ 944.801806][T17975] bridge0: port 2(bridge_slave_1) entered blocking state [ 944.818710][T17975] bridge0: port 2(bridge_slave_1) entered disabled state [ 944.826790][T15601] usbtmc 3-1:16.0: can't read capabilities [ 944.833631][ T5837] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 944.839059][T17975] bridge_slave_1: entered allmulticast mode [ 944.865847][ T5837] usb 6-1: config 0 interface 0 has no altsetting 0 [ 944.878269][T15601] usb 3-1: USB disconnect, device number 17 [ 944.899647][ T5837] usb 6-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.00 [ 944.951204][ T5837] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 944.966850][T17975] bridge_slave_1: entered promiscuous mode [ 944.986188][ T5837] usb 6-1: config 0 descriptor?? [ 945.251666][T18017] [ 945.254028][T18017] ===================================================== [ 945.260960][T18017] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [ 945.268419][T18017] syzkaller #0 Not tainted [ 945.272828][T18017] ----------------------------------------------------- [ 945.279749][T18017] syz.5.3151/18017 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 945.287462][T18017] ffff8880559b92b8 (&new->fa_lock){....}-{3:3}, at: kill_fasync+0x199/0x4d0 [ 945.296178][T18017] [ 945.296178][T18017] and this task is already holding: [ 945.303538][T18017] ffff88802029e028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 945.313463][T18017] which would create a new lock dependency: [ 945.319347][T18017] (&client->buffer_lock){..-.}-{3:3} -> (&new->fa_lock){....}-{3:3} [ 945.327445][T18017] [ 945.327445][T18017] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 945.336879][T18017] (&client->buffer_lock){..-.}-{3:3} [ 945.336910][T18017] [ 945.336910][T18017] ... which became SOFTIRQ-irq-safe at: [ 945.349975][T18017] lock_acquire+0x120/0x360 [ 945.354574][T18017] _raw_spin_lock+0x2e/0x40 [ 945.359239][T18017] evdev_pass_values+0xb9/0xbd0 [ 945.364164][T18017] evdev_events+0x1e6/0x340 [ 945.368741][T18017] input_pass_values+0x288/0x890 [ 945.374368][T18017] input_event_dispose+0x3e5/0x6b0 [ 945.379581][T18017] input_event+0x89/0xe0 [ 945.383927][T18017] hidinput_hid_event+0x1362/0x1ca0 [ 945.389477][T18017] hid_process_event+0x4be/0x620 [ 945.394626][T18017] hid_report_raw_event+0xe91/0x16d0 [ 945.400106][T18017] hid_input_report+0x43e/0x520 [ 945.405082][T18017] hid_irq_in+0x47e/0x6d0 [ 945.409525][T18017] __usb_hcd_giveback_urb+0x376/0x540 [ 945.414984][T18017] dummy_timer+0x85f/0x44c0 [ 945.419583][T18017] __hrtimer_run_queues+0x52c/0xc60 [ 945.424877][T18017] hrtimer_run_softirq+0x187/0x2b0 [ 945.430170][T18017] handle_softirqs+0x286/0x870 [ 945.435123][T18017] __irq_exit_rcu+0xca/0x1f0 [ 945.439802][T18017] irq_exit_rcu+0x9/0x30 [ 945.444222][T18017] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 945.449956][T18017] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 945.456028][T18017] pv_native_safe_halt+0x13/0x20 [ 945.461059][T18017] default_idle+0x13/0x20 [ 945.465501][T18017] default_idle_call+0x73/0xb0 [ 945.470360][T18017] do_idle+0x1e7/0x510 [ 945.474503][T18017] cpu_startup_entry+0x44/0x60 [ 945.479365][T18017] rest_init+0x2de/0x300 [ 945.483774][T18017] start_kernel+0x3ae/0x410 [ 945.488392][T18017] x86_64_start_reservations+0x24/0x30 [ 945.493939][T18017] x86_64_start_kernel+0x143/0x1c0 [ 945.499178][T18017] common_startup_64+0x13e/0x147 [ 945.504244][T18017] [ 945.504244][T18017] to a SOFTIRQ-irq-unsafe lock: [ 945.511275][T18017] (tasklist_lock){.+.+}-{3:3} [ 945.511311][T18017] [ 945.511311][T18017] ... which became SOFTIRQ-irq-unsafe at: [ 945.524024][T18017] ... [ 945.524034][T18017] lock_acquire+0x120/0x360 [ 945.531206][T18017] _raw_read_lock+0x36/0x50 [ 945.535825][T18017] __do_wait+0xde/0x740 [ 945.540066][T18017] do_wait+0x1f8/0x510 [ 945.544223][T18017] kernel_wait+0xab/0x170 [ 945.548638][T18017] call_usermodehelper_exec_work+0xbe/0x230 [ 945.554606][T18017] process_scheduled_works+0xae1/0x17b0 [ 945.560237][T18017] worker_thread+0x8a0/0xda0 [ 945.564920][T18017] kthread+0x711/0x8a0 [ 945.569531][T18017] ret_from_fork+0x4bc/0x870 [ 945.574231][T18017] ret_from_fork_asm+0x1a/0x30 [ 945.579091][T18017] [ 945.579091][T18017] other info that might help us debug this: [ 945.579091][T18017] [ 945.589323][T18017] Chain exists of: [ 945.589323][T18017] &client->buffer_lock --> &new->fa_lock --> tasklist_lock [ 945.589323][T18017] [ 945.602450][T18017] Possible interrupt unsafe locking scenario: [ 945.602450][T18017] [ 945.610764][T18017] CPU0 CPU1 [ 945.616126][T18017] ---- ---- [ 945.621485][T18017] lock(tasklist_lock); [ 945.625724][T18017] local_irq_disable(); [ 945.632466][T18017] lock(&client->buffer_lock); [ 945.639908][T18017] lock(&new->fa_lock); [ 945.646670][T18017] [ 945.650126][T18017] lock(&client->buffer_lock); [ 945.655142][T18017] [ 945.655142][T18017] *** DEADLOCK *** [ 945.655142][T18017] [ 945.663295][T18017] 7 locks held by syz.5.3151/18017: [ 945.668495][T18017] #0: ffff888147779118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_write+0x1a1/0x480 [ 945.677640][T18017] #1: ffff888147ac7230 (&dev->event_lock#2){..-.}-{3:3}, at: input_inject_event+0xa5/0x340 [ 945.687726][T18017] #2: ffffffff8e13d2e0 (rcu_read_lock){....}-{1:3}, at: input_inject_event+0xb6/0x340 [ 945.697902][T18017] #3: ffffffff8e13d2e0 (rcu_read_lock){....}-{1:3}, at: input_pass_values+0x8d/0x890 [ 945.707487][T18017] #4: ffffffff8e13d2e0 (rcu_read_lock){....}-{1:3}, at: evdev_events+0x79/0x340 [ 945.716642][T18017] #5: ffff88802029e028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 945.726822][T18017] #6: ffffffff8e13d2e0 (rcu_read_lock){....}-{1:3}, at: kill_fasync+0x53/0x4d0 [ 945.735961][T18017] [ 945.735961][T18017] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 945.746367][T18017] -> (&client->buffer_lock){..-.}-{3:3} { [ 945.752131][T18017] IN-SOFTIRQ-W at: [ 945.756185][T18017] lock_acquire+0x120/0x360 [ 945.762381][T18017] _raw_spin_lock+0x2e/0x40 [ 945.768634][T18017] evdev_pass_values+0xb9/0xbd0 [ 945.775153][T18017] evdev_events+0x1e6/0x340 [ 945.781677][T18017] input_pass_values+0x288/0x890 [ 945.788291][T18017] input_event_dispose+0x3e5/0x6b0 [ 945.795171][T18017] input_event+0x89/0xe0 [ 945.801094][T18017] hidinput_hid_event+0x1362/0x1ca0 [ 945.808172][T18017] hid_process_event+0x4be/0x620 [ 945.814861][T18017] hid_report_raw_event+0xe91/0x16d0 [ 945.821833][T18017] hid_input_report+0x43e/0x520 [ 945.828352][T18017] hid_irq_in+0x47e/0x6d0 [ 945.834357][T18017] __usb_hcd_giveback_urb+0x376/0x540 [ 945.841380][T18017] dummy_timer+0x85f/0x44c0 [ 945.847534][T18017] __hrtimer_run_queues+0x52c/0xc60 [ 945.854381][T18017] hrtimer_run_softirq+0x187/0x2b0 [ 945.861158][T18017] handle_softirqs+0x286/0x870 [ 945.867569][T18017] __irq_exit_rcu+0xca/0x1f0 [ 945.873806][T18017] irq_exit_rcu+0x9/0x30 [ 945.879707][T18017] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 945.886994][T18017] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 945.894638][T18017] pv_native_safe_halt+0x13/0x20 [ 945.901217][T18017] default_idle+0x13/0x20 [ 945.907305][T18017] default_idle_call+0x73/0xb0 [ 945.913735][T18017] do_idle+0x1e7/0x510 [ 945.919457][T18017] cpu_startup_entry+0x44/0x60 [ 945.925884][T18017] rest_init+0x2de/0x300 [ 945.931786][T18017] start_kernel+0x3ae/0x410 [ 945.937941][T18017] x86_64_start_reservations+0x24/0x30 [ 945.945035][T18017] x86_64_start_kernel+0x143/0x1c0 [ 945.951784][T18017] common_startup_64+0x13e/0x147 [ 945.958373][T18017] INITIAL USE at: [ 945.962256][T18017] lock_acquire+0x120/0x360 [ 945.968498][T18017] _raw_spin_lock+0x2e/0x40 [ 945.974569][T18017] evdev_pass_values+0xb9/0xbd0 [ 945.980987][T18017] evdev_events+0x1e6/0x340 [ 945.987065][T18017] input_pass_values+0x288/0x890 [ 945.993562][T18017] input_event_dispose+0x330/0x6b0 [ 946.000627][T18017] input_inject_event+0x1dd/0x340 [ 946.007218][T18017] evdev_write+0x2fc/0x480 [ 946.013203][T18017] vfs_write+0x27e/0xb30 [ 946.019008][T18017] ksys_write+0x145/0x250 [ 946.024899][T18017] do_syscall_64+0xfa/0xfa0 [ 946.030983][T18017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.038453][T18017] } [ 946.040957][T18017] ... key at: [] evdev_open.__key.25+0x0/0x20 [ 946.049105][T18017] [ 946.049105][T18017] the dependencies between the lock to be acquired [ 946.049115][T18017] and SOFTIRQ-irq-unsafe lock: [ 946.062620][T18017] -> (tasklist_lock){.+.+}-{3:3} { [ 946.067915][T18017] HARDIRQ-ON-R at: [ 946.072068][T18017] lock_acquire+0x120/0x360 [ 946.078576][T18017] _raw_read_lock+0x36/0x50 [ 946.085078][T18017] __do_wait+0xde/0x740 [ 946.091248][T18017] do_wait+0x1f8/0x510 [ 946.097354][T18017] kernel_wait+0xab/0x170 [ 946.103790][T18017] call_usermodehelper_exec_work+0xbe/0x230 [ 946.111686][T18017] process_scheduled_works+0xae1/0x17b0 [ 946.119235][T18017] worker_thread+0x8a0/0xda0 [ 946.125835][T18017] kthread+0x711/0x8a0 [ 946.131947][T18017] ret_from_fork+0x4bc/0x870 [ 946.138542][T18017] ret_from_fork_asm+0x1a/0x30 [ 946.145342][T18017] SOFTIRQ-ON-R at: [ 946.149501][T18017] lock_acquire+0x120/0x360 [ 946.156008][T18017] _raw_read_lock+0x36/0x50 [ 946.162524][T18017] __do_wait+0xde/0x740 [ 946.168768][T18017] do_wait+0x1f8/0x510 [ 946.174831][T18017] kernel_wait+0xab/0x170 [ 946.181170][T18017] call_usermodehelper_exec_work+0xbe/0x230 [ 946.189080][T18017] process_scheduled_works+0xae1/0x17b0 [ 946.196622][T18017] worker_thread+0x8a0/0xda0 [ 946.203215][T18017] kthread+0x711/0x8a0 [ 946.209282][T18017] ret_from_fork+0x4bc/0x870 [ 946.215877][T18017] ret_from_fork_asm+0x1a/0x30 [ 946.222653][T18017] INITIAL USE at: [ 946.226726][T18017] lock_acquire+0x120/0x360 [ 946.233187][T18017] _raw_write_lock_irq+0xa2/0xf0 [ 946.240042][T18017] copy_process+0x224f/0x3c00 [ 946.246661][T18017] kernel_clone+0x21e/0x840 [ 946.253073][T18017] user_mode_thread+0xdd/0x140 [ 946.259766][T18017] rest_init+0x23/0x300 [ 946.265839][T18017] start_kernel+0x3ae/0x410 [ 946.272260][T18017] x86_64_start_reservations+0x24/0x30 [ 946.279624][T18017] x86_64_start_kernel+0x143/0x1c0 [ 946.286742][T18017] common_startup_64+0x13e/0x147 [ 946.293579][T18017] INITIAL READ USE at: [ 946.298072][T18017] lock_acquire+0x120/0x360 [ 946.304912][T18017] _raw_read_lock+0x36/0x50 [ 946.311787][T18017] __do_wait+0xde/0x740 [ 946.318287][T18017] do_wait+0x1f8/0x510 [ 946.324705][T18017] kernel_wait+0xab/0x170 [ 946.331377][T18017] call_usermodehelper_exec_work+0xbe/0x230 [ 946.339605][T18017] process_scheduled_works+0xae1/0x17b0 [ 946.347489][T18017] worker_thread+0x8a0/0xda0 [ 946.354420][T18017] kthread+0x711/0x8a0 [ 946.360840][T18017] ret_from_fork+0x4bc/0x870 [ 946.367792][T18017] ret_from_fork_asm+0x1a/0x30 [ 946.374910][T18017] } [ 946.377579][T18017] ... key at: [] tasklist_lock+0x18/0x40 [ 946.385501][T18017] ... acquired at: [ 946.389477][T18017] lock_acquire+0x120/0x360 [ 946.394140][T18017] _raw_read_lock+0x36/0x50 [ 946.398814][T18017] send_sigio+0x101/0x370 [ 946.403329][T18017] dnotify_handle_event+0x169/0x440 [ 946.408793][T18017] fsnotify+0x1814/0x1a80 [ 946.413280][T18017] vfs_mkdir+0x477/0x510 [ 946.417687][T18017] do_mkdirat+0x247/0x590 [ 946.422188][T18017] __x64_sys_mkdirat+0x87/0xa0 [ 946.427208][T18017] do_syscall_64+0xfa/0xfa0 [ 946.431933][T18017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.438008][T18017] [ 946.440341][T18017] -> (&f_owner->lock){....}-{3:3} { [ 946.445639][T18017] INITIAL USE at: [ 946.449617][T18017] lock_acquire+0x120/0x360 [ 946.455869][T18017] _raw_write_lock_irq+0xa2/0xf0 [ 946.462542][T18017] __f_setown+0x67/0x370 [ 946.468527][T18017] fcntl_dirnotify+0x3fa/0x6a0 [ 946.475041][T18017] do_fcntl+0x6d0/0x1910 [ 946.481055][T18017] __se_sys_fcntl+0xc8/0x150 [ 946.487468][T18017] do_syscall_64+0xfa/0xfa0 [ 946.493788][T18017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.501419][T18017] INITIAL READ USE at: [ 946.505836][T18017] lock_acquire+0x120/0x360 [ 946.512528][T18017] _raw_read_lock_irqsave+0xaf/0x100 [ 946.519975][T18017] send_sigio+0x38/0x370 [ 946.526385][T18017] dnotify_handle_event+0x169/0x440 [ 946.533785][T18017] fsnotify+0x1814/0x1a80 [ 946.540326][T18017] vfs_mkdir+0x477/0x510 [ 946.546762][T18017] do_mkdirat+0x247/0x590 [ 946.553259][T18017] __x64_sys_mkdirat+0x87/0xa0 [ 946.560228][T18017] do_syscall_64+0xfa/0xfa0 [ 946.566985][T18017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.575075][T18017] } [ 946.577655][T18017] ... key at: [] file_f_owner_allocate.__key+0x0/0x20 [ 946.586602][T18017] ... acquired at: [ 946.590504][T18017] lock_acquire+0x120/0x360 [ 946.595187][T18017] _raw_read_lock_irqsave+0xaf/0x100 [ 946.600642][T18017] send_sigio+0x38/0x370 [ 946.605073][T18017] kill_fasync+0x24d/0x4d0 [ 946.609663][T18017] sock_wake_async+0x137/0x160 [ 946.614599][T18017] sock_def_readable+0x3bb/0x550 [ 946.619712][T18017] queue_oob+0x452/0x4f0 [ 946.624119][T18017] unix_stream_sendmsg+0xc3f/0xdf0 [ 946.629395][T18017] __sock_sendmsg+0x21c/0x270 [ 946.634268][T18017] ____sys_sendmsg+0x52d/0x830 [ 946.639205][T18017] ___sys_sendmsg+0x21f/0x2a0 [ 946.644051][T18017] __sys_sendmmsg+0x227/0x430 [ 946.648889][T18017] __x64_sys_sendmmsg+0xa0/0xc0 [ 946.653908][T18017] do_syscall_64+0xfa/0xfa0 [ 946.658575][T18017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.664647][T18017] [ 946.666969][T18017] -> (&new->fa_lock){....}-{3:3} { [ 946.672102][T18017] INITIAL USE at: [ 946.676011][T18017] lock_acquire+0x120/0x360 [ 946.682073][T18017] _raw_write_lock_irq+0xa2/0xf0 [ 946.688601][T18017] fasync_remove_entry+0xf1/0x1c0 [ 946.695204][T18017] sock_fasync+0x85/0xf0 [ 946.701010][T18017] __fput+0x8a2/0xa70 [ 946.706552][T18017] task_work_run+0x1d4/0x260 [ 946.712718][T18017] exit_to_user_mode_loop+0xe9/0x130 [ 946.719574][T18017] do_syscall_64+0x2bd/0xfa0 [ 946.725714][T18017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.733157][T18017] INITIAL READ USE at: [ 946.737485][T18017] lock_acquire+0x120/0x360 [ 946.743977][T18017] _raw_read_lock_irqsave+0xaf/0x100 [ 946.751264][T18017] kill_fasync+0x199/0x4d0 [ 946.757670][T18017] vcs_notifier+0x14b/0x1f0 [ 946.764172][T18017] notifier_call_chain+0x1b6/0x3e0 [ 946.771272][T18017] atomic_notifier_call_chain+0xda/0x180 [ 946.778909][T18017] vcs_scr_updated+0x8c/0xd0 [ 946.785605][T18017] vcs_write+0x105f/0x1260 [ 946.792044][T18017] vfs_write+0x27e/0xb30 [ 946.798278][T18017] ksys_write+0x145/0x250 [ 946.804604][T18017] do_syscall_64+0xfa/0xfa0 [ 946.811188][T18017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.819088][T18017] } [ 946.821581][T18017] ... key at: [] fasync_insert_entry.__key+0x0/0x20 [ 946.830238][T18017] ... acquired at: [ 946.834024][T18017] lock_acquire+0x120/0x360 [ 946.838690][T18017] _raw_read_lock_irqsave+0xaf/0x100 [ 946.844160][T18017] kill_fasync+0x199/0x4d0 [ 946.848753][T18017] evdev_pass_values+0x627/0xbd0 [ 946.853867][T18017] evdev_events+0x1e6/0x340 [ 946.858546][T18017] input_pass_values+0x288/0x890 [ 946.863741][T18017] input_event_dispose+0x330/0x6b0 [ 946.869078][T18017] input_inject_event+0x1dd/0x340 [ 946.874378][T18017] evdev_write+0x2fc/0x480 [ 946.878966][T18017] vfs_write+0x27e/0xb30 [ 946.883435][T18017] ksys_write+0x145/0x250 [ 946.888036][T18017] do_syscall_64+0xfa/0xfa0 [ 946.892715][T18017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.898795][T18017] [ 946.901313][T18017] [ 946.901313][T18017] stack backtrace: [ 946.907222][T18017] CPU: 1 UID: 0 PID: 18017 Comm: syz.5.3151 Not tainted syzkaller #0 PREEMPT(full) [ 946.907246][T18017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 946.907257][T18017] Call Trace: [ 946.907267][T18017] [ 946.907276][T18017] dump_stack_lvl+0x189/0x250 [ 946.907299][T18017] ? __pfx_dump_stack_lvl+0x10/0x10 [ 946.907310][T18017] ? __pfx__printk+0x10/0x10 [ 946.907322][T18017] validate_chain+0x1f05/0x2140 [ 946.907340][T18017] __lock_acquire+0xab9/0xd20 [ 946.907353][T18017] ? kill_fasync+0x199/0x4d0 [ 946.907372][T18017] lock_acquire+0x120/0x360 [ 946.907393][T18017] ? kill_fasync+0x199/0x4d0 [ 946.907421][T18017] _raw_read_lock_irqsave+0xaf/0x100 [ 946.907446][T18017] ? kill_fasync+0x199/0x4d0 [ 946.907460][T18017] ? __pfx__raw_read_lock_irqsave+0x10/0x10 [ 946.907472][T18017] ? do_raw_spin_lock+0x121/0x290 [ 946.907483][T18017] kill_fasync+0x199/0x4d0 [ 946.907496][T18017] ? kill_fasync+0x53/0x4d0 [ 946.907510][T18017] evdev_pass_values+0x627/0xbd0 [ 946.907533][T18017] ? evdev_pass_values+0x5c1/0xbd0 [ 946.907555][T18017] evdev_events+0x1e6/0x340 [ 946.907572][T18017] ? evdev_events+0x79/0x340 [ 946.907590][T18017] ? input_pass_values+0x8d/0x890 [ 946.907601][T18017] input_pass_values+0x288/0x890 [ 946.907612][T18017] ? input_handle_event+0x70c/0xf30 [ 946.907625][T18017] input_event_dispose+0x330/0x6b0 [ 946.907638][T18017] input_inject_event+0x1dd/0x340 [ 946.907652][T18017] ? input_inject_event+0xb6/0x340 [ 946.907674][T18017] evdev_write+0x2fc/0x480 [ 946.907696][T18017] ? __pfx_evdev_write+0x10/0x10 [ 946.907715][T18017] ? bpf_lsm_file_permission+0x9/0x20 [ 946.907738][T18017] ? security_file_permission+0x75/0x290 [ 946.907752][T18017] ? rw_verify_area+0x255/0x4d0 [ 946.907762][T18017] ? __lock_acquire+0xab9/0xd20 [ 946.907772][T18017] ? __pfx_evdev_write+0x10/0x10 [ 946.907782][T18017] vfs_write+0x27e/0xb30 [ 946.907794][T18017] ? __pfx_vfs_write+0x10/0x10 [ 946.907807][T18017] ? __fget_files+0x2a/0x420 [ 946.907828][T18017] ? __fget_files+0x2a/0x420 [ 946.907847][T18017] ? __fget_files+0x3a0/0x420 [ 946.907872][T18017] ? __fget_files+0x2a/0x420 [ 946.907891][T18017] ksys_write+0x145/0x250 [ 946.907901][T18017] ? __pfx_ksys_write+0x10/0x10 [ 946.907911][T18017] ? do_syscall_64+0xbe/0xfa0 [ 946.907921][T18017] do_syscall_64+0xfa/0xfa0 [ 946.907930][T18017] ? lockdep_hardirqs_on+0x9c/0x150 [ 946.907940][T18017] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.907953][T18017] ? clear_bhb_loop+0x60/0xb0 [ 946.907972][T18017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.907990][T18017] RIP: 0033:0x7f9877b8eec9 [ 946.908007][T18017] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 946.908023][T18017] RSP: 002b:00007f9878967038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 946.908039][T18017] RAX: ffffffffffffffda RBX: 00007f9877de6090 RCX: 00007f9877b8eec9 [ 946.908047][T18017] RDX: 0000000000001068 RSI: 0000200000000040 RDI: 0000000000000005 [ 946.908054][T18017] RBP: 00007f9877c11f91 R08: 0000000000000000 R09: 0000000000000000 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 946.908060][T18017] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 946.908066][T18017] R13: 00007f9877de6128 R14: 00007f9877de6090 R15: 00007f9877f0fa28 [ 946.908076][T18017] [ 947.246298][T18020] ipvlan2: entered promiscuous mode [ 947.280472][ T5150] Bluetooth: hci5: command tx timeout [ 947.524781][T17975] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 947.684505][ T5837] usbhid 6-1:0.0: can't add hid device: -71 [ 947.697737][ T5837] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 947.730849][ T5837] usb 6-1: USB disconnect, device number 91 [ 948.498354][T14813] bond4 (unregistering): (slave bridge2): Releasing active interface [ 948.778039][T14813] bond0 (unregistering): Released all slaves [ 948.786656][T14813] bond1 (unregistering): Released all slaves [ 948.795507][T14813] bond2 (unregistering): Released all slaves [ 948.920240][T14813] bond3 (unregistering): Released all slaves [ 948.929638][T14813] bond4 (unregistering): Released all slaves [ 949.408812][T14813] hsr_slave_0: left promiscuous mode [ 949.415065][T14813] hsr_slave_1: left promiscuous mode [ 950.103950][T14813] dummy0 (unregistering): left allmulticast mode [ 950.113096][T14813] team0 (unregistering): Port device dummy0 removed [ 950.488958][T14813] IPVS: stop unused estimator thread 0... [ 950.574171][T14813] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.615974][T14813] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.673185][T14813] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.731109][T14813] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.817663][T14813] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 950.828952][T14813] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.882331][T14813] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 950.892781][T14813] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.932225][T14813] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 950.944964][T14813] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 951.007854][T14813] netdevsim netdevsim5  (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 951.017517][T14813] netdevsim netdevsim5  (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 951.106230][T14813] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 951.152820][T14813] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 951.206066][T14813] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 951.269505][T14813] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 951.639184][T14813] bridge_slave_1: left allmulticast mode [ 951.644877][T14813] bridge_slave_1: left promiscuous mode [ 951.652021][T14813] bridge0: port 2(bridge_slave_1) entered disabled state [ 951.663503][T14813] bridge_slave_0: left allmulticast mode [ 951.669879][T14813] bridge_slave_0: left promiscuous mode [ 951.675517][T14813] bridge0: port 1(bridge_slave_0) entered disabled state [ 951.684778][T14813] bridge_slave_1: left allmulticast mode [ 951.690938][T14813] bridge_slave_1: left promiscuous mode [ 951.696597][T14813] bridge0: port 2(bridge_slave_1) entered disabled state [ 951.704776][T14813] : left allmulticast mode [ 951.709467][T14813] : left promiscuous mode [ 951.713955][T14813] bridge0: port 1() entered disabled state [ 951.721873][T14813] bridge_slave_1: left allmulticast mode [ 951.727702][T14813] bridge_slave_1: left promiscuous mode [ 951.733329][T14813] bridge0: port 2(bridge_slave_1) entered disabled state [ 951.743643][T14813] bridge_slave_0: left allmulticast mode [ 951.749568][T14813] bridge_slave_0: left promiscuous mode [ 951.755209][T14813] bridge0: port 1(bridge_slave_0) entered disabled state [ 951.763945][T14813] bridge_slave_1: left allmulticast mode [ 951.769727][T14813] bridge_slave_1: left promiscuous mode [ 951.775383][T14813] bridge0: port 2(bridge_slave_1) entered disabled state [ 951.783629][T14813] bridge_slave_0: left allmulticast mode [ 951.789524][T14813] bridge_slave_0: left promiscuous mode [ 951.795461][T14813] bridge0: port 1(bridge_slave_0) entered disabled state [ 951.804336][T14813] bridge_slave_1: left allmulticast mode [ 951.810260][T14813] bridge_slave_1: left promiscuous mode [ 951.815960][T14813] bridge0: port 2(bridge_slave_1) entered disabled state [ 951.823954][T14813] bridge_slave_0: left allmulticast mode [ 951.829664][T14813] bridge_slave_0: left promiscuous mode [ 951.835281][T14813] bridge0: port 1(bridge_slave_0) entered disabled state [ 951.963068][T14813] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 951.973009][T14813] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 951.982634][T14813] bond0 (unregistering): Released all slaves [ 952.121852][T14813] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 952.131841][T14813] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 952.141385][T14813] bond0 (unregistering): Released all slaves [ 952.150214][T14813] bond1 (unregistering): Released all slaves [ 952.275783][T14813] bond2 (unregistering): (slave bond3): Releasing backup interface [ 952.285311][T14813] bond3 (unregistering): left promiscuous mode [ 952.291567][T14813] bond3 (unregistering): left allmulticast mode [ 952.298079][T14813] bond2 (unregistering): Released all slaves [ 952.409559][T14813] bond3 (unregistering): Released all slaves [ 952.472927][T14813] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 952.482798][T14813] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 952.492414][T14813] bond0 (unregistering): Released all slaves [ 952.809600][T14813] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 952.819596][T14813] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 952.828840][T14813] bond0 (unregistering): Released all slaves [ 952.878911][T14813] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 952.888300][T14813] bond0 (unregistering): Released all slaves [ 953.577067][T14813] hsr_slave_0: left promiscuous mode [ 953.582914][T14813] hsr_slave_1: left promiscuous mode [ 953.594542][T14813] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 953.602524][T14813] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 953.611716][T14813] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 953.619429][T14813] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 953.628695][T14813] hsr_slave_0: left promiscuous mode [ 953.634493][T14813] hsr_slave_1: left promiscuous mode [ 953.640647][T14813] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 953.648375][T14813] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 953.656085][T14813] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 953.664200][T14813] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 953.675455][T14813] hsr_slave_0: left promiscuous mode [ 953.682318][T14813] hsr_slave_1: left promiscuous mode [ 953.688209][T14813] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 953.695606][T14813] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 953.707936][T14813] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 953.715345][T14813] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 953.728785][T14813] hsr_slave_0: left promiscuous mode [ 953.734620][T14813] hsr_slave_1: left promiscuous mode [ 953.741066][T14813] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 953.751244][T14813] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 953.767702][T14813] veth1_macvtap: left promiscuous mode [ 953.773249][T14813] veth0_macvtap: left promiscuous mode [ 953.779385][T14813] veth1_vlan: left promiscuous mode [ 953.784674][T14813] veth0_vlan: left promiscuous mode [ 953.792668][T14813] veth1_macvtap: left promiscuous mode [ 953.798286][T14813] veth0_macvtap: left promiscuous mode [ 953.804319][T14813] veth1_macvtap: left promiscuous mode [ 953.809954][T14813] veth0_macvtap: left promiscuous mode [ 953.815473][T14813] veth1_vlan: left promiscuous mode [ 953.820828][T14813] veth0_vlan: left promiscuous mode [ 954.026836][T14813] team0 (unregistering): Port device team_slave_1 removed [ 954.058680][T14813] team0 (unregistering): Port device team_slave_0 removed [ 954.431745][T14813] team0 (unregistering): Port device team_slave_1 removed [ 954.458611][T14813] team0 (unregistering): Port device team_slave_0 removed [ 954.841471][T14813] team0 (unregistering): Port device team_slave_1 removed [ 954.886320][T14813] team0 (unregistering): Port device team_slave_0 removed