last executing test programs: 11m23.573425389s ago: executing program 1 (id=1306): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) socket$packet(0x11, 0x2, 0x300) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendto$inet(r1, 0x0, 0x0, 0xc806, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r1, &(0x7f0000000100)='J', 0xfdbe, 0x4004084, 0x0, 0x11000a00) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r0, 0x7a5, &(0x7f0000000180)={{@my=0x0}, 0x0, 0x1}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000200)=0x10000) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = dup(r3) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) pselect6(0x40, &(0x7f0000000600)={0x11, 0xff7ffffffffffffd, 0x2, 0xffffffffffffffff, 0xfffffffffffffffe, 0x9, 0x2, 0x8}, 0x0, &(0x7f0000000400)={0x7fc, 0x2, 0x800000, 0x0, 0x0, 0xc3ad, 0x0, 0xc2c5}, 0x0, 0x0) pselect6(0x40, &(0x7f0000000600)={0x6, 0x0, 0x80000000, 0xc, 0x2, 0x5e51, 0x9, 0x7}, 0x0, &(0x7f0000000680)={0x7ff, 0x7, 0x9, 0x7, 0x4, 0x0, 0x5, 0x5}, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 11m22.609492439s ago: executing program 1 (id=1307): r0 = socket$kcm(0x29, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = syz_io_uring_setup(0x235, &(0x7f0000000500)={0x0, 0x4533, 0x10100, 0x0, 0x24c, 0x0, r2}, &(0x7f00000001c0)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x201}, 0x1}) io_uring_enter(r3, 0x234f, 0xb1e6, 0x1, 0x0, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x4, 0x20010, r0, 0xc4c52000) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r6, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r6, 0x26, &(0x7f0000000080)={0x1, 0x0, 0x2007, 0x1fd}) fcntl$lock(r6, 0x7, &(0x7f0000000280)={0x1, 0x0, 0x2f, 0x9}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000000)={0xff, 0xffffff80, 0x1, 'queue0\x00', 0x2}) ioctl$sock_proto_private(r0, 0x89ed, &(0x7f0000000000)) 11m21.448798614s ago: executing program 1 (id=1310): io_setup(0x10000, &(0x7f0000000800)) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4080003680601000008000300ff000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$DRM_IOCTL_MODE_SETPLANE(0xffffffffffffffff, 0xc03064b7, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f00000000c0)="0fdf8bc95b0000b9a2030000b800000000ba000000800f3066b81f008ee066ba430066ed66b8e4000f00d0b8010000000f01c12e260f01b50a000000c4e27d785670360f011866baf80cb8d6603f8eef66bafc0c66ed", 0x56}], 0x1, 0x4b, 0x0, 0x0) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000500), 0x400, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r7 = accept(r6, 0x0, 0x0) sendmmsg$alg(r7, &(0x7f0000000740)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000001c0)="564004c6852da7a299e4c397614090d1a6e12edf17", 0x15}], 0x1}], 0x1, 0x0) recvmsg(r7, &(0x7f000000b680)={0x0, 0x10400004, &(0x7f000000b600)=[{&(0x7f000000b4c0)=""/5, 0x4}, {&(0x7f000000b500)=""/153, 0xfb59}], 0x2}, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 11m18.834902038s ago: executing program 1 (id=1316): write$sndseq(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) prctl$PR_SCHED_CORE(0x3e, 0x3, 0xffffffffffffffff, 0x1, &(0x7f0000000200)) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f0000000240)='./file0\x00', 0x22070099d234ad28) r5 = dup(r0) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) r6 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c2a, 0x10000, 0x0, 0x4, 0x0, r5}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r6, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r9 = fanotify_init(0x200, 0x101000) readv(r9, &(0x7f00000001c0)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) 11m17.781389881s ago: executing program 1 (id=1320): r0 = socket$kcm(0x29, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = syz_io_uring_setup(0x235, &(0x7f0000000500)={0x0, 0x4533, 0x10100, 0x0, 0x24c, 0x0, r2}, &(0x7f00000001c0)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x201}, 0x1}) io_uring_enter(r3, 0x234f, 0xb1e6, 0x1, 0x0, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x4, 0x20010, r0, 0xc4c52000) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r6, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r6, 0x26, &(0x7f0000000080)={0x1, 0x0, 0x2007, 0x1fd}) fcntl$lock(r6, 0x7, &(0x7f0000000280)={0x1, 0x0, 0x2f, 0x9}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000000)={0xff, 0xffffff80, 0x1, 'queue0\x00', 0x2}) ioctl$sock_proto_private(r0, 0x89ed, &(0x7f0000000000)) 11m17.341480706s ago: executing program 1 (id=1321): rseq(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x7}, 0x20, 0x0, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000002100)={{0x12, 0x1, 0x300, 0xcd, 0x97, 0x2c, 0x8, 0x3923, 0x718a, 0x9b2e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x30, 0x0, [{{0x9, 0x4, 0xa5, 0x81, 0x0, 0x1f, 0xc7, 0xfd, 0xf1}}]}}]}}, &(0x7f0000002340)={0x0, 0x0, 0x0, 0x0}) (async) syz_usb_connect(0x3, 0x24, &(0x7f0000002100)={{0x12, 0x1, 0x300, 0xcd, 0x97, 0x2c, 0x8, 0x3923, 0x718a, 0x9b2e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x30, 0x0, [{{0x9, 0x4, 0xa5, 0x81, 0x0, 0x1f, 0xc7, 0xfd, 0xf1}}]}}]}}, &(0x7f0000002340)={0x0, 0x0, 0x0, 0x0}) 11m16.733805554s ago: executing program 32 (id=1321): rseq(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x7}, 0x20, 0x0, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000002100)={{0x12, 0x1, 0x300, 0xcd, 0x97, 0x2c, 0x8, 0x3923, 0x718a, 0x9b2e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x30, 0x0, [{{0x9, 0x4, 0xa5, 0x81, 0x0, 0x1f, 0xc7, 0xfd, 0xf1}}]}}]}}, &(0x7f0000002340)={0x0, 0x0, 0x0, 0x0}) (async) syz_usb_connect(0x3, 0x24, &(0x7f0000002100)={{0x12, 0x1, 0x300, 0xcd, 0x97, 0x2c, 0x8, 0x3923, 0x718a, 0x9b2e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x30, 0x0, [{{0x9, 0x4, 0xa5, 0x81, 0x0, 0x1f, 0xc7, 0xfd, 0xf1}}]}}]}}, &(0x7f0000002340)={0x0, 0x0, 0x0, 0x0}) 4m55.209485968s ago: executing program 3 (id=2827): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010800000000030000000b00000008000300", @ANYRES32=r3, @ANYBLOB="06000000b9b73861a6e873ffc75f01dfbfeb40183d3f561c4703928f46240bfb6a6c946c9b98e2ffdeccf664b8effe0a4ad1b8"], 0x20}}, 0x20000000) 4m55.072460577s ago: executing program 3 (id=2829): r0 = syz_usb_connect(0x2, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[], 0x58}, 0x1, 0x0, 0x0, 0x40801}, 0x8004) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mknod$loop(0x0, 0x2, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000180)=0x7a, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x26) socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002200)=[{{&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x4, 0x0}}, 0x10, 0x0}}], 0x1, 0x4000000) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) inotify_add_watch(0xffffffffffffffff, 0x0, 0x80000000) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, 0x0) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/resume', 0x88102, 0x0) write$cgroup_int(r6, &(0x7f0000000040)=0x700, 0xfdef) 4m50.941005483s ago: executing program 3 (id=2839): bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = gettid() waitid(0x3, r3, 0x0, 0x4, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) socket$packet(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r5, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) setsockopt$sock_attach_bpf(r5, 0x1, 0xd, &(0x7f0000000080), 0x24) close(r5) 4m50.61329639s ago: executing program 3 (id=2844): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r1, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000000440)={'\x00', 0x4, 0x9, 0x99, 0x0, 0x2, 0x0, 0x2, '\x00', 0xc94}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/../file0/../file0/../file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x104000, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, 0x0, 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x135) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000000)={{0x2, 0x4e20, @local}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x0, {0x2, 0x4e23, @remote}, 'team0\x00'}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@ipv6_getaddrlabel={0x24, 0x1a, 0x1, 0x70bd29, 0x3, {0x2, 0x0, 0x20}, [@IFAL_LABEL={0x8, 0x2, 0x3}]}, 0x24}}, 0x8000) 4m50.191075886s ago: executing program 3 (id=2846): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x4c}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x40c0080) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x45e, 0xf9, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xc0, 0x0, [{{0x9, 0x4, 0x0, 0xfe, 0xf2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x3, 0x2, 0x1, {0x22, 0x3}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xfe, 0x0, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000100)={0x2c, &(0x7f0000000000)={0x0, 0x23, 0xd, {0xd, 0x4, "44d042bf4eab10d5f265ee"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x32}}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xffff060e}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = fsopen(&(0x7f0000000000)='9p\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='source', &(0x7f0000001bc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6h\xd1\x1d\xac\xaa\xfb\xc7Y\xcd\xc5n\xeb\xab\xf70\x99\xef\x8b0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg$inet(r6, &(0x7f0000001900)=[{{&(0x7f0000000080)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000200)=[{&(0x7f00000002c0)="331277f25dd40c4959983dfa060a482caaeee50638aea22432458f2c6a9e03cfa8945bbb26a29f022f58342f46c34a1f89320d32fcffd0dfa03f30f1eb171b750cd22ba50ffd40b155a061e9581b6eec72d1960cecba661e4b959fb05e83a0756b8696a53ea4ff8bf04f1c4272f42eb83147172ec7fbc2e6b177ee3a", 0x7c}, {&(0x7f0000000340)="7fde3fc086331f683527a2d87c46308514e467c91f07437a6a88ad88dd1b9b81e9a865e012b0162f83322ee9e2aad1cc4944012204009378a481cbf0011724b5e4463842795a54300b7f0b352a6dce9581c9d01e3e8828a9b4bc1d6ad1503f85d2de0e47eec192a7d5fae657fbdc26df62f8245f93322b032f5695c23a752ff86fd4832697e038b748086bb173fe5c5c8edaca51eb3b9b62fb59685f3094b791c76a7b96db09c293a294bbaef8f83cebd6371102cd0ea69d30e1f574898bd6415f529c050c41", 0xc6}, {&(0x7f0000000180)="c1d70fee9f30c220882186d04213624fd09953fb", 0x14}], 0x3}}, {{&(0x7f0000000440)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000001880)=[{&(0x7f0000000480)="53bf519f20ae505392a5c3104a9ef792c020f320d75ffa5e2200cce747846fada1d3e1f8b9782c08178172c276c7b67a1b4376654fe345b3979564e07f3b018771adeee4f08b4957cc0c84fda7bfe5f5d4000f2a6b25741839c2fe864876ba72f20c3b721e744939515948e8b87f24f7677b34b6f350a1973c4746bcf2ee32ccbf697d1c", 0x84}, {&(0x7f0000000540)="4a79999bdcf7d1409b7a3fad2f42535eed1837c91048aadae63ef8f1e933cc7975b1ae4e4cd049c62fd6505f4c28795ff2cb47c9f9ab9dc1ec38e84cd9223ac897bd877e045077527cf9d100d46abbe730319545191af0ba9021c18e78627b1e7fa0983656114e423ad4adf533ff14e4a54f5cbce80d945a0589acb6651c", 0x7e}, {&(0x7f00000005c0)="1a0bada56c7cd3a0882267e5fadbd5f2f394d41b4579e4bbdcdfa9252e095cfa2f01a00c18386f86c917dfb3235e872948c8d712235f20d1e807b648fb5bd0ff19b6e0fa7f2f9a8528e619757b95caee5757fcd41aea31da248d31564299ed70da2073767583cce03872eb7a33a4a769a28781eb", 0x74}, {&(0x7f0000000740)="547d7b609b7f1357e511a7d0f444cf09cd4da812e2fc7ebe957afccccac6da7c1168c483ae524654f265bcb994014ac1fe9b223e2a2bac27cea6bd2d5981fbb695c45819306a6702879c7f04e6637cee01710bc75b2111fc5b3f9282645b4c54795c5bc92433fdee133460ebdbdb5465e9889195119ffa5c5637e8a0a208844d9f976287c084eb4f7f074bb525483e291196501632fcf7d70908bd9f69536475108b5e5a79e8c8e97b902375c98fcf04bbfc3c32462b3a4b7de344c2771b06d7a049e99f013af4a19a8c989970661ea0a1dd5f3e7e56c2d4b77a7a93306482b4ed4579863923cbe95c931a684772117cf2fa18ad09b53df70f70a607bbfae4316eb31a6aa4f35facbfea144af7b376afe198f4e1af7fc4c7ef7a76874f3046577a7b3c8d026e45d58aa2fefa7489abd0501277efeed4c75e8eb56443010bbbbcb40bd7945c9e75e67827eea6e5d9a5f31e11f80e0d800cfe3fcee33cf6d59648ad6bee273469a05c75f5db6e79369be7cfb8098b0b7892ea064afd713385b63ba3e27a7ac9de186f0d04853571ecceb324eff6aeaf39e3dd1ac6d14460c2092b61fae32a396dc58f949187c1f0e1a6e16ee18b33c434d0f91b10d53c8fb94a5f257c8bb495c149baec151a9ad4c65e41ac4d3f1d9f161e99f1f64880a704c0242a4d94c55a4c9d37efc32720ffad38223c10ac5f8015f8bedcf16835aec056cc59d2a33edb131138271110b220f3696bfa8593ce8d037b89f588c1266e57d44898e94e3cdd0a4fc4e0a65a71077ecacc7f6194b1089839332de29fd2145ebb85f4dd43cd3187c23738ae29dab885d89bf526f651c80146de8900a9da661ba0fa709a71948e21d8f110e69ed880c6df6496567dd123b32835d772c2a53454b2ad4f933bb8dd52cc854fc30392727d46b4d7c521a5a57605e615cb32dfb76ca364787d092619173c6b7a9acab8a8ddb10a9c6cc13f4c4a6920cf2713eb1d3c35203dcaabaf66c123e32d7cfbb018e41f33e8b6119d538f1d9ff1d4b5bda35814fdd80ed500a18a659ea13cac6ec8e62ed1bb7b64c6c15224a73fac639174642248ad9b6a254749ff744eff6731c57dc511c99604e969165e8f1b6bd487ce26cb0ab5e325950881a415158d21318c8cf77525f827cd939fdf073e5b398bd58933b811f9e7ced5d48195c7474be64426dbad7f0d8b4d836e7fd2a8dfb6e4d49db6464f0f909b4527ad05c89d4aa08dddcb8292647b201453e8c86b876ded08c71d59e0d2e480406989b2d7d56c362fe02403bfc6832a8da4b05a3ab406059d2d3afbc0ae5a7d431a5c7e0e047117b95c5fc175718c17a725157b395ed6c18d3f255f768b94f6a9eca7de16aa968d21b82304d84755b627f9ac2a2e2aed2f36ce1fc2166230db7c6cfe2ba4760926a9720c39edcfbd843a8568806472810c30d2118fcb9fa69d3486e2b939c76d53721a45912939ce2f5a17421a84243cf7eb0fdcea8d554b9aabb2d04aa43506a84e2c677857f501c4ac271b950c5e0ec8364db122c3babd811a31d6ceca667b39380dab6fc8be5868e4ce925e872f7df9a69af2357f234b676095a6a6e3b892d6d83e08b0cce3dd1d9fc0b0a38d89c4b8f76125636be1a1582b6317c96ec5f8746cd3949cbb7584ec18799db69576a88095ea6519e10394b4b24fdce909638ebf8b75c92f21b700227f8af8e67eb7ded7335957d05be6061a387f162561d83657876ca4bcb5f35db8a9d1217e50d850cbe2d466729814ff3208f47efbee32bd5fac7c83f7883707d651815313f6d656c0924cd685b6f6f6d69b76f0e31a2f2a2aeae2ddadfc8ddef2e89da7b1e04cb28a8fa83a835bd4e935f17dfa70977fd455db0b43c4a19ff39e29c952c21f59f2a901622940862cf5a24f11c5bdd2b9ccd7ae641e6c9d27817ed43fd8167a2df8ef9d5a55590b33e39fb1e342e05dee6142766cacbccb840db47ebf24c212b84060fda348be94f178e69f43d6c630afbb5145efd64b5b93af34f70a6b5624a851cdfd9f8ca695a3445ac09a0f65fde05deda77197e4266c501723322184c8c047635c41bc193eb152454a2d8fc183c8586bb5fedcea35d7061a6e204882adcec53f1ea4c6848e99739d213283f954bd0f7fab07d726391b3e8dd7b94fb8b0f4375a8de77843a5e2b54bf1aeff611767ee0f1df20e4bf6420e9dfcb1f12a41f0f0b86910415339918387de8f7cbd5c77dad443b2ad13cab18b102e9da8299a84ae0a24fbcd5927d27a6f0b27f4f73929809c1b0d9b160f44b12f28b7922a2f53c6fda9c0f4ea0c43c5b505b6f812dde8816b0ae3ec7f92d9633eb7f4fec7049ae64d5253563912161eb8674f0ac8f718618e8c651ba0b395b6240dbbd9e2243f78f29ef61299051915c965cdd835bd9fe189daa90f5464ee0b282953f897947ada048899a6170771d4b1accad9053c5b961fa265f288fc1ccff105fbd01d4b488150cdda6247ccd62f317e85e9b748a5433213b24182f913868c17bfe81970fc3ea5691020b82acdd0f1dcb3a2581c3fb4c3d0561699fba60534d5ea947e19f63f216975c26a31fc5d461d12d75302784778240dccf64696492d59000ecd96ac42bca8aa254528cae49405ad99965b57e45b87a7f256912fa9cbf15e3beacd8fea12e8f192510d051b4da6199aad595a7db0df876df178ea35ad52ac68d95f90731013456648547c0f54bcb2649647d9efc2589518f8d805b54881b9112922eac262f0b6a6a2cca9380636d278ab9bf0162756bd63afc18697e9083ee35363b58f7fe430021a88488dbd0c6c335686f6bd50703456729c14265271d08debbd7dbb94c3eb23877a75026f35dbc101cc0699c63fa425bdda7b0a273be9dc0d5f997240d29f59d7253d6d47262724e5facdeae51601f547257be5f423fe376a1864a210048c70554b4eeb506165ab17467262f420455ff8413817cb6665948422c8b7661ceb915a90ba346b5fddf9628aa62bedc380d15e616658bb4d5466498b93b27142ffeb9839467a9a79f1c05351bc9e0805f73d89941ba317fe9843dc9d4a12e7c021daa782fc72143dcf6ac4503964b7c3c05931f9df8d3ef264dbff1af5e413bd26ef3fcb5274c17075b04a53a286de708ccdb5e77ed960bdc9fda8ff62eec0e74ba86ff3863b9ca00150c13be4209a62d0af95f4eb8644b20b3338f06c440fa4c76d6889bbcd8da17b9984041e0c48f9df8bd61c319a0f2a0fbee64045f838bd513d2ad7ef4470f5141e99ad41224deae1f4bdc53066969a1fbeb960d4d1727fbc19fcb9f92c91bffc0374c6af844576f6156c711a3ff04b3283f65fc7c22fce828c2bce71699551501ddc2965fbcb195e6d8b6d17474c2a47f66a5ec94b95fee438fb2c3257346fefad82893f5683c85999e63e3e7b50840d6fd94990de077dc8616e85f161c029d6eb4654e5c237f48c18213dcb29cb144b9c007092f60d62e80681fcde7492eb8cfb3657ff516cbbb07d806f741d661fab607ed93db56fd003dddabb02cb7f79587656027d12cd47553c215a28348e4908daaf51aff534dfc8180411044043f617a17a12e02e9da5bcbf466d3f034e47b3a5bb6fc681fcff9f82587f5537d1e2a2ba5ad6566c4ff62001ffb06fd94daed867824f3dc1067decfc7d0653ee7202ce7544af1d2541a6d52fb611df4b9e624ce7c1f182434730997d8fe2738a75cc0c334ffdf98e02d3f44067a7d999a57e2d5e7c759ca6cd6a723692c8db5e6d734e2df03748ae6196f32b5d7611277b32a65ac5e62c505b0f38aee4342a8edcb63025b64cac84fe4dddc0a3a69dbdc826be5a0d0e0c4cdf2286e7a8dc723689a80ead27a69b80ba8d334668e85499c1e651d586ca0a70946ca749b6c7e90e9757e0ffb23a7846ba660d8c72f55e19ca17bd3414a01564d2ef21fcbe1ecd3d715db3cc2ae9b567b8f439fa12e39e4332a8d216bc70f6f4ecc494fb8a98e20073c4f8fdf95df5a4f189cc5569d658b6f59adf4ababcc516539a9e90f485ec0b794eff9aa36670d723d72d82f1688c98a07e360766b1f32cc908143db871de6ded19fcd1ece0fdca3d27bb6f9ac07c82b4848af37395f6314b54111f1757eb498eb99dc70bbe98e990af5f30fcc32f72f98c32078ec508bb2d1eb0f0e456a3a3e677351a21756a71c65125a51fff741ada0f3927857e0edb5380da098e1510320e19439b847209d7653d8f1155bf23be60d19f780cf0f1307e9ec62e729a408808b193d45fc6218d39ed058e88f5423a93a4c6ba49421980c383c87c1263571f43a0030389f9624c595f0742398a489851bdfab33dbddfc3c9a1fbbaf6f058312fbfa3096ebbc263b09c41156afeb648201f2477d737126575f466a6116ca1d82f4d10364d37ce925ea8d7c0ea1db97a558229afeb525ca4b7ebf03194f6a9d08fb720b01946df91d185c85aabf8752db4a0bfb740b261fac9dda914eff0f74d65573fe5caca0146276c5510cf863139f767202017487f9f677dacdc3650b1a175c70277b7abea4a61034d6601c4a24105325ff60ca3b9b2a25fcfb4879289eae7e74289247f0c10af48c041b067aeb5b13c77c0112018d742d87422da301e9032afff90af559f52c771ca23a484c1bbbbaf0c59ba8b177c9d719ce9c2b2831ff0c3ca7d06f5c717cda1436c23af21204602fb10129545416fdf46af1eacc0d1415f6b215ad83d9a50fce763a24a8a191781942ad3782c56cf57e5f7dd540d4da0001fd7b14f7dcdcc8280d89c6f856cefed8225d6629ba1817fa496deb75a2bd8084e5398a0b91499f0e602153339dc7861cedc20103bcc55668152f38ef8e9f2ac9db81436575283963312ea48a6ece744a2f9a18fe155e0c6fc4a96bc92aa88f701c4878720a37695ff9d45c3e85220abce6828abd8b353764106d7e0318f5a02034bd6096df7d95ecf6a7403153d6f71dab61e1bb05765c167d8999cb13c6f4e03827fa90aa986a10871e509a3171d64b68d55b810cd717761af7a4827a832f1c92dcf25fcdecec216bce937cc5e2e2aea4ffb14d11b98a7aad28133e12f39899d7f831c6cab7ffef19b6f426a21a3e1d877124b09bc39172a5afee2d393cbab55f4f1f4056544d5e56dec1f8fa0f267ba6819cbcf415095fe933cf48fc90cf3f00b1f39aff40089c2de202650ace8d2bc8b11786482b595abdcf26d64689b1c6a3c98e373eb68967ceb51aad61809172375ef279bcd47ea3c447f8b20d63af87bef3170213ffdb886e6685036e72cb1a6ec16e32cd78f66c79494ef93780a405be7ae083caa391bd1edfe4d0ee52f1ab944fe380437d48372bf5a6c517b95ae57a4801f61d8c3bbd2365ecad5a9a4906e1bcbff487226327e3ec196ab18de20db6d39400372d1bfdd63731c892dda91e7d6d088d79e3e9d769e4e7221b34571b30fcf0725806358e95a3a30e9936cb04aafa09cf3ae83f420cccc8ed39dd1a27188cdb29ed12d033acfdfbf9d8e42d705107f0871a2d7e1bfa820703f8064bde4c15de1e29ce2940121425e14d5cc080403a1657b1ed44739e18ae1f7920c53f416644f12b57f9df84e267d877ce930463eb4c43942434e8e59405ff8771928eed5c46cf4674fc8c3d9b405f810c3bd1e5152cd11a3bea24e649ec37b0ef07b053f8dd0f7c6c87569dcc7cdcb0bdad81c7cf8ead49111ba6ec57bf7360092cdd2ce7a568b87cd07965c07005939c037a8f8336174429fc00568f3f1755da0a554f5a2eca2bf0726d0c301aae9cbc3ad88041811f456e912c5b543", 0x1000}, {&(0x7f0000001ac0)="2fdedcbedf3e7fb1fc0d07eba264af90251f27d12b7f5f8b41ca3082f6eb6d59e17033c958ab4679508b6506d670a5f101872fc740dd7f10488fb2b5170667d07f0c04d4357be63f64ee9da8dfecce6eaa4f0ddfd62efd7a448c668355248e4e5f6988881f0d10fb1dc5e3a823f5039a73e4cb07626e0b4cccaaf8f630f91052283f243733b92a7e1828bc7b79d000eaded49008a094ad45fc4e5b00ce43ce0503b4c93d8b02c2122c81816e8bee6f64e0ac0716b7f153ad5b73515c4a2c3667274514b55f6bd53d288da6c06f51103f17b643c2f51623d2720a4c15e827d694323b27da6855a072fa25a66eb929d8a20e46916bd9cec33126ceba64b29422f30b1f95370d55bc2d71baffc402528adcfee823dbf7e47554346fcd6158f3df443f7dc3a7f18c58234614018f4dcc9411e9508bffc8a11d6cacceca269c81888411ddf56907445050cf26f226d2a133426267e2d45c0d1a24dcdb8cec1a01a013df5d5fdce7fbaf60d32de7a1b43fb7faffa918292412bc94ef3e91b036f693d43de56c98b9013f384f077ad7b6ce8752292d4fa340a45c015fd7d1dcebb85064a7c295eee9833190d9fe6f9d5ee3199a0d08b76aa20621965965620c5082817cb8d5c26b65caa6d34b53c277d9d2a820976e83c97999ae198bb6e7e71f67c82968068c072fea7d729b35e4001ae0379951508d79a77af85f15498a45313538c81e14851f3cd1958ca68fab82327ea0fccb289c8d21e1e7cde8e07f7abb39521daad1b79d31826b435ccacbd462b12c9f7ce875f60966cef7e34b7cf480c32934b73d462deb6a6025927c91cbd0864d4b3199e20e7bfc9a396395dc36cb7e8562213f26c212dcbe1732e4c72e50ca92c633062f8a5c4786f12b04b0de8c2198996a327271d46a8b0c1f54446720dce7955c6dacad76391188c702bc92de1e9f075e2e01841f26e4c0effd7fb1c9ba26fab4b5a26b1de7fd751c4082c5c2ec3178049590d678b3013f5c3c0e8602531df56184dc25da7116737d444af271e924d15fbca6b782a318c641483160b71f52a7fef90e2c9cdd307ac1f635b243e8e53b4d1a8d187c698c25e196b81534a19a1974252a3d108f7ef000f7ebf6ae69e5c841e0ddfbf9f71e0f5b8ea0eecccb796ad3ed94acb35455dd4ea8dfb3fb38465edba3c2de4baad9c91d8ab9361e5966387b49a920fcaf9b86f44de14460f279596ac7d0ef6337290cf46259de88565b844b441a1da68830f286ff461f21300ed243f6ae2016b46bcd052d93fdaa213381eaf6313a13f1d737dbe97ae1e9a860f87251d6b4f1c68ae1aeba298f331160016e41035e91394bc09c7be999b26acd065713918967cd47d0a204e2360479e630211dbeb4e83447f17eeeec457d95275bdbcd1c962619a9667af71b00c1f93b4efeae5fe65cdfa5789d13251d190784fa6993e7f8afcd6d0a79319493955d83f3430485301f9dffe68b43a20898b51d52ee37919008b763ca43c26fc4c857897c37c5a95795a710aac64276bf5695f5e1715ff5c39731c7f01332a8f99433d297ae681c6959440aee12a8cfeb6b5621844d0168e5f1913b41169fcf14c200ef45810755f2d14a0412ec74dd1418db74055502e24ba012cc8cbc51d4a8d14ed08bbab9edb887e5ac4e18822114c1d456eabf30241ca573176ab46db54b6737f39292556051b08c00ee768af0f50eb87482409403153a4f517ea563aa39634531000c869dedd1eebe73d452e26e579c125163938f931f74416745c2550c22642a83c8887b93cf38a171683789f91e61009a7c00327f0c409f94751dc4eed7400138af0cff05dfad428a4afbf6567fc6d58888d3dbfde321dc5b229acaa55bb6ab7ed6cb5d6b011f2ae00e8db5e0aded28e839dd7c2cfbae6e52f3f8a32ddfa83cf3da7f8c91a0c8ac88e748e4ece2796f1fb23c8099d3e66aeb85cabe038c056f96a9773f797570823b3901967e7da7c930255f024ee9ef5a60a18c62aae0914648f3e9af95a0f5f01a349c05d0e117adab2e7d98396260aecad9d2b8406d270dd233685021cb40fa0bb896b1153ee1905e5a6245c488da98f551cf69794c693cbfc65ab2a99e6b42d77eeb82cc6a721774f7bba7b4a23cbbc4a068508d908a1efc4794cea285f7ac1c51c0a43fb4825d9dd59e3c6d5a5a19502c92c6bd0b7e626fdb7f5fc4b958013c105eb77659a546594b409667d2277ee58e2c32fbd066f7f6a54788c3312a125b490fe0473a8311864cf3618385ab85a5d82a8e77dae93b279798c3d90ba0260b651815bc3563a2a687c2783c5e0dd226b97bdc7a49656cb324376ca036d2ccf62e27d256b9a9585ece3b084731d83ac5fea8c55fd5072400f6cfb698f5fa9a20a2174cb93fd573b7a8e8ad47c768e5034cdd959904b3af5b134be6f17e6d4fc172a9bd23968fab5ad39b4d42b3078210ab87aa74162d261265af55160f8ded84692ee48154c06f92c2a8a652bc6af7ff295294541a3afdd22ee4732f994e8bd446c27c1261e775dd2d6cb174169c626089060b0c76a815eff236efedf95a488fdb1c87d4767f00a304df959a140ad7a69fba981bbc8aa653e0e92e6755919a5338719b8998e2b85a8a35dba8377391571d9f1b02ab6407d90ec78731bc261deedd6224acd8da84b727ca18d01aab359c292907edfd369b51b287c857eaa1971d22b0d25c411eeef586ff344fc2132eee91f9cc2e0d64272f292ba60a665cb94953b388734cfef05ddd73fcb247634d8d1946452b617cc94e3735794d0f74f1cc4c31c9781373d3629894e4bad7e958d48b31ad4929062655d21215c3b23543bb124106281cdf5e4c7168fd3e0569ed8e11ccd8c4139b08627c713e4747ac852c9b2f23756bc7e62c4fc61ed68f481964a7ff02ea396eb9a8457e8d7db510a71af63b1b49ee06076f5237fa78c89150995f4596d33eb23fc7feb689330556e255922287038ed4fe9e0e879dd0a311553abb89fe2c14b6df00ef59d760a0e390e218c2dfd0850901dd784b35e18bd6774980a31f2f2b3b4a5f36878ed1281be845fae0a060934390e79248ee9b7f6886254a54aba2c33815943d0fc3667ad46e78fd714007b21eeb74228aaf2bb6eb019173e12a635d872587f6a04c08526d6fb2a52f027a8f04225110af71d75ae29aab4829ab13de8026f89905351b8ca3df87fc5e8867f38164f491db5a469bedfa4164d7a0db3040df541c2801f339a08a90a65e85189a8652b14a29b905b02db0d10931c927281b23f97736b79c43de0a8c0e64229879e5c98c4493c04084372153a2a1af317614186d1fa74d0a06b616b9c843c6eb94ad45026fa509459efc560ca82777a13d8ca62d8282b7371f2fe69cfc389b5f138a930c6ca0cdedfc02441ae923cf55799af9f41368382e3cd4665266077895af2cde4e3fcc21a3db00c2870093fb5dea3a9670d0c0af442d19bbbf97e6dd43857b939fc918b8fbda0b2c8c181973eb6bbaf8f93ca9bb6c52d4dadef4988e033de13e4d510e7067b4880999dcad1dffb12b56d4d8d9065c79f2ffbc5b1a85ed31cc75adf8ce55f72fbb927080c98d95cb1bb08d2037e5c0a255364ef4ed4bedd9209ebdc818da4857862da4d6eb89e79464d489e6c476c87aa1fafc03d2a9dc9afc7dbc8e5bf08f859bb296bdbbae4c9e9f3b9b9f59577375c7f33394a8cacb11d5618ad61ce65374f3442885a108da869d10c273aeec51f22328f13bcb9ce36923b8f5f3a159468038938d9bff22d4cecc32d98bf91d82fea41c3b55046cbd5c800a4b2c0ee001c08c6ec597fddbb748eff3dc05c8ff26fabe5555aa88968931e9d8a5f86e905356825477489512f2fa647b82f9a07858df6aee444ff7eaf8f56d977044718b4742ca1e5a8214c7b93e884175d4e0df99829cce04797c0db0434112e81dc77485c4ff184a1007bd49254760b3bcbb35cfcb9d3490e1c0d040b4b68fd318d0639caca3e7aa301f50a874ffa7945d14202db6c738d3d3d96619ebb6b5e538589bd1ab144d4225afe5875cc1f417c1c3767d336523aff54522a2cd0394cc76f99ff3607008570b3584fa0cf02a7db2d71020f3fe84ea860ab9a260d84e5beb2cb39c7ea2f5312204f2c5fe8d1d2f2cab3d9c258ac4a1f1be979cba9859766d4c39a2ba1ff7bedc0536e3d275ed29f37918e6b7d74536095ee86f648ef163810e0e9e2250cafe7c2129d416d7165b27afa5b0823c1f51afe3f4267c8d71e822c68d755a2384d7681e4d6393ee61aad87d9fc71ca81c8462faa977e51cd68041f584bb994524cf9875daf7ead9b2e3a9cc0ba19f80bfaf30ee4b42c4b9e729cc74b60fdbf82a4daa55ac3bfaadb0cb7dd43cb6708682db42be228e89b34cf9a3ce7cd4b5bf601580f0d91744418b8dbe3fb415c3aad1a85dab9c1753d26eece516baa539c5d5a37882dbeebd7d90b4045cba414896befd4457225e1aaaadf2958d2067a621a35ad610f14d063562341f62f52d3e789ff904cbe18dc27c49ab8b1c3bc338d820815da00a363bf533f9d0c4bfaf69ae538c66a7d147b933ffc445dacd8cdafcffcad711386e0d755065116e5f00c14b4106ca190493f8cecd0afc81f625e816c9bb50d2b8c3f3af67fde140498b1a765edadcd4dcaae39d3a8db8b97e5f548a6eb4813eb1f267d9f9dc49411b7e7aef9bce572eff0be0c27fab513a206224f3f8074443e145a7403be0ca45cc9579ca3d7a45944da1a9911df43c081b7e808ee104ef0a776016cb2920da8368fe7184c4da928da01c59572aa85533c57914dbf4e1b01af4c25fb3852ba81be586436d56b76348c38fa54d51a88567f867e52f41ee1d9400975dc23f0b07b6bad62edff576333c29dd04bc1a9a8dba33a0428bbbc4a8ea523d4fb6930a6f01996e285b8715c77f43d83ad0c1aaf36fb71f1f72055fc2eaa1de38e3b0b29c55fac18b5ee786d491b399465bd03b92c50bdea2b77d640bbddf032016fef9b6391d1bafacb8bb79e86e725b4c26d5491be203ab11343be013b8ae1fd1c62e07d1a0363699c177136aae1681583d7aea57e03ece45ee18f0810315e3f71da75af6eaa29e4445a8ea39695dd319295ea757ba27b9fea1a59892f7e1900a3cf671dcd038279d1344ff99815d7dec4b6a165e3f014495535c4f6c858bf60b3ad37560d564f9d38b25d0fb5db97b46dd51a05e2ac17e6eba000d1084bd3c5519ce7dc11d69ee670a83ad3f238a4aa9bce3da838b70968ff476660c546e1e9049d9da41cff74b133419704502a510bda2792129a7d234feffff98a36e0056ca85c507adb100b6de704ab7e448bb89e6d5463fbcbda1e32eb9bd96c6dfbacea990ef9e87f3495741b0812fec4ba17f69c18916f1fd56f4d02e155c841eaa688f45f69a09ca4cb2ff9d9be2b25b71e11f950c08d45d7b32366498884cd8bb8cd1be4ee94a57a28a104bb832f514fce4b0011a28511cd2b968ff957aa3fd5c0c3b170a9ef0e3d49d18d97e7a743dda7eca98f5b0f03c24c295529582b18ce93676c895ac32dcb9f1e064aa8b4f77664e75b68c0d96c2fa58f1dbcf68b14105fab726a7966df4a48bbce800945bb12d4f5a4956", 0xf80}, {&(0x7f0000001740)="e9bfb75f5f868490945591d131620396e8da1abc392a3ce51f175c0d5014f428fa590774577511f8", 0x28}, {&(0x7f0000001780)="aab754466dcc7f7123797de91559a93210602681f48fe6d253b99232235cac44f99fc6502673bd840d65ff30c80d4173f1b3ec8d71abfedff8552b8f645a5d6b1d1183f839613e9d99c509d10e141f2315cdff5194aea32d6181928b3c42388c51bb32a7d1673b0b146c930f811d26a1dee0f5a544c79247b7b8f389921fb8001cafffe204b4b85e65c5e1911e83a737e889a9bfc82e5afb8ac273cc1970696775f0cb4b6a03fe3a7b7acd0241c64f3aaccc60886a297a754e0bf94e2ec274", 0xbf}], 0x7}}], 0x2, 0x1) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0xd}, {0xd}, {0x8, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x48050}, 0x40004) recvmmsg(r6, &(0x7f0000005140)=[{{0x0, 0x0, &(0x7f0000001a80)=[{&(0x7f0000000640)=""/216, 0xd8}, {&(0x7f00000052c0)=""/235, 0xeb}, {&(0x7f0000003080)=""/4096, 0x1000}], 0x3}, 0x3}], 0x1b00, 0x0, 0x0) 4m47.874141985s ago: executing program 33 (id=2849): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa802, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$midi(&(0x7f0000001980), 0x8, 0x1) fanotify_mark(0xffffffffffffffff, 0x1, 0x4800003a, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r2, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write$binfmt_aout(r3, 0x0, 0xffffffdb) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x600000000000000, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg$inet(r6, &(0x7f0000001900)=[{{&(0x7f0000000080)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000200)=[{&(0x7f00000002c0)="331277f25dd40c4959983dfa060a482caaeee50638aea22432458f2c6a9e03cfa8945bbb26a29f022f58342f46c34a1f89320d32fcffd0dfa03f30f1eb171b750cd22ba50ffd40b155a061e9581b6eec72d1960cecba661e4b959fb05e83a0756b8696a53ea4ff8bf04f1c4272f42eb83147172ec7fbc2e6b177ee3a", 0x7c}, {&(0x7f0000000340)="7fde3fc086331f683527a2d87c46308514e467c91f07437a6a88ad88dd1b9b81e9a865e012b0162f83322ee9e2aad1cc4944012204009378a481cbf0011724b5e4463842795a54300b7f0b352a6dce9581c9d01e3e8828a9b4bc1d6ad1503f85d2de0e47eec192a7d5fae657fbdc26df62f8245f93322b032f5695c23a752ff86fd4832697e038b748086bb173fe5c5c8edaca51eb3b9b62fb59685f3094b791c76a7b96db09c293a294bbaef8f83cebd6371102cd0ea69d30e1f574898bd6415f529c050c41", 0xc6}, {&(0x7f0000000180)="c1d70fee9f30c220882186d04213624fd09953fb", 0x14}], 0x3}}, {{&(0x7f0000000440)={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000001880)=[{&(0x7f0000000480)="53bf519f20ae505392a5c3104a9ef792c020f320d75ffa5e2200cce747846fada1d3e1f8b9782c08178172c276c7b67a1b4376654fe345b3979564e07f3b018771adeee4f08b4957cc0c84fda7bfe5f5d4000f2a6b25741839c2fe864876ba72f20c3b721e744939515948e8b87f24f7677b34b6f350a1973c4746bcf2ee32ccbf697d1c", 0x84}, {&(0x7f0000000540)="4a79999bdcf7d1409b7a3fad2f42535eed1837c91048aadae63ef8f1e933cc7975b1ae4e4cd049c62fd6505f4c28795ff2cb47c9f9ab9dc1ec38e84cd9223ac897bd877e045077527cf9d100d46abbe730319545191af0ba9021c18e78627b1e7fa0983656114e423ad4adf533ff14e4a54f5cbce80d945a0589acb6651c", 0x7e}, {&(0x7f00000005c0)="1a0bada56c7cd3a0882267e5fadbd5f2f394d41b4579e4bbdcdfa9252e095cfa2f01a00c18386f86c917dfb3235e872948c8d712235f20d1e807b648fb5bd0ff19b6e0fa7f2f9a8528e619757b95caee5757fcd41aea31da248d31564299ed70da2073767583cce03872eb7a33a4a769a28781eb", 0x74}, {&(0x7f0000000740)="547d7b609b7f1357e511a7d0f444cf09cd4da812e2fc7ebe957afccccac6da7c1168c483ae524654f265bcb994014ac1fe9b223e2a2bac27cea6bd2d5981fbb695c45819306a6702879c7f04e6637cee01710bc75b2111fc5b3f9282645b4c54795c5bc92433fdee133460ebdbdb5465e9889195119ffa5c5637e8a0a208844d9f976287c084eb4f7f074bb525483e291196501632fcf7d70908bd9f69536475108b5e5a79e8c8e97b902375c98fcf04bbfc3c32462b3a4b7de344c2771b06d7a049e99f013af4a19a8c989970661ea0a1dd5f3e7e56c2d4b77a7a93306482b4ed4579863923cbe95c931a684772117cf2fa18ad09b53df70f70a607bbfae4316eb31a6aa4f35facbfea144af7b376afe198f4e1af7fc4c7ef7a76874f3046577a7b3c8d026e45d58aa2fefa7489abd0501277efeed4c75e8eb56443010bbbbcb40bd7945c9e75e67827eea6e5d9a5f31e11f80e0d800cfe3fcee33cf6d59648ad6bee273469a05c75f5db6e79369be7cfb8098b0b7892ea064afd713385b63ba3e27a7ac9de186f0d04853571ecceb324eff6aeaf39e3dd1ac6d14460c2092b61fae32a396dc58f949187c1f0e1a6e16ee18b33c434d0f91b10d53c8fb94a5f257c8bb495c149baec151a9ad4c65e41ac4d3f1d9f161e99f1f64880a704c0242a4d94c55a4c9d37efc32720ffad38223c10ac5f8015f8bedcf16835aec056cc59d2a33edb131138271110b220f3696bfa8593ce8d037b89f588c1266e57d44898e94e3cdd0a4fc4e0a65a71077ecacc7f6194b1089839332de29fd2145ebb85f4dd43cd3187c23738ae29dab885d89bf526f651c80146de8900a9da661ba0fa709a71948e21d8f110e69ed880c6df6496567dd123b32835d772c2a53454b2ad4f933bb8dd52cc854fc30392727d46b4d7c521a5a57605e615cb32dfb76ca364787d092619173c6b7a9acab8a8ddb10a9c6cc13f4c4a6920cf2713eb1d3c35203dcaabaf66c123e32d7cfbb018e41f33e8b6119d538f1d9ff1d4b5bda35814fdd80ed500a18a659ea13cac6ec8e62ed1bb7b64c6c15224a73fac639174642248ad9b6a254749ff744eff6731c57dc511c99604e969165e8f1b6bd487ce26cb0ab5e325950881a415158d21318c8cf77525f827cd939fdf073e5b398bd58933b811f9e7ced5d48195c7474be64426dbad7f0d8b4d836e7fd2a8dfb6e4d49db6464f0f909b4527ad05c89d4aa08dddcb8292647b201453e8c86b876ded08c71d59e0d2e480406989b2d7d56c362fe02403bfc6832a8da4b05a3ab406059d2d3afbc0ae5a7d431a5c7e0e047117b95c5fc175718c17a725157b395ed6c18d3f255f768b94f6a9eca7de16aa968d21b82304d84755b627f9ac2a2e2aed2f36ce1fc2166230db7c6cfe2ba4760926a9720c39edcfbd843a8568806472810c30d2118fcb9fa69d3486e2b939c76d53721a45912939ce2f5a17421a84243cf7eb0fdcea8d554b9aabb2d04aa43506a84e2c677857f501c4ac271b950c5e0ec8364db122c3babd811a31d6ceca667b39380dab6fc8be5868e4ce925e872f7df9a69af2357f234b676095a6a6e3b892d6d83e08b0cce3dd1d9fc0b0a38d89c4b8f76125636be1a1582b6317c96ec5f8746cd3949cbb7584ec18799db69576a88095ea6519e10394b4b24fdce909638ebf8b75c92f21b700227f8af8e67eb7ded7335957d05be6061a387f162561d83657876ca4bcb5f35db8a9d1217e50d850cbe2d466729814ff3208f47efbee32bd5fac7c83f7883707d651815313f6d656c0924cd685b6f6f6d69b76f0e31a2f2a2aeae2ddadfc8ddef2e89da7b1e04cb28a8fa83a835bd4e935f17dfa70977fd455db0b43c4a19ff39e29c952c21f59f2a901622940862cf5a24f11c5bdd2b9ccd7ae641e6c9d27817ed43fd8167a2df8ef9d5a55590b33e39fb1e342e05dee6142766cacbccb840db47ebf24c212b84060fda348be94f178e69f43d6c630afbb5145efd64b5b93af34f70a6b5624a851cdfd9f8ca695a3445ac09a0f65fde05deda77197e4266c501723322184c8c047635c41bc193eb152454a2d8fc183c8586bb5fedcea35d7061a6e204882adcec53f1ea4c6848e99739d213283f954bd0f7fab07d726391b3e8dd7b94fb8b0f4375a8de77843a5e2b54bf1aeff611767ee0f1df20e4bf6420e9dfcb1f12a41f0f0b86910415339918387de8f7cbd5c77dad443b2ad13cab18b102e9da8299a84ae0a24fbcd5927d27a6f0b27f4f73929809c1b0d9b160f44b12f28b7922a2f53c6fda9c0f4ea0c43c5b505b6f812dde8816b0ae3ec7f92d9633eb7f4fec7049ae64d5253563912161eb8674f0ac8f718618e8c651ba0b395b6240dbbd9e2243f78f29ef61299051915c965cdd835bd9fe189daa90f5464ee0b282953f897947ada048899a6170771d4b1accad9053c5b961fa265f288fc1ccff105fbd01d4b488150cdda6247ccd62f317e85e9b748a5433213b24182f913868c17bfe81970fc3ea5691020b82acdd0f1dcb3a2581c3fb4c3d0561699fba60534d5ea947e19f63f216975c26a31fc5d461d12d75302784778240dccf64696492d59000ecd96ac42bca8aa254528cae49405ad99965b57e45b87a7f256912fa9cbf15e3beacd8fea12e8f192510d051b4da6199aad595a7db0df876df178ea35ad52ac68d95f90731013456648547c0f54bcb2649647d9efc2589518f8d805b54881b9112922eac262f0b6a6a2cca9380636d278ab9bf0162756bd63afc18697e9083ee35363b58f7fe430021a88488dbd0c6c335686f6bd50703456729c14265271d08debbd7dbb94c3eb23877a75026f35dbc101cc0699c63fa425bdda7b0a273be9dc0d5f997240d29f59d7253d6d47262724e5facdeae51601f547257be5f423fe376a1864a210048c70554b4eeb506165ab17467262f420455ff8413817cb6665948422c8b7661ceb915a90ba346b5fddf9628aa62bedc380d15e616658bb4d5466498b93b27142ffeb9839467a9a79f1c05351bc9e0805f73d89941ba317fe9843dc9d4a12e7c021daa782fc72143dcf6ac4503964b7c3c05931f9df8d3ef264dbff1af5e413bd26ef3fcb5274c17075b04a53a286de708ccdb5e77ed960bdc9fda8ff62eec0e74ba86ff3863b9ca00150c13be4209a62d0af95f4eb8644b20b3338f06c440fa4c76d6889bbcd8da17b9984041e0c48f9df8bd61c319a0f2a0fbee64045f838bd513d2ad7ef4470f5141e99ad41224deae1f4bdc53066969a1fbeb960d4d1727fbc19fcb9f92c91bffc0374c6af844576f6156c711a3ff04b3283f65fc7c22fce828c2bce71699551501ddc2965fbcb195e6d8b6d17474c2a47f66a5ec94b95fee438fb2c3257346fefad82893f5683c85999e63e3e7b50840d6fd94990de077dc8616e85f161c029d6eb4654e5c237f48c18213dcb29cb144b9c007092f60d62e80681fcde7492eb8cfb3657ff516cbbb07d806f741d661fab607ed93db56fd003dddabb02cb7f79587656027d12cd47553c215a28348e4908daaf51aff534dfc8180411044043f617a17a12e02e9da5bcbf466d3f034e47b3a5bb6fc681fcff9f82587f5537d1e2a2ba5ad6566c4ff62001ffb06fd94daed867824f3dc1067decfc7d0653ee7202ce7544af1d2541a6d52fb611df4b9e624ce7c1f182434730997d8fe2738a75cc0c334ffdf98e02d3f44067a7d999a57e2d5e7c759ca6cd6a723692c8db5e6d734e2df03748ae6196f32b5d7611277b32a65ac5e62c505b0f38aee4342a8edcb63025b64cac84fe4dddc0a3a69dbdc826be5a0d0e0c4cdf2286e7a8dc723689a80ead27a69b80ba8d334668e85499c1e651d586ca0a70946ca749b6c7e90e9757e0ffb23a7846ba660d8c72f55e19ca17bd3414a01564d2ef21fcbe1ecd3d715db3cc2ae9b567b8f439fa12e39e4332a8d216bc70f6f4ecc494fb8a98e20073c4f8fdf95df5a4f189cc5569d658b6f59adf4ababcc516539a9e90f485ec0b794eff9aa36670d723d72d82f1688c98a07e360766b1f32cc908143db871de6ded19fcd1ece0fdca3d27bb6f9ac07c82b4848af37395f6314b54111f1757eb498eb99dc70bbe98e990af5f30fcc32f72f98c32078ec508bb2d1eb0f0e456a3a3e677351a21756a71c65125a51fff741ada0f3927857e0edb5380da098e1510320e19439b847209d7653d8f1155bf23be60d19f780cf0f1307e9ec62e729a408808b193d45fc6218d39ed058e88f5423a93a4c6ba49421980c383c87c1263571f43a0030389f9624c595f0742398a489851bdfab33dbddfc3c9a1fbbaf6f058312fbfa3096ebbc263b09c41156afeb648201f2477d737126575f466a6116ca1d82f4d10364d37ce925ea8d7c0ea1db97a558229afeb525ca4b7ebf03194f6a9d08fb720b01946df91d185c85aabf8752db4a0bfb740b261fac9dda914eff0f74d65573fe5caca0146276c5510cf863139f767202017487f9f677dacdc3650b1a175c70277b7abea4a61034d6601c4a24105325ff60ca3b9b2a25fcfb4879289eae7e74289247f0c10af48c041b067aeb5b13c77c0112018d742d87422da301e9032afff90af559f52c771ca23a484c1bbbbaf0c59ba8b177c9d719ce9c2b2831ff0c3ca7d06f5c717cda1436c23af21204602fb10129545416fdf46af1eacc0d1415f6b215ad83d9a50fce763a24a8a191781942ad3782c56cf57e5f7dd540d4da0001fd7b14f7dcdcc8280d89c6f856cefed8225d6629ba1817fa496deb75a2bd8084e5398a0b91499f0e602153339dc7861cedc20103bcc55668152f38ef8e9f2ac9db81436575283963312ea48a6ece744a2f9a18fe155e0c6fc4a96bc92aa88f701c4878720a37695ff9d45c3e85220abce6828abd8b353764106d7e0318f5a02034bd6096df7d95ecf6a7403153d6f71dab61e1bb05765c167d8999cb13c6f4e03827fa90aa986a10871e509a3171d64b68d55b810cd717761af7a4827a832f1c92dcf25fcdecec216bce937cc5e2e2aea4ffb14d11b98a7aad28133e12f39899d7f831c6cab7ffef19b6f426a21a3e1d877124b09bc39172a5afee2d393cbab55f4f1f4056544d5e56dec1f8fa0f267ba6819cbcf415095fe933cf48fc90cf3f00b1f39aff40089c2de202650ace8d2bc8b11786482b595abdcf26d64689b1c6a3c98e373eb68967ceb51aad61809172375ef279bcd47ea3c447f8b20d63af87bef3170213ffdb886e6685036e72cb1a6ec16e32cd78f66c79494ef93780a405be7ae083caa391bd1edfe4d0ee52f1ab944fe380437d48372bf5a6c517b95ae57a4801f61d8c3bbd2365ecad5a9a4906e1bcbff487226327e3ec196ab18de20db6d39400372d1bfdd63731c892dda91e7d6d088d79e3e9d769e4e7221b34571b30fcf0725806358e95a3a30e9936cb04aafa09cf3ae83f420cccc8ed39dd1a27188cdb29ed12d033acfdfbf9d8e42d705107f0871a2d7e1bfa820703f8064bde4c15de1e29ce2940121425e14d5cc080403a1657b1ed44739e18ae1f7920c53f416644f12b57f9df84e267d877ce930463eb4c43942434e8e59405ff8771928eed5c46cf4674fc8c3d9b405f810c3bd1e5152cd11a3bea24e649ec37b0ef07b053f8dd0f7c6c87569dcc7cdcb0bdad81c7cf8ead49111ba6ec57bf7360092cdd2ce7a568b87cd07965c07005939c037a8f8336174429fc00568f3f1755da0a554f5a2eca2bf0726d0c301aae9cbc3ad88041811f456e912c5b543", 0x1000}, {&(0x7f0000001ac0)="2fdedcbedf3e7fb1fc0d07eba264af90251f27d12b7f5f8b41ca3082f6eb6d59e17033c958ab4679508b6506d670a5f101872fc740dd7f10488fb2b5170667d07f0c04d4357be63f64ee9da8dfecce6eaa4f0ddfd62efd7a448c668355248e4e5f6988881f0d10fb1dc5e3a823f5039a73e4cb07626e0b4cccaaf8f630f91052283f243733b92a7e1828bc7b79d000eaded49008a094ad45fc4e5b00ce43ce0503b4c93d8b02c2122c81816e8bee6f64e0ac0716b7f153ad5b73515c4a2c3667274514b55f6bd53d288da6c06f51103f17b643c2f51623d2720a4c15e827d694323b27da6855a072fa25a66eb929d8a20e46916bd9cec33126ceba64b29422f30b1f95370d55bc2d71baffc402528adcfee823dbf7e47554346fcd6158f3df443f7dc3a7f18c58234614018f4dcc9411e9508bffc8a11d6cacceca269c81888411ddf56907445050cf26f226d2a133426267e2d45c0d1a24dcdb8cec1a01a013df5d5fdce7fbaf60d32de7a1b43fb7faffa918292412bc94ef3e91b036f693d43de56c98b9013f384f077ad7b6ce8752292d4fa340a45c015fd7d1dcebb85064a7c295eee9833190d9fe6f9d5ee3199a0d08b76aa20621965965620c5082817cb8d5c26b65caa6d34b53c277d9d2a820976e83c97999ae198bb6e7e71f67c82968068c072fea7d729b35e4001ae0379951508d79a77af85f15498a45313538c81e14851f3cd1958ca68fab82327ea0fccb289c8d21e1e7cde8e07f7abb39521daad1b79d31826b435ccacbd462b12c9f7ce875f60966cef7e34b7cf480c32934b73d462deb6a6025927c91cbd0864d4b3199e20e7bfc9a396395dc36cb7e8562213f26c212dcbe1732e4c72e50ca92c633062f8a5c4786f12b04b0de8c2198996a327271d46a8b0c1f54446720dce7955c6dacad76391188c702bc92de1e9f075e2e01841f26e4c0effd7fb1c9ba26fab4b5a26b1de7fd751c4082c5c2ec3178049590d678b3013f5c3c0e8602531df56184dc25da7116737d444af271e924d15fbca6b782a318c641483160b71f52a7fef90e2c9cdd307ac1f635b243e8e53b4d1a8d187c698c25e196b81534a19a1974252a3d108f7ef000f7ebf6ae69e5c841e0ddfbf9f71e0f5b8ea0eecccb796ad3ed94acb35455dd4ea8dfb3fb38465edba3c2de4baad9c91d8ab9361e5966387b49a920fcaf9b86f44de14460f279596ac7d0ef6337290cf46259de88565b844b441a1da68830f286ff461f21300ed243f6ae2016b46bcd052d93fdaa213381eaf6313a13f1d737dbe97ae1e9a860f87251d6b4f1c68ae1aeba298f331160016e41035e91394bc09c7be999b26acd065713918967cd47d0a204e2360479e630211dbeb4e83447f17eeeec457d95275bdbcd1c962619a9667af71b00c1f93b4efeae5fe65cdfa5789d13251d190784fa6993e7f8afcd6d0a79319493955d83f3430485301f9dffe68b43a20898b51d52ee37919008b763ca43c26fc4c857897c37c5a95795a710aac64276bf5695f5e1715ff5c39731c7f01332a8f99433d297ae681c6959440aee12a8cfeb6b5621844d0168e5f1913b41169fcf14c200ef45810755f2d14a0412ec74dd1418db74055502e24ba012cc8cbc51d4a8d14ed08bbab9edb887e5ac4e18822114c1d456eabf30241ca573176ab46db54b6737f39292556051b08c00ee768af0f50eb87482409403153a4f517ea563aa39634531000c869dedd1eebe73d452e26e579c125163938f931f74416745c2550c22642a83c8887b93cf38a171683789f91e61009a7c00327f0c409f94751dc4eed7400138af0cff05dfad428a4afbf6567fc6d58888d3dbfde321dc5b229acaa55bb6ab7ed6cb5d6b011f2ae00e8db5e0aded28e839dd7c2cfbae6e52f3f8a32ddfa83cf3da7f8c91a0c8ac88e748e4ece2796f1fb23c8099d3e66aeb85cabe038c056f96a9773f797570823b3901967e7da7c930255f024ee9ef5a60a18c62aae0914648f3e9af95a0f5f01a349c05d0e117adab2e7d98396260aecad9d2b8406d270dd233685021cb40fa0bb896b1153ee1905e5a6245c488da98f551cf69794c693cbfc65ab2a99e6b42d77eeb82cc6a721774f7bba7b4a23cbbc4a068508d908a1efc4794cea285f7ac1c51c0a43fb4825d9dd59e3c6d5a5a19502c92c6bd0b7e626fdb7f5fc4b958013c105eb77659a546594b409667d2277ee58e2c32fbd066f7f6a54788c3312a125b490fe0473a8311864cf3618385ab85a5d82a8e77dae93b279798c3d90ba0260b651815bc3563a2a687c2783c5e0dd226b97bdc7a49656cb324376ca036d2ccf62e27d256b9a9585ece3b084731d83ac5fea8c55fd5072400f6cfb698f5fa9a20a2174cb93fd573b7a8e8ad47c768e5034cdd959904b3af5b134be6f17e6d4fc172a9bd23968fab5ad39b4d42b3078210ab87aa74162d261265af55160f8ded84692ee48154c06f92c2a8a652bc6af7ff295294541a3afdd22ee4732f994e8bd446c27c1261e775dd2d6cb174169c626089060b0c76a815eff236efedf95a488fdb1c87d4767f00a304df959a140ad7a69fba981bbc8aa653e0e92e6755919a5338719b8998e2b85a8a35dba8377391571d9f1b02ab6407d90ec78731bc261deedd6224acd8da84b727ca18d01aab359c292907edfd369b51b287c857eaa1971d22b0d25c411eeef586ff344fc2132eee91f9cc2e0d64272f292ba60a665cb94953b388734cfef05ddd73fcb247634d8d1946452b617cc94e3735794d0f74f1cc4c31c9781373d3629894e4bad7e958d48b31ad4929062655d21215c3b23543bb124106281cdf5e4c7168fd3e0569ed8e11ccd8c4139b08627c713e4747ac852c9b2f23756bc7e62c4fc61ed68f481964a7ff02ea396eb9a8457e8d7db510a71af63b1b49ee06076f5237fa78c89150995f4596d33eb23fc7feb689330556e255922287038ed4fe9e0e879dd0a311553abb89fe2c14b6df00ef59d760a0e390e218c2dfd0850901dd784b35e18bd6774980a31f2f2b3b4a5f36878ed1281be845fae0a060934390e79248ee9b7f6886254a54aba2c33815943d0fc3667ad46e78fd714007b21eeb74228aaf2bb6eb019173e12a635d872587f6a04c08526d6fb2a52f027a8f04225110af71d75ae29aab4829ab13de8026f89905351b8ca3df87fc5e8867f38164f491db5a469bedfa4164d7a0db3040df541c2801f339a08a90a65e85189a8652b14a29b905b02db0d10931c927281b23f97736b79c43de0a8c0e64229879e5c98c4493c04084372153a2a1af317614186d1fa74d0a06b616b9c843c6eb94ad45026fa509459efc560ca82777a13d8ca62d8282b7371f2fe69cfc389b5f138a930c6ca0cdedfc02441ae923cf55799af9f41368382e3cd4665266077895af2cde4e3fcc21a3db00c2870093fb5dea3a9670d0c0af442d19bbbf97e6dd43857b939fc918b8fbda0b2c8c181973eb6bbaf8f93ca9bb6c52d4dadef4988e033de13e4d510e7067b4880999dcad1dffb12b56d4d8d9065c79f2ffbc5b1a85ed31cc75adf8ce55f72fbb927080c98d95cb1bb08d2037e5c0a255364ef4ed4bedd9209ebdc818da4857862da4d6eb89e79464d489e6c476c87aa1fafc03d2a9dc9afc7dbc8e5bf08f859bb296bdbbae4c9e9f3b9b9f59577375c7f33394a8cacb11d5618ad61ce65374f3442885a108da869d10c273aeec51f22328f13bcb9ce36923b8f5f3a159468038938d9bff22d4cecc32d98bf91d82fea41c3b55046cbd5c800a4b2c0ee001c08c6ec597fddbb748eff3dc05c8ff26fabe5555aa88968931e9d8a5f86e905356825477489512f2fa647b82f9a07858df6aee444ff7eaf8f56d977044718b4742ca1e5a8214c7b93e884175d4e0df99829cce04797c0db0434112e81dc77485c4ff184a1007bd49254760b3bcbb35cfcb9d3490e1c0d040b4b68fd318d0639caca3e7aa301f50a874ffa7945d14202db6c738d3d3d96619ebb6b5e538589bd1ab144d4225afe5875cc1f417c1c3767d336523aff54522a2cd0394cc76f99ff3607008570b3584fa0cf02a7db2d71020f3fe84ea860ab9a260d84e5beb2cb39c7ea2f5312204f2c5fe8d1d2f2cab3d9c258ac4a1f1be979cba9859766d4c39a2ba1ff7bedc0536e3d275ed29f37918e6b7d74536095ee86f648ef163810e0e9e2250cafe7c2129d416d7165b27afa5b0823c1f51afe3f4267c8d71e822c68d755a2384d7681e4d6393ee61aad87d9fc71ca81c8462faa977e51cd68041f584bb994524cf9875daf7ead9b2e3a9cc0ba19f80bfaf30ee4b42c4b9e729cc74b60fdbf82a4daa55ac3bfaadb0cb7dd43cb6708682db42be228e89b34cf9a3ce7cd4b5bf601580f0d91744418b8dbe3fb415c3aad1a85dab9c1753d26eece516baa539c5d5a37882dbeebd7d90b4045cba414896befd4457225e1aaaadf2958d2067a621a35ad610f14d063562341f62f52d3e789ff904cbe18dc27c49ab8b1c3bc338d820815da00a363bf533f9d0c4bfaf69ae538c66a7d147b933ffc445dacd8cdafcffcad711386e0d755065116e5f00c14b4106ca190493f8cecd0afc81f625e816c9bb50d2b8c3f3af67fde140498b1a765edadcd4dcaae39d3a8db8b97e5f548a6eb4813eb1f267d9f9dc49411b7e7aef9bce572eff0be0c27fab513a206224f3f8074443e145a7403be0ca45cc9579ca3d7a45944da1a9911df43c081b7e808ee104ef0a776016cb2920da8368fe7184c4da928da01c59572aa85533c57914dbf4e1b01af4c25fb3852ba81be586436d56b76348c38fa54d51a88567f867e52f41ee1d9400975dc23f0b07b6bad62edff576333c29dd04bc1a9a8dba33a0428bbbc4a8ea523d4fb6930a6f01996e285b8715c77f43d83ad0c1aaf36fb71f1f72055fc2eaa1de38e3b0b29c55fac18b5ee786d491b399465bd03b92c50bdea2b77d640bbddf032016fef9b6391d1bafacb8bb79e86e725b4c26d5491be203ab11343be013b8ae1fd1c62e07d1a0363699c177136aae1681583d7aea57e03ece45ee18f0810315e3f71da75af6eaa29e4445a8ea39695dd319295ea757ba27b9fea1a59892f7e1900a3cf671dcd038279d1344ff99815d7dec4b6a165e3f014495535c4f6c858bf60b3ad37560d564f9d38b25d0fb5db97b46dd51a05e2ac17e6eba000d1084bd3c5519ce7dc11d69ee670a83ad3f238a4aa9bce3da838b70968ff476660c546e1e9049d9da41cff74b133419704502a510bda2792129a7d234feffff98a36e0056ca85c507adb100b6de704ab7e448bb89e6d5463fbcbda1e32eb9bd96c6dfbacea990ef9e87f3495741b0812fec4ba17f69c18916f1fd56f4d02e155c841eaa688f45f69a09ca4cb2ff9d9be2b25b71e11f950c08d45d7b32366498884cd8bb8cd1be4ee94a57a28a104bb832f514fce4b0011a28511cd2b968ff957aa3fd5c0c3b170a9ef0e3d49d18d97e7a743dda7eca98f5b0f03c24c295529582b18ce93676c895ac32dcb9f1e064aa8b4f77664e75b68c0d96c2fa58f1dbcf68b14105fab726a7966df4a48bbce800945bb12d4f5a4956", 0xf80}, {&(0x7f0000001740)="e9bfb75f5f868490945591d131620396e8da1abc392a3ce51f175c0d5014f428fa590774577511f8", 0x28}, {&(0x7f0000001780)="aab754466dcc7f7123797de91559a93210602681f48fe6d253b99232235cac44f99fc6502673bd840d65ff30c80d4173f1b3ec8d71abfedff8552b8f645a5d6b1d1183f839613e9d99c509d10e141f2315cdff5194aea32d6181928b3c42388c51bb32a7d1673b0b146c930f811d26a1dee0f5a544c79247b7b8f389921fb8001cafffe204b4b85e65c5e1911e83a737e889a9bfc82e5afb8ac273cc1970696775f0cb4b6a03fe3a7b7acd0241c64f3aaccc60886a297a754e0bf94e2ec274", 0xbf}], 0x7}}], 0x2, 0x1) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0xd}, {0xd}, {0x8, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x48050}, 0x40004) recvmmsg(r6, &(0x7f0000005140)=[{{0x0, 0x0, &(0x7f0000001a80)=[{&(0x7f0000000640)=""/216, 0xd8}, {&(0x7f00000052c0)=""/235, 0xeb}, {&(0x7f0000003080)=""/4096, 0x1000}], 0x3}, 0x3}], 0x1b00, 0x0, 0x0) 4m32.121786266s ago: executing program 6 (id=2850): r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0x3, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x8, 0x1, 0x2, "3a7107ca5de21f000000f373000000e0ff00", 0x56595559}) r1 = socket(0x2b, 0x80801, 0x1) socketpair$unix(0x1, 0x3, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f00000005c0)={0xa, 0x4e23, 0xa, @loopback, 0x7ffffffe}, 0x1c) r2 = socket$nl_route(0x10, 0x3, 0x0) unshare(0x64000600) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) mremap(&(0x7f0000260000/0x3000)=nil, 0x3000, 0x3000, 0x2, &(0x7f000090b000/0x3000)=nil) socket$nl_generic(0x10, 0x3, 0x10) io_setup(0xbab, &(0x7f0000000000)=0x0) io_destroy(r3) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000104000000000000000000000200", @ANYRES32, @ANYBLOB="0000000002000100240012800b00010065727370616e0000140002800600020030000000080004"], 0x44}}, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x11e, 0x486, 0x0, 0x0) r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$printer(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="400f010000005623083903834b4a30e7a9c7d1b61df58ceaca669f90d0d4a260f7de3a37f3be38a4b6f75b6e78b7b11e4fe5cc25bf4981b677368201f0bf7bf4da2fb983923ff4ebd28106e04050de9bfede7c4ee50a298f439d7062f287299d01f18970fc91dd6dd1afde980d0b7d4df8ca08136ea11072debff41a8e2679a4ca11d3e8d4d4002815e6762cef982bbe6e03640175611b50fb1d9ae8bfc694dee23c70ab43dc353ec1c2a90c0c33c4b5e77bae2cb2e92e36b8d07e16cc1554631d198ddb1941833237e6bf33d820520353deca00"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f0000000780)={0x18, &(0x7f0000000580)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r4, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) syz_usb_control_io$uac1(r4, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r4, 0x0, 0x0) syz_usb_control_io$uac1(r4, 0x0, 0x0) 4m26.756388586s ago: executing program 6 (id=2915): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x4c}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x40c0080) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x45e, 0xf9, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xc0, 0x0, [{{0x9, 0x4, 0x0, 0xfe, 0xf2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x3, 0x2, 0x1, {0x22, 0x3}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xfe, 0x0, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000100)={0x2c, &(0x7f0000000000)={0x0, 0x23, 0xd, {0xd, 0x4, "44d042bf4eab10d5f265ee"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x32}}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xffff060e}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = fsopen(&(0x7f0000000000)='9p\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='source', &(0x7f0000001bc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6h\xd1\x1d\xac\xaa\xfb\xc7Y\xcd\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6h\xd1\x1d\xac\xaa\xfb\xc7Y\xcd\xc5n\xeb\xab\xf70\x99\xef\x8b0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1}}) io_uring_enter(r0, 0x47ba, 0x3e80, 0x100000000000000, 0x0, 0x0) (fail_nth: 3) 11.665497098s ago: executing program 7 (id=3776): syz_usb_connect(0x0, 0x1c5, &(0x7f0000000200)=ANY=[@ANYBLOB="120100002aa9dc20560800bc7fb2010203010902"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x30, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x15523ea56aa22b9a, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r0, 0x1733, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r5, 0x3ba0, &(0x7f00000001c0)={0x48, 0x1, r6, 0x0, 0x2, 0xffffffff}) ioctl$IOMMU_IOAS_IOVA_RANGES(r5, 0x3b84, &(0x7f0000000880)={0x20, r6, 0x0, 0x0, 0x0}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) cachestat(0xffffffffffffffff, 0x0, 0xfffffffffffffffc, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r7 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FILTER(r7, 0x65, 0x1, &(0x7f0000001040)=[{}], &(0x7f0000000000)=0x8) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) 8.587746609s ago: executing program 7 (id=3789): socket$inet_mptcp(0x2, 0x1, 0x106) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, 0x0, 0x39) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r1, &(0x7f00000004c0)='W', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback, 0x8}, 0x1c) setsockopt$inet6_mreq(r1, 0x29, 0x1b, 0x0, 0x0) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000300)={0x1c, 0x0, 0x400, 0x70bd26, 0x0, {{0x12}, {@val={0x8}, @void}}}, 0x1c}}, 0x40) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000080)="18", 0x1, 0x40000d3, &(0x7f0000000340)={0x11, 0xc, r5, 0x1, 0xfe, 0x6, @multicast}, 0x14) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000003c0)={0x0, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4a24, @dev={0xac, 0x14, 0x14, 0x1a}}, {0x2, 0x4e21, @multicast2}, 0x4, 0x0, 0x0, 0x0, 0x8, 0x0, 0x6f8, 0x1ff, 0x9}) write$tun(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="080000fa"], 0xdc) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000380)={0x6000000, 0x1, "5a77bd318786aeb879ca62cdab2a0000000086d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f6853772b21a140efb76cba37ff3111d6847e8b9398a646717af75fc008daefba68e62221034718c55704cdb737ae996ed831f3b803549db3a8ffff7d34171111d806726615380fe65a6a0a72e1ac2b68bd6276fd8bb6363d10f70da60fd53ded22c87eb2d9500e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef1d7ee686be0fc58e384f93a13f4e8bbf599394baea3a9ca1864f0a35d6cc38fca320900000000000000001457df7be7e1aefe363590d1f600"}) syz_open_dev$usbfs(&(0x7f0000000080), 0x6, 0x2) r6 = socket$packet(0x11, 0x2, 0x300) socket$inet_udp(0x2, 0x2, 0x0) bind$packet(r6, &(0x7f0000000000)={0x11, 0x4, 0x0, 0x1, 0xfe, 0x6, @remote}, 0x14) syz_emit_ethernet(0xe, &(0x7f0000000040)=ANY=[@ANYBLOB="90"], 0x0) 7.377810645s ago: executing program 7 (id=3798): syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x77, 0x29, 0x4, 0x20, 0x424, 0x9901, 0xc257, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x43, 0x0, 0x2, 0x31, 0x7d, 0x55, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) (async) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x77, 0x29, 0x4, 0x20, 0x424, 0x9901, 0xc257, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x43, 0x0, 0x2, 0x31, 0x7d, 0x55, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) r1 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000480)=@name, &(0x7f00000004c0)=0x10, 0x80800) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000580)={0x0, 'macsec0\x00', {0x2}, 0xa}) (async) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000580)={0x0, 'macsec0\x00', {0x2}, 0xa}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000640)=ANY=[@ANYBLOB="0000000000eaf2dd9dde390d5258754e6cf836c959c4ff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x410000, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000340)={'gre0\x00', &(0x7f0000000280)={'gre0\x00', 0x0, 0x8, 0x8000, 0x10000, 0x0, {{0x1a, 0x4, 0x3, 0x13, 0x68, 0x67, 0x0, 0x0, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_addr={0x44, 0x54, 0x32, 0x1, 0xa, [{@multicast1, 0x4}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x5e28}, {@rand_addr=0x64010101, 0x1000008}, {@multicast1, 0x93f4}, {@empty, 0x10001}, {@empty}, {@remote, 0x1}, {@rand_addr=0x64010102, 0xd4e}, {@loopback, 0x1ff}, {@remote}]}]}}}}}) sendmsg$nl_route(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000680)=@ipv6_newrule={0x44, 0x20, 0x20, 0x70bd2c, 0x25dfdbfb, {0xa, 0x10, 0x80, 0xe7, 0x3, 0x0, 0x0, 0x8, 0x6}, [@FRA_SRC={0x14, 0x2, @private1}, @FRA_SRC={0x14, 0x2, @private1}]}, 0x44}}, 0x20004052) (async) sendmsg$nl_route(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000680)=@ipv6_newrule={0x44, 0x20, 0x20, 0x70bd2c, 0x25dfdbfb, {0xa, 0x10, 0x80, 0xe7, 0x3, 0x0, 0x0, 0x8, 0x6}, [@FRA_SRC={0x14, 0x2, @private1}, @FRA_SRC={0x14, 0x2, @private1}]}, 0x44}}, 0x20004052) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000200)={0x40, 0x1, 0x4, "60d5837c"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r3 = socket$inet(0xa, 0x801, 0x84) listen(r3, 0x8) r4 = socket$inet(0xa, 0x801, 0x84) listen(r4, 0xfffffffd) r5 = socket$inet(0xa, 0x801, 0x84) listen(r5, 0x8) (async) listen(r5, 0x8) socket$inet(0xa, 0x801, 0x84) (async) r6 = socket$inet(0xa, 0x801, 0x84) listen(r6, 0x8) socket$inet6(0xa, 0x1, 0x8010000000000084) (async) r7 = socket$inet6(0xa, 0x1, 0x8010000000000084) listen(r7, 0x7) (async) listen(r7, 0x7) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r8, 0x100) (async) listen(r8, 0x100) r9 = socket$netlink(0x10, 0x3, 0x4) writev(r9, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r9) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000400)={0x34, &(0x7f0000000240)={0x40, 0xe, 0x4, "570f0bc2"}, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.648603324s ago: executing program 4 (id=3822): r0 = syz_io_uring_setup(0x49f, &(0x7f0000000400)={0x0, 0xe7a8, 0x3700, 0x7ffe, 0x1af}, &(0x7f0000000340)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r3 = eventfd2(0xff, 0x80001) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000300)=r3, 0x1) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_MSG_RING={0x28, 0x44, 0x0, r0, 0x0, 0x0, 0x0, 0x2}) io_uring_enter(r0, 0x627, 0x4c1, 0x43, 0x0, 0x0) (fail_nth: 20) 4.446716868s ago: executing program 4 (id=3825): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc0505350, &(0x7f0000000140)={{0x0, 0x1}, {0xf}}) syz_usb_connect(0x5, 0x2d, 0x0, 0x0) ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000040)={0x251e0, 0x9, 0x4, {0x2, @pix={0x900000, 0x2, 0x38415262, 0x4, 0x62, 0x6, 0x6, 0x2, 0x1, 0x3, 0x2, 0x6}}, 0xaf}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) ioctl$TIOCSERGETLSR(r1, 0x5459, &(0x7f0000000200)) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) 4.097455336s ago: executing program 7 (id=3829): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_DESTROY$ioas(r0, 0x3b80, &(0x7f0000000540)={0x8, r2}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r1}) ioctl$IOMMU_IOAS_UNMAP(r0, 0x3b86, &(0x7f0000000900)={0x18, r2, 0xfff, 0x1004000}) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x3c, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @empty}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) r3 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c00009040000020701010009050102"], 0x0) syz_usb_control_io$printer(r3, 0x0, &(0x7f00000011c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r4, &(0x7f00000015c0)=[{&(0x7f0000000080)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) 4.087008241s ago: executing program 5 (id=3830): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb47, 0x9, 0x8, 0x80000001, 0x3}, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_inet_SIOCDELRT(0xffffffffffffffff, 0x890c, 0x0) ioctl$TIOCMGET(r2, 0x541e, &(0x7f0000000040)) openat$sndseq(0xffffffffffffff9c, 0x0, 0x40041) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001a80)=ANY=[@ANYBLOB="b700000017000000bfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff0000000015040000000002000f030000000000003404000001ed0a0014040000170000801c400000000000007b0a00fe000000002c04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d0cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090d030000003acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931481747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885769754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8269b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd23834a50d7eb8e327fb5db12cbd6a9efe8e671c4f251fe3bf440cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa2c910fb8de24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d1767e31a3446cd57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c828c02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007f00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d05d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b530500d8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bd9b075f1488d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462aa2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783fefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9be0bdd37220e316f2297743dd4731614a50c16c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd08000000e843591d2618e2d2cdc7081c8fafffe9c350a5c554a387de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119d2a673bdae05779208409e6cf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8a9d3374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9eed636338f1835fc957729d63dc1bfc7b772cbe536c2d3aff27c22f9a2f876512616a5bdaf22a16e19d1b5f52abb40b433983d0cf50234de659c1a397ce901000000caae1bcfdce33dae6adc260321702f239c25ab181390e7dc8c1e5b1cf3b4fef1cd5c44a89b5e5d8314e02f4673ded90bce9a4025b0232eec970f7aa17f175a14e8dc0700bac0006b98a8283eee5665f3aede28228e0468dbcf8b776fe4c629d3af183a7cba5adf77f23d31f9d5a183c0da4e95f75b1496a97a46a06e4e1f5a8438d49dbd493ba2482c398ab724577fd742bf44cdd8489086e61aa3cb1d3ab3dac8183102fe6fc8a038e3868a05928114"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000480)={'raw\x00', 0x4, [{}, {}, {}, {}]}, 0x68) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={r3, 0x0, 0x0}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000900000000000008000003000000040004001c000180180010"], 0x34}}, 0x84) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c000000", @ANYBLOB="01002abd700000ffdf25050000000800020008000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000081}, 0x4000884) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c0000006c00010025bd", @ANYRES32=0x0], 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a300000000040000000030a01080000000000000000010000000900030073797a32000000001400048008000240fffffffe08000140000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d657461000000001400028008000340000000120800024000000013"], 0xd8}}, 0x8090) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x0, 0x0) r7 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x370, 0xffffffff, 0xb0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0xb0, 0x0, {0x100000000000000}}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x0, 0x9}}}, {{@uncond, 0x0, 0xc8, 0x128, 0x0, {}, [@common=@inet=@socket3={{0x28, 'socket\x00', 0x2}}, @common=@unspec=@cluster={{0x30}, {0x4, 0x4, 0x183e, 0x1}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0x4ca, 0xb, [0x10, 0x2a, 0x36, 0xe, 0x7, 0xf, 0xb, 0x22, 0x39, 0x12, 0x17, 0x36, 0x6, 0xe, 0xa, 0x10], 0x0, 0xb, 0x681}}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'wlan1\x00', 'pim6reg1\x00', {0xff}}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@set={{0x40}, {{0x2, [0x4, 0x4, 0x4, 0x1, 0x4, 0x7], 0x0, 0x2}}}, @common=@ttl={{0x28}, {0x0, 0x40}}]}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3d0) 3.551562932s ago: executing program 4 (id=3831): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c00", @ANYRES16=r2, @ANYBLOB="05a300000000000000000d00000008000300", @ANYRES32=r1, @ANYBLOB="9fe63ce9e70421ca3d6a7c101f8fa84ae0eac6d39b7ee8fa9a0ee6fcff1ecfc5b808d3a7b0ef1db81388fd0e06eac3d65a02bb9b6910e15fc1efe32195ba444bce9201000000000000b88d1a54cd3f1f96289c573b0c27b3942e7ef65c46525f0c980c0e4e8a0c32418df51416e839f2e53820ba795132e84e479e71057515e0bd83ea703de1e2d43a418cdc4e56172b703b4a2a9e42ca210ea892795ba54508734fb3a1d103ea6040ae9021fc3b2c"], 0x1c}}, 0x0) 3.244672s ago: executing program 4 (id=3832): r0 = syz_open_dev$sg(&(0x7f0000000280), 0x1, 0xf7a958f98e37f456) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)={0x0, 0xe, 0x25}) 3.057367388s ago: executing program 4 (id=3833): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x6700000000000000) ioctl$KVM_SET_NESTED_STATE(0xffffffffffffffff, 0x4080aebf, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) execve(0x0, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r1, &(0x7f0000000cc0)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000d40)="b1f56ee29c433328d3b2a83bd97e37007087acae7568edff43ed556d76770122635aea1dc48755381c71590cd542e796cc2669e2af442a03760c5cdfc691b3da35ad6a8d2ef9c2baa53a8dec36a2e434d46e643a1277b1dd932f3ef2cf46c257d6a19523b8b789ef34b46e461725b5e437323385b88c368f8bb5b933aa9169f5f7b51dd5319b8016623d1863d70581691a79a6678db1e5e7fa1c98c5b9e4a87272e9c4a1bd98dbb2ab76919ba5c1020e80bd0659e82d861dc6fe4c62639134c504aa438689", 0xc5}], 0x1}}], 0x1, 0xc0) sendto$inet(r1, &(0x7f00000012c0)="09268a92", 0x4, 0x11, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) 2.28433004s ago: executing program 5 (id=3837): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/65, 0x328000, 0x800}, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) syz_emit_ethernet(0x42, &(0x7f0000000100)={@broadcast, @remote, @val={@void}, {@ipv6={0x86dd, @icmpv6={0xb, 0x6, "c77d3d", 0x8, 0x3a, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @loopback, {[], @echo_request={0x80, 0x0, 0x0, 0x7, 0xa6da}}}}}}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x12) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x12) 1.957472072s ago: executing program 5 (id=3840): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000100)={0x7ffffffc, "5660359c3245d1c42317afadfd48ed5100000000000000608a00", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000180)={0x10001, "029c6e5c846eccb800d2ae30e3f5c320998750190300", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f0000000000)={"3c24139ed44aec57f2e2ad238a7b448ed886923c31d4b8affbf514fd00", r3, 0xffffffffffffffff}) poll(&(0x7f0000000040)=[{r4, 0x658}, {r2, 0x4054}], 0x2, 0xfffffff8) close_range(r1, 0xffffffffffffffff, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/pm_trace', 0x2, 0x0) write$FUSE_NOTIFY_STORE(r5, &(0x7f00000002c0)=ANY=[], 0x28) r6 = socket$packet(0x11, 0x3, 0x300) sendmsg$xdp(0xffffffffffffffff, 0x0, 0x40001) memfd_create(0x0, 0x0) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r6, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x48}, {0x6, 0x37, 0x0, 0x9}]}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_pressure(r7, &(0x7f0000000040)='io.pressure\x00', 0x2, 0x0) ppoll(&(0x7f0000000180)=[{r8}], 0x1, 0x0, 0x0, 0x0) r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r9) ptrace(0x10, r9) ptrace$peeksig(0x4209, r9, &(0x7f0000000080)={0x0, 0xad93466708c7e227}, 0x0) sendto$inet6(r0, &(0x7f0000000240)="8a", 0x1, 0x51, &(0x7f0000000080)={0xa, 0x3, 0x1, @local, 0x9}, 0x1c) 1.924004425s ago: executing program 2 (id=3841): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$loop(&(0x7f0000000100), 0xdf6, 0x0) syz_open_procfs$namespace(0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x20100008b}, 0x0) socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = openat$incfs(0xffffffffffffffff, &(0x7f0000000180)='.pending_reads\x00', 0x452000, 0x59) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x18000000000002a0, 0x78, 0x0, &(0x7f0000000100)="8e0ef086dd00000000000000003c5200ca5e361fb025b8e84660f97cd3c50752845a968b416b36e31cb7fc876a78a4c8ba275f2643fc8f46e70976a8f0cfec039c56421f7426d64fcccd49a43c5da25b8ba74f92674300517a44ebc71cae3da2f34ffe97141f01ed58dbc0658ce9725e71f7a4b68db54409", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8}, 0x50) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5800000010000104fcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000040000000380012800b0001"], 0x58}}, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r5, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x1058, [{0xa00}, {0x0, 0x100000000000000}]}, 0xa50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000000) syz_emit_vhci(&(0x7f0000000080)=ANY=[], 0x10) mq_open(&(0x7f00000001c0)='\\![[,\x00', 0x40, 0x80, &(0x7f0000000200)={0x7, 0xc92, 0x3, 0x6}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'essiv(authenc(rmd160-generic,cbc-camellia-aesni-avx2),sha1-avx)\x00'}, 0x58) r7 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="e0000000150001", @ANYRES16=r1, @ANYRESHEX=r1], 0xe0}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x20, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_XFRM_DIR={0x5}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x3}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xb8}}, 0x0) 1.795060795s ago: executing program 5 (id=3842): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000", @ANYRES16=r2, @ANYBLOB="05a300000000000000000d00000008000300", @ANYRES32=r1, @ANYBLOB="9fe63ce9e70421ca3d6a7c101f8fa84ae0eac6d39b7ee8fa9a0ee6fcff1ecfc5b808d3a7b0ef1db81388fd0e06eac3d65a02bb9b6910e15fc1efe32195ba444bce9201000000000000b88d1a54cd3f1f96289c573b0c27b3942e7ef65c46525f0c980c0e4e8a0c32418df51416e839f2e53820ba795132e84e479e71057515e0bd83ea703de1e2d43a418cdc4e56172b703b4a2a9e42ca210ea892795ba54508734fb3a1d103ea6040ae9021fc3b2c"], 0x1c}}, 0x0) 1.77349568s ago: executing program 2 (id=3843): socket(0x10, 0x803, 0x0) syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) socket(0x2, 0x80805, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) fsopen(0x0, 0x0) pipe(&(0x7f0000000480)) socket$can_raw(0x1d, 0x3, 0x1) syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vimc2(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x54}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.699938715s ago: executing program 5 (id=3844): socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x1}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f0000004340)=[{{&(0x7f00000002c0)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @multicast2}}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000380)=""/226, 0xe2}], 0x1, &(0x7f00000015c0)=""/70, 0x46}, 0x40}, {{&(0x7f0000001640)=@sco, 0x80, &(0x7f0000001700)=[{&(0x7f00000016c0)=""/45, 0x2d}], 0x1, &(0x7f0000001740)=""/90, 0x5a}, 0x7}, {{&(0x7f00000017c0)=@generic, 0x80, &(0x7f0000003cc0)=[{&(0x7f0000001840)=""/208, 0xd0}, {&(0x7f00000044c0)=""/67, 0x43}, {&(0x7f00000019c0)=""/4084, 0xff4}, {&(0x7f0000004480)=""/55, 0x37}, {&(0x7f0000002a00)=""/38, 0x26}, {&(0x7f0000002a40)=""/4090, 0xffa}, {&(0x7f0000003a40)=""/245, 0xf5}, {&(0x7f0000003b40)=""/225, 0xe1}, {&(0x7f0000003c40)=""/114, 0x72}], 0x9, &(0x7f0000003d80)=""/130, 0x82}, 0x3}, {{&(0x7f0000003e40)=@nfc, 0x80, &(0x7f0000004080)=[{&(0x7f0000003ec0)=""/111, 0x6f}, {&(0x7f0000003f40)=""/132, 0x84}, {&(0x7f0000004000)=""/115, 0x73}], 0x3, &(0x7f00000040c0)=""/177, 0xb1}, 0x2}, {{&(0x7f0000004180)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000004200)=""/102, 0x66}], 0x1, &(0x7f00000042c0)=""/88, 0x58}, 0x4}], 0x5, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) personality(0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x8, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000001c0)={0xffffffffffffffff}, 0x13f, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180), r3, 0x0, 0x1, 0x4}}, 0x20) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) r4 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, r4, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffdd5}, 0x94) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$MRT6_INIT(r0, 0x29, 0xc8, &(0x7f0000000340), 0x4) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x1}, 0xc) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, &(0x7f0000000000)=0xd, 0x4) 1.650601271s ago: executing program 2 (id=3845): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x1c, 0x18, 0x80f, 0x70bd2b, 0x25dfdbfc, {0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0xc8, 0x9, 0x1100}}, 0x1c}}, 0x4000) 1.37750365s ago: executing program 2 (id=3846): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000100)=0x2800, 0x4) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002800), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000100)) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000001740)=""/192, 0x0}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f00000000c0)=0x1) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x89b1, &(0x7f00000002c0)={'macvtap0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r2 = socket$nl_route(0x10, 0x3, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) fcntl$lock(r3, 0x7, &(0x7f0000000040)={0x1, 0x0, 0x9, 0x401}) fcntl$lock(r3, 0x7, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x6, 0x2, 0x0, 0x2, 0x0, 0xffffff01}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0xfffffffd}}, @TCA_NETEM_RATE={0x14, 0x6, {0x5, 0x5, 0x4}}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8080}, 0x0) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) socket$igmp6(0xa, 0x3, 0x2) 1.015773054s ago: executing program 0 (id=3849): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000ad0010000060a010400000000000000000a0000040900020073797a32000000000900020073797a32000000000900010073797a3100000000980104802c0001800b0001006c6f6f6b757000001c000280080003400000000f08000440000000020801004000000017100001800b0001007470726f78790000480101800b00010064796e7365740000380102800c0006400000000000000005100007800b0001006c6f6f6b757000000900010073797a320000000008000240000000010900010073797a30000000007c000a80100001800b0001006578746864720000100001800b0001007470726f78790000100001800a0001006d617463680000001800018008000100647570000c0002800800014000000012100001800b0001006c6f6f6b7570000020000180080001006f73660014000280050002000900000008000340000000010900010073797a31000000000800094000000002680007800b0001006c6f6f6b757000005800028008000540000000010900010073797a3200000000080004400000000208000540000000010900010073797a300000000008000240000000080900010073797a320000000008000340000000000800054000000001100001800a0001006c696a1b62dff608db4c00001100010000000000000000000100000a"], 0x1f8}, 0x1, 0x0, 0x0, 0x8800}, 0x24000000) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x9) 961.560292ms ago: executing program 7 (id=3850): socket(0x400000000010, 0x4, 0xceb) (async) openat(0xffffffffffffff9c, 0x0, 0x401c2, 0x0) (async) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) sched_setscheduler(0x0, 0x2, 0x0) rt_sigpending(0x0, 0x0) (async) sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, 0x0, 0xc800) (async) syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001ed472082a110500a8140102030109022d0001960000000009040000035a07660009050223000000000009050e000000000000090508000001000000"], 0x0) 869.966136ms ago: executing program 0 (id=3851): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) r3 = dup(r1) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) shutdown(r3, 0x1) close_range(r0, 0xffffffffffffffff, 0x600) 799.601899ms ago: executing program 0 (id=3852): sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4a, 0x9, 0x8, 0x0, 0x3}, 0x0) r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) sendfile(r0, r0, 0x0, 0xf2) 731.976525ms ago: executing program 5 (id=3853): ioctl$KVM_HYPERV_EVENTFD(0xffffffffffffffff, 0x400caed0, &(0x7f0000000000)={0x2, 0xffffffffffffffff, 0xffffffff}) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x29) ioctl$KVM_CAP_DIRTY_LOG_RING(r0, 0x4068aea3, &(0x7f00000001c0)={0xc0, 0x0, 0x6000}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="00220f00000054b20000935aa8257f90b39e"], 0x0}, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x8, 0x2) ioctl$vim2m_VIDIOC_PREPARE_BUF(r3, 0xc058565d, &(0x7f0000000140)=@fd={0x3, 0x1, 0x4, 0x800, 0x7, {0x0, 0xea60}, {0x4, 0x1, 0x2, 0x3, 0xb2, 0x6, "c809ecaa"}, 0x1000, 0x4, {}, 0x1ff}) r4 = syz_open_dev$hiddev(&(0x7f0000000140), 0x0, 0x0) ioctl$HIDIOCSREPORT(r4, 0x400c4808, &(0x7f0000000080)={0x2, 0x100, 0x20a6}) r5 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000006380), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r5, 0xc02064cc, &(0x7f0000000180)) ioctl$HIDIOCGCOLLECTIONINDEX(r4, 0x40184810, 0x0) syz_usb_connect$uac1(0x0, 0xa4, 0x0, 0x0) ioctl$HIDIOCGDEVINFO(r1, 0x801c4803, &(0x7f0000000500)=""/121) close_range(r1, 0xffffffffffffffff, 0x0) 669.418859ms ago: executing program 0 (id=3854): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000", @ANYRES16=r2, @ANYBLOB="05a300000000000000000d00000008000300", @ANYRES32=r1, @ANYBLOB="9fe63ce9e70421ca3d6a7c101f8fa84ae0eac6d39b7ee8fa9a0ee6fcff1ecfc5b808d3a7b0ef1db81388fd0e06eac3d65a02bb9b6910e15fc1efe32195ba444bce9201000000000000b88d1a54cd3f1f96289c573b0c27b3942e7ef65c46525f0c980c0e4e8a0c32418df51416e839f2e53820ba795132e84e479e71057515e0bd83ea703de1e2d43a418cdc4e56172b703b4a2a9e42ca210ea892795ba54508734fb3a1d103ea6040ae9021fc3b2c"], 0x1c}}, 0x0) 639.506786ms ago: executing program 0 (id=3855): socket(0x10, 0x803, 0x0) syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) socket(0x2, 0x80805, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) fsopen(0x0, 0x0) pipe(&(0x7f0000000480)) socket$can_raw(0x1d, 0x3, 0x1) syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vimc2(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x54}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 587.412776ms ago: executing program 0 (id=3856): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket(0x2, 0x2, 0x0) setsockopt$inet_opts(r2, 0x0, 0x14, 0x0, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYRES16=r1], 0xa0}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000440)=ANY=[@ANYBLOB="48000000100005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000010810000140012800b000100626174616476000089ff028008000a00", @ANYRES32=0x0, @ANYBLOB="0a000100bb30b5080398f20eb067c91cc7bd6cfaed285f461669e43db1c438b4a4a3bd31b9cc289ab80afb4ca230b5460c473ed6afd4a238139bf9341f3bc3eea51d8ed611100b0c30dc05e16f1737d5149a3212b462b4db85ce2ddb192ff3fe6e28bedd2320ef491545e41aea8e78104d"], 0x48}}, 0x0) connect$inet(r3, &(0x7f0000000140)={0x2, 0x4e22, @loopback}, 0x10) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)=0x0) sched_setattr(r6, &(0x7f00000000c0)={0x38, 0x6, 0xa, 0x3c3, 0x79, 0x8, 0x1a, 0x8a6f, 0x5, 0x3b}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYRES16=r7], 0x3c}}, 0x4000000) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r8, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x30}}, 0x0) 469.563393ms ago: executing program 2 (id=3857): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000100)={r1}) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e21, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x2000008, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) r4 = dup(r1) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={'pimreg0\x00', {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x17}}}) r5 = socket(0x11, 0x2, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r5, 0x8917, &(0x7f0000000080)={'bond0\x00', {0x2, 0x0, @initdev}}) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) sendmsg$IPSET_CMD_ADD(r6, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x11c, 0x9, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x1}, [@IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x1}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x8}, @IPSET_ATTR_NAMEREF={0x9, 0x13, 'syz2\x00'}]}, @IPSET_ATTR_ADT={0x58, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010101}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBQUEUE={0x6, 0x1d, 0x1, 0x0, 0x6}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR={0x5, 0x3, 0x3}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x33}}}}]}, @IPSET_ATTR_ADT={0x40, 0x8, 0x0, 0x1, [{0x18, 0x7, 0x0, 0x1, @IPSET_ATTR_IFACE={0x14, 0x17, 'tunl0\x00'}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x7}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x988}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x6}}]}, @IPSET_ATTR_ADT={0x2c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBPRIO={0x8, 0x1c, 0x1, 0x0, 0x101}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @empty}}}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x8}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x11c}}, 0x4000800) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) shutdown(r4, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 325.410563ms ago: executing program 2 (id=3858): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000024000/0x18000)=nil, &(0x7f0000000680)=[@text16={0x10, &(0x7f0000000280)="66b9800000c00f326635010000000f3064660f38828e4258660f086766c744240012e93bf96766c7442402010000006766c744240600000000670f011c2466b9800000c00f326635002000000f300f01df66b80500000066b900200000a90a000f01c40f019f09000f01c2", 0x6b}], 0x1, 0x7d, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000300)={[0x7, 0x800, 0x100, 0x0, 0x5700000000000000, 0x401, 0x6, 0xfffffffffffffff7, 0x0, 0x13f, 0x100000001, 0xba25, 0xfff, 0x3, 0xfffffffffffffe00, 0x4], 0xeeef0000, 0x1c0080}) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000039000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000040)="b861078ee82e0f797e00ba2000ec0f20e06635020000000f22e066b8734700000f23d00f21f86635200000010f23f8baf80c66b8e8e8f38066efbafc0cb8bb7eef36660f754c710f01da0f0866b9800000c00f326635008000000f30", 0x5c}], 0x1, 0x40, &(0x7f00000003c0), 0x0) 0s ago: executing program 4 (id=3859): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1000, 0x0, 0xb49, 0x401, 0x8, 0x0, 0x100006}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000140), &(0x7f0000000380)=0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB, @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f0000000200)={0x2020, 0x0, 0x0}, 0x2020) open(&(0x7f00000000c0)='./file1\x00', 0x4002, 0x0) write$FUSE_INIT(r4, &(0x7f0000002300)={0x50, 0x0, r5, {0x7, 0x9, 0x0, 0x31008003, 0xfffe}}, 0x50) read$FUSE(r4, &(0x7f0000004580)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r4, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r6}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x3b, 0x2, [{0xfe}, {0xfffffff9}]}}) r8 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) r9 = openat$nullb(0xffffffffffffff9c, 0x0, 0x2000, 0x0) sendfile(r8, r9, 0x0, 0xff7e82) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'sit0\x00'}) kernel console output (not intermixed with test programs): .031461][ T5933] usb 5-1: USB disconnect, device number 73 [ 1052.062152][ T30] audit: type=1326 audit(1753259502.345:1599): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18883 comm="syz.4.3196" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f28b038e9a9 code=0x7ffc0000 [ 1052.084748][ C0] vkms_vblank_simulate: vblank timer overrun [ 1052.240089][ T5933] usblp0: removed [ 1052.345186][T18920] input: syz1 as /devices/virtual/input/input55 [ 1053.609149][ T2150] usb 5-1: new full-speed USB device number 74 using dummy_hcd [ 1053.832313][ T2150] usb 5-1: not running at top speed; connect to a high speed hub [ 1053.865128][ T2150] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 66, changing to 4 [ 1053.926006][ T2150] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1053.974904][ T2150] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1054.017396][ T2150] usb 5-1: Product: syz [ 1054.036641][ T2150] usb 5-1: Manufacturer: syz [ 1054.060621][ T2150] usb 5-1: SerialNumber: syz [ 1054.320888][T18947] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1054.364605][T18947] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1054.510335][ T2150] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1054.626492][ T2150] usb 5-1: USB disconnect, device number 74 [ 1054.633941][ T5933] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 1054.783011][T18973] IPVS: set_ctl: invalid protocol: 51 172.30.0.5:16387 [ 1054.790514][ T5933] usb 1-1: Using ep0 maxpacket: 8 [ 1054.816507][ T5933] usb 1-1: config 2 has an invalid interface number: 31 but max is 0 [ 1054.837635][T18974] bridge: RTM_NEWNEIGH with invalid ether address [ 1054.849426][ T5933] usb 1-1: config 2 has no interface number 0 [ 1054.898749][ T5933] usb 1-1: config 2 interface 31 has no altsetting 0 [ 1054.953009][ T5933] usb 1-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 1054.984192][ T5933] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1055.039083][ T5933] usb 1-1: Product: syz [ 1055.064369][ T5933] usb 1-1: Manufacturer: syz [ 1055.089991][ T5933] usb 1-1: SerialNumber: syz [ 1055.597507][T18965] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1055.634179][T18965] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1055.686244][ T5933] ch9200 1-1:2.31: probe with driver ch9200 failed with error -22 [ 1055.708189][ T5933] usb 1-1: USB disconnect, device number 112 [ 1055.832435][T19007] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 1056.337261][T18999] syzkaller0: entered promiscuous mode [ 1056.418349][T18999] syzkaller0: entered allmulticast mode [ 1057.657907][T19034] x_tables: duplicate underflow at hook 1 [ 1058.600326][ T2150] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1058.765305][ T2150] usb 5-1: device descriptor read/64, error -71 [ 1059.039302][ T2150] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 1059.189200][ T2150] usb 5-1: device descriptor read/64, error -71 [ 1059.310156][ T2150] usb usb5-port1: attempt power cycle [ 1059.661606][ T2150] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 1059.701887][ T2150] usb 5-1: device descriptor read/8, error -71 [ 1059.756544][T19069] FAULT_INJECTION: forcing a failure. [ 1059.756544][T19069] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1059.771474][T19069] CPU: 0 UID: 0 PID: 19069 Comm: syz.0.3227 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 1059.771500][T19069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1059.771514][T19069] Call Trace: [ 1059.771522][T19069] [ 1059.771531][T19069] dump_stack_lvl+0x189/0x250 [ 1059.771561][T19069] ? __pfx____ratelimit+0x10/0x10 [ 1059.771584][T19069] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1059.771604][T19069] ? __pfx__printk+0x10/0x10 [ 1059.771637][T19069] should_fail_ex+0x414/0x560 [ 1059.771660][T19069] _copy_to_user+0x31/0xb0 [ 1059.771685][T19069] simple_read_from_buffer+0xe1/0x170 [ 1059.771717][T19069] proc_fail_nth_read+0x1df/0x250 [ 1059.771740][T19069] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1059.771764][T19069] ? rw_verify_area+0x258/0x650 [ 1059.771790][T19069] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1059.771812][T19069] vfs_read+0x200/0x980 [ 1059.771844][T19069] ? __pfx___mutex_lock+0x10/0x10 [ 1059.771869][T19069] ? __pfx_vfs_read+0x10/0x10 [ 1059.771897][T19069] ? __fget_files+0x2a/0x420 [ 1059.771920][T19069] ? __fget_files+0x3a0/0x420 [ 1059.771937][T19069] ? __fget_files+0x2a/0x420 [ 1059.771965][T19069] ksys_read+0x145/0x250 [ 1059.771995][T19069] ? __pfx_ksys_read+0x10/0x10 [ 1059.772026][T19069] ? do_syscall_64+0xbe/0x3b0 [ 1059.772054][T19069] do_syscall_64+0xfa/0x3b0 [ 1059.772077][T19069] ? lockdep_hardirqs_on+0x9c/0x150 [ 1059.772098][T19069] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1059.772119][T19069] ? clear_bhb_loop+0x60/0xb0 [ 1059.772144][T19069] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1059.772164][T19069] RIP: 0033:0x7ff9b938d3bc [ 1059.772183][T19069] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1059.772201][T19069] RSP: 002b:00007ff9ba162030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1059.772222][T19069] RAX: ffffffffffffffda RBX: 00007ff9b95b5fa0 RCX: 00007ff9b938d3bc [ 1059.772237][T19069] RDX: 000000000000000f RSI: 00007ff9ba1620a0 RDI: 0000000000000005 [ 1059.772250][T19069] RBP: 00007ff9ba162090 R08: 0000000000000000 R09: 0000000000000000 [ 1059.772276][T19069] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000001 [ 1059.772289][T19069] R13: 0000000000000000 R14: 00007ff9b95b5fa0 R15: 00007ff9b96dfa28 [ 1059.772321][T19069] [ 1060.011018][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1060.019476][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1060.065082][ T2150] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 1060.099315][T19071] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3228'. [ 1060.103041][ T2150] usb 5-1: device descriptor read/8, error -71 [ 1060.231186][ T2150] usb usb5-port1: unable to enumerate USB device [ 1062.092220][T15917] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 1062.709622][T15917] usb 5-1: Using ep0 maxpacket: 16 [ 1062.825471][T15917] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1062.842744][T15917] usb 5-1: New USB device found, idVendor=05ac, idProduct=abdf, bcdDevice=3d.49 [ 1062.852249][T15917] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1062.871331][T15917] usb 5-1: Product: syz [ 1062.882226][T15917] usb 5-1: Manufacturer: syz [ 1062.902225][T15917] usb 5-1: SerialNumber: syz [ 1063.031843][T15917] usb 5-1: config 0 descriptor?? [ 1063.275519][T15917] ipheth 5-1:0.0: Unable to find endpoints [ 1065.569817][ T5933] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 1065.690130][ T5845] usb 5-1: USB disconnect, device number 79 [ 1065.765037][ T5933] usb 1-1: Using ep0 maxpacket: 32 [ 1065.820538][ T5933] usb 1-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 1065.839350][ T5933] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1065.847437][ T5933] usb 1-1: Product: syz [ 1065.885639][T19139] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 2666 [ 1065.890188][ T5933] usb 1-1: Manufacturer: syz [ 1065.928825][ T5933] usb 1-1: SerialNumber: syz [ 1065.979459][ T5933] usb 1-1: config 0 descriptor?? [ 1066.214567][T19130] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3242'. [ 1066.280261][T19130] FAULT_INJECTION: forcing a failure. [ 1066.280261][T19130] name failslab, interval 1, probability 0, space 0, times 0 [ 1066.295067][T19130] CPU: 0 UID: 0 PID: 19130 Comm: syz.0.3242 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 1066.295101][T19130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1066.295115][T19130] Call Trace: [ 1066.295125][T19130] [ 1066.295134][T19130] dump_stack_lvl+0x189/0x250 [ 1066.295165][T19130] ? __pfx____ratelimit+0x10/0x10 [ 1066.295190][T19130] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1066.295217][T19130] ? __pfx__printk+0x10/0x10 [ 1066.295252][T19130] ? __pfx___might_resched+0x10/0x10 [ 1066.295276][T19130] ? fs_reclaim_acquire+0x7d/0x100 [ 1066.295303][T19130] should_fail_ex+0x414/0x560 [ 1066.295331][T19130] ? alloc_netdev_mqs+0xc9e/0x11e0 [ 1066.295354][T19130] should_failslab+0xa8/0x100 [ 1066.295410][T19130] __kvmalloc_node_noprof+0x161/0x5f0 [ 1066.295442][T19130] ? alloc_netdev_mqs+0xc9e/0x11e0 [ 1066.295462][T19130] ? alloc_netdev_mqs+0xc36/0x11e0 [ 1066.295490][T19130] alloc_netdev_mqs+0xc9e/0x11e0 [ 1066.295521][T19130] rtnl_create_link+0x31f/0xd10 [ 1066.295552][T19130] rtnl_newlink_create+0x25c/0xb00 [ 1066.295589][T19130] ? __mutex_lock+0x51b/0xe80 [ 1066.295620][T19130] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1066.295649][T19130] ? rtnl_newlink+0x8db/0x1c70 [ 1066.295679][T19130] ? __pfx___mutex_lock+0x10/0x10 [ 1066.295715][T19130] ? ns_capable+0x8a/0xf0 [ 1066.295744][T19130] rtnl_newlink+0x16d6/0x1c70 [ 1066.295781][T19130] ? netlink_sendmsg+0x805/0xb30 [ 1066.295825][T19130] ? __pfx_rtnl_newlink+0x10/0x10 [ 1066.295880][T19130] ? kasan_quarantine_put+0xdd/0x220 [ 1066.295907][T19130] ? lockdep_hardirqs_on+0x9c/0x150 [ 1066.295937][T19130] ? nlmon_xmit+0xb0/0x100 [ 1066.295962][T19130] ? kmem_cache_free+0x18f/0x400 [ 1066.296000][T19130] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1066.296024][T19130] ? lockdep_hardirqs_on+0x9c/0x150 [ 1066.296048][T19130] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1066.296082][T19130] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1066.296110][T19130] ? __dev_queue_xmit+0x27e/0x3a70 [ 1066.296148][T19130] ? __lock_acquire+0xab9/0xd20 [ 1066.296199][T19130] ? __pfx_rtnl_newlink+0x10/0x10 [ 1066.296226][T19130] rtnetlink_rcv_msg+0x7cf/0xb70 [ 1066.296258][T19130] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1066.296286][T19130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1066.296311][T19130] ? ref_tracker_free+0x63a/0x7d0 [ 1066.296333][T19130] ? __copy_skb_header+0xa7/0x550 [ 1066.296356][T19130] ? __pfx_ref_tracker_free+0x10/0x10 [ 1066.296393][T19130] netlink_rcv_skb+0x208/0x470 [ 1066.296424][T19130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1066.296454][T19130] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1066.296498][T19130] ? netlink_deliver_tap+0x2e/0x1b0 [ 1066.296527][T19130] ? netlink_deliver_tap+0x2e/0x1b0 [ 1066.296563][T19130] netlink_unicast+0x759/0x8e0 [ 1066.296604][T19130] netlink_sendmsg+0x805/0xb30 [ 1066.296645][T19130] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1066.296680][T19130] ? aa_sock_msg_perm+0x94/0x160 [ 1066.296707][T19130] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1066.296731][T19130] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1066.296770][T19130] __sock_sendmsg+0x21c/0x270 [ 1066.296799][T19130] ____sys_sendmsg+0x505/0x830 [ 1066.296839][T19130] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1066.296883][T19130] ? import_iovec+0x74/0xa0 [ 1066.296917][T19130] ___sys_sendmsg+0x21f/0x2a0 [ 1066.296953][T19130] ? __pfx____sys_sendmsg+0x10/0x10 [ 1066.297028][T19130] ? __fget_files+0x2a/0x420 [ 1066.297046][T19130] ? __fget_files+0x3a0/0x420 [ 1066.297078][T19130] __x64_sys_sendmsg+0x19b/0x260 [ 1066.297113][T19130] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1066.297158][T19130] ? __pfx_ksys_write+0x10/0x10 [ 1066.297184][T19130] ? rcu_is_watching+0x15/0xb0 [ 1066.297215][T19130] ? do_syscall_64+0xbe/0x3b0 [ 1066.297244][T19130] do_syscall_64+0xfa/0x3b0 [ 1066.297270][T19130] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1066.297290][T19130] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1066.297312][T19130] ? clear_bhb_loop+0x60/0xb0 [ 1066.297338][T19130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1066.297358][T19130] RIP: 0033:0x7ff9b938e9a9 [ 1066.297377][T19130] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1066.297396][T19130] RSP: 002b:00007ff9ba162038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1066.297419][T19130] RAX: ffffffffffffffda RBX: 00007ff9b95b5fa0 RCX: 00007ff9b938e9a9 [ 1066.297435][T19130] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000011 [ 1066.297448][T19130] RBP: 00007ff9ba162090 R08: 0000000000000000 R09: 0000000000000000 [ 1066.297462][T19130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1066.297475][T19130] R13: 0000000000000000 R14: 00007ff9b95b5fa0 R15: 00007ff9b96dfa28 [ 1066.297508][T19130] [ 1066.765731][T19148] syzkaller1: entered promiscuous mode [ 1066.771414][T19148] syzkaller1: entered allmulticast mode [ 1066.782077][ T5933] airspy 1-1:0.0: usb_control_msg() failed -71 request 09 [ 1066.789391][ T5933] airspy 1-1:0.0: Could not detect board [ 1066.795241][ T5933] airspy 1-1:0.0: probe with driver airspy failed with error -71 [ 1066.817297][ T5933] usb 1-1: USB disconnect, device number 113 [ 1067.199601][ T5845] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 1067.362560][ T5845] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1067.412413][ T5845] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1067.451738][ T5845] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1067.478621][ T5845] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1067.498605][ T5845] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1067.534808][ T5845] usb 3-1: config 0 descriptor?? [ 1067.842561][ T5933] usb 5-1: new full-speed USB device number 80 using dummy_hcd [ 1068.026059][ T5933] usb 5-1: config 150 has an invalid interface number: 204 but max is 1 [ 1068.063737][ T5933] usb 5-1: config 150 has no interface number 0 [ 1068.121574][ T5933] usb 5-1: config 150 interface 204 has no altsetting 0 [ 1068.182190][ T5933] usb 5-1: config 150 interface 1 has no altsetting 0 [ 1068.200839][ T5933] usb 5-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 1068.241207][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1068.290810][ T5933] usb 5-1: Product: syz [ 1068.514503][ T5933] usb 5-1: Manufacturer: syz [ 1068.529411][ T5933] usb 5-1: SerialNumber: syz [ 1068.711887][ T5845] usbhid 3-1:0.0: can't add hid device: -71 [ 1068.738242][ T5845] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1068.785599][ T5845] usb 3-1: USB disconnect, device number 120 [ 1069.991757][T19218] input: syz1 as /devices/virtual/input/input56 [ 1070.592787][ T5933] xr_serial 5-1:150.204: xr_serial converter detected [ 1070.599346][ T5845] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 1070.659331][ T5933] xr_serial ttyUSB0: Failed to set reg 0x60: -71 [ 1070.665895][ T5933] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 1070.750890][ T5933] usb 5-1: USB disconnect, device number 80 [ 1070.777140][ T5933] xr_serial 5-1:150.204: device disconnected [ 1070.809819][ T5845] usb 6-1: Using ep0 maxpacket: 8 [ 1070.850975][ T5845] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1070.898942][T19238] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3263'. [ 1070.903517][ T5845] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1070.959912][ T5845] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1071.015909][ T5845] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1071.049264][ T5845] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1071.095106][ T5845] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1071.398644][ T5845] usb 6-1: GET_CAPABILITIES returned 0 [ 1071.477404][ T5845] usbtmc 6-1:16.0: can't read capabilities [ 1071.604207][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1071.615977][T19227] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1071.627962][T19227] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1071.695095][T19258] binder: 19255:19258 ioctl c0306201 0 returned -14 [ 1071.703026][T19258] binder: 19255:19258 ioctl c0306201 200000000640 returned -22 [ 1071.716732][T19258] netlink: 196 bytes leftover after parsing attributes in process `syz.4.3268'. [ 1071.761874][T19261] netlink: 'syz.2.3269': attribute type 10 has an invalid length. [ 1071.818443][T19264] FAULT_INJECTION: forcing a failure. [ 1071.818443][T19264] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1071.835351][T19264] CPU: 0 UID: 0 PID: 19264 Comm: syz.2.3269 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 1071.835381][T19264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1071.835395][T19264] Call Trace: [ 1071.835403][T19264] [ 1071.835414][T19264] dump_stack_lvl+0x189/0x250 [ 1071.835446][T19264] ? __pfx____ratelimit+0x10/0x10 [ 1071.835469][T19264] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1071.835498][T19264] ? __pfx__printk+0x10/0x10 [ 1071.835528][T19264] ? __might_fault+0xb0/0x130 [ 1071.835568][T19264] should_fail_ex+0x414/0x560 [ 1071.835596][T19264] _copy_from_user+0x2d/0xb0 [ 1071.835628][T19264] ___sys_sendmsg+0x158/0x2a0 [ 1071.835663][T19264] ? __pfx____sys_sendmsg+0x10/0x10 [ 1071.835733][T19264] ? __fget_files+0x2a/0x420 [ 1071.835764][T19264] ? __fget_files+0x3a0/0x420 [ 1071.835793][T19264] __x64_sys_sendmsg+0x19b/0x260 [ 1071.835827][T19264] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1071.835869][T19264] ? __pfx_ksys_write+0x10/0x10 [ 1071.835893][T19264] ? rcu_is_watching+0x15/0xb0 [ 1071.835923][T19264] ? do_syscall_64+0xbe/0x3b0 [ 1071.835950][T19264] do_syscall_64+0xfa/0x3b0 [ 1071.835973][T19264] ? lockdep_hardirqs_on+0x9c/0x150 [ 1071.835995][T19264] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1071.836014][T19264] ? clear_bhb_loop+0x60/0xb0 [ 1071.836039][T19264] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1071.836059][T19264] RIP: 0033:0x7fb283f8e9a9 [ 1071.836076][T19264] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1071.836094][T19264] RSP: 002b:00007fb284e17038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1071.836116][T19264] RAX: ffffffffffffffda RBX: 00007fb2841b6160 RCX: 00007fb283f8e9a9 [ 1071.836131][T19264] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000004 [ 1071.836144][T19264] RBP: 00007fb284e17090 R08: 0000000000000000 R09: 0000000000000000 [ 1071.836164][T19264] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1071.836175][T19264] R13: 0000000000000001 R14: 00007fb2841b6160 R15: 00007fb2842dfa28 [ 1071.836206][T19264] [ 1072.045097][ C0] vkms_vblank_simulate: vblank timer overrun [ 1072.193105][T16057] Bluetooth: hci4: command 0x0406 tx timeout [ 1072.355733][ T5933] usb 6-1: USB disconnect, device number 53 [ 1072.599534][ T5845] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 1072.766805][T19274] FAULT_INJECTION: forcing a failure. [ 1072.766805][T19274] name failslab, interval 1, probability 0, space 0, times 0 [ 1072.786064][T19274] CPU: 0 UID: 0 PID: 19274 Comm: syz.7.3273 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 1072.786094][T19274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1072.786107][T19274] Call Trace: [ 1072.786116][T19274] [ 1072.786125][T19274] dump_stack_lvl+0x189/0x250 [ 1072.786155][T19274] ? __pfx____ratelimit+0x10/0x10 [ 1072.786179][T19274] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1072.786204][T19274] ? __pfx__printk+0x10/0x10 [ 1072.786238][T19274] ? __pfx___might_resched+0x10/0x10 [ 1072.786268][T19274] should_fail_ex+0x414/0x560 [ 1072.786309][T19274] should_failslab+0xa8/0x100 [ 1072.786343][T19274] __kmalloc_noprof+0xcb/0x4f0 [ 1072.786369][T19274] ? sock_kmalloc+0xd6/0x160 [ 1072.786395][T19274] sock_kmalloc+0xd6/0x160 [ 1072.786418][T19274] af_alg_alloc_areq+0x8d/0x260 [ 1072.786443][T19274] skcipher_recvmsg+0x356/0x11c0 [ 1072.786471][T19274] ? aa_sk_perm+0x81e/0x950 [ 1072.786504][T19274] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 1072.786524][T19274] ? __lock_acquire+0xab9/0xd20 [ 1072.786548][T19274] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1072.786569][T19274] ? security_socket_recvmsg+0x7e/0x2e0 [ 1072.786598][T19274] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 1072.786622][T19274] sock_recvmsg+0x22c/0x270 [ 1072.786651][T19274] ____sys_recvmsg+0x1c9/0x460 [ 1072.786681][T19274] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1072.786718][T19274] ? import_iovec+0x74/0xa0 [ 1072.786750][T19274] ___sys_recvmsg+0x1b5/0x510 [ 1072.786775][T19274] ? __pfx____sys_recvmsg+0x10/0x10 [ 1072.786822][T19274] ? __fget_files+0x3a0/0x420 [ 1072.786853][T19274] do_recvmmsg+0x307/0x770 [ 1072.786883][T19274] ? __pfx_do_recvmmsg+0x10/0x10 [ 1072.786916][T19274] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1072.786959][T19274] __x64_sys_recvmmsg+0x190/0x240 [ 1072.786983][T19274] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1072.787008][T19274] ? rcu_is_watching+0x15/0xb0 [ 1072.787038][T19274] ? do_syscall_64+0xbe/0x3b0 [ 1072.787065][T19274] do_syscall_64+0xfa/0x3b0 [ 1072.787087][T19274] ? lockdep_hardirqs_on+0x9c/0x150 [ 1072.787109][T19274] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1072.787129][T19274] ? clear_bhb_loop+0x60/0xb0 [ 1072.787154][T19274] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1072.787173][T19274] RIP: 0033:0x7fb9e5f8e9a9 [ 1072.787192][T19274] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1072.787209][T19274] RSP: 002b:00007fb9e6d67038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1072.787229][T19274] RAX: ffffffffffffffda RBX: 00007fb9e61b5fa0 RCX: 00007fb9e5f8e9a9 [ 1072.787245][T19274] RDX: 0000000000000001 RSI: 0000200000003800 RDI: 0000000000000004 [ 1072.787258][T19274] RBP: 00007fb9e6d67090 R08: 0000000000000000 R09: 0000000000000000 [ 1072.787270][T19274] R10: 0000000000010000 R11: 0000000000000246 R12: 0000000000000001 [ 1072.787283][T19274] R13: 0000000000000000 R14: 00007fb9e61b5fa0 R15: 00007fb9e62dfa28 [ 1072.787315][T19274] [ 1073.076173][ C0] vkms_vblank_simulate: vblank timer overrun [ 1073.159180][ T5845] usb 5-1: Using ep0 maxpacket: 16 [ 1073.256501][ T5845] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1073.544127][T19283] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3276'. [ 1073.554363][ T5845] usb 5-1: config 0 has no interfaces? [ 1073.737315][ T5845] usb 5-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 1073.765579][ T5845] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1073.823556][ T5845] usb 5-1: config 0 descriptor?? [ 1074.080063][T19268] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1074.091820][T19268] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1074.125845][T19296] ptrace attach of "./syz-executor exec"[11470] was attempted by "./syz-executor exec"[19296] [ 1074.228794][T19297] netlink: 88 bytes leftover after parsing attributes in process `syz.5.3280'. [ 1074.401771][T19296] netlink: 'syz.5.3280': attribute type 21 has an invalid length. [ 1074.453425][T19296] netlink: 128 bytes leftover after parsing attributes in process `syz.5.3280'. [ 1074.539244][T19296] netlink: 'syz.5.3280': attribute type 4 has an invalid length. [ 1074.547524][T19296] netlink: 3 bytes leftover after parsing attributes in process `syz.5.3280'. [ 1074.988843][T19312] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3095185786 (6190371572 ns) > initial count (5484635560 ns). Using initial count to start timer. [ 1075.206805][T19317] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3095185786 (6190371572 ns) > initial count (5484635560 ns). Using initial count to start timer. [ 1075.299160][T11681] usb 1-1: new full-speed USB device number 114 using dummy_hcd [ 1075.589349][T17657] usb 6-1: new full-speed USB device number 54 using dummy_hcd [ 1075.621840][T11681] usb 1-1: config 8 has an invalid interface number: 223 but max is 0 [ 1075.664476][T11681] usb 1-1: config 8 has no interface number 0 [ 1075.696700][T11681] usb 1-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d [ 1075.746056][T11681] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1075.788730][T11681] usb 1-1: Product: syz [ 1075.813217][T11681] usb 1-1: Manufacturer: syz [ 1075.828554][T17657] usb 6-1: config 8 has an invalid interface number: 223 but max is 0 [ 1075.854975][T11681] usb 1-1: SerialNumber: syz [ 1075.869181][T17657] usb 6-1: config 8 has no interface number 0 [ 1075.908779][T17657] usb 6-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d [ 1075.939386][T17657] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1076.022213][T17657] usb 6-1: Product: syz [ 1076.081595][T17657] usb 6-1: Manufacturer: syz [ 1076.086320][T17657] usb 6-1: SerialNumber: syz [ 1076.092380][ T977] usb 5-1: USB disconnect, device number 81 [ 1076.103143][T19311] FAULT_INJECTION: forcing a failure. [ 1076.103143][T19311] name failslab, interval 1, probability 0, space 0, times 0 [ 1076.119870][T19311] CPU: 1 UID: 0 PID: 19311 Comm: syz.0.3283 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 1076.119898][T19311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1076.119912][T19311] Call Trace: [ 1076.119921][T19311] [ 1076.119931][T19311] dump_stack_lvl+0x189/0x250 [ 1076.119960][T19311] ? __pfx____ratelimit+0x10/0x10 [ 1076.120026][T19311] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1076.120050][T19311] ? __pfx__printk+0x10/0x10 [ 1076.120085][T19311] ? __pfx___might_resched+0x10/0x10 [ 1076.120108][T19311] ? fs_reclaim_acquire+0x7d/0x100 [ 1076.120133][T19311] should_fail_ex+0x414/0x560 [ 1076.120161][T19311] should_failslab+0xa8/0x100 [ 1076.120193][T19311] __kmalloc_noprof+0xcb/0x4f0 [ 1076.120220][T19311] ? kfree+0x4d/0x440 [ 1076.120243][T19311] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1076.120274][T19311] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1076.120302][T19311] ? tomoyo_domain+0xd9/0x130 [ 1076.120334][T19311] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1076.120355][T19311] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1076.120379][T19311] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1076.120435][T19311] ? __lock_acquire+0xab9/0xd20 [ 1076.120479][T19311] ? __fget_files+0x2a/0x420 [ 1076.120502][T19311] ? __fget_files+0x2a/0x420 [ 1076.120520][T19311] ? __fget_files+0x3a0/0x420 [ 1076.120538][T19311] ? __fget_files+0x2a/0x420 [ 1076.120561][T19311] security_file_ioctl+0xcb/0x2d0 [ 1076.120596][T19311] __se_sys_ioctl+0x47/0x170 [ 1076.120626][T19311] do_syscall_64+0xfa/0x3b0 [ 1076.120650][T19311] ? lockdep_hardirqs_on+0x9c/0x150 [ 1076.120672][T19311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1076.120693][T19311] ? clear_bhb_loop+0x60/0xb0 [ 1076.120719][T19311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1076.120739][T19311] RIP: 0033:0x7ff9b938e9a9 [ 1076.120766][T19311] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1076.120785][T19311] RSP: 002b:00007ff9ba162038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1076.120807][T19311] RAX: ffffffffffffffda RBX: 00007ff9b95b5fa0 RCX: 00007ff9b938e9a9 [ 1076.120823][T19311] RDX: 00002000000000c0 RSI: 000000004008ae89 RDI: 0000000000000005 [ 1076.120837][T19311] RBP: 00007ff9ba162090 R08: 0000000000000000 R09: 0000000000000000 [ 1076.120849][T19311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1076.120862][T19311] R13: 0000000000000000 R14: 00007ff9b95b5fa0 R15: 00007ff9b96dfa28 [ 1076.120894][T19311] [ 1076.120903][T19311] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1076.415966][T19327] CUSE: unknown device info "KJ H+ۤ2LhnL1`Ccn80(3նi>f_ٮ,<_eF" [ 1076.452900][T19327] CUSE: unknown device info "3ܟ,v" [ 1076.459770][T19327] CUSE: unknown device info "J2S Z !e/J+-na4D|G$5O~q [ 1076.459770][T19327] fzXSAxjTǔw xRɐQ(hҏj pVdY0|M?2JIv^R@" [ 1076.485041][T19327] CUSE: unknown device info "!To}ݝ&|L+Uoϲ"FstV:׌E gJ<@c4TMM|" [ 1076.527845][T11681] usb 1-1: USB disconnect, device number 114 [ 1076.565682][T19327] CUSE: DEVNAME unspecified [ 1076.684288][T17657] usb 6-1: USB disconnect, device number 54 [ 1077.008288][T19340] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 2666 [ 1077.309252][T16057] Bluetooth: hci5: command 0x0406 tx timeout [ 1077.505345][T19350] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1078.352438][T19378] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3296'. [ 1078.606622][T19381] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3296'. [ 1078.869177][T15917] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 1078.876912][T15923] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 1079.097650][T15923] usb 5-1: Using ep0 maxpacket: 16 [ 1079.129165][T15923] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1079.138861][T15923] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 1079.148627][T15917] usb 1-1: Using ep0 maxpacket: 32 [ 1079.259346][T15923] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 1079.652089][T19400] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1079.684205][T15917] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 1079.804879][T15917] usb 1-1: config 255 has too many interfaces: 255, using maximum allowed: 32 [ 1079.882742][T15917] usb 1-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 1080.067896][T15923] usb 5-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 1080.089998][T15923] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1080.584600][T19409] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 2666 [ 1080.812113][T15917] usb 1-1: config 255 has 0 interfaces, different from the descriptor's value: 255 [ 1080.821617][T15923] usb 5-1: Product: syz [ 1080.899073][T15917] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 1080.908389][T15923] usb 5-1: Manufacturer: syz [ 1080.934925][T15917] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1080.956083][T15923] usb 5-1: SerialNumber: syz [ 1081.009537][T15923] usb 5-1: config 0 descriptor?? [ 1081.027844][T19384] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 1081.205391][T15923] mcba_usb 5-1:0.0 can0: failed tx_urb -90 [ 1081.259148][T15923] mcba_usb 5-1:0.0 can0: Failed to send cmd (169) [ 1081.297419][T15923] mcba_usb 5-1:0.0 can0: failed tx_urb -90 [ 1081.349137][T15923] mcba_usb 5-1:0.0 can0: Failed to send cmd (169) [ 1081.391447][T15923] mcba_usb 5-1:0.0: Microchip CAN BUS Analyzer connected [ 1081.462217][T15917] usb 1-1: can't set config #255, error -71 [ 1081.479128][T15917] usb 1-1: USB disconnect, device number 115 [ 1082.115282][T19431] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3304'. [ 1082.218917][T19431] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3304'. [ 1082.662622][T19431] bridge0: port 2(bridge_slave_1) entered disabled state [ 1082.670502][T19431] bridge0: port 1(bridge_slave_0) entered disabled state [ 1082.745412][ T977] usb 5-1: USB disconnect, device number 82 [ 1082.755291][ T977] mcba_usb 5-1:0.0 can0: device disconnected [ 1083.724258][T19431] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1083.771060][T19431] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1083.883758][T19431] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1083.893003][T19431] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1083.903748][T19431] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1083.913058][T19431] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1084.096582][T19471] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 2666 [ 1084.247241][T19474] af_packet: tpacket_rcv: packet too big, clamped from 65232 to 4294967272. macoff=96 [ 1084.521084][T11681] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 1084.615157][T19469] syzkaller0: entered promiscuous mode [ 1084.654644][T19469] syzkaller0: entered allmulticast mode [ 1084.699584][T11681] usb 3-1: config index 0 descriptor too short (expected 24, got 18) [ 1084.708384][T11681] usb 3-1: config 0 has an invalid interface number: 40 but max is 0 [ 1084.743443][T11681] usb 3-1: config 0 has no interface number 0 [ 1084.762833][T11681] usb 3-1: too many endpoints for config 0 interface 40 altsetting 48: 120, using maximum allowed: 30 [ 1084.805353][T19489] input: syz1 as /devices/virtual/input/input57 [ 1084.809294][T11681] usb 3-1: config 0 interface 40 altsetting 48 has 0 endpoint descriptors, different from the interface descriptor's value: 120 [ 1084.851745][T11681] usb 3-1: config 0 interface 40 has no altsetting 0 [ 1084.872834][T11681] usb 3-1: New USB device found, idVendor=08fd, idProduct=0002, bcdDevice=ca.fd [ 1084.894725][T11681] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1084.929203][T11681] usb 3-1: Product: syz [ 1084.937900][T11681] usb 3-1: Manufacturer: syz [ 1084.954655][T11681] usb 3-1: SerialNumber: syz [ 1084.972166][T11681] usb 3-1: config 0 descriptor?? [ 1085.159772][T19501] input: syz1 as /devices/virtual/input/input58 [ 1085.214047][T11681] usb 3-1: USB disconnect, device number 121 [ 1086.091531][ C0] vcan0: j1939_tp_rxtimer: 0xffff88806ed1c400: rx timeout, send abort [ 1086.103018][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88806ed1c400: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session. [ 1086.199193][ T977] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 1086.351062][ T977] usb 3-1: device descriptor read/64, error -71 [ 1086.592148][ T977] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 1086.744629][ T977] usb 3-1: device descriptor read/64, error -71 [ 1086.859871][ T977] usb usb3-port1: attempt power cycle [ 1087.200362][ T977] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 1087.228227][ T977] usb 3-1: device descriptor read/8, error -71 [ 1087.479860][ T977] usb 3-1: new high-speed USB device number 125 using dummy_hcd [ 1087.502482][ T977] usb 3-1: device descriptor read/8, error -71 [ 1087.622208][ T977] usb usb3-port1: unable to enumerate USB device [ 1088.190927][T19534] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 2666 [ 1089.466348][T19560] macvlan2: entered allmulticast mode [ 1089.484379][T19560] bond0: entered allmulticast mode [ 1089.513456][T19560] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1089.540569][T19560] bridge0: port 1(macvlan2) entered blocking state [ 1089.583193][T19560] bridge0: port 1(macvlan2) entered disabled state [ 1089.652788][T19560] macvlan2: entered promiscuous mode [ 1089.702840][T19560] bond0: entered promiscuous mode [ 1090.251380][T19571] netlink: 'syz.2.3332': attribute type 21 has an invalid length. [ 1090.542504][T19578] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3334'. [ 1090.945210][T19589] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 2666 [ 1091.245685][T19596] netlink: 160 bytes leftover after parsing attributes in process `syz.2.3340'. [ 1091.277961][T19596] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1091.851976][ T977] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 1091.862036][T19621] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3346'. [ 1092.011457][ T977] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1092.086244][ T977] usb 6-1: New USB device found, idVendor=056e, idProduct=00fc, bcdDevice= 0.00 [ 1092.105337][ T977] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1092.123568][ T977] usb 6-1: config 0 descriptor?? [ 1092.369586][ T977] usbhid 6-1:0.0: can't add hid device: -71 [ 1092.376103][ T977] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1092.428092][ T977] usb 6-1: USB disconnect, device number 55 [ 1092.600482][T19634] IPv6: Can't replace route, no match found [ 1093.939701][T15923] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 1094.176686][T15923] usb 5-1: Using ep0 maxpacket: 16 [ 1094.200006][T15923] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1094.252661][T15923] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 1094.287246][T15923] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 1094.412008][T15923] usb 5-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 1094.445576][T15923] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1094.474255][T15923] usb 5-1: Product: syz [ 1094.478487][T15923] usb 5-1: Manufacturer: syz [ 1094.495774][T15923] usb 5-1: SerialNumber: syz [ 1094.509836][T15923] usb 5-1: config 0 descriptor?? [ 1094.524295][T19651] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1094.586738][T15923] mcba_usb 5-1:0.0 can0: failed tx_urb -90 [ 1094.617553][T15923] mcba_usb 5-1:0.0 can0: Failed to send cmd (169) [ 1094.625334][T15923] mcba_usb 5-1:0.0 can0: failed tx_urb -90 [ 1094.634217][T15923] mcba_usb 5-1:0.0 can0: Failed to send cmd (169) [ 1094.643336][T15923] mcba_usb 5-1:0.0: Microchip CAN BUS Analyzer connected [ 1094.784824][ T977] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 1094.951484][ T977] usb 6-1: config index 0 descriptor too short (expected 23569, got 27) [ 1094.960364][ T977] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1094.983325][ T977] usb 6-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1094.995915][ T977] usb 6-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1095.056349][ T977] usb 6-1: Manufacturer: syz [ 1095.108220][ T977] usb 6-1: config 0 descriptor?? [ 1095.284632][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.299849][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.371239][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.414021][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.447573][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.452573][ T977] rc_core: IR keymap rc-hauppauge not found [ 1095.498893][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.505052][ T977] Registered IR keymap rc-empty [ 1095.537835][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.564672][ T977] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 1095.604066][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.634187][ T977] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input59 [ 1095.645599][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.674565][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.707281][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.732289][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.758807][ T977] usb 6-1: USB disconnect, device number 56 [ 1095.759514][T19698] Set syz0 is full, maxelem 0 reached [ 1095.823825][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.874510][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.915135][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1095.947613][T19703] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3367'. [ 1096.016165][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1096.134972][T15917] hid-generic 0002:0004:0009.0018: unknown main item tag 0x0 [ 1096.241909][T15917] hid-generic 0002:0004:0009.0018: hidraw0: HID v0.04 Device [syz0] on syz0 [ 1096.284452][T19708] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3367'. [ 1096.529454][T19709] fido_id[19709]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1097.053546][T19727] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1097.254882][ T977] usb 5-1: USB disconnect, device number 83 [ 1097.263034][ T977] mcba_usb 5-1:0.0 can0: device disconnected [ 1097.399272][T19733] FAULT_INJECTION: forcing a failure. [ 1097.399272][T19733] name failslab, interval 1, probability 0, space 0, times 0 [ 1097.477670][T19733] CPU: 0 UID: 0 PID: 19733 Comm: syz.2.3378 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 1097.477700][T19733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1097.477714][T19733] Call Trace: [ 1097.477722][T19733] [ 1097.477732][T19733] dump_stack_lvl+0x189/0x250 [ 1097.477763][T19733] ? __pfx____ratelimit+0x10/0x10 [ 1097.477786][T19733] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1097.477809][T19733] ? __pfx__printk+0x10/0x10 [ 1097.477852][T19733] should_fail_ex+0x414/0x560 [ 1097.477878][T19733] should_failslab+0xa8/0x100 [ 1097.477911][T19733] __kmalloc_cache_noprof+0x70/0x3d0 [ 1097.477940][T19733] ? sctp_add_bind_addr+0x8c/0x370 [ 1097.477969][T19733] sctp_add_bind_addr+0x8c/0x370 [ 1097.477999][T19733] sctp_copy_local_addr_list+0x30b/0x4e0 [ 1097.478028][T19733] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 1097.478053][T19733] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1097.478079][T19733] ? sctp_v6_is_any+0x64/0x80 [ 1097.478108][T19733] ? sctp_copy_one_addr+0x93/0x360 [ 1097.478136][T19733] sctp_bind_addr_copy+0xb3/0x3c0 [ 1097.478162][T19733] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1097.478188][T19733] sctp_connect_new_asoc+0x2e0/0x690 [ 1097.478222][T19733] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1097.478250][T19733] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1097.478281][T19733] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1097.478305][T19733] ? security_sctp_bind_connect+0x7e/0x2e0 [ 1097.478345][T19733] sctp_sendmsg+0x155c/0x2810 [ 1097.478387][T19733] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1097.478419][T19733] ? aa_sk_perm+0x81e/0x950 [ 1097.478445][T19733] ? __pfx_aa_sk_perm+0x10/0x10 [ 1097.478468][T19733] ? sock_rps_record_flow+0x19/0x410 [ 1097.478495][T19733] ? inet_sendmsg+0x2f4/0x370 [ 1097.478523][T19733] __sock_sendmsg+0x19c/0x270 [ 1097.478556][T19733] __sys_sendto+0x3bd/0x520 [ 1097.478587][T19733] ? __pfx___sys_sendto+0x10/0x10 [ 1097.478612][T19733] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 1097.478650][T19733] ? __fget_files+0x3a0/0x420 [ 1097.478682][T19733] ? ksys_write+0x22a/0x250 [ 1097.478712][T19733] ? __pfx_ksys_write+0x10/0x10 [ 1097.478737][T19733] ? rcu_is_watching+0x15/0xb0 [ 1097.478767][T19733] __x64_sys_sendto+0xde/0x100 [ 1097.478799][T19733] do_syscall_64+0xfa/0x3b0 [ 1097.478822][T19733] ? lockdep_hardirqs_on+0x9c/0x150 [ 1097.478843][T19733] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1097.478873][T19733] ? clear_bhb_loop+0x60/0xb0 [ 1097.478897][T19733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1097.478915][T19733] RIP: 0033:0x7fb283f8e9a9 [ 1097.478932][T19733] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1097.478949][T19733] RSP: 002b:00007fb284e59038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1097.478970][T19733] RAX: ffffffffffffffda RBX: 00007fb2841b5fa0 RCX: 00007fb283f8e9a9 [ 1097.478984][T19733] RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000003 [ 1097.478996][T19733] RBP: 00007fb284e59090 R08: 0000200000000080 R09: 000000000000001c [ 1097.479009][T19733] R10: 0000000000000051 R11: 0000000000000246 R12: 0000000000000002 [ 1097.479020][T19733] R13: 0000000000000000 R14: 00007fb2841b5fa0 R15: 00007fb2842dfa28 [ 1097.479048][T19733] [ 1097.790663][ C0] vkms_vblank_simulate: vblank timer overrun [ 1097.796882][T15923] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 1098.094017][T15923] usb 1-1: config 0 has an invalid interface number: 237 but max is 0 [ 1098.109607][T15923] usb 1-1: config 0 has no interface number 0 [ 1098.175224][T15923] usb 1-1: config 0 interface 237 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1098.213484][T19740] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 1098.230642][T15923] usb 1-1: config 0 interface 237 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1098.265227][T15923] usb 1-1: config 0 interface 237 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 1098.317409][T15923] usb 1-1: config 0 interface 237 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 1098.355075][T15923] usb 1-1: New USB device found, idVendor=045e, idProduct=84bd, bcdDevice=89.b6 [ 1098.472103][T15923] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1098.491718][T19758] netlink: 48 bytes leftover after parsing attributes in process `syz.7.3385'. [ 1098.523124][T15923] usb 1-1: Product: syz [ 1098.545238][T15923] usb 1-1: Manufacturer: syz [ 1098.564003][ T977] usb 3-1: new high-speed USB device number 126 using dummy_hcd [ 1098.578331][T15923] usb 1-1: SerialNumber: syz [ 1098.581749][T19761] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3385'. [ 1098.668713][T19761] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3385'. [ 1098.684285][T15923] usb 1-1: config 0 descriptor?? [ 1098.793345][T15923] xpad 1-1:0.237: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1098.813815][ T977] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1098.834198][T15923] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.237/input/input60 [ 1098.897088][ T977] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1098.930565][T19729] vlan2: entered promiscuous mode [ 1098.954633][T19729] vlan2: entered allmulticast mode [ 1098.969965][ T977] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1098.996915][T19729] hsr_slave_1: entered allmulticast mode [ 1099.085615][T19765] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3376'. [ 1099.137854][ T977] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1099.184182][ T977] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1099.292740][ T977] usb 3-1: config 0 descriptor?? [ 1099.599768][T19753] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1099.608765][T19753] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1099.771148][ T5845] usb 1-1: USB disconnect, device number 116 [ 1099.869765][ T977] plantronics 0003:047F:FFFF.0019: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 1100.333927][T19780] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3388'. [ 1100.391457][T19780] netlink: 'syz.5.3388': attribute type 1 has an invalid length. [ 1100.564769][T19788] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3390'. [ 1100.659096][ T977] usb 6-1: new full-speed USB device number 57 using dummy_hcd [ 1100.896372][ T977] usb 6-1: device descriptor read/64, error -71 [ 1101.179267][ T977] usb 6-1: new full-speed USB device number 58 using dummy_hcd [ 1101.319166][ T977] usb 6-1: device descriptor read/64, error -71 [ 1101.326053][T11681] usb 3-1: reset high-speed USB device number 126 using dummy_hcd [ 1101.451096][ T977] usb usb6-port1: attempt power cycle [ 1101.809556][ T977] usb 6-1: new full-speed USB device number 59 using dummy_hcd [ 1101.830176][ T977] usb 6-1: device descriptor read/8, error -71 [ 1102.037251][T19812] IPVS: set_ctl: invalid protocol: 60 172.20.20.45:20000 [ 1102.079172][ T977] usb 6-1: new full-speed USB device number 60 using dummy_hcd [ 1102.100832][ T977] usb 6-1: device descriptor read/8, error -71 [ 1102.182214][T19816] input: syz1 as /devices/virtual/input/input62 [ 1102.259636][ T977] usb usb6-port1: unable to enumerate USB device [ 1103.042947][T17657] usb 3-1: USB disconnect, device number 126 [ 1103.801007][T19851] input: syz1 as /devices/virtual/input/input63 [ 1104.149186][T11681] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 1104.458813][T11681] usb 6-1: config 1 interface 0 altsetting 15 endpoint 0x81 has an invalid bInterval 64, changing to 10 [ 1104.513384][T11681] usb 6-1: config 1 interface 0 altsetting 15 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1104.571333][T11681] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1104.576029][T19867] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3413'. [ 1104.599259][ T30] kauditd_printk_skb: 32 callbacks suppressed [ 1104.602122][ T30] audit: type=1326 audit(1753259556.845:1632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19866 comm="syz.2.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb283f8e9a9 code=0x7ffc0000 [ 1104.630978][ C0] vkms_vblank_simulate: vblank timer overrun [ 1104.642704][T19867] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3413'. [ 1104.654695][T19867] netlink: 'syz.0.3413': attribute type 6 has an invalid length. [ 1104.663103][T19867] netlink: 'syz.0.3413': attribute type 5 has an invalid length. [ 1104.682763][T11681] usb 6-1: New USB device found, idVendor=1b1c, idProduct=1c1e, bcdDevice= 0.40 [ 1104.694217][T11681] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1104.705636][T11681] usb 6-1: Product: ␊ [ 1104.713058][T11681] usb 6-1: Manufacturer: 川䭩쫅娀䠷஼㳮줼娨᲏鹔蠐뀠ﲒ䙗灡⛲㵼അ㠚漯堖鄅壎嬵ӵᜈ륺샣뭏섚뻣낱ℯꌰ䨺孳쁹 [ 1104.734454][ T30] audit: type=1326 audit(1753259556.925:1633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19866 comm="syz.2.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fb283f8e9a9 code=0x7ffc0000 [ 1104.763530][T11681] usb 6-1: SerialNumber: 㠁 [ 1104.774133][ T30] audit: type=1326 audit(1753259556.925:1634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19866 comm="syz.2.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb283f8e9a9 code=0x7ffc0000 [ 1104.796642][ C0] vkms_vblank_simulate: vblank timer overrun [ 1104.955106][ T30] audit: type=1326 audit(1753259556.925:1635): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19866 comm="syz.2.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb283f8e9a9 code=0x7ffc0000 [ 1104.977722][ C0] vkms_vblank_simulate: vblank timer overrun [ 1105.277935][T11681] usbhid 6-1:1.0: can't add hid device: -71 [ 1105.284465][T11681] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 1105.305113][ T30] audit: type=1326 audit(1753259556.925:1636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19866 comm="syz.2.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=48 compat=0 ip=0x7fb283f8e9a9 code=0x7ffc0000 [ 1105.327693][ C0] vkms_vblank_simulate: vblank timer overrun [ 1105.344358][T11681] usb 6-1: USB disconnect, device number 61 [ 1105.377079][ T30] audit: type=1326 audit(1753259556.925:1637): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19866 comm="syz.2.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb283f8e9a9 code=0x7ffc0000 [ 1105.482079][ T30] audit: type=1326 audit(1753259556.925:1638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19866 comm="syz.2.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb283f8e9a9 code=0x7ffc0000 [ 1105.543678][T19885] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3418'. [ 1105.628642][ T30] audit: type=1326 audit(1753259556.925:1639): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19866 comm="syz.2.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7fb283f8e9a9 code=0x7ffc0000 [ 1105.657098][ T30] audit: type=1326 audit(1753259556.925:1640): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19866 comm="syz.2.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb283f8e9a9 code=0x7ffc0000 [ 1105.679632][ C0] vkms_vblank_simulate: vblank timer overrun [ 1105.707932][ T30] audit: type=1326 audit(1753259556.925:1641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19866 comm="syz.2.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb283f8e9a9 code=0x7ffc0000 [ 1105.730484][ C0] vkms_vblank_simulate: vblank timer overrun [ 1106.056131][T19890] netlink: 'syz.0.3420': attribute type 1 has an invalid length. [ 1106.121800][T19896] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3420'. [ 1106.141299][T19890] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1106.179253][T11681] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 1106.187979][T19901] netlink: 56 bytes leftover after parsing attributes in process `syz.5.3423'. [ 1106.199595][T19901] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3423'. [ 1106.252939][T19890] sctp: [Deprecated]: syz.0.3420 (pid 19890) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1106.252939][T19890] Use struct sctp_sack_info instead [ 1106.381246][T11681] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1106.395439][T11681] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1106.428240][T11681] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1106.438216][T11681] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1106.458325][T11681] usb 5-1: Product: syz [ 1106.462808][T11681] usb 5-1: Manufacturer: syz [ 1106.467528][T11681] usb 5-1: SerialNumber: syz [ 1106.495805][T11681] usb 5-1: config 0 descriptor?? [ 1106.518662][T11681] usb 5-1: selecting invalid altsetting 0 [ 1106.791556][T11681] usb 5-1: USB disconnect, device number 84 [ 1106.922089][T19908] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3425'. [ 1107.030612][T19916] udevd[19916]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1108.029225][T16057] Bluetooth: hci0: command 0x0406 tx timeout [ 1108.417372][T19937] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 1108.435911][T19936] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 1109.411281][T19950] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3437'. [ 1109.528583][T19952] netlink: 140 bytes leftover after parsing attributes in process `syz.0.3438'. [ 1109.679268][T19956] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3439'. [ 1110.224730][T19963] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3441'. [ 1110.254051][T19963] xt_policy: neither incoming nor outgoing policy selected [ 1110.407199][T19963] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3441'. [ 1111.389279][T15923] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 1111.601216][T15923] usb 6-1: too many endpoints for config 4 interface 0 altsetting 0: 101, using maximum allowed: 30 [ 1111.639817][T15923] usb 6-1: config 4 interface 0 altsetting 0 has an endpoint descriptor with address 0xA4, changing to 0x84 [ 1111.651876][T15923] usb 6-1: config 4 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 77 [ 1111.673167][T15923] usb 6-1: config 4 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 101 [ 1111.686387][T15923] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1111.695522][T15923] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1111.721089][T19974] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1112.233597][T19985] syzkaller0: entered promiscuous mode [ 1112.336327][T19985] syzkaller0: entered allmulticast mode [ 1112.372352][T15923] ath6kl: Failed to submit usb control message: -71 [ 1112.396889][T15923] ath6kl: unable to send the bmi data to the device: -71 [ 1112.442858][T15923] ath6kl: Unable to send get target info: -71 [ 1112.464297][T15923] ath6kl: Failed to init ath6kl core: -71 [ 1112.480348][T15923] ath6kl_usb 6-1:4.0: probe with driver ath6kl_usb failed with error -71 [ 1112.510740][T15923] usb 6-1: USB disconnect, device number 62 [ 1114.111339][T20007] block device autoloading is deprecated and will be removed. [ 1114.120132][T20007] syz.0.3453: attempt to access beyond end of device [ 1114.120132][T20007] loop0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1117.723174][T20029] block device autoloading is deprecated and will be removed. [ 1117.737937][T20029] syz.0.3459: attempt to access beyond end of device [ 1117.737937][T20029] loop0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1117.887664][T20021] delete_channel: no stack [ 1120.260205][T20045] input: syz1 as /devices/virtual/input/input65 [ 1120.694585][T20056] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 1120.809663][T15923] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 1120.979219][T15923] usb 5-1: Using ep0 maxpacket: 8 [ 1121.009115][T15923] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1121.024776][T15923] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1121.069938][T15923] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1121.111545][T15923] usb 5-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1121.254762][T15923] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1121.305644][T15923] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1121.398913][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1121.405522][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1121.474428][T15923] usbtmc 5-1:16.0: bulk endpoints not found [ 1121.649992][T15923] usb 5-1: USB disconnect, device number 85 [ 1123.397669][T20097] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1123.440160][T20095] [U] k} [ 1123.575019][ T30] audit: type=1326 audit(1753259575.815:1642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20098 comm="syz.0.3481" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff9b938e9a9 code=0x0 [ 1124.299128][ T5845] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 1124.601400][T20121] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 1124.796575][ T5845] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1124.809453][ T5845] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1124.858324][ T5845] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1124.883393][ T5845] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1124.917154][ T5845] usb 5-1: SerialNumber: syz [ 1125.160618][ T5845] usb 5-1: 0:2 : does not exist [ 1125.208122][ T5845] usb 5-1: USB disconnect, device number 86 [ 1125.305775][T19916] udevd[19916]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1125.569112][T17657] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 1125.745052][T17657] usb 1-1: Using ep0 maxpacket: 16 [ 1125.796158][T17657] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1125.963214][T17657] usb 1-1: New USB device found, idVendor=05ac, idProduct=abdf, bcdDevice=3d.49 [ 1125.972691][T17657] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1126.000522][T17657] usb 1-1: Product: syz [ 1126.007186][T17657] usb 1-1: Manufacturer: syz [ 1126.016582][T17657] usb 1-1: SerialNumber: syz [ 1126.038559][T17657] usb 1-1: config 0 descriptor?? [ 1126.118977][T20136] tipc: Enabled bearer , priority 10 [ 1126.186807][T17657] ipheth 1-1:0.0: Unable to find endpoints [ 1127.047485][T20162] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 1127.124155][ T5845] tipc: Node number set to 607079391 [ 1127.398116][T20165] input: syz1 as /devices/virtual/input/input67 [ 1127.756139][T20175] netlink: 'syz.2.3506': attribute type 12 has an invalid length. [ 1127.777452][T20172] netlink: 'syz.5.3505': attribute type 3 has an invalid length. [ 1127.790395][ T5845] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 1127.850535][T20176] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1127.883902][T20176] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1127.959191][ T5845] usb 5-1: Using ep0 maxpacket: 32 [ 1127.961445][T17657] usb 1-1: USB disconnect, device number 117 [ 1127.973553][ T5845] usb 5-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 1127.989069][ T5845] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1128.010870][ T5845] usb 5-1: Product: syz [ 1128.015097][ T5845] usb 5-1: Manufacturer: syz [ 1128.027826][ T5845] usb 5-1: SerialNumber: syz [ 1128.055831][ T5845] usb 5-1: config 0 descriptor?? [ 1128.275162][T20170] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3504'. [ 1128.296699][T20170] vlan3: entered promiscuous mode [ 1128.394488][ T5845] airspy 5-1:0.0: usb_control_msg() failed -71 request 09 [ 1128.473350][ T977] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 1128.497715][ T5845] airspy 5-1:0.0: Could not detect board [ 1128.504754][ T5845] airspy 5-1:0.0: probe with driver airspy failed with error -71 [ 1128.518113][ T5845] usb 5-1: USB disconnect, device number 87 [ 1128.662848][ T977] usb 6-1: Using ep0 maxpacket: 32 [ 1128.673425][ T977] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1128.688260][ T977] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1128.702618][ T977] usb 6-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 1128.735653][ T977] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1128.792192][ T977] usb 6-1: config 0 descriptor?? [ 1129.045197][T20192] fuse: Unknown parameter 'ootmode' [ 1129.067561][T20192] program syz.2.3511 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1129.219473][ T977] greenasia 0003:0E8F:0012.001A: hidraw0: USB HID v0.00 Device [HID 0e8f:0012] on usb-dummy_hcd.5-1/input0 [ 1129.260209][ T977] greenasia 0003:0E8F:0012.001A: no inputs found [ 1129.466522][ T977] usb 6-1: USB disconnect, device number 63 [ 1129.740407][T20203] fido_id[20203]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 1130.137499][T20207] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3516'. [ 1130.157145][T20211] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3518'. [ 1130.157903][ T30] audit: type=1400 audit(1753259582.405:1643): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name="#(%#{//&@\)//&" pid=20208 comm="syz.7.3517" [ 1130.183958][T20213] fuse: Unknown parameter 'fsname' [ 1130.564217][ T5845] usb 6-1: new full-speed USB device number 64 using dummy_hcd [ 1130.632654][T20217] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3520'. [ 1130.735540][ T5845] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1130.746344][ T5845] usb 6-1: not running at top speed; connect to a high speed hub [ 1130.863141][ T5845] usb 6-1: config 6 has an invalid interface number: 30 but max is 0 [ 1130.953959][ T5845] usb 6-1: config 6 has no interface number 0 [ 1130.973796][ T5845] usb 6-1: config 6 interface 30 altsetting 0 has an endpoint descriptor with address 0x47, changing to 0x7 [ 1130.997905][ T5845] usb 6-1: config 6 interface 30 altsetting 0 endpoint 0x7 has invalid maxpacket 40968, setting to 64 [ 1131.049141][ T5845] usb 6-1: config 6 interface 30 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1131.124503][ T5845] usb 6-1: New USB device found, idVendor=fff0, idProduct=fff0, bcdDevice=1e.11 [ 1131.137634][ T5845] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1131.159039][ T5845] usb 6-1: Product: syz [ 1131.181736][ T5845] usb 6-1: Manufacturer: syz [ 1131.197643][ T5845] usb 6-1: SerialNumber: syz [ 1131.246472][T20223] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 1131.261540][T20213] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1131.418016][T20223] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1131.615361][ T5845] usbtest 6-1:6.30: usb test device [ 1131.643418][ T5845] usbtest 6-1:6.30: full-speed {control in/out iso-out} tests (+alt) [ 1131.686982][ T5845] usb 6-1: USB disconnect, device number 64 [ 1131.779507][T15917] usb 3-1: new high-speed USB device number 127 using dummy_hcd [ 1131.964037][T15917] usb 3-1: Using ep0 maxpacket: 32 [ 1132.066868][T15923] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1132.112578][T15917] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 1132.140463][T15917] usb 3-1: config 0 has no interface number 0 [ 1132.158928][T15917] usb 3-1: config 0 interface 85 has no altsetting 0 [ 1132.224641][T15917] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1132.243485][T15917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1132.269771][T15923] usb 5-1: Using ep0 maxpacket: 8 [ 1132.277734][T15923] usb 5-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 1132.290802][T15917] usb 3-1: Product: syz [ 1132.296399][T15923] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1132.314649][T15917] usb 3-1: Manufacturer: syz [ 1132.333752][T15917] usb 3-1: SerialNumber: syz [ 1132.355586][T15923] usb 5-1: config 0 descriptor?? [ 1132.437307][T15917] usb 3-1: config 0 descriptor?? [ 1132.526432][T15917] appletouch 3-1:0.85: Could not find int-in endpoint [ 1132.539193][T15917] appletouch 3-1:0.85: probe with driver appletouch failed with error -5 [ 1132.551857][T15917] usbhid 3-1:0.85: couldn't find an input interrupt endpoint [ 1132.590413][T15923] asix 5-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 1133.606477][T20235] program syz.4.3526 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1133.621036][T15923] asix 5-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 1133.650948][T15923] asix 5-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 1133.664539][T15923] asix 5-1:0.0: probe with driver asix failed with error -71 [ 1133.692488][T15923] usb 5-1: USB disconnect, device number 88 [ 1134.118451][T20260] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3533'. [ 1134.330484][T20266] FAULT_INJECTION: forcing a failure. [ 1134.330484][T20266] name failslab, interval 1, probability 0, space 0, times 0 [ 1134.380183][T20266] CPU: 0 UID: 0 PID: 20266 Comm: syz.0.3534 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 1134.380214][T20266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1134.380228][T20266] Call Trace: [ 1134.380237][T20266] [ 1134.380248][T20266] dump_stack_lvl+0x189/0x250 [ 1134.380278][T20266] ? __pfx____ratelimit+0x10/0x10 [ 1134.380302][T20266] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1134.380328][T20266] ? __pfx__printk+0x10/0x10 [ 1134.380359][T20266] ? __pfx___might_resched+0x10/0x10 [ 1134.380383][T20266] ? fs_reclaim_acquire+0x7d/0x100 [ 1134.380409][T20266] should_fail_ex+0x414/0x560 [ 1134.380438][T20266] should_failslab+0xa8/0x100 [ 1134.380472][T20266] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1134.380500][T20266] ? getname_flags+0xb8/0x540 [ 1134.380524][T20266] getname_flags+0xb8/0x540 [ 1134.380559][T20266] __x64_sys_rename+0x5d/0x90 [ 1134.380591][T20266] do_syscall_64+0xfa/0x3b0 [ 1134.380615][T20266] ? lockdep_hardirqs_on+0x9c/0x150 [ 1134.380636][T20266] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1134.380656][T20266] ? clear_bhb_loop+0x60/0xb0 [ 1134.380681][T20266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1134.380702][T20266] RIP: 0033:0x7ff9b938e9a9 [ 1134.380720][T20266] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1134.380737][T20266] RSP: 002b:00007ff9ba120038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 1134.380759][T20266] RAX: ffffffffffffffda RBX: 00007ff9b95b6160 RCX: 00007ff9b938e9a9 [ 1134.380775][T20266] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000200000000100 [ 1134.380788][T20266] RBP: 00007ff9ba120090 R08: 0000000000000000 R09: 0000000000000000 [ 1134.380814][T20266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1134.380827][T20266] R13: 0000000000000001 R14: 00007ff9b95b6160 R15: 00007ff9b96dfa28 [ 1134.380858][T20266] [ 1134.662418][ T977] usb 3-1: USB disconnect, device number 127 [ 1134.747451][T20273] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3538'. [ 1135.231958][T20285] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1136.164123][T20303] program syz.7.3543 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1136.429528][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1136.954850][T20311] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3548'. [ 1137.037808][T20314] kvm: MWAIT instruction emulated as NOP! [ 1137.236449][T20319] ptrace attach of "./syz-executor exec"[11470] was attempted by "./syz-executor exec"[20319] [ 1137.308233][T20321] FAULT_INJECTION: forcing a failure. [ 1137.308233][T20321] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1137.355262][T20321] CPU: 0 UID: 0 PID: 20321 Comm: syz.4.3549 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 1137.355285][T20321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1137.355295][T20321] Call Trace: [ 1137.355301][T20321] [ 1137.355309][T20321] dump_stack_lvl+0x189/0x250 [ 1137.355330][T20321] ? __pfx____ratelimit+0x10/0x10 [ 1137.355347][T20321] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1137.355365][T20321] ? __pfx__printk+0x10/0x10 [ 1137.355384][T20321] ? __might_fault+0xb0/0x130 [ 1137.355412][T20321] should_fail_ex+0x414/0x560 [ 1137.355431][T20321] _copy_from_iter+0x1db/0x16f0 [ 1137.355452][T20321] ? rcu_is_watching+0x15/0xb0 [ 1137.355471][T20321] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 1137.355492][T20321] ? __pfx__copy_from_iter+0x10/0x10 [ 1137.355511][T20321] ? __build_skb_around+0x257/0x3e0 [ 1137.355534][T20321] ? netlink_sendmsg+0x642/0xb30 [ 1137.355566][T20321] ? skb_put+0x11b/0x210 [ 1137.355588][T20321] netlink_sendmsg+0x6b2/0xb30 [ 1137.355613][T20321] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1137.355644][T20321] ? aa_sock_msg_perm+0x94/0x160 [ 1137.355670][T20321] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1137.355689][T20321] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1137.355715][T20321] __sock_sendmsg+0x21c/0x270 [ 1137.355759][T20321] ____sys_sendmsg+0x505/0x830 [ 1137.355794][T20321] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1137.355833][T20321] ? import_iovec+0x74/0xa0 [ 1137.355862][T20321] ___sys_sendmsg+0x21f/0x2a0 [ 1137.355893][T20321] ? __pfx____sys_sendmsg+0x10/0x10 [ 1137.355959][T20321] ? __fget_files+0x2a/0x420 [ 1137.355976][T20321] ? __fget_files+0x3a0/0x420 [ 1137.356009][T20321] __x64_sys_sendmsg+0x19b/0x260 [ 1137.356039][T20321] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1137.356074][T20321] ? __pfx_ksys_write+0x10/0x10 [ 1137.356096][T20321] ? rcu_is_watching+0x15/0xb0 [ 1137.356121][T20321] ? do_syscall_64+0xbe/0x3b0 [ 1137.356145][T20321] do_syscall_64+0xfa/0x3b0 [ 1137.356164][T20321] ? lockdep_hardirqs_on+0x9c/0x150 [ 1137.356182][T20321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1137.356203][T20321] ? clear_bhb_loop+0x60/0xb0 [ 1137.356225][T20321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1137.356242][T20321] RIP: 0033:0x7f28b038e9a9 [ 1137.356261][T20321] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1137.356280][T20321] RSP: 002b:00007f28b12bf038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1137.356302][T20321] RAX: ffffffffffffffda RBX: 00007f28b05b5fa0 RCX: 00007f28b038e9a9 [ 1137.356317][T20321] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 1137.356330][T20321] RBP: 00007f28b12bf090 R08: 0000000000000000 R09: 0000000000000000 [ 1137.356342][T20321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1137.356354][T20321] R13: 0000000000000000 R14: 00007f28b05b5fa0 R15: 00007f28b06dfa28 [ 1137.356384][T20321] [ 1137.509376][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1137.588716][ C1] vkms_vblank_simulate: vblank timer overrun [ 1138.309293][ T977] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 1138.530212][ T977] usb 3-1: config 0 has no interfaces? [ 1138.537990][ T977] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1138.550598][ T977] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1138.558733][ T977] usb 3-1: Product: syz [ 1138.573875][T20326] syzkaller0: entered promiscuous mode [ 1138.579531][T20326] syzkaller0: entered allmulticast mode [ 1138.585169][ T977] usb 3-1: Manufacturer: syz [ 1138.604892][ T977] usb 3-1: SerialNumber: syz [ 1138.680365][ T977] usb 3-1: config 0 descriptor?? [ 1143.889631][T20338] netlink: 'syz.5.3553': attribute type 12 has an invalid length. [ 1143.899242][T20338] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3553'. [ 1143.978325][T17657] usb 3-1: USB disconnect, device number 2 [ 1144.489269][T15923] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 1144.991909][T20374] netlink: 'syz.5.3563': attribute type 5 has an invalid length. [ 1145.001225][T20373] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1145.889725][T15923] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 1146.128177][T15923] usb 6-1: Using ep0 maxpacket: 16 [ 1146.365400][T15923] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1146.378341][T15923] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 1146.425675][T15923] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 1146.596663][T15923] usb 6-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 1146.606066][T15923] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1146.650004][T15923] usb 6-1: Product: syz [ 1146.664442][T15923] usb 6-1: Manufacturer: syz [ 1146.678711][T15923] usb 6-1: SerialNumber: syz [ 1146.713040][T15923] usb 6-1: config 0 descriptor?? [ 1146.740713][T20386] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1146.851973][T15923] mcba_usb 6-1:0.0 can0: failed tx_urb -90 [ 1146.944622][T15923] mcba_usb 6-1:0.0 can0: Failed to send cmd (169) [ 1146.988640][T15923] mcba_usb 6-1:0.0 can0: failed tx_urb -90 [ 1147.054483][T15923] mcba_usb 6-1:0.0 can0: Failed to send cmd (169) [ 1147.093010][T15923] mcba_usb 6-1:0.0: Microchip CAN BUS Analyzer connected [ 1147.471425][ T2150] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 1147.679236][ T2150] usb 1-1: Using ep0 maxpacket: 8 [ 1147.737006][ T2150] usb 1-1: config 0 has an invalid interface number: 147 but max is 0 [ 1147.829551][ T2150] usb 1-1: config 0 has no interface number 0 [ 1147.855846][ T2150] usb 1-1: config 0 interface 147 altsetting 2 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1147.890378][T20418] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3578'. [ 1147.949285][ T2150] usb 1-1: config 0 interface 147 has no altsetting 0 [ 1148.116420][ T2150] usb 1-1: New USB device found, idVendor=0c45, idProduct=1060, bcdDevice= 1.00 [ 1148.193991][T20420] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1148.366007][ T2150] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1148.452631][ T2150] usb 1-1: Product: syz [ 1148.473051][ T2150] usb 1-1: Manufacturer: syz [ 1148.548393][ T2150] usb 1-1: SerialNumber: syz [ 1148.625333][T20429] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3580'. [ 1148.649718][ T2150] usb 1-1: config 0 descriptor?? [ 1148.683091][T20429] batadv0: entered promiscuous mode [ 1148.700788][ T2150] usb-storage 1-1:0.147: USB Mass Storage device detected [ 1148.730393][T20429] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1148.783215][T20429] batadv0: left promiscuous mode [ 1148.788624][ T2150] usb-storage 1-1:0.147: Quirks match for vid 0c45 pid 1060: 1 [ 1149.309191][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1149.899673][ T5514] mcba_usb 6-1:0.0 can0: bit-timing not yet defined [ 1149.993226][ T2150] usb 6-1: USB disconnect, device number 66 [ 1150.001288][ T2150] mcba_usb 6-1:0.0 can0: device disconnected [ 1150.320112][T20466] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1150.349165][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1151.399234][T15917] usb 5-1: new full-speed USB device number 89 using dummy_hcd [ 1152.003960][T15917] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1152.059244][T15917] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1152.098875][T15917] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1152.154369][T15917] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1152.224319][T15917] usb 5-1: config 0 descriptor?? [ 1152.356017][T15917] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1152.486293][T15917] dvb-usb: bulk message failed: -22 (3/0) [ 1152.587617][T15917] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1152.670334][T15917] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1152.779161][T11681] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 1152.939234][T11681] usb 3-1: Using ep0 maxpacket: 32 [ 1152.946131][T11681] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 1152.961328][T11681] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 1153.029207][T11681] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 1153.029501][T15917] usb 5-1: media controller created [ 1153.038862][T11681] usb 3-1: config 1 has no interface number 0 [ 1153.038912][T11681] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1153.038941][T11681] usb 3-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 1153.166371][T11681] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1153.220841][T11681] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1153.279936][T11681] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 1153.467589][T15917] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1153.472340][T11681] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now attached [ 1153.515454][T20506] gtp0: entered promiscuous mode [ 1153.639225][T20506] gtp0: entered allmulticast mode [ 1153.840226][T15917] dvb-usb: bulk message failed: -22 (6/0) [ 1153.869729][T15917] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1153.926495][T15917] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input70 [ 1154.024699][T15923] usb 3-1: USB disconnect, device number 3 [ 1154.071829][T15923] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 1154.091068][T15917] dvb-usb: schedule remote query interval to 150 msecs. [ 1154.098091][T15917] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1154.252117][T15917] dvb-usb: bulk message failed: -22 (1/0) [ 1154.258140][T15917] dvb-usb: error while querying for an remote control event. [ 1154.376486][T20518] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 1154.387348][T20518] netlink: 44 bytes leftover after parsing attributes in process `syz.5.3598'. [ 1154.470228][T15917] dvb-usb: bulk message failed: -22 (1/0) [ 1154.476033][T15917] dvb-usb: error while querying for an remote control event. [ 1154.710036][T15917] dvb-usb: bulk message failed: -22 (1/0) [ 1154.715835][T15917] dvb-usb: error while querying for an remote control event. [ 1154.942405][T15917] dvb-usb: bulk message failed: -22 (1/0) [ 1154.975868][T15917] dvb-usb: error while querying for an remote control event. [ 1155.169285][ T5845] dvb-usb: bulk message failed: -22 (1/0) [ 1155.176269][ T5845] dvb-usb: error while querying for an remote control event. [ 1155.332712][T20524] FAULT_INJECTION: forcing a failure. [ 1155.332712][T20524] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1155.346022][ T5845] dvb-usb: bulk message failed: -22 (1/0) [ 1155.356832][ T5845] dvb-usb: error while querying for an remote control event. [ 1155.429255][T20524] CPU: 1 UID: 0 PID: 20524 Comm: syz.2.3600 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 1155.429283][T20524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1155.429293][T20524] Call Trace: [ 1155.429300][T20524] [ 1155.429307][T20524] dump_stack_lvl+0x189/0x250 [ 1155.429331][T20524] ? __pfx____ratelimit+0x10/0x10 [ 1155.429349][T20524] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1155.429367][T20524] ? __pfx__printk+0x10/0x10 [ 1155.429388][T20524] ? __might_fault+0xb0/0x130 [ 1155.429418][T20524] should_fail_ex+0x414/0x560 [ 1155.429438][T20524] _copy_from_user+0x2d/0xb0 [ 1155.429461][T20524] memdup_user+0x5e/0xd0 [ 1155.429478][T20524] uinput_write+0x22c/0xfc0 [ 1155.429503][T20524] ? __pfx_uinput_write+0x10/0x10 [ 1155.429521][T20524] ? bpf_lsm_file_permission+0x9/0x20 [ 1155.429540][T20524] ? security_file_permission+0x75/0x290 [ 1155.429564][T20524] ? rw_verify_area+0x258/0x650 [ 1155.429584][T20524] ? __pfx_uinput_write+0x10/0x10 [ 1155.429602][T20524] vfs_write+0x27e/0xa90 [ 1155.429629][T20524] ? __pfx_vfs_write+0x10/0x10 [ 1155.429654][T20524] ? __fget_files+0x2a/0x420 [ 1155.429671][T20524] ? __fget_files+0x2a/0x420 [ 1155.429683][T20524] ? __fget_files+0x3a0/0x420 [ 1155.429696][T20524] ? __fget_files+0x2a/0x420 [ 1155.429715][T20524] ksys_write+0x145/0x250 [ 1155.429738][T20524] ? __pfx_ksys_write+0x10/0x10 [ 1155.429756][T20524] ? rcu_is_watching+0x15/0xb0 [ 1155.429778][T20524] ? do_syscall_64+0xbe/0x3b0 [ 1155.429798][T20524] do_syscall_64+0xfa/0x3b0 [ 1155.429814][T20524] ? lockdep_hardirqs_on+0x9c/0x150 [ 1155.429830][T20524] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1155.429876][T20524] ? clear_bhb_loop+0x60/0xb0 [ 1155.429894][T20524] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1155.429909][T20524] RIP: 0033:0x7fb283f8e9a9 [ 1155.429923][T20524] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1155.429937][T20524] RSP: 002b:00007fb284e59038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1155.429954][T20524] RAX: ffffffffffffffda RBX: 00007fb2841b5fa0 RCX: 00007fb283f8e9a9 [ 1155.429965][T20524] RDX: 000000000000045c RSI: 00002000000000c0 RDI: 0000000000000005 [ 1155.429975][T20524] RBP: 00007fb284e59090 R08: 0000000000000000 R09: 0000000000000000 [ 1155.429984][T20524] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1155.429994][T20524] R13: 0000000000000000 R14: 00007fb2841b5fa0 R15: 00007fb2842dfa28 [ 1155.430016][T20524] [ 1155.681012][ C1] vkms_vblank_simulate: vblank timer overrun [ 1155.692040][ T5845] dvb-usb: bulk message failed: -22 (1/0) [ 1155.698664][ T5845] dvb-usb: error while querying for an remote control event. [ 1155.875804][ T5845] dvb-usb: bulk message failed: -22 (1/0) [ 1155.881859][ T5845] dvb-usb: error while querying for an remote control event. [ 1156.031019][T17657] usb 5-1: USB disconnect, device number 89 [ 1156.049153][ T5845] dvb-usb: bulk message failed: -22 (1/0) [ 1156.054991][ T5845] dvb-usb: error while querying for an remote control event. [ 1156.144709][ T5845] usb 1-1: USB disconnect, device number 118 [ 1156.223675][T17657] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1158.208140][T20590] FAULT_INJECTION: forcing a failure. [ 1158.208140][T20590] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1158.318837][T20590] CPU: 1 UID: 0 PID: 20590 Comm: syz.4.3620 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 1158.318867][T20590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1158.318882][T20590] Call Trace: [ 1158.318891][T20590] [ 1158.318901][T20590] dump_stack_lvl+0x189/0x250 [ 1158.318931][T20590] ? __pfx____ratelimit+0x10/0x10 [ 1158.318954][T20590] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1158.318982][T20590] ? __pfx__printk+0x10/0x10 [ 1158.319022][T20590] should_fail_ex+0x414/0x560 [ 1158.319050][T20590] _copy_to_user+0x31/0xb0 [ 1158.319082][T20590] iommufd_ioas_unmap+0x30a/0x4d0 [ 1158.319112][T20590] ? __pfx_iommufd_ioas_unmap+0x10/0x10 [ 1158.319149][T20590] iommufd_fops_ioctl+0x449/0x520 [ 1158.319180][T20590] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 1158.319220][T20590] ? __fget_files+0x3a0/0x420 [ 1158.319239][T20590] ? __fget_files+0x2a/0x420 [ 1158.319262][T20590] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1158.319287][T20590] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 1158.319315][T20590] __se_sys_ioctl+0xfc/0x170 [ 1158.319354][T20590] do_syscall_64+0xfa/0x3b0 [ 1158.319377][T20590] ? lockdep_hardirqs_on+0x9c/0x150 [ 1158.319399][T20590] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1158.319420][T20590] ? clear_bhb_loop+0x60/0xb0 [ 1158.319445][T20590] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1158.319464][T20590] RIP: 0033:0x7f28b038e9a9 [ 1158.319481][T20590] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1158.319498][T20590] RSP: 002b:00007f28b127d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1158.319519][T20590] RAX: ffffffffffffffda RBX: 00007f28b05b6160 RCX: 00007f28b038e9a9 [ 1158.319534][T20590] RDX: 0000200000000300 RSI: 0000000000003b86 RDI: 0000000000000003 [ 1158.319547][T20590] RBP: 00007f28b127d090 R08: 0000000000000000 R09: 0000000000000000 [ 1158.319559][T20590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1158.319572][T20590] R13: 0000000000000001 R14: 00007f28b05b6160 R15: 00007f28b06dfa28 [ 1158.319603][T20590] [ 1158.522010][ C1] vkms_vblank_simulate: vblank timer overrun [ 1159.039238][T20605] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3628'. [ 1159.206759][T15923] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 1159.463415][T15923] usb 1-1: Using ep0 maxpacket: 8 [ 1159.478209][T15923] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1159.492208][T15923] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1159.503938][T15923] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1159.558707][T15923] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1159.590735][T15923] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1159.601517][T15923] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1159.933272][T15923] usb 1-1: GET_CAPABILITIES returned 0 [ 1159.940729][T15923] usbtmc 1-1:16.0: can't read capabilities [ 1160.143136][T20601] fuse: Bad value for 'fd' [ 1160.188345][ T977] usb 1-1: USB disconnect, device number 119 [ 1160.869193][ T977] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 1160.956632][T20628] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3632'. [ 1160.966752][T20628] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3632'. [ 1161.031623][ T977] usb 3-1: Using ep0 maxpacket: 16 [ 1161.040945][ T977] usb 3-1: config 0 has an invalid interface number: 68 but max is 0 [ 1161.054799][ T977] usb 3-1: config 0 has no interface number 0 [ 1161.080798][ T977] usb 3-1: config 0 interface 68 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1161.123438][ T977] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 1161.141205][ T977] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1161.170237][ T977] usb 3-1: Product: syz [ 1161.184492][ T977] usb 3-1: Manufacturer: syz [ 1161.238142][ T977] usb 3-1: SerialNumber: syz [ 1161.274658][ T977] usb 3-1: config 0 descriptor?? [ 1161.313865][ T977] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1161.498181][ T977] usb 3-1: USB disconnect, device number 4 [ 1161.504954][ T2947] usb 3-1: Failed to submit usb control message: -71 [ 1161.531076][T20637] input: syz1 as /devices/virtual/input/input74 [ 1161.546554][ T2947] usb 3-1: unable to send the bmi data to the device: -71 [ 1161.636024][ T2947] usb 3-1: unable to get target info from device [ 1161.662637][T20641] No such timeout policy "syz0" [ 1161.674166][ T2947] usb 3-1: could not get target info (-71) [ 1161.700977][ T2947] usb 3-1: could not probe fw (-71) [ 1162.399118][ T977] usb 5-1: new full-speed USB device number 90 using dummy_hcd [ 1162.592809][ T977] usb 5-1: config index 0 descriptor too short (expected 45568, got 9) [ 1162.609169][ T977] usb 5-1: config 0 has too many interfaces: 34, using maximum allowed: 32 [ 1162.629162][ T977] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 34 [ 1162.661458][ T977] usb 5-1: New USB device found, idVendor=04a5, idProduct=300a, bcdDevice=5f.57 [ 1162.690501][ T977] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1162.704177][ T977] usb 5-1: Product: syz [ 1162.708416][ T977] usb 5-1: Manufacturer: syz [ 1162.727679][ T977] usb 5-1: SerialNumber: syz [ 1162.759277][ T977] usb 5-1: config 0 descriptor?? [ 1162.839814][T20656] syzkaller0: entered promiscuous mode [ 1162.866602][T20656] syzkaller0: entered allmulticast mode [ 1162.977296][T20650] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1162.999495][T20650] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1163.016158][ T9] usb 5-1: USB disconnect, device number 90 [ 1163.626745][T20672] FAULT_INJECTION: forcing a failure. [ 1163.626745][T20672] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1163.640559][T20672] CPU: 1 UID: 0 PID: 20672 Comm: syz.5.3643 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 1163.640585][T20672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1163.640597][T20672] Call Trace: [ 1163.640605][T20672] [ 1163.640613][T20672] dump_stack_lvl+0x189/0x250 [ 1163.640642][T20672] ? __pfx____ratelimit+0x10/0x10 [ 1163.640665][T20672] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1163.640688][T20672] ? __pfx__printk+0x10/0x10 [ 1163.640716][T20672] ? fs_reclaim_acquire+0x7d/0x100 [ 1163.640744][T20672] should_fail_ex+0x414/0x560 [ 1163.640770][T20672] prepare_alloc_pages+0x213/0x610 [ 1163.640797][T20672] __alloc_frozen_pages_noprof+0x123/0x370 [ 1163.640822][T20672] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1163.640849][T20672] ? __lock_acquire+0xab9/0xd20 [ 1163.640870][T20672] ? policy_nodemask+0x27c/0x720 [ 1163.640903][T20672] alloc_pages_mpol+0x232/0x4a0 [ 1163.640936][T20672] alloc_pages_noprof+0xa9/0x190 [ 1163.640974][T20672] get_free_pages_noprof+0xf/0x80 [ 1163.640995][T20672] __pollwait+0x27b/0x460 [ 1163.641022][T20672] ? __pfx___pollwait+0x10/0x10 [ 1163.641049][T20672] snd_rawmidi_poll+0x240/0x420 [ 1163.641076][T20672] ? __pfx_snd_rawmidi_poll+0x10/0x10 [ 1163.641104][T20672] do_select+0x105b/0x17e0 [ 1163.641140][T20672] ? do_select+0x7f1/0x17e0 [ 1163.641186][T20672] ? __pfx_do_select+0x10/0x10 [ 1163.641211][T20672] ? __schedule+0x171b/0x4cf0 [ 1163.641256][T20672] ? __pfx___pollwait+0x10/0x10 [ 1163.641289][T20672] ? __pfx_pollwake+0x10/0x10 [ 1163.641322][T20672] ? __pfx_pollwake+0x10/0x10 [ 1163.641355][T20672] ? __pfx_pollwake+0x10/0x10 [ 1163.641387][T20672] ? __pfx_pollwake+0x10/0x10 [ 1163.641418][T20672] ? __pfx_pollwake+0x10/0x10 [ 1163.641450][T20672] ? __pfx_pollwake+0x10/0x10 [ 1163.641483][T20672] ? __pfx_pollwake+0x10/0x10 [ 1163.641515][T20672] ? __pfx_pollwake+0x10/0x10 [ 1163.641547][T20672] ? __pfx_pollwake+0x10/0x10 [ 1163.641601][T20672] core_sys_select+0x6dd/0xa20 [ 1163.641643][T20672] ? __pfx_core_sys_select+0x10/0x10 [ 1163.641697][T20672] ? __pfx_set_user_sigmask+0x10/0x10 [ 1163.641734][T20672] __se_sys_pselect6+0x27a/0x300 [ 1163.641770][T20672] ? __pfx___se_sys_pselect6+0x10/0x10 [ 1163.641799][T20672] ? __pfx_ksys_write+0x10/0x10 [ 1163.641833][T20672] ? __x64_sys_pselect6+0x21/0xf0 [ 1163.641865][T20672] do_syscall_64+0xfa/0x3b0 [ 1163.641890][T20672] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1163.641910][T20672] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1163.641930][T20672] ? clear_bhb_loop+0x60/0xb0 [ 1163.641955][T20672] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1163.641985][T20672] RIP: 0033:0x7f655918e9a9 [ 1163.642004][T20672] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1163.642022][T20672] RSP: 002b:00007f6559fdb038 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 1163.642044][T20672] RAX: ffffffffffffffda RBX: 00007f65593b6160 RCX: 00007f655918e9a9 [ 1163.642059][T20672] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000040 [ 1163.642072][T20672] RBP: 00007f6559fdb090 R08: 0000000000000000 R09: 0000000000000000 [ 1163.642085][T20672] R10: 0000200000000680 R11: 0000000000000246 R12: 0000000000000001 [ 1163.642097][T20672] R13: 0000000000000001 R14: 00007f65593b6160 R15: 00007f65594dfa28 [ 1163.642128][T20672] [ 1164.283005][T15917] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 1164.459115][T15917] usb 6-1: Using ep0 maxpacket: 16 [ 1164.555078][T15917] usb 6-1: config 0 has an invalid interface number: 68 but max is 0 [ 1164.565160][T15917] usb 6-1: config 0 has no interface number 0 [ 1164.571732][T15917] usb 6-1: config 0 interface 68 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1164.613155][T15917] usb 6-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 1164.635656][T15917] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1164.659111][T15923] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 1164.683527][T15917] usb 6-1: Product: syz [ 1164.687760][T15917] usb 6-1: Manufacturer: syz [ 1164.716191][T15917] usb 6-1: SerialNumber: syz [ 1164.759867][T15917] usb 6-1: config 0 descriptor?? [ 1164.791239][T15917] usb 6-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1164.801972][T15923] usb 5-1: device descriptor read/64, error -71 [ 1164.967555][ T9] usb 6-1: USB disconnect, device number 67 [ 1164.974484][ T64] usb 6-1: Failed to submit usb control message: -71 [ 1164.983304][ T64] usb 6-1: unable to send the bmi data to the device: -71 [ 1164.992851][ T64] usb 6-1: unable to get target info from device [ 1165.006468][ T64] usb 6-1: could not get target info (-71) [ 1165.013923][ T64] usb 6-1: could not probe fw (-71) [ 1165.039156][T15923] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 1165.189328][T15923] usb 5-1: device descriptor read/64, error -71 [ 1165.309594][T15923] usb usb5-port1: attempt power cycle [ 1165.673561][T15923] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 1165.779839][T15923] usb 5-1: device descriptor read/8, error -71 [ 1166.053098][ T9] usb 6-1: new full-speed USB device number 68 using dummy_hcd [ 1166.059426][T15923] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1166.103594][T15923] usb 5-1: device descriptor read/8, error -71 [ 1166.223816][ T9] usb 6-1: not running at top speed; connect to a high speed hub [ 1166.224460][T15923] usb usb5-port1: unable to enumerate USB device [ 1166.233842][ T9] usb 6-1: config 1 has an invalid interface number: 186 but max is 2 [ 1166.261850][ T9] usb 6-1: config 1 has an invalid interface number: 17 but max is 2 [ 1166.270111][ T9] usb 6-1: config 1 has an invalid interface number: 83 but max is 2 [ 1166.278241][ T9] usb 6-1: config 1 has no interface number 0 [ 1166.291420][ T9] usb 6-1: config 1 has no interface number 1 [ 1166.297556][ T9] usb 6-1: config 1 has no interface number 2 [ 1166.303785][ T9] usb 6-1: config 1 interface 83 altsetting 8 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1166.313695][ T9] usb 6-1: config 1 interface 83 altsetting 8 endpoint 0x1 has invalid maxpacket 1023, setting to 64 [ 1166.324755][ T9] usb 6-1: config 1 interface 83 altsetting 8 has a duplicate endpoint with address 0x1, skipping [ 1166.335645][ T9] usb 6-1: config 1 interface 83 altsetting 8 endpoint 0x5 has invalid maxpacket 1023, setting to 64 [ 1166.346610][ T9] usb 6-1: config 1 interface 83 altsetting 8 has a duplicate endpoint with address 0x5, skipping [ 1166.358019][ T9] usb 6-1: config 1 interface 83 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 1166.368933][ T9] usb 6-1: config 1 interface 17 has no altsetting 0 [ 1166.375702][ T9] usb 6-1: config 1 interface 83 has no altsetting 0 [ 1166.397183][ T9] usb 6-1: New USB device found, idVendor=19d2, idProduct=1015, bcdDevice=ab.4b [ 1166.407450][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1166.415587][ T9] usb 6-1: Product: ⎦ [ 1166.420177][ T9] usb 6-1: Manufacturer:  [ 1166.424843][ T9] usb 6-1: SerialNumber: 佃߮ⵡ丐骔꒜ᠰ箪ﲆᄞ鮋㩑䧆዗읏ť′벲ꈽಁ싟穃湑૚玆龩떤㋯쉘Ҧ忁歞褃䬲䠊 [ 1166.812351][T20696] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1166.823382][T20696] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1167.839287][T15917] usb 5-1: new full-speed USB device number 95 using dummy_hcd [ 1168.034742][T15917] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1168.058662][T15917] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1168.088834][T15917] usb 5-1: New USB device found, idVendor=10c4, idProduct=8acf, bcdDevice= 0.00 [ 1168.179794][T15917] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1168.232790][T15917] usb 5-1: config 0 descriptor?? [ 1168.477087][T20707] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1168.500035][T20707] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1168.849712][ T9] cdc_ether 6-1:1.186: skipping garbage [ 1168.855316][ T9] usb 6-1: bad CDC descriptors [ 1168.911857][T15917] hid-u2fzero 0003:10C4:8ACF.001B: hidraw0: USB HID v0.00 Device [HID 10c4:8acf] on usb-dummy_hcd.4-1/input0 [ 1168.949625][ T9] usb 6-1: USB disconnect, device number 68 [ 1168.976665][T20720] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1168.990349][T15917] hid-u2fzero 0003:10C4:8ACF.001B: U2F Zero LED initialised [ 1169.038934][T15917] hid-u2fzero 0003:10C4:8ACF.001B: U2F Zero RNG initialised [ 1169.146164][T15917] usb 5-1: USB disconnect, device number 95 [ 1169.235066][T20723] fido_id[20723]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 1169.597557][T20728] netlink: 'syz.7.3660': attribute type 1 has an invalid length. [ 1169.787995][T20728] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1169.875064][T20738] bond1: (slave gretap1): making interface the new active one [ 1169.876284][T20738] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 1169.910828][T20739] dvmrp1: tun_chr_ioctl cmd 21731 [ 1170.081797][T20744] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3666'. [ 1170.382275][T20754] netlink: 60 bytes leftover after parsing attributes in process `syz.7.3669'. [ 1170.392453][T20753] netlink: 60 bytes leftover after parsing attributes in process `syz.7.3669'. [ 1170.859123][ T9] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 1171.409279][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 1171.420920][ T9] usb 6-1: config index 0 descriptor too short (expected 1307, got 27) [ 1171.452245][ T9] usb 6-1: config 0 has an invalid interface number: 0 but max is -1 [ 1171.483355][ T9] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1171.559887][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1171.579584][ T9] usb 6-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=c3.de [ 1171.589439][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1171.636595][ T9] usb 6-1: Product: syz [ 1171.647962][ T9] usb 6-1: Manufacturer: syz [ 1171.714335][ T9] usb 6-1: SerialNumber: syz [ 1171.778122][ T9] usb 6-1: config 0 descriptor?? [ 1171.855681][ T9] hub 6-1:0.0: bad descriptor, ignoring hub [ 1171.885096][ T9] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1172.209712][ T9] usb 6-1: USB disconnect, device number 69 [ 1173.332727][T20796] FAULT_INJECTION: forcing a failure. [ 1173.332727][T20796] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1173.359147][T20796] CPU: 1 UID: 0 PID: 20796 Comm: syz.4.3682 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 1173.359185][T20796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1173.359199][T20796] Call Trace: [ 1173.359208][T20796] [ 1173.359217][T20796] dump_stack_lvl+0x189/0x250 [ 1173.359247][T20796] ? __pfx____ratelimit+0x10/0x10 [ 1173.359270][T20796] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1173.359295][T20796] ? __pfx__printk+0x10/0x10 [ 1173.359335][T20796] should_fail_ex+0x414/0x560 [ 1173.359363][T20796] _copy_to_user+0x31/0xb0 [ 1173.359404][T20796] simple_read_from_buffer+0xe1/0x170 [ 1173.359436][T20796] proc_fail_nth_read+0x1df/0x250 [ 1173.359456][T20796] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1173.359472][T20796] ? rw_verify_area+0x258/0x650 [ 1173.359490][T20796] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1173.359505][T20796] vfs_read+0x200/0x980 [ 1173.359526][T20796] ? __pfx___mutex_lock+0x10/0x10 [ 1173.359543][T20796] ? __pfx_vfs_read+0x10/0x10 [ 1173.359562][T20796] ? __fget_files+0x2a/0x420 [ 1173.359578][T20796] ? __fget_files+0x3a0/0x420 [ 1173.359590][T20796] ? __fget_files+0x2a/0x420 [ 1173.359608][T20796] ksys_read+0x145/0x250 [ 1173.359625][T20796] ? __fget_files+0x3a0/0x420 [ 1173.359638][T20796] ? __pfx_ksys_read+0x10/0x10 [ 1173.359660][T20796] ? do_syscall_64+0xbe/0x3b0 [ 1173.359678][T20796] do_syscall_64+0xfa/0x3b0 [ 1173.359693][T20796] ? lockdep_hardirqs_on+0x9c/0x150 [ 1173.359708][T20796] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1173.359721][T20796] ? clear_bhb_loop+0x60/0xb0 [ 1173.359738][T20796] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1173.359752][T20796] RIP: 0033:0x7f28b038d3bc [ 1173.359765][T20796] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1173.359777][T20796] RSP: 002b:00007f28b12bf030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1173.359793][T20796] RAX: ffffffffffffffda RBX: 00007f28b05b5fa0 RCX: 00007f28b038d3bc [ 1173.359803][T20796] RDX: 000000000000000f RSI: 00007f28b12bf0a0 RDI: 0000000000000004 [ 1173.359812][T20796] RBP: 00007f28b12bf090 R08: 0000000000000000 R09: 0000000000000000 [ 1173.359821][T20796] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1173.359829][T20796] R13: 0000000000000000 R14: 00007f28b05b5fa0 R15: 00007f28b06dfa28 [ 1173.359849][T20796] [ 1173.598300][ C1] vkms_vblank_simulate: vblank timer overrun [ 1174.171582][T20804] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3687'. [ 1174.349623][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.375159][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.390638][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.398196][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.408320][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.438044][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.456028][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.479140][ T9] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 1174.482862][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.507709][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.516045][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.528515][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.536391][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.551348][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.564745][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.574173][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.662334][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 1174.667682][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.683214][ T9] usb 6-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1174.688321][T15917] hid-generic 0002:0004:0009.001C: unknown main item tag 0x0 [ 1174.692525][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1174.692550][ T9] usb 6-1: Product: syz [ 1174.692566][ T9] usb 6-1: Manufacturer: syz [ 1174.692593][ T9] usb 6-1: SerialNumber: syz [ 1174.722851][ T9] usb 6-1: config 0 descriptor?? [ 1174.795467][T15917] hid-generic 0002:0004:0009.001C: hidraw0: HID v0.04 Device [syz0] on syz0 [ 1174.797884][ T9] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1175.088815][T20824] fido_id[20824]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1175.219423][T20808] fuse: Unknown parameter '%' [ 1175.399809][ T9] gspca_sonixj: reg_w1 err -110 [ 1175.408272][ T9] sonixj 6-1:0.0: probe with driver sonixj failed with error -110 [ 1175.598755][ T9] usb 6-1: USB disconnect, device number 70 [ 1176.969284][ T9] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 1177.079277][T20853] syzkaller0: entered promiscuous mode [ 1177.084823][T20853] syzkaller0: entered allmulticast mode [ 1177.120664][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 1177.129288][ T9] usb 1-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1177.138846][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1177.182461][ T9] usb 1-1: Product: syz [ 1177.186767][ T9] usb 1-1: Manufacturer: syz [ 1177.192042][ T9] usb 1-1: SerialNumber: syz [ 1177.219608][ T9] usb 1-1: config 0 descriptor?? [ 1177.474345][T15923] usb 1-1: USB disconnect, device number 121 [ 1177.579907][T20857] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3702'. [ 1179.201743][T20889] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3713'. [ 1179.506915][T20893] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3715'. [ 1179.937721][T15923] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 1180.129757][T15923] usb 6-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1180.162870][T15923] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1180.185640][T15923] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1180.199378][ T9] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 1180.199679][T15923] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1180.238451][T15923] usb 6-1: Product: syz [ 1180.301109][T15923] usb 6-1: Manufacturer: syz [ 1180.318652][T15923] usb 6-1: SerialNumber: syz [ 1180.332817][T15923] usb 6-1: config 0 descriptor?? [ 1180.369676][T15923] usb 6-1: selecting invalid altsetting 0 [ 1180.418136][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 1180.460422][ T9] usb 5-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 1180.470251][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1180.480914][ T9] usb 5-1: Product: syz [ 1180.486884][ T9] usb 5-1: Manufacturer: syz [ 1180.493790][ T9] usb 5-1: SerialNumber: syz [ 1180.508750][ T9] usb 5-1: config 0 descriptor?? [ 1180.550672][ T9] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 1180.630638][ T977] usb 6-1: USB disconnect, device number 71 [ 1182.754391][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1182.761008][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1183.799143][T20931] Bluetooth: hci0: command 0x0406 tx timeout [ 1183.869760][T20931] Bluetooth: hci2: command 0x0406 tx timeout [ 1183.876064][T20929] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 1184.363248][T20929] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1184.449473][T20929] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1184.457038][T20929] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1184.576796][T20929] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1184.584119][T20929] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1184.603400][T20929] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1184.613459][T20929] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1184.716683][T15917] usb 5-1: USB disconnect, device number 96 [ 1185.303191][T20970] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3738'. [ 1185.949309][ T5855] Bluetooth: hci3: command 0x0406 tx timeout [ 1186.514069][ T5855] Bluetooth: hci4: command 0x0406 tx timeout [ 1186.589191][ T5855] Bluetooth: hci5: command 0x0406 tx timeout [ 1186.669333][ T5855] Bluetooth: hci0: command 0x0406 tx timeout [ 1186.790499][T21002] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3750'. [ 1187.033955][T21006] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3752'. [ 1187.629230][ T9] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 1187.816164][ T9] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1187.834402][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1187.857290][ T9] usb 1-1: Product: syz [ 1187.875752][ T9] usb 1-1: Manufacturer: syz [ 1187.888112][ T9] usb 1-1: SerialNumber: syz [ 1187.905899][T21025] syzkaller1: entered promiscuous mode [ 1187.916919][ T9] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1187.929204][T21025] syzkaller1: entered allmulticast mode [ 1187.994742][ T977] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1188.474640][ T2150] usb 1-1: USB disconnect, device number 122 [ 1188.589619][ T5855] Bluetooth: hci4: command 0x0406 tx timeout [ 1188.669329][ T5855] Bluetooth: hci5: command 0x0406 tx timeout [ 1188.817603][ T5855] Bluetooth: hci0: command 0x0406 tx timeout [ 1189.070764][ T977] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1189.089329][ T977] ath9k_htc: Failed to initialize the device [ 1189.125840][ T2150] usb 1-1: ath9k_htc: USB layer deinitialized [ 1189.526673][T21051] vlan0: entered promiscuous mode [ 1190.179190][ T2150] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 1190.334177][ T2150] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1190.360097][ T2150] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1190.401729][ T2150] usb 1-1: New USB device found, idVendor=046d, idProduct=4101, bcdDevice= 0.00 [ 1190.561834][ T2150] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1190.584856][ T2150] usb 1-1: config 0 descriptor?? [ 1191.037424][ T2150] hid-generic 0003:046D:4101.001D: hidraw0: USB HID vff.fd Device [HID 046d:4101] on usb-dummy_hcd.0-1/input0 [ 1191.040717][T21067] syzkaller1: entered promiscuous mode [ 1191.098123][T21067] syzkaller1: entered allmulticast mode [ 1191.299062][ T2150] usb 1-1: USB disconnect, device number 123 [ 1191.357060][T21084] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3777'. [ 1192.265166][T21096] binder: BINDER_SET_CONTEXT_MGR already set [ 1192.306346][T21096] binder: 21093:21096 ioctl 4018620d 2000000001c0 returned -16 [ 1192.397851][T21096] binder: BINDER_SET_CONTEXT_MGR already set [ 1192.405284][T21096] binder: 21093:21096 ioctl 4018620d 2000000001c0 returned -16 [ 1192.413144][T21096] binder: BINDER_SET_CONTEXT_MGR already set [ 1192.421423][T21096] binder: 21093:21096 ioctl 4018620d 2000000001c0 returned -16 [ 1192.429322][T21096] binder: BINDER_SET_CONTEXT_MGR already set [ 1192.435523][T21096] binder: 21093:21096 ioctl 4018620d 2000000001c0 returned -16 [ 1192.443411][T21096] binder: BINDER_SET_CONTEXT_MGR already set [ 1192.449469][T21096] binder: 21093:21096 ioctl 4018620d 2000000001c0 returned -16 [ 1192.457190][T21096] binder: BINDER_SET_CONTEXT_MGR already set [ 1192.465362][T21096] binder: 21093:21096 ioctl 4018620d 2000000001c0 returned -16 [ 1192.520942][T21096] binder: BINDER_SET_CONTEXT_MGR already set [ 1192.567323][T21096] binder: 21093:21096 ioctl 4018620d 2000000001c0 returned -16 [ 1193.105553][T21104] netlink: 'syz.5.3782': attribute type 12 has an invalid length. [ 1193.319413][T21106] macvlan0: entered promiscuous mode [ 1193.342372][T21106] netlink: 'syz.2.3783': attribute type 1 has an invalid length. [ 1193.361913][T21106] netlink: 'syz.2.3783': attribute type 2 has an invalid length. [ 1193.576982][T21095] syz.0.3780 (21095): drop_caches: 2 [ 1193.669580][ T2150] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 1193.839137][ T2150] usb 6-1: Using ep0 maxpacket: 32 [ 1193.858939][ T2150] usb 6-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 1193.871654][ T2150] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1193.881729][ T2150] usb 6-1: Product: syz [ 1193.886214][ T2150] usb 6-1: Manufacturer: syz [ 1193.891418][ T2150] usb 6-1: SerialNumber: syz [ 1193.913847][ T2150] usb 6-1: config 0 descriptor?? [ 1193.949430][ T9] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 1194.099060][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 1194.106122][ T9] usb 1-1: too many configurations: 29, using maximum allowed: 8 [ 1194.116954][ T9] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 1194.124816][ T9] usb 1-1: can't read configurations, error -61 [ 1194.155485][T21111] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3784'. [ 1194.173692][ T2150] airspy 6-1:0.0: usb_control_msg() failed -71 request 09 [ 1194.184885][ T2150] airspy 6-1:0.0: Could not detect board [ 1194.193733][ T2150] airspy 6-1:0.0: probe with driver airspy failed with error -71 [ 1194.224209][ T2150] usb 6-1: USB disconnect, device number 72 [ 1194.279728][ T9] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 1194.479522][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 1194.532649][ T9] usb 1-1: too many configurations: 29, using maximum allowed: 8 [ 1194.567655][T21127] syzkaller1: entered promiscuous mode [ 1194.583769][T21127] syzkaller1: entered allmulticast mode [ 1194.594359][ T9] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 1194.604603][ T9] usb 1-1: can't read configurations, error -61 [ 1194.612178][ T9] usb usb1-port1: attempt power cycle [ 1194.721684][ T2150] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1194.909201][ T2150] usb 5-1: Using ep0 maxpacket: 8 [ 1194.921672][ T2150] usb 5-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 1194.939313][ T2150] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1194.947360][ T2150] usb 5-1: Product: syz [ 1194.958769][ T2150] usb 5-1: Manufacturer: syz [ 1194.963696][ T2150] usb 5-1: SerialNumber: syz [ 1194.971848][ T9] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 1194.981400][ T2150] usb 5-1: config 0 descriptor?? [ 1194.993991][ T2150] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 1195.012587][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 1195.019667][ T9] usb 1-1: too many configurations: 29, using maximum allowed: 8 [ 1195.038181][ T9] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 1195.046243][ T9] usb 1-1: can't read configurations, error -61 [ 1195.179521][ T9] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 1195.224862][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 1195.246654][ T9] usb 1-1: too many configurations: 29, using maximum allowed: 8 [ 1195.259937][ T9] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 1195.267969][ T9] usb 1-1: can't read configurations, error -61 [ 1195.280329][ T9] usb usb1-port1: unable to enumerate USB device [ 1195.673221][T21150] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1195.714926][T21150] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1195.959111][T21158] binder: 21157:21158 ioctl c0306201 0 returned -14 [ 1195.967202][T21158] binder: 21157:21158 ioctl c0306201 200000000640 returned -22 [ 1195.976408][T21158] netlink: 180 bytes leftover after parsing attributes in process `syz.5.3801'. [ 1195.979231][ T977] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 1196.161419][ T977] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1196.181465][ T977] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1196.192337][ T977] usb 3-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 1196.201812][ T977] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1196.213538][ T977] usb 3-1: config 0 descriptor?? [ 1196.447574][ T2150] gspca_sonixj: reg_r err -32 [ 1196.454387][ T2150] sonixj 5-1:0.0: probe with driver sonixj failed with error -32 [ 1196.634496][ T977] hid-steam 0003:28DE:1142.001E: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.2-1/input0 [ 1196.709147][ T977] hid-steam 0003:28DE:1142.001E: Steam wireless receiver connected [ 1196.745878][ T977] hid-steam 0003:28DE:1142.001F: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.2-1/input0 [ 1196.974744][T21174] vlan2: entered promiscuous mode [ 1196.980210][T21174] syz_tun: entered promiscuous mode [ 1197.181632][ T2150] usb 5-1: USB disconnect, device number 97 [ 1197.410073][ T2150] usb 3-1: USB disconnect, device number 5 [ 1197.451881][ T2150] hid-steam 0003:28DE:1142.001E: Steam wireless receiver disconnected [ 1197.516903][T21194] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1197.595683][T21196] bridge_slave_0: left allmulticast mode [ 1197.601530][T21196] bridge_slave_0: left promiscuous mode [ 1197.607268][T21196] bridge0: port 1(bridge_slave_0) entered disabled state [ 1197.622805][T21196] bond0: (slave bridge_slave_1): Releasing backup interface [ 1197.632350][T21196] bond0: (slave bond_slave_0): Releasing backup interface [ 1197.670377][T21196] bond0: (slave bond_slave_1): Releasing backup interface [ 1197.671588][T21199] netlink: 'syz.5.3813': attribute type 10 has an invalid length. [ 1197.714058][T21196] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1197.725564][T21201] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3813'. [ 1197.734668][T21196] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1197.805004][T21196] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1197.822777][T21196] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1197.866077][T21196] bond1: (slave gretap1): Releasing active interface [ 1197.904482][T21203] netlink: 384 bytes leftover after parsing attributes in process `syz.4.3814'. [ 1198.186121][T21213] binder: 21212:21213 ioctl c0306201 0 returned -14 [ 1198.220069][T21213] binder: 21212:21213 ioctl c0306201 200000000640 returned -22 [ 1198.297011][T21218] kAFS: unparsable volume name [ 1198.663331][T21234] netlink: 60 bytes leftover after parsing attributes in process `syz.5.3827'. [ 1198.720912][T21234] netlink: 60 bytes leftover after parsing attributes in process `syz.5.3827'. [ 1198.732563][T21234] netlink: 60 bytes leftover after parsing attributes in process `syz.5.3827'. [ 1198.769971][T21235] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3826'. [ 1198.917246][T21239] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1199.104689][T21244] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 1199.116930][T21244] netlink: 44 bytes leftover after parsing attributes in process `syz.5.3830'. [ 1199.146609][T15923] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 1199.511033][T15923] usb 3-1: config 1 has an invalid descriptor of length 100, skipping remainder of the config [ 1199.528237][T15923] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1199.559244][T15923] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1199.570789][T15923] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1199.589734][T15923] usb 3-1: SerialNumber: syz [ 1199.878192][T15923] usb 3-1: 0:2 : does not exist [ 1199.886141][T15923] usb 3-1: unit 5: unexpected type 0x0c [ 1200.032441][T15923] usb 3-1: USB disconnect, device number 6 [ 1200.195241][T20915] udevd[20915]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1201.336906][ T30] audit: type=1326 audit(1753259653.585:1644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21283 comm="syz.5.3844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f655918e9a9 code=0x7ffc0000 [ 1201.365017][ T30] audit: type=1326 audit(1753259653.615:1645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21283 comm="syz.5.3844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f655918e9a9 code=0x7ffc0000 [ 1201.405107][ T30] audit: type=1326 audit(1753259653.615:1646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21283 comm="syz.5.3844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f655918e9a9 code=0x7ffc0000 [ 1201.436392][ T30] audit: type=1326 audit(1753259653.615:1647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21283 comm="syz.5.3844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f655918e9a9 code=0x7ffc0000 [ 1201.459500][ T30] audit: type=1326 audit(1753259653.615:1648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21283 comm="syz.5.3844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f655918e9a9 code=0x7ffc0000 [ 1201.521187][ T30] audit: type=1326 audit(1753259653.615:1649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21283 comm="syz.5.3844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f655918e9a9 code=0x7ffc0000 [ 1201.569681][ T30] audit: type=1326 audit(1753259653.615:1650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21283 comm="syz.5.3844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f655918e9a9 code=0x7ffc0000 [ 1201.613730][ T30] audit: type=1326 audit(1753259653.615:1651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21283 comm="syz.5.3844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f655918e9a9 code=0x7ffc0000 [ 1201.640382][ T30] audit: type=1326 audit(1753259653.615:1652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21283 comm="syz.5.3844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f655918e9a9 code=0x7ffc0000 [ 1201.686763][T21285] pim6reg: entered allmulticast mode [ 1201.709370][ T30] audit: type=1326 audit(1753259653.615:1653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21283 comm="syz.5.3844" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f655918e9a9 code=0x7ffc0000 [ 1201.733429][T21285] pim6reg: left allmulticast mode [ 1202.367283][T21316] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3856'. [ 1202.482082][T11681] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 1202.651435][T11681] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1202.679221][T11681] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1202.689216][T11681] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1202.709087][T11681] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1202.721012][T11681] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1202.742626][T11681] usb 6-1: config 0 descriptor?? [ 1203.192935][T11681] plantronics 0003:047F:FFFF.0020: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 1203.231365][T21328] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1203.242464][T21328] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1203.253170][T21328] [ 1203.255541][T21328] ============================================ [ 1203.261702][T21328] WARNING: possible recursive locking detected [ 1203.267870][T21328] 6.16.0-rc7-syzkaller #0 Not tainted [ 1203.273254][T21328] -------------------------------------------- [ 1203.279417][T21328] syz.4.3859/21328 is trying to acquire lock: [ 1203.285492][T21328] ffff888060dacd30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: __netdev_update_features+0xcb1/0x1a20 [ 1203.296487][T21328] [ 1203.296487][T21328] but task is already holding lock: [ 1203.303874][T21328] ffff888060dacd30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: dev_ethtool+0x716/0x1990 [ 1203.313918][T21328] and the lock comparison function returns 0: [ 1203.319994][T21328] [ 1203.319994][T21328] other info that might help us debug this: [ 1203.328414][T21328] Possible unsafe locking scenario: [ 1203.328414][T21328] [ 1203.335895][T21328] CPU0 [ 1203.339194][T21328] ---- [ 1203.342497][T21328] lock(&dev_instance_lock_key#20); [ 1203.347840][T21328] lock(&dev_instance_lock_key#20); [ 1203.353149][T21328] [ 1203.353149][T21328] *** DEADLOCK *** [ 1203.353149][T21328] [ 1203.361299][T21328] May be due to missing lock nesting notation [ 1203.361299][T21328] [ 1203.369718][T21328] 2 locks held by syz.4.3859/21328: [ 1203.374925][T21328] #0: ffffffff8f51c108 (rtnl_mutex){+.+.}-{4:4}, at: dev_ethtool+0x1d0/0x1990 [ 1203.383921][T21328] #1: ffff888060dacd30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: dev_ethtool+0x716/0x1990 [ 1203.394221][T21328] [ 1203.394221][T21328] stack backtrace: [ 1203.400132][T21328] CPU: 1 UID: 0 PID: 21328 Comm: syz.4.3859 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 1203.400155][T21328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1203.400167][T21328] Call Trace: [ 1203.400174][T21328] [ 1203.400182][T21328] dump_stack_lvl+0x189/0x250 [ 1203.400207][T21328] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1203.400228][T21328] ? __pfx__printk+0x10/0x10 [ 1203.400252][T21328] ? print_lock_name+0xde/0x100 [ 1203.400276][T21328] print_deadlock_bug+0x28b/0x2a0 [ 1203.400298][T21328] validate_chain+0x1a3f/0x2140 [ 1203.400321][T21328] ? is_bpf_text_address+0x292/0x2b0 [ 1203.400339][T21328] ? is_bpf_text_address+0x26/0x2b0 [ 1203.400361][T21328] __lock_acquire+0xab9/0xd20 [ 1203.400381][T21328] ? __netdev_update_features+0xcb1/0x1a20 [ 1203.400397][T21328] lock_acquire+0x120/0x360 [ 1203.400413][T21328] ? __netdev_update_features+0xcb1/0x1a20 [ 1203.400448][T21328] __mutex_lock+0x182/0xe80 [ 1203.400474][T21328] ? __netdev_update_features+0xcb1/0x1a20 [ 1203.400494][T21328] ? kasan_save_track+0x4f/0x80 [ 1203.400515][T21328] ? kasan_save_free_info+0x46/0x50 [ 1203.400533][T21328] ? __kasan_slab_free+0x62/0x70 [ 1203.400553][T21328] ? kmem_cache_free+0x18f/0x400 [ 1203.400576][T21328] ? netlink_broadcast_filtered+0x103e/0x1140 [ 1203.400598][T21328] ? ethnl_multicast+0xb6/0x100 [ 1203.400620][T21328] ? ethnl_default_notify+0x7c0/0x990 [ 1203.400643][T21328] ? ethnl_netdev_event+0xe2/0x160 [ 1203.400668][T21328] ? __netdev_update_features+0xcb1/0x1a20 [ 1203.400684][T21328] ? __lock_acquire+0xab9/0xd20 [ 1203.400700][T21328] ? __pfx___mutex_lock+0x10/0x10 [ 1203.400725][T21328] __netdev_update_features+0xcb1/0x1a20 [ 1203.400747][T21328] ? __pfx___netdev_update_features+0x10/0x10 [ 1203.400763][T21328] ? __wake_up_common_lock+0x190/0x1f0 [ 1203.400789][T21328] ? cfg80211_netdev_notifier_call+0x1ea/0x13c0 [ 1203.400813][T21328] ? consume_skb+0xce/0xf0 [ 1203.400863][T21328] ? netlink_broadcast_filtered+0x10c8/0x1140 [ 1203.400886][T21328] ? __pfx_cfg80211_netdev_notifier_call+0x10/0x10 [ 1203.400913][T21328] ? __lock_acquire+0xab9/0xd20 [ 1203.400932][T21328] ? do_raw_spin_lock+0x121/0x290 [ 1203.400956][T21328] netdev_update_features+0x6d/0xe0 [ 1203.400980][T21328] ? __pfx_netdev_update_features+0x10/0x10 [ 1203.401006][T21328] macsec_notify+0x2f5/0x660 [ 1203.401034][T21328] ? __pfx_macsec_notify+0x10/0x10 [ 1203.401057][T21328] ? __pfx_xfrm_dev_event+0x10/0x10 [ 1203.401079][T21328] ? notifier_call_chain+0x164/0x3e0 [ 1203.401101][T21328] notifier_call_chain+0x1b3/0x3e0 [ 1203.401123][T21328] netdev_features_change+0x85/0xc0 [ 1203.401145][T21328] ? __pfx_netdev_features_change+0x10/0x10 [ 1203.401166][T21328] ? security_capable+0x7e/0x2e0 [ 1203.401186][T21328] dev_ethtool+0x1520/0x1990 [ 1203.401208][T21328] ? __pfx_dev_ethtool+0x10/0x10 [ 1203.401229][T21328] ? dev_load+0x21/0x1f0 [ 1203.401251][T21328] dev_ioctl+0x392/0x1150 [ 1203.401273][T21328] sock_do_ioctl+0x22c/0x300 [ 1203.401293][T21328] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1203.401310][T21328] ? __lock_acquire+0xab9/0xd20 [ 1203.401333][T21328] sock_ioctl+0x576/0x790 [ 1203.401351][T21328] ? __pfx_sock_ioctl+0x10/0x10 [ 1203.401369][T21328] ? __fget_files+0x2a/0x420 [ 1203.401384][T21328] ? __fget_files+0x3a0/0x420 [ 1203.401397][T21328] ? __fget_files+0x2a/0x420 [ 1203.401413][T21328] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1203.401433][T21328] ? __pfx_sock_ioctl+0x10/0x10 [ 1203.401450][T21328] __se_sys_ioctl+0xfc/0x170 [ 1203.401472][T21328] do_syscall_64+0xfa/0x3b0 [ 1203.401491][T21328] ? lockdep_hardirqs_on+0x9c/0x150 [ 1203.401508][T21328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1203.401524][T21328] ? clear_bhb_loop+0x60/0xb0 [ 1203.401542][T21328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1203.401559][T21328] RIP: 0033:0x7f28b038e9a9 [ 1203.401576][T21328] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1203.401592][T21328] RSP: 002b:00007f28b125c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1203.401611][T21328] RAX: ffffffffffffffda RBX: 00007f28b05b6240 RCX: 00007f28b038e9a9 [ 1203.401625][T21328] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 0000000000000009 [ 1203.401637][T21328] RBP: 00007f28b0410d69 R08: 0000000000000000 R09: 0000000000000000 [ 1203.401649][T21328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1203.401660][T21328] R13: 0000000000000000 R14: 00007f28b05b6240 R15: 00007f28b06dfa28 [ 1203.401679][T21328] [ 1204.428382][T11681] usb 6-1: USB disconnect, device number 73