last executing test programs: 5m20.281270569s ago: executing program 0 (id=2409): socket$inet6(0xa, 0x3, 0x5) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_open_dev$sndctrl(0x0, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x5, &(0x7f0000000280)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000600a8000600200002400700027c035c0461c1d67f6f94007134cf6efb807ca007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001a00)=ANY=[@ANYBLOB="850000002f000201840000000000000095000000000000008560fc2b2062f611fc2f864ef177d634e46e8dcfe61b4fb9f600344d592fee49e176fe6ad28fbcb1f9259bfc63e9030971917e30b6f42e8f9dd6ab0ce07312a135cd363aa7e5bcef8fd0e8c7d2082584156c52ebfd69e8e13b7a8b477abc86468e11b6242133ce882f05e16b91c37b3437347f6058b4489c759783b9d4dfb55d0085a26e41201a6d8c8ced33e10048e756a40538b32bf653fa3c831a4e60599ed7a0f999d18de9984522a7cdb6fc30015633a0132c9578b7da5bd7280a5f7e28fd858ba712020b23ef8a2785b6c146c48b48ca7e232d0489661396e9303b38aa5d26d06e2e676795fd2733f95da570bab301000000ffffffff2a2792a630d8fcdc"], &(0x7f0000000180)='GPL\x00'}, 0x48) 5m18.61328022s ago: executing program 0 (id=2416): syz_emit_ethernet(0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="20010000120013070000000000000000e0000001000000000000000000000000fc00"/56, @ANYBLOB="fc0200"], 0x120}}, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000004c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r2, @ANYBLOB="08002700851600000a00180000000000000000001c005a8018000180140003"], 0x4c}}, 0x4000804) 5m17.662329697s ago: executing program 0 (id=2420): syz_emit_ethernet(0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="20010000120013070000000000000000e0000001000000000000000000000000fc00"/64, @ANYRES32=0x0, @ANYBLOB="fc0200"], 0x120}}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000004c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r3, @ANYBLOB="08002700851600000a00180000000000000000001c005a8018000180"], 0x4c}}, 0x4000804) 5m15.567613512s ago: executing program 0 (id=2426): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x10010, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0xc, &(0x7f00000000c0)=0x6, 0x4) sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1c00000056000106000000000000000007"], 0x1c}], 0x1}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) r2 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x20201) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000100)) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r3, 0x80045017, 0x0) r4 = fsopen(&(0x7f0000000380)='gfs2\x00', 0x1) fsconfig$FSCONFIG_SET_FD(r4, 0x5, &(0x7f00000003c0)='/dev/snd/pcmC#D#p\x00', 0x0, r1) r5 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f0000000180)=0x38, 0x4) write$snddsp(r5, &(0x7f0000000200)="a38d", 0x2) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f00000083c0)={{0x3, 0x7}}) ioctl$SNDRV_TIMER_IOCTL_START(r6, 0x54a0) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(r5, 0xc06c4124, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x604ab000) openat$ttyS3(0xffffff9c, &(0x7f00000002c0), 0x100, 0x0) close(r5) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newlink={0x58, 0x10, 0x40d, 0x70bd2a, 0x40000004, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5019}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR_MODE={0x8, 0x3, 0x2}, @IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f00000031c0)=""/4091, 0xff4, 0x0, 0x0, 0xfffffffffffffda6}, &(0x7f0000000000)=0x40) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff78, 0x0, 0x0}, &(0x7f0000000340)=0x40) 5m14.351293975s ago: executing program 0 (id=2433): r0 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r0, &(0x7f0000001a00)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000580)=@l2tp6={0xa, 0x0, 0x707fffd, @ipv4={'\x00', '\xff\xff', @loopback}, 0x6, 0x1}, 0x80, 0x0, 0x12}}], 0x2, 0x0) 5m14.114226414s ago: executing program 0 (id=2434): openat$kvm(0xffffff9c, &(0x7f0000000000), 0x400242, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x22100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) dup3(r0, 0xffffffffffffffff, 0x80000) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x22000, 0x0) read$FUSE(r3, 0x0, 0x0) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x2}, &(0x7f0000001fee)='R\x10rust\xe3c*s\xa8rVid8\xc4e', 0x0) capget(&(0x7f0000000140)={0x20080522}, &(0x7f00000001c0)={0x7, 0x1, 0x2e7, 0x8, 0x1, 0x86d7}) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r4, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xe737}}, 0x10) writev(r4, &(0x7f0000000000)=[{&(0x7f0000000080)}, {&(0x7f0000000100)="16000000246837f73199aee6fdb9291b3091ec1a2d41d227975ad8ec030f59190200867997f9c0efa9c9092a31cdbb98ea272787afda0af59a320709c3a59ef05c6f40ceafec53f48d6186e7d8409e35306221caf67b370d875eff3191932728e5ab6c9a3acf6ccee3e352c898f5744abaedfb53f92c37acb126bd143f3e9cdfcf25a8d6129fcc3a141c3f5ab6db772f87c787817a9b699dd60732d952716b103bc1e91ac5b1ed92f35389580994bb0df9bce07e7a80921888f984139f488d256a67fec0cbb5c4e93d5c151d97f676ab93b1", 0xd2}, {&(0x7f0000001480)="d1ffacd516de50ac9d15bc75316da4defa1e72f65a65cdd26dcc389aacf7856da9aecf3765d4c032e1960faf25bad906b7d3440b6e71a82f1d8f8b8db35b6091f3af94c6b46b9ab10fe3923f268771078d2668be7bd3eb941d4bb5baa8547e36283a065ce5766cbff3a8fc37fc4507643d3786bbf231d3ed88cb8b01eab14e4372cf4f89bd1b853caa5d9f07f523b9dfa8cc09053ff36fde08e96fb6b3acc196b1bd1e2d3a6c65f585df7e2b8b17439a7ab29a7dfe642c2f0ac7a81eca8073b559663f2daf7a0832b2b09557794a21bf114831f8e6db3922d0cd169e5a8b4adc95d7322ee75944de15f57780b88fef7f3d9b256705ccfa2125b43ce8e3aacaead963cdd7f792f14c9b24493f9f830f6de8da93bbd4357095631adec14224dd9bb049e826f3a49624393e6a031103faff0902ba88ae30af4a61caa77ff956214196fcf3c5536d823284306f367afcb46fb43231911cc53091671e7d853ebf015241b18e9fb6ac6d9a7a1b05dfd6d9e56a51567cd8837dd045abf6b85550f0dd8dded43147ab9bfadc18b9984699d5d875cb21a95a7f584d8c466d033df75193f9ae58b85cfacc54f6c6e12a0debe40ee361a839563bc2cb64271672a55370c2b035b482074ce2487ef8a3bc1c68856e6e09539276d961a0c647f1ee3237496fc99623e8fd33faf7797d86a88dcee152d15e10739bcbbd6077b76867e291f350d999024c12faf81f83792f48f7f6dd66aa6854e460ef7f8c755f3a6dd76509ea0d2db39057a5129185b2fb11546cd5d6cc59f640e9028ae6c7075fba5e5b5593d7f79ec387833f465d09bde464112821eaec5e6e8f2aee8d7358f9c14afe2018856f610848706c71cda62493aef2e39efb71b4a8e804847eda66b2b5b1d75b478f19208ee1ac43afb2dbbba5dd0f29f6946022e09fb853cb176ca3474ba2fa67cb245fe85ec61a095d6fd9ac2ac5685920201617342fe56072427b9bd3626a1a371e67041fcda781be0c234d6feb5ad500e8bc7074381fd0d04983a4a6cdb6c8e03d59dc50925e9e4b24e6f8e455f02818959f2927f0a2d9ff62ec3c5c399077048f7d3dad0830b2e6563693f2f9d48eca8c34804a7626282a4a214d13786993c011a88194dbf7b23e25f592e62186c9fb565fac7632de356153c89a6be0b6b26ba48c2427424769fcbd7ee072ed4bd4d0731d06c8537d616b1145a6c70edb13fb4dba3565221b3a2897a23861cd0e8e0060021cdd7de002d5e785e5d6d3d07f4e445ada9c8d9ba8b819d0b5c7b5d15a5192d3a83c125c8e117c823a9e33316b8c9154e7330d3a865048dbd9c14757691bfe56f10423f6ab717bec5eebeac6ba9ad1aeb6cde09d7fda8e475a71ac48d46b8d9a40879c9dec2db5c4799e5fc8e8b3d419031c1033fce88ae2c93d7ca62c9302e6b45ca8dfebe5b92724f035e8e9d7704efb23f445999fe08cfa28404874d8acc8d37870d394d9fcc8dbe763bc85c37f0f3bcc2cbea420cd073db598e7d89c14a31e5bf57cbefa301427c93091505f1f3e5cdf712958b2e8fc56684d3388107c1728f0e5a3be2164246071653e256ed3bf3000c17301da9a5a3d9ca475867c4f311a24e5ae909a62047a9e6bb71cbcb4f159c2ef0f66b4d0f9da51aba99cd9448443dd277362af18d32f111c48a952ef555b2c7c58b997ce61e74cc7551b57eaffe411219baddf490926d8e260dcd87c069e617195c352950f9b51ce88c12c4f7997ba515f77e68d44f831cdf4d7ee8b1b7cedcb4c4fc7e85ba288c8555d49d5b4b9bb70dc4b688bd12e6b38e37150f3ea457a76b23d5abe6551ea598e090aed87822b0954b8db1a7c605c925b7f9240b0e7a020f292a1fd4a37c74139bc6e7ff08373ebfc8feea371ae0b6c61c715f6f1f4b0b994c7e2e129f87db959aae6ff48664d824b29ba9f255890f9c537178db9c5302097891557f8175a46f308b1a2530aa726ea9d4cfce76db50637369724d0c5f51c97edb58ff5eb9b2434b3721b61688ba12471b97c6a65ba085e15406568ac852590701f2ef8451c5cf1191d70f51eaea9ddc4cbdd7428f627db5069111f65062d5cc34581826af3e670613dda99e31c42736aabd87be56e214ed606862a152455f91891b7430bae03284569c234588f495a5ecc4a23fad6ba34e2ee9ebde8c7f5f62c9344659375c2a1fe6fa6e4ef68712223b9471c513bb11429dbb8a45463c8882f462275ee0da567c60c2d8038843e0c20486676e9978f2aec9187820c94a6e7e519d06daf2ab198f5cafcab4d9c90a479800906192d66a3301a34fa6c5a931cea0a479a4d98d86d9de3e061323504b57186dd33df7a16ccb688c0de203666cb0a6b543a9d069dded44a3b432cbb71da921dcab6be1c2d7494d3b07841d9b4f9d659b5d3d3b2ed916f91588d589128e4b2d4448e6aab5a8160eddca0f6e022abb85e251a11cd6bae57a09b2c434ab5bdf6264afb20d5ab022d152e345bd32ba9283aa5b3cd9118bd271a8ac9083c98b8a83064e65428f7ad7b35bf1d60d4e703f22d2d316fc12bd68bcced82cf0962a3d5769c6a3d75d59f7a7b76454661fd3574b8c8e26d20c372407854505ea6c2406fbd8a1ba7bb017c565228aa6d03d18ed309a308ffb1ecec73c246413e7c70f25070eafed9e70d22e9e8b44125c44eceff37e65bf073bc6fad1ea2b72675af4bf70586a8f7e0f35700de94c802", 0x783}], 0x3) timerfd_create(0x1, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4400000010000104000000000000000600000000", @ANYRES32=0x0, @ANYBLOB="8a450200000000002400128009000100626f6e6400000000140002800500010006000000080002"], 0x44}}, 0x40) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r6 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) sendmsg$alg(r6, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=[@iv={0x14, 0x117, 0x2, 0x2, '8r'}, @op={0x10, 0x117, 0x3, 0x1}], 0x24, 0x1}, 0x801) syz_open_procfs(0x0, &(0x7f00000000c0)='projid_map\x00') 4m58.873534056s ago: executing program 32 (id=2434): openat$kvm(0xffffff9c, &(0x7f0000000000), 0x400242, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x22100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) dup3(r0, 0xffffffffffffffff, 0x80000) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x22000, 0x0) read$FUSE(r3, 0x0, 0x0) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x2}, &(0x7f0000001fee)='R\x10rust\xe3c*s\xa8rVid8\xc4e', 0x0) capget(&(0x7f0000000140)={0x20080522}, &(0x7f00000001c0)={0x7, 0x1, 0x2e7, 0x8, 0x1, 0x86d7}) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r4, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0xe737}}, 0x10) writev(r4, &(0x7f0000000000)=[{&(0x7f0000000080)}, {&(0x7f0000000100)="16000000246837f73199aee6fdb9291b3091ec1a2d41d227975ad8ec030f59190200867997f9c0efa9c9092a31cdbb98ea272787afda0af59a320709c3a59ef05c6f40ceafec53f48d6186e7d8409e35306221caf67b370d875eff3191932728e5ab6c9a3acf6ccee3e352c898f5744abaedfb53f92c37acb126bd143f3e9cdfcf25a8d6129fcc3a141c3f5ab6db772f87c787817a9b699dd60732d952716b103bc1e91ac5b1ed92f35389580994bb0df9bce07e7a80921888f984139f488d256a67fec0cbb5c4e93d5c151d97f676ab93b1", 0xd2}, {&(0x7f0000001480)="d1ffacd516de50ac9d15bc75316da4defa1e72f65a65cdd26dcc389aacf7856da9aecf3765d4c032e1960faf25bad906b7d3440b6e71a82f1d8f8b8db35b6091f3af94c6b46b9ab10fe3923f268771078d2668be7bd3eb941d4bb5baa8547e36283a065ce5766cbff3a8fc37fc4507643d3786bbf231d3ed88cb8b01eab14e4372cf4f89bd1b853caa5d9f07f523b9dfa8cc09053ff36fde08e96fb6b3acc196b1bd1e2d3a6c65f585df7e2b8b17439a7ab29a7dfe642c2f0ac7a81eca8073b559663f2daf7a0832b2b09557794a21bf114831f8e6db3922d0cd169e5a8b4adc95d7322ee75944de15f57780b88fef7f3d9b256705ccfa2125b43ce8e3aacaead963cdd7f792f14c9b24493f9f830f6de8da93bbd4357095631adec14224dd9bb049e826f3a49624393e6a031103faff0902ba88ae30af4a61caa77ff956214196fcf3c5536d823284306f367afcb46fb43231911cc53091671e7d853ebf015241b18e9fb6ac6d9a7a1b05dfd6d9e56a51567cd8837dd045abf6b85550f0dd8dded43147ab9bfadc18b9984699d5d875cb21a95a7f584d8c466d033df75193f9ae58b85cfacc54f6c6e12a0debe40ee361a839563bc2cb64271672a55370c2b035b482074ce2487ef8a3bc1c68856e6e09539276d961a0c647f1ee3237496fc99623e8fd33faf7797d86a88dcee152d15e10739bcbbd6077b76867e291f350d999024c12faf81f83792f48f7f6dd66aa6854e460ef7f8c755f3a6dd76509ea0d2db39057a5129185b2fb11546cd5d6cc59f640e9028ae6c7075fba5e5b5593d7f79ec387833f465d09bde464112821eaec5e6e8f2aee8d7358f9c14afe2018856f610848706c71cda62493aef2e39efb71b4a8e804847eda66b2b5b1d75b478f19208ee1ac43afb2dbbba5dd0f29f6946022e09fb853cb176ca3474ba2fa67cb245fe85ec61a095d6fd9ac2ac5685920201617342fe56072427b9bd3626a1a371e67041fcda781be0c234d6feb5ad500e8bc7074381fd0d04983a4a6cdb6c8e03d59dc50925e9e4b24e6f8e455f02818959f2927f0a2d9ff62ec3c5c399077048f7d3dad0830b2e6563693f2f9d48eca8c34804a7626282a4a214d13786993c011a88194dbf7b23e25f592e62186c9fb565fac7632de356153c89a6be0b6b26ba48c2427424769fcbd7ee072ed4bd4d0731d06c8537d616b1145a6c70edb13fb4dba3565221b3a2897a23861cd0e8e0060021cdd7de002d5e785e5d6d3d07f4e445ada9c8d9ba8b819d0b5c7b5d15a5192d3a83c125c8e117c823a9e33316b8c9154e7330d3a865048dbd9c14757691bfe56f10423f6ab717bec5eebeac6ba9ad1aeb6cde09d7fda8e475a71ac48d46b8d9a40879c9dec2db5c4799e5fc8e8b3d419031c1033fce88ae2c93d7ca62c9302e6b45ca8dfebe5b92724f035e8e9d7704efb23f445999fe08cfa28404874d8acc8d37870d394d9fcc8dbe763bc85c37f0f3bcc2cbea420cd073db598e7d89c14a31e5bf57cbefa301427c93091505f1f3e5cdf712958b2e8fc56684d3388107c1728f0e5a3be2164246071653e256ed3bf3000c17301da9a5a3d9ca475867c4f311a24e5ae909a62047a9e6bb71cbcb4f159c2ef0f66b4d0f9da51aba99cd9448443dd277362af18d32f111c48a952ef555b2c7c58b997ce61e74cc7551b57eaffe411219baddf490926d8e260dcd87c069e617195c352950f9b51ce88c12c4f7997ba515f77e68d44f831cdf4d7ee8b1b7cedcb4c4fc7e85ba288c8555d49d5b4b9bb70dc4b688bd12e6b38e37150f3ea457a76b23d5abe6551ea598e090aed87822b0954b8db1a7c605c925b7f9240b0e7a020f292a1fd4a37c74139bc6e7ff08373ebfc8feea371ae0b6c61c715f6f1f4b0b994c7e2e129f87db959aae6ff48664d824b29ba9f255890f9c537178db9c5302097891557f8175a46f308b1a2530aa726ea9d4cfce76db50637369724d0c5f51c97edb58ff5eb9b2434b3721b61688ba12471b97c6a65ba085e15406568ac852590701f2ef8451c5cf1191d70f51eaea9ddc4cbdd7428f627db5069111f65062d5cc34581826af3e670613dda99e31c42736aabd87be56e214ed606862a152455f91891b7430bae03284569c234588f495a5ecc4a23fad6ba34e2ee9ebde8c7f5f62c9344659375c2a1fe6fa6e4ef68712223b9471c513bb11429dbb8a45463c8882f462275ee0da567c60c2d8038843e0c20486676e9978f2aec9187820c94a6e7e519d06daf2ab198f5cafcab4d9c90a479800906192d66a3301a34fa6c5a931cea0a479a4d98d86d9de3e061323504b57186dd33df7a16ccb688c0de203666cb0a6b543a9d069dded44a3b432cbb71da921dcab6be1c2d7494d3b07841d9b4f9d659b5d3d3b2ed916f91588d589128e4b2d4448e6aab5a8160eddca0f6e022abb85e251a11cd6bae57a09b2c434ab5bdf6264afb20d5ab022d152e345bd32ba9283aa5b3cd9118bd271a8ac9083c98b8a83064e65428f7ad7b35bf1d60d4e703f22d2d316fc12bd68bcced82cf0962a3d5769c6a3d75d59f7a7b76454661fd3574b8c8e26d20c372407854505ea6c2406fbd8a1ba7bb017c565228aa6d03d18ed309a308ffb1ecec73c246413e7c70f25070eafed9e70d22e9e8b44125c44eceff37e65bf073bc6fad1ea2b72675af4bf70586a8f7e0f35700de94c802", 0x783}], 0x3) timerfd_create(0x1, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4400000010000104000000000000000600000000", @ANYRES32=0x0, @ANYBLOB="8a450200000000002400128009000100626f6e6400000000140002800500010006000000080002"], 0x44}}, 0x40) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r6 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) sendmsg$alg(r6, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=[@iv={0x14, 0x117, 0x2, 0x2, '8r'}, @op={0x10, 0x117, 0x3, 0x1}], 0x24, 0x1}, 0x801) syz_open_procfs(0x0, &(0x7f00000000c0)='projid_map\x00') 9.340278941s ago: executing program 2 (id=3746): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000000)={[{0x4, 0x200, 0x8, 0x4f, 0x81, 0x7, 0xc0, 0x1, 0xff, 0x6, 0xc, 0x4, 0x9}, {0x8, 0xaff3, 0x0, 0x8, 0x4, 0x1, 0x8, 0x3, 0x4, 0x53, 0x1, 0x6, 0x10005}, {0x0, 0x7, 0x10, 0x10, 0x25, 0x2, 0x0, 0xfb, 0x4, 0x15, 0x1, 0x3, 0x40000000000002}], 0x9}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x6, 0xfffffffffffffffd, 0x0, 0x10004, 0xfffffffffffffffd, 0x4002004c4, 0x1000, 0x0, 0xfff, 0x10, 0x0, 0x0, 0x0, 0x8, 0x800000001], 0x0, 0x2011c0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_GET_XCRS(r2, 0x8188aea6, &(0x7f0000000440)) 9.05112806s ago: executing program 1 (id=3748): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x60880, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) r2 = dup3(r1, r0, 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x8c36, 0x3c00, 0x2, 0xbfdffffc}, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x1, 0x3}, 0x0, &(0x7f00000002c0)={0x3ff, 0xe, 0x0, 0x6, 0x8200000400000000, 0x7, 0x344}, 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x0) sendmsg$NFT_BATCH(r4, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 8.973142364s ago: executing program 2 (id=3749): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000006, 0x8031, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee00, 0xffffffffffffffff}}, './file0\x00'}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=@allocspi={0x15c, 0x16, 0x100, 0x70bd25, 0x25dfdbff, {{{@in6=@remote, @in=@rand_addr=0x64010102, 0x4e21, 0x0, 0x4e21, 0x7, 0xa, 0xa0, 0x20, 0x87, r0, r1}, {@in=@local, 0x4d3, 0x32}, @in6=@remote, {0x0, 0x8000000000000001, 0x2, 0xe0, 0x4, 0xffffffffffffff81, 0x0, 0x7}, {0x7f90, 0x0, 0x8, 0x80}, {0x2, 0xba5a, 0xe}, 0x70bd2d, 0x0, 0x2, 0x3, 0x6, 0x2}, 0x5, 0x5}, [@coaddr={0x14, 0xe, @in6=@local}, @algo_crypt={0x4a, 0x2, {{'ctr(cast6)\x00'}, 0x10, '\'j'}}, @etimer_thresh={0x8, 0xc, 0x5}]}, 0x15c}, 0x1, 0x0, 0x0, 0x8000}, 0x40800) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000000000010711e0920000000000001090224000100000000090400090103000100092105000001220500090581030002"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f00000003c0)={0x18, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) r3 = syz_open_dev$hidraw(&(0x7f0000000100), 0x0, 0x0) syz_usb_ep_write(r2, 0x81, 0x1, &(0x7f0000000140)='g') preadv(r3, &(0x7f00000002c0)=[{&(0x7f0000001740)=""/4096, 0x1000}], 0x1, 0x6, 0xc052) 8.158880612s ago: executing program 5 (id=3754): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x1e, 0x2, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x2, 0x1000000000, 0x7, 0xfa11, 0xfffffffc}, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x20040000) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'stdrng\x00'}, 0x58) r6 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0xbcb8, 0x0, 0x1, 0x1000}, &(0x7f0000000340)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r9 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x1c, r9, 0x4, 0x70bd28, 0x25dfdc02, {}, [""]}, 0x1c}}, 0x40010) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x40, 0x0, r5, 0x0}) io_uring_enter(r6, 0x3516, 0x3e44, 0x8, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) rt_sigaction(0x8, &(0x7f0000000080)={&(0x7f0000000200)="2437460f1c2bc4a2f99c9022000000c4a2f1002746c44179700d32233333a738e7c44240f29a3b470000a5c4c4a14d590c9736fe0d094e486ff5f5bb559a00000f75bed5370b1c2665d2950e000000db37", 0x88000007, 0x0}, 0x0, 0x8, &(0x7f0000000300)) syz_open_procfs(0x0, &(0x7f0000000000)='stat\x00') 8.084546432s ago: executing program 1 (id=3755): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c000280050001000000000008000740"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x32}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x88}, 0x0) 7.859002519s ago: executing program 1 (id=3757): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, 0x0, 0x8, 0x0) syz_io_uring_setup(0x1714, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) modify_ldt$write(0x1, &(0x7f0000004180)={0x8, 0x20000000}, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0xfd, 0x0, 0x7fff0000}]}) syz_open_procfs$pagemap(0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) futex(&(0x7f0000002200)=0x2, 0x5, 0x0, 0x0, &(0x7f0000002240)=0x3, 0xab02000d) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000002000000a70000000060a0b0400000000000000000200000044000480200001800e000100636f6e6e6c696d69740000000c000280080001400000000010000180090001006c61737400000000100001800a00010072656469720000000900010073797a30000000000900020073797a3200000000140000"], 0x98}, 0x1, 0x0, 0x0, 0x4000}, 0x24000000) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000e0000001000000000000000000000000ac1e000100000000000000000000000000000000000000000a003080000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000f63c31e5fdf8c000000000000400000000000000000000000000000000000000000000000200000000000000080000000080000000000000000000000000000000000000040000000000"], 0xb8}}, 0x40) sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0xb8}}, 0x0) mknodat$null(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0xc000, 0x103) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x94f031, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000"], 0xb8}}, 0x0) close(r2) read$FUSE(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000020c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000006c000122283d7008ffdbdf2500000000", @ANYRES32=0x0, @ANYRES16=r0], 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) 5.434410099s ago: executing program 5 (id=3762): socket$nl_generic(0x10, 0x3, 0x10) socket(0x1, 0x80802, 0x0) socket$kcm(0x2a, 0x2, 0x0) socket$xdp(0x2c, 0x3, 0x0) epoll_create1(0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x0, 0x4}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f00000004c0)={@flat=@binder={0x73622a85, 0x100, 0x800001}, @flat=@weak_binder={0x77622a85, 0x1101, 0x800001}, @fd={0x66642a85, 0x48000000, r1}}, &(0x7f0000000140)={0x0, 0x18, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x40000000015, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000140)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x20, 0x0, 0x10, 0xfffff010}, {0x6, 0x0, 0x0, 0xfffffffd}]}, 0x8) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000"], 0x18}}, 0x4000) sendmmsg(r4, &(0x7f0000000180), 0x4000190, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, &(0x7f00000002c0)=""/77) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) socket$packet(0x11, 0x2, 0x300) 5.186054297s ago: executing program 2 (id=3763): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000e0000001000000000000000000000002ac1e000100000000000000000000000000000000000000000a003080000000"], 0xb8}}, 0x40) 5.090440826s ago: executing program 5 (id=3765): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) setgid(0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)="9e", 0x1, 0x41, &(0x7f0000000200)={0xa, 0x4e23, 0x10003, @loopback, 0x7}, 0x1c) socket(0x10, 0x803, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') r2 = memfd_create(&(0x7f00000002c0)='D\xa3\xd5Wj\x00\x00\x8b\x14\xc2\xac\x1a\x1a\vG\xa9~vB\xbc\t\x00\x00\x00VoA\xaa\xbc\xee[\xe1\xa2\xe0\xff\x04\x00\x9b\x12\x0eW\xcf\t\xb0\xa9 +H/\xfd\xa4\xcaN\x84\xadS\x8bqE\x99\x01t\xb1\x1f|\x99PL\x92\x8f\xc2y\xcd\x8cj\x03X\x05\x17mwI\xf0\x01\xe5z\xcdJ)\xc7\xfa)\xaa}\xef\xde\xf5\xcd\xb1o5\x18\xd6\v\x85q\x98\x9bB\xb9\xea\xe7\xff\x7f\x00\x00T\xc0\xd2\t?\bpBl\xf4\x86\xd4\xc9\xe3\x8f\xd9\x9f\x15\x1e\xf2\x18\r\xad\b\xe0\x96NH\x85\r+\xfc\xb3\xdd\xddhg(\x03\xa7\x92\xe5\x00+h\xb7@#K\x9cMY\xd3\x9b\b-G\xb1\xdaS\x81\xb2\x93\xb83\x8a\x94*\x8d\\\b\xff/\xf8A\xaf\\\xaa\xf5u\xde\xfa\xa1\xc0\xf9&gR\x81.\xff\x83k\xe6\rDa\x16\xbd\x1a\xb2w\b\x00'/244, 0x0) write(r2, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) r3 = dup3(r1, r1, 0x0) fchdir(r3) r4 = inotify_init1(0x0) inotify_add_watch(r4, &(0x7f0000000040)='.\x00', 0x80000300) utimensat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000004580)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000006010000504af4ff100000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x6, 0x13, &(0x7f0000000200)=""/41, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000300)={0x0, 0x200002, 0x30}, 0xc) sendto$inet6(r0, &(0x7f0000000040)='\v', 0x1, 0x20008081, 0x0, 0x0) writev(r0, &(0x7f00000008c0)=[{&(0x7f0000000400)='U', 0x1}], 0x1) ioctl$KVM_SET_USER_MEMORY_REGION2(r3, 0x40a0ae49, &(0x7f0000000140)={0x1fe, 0x4, 0xeeee0000, 0x2000, &(0x7f0000001000/0x2000)=nil, 0x9, r3}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000900)={@cgroup, 0xffffffffffffffff, 0x1c, 0x4}, 0x20) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000340)=',', 0x34000}], 0x1) 4.881663563s ago: executing program 2 (id=3767): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x300}, 0x4) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r2 = socket$inet6(0xa, 0x3, 0x26) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev={0xac, 0x14, 0x14, 0x14}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e20, 0x0, 0x4e22, 0x49, 0xa, 0x0, 0x0, 0x3b}, {0x9, 0x0, 0x800, 0x800000, 0x0, 0x0, 0x0, 0x24}, {0x0, 0x4, 0x1}, 0x0, 0x0, 0x1, 0x0, 0x5, 0x3}, {{@in=@empty, 0x800, 0x33}, 0xa, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x0, 0x0, 0x4, 0xfffffffc, 0x4, 0x401}}, 0xe4) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000100)={0x16, 0x1, 0x0, "ff3a55f32ec78900d10052d000200000f3018e54fa19000000ffc800001c00"}) sendmmsg(r2, &(0x7f0000000480), 0x2e9, 0x0) 4.715013609s ago: executing program 3 (id=3768): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c00000010000104000000000000050000000000", @ANYRES32=0x0, @ANYBLOB="00030000000000001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r5, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r5], 0x4c}}, 0x0) 4.690531871s ago: executing program 5 (id=3769): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x403, 0x6030, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x2}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x14, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x3, {[@local=@item_012={0x2, 0x2, 0xa, "4818"}]}}, 0x0}, 0x0) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x0, 0x14, 0xd, "5e6424818327b2369deca65eb2"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00M'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) syz_usb_control_io(r0, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000380)={0x18, 0x0, 0x0, 0x0, &(0x7f0000000c80)={0x20, 0x1, 0x5, "dbd23f47ff"}, 0x0}) (rerun: 64) 4.235970444s ago: executing program 3 (id=3772): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05000000040000000400000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x13, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1ffffc, 0x0, 0x0, 0x0, 0x5000000}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0x6, 0x9, 0x0, 0x6, 0xe7030000}, {0x4, 0x0, 0x0, 0x6}}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{0x5, 0x1, 0x5, 0x3}, {0x5, 0x0, 0xb, 0x3, 0x0, 0x2}, {0x85, 0x0, 0x0, 0xcb}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.056352355s ago: executing program 1 (id=3773): syz_emit_ethernet(0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="20010000120013070000000000000000e0000001000000000000000000000000fc00"/56, @ANYRES32=0x0, @ANYBLOB="fc0200"], 0x120}}, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000004c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r2, @ANYBLOB="08002700851600000a00180000000000000000001c005a8018000180140003"], 0x4c}}, 0x4000804) (fail_nth: 3) 4.002341183s ago: executing program 3 (id=3774): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000006, 0x8031, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000000)) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee00, 0xffffffffffffffff}}, './file0\x00'}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x40800) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000000000010711e0920000000000001090224000100000000090400090103000100092105000001220500090581030002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x18, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000100), 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000140)='g') preadv(r1, &(0x7f00000002c0)=[{&(0x7f0000001740)=""/4096, 0x1000}], 0x1, 0x6, 0xc052) 3.882030721s ago: executing program 1 (id=3775): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f000000d240), 0x0, 0x0) lseek(r2, 0x3, 0x2) write$UHID_CREATE2(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="0b00000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006900b67009000000ff7f0000c500000002000000b845798d8371fcf489698fbb1ad81908db3c7b18ec496db4a8df79dbe19d03e79533ede0db65970743b4fe4ab826e15aba1a7bdf859b211bd1f681dee2f5f0190badf149b3e0634980ad77843b703d3e6d1db8ce9379b5f9768f32568fe02ab436b215e01807c08998000000000000"], 0x181) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000000000401c1b310a000000000001090224000100000000090400000103000000092100000001220500090d81034004000000"], 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000180)={0x7f, 0x4, 0x2, 0x1, 0x4, "e5eb314f5c6add4f"}) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="00f3baaac0550c0066808bb40f00000000000016d000001748"], 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000100)) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000015c0)=[@in={0x2, 0x4e20, @empty}], 0x10) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d032, 0xffffffffffffffff, 0x0) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x60}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)=ANY=[@ANYBLOB="30000000100005ff27bd7000fbdbdf25002000431be32c9397950a365ee6f869efd20e938207000000000000006aa57baad07642cd888ede0e95b5d48251e5e327e37e8a87f74d123295e78f4bf14480f623be0f703742ec181a39242ff2", @ANYRES32=0x0, @ANYBLOB="01800000004b00001800128008000100677470000c00028008000300f7042139"], 0x38}}, 0x20044004) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @rand_addr=0x64010102}]}, &(0x7f0000000100)=0xc) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, 0x0) openat$sequencer2(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x60600, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000200)="66b97208000066b8d04a000066ba000000000f30da4300bad004edb8dd008ed0650f0199009867362ea5752f2e0f73d399ba2100ec0f20e06635040000000f22e0", 0x41}], 0x1, 0x10, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff2}, {0x10, 0xf}, {0xa, 0x5}}}, 0x24}}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 3.363604839s ago: executing program 5 (id=3776): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x88, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x44, 0x12, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x1000}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x1}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}, {0xc, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @void}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x12, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xd0}}, 0x20050800) 2.982749375s ago: executing program 4 (id=3778): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) bpf$MAP_CREATE(0x0, 0x0, 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_int(r3, 0x1, 0x23, &(0x7f0000000000)=0x2, 0x4) bind$inet(r3, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) recvmmsg(r3, &(0x7f00000040c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000015c0)=""/127, 0x7f}}], 0x1, 0x0, 0x0) sendto$inet(r3, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) r4 = socket$inet6(0xa, 0x1, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000fbffffff0004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) r6 = socket$key(0xf, 0x3, 0x2) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r7, 0xae03, 0xbe) sendmsg$key(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="02090000020000000000000000006ed50d169fd1259a4008814b921f312bdff9490675285f56e698679723b433298a597a017f02c5d6ebed91840ceb992d349e05fa69619c"], 0x10}}, 0x0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0xba01}, 0x0) socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGPGRP(r8, 0x8904, &(0x7f00000000c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x4008031, 0xffffffffffffffff, 0x0) 2.284514892s ago: executing program 5 (id=3779): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) timer_settime(r0, 0x1, &(0x7f0000000000)={{r1, r2+60000000}}, 0x0) modify_ldt$read(0x0, &(0x7f0000000100)=""/77, 0x4d) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x3, 0x61, 0x400, 0x5, 0x9, 0x5, 0x4b85, 0x0, 0x7}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) select(0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000c4b20710200e01015a000000000109021b00010000000009040000012e6d0a000905", @ANYBLOB="19e6c5"], 0x0) 1.310466514s ago: executing program 2 (id=3780): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c00000012003b77"], 0x4c}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000005200010001000000fcdbdf250a00000008000100", @ANYRES64=r1], 0x1c}, 0x1, 0x0, 0x0, 0x2800c815}, 0x40084) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x80}], 0x1, 0x0) recvmmsg(r5, &(0x7f0000005dc0)=[{{0x0, 0x0, &(0x7f00000036c0)=[{&(0x7f0000002100)=""/1, 0x1}, {&(0x7f0000002140)=""/234, 0xea}], 0x2}, 0x9}], 0x1, 0x2200, 0x0) r6 = syz_open_dev$sndctrl(&(0x7f00000012c0), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r6, 0xc2c45512, &(0x7f0000000a00)={{0x5, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, [0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000]}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x28, 0x0, 0x800, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffc, 0x14}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x8004}, 0x24000000) fsmount(0xffffffffffffffff, 0x0, 0xa) r7 = fanotify_init(0x1a, 0x800) fanotify_mark(r7, 0x1, 0x4800003a, 0xffffffffffffffff, 0x0) ftruncate(r3, 0xb66f) sendfile(r0, r2, 0x0, 0x7ffff004) socket$can_raw(0x1d, 0x3, 0x1) r8 = syz_io_uring_setup(0x222f, &(0x7f0000000280)={0x0, 0x20002, 0x10100}, &(0x7f0000000080)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r9, r10, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x3, 0x800000, 0x0, 0x0, 0x13}) io_uring_enter(r8, 0x53d1, 0x0, 0x4, 0x0, 0x0) 1.162005079s ago: executing program 4 (id=3781): sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000629bd70000e0000000e0000000c000a800800038004000180"], 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x41) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000240)=ANY=[@ANYBLOB="d8010000", @ANYRES16=r1, @ANYBLOB="010000000000fbdbdf2501000000080005000100000006000600234e00001400020077673200003f0000000000000000000024000300a0cb879a47f5bc644c0e690100000001000000b6e901b9ff2f518c78042fb5427c0108"], 0x1d8}}, 0x0) 1.130731352s ago: executing program 4 (id=3782): socket$inet6(0xa, 0x80002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r1, 0x0, 0x24040013) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x2, 0xbfdffffc}, 0x0, &(0x7f0000000280)) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000004100000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r5], 0x90}, 0x1, 0x0, 0x0, 0x800}, 0x0) 1.022367544s ago: executing program 2 (id=3783): syz_usb_connect(0x3, 0x85, &(0x7f0000000080)={{0x12, 0x1, 0x250, 0x33, 0x58, 0xe3, 0x10, 0x424, 0xcf30, 0x9276, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x73, 0x1, 0x9f, 0x5, 0xc0, 0x5, [{{0x9, 0x4, 0x83, 0x5, 0x1, 0xab, 0xd9, 0x7f, 0x3, [], [{{0x9, 0x5, 0x1, 0x2, 0x10, 0x7, 0x80, 0xc8, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x3, 0x4}, @generic={0x51, 0x15, "8f7cfd1e9e46b42d3b7b926ba602d52847e4119020bf469415913bd6df210a9251e577bea7d55026a4e2895e0e89286fb89c6e38f72c0d2e4f3ddfc6e169117e09b0d38151282c6e83fc4d76a42ce9"}]}}]}}]}}]}}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) 907.226146ms ago: executing program 4 (id=3784): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_HASH_TYPE={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_HASH_MODULUS={0x8, 0x4, 0x1, 0x0, 0xac}, @NFTA_HASH_DREG={0x8, 0x2, 0x1, 0x0, 0x8}]}}}]}]}], {0x14}}, 0x84}, 0x1, 0x0, 0x24000000}, 0x600c0) 890.148083ms ago: executing program 4 (id=3785): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, 0x30, 0x0, @in6={0xa, 0x4e24, 0x609a, @private2, 0x1}, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000001600"}, 0x0, 0x1, 0x4}}}, 0x118) 813.879559ms ago: executing program 4 (id=3786): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000000)={'sit0\x00', {0x2, 0x4e26, @rand_addr=0xdffffc13}}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000080)={'wlan0\x00', &(0x7f0000000000)=@ethtool_gstrings={0x1b, 0x2}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, 0x0, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) ioctl$PPPOEIOCDFWD(0xffffffffffffffff, 0xb101, 0x0) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000240)=[@mss, @sack_perm, @timestamp, @sack_perm, @window, @window={0x3, 0x2, 0xe}, @timestamp, @timestamp], 0x8) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0), 0xc7) sendto$inet(r4, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/net\x00') r5 = gettid() timer_create(0x0, 0x0, 0x0) move_pages(0x0, 0x3, &(0x7f0000000040)=[&(0x7f0000a0d000/0x3000)=nil, &(0x7f0000a77000/0x3000)=nil, &(0x7f0000a3a000/0x1000)=nil], &(0x7f0000000100)=[0x1], &(0x7f0000000380), 0x2) sched_setattr(r5, &(0x7f0000000100)={0x38, 0x6, 0x70, 0x200000, 0x0, 0x0, 0xf, 0x85d}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) open(0x0, 0x6440, 0xb9) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000580)="6700000011008188040f56ecdb4cb9cca7480ef432000000e3bd6efb440009000e000a0010000000ba80010000005a8c3774fa0af3dc59a933c1e7a6d3361d83b20003319cdf5656826edaaa11032701c61ec666d482078ccebcb9a4f187f7a4e98f09cdc2649f", 0x67}], 0x1}, 0x0) r7 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f0000000100)={@empty}, 0x14) 788.021108ms ago: executing program 3 (id=3787): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x39) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000400)='dctcp\x00', 0x6) sendto$inet(r0, 0x0, 0x0, 0x200007ed, &(0x7f0000000300)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmsg$inet_sctp(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000002c0)="818b121b", 0x4}], 0x1, 0x0, 0x0, 0x4}, 0x20000041) r1 = syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x1) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000640)={0x53, 0xfffffffffffffffe, 0x6, 0x53, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000480)="4c18661d14fd", 0x0, 0x9, 0x14, 0x0, 0x0}) r2 = openat$vimc1(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f00000001c0)={0xc, 0x140000, 0x1}) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r4) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r4, &(0x7f0000002c00)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x2046}, {{0x0, 0x0, 0x0}, 0x401}, {{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, 0x0}, 0x40}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000540)=""/107, 0x6b}, {&(0x7f0000004500)=""/4112, 0x1010}, {&(0x7f0000001900)=""/4093, 0xffd}, {&(0x7f0000000900)=""/100, 0x64}, {&(0x7f0000000040)=""/96, 0x60}, {&(0x7f0000000340)=""/63, 0x3f}, {&(0x7f00000000c0)=""/107, 0x6b}, {&(0x7f0000000800)=""/114, 0x72}, {&(0x7f0000001800)=""/203, 0xcb}], 0x9}, 0x4}, {{0x0, 0x0, 0x0}, 0x8}], 0x8, 0x2, 0x0) r5 = socket(0x40000000015, 0x5, 0x0) bind$inet(r5, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r5, 0x0, 0xf4ff, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000000)={0x0, 0x7}, &(0x7f0000000040)=0x8) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x6, 'wlan1\x00', {}, 0x108}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01090000000000000f478e"]) r6 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f00000004c0)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0x2, 0x4002004c4, 0x413, 0x0, 0x0, 0x0, 0x900f, 0x9, 0xd57b, 0x0, 0x4], 0xeeee8000, 0x2113c0}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) 435.088047ms ago: executing program 3 (id=3788): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @local}, 0x1c) syz_genetlink_get_family_id$ethtool(&(0x7f0000000840), 0xffffffffffffffff) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newlink={0x4c, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL={0x5, 0x3, 0x1}, @IFLA_GENEVE_DF={0x5, 0xd, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0xac}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x200008e5) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x17, 0x0, 0x0) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000000), 0x4) 348.720108ms ago: executing program 1 (id=3789): r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x4d, &(0x7f0000000040)=0x7, 0x4) socket$inet6(0xa, 0x3, 0x1) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) openat$mixer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000040)={0xf0f023}) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) fcntl$dupfd(r1, 0x0, r1) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc001}, 0x800) fsopen(&(0x7f0000000140)='nilfs2\x00', 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r6, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000002540)=[{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000640)="8256a3f765617d33111f6e95c27940f2", 0x10}], 0x1, 0x0, 0x0, 0x404c045}], 0x1, 0x40800) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 0s ago: executing program 3 (id=3790): r0 = socket$nl_route(0x10, 0x3, 0x0) writev(0xffffffffffffffff, &(0x7f0000003800)=[{&(0x7f0000000400)="2cacbf38276c37d5d828db9be6605acad320b39bf4d176fcfc15", 0x1a}], 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="70000000100001000000001800000000000000c3", @ANYRES32=r1, @ANYBLOB="000000002f95abbe480012800e0001006970366772657461700000003400028008000100", @ANYRES32=r1, @ANYBLOB="140006bc5880000000000000000000000000000014000700ff"], 0x70}}, 0x0) kernel console output (not intermixed with test programs): 8.918288][T10553] usb 3-1: config 0 interface 0 has no altsetting 0 [ 858.947312][T10553] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 858.973117][T10553] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 859.001788][T10553] usb 3-1: Product: syz [ 859.014617][T10553] usb 3-1: Manufacturer: syz [ 859.026895][T10553] usb 3-1: SerialNumber: syz [ 859.060711][T10553] usb 3-1: config 0 descriptor?? [ 859.343459][T16896] netlink: 256 bytes leftover after parsing attributes in process `syz.5.3146'. [ 859.430200][T16893] tipc: Started in network mode [ 859.435397][T16893] tipc: Node identity 26d79023dd13, cluster identity 4711 [ 859.443036][T16893] tipc: Enabled bearer , priority 0 [ 859.453919][T16893] syzkaller0: entered promiscuous mode [ 859.459987][T16893] syzkaller0: entered allmulticast mode [ 859.698865][T16901] netlink: 'syz.4.3150': attribute type 6 has an invalid length. [ 859.762960][T10553] gs_usb 3-1:0.0: Configuring for 3 interfaces [ 859.786284][T16892] tipc: Resetting bearer [ 860.076955][T10553] gs_usb 3-1:0.0: Couldn't get bit timing const for channel 0 (-EREMOTEIO) [ 860.096862][T10553] gs_usb 3-1:0.0: probe with driver gs_usb failed with error -121 [ 860.116444][T16892] tipc: Disabling bearer [ 860.152280][T16905] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3151'. [ 860.350699][T16872] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3142'. [ 860.392024][ T9] usb 3-1: USB disconnect, device number 74 [ 860.602062][T16911] Unknown options in mask b7f2 [ 860.625679][T10553] usb 2-1: new full-speed USB device number 83 using dummy_hcd [ 860.808000][T10553] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 860.819329][T10553] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 860.831908][T10553] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 860.845302][T10553] usb 2-1: New USB device found, idVendor=1b96, idProduct=0009, bcdDevice= 0.00 [ 860.854398][T10553] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 860.875580][T10553] usb 2-1: config 0 descriptor?? [ 860.955057][ T9] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 861.107343][T10553] usbhid 2-1:0.0: can't add hid device: -71 [ 861.113430][T10553] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 861.127017][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 861.138994][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 861.149625][ T9] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 861.159155][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 861.174559][T10553] usb 2-1: USB disconnect, device number 83 [ 861.218466][ T9] usb 4-1: SerialNumber: syz [ 861.867006][T16932] bond3: entered promiscuous mode [ 862.211553][T16936] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3159'. [ 862.346970][T16923] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3159'. [ 862.586420][ T3196] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 862.747117][ T3196] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 862.778352][ T3196] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 862.818662][ T3196] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 862.843904][ T3196] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 862.864767][ T3196] usb 2-1: SerialNumber: syz [ 863.092680][T16942] syz_tun: entered promiscuous mode [ 863.106056][T16942] batadv_slave_0: entered promiscuous mode [ 863.114121][ T3196] usb 2-1: 0:2 : does not exist [ 863.117286][T16942] hsr2: entered allmulticast mode [ 863.129564][T16942] syz_tun: entered allmulticast mode [ 863.138540][T16942] batadv_slave_0: entered allmulticast mode [ 863.145861][ T3196] usb 2-1: unit 16 not found! [ 863.221709][ T3196] usb 2-1: USB disconnect, device number 84 [ 863.350566][T16224] udevd[16224]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 863.553822][T16956] tap0: tun_chr_ioctl cmd 1074025677 [ 863.563587][T16956] tap0: linktype set to 825 [ 863.727122][ T9] usb 4-1: 0:2 : does not exist [ 863.881017][ T9] usb 4-1: USB disconnect, device number 69 [ 864.223587][T16962] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3164'. [ 864.235491][T16962] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 865.266949][T16971] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3171'. [ 866.100484][T16984] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3175'. [ 866.445083][ T9] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 866.628310][T16997] loop2: detected capacity change from 0 to 7 [ 866.638139][T16997] loop2: [POWERTEC] p1 p2 p3 p4 [ 866.644776][T16997] loop2: p1 size 1114112 extends beyond EOD, truncated [ 866.656049][T16997] loop2: p2 start 393215 is beyond EOD, truncated [ 866.662600][T16997] loop2: p3 start 1635021614 is beyond EOD, truncated [ 866.698160][T16997] loop2: p4 start 1680801792 is beyond EOD, truncated [ 866.889597][T16265] udevd[16265]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 867.365075][ T5871] Bluetooth: hci1: command 0x0406 tx timeout [ 869.171254][T17030] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3187'. [ 869.257928][T17030] bond0: ARP target 170.170.170.170 is already present [ 869.301414][T17030] bond0: option arp_ip_target: invalid value (2863311530) [ 869.491097][ T9] usb 4-1: device descriptor read/64, error -71 [ 869.741351][ T9] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 869.764990][ T5945] usb 6-1: new low-speed USB device number 14 using dummy_hcd [ 869.935137][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 869.948396][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 869.968745][ T5945] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 869.992591][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 870.013147][ T5945] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 870.048130][ T9] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 870.078700][ T5945] usb 6-1: New USB device found, idVendor=12d1, idProduct=42f7, bcdDevice=aa.47 [ 870.090173][ T9] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x7E, changing to 0xE [ 870.107957][ T5945] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 870.122319][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 870.168591][ T5945] usb 6-1: config 0 descriptor?? [ 870.174493][ T9] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xE has invalid maxpacket 0 [ 870.204110][ T9] usb 4-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 870.243811][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 870.277297][ T9] usb 4-1: config 0 descriptor?? [ 870.517793][ T5967] usb 4-1: USB disconnect, device number 71 [ 870.530190][T17058] pimreg: entered allmulticast mode [ 870.551813][T17037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 870.595843][T17037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 870.635459][T17061] pimreg: left allmulticast mode [ 871.511646][T17077] batadv0: entered promiscuous mode [ 871.776201][T17077] vlan3: entered promiscuous mode [ 872.535165][ T36] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 872.575358][T15348] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 872.613275][T15348] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 872.664729][T15348] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 872.949376][T17087] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 874.019301][T17093] netlink: 'syz.3.3211': attribute type 21 has an invalid length. [ 874.027516][T17093] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3211'. [ 874.048918][T17093] netlink: 'syz.3.3211': attribute type 5 has an invalid length. [ 874.098904][ T5945] usb 6-1: string descriptor 0 read error: -71 [ 874.103981][T17093] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3211'. [ 874.178888][ T5945] qmi_wwan 6-1:0.0: probe with driver qmi_wwan failed with error -22 [ 874.250420][ T5945] usb 6-1: USB disconnect, device number 14 [ 874.474747][T17100] loop2: detected capacity change from 0 to 7 [ 874.483155][T16265] Dev loop2: unable to read RDB block 7 [ 874.490078][T16265] loop2: unable to read partition table [ 874.496371][T16265] loop2: partition table beyond EOD, truncated [ 874.503714][T17100] Dev loop2: unable to read RDB block 7 [ 874.510109][T17100] loop2: unable to read partition table [ 874.520519][T17100] loop2: partition table beyond EOD, truncated [ 874.532607][T17100] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 874.920835][T17112] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3219'. [ 874.942882][T17112] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 875.287917][ T30] audit: type=1800 audit(1757775198.297:305): pid=17119 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.3218" name="SYSV00000000" dev="hugetlbfs" ino=1 res=0 errno=0 [ 875.495548][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 875.501863][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 875.584974][ T5945] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 875.594932][ T1212] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 875.605082][ T5967] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 875.774487][ T1212] usb 4-1: Using ep0 maxpacket: 8 [ 875.792806][ T5967] usb 6-1: Using ep0 maxpacket: 16 [ 875.801657][ T5967] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 875.813740][ T5967] usb 6-1: config 0 interface 0 has no altsetting 0 [ 875.863475][ T1212] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 875.912381][ T1212] usb 4-1: config 1 has no interface number 1 [ 875.914294][ T5967] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 875.932817][ T5967] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 875.952081][ T1212] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 875.963508][ T5967] usb 6-1: config 0 descriptor?? [ 875.999483][ T1212] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 876.015396][ T1212] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 876.027822][T17129] input: syz1 as /devices/virtual/input/input40 [ 876.131670][ T1212] usb 4-1: Product: syz [ 876.158828][ T1212] usb 4-1: Manufacturer: syz [ 876.179704][ T5945] usb 5-1: config 0 has an invalid interface number: 64 but max is 0 [ 876.213434][ T5945] usb 5-1: config 0 has no interface number 0 [ 876.220373][ T1212] usb 4-1: SerialNumber: syz [ 876.325879][ T5945] usb 5-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 876.346517][ T5945] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 876.383492][ T5945] usb 5-1: Product: syz [ 876.415420][ T5945] usb 5-1: Manufacturer: syz [ 876.429839][ T5945] usb 5-1: SerialNumber: syz [ 876.438419][ T5945] usb 5-1: config 0 descriptor?? [ 876.458951][ T5967] nzxt-smart2 0003:1E71:2009.001D: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.5-1/input0 [ 876.840249][T10553] usb 6-1: USB disconnect, device number 15 [ 877.175664][T17143] netlink: 'syz.1.3228': attribute type 21 has an invalid length. [ 877.183611][T17143] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3228'. [ 877.196821][T17143] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3228'. [ 877.843582][T17146] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3229'. [ 877.872010][T17146] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3229'. [ 878.102745][ T1212] usb 4-1: 2:1 : format type 0 is detected, processed as PCM [ 878.115488][ T1212] usb 4-1: 2:1 : sample bitwidth 243 in over sample bytes 3 [ 878.184050][ T1212] usb 4-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 878.245048][ T1212] usb 4-1: 2:1 : invalid channels 0 [ 878.325376][ T1212] usb 4-1: USB disconnect, device number 72 [ 878.475752][T16265] udevd[16265]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 878.924143][ T5945] usb 5-1: Found UVC 0.08 device syz (046d:0823) [ 878.938796][ T5945] uvcvideo 5-1:0.64: Entity type for entity Output 3 was not initialized! [ 878.966335][ T5945] usb 5-1: Failed to create links for entity 3 [ 878.982813][ T5945] usb 5-1: Failed to register entities (-22). [ 879.022753][ T5945] usb 5-1: USB disconnect, device number 90 [ 879.453317][T17175] Unknown options in mask b7f2 [ 879.459345][T17176] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3241'. [ 880.521894][T17189] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3246'. [ 880.615074][T17189] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3246'. [ 880.749653][T17189] bridge0: entered promiscuous mode [ 880.760007][T17189] batadv_slave_1: entered promiscuous mode [ 880.794180][T17189] debugfs: 'hsr1' already exists in 'hsr' [ 880.824729][T17189] Cannot create hsr debugfs directory [ 881.444949][ T5945] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 881.556693][T17205] bond2: entered promiscuous mode [ 881.594909][ T5945] usb 2-1: Using ep0 maxpacket: 16 [ 881.601778][ T5945] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 881.615230][ T5945] usb 2-1: config 0 interface 0 has no altsetting 0 [ 881.622824][ T5945] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 881.644083][ T5945] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 881.692358][ T5945] usb 2-1: config 0 descriptor?? [ 881.976018][T17211] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3251'. [ 882.121590][T17211] misc userio: The device must be registered before sending interrupts [ 882.168272][ T5945] nzxt-smart2 0003:1E71:2009.001E: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.1-1/input0 [ 882.511444][T17201] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3249'. [ 882.522418][T17201] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3249'. [ 882.587870][ T5945] usb 2-1: USB disconnect, device number 85 [ 882.694315][ T5871] Bluetooth: hci3: command 0x0406 tx timeout [ 883.772592][T17226] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 883.779183][T17226] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 883.794475][T17226] vhci_hcd vhci_hcd.0: Device attached [ 883.820810][T17226] vhci_hcd vhci_hcd.0: pdev(5) rhport(1) sockfd(5) [ 883.827346][T17226] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 883.850145][T17226] vhci_hcd vhci_hcd.0: Device attached [ 883.863610][T17229] vhci_hcd: connection closed [ 883.865248][T17227] vhci_hcd: connection closed [ 883.943694][ T36] vhci_hcd: stop threads [ 883.972803][ T36] vhci_hcd: release socket [ 883.986587][ T36] vhci_hcd: disconnect device [ 883.989891][T17232] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3256'. [ 884.036229][ T1212] usb 43-1: new low-speed USB device number 3 using vhci_hcd [ 884.046400][ T36] vhci_hcd: stop threads [ 884.054521][ T36] vhci_hcd: release socket [ 884.080821][ T36] vhci_hcd: disconnect device [ 884.182909][T17236] binder: BINDER_SET_CONTEXT_MGR already set [ 884.192010][T17236] binder: 17235:17236 ioctl 4018620d 80000040 returned -16 [ 885.624982][ T5945] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 885.708722][T17250] syz_tun: entered promiscuous mode [ 885.717309][T17250] batadv_slave_0: entered promiscuous mode [ 885.724229][T17250] debugfs: 'hsr1' already exists in 'hsr' [ 885.732296][T17250] Cannot create hsr debugfs directory [ 885.737914][ T9] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 885.750245][T17250] hsr1: entered allmulticast mode [ 885.756155][T17250] syz_tun: entered allmulticast mode [ 885.761651][T17250] batadv_slave_0: entered allmulticast mode [ 885.826864][ T5945] usb 4-1: config 0 has an invalid interface number: 48 but max is 0 [ 885.836190][ T30] audit: type=1326 audit(1757775208.977:306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17252 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb7539 code=0x7ffc0000 [ 885.858201][ C0] vkms_vblank_simulate: vblank timer overrun [ 885.872698][ T5945] usb 4-1: config 0 has no interface number 0 [ 885.901996][ T5945] usb 4-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 885.910204][ T30] audit: type=1326 audit(1757775208.997:307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17252 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb7539 code=0x7ffc0000 [ 885.911381][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 885.960711][ T30] audit: type=1326 audit(1757775209.017:308): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17252 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf7fb7539 code=0x7ffc0000 [ 885.964912][ T5945] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 885.987421][ T30] audit: type=1326 audit(1757775209.017:309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17252 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb7539 code=0x7ffc0000 [ 886.032477][ T30] audit: type=1326 audit(1757775209.017:310): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17252 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb7539 code=0x7ffc0000 [ 886.055415][ T5945] usb 4-1: Product: syz [ 886.101370][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 886.114135][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 886.114235][ T30] audit: type=1326 audit(1757775209.017:311): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17252 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf7fb7539 code=0x7ffc0000 [ 886.163308][ T5945] usb 4-1: Manufacturer: syz [ 886.214609][ T5945] usb 4-1: SerialNumber: syz [ 886.231381][ T9] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 886.249768][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.273106][ T5945] usb 4-1: config 0 descriptor?? [ 886.297494][ T30] audit: type=1326 audit(1757775209.017:312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17252 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb7539 code=0x7ffc0000 [ 886.324231][ T9] usb 6-1: config 0 descriptor?? [ 886.347761][ T9] hub 6-1:0.0: USB hub found [ 886.353471][ T30] audit: type=1326 audit(1757775209.017:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17252 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf7fb7539 code=0x7ffc0000 [ 886.388351][ T30] audit: type=1326 audit(1757775209.017:314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17252 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb7539 code=0x7ffc0000 [ 886.411864][ T30] audit: type=1326 audit(1757775209.017:315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17252 comm="syz.4.3263" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fb7539 code=0x7ffc0000 [ 886.466394][T17258] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3264'. [ 886.493092][T17258] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 886.520381][ T5945] usb 4-1: USB disconnect, device number 73 [ 886.893348][T17268] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3267'. [ 887.112604][T17274] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3270'. [ 887.139035][T17274] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3270'. [ 887.181495][T17276] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3271'. [ 887.234543][T17274] erspan0: entered promiscuous mode [ 887.285098][ T5967] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 887.306929][T17274] gretap0: entered promiscuous mode [ 887.313078][T17274] debugfs: 'hsr1' already exists in 'hsr' [ 887.327078][T17274] Cannot create hsr debugfs directory [ 887.435122][ T5967] usb 2-1: Using ep0 maxpacket: 8 [ 887.449267][ T5967] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 887.464377][ T5967] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 887.478108][ T5967] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 887.506609][ T5967] usb 2-1: config 0 descriptor?? [ 887.779241][T17273] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 887.796721][T17273] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 887.825841][ T5967] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 888.158079][T17292] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3277'. [ 888.243638][ T5945] usb 2-1: USB disconnect, device number 86 [ 888.591882][ T9] hub 6-1:0.0: config failed, can't read hub descriptor (err -22) [ 888.626029][ T9] usbhid 6-1:0.0: can't add hid device: -71 [ 888.632082][ T9] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 888.717540][ T9] usb 6-1: USB disconnect, device number 16 [ 888.964107][T17314] netlink: 'syz.5.3286': attribute type 10 has an invalid length. [ 888.991247][T17314] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3286'. [ 889.002410][T17318] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 889.042086][T17314] team0: entered promiscuous mode [ 889.097683][T17314] team_slave_0: entered promiscuous mode [ 889.104767][T17314] team_slave_1: entered promiscuous mode [ 889.121285][T17314] team0: entered allmulticast mode [ 889.141217][T17314] team_slave_0: entered allmulticast mode [ 889.147223][T17314] team_slave_1: entered allmulticast mode [ 889.172210][T17292] netlink: 'syz.2.3277': attribute type 1 has an invalid length. [ 889.214695][T17314] bridge0: port 3(team0) entered blocking state [ 889.221336][ T1212] vhci_hcd: vhci_device speed not set [ 889.227060][T17314] bridge0: port 3(team0) entered disabled state [ 889.236008][T17292] netlink: 168864 bytes leftover after parsing attributes in process `syz.2.3277'. [ 889.258140][T17314] bridge0: port 3(team0) entered blocking state [ 889.264534][T17314] bridge0: port 3(team0) entered forwarding state [ 889.343729][T17325] bond0: (slave veth0_to_hsr): Error: Device can not be enslaved while up [ 890.167012][ T3196] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 890.344969][ T3196] usb 6-1: Using ep0 maxpacket: 32 [ 890.351878][ T3196] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 890.383100][ T3196] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 890.477237][ T3196] usb 6-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 890.500214][ T3196] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 890.543580][ T3196] usb 6-1: Product: syz [ 890.562846][ T3196] usb 6-1: Manufacturer: syz [ 890.578046][ T3196] usb 6-1: SerialNumber: syz [ 890.605231][ T3196] usb 6-1: config 0 descriptor?? [ 891.405374][T17352] sch_tbf: peakrate 64 is lower than or equals to rate 2147483649 ! [ 891.492391][T17356] loop8: detected capacity change from 0 to 7 [ 891.526530][T17356] Dev loop8: unable to read RDB block 7 [ 891.544252][T17356] loop8: unable to read partition table [ 891.590112][T17356] loop8: partition table beyond EOD, truncated [ 891.610087][T17356] loop_reread_partitions: partition scan of loop8 (þ被xüŸÑø éÚ¬§½dƤ´à–ƒÝ¡¯¨â·û [ 891.610087][T17356] ) failed (rc=-5) [ 891.717743][T17359] batadv0: entered promiscuous mode [ 891.761576][T17359] vlan2: entered promiscuous mode [ 891.783225][T17361] loop6: detected capacity change from 0 to 7 [ 891.823180][T17361] Dev loop6: unable to read RDB block 7 [ 891.833324][T17361] loop6: unable to read partition table [ 891.862948][T17361] loop6: partition table beyond EOD, truncated [ 891.891551][T17361] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 891.999276][ T3196] usb 6-1: USB disconnect, device number 17 [ 892.283104][T17375] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3307'. [ 892.608944][T17388] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 892.663668][T17388] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 892.743437][T17388] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 892.756597][T17388] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 892.784994][ T9] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 892.855308][ T3196] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 892.959565][T17399] loop2: detected capacity change from 0 to 7 [ 892.973903][T17399] Dev loop2: unable to read RDB block 7 [ 892.979586][T17399] loop2: unable to read partition table [ 892.986392][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 892.996249][ T9] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 893.005212][T17399] loop2: partition table beyond EOD, [ 893.010910][ T9] usb 3-1: config 0 interface 0 has no altsetting 0 [ 893.012319][T17399] truncated [ 893.021176][ T9] usb 3-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 893.039877][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 893.140815][T17399] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 893.223069][ T30] kauditd_printk_skb: 24 callbacks suppressed [ 893.223089][ T30] audit: type=1800 audit(1757775216.357:340): pid=17402 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3313" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 893.275772][ T9] usb 3-1: config 0 descriptor?? [ 893.565060][ T1212] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 893.747681][ T1212] usb 6-1: Using ep0 maxpacket: 8 [ 893.755251][ T9] nzxt-smart2 0003:1E71:2009.001F: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.2-1/input0 [ 893.801033][ T1212] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 893.825368][ T1212] usb 6-1: config 1 has no interface number 1 [ 893.833451][ T1212] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 893.911481][ T1212] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 893.922162][ T1212] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 893.941792][ T1212] usb 6-1: Product: syz [ 893.962918][ T1212] usb 6-1: Manufacturer: syz [ 893.974869][ T1212] usb 6-1: SerialNumber: syz [ 894.147186][ T5952] usb 3-1: USB disconnect, device number 75 [ 894.365031][ T9] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 894.508789][T17410] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3317'. [ 894.515024][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 894.532611][ T9] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 894.541498][ T9] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 894.590171][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 894.644037][ T9] usb 4-1: config 1 has no interface number 0 [ 894.696030][ T9] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 894.720617][ T9] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 894.754159][ T9] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 894.781013][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 894.830518][ T9] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 895.010095][ T9] snd_usb_pod 4-1:1.1: invalid control EP [ 895.016124][ T9] snd_usb_pod 4-1:1.1: cannot start listening: -22 [ 895.022984][ T9] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 895.082457][ T9] snd_usb_pod 4-1:1.1: probe with driver snd_usb_pod failed with error -22 [ 895.214059][ T9] usb 4-1: USB disconnect, device number 75 [ 895.659004][T17429] kAFS: unable to lookup cell '(,c8bÙí80»PÞûL' [ 895.881503][T17432] netlink: 100 bytes leftover after parsing attributes in process `syz.1.3325'. [ 896.004506][ T1212] usb 6-1: 2:1 : format type 0 is detected, processed as PCM [ 896.053621][ T1212] usb 6-1: 2:1 : sample bitwidth 243 in over sample bytes 3 [ 896.118520][ T1212] usb 6-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 896.124699][ T1212] usb 6-1: 2:1 : invalid channels 0 [ 896.186439][ T1212] usb 6-1: USB disconnect, device number 18 [ 896.248341][T16265] udevd[16265]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 896.345025][T10553] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 896.423278][T17449] mmap: syz.4.3332 (17449): VmData 37384192 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 896.519995][T10553] usb 3-1: Using ep0 maxpacket: 16 [ 896.531274][T17453] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3336'. [ 896.551079][T10553] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 896.563572][T10553] usb 3-1: New USB device found, idVendor=054c, idProduct=024b, bcdDevice= 0.00 [ 896.605026][T10553] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 896.648916][T10553] usb 3-1: config 0 descriptor?? [ 896.687418][T17461] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3338'. [ 896.740865][T17464] Unknown options in mask b7f2 [ 896.764976][ T1212] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 896.873364][T17469] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3341'. [ 896.894699][T17469] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3341'. [ 896.915168][ T1212] usb 2-1: device descriptor read/64, error -71 [ 897.114207][T17437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 897.153328][T17437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 897.161532][ T1212] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 897.281409][T10553] sony 0003:054C:024B.0020: hiddev0,hidraw0: USB HID vff.fb Device [HID 054c:024b] on usb-dummy_hcd.2-1/input0 [ 897.323018][T17478] tap0: tun_chr_ioctl cmd 1074025677 [ 897.329367][T17478] tap0: linktype set to 825 [ 897.353656][T10553] sony 0003:054C:024B.0020: failed to claim input [ 897.357696][ T1212] usb 2-1: device descriptor read/64, error -71 [ 897.418792][T10553] usb 3-1: USB disconnect, device number 76 [ 897.495907][ T1212] usb usb2-port1: attempt power cycle [ 897.543321][T17479] fido_id[17479]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 897.855840][ T1212] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 897.885052][ T3196] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 897.885814][ T1212] usb 2-1: device descriptor read/8, error -71 [ 898.034984][ T3196] usb 6-1: device descriptor read/64, error -71 [ 898.154949][ T1212] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 898.207033][ T1212] usb 2-1: device descriptor read/8, error -71 [ 898.275008][ T3196] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 898.335398][ T1212] usb usb2-port1: unable to enumerate USB device [ 898.415245][ T3196] usb 6-1: device descriptor read/64, error -71 [ 898.525308][ T3196] usb usb6-port1: attempt power cycle [ 898.872101][T17493] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3349'. [ 898.885553][ T3196] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 898.915682][ T3196] usb 6-1: device descriptor read/8, error -71 [ 899.005362][T10553] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 899.146290][T17499] kAFS: unable to lookup cell 'Þ({^ú@' [ 899.155096][ T3196] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 899.177498][T10553] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 899.192291][ T3196] usb 6-1: device descriptor read/8, error -71 [ 899.214008][T10553] usb 4-1: New USB device found, idVendor=03da, idProduct=2820, bcdDevice=52.3c [ 899.239043][T10553] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 899.269667][T10553] usb 4-1: config 0 descriptor?? [ 899.291186][T10553] usb 4-1: bad CDC descriptors [ 899.319337][ T3196] usb usb6-port1: unable to enumerate USB device [ 899.498078][T10553] usb 4-1: USB disconnect, device number 76 [ 899.675328][T17505] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3352'. [ 899.696206][T17505] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3352'. [ 899.715603][T17505] bridge0: entered promiscuous mode [ 899.722374][T17505] batadv_slave_1: entered promiscuous mode [ 899.731994][T17505] debugfs: 'hsr2' already exists in 'hsr' [ 899.737893][T17505] Cannot create hsr debugfs directory [ 899.942106][T17510] netlink: 'syz.1.3354': attribute type 5 has an invalid length. [ 900.378368][T17519] netlink: 100 bytes leftover after parsing attributes in process `syz.5.3356'. [ 900.383535][T17520] input: syz0 as /devices/virtual/input/input41 [ 900.394093][ T5945] usb 4-1: new full-speed USB device number 77 using dummy_hcd [ 900.554133][ T5945] usb 4-1: New USB device found, idVendor=07c9, idProduct=0012, bcdDevice=c2.f4 [ 900.594518][ T5945] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 900.623231][ T5945] usb 4-1: Product: syz [ 900.639463][ T5945] usb 4-1: Manufacturer: syz [ 900.665404][ T5945] usb 4-1: SerialNumber: syz [ 900.673657][ T5945] usb 4-1: config 0 descriptor?? [ 900.966547][T17548] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3355'. [ 901.564972][ T3196] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 901.692883][T17566] netlink: 100 bytes leftover after parsing attributes in process `syz.4.3375'. [ 901.720911][ T3196] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 901.730473][ T3196] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.750791][ T3196] usb 2-1: Product: syz [ 901.760974][ T3196] usb 2-1: Manufacturer: syz [ 901.772859][ T3196] usb 2-1: SerialNumber: syz [ 902.476030][ T3196] rtl8150 2-1:1.0: couldn't reset the device [ 902.552796][ T3196] rtl8150 2-1:1.0: probe with driver rtl8150 failed with error -5 [ 902.634304][ T3196] usb 2-1: USB disconnect, device number 91 [ 903.148565][T10553] usb 4-1: USB disconnect, device number 77 [ 903.210789][T17588] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3383'. [ 903.260892][T17588] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3383'. [ 903.414987][ T3196] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 903.484912][ T5945] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 903.545120][ T3196] usb 2-1: device descriptor read/64, error -71 [ 903.679160][ T5945] usb 5-1: New USB device found, idVendor=05ac, idProduct=0290, bcdDevice=dc.1b [ 903.762296][ T5945] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 903.945514][ T3196] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 903.947368][ T5945] usb 5-1: config 0 descriptor?? [ 903.984689][ T5945] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input42 [ 904.014654][T10553] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 904.115363][ T3196] usb 2-1: device descriptor read/64, error -71 [ 904.245639][ T3196] usb usb2-port1: attempt power cycle [ 904.280239][T10553] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 904.344406][T10553] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 904.365250][ T5952] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 904.378054][T10553] usb 4-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 904.410557][T10553] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 904.440217][T10553] usb 4-1: config 0 descriptor?? [ 904.534906][ T5952] usb 3-1: Using ep0 maxpacket: 32 [ 904.635449][ T3196] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 904.655998][ T3196] usb 2-1: device descriptor read/8, error -71 [ 904.779356][T10553] usbhid 4-1:0.0: can't add hid device: -71 [ 904.799968][ T5952] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 904.820998][T10553] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 904.821017][ T5952] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 904.861079][ T5952] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 904.862814][T10553] usb 4-1: USB disconnect, device number 78 [ 904.888845][ T5952] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 904.895256][ T3196] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 904.936585][ T3196] usb 2-1: device descriptor read/8, error -71 [ 905.029374][ T5952] usb 3-1: config 0 descriptor?? [ 905.046502][ T3196] usb usb2-port1: unable to enumerate USB device [ 905.162348][ T5952] hub 3-1:0.0: USB hub found [ 905.520121][T17624] netlink: 'syz.5.3393': attribute type 6 has an invalid length. [ 905.713755][T15926] usb 5-1: USB disconnect, device number 91 [ 905.719932][ T3196] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 905.974427][ T3196] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 906.002013][ T3196] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 906.191810][ T3196] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 906.245222][ T3196] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 906.273348][ T3196] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 906.526307][ T3196] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 906.572211][ T3196] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 906.587375][ T3196] usb 4-1: Product: syz [ 906.591774][ T3196] usb 4-1: Manufacturer: syz [ 906.608963][ T5945] usb 5-1: new full-speed USB device number 92 using dummy_hcd [ 906.619112][ T3196] cdc_wdm 4-1:1.0: skipping garbage [ 906.626025][ T3196] cdc_wdm 4-1:1.0: skipping garbage [ 906.633560][ T3196] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 906.709709][ T3196] cdc_wdm 4-1:1.0: Unknown control protocol [ 906.795614][ T5952] hub 3-1:0.0: config failed, can't read hub descriptor (err -22) [ 906.810983][ T5945] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 906.823472][ T5952] usbhid 3-1:0.0: can't add hid device: -71 [ 906.834285][ T5945] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 906.845662][ T5952] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 906.871528][ T5945] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 906.883397][ T5945] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 906.930132][ T5945] usb 5-1: Manufacturer: syz [ 906.950228][ T5952] usb 3-1: USB disconnect, device number 77 [ 906.976890][T17640] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3400'. [ 906.987860][ T5945] usb 5-1: config 0 descriptor?? [ 907.002654][T17640] bond0: ARP target 170.170.170.170 is already present [ 907.016576][T17640] bond0: option arp_ip_target: invalid value (2863311530) [ 907.202848][ T5952] usb 5-1: USB disconnect, device number 92 [ 907.403882][T17656] batadv0: entered promiscuous mode [ 907.410053][T17656] vlan2: entered promiscuous mode [ 907.490779][T17623] veth0_to_bond: entered allmulticast mode [ 907.502904][T17623] A link change request failed with some changes committed already. Interface veth0_to_bond may have been left with an inconsistent configuration, please check. [ 907.548798][ T3196] usb 4-1: USB disconnect, device number 79 [ 907.918200][T17658] bond1: entered allmulticast mode [ 907.932515][T17658] 8021q: adding VLAN 0 to HW filter on device bond1 [ 908.262997][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 908.416585][T17675] loop2: detected capacity change from 0 to 7 [ 908.447816][T17675] Dev loop2: unable to read RDB block 7 [ 908.463869][T17675] loop2: unable to read partition table [ 908.484280][T17675] loop2: partition table beyond EOD, truncated [ 908.525061][T17675] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 908.865454][T15926] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 908.980920][T17694] netlink: 360 bytes leftover after parsing attributes in process `syz.4.3421'. [ 909.037963][T15926] usb 2-1: Using ep0 maxpacket: 16 [ 909.064920][ T5952] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 909.075900][T15926] usb 2-1: config 0 has no interfaces? [ 909.084219][T15926] usb 2-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 909.094988][T15926] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 909.113583][T15926] usb 2-1: config 0 descriptor?? [ 909.194901][T17703] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3423'. [ 909.195037][ T5945] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 909.225847][ T5952] usb 6-1: Using ep0 maxpacket: 16 [ 909.238073][ T5952] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 909.267338][ T5952] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 909.304115][ T5952] usb 6-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice= 0.00 [ 909.313642][ T5952] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 909.325793][ T5952] usb 6-1: config 0 descriptor?? [ 909.377770][ T5945] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 909.427052][ T5945] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 909.451655][ T5945] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 909.478758][ T5945] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 909.500737][ T5945] usb 4-1: SerialNumber: syz [ 909.736071][ T5945] usb 4-1: 0:2 : does not exist [ 909.751847][ T5945] usb 4-1: unit 5: unexpected type 0x0d [ 909.780059][ T5952] playstation 0003:054C:0DF2.0021: unknown main item tag 0x0 [ 909.804020][ T5952] playstation 0003:054C:0DF2.0021: global environment stack underflow [ 909.818219][ T5945] usb 4-1: USB disconnect, device number 80 [ 909.824751][ T5952] playstation 0003:054C:0DF2.0021: item 0 2 1 11 parsing failed [ 909.856251][ T5952] playstation 0003:054C:0DF2.0021: Parse failed [ 909.862634][ T5952] playstation 0003:054C:0DF2.0021: probe with driver playstation failed with error -22 [ 909.898035][T16265] udevd[16265]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 909.972347][ T5952] usb 6-1: USB disconnect, device number 23 [ 910.470627][T17726] input: syz1 as /devices/virtual/input/input43 [ 910.500030][T17726] netlink: 'syz.4.3429': attribute type 21 has an invalid length. [ 910.530459][T17726] netlink: 128 bytes leftover after parsing attributes in process `syz.4.3429'. [ 910.649425][T17726] netlink: 'syz.4.3429': attribute type 5 has an invalid length. [ 910.748117][T17726] netlink: 'syz.4.3429': attribute type 6 has an invalid length. [ 911.091066][T17726] netlink: 3 bytes leftover after parsing attributes in process `syz.4.3429'. [ 911.190005][T17740] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3431'. [ 911.652518][ T1212] usb 2-1: USB disconnect, device number 96 [ 912.329261][T17749] bridge0: port 2(bridge_slave_1) entered disabled state [ 912.337098][T17749] bridge0: port 1(bridge_slave_0) entered disabled state [ 913.302101][T17749] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 913.384454][T17749] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 914.517864][T17769] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3440'. [ 914.699210][T17773] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3442'. [ 915.177906][ T1098] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 915.190112][ T1098] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 915.202846][ T1098] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 915.222987][ T1098] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 915.266863][T17773] 8021q: adding VLAN 0 to HW filter on device bond3 [ 915.290814][T17775] macvlan3: entered promiscuous mode [ 915.296981][T17775] macvlan3: entered allmulticast mode [ 915.305075][T17775] bond3: entered promiscuous mode [ 915.313151][T17775] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 915.327613][T17775] bond3: left promiscuous mode [ 915.358175][T17776] sit0: entered promiscuous mode [ 915.379590][T17776] netlink: 'syz.1.3443': attribute type 1 has an invalid length. [ 915.422147][T17776] netlink: 1 bytes leftover after parsing attributes in process `syz.1.3443'. [ 915.465305][T17778] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3444'. [ 915.541651][ T1098] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 915.580493][ T1098] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 915.609652][ T1098] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 915.638443][ T1098] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 915.686487][T17791] macvlan0: entered promiscuous mode [ 915.707868][T17791] hsr3: entered allmulticast mode [ 915.713075][T17791] macvlan0: entered allmulticast mode [ 915.719264][T17791] veth1_vlan: entered allmulticast mode [ 915.725822][T17791] batadv0: entered allmulticast mode [ 915.913459][T17799] input: syz0 as /devices/virtual/input/input44 [ 916.034900][ T5945] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 916.274873][ T5945] usb 6-1: Using ep0 maxpacket: 16 [ 916.283203][ T5945] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 916.301292][ T5945] usb 6-1: config 0 interface 0 has no altsetting 0 [ 916.308531][ T5945] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 916.317793][ T5945] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 916.342037][ T5945] usb 6-1: config 0 descriptor?? [ 917.563182][T17811] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3455'. [ 917.729951][ T5945] nzxt-smart2 0003:1E71:2009.0022: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.5-1/input0 [ 917.930734][T17798] tipc: Enabled bearer , priority 0 [ 917.937841][T17797] tipc: Enabling of bearer rejected, already enabled [ 917.987554][T17795] tipc: Disabling bearer [ 918.665085][T15926] usb 6-1: USB disconnect, device number 24 [ 918.831000][T17844] netlink: 'syz.3.3465': attribute type 6 has an invalid length. [ 919.158259][T17851] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3466'. [ 919.301069][T17851] misc userio: The device must be registered before sending interrupts [ 919.363378][T17854] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3468'. [ 919.642122][T17859] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 920.174961][ T1212] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 920.330117][T17878] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3474'. [ 920.351010][T17878] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3474'. [ 920.364870][ T1212] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 920.385851][ T1212] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 920.416729][ T1212] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 920.429657][T17878] erspan0: entered promiscuous mode [ 920.439950][T17878] gretap0: entered promiscuous mode [ 920.444593][ T1212] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 920.448149][T17878] debugfs: 'hsr3' already exists in 'hsr' [ 920.462950][T17878] Cannot create hsr debugfs directory [ 920.486492][T17869] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 920.497767][ T1212] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 920.582112][ T30] audit: type=1326 audit(1757775243.697:341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17883 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f82539 code=0x7ffc0000 [ 920.583715][ T30] audit: type=1326 audit(1757775243.717:342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17883 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f82539 code=0x7ffc0000 [ 920.629492][ T30] audit: type=1326 audit(1757775243.757:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17883 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f82539 code=0x7ffc0000 [ 920.629553][ T30] audit: type=1326 audit(1757775243.757:344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17883 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f82539 code=0x7ffc0000 [ 920.629635][ T30] audit: type=1326 audit(1757775243.757:345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17883 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=40000003 syscall=361 compat=1 ip=0xf7f82539 code=0x7ffc0000 [ 920.629691][ T30] audit: type=1326 audit(1757775243.757:346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17883 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f82539 code=0x7ffc0000 [ 920.629739][ T30] audit: type=1326 audit(1757775243.757:347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17883 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=40000003 syscall=91 compat=1 ip=0xf7f82539 code=0x7ffc0000 [ 920.629787][ T30] audit: type=1326 audit(1757775243.757:348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17883 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f82539 code=0x7ffc0000 [ 920.629833][ T30] audit: type=1326 audit(1757775243.757:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17883 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f82539 code=0x7ffc0000 [ 920.629882][ T30] audit: type=1326 audit(1757775243.757:350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17883 comm="syz.1.3476" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f82539 code=0x7ffc0000 [ 920.689954][T17886] netlink: 'syz.5.3477': attribute type 1 has an invalid length. [ 920.754045][T17886] 8021q: adding VLAN 0 to HW filter on device bond4 [ 920.777047][T17889] bond4: (slave geneve2): making interface the new active one [ 920.918376][T15926] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 920.926780][T17889] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 921.095096][T15926] usb 2-1: Using ep0 maxpacket: 16 [ 921.119154][T15926] usb 2-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 921.128530][T15926] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 921.137439][T15926] usb 2-1: Product: syz [ 921.142273][T15926] usb 2-1: Manufacturer: syz [ 921.158009][T15926] usb 2-1: SerialNumber: syz [ 921.175304][T15926] usb 2-1: config 0 descriptor?? [ 921.190036][T15926] ssu100 2-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 921.285011][ T5952] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 921.474870][ T5952] usb 6-1: Using ep0 maxpacket: 32 [ 921.481959][ T5952] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 921.494973][ T5952] usb 6-1: config 0 has no interface number 0 [ 921.520749][ T5952] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 921.542181][ T5952] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 921.556118][ T1212] usb 4-1: USB disconnect, device number 81 [ 921.938016][T15926] ssu100 2-1:0.0: probe with driver ssu100 failed with error -110 [ 921.966391][ T5952] usb 6-1: Product: syz [ 921.982615][ T5952] usb 6-1: Manufacturer: syz [ 922.006109][ T5952] usb 6-1: SerialNumber: syz [ 922.021694][ T5952] usb 6-1: config 0 descriptor?? [ 922.049165][ T5952] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 922.589330][T17909] netlink: 'syz.3.3481': attribute type 6 has an invalid length. [ 922.663432][ T5952] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 922.772846][ T5952] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 923.059748][ T1212] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 923.063526][ T5967] usb 6-1: USB disconnect, device number 25 [ 923.067498][ C0] usb 6-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 923.122752][ T5967] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 923.166916][ T5967] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 923.215319][ T5967] quatech2 6-1:0.51: device disconnected [ 923.245300][ T1212] usb 3-1: device descriptor read/64, error -71 [ 923.429616][T17919] IPv4: Oversized IP packet from 172.20.20.24 [ 923.436209][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 923.442506][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 923.462655][T17921] fuse: Bad value for 'fd' [ 923.505017][ T1212] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 923.654981][ T1212] usb 3-1: device descriptor read/64, error -71 [ 923.933615][ T1212] usb usb3-port1: attempt power cycle [ 924.126362][T17937] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3491'. [ 924.310495][T13249] usb 2-1: USB disconnect, device number 97 [ 924.326082][ T1212] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 924.335000][T15926] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 924.375545][ T1212] usb 3-1: device descriptor read/8, error -71 [ 924.674914][ T1212] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 924.736056][ T1212] usb 3-1: device descriptor read/8, error -71 [ 924.744146][T15926] usb 5-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 924.911947][T15926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 924.928018][T15926] usb 5-1: Product: syz [ 924.942185][T15926] usb 5-1: Manufacturer: syz [ 924.954956][T15926] usb 5-1: SerialNumber: syz [ 924.996214][ T1212] usb usb3-port1: unable to enumerate USB device [ 925.003702][T15926] usb 5-1: config 0 descriptor?? [ 925.455533][T15926] usb 5-1: f81604_read: reg: 105 failed: -EPROTO [ 925.492113][T15926] f81604 5-1:0.0: Setting termination of CH#0 failed: -EPROTO [ 925.512355][T15926] f81604 5-1:0.0: probe with driver f81604 failed with error -71 [ 925.925584][T15926] usb 5-1: USB disconnect, device number 93 [ 926.697041][T17967] loop2: detected capacity change from 0 to 7 [ 926.710719][T16265] Dev loop2: unable to read RDB block 7 [ 926.739133][T16265] loop2: unable to read partition table [ 926.772822][T16265] loop2: partition table beyond EOD, truncated [ 926.807742][T17967] Dev loop2: unable to read RDB block 7 [ 926.837550][T17967] loop2: unable to read partition table [ 926.866494][T17967] loop2: partition table beyond EOD, truncated [ 926.908112][T17967] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 927.154259][T17982] netlink: 88 bytes leftover after parsing attributes in process `syz.5.3502'. [ 927.176880][T17982] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3502'. [ 927.214244][T17985] netlink: 360 bytes leftover after parsing attributes in process `syz.2.3503'. [ 927.538882][T17994] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3506'. [ 927.552199][T17991] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3505'. [ 927.555031][T13249] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 927.584343][T17994] bond0: ARP target 170.170.170.170 is already present [ 927.643413][T17994] bond0: option arp_ip_target: invalid value (2863311530) [ 927.666252][T17991] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 927.973506][T13249] usb 4-1: config 0 has an invalid interface number: 190 but max is 0 [ 927.982025][T13249] usb 4-1: config 0 has no interface number 0 [ 927.991823][T13249] usb 4-1: New USB device found, idVendor=05ac, idProduct=0253, bcdDevice=71.eb [ 928.001938][T13249] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 928.012100][T13249] usb 4-1: Product: syz [ 928.021557][T13249] usb 4-1: Manufacturer: syz [ 928.026604][T13249] usb 4-1: SerialNumber: syz [ 928.214251][T13249] usb 4-1: config 0 descriptor?? [ 928.229613][T13249] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.190/input/input47 [ 928.385066][T17996] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3507'. [ 928.431156][ T5220] bcm5974 4-1:0.190: could not read from device [ 928.458386][ T5220] bcm5974 4-1:0.190: could not read from device [ 928.486430][T17998] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3508'. [ 928.523366][ T5220] bcm5974 4-1:0.190: could not read from device [ 928.543769][T13249] usb 4-1: USB disconnect, device number 82 [ 928.599496][T18001] 8021q: adding VLAN 0 to HW filter on device bond5 [ 928.641895][ T5220] bcm5974 4-1:0.190: could not read from device [ 928.782357][T16224] udevd[16224]: Error opening device "/dev/input/event4": No such file or directory [ 928.811748][T16224] udevd[16224]: Unable to EVIOCGABS device "/dev/input/event4" [ 928.832474][T16224] udevd[16224]: Unable to EVIOCGABS device "/dev/input/event4" [ 928.887927][T16224] udevd[16224]: Unable to EVIOCGABS device "/dev/input/event4" [ 928.926311][T16224] udevd[16224]: Unable to EVIOCGABS device "/dev/input/event4" [ 928.994917][ T5952] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 929.215137][ T5952] usb 3-1: Using ep0 maxpacket: 32 [ 929.238508][ T5952] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 929.270752][ T5952] usb 3-1: config 0 has no interface number 0 [ 929.295426][ T5952] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 929.334593][ T5952] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 929.456797][ T5952] usb 3-1: Product: syz [ 929.470558][ T5952] usb 3-1: Manufacturer: syz [ 929.475560][ T5952] usb 3-1: SerialNumber: syz [ 929.510481][ T5952] usb 3-1: config 0 descriptor?? [ 929.518512][ T5952] smsc95xx v2.0.0 [ 929.525692][T18021] ip6tnl0: entered promiscuous mode [ 929.537428][T18021] ip6tnl0: entered allmulticast mode [ 929.575353][T15926] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 929.618262][T18021] A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check. [ 929.715058][T13249] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 929.735071][T15926] usb 4-1: Using ep0 maxpacket: 16 [ 929.825043][ T3196] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 929.895169][T13249] usb 5-1: Using ep0 maxpacket: 32 [ 929.911554][T13249] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 929.924226][T13249] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xEC, changing to 0x8C [ 929.944943][T13249] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x8C has an invalid bInterval 200, changing to 11 [ 929.963046][T13249] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 930.030648][T13249] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 930.041741][T13249] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 930.050463][T13249] usb 5-1: Product: syz [ 930.073222][T13249] usb 5-1: Manufacturer: syz [ 930.084006][T13249] usb 5-1: SerialNumber: syz [ 930.105066][ T3196] usb 2-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 930.114482][ T3196] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 930.125965][ T3196] usb 2-1: Product: syz [ 930.130198][ T3196] usb 2-1: Manufacturer: syz [ 930.139887][ T3196] usb 2-1: SerialNumber: syz [ 930.157152][ T3196] usb 2-1: config 0 descriptor?? [ 930.282966][ T3196] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 930.290772][T13249] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input48 [ 930.471378][T18021] program syz.1.3515 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 930.472282][T13249] imon:send_packet: packet tx failed (-71) [ 930.524452][ T3196] gspca_sunplus: reg_r err -71 [ 930.555001][T13249] imon 5-1:155.0: panel buttons/knobs setup failed [ 930.569508][T13249] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 930.591431][ T3196] usb 2-1: USB disconnect, device number 98 [ 930.620438][T13249] (id 0x00) [ 930.710872][ T5952] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 930.731396][ T5952] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 930.875142][T13249] rc_core: IR keymap rc-imon-pad not found [ 930.898252][T13249] Registered IR keymap rc-empty [ 930.974461][T18029] netlink: 'syz.5.3516': attribute type 4 has an invalid length. [ 930.985752][T13249] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 930.996790][T13249] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 931.000112][T18029] netlink: 'syz.5.3516': attribute type 4 has an invalid length. [ 931.031003][T13249] imon:send_packet: packet tx failed (-71) [ 931.056642][T13249] imon 5-1:155.0: remote input dev register failed [ 931.064174][T13249] imon 5-1:155.0: imon_init_intf0: rc device setup failed [ 931.183209][T13249] imon 5-1:155.0: unable to initialize intf0, err 0 [ 931.200196][T13249] imon:imon_probe: failed to initialize context! [ 931.216235][T13249] imon 5-1:155.0: unable to register, err -19 [ 931.245753][T13249] usb 5-1: USB disconnect, device number 94 [ 931.278560][T18031] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3518'. [ 931.301912][T18031] bond0: ARP target 170.170.170.170 is already present [ 931.321152][T18031] bond0: option arp_ip_target: invalid value (2863311530) [ 931.592697][T18042] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3521'. [ 931.635030][T13249] usb 5-1: new full-speed USB device number 95 using dummy_hcd [ 931.674196][T18042] 8021q: adding VLAN 0 to HW filter on device bond5 [ 931.704358][T18044] macvlan3: entered promiscuous mode [ 931.722261][T18044] macvlan3: entered allmulticast mode [ 931.734384][T18044] bond5: entered promiscuous mode [ 931.742432][T18044] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 931.760272][T18044] bond5: left promiscuous mode [ 931.779836][T13249] usb 5-1: device descriptor read/64, error -71 [ 931.847318][ T5952] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 931.859754][ T5952] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 931.902379][ T5952] usb 3-1: USB disconnect, device number 82 [ 932.024975][T13249] usb 5-1: new full-speed USB device number 96 using dummy_hcd [ 932.099349][T15926] usb 4-1: unable to get BOS descriptor or descriptor too short [ 932.108711][T15926] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 932.139546][T15926] usb 4-1: can't read configurations, error -71 [ 932.184890][T13249] usb 5-1: device descriptor read/64, error -71 [ 932.215046][T18053] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3525'. [ 932.236564][T18053] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3525'. [ 932.295615][T13249] usb usb5-port1: attempt power cycle [ 932.445619][ T1212] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 932.604876][ T1212] usb 2-1: Using ep0 maxpacket: 16 [ 932.632450][ T1212] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 932.644881][T13249] usb 5-1: new full-speed USB device number 97 using dummy_hcd [ 932.645292][ T3196] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 932.652628][ T1212] usb 2-1: config 0 interface 0 has no altsetting 0 [ 932.671012][T13249] usb 5-1: device descriptor read/8, error -71 [ 932.681087][ T1212] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 932.692779][ T1212] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 932.707881][ T1212] usb 2-1: config 0 descriptor?? [ 932.795627][ T5952] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 932.821682][ T3196] usb 6-1: New USB device found, idVendor=1b80, idProduct=e396, bcdDevice=a7.b1 [ 932.831255][ T3196] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 932.847684][ T3196] usb 6-1: config 0 descriptor?? [ 932.861499][ T3196] usb 6-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 932.873059][ T3196] dvb_usb_af9015 6-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 932.945783][T13249] usb 5-1: new full-speed USB device number 98 using dummy_hcd [ 932.985040][ T5952] usb 3-1: Using ep0 maxpacket: 8 [ 932.995522][T13249] usb 5-1: device descriptor read/8, error -71 [ 933.005169][ T5952] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 933.014959][ T5952] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 933.062943][ T5952] usb 3-1: config 0 descriptor?? [ 933.131613][T13249] usb usb5-port1: unable to enumerate USB device [ 933.233464][ T1212] nzxt-smart2 0003:1E71:2009.0023: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.1-1/input0 [ 933.645352][ T1212] usb 2-1: USB disconnect, device number 99 [ 933.777729][ T5952] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 933.788249][ T5952] asix 3-1:0.0: probe with driver asix failed with error -71 [ 933.799239][ T5952] usb 3-1: USB disconnect, device number 83 [ 934.270791][T18069] ttyS ttyS3: ldisc open failed (-12), clearing slot 3 [ 934.529402][T18081] netlink: 'syz.1.3533': attribute type 21 has an invalid length. [ 934.537492][T18081] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3533'. [ 934.546735][T18081] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3533'. [ 935.531745][ T3196] usb 6-1: USB disconnect, device number 26 [ 935.893637][T18094] netlink: 'syz.4.3537': attribute type 6 has an invalid length. [ 936.038193][T18102] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3539'. [ 936.253599][T18103] dummy0: entered promiscuous mode [ 936.279790][T18103] vlan2: entered promiscuous mode [ 936.313318][ T30] kauditd_printk_skb: 58 callbacks suppressed [ 936.313338][ T30] audit: type=1326 audit(1757775259.447:409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18104 comm="syz.5.3541" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 936.402444][T18106] vcan0: MTU too low for tipc bearer [ 936.464876][T18106] tipc: Enabling of bearer rejected, failed to enable media [ 936.475748][ T30] audit: type=1326 audit(1757775259.447:410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18104 comm="syz.5.3541" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 936.715041][ T3196] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 936.793879][ T30] audit: type=1326 audit(1757775259.447:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18104 comm="syz.5.3541" exe="/root/syz-executor" sig=0 arch=40000003 syscall=175 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 936.863748][T18114] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 936.874976][ T3196] usb 6-1: device descriptor read/64, error -71 [ 936.897324][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 936.903860][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 936.975220][ T30] audit: type=1326 audit(1757775259.447:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18104 comm="syz.5.3541" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 937.053205][ T30] audit: type=1326 audit(1757775259.447:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18104 comm="syz.5.3541" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 937.135003][ T3196] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 937.142748][ T30] audit: type=1326 audit(1757775259.447:414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18104 comm="syz.5.3541" exe="/root/syz-executor" sig=0 arch=40000003 syscall=337 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 937.315540][ T3196] usb 6-1: device descriptor read/64, error -71 [ 937.452511][ T3196] usb usb6-port1: attempt power cycle [ 937.815178][ T3196] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 937.857446][ T3196] usb 6-1: device descriptor read/8, error -71 [ 937.968778][T18126] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3549'. [ 938.029832][T18126] bond0: ARP target 170.170.170.170 is already present [ 938.093986][T18126] bond0: option arp_ip_target: invalid value (2863311530) [ 938.095073][ T3196] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 938.269191][ T3196] usb 6-1: device descriptor read/8, error -71 [ 938.425161][ T3196] usb usb6-port1: unable to enumerate USB device [ 938.570545][T18140] loop8: detected capacity change from 0 to 7 [ 938.619426][T18140] Dev loop8: unable to read RDB block 7 [ 938.663505][T18140] loop8: unable to read partition table [ 938.742678][T18140] loop8: partition table beyond EOD, truncated [ 938.806539][T18140] loop_reread_partitions: partition scan of loop8 (þ被xüŸÑø éÚ¬§½dƤ´à–ƒÝ¡¯¨â·û [ 938.806539][T18140] ) failed (rc=-5) [ 938.965935][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 938.974419][ T5871] Bluetooth: hci0: command 0x0406 tx timeout [ 938.989375][T18149] loop9: detected capacity change from 0 to 7 [ 938.999526][T18149] Dev loop9: unable to read RDB block 7 [ 939.005290][T18149] loop9: unable to read partition table [ 939.034227][T18149] loop9: partition table beyond EOD, truncated [ 939.139845][T18149] loop_reread_partitions: partition scan of loop9 (þ被xü—ŸÑà– ) failed (rc=-5) [ 939.359460][T10553] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 939.424894][ T3196] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 939.565181][T10553] usb 4-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 939.594999][ T3196] usb 3-1: Using ep0 maxpacket: 32 [ 939.602803][ T3196] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 939.615074][T10553] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 939.624957][ T3196] usb 3-1: config 0 has no interface number 0 [ 939.631144][ T3196] usb 3-1: config 0 interface 89 has no altsetting 0 [ 939.653417][T10553] usb 4-1: Product: syz [ 939.675044][T10553] usb 4-1: Manufacturer: syz [ 939.688195][ T3196] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 939.699726][T10553] usb 4-1: SerialNumber: syz [ 939.718518][ T3196] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 939.735557][ T3196] usb 3-1: Product: syz [ 939.754002][ T3196] usb 3-1: Manufacturer: syz [ 939.773709][T10553] usb 4-1: config 0 descriptor?? [ 939.785678][T10553] ch341 4-1:0.0: ch341-uart converter detected [ 939.802142][ T3196] usb 3-1: SerialNumber: syz [ 939.821758][ T3196] usb 3-1: config 0 descriptor?? [ 939.881414][ T3196] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 939.926498][ T3196] em28xx 3-1:0.89: Video interface 89 found: bulk [ 939.946361][T18166] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3562'. [ 940.078292][T18172] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3565'. [ 940.090821][T18172] bridge0: Device is already in use. [ 940.102007][T18171] loop6: detected capacity change from 0 to 7 [ 940.259119][T18171] Dev loop6: unable to read RDB block 7 [ 940.315144][T18171] loop6: unable to read partition table [ 940.331878][T18171] loop6: partition table beyond EOD, truncated [ 940.344661][T18171] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 940.471411][ T3196] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 940.671377][T10553] usb 4-1: failed to send control message: -71 [ 940.682805][T10553] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 940.707333][T10553] usb 4-1: USB disconnect, device number 85 [ 940.734584][T10553] ch341 4-1:0.0: device disconnected [ 940.816730][ T5856] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 940.995172][ T5856] usb 6-1: Using ep0 maxpacket: 32 [ 941.032985][ T5856] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 941.049962][ T5856] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 941.073597][ T5856] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 941.098955][ T5856] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 941.118067][ T3196] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 941.132474][ T3196] em28xx 3-1:0.89: board has no eeprom [ 941.172815][ T5856] usb 6-1: config 0 descriptor?? [ 941.190976][ T5856] hub 6-1:0.0: USB hub found [ 941.211147][ T3196] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 941.224501][ T3196] em28xx 3-1:0.89: analog set to bulk mode. [ 941.231292][T10553] em28xx 3-1:0.89: Registering V4L2 extension [ 941.259514][ T3196] usb 3-1: USB disconnect, device number 84 [ 941.331266][ T3196] em28xx 3-1:0.89: Disconnecting em28xx [ 941.365299][T10553] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 941.406594][T10553] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 941.436471][ T1212] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 941.454578][T10553] em28xx 3-1:0.89: No AC97 audio processor [ 941.515281][T10553] usb 3-1: Decoder not found [ 941.525615][T10553] em28xx 3-1:0.89: failed to create media graph [ 941.536965][T10553] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 941.565277][T10553] em28xx 3-1:0.89: Registering snapshot button... [ 941.603711][ T1212] usb 5-1: device descriptor read/64, error -71 [ 941.666247][T10553] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input50 [ 941.805543][T10553] em28xx 3-1:0.89: Remote control support is not available for this card. [ 941.850364][ T1212] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 941.883846][ T3196] em28xx 3-1:0.89: Closing input extension [ 941.929673][ T3196] em28xx 3-1:0.89: Deregistering snapshot button [ 942.011006][ T1212] usb 5-1: device descriptor read/64, error -71 [ 942.120505][ T3196] em28xx 3-1:0.89: Freeing device [ 942.129459][ T1212] usb usb5-port1: attempt power cycle [ 942.183622][T18206] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3574'. [ 942.242197][T18209] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3575'. [ 942.486872][ T1212] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 942.516057][ T1212] usb 5-1: device descriptor read/8, error -71 [ 942.765071][ T1212] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 942.775042][ T3196] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 942.786517][ T1212] usb 5-1: device descriptor read/8, error -71 [ 942.898544][ T1212] usb usb5-port1: unable to enumerate USB device [ 942.954892][ T3196] usb 4-1: device descriptor read/64, error -71 [ 943.253494][T18215] netlink: 360 bytes leftover after parsing attributes in process `syz.2.3578'. [ 943.263551][ T3196] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 943.394949][ T3196] usb 4-1: device descriptor read/64, error -71 [ 943.505768][ T3196] usb usb4-port1: attempt power cycle [ 943.751501][ T5856] hub 6-1:0.0: config failed, can't read hub descriptor (err -22) [ 943.763915][ T5856] usbhid 6-1:0.0: can't add hid device: -71 [ 943.772283][ T5856] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 943.827098][ T5856] usb 6-1: USB disconnect, device number 31 [ 943.867378][ T3196] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 943.876538][T18223] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3582'. [ 943.896244][ T1212] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 943.906658][ T3196] usb 4-1: device descriptor read/8, error -71 [ 943.984351][T18227] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3585'. [ 944.053915][T18227] bond6: (slave ip6gretap1): Enslaving as an active interface with an up link [ 944.068033][T18227] 8021q: adding VLAN 0 to HW filter on device bond6 [ 944.095388][ T1212] usb 2-1: Using ep0 maxpacket: 16 [ 944.121242][ T1212] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 944.145788][ T3196] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 944.175642][ T3196] usb 4-1: device descriptor read/8, error -71 [ 944.185725][ T1212] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 944.205825][ T1212] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 944.220281][ T1212] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 944.244893][ T1212] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 944.257597][T18234] FAULT_INJECTION: forcing a failure. [ 944.257597][T18234] name failslab, interval 1, probability 0, space 0, times 0 [ 944.264168][ T1212] usb 2-1: Product: syz [ 944.285681][ T3196] usb usb4-port1: unable to enumerate USB device [ 944.286737][ T1212] usb 2-1: Manufacturer: syz [ 944.302487][T18234] CPU: 1 UID: 0 PID: 18234 Comm: syz.5.3587 Not tainted syzkaller #0 PREEMPT(full) [ 944.302521][T18234] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 944.302536][T18234] Call Trace: [ 944.302545][T18234] [ 944.302555][T18234] dump_stack_lvl+0x189/0x250 [ 944.302587][T18234] ? __pfx____ratelimit+0x10/0x10 [ 944.302610][T18234] ? __pfx_dump_stack_lvl+0x10/0x10 [ 944.302637][T18234] ? __pfx__printk+0x10/0x10 [ 944.302675][T18234] ? __pfx___might_resched+0x10/0x10 [ 944.302695][T18234] ? fs_reclaim_acquire+0x7d/0x100 [ 944.302721][T18234] should_fail_ex+0x414/0x560 [ 944.302757][T18234] should_failslab+0xa8/0x100 [ 944.302793][T18234] __kmalloc_cache_noprof+0x70/0x3d0 [ 944.302823][T18234] ? sctp_transport_new+0x7e/0x640 [ 944.302850][T18234] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 944.302889][T18234] sctp_transport_new+0x7e/0x640 [ 944.302923][T18234] sctp_assoc_add_peer+0x260/0x13b0 [ 944.302962][T18234] ? sctp_bind_addr_copy+0x380/0x3c0 [ 944.303005][T18234] sctp_connect_new_asoc+0x30a/0x690 [ 944.303037][T18234] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 944.303062][T18234] ? __local_bh_enable_ip+0x12d/0x1c0 [ 944.303093][T18234] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 944.303119][T18234] ? security_sctp_bind_connect+0x7e/0x2e0 [ 944.303154][T18234] sctp_sendmsg+0x155c/0x2810 [ 944.303194][T18234] ? __pfx_sctp_sendmsg+0x10/0x10 [ 944.303224][T18234] ? aa_sk_perm+0x81e/0x950 [ 944.303264][T18234] ? __pfx_aa_sk_perm+0x10/0x10 [ 944.303302][T18234] ? sock_rps_record_flow+0x19/0x410 [ 944.303338][T18234] ? inet_sendmsg+0x2f4/0x370 [ 944.303374][T18234] __sock_sendmsg+0x19c/0x270 [ 944.303413][T18234] __sys_sendto+0x3bd/0x520 [ 944.303442][T18234] ? __pfx___sys_sendto+0x10/0x10 [ 944.303465][T18234] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 944.303504][T18234] ? __fget_files+0x3a0/0x420 [ 944.303537][T18234] ? ksys_write+0x22a/0x250 [ 944.303578][T18234] __ia32_sys_sendto+0xdd/0x100 [ 944.303608][T18234] __do_fast_syscall_32+0xb6/0x2b0 [ 944.303635][T18234] ? lockdep_hardirqs_on+0x9c/0x150 [ 944.303663][T18234] do_fast_syscall_32+0x34/0x80 [ 944.303688][T18234] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 944.303716][T18234] RIP: 0023:0xf709e539 [ 944.303736][T18234] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 944.303757][T18234] RSP: 002b:00000000f548e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 944.303780][T18234] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080847fff [ 944.303796][T18234] RDX: 0000000000034000 RSI: 00000000000000e0 RDI: 000000008005ffe4 [ 944.303811][T18234] RBP: 000000000000001c R08: 0000000000000000 R09: 0000000000000000 [ 944.303824][T18234] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 944.303838][T18234] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 944.303870][T18234] [ 944.304882][ T1212] usb 2-1: SerialNumber: syz [ 944.527150][ T3196] IPVS: starting estimator thread 0... [ 944.747363][T18243] syz_tun: entered promiscuous mode [ 944.754719][T18243] batadv_slave_0: entered promiscuous mode [ 944.762285][T18243] debugfs: 'hsr2' already exists in 'hsr' [ 944.769087][T18243] Cannot create hsr debugfs directory [ 944.775493][T18243] hsr2: entered allmulticast mode [ 944.780833][T18243] syz_tun: entered allmulticast mode [ 944.788799][T18243] batadv_slave_0: entered allmulticast mode [ 944.805131][T18240] IPVS: using max 32 ests per chain, 76800 per kthread [ 945.013711][ T1212] usb 2-1: 0:2 : does not exist [ 945.144912][ T3196] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 945.303312][ T3196] usb 3-1: Using ep0 maxpacket: 16 [ 945.310785][ T3196] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 945.322166][ T3196] usb 3-1: config 0 interface 0 has no altsetting 0 [ 945.328915][ T3196] usb 3-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 945.345656][ T3196] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 945.381988][ T3196] usb 3-1: config 0 descriptor?? [ 945.953749][ T3196] nzxt-smart2 0003:1E71:2009.0024: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.2-1/input0 [ 946.208221][ T1212] usb 2-1: 1:0: failed to get current value for ch 0 (-22) [ 946.447894][ T5952] usb 3-1: USB disconnect, device number 85 [ 946.633321][ T1212] usb 2-1: USB disconnect, device number 100 [ 946.650931][T18261] fido_id[18261]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 946.698909][T18263] 8021q: adding VLAN 0 to HW filter on device bond3 [ 946.768540][T16265] udevd[16265]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 947.399077][T18272] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3598'. [ 947.573762][T18277] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3600'. [ 947.691815][T18277] 8021q: adding VLAN 0 to HW filter on device bond4 [ 947.714884][T10553] usb 2-1: new full-speed USB device number 101 using dummy_hcd [ 947.741308][T18280] macvlan2: entered promiscuous mode [ 947.750659][T18280] macvlan2: entered allmulticast mode [ 947.761134][T18280] bond4: entered promiscuous mode [ 947.775840][T18280] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 947.790937][T18280] bond4: left promiscuous mode [ 947.888981][T10553] usb 2-1: config 0 has an invalid interface number: 110 but max is 0 [ 947.909756][T10553] usb 2-1: config 0 has no interface number 0 [ 947.918425][T10553] usb 2-1: config 0 interface 110 altsetting 0 endpoint 0xD has invalid maxpacket 40068, setting to 64 [ 947.938951][T10553] usb 2-1: config 0 interface 110 altsetting 0 endpoint 0xC has invalid maxpacket 512, setting to 64 [ 947.950634][T18290] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3603'. [ 947.966538][T10553] usb 2-1: config 0 interface 110 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 947.980988][T18290] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3603'. [ 948.013293][T10553] usb 2-1: config 0 interface 110 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 10 [ 948.027118][T10553] usb 2-1: config 0 interface 110 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 948.037228][T10553] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=17.65 [ 948.049691][T10553] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 948.075473][T10553] usb 2-1: config 0 descriptor?? [ 948.099551][T18274] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 948.123689][T10553] adutux 2-1:0.110: ADU100 now attached to /dev/usb/adutux0 [ 948.235157][ T5952] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 948.368593][T10553] usb 2-1: USB disconnect, device number 101 [ 948.395065][ T5952] usb 6-1: Using ep0 maxpacket: 32 [ 948.452910][ T5952] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 948.463297][ T5952] usb 6-1: config 0 has no interface number 0 [ 948.473133][ T5952] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 948.493032][ T5952] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 948.501337][ T5952] usb 6-1: Product: syz [ 948.507712][ T5952] usb 6-1: Manufacturer: syz [ 948.512403][ T5952] usb 6-1: SerialNumber: syz [ 948.529136][ T5952] usb 6-1: config 0 descriptor?? [ 948.540051][ T5952] smsc95xx v2.0.0 [ 949.005052][ T5952] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 949.077881][ T5952] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 949.347578][T18316] FAULT_INJECTION: forcing a failure. [ 949.347578][T18316] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 949.383605][T18316] CPU: 1 UID: 0 PID: 18316 Comm: syz.1.3612 Not tainted syzkaller #0 PREEMPT(full) [ 949.383637][T18316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 949.383651][T18316] Call Trace: [ 949.383661][T18316] [ 949.383671][T18316] dump_stack_lvl+0x189/0x250 [ 949.383703][T18316] ? __pfx____ratelimit+0x10/0x10 [ 949.383727][T18316] ? __pfx_dump_stack_lvl+0x10/0x10 [ 949.383754][T18316] ? __pfx__printk+0x10/0x10 [ 949.383785][T18316] ? __might_fault+0xb0/0x130 [ 949.383829][T18316] should_fail_ex+0x414/0x560 [ 949.383868][T18316] _copy_from_user+0x2d/0xb0 [ 949.383899][T18316] get_compat_msghdr+0xad/0x4a0 [ 949.383932][T18316] ? __pfx_get_compat_msghdr+0x10/0x10 [ 949.383973][T18316] ___sys_sendmsg+0x193/0x2a0 [ 949.384011][T18316] ? __pfx____sys_sendmsg+0x10/0x10 [ 949.384083][T18316] ? __fget_files+0x2a/0x420 [ 949.384103][T18316] ? __fget_files+0x3a0/0x420 [ 949.384134][T18316] __sys_sendmsg+0x164/0x220 [ 949.384164][T18316] ? __pfx___sys_sendmsg+0x10/0x10 [ 949.384209][T18316] ? lockdep_hardirqs_on+0x9c/0x150 [ 949.384236][T18316] __do_fast_syscall_32+0xb6/0x2b0 [ 949.384262][T18316] ? lockdep_hardirqs_on+0x9c/0x150 [ 949.384287][T18316] do_fast_syscall_32+0x34/0x80 [ 949.384312][T18316] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 949.384338][T18316] RIP: 0023:0xf7f82539 [ 949.384352][T18316] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 949.384371][T18316] RSP: 002b:00000000f548655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 949.384395][T18316] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400 [ 949.384411][T18316] RDX: 0000000004000804 RSI: 0000000000000000 RDI: 0000000000000000 [ 949.384424][T18316] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 949.384437][T18316] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 949.384450][T18316] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 949.384478][T18316] [ 949.734122][T18322] vim2m vim2m.0: Fourcc format (0x56595559) invalid. [ 949.757789][ T30] audit: type=1326 audit(1757775272.897:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18321 comm="syz.3.3614" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f95558 code=0x7ffc0000 [ 950.149277][ T30] audit: type=1326 audit(1757775272.897:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18321 comm="syz.3.3614" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f95558 code=0x7ffc0000 [ 950.205710][T18332] binder: BINDER_SET_CONTEXT_MGR already set [ 950.211808][T18332] binder: 18331:18332 ioctl 4018620d 80000040 returned -16 [ 950.341046][ T30] audit: type=1326 audit(1757775272.897:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18321 comm="syz.3.3614" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f95558 code=0x7ffc0000 [ 950.524931][T10553] usb 2-1: new full-speed USB device number 102 using dummy_hcd [ 950.800327][ T1212] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 950.816968][ T30] audit: type=1326 audit(1757775272.897:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18321 comm="syz.3.3614" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f95558 code=0x7ffc0000 [ 950.845190][T10553] usb 2-1: device descriptor read/64, error -71 [ 950.859795][ T30] audit: type=1326 audit(1757775272.897:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18321 comm="syz.3.3614" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f95558 code=0x7ffc0000 [ 950.885676][ T30] audit: type=1326 audit(1757775272.897:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18321 comm="syz.3.3614" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f95558 code=0x7ffc0000 [ 950.923657][ T30] audit: type=1326 audit(1757775272.897:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18321 comm="syz.3.3614" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f95558 code=0x7ffc0000 [ 950.990593][ T30] audit: type=1326 audit(1757775272.897:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18321 comm="syz.3.3614" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f95558 code=0x7ffc0000 [ 951.104932][T10553] usb 2-1: new full-speed USB device number 103 using dummy_hcd [ 951.118541][ T30] audit: type=1326 audit(1757775272.897:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18321 comm="syz.3.3614" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f95558 code=0x7ffc0000 [ 951.165137][ T1212] usb 3-1: device descriptor read/64, error -71 [ 951.192143][ T5952] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000006c: -71 [ 951.243636][ T30] audit: type=1326 audit(1757775272.897:424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18321 comm="syz.3.3614" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f95558 code=0x7ffc0000 [ 951.270590][ T5952] smsc95xx 6-1:0.67: probe with driver smsc95xx failed with error -71 [ 951.295166][T10553] usb 2-1: device descriptor read/64, error -71 [ 951.359651][ T5952] usb 6-1: USB disconnect, device number 32 [ 951.412976][ T1212] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 951.427777][T10553] usb usb2-port1: attempt power cycle [ 951.758226][T18342] netlink: 'syz.3.3620': attribute type 1 has an invalid length. [ 951.824956][T10553] usb 2-1: new full-speed USB device number 104 using dummy_hcd [ 951.859672][T10553] usb 2-1: device descriptor read/8, error -71 [ 952.045244][ T1212] usb 3-1: device descriptor read/64, error -71 [ 952.093543][T18342] 8021q: adding VLAN 0 to HW filter on device bond5 [ 952.175393][T10553] usb 2-1: new full-speed USB device number 105 using dummy_hcd [ 952.231855][T10553] usb 2-1: device descriptor read/8, error -71 [ 952.236106][ T1212] usb usb3-port1: attempt power cycle [ 952.273436][T18344] bond5: (slave geneve2): making interface the new active one [ 952.320040][T18344] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 952.345374][T10553] usb usb2-port1: unable to enumerate USB device [ 952.584928][ T1212] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 952.608021][ T1212] usb 3-1: device descriptor read/8, error -71 [ 953.317908][T18360] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3626'. [ 953.605084][T18367] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 953.885930][T18377] netlink: 'syz.3.3633': attribute type 1 has an invalid length. [ 954.173598][T18382] loop2: detected capacity change from 0 to 7 [ 954.185645][T16265] loop2: [POWERTEC] p1 p2 p3 p4 [ 954.190949][T16265] loop2: p1 size 1114112 extends beyond EOD, truncated [ 954.206156][T16265] loop2: p2 start 393215 is beyond EOD, truncated [ 954.216888][T16265] loop2: p3 start 1635021614 is beyond EOD, truncated [ 954.233032][T16265] loop2: p4 start 1680801792 is beyond EOD, truncated [ 954.309907][T18384] input: syz0 as /devices/virtual/input/input51 [ 954.346751][T18382] loop2: [POWERTEC] p1 p2 p3 p4 [ 954.368128][T18382] loop2: p1 size 1114112 extends beyond EOD, truncated [ 954.416457][T18382] loop2: p2 start 393215 is beyond EOD, truncated [ 954.464538][T18382] loop2: p3 start 1635021614 is beyond EOD, truncated [ 954.498610][T18382] loop2: p4 start 1680801792 is beyond EOD, truncated [ 954.724688][T16265] udevd[16265]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 954.836555][ T1212] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 954.838353][T16265] udevd[16265]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 955.393749][ T1212] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 955.493423][ T1212] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 955.545029][ T1212] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 255, changing to 11 [ 955.584383][ T1212] usb 2-1: config 0 interface 0 has no altsetting 0 [ 955.594809][ T1212] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 955.604010][ T1212] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 255, changing to 11 [ 955.645186][ T1212] usb 2-1: config 0 interface 0 has no altsetting 0 [ 955.654505][ T1212] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 955.678423][ T1212] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 255, changing to 11 [ 955.711134][ T1212] usb 2-1: config 0 interface 0 has no altsetting 0 [ 956.000274][ T1212] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 956.020700][ T1212] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 255, changing to 11 [ 956.267380][ T1212] usb 2-1: config 0 interface 0 has no altsetting 0 [ 956.276359][ T1212] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 956.287897][ T1212] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 255, changing to 11 [ 956.300213][ T1212] usb 2-1: config 0 interface 0 has no altsetting 0 [ 956.369732][ T1212] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 956.379159][ T1212] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 255, changing to 11 [ 956.470565][ T1212] usb 2-1: config 0 interface 0 has no altsetting 0 [ 956.555273][ T1212] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 956.581329][ T1212] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 255, changing to 11 [ 956.621981][ T1212] usb 2-1: config 0 interface 0 has no altsetting 0 [ 956.729658][ T1212] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 956.779430][ T1212] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 255, changing to 11 [ 956.810181][ T1212] usb 2-1: config 0 interface 0 has no altsetting 0 [ 956.822104][ T1212] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 956.835447][ T1212] usb 2-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 956.843975][ T1212] usb 2-1: Product: syz [ 956.848774][ T1212] usb 2-1: Manufacturer: syz [ 956.853591][ T1212] usb 2-1: SerialNumber: syz [ 956.871414][ T1212] usb 2-1: config 0 descriptor?? [ 957.033849][ T1212] yurex 2-1:0.0: USB YUREX device now attached to Yurex #0 [ 957.284076][T18407] gretap0: entered allmulticast mode [ 957.337392][ T1212] usb 2-1: USB disconnect, device number 106 [ 957.451468][ T1212] yurex 2-1:0.0: USB YUREX #0 now disconnected [ 958.377759][T18412] bond1: entered promiscuous mode [ 958.951139][T18433] loop6: detected capacity change from 0 to 7 [ 958.960699][T18433] Dev loop6: unable to read RDB block 7 [ 958.966809][T18433] loop6: unable to read partition table [ 958.973035][T18433] loop6: partition table beyond EOD, truncated [ 958.980539][T18433] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 960.559126][T18454] netlink: 'syz.1.3655': attribute type 6 has an invalid length. [ 960.639204][T18457] netlink: 'syz.2.3656': attribute type 21 has an invalid length. [ 960.648162][T18457] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3656'. [ 960.714179][T18457] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3656'. [ 960.823860][T18463] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3658'. [ 961.293730][T18463] 8021q: adding VLAN 0 to HW filter on device bond6 [ 961.308278][T18470] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3659'. [ 961.410110][T18442] futex_wake_op: syz.5.3653 tries to shift op by 32; fix this program [ 961.504660][T18471] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3653'. [ 961.599436][T18442] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3653'. [ 961.619982][T18476] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3662'. [ 961.639121][T18477] FAULT_INJECTION: forcing a failure. [ 961.639121][T18477] name failslab, interval 1, probability 0, space 0, times 0 [ 961.652728][T18476] netlink: 9 bytes leftover after parsing attributes in process `syz.3.3662'. [ 961.687975][T18481] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3653'. [ 961.697379][T18471] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3653'. [ 961.747543][T18477] CPU: 0 UID: 0 PID: 18477 Comm: syz.4.3661 Not tainted syzkaller #0 PREEMPT(full) [ 961.747574][T18477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 961.747589][T18477] Call Trace: [ 961.747598][T18477] [ 961.747608][T18477] dump_stack_lvl+0x189/0x250 [ 961.747641][T18477] ? __pfx____ratelimit+0x10/0x10 [ 961.747664][T18477] ? __pfx_dump_stack_lvl+0x10/0x10 [ 961.747691][T18477] ? __pfx__printk+0x10/0x10 [ 961.747729][T18477] ? __pfx___might_resched+0x10/0x10 [ 961.747749][T18477] ? fs_reclaim_acquire+0x7d/0x100 [ 961.747775][T18477] should_fail_ex+0x414/0x560 [ 961.747814][T18477] should_failslab+0xa8/0x100 [ 961.747857][T18477] __kmalloc_cache_noprof+0x70/0x3d0 [ 961.747888][T18477] ? sctp_transport_new+0x7e/0x640 [ 961.747916][T18477] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 961.747955][T18477] sctp_transport_new+0x7e/0x640 [ 961.747989][T18477] sctp_assoc_add_peer+0x260/0x13b0 [ 961.748019][T18477] ? sctp_bind_addr_copy+0x380/0x3c0 [ 961.748061][T18477] sctp_connect_new_asoc+0x30a/0x690 [ 961.748093][T18477] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 961.748118][T18477] ? __local_bh_enable_ip+0x12d/0x1c0 [ 961.748149][T18477] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 961.748176][T18477] ? security_sctp_bind_connect+0x7e/0x2e0 [ 961.748210][T18477] sctp_sendmsg+0x155c/0x2810 [ 961.748250][T18477] ? __pfx_sctp_sendmsg+0x10/0x10 [ 961.748280][T18477] ? aa_sk_perm+0x81e/0x950 [ 961.748320][T18477] ? __pfx_aa_sk_perm+0x10/0x10 [ 961.748357][T18477] ? sock_rps_record_flow+0x19/0x410 [ 961.748394][T18477] ? inet_sendmsg+0x2f4/0x370 [ 961.748430][T18477] __sock_sendmsg+0x19c/0x270 [ 961.748467][T18477] __sys_sendto+0x3bd/0x520 [ 961.748495][T18477] ? __pfx___sys_sendto+0x10/0x10 [ 961.748517][T18477] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 961.748556][T18477] ? __fget_files+0x3a0/0x420 [ 961.748599][T18477] ? ksys_write+0x22a/0x250 [ 961.748639][T18477] __ia32_sys_sendto+0xdd/0x100 [ 961.748668][T18477] __do_fast_syscall_32+0xb6/0x2b0 [ 961.748694][T18477] ? lockdep_hardirqs_on+0x9c/0x150 [ 961.748720][T18477] do_fast_syscall_32+0x34/0x80 [ 961.748763][T18477] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 961.748791][T18477] RIP: 0023:0xf7fb7539 [ 961.748811][T18477] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 961.748837][T18477] RSP: 002b:00000000f54b655c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 961.748860][T18477] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080847fff [ 961.748876][T18477] RDX: 0000000000034000 RSI: 00000000000000e0 RDI: 000000008005ffe4 [ 961.748891][T18477] RBP: 000000000000001c R08: 0000000000000000 R09: 0000000000000000 [ 961.748905][T18477] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 961.748919][T18477] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 961.748961][T18477] [ 962.345694][T18487] Unknown options in mask b7f2 [ 964.107024][T18517] 8021q: adding VLAN 0 to HW filter on device bond7 [ 964.143038][T18526] input: syz0 as /devices/virtual/input/input52 [ 964.337963][T18521] macvlan3: entered promiscuous mode [ 964.421718][T18521] macvlan3: entered allmulticast mode [ 964.441062][T18521] bond7: entered promiscuous mode [ 964.447106][T18521] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 964.553714][T18521] bond7: left promiscuous mode [ 964.952277][T18535] netlink: 'syz.4.3677': attribute type 21 has an invalid length. [ 966.347740][T18564] FAULT_INJECTION: forcing a failure. [ 966.347740][T18564] name failslab, interval 1, probability 0, space 0, times 0 [ 966.406837][T18564] CPU: 1 UID: 0 PID: 18564 Comm: syz.5.3686 Not tainted syzkaller #0 PREEMPT(full) [ 966.406867][T18564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 966.406881][T18564] Call Trace: [ 966.406890][T18564] [ 966.406900][T18564] dump_stack_lvl+0x189/0x250 [ 966.406932][T18564] ? __pfx____ratelimit+0x10/0x10 [ 966.406956][T18564] ? __pfx_dump_stack_lvl+0x10/0x10 [ 966.406983][T18564] ? __pfx__printk+0x10/0x10 [ 966.407020][T18564] ? __pfx___might_resched+0x10/0x10 [ 966.407046][T18564] should_fail_ex+0x414/0x560 [ 966.407086][T18564] should_failslab+0xa8/0x100 [ 966.407122][T18564] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 966.407153][T18564] ? __alloc_skb+0x112/0x2d0 [ 966.407183][T18564] __alloc_skb+0x112/0x2d0 [ 966.407211][T18564] netlink_sendmsg+0x5c6/0xb30 [ 966.407255][T18564] ? __pfx_netlink_sendmsg+0x10/0x10 [ 966.407282][T18564] ? __import_iovec+0x5d4/0x7f0 [ 966.407321][T18564] ? aa_sock_msg_perm+0xf1/0x1d0 [ 966.407344][T18564] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 966.407368][T18564] ? __pfx_netlink_sendmsg+0x10/0x10 [ 966.407392][T18564] __sock_sendmsg+0x21c/0x270 [ 966.407428][T18564] ____sys_sendmsg+0x505/0x830 [ 966.407461][T18564] ? __pfx_____sys_sendmsg+0x10/0x10 [ 966.407512][T18564] ___sys_sendmsg+0x21f/0x2a0 [ 966.407542][T18564] ? __pfx____sys_sendmsg+0x10/0x10 [ 966.407607][T18564] ? __fget_files+0x2a/0x420 [ 966.407626][T18564] ? __fget_files+0x3a0/0x420 [ 966.407656][T18564] __sys_sendmsg+0x164/0x220 [ 966.407685][T18564] ? __pfx___sys_sendmsg+0x10/0x10 [ 966.407729][T18564] ? lockdep_hardirqs_on+0x9c/0x150 [ 966.407755][T18564] __do_fast_syscall_32+0xb6/0x2b0 [ 966.407779][T18564] ? lockdep_hardirqs_on+0x9c/0x150 [ 966.407805][T18564] do_fast_syscall_32+0x34/0x80 [ 966.407829][T18564] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 966.407862][T18564] RIP: 0023:0xf709e539 [ 966.407880][T18564] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 966.407899][T18564] RSP: 002b:00000000f548e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 966.407939][T18564] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400 [ 966.407955][T18564] RDX: 0000000004000804 RSI: 0000000000000000 RDI: 0000000000000000 [ 966.407969][T18564] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 966.407982][T18564] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 966.407996][T18564] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 966.408027][T18564] [ 968.530253][T18612] loop6: detected capacity change from 0 to 7 [ 968.600216][T16265] Dev loop6: unable to read RDB block 7 [ 968.624273][T16265] loop6: AHDI p4 [ 968.634017][T16265] loop6: partition table partially beyond EOD, truncated [ 968.646674][T18614] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 968.673447][T18612] Dev loop6: unable to read RDB block 7 [ 968.678053][T18614] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 968.705205][ T9] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 968.710089][T18612] loop6: AHDI p4 [ 968.720252][T18612] loop6: partition table partially beyond EOD, truncated [ 968.867277][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 968.878525][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 968.929315][ T9] usb 6-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 968.965134][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 969.003427][ T9] usb 6-1: config 0 descriptor?? [ 969.016728][T18620] netlink: 'syz.3.3704': attribute type 1 has an invalid length. [ 969.138032][T18620] 8021q: adding VLAN 0 to HW filter on device bond6 [ 969.467350][ T9] cp2112 0003:10C4:EA90.0025: unknown main item tag 0x0 [ 969.550258][ T9] cp2112 0003:10C4:EA90.0025: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.5-1/input0 [ 969.682327][ T9] cp2112 0003:10C4:EA90.0025: error requesting version [ 969.707323][ T9] cp2112 0003:10C4:EA90.0025: probe with driver cp2112 failed with error -32 [ 970.471592][T18637] __nla_validate_parse: 4 callbacks suppressed [ 970.471613][T18637] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3707'. [ 970.605692][T18641] FAULT_INJECTION: forcing a failure. [ 970.605692][T18641] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 970.619157][T18641] CPU: 0 UID: 0 PID: 18641 Comm: syz.1.3709 Not tainted syzkaller #0 PREEMPT(full) [ 970.619183][T18641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 970.619193][T18641] Call Trace: [ 970.619200][T18641] [ 970.619206][T18641] dump_stack_lvl+0x189/0x250 [ 970.619228][T18641] ? __pfx____ratelimit+0x10/0x10 [ 970.619246][T18641] ? __pfx_dump_stack_lvl+0x10/0x10 [ 970.619265][T18641] ? __pfx__printk+0x10/0x10 [ 970.619286][T18641] ? __might_fault+0xb0/0x130 [ 970.619316][T18641] should_fail_ex+0x414/0x560 [ 970.619342][T18641] _copy_from_iter+0x1de/0x1790 [ 970.619365][T18641] ? rcu_is_watching+0x15/0xb0 [ 970.619381][T18641] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 970.619404][T18641] ? __pfx__copy_from_iter+0x10/0x10 [ 970.619423][T18641] ? __build_skb_around+0x257/0x3e0 [ 970.619443][T18641] ? netlink_sendmsg+0x642/0xb30 [ 970.619458][T18641] ? skb_put+0x11b/0x210 [ 970.619477][T18641] netlink_sendmsg+0x6b2/0xb30 [ 970.619500][T18641] ? __pfx_netlink_sendmsg+0x10/0x10 [ 970.619518][T18641] ? __import_iovec+0x5d4/0x7f0 [ 970.619536][T18641] ? aa_sock_msg_perm+0xf1/0x1d0 [ 970.619552][T18641] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 970.619569][T18641] ? __pfx_netlink_sendmsg+0x10/0x10 [ 970.619586][T18641] __sock_sendmsg+0x21c/0x270 [ 970.619612][T18641] ____sys_sendmsg+0x505/0x830 [ 970.619636][T18641] ? __pfx_____sys_sendmsg+0x10/0x10 [ 970.619679][T18641] ___sys_sendmsg+0x21f/0x2a0 [ 970.619710][T18641] ? __pfx____sys_sendmsg+0x10/0x10 [ 970.619759][T18641] ? __fget_files+0x2a/0x420 [ 970.619772][T18641] ? __fget_files+0x3a0/0x420 [ 970.619793][T18641] __sys_sendmsg+0x164/0x220 [ 970.619814][T18641] ? __pfx___sys_sendmsg+0x10/0x10 [ 970.619844][T18641] ? lockdep_hardirqs_on+0x9c/0x150 [ 970.619862][T18641] __do_fast_syscall_32+0xb6/0x2b0 [ 970.619880][T18641] ? lockdep_hardirqs_on+0x9c/0x150 [ 970.619898][T18641] do_fast_syscall_32+0x34/0x80 [ 970.619915][T18641] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 970.619934][T18641] RIP: 0023:0xf7f82539 [ 970.619947][T18641] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 970.619961][T18641] RSP: 002b:00000000f548655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 970.619977][T18641] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800001c0 [ 970.619995][T18641] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 970.620004][T18641] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 970.620013][T18641] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 970.620022][T18641] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 970.620043][T18641] [ 971.146155][ T9] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 971.306139][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 971.318532][ T9] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 971.358542][ T9] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 971.405255][ T1212] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 971.413226][ T9] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 29216, setting to 1024 [ 971.451560][ T9] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 971.462769][ T9] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 971.486494][ T9] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 971.497154][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 971.524512][T18658] binder: 18657:18658 ioctl c0306201 0 returned -14 [ 971.614888][ T1212] usb 2-1: Using ep0 maxpacket: 32 [ 971.622500][ T1212] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 971.635143][ T1212] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 971.704402][ T1212] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 971.747316][ T9] usb 4-1: usb_control_msg returned -71 [ 971.757514][ T9] usbtmc 4-1:16.0: can't read capabilities [ 971.775145][ T1212] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 971.792373][ T9] usb 4-1: USB disconnect, device number 91 [ 971.803594][ T1212] usb 2-1: config 0 descriptor?? [ 972.246276][ T1212] ft260 0003:0403:6030.0026: unknown main item tag 0x7 [ 972.350366][T18668] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3718'. [ 972.360406][T18668] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3718'. [ 972.404068][T10553] usb 6-1: USB disconnect, device number 33 [ 972.430084][ T1212] ft260 0003:0403:6030.0026: chip code: 6424 8183 [ 972.473558][T18668] erspan0: entered promiscuous mode [ 972.512164][T18668] gretap0: entered promiscuous mode [ 972.549742][T18668] debugfs: 'hsr3' already exists in 'hsr' [ 972.559539][T18668] Cannot create hsr debugfs directory [ 972.630807][ T1212] ft260 0003:0403:6030.0026: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.1-1/input0 [ 972.901220][ T1212] ft260 0003:0403:6030.0026: failed to retrieve status: -32, no wakeup [ 973.189391][T18653] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 973.209955][T18653] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 973.223013][T10553] usb 2-1: USB disconnect, device number 107 [ 973.421673][T18690] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3725'. [ 973.665817][T18690] misc userio: The device must be registered before sending interrupts [ 974.725150][T13249] usb 6-1: new low-speed USB device number 34 using dummy_hcd [ 975.093768][T13249] usb 6-1: config 7 has 0 interfaces, different from the descriptor's value: 1 [ 975.113353][T13249] usb 6-1: string descriptor 0 read error: -22 [ 975.120346][T13249] usb 6-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice=56.c0 [ 975.186816][T13249] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.533700][ T1212] usb 6-1: USB disconnect, device number 34 [ 975.962796][T18716] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3732'. [ 976.358274][T18723] sctp: [Deprecated]: syz.5.3734 (pid 18723) Use of struct sctp_assoc_value in delayed_ack socket option. [ 976.358274][T18723] Use struct sctp_sack_info instead [ 976.964119][ T1212] usb 6-1: new full-speed USB device number 35 using dummy_hcd [ 977.176615][ T1212] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 977.204255][ T1212] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 977.224539][ T1212] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 977.292920][T18732] netlink: 'syz.4.3735': attribute type 6 has an invalid length. [ 977.348649][ T1212] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 977.380273][ T1212] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 977.395160][ T1212] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 977.420996][ T1212] usb 6-1: Manufacturer: syz [ 977.447201][ T1212] usb 6-1: config 0 descriptor?? [ 977.634966][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 977.634981][ T30] audit: type=1326 audit(1757775300.757:482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18733 comm="syz.3.3737" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f95539 code=0x0 [ 977.901245][ T30] audit: type=1326 audit(1757775300.767:483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18733 comm="syz.3.3737" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f95539 code=0x0 [ 978.076589][ T1212] rc_core: IR keymap rc-hauppauge not found [ 978.087195][ T1212] Registered IR keymap rc-empty [ 978.092187][ T1212] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 978.147241][ T1212] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 978.196069][ T1212] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 978.279705][ T1212] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input53 [ 978.333631][ T1212] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 978.334048][T18751] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3743'. [ 978.388899][ T1212] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 978.414990][ T1212] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 978.438858][ T1212] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 978.510361][ T1212] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 978.685375][ T1212] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 978.745066][ T1212] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 978.805187][ T1212] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 978.856451][ T1212] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 978.899116][ T1212] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 978.927787][ T1212] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 978.967386][ T1212] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 979.043059][ T1212] usb 6-1: USB disconnect, device number 35 [ 980.285275][ T9] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 980.405092][T18805] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3758'. [ 980.455053][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 980.465536][ T9] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 980.480976][ T9] usb 3-1: config 0 interface 0 has no altsetting 0 [ 980.502854][ T9] usb 3-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 980.532642][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 980.574065][ T9] usb 3-1: config 0 descriptor?? [ 981.030977][ T9] nzxt-smart2 0003:1E71:2009.0027: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.2-1/input0 [ 981.848681][ T3196] usb 3-1: USB disconnect, device number 90 [ 982.412396][T18816] futex_wake_op: syz.1.3757 tries to shift op by 32; fix this program [ 982.506566][T18825] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3757'. [ 982.518923][T18825] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3757'. [ 982.531198][T18825] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3757'. [ 982.546508][T18825] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3757'. [ 983.024551][T18832] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3763'. [ 983.138107][T18834] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3766'. [ 983.213127][T18834] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3766'. [ 983.424590][T18841] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3768'. [ 983.484285][T18841] 8021q: adding VLAN 0 to HW filter on device bond7 [ 983.531377][T18844] macvlan2: entered promiscuous mode [ 983.538121][T18844] macvlan2: entered allmulticast mode [ 983.544528][T18844] bond7: entered promiscuous mode [ 983.550591][T18844] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 983.560233][T18844] bond7: left promiscuous mode [ 983.827870][ T3196] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 984.024867][ T3196] usb 6-1: Using ep0 maxpacket: 32 [ 984.039875][ T3196] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 984.053494][ T3196] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 984.081694][ T3196] usb 6-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 984.104189][ T3196] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 984.211483][ T3196] usb 6-1: config 0 descriptor?? [ 984.434915][ T9] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 984.620930][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 984.655622][ T3196] ft260 0003:0403:6030.0028: item fetching failed at offset 0/2 [ 984.663978][ T3196] ft260 0003:0403:6030.0028: failed to parse HID [ 984.678991][ T3196] ft260 0003:0403:6030.0028: probe with driver ft260 failed with error -22 [ 984.741800][ T9] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0a31, bcdDevice= 0.00 [ 984.774222][ T3196] usb 6-1: USB disconnect, device number 36 [ 984.800237][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 984.889696][ T9] usb 2-1: config 0 descriptor?? [ 984.917176][ T9] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 985.127034][ T1212] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 985.687325][ T1212] usb 4-1: Using ep0 maxpacket: 16 [ 985.697594][ T1212] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 985.713168][ T1212] usb 4-1: config 0 interface 0 has no altsetting 0 [ 985.732238][ T1212] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 985.749964][ T1212] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 985.826432][ T1212] usb 4-1: config 0 descriptor?? [ 985.916345][T18879] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3775'. [ 986.318607][ T1212] nzxt-smart2 0003:1E71:2009.0029: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.3-1/input0 [ 986.665530][ T3196] usb 4-1: USB disconnect, device number 92 [ 986.797092][T18886] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3780'. [ 987.266551][T13249] usb 6-1: new full-speed USB device number 37 using dummy_hcd [ 987.314869][ T1212] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 987.446542][T13249] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x19, changing to 0x9 [ 987.475014][ T1212] usb 3-1: Using ep0 maxpacket: 16 [ 987.485003][T13249] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid maxpacket 197, setting to 64 [ 987.520185][ T1212] usb 3-1: unable to get BOS descriptor or descriptor too short [ 987.530879][T13249] usb 6-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice= 0.5a [ 987.540738][T13249] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 987.555725][ T1212] usb 3-1: config 159 has an invalid interface number: 131 but max is 0 [ 987.564618][ T1212] usb 3-1: config 159 has no interface number 0 [ 987.576373][T13249] usb 6-1: config 0 descriptor?? [ 987.583611][T18882] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 987.594074][ T1212] usb 3-1: config 159 interface 131 altsetting 5 bulk endpoint 0x1 has invalid maxpacket 16 [ 987.620959][T13249] pegasus_notetaker 6-1:0.0: probe with driver pegasus_notetaker failed with error -22 [ 987.622265][ T3196] usb 2-1: USB disconnect, device number 108 [ 987.634901][ T1212] usb 3-1: config 159 interface 131 has no altsetting 0 [ 987.654169][ T1212] usb 3-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=92.76 [ 987.670994][T18910] netlink: 'syz.4.3786': attribute type 10 has an invalid length. [ 987.679066][T18910] __nla_validate_parse: 2 callbacks suppressed [ 987.679086][T18910] netlink: 55 bytes leftover after parsing attributes in process `syz.4.3786'. [ 987.692718][ T1212] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 987.721391][ T1212] usb 3-1: Product: syz [ 987.750940][ T1212] usb 3-1: Manufacturer: syz [ 987.756476][T18912] netlink: 'syz.3.3788': attribute type 1 has an invalid length. [ 987.759478][ T1212] usb 3-1: SerialNumber: syz [ 987.821416][T18159] usb 6-1: USB disconnect, device number 37 [ 987.941984][T18896] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 987.946596][T18912] 8021q: adding VLAN 0 to HW filter on device bond8 [ 988.240786][T18920] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3790'. [ 988.274195][ T1212] usb 3-1: USB disconnect, device number 91 [ 988.308831][ T1212] ================================================================== [ 988.317060][ T1212] BUG: KASAN: slab-use-after-free in hdm_disconnect+0x10d/0x1c0 [ 988.324734][ T1212] Read of size 8 at addr ffff88804bbed8a0 by task kworker/0:2/1212 [ 988.332729][ T1212] [ 988.335061][ T1212] CPU: 0 UID: 0 PID: 1212 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 988.335080][ T1212] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 988.335093][ T1212] Workqueue: usb_hub_wq hub_event [ 988.335119][ T1212] Call Trace: [ 988.335126][ T1212] [ 988.335134][ T1212] dump_stack_lvl+0x189/0x250 [ 988.335154][ T1212] ? __kasan_check_byte+0x12/0x40 [ 988.335179][ T1212] ? __pfx_dump_stack_lvl+0x10/0x10 [ 988.335198][ T1212] ? lock_release+0x4b/0x3e0 [ 988.335224][ T1212] ? __virt_addr_valid+0x4a5/0x5c0 [ 988.335247][ T1212] print_report+0xca/0x240 [ 988.335262][ T1212] ? hdm_disconnect+0x10d/0x1c0 [ 988.335282][ T1212] kasan_report+0x118/0x150 [ 988.335306][ T1212] ? hdm_disconnect+0x10d/0x1c0 [ 988.335329][ T1212] hdm_disconnect+0x10d/0x1c0 [ 988.335351][ T1212] usb_unbind_interface+0x26e/0x910 [ 988.335379][ T1212] ? __pfx_usb_unbind_interface+0x10/0x10 [ 988.335404][ T1212] device_release_driver_internal+0x4d9/0x800 [ 988.335429][ T1212] bus_remove_device+0x34d/0x410 [ 988.335452][ T1212] device_del+0x511/0x8e0 [ 988.335472][ T1212] ? kfree+0x18e/0x440 [ 988.335493][ T1212] ? __pfx_device_del+0x10/0x10 [ 988.335514][ T1212] ? kobject_put+0x446/0x480 [ 988.335536][ T1212] usb_disable_device+0x3e9/0x8a0 [ 988.335562][ T1212] usb_disconnect+0x330/0x950 [ 988.335584][ T1212] hub_event+0x1cf5/0x4a20 [ 988.335621][ T1212] ? do_raw_spin_lock+0x121/0x290 [ 988.335642][ T1212] ? register_lock_class+0x51/0x320 [ 988.335672][ T1212] ? __pfx_hub_event+0x10/0x10 [ 988.335694][ T1212] ? process_scheduled_works+0x9ef/0x17b0 [ 988.335712][ T1212] ? _raw_spin_unlock_irq+0x23/0x50 [ 988.335737][ T1212] ? process_scheduled_works+0x9ef/0x17b0 [ 988.335752][ T1212] ? process_scheduled_works+0x9ef/0x17b0 [ 988.335768][ T1212] process_scheduled_works+0xae1/0x17b0 [ 988.335794][ T1212] ? __pfx_process_scheduled_works+0x10/0x10 [ 988.335816][ T1212] worker_thread+0x8a0/0xda0 [ 988.335833][ T1212] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 988.335862][ T1212] ? __kthread_parkme+0x7b/0x200 [ 988.335882][ T1212] kthread+0x70e/0x8a0 [ 988.335903][ T1212] ? __pfx_worker_thread+0x10/0x10 [ 988.335919][ T1212] ? __pfx_kthread+0x10/0x10 [ 988.335939][ T1212] ? _raw_spin_unlock_irq+0x23/0x50 [ 988.335963][ T1212] ? lockdep_hardirqs_on+0x9c/0x150 [ 988.335977][ T1212] ? __pfx_kthread+0x10/0x10 [ 988.335997][ T1212] ret_from_fork+0x436/0x7d0 [ 988.336015][ T1212] ? __pfx_ret_from_fork+0x10/0x10 [ 988.336033][ T1212] ? __switch_to_asm+0x39/0x70 [ 988.336054][ T1212] ? __switch_to_asm+0x33/0x70 [ 988.336075][ T1212] ? __pfx_kthread+0x10/0x10 [ 988.336095][ T1212] ret_from_fork_asm+0x1a/0x30 [ 988.336122][ T1212] [ 988.336129][ T1212] [ 988.595565][ T1212] Allocated by task 1212: [ 988.599905][ T1212] kasan_save_track+0x3e/0x80 [ 988.604597][ T1212] __kasan_kmalloc+0x93/0xb0 [ 988.609197][ T1212] __kmalloc_cache_noprof+0x230/0x3d0 [ 988.614590][ T1212] hdm_probe+0x96/0x1400 [ 988.618848][ T1212] usb_probe_interface+0x665/0xc30 [ 988.623983][ T1212] really_probe+0x26d/0x9e0 [ 988.628503][ T1212] __driver_probe_device+0x18c/0x2f0 [ 988.633801][ T1212] driver_probe_device+0x4f/0x430 [ 988.638836][ T1212] __device_attach_driver+0x2ce/0x530 [ 988.644220][ T1212] bus_for_each_drv+0x24e/0x2e0 [ 988.649080][ T1212] __device_attach+0x2b8/0x400 [ 988.653855][ T1212] bus_probe_device+0x185/0x260 [ 988.658711][ T1212] device_add+0x7b6/0xb50 [ 988.663052][ T1212] usb_set_configuration+0x1a87/0x20e0 [ 988.668526][ T1212] usb_generic_driver_probe+0x8d/0x150 [ 988.674004][ T1212] usb_probe_device+0x1c1/0x390 [ 988.678870][ T1212] really_probe+0x26d/0x9e0 [ 988.683383][ T1212] __driver_probe_device+0x18c/0x2f0 [ 988.688683][ T1212] driver_probe_device+0x4f/0x430 [ 988.693717][ T1212] __device_attach_driver+0x2ce/0x530 [ 988.699110][ T1212] bus_for_each_drv+0x24e/0x2e0 [ 988.703988][ T1212] __device_attach+0x2b8/0x400 [ 988.708776][ T1212] bus_probe_device+0x185/0x260 [ 988.713651][ T1212] device_add+0x7b6/0xb50 [ 988.718002][ T1212] usb_new_device+0xa39/0x16f0 [ 988.722796][ T1212] hub_event+0x2958/0x4a20 [ 988.727231][ T1212] process_scheduled_works+0xae1/0x17b0 [ 988.732784][ T1212] worker_thread+0x8a0/0xda0 [ 988.737382][ T1212] kthread+0x70e/0x8a0 [ 988.741462][ T1212] ret_from_fork+0x436/0x7d0 [ 988.746057][ T1212] ret_from_fork_asm+0x1a/0x30 [ 988.750852][ T1212] [ 988.753178][ T1212] Freed by task 1212: [ 988.757162][ T1212] kasan_save_track+0x3e/0x80 [ 988.761867][ T1212] kasan_save_free_info+0x46/0x50 [ 988.766899][ T1212] __kasan_slab_free+0x5b/0x80 [ 988.771671][ T1212] kfree+0x18e/0x440 [ 988.775585][ T1212] device_release+0x99/0x1c0 [ 988.780191][ T1212] kobject_put+0x22b/0x480 [ 988.784613][ T1212] hdm_disconnect+0xf3/0x1c0 [ 988.789220][ T1212] usb_unbind_interface+0x26e/0x910 [ 988.794438][ T1212] device_release_driver_internal+0x4d9/0x800 [ 988.800637][ T1212] bus_remove_device+0x34d/0x410 [ 988.805607][ T1212] device_del+0x511/0x8e0 [ 988.809989][ T1212] usb_disable_device+0x3e9/0x8a0 [ 988.815072][ T1212] usb_disconnect+0x330/0x950 [ 988.819789][ T1212] hub_event+0x1cf5/0x4a20 [ 988.824261][ T1212] process_scheduled_works+0xae1/0x17b0 [ 988.829870][ T1212] worker_thread+0x8a0/0xda0 [ 988.834499][ T1212] kthread+0x70e/0x8a0 [ 988.838619][ T1212] ret_from_fork+0x436/0x7d0 [ 988.843244][ T1212] ret_from_fork_asm+0x1a/0x30 [ 988.848081][ T1212] [ 988.850432][ T1212] The buggy address belongs to the object at ffff88804bbec000 [ 988.850432][ T1212] which belongs to the cache kmalloc-8k of size 8192 [ 988.864529][ T1212] The buggy address is located 6304 bytes inside of [ 988.864529][ T1212] freed 8192-byte region [ffff88804bbec000, ffff88804bbee000) [ 988.878618][ T1212] [ 988.880970][ T1212] The buggy address belongs to the physical page: [ 988.887424][ T1212] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4bbe8 [ 988.896409][ T1212] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 988.904953][ T1212] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 988.912543][ T1212] page_type: f5(slab) [ 988.916581][ T1212] raw: 00fff00000000040 ffff88801a442280 ffffea00018e9a00 dead000000000004 [ 988.925203][ T1212] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 988.933846][ T1212] head: 00fff00000000040 ffff88801a442280 ffffea00018e9a00 dead000000000004 [ 988.942626][ T1212] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 988.951441][ T1212] head: 00fff00000000003 ffffea00012efa01 00000000ffffffff 00000000ffffffff [ 988.960209][ T1212] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 988.968924][ T1212] page dumped because: kasan: bad access detected [ 988.975374][ T1212] page_owner tracks the page as allocated [ 988.981142][ T1212] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 18322, tgid 18321 (syz.3.3614), ts 949833833468, free_ts 949612142902 [ 989.002863][ T1212] post_alloc_hook+0x240/0x2a0 [ 989.007730][ T1212] get_page_from_freelist+0x21e4/0x22c0 [ 989.013330][ T1212] __alloc_frozen_pages_noprof+0x181/0x370 [ 989.019196][ T1212] alloc_pages_mpol+0x232/0x4a0 [ 989.024113][ T1212] allocate_slab+0x8a/0x370 [ 989.028665][ T1212] ___slab_alloc+0xbeb/0x1420 [ 989.033423][ T1212] __kmalloc_cache_noprof+0x296/0x3d0 [ 989.038878][ T1212] audit_log_d_path+0xb5/0x190 [ 989.043717][ T1212] audit_log_d_path_exe+0x42/0x70 [ 989.048787][ T1212] audit_log_task+0x2b3/0x3c0 [ 989.053480][ T1212] audit_seccomp+0x86/0x190 [ 989.058002][ T1212] __seccomp_filter+0x9aa/0x1a40 [ 989.062960][ T1212] syscall_trace_enter+0xaa/0x160 [ 989.068037][ T1212] do_int80_emulation+0x101/0x390 [ 989.073087][ T1212] asm_int80_emulation+0x1a/0x20 [ 989.078047][ T1212] page last free pid 16180 tgid 16180 stack trace: [ 989.084688][ T1212] __free_frozen_pages+0xbc4/0xd30 [ 989.089835][ T1212] __put_partials+0x156/0x1a0 [ 989.094522][ T1212] put_cpu_partial+0x17c/0x250 [ 989.099297][ T1212] __slab_free+0x2d5/0x3c0 [ 989.103722][ T1212] qlist_free_all+0x97/0x140 [ 989.108323][ T1212] kasan_quarantine_reduce+0x148/0x160 [ 989.113802][ T1212] __kasan_slab_alloc+0x22/0x80 [ 989.118668][ T1212] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 989.124138][ T1212] getname_flags+0xb8/0x540 [ 989.128856][ T1212] user_path_at+0x24/0x60 [ 989.133235][ T1212] __ia32_sys_umount+0xee/0x160 [ 989.138098][ T1212] __do_fast_syscall_32+0xb6/0x2b0 [ 989.143219][ T1212] do_fast_syscall_32+0x34/0x80 [ 989.148076][ T1212] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 989.154410][ T1212] [ 989.156738][ T1212] Memory state around the buggy address: [ 989.162369][ T1212] ffff88804bbed780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 989.170436][ T1212] ffff88804bbed800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 989.178501][ T1212] >ffff88804bbed880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 989.186565][ T1212] ^ [ 989.191686][ T1212] ffff88804bbed900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 989.199756][ T1212] ffff88804bbed980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 989.207824][ T1212] ================================================================== [ 989.645410][ T1212] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 989.652692][ T1212] CPU: 0 UID: 0 PID: 1212 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 989.662087][ T1212] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 989.672161][ T1212] Workqueue: usb_hub_wq hub_event [ 989.677306][ T1212] Call Trace: [ 989.680597][ T1212] [ 989.683532][ T1212] dump_stack_lvl+0x99/0x250 [ 989.688229][ T1212] ? __asan_memcpy+0x40/0x70 [ 989.692916][ T1212] ? __pfx_dump_stack_lvl+0x10/0x10 [ 989.698124][ T1212] ? __pfx__printk+0x10/0x10 [ 989.702751][ T1212] vpanic+0x281/0x750 [ 989.706752][ T1212] ? preempt_schedule+0xae/0xc0 [ 989.711607][ T1212] ? __pfx_vpanic+0x10/0x10 [ 989.716121][ T1212] ? preempt_schedule_common+0x83/0xd0 [ 989.721672][ T1212] ? preempt_schedule+0xae/0xc0 [ 989.726529][ T1212] ? __pfx_preempt_schedule+0x10/0x10 [ 989.731907][ T1212] panic+0xb9/0xc0 [ 989.735640][ T1212] ? __pfx_panic+0x10/0x10 [ 989.740072][ T1212] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 989.745985][ T1212] ? hdm_disconnect+0x10d/0x1c0 [ 989.750847][ T1212] check_panic_on_warn+0x89/0xb0 [ 989.755802][ T1212] ? hdm_disconnect+0x10d/0x1c0 [ 989.760672][ T1212] end_report+0x78/0x160 [ 989.764941][ T1212] kasan_report+0x129/0x150 [ 989.769477][ T1212] ? hdm_disconnect+0x10d/0x1c0 [ 989.774349][ T1212] hdm_disconnect+0x10d/0x1c0 [ 989.779042][ T1212] usb_unbind_interface+0x26e/0x910 [ 989.784262][ T1212] ? __pfx_usb_unbind_interface+0x10/0x10 [ 989.790000][ T1212] device_release_driver_internal+0x4d9/0x800 [ 989.796087][ T1212] bus_remove_device+0x34d/0x410 [ 989.801036][ T1212] device_del+0x511/0x8e0 [ 989.805384][ T1212] ? kfree+0x18e/0x440 [ 989.809466][ T1212] ? __pfx_device_del+0x10/0x10 [ 989.814325][ T1212] ? kobject_put+0x446/0x480 [ 989.818921][ T1212] usb_disable_device+0x3e9/0x8a0 [ 989.823957][ T1212] usb_disconnect+0x330/0x950 [ 989.828649][ T1212] hub_event+0x1cf5/0x4a20 [ 989.833110][ T1212] ? do_raw_spin_lock+0x121/0x290 [ 989.838160][ T1212] ? register_lock_class+0x51/0x320 [ 989.843408][ T1212] ? __pfx_hub_event+0x10/0x10 [ 989.848200][ T1212] ? process_scheduled_works+0x9ef/0x17b0 [ 989.853932][ T1212] ? _raw_spin_unlock_irq+0x23/0x50 [ 989.859154][ T1212] ? process_scheduled_works+0x9ef/0x17b0 [ 989.864886][ T1212] ? process_scheduled_works+0x9ef/0x17b0 [ 989.870619][ T1212] process_scheduled_works+0xae1/0x17b0 [ 989.876198][ T1212] ? __pfx_process_scheduled_works+0x10/0x10 [ 989.882189][ T1212] worker_thread+0x8a0/0xda0 [ 989.886795][ T1212] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 989.893145][ T1212] ? __kthread_parkme+0x7b/0x200 [ 989.898099][ T1212] kthread+0x70e/0x8a0 [ 989.902209][ T1212] ? __pfx_worker_thread+0x10/0x10 [ 989.907345][ T1212] ? __pfx_kthread+0x10/0x10 [ 989.911968][ T1212] ? _raw_spin_unlock_irq+0x23/0x50 [ 989.917195][ T1212] ? lockdep_hardirqs_on+0x9c/0x150 [ 989.922427][ T1212] ? __pfx_kthread+0x10/0x10 [ 989.927036][ T1212] ret_from_fork+0x436/0x7d0 [ 989.931643][ T1212] ? __pfx_ret_from_fork+0x10/0x10 [ 989.936793][ T1212] ? __switch_to_asm+0x39/0x70 [ 989.941573][ T1212] ? __switch_to_asm+0x33/0x70 [ 989.946348][ T1212] ? __pfx_kthread+0x10/0x10 [ 989.950953][ T1212] ret_from_fork_asm+0x1a/0x30 [ 989.955751][ T1212] [ 989.959179][ T1212] Kernel Offset: disabled [ 989.963507][ T1212] Rebooting in 86400 seconds..