last executing test programs: 27m58.313940469s ago: executing program 0 (id=201): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r2 = syz_io_uring_setup(0x66e, &(0x7f0000000940)={0x0, 0x0, 0x10100, 0x0, 0x2e9}, &(0x7f0000000380)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r2, 0x567, 0xfffffffd, 0x28, 0x0, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f00000000c0)={0x4000001, 0x71, 0x200000009}) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000300)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000400)={0x0, 0x0, r6, 0x0, 0x0, 0x1f5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "b4bc323ef77d1f000071849800000000dfff00"}}) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000009080)=@filter={'filter\x00', 0xe, 0x0, 0x0, [0x0, 0x200000008fc0, 0x200000008ff0, 0x200000009020], 0x0, 0x0, 0x0}, 0x108) socket$kcm(0x11, 0x3, 0x0) 27m58.193715691s ago: executing program 0 (id=202): openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001340)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x20, 0x5, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}], {0x14}}, 0xbc}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0xcf, 0x0, 0x0, @loopback, @multicast1}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f5, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000140)={'erspan0\x00', r4, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14, 0x91}, @multicast2}}}}) 27m55.856898276s ago: executing program 0 (id=210): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x20) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000000000), 0x10) setsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, &(0x7f00000000c0), 0xf00) setsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, 0x0, 0x0) 27m53.386132138s ago: executing program 0 (id=221): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[]) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r3, r3, &(0x7f0000000000)=0x2eb4, 0x2000007ff) 27m52.244893711s ago: executing program 0 (id=225): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r1) socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0x7, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x100, 0x7, 0x6361, 0x4, 0xc9, 0x6}, [@TCA_NETEM_LATENCY64={0xc, 0xa, 0x6}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xb, 0xb}, {0xa, 0xb}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x9}, @TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x9}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4010865}, 0x4008000) r5 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r5, 0x0, 0x0, 0x4000044, &(0x7f00000001c0)={0x11, 0x9900, r4, 0x1, 0xd9, 0x6, @random="98c8ca7122df"}, 0x14) 27m51.71360547s ago: executing program 0 (id=226): socket$inet_sctp(0x2, 0x1, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x6094, 0x0, &(0x7f0000000600), &(0x7f00000001c0)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a00)=@newtfilter={0x2e0, 0x2c, 0xd27, 0x30bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x3}, {}, {0xfff1, 0xc}}, [@filter_kind_options=@f_matchall={{0xd}, {0x2ac, 0x2, [@TCA_MATCHALL_ACT={0x2a8, 0x2, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x40, 0x6, 0x1, 0xea, 0x100004}, 0x1}}, @TCA_IFE_SMAC={0xa, 0x4, @remote}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}, @m_tunnel_key={0x128, 0xc, 0x0, 0x0, {{0xf}, {0x50, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e20}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @local}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @multicast2}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @empty}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e23}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x80000001, 0x5, 0x0, 0x7fffffff, 0x3}, 0x2}}, @TCA_TUNNEL_KEY_NO_CSUM={0x5}]}, {0xaa, 0x6, "702d7b7ca2605b80fb0bfc581434a99b0850c1e175b9e72d4819877b7effa9a22735ec0257f9035602a8c82a11dcd81f6da90792c83eb930b4651b0842fd8b24ec959c6de4ea9a6fdfff65cf7fc47d67a92fccbcf4fd60e2271bae67b9018d70f2d67b7fcbbfc60cf21233bfcc9ab73d6b2b4e85bed55d04fedeb2f8b470d29a44a7f85406cacfcdfea3e574aeb330772672c017d8cb90971aa75861a28f23ee6cdfb876faaa"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x6}}}}, @m_skbedit={0x128, 0x2, 0x0, 0x0, {{0xc}, {0x3c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x8, 0x8, 0x10000000, 0x7ff, 0x9}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x3350}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x10001}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x1}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x1}]}, {0xffffff10, 0x6, "04f1182a84f597cf3b9523440c209d73ff6282fffbe76149d4d47c7f085e00962e0197abc32c39d6c30a5d1b7be4d09795bce6d91a10a26c1a35fc59fbfe2ffe96ec7f206d912712c74135715760f3e6da7c1f87b9a4359bd92c4a106b30e29df4501a7971e68cd5c207fb9a850306331fd3a39ad27e6cd6fef98261cf73c07d26dbc5dd8b3fbb5128be3f63dc090fdb8d78e151445e7a7a17bfe450e03190ce0b6a62bfcdbecf9681515413ed98ca95e4a57d3350cf749b2317a1938d"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}]}}]}, 0x2e0}, 0x1, 0x0, 0x0, 0x4040011}, 0x0) 27m50.929205874s ago: executing program 32 (id=226): socket$inet_sctp(0x2, 0x1, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x6094, 0x0, &(0x7f0000000600), &(0x7f00000001c0)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a00)=@newtfilter={0x2e0, 0x2c, 0xd27, 0x30bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x3}, {}, {0xfff1, 0xc}}, [@filter_kind_options=@f_matchall={{0xd}, {0x2ac, 0x2, [@TCA_MATCHALL_ACT={0x2a8, 0x2, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x40, 0x6, 0x1, 0xea, 0x100004}, 0x1}}, @TCA_IFE_SMAC={0xa, 0x4, @remote}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}, @m_tunnel_key={0x128, 0xc, 0x0, 0x0, {{0xf}, {0x50, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e20}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @local}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @multicast2}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @empty}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e23}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x80000001, 0x5, 0x0, 0x7fffffff, 0x3}, 0x2}}, @TCA_TUNNEL_KEY_NO_CSUM={0x5}]}, {0xaa, 0x6, "702d7b7ca2605b80fb0bfc581434a99b0850c1e175b9e72d4819877b7effa9a22735ec0257f9035602a8c82a11dcd81f6da90792c83eb930b4651b0842fd8b24ec959c6de4ea9a6fdfff65cf7fc47d67a92fccbcf4fd60e2271bae67b9018d70f2d67b7fcbbfc60cf21233bfcc9ab73d6b2b4e85bed55d04fedeb2f8b470d29a44a7f85406cacfcdfea3e574aeb330772672c017d8cb90971aa75861a28f23ee6cdfb876faaa"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x6}}}}, @m_skbedit={0x128, 0x2, 0x0, 0x0, {{0xc}, {0x3c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x8, 0x8, 0x10000000, 0x7ff, 0x9}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x3350}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x10001}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x1}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x1}]}, {0xffffff10, 0x6, "04f1182a84f597cf3b9523440c209d73ff6282fffbe76149d4d47c7f085e00962e0197abc32c39d6c30a5d1b7be4d09795bce6d91a10a26c1a35fc59fbfe2ffe96ec7f206d912712c74135715760f3e6da7c1f87b9a4359bd92c4a106b30e29df4501a7971e68cd5c207fb9a850306331fd3a39ad27e6cd6fef98261cf73c07d26dbc5dd8b3fbb5128be3f63dc090fdb8d78e151445e7a7a17bfe450e03190ce0b6a62bfcdbecf9681515413ed98ca95e4a57d3350cf749b2317a1938d"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}]}}]}, 0x2e0}, 0x1, 0x0, 0x0, 0x4040011}, 0x0) 17m59.513688187s ago: executing program 2 (id=2041): r0 = socket(0x80000000000000a, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x7}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r3}, {}, {0x46, 0x0, 0x0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x5, 0x0, 0xb, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={r5, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000001200)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13, 0x8, 0x0, 0x0}}, 0x10) r6 = openat$dma_heap(0xffffffffffffff9c, &(0x7f00000011c0), 0x8c081, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r6, 0xc0184800, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='numa_maps\x00') mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0xfffffffc, 0xffffffff) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, 0x0, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000000480)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x1}}, {{0xa, 0x0, 0x7, @initdev={0xfe, 0x88, '\x00', 0x3, 0x0}, 0xfffffff8}}}, 0x104) 17m58.149017321s ago: executing program 2 (id=2046): socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) pipe(&(0x7f0000000040)={0xffffffffffffffff}) r4 = fanotify_init(0x200, 0x0) fanotify_mark(r4, 0x1, 0x48001059, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)=0x0) timer_settime(r6, 0x1, 0x0, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r7, 0x0) ioctl$DRM_IOCTL_GET_UNIQUE(r3, 0xc0106401, &(0x7f00000000c0)={0xdf, &(0x7f00000002c0)=""/223}) recvmmsg(r1, &(0x7f0000005800)=[{{0x0, 0x0, &(0x7f0000000680), 0x0, &(0x7f00000006c0)=""/227, 0xe3}, 0x3}, {{&(0x7f0000000c40)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, 0x0}, 0x6}, {{&(0x7f0000001d40)=@l2tp6={0xa, 0x0, 0x0, @private2}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001dc0)=""/221, 0xdd}, {&(0x7f0000001ec0)=""/18, 0x12}, {&(0x7f0000001f00)=""/230, 0xe6}], 0x3, &(0x7f0000002040)=""/167, 0xa7}, 0x5}, {{0x0, 0x0, &(0x7f0000003840)=[{&(0x7f0000002180)=""/4096, 0x1000}, {&(0x7f0000003180)=""/133, 0x85}, {0x0}, {&(0x7f0000003340)=""/233, 0xe9}, {&(0x7f0000003440)=""/206, 0xce}, {&(0x7f0000003540)=""/38, 0x26}, {&(0x7f0000003680)=""/216, 0xd8}, {&(0x7f0000003780)=""/122, 0x7a}, {&(0x7f0000003800)=""/41, 0x29}], 0x9}, 0x3}, {{&(0x7f0000003900)=@isdn, 0x80, &(0x7f00000039c0)=[{&(0x7f0000003980)=""/54, 0x36}], 0x1, &(0x7f0000003a00)=""/165, 0xa5}, 0x4}, {{&(0x7f0000003ac0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, 0x0, 0x0, &(0x7f0000003dc0)=""/176, 0xb0}, 0xfffffffc}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000042c0)=""/4096, 0x1000}, 0xff}, {{&(0x7f0000005600)=@sco, 0x80, &(0x7f0000005700)=[{&(0x7f0000005680)=""/72, 0x48}], 0x1, &(0x7f0000005740)=""/131, 0x83}, 0x7}], 0x8, 0x40000100, &(0x7f0000005ac0)) getitimer(0x1, &(0x7f0000000100)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 17m56.623628632s ago: executing program 2 (id=2050): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, 0x0, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') r4 = open(&(0x7f0000000200)='./bus\x00', 0x141a42, 0x0) sendfile(r4, r3, 0x0, 0xffffffff) r5 = fcntl$dupfd(r2, 0x0, r2) sendmmsg$inet6(r5, &(0x7f0000000a80)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000300)="75764169432797fa9d5a46aa3a", 0xd}], 0x1}}], 0x1, 0xc001) r6 = syz_io_uring_setup(0x98, &(0x7f0000000140)={0x0, 0xffffffff, 0x0, 0x3}, &(0x7f0000000240)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, &(0x7f00000004c0)={0x24102}, &(0x7f0000000500)='./file0\x00', 0x18}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000500), 0x101, 0x0) io_uring_enter(r6, 0x47f6, 0xbacc, 0x0, 0x0, 0x0) 17m54.220381825s ago: executing program 2 (id=2057): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x220c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r7, &(0x7f0000000040)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002", 0x4d}], 0x1) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r7) 17m54.051871884s ago: executing program 2 (id=2058): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file0\x00', 0x1c0) landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0/file0\x00', 0x200000, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) pipe(&(0x7f0000000080)) socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), 0x0, &(0x7f00000001c0), 0x0, 0x1}) 17m53.824192586s ago: executing program 2 (id=2060): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80021}, 0xc, &(0x7f0000000380)={&(0x7f0000000a40)=ANY=[@ANYRES32, @ANYRES32], 0x1074}, 0x1, 0x0, 0x0, 0x20000000}, 0x28880) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x0, &(0x7f0000000040)}, 0x10) write$binfmt_aout(r2, &(0x7f0000000000)=ANY=[], 0xfdef) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r4, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000001580)={{{@in6=@private1, @in=@local, 0x0, 0x0, 0x4e22, 0x0, 0x2, 0x0, 0x20, 0x11}, {0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x10, 0x9}, {}, 0x6, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x4d2, 0x33}, 0x0, @in=@loopback, 0x3506, 0x0, 0x2, 0xb7, 0x2, 0xfffffff9}}, 0xe8) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x1c) 17m38.423391581s ago: executing program 33 (id=2060): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80021}, 0xc, &(0x7f0000000380)={&(0x7f0000000a40)=ANY=[@ANYRES32, @ANYRES32], 0x1074}, 0x1, 0x0, 0x0, 0x20000000}, 0x28880) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x0, &(0x7f0000000040)}, 0x10) write$binfmt_aout(r2, &(0x7f0000000000)=ANY=[], 0xfdef) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r4, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000001580)={{{@in6=@private1, @in=@local, 0x0, 0x0, 0x4e22, 0x0, 0x2, 0x0, 0x20, 0x11}, {0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x10, 0x9}, {}, 0x6, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x4d2, 0x33}, 0x0, @in=@loopback, 0x3506, 0x0, 0x2, 0xb7, 0x2, 0xfffffff9}}, 0xe8) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x1c) 9.010732657s ago: executing program 3 (id=4954): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="20002dbd7000fbdbde250200000008003f000800000005003d004e"], 0x24}, 0x1, 0x0, 0x0, 0x8090}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @void}}}, 0x28}}, 0x0) 8.868045678s ago: executing program 3 (id=4956): r0 = userfaultfd(0x801) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x24fc, &(0x7f0000000400)={0x0, 0x80000, 0x10100, 0xfffffffe, 0xe6}, 0x0, &(0x7f0000000080)=0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_io_uring_submit(0x0, r4, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}) io_uring_enter(r3, 0x5b43, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x100000f, 0x810, r0, 0x57c68000) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r6, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r6, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$UI_ABS_SETUP(r7, 0x401c5504, &(0x7f0000000140)={0x4, {0x1, 0x1, 0x8, 0x4, 0x5, 0x52}}) shutdown(r6, 0x1) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[], 0x0) r8 = fsopen(&(0x7f0000000000)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000080)='source', &(0x7f0000000240)='//\xf2/\x06\b///o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) personality(0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000001c0), 0x13f, 0xa}}, 0x20) userfaultfd(0x801) r2 = socket$inet6(0xa, 0x2, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r3, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r4, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) listen(r5, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r6 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r6, 0xc008551a, &(0x7f0000000100)=ANY=[@ANYRESHEX=r6]) 7.565632868s ago: executing program 5 (id=4962): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getrlimit(0xc, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) rseq(&(0x7f0000000080)={0x0, 0x0, 0x0, 0x3}, 0x20, 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)}], 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) r5 = socket$netlink(0x10, 0x3, 0x15) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80fae0090f000000000000a2bc5603ca00000f7f89000000200000004a2471083ec6811778581acb6c0101ff0000000309", 0x48}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r4, 0x0) pipe2(&(0x7f0000000040), 0x0) sendfile(r4, r4, 0x0, 0x40008) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r6) mkdirat(0xffffffffffffff9c, &(0x7f0000001dc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) rename(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000200)='./file0\x00') 7.419341995s ago: executing program 1 (id=4964): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) unshare(0x8040480) r2 = socket$unix(0x1, 0x1, 0x0) cachestat(r2, &(0x7f0000000280)={0x52a, 0x6}, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000200)}], 0x1) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0xa00, 0xa00}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r4 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r4, 0xc0184800, &(0x7f0000000100)={0x20004, r3, 0x80000}) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='numa_maps\x00') mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./bus\x00', 0x289c2, 0x1) fcntl$setlease(r6, 0x400, 0x1) fremovexattr(r6, &(0x7f0000000040)=@known='system.posix_acl_default\x00') preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0x0) r7 = syz_open_dev$dri(&(0x7f0000000040), 0x1ff, 0x80000) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r7, 0xc00c642e, 0x0) r8 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r8, 0x80089419, &(0x7f0000000000)) ioctl$IOMMU_TEST_OP_ACCESS_RW(r8, 0x3ba0, &(0x7f0000000380)={0x48, 0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000540), 0x4}) 6.327917675s ago: executing program 4 (id=4967): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000240)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000200)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="05"], 0x48}}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="06"], 0x48}, 0x1, 0x0, 0x0, 0x4000011}, 0x2004c800) 6.247866877s ago: executing program 4 (id=4968): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) socket$inet6(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000280)={'syztnl1\x00', 0x0, 0x4, 0x2, 0x3, 0x424, 0x5a, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x40, 0x8007, 0x180, 0x5}}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80021}, 0xc, &(0x7f0000000380)={&(0x7f0000004d80)=@migrate={0x58, 0x21, 0x10, 0x70bd27, 0x25dfdbfd, {{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6=@remote, 0x4e21, 0x0, 0x4e20, 0x0, 0xa, 0x80, 0x0, 0x5c, r4}, 0x6e6bb0, 0x1}, [@XFRMA_SET_MARK={0x8, 0x1d, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x28880) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x800) recvmmsg(r5, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001180)=""/4096}, {&(0x7f0000000440)=""/128}], 0x0, &(0x7f00000004c0)=""/193}, 0x7f}, {{&(0x7f00000005c0)=@in, 0x0, &(0x7f0000000700)=[{&(0x7f0000000640)=""/35}, {&(0x7f0000000680)=""/127}], 0x0, &(0x7f0000000740)=""/23}, 0x3}], 0x400000000000054, 0x40012100, 0x0) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0x6}, {0x6, 0x0, 0x0, 0xb}}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}, {0x56}}], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r7, &(0x7f0000000100)={0xa, 0xa9d, 0x3, @mcast1}, 0x1c) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)={0x30, r1, 0x1, 0x70bd2b, 0x0, {{0x2}, {@val={0x8}, @val={0xc, 0x99, {0x9, 0x44}}}}, [@NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x2400c891}, 0x0) 6.246493559s ago: executing program 1 (id=4969): syz_usb_connect(0x2, 0x56, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000c9d1c40899040a50b7e70102030109024400020000000009049700010dd5ce0008240201000000000905000000000000000705a3f6d2fb5b09040000014106cf0008240201000000000905c926"], 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) userfaultfd(0x80001) io_setup(0x6, &(0x7f00000003c0)=0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x62081, 0x0) io_submit(r0, 0x0, &(0x7f00000000c0)) openat$sequencer(0xffffffffffffff9c, 0x0, 0x8002, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) r3 = socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r4 = socket$inet(0xa, 0x801, 0x84) connect$inet(r4, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r4, 0x9) accept4(r4, &(0x7f0000000280)=@l2={0x1f, 0x0, @fixed}, 0x0, 0x800) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000640)=ANY=[@ANYRESOCT=r4, @ANYRESHEX=r3, @ANYBLOB="d93c3979db996d1c840ab40697d7281cd758d64c70f852a5e15edbe646cd0f03dd2d697423615b73684c141e61752f8c91460dfe6ce21bd90f07f28c2298b4656d07"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) r6 = open$dir(&(0x7f0000000240)='./file0\x00', 0x800, 0x100) openat$incfs(r6, &(0x7f0000000280)='.log\x00', 0x800, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x189240, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'\x00', 0x2}) ioctl$USBDEVFS_CLAIM_PORT(0xffffffffffffffff, 0x80045518, &(0x7f0000000000)=0x1) 5.839826886s ago: executing program 6 (id=4970): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) unshare(0x8040480) r2 = socket$unix(0x1, 0x1, 0x0) cachestat(r2, &(0x7f0000000280)={0x52a, 0x6}, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000200)}], 0x1) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0xa00, 0xa00}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r4 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r4, 0xc0184800, &(0x7f0000000100)={0x20004, r3, 0x80000}) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='numa_maps\x00') mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./bus\x00', 0x289c2, 0x1) fcntl$setlease(r6, 0x400, 0x1) fremovexattr(r6, &(0x7f0000000040)=@known='system.posix_acl_default\x00') preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0x0) r7 = syz_open_dev$dri(&(0x7f0000000040), 0x1ff, 0x80000) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r7, 0xc00c642e, 0x0) r8 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r8, 0x80089419, &(0x7f0000000000)) ioctl$IOMMU_TEST_OP_ACCESS_RW(r8, 0x3ba0, &(0x7f0000000380)={0x48, 0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000540), 0x4}) 4.965896418s ago: executing program 3 (id=4971): r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x46, &(0x7f00000003c0)=ANY=[], 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) socket(0x1000000010, 0x80002, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0xb2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001a80)=ANY=[@ANYBLOB="b700000017000000bfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff00000000a4040000000002000f030000000000003404000001ed0a0014040000170000801c400000000000007b0a00fe000000002c04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d0cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090d030000003acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931481747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885769754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8269b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd23834a50d7eb8e327fb5db12cbd6a9efe8e671c4f251fe3bf440cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa2c910fb8de24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d1767e31a3446cd57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c828c02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007f00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d05d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b530500d8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bd9b075f1488d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462aa2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783fefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9be0bdd37220e316f2297743dd4731614a50c16c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd08000000e843591d2618e2d2cdc7081c8fafffe9c350a5c554a387de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119d2a673bdae05779208409e6cf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8a9d3374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9eed636338f1835fc957729d63dc1bfc7b772cbe536c2d3aff27c22f9a2f876512616a5bdaf22a16e19d1b5f52abb40b433983d0cf50234de659c1a397ce901000000caae1bcfdce33dae6adc260321702f239c25ab181390e7dc8c1e5b1cf3b4fef1cd5c44a89b5e5d8314e02f4673ded90bce9a4025b0232eec970f7aa17f175a14e8dc0700bac0006b98a8283eee5665f3aede28228e0468dbcf8b776fe4c629d3af183a7cba5adf77f23d31f9d5a183c0da4e95f75b1496a97a46a06e4e1f5a8438d49dbd493ba2482c398ab724577fd742bf44cdd8489086e61aa3cb1d3ab3dac8183102fe6fc8a038e3868a0592811446867969f0fb3f547e83c4ca35aac023f09f15bb0acb3cdc6efd9b0e9df56af7fda01280a384028b35994388"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1e}, 0x48) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x0) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r3, 0x2) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000040)={0xf0f01e, 0x1}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2f) ioctl$VFAT_IOCTL_READDIR_BOTH(r5, 0x82307201, &(0x7f0000000640)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) socket$inet6_udp(0xa, 0x2, 0x0) unshare(0x42000000) syz_emit_ethernet(0x4a, &(0x7f0000000280)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a37f2", 0x14, 0x2c, 0xfe, @remote, @local, {[], {{0x600, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 4.909863032s ago: executing program 4 (id=4972): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) unshare(0x8040480) socket$unix(0x1, 0x1, 0x0) writev(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000200)}], 0x1) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0xa00, 0xa00}) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r3 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x20004, r2, 0x80000}) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='numa_maps\x00') mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./bus\x00', 0x289c2, 0x1) fcntl$setlease(r5, 0x400, 0x1) fremovexattr(r5, &(0x7f0000000040)=@known='system.posix_acl_default\x00') preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000040), 0x1ff, 0x80000) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r6, 0xc00c642e, 0x0) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r7, 0x80089419, &(0x7f0000000000)) ioctl$IOMMU_TEST_OP_ACCESS_RW(r7, 0x3ba0, 0x0) 4.288147212s ago: executing program 5 (id=4973): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@loopback, 0x0, 0x0, 0xffff, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x6c}, 0x0, @in6=@empty, 0x0, 0x0, 0x0, 0x3}}, 0xe8) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) 4.286797929s ago: executing program 6 (id=4974): socket(0xa, 0x800, 0xfffffffb) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) personality(0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000001c0), 0x13f, 0xa}}, 0x20) userfaultfd(0x801) r2 = socket$inet6(0xa, 0x2, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r3, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r4, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) listen(r5, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r6 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r6, 0xc008551a, &(0x7f0000000100)=ANY=[@ANYRESHEX=r6]) 4.109743663s ago: executing program 5 (id=4975): r0 = userfaultfd(0x801) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0x24fc, &(0x7f0000000400)={0x0, 0x80000, 0x10100, 0xfffffffe, 0xe6}, 0x0, &(0x7f0000000080)=0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_io_uring_submit(0x0, r4, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}) io_uring_enter(r3, 0x5b43, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x100000f, 0x810, r0, 0x57c68000) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r6, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r6, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$UI_ABS_SETUP(r7, 0x401c5504, &(0x7f0000000140)={0x4, {0x1, 0x1, 0x8, 0x4, 0x5, 0x52}}) shutdown(r6, 0x1) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[], 0x0) r8 = fsopen(&(0x7f0000000000)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000080)='source', &(0x7f0000000240)='//\xf2/\x06\b///o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8bte default t'], 0x20, 0xfffffffffffffffd) syz_open_dev$vcsn(&(0x7f00000001c0), 0x1, 0x800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x15) write$uinput_user_dev(r1, &(0x7f0000000800)={'syz1\x00', {}, 0x4, [0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xb77b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01090000000000000f478e"]) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0x2, 0x4002004c4, 0xffe, 0x0, 0x0, 0xfffffffffffffffd, 0x900f, 0x0, 0xd57b, 0x0, 0x7], 0xeeee8000, 0x2113c0}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r5 = syz_open_dev$loop(0x0, 0xffffffff7ffffffd, 0x160862) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000000080)={r6, 0x0, {0x0, 0x600000000000000, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "715237601a8ca5b07dcc141802c4dacf162e43ac61f7ad330000000000a04100", [0xfffffffffffffce8, 0xa]}}) pwritev(r5, &(0x7f0000000500)=[{&(0x7f0000000380)="9e", 0x1}], 0x1, 0x5, 0xfffffff9) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000300)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x1, 0x0, 0x0, 0x2c, 0x0, @remote, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x1}}}}}}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000200)={0x20}, 0x0, 0x0, 0x0, 0x0}) 3.134846169s ago: executing program 4 (id=4977): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000005b574e69622bf85eda07b3"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000040)={0x3, 0x100, 0x0, 0x7, 0xf, 0x52b}) 2.748215597s ago: executing program 3 (id=4978): syz_open_dev$radio(&(0x7f0000000200), 0x1, 0x2) r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=@delqdisc={0xec, 0x25, 0x9, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x4, 0x7}, {0xffe0, 0x6}, {0xfff1}}, [@TCA_STAB={0xb8, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xf, 0x8, 0xc, 0x2, 0x2, 0x9, 0x5, 0x3}}, {0xa, 0x2, [0x7, 0x4, 0x1ff]}}, {{0x1c, 0x1, {0x2, 0x5, 0x9, 0x10, 0x0, 0x4, 0x6, 0x7}}, {0x12, 0x2, [0x9, 0xfffa, 0xb4, 0x0, 0x800, 0x5, 0x3]}}, {{0x1c, 0x1, {0x1, 0x9d, 0x101, 0x45eb, 0x0, 0x5, 0x1000, 0x7}}, {0x12, 0x2, [0xd8, 0x4, 0x6, 0x9, 0xa, 0x8, 0x9]}}, {{0x1c, 0x1, {0x7, 0xf0, 0x5c9a, 0x800, 0x1, 0xfffffff7, 0xffffffff, 0x5}}, {0xe, 0x2, [0x1e, 0x401, 0xfff8, 0xa4, 0x7fff]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x4}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}]}, 0xec}, 0x1, 0x0, 0x0, 0x20000005}, 0x2000a084) syz_emit_ethernet(0x52, &(0x7f0000000100)=ANY=[@ANYRES32=0x41424344], 0x0) r3 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f00000001c0)="c683c320bb386bce45eb641122", 0xd, 0xfffffffffffffffe) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) ioctl$KVM_HYPERV_EVENTFD(r5, 0x4018aebd, &(0x7f00000000c0)={0x1, r6}) r7 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r3, r7, r3}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = dup(r9) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) syz_kvm_setup_cpu$x86(r9, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) 2.601716764s ago: executing program 1 (id=4979): r0 = io_uring_setup(0x33cd, &(0x7f0000000180)={0x0, 0x0, 0x10, 0x8000001}) r1 = socket(0x2b, 0x1, 0x1) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) ioctl$sock_inet_sctp_SIOCINQ(r1, 0x894b, &(0x7f0000000000)) close_range(r0, r1, 0x0) 2.281726109s ago: executing program 1 (id=4980): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000300)=0xffd, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r2}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000180)='O', 0x1}, {&(0x7f00000002c0)="7450fa00744334afa6", 0x9}], 0x2}}], 0x1, 0x0) 2.236599931s ago: executing program 1 (id=4981): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x145, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x46, 0x0}, 0x4000804) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a310000000044030000090a030000000000000009000700000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000000d04001280080003400000011008000c400000edd8e8020980a0000280440001800800014000000000080001400000000408000140000003ff080001400000007f08000140000006860800014000008001080001400000000708000140000000073c000180080001400000000108000140000001d0080001400000000008000140000000090800014000000009080001400000800008000140000000091c000180080001407fffffff0800014000009af7080001400000000708000140000003ff700002802c00018008000140000000090800014000007ffa0800014000000002080001400000000c080001400000000a1c000180080001400000a8e5080001400000ffff080001400000000724000180080001400000008108000140000000010800014000000008080001400000000608000140000080002a01028044000180080001400000000608000140000000080800014000000fff080001400000000a08000140000000060800014000000000080001400000100008000140ffffffff440001804400014000000006080001400000000b08000140000000010800014000008001080001400000019508000140000000080800014000004beb08000140000000061400018008000140000000ff08000140000000062c000180080001400000000308000140000000050800014040000000080001400000000008000140000000042400018008000140"], 0x38c}}, 0x0) socket$netlink(0x10, 0x3, 0x14) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000475000/0x3000)=nil, 0x3000, 0x0, 0x1010, 0xffffffffffffffff, 0x0) r4 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000000c0), &(0x7f00000001c0)) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x3) write$uinput_user_dev(r5, &(0x7f0000000080)={'syz1\x00', {0x3ff, 0x3, 0x4}, 0x4d, [0x10004, 0x6, 0x9, 0x8a4, 0x2, 0x2, 0x7fffffff, 0x80000001, 0x4, 0x1, 0xfd, 0x3c6, 0x7, 0x7, 0xf70, 0x3c00, 0xe7, 0x4007, 0x401, 0xbc5e, 0x4, 0x1, 0x8, 0xffff, 0xe, 0xe, 0x10, 0x20000000, 0x15098855, 0x6, 0x2, 0xfffffffb, 0x6, 0xc, 0xfffffff7, 0x4, 0xe79, 0x7, 0x1, 0x1, 0x1, 0x0, 0x401, 0x9, 0xbdc7, 0xb, 0x1, 0x9, 0x3, 0x1, 0x6, 0x2, 0x5, 0x49, 0x5, 0x9, 0x0, 0x1, 0x1000, 0x3, 0x2, 0x6, 0x7ff, 0xb8547353], [0x4, 0xffffffff, 0x4, 0x5, 0x7ffffdff, 0x1, 0x550, 0x6, 0x2, 0xfffffffc, 0x10001, 0xc, 0x36, 0x4, 0x6, 0x1, 0x9, 0x98, 0x8, 0xe56d, 0xa4, 0x9, 0x99d, 0x8, 0x0, 0xd, 0x10001, 0xfffffffe, 0x6e38, 0x8000, 0xa, 0x6, 0x3, 0x0, 0x5, 0x7, 0x4, 0xd, 0x9, 0xfff, 0x4, 0x0, 0x40000040, 0x1, 0x8, 0x5, 0x8, 0x0, 0x34f1, 0x1ff, 0x4, 0x1b2c5a97, 0x0, 0x9, 0x8, 0x0, 0x1, 0x1, 0x6, 0x6, 0xac, 0x2, 0x54, 0xcfb9], [0x5, 0xdb8, 0x9, 0x4, 0x2, 0x200006, 0x5, 0x5, 0x2, 0x80, 0xfffffffd, 0xc8d3, 0x33, 0x9a45, 0x0, 0xee40000, 0x1, 0x1, 0x4, 0x69d, 0x8, 0xffff, 0x0, 0x0, 0x40000008, 0x2, 0x4, 0x800, 0x7, 0x9, 0x10000, 0x0, 0x1, 0xfffffffe, 0x3, 0x0, 0x4, 0x8c0, 0x9, 0x2, 0x8, 0x7, 0x6, 0x2, 0x81, 0x8, 0x1, 0x55f2, 0xdf46, 0xfffffffd, 0x7f, 0x9, 0x8000, 0x40, 0x3, 0x2, 0xa, 0x6, 0x2, 0xffffff00, 0xda15, 0x82, 0x3, 0x10], [0x0, 0x897, 0x8, 0x246d, 0x6, 0x101, 0x7fffffff, 0xd, 0x7ff, 0x606, 0x5, 0x9, 0x80000001, 0x2, 0xb, 0x2, 0x7, 0x1, 0x7, 0x8, 0x7ff, 0x1, 0x0, 0x2, 0x6, 0x20c, 0xfffffffd, 0xa18, 0x61c8, 0x6, 0x7ff, 0x101, 0xff, 0x7, 0x9, 0x5, 0x7, 0x101, 0x9, 0x3000000, 0x20e, 0x4000006, 0x7, 0xfffffffd, 0x9, 0x1, 0x4, 0x100009, 0x100, 0x8, 0x3c, 0x1000, 0x3, 0x3, 0x15, 0x8000, 0x7, 0x81, 0x8, 0x7, 0xfffffffc, 0x4, 0x6, 0xeff]}, 0x45c) ioctl$UI_DEV_CREATE(r5, 0x5501) write$uinput_user_dev(r5, &(0x7f0000001180)={'syz0\x00', {0xaf0, 0xd033, 0x180}, 0x45, [0xfffffff7, 0x3, 0x2, 0x1, 0x80, 0xaf7, 0x8, 0x6, 0x7fff, 0x9, 0x42, 0x40, 0x3ff, 0x2, 0x1, 0x8000, 0x7ff, 0x20000003, 0x5, 0x5, 0x1, 0x4, 0x6, 0x2, 0x6, 0x6, 0x7, 0x1600000, 0xa, 0xfe, 0x3ff, 0xc6, 0x3, 0x8000, 0x1b, 0xb, 0x7, 0x0, 0xff, 0x4, 0x57, 0x6253, 0x7, 0xda, 0x67aa2099, 0xffffffff, 0x7, 0x8, 0x9, 0x9, 0xd, 0x6, 0x5, 0x9ec6, 0x7, 0x1, 0x7, 0xff, 0x7, 0x800, 0xfffffffa, 0x3, 0x6, 0x3], [0x3, 0x7ff, 0x7, 0xa, 0x3, 0x3, 0x3, 0x2, 0x2, 0x5, 0x0, 0xfffff283, 0x1ff8, 0x8, 0x100, 0xffffffff, 0x7, 0x3ff, 0xffffffff, 0x0, 0x400000, 0x9, 0x6, 0xe, 0x0, 0x100, 0x1, 0xd, 0x100, 0x800, 0xcb, 0x5, 0x5, 0x6, 0x0, 0x3, 0xe, 0x6, 0x81, 0x3, 0x2, 0x8, 0xfffffff7, 0x6, 0x8, 0x5, 0xd, 0xfffffffa, 0x2, 0x8e, 0x4, 0x8b7, 0xfffffffa, 0x1, 0xfbfffff9, 0x3, 0x9, 0x7, 0x3, 0x942, 0x4, 0x12000, 0x4fb2adfa, 0xdea0], [0x2, 0x3, 0xfffff001, 0xfffffffd, 0x8, 0xe6, 0x8, 0x2, 0xf441, 0x2, 0xfffffffd, 0x2, 0x10, 0x1000, 0x9, 0x2, 0xffffffff, 0x7, 0x0, 0xf361, 0x7, 0x3, 0x0, 0x5, 0x6, 0xff, 0x81, 0xf, 0x1, 0x9, 0x7, 0x0, 0x10001, 0x8e5c, 0x4, 0x9, 0x6, 0x1, 0x200, 0x7, 0x40, 0x7a2c, 0x200101, 0x9e38, 0x4c88, 0x6, 0xa8, 0x4, 0x8, 0x9, 0x2, 0x6, 0x5, 0x1, 0x1137, 0x8, 0xae, 0x4d70, 0x400, 0xfaa5, 0xffffff01, 0x15, 0x7a, 0x1], [0x0, 0x8, 0x9, 0x0, 0x6, 0x8, 0x9, 0x4, 0xfffffff8, 0x200, 0xf, 0x5, 0x3, 0x6727, 0x7fff, 0x9, 0x200, 0xfffffff7, 0xe3, 0x400, 0x0, 0x4, 0xdfd2, 0x39, 0x101, 0x9, 0x1, 0x1, 0xa, 0x7, 0x10001, 0x1, 0x6, 0x400, 0x0, 0x8, 0x2, 0x9, 0x9, 0x6, 0x200, 0x0, 0x2334, 0x6, 0x1, 0x2, 0x6f51, 0x81, 0x5, 0x0, 0x7, 0x3, 0x7, 0x34254b70, 0x4ad, 0x3, 0x8b21, 0x1, 0x9, 0x3, 0xc, 0xffff, 0x7, 0x8]}, 0x45c) io_uring_register$IORING_REGISTER_CLONE_BUFFERS(r4, 0x1e, &(0x7f0000000040)={r4}, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r6, 0x1, 0x9, 0x0, &(0x7f0000000040)) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="180000002e00010026bdf000fcdbdf1b04000000040010"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) close(0x3) syz_usb_connect$uac1(0x3, 0xa2, 0x0, 0x0) 2.217583211s ago: executing program 3 (id=4982): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x16}, @NFTA_CT_DIRECTION={0x5, 0x3, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x80}, 0x1, 0x0, 0x0, 0x840}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000480)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x4000, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x3b, &(0x7f0000000240)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x2d, 0x65, 0x0, 0xf, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xffff}, {"5abb2cd56b"}}}}}}, 0x0) 2.133818485s ago: executing program 3 (id=4983): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local={0x3, 0x80, 0xc2, 0x0, 0x0, 0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010101, @remote}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x1, 0x0, @loopback, @dev={0xac, 0x14, 0x14, 0xe}}}}}}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0) fcntl$lock(r3, 0x25, &(0x7f0000002380)) preadv(r3, &(0x7f0000000000)=[{&(0x7f0000000080)=""/4094, 0xffe}], 0x1, 0x33, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x7400}, 0x20000804) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001cc0)=@acquire={0x26c, 0x17, 0x1, 0x0, 0x0, {{@in=@loopback}, @in6=@remote, {@in=@remote, @in=@broadcast, 0x4e21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56befe125658cb64}, {{@in6=@private2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x20, 0x0, 0x0, 0xee00}, {}, {}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2}, 0xfffffff9}, [@tmpl={0x144, 0x5, [{{@in=@broadcast, 0x4d5, 0x3c}, 0xa, @in6=@loopback, 0x3505, 0x2, 0x0, 0xac, 0x3, 0x1, 0x9}, {{@in=@multicast1, 0x4d4, 0x3c}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @multicast2}, 0x3504, 0x2, 0x2, 0x6, 0x0, 0x1}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x3c}, 0x4d5, 0x6c}, 0xa, @in=@remote, 0x3505, 0x3, 0x1, 0xf9, 0x2000009, 0x3, 0x200}, {{@in=@broadcast, 0x4d2, 0x6c}, 0xa, @in=@empty, 0x0, 0x1, 0x0, 0x5, 0x7ff, 0x401, 0x5}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d4, 0x3c}, 0xa, @in=@dev={0xac, 0x14, 0x14, 0x19}, 0x3506, 0x0, 0x3, 0x2, 0x9, 0x101, 0x8}]}]}, 0x26c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000104a5270b7357000000925e4a44", @ANYRES32, @ANYBLOB="0dfa130016000000240012000c00010000000000000000000c0002f60800000001180000080001"], 0x44}}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000280)={r5, 0x7, 0x9, 0xfffffffe}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='H'], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) io_submit(0x0, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0}]) write$rfkill(r0, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) 962.77761ms ago: executing program 5 (id=4984): io_uring_setup(0x177d, &(0x7f00000002c0)={0x0, 0x698c, 0x40, 0x2, 0xfffffffe}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f000001f580), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000004c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000002c0)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r1, @ANYBLOB="010025bd7000fcdbdf253f00000008000300", @ANYRES32=r2, @ANYBLOB="04005e801c005e8008000700c5f133694bbd07cb55000000080003006e8f000030005e800800020003000000080002491acf00000c0001"], 0x8c}, 0x1, 0x0, 0x0, 0x4080}, 0x4004000) 393.076972ms ago: executing program 5 (id=4985): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) r2 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r2, &(0x7f0000000080)={0x1d, r1, 0x1, {0x0, 0xff, 0x2}, 0xff}, 0x18) sendmsg$can_j1939(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x4}, 0xff}, 0x18, &(0x7f0000000180)={0x0}}, 0xee) 392.635438ms ago: executing program 5 (id=4986): socket(0xa, 0x800, 0xfffffffb) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) personality(0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000001c0), 0x13f, 0xa}}, 0x20) userfaultfd(0x801) r2 = socket$inet6(0xa, 0x2, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r3, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r4, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) listen(r5, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r6 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r6, 0xc008551a, &(0x7f0000000100)=ANY=[@ANYRESHEX=r6]) 240.719991ms ago: executing program 6 (id=4987): mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x3000003, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000001800)='\x00', 0x1}], 0x1, 0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0x0) vmsplice(r0, &(0x7f0000000140)=[{&(0x7f0000000040)="f025", 0x2}], 0x1, 0x1) 162.192686ms ago: executing program 6 (id=4988): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ip6gretap0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000180)="0b036c11e0ff64000200475400f6a13bb1000000080088484803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x0, r2}, 0x14) 101.222209ms ago: executing program 6 (id=4989): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r0 = socket$kcm(0x11, 0xa, 0x300) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0) recvmsg(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000002400)=""/4098, 0xd5e}], 0x3a}, 0x0) 9.964956ms ago: executing program 4 (id=4990): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000200)=@ccm_128={{0x303}, "416a0be7c02c37c0", "c3a5059aee1679bc50218d2188f33a9e", "d2dccbc7", "f6464c4abe4b8e0f"}, 0x1) 0s ago: executing program 4 (id=4991): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000000042f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) kernel console output (not intermixed with test programs): ng 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1694.280727][T23222] usb 4-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1694.300527][T23222] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1694.314646][T23222] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1694.328057][T23222] usb 4-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1694.338071][T23222] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1694.346192][T23222] usb 4-1: Product: syz [ 1694.351203][T23222] usb 4-1: Manufacturer: syz [ 1694.355934][T23222] usb 4-1: SerialNumber: syz [ 1694.407411][T23222] usb 4-1: config 0 descriptor?? [ 1694.459713][T27846] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1694.509307][ T6511] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 1694.522269][T23222] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1694.614672][T23222] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1694.767025][ T6511] usb 6-1: Using ep0 maxpacket: 8 [ 1694.773950][ T6511] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1694.783005][ T6511] usb 6-1: config 4 interface 0 has no altsetting 0 [ 1694.796836][ T6511] usb 6-1: string descriptor 0 read error: -22 [ 1694.814259][ T6511] usb 6-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 1694.825883][T23222] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1694.852432][ T6511] usb 6-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 1694.882886][ T6511] usb 6-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 1694.916044][ T6511] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1695.001237][ T6511] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 1695.014731][ T6511] usb 6-1: media controller created [ 1695.034403][ T6511] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1695.790371][T27871] input: syz1 as /devices/virtual/input/input199 [ 1696.126238][T27854] usb 6-1: dvb_usb_au6610: wlen=0, aborting [ 1696.134546][ T6511] zl10353_read_register: readreg error (reg=127, ret==0) [ 1696.234065][ T6511] usb 6-1: USB disconnect, device number 100 [ 1696.957587][T17853] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 1697.129464][T17853] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1697.148372][ T65] net_ratelimit: 32 callbacks suppressed [ 1697.148394][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1697.184256][T17853] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1697.286861][T17853] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1697.313740][T17853] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1697.328794][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1697.341530][ T6511] usb 4-1: USB disconnect, device number 105 [ 1697.435446][T27882] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4455'. [ 1697.445249][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1697.464852][T17853] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1697.515581][T17853] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1697.578083][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1697.606417][T17853] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1697.623919][T17853] usb 2-1: invalid MIDI out EP 0 [ 1697.767385][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1697.913919][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1698.034075][T17853] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1698.079023][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1698.197523][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1698.337246][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1698.457193][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1699.424750][T27914] batman_adv: batadv0: Adding interface: macsec2 [ 1699.438020][T27914] batman_adv: batadv0: Interface activated: macsec2 [ 1699.823177][T16955] usb 2-1: USB disconnect, device number 108 [ 1699.904387][T27927] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4470'. [ 1700.057571][T26056] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 1700.216260][T27938] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4473'. [ 1700.218159][T26056] usb 4-1: Using ep0 maxpacket: 8 [ 1700.251025][T26056] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 1700.265842][T27938] Cannot find map_set index 135 as target [ 1700.281683][T26056] usb 4-1: config 179 has no interface number 0 [ 1700.298165][T26056] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1700.322493][T26056] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1700.335551][T26056] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1700.374057][T26056] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1700.411008][T26056] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1700.448151][T16955] usb 7-1: new full-speed USB device number 70 using dummy_hcd [ 1700.458000][T26056] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1700.486077][T26056] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1700.512754][T27925] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1700.600529][T16955] usb 7-1: config 0 has an invalid interface number: 151 but max is 1 [ 1700.611835][T16955] usb 7-1: config 0 has no interface number 1 [ 1700.628694][T16955] usb 7-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1700.641115][T16955] usb 7-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1700.655179][T16955] usb 7-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1700.668185][T16955] usb 7-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1700.682677][T16955] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1700.695800][T16955] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1700.713908][T16955] usb 7-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1700.725085][T16955] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1700.752015][T26056] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input201 [ 1700.764165][T16955] usb 7-1: Product: syz [ 1700.778447][T16955] usb 7-1: Manufacturer: syz [ 1700.785315][T16955] usb 7-1: SerialNumber: syz [ 1700.814679][T16955] usb 7-1: config 0 descriptor?? [ 1700.837580][T27937] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 1700.915239][T16955] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1700.950537][T26056] usb 4-1: USB disconnect, device number 106 [ 1700.956601][ C0] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1700.956638][ C0] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1700.979944][T16955] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1701.031972][T16955] snd-usb-audio 7-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1701.907012][ T6511] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 1702.089550][ T6511] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1702.107908][ T6511] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1702.131504][ T6511] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1702.158371][ T12] net_ratelimit: 31 callbacks suppressed [ 1702.158389][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1702.181910][ T6511] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1702.223187][ T6511] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1702.257960][ T6511] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1702.288022][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1702.320073][ T6511] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1702.344430][ T6511] usb 2-1: invalid MIDI out EP 0 [ 1702.398270][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1702.538402][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1702.609541][ T6511] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1702.648990][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1702.797388][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1702.907665][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1703.037805][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1703.167292][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1703.297348][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1703.341565][T27966] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4481'. [ 1703.634136][T27972] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4482'. [ 1703.838710][T26056] usb 7-1: USB disconnect, device number 70 [ 1703.930397][T27978] tap0: tun_chr_ioctl cmd 1074025677 [ 1703.935944][T27978] tap0: linktype set to 769 [ 1704.257959][T26056] usb 7-1: new high-speed USB device number 71 using dummy_hcd [ 1704.408070][T26056] usb 7-1: Using ep0 maxpacket: 8 [ 1704.415277][T26056] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1704.436274][T26056] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1704.515787][T26056] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1704.537528][T26056] pvrusb2: ********** [ 1704.548361][T26056] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1704.605532][T26056] pvrusb2: Important functionality might not be entirely working. [ 1704.614451][T26056] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1704.626870][T26056] pvrusb2: ********** [ 1704.735916][ T2346] pvrusb2: Invalid write control endpoint [ 1704.813140][ T2346] pvrusb2: Invalid write control endpoint [ 1704.821286][ T2346] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1704.834821][ T2346] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1704.843706][ T2346] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1704.857586][ T2346] pvrusb2: Device being rendered inoperable [ 1704.874318][ T2346] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1704.883435][ T2346] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1704.884713][T27997] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4491'. [ 1704.984660][ T2346] pvrusb2: Attached sub-driver cx25840 [ 1704.999645][T28000] Cannot find map_set index 135 as target [ 1705.019152][ T2346] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1705.019209][ T6511] usb 7-1: USB disconnect, device number 71 [ 1705.042364][ T2346] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1705.081281][T26056] usb 2-1: USB disconnect, device number 109 [ 1705.222648][T28006] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4494'. [ 1706.317180][ T6511] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 1706.497371][ T6511] usb 4-1: Using ep0 maxpacket: 32 [ 1706.515353][ T6511] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1706.537563][ T6511] usb 4-1: config 0 has no interface number 0 [ 1706.560551][ T6511] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1706.586542][ T6511] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1706.611985][ T6511] usb 4-1: Product: syz [ 1706.628748][ T6511] usb 4-1: Manufacturer: syz [ 1706.645296][ T6511] usb 4-1: SerialNumber: syz [ 1706.706114][ T6511] usb 4-1: config 0 descriptor?? [ 1706.721602][ T6511] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1706.750635][ T6511] usb 4-1: selecting invalid altsetting 1 [ 1706.769548][ T6511] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1706.812405][ T6511] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1706.839472][ T6511] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1706.855560][ T6511] usb 4-1: media controller created [ 1706.899069][ T6511] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1707.001716][ T6511] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 1707.014791][ T6511] zl10353_read_register: readreg error (reg=127, ret==-71) [ 1707.040841][ T6511] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1707.159938][ T6511] usb 4-1: USB disconnect, device number 107 [ 1707.189888][ T12] net_ratelimit: 32 callbacks suppressed [ 1707.189910][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1707.308805][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1707.428174][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1707.537589][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1707.667093][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1707.708550][ T6511] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 1707.789140][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1707.798128][T26056] usb 7-1: new full-speed USB device number 72 using dummy_hcd [ 1707.877188][ T6511] usb 2-1: Using ep0 maxpacket: 32 [ 1707.894347][ T6511] usb 2-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 1707.907189][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1707.922758][ T6511] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1707.939057][ T6511] usb 2-1: Product: syz [ 1707.945060][ T6511] usb 2-1: Manufacturer: syz [ 1707.951876][T26056] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 1707.951974][ T6511] usb 2-1: SerialNumber: syz [ 1707.974179][ T6511] usb 2-1: config 0 descriptor?? [ 1707.987994][T26056] usb 7-1: config 179 has no interface number 0 [ 1708.001050][T26056] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 10 [ 1708.034330][T26056] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 64 [ 1708.048022][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1708.078389][T26056] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 1708.153058][T26056] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 45824, setting to 64 [ 1708.177104][ T6517] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 1708.208268][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1708.327324][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1708.350533][T26056] usb 7-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1708.516517][ T6517] usb 6-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1708.535930][T26056] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1708.564159][ T6517] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1708.575654][T26056] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1708.632919][ T6517] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1708.634328][T28025] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 1708.673369][ T6517] usb 6-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1708.696776][T28025] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 1709.166301][ T6511] peak_usb 2-1:0.0: PEAK-System PCAN-USB Pro hwrev 0 serial 00000000.00000000 (2 channels) [ 1709.180794][T26056] usb 7-1: USB disconnect, device number 72 [ 1709.186777][ C0] xpad 7-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1709.186810][ C0] xpad 7-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1709.218281][ T6517] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1709.227455][ T6511] peak_usb 2-1:0.0 can0: sending command failure: -22 [ 1709.234324][ T6511] peak_usb 2-1:0.0 can0: sending command failure: -22 [ 1709.255581][ T6517] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1709.359220][ T6511] peak_usb 2-1:0.0: probe with driver peak_usb failed with error -22 [ 1709.460309][ T6511] usb 2-1: USB disconnect, device number 110 [ 1709.564871][ T6517] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1709.598402][ T6517] usb 6-1: invalid MIDI out EP 0 [ 1710.101863][T24250] udevd[24250]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1710.257202][ T6517] snd-usb-audio 6-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1710.349302][T28078] netlink: 152 bytes leftover after parsing attributes in process `syz.1.4517'. [ 1710.362848][T28078] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4517'. [ 1710.453037][T28082] xt_hashlimit: max too large, truncated to 1048576 [ 1711.158243][T26056] usb 7-1: new high-speed USB device number 73 using dummy_hcd [ 1711.229574][ T6517] usb 6-1: USB disconnect, device number 101 [ 1711.290588][T28104] IPVS: sync thread started: state = MASTER, mcast_ifn = sit0, syncid = 4, id = 0 [ 1711.308515][T26056] usb 7-1: Using ep0 maxpacket: 32 [ 1711.354332][T26056] usb 7-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 1711.374206][T26056] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1711.395552][T26056] usb 7-1: Product: syz [ 1711.411529][T26056] usb 7-1: Manufacturer: syz [ 1711.431654][T26056] usb 7-1: SerialNumber: syz [ 1711.473819][T26056] usb 7-1: config 0 descriptor?? [ 1711.707095][ T6517] usb 6-1: new high-speed USB device number 102 using dummy_hcd [ 1711.889192][ T6517] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1711.907066][ T6517] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1711.942970][T26056] RobotFuzz Open Source InterFace, OSIF 7-1:0.0: version d4.15 found at bus 007 address 073 [ 1711.943145][ T6517] usb 6-1: config 0 descriptor?? [ 1712.032901][ T6517] cp210x 6-1:0.0: cp210x converter detected [ 1712.180770][T28092] i2c i2c-1: adapter quirk: no zero length (addr 0x0001, size 0, read) [ 1712.197264][ T13] net_ratelimit: 27 callbacks suppressed [ 1712.197286][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1712.262445][T26056] usb 7-1: USB disconnect, device number 73 [ 1712.378513][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1712.430511][ T6517] cp210x 6-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 1712.488998][ T6517] usb 6-1: cp210x converter now attached to ttyUSB0 [ 1712.497089][T23222] usb 4-1: new full-speed USB device number 108 using dummy_hcd [ 1712.508288][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1712.628006][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1712.679580][T26056] usb 6-1: USB disconnect, device number 102 [ 1712.694053][T26056] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1712.733941][T26056] cp210x 6-1:0.0: device disconnected [ 1712.739862][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1712.793351][T23222] usb 4-1: config 0 has an invalid interface number: 151 but max is 1 [ 1712.811098][T23222] usb 4-1: config 0 has no interface number 1 [ 1712.837784][T23222] usb 4-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1712.858801][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1712.869101][T23222] usb 4-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1712.893681][T28135] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4536'. [ 1712.911413][T23222] usb 4-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1712.980875][T23222] usb 4-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1712.988706][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1713.088413][T23222] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1713.118741][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1713.154923][T23222] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1713.210447][T23222] usb 4-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1713.220097][T23222] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1713.228152][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1713.241994][T23222] usb 4-1: Product: syz [ 1713.247460][T23222] usb 4-1: Manufacturer: syz [ 1713.252206][T23222] usb 4-1: SerialNumber: syz [ 1713.260596][T23222] usb 4-1: config 0 descriptor?? [ 1713.271102][T28126] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1713.301030][T23222] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1713.337677][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1713.367689][T26056] usb 7-1: new full-speed USB device number 74 using dummy_hcd [ 1713.380407][T23222] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1713.519469][T26056] usb 7-1: config 7 has an invalid interface number: 101 but max is 0 [ 1713.540904][T26056] usb 7-1: config 7 has no interface number 0 [ 1713.553194][T26056] usb 7-1: New USB device found, idVendor=0fd9, idProduct=002c, bcdDevice= 6.6b [ 1713.572620][T26056] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1713.589386][T26056] usb 7-1: Product: syz [ 1713.589405][T23222] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1713.648087][T26056] usb 7-1: Manufacturer: syz [ 1713.653047][T26056] usb 7-1: SerialNumber: syz [ 1714.501692][T26056] as10x_usb: device has been detected [ 1714.563534][T26056] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT Deluxe) [ 1714.634573][T26056] usb 7-1: DVB: registering adapter 1 frontend 0 (Elgato EyeTV DTT Deluxe)... [ 1714.754626][T26056] as10x_usb: error during firmware upload part1 [ 1714.788845][T26056] Registered device Elgato EyeTV DTT Deluxe [ 1714.804994][T26056] usb 7-1: USB disconnect, device number 74 [ 1714.886180][T26056] Unregistered device Elgato EyeTV DTT Deluxe [ 1714.895244][T26056] as10x_usb: device has been disconnected [ 1715.919261][T26056] usb 4-1: USB disconnect, device number 108 [ 1716.767120][ T6511] usb 6-1: new full-speed USB device number 103 using dummy_hcd [ 1716.923560][ T6511] usb 6-1: config 0 has an invalid interface number: 151 but max is 1 [ 1716.988188][ T6511] usb 6-1: config 0 has no interface number 1 [ 1717.054390][ T6511] usb 6-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1717.136901][ T6511] usb 6-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1717.186993][ T6511] usb 6-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1717.217088][ T36] net_ratelimit: 28 callbacks suppressed [ 1717.217109][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1717.259787][ T6511] usb 6-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1717.337052][ T6511] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1717.407122][ T6511] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1717.437733][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1717.477092][ T6511] usb 6-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1717.558419][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1717.559192][ T6511] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1717.587905][ T6511] usb 6-1: Product: syz [ 1717.592114][ T6511] usb 6-1: Manufacturer: syz [ 1717.624659][ T6511] usb 6-1: SerialNumber: syz [ 1717.646890][ T6511] usb 6-1: config 0 descriptor?? [ 1717.664703][T28209] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1717.678208][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1717.679523][ T6511] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1717.727598][T16955] usb 7-1: new high-speed USB device number 75 using dummy_hcd [ 1717.752910][ T6511] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1717.790756][ T6511] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1717.799299][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1717.887564][T16955] usb 7-1: Using ep0 maxpacket: 8 [ 1717.901511][T16955] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1717.918858][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1717.939810][T16955] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1717.954301][T28232] hsr0: entered allmulticast mode [ 1717.970486][T28232] hsr_slave_0: entered allmulticast mode [ 1717.976503][T28232] hsr_slave_1: entered allmulticast mode [ 1718.059849][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1718.082632][T16955] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1718.138380][T16955] pvrusb2: ********** [ 1718.142412][T16955] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1718.182539][T16955] pvrusb2: Important functionality might not be entirely working. [ 1718.191085][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1718.267280][ T6511] usb 4-1: new full-speed USB device number 109 using dummy_hcd [ 1718.336143][T16955] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1718.398361][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1718.449025][ T6511] usb 4-1: config 0 has an invalid interface number: 151 but max is 1 [ 1718.457708][ T6511] usb 4-1: config 0 has no interface number 1 [ 1718.465525][ T6511] usb 4-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1718.487584][ T6511] usb 4-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1718.487899][T16955] pvrusb2: ********** [ 1718.524685][ T6511] usb 4-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1718.544614][ T2346] pvrusb2: Invalid write control endpoint [ 1718.551676][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1718.581052][ T6511] usb 4-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1718.697698][ T6511] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1718.732698][ T6511] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1718.751536][T28217] pvrusb2: Killing an I2C write to 1 that is too large (desired=8192 limit=61) [ 1718.768624][T16955] usb 7-1: USB disconnect, device number 75 [ 1718.792981][ T2346] pvrusb2: Invalid write control endpoint [ 1718.808198][ T2346] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1718.818722][ T2346] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1718.826576][ T2346] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1718.843120][ T6511] usb 4-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1718.859383][ T2346] pvrusb2: Device being rendered inoperable [ 1718.865738][ T2346] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1718.865844][ T6511] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1718.874698][ T2346] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1718.894562][ T2346] pvrusb2: Attached sub-driver cx25840 [ 1718.901677][ T2346] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1718.913134][ T2346] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1718.979262][ T6511] usb 4-1: Product: syz [ 1718.988390][ T6511] usb 4-1: Manufacturer: syz [ 1718.998202][ T6511] usb 4-1: SerialNumber: syz [ 1719.013698][ T6511] usb 4-1: config 0 descriptor?? [ 1719.041689][T28236] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1719.057488][ T6511] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1719.119850][ T6511] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1719.235163][T28249] tap0: tun_chr_ioctl cmd 1074025673 [ 1719.235843][ T6511] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1719.747641][T26056] usb 7-1: new high-speed USB device number 76 using dummy_hcd [ 1719.968018][T26056] usb 7-1: Using ep0 maxpacket: 8 [ 1719.979680][T26056] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1719.994074][T26056] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1720.081341][T26056] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1720.095892][T26056] pvrusb2: ********** [ 1720.105886][T26056] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1720.183341][T26056] pvrusb2: Important functionality might not be entirely working. [ 1720.200527][T26056] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1720.220973][T26056] pvrusb2: ********** [ 1720.283582][ T2346] pvrusb2: Invalid write control endpoint [ 1720.335436][ T2346] pvrusb2: Invalid write control endpoint [ 1720.342563][ T2346] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1720.396326][ T2346] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1720.441765][ T2346] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1720.509497][ T6517] usb 6-1: USB disconnect, device number 103 [ 1720.539575][ T2346] pvrusb2: Device being rendered inoperable [ 1720.567727][T16955] usb 7-1: USB disconnect, device number 76 [ 1720.576795][ T2346] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1720.612439][T28275] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4574'. [ 1720.629759][ T2346] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1720.685870][ T2346] pvrusb2: Attached sub-driver cx25840 [ 1720.730738][ T2346] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1720.837095][ T2346] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1721.278717][T28289] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4581'. [ 1721.437665][T16955] usb 7-1: new full-speed USB device number 77 using dummy_hcd [ 1721.487290][T28294] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4582'. [ 1721.520362][T28294] Cannot find map_set index 135 as target [ 1721.622790][T16955] usb 7-1: config 0 has an invalid interface number: 151 but max is 1 [ 1721.628467][T28299] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4585'. [ 1721.650466][T16955] usb 7-1: config 0 has no interface number 1 [ 1721.658494][T28299] Cannot find map_set index 135 as target [ 1721.672601][T16955] usb 7-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1721.686433][T16955] usb 7-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1721.701425][T16955] usb 7-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1721.713570][T16955] usb 7-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1721.730411][T16955] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1721.742844][T16955] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1721.755738][T16955] usb 7-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1721.766049][T16955] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1721.775194][T16955] usb 7-1: Product: syz [ 1721.780604][T16955] usb 7-1: Manufacturer: syz [ 1721.785324][T16955] usb 7-1: SerialNumber: syz [ 1721.803506][T16955] usb 7-1: config 0 descriptor?? [ 1721.820435][ T6511] usb 4-1: USB disconnect, device number 109 [ 1721.836215][T28285] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1721.894064][T16955] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1721.908959][T28301] dvmrp1: tun_chr_ioctl cmd 1074025680 [ 1721.913651][T16955] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1721.952962][T16955] snd-usb-audio 7-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1722.310561][ T12] net_ratelimit: 31 callbacks suppressed [ 1722.310590][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1722.437687][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1722.547688][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1722.657677][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1722.768180][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1722.877614][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1722.908236][T26056] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 1722.988200][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1723.107367][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1723.131069][T26056] usb 6-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1723.167763][T26056] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1723.247167][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1723.270944][T26056] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1723.354293][T26056] usb 6-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1723.375412][T28319] xt_hashlimit: size too large, truncated to 1048576 [ 1723.383662][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1723.424446][T26056] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1723.470621][T26056] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1723.506093][T26056] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1723.514676][T26056] usb 6-1: invalid MIDI out EP 0 [ 1723.664235][T26056] snd-usb-audio 6-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1724.951942][ T6511] usb 7-1: USB disconnect, device number 77 [ 1725.041122][T26056] hid-generic 0000:0000:0000.0021: unknown main item tag 0x1 [ 1725.067837][ T5948] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 1725.106212][T26056] hid-generic 0000:0000:0000.0021: unknown main item tag 0x0 [ 1725.155085][T26056] hid-generic 0000:0000:0000.0021: unknown main item tag 0x0 [ 1725.189186][T26056] hid-generic 0000:0000:0000.0021: unknown main item tag 0x0 [ 1725.200052][T26056] hid-generic 0000:0000:0000.0021: unknown main item tag 0x0 [ 1725.208479][T26056] hid-generic 0000:0000:0000.0021: unknown main item tag 0x0 [ 1725.216150][T26056] hid-generic 0000:0000:0000.0021: unknown main item tag 0x0 [ 1725.224841][T26056] hid-generic 0000:0000:0000.0021: unknown main item tag 0x0 [ 1725.238341][T26056] hid-generic 0000:0000:0000.0021: unknown main item tag 0x2 [ 1725.248462][T26056] hid-generic 0000:0000:0000.0021: unknown main item tag 0x0 [ 1725.268835][T26056] hid-generic 0000:0000:0000.0021: hidraw0: HID v8.00 Device [syz0] on syz0 [ 1725.301391][ T5948] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1725.343509][ T5948] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1725.410508][ T5948] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1725.477861][ T5948] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1725.571206][ T5948] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1725.583080][ T5948] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1725.592657][T28344] fido_id[28344]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1725.651495][ T5948] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1725.686049][ T5948] usb 2-1: invalid MIDI out EP 0 [ 1725.748510][T28353] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4598'. [ 1725.776694][T28353] Cannot find del_set index 0 as target [ 1725.862548][ T5948] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1725.881446][ T5948] usb 6-1: USB disconnect, device number 104 [ 1725.946658][T14351] udevd[14351]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1726.925808][T28366] tap0: tun_chr_ioctl cmd 1074025677 [ 1726.939254][T28366] tap0: linktype set to 776 [ 1727.044591][T28370] vcan0: tx drop: invalid da for name 0x00000000000000f0 [ 1727.094777][T28371] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4604'. [ 1727.106789][T28371] Cannot find map_set index 135 as target [ 1727.117499][ T6511] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 1727.267210][ T6511] usb 4-1: Using ep0 maxpacket: 8 [ 1727.274479][ T6511] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1727.286142][ T6511] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1727.296506][ T6511] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1727.306838][ T6511] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1727.320259][ T6511] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1727.329465][ T6511] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1727.418076][ T12] net_ratelimit: 35 callbacks suppressed [ 1727.418097][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1727.537326][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1727.553439][ T6511] usb 4-1: usb_control_msg returned -32 [ 1727.559534][ T6511] usbtmc 4-1:16.0: can't read capabilities [ 1727.647866][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1727.757810][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1727.868521][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1727.970454][ T6511] usb 2-1: USB disconnect, device number 111 [ 1727.978064][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1728.108677][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1728.217615][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1728.327866][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1728.667098][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1729.692967][T28401] bond0: entered promiscuous mode [ 1729.712607][T28401] bond_slave_0: entered promiscuous mode [ 1729.730618][T28401] bond_slave_1: entered promiscuous mode [ 1729.752374][T28401] bond0: left promiscuous mode [ 1729.758605][T28401] bond_slave_0: left promiscuous mode [ 1729.765410][T28401] bond_slave_1: left promiscuous mode [ 1729.937531][ T6517] usb 4-1: USB disconnect, device number 110 [ 1730.355392][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1730.362620][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1730.657190][ T6517] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 1730.767129][ T6511] usb 7-1: new high-speed USB device number 78 using dummy_hcd [ 1731.037060][ T6511] usb 7-1: Using ep0 maxpacket: 32 [ 1731.141459][ T6517] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1731.165106][ T6517] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1731.190426][ T6517] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1731.212121][ T6517] usb 4-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1731.225686][ T6511] usb 7-1: config 0 has an invalid interface number: 89 but max is 0 [ 1731.237030][ T6511] usb 7-1: config 0 has no interface number 0 [ 1731.257291][ T6511] usb 7-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1731.323845][ T6511] usb 7-1: config 0 interface 89 has no altsetting 0 [ 1731.330800][ T6517] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1731.382711][ T6511] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1731.394428][ T6517] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1731.434728][ T6511] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1731.460752][ T6511] usb 7-1: Product: syz [ 1731.491884][ T6517] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1731.499793][ T6511] usb 7-1: Manufacturer: syz [ 1731.509744][ T6511] usb 7-1: SerialNumber: syz [ 1731.519707][ T6517] usb 4-1: invalid MIDI out EP 0 [ 1731.535031][ T6511] usb 7-1: config 0 descriptor?? [ 1731.555423][ T6511] em28xx 7-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1731.614660][ T6511] em28xx 7-1:0.89: Video interface 89 found: [ 1731.881039][ T6517] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1732.340225][T28423] input: syz1 as /devices/virtual/input/input209 [ 1732.446652][ T6511] em28xx 7-1:0.89: unknown em28xx chip ID (0) [ 1732.489064][ T3559] net_ratelimit: 30 callbacks suppressed [ 1732.489083][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1732.627954][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1732.692370][ T30] kauditd_printk_skb: 49 callbacks suppressed [ 1732.692388][ T30] audit: type=1326 audit(1763908685.745:2632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28434 comm="syz.4.4623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca0d98f749 code=0x7ffc0000 [ 1732.749036][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1732.797149][ T6517] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 1732.834207][ T30] audit: type=1326 audit(1763908685.745:2633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28434 comm="syz.4.4623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca0d98f749 code=0x7ffc0000 [ 1732.858459][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1732.906060][ T30] audit: type=1326 audit(1763908685.745:2634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28434 comm="syz.4.4623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7fca0d98f749 code=0x7ffc0000 [ 1732.966860][ T30] audit: type=1326 audit(1763908685.745:2635): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28434 comm="syz.4.4623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca0d98f749 code=0x7ffc0000 [ 1732.991504][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1733.027090][ T6517] usb 6-1: Using ep0 maxpacket: 32 [ 1733.029916][ T30] audit: type=1326 audit(1763908685.745:2636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28434 comm="syz.4.4623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca0d98f749 code=0x7ffc0000 [ 1733.044973][ T6517] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 1733.108345][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1733.147828][ T6511] em28xx 7-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 1733.165207][ T6517] usb 6-1: config 0 has no interface number 0 [ 1733.191155][ T30] audit: type=1326 audit(1763908685.785:2637): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28434 comm="syz.4.4623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fca0d98f749 code=0x7ffc0000 [ 1733.192027][ T6517] usb 6-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1733.218113][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1733.232299][ T6511] em28xx 7-1:0.89: board has no eeprom [ 1733.295107][ T30] audit: type=1326 audit(1763908685.785:2638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28434 comm="syz.4.4623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca0d98f749 code=0x7ffc0000 [ 1733.327499][ T6511] em28xx 7-1:0.89: Identified as Terratec Grabby (card=67) [ 1733.334771][ T6511] em28xx 7-1:0.89: analog set to bulk mode. [ 1733.349449][ T30] audit: type=1326 audit(1763908685.785:2639): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28434 comm="syz.4.4623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca0d98f749 code=0x7ffc0000 [ 1733.372980][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1733.408400][T23222] em28xx 7-1:0.89: Registering V4L2 extension [ 1733.431489][ T30] audit: type=1326 audit(1763908685.815:2640): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28434 comm="syz.4.4623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7fca0d98f749 code=0x7ffc0000 [ 1733.477764][ T6511] usb 7-1: USB disconnect, device number 78 [ 1733.488762][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1733.511324][ T6517] usb 6-1: config 0 interface 89 has no altsetting 0 [ 1733.519804][ T6511] em28xx 7-1:0.89: Disconnecting em28xx [ 1733.569387][ T30] audit: type=1326 audit(1763908686.325:2641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28434 comm="syz.4.4623" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca0d98f749 code=0x7ffc0000 [ 1733.574704][ T6517] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1733.613683][T23222] em28xx 7-1:0.89: Config register raw data: 0xffffffed [ 1733.622606][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1733.647002][T23222] em28xx 7-1:0.89: AC97 chip type couldn't be determined [ 1733.654068][T23222] em28xx 7-1:0.89: No AC97 audio processor [ 1733.690276][ T6517] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1733.700968][T14063] usb 4-1: USB disconnect, device number 111 [ 1733.753600][T23222] usb 7-1: Decoder not found [ 1733.761473][ T6517] usb 6-1: Product: syz [ 1733.765671][ T6517] usb 6-1: Manufacturer: syz [ 1733.770338][T23222] em28xx 7-1:0.89: failed to create media graph [ 1733.776611][T23222] em28xx 7-1:0.89: V4L2 device video103 deregistered [ 1733.787104][ T6517] usb 6-1: SerialNumber: syz [ 1733.796182][T23222] em28xx 7-1:0.89: Registering snapshot button... [ 1733.808439][ T6517] usb 6-1: config 0 descriptor?? [ 1733.825251][ T6517] em28xx 6-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1733.836544][T23222] input: em28xx snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.89/input/input210 [ 1733.897550][ T6517] em28xx 6-1:0.89: Video interface 89 found: [ 1733.903985][T23222] em28xx 7-1:0.89: Remote control support is not available for this card. [ 1733.947667][ T6511] em28xx 7-1:0.89: Closing input extension [ 1733.953577][ T6511] em28xx 7-1:0.89: Deregistering snapshot button [ 1734.013600][ T6511] em28xx 7-1:0.89: Freeing device [ 1734.036803][T28455] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4627'. [ 1734.066676][T28455] Cannot find map_set index 135 as target [ 1734.438835][ T6517] em28xx 6-1:0.89: unknown em28xx chip ID (0) [ 1734.854479][ T6517] em28xx 6-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1734.863492][ T6517] em28xx 6-1:0.89: board has no eeprom [ 1734.927308][ T6517] em28xx 6-1:0.89: Identified as Terratec Grabby (card=67) [ 1734.962581][ T6517] em28xx 6-1:0.89: analog set to bulk mode. [ 1734.974901][ T6511] em28xx 6-1:0.89: Registering V4L2 extension [ 1735.026341][ T6517] usb 6-1: USB disconnect, device number 105 [ 1735.072842][ T6517] em28xx 6-1:0.89: Disconnecting em28xx [ 1735.151621][ T6511] em28xx 6-1:0.89: Config register raw data: 0xffffffed [ 1735.176028][ T6511] em28xx 6-1:0.89: AC97 chip type couldn't be determined [ 1735.214422][ T6511] em28xx 6-1:0.89: No AC97 audio processor [ 1735.242141][ T6511] usb 6-1: Decoder not found [ 1735.252814][ T6511] em28xx 6-1:0.89: failed to create media graph [ 1735.269906][ T6511] em28xx 6-1:0.89: V4L2 device video103 deregistered [ 1735.290335][ T6511] em28xx 6-1:0.89: Registering snapshot button... [ 1735.334819][ T6511] input: em28xx snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.89/input/input211 [ 1735.452657][ T6511] em28xx 6-1:0.89: Remote control support is not available for this card. [ 1735.521626][T28482] netlink: 504 bytes leftover after parsing attributes in process `syz.5.4635'. [ 1735.524298][ T6517] em28xx 6-1:0.89: Closing input extension [ 1735.572313][ T6517] em28xx 6-1:0.89: Deregistering snapshot button [ 1735.645169][ T6517] em28xx 6-1:0.89: Freeing device [ 1736.477206][ T6517] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 1736.531656][T28499] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4640'. [ 1736.639536][ T6517] usb 6-1: Using ep0 maxpacket: 32 [ 1736.647896][ T6517] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 1736.661932][ T6517] usb 6-1: config 0 has no interface number 0 [ 1736.676406][ T6517] usb 6-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1736.711558][ T6517] usb 6-1: config 0 interface 89 has no altsetting 0 [ 1736.729404][ T6517] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1736.742718][ T6517] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1736.763339][ T6517] usb 6-1: Product: syz [ 1736.767837][ T6517] usb 6-1: Manufacturer: syz [ 1736.773054][ T6517] usb 6-1: SerialNumber: syz [ 1736.781242][ T6517] usb 6-1: config 0 descriptor?? [ 1736.799624][ T6517] em28xx 6-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1736.820388][ T6517] em28xx 6-1:0.89: Video interface 89 found: [ 1737.402836][T28493] input: syz1 as /devices/virtual/input/input212 [ 1737.528354][T22636] net_ratelimit: 29 callbacks suppressed [ 1737.528375][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1737.564489][ T6517] em28xx 6-1:0.89: unknown em28xx chip ID (0) [ 1737.688545][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1737.797710][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1737.907740][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1738.017878][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1738.138158][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1738.258514][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1738.296315][ T30] kauditd_printk_skb: 43 callbacks suppressed [ 1738.296334][ T30] audit: type=1326 audit(1763908691.345:2685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28504 comm="syz.1.4643" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb364b8f749 code=0x7ffc0000 [ 1738.328394][ T30] audit: type=1326 audit(1763908691.385:2686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28504 comm="syz.1.4643" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb364b8f749 code=0x7ffc0000 [ 1738.356545][ T6517] em28xx 6-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 1738.368191][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1738.375775][ T6517] em28xx 6-1:0.89: board has no eeprom [ 1738.439073][ T6517] em28xx 6-1:0.89: Identified as Terratec Grabby (card=67) [ 1738.448554][ T6517] em28xx 6-1:0.89: analog set to bulk mode. [ 1738.465070][T23222] em28xx 6-1:0.89: Registering V4L2 extension [ 1738.522706][ T6517] usb 6-1: USB disconnect, device number 106 [ 1738.539718][ T6517] em28xx 6-1:0.89: Disconnecting em28xx [ 1738.557681][T23222] em28xx 6-1:0.89: Config register raw data: 0xffffffed [ 1738.571357][T23222] em28xx 6-1:0.89: AC97 chip type couldn't be determined [ 1738.590537][T23222] em28xx 6-1:0.89: No AC97 audio processor [ 1738.614916][T23222] usb 6-1: Decoder not found [ 1738.622525][T23222] em28xx 6-1:0.89: failed to create media graph [ 1738.636632][T23222] em28xx 6-1:0.89: V4L2 device video103 deregistered [ 1738.648617][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1738.649761][T23222] em28xx 6-1:0.89: Registering snapshot button... [ 1738.709942][T23222] input: em28xx snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.89/input/input214 [ 1738.721715][T23222] em28xx 6-1:0.89: Remote control support is not available for this card. [ 1738.743320][ T6517] em28xx 6-1:0.89: Closing input extension [ 1738.757633][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1738.772965][ T6517] em28xx 6-1:0.89: Deregistering snapshot button [ 1738.819860][ T6517] em28xx 6-1:0.89: Freeing device [ 1739.356395][T28535] input: syz1 as /devices/virtual/input/input215 [ 1740.271487][T28547] bond0: Device is already in use. [ 1740.383360][T16955] hid_parser_main: 28 callbacks suppressed [ 1740.383382][T16955] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 1740.398506][T16955] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 1740.406108][T16955] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 1740.415168][T16955] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 1740.423217][T16955] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 1740.431576][T16955] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 1740.440644][T16955] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 1740.450924][T16955] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 1740.460986][T16955] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 1740.469185][T16955] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 1740.483313][T16955] hid-generic 0000:0000:0000.0022: hidraw0: HID v8.00 Device [syz0] on syz0 [ 1740.583746][T28550] fido_id[28550]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1741.529233][T28567] input: syz1 as /devices/virtual/input/input216 [ 1741.647105][T28570] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4659'. [ 1742.297762][T16955] usb 6-1: new high-speed USB device number 107 using dummy_hcd [ 1742.458733][T16955] usb 6-1: Using ep0 maxpacket: 8 [ 1742.468333][T16955] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1742.480668][T16955] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1742.492726][T16955] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1742.504682][T16955] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1742.519986][T16955] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1742.531113][T16955] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1742.686899][T28570] team2: entered promiscuous mode [ 1742.696492][T28570] team2: entered allmulticast mode [ 1742.717060][ T3559] net_ratelimit: 20 callbacks suppressed [ 1742.717082][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1742.831817][T16955] usb 6-1: usb_control_msg returned -32 [ 1742.839867][T16955] usbtmc 6-1:16.0: can't read capabilities [ 1742.848159][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1742.957189][ T65] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1743.077151][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1743.197282][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1743.317363][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1743.427181][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1743.537376][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1743.647175][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1743.767124][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1745.090902][T28450] usb 6-1: USB disconnect, device number 107 [ 1745.277270][T23222] usb 7-1: new full-speed USB device number 79 using dummy_hcd [ 1745.470112][T23222] usb 7-1: too many endpoints for config 0 interface 0 altsetting 0: 129, using maximum allowed: 30 [ 1745.481788][T23222] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 1745.493062][T23222] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 1745.506378][T23222] usb 7-1: New USB device found, idVendor=056a, idProduct=00b3, bcdDevice= 0.00 [ 1745.515659][T23222] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1745.529615][T23222] usb 7-1: config 0 descriptor?? [ 1745.542533][T28605] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1745.721944][T28611] input: syz1 as /devices/virtual/input/input217 [ 1745.986831][T23222] wacom 0003:056A:00B3.0023: Unknown device_type for 'HID 056a:00b3'. Assuming pen. [ 1746.034657][T23222] wacom 0003:056A:00B3.0023: hidraw0: USB HID v0.00 Device [HID 056a:00b3] on usb-dummy_hcd.6-1/input0 [ 1746.117964][T23222] input: Wacom Intuos3 12x12 Pen as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:056A:00B3.0023/input/input218 [ 1746.251551][T23222] usb 7-1: USB disconnect, device number 79 [ 1747.757828][ T3559] net_ratelimit: 32 callbacks suppressed [ 1747.757844][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1747.843069][T28630] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4678'. [ 1747.944512][T28630] team3: entered promiscuous mode [ 1747.951938][T28630] team3: entered allmulticast mode [ 1748.007601][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1748.137135][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1748.257061][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1748.508438][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1748.711407][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1748.827759][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1748.937827][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1749.050103][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1749.483143][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1749.972050][T28664] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4685'. [ 1752.681056][T28709] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4701'. [ 1753.057144][T28450] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 1753.232681][T28450] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1753.243334][T28450] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1753.255006][T28450] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1753.265338][T28450] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1753.280616][T28450] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1753.290211][T28450] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1753.311910][T28709] team2: entered promiscuous mode [ 1753.323060][T28450] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1753.330880][T28450] usb 2-1: invalid MIDI out EP 0 [ 1753.378865][T28709] team2: entered allmulticast mode [ 1753.459335][T28450] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1753.518740][ T3559] net_ratelimit: 27 callbacks suppressed [ 1753.518756][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1753.647174][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1753.737966][T28730] loop7: detected capacity change from 16383 to 16384 [ 1753.757251][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1753.788915][T16955] usb 7-1: new high-speed USB device number 80 using dummy_hcd [ 1753.888180][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1753.952206][T16955] usb 7-1: config 0 has no interfaces? [ 1753.967819][T16955] usb 7-1: config 0 has no interfaces? [ 1753.975100][T16955] usb 7-1: config 0 has no interfaces? [ 1753.983345][T16955] usb 7-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 1753.993438][T16955] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 1754.008322][T16955] usb 7-1: Product: syz [ 1754.008544][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1754.021629][T16955] usb 7-1: Manufacturer: syz [ 1754.027987][T16955] usb 7-1: SerialNumber: syz [ 1754.038934][T16955] usb 7-1: config 0 descriptor?? [ 1754.137171][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1754.156530][T28735] syzkaller1: entered promiscuous mode [ 1754.171662][T28735] syzkaller1: entered allmulticast mode [ 1754.221760][T28736] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4709'. [ 1754.248131][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1754.259791][T16955] usb 7-1: USB disconnect, device number 80 [ 1754.381543][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1754.522338][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1754.638004][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1755.704594][T28780] syzkaller1: entered promiscuous mode [ 1755.711660][T28780] syzkaller1: entered allmulticast mode [ 1755.970045][T28450] usb 2-1: USB disconnect, device number 112 [ 1756.268188][T28790] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4725'. [ 1757.067603][T28799] netlink: 7 bytes leftover after parsing attributes in process `syz.3.4729'. [ 1757.268012][T16955] usb 7-1: new full-speed USB device number 81 using dummy_hcd [ 1757.618148][T16955] usb 7-1: config 0 has an invalid interface number: 151 but max is 1 [ 1757.656227][T16955] usb 7-1: config 0 has no interface number 1 [ 1757.672708][T16955] usb 7-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1757.706227][T16955] usb 7-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1757.751808][T16955] usb 7-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1757.778615][T16955] usb 7-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1757.819896][T16955] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1757.851744][T16955] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1757.925585][T16955] usb 7-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1757.956413][T16955] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1757.972997][T16955] usb 7-1: Product: syz [ 1757.978432][T16955] usb 7-1: Manufacturer: syz [ 1757.983353][T16955] usb 7-1: SerialNumber: syz [ 1758.002230][T16955] usb 7-1: config 0 descriptor?? [ 1758.009001][T28797] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1758.023610][T16955] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1758.034703][T16955] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1758.073525][T16955] snd-usb-audio 7-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1758.147123][T28450] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 1758.388770][T28450] usb 2-1: Using ep0 maxpacket: 8 [ 1758.399671][T28450] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1758.422686][T28450] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1758.456755][T28450] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1758.488712][T28450] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1758.540536][T28450] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1758.550673][ T8054] net_ratelimit: 30 callbacks suppressed [ 1758.550687][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1758.605173][T28450] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1758.692056][T28831] loop6: detected capacity change from 0 to 1 [ 1758.718569][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1758.739314][T28831] Dev loop6: unable to read RDB block 1 [ 1758.821760][T28831] loop6: unable to read partition table [ 1758.853904][T28831] loop6: partition table beyond EOD, truncated [ 1758.878062][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1758.915997][T28831] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1758.998717][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1759.038337][T28450] usb 2-1: usb_control_msg returned -32 [ 1759.089759][T28450] usbtmc 2-1:16.0: can't read capabilities [ 1759.142201][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1759.288097][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1759.413999][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1759.529162][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1759.658305][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1759.777633][T28842] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4741'. [ 1759.787442][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1760.421275][T28849] input: syz1 as /devices/virtual/input/input222 [ 1760.653078][ T5948] usb 7-1: USB disconnect, device number 81 [ 1761.045612][T23222] usb 2-1: USB disconnect, device number 113 [ 1763.174001][T28881] input: syz1 as /devices/virtual/input/input224 [ 1763.647600][ T13] net_ratelimit: 28 callbacks suppressed [ 1763.647617][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1763.777578][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1763.897561][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1764.008291][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1764.118644][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1764.145844][T28907] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4757'. [ 1764.210814][T28909] Cannot find map_set index 135 as target [ 1764.343351][T28911] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4754'. [ 1764.353785][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1764.452616][T28912] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4755'. [ 1764.468448][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1764.578359][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1764.697725][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1764.827621][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1765.327707][ T5948] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 1765.508672][ T5948] usb 2-1: Using ep0 maxpacket: 32 [ 1765.515611][ T5948] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 1765.525513][ T5948] usb 2-1: config 0 has no interface number 0 [ 1765.567878][ T5948] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1765.578884][ T5948] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1765.588037][ T5948] usb 2-1: Product: syz [ 1765.592368][ T5948] usb 2-1: Manufacturer: syz [ 1765.599199][ T5948] usb 2-1: SerialNumber: syz [ 1765.605719][ T5948] usb 2-1: config 0 descriptor?? [ 1765.642258][ T5948] smsc95xx v2.0.0 [ 1766.682864][ T5948] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 1766.701208][ T5948] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1766.713495][ T5948] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 1766.725661][ T5948] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 1766.758202][ T5948] usb 2-1: USB disconnect, device number 114 [ 1767.308468][ T30] audit: type=1326 audit(1763908720.355:2687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28944 comm="syz.1.4766" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb364b8f749 code=0x7ffc0000 [ 1767.349803][ T30] audit: type=1326 audit(1763908720.355:2688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28944 comm="syz.1.4766" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb364b8f749 code=0x7ffc0000 [ 1767.398293][ T30] audit: type=1326 audit(1763908720.355:2689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28944 comm="syz.1.4766" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7fb364b8f749 code=0x7ffc0000 [ 1767.422238][ T30] audit: type=1326 audit(1763908720.355:2690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28944 comm="syz.1.4766" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb364b8f749 code=0x7ffc0000 [ 1767.445232][T23222] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 1767.474045][ T30] audit: type=1326 audit(1763908720.355:2691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28944 comm="syz.1.4766" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb364b8f749 code=0x7ffc0000 [ 1767.497245][ T30] audit: type=1326 audit(1763908720.355:2692): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28944 comm="syz.1.4766" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fb364b8f749 code=0x7ffc0000 [ 1767.519785][ T30] audit: type=1326 audit(1763908720.355:2693): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28944 comm="syz.1.4766" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb364b8f749 code=0x7ffc0000 [ 1767.542373][ T30] audit: type=1326 audit(1763908720.355:2694): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28944 comm="syz.1.4766" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb364b8f749 code=0x7ffc0000 [ 1767.566709][ T30] audit: type=1326 audit(1763908720.355:2695): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28944 comm="syz.1.4766" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7fb364b8f749 code=0x7ffc0000 [ 1767.590063][ T30] audit: type=1326 audit(1763908720.355:2696): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28944 comm="syz.1.4766" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb364b8f749 code=0x7ffc0000 [ 1767.669770][T23222] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1767.682417][T23222] usb 4-1: config 0 has no interface number 0 [ 1767.692217][T23222] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1767.702068][T23222] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1767.710615][T23222] usb 4-1: Product: syz [ 1767.715724][T23222] usb 4-1: Manufacturer: syz [ 1767.721315][T23222] usb 4-1: SerialNumber: syz [ 1767.732888][T23222] usb 4-1: config 0 descriptor?? [ 1767.970998][T23222] usb 4-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 1768.010795][T23222] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1768.038296][T23222] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 1768.056667][T23222] usb 4-1: media controller created [ 1768.098790][T23222] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1768.279802][T28964] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4769'. [ 1768.659134][ T36] net_ratelimit: 32 callbacks suppressed [ 1768.659156][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1768.798218][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1768.907890][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1769.017712][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1769.127832][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1769.237874][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1769.347806][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1769.478430][T23222] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 1769.548691][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1769.681571][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1769.797702][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1769.942346][T23222] usb 4-1: USB disconnect, device number 112 [ 1770.272716][T28992] Invalid logical block size (-2) [ 1770.437466][T26056] usb 7-1: new high-speed USB device number 82 using dummy_hcd [ 1770.475178][T28997] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4772'. [ 1770.607773][T26056] usb 7-1: Using ep0 maxpacket: 8 [ 1770.736225][T26056] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1770.747580][T23222] usb 4-1: new full-speed USB device number 113 using dummy_hcd [ 1770.768814][T26056] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1770.807774][T26056] usb 7-1: Product: syz [ 1770.839996][T26056] usb 7-1: Manufacturer: syz [ 1770.855728][T26056] usb 7-1: SerialNumber: syz [ 1770.898962][T23222] usb 4-1: config 0 has an invalid interface number: 151 but max is 1 [ 1770.957720][T23222] usb 4-1: config 0 has no interface number 1 [ 1770.997453][T23222] usb 4-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1771.057623][T23222] usb 4-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1771.142205][T23222] usb 4-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1771.168581][T26056] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 82 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1771.211313][T23222] usb 4-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1771.296012][T23222] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1771.336993][T23222] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1771.375207][T23222] usb 4-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1771.405202][T23222] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1771.457008][T23222] usb 4-1: Product: syz [ 1771.461286][T23222] usb 4-1: Manufacturer: syz [ 1771.465865][T23222] usb 4-1: SerialNumber: syz [ 1771.517715][T23222] usb 4-1: config 0 descriptor?? [ 1771.563490][T28995] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1771.588100][T23222] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1771.602447][T23222] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1771.683093][T23222] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1771.709859][T29006] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4785'. [ 1771.993455][ T6517] usb 7-1: USB disconnect, device number 82 [ 1772.012925][ T6517] usblp0: removed [ 1772.884825][T29024] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4789'. [ 1773.448159][T26056] usb 6-1: new full-speed USB device number 108 using dummy_hcd [ 1773.697924][ T3559] net_ratelimit: 32 callbacks suppressed [ 1773.697940][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1773.779228][T26056] usb 6-1: config 0 has an invalid interface number: 151 but max is 1 [ 1773.837096][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1773.847673][T26056] usb 6-1: config 0 has no interface number 1 [ 1773.894283][T26056] usb 6-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1773.947370][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1773.968054][T26056] usb 6-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1774.028030][T26056] usb 6-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1774.057232][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1774.095268][T26056] usb 6-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1774.146244][T26056] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1774.168538][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1774.207878][T26056] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1774.235311][T26056] usb 6-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1774.268597][T26056] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1774.278405][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1774.318583][T26056] usb 6-1: Product: syz [ 1774.322772][T26056] usb 6-1: Manufacturer: syz [ 1774.359863][T26056] usb 6-1: SerialNumber: syz [ 1774.392464][T26056] usb 6-1: config 0 descriptor?? [ 1774.407267][T29029] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1774.408529][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1774.435405][T26056] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1774.460983][T16955] usb 4-1: USB disconnect, device number 113 [ 1774.558556][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1774.617557][ T6517] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 1774.639133][T26056] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1774.679188][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1774.772171][T26056] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1774.795182][ T6517] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1774.805831][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1774.856310][ T6517] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1774.929971][ T6517] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1774.987697][T16955] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 1775.031913][ T6517] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1775.083925][ T6517] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1775.142629][ T6517] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1775.150231][T16955] usb 4-1: Using ep0 maxpacket: 32 [ 1775.165132][T16955] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 1775.196781][T16955] usb 4-1: config 0 has no interface number 0 [ 1775.231249][T16955] usb 4-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1775.280834][T16955] usb 4-1: config 0 interface 89 has no altsetting 0 [ 1775.315000][T16955] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1775.353304][ T6517] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1775.364402][T16955] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1775.378005][ T6517] usb 2-1: invalid MIDI out EP 0 [ 1775.403365][T16955] usb 4-1: Product: syz [ 1775.425260][T16955] usb 4-1: Manufacturer: syz [ 1775.479479][T16955] usb 4-1: SerialNumber: syz [ 1775.518439][T16955] usb 4-1: config 0 descriptor?? [ 1775.600151][T16955] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1775.666393][T16955] em28xx 4-1:0.89: Video interface 89 found: [ 1775.706063][ T6517] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1775.798685][ C0] usb 6-1: usb_submit_urb: -1 [ 1776.226868][T29046] input: syz1 as /devices/virtual/input/input227 [ 1776.248432][T29057] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4797'. [ 1776.362043][T16955] em28xx 4-1:0.89: unknown em28xx chip ID (0) [ 1777.163687][T16955] em28xx 4-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 1777.212097][ T6517] usb 2-1: USB disconnect, device number 115 [ 1777.248965][T16955] em28xx 4-1:0.89: board has no eeprom [ 1777.317899][T16955] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67) [ 1777.340880][T16955] em28xx 4-1:0.89: analog set to bulk mode. [ 1777.358338][ T5948] em28xx 4-1:0.89: Registering V4L2 extension [ 1777.381343][T16955] usb 4-1: USB disconnect, device number 114 [ 1777.399357][T16955] em28xx 4-1:0.89: Disconnecting em28xx [ 1777.472527][T26056] usb 6-1: USB disconnect, device number 108 [ 1777.650913][ T5948] em28xx 4-1:0.89: Config register raw data: 0xffffffed [ 1777.700083][ T30] kauditd_printk_skb: 35 callbacks suppressed [ 1777.700101][ T30] audit: type=1326 audit(1763908730.755:2732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29062 comm="syz.5.4800" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20f7d8f749 code=0x7ffc0000 [ 1777.733733][ T5948] em28xx 4-1:0.89: AC97 chip type couldn't be determined [ 1777.764414][ T5948] em28xx 4-1:0.89: No AC97 audio processor [ 1777.795289][ T5948] usb 4-1: Decoder not found [ 1777.801875][ T5948] em28xx 4-1:0.89: failed to create media graph [ 1777.831497][ T5948] em28xx 4-1:0.89: V4L2 device video103 deregistered [ 1777.861798][ T5948] em28xx 4-1:0.89: Registering snapshot button... [ 1777.868984][T17853] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 1777.891630][ T5948] input: em28xx snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.89/input/input228 [ 1777.911955][ T30] audit: type=1326 audit(1763908730.785:2733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29062 comm="syz.5.4800" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20f7d8f749 code=0x7ffc0000 [ 1777.976100][ T5948] em28xx 4-1:0.89: Remote control support is not available for this card. [ 1778.007038][ T30] audit: type=1326 audit(1763908730.795:2734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29062 comm="syz.5.4800" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f20f7d8f749 code=0x7ffc0000 [ 1778.047683][T16955] em28xx 4-1:0.89: Closing input extension [ 1778.054247][T16955] em28xx 4-1:0.89: Deregistering snapshot button [ 1778.062252][T17853] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1778.120358][T17853] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1778.133065][T16955] em28xx 4-1:0.89: Freeing device [ 1778.156881][ T30] audit: type=1326 audit(1763908730.795:2735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29062 comm="syz.5.4800" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20f7d8f749 code=0x7ffc0000 [ 1778.185591][T17853] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1778.249052][T17853] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1778.270151][ T30] audit: type=1326 audit(1763908730.795:2736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29062 comm="syz.5.4800" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20f7d8f749 code=0x7ffc0000 [ 1778.314743][T17853] usb 2-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1778.361168][T17853] usb 2-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1778.386507][T17853] usb 2-1: Manufacturer: syz [ 1778.403039][T17853] usb 2-1: config 0 descriptor?? [ 1778.449902][ T30] audit: type=1326 audit(1763908730.795:2737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29062 comm="syz.5.4800" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f20f7d8f749 code=0x7ffc0000 [ 1778.568475][ T30] audit: type=1326 audit(1763908730.795:2738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29062 comm="syz.5.4800" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20f7d8f749 code=0x7ffc0000 [ 1778.596575][ T30] audit: type=1326 audit(1763908730.795:2739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29062 comm="syz.5.4800" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20f7d8f749 code=0x7ffc0000 [ 1778.658744][ T30] audit: type=1326 audit(1763908730.795:2740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29062 comm="syz.5.4800" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f20f7d8f749 code=0x7ffc0000 [ 1778.725574][ T30] audit: type=1326 audit(1763908730.795:2741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29062 comm="syz.5.4800" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20f7d8f749 code=0x7ffc0000 [ 1778.807747][ T8054] net_ratelimit: 35 callbacks suppressed [ 1778.807765][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1778.855099][T17853] hid_parser_main: 33 callbacks suppressed [ 1778.855115][T17853] appleir 0003:05AC:8243.0024: unknown main item tag 0x0 [ 1778.927703][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1778.968560][T17853] appleir 0003:05AC:8243.0024: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.1-1/input0 [ 1779.048791][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1779.129983][T14063] usb 2-1: USB disconnect, device number 116 [ 1779.177259][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1779.264219][T29092] fido_id[29092]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 1779.308417][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1779.418330][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1779.559669][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1779.677397][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1779.798461][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1779.908438][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1780.068194][T17853] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 1780.228054][T17853] usb 2-1: Using ep0 maxpacket: 8 [ 1780.236395][T17853] usb 2-1: config index 0 descriptor too short (expected 30, got 18) [ 1780.252149][T17853] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1780.268119][T17853] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1780.296564][T17853] usb 2-1: Product: syz [ 1780.312801][T17853] usb 2-1: Manufacturer: syz [ 1780.340052][T17853] usb 2-1: SerialNumber: syz [ 1780.382132][T17853] usb 2-1: config 0 descriptor?? [ 1780.404951][T17853] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 1780.414558][T17853] usb 2-1: setting power ON [ 1780.420725][T17853] dvb-usb: bulk message failed: -22 (2/0) [ 1780.434030][T17853] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1780.446015][T17853] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 1780.456549][T17853] usb 2-1: media controller created [ 1780.495448][T29111] netlink: 56 bytes leftover after parsing attributes in process `syz.6.4810'. [ 1780.496666][T17853] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1780.591855][T17853] usb 2-1: selecting invalid altsetting 6 [ 1780.605802][T17853] usb 2-1: digital interface selection failed (-22) [ 1780.624120][T29102] dvb-usb: bulk message failed: -22 (3/0) [ 1780.631504][T29102] cxusb: i2c wr: len=79 is too big! [ 1780.631504][T29102] [ 1780.642301][T17853] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 1780.666496][T17853] usb 2-1: setting power OFF [ 1780.680930][T17853] dvb-usb: bulk message failed: -22 (2/0) [ 1780.701498][T17853] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 1780.712579][T17853] (NULL device *): no alternate interface [ 1780.768309][T17853] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 1780.816351][T17853] usb 2-1: USB disconnect, device number 117 [ 1781.819049][T29134] netlink: 9 bytes leftover after parsing attributes in process `syz.5.4817'. [ 1781.842680][T29130] input: syz1 as /devices/virtual/input/input229 [ 1782.290991][T29141] netlink: 112 bytes leftover after parsing attributes in process `syz.5.4819'. [ 1783.819715][ T3559] net_ratelimit: 30 callbacks suppressed [ 1783.819730][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1784.038518][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1784.178352][T29174] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4825'. [ 1784.198556][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1784.319146][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1784.448230][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1784.567811][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1784.818709][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1784.977096][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1785.088973][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1785.319790][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1785.490590][T29191] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4834'. [ 1785.557906][T29192] Cannot find map_set index 135 as target [ 1785.598233][T17853] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 1785.768330][T17853] usb 4-1: Using ep0 maxpacket: 16 [ 1785.775554][T17853] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1785.796782][T17853] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1785.812960][T17853] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1785.829053][T17853] usb 4-1: config 0 descriptor?? [ 1786.030879][T29191] bond3: (slave bridge0): Releasing active interface [ 1786.272268][T17853] mcp2221 0003:04D8:00DD.0025: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 1786.511481][T14063] usb 4-1: USB disconnect, device number 115 [ 1787.527064][T14063] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 1787.682142][T14063] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1787.712870][T14063] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1787.782391][T14063] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1787.793032][T14063] usb 4-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1787.813891][T14063] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1787.834541][T14063] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1787.856784][T14063] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1787.871941][T14063] usb 4-1: invalid MIDI out EP 0 [ 1788.014507][T14063] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1788.677655][T17853] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 1788.827797][ T8054] net_ratelimit: 24 callbacks suppressed [ 1788.827811][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1788.842401][T17853] usb 6-1: Using ep0 maxpacket: 8 [ 1788.850098][T17853] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1788.880453][T17853] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1788.962316][T17853] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1788.978016][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1789.005197][T17853] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1789.107824][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1789.116542][T17853] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1789.126749][T17853] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1789.217971][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1789.337660][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1789.361773][T17853] usb 6-1: usb_control_msg returned -32 [ 1789.368555][T17853] usbtmc 6-1:16.0: can't read capabilities [ 1789.438139][T16955] usb 7-1: new high-speed USB device number 83 using dummy_hcd [ 1789.457086][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1789.577625][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1789.608035][T16955] usb 7-1: Using ep0 maxpacket: 16 [ 1789.620428][T16955] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1789.635097][T16955] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1789.646485][T16955] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1789.655335][T16955] usb 7-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 1789.669598][T16955] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1789.683380][T16955] usb 7-1: config 0 descriptor?? [ 1789.689208][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1789.797671][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1789.907789][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1790.061071][T26056] hid-generic 0000:0000:0000.0026: unknown main item tag 0x7 [ 1790.070055][T26056] hid-generic 0000:0000:0000.0026: ignoring exceeding usage max [ 1790.080686][T26056] hid-generic 0000:0000:0000.0026: unknown main item tag 0x0 [ 1790.089457][T26056] hid-generic 0000:0000:0000.0026: unknown main item tag 0x6 [ 1790.098178][T26056] hid-generic 0000:0000:0000.0026: reserved main item tag 0xd [ 1790.116383][T26056] hid-generic 0000:0000:0000.0026: hidraw0: HID v0.00 Device [syz0] on syz0 [ 1790.154585][T29224] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1790.194102][T29224] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1790.217962][T16955] hid (null): global environment stack underflow [ 1790.365366][T23222] usb 4-1: USB disconnect, device number 116 [ 1790.379632][T16955] cougar 0003:060B:500A.0027: unknown main item tag 0x0 [ 1790.400520][T16955] cougar 0003:060B:500A.0027: unknown main item tag 0x0 [ 1790.406466][T29234] fido_id[29234]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1790.419831][T16955] cougar 0003:060B:500A.0027: unknown main item tag 0x0 [ 1790.436236][T16955] cougar 0003:060B:500A.0027: unknown main item tag 0x0 [ 1790.628182][T16955] cougar 0003:060B:500A.0027: unknown main item tag 0x0 [ 1790.635544][T16955] cougar 0003:060B:500A.0027: unknown main item tag 0x0 [ 1790.656623][T16955] cougar 0003:060B:500A.0027: unknown main item tag 0x0 [ 1790.736462][T16955] cougar 0003:060B:500A.0027: global environment stack underflow [ 1790.766739][T16955] cougar 0003:060B:500A.0027: item 0 4 1 11 parsing failed [ 1790.786172][T16955] cougar 0003:060B:500A.0027: parse failed [ 1790.799076][T16955] cougar 0003:060B:500A.0027: probe with driver cougar failed with error -22 [ 1790.844495][T16955] usb 7-1: USB disconnect, device number 83 [ 1790.894829][T29257] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4856'. [ 1790.905651][T29257] netlink: 452 bytes leftover after parsing attributes in process `syz.3.4856'. [ 1791.025086][T29257] input: syz1 as /devices/virtual/input/input232 [ 1791.411133][ T6517] usb 6-1: USB disconnect, device number 109 [ 1791.560705][T29268] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4860'. [ 1791.627698][T29267] Cannot find map_set index 135 as target [ 1791.733681][T29274] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4859'. [ 1791.818666][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1791.825363][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1792.930207][T29290] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4862'. [ 1793.029302][T29290] Cannot find del_set index 0 as target [ 1793.518139][T26056] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 1793.668326][T26056] usb 6-1: Using ep0 maxpacket: 32 [ 1793.676082][T26056] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1793.690042][T26056] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1793.701343][T26056] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 1793.714150][T26056] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1793.729576][T26056] usb 6-1: config 0 descriptor?? [ 1793.759499][T29296] netlink: 'syz.1.4866': attribute type 2 has an invalid length. [ 1793.897093][ T13] net_ratelimit: 23 callbacks suppressed [ 1793.897115][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1794.028479][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1794.173145][T26056] savu 0003:1E7D:2D5A.0028: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.5-1/input0 [ 1794.187188][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1794.198026][T17853] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 1794.318312][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1794.367794][T17853] usb 2-1: Using ep0 maxpacket: 8 [ 1794.374505][T17853] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 1794.390980][T17853] usb 2-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 1794.400763][T17853] usb 2-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 1794.411221][T17853] usb 2-1: Product: syz [ 1794.415501][T17853] usb 2-1: Manufacturer: syz [ 1794.421158][T17853] usb 2-1: SerialNumber: syz [ 1794.428069][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1794.439756][ T6517] usb 6-1: USB disconnect, device number 110 [ 1794.557950][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1794.664842][T17853] usb 2-1: Handspring Visor / Palm OS: No valid connect info available [ 1794.668390][T29313] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4872'. [ 1794.676567][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1794.691416][T17853] usb 2-1: Handspring Visor / Palm OS: port 109, is for unknown use [ 1794.700394][T17853] usb 2-1: Handspring Visor / Palm OS: port 211, is for unknown use [ 1794.711097][T17853] usb 2-1: Handspring Visor / Palm OS: Number of ports: 2 [ 1794.797518][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1794.865674][T17853] visor 2-1:1.0: Handspring Visor / Palm OS converter detected [ 1794.876446][T17853] usb 2-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 1794.890700][T17853] usb 2-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 1794.907871][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1795.018357][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1795.094291][T17853] usb 2-1: USB disconnect, device number 118 [ 1795.121321][T17853] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 1795.152848][T17853] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 1795.178746][T17853] visor 2-1:1.0: device disconnected [ 1795.277169][ T6517] usb 6-1: new full-speed USB device number 111 using dummy_hcd [ 1795.429347][ T6517] usb 6-1: config 0 has an invalid interface number: 151 but max is 1 [ 1795.446231][ T6517] usb 6-1: config 0 has no interface number 1 [ 1795.459611][ T6517] usb 6-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1795.471661][ T6517] usb 6-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1795.490059][ T6517] usb 6-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1795.513933][ T6517] usb 6-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1795.542832][ T6517] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1795.571738][ T6517] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1795.595926][ T6517] usb 6-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1795.605341][ T6517] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1795.613505][ T6517] usb 6-1: Product: syz [ 1795.622727][ T6517] usb 6-1: Manufacturer: syz [ 1795.634533][ T6517] usb 6-1: SerialNumber: syz [ 1795.654831][ T6517] usb 6-1: config 0 descriptor?? [ 1795.678617][T29319] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1795.721537][ T6517] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1795.743381][ T6517] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1795.787428][ T6517] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1796.121529][ T30] kauditd_printk_skb: 79 callbacks suppressed [ 1796.121547][ T30] audit: type=1326 audit(1763908749.175:2821): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29327 comm="syz.3.4876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1796.194263][ T30] audit: type=1326 audit(1763908749.215:2822): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29327 comm="syz.3.4876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1796.226482][ T30] audit: type=1326 audit(1763908749.215:2823): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29327 comm="syz.3.4876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1796.487983][ T30] audit: type=1326 audit(1763908749.215:2824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29327 comm="syz.3.4876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1796.550734][T29347] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4879'. [ 1796.580655][T29347] netlink: 64 bytes leftover after parsing attributes in process `syz.6.4879'. [ 1796.597118][ T30] audit: type=1326 audit(1763908749.215:2825): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29327 comm="syz.3.4876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1796.638801][T29347] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4879'. [ 1796.665080][T29347] netlink: 152 bytes leftover after parsing attributes in process `syz.6.4879'. [ 1796.677637][ T30] audit: type=1326 audit(1763908749.215:2826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29327 comm="syz.3.4876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1796.723061][T29348] input: syz1 as /devices/virtual/input/input233 [ 1796.777970][ T30] audit: type=1326 audit(1763908749.215:2827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29327 comm="syz.3.4876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1796.901539][ T30] audit: type=1326 audit(1763908749.215:2828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29327 comm="syz.3.4876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1797.002672][ T30] audit: type=1326 audit(1763908749.215:2829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29327 comm="syz.3.4876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1797.132084][ T30] audit: type=1326 audit(1763908749.215:2830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29327 comm="syz.3.4876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1799.136217][T22636] net_ratelimit: 26 callbacks suppressed [ 1799.136231][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1799.201315][T26056] usb 6-1: USB disconnect, device number 111 [ 1799.325688][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1799.447908][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1799.557553][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1799.667772][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1799.867704][ T3559] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1800.047708][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1800.189433][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1800.297608][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1800.407167][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1800.660274][T29396] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4889'. [ 1800.679734][T29396] netlink: 452 bytes leftover after parsing attributes in process `syz.6.4889'. [ 1800.803471][T29396] input: syz1 as /devices/virtual/input/input234 [ 1801.199758][ T30] kauditd_printk_skb: 65 callbacks suppressed [ 1801.199775][ T30] audit: type=1326 audit(1763908754.255:2896): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29399 comm="syz.4.4893" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca0d98f749 code=0x7ffc0000 [ 1801.231919][ T30] audit: type=1326 audit(1763908754.285:2897): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29399 comm="syz.4.4893" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fca0d98f749 code=0x7ffc0000 [ 1801.321205][T29405] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4894'. [ 1802.157272][T14063] usb 4-1: new full-speed USB device number 117 using dummy_hcd [ 1802.344190][T14063] usb 4-1: config 0 has an invalid interface number: 151 but max is 1 [ 1802.362897][T14063] usb 4-1: config 0 has no interface number 1 [ 1802.383141][T14063] usb 4-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1802.416093][T29432] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4902'. [ 1802.445624][T14063] usb 4-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1802.480651][T14063] usb 4-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1802.515820][T14063] usb 4-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1802.532577][T29432] netlink: 452 bytes leftover after parsing attributes in process `syz.4.4902'. [ 1802.596681][T29433] input: syz1 as /devices/virtual/input/input235 [ 1802.606204][T14063] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1802.648165][T14063] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1802.711413][T14063] usb 4-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1802.732988][T14063] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1802.749481][T14063] usb 4-1: Product: syz [ 1802.758612][T14063] usb 4-1: Manufacturer: syz [ 1802.768024][T14063] usb 4-1: SerialNumber: syz [ 1802.781248][T14063] usb 4-1: config 0 descriptor?? [ 1802.793618][T29415] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1802.809552][T14063] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1802.859367][T14063] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1803.011587][T14063] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1803.831445][T29446] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4905'. [ 1804.567900][ T13] net_ratelimit: 20 callbacks suppressed [ 1804.567916][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1804.828878][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1804.997142][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1805.128135][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1805.268146][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1805.407132][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1805.537734][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1805.648138][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1805.821995][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1805.997637][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1806.134236][T29476] netlink: 'syz.5.4910': attribute type 9 has an invalid length. [ 1806.193000][T29476] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4910'. [ 1806.276218][T29476] macvlan2: entered promiscuous mode [ 1806.288248][T29476] hsr0: entered promiscuous mode [ 1806.306610][T29476] macvlan2: entered allmulticast mode [ 1806.326709][T29476] hsr0: entered allmulticast mode [ 1806.345083][T29476] hsr_slave_0: entered allmulticast mode [ 1806.411586][T29476] hsr_slave_1: entered allmulticast mode [ 1806.622396][T26056] usb 4-1: USB disconnect, device number 117 [ 1807.731639][T29501] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4914'. [ 1808.259784][T29506] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4920'. [ 1808.274347][T29506] Cannot find del_set index 0 as target [ 1808.626456][T29517] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4923'. [ 1808.689658][T29517] Cannot find map_set index 135 as target [ 1808.756551][ T30] audit: type=1326 audit(1763908761.805:2898): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29516 comm="syz.3.4924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1808.806201][ T30] audit: type=1326 audit(1763908761.835:2899): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29516 comm="syz.3.4924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1808.830878][ T30] audit: type=1326 audit(1763908761.835:2900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29516 comm="syz.3.4924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1808.854899][ T30] audit: type=1326 audit(1763908761.835:2901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29516 comm="syz.3.4924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1808.878673][ T30] audit: type=1326 audit(1763908761.835:2902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29516 comm="syz.3.4924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1808.909415][ T30] audit: type=1326 audit(1763908761.835:2903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29516 comm="syz.3.4924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1808.932867][ T30] audit: type=1326 audit(1763908761.835:2904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29516 comm="syz.3.4924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1808.958430][ T30] audit: type=1326 audit(1763908761.835:2905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29516 comm="syz.3.4924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1808.984564][ T30] audit: type=1326 audit(1763908761.835:2906): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29516 comm="syz.3.4924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1809.008893][ T30] audit: type=1326 audit(1763908761.835:2907): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29516 comm="syz.3.4924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f199e98f749 code=0x7ffc0000 [ 1809.609037][ T13] net_ratelimit: 23 callbacks suppressed [ 1809.609053][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1809.728121][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1809.868451][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1809.977781][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1810.498068][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1810.572372][T29544] vcan0: tx drop: invalid sa for name 0x0000020000000000 [ 1810.926577][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1811.127168][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1811.237433][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1811.260877][T29553] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4932'. [ 1811.300036][T29553] Cannot find del_set index 0 as target [ 1811.358468][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1811.471774][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1812.380122][T29581] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4940'. [ 1812.448662][T29581] team3: entered promiscuous mode [ 1812.454254][T29581] team3: entered allmulticast mode [ 1813.346617][T29594] netlink: 56 bytes leftover after parsing attributes in process `syz.6.4945'. [ 1813.387590][T26056] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 1813.549415][T26056] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1813.558905][T26056] usb 2-1: config 0 has no interface number 0 [ 1813.584381][T26056] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1813.625449][T26056] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1813.735515][T26056] usb 2-1: Product: syz [ 1813.741459][T26056] usb 2-1: Manufacturer: syz [ 1813.751198][T26056] usb 2-1: SerialNumber: syz [ 1813.769838][T26056] usb 2-1: config 0 descriptor?? [ 1813.791902][ T30] kauditd_printk_skb: 46 callbacks suppressed [ 1813.791921][ T30] audit: type=1326 audit(1763908766.845:2954): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29597 comm="syz.5.4946" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f20f7d8f749 code=0x7ffc0000 [ 1813.989314][T26056] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 1814.012561][ T30] audit: type=1326 audit(1763908767.065:2955): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29597 comm="syz.5.4946" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20f7d8f749 code=0x7ffc0000 [ 1814.043369][ T30] audit: type=1326 audit(1763908767.085:2956): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29597 comm="syz.5.4946" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20f7d8f749 code=0x7ffc0000 [ 1814.088362][T26056] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1814.142621][T26056] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 1814.170980][T26056] usb 2-1: media controller created [ 1814.271057][T26056] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1814.628419][ T13] net_ratelimit: 25 callbacks suppressed [ 1814.628437][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1814.729036][T26056] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 1814.816786][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1814.849043][T26056] usb 2-1: USB disconnect, device number 119 [ 1814.947636][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1815.057792][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1815.207951][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1815.337265][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1815.468658][T22636] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1815.577616][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1815.687632][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1815.797732][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1815.841053][T29624] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4954'. [ 1815.914345][T29626] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4955'. [ 1816.358218][T17853] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 1816.527635][T17853] usb 4-1: device descriptor read/64, error -71 [ 1816.807411][T17853] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 1816.967714][T17853] usb 4-1: device descriptor read/64, error -71 [ 1817.078429][T17853] usb usb4-port1: attempt power cycle [ 1817.417992][T17853] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 1817.574437][T17853] usb 4-1: device descriptor read/8, error -71 [ 1817.644935][T29660] batadv_slave_1: entered promiscuous mode [ 1817.652548][T29659] batadv_slave_1: left promiscuous mode [ 1817.817630][T17853] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 1817.858241][T17853] usb 4-1: device descriptor read/8, error -71 [ 1817.980772][T17853] usb usb4-port1: unable to enumerate USB device [ 1818.849150][T29676] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4962'. [ 1819.017039][T14063] usb 2-1: new full-speed USB device number 120 using dummy_hcd [ 1819.169135][T14063] usb 2-1: config 0 has an invalid interface number: 151 but max is 1 [ 1819.177809][T14063] usb 2-1: config 0 has no interface number 1 [ 1819.199911][T14063] usb 2-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1819.359164][T14063] usb 2-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1819.444268][T14063] usb 2-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 64 [ 1819.461678][T14063] usb 2-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1819.476086][T14063] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC9, changing to 0x89 [ 1819.489019][T14063] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1819.502511][T14063] usb 2-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1819.512006][T14063] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1819.520375][T14063] usb 2-1: Product: syz [ 1819.524650][T14063] usb 2-1: Manufacturer: syz [ 1819.529953][T14063] usb 2-1: SerialNumber: syz [ 1819.551627][T14063] usb 2-1: config 0 descriptor?? [ 1819.563692][T29675] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1819.574250][T14063] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1819.585841][T14063] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1819.610056][T14063] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 1819.683565][ T13] net_ratelimit: 34 callbacks suppressed [ 1819.683585][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1819.817989][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1819.977587][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1820.118125][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1820.248200][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1820.485099][ T36] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1820.708210][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1820.817610][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1820.927712][ T13] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1821.167780][ T8054] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 1821.267925][T26056] usb 6-1: new high-speed USB device number 112 using dummy_hcd [ 1821.558227][T26056] usb 6-1: device descriptor read/64, error -71 [ 1821.807609][T26056] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 1821.837004][T14063] usb 7-1: new high-speed USB device number 84 using dummy_hcd [ 1821.968025][T26056] usb 6-1: device descriptor read/64, error -71 [ 1821.987090][T14063] usb 7-1: Using ep0 maxpacket: 32 [ 1821.994052][T14063] usb 7-1: config 0 has an invalid interface number: 89 but max is 0 [ 1822.030469][T14063] usb 7-1: config 0 has no interface number 0 [ 1822.077619][T26056] usb usb6-port1: attempt power cycle [ 1822.084604][T14063] usb 7-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1822.139541][T14063] usb 7-1: config 0 interface 89 has no altsetting 0 [ 1822.152846][T14063] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1822.189326][T17853] usb 2-1: USB disconnect, device number 120 [ 1822.195537][T14063] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1822.212556][T14063] usb 7-1: Product: syz [ 1822.217873][T14063] usb 7-1: Manufacturer: syz [ 1822.243398][T14063] usb 7-1: SerialNumber: syz [ 1822.321044][T14063] usb 7-1: config 0 descriptor?? [ 1822.340371][T14063] em28xx 7-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1822.350529][T14063] em28xx 7-1:0.89: Video interface 89 found: [ 1822.428261][T26056] usb 6-1: new high-speed USB device number 114 using dummy_hcd [ 1822.461659][T26056] usb 6-1: device descriptor read/8, error -71 [ 1822.718297][T26056] usb 6-1: new high-speed USB device number 115 using dummy_hcd [ 1822.749864][T26056] usb 6-1: device descriptor read/8, error -71 [ 1822.759115][T29736] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4981'. [ 1822.769658][T29736] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4981'. [ 1822.783370][T29736] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4981'. [ 1822.798374][T29713] input: syz1 as /devices/virtual/input/input239 [ 1822.804163][T29736] netlink: 152 bytes leftover after parsing attributes in process `syz.1.4981'. [ 1822.848839][T29737] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4983'. [ 1822.883534][T26056] usb usb6-port1: unable to enumerate USB device [ 1822.958965][T29736] input: syz1 as /devices/virtual/input/input240 [ 1823.052333][T29737] team4: entered promiscuous mode [ 1823.059352][T29737] team4: entered allmulticast mode [ 1823.286736][T14063] em28xx 7-1:0.89: unknown em28xx chip ID (0) [ 1823.987510][T14063] em28xx 7-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1823.995959][T14063] em28xx 7-1:0.89: board has no eeprom [ 1824.081404][T14063] em28xx 7-1:0.89: Identified as Terratec Grabby (card=67) [ 1824.102812][T14063] em28xx 7-1:0.89: analog set to bulk mode. [ 1824.123583][T23222] em28xx 7-1:0.89: Registering V4L2 extension [ 1824.169849][T14063] usb 7-1: USB disconnect, device number 84 [ 1824.202720][T23222] em28xx 7-1:0.89: reading from i2c device at 0x4a failed (error=-19) [ 1824.229484][T14063] em28xx 7-1:0.89: Disconnecting em28xx [ 1824.248029][T23222] em28xx 7-1:0.89: Config register raw data: 0xffffffed [ 1824.279101][T23222] em28xx 7-1:0.89: AC97 chip type couldn't be determined [ 1824.301582][T23222] em28xx 7-1:0.89: No AC97 audio processor [ 1824.403546][T23222] usb 7-1: Decoder not found [ 1824.461238][T23222] em28xx 7-1:0.89: failed to create media graph [ 1824.653665][T23222] em28xx 7-1:0.89: V4L2 device video103 deregistered [ 1824.839263][T23222] em28xx 7-1:0.89: Registering snapshot button... [ 1824.840326][T29750] ================================================================== [ 1824.853772][T29750] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 1824.861141][T29750] Read of size 8 at addr ffff888027378740 by task v4l_id/29750 [ 1824.868672][T29750] [ 1824.870989][T29750] CPU: 0 UID: 0 PID: 29750 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 1824.871002][T29750] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1824.871010][T29750] Call Trace: [ 1824.871018][T29750] [ 1824.871024][T29750] dump_stack_lvl+0x189/0x250 [ 1824.871042][T29750] ? __virt_addr_valid+0x1c8/0x5c0 [ 1824.871057][T29750] ? rcu_is_watching+0x15/0xb0 [ 1824.871069][T29750] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1824.871082][T29750] ? rcu_is_watching+0x15/0xb0 [ 1824.871093][T29750] ? lock_release+0x4b/0x3e0 [ 1824.871103][T29750] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 1824.871117][T29750] ? __virt_addr_valid+0x1c8/0x5c0 [ 1824.871130][T29750] ? __virt_addr_valid+0x4a5/0x5c0 [ 1824.871144][T29750] print_report+0xca/0x240 [ 1824.871157][T29750] ? v4l2_fh_open+0xac/0x420 [ 1824.871168][T29750] kasan_report+0x118/0x150 [ 1824.871179][T29750] ? v4l2_fh_open+0xac/0x420 [ 1824.871190][T29750] v4l2_fh_open+0xac/0x420 [ 1824.871201][T29750] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1824.871218][T29750] em28xx_v4l2_open+0x157/0x9a0 [ 1824.871236][T29750] v4l2_open+0x1bf/0x3a0 [ 1824.871248][T29750] chrdev_open+0x4cc/0x5e0 [ 1824.871259][T29750] ? __pfx_chrdev_open+0x10/0x10 [ 1824.871269][T29750] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 1824.871281][T29750] ? __pfx_chrdev_open+0x10/0x10 [ 1824.871290][T29750] do_dentry_open+0x953/0x13f0 [ 1824.871304][T29750] vfs_open+0x3b/0x340 [ 1824.871315][T29750] ? path_openat+0x2ecd/0x3830 [ 1824.871328][T29750] path_openat+0x2ee5/0x3830 [ 1824.871347][T29750] ? __pfx_path_openat+0x10/0x10 [ 1824.871363][T29750] do_filp_open+0x1fa/0x410 [ 1824.871375][T29750] ? __lock_acquire+0xab9/0xd20 [ 1824.871385][T29750] ? __pfx_do_filp_open+0x10/0x10 [ 1824.871402][T29750] ? _raw_spin_unlock+0x28/0x50 [ 1824.871418][T29750] ? alloc_fd+0x64c/0x6c0 [ 1824.871436][T29750] do_sys_openat2+0x121/0x1c0 [ 1824.871448][T29750] ? __pfx_do_sys_openat2+0x10/0x10 [ 1824.871460][T29750] ? exc_page_fault+0x82/0x100 [ 1824.871474][T29750] ? do_user_addr_fault+0xc85/0x1380 [ 1824.871485][T29750] __x64_sys_openat+0x138/0x170 [ 1824.871498][T29750] do_syscall_64+0xfa/0xfa0 [ 1824.871513][T29750] ? lockdep_hardirqs_on+0x9c/0x150 [ 1824.871527][T29750] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1824.871537][T29750] ? clear_bhb_loop+0x60/0xb0 [ 1824.871549][T29750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1824.871560][T29750] RIP: 0033:0x7f3687aa7407 [ 1824.871572][T29750] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1824.871582][T29750] RSP: 002b:00007fff10aedd10 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1824.871593][T29750] RAX: ffffffffffffffda RBX: 00007f3688193880 RCX: 00007f3687aa7407 [ 1824.871602][T29750] RDX: 0000000000000000 RSI: 00007fff10aeff1b RDI: ffffffffffffff9c [ 1824.871609][T29750] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1824.871615][T29750] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1824.871622][T29750] R13: 00007fff10aedf60 R14: 00007f36882fa000 R15: 000055af1ef724d8 [ 1824.871633][T29750] [ 1824.871637][T29750] [ 1825.173489][T29750] Allocated by task 23222: [ 1825.177890][T29750] kasan_save_track+0x3e/0x80 [ 1825.182556][T29750] __kasan_kmalloc+0x93/0xb0 [ 1825.187128][T29750] __kmalloc_cache_noprof+0x3d5/0x6f0 [ 1825.192485][T29750] em28xx_v4l2_init+0x10b/0x2e70 [ 1825.197404][T29750] em28xx_init_extension+0x120/0x1c0 [ 1825.202670][T29750] process_scheduled_works+0xae1/0x17b0 [ 1825.208206][T29750] worker_thread+0x8a0/0xda0 [ 1825.212778][T29750] kthread+0x711/0x8a0 [ 1825.216831][T29750] ret_from_fork+0x4bc/0x870 [ 1825.221398][T29750] ret_from_fork_asm+0x1a/0x30 [ 1825.226137][T29750] [ 1825.228441][T29750] Freed by task 23222: [ 1825.232483][T29750] kasan_save_track+0x3e/0x80 [ 1825.237143][T29750] __kasan_save_free_info+0x46/0x50 [ 1825.242329][T29750] __kasan_slab_free+0x5c/0x80 [ 1825.247075][T29750] kfree+0x19a/0x6d0 [ 1825.250952][T29750] em28xx_v4l2_init+0x1683/0x2e70 [ 1825.255961][T29750] em28xx_init_extension+0x120/0x1c0 [ 1825.261245][T29750] process_scheduled_works+0xae1/0x17b0 [ 1825.266784][T29750] worker_thread+0x8a0/0xda0 [ 1825.271354][T29750] kthread+0x711/0x8a0 [ 1825.275443][T29750] ret_from_fork+0x4bc/0x870 [ 1825.280019][T29750] ret_from_fork_asm+0x1a/0x30 [ 1825.284758][T29750] [ 1825.287061][T29750] The buggy address belongs to the object at ffff888027378000 [ 1825.287061][T29750] which belongs to the cache kmalloc-8k of size 8192 [ 1825.301090][T29750] The buggy address is located 1856 bytes inside of [ 1825.301090][T29750] freed 8192-byte region [ffff888027378000, ffff88802737a000) [ 1825.315038][T29750] [ 1825.317341][T29750] The buggy address belongs to the physical page: [ 1825.323741][T29750] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27378 [ 1825.332482][T29750] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1825.340959][T29750] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1825.348949][T29750] page_type: f5(slab) [ 1825.352910][T29750] raw: 00fff00000000040 ffff88801a027280 0000000000000000 dead000000000001 [ 1825.361473][T29750] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 1825.370043][T29750] head: 00fff00000000040 ffff88801a027280 0000000000000000 dead000000000001 [ 1825.378693][T29750] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 1825.387353][T29750] head: 00fff00000000003 ffffea00009cde01 00000000ffffffff 00000000ffffffff [ 1825.396023][T29750] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1825.404693][T29750] page dumped because: kasan: bad access detected [ 1825.411094][T29750] page_owner tracks the page as allocated [ 1825.416787][T29750] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 28639, tgid 28635 (syz.6.4679), ts 1748244802903, free_ts 1745085412500 [ 1825.439261][T29750] post_alloc_hook+0x234/0x290 [ 1825.444024][T29750] get_page_from_freelist+0x2365/0x2440 [ 1825.449549][T29750] __alloc_frozen_pages_noprof+0x181/0x370 [ 1825.455358][T29750] alloc_pages_mpol+0x232/0x4a0 [ 1825.460216][T29750] allocate_slab+0x96/0x350 [ 1825.464699][T29750] ___slab_alloc+0xf56/0x1990 [ 1825.469357][T29750] __slab_alloc+0x65/0x100 [ 1825.473753][T29750] __kmalloc_node_track_caller_noprof+0x5c7/0x800 [ 1825.480153][T29750] kmalloc_reserve+0x136/0x290 [ 1825.484895][T29750] __alloc_skb+0x142/0x2d0 [ 1825.489292][T29750] sctp_packet_transmit+0x2cc/0x2bb0 [ 1825.494593][T29750] sctp_outq_flush+0xecb/0x3140 [ 1825.499516][T29750] sctp_do_sm+0x5332/0x5a20 [ 1825.504002][T29750] sctp_assoc_bh_rcv+0x3f2/0x630 [ 1825.508925][T29750] sctp_backlog_rcv+0x167/0x3f0 [ 1825.513756][T29750] __release_sock+0x297/0x3a0 [ 1825.518416][T29750] page last free pid 5200 tgid 5200 stack trace: [ 1825.524718][T29750] __free_frozen_pages+0xbc4/0xd30 [ 1825.529813][T29750] __put_partials+0x146/0x170 [ 1825.534481][T29750] put_cpu_partial+0x1f2/0x2e0 [ 1825.539240][T29750] __slab_free+0x2b9/0x390 [ 1825.543645][T29750] qlist_free_all+0x97/0x140 [ 1825.548219][T29750] kasan_quarantine_reduce+0x148/0x160 [ 1825.553664][T29750] __kasan_slab_alloc+0x22/0x80 [ 1825.558511][T29750] kmem_cache_alloc_noprof+0x367/0x6e0 [ 1825.563951][T29750] getname_flags+0xb8/0x540 [ 1825.568431][T29750] do_sys_openat2+0xbc/0x1c0 [ 1825.573002][T29750] __x64_sys_openat+0x138/0x170 [ 1825.577870][T29750] do_syscall_64+0xfa/0xfa0 [ 1825.582368][T29750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1825.588241][T29750] [ 1825.590544][T29750] Memory state around the buggy address: [ 1825.596155][T29750] ffff888027378600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1825.604198][T29750] ffff888027378680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1825.612345][T29750] >ffff888027378700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1825.620393][T29750] ^ [ 1825.626614][T29750] ffff888027378780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1825.634690][T29750] ffff888027378800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1825.642740][T29750] ================================================================== [ 1825.672525][T23222] input: em28xx snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.89/input/input241 [ 1825.728229][T29750] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1825.735474][T29750] CPU: 0 UID: 0 PID: 29750 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 1825.744516][T29750] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1825.754590][T29750] Call Trace: [ 1825.757882][T29750] [ 1825.760804][T29750] dump_stack_lvl+0x99/0x250 [ 1825.765392][T29750] ? __asan_memcpy+0x40/0x70 [ 1825.770148][T29750] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1825.775337][T29750] ? __pfx__printk+0x10/0x10 [ 1825.779927][T29750] vpanic+0x237/0x6d0 [ 1825.783914][T29750] ? __pfx_vpanic+0x10/0x10 [ 1825.788417][T29750] ? preempt_schedule+0xae/0xc0 [ 1825.793280][T29750] ? __pfx_preempt_schedule+0x10/0x10 [ 1825.798658][T29750] panic+0xb9/0xc0 [ 1825.802404][T29750] ? __pfx_panic+0x10/0x10 [ 1825.806817][T29750] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 1825.812705][T29750] ? is_module_address+0x17/0xf0 [ 1825.817634][T29750] ? v4l2_fh_open+0xac/0x420 [ 1825.822216][T29750] check_panic_on_warn+0x89/0xb0 [ 1825.827145][T29750] ? v4l2_fh_open+0xac/0x420 [ 1825.831723][T29750] end_report+0x78/0x160 [ 1825.835960][T29750] kasan_report+0x129/0x150 [ 1825.840459][T29750] ? v4l2_fh_open+0xac/0x420 [ 1825.845044][T29750] v4l2_fh_open+0xac/0x420 [ 1825.849457][T29750] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1825.855473][T29750] em28xx_v4l2_open+0x157/0x9a0 [ 1825.860339][T29750] v4l2_open+0x1bf/0x3a0 [ 1825.864670][T29750] chrdev_open+0x4cc/0x5e0 [ 1825.869085][T29750] ? __pfx_chrdev_open+0x10/0x10 [ 1825.874015][T29750] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 1825.880340][T29750] ? __pfx_chrdev_open+0x10/0x10 [ 1825.885274][T29750] do_dentry_open+0x953/0x13f0 [ 1825.890047][T29750] vfs_open+0x3b/0x340 [ 1825.894116][T29750] ? path_openat+0x2ecd/0x3830 [ 1825.899052][T29750] path_openat+0x2ee5/0x3830 [ 1825.903653][T29750] ? __pfx_path_openat+0x10/0x10 [ 1825.908594][T29750] do_filp_open+0x1fa/0x410 [ 1825.913091][T29750] ? __lock_acquire+0xab9/0xd20 [ 1825.917935][T29750] ? __pfx_do_filp_open+0x10/0x10 [ 1825.922965][T29750] ? _raw_spin_unlock+0x28/0x50 [ 1825.927814][T29750] ? alloc_fd+0x64c/0x6c0 [ 1825.932168][T29750] do_sys_openat2+0x121/0x1c0 [ 1825.936843][T29750] ? __pfx_do_sys_openat2+0x10/0x10 [ 1825.942047][T29750] ? exc_page_fault+0x82/0x100 [ 1825.946821][T29750] ? do_user_addr_fault+0xc85/0x1380 [ 1825.952101][T29750] __x64_sys_openat+0x138/0x170 [ 1825.956954][T29750] do_syscall_64+0xfa/0xfa0 [ 1825.961460][T29750] ? lockdep_hardirqs_on+0x9c/0x150 [ 1825.966663][T29750] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1825.972720][T29750] ? clear_bhb_loop+0x60/0xb0 [ 1825.977390][T29750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1825.983276][T29750] RIP: 0033:0x7f3687aa7407 [ 1825.987693][T29750] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1826.007301][T29750] RSP: 002b:00007fff10aedd10 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1826.015713][T29750] RAX: ffffffffffffffda RBX: 00007f3688193880 RCX: 00007f3687aa7407 [ 1826.023692][T29750] RDX: 0000000000000000 RSI: 00007fff10aeff1b RDI: ffffffffffffff9c [ 1826.031673][T29750] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1826.039648][T29750] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1826.047616][T29750] R13: 00007fff10aedf60 R14: 00007f36882fa000 R15: 000055af1ef724d8 [ 1826.055594][T29750] [ 1826.059047][T29750] Kernel Offset: disabled [ 1826.063369][T29750] Rebooting in 86400 seconds..