last executing test programs: 10m9.968947826s ago: executing program 1 (id=1157): bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000e80)={@ifindex, 0xffffffffffffffff, 0x1a, 0x0, 0x0, @void, @value}, 0x20) (async) unshare(0x2a020400) (async) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x361001, 0x0) fadvise64(r0, 0x3, 0x100, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000001d40)={{0x12, 0x1, 0x0, 0x43, 0xed, 0xb9, 0x10, 0x1235, 0x10, 0xa738, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x2, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xb5, 0x0, 0x0, 0x2b, 0xff, 0xea}}, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x18, 0xad, 0x63}}]}}]}}, 0x0) 10m8.464134275s ago: executing program 1 (id=1162): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$kcm(0x10, 0x2, 0x4) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket(0x18, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$l2tp6(0xa, 0x2, 0x73) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e20, 0x7eaada86, @mcast2, 0x5}, 0x1c) bpf$MAP_CREATE(0x0, 0x0, 0x48) socket$inet_sctp(0x2, 0x1, 0x84) bpf$MAP_CREATE(0x0, 0x0, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r3, &(0x7f0000000600)={0xa, 0x4c23, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x2}, 0x1c) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0xc004743e, 0x110e22ffef) setsockopt$inet6_int(r2, 0x29, 0x3c, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) bind$packet(r2, 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0x9, 0x0, 0x0) sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 10m5.466418115s ago: executing program 1 (id=1165): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8}, @NFTA_PAYLOAD_SREG={0x8, 0x5, 0x1, 0x0, 0x13}, @NFTA_PAYLOAD_BASE={0x8}, @NFTA_PAYLOAD_OFFSET={0x8}, @NFTA_PAYLOAD_CSUM_TYPE={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}]}], {0x14}}, 0x94}}, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000040)={0x4, 0x0, 0x1, 0x1, 0xffffffff, 0x3, 0x7fffffff, 0x5, 0x0}, &(0x7f00000000c0)=0x20) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000200)={0xf000, 0x0, 0x8, 0x5, 0xb, 0x8, 0x5, 0x8, r3}, 0x20) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000001340)={'batadv_slave_1\x00', 0x0}) sendmmsg$inet6(r1, &(0x7f00000014c0)=[{{&(0x7f0000000280)={0xa, 0x4e21, 0x7fff, @local, 0xe44}, 0x1c, &(0x7f00000008c0)=[{&(0x7f00000002c0)="6d9b9517c55ce62001fdd7cc2bd805d3bab5f4eac24eb3bdf47c99b3518b67b1536056c89bb7d3d0796dfd41110a72b517e40f00755cc565e7892a015a1c44e3085cf00ca921bc482ceef928541341b69acf2a38", 0x54}, {&(0x7f0000000340)="3b1e2646c187220d91ffaabfc55adfbbf0717ada53469dacc232063880e646559a6f52473a13b115f32c8e49183d263d5ff74fd22be6409ff9aca618da3793e634b5db880e05b7fd4ee46d1e5b00bf2cd21264b13ea07c7e61cce7960fff4097bb0b9d5f13f946b9a79aa87f0e18dff9c77dfea197c219e9aba417006ff047b21f0407ba2532f0c9586a3c5cccf14c47c24912c252d7acdbf1ca37770c44b1dd04b9b8c01712a162c139fee95018a60dc55296cf0137330a8c60ee7250b3ec21bbcd52bf5c5baf4b5c82d329ce797b4fb2a1c45013ef2631199e76ffaf2ff9f760a50225a6836e3e52b08946d1f6521798f91250363a1d66e600", 0xfa}, {&(0x7f0000000440)="dcced6f37820839973825f7e40ee3c82598c48b6d117a1d0bfd4776c009ca24f2d8d3721c55a49db5f2cf891e32cc96b577fc13b4c82046fa2761d10b7e3f303538bf46664339342ab3a068aa2b66b824c00131a1db0c16d150b6497b45f7f2b3be43f66d53e46cebdbe9e631bff4d3800857e21c151d9318b54b009f3338cf89e218665b1bf4bbf5f6762d936b1a1cf0261dabc1d1d272491344962873796a3b86d8cd9a474e20622b02c3c8f89bb37f5c68d5e1849c9981901a8da5c7123cd26d6da9bca1d241d4b2e2effffb0f84dddfd87849b550bb5e04fd4766b1ca0d17be3048db586bb", 0xe7}, {&(0x7f0000000540)="e6c7887638ba286bb6da79533b2bf08bb85cd9ed8cafd68be727d3c09c35bb1e71d38196291344c2eed7f050ecae727955193435d9ffd00d493c336bcbf25b2785cacd57643e06005db08ec29b5ae5d1e20f75f32d3ec71de4a8c477835e8ce759266da8ef9c240fd321555e5ce856edf1a0", 0x72}, {&(0x7f00000005c0)="fbcd473b31406371498f239d63427325d90af7d5b0e1b0918c6c6980d1695380337e5620ee74088cede2a147dc973d4cca1edc807db583ea3100ff600e7f4f8bd863e9958f97a52c2ddc8f832ecfa5939663e4409f3e56b38382a011f8232599bb788d8299fb785cc2ded3a94382dc803cad209e589a6bb5e63735d9d3170020e894901d8b8c567a3ea5a9a73fb3c8e9911dc3a64d9f78d892366c63b1fe00827c6c06706f923a6b4dcd524cf25ac33da456e35039bda2c1d369c6abd1c2f4e6dd00657ebc29b0ad475dbed5d8ed5d04537a20bfeb01837fba198d412440cd069338fe6103b2b4691ec923239299", 0xee}, {&(0x7f00000006c0)="91dfb5debb14adbe7bf2cd5a38bb90cc6afb034c41d8f7d06ab56c318f964f488815fd0d", 0x24}, {&(0x7f0000000700)="311e068f9effe5c3526741189b0a2a8bf1b964fb64fe32bed7b240926c7178782e63ffb1ffc08a409f551242e5b149c6966c0789", 0x34}, {&(0x7f0000000740)="d2d7d87703b340591242384026378e4ed0cf7ba24b16dd8525704120042cf8715e9a40f6ae43ead5a9e8178fdc9c770fd41e5d33864f18e52a144d990e1084b8cf224a6f4c3aa9b37b0c72ef0b2e76496ba1ffaa9c4ac1827efb4263a9f23bba377843fa6489b95cd2844f762da9637e90647a317f1a57e2c00d0297c5ab82ba41c3da88ea191235658d97323541f48e2f7f367fad7572bd0e102cff54ca9b79872fffeed8da56eedf59aa8280fd7f256b9aaf7806899e574a69ddecc64ff062ced48f59d2f49d2e876a49c0cfa06669962055d252317814d39059a4d15df56323ca53c5f2a75ea68570", 0xea}, {&(0x7f0000000840)="70572b7186f497e956e3f5d70416bd251ea7b02765af283397430e311c845da8e3cfb4e6a01e14a94317b1a3a265d6a369abb328dbc650522cc66f1291dac1f26d8078a5ddf060e5224c76c28b895e6c73d9c3d9f3fadeb03cd302172a13aea88d5f0f91330be0fee4e0d5e1579cf61edbd409df", 0x74}], 0x9, &(0x7f0000000940)=[@rthdr={{0x34, 0x29, 0x39, {0x35, 0x4, 0x2, 0x6, 0x0, [@dev={0xfe, 0x80, '\x00', 0x33}, @mcast2]}}}, @dstopts={{0xac, 0x29, 0x37, {0x21, 0x12, '\x00', [@padn={0x1, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x18, {0x3, 0x4, 0xb, 0xf0, [0x51dc, 0xfff]}}, @calipso={0x7, 0x30, {0x0, 0xa, 0xad, 0xb, [0x7, 0x4, 0x9, 0xfffffffffffff001, 0x6]}}, @generic={0x5, 0x40, "14bd54b5f8cfec1d9ac8122afcf75bc8b4c8a55bc7c54e94e62e0d2c1b4f0265aa75a46b91b353f7e3175ed9377d9260b37575703bde9cd2f08f377a1ffc6eb5"}]}}}, @tclass={{0x10, 0x29, 0x43, 0x6}}, @rthdrdstopts={{0x114, 0x29, 0x37, {0x21, 0x1f, '\x00', [@hao={0xc9, 0x10, @private0}, @calipso={0x7, 0x10, {0x0, 0x2, 0x4, 0x7f, [0x3ac7]}}, @hao={0xc9, 0x10, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @generic={0x7f, 0x3e, "f3171997c32dac2aa4d95a71d1562760c6e54621a080533e766eb6a6b4097e34aafe363f349530bf5a0218710c68a1ffb021169151ecef957bc5ed44a032"}, @calipso={0x7, 0x50, {0x2, 0x12, 0x1, 0x4, [0x9, 0x7, 0x4, 0x8, 0x2, 0x1b577119, 0xc73d, 0x9, 0x200]}}, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x28, {0x1, 0x8, 0x7e, 0x0, [0x2, 0x2, 0x6, 0xffffffffffffff0c]}}, @jumbo={0xc2, 0x4, 0x1}]}}}, @rthdrdstopts={{0x11c, 0x29, 0x37, {0x1d, 0x20, '\x00', [@ra={0x5, 0x2, 0x6}, @calipso={0x7, 0x38, {0x1, 0xc, 0x6, 0x4, [0xffffffffffffff67, 0x9, 0x2, 0x10, 0xfffffffffffffff4, 0x1]}}, @calipso={0x7, 0x28, {0x2, 0x8, 0x3, 0x1, [0xffffffffffffffff, 0x2, 0x4, 0x0]}}, @calipso={0x7, 0x50, {0x1, 0x12, 0xe4, 0xff01, [0x10, 0x9, 0x8, 0x7fffffffffffffff, 0x9, 0x36b, 0x1, 0x4, 0x7]}}, @jumbo={0xc2, 0x4, 0xd}, @calipso={0x7, 0x40, {0x3, 0xe, 0x0, 0x9e, [0x2, 0x6, 0x7, 0xb, 0x7, 0x2, 0x7]}}]}}}], 0x320}}, {{&(0x7f0000000c80)={0xa, 0x4e22, 0x8, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}, 0x1c, &(0x7f0000001000)=[{&(0x7f0000000cc0)}, {&(0x7f0000000d40)="ab454100c7c09ffb0f333d59b7dfc5cdaf45424e54880e7111fca01ecc8822a04677f7d4a33f7264df7a4766e29d7e9721556ef73e4d952e04ad3f1c3b71e2e3e2721a9a1ec1c3f2d8a68957c8543bba84cfd53e9b0dd277a8577ee59159df6182c305aa", 0x64}, {&(0x7f0000000dc0)="09c648e7cb6cb6d6b5691b8ee91a8f82675731112f39584f08002ea52d1dd7d21b0e4881bd2d01b4c71f185238867700f6a5675ba7d49f8f442ac7834f8b0f52ba7277e0ea8a730cf6ec09e4c2f3b0ad0e8ad33117bb94fb60c1d48a285d0ca4071c49f68d434e321b38d74fe056b31f4e3f8afc781ad06c432a61553427f42ba682a9be4c4fb26df12e6fc69bd1d26c3c92192e92f418a29d3e491d3138fd6aed43ab094e6b90972478a8fa3c91077dd203d0db4966a3126ddf533de875b1299f68b20de0700d916f3b4e6fd31109bac4cee6ec80c038ad04e22533311aa5b7dbab20bf04622a78bc942fe6e25602731df8b5cc0969208e10", 0xf9}, {&(0x7f0000000ec0)="8b5b7ee754f8cab550eb10ad320c73a49a27151625e2269b676b187ad4d2ff8de6a923a38f682415658f50e4265ef525dcb5b1837a8a02e1cfbb2423fd02c42f2e6e4bb2df42a38f0a78a1e31456bdd3c585682870fc658925efe9b4c7bef1de51a4dab3a0a84b56e3b2ba16f45befbb22c7e2ea2d2ed85d8535a2cb4abd4e4735906069f22d", 0x86}, {&(0x7f0000000f80)="662d3d09dcdf066a44747e7111ec1339791e10a769aad0ce225d70326b139bd4f45bc1ae40201a06fd9f425992aea964826bbec886ecd16366ab06c449e1d0539081a541b93c6d19b6bca68730c90f2f5fd70bee72ce24", 0x57}], 0x5, &(0x7f0000001040)=[@hoplimit_2292={{0x10, 0x29, 0x8, 0x252}}, @flowinfo={{0x10, 0x29, 0xb, 0x3}}, @hoplimit_2292={{0x10, 0x29, 0x8, 0x6}}, @hopopts_2292={{0xec, 0x29, 0x36, {0x2f, 0x1a, '\x00', [@calipso={0x7, 0x40, {0x2, 0xe, 0x80, 0x9, [0x200, 0x2, 0x8, 0xffffffffffffffc2, 0x2, 0x7, 0x4]}}, @enc_lim={0x4, 0x1, 0x3}, @enc_lim={0x4, 0x1, 0x2}, @generic={0xf, 0x13, "59aa24f6dea8ccd702cb3b41c25b36c0892063"}, @generic={0xf4, 0x72, "efb9e331f5dbc69f1de24ddaf9e127410bd2ba7b903b02c31623011dd8fa99fdf875b0968b86ea69eb621087cdac90560f5a89ca45f7f57168d05f2e9279962ef1e9f2d79dac8615fdb14e6cc47ecf6bfb069d2b5669efbc8383cb497713a1a75fa2883cecb2b587f6a0d5cd271786fa454e"}]}}}, @dontfrag={{0x10}}, @hoplimit_2292={{0x10, 0x29, 0x8, 0x6}}, @flowinfo={{0x10, 0x29, 0xb, 0x7f}}], 0x14c}}, {{&(0x7f00000011c0)={0xa, 0x4e21, 0x8, @private0, 0xf}, 0x1c, &(0x7f0000001300)=[{&(0x7f0000001200)="92f765c67607cdfb13c0b420c801532c7f7527fb9dcc9194ecb98d3d0a57ac5e795a8f6a7dec4219d75951945e48db8cab4db6b2ee91c15d721172eb1afdc8fdaca37a4f2dc8f67e5be64611979d11ed1cc3cab207a09d", 0x57}, {&(0x7f0000001280)="492395bb26ec117530118a0fd97cf7900fb6a35515544b9d0d559b711d7033831c84b7aa2fe71f0ae01f28210b48ddd38a7e1487fa578051afaae86baf923ef5195f7098b3e99343e7da09c825a425b3fba2072b567217c787614dd4ee8f", 0x5e}], 0x2, &(0x7f0000001380)=[@pktinfo={{0x20, 0x29, 0x32, {@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', r5}}}, @rthdrdstopts={{0x114, 0x29, 0x37, {0x2b, 0x1f, '\x00', [@enc_lim={0x4, 0x1, 0x3}, @calipso={0x7, 0x40, {0x2, 0xe, 0x1, 0x7fff, [0x9e80, 0x0, 0xfffffffffffffff8, 0x61, 0x5, 0x8, 0xfffffffffffffffa]}}, @padn={0x1, 0x2, [0x0, 0x0]}, @generic={0xf8, 0xa2, "7533c53a21bc8dd9329b59f0bb676ea54288db9f7cbf462c1b0d16d485b0bcfa35ad1a674154d2dbf509742e9f252bfedb4493e7d2207105f2b8ef5ea5e02f76c8391de654106eea83e106331321c4d12a89ab427fa2d25086bdf1c5b3143c66c26e2bf4517037f77c14e7c1999b8c7b4c2fdb359b5302a4488e52b443b25d7a36dbbaa6583d09f69bea40e1248e9dc5316d91c10f8867f38d267f2f21c8888138e0"}, @hao={0xc9, 0x10, @empty}]}}}], 0x134}}], 0x3, 0x40800) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOGETCMAP(r6, 0x4604, &(0x7f00000001c0)={0x2, 0x1, &(0x7f00000000c0)=[0x0], &(0x7f0000000300), &(0x7f0000001200), 0x0}) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r7, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f0000000000)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r7, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x20005e, 0x0, 0x9, 0x4}) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) mlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r8, 0x7a0, &(0x7f0000000240)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r8, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x20005f, 0x0, 0x0, 0x0, 0x2}) ioctl$VIDIOC_S_STD(r4, 0x40085618, &(0x7f00000001c0)=0x1700) 10m4.57371593s ago: executing program 1 (id=1169): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001640)={0x30, 0x3e, 0x1, 0x7fffc, 0x4, {0x1}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x10, 0x0, 0x1, [@nested={0x4, 0x8}]}]}, @typed={0xc, 0x2, 0x0, 0x0, @u64}]}, 0x30}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 10m4.345034161s ago: executing program 1 (id=1171): socket$key(0xf, 0x3, 0x2) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) openat(0xffffffffffffff9c, &(0x7f0000002600)='./file1\x00', 0x105042, 0x0) r1 = inotify_init1(0x800) inotify_add_watch(r1, &(0x7f0000000200)='.\x00', 0x10000a0) inotify_add_watch(r1, &(0x7f0000000000)='./file1\x00', 0x90) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x100, 0x80) r2 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) syz_usb_connect$uac1(0x6, 0x83, &(0x7f0000000280)={{0x12, 0x1, 0x211, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x71, 0x3, 0x1, 0xa, 0x40, 0x60, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x1, 0xb}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x32, 0x5, 0x1001}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0xce, 0x1, 0x2, 0x1, "", "03c33f"}]}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0xf, 0x10, 0xe, {0x7, 0x25, 0x1, 0x0, 0xf3, 0xf11c}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x21, 0x4, 0x4, {0x7, 0x25, 0x1, 0x80, 0x5, 0x80}}}}}}}]}}, &(0x7f0000000980)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x310, 0x2, 0x1, 0x5, 0x20, 0x9}, 0x85, &(0x7f0000000340)={0x5, 0xf, 0x85, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0xc, 0x4, 0x3, 0x7f}, @ss_container_id={0x14, 0x10, 0x4, 0xa9, "3546c642cfc848f35afae90d0f967419"}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x4, 0xa, 0x7}, @generic={0x5b, 0x10, 0x4, "bcfa3a68065185b448b3331c6122543293474195b3394d377fde8e0097ae67587a49cace39523434a2607da59b7ec4a33f58f0db978660693653d09fcc0f3ddc45403b19cd36e18503e8ade38073abd7db88c7546a273dd6"}]}, 0x7, [{0xa3, &(0x7f00000004c0)=@string={0xa3, 0x3, "bd8076ee382f36904d73c2d1448f5261ba69f186cdafe543cf016442d00ab7c7f2caa9fcd1713129a9bf99a750b569122110dd5b1c691dab5536e19841f92add196a09c8507f249fe5ff4a96e921199009184794728cf02c4759faa7a0f83f769d709381abf803f9fe6598dcbebdf8e842a6c99eb52a2bfb0597da50caa0478ecb6041a15cb4cf7ac96d46c3919afa6f2a652197c342c702e26dbcbe4badc5fd95"}}, {0xe9, &(0x7f0000000580)=@string={0xe9, 0x3, "c0cdbea4ecca7ed24d194fd720250ce52d6ac49d2916eeed0cba7525dec37936c09715bc7a904596e7cb200596d172d3254d1e8f6a7bd99befd0768b4dfc79f5eeaf24049e5261ed04bb032986b17d3ee9f03c5e79c83b32a428c10ecb2e4f22bb670ea762955ae7da78bed1331a0d578737c2a98355ea0b4d95f8bf4cc64df353e65de3673d3bf17e4ecbb509854ce07c2a91b455354448ca464e17fd2a8e406231d45e18782f8af3237a443bcfd94d1baa8c7f0e3eb5658b6288a105592c29aa5d8f21c1d1133f95a2b1c26d6670c48084cbb8b4f7a66885f946136dec63b2b418cef3396e4f"}}, {0xf0, &(0x7f0000000680)=@string={0xf0, 0x3, "dd3440e11da350adf90947681d0899426f5dd7c99afd9ee3dbafe4bfa8e5d19ab155f6bc74ff52983d5cbc7d2ed24527a5650aad679c8d5d60f33e6fa19250c4d518696b03f5dddcfe49598e8a41c60913a567e7ed9c26cc1da2359dd0163cb458f28b83fbf53ffd99c3219f5d1b6abf24c11983906fa58412ace59c54f95a54560dc4035c089e8d86f195f19642d0381afee846a9bb6c650a01fb868a123937183da1e479b350933737dc0700bc2b11f5459e19175db0949d0218c4bc751d2aa0c47ff868a00701b68a74554fb1a3f13374fe10dd691d4e5152ce08c646cb7928d209116d7a5ef36492dbca0787"}}, {0xb6, &(0x7f0000000780)=@string={0xb6, 0x3, "a1ee2944655f05ac0f7aa60a236e8a55805e0a4fb08c7b67795d0a4e06732db4648102a39b43e32b60f92720e1d7e2eac8f5e156998b7ba823364655651c5c4df9b67264ea74fb1ab56570780ec55a9035a96c3367ae2a9485fe6df2916631cd38e6cc6324a08fe453feb4a7e7a0d6e72fe9d009e38a6950fa9a657a11f957ba4c50b99a2bc717956eb8acf38ae430a647ed540dce9a019af257ca1e3817cf43849a71c4191ecc877cbcb647670a8cd10d94c84b"}}, {0xbc, &(0x7f0000000840)=@string={0xbc, 0x3, "56009e8633913390949eb8eee59925e1c303e5b1c27283880a53bc295dd834bdec7d84e959efe73a5f76486a9610714fce0d82d70b41cb8547a013a1a43b5e1b9ebf05184075c65cf8ca5ec531a0835a19d23d76e00b2053cc7fde999aa44e7656c9be074efccbb8b232686828bb065b9cd74f89d54d7bcf0f0e81b1d9f948b6c281c8263a040b94258403186a9ebb3dc5e808c3cb8c21cd7e812a19e11b649faeab83e6fa290d444e78606dd5fdaa8669fb18d0c6a613eadb37"}}, {0x51, &(0x7f0000000400)=@string={0x51, 0x3, "015b97f71645789f822c87b3e4926e29f9df6c002b66ef132e4ba251d7888495c341fdd498f0efdd0de37ab16ec2d9713b84a78ff351803b4679784ec362775a11be82c05a0c7174bfa9ba94687916"}}, {0x7e, &(0x7f0000000900)=@string={0x7e, 0x3, "f778bf152e86d39b51b2073983fc2dc30972dcf514f8b0d7ced6427589b647d1daf61df24343fe04ce5b2c0108919f469cd5f3887541b4051da29fc1e82dd7f71e55e25a400f485e95fd0da7831644e332bb7f2538b07c147b9bb3680aec73f45ecccdf43359b9331ef29d11550c40c883fdd35d58392d5cd203a701"}}]}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000180)={0x3c, r5, 0x1, 0x70bd2c, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x99e}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xffff}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x980}]]}, 0x3c}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)) bpf$MAP_CREATE(0x0, 0x0, 0x48) r6 = socket$inet6(0xa, 0x800, 0x0) socket$tipc(0x1e, 0x2, 0x0) bind$inet6(r6, 0x0, 0x0) r7 = syz_io_uring_setup(0xf6d, 0x0, &(0x7f0000000140), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000fad000/0x1000)=nil, 0x1000, 0x2000003, 0x40010, r7, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141121) syz_io_uring_setup(0x38fe, 0x0, 0x0, &(0x7f00000001c0)) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000104a5270b7357000000925e4a44", @ANYRES32, @ANYBLOB="0dfa130016000000240012000c00010000000000000000000c0002f60800000001180000080001"], 0x44}}, 0x0) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x20, 0x19, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}}, 0x4010010) 10m2.268343304s ago: executing program 1 (id=1177): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) setgroups(0x0, 0x0) getgroups(0x0, 0x0) setregid(0x0, 0x0) syz_clone(0x22180, 0x0, 0xa42f, 0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0), 0x48441, 0x0) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) r2 = syz_io_uring_setup(0x51a4, &(0x7f0000000140)={0x0, 0xf865, 0x800, 0x1, 0x272}, &(0x7f0000000040), &(0x7f0000000000)) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r2, 0xc, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x22, &(0x7f0000000200)=0x1, 0x4) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000070601080000000000000000000000000500010006"], 0x1c}, 0x1, 0x0, 0x0, 0x12}, 0x20048004) recvmmsg(r3, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) recvmmsg$unix(r1, &(0x7f0000002440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}}], 0x1, 0x2, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x3, 0x1000002, 0x0, 0xff, "d46900b32b9cfe20fd5ac38d00"}) r4 = syz_open_pts(r0, 0x0) r5 = dup(0xffffffffffffffff) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0x3) dup3(r0, r5, 0x0) r6 = dup3(r4, r0, 0x0) ioctl$TIOCSTI(r6, 0x5412, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000840), 0x1a01, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={0x0}, 0x18) ioctl$EVIOCGPROP(r7, 0x40047438, &(0x7f0000000180)=""/246) 9m46.934896558s ago: executing program 32 (id=1177): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) setgroups(0x0, 0x0) getgroups(0x0, 0x0) setregid(0x0, 0x0) syz_clone(0x22180, 0x0, 0xa42f, 0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0), 0x48441, 0x0) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) r2 = syz_io_uring_setup(0x51a4, &(0x7f0000000140)={0x0, 0xf865, 0x800, 0x1, 0x272}, &(0x7f0000000040), &(0x7f0000000000)) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r2, 0xc, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x22, &(0x7f0000000200)=0x1, 0x4) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000070601080000000000000000000000000500010006"], 0x1c}, 0x1, 0x0, 0x0, 0x12}, 0x20048004) recvmmsg(r3, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) recvmmsg$unix(r1, &(0x7f0000002440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}}], 0x1, 0x2, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x3, 0x1000002, 0x0, 0xff, "d46900b32b9cfe20fd5ac38d00"}) r4 = syz_open_pts(r0, 0x0) r5 = dup(0xffffffffffffffff) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0x3) dup3(r0, r5, 0x0) r6 = dup3(r4, r0, 0x0) ioctl$TIOCSTI(r6, 0x5412, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000840), 0x1a01, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={0x0}, 0x18) ioctl$EVIOCGPROP(r7, 0x40047438, &(0x7f0000000180)=""/246) 7m12.011978999s ago: executing program 4 (id=1873): syz_open_procfs$pagemap(0x0, &(0x7f0000000140)) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="1201010200000010450c1251400001020301090224000101000000090400000000000100000003000001220000090581030000000000926a569315ffafa15f551bc522bd724855a67d92cdd3ef253ff209788e7ed8d7b6f1a65713e55a9f9c55117c6cb250e7f5d3f63afe530a94e04dcb04cdc6878247a7b98569368124a1f187fbe63331af641c45bf6b8b9f3bdf58b8cc92bb0cd81a83260dfa091a1c1821593a8c57d48b5c4d3e2cf46e2a8ff6f6eb8f3fb95ff22bef059471c8abd80b"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x4, &(0x7f0000000000)=@lang_id={0x4, 0x3, 0x409}}, {0x28, &(0x7f0000000600)=ANY=[@ANYBLOB="2873154308b9b7060070edbad8c4cafa196fa857d3b950958634d43ea2a530b3d92bbaafa0b640ec13bd5f4bdd54daefdf1f81589c3083124ebe402452fc647d78dbb9285540a1cc1f0a559b3dcec37b6333132e02c6c60e597b4c560028026bf6fc50e543c3cb6de1ade9d7cdba5666176c214cfb767fc1bdc69aaab173fb4c67a80acd366137fd291a15380e3109246e1bb3571aab5be46a30ec2e66ed62f312a60af8ad739fe88971cb93db26929358e5bd5a839d637dc09c3341a82bcb94c8318ef1ccf5cb7bb564d93ddb4ce77e9e1b1ca2fbe3150d88e3270c"]}]}) ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, 0x0) r0 = syz_open_dev$evdev(0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) userfaultfd(0x801) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r3 = syz_io_uring_setup(0x109, &(0x7f00000000c0)={0x0, 0x1b5d, 0x80, 0x0, 0x114}, &(0x7f0000000400)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000004c0)=@IORING_OP_SENDMSG={0x9, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0, 0x40080c4, 0x1}) io_uring_enter(r3, 0x8aa, 0x0, 0x0, 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$cdc_ncm(0x0, 0x5, &(0x7f0000000680)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0x40045506, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f0000000240)='asymmetric\x00', &(0x7f0000000500)=@chain) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000000c0)="ed5696c5820f070000000000000080be0200", 0x12) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0042, 0x0) 7m8.835759283s ago: executing program 4 (id=1892): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@dev, 0x0, r2}) (fail_nth: 9) 7m8.380768471s ago: executing program 4 (id=1893): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0x80000001, 0x4) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x20, &(0x7f0000000080)=[@in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e22, @remote}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000400)={r2, @in6={{0xa, 0x4e21, 0x4, @empty, 0x9}}, 0x4, 0x4, 0x624e, 0xa, 0x55, 0x7f}, 0x9c) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000001040)=ANY=[], 0xa0}, 0x8044) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x880) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r3, 0x29, 0x31, &(0x7f0000000040)=0x8000, 0x4) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x2a, &(0x7f0000001600)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x8}}}}}, 0x0) recvmmsg(r3, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes-generic)\x00'}, 0x58) socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r5, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r6 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r6, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x4, 0x0, 0x0, 0x7fffffff, 0x0, 0xfffffffffffffffe}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@rand_addr=0x64010100, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x1, 0x7}}, 0xe4) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) sendmmsg(r6, &(0x7f0000000480), 0x2e9, 0x0) socket$key(0xf, 0x3, 0x2) 7m7.457313691s ago: executing program 4 (id=1896): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x5b5}]}) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r1, 0x402, 0x8000003d) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x0, 0x1000000d) r2 = open(&(0x7f0000000000)='./bus\x00', 0x1, 0xc32a4cddd557707a) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeed, 0x10010, r2, 0xd73cb000) r3 = dup(r0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) mount$fuseblk(&(0x7f0000000080), &(0x7f0000000200)='./file0\x00', 0x0, 0x1151000, 0x0) mount$fuseblk(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x1813caa, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4800000000010104000000000000000002000000240001801400018008000100e00000ea14740108000200e00000010c0002800500010000000000100005800a000100482e323435000000ea1928f20628b1df1cae3f7d8c924a54114626156b923522f01807861f5c7130cabe5727f4af7d991c1d52291e830afff0b348b2fa8fe56f1a05f252650bc2dd75d1879007719ed2"], 0x48}}, 0x0) write$UHID_INPUT(r3, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, r1, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x3, &(0x7f0000000580)=@framed={{0x18, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kmem_cache_free\x00', r6}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f00000000c0)='ext4_allocate_blocks\x00', 0xffffffffffffffff, 0x0, 0x3}, 0x18) r7 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r7, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r7, 0x0) r8 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r8, &(0x7f0000002300)={&(0x7f0000000040)=@name={0x1e, 0x2, 0x1, {{0x42, 0x200000}, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x404c800}, 0x0) sendmsg$tipc(r8, &(0x7f00000002c0)={&(0x7f0000000080)=@nameseq={0x1e, 0x2, 0x0, {0x41}}, 0x10, 0x0}, 0x0) accept4(r7, 0x0, 0x0, 0x400000000000000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) 7m6.527839814s ago: executing program 4 (id=1904): r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='devfreq_frequency\x00', 0xffffffffffffffff, 0x0, 0xb}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001600), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_PORTS(r1, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000001640)={0x1c, r2, 0x1}, 0x1c}}, 0x0) close_range(r0, r1, 0x2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) mlock2(&(0x7f00004af000/0x1000)=nil, 0x1000, 0x1) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r3 = openat$nvram(0xffffff9c, &(0x7f0000000140), 0x8000, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x12, &(0x7f00000000c0)=0x100000001, 0x4) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x1fd, 0x1, 0x0, 0x2000, &(0x7f0000bd3000/0x2000)=nil}) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r6, 0x0, 0x0) wait4(r6, 0x0, 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) r8 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000000)={0xfffffff8, 0x0, 0x400}, 0x10) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c00000012009703000000000000000007000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000a0001"], 0x2c}, 0x1, 0x0, 0x0, 0x40010}, 0x880) ioctl$KVM_GET_VCPU_EVENTS(r7, 0x4048aecb, &(0x7f00000000c0)) r9 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r9, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) setsockopt$inet6_int(r9, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r9, &(0x7f0000000a80)=[{{&(0x7f0000000400)={0xa, 0x4e23, 0x0, @loopback}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000000800), 0x0, 0x12141, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 7m6.116017632s ago: executing program 4 (id=1907): bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="1e0000000000000000", @ANYRES32], 0x20) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000180)={'\x00', 0x6}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)={0x1c, 0x0, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8}, @void}}}, 0x1c}}, 0x40) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f00000000c0)={0x20, 0x5, 0xe}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000009a02"]) r3 = socket$can_bcm(0x1d, 0x2, 0x2) fsetxattr$system_posix_acl(r3, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f00000002c0)={{}, {0x10}}, 0x24, 0x0) ioctl$sock_SIOCGIFCONF(r3, 0x8912, &(0x7f0000000340)) 7m5.319014231s ago: executing program 33 (id=1907): bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="1e0000000000000000", @ANYRES32], 0x20) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000180)={'\x00', 0x6}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)={0x1c, 0x0, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8}, @void}}}, 0x1c}}, 0x40) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f00000000c0)={0x20, 0x5, 0xe}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000009a02"]) r3 = socket$can_bcm(0x1d, 0x2, 0x2) fsetxattr$system_posix_acl(r3, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f00000002c0)={{}, {0x10}}, 0x24, 0x0) ioctl$sock_SIOCGIFCONF(r3, 0x8912, &(0x7f0000000340)) 6.512525816s ago: executing program 3 (id=3462): r0 = add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000080)={'fscrypt:', @desc1}, &(0x7f0000000100)={0x0, "075914fcb547fdcac6670da17ff3b169656eac5e899085ea56426d61d2b0e2804003186db4cc86bddd4fe1d8e7a0a3625a1efc8de6f1f9bf86bfb3f22d2dfd1b", 0x2e}, 0x48, 0xfffffffffffffffc) keyctl$update(0x2, r0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001540)={0x0, 0x0, 0x0}, 0x0) r1 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000100)={@host}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f0000000040)={{@local, 0x200001}, @local, 0x8, 0x6, 0x347, 0x80000004, 0x24b, 0x10001, 0x9}) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000100)) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000000040)={0x80000000}) r3 = syz_open_dev$midi(&(0x7f0000000180), 0x2, 0x2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x9c, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x70, 0x3, 0x0, 0x1, [{0x6c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x60, 0xb, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc}]}}}, {0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x3}]}}}, {0x10, 0x1, 0x0, 0x1, @dup={{0x8}, @val={0x4}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x120}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=@updpolicy={0xc0, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {}, {0x0, 0x0, 0x40000000000000}}, [@offload={0xc, 0x1c, {0x0, 0x4}}]}, 0xc0}}, 0x0) r6 = socket$inet_smc(0x2b, 0x1, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f00000000c0)={0x1d, r8}, 0x18) connect$can_j1939(r7, &(0x7f0000000140)={0x1d, r8}, 0x18) setsockopt$inet_mreqn(r6, 0x0, 0x20, &(0x7f00000001c0)={@initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010102, r8}, 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e001400028008000100080000000600020001"], 0x54}}, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x15) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r3, 0xc0305720, &(0x7f0000000040)) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000000104038a0000000000000000000000000a00020000000000020000000500010001"], 0x28}}, 0x0) 6.280773475s ago: executing program 3 (id=3463): socket$inet6(0xa, 0x3, 0x6) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x42, 0x0) io_setup(0x20, 0x0) io_submit(0x0, 0x1, &(0x7f00000001c0)=[&(0x7f0000002040)={0xf, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000080)="0d32818e7e6ae0", 0x7}]) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000240)={@loopback, 0x480007fc, 0x0, 0x1, 0x8, 0x3, 0x43b}, 0x20) 6.13976753s ago: executing program 3 (id=3464): r0 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a440000104000109026000420100000009040000010209"], 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='devices.list\x00', 0x275a, 0x0) r2 = io_uring_setup(0x610f, &(0x7f0000000200)={0x0, 0x0, 0x2, 0xfffffffc, 0x0, 0x0, r1}) io_uring_register$IORING_REGISTER_BUFFERS2(r2, 0xf, &(0x7f0000001580)={0x3, 0x0, 0x0, &(0x7f00000014c0)=[{0x0}, {0x0}, {&(0x7f0000000280)=""/4094, 0xffe}], 0x0}, 0x20) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r2, 0x10, &(0x7f0000001b00)={0x0, 0x0, &(0x7f0000001a80)=[{0x0}, {0x0, 0x700}, {0x0}], 0x0, 0x3}, 0x20) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000740)={0x30, 0x5, 0x0, {0x0, 0xffffffffffffffff, 0x3, 0xfffffffc}}, 0x30) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') fchdir(r3) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000001280)=[@in6={0xa, 0x4e23, 0xabd, @empty, 0x2}, @in6={0xa, 0x4e1d, 0x0, @dev={0xfe, 0x80, '\x00', 0x29}, 0x9}], 0x38) sendto$inet6(r4, &(0x7f0000000500)="a4", 0x34000, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) socket$inet6(0xa, 0x800, 0x3) socket(0x10, 0x3, 0x0) r5 = epoll_create1(0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000012c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004", @ANYRESOCT=r3], 0x48) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x3}, 0x0, &(0x7f0000001300)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7effffff}, 0x0, 0x0) r6 = socket$unix(0x1, 0x2, 0x0) setsockopt$sock_int(r6, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000000080)={0xa002a008}) close(0x4) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000180)={0x0, &(0x7f00000000c0)=[0x0, 0x0], 0x0, 0x0, 0x0, 0x2}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000100)={0x0, 0x0, r7}) r8 = syz_usb_connect(0x2, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b"], 0x0) syz_usb_control_io(r8, 0x0, &(0x7f0000000bc0)={0x84, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r8, 0x0, &(0x7f00000006c0)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="15b381d5efeb5abe946fcdcf97d779d64823dcdd0616487fb38104436c9b46032957b42680ae05b9cf6f1d3c7169408f8d19489083ba4d72ae7d7c495aaaa9bd0718d33ecfe73d65b65ba6460855b0078058f32620bfc92603a312a490321538d7f8cd81838478032535f0b168770c027673dc15a8"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 6.008193408s ago: executing program 6 (id=3467): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2800000012000101a10000000000000007000000", @ANYRES32=0x0, @ANYBLOB="000000000000000008001d008b"], 0x28}, 0x1, 0x0, 0x0, 0x24000010}, 0x44804) 5.931195114s ago: executing program 6 (id=3468): mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) syz_emit_ethernet(0xae, &(0x7f0000000000)=ANY=[], 0x0) 5.930555619s ago: executing program 6 (id=3469): r0 = socket(0x10, 0x3, 0x0) unshare(0x6a040000) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000140)=0xec62, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000840) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) modify_ldt$write(0x1, &(0x7f0000000000)={0xfff}, 0x10) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x0) r3 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x80, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f00000000c0)={0x6, "89698ab74a98235749a9a89924cc7208716bde2e9da33997943b7e3eafdabafb"}) syz_emit_ethernet(0x46, &(0x7f0000002e80)=ANY=[], 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000001440)={'veth1_to_bond\x00', &(0x7f00000005c0)=@ethtool_dump={0x3e, 0x1, 0x900000a}}) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0185648, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000040)=ANY=[@ANYRES16], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x100}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) quotactl_fd$Q_SYNC(r4, 0x80000305, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0x18, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b70300001eb100008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000000000008500000085000000b7000000000000009500"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r6, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) 5.115528635s ago: executing program 2 (id=3470): r0 = openat$hwrng(0xffffff9c, &(0x7f0000000000), 0x400680, 0x0) r1 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="4800000010004b04000000000000000500000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002800128008000100677265001c00028006000e0001000000060003008000000008000700e0"], 0x48}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f00000000c0)={'fscrypt:', @desc1}, &(0x7f00000001c0)={0x0, "28d7b07d54891881fe02c1203fe49696b9f26f2da4149683f065714f8a61d1f32c9d064bbd27b2aa57459cff33a3a9831ac46b8829b48fff3d63520d260804d0"}, 0x48, 0xfffffffffffffffd) keyctl$setperm(0x5, r5, 0x0) r6 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000340), 0xf2, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r6, r6, r6}, &(0x7f0000000140)=""/58, 0x3a, &(0x7f0000000100)={&(0x7f0000000080)={'sha1-ssse3\x00'}}) keyctl$dh_compute(0x17, &(0x7f0000000080)={r5, r6, r1}, &(0x7f00000001c0)=""/173, 0xad, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r1, r3, 0xa1) keyctl$update(0x2, r1, &(0x7f0000000140)="c4", 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x1b) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r0) r7 = syz_usb_connect(0x4, 0x36, &(0x7f0000000100)=ANY=[@ANYRESHEX=r0, @ANYBLOB="aa4b88cb7aa208973173a2a2a921d96fda711cda95ce57a506bad07ca57e02f7b0b949c9d57a6a527377c3da8f23227cdc5b72178dfbc71c404be6ec1de7c9a6cf282c838020fc068019275d9607003b85dd6c8054d88330fabee958e843748788f784922a9266", @ANYRESHEX=r0, @ANYRES32=r3, @ANYRES32, @ANYRESOCT=r0], 0x0) syz_usb_control_io(r7, 0x0, 0x0) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) ioctl$BTRFS_IOC_LOGICAL_INO(r4, 0xc0389424, &(0x7f0000000340)={0x7, 0x18, '\x00', 0xcb65f7be572068fb, &(0x7f0000000300)=[0x0, 0x0, 0x0]}) keyctl$reject(0x13, r1, 0x1000, 0x4, r1) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r4) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000500)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r4, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x28, r8, 0x4, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x780c, 0x2e}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x18000) 4.983929228s ago: executing program 6 (id=3472): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240), 0x8040, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x4, 0x0, 0x0, "ff00f7000000000000000000af88008300"}) r2 = syz_open_pts(r1, 0x141601) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c050000180001002dbd70d7000000000002222000ff03c8080000000008000500ac1e000108001e000c00007ec49fad4e3c9ff2a8cd1fb99c2dce4849fad12c34a0e31915c6b0"], 0x2c}, 0x1, 0x0, 0x0, 0x4008800}, 0x24040880) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELRULE={0x2c, 0x8, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x74}}, 0x0) write(r2, &(0x7f0000000000)="d5", 0xfffffedf) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x8933, &(0x7f00000002c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="05002abd7000fddbdf2501000000400008803c00008024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b1400040002004e227f000001000000000000000008000100", @ANYRES32=r8], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x40) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000080)={0x8, 0x20000000, 0xfffffffc, 0x7fffffd, 0x5, "682341f2fd71a6a76177920ea7e60c0ac7a4a5"}) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r5, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x30, 0x0, 0x90a, 0x70bd27, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0xfffffffe, 0x1000, 0x7, 0x400}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x14000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) add_key(&(0x7f0000000040)='keyring\x00', 0x0, &(0x7f00000001c0)="b298273df7", 0x5, 0xfffffffffffffffb) r9 = syz_io_uring_setup(0x113, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x20000000}, &(0x7f0000000200)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x3c}, 0x1, 0x0, 0x0, 0x4004042}, 0x0) syz_io_uring_submit(r10, r11, &(0x7f00000004c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x40, 0x0, r12, 0x0, 0x0, 0x0, 0x2102, 0x1}) io_uring_enter(r9, 0x8aa, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000180)={@local, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "3000bb", 0x10, 0x2b, 0x0, @private2, @local, {[@fragment={0x3a, 0x0, 0x3, 0x1, 0x0, 0x16, 0x67}], {0x0, 0x500, 0x8}}}}}}, 0x0) 4.636469942s ago: executing program 5 (id=3475): r0 = socket(0x80000000000000a, 0x2, 0x0) fchdir(r0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000680)={0x20000000, {{0xa, 0x0, 0x6, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x20000}}, {{0xa, 0x0, 0x6, @ipv4={'\x00', '\xff\xff', @broadcast}}}}, 0x104) r1 = open_tree(0xffffffffffffff9c, 0x0, 0x89901) ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020662a, &(0x7f0000000300)={0x8, 0x3, 0x4, 0x200000, 0x3, 0x0, [{0x5, 0x0, 0x7, '\x00', 0x308a}, {0x9, 0x81f4, 0xd795, '\x00', 0x85}, {0xff, 0x7, 0x9, '\x00', 0x204}]}) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000440)='wlan0\x00', 0x10) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000040)=0xa294, 0x4) sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r4) umount2(&(0x7f0000000000)='.\x00', 0x9) syz_usb_disconnect(0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(0xffffffffffffffff, 0xc08c5336, &(0x7f0000000240)={0x0, 0x2, 0x0, 'queue0\x00'}) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042402024424"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) 4.559444142s ago: executing program 2 (id=3476): r0 = open(&(0x7f0000000180)='.\x00', 0x628080, 0x189) signalfd(r0, &(0x7f0000000140)={[0xa]}, 0x8) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x12, 0x3, 0x2, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='br_fdb_add\x00', r2}, 0x10) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x0, 0x0) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r4, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f000000b5c0)={0x8, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) move_pages(0x0, 0x1, &(0x7f0000000040)=[&(0x7f0000704000/0x4000)=nil], &(0x7f0000001180), 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x129142, 0x1fa) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000680)={'#! ', './file0', [], 0xa, "4df8145e8b1ad01516ea1562938fffb1fd60a84b67f4ef2c21246891351a2bfb9195de101b9a2c8f62d83f29c4849e78c343be6c43f1110a55539a6866b1016b524db5260c05b1402602d63970cdb00fd04ce8e9ea03af10f41a5c7fc024eac4583909a79bb04519283afe9ebd3caf7f5e910d00ac3bab72eee532146a24f2682e5655787f34a14e882d289a1a93c53672508d144012f843145a752f75aa0ae8b623ea20ffa41f33837a0a1a1a0bc54a0eb957ce4b68c390f0dd04f45032"}, 0xc9) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000006, 0x10012, r6, 0x0) close(r5) execveat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', &(0x7f0000001440), 0x0, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r7, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@ipv4_newrule={0x2c, 0x20, 0x801, 0x0, 0x0, {0x2, 0x20}, [@FRA_DST={0x8, 0x1, @multicast2}, @FRA_GENERIC_POLICY=@FRA_SUPPRESS_PREFIXLEN={0x8, 0xe, 0x101}]}, 0x2c}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="600000000206050a00000000000000000000000005000400000000000900020073797a3200000000140007800800064000006a000800084000005fdc050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="280000001c000100000000000000000007000000", @ANYRES32=r11, @ANYBLOB="4000aa000a0002"], 0x28}}, 0x0) r13 = socket$inet6_dccp(0xa, 0x6, 0x0) write$6lowpan_enable(r4, &(0x7f00000002c0)='0', 0x1) setsockopt$IP6T_SO_SET_REPLACE(r13, 0x29, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0x2b8, 0x182, 0x0, 0x0, 0x1d8, 0x3a8, 0x3a8, 0x1d8, 0x3a8, 0x3, 0x0, {[{{@uncond, 0x0, 0xa4, 0xec, 0x0, {0x0, 0xe0ffff00000000}}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xf7db, 'syz1\x00'}}}, {{@uncond, 0x0, 0xa4, 0xec}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x100, 'syz0\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x2fc) 3.991866321s ago: executing program 6 (id=3477): r0 = socket(0x10, 0x3, 0x0) unshare(0x6a040000) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000140)=0xec62, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) modify_ldt$write(0x1, &(0x7f0000000000)={0xfff}, 0x10) modify_ldt$write(0x1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x0) r4 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x80, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000000c0)={0x6, "89698ab74a98235749a9a89924cc7208716bde2e9da33997943b7e3eafdabafb"}) syz_emit_ethernet(0x46, &(0x7f0000002e80)=ANY=[], 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000001440)={'veth1_to_bond\x00', &(0x7f00000005c0)=@ethtool_dump={0x3e, 0x1, 0x900000a}}) r5 = openat$vicodec0(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r5, 0xc0185648, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000040)=ANY=[@ANYRES16], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x100}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) quotactl_fd$Q_SYNC(r6, 0x80000305, 0x0, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0x18, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b70300001eb100008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000000000008500000085000000b7000000000000009500"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r8, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) bpf$MAP_CREATE(0x1900000000000000, &(0x7f00000003c0)=ANY=[@ANYRES8=0x0, @ANYRESOCT=r4, @ANYRES8=r7, @ANYRESOCT=r3, @ANYRES16=0x0, @ANYRESDEC=r4, @ANYRESOCT], 0x48) 3.891675355s ago: executing program 2 (id=3478): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() r0 = socket$key(0xf, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000040)={0x3, 'veth1_to_bridge\x00', {0x78}, 0x7}) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$inet6(0xa, 0x806, 0x0) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @rand_addr, 0x9}, 0x1c) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x100) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f0000000200)=0x1, 0x4) listen(r2, 0x3) shutdown(r2, 0x0) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) exit(0x0) r4 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket(0x1, 0x803, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000a00)=ANY=[@ANYBLOB="c3070000000000006311730000e8003f070400000000000095000000000000006aebdb7e47fd3418a03b9f061f8cbf19f0abe792b762afb67b25d097591f7c2f28e5b9ed285518d2874b13234b984d577542689be276f45f16ea0c2855b8fdd137810fdddd89841f8f06493cdb0c01fe24632a84f5b1eecffb80e7b3b89fcfc48336df2c0aeac42821ce771783a6c75eec5454c4c0fcf5db516d87ef70276329525314521485682639637955c13af0938865ba20f7513af33f886b1b34fb75714da6339a03545628132ed6a3b30d0c5584e6f02e7f8c8482e72818319073610eca1b0a1bc2bdaf84ef041edda3a87672b1e6ba18be8d056938b1722fa30bb6a6368e643f40e94423fd65c32914b79873e1e2ba9c092591e17be0e5adabbe"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xb579, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x23) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3400000000000a4055d38cac8717ad1657705500", @ANYRES32=r7, @ANYBLOB="14000200ff0200000000000000000000000000010800080002070000"], 0x34}}, 0x0) r8 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r8, 0x10f, 0x87, &(0x7f0000000280)=@req3={0x2, 0x1, 0x7, 0x9, 0xc, 0x2a5e, 0xffffffff}, 0x1c) r9 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r9, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fe, 0x200}, 0x10) sendmmsg(r5, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f00000002c0)}}], 0x1, 0x9200000000000010) recvmmsg$unix(r8, &(0x7f0000005100)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000100)=""/94, 0x5e}], 0x1}}, {{0x0, 0x0, &(0x7f0000002700)=[{&(0x7f0000002680)=""/70, 0x46}], 0x1}}], 0x2, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r10, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r10]) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4e22, 0xffffffff, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) 3.44862713s ago: executing program 0 (id=3479): mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) syz_emit_ethernet(0xae, &(0x7f0000000000)=ANY=[], 0x0) 3.182476111s ago: executing program 0 (id=3480): r0 = openat$dma_heap(0xffffff9c, &(0x7f00000000c0), 0x80, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'stdrng\x00'}, 0x58) syz_io_uring_setup(0x10f, &(0x7f00000000c0)={0x0, 0x211a, 0x0, 0x4, 0x306}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000040)=0xffefffdc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x1, r2, 0x0}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8001c00180081064e81f782db44b9b545c7910006007c09e8fe55a1", 0x1c}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000210081044e81f7d28344b904020000", 0x13}], 0x1}, 0x4000010) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r7, 0x4048ae9b, &(0x7f00000001c0)={0x70003, 0x0, [0x7, 0xb, 0x2, 0x9, 0xfffffffffffffff7, 0x6, 0x3000000002, 0x35fe7901]}) ioctl$KVM_RUN(r7, 0xae80, 0x0) connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x2, 0x0, 0x2, 0xfffe, {0xa, 0xfffe, 0x0, @remote, 0x4}}}, 0x32) close(0x3) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="3ce2f76f28548ca29943fcffffffb2e17d000300", @ANYRES32=0x0, @ANYBLOB="20000000000002001c0012800900010069706970000000000c00028006000f0005000000"], 0x3c}}, 0x0) r9 = socket$rds(0x15, 0x5, 0x0) recvmmsg(r9, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd26}}], 0x40000000000009c, 0x2160, 0x0) r10 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r10, 0xc008551a, &(0x7f0000000040)={0xa, 0x8, [0xfffffffd, 0x10001]}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r11 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r11, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x200000}, 0x1c) 3.039730379s ago: executing program 3 (id=3481): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) openat$yama_ptrace_scope(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) openat$yama_ptrace_scope(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) socket$unix(0x1, 0x1, 0x0) (async) socket$unix(0x1, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x1, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000000)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x1, 0x7fffffff}, 0x0, 0x0) connect$unix(r1, &(0x7f0000000080)=@abs, 0x6e) readlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)=""/243, 0xf3) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), r3) sendmsg$TIPC_NL_MON_GET(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)={0x14, r4, 0x32b, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) (async) sendmsg$TIPC_NL_MON_GET(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)={0x14, r4, 0x32b, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4004, r0, 0x2}) write$binfmt_format(r5, &(0x7f0000000240)='1\x00', 0x2) r6 = syz_open_procfs(0x0, &(0x7f0000000440)='fdinfo/4\x00') read$FUSE(r6, &(0x7f0000001f40)={0x2020}, 0x2020) 3.029261966s ago: executing program 2 (id=3482): r0 = socket(0x10, 0x3, 0x0) unshare(0x6a040000) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000140)=0xec62, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000840) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) modify_ldt$write(0x1, &(0x7f0000000000)={0xfff}, 0x10) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x0) r3 = openat$sw_sync(0xffffff9c, &(0x7f0000000040), 0x80, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f00000000c0)={0x6, "89698ab74a98235749a9a89924cc7208716bde2e9da33997943b7e3eafdabafb"}) syz_emit_ethernet(0x46, &(0x7f0000002e80)=ANY=[], 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000001440)={'veth1_to_bond\x00', &(0x7f00000005c0)=@ethtool_dump={0x3e, 0x1, 0x900000a}}) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0185648, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000040)=ANY=[@ANYRES16], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x100}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) quotactl_fd$Q_SYNC(r4, 0x80000305, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0x18, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b70300001eb100008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000000000008500000085000000b7000000000000009500"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r6, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) 2.88854862s ago: executing program 0 (id=3483): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_open_dev$vbi(&(0x7f0000000080), 0x0, 0x2) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000300)={0x4376ea830d4d549b, 0x0, [0x9, 0x7, 0x0, 0x0, 0x5, 0x3, 0xfffffffffffffffc, 0x800000]}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f00000ab000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000140)="36d0e866b8970000000f23c80f21f866350c00a0000f23f89d0f326635000400000f302e8dcc0f23742e3b5753baf80466b8f494f78e66efbafc0c66b83ac80000666fda6509", 0x46}], 0x1, 0x1a, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x28b) ioctl$VIDIOC_S_CROP(0xffffffffffffffff, 0x4014563c, &(0x7f0000000040)={0x9, {0xa15c, 0x404, 0x7, 0xffffffff}}) 2.784731295s ago: executing program 5 (id=3484): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) statx(0xffffffffffffffff, &(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x7100, 0x7ff, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/netlink\x00') lseek(r2, 0x111, 0x0) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) setsockopt$sock_int(r3, 0x1, 0x12, &(0x7f0000000080)=0x7ff, 0x4) syz_emit_ethernet(0x66, &(0x7f0000000000)={@local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x30, 0x88, 0x0, @remote, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x3, {0x0, 0x6, "5f07d2", 0x0, 0x0, 0x0, @mcast1, @private0}}}}}}}, 0x0) syz_emit_ethernet(0x1a1, &(0x7f0000001040)={@local, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000210", 0x16b, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, [{0x18, 0x1, "00d414ce8ad4"}, {0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x5, 0x1b, "005ff92900c5ab4992020900aec0c31fe17bfc43b9234b70454d0ee3c7774490141285e8c19e659d7398ff692ad764939ce83cf87885c1ba8d1b52b51bea6baa7195e11cee4fb35de4cee30b6c59b358cb5123fdefb7bdf453e45ed053b5e108f1289257f07b0ad277b544cd5f6795277ca9210675f3c16eaa6ce44a03a653aa67408567bf01254a137f1d3091cd14ed5d6c3c25879037574724c3129d8862dcca394518fe41afc49bb63de03fc15c64c1d5db5ebac5a7b26225fa272101335cf582fcaa757b66a0b2d3f60faa5a9b08e2a2f67ac3dfdf"}, {0x18, 0x5, "aace49d3309292c341ace5b1886d5602c075176b808ba538f4172998fc01f94be1886976a3e7"}]}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000240)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010100000000000000002b00000008000300", @ANYRES32=r4, @ANYBLOB="0a0034000101010101010000080026006c09000008002700"], 0x40}}, 0x0) 2.552744962s ago: executing program 5 (id=3485): socket$inet6(0xa, 0x3, 0x6) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x42, 0x0) io_setup(0x20, &(0x7f0000000180)=0x0) io_submit(r1, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000240)={@loopback, 0x480007fc, 0x0, 0x1, 0x8, 0x3, 0x43b}, 0x20) 2.270397016s ago: executing program 0 (id=3486): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x10, 0x11, 0x0, 0x1, @counter={{0xc}, @void}}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x4}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xd4}, 0x1, 0x0, 0x0, 0x4000801}, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x0, 0xb, 0x0, 0x0, 0x7995}, 0xfcb5, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) r2 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f00000002c0)={0xf0f045, 0x800}) poll(&(0x7f0000000140)=[{r2, 0x19f23}], 0x1, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000080)=0x6490, 0x4) ioctl$USBDEVFS_FREE_STREAMS(r3, 0x802c550a, &(0x7f0000000000)=ANY=[]) ioctl$USBDEVFS_REAPURB(r3, 0x4008550c, &(0x7f00000002c0)) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000080)={0x90000015}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000580)=0x2) 2.123486715s ago: executing program 3 (id=3487): socket(0x10, 0x3, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x219000, 0x1000}, 0x20) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x20, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'ipvlan1\x00'}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) gettid() r5 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}}, 0x5c) setsockopt$MRT6_FLUSH(r5, 0x29, 0xd4, &(0x7f0000000100)=0x2, 0x4) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000003c0)={&(0x7f0000000200)=""/60, 0x10000, 0x0, 0x4, 0x3}, 0x1c) r6 = socket$nl_route(0x10, 0x3, 0x0) mq_open(&(0x7f0000000140)='s(\x00', 0x40, 0x21, &(0x7f00000001c0)={0x6, 0x7ff, 0xa4b, 0xaa}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bond_slave_0\x00', 0x0}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000000)={0x0, 0xfffffffffffffeaf, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYRES16=r1], 0x70}}, 0x0) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000054000100000000000000000007000000", @ANYRES32=r7, @ANYBLOB="20000100", @ANYRES32, @ANYBLOB="010003007f0000"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@getqdisc={0x48, 0x26, 0x200, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r10, {0x4, 0xfff2}, {0x9, 0x5}, {0x0, 0xe}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x4c080) 1.996355294s ago: executing program 2 (id=3488): add_key$user(0x0, &(0x7f0000000340)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000580)='x', 0x1, 0xfffffffffffffffe) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_SUBMITURB(r1, 0x802c550a, &(0x7f0000001340)=@urb_type_iso={0x0, {0xf}, 0x0, 0xa1, 0x0, 0x0, 0x0, 0x4, 0x1, 0x7ff, 0x5, 0x0, [{0x8, 0x0, 0x1}]}) r2 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f0000000340), 0x584, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r2, r2}, 0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)={'sha1-generic\x00'}}) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f00000083c0)={{0x3, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r3, 0x40505412, &(0x7f0000000240)={0x4, 0x8000, 0x8000, 0x0, 0xd}) 1.873371738s ago: executing program 6 (id=3489): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000008c0)=ANY=[@ANYBLOB="6c0000001000010400d201000072f60000020000", @ANYRES32=0x0, @ANYBLOB="0524060000000000300012800b0001006272696467650000200002800c002e00fffff6ffffffffff050007001f000000060027000000000008000a00a8"], 0x6c}}, 0x0) r0 = socket(0x10, 0x3, 0x7) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x74, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_SREG={0x8}, @NFTA_PAYLOAD_BASE={0x8}, @NFTA_PAYLOAD_LEN={0x8}, @NFTA_PAYLOAD_OFFSET={0x8}, @NFTA_PAYLOAD_CSUM_TYPE={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_PAYLOAD_CSUM_OFFSET={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x9c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0x0, 0x800) r2 = syz_open_dev$vim2m(&(0x7f0000000040), 0x40003, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000000)={0x1b, 0x1, 0x0, "6906fffffeffffffffff568eb4f80102f5372f2c74f6025c55f11fd3454ad23d", 0x3147504d}) r3 = fsopen(&(0x7f00000003c0)='jfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000280)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\bb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xd7\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000280)={{0x12, 0x1, 0x141, 0xf2, 0xc5, 0x96, 0x20, 0x16d0, 0x10b8, 0xde8e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x0, 0x0, 0x83, 0xec}}]}}]}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) syz_open_dev$sndpcmp(0x0, 0x0, 0xa0202) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="680000001c"], 0x68}, 0x1, 0x0, 0x0, 0x8850}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6016000000102b00fc0100000000000000e2ff0000000000fe8000000000000000000400000000aa"], 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0xa}, 0x20) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x40000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x3}, 0x1c) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="22c8e2f86498c7bbef040200000100"], 0x9) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000080)={0x5ee, 0x0}, 0x8) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000100)={0x2, 0x4, @dev={0xac, 0x14, 0x14, 0x26}}, 0x10, &(0x7f00000005c0)=[{&(0x7f0000000440)="8ce3249ff3822cb6272d363b674281b76865b7808275d1e7e62c812b2c97784299d9f2266f96c330ceddd6565caa6cc5b00808202a8b4b5892749b872d30757d8d2cc622e3b08d3b98ee7b6ca3ca182466cd51de963df33f95", 0x59}, {&(0x7f00000004c0)="63468adc1e8b08e9821d5dcf14ef8682d0d228b5964a4c4f9dc39458d9c9b8f2c183e8a197faa7a71b3b32b5688e178509dcd94ef63fe53db60a86e747b642b0458d82447b836f031d527bf43f69ead25c262361062cfb7c0d4c00f10bdf6e47882eb1c2", 0x64}, {&(0x7f0000000540)="0d694d03a1bc249dd97209c607c2160cc0ad177d70021c2a50a4522de00e2a89fd9e115874a0d0bc6f9b3130016e3e2d679bd0d915288fd0bb0c17db4c7c0b8fb6", 0x41}, {&(0x7f0000002940)="dc9816726b42125ce664a5b7144dab8defee2c4c584217c32e998fbd959f6e8c83a14da0f179faa272badd4c39710cb11ab5927e73ddbbb0df9acf9888dfb25e320e38e6704c182c4332f3c68704974d9fb827ec584c34aa4fcee1ac7af61ac5ff9f8b528ce6d61c6dfc82db80ea314844a4406bece52c3be170658d37dd4448dde89bc7f75f5f17dfa16d147d610e28fec46540d43b425ce3712ac87005d4e7aa428a66f915908b7549451acbedb22d26ae50782990e3a833937638c3807584896beb8f4e679b54ed5956e5bfaa2bd7de2d8a26892562b195584d871e8a20c4b30cba0b7d583dc9b23406c1362c6d18506497ae7e03f7ae22a101ab1f4a943472dde47f5e422baaebf0b6257061d192a443a07bb517617220db82b36407aaadc057c17a607439a5133be1dbb2cdb0fb52c6411bde727d2657ee9dff0e4228d39ed47e07a8d1f3e5ff5d725e618ef97c4280b3cebd782c71b9275793ba09314e74ccef63549acdec13b586622eefc702ab2c20b77f245f18b646efa84a17ae6117217b97c79752f1ecea7885b7c3289dda518423f427d4dda40c6890f82dee49c0ec40d2e49e5367c3b1c3085eaef9137dffddeec93f9f6ca901512e9de94b81421634d348fbb9983f7ee0c6d58614cd5e5224de51d14f3dece801fe00fadde03f6d440f2f66feb1a8d53e8b3e2910080c694f6a510bda814436a409de88a76158ba4e6a0aa42658b54e9d7db96b4a8640514c2c088df3ed24fb32c38fbe64734fc9e179edbedd683537e742617c851bb0dd82111eb2a21ab33dc5df7ac426259b2283b0b60fa37f94951b059bde1c3dfc2ea53a13c0ad3f610bed29a4a689d51558f21e11cfd513d55fde6be06696203da11947a56b5dfc85a2721c029d7b4ba4f9cc123079c6d2d39392281a56c8c817a99fee748348318cbb82016569215bab1338f56f0d54181098d3ef94907b8d02e7d9981e1848a336a45d3dfe7973f8b209526ad59f5c0c692cdcd219ce328f26828121b975379b09a40b18a41acff1b6f91a1b3db0e82fde59fd7e600f22dba5a4ad184b72c2e222d29eae901211bb4b96cf4880e19650ca89516ff790b6ce0fa93377faed4d5aec2c8760fd2ff0d4f12be09a93a3e2e1477be1f16eba9543a0d9ef6a9f4f7073c183be06cd824138286be800695c7c554fbafefb0ce7dc778932d101b3aebdc62096413b4f2f138e1be0ad047c3f6b993017305d8a76392d19b6d3a7367242f5ef581343728b145778fe1b79bcdf107038677e25eab298ce12e514ab85aea01d8ffe19e38f5ee663db5fe2f56e9c7f0d3f672b8df8c6def05af14a2d33eb045b58bc068c2cc67c1e24d3c0d18e34b8125258d526e9c73049b1a11949b80b662385812ac3dbcdb8aa433a1c0f43118e8c3b46e9f5ac4e59e3c7e57791b79fda8593e6dafd5d89258ebb288599881f4d40511cb8ee594212f8e4447c7b73b4868cd9cdf25ce712fc4e271509316be3e1cec94879e2eb4b9ad4b0e4e91fd09d011848000efc2fde8a4da277d6390b43ddc08cf3c4dc84b4483432d89ddba5d9067314be14fba69ab553e0670cb691702d8f9462dbc01ceee988f6fa2fc16613db782dd69b74bff8a6c434fb0f3a2c5ff9c4aefd46f9ea10d834f09595caba282d35b3dc762d80877f259543d0c4086ca7c9527c27bd8a1934fcbccd7ef3c543b0556d1dd20bf48fe71b917339f09990e789fecbd90829a8112017f1e5f14b55078ba5e580ef7cb2518f8ecc003df3de07838f2dfc2864bd7b308c1c97299e250e357e8527dc5bcba07e95aaff42102af123d976d082d8970d925b38e52cb76c2deed1bc8bd2397b666535f0aa508f30e4e59677b604b248413146e25312bf27c7c7d9f10e2640795efd3592938024ebe6ae9f0e4099d5e371c0561ba294a849dd63bb6d3a8258de655097c9f334f39f9c1e112a966ea77fc0019f5a7351750a7553497ab1328962e664ce11d6879dfcebdc68f60130cf301dfb7896a8b4487fadf952e0c7886167c297497978ee4dcbf517c55d93159b0642474d037405d7e083d9b234c4474db29075b46608399fad8061459708e65f19acedf6cfaa011ff07df0c3bbc27623052b9c6ba0eb73c7fc3786eb31a6192ddda39a4ff63447ccf1f8eb13ee136003c39f719e299ca56805509c2e446418374d16ceb181ae5b9acd307e509ff3eea7ab58df218ff0f77f0f4154d898ecd584da95af1e4057ced5115aa8c0642f6047ed6550745870e04e0611bc74284af2ee26f1f0b4d46c19140ac5e30c2934ce55fe690a487668e2e5c501cbbdfe8033679c5ae1c34c507f0dc091f9062427e595bc88f26c823b421bbd84573f941586e36e4c05356c12efd09d0ae80c46814ed246065707bc7468403c438a7d0629fcba39049d3d2280ec030cdff1be5f12e7f50212f9d9bd31039a39bb43f6a01d4d3d47e251dbc84281667649f5213d3ecd1b5b29e71955c96fb01d3776dbd493f767b99bf65793cd2027a472650672b1ccae71ad67a3bb9dfd9a4819b6752c22101cd1419337e1d9f11386d75b91be2b7fa9ab8706674268385a66a639a8f9b0130699914a2a76977c9d648f30d18a2934c7d56a237c1e7e4aaddd94ead5bd8c931ec31df16d0b810e055c3c8f429c05a6bd8fa4869bb4167c43052e9f5adcac0d666290c4432da21f4f13b3d38848d1b9aece028fd26e9cdfb0f2a52870bd28d92dd7edcfd5c095fa69e3855d494dbb5500416c8197c9ed36dab74caaf74ce0573244065c72a9501db21e9ffff8b78982da208a9c663057738b9f2bf11b55ceb966b604b2534d0fa60d108d05bea7d2a7af24acb162b14fdf7d5253b1ec226d0dfe3956a17ec10912ee5d168956a25cf55e2950e46fd0821bec1cbc37c29a874cd2f1b8fb6b17c174de1e22cbea397370c2ac46f5fa3f1b789f93e81df39aa58b9956987dd612448829d75769f46a70d4193235fcea15e95f78d5eb7b6277a356116b70b919b0664b3ca5c9a7d8e91d9056be35bb1b0ab1ea1455f96bd3a6b43cf3d35d56074a0fb14a73847f3f4ecb53b9bf41b2543425222f90678b6c751d5594447d20d0293c72f10b9a668da01d70c79228612745a0e3017aa0fa869340aa7cf132215504e20140a09a58d42b1b35559b4e4fd2db8b36e2b3ea5cfd78eaf11e34014de9b7b064341d993115423a6376efa871358e8f2b649167cc99d42eb516fc29e21e74a01f7c883a5ff86e70405304905d5ef32a4a5531e79390809e172f63c78d07f0bc8527cb0d7a97d5827d4fe5ea91b89c1a5cae9a62186c0887b1b8a4fe21bd3dc081eee889095a3167c0e6c23db1d2a081f4a6604d323d8861d78db5298d904cf2bd494f76505a9694834897b7361103eb3af2ed134452c8bfd31375b7ae0193565c3ed4fbf93a6198516c9df4fbc471ecb18a29ff265de87bdac59870826918f0ad2c78f061d1ec4b0a6c29ebb0c287bfc1391695a9e52bfe68fa3f4e74e95086f56f2319343c33e584966da854a6403e0ae2968b3afd392077cdd56c8125076f3ff53480398298e660927c75fbda4a968773a5ce3299bf21c3d3bc85976056da4609ee3d1c683b63be7d31ca89f90ee9efb11a552a2ef7827dc1ac0baa7ad7c93232abd9c5a2845a610306af10dc69ee30e04b1a027837b9ff2ebd5e63482552bc29d0658ee93353973ddec842286c3b9f21c03faf36d5645660d30d1c3ed4419a752bc83e66f93d64bc73dcb26f51bceaa4d49a7dc001dd99995e12d3222dc022fd8d7560164480ba3e2a372b8d1fb6224678476bbce7a88d4cacb96d9b585909a424ce8bbfb380f8b1d7dcf9ac416f5aa296e8c47b042248f482134a2898733a23b1baecbb519bb781aba699b18f192ece5841aa8bfa69a19fa01f9368fb39a9dd894ac82ed197777f17e51ecb998bee7e43ffd4f242da98b4c6a2972a6bb122f3e8c324c6dd3d4293fdf9f8886cf040d3aa0caee4fb64c5e5c3d2ae8a73aee476455affa6202aa3d3c58e0deb1b7121075ec70f1a3ed3a933df92e5f38f534b2e58360b21ac3807e8e56dc29865be84d26c0bc905d8dcc4cccb6ef3a6b9d40739f5eff5c532ff4774d4742d99c60fa193e39c08926a8a9ac2af9d2701a139507b2573b1ac23c86aa1891a98faee3b3bbad210f2affc2f1273db4593d92882cf8e4efff82360e5ca4b896d3b5b84e16364d58c8f7281f132a1982af8c051312db0d8acb8244e14d2652737f50cb47b24ae2d395aa72d08eb5802c9527b0c234cd53e939be30555adc4d2ddb0a8b1a9ac5d0ff09a4f36bb46b8666fa5d0c13d4c47c1a076641fe92deb388892a84fc4463781e171e2490f625f63edde48e1c97ffa338e1878eec87e917a027f5739c698f8794046b4155a5a6755889749a8019e6525a9da6d2f8a17c6f0fd8bd0cb42700bc36e7cce1972abc8720f89730468975af69754670290a985218e1f1eed48b0c1f37f7fef0462f9414c6ca93f8ceccb8ea171c07990f0d2199c9527ebe86623f62800ed62be4daa650b1f61f92602936cf13b1e6dff15c7a390cefe36ce88b6459e59a6ab0f9d1e578f2c14f289afe5ada6a805c8235cf6337632a8b9c12fcac60eeb80db520e36d0f39d970c51343563d96464e7c7e32a32d14a350e63b4b19882f701373b5f5e52e8a1686f5c32a25d35ece94690a516e84f4f3321d4e38541c9d5eb9ffc9223509cf2744ef9ea7cc8e2277b2372633e30b8a5976a424b6a1f9a5221817428725c1bc5caad29d03e18105e5f114da149d9aa545c898b8299532cc84104d8e1ac0aafb32151ae08840308bc67053a09b27f727ebd6d6e682e7c1dc845dfdbb1741fca7b8ec53e17ec8487828c6b0a7683009f147bc37d6095ff6d3457b409e43b0072d2a14898206d0cdb96c385c87cd17cd116e866d202c760385f2fc527d31c00987fc3c369cdcf2b1a128640711e3eb23b2b35a65d144aa85d43d0066a5cad7258e9e455dc8a9a6c5029837ac98d49f0a2038f46088046a93e1ef73e0f49b3b881d143596f487efd22ef325cbb1dc2c2277430daf14d646daf8ebd89531f47ae13471f855202935dee82f939b3cff74b8891ff28c91d99a9013dcfa82b5dbb40fa0a20a38d8f20a9b3363626d621ec4539cb6e7c57d52d4d08aaad95cd9459b04850251dc6d8ca5bf3a32c60ee05cce592415c7116f44006e57a9fb1149d69166c51c79f37ee63610a3682feb0765f4133a85943ef214ad3c78cd70f65c4cd36a2c665ddd988375e23c41cc6bba948a1863e20ab2cfefda36c8b092c317b5864dcf77445438c5a8aedcf695cbdf78dc63256d0583e8fb89eb00c1a8fc3aa9a028ba36b608b1ee46bc29229a2eb191dbd60f73c76490780d5ccbb0080c26c3d8c41c874f2541003fdb5499bed38e45d8cf653d7ed43867f0811e1268e1c56c99b42fad97452ef3b67b98ad6fb0a16b557e0e54a52bde1bb00d1b41dc8a2496e5e4b48ea9febe91f9e505cfe81720d6524978c55908d8b301884583f28a3a1b46d71863474d4e6a23bcaaef932623af1f13e3be37da8ff7c71fa014c199330de4229f2125669d70690565b92bc232e619e111452cd22bb04bb0aeaa10efdb42cb7b65b1ab55fb5ecf8fc97caef20c423df84430f3e882ee5c0eaa65e6ff283ea4d7a68eb2a5ae0204f5175100c35eee25d9fe6a9f3b7c24ac8f855fde57a863c6ca1e3cbf023ba1d7edcc8f89e164637050c01276b00a09aa7e8222728102070d2c645333de91c25d4303b220190b00de97a7146b7422a7e44c064356e758878ccf84d907ff1476bbf307fa20139a505aab24fa804ed145fe7cffc2bd659cb02d55eaaf55a4e104fb7fd1c89f1e8544f92f205190e1262b19299265773e873a461ff05c7d815592bd589f3ae81b100d1d1e807e4d6ea2dbd07b5c9b7723341dc9b3c08b8583b55d1dc0a49855393fbccd10e9e5fc0b8b49f79bfde2a55d2030121180304eccbbe771cb55026d57d230793549b5b2b6fbd302abcf4121a1bda2a31b290fe710e956177521a5903f12d4e9dcf57276deeb3582b1893636c250a2604952f4fe5ba1ed6e2db335fd927528f9f9422df7bb175eecc27b781f07d955ed913fc8a852fe5dabb7d48ae3f8a70d95521f3312105373c82fcb2be076c60f8d58e511b68b3b3b226139efa33ec5abb0c9518000000", 0x1122}, {&(0x7f0000000640)="2fc254be99f1c46bf869cfb811fc25971422b3ca70d886c34a4371dfb151a92fdd090c61398caf7e24e2c4cdd47e584ee6bbc13d92bcaba7c511dd5b4f8918cbcde927d891db42ee7966a6d1a3a8c09105a434e1400e115ece", 0x59}, {&(0x7f0000000a80)="d73c4a92d411288f48f79b49167d2c171267e2f1f87b455d839290f00f01c4fd95aa07162a18f6f9e95edf02d72f5973f43cbd60fe09c96fd093c85948a749990b4bc134ea538dd7475fef2a23684fd1c518f7ca72b9ad189cbf87d9540287c270c66295b04a3b8035d0bd9c3d916545b616f2af86937125fee2015e5d94c4e7b95ff0b0c86f15fa27ba116d8de40ab3d85e62e47dd9cb72df00f437febe6c04e8e3d258c1f711e7f05f3be7bf155461005b87b4bd0bb9c903dd7d1ef5e5383914cf09b35d46788423ae673e92412399d092ad078a6eff159c122ef6c1afa108fbbb9fc92239a021d7114077f969e25ea2d00b48ab84a33ddd0201f24e9799ecef2f9071e3bbba29e30fa6c60541c97054e4b17a36995071072c5126bdde835b86184acc880c67bb7f7b", 0x12a}, {&(0x7f0000000a00)="8c6e75fb443168ad78c1c5aa94e9e674ed70c098760b47b3fdb4dcc42b7d92cddddb12f556580fb19ccbe6eb45ec2fb042bedb8d1d1dfcf80bce83959167e000000080000000000c02049ae7d7b0d007", 0x50}, {&(0x7f0000000300)="7d9744667c624c9c4b843d5ea3543accd026c500"/29, 0x1d}, {&(0x7f0000001940)="da45534ea0a8c40a727b64c595d4a0f5b6131c677ecb2fb08670fe658a7cd5a3f82286c3011cdbb1682fd9f7e864cb73da66bca63c5ffd124b405b36108b64844f496a115df163bcbba0c7e6ee3b361f8f562f20fe2a4374466985bc3ec4482a84bb33493e69d4e3c165453bd1089c1681e00948d28ce63a9df86cf4eb7ff6ea386b2518accd4a8d8f52e4afbce7c13ee473a13fd1c669e45447e0d5d9bf1cff0523701e3a78458eb4180bba749edb816b6b63530a16f34c5be8395ece3b056ade03c05f9c4ef1bddbc3c16540f93000b5f94fc8ba77d62e11bced82cd2dd7c60c41c187caeb22bae8655d0e920529b0e7194b64010d77242635ce040f4c997de41a1659cfd326adb69980f38607e133bf3a435d180f7857d39f570c0f2ee0ecb7eafd70f556138f9fb19366b55c41ee9ac3943f711ab99a384183dc7fabd586d6701706e2bc94cdcfe77dec9c55417b77ffd8fe839941241dc52ab1e5d6f4950f3f1e9f35f951fe86b4f769c7f29ca68d69380c15b049d5d8f86303a8d6f17fe8d9a1005ab97d457685b7824863995272ed2931d276d1280aae47c9e7f5fc903297d0e8b855e9184b93a8db25652e91fa4955d8cbb2390a394802f22e620e9b1ae177ab0607cacf108665cc2bac171760345bcf10381ad8a821b0f01683b80b8dd2164bc0c6455ac4a223cded7b88cb59216fd793ccefbda1c0152d159517472e7f6123c590bdb8987326aebbf012d0715a8e8bb9b06dfbf4b532a87fdefc497de3c0d9f4380fd576cce5b70c98f08fd82d8c5949b8a22fd53016817dfe606940837f443403b0fe593b8cd2e05387d9721748f14330933376931411d993571cc0ca4d78a647a4b49f818bbf8686cbaba92ca79c6a65a9d76e841a81e69c9595c8132c3929f061b104b1f04c687449cbe6a480dd6057cbc886d1bcc70eade7e99cdcfe862236338cc8d29436051e148be661b7cf12fbca3081d14fe79f6d8fb34c2d939442a096fb6f7f83d3faca788f7b232a4937ec4268c87c7a514c22975083864d089d5bc5a92a8dd06cd7d7c19c7f2f12e71229aa9aa2a477fc8d097b8eeec93faa4fd85ba3d5ad7a8acbf11683b292d26b3ab9dc18a1d2d1f5eac05bf1d431b92bdaaa6d48bfb51b72a2afdfb142cdab7a50cb662092634eb3e4e35efdd199b556456b728a94323fa886a6ae48828ce88151ac27d73327409b1e79d06bf4887017c569dd4accf7869a18bbc71756042865871e9f7753f78d9aee67728396a69c9df37ef5488802ebcfdd278a2f585d529e54e28a9af2878e6ff73dfa203cfeab629af5259aaf04be581d50285ee874db8220645a5051f3837a0cfab324cb0500ecc964fa50e4783a16d93c141c1c853aa8458b756ef4d3822ca9ec4a61691d248502b432b8ee7fffc3b4e674093dacb7207e6e83d0577157b862d468f3334f17ca3dfc42f62d4b809c61bb9a75d744a20b5c89e395ebd79fa8edda8c3165293dd9730489ec9f079efda202d8bb262f01ca63f48216696fa631f55bbb6c8459196c4095252ac2b6313c2e6daeb81f407148233428144aaa60543d9eeedcc7e4afad120f65c04a5ad6fb8b314a42c683142ac83265d2fffe9f0578140545fa17dd1d9d96f4164338af9a33dff64bb02200e55595adca799f8368cd3e91cbb3d8a187a105e0e4d67f5a6fc27f176c3784efee922e289c2ec41598ec756ce92936ec81cac419fad2dcb30a01d8a55c5172a26b51733c68d5fef920b36ed1dc2f49bf6398a73d7920e51feaa0f3b83106eafb84dccd7db98aaa470d709ccf10e63c33d956b1fb4ca2eca85cd6775f4f55ea1f2ac6082dc3c77c32200af16fe7a36ad8e5abf38552146fab9a73666a08548f7274c6b66d51691958eb1f39525c4173389f25289dada33adc7d09b7f73a9b97412c96eb30c8cf3ab2be45a9fb9d825eebc1217fd8fec1c4352c465421a06e9a50e966ef2706921c4fc1bce7221e747faeeed5357b24881a7142b557c64713a6922de804b7867a92eb947d92ddc8e565794651c72042fdb848090f7b8713579b5af333c9dc140c171a79e893eb0bf5a89bb4587078f493b45e2d54b38dc3ed529b74a06a3b6cf16077a271745b3c03ed0f95e946bcc56bc1ced7483d9e2a3a82e8134623412f01af5517289b13f42fb14c967a01682dbd4902655d99fab885c1be543eb1024d402667b457899b2a5556d7e88ec159123b02930b5c1e0d8b6cde121e7020617926979c5586bdc7d42678157529f96f5bd169dd0dd194438f09f993b70da9f9f51efaf23e5171ab2b8ab2617e28d8e15d134fd7147ae01fd2e22469474b0414c4d6606d2207d38586caab74c4eeefdcc60e3119f1c395a3484e764a11e2584ce5942e4b679d70c44ba12c12d3c20e2f7a3cabce1a012c4afc0957ae9c7b7adc6aed5e0d86a8fd584ef807486c029889276ee313a6aa33d6b18f09d364e7bd4377f332bad74259f988daca6f390b94807fa5a0faaa8268c00c5f04d3652b97113565ee299b16d9095103db098918270817af5c1e18963f084b781ea0dfc4a29e96f1d3e2eedbca8224ee7143891858abd42af331698cfde6ec9df7c2295bca2a2e113522467a2efb3dd52b42abc5ad9a825f45823d483eefcdbe22fdf143a6b3fa0519774da9a0a529cc3cd3ea6909f59be2c657c8b5b1c10116a9dd2886559ba8da456fe105e9c7c33dbb0a153bd157293482fae08971dbda163d203a7a5c4146e0661c392b16f1e5bb86156f3a8005ef1f70ac541f95aa5fe2e258a8bef2d6feb4ef6913c4fdcacc5bf419d01c53789d2f228a53dbc99ec6e849f1af5b2a9f1b43bea4cf8dcc514a303df7a89962e2cc9265756f2f09a10c2e6cf7583ec21bfb129134783c5f31a672d84a252d4bd90feeadf839169ded61ed5dcf3d53f53b142fcad506ac814bfdf414d3f94f3c97314b4f0036a2688d70778ae6e3f354c59d34a196a2dee839eadaad8cab70179095efdf0d6b84195935c0bd3f88cf07dd9b31b45caad85c321e7f0ab877f3abd37043087ed5e6a4582aea8a90119b6b5636c24a7bae5251dc1657ed916be9df67d7aa6d51ccff137533a250d97a359d4a7dc0d0d7809e504602522bb24934e9b812afbd74edcd6ea6fade4f3e2319337624e912affec6cbc03412446181809f50e94e8b04e3f3e4d0acf1c53c65d431184ffd9c459126615069725c0de09f38f1ad4d5db068653114a0c07b4fda00e54877faddcd13e0f35442394040ba666e3c58a6e0ac36a4875c3afd2075c59f09b6c66dfb34a0376febe56835cad2d5dc1caaf742707f3a8232da07c778bbb793b48b640626438f9cf0673ae6c4f17874d46a3e2f4c180b9ef598eeae12b743824df584197a23448e6a5d11c94757afd71f8cf84fccf3eae1a8ab3d20e97c199142c44325f6599f69c9479c2e14a96a47408029f3b308ab383e790e1917ed36140e780ccdb4ccfafa514a5fe4fc9e28cf1faac3430e20bf8d1e0424501df5f0e7e3be2b270b1d8e72987237b13aa72c0fcf59eb40da65b088ccd6def06ce8d61b482b2fbd6c0acdbba80d67fbda77362c5a4cd1f77dce03023c66a69397873ce07ed2146997db7e5716d027d5eb8a5a05d567e8a732eda88a53372592e8fead3c6cf14710f471336e53b82f17f0911917a6e5e9f84e106ad636d42f5ae526fd75f860689b11fe4c8bcc6318fe6f121e995f46f1d975564d31a91fd4323f02b39370e6fc72a788783c45677039d33f031c913ba37c5391c132ef57bae0069a4ceaec4e57cd56787435df9cbf111939b9b1c28e14445b99c22cd940d1821108fd2fe47421c09691f1e42319279bc58704c6a9fe571a3839e5543011079e6ccba6066b515e20ede77cf1ab9e0fdcc710a1c45827c6aafcf1c2e79d83fdc8c3d512824591a366ef2cb78c9f23c46f5b56c83ef2f298808a6c1d42ef4a5d40760f1580aa1b1da8781b1f49048e9259dccb70f5f32d8f8857644a2452f42065f804bdd129be7997a6f8b868bf667b8613689dfe26bb7c4cf4e856031a447d6b7cc5c23266a4812f8a7571ba3fa8313c3a845eee2245bd18047730612b8dde67d86ff766115a24beec5549a174e25f14eda570f0ec16c6a9a94b0fd5774288e6ff7249b9e3ff36d71c8a00ad18588d85b3dc766995e390c84d90faa710e66338ccd0cc6d3c27943b88eb35b394132795738a7dd19922a36ed8a130e67d11c73953080a52bb2d18d23e7dc74fb141db4ef61ba3c59363a12a13d7c8249ce8bef959e0a2e4899c4cbd049b5a8b2e39b111712d1d52026f85576e9a65f506ad3ddb5d926ad7b7ffbf4d4c84676e8c4f2e5adf9edf352b6e5e2cc837a83d4e29dfaf4ecdb354b31f559aa6e6d7e29789a55a0c25138d2a14ff54fd5681843e9d56e86fea84e6295578e956c1a3fe11824057e3b2f21d7f379cfffd8d77ad20e53bc9c37765dcc136af55f483ce46315362c9f13375cccef90156ab94e09dd9997547139ae1dde13327bb1adcba638da65a7977198aef9ecdf885e88661368247b272abb0516ec9fd7fa2c7991cc70b28e4d34aea6a2bb42e000a91d51cded269466697271dedb896954bf651de754eee4b9b7956259c8d5ea96b63ffafb6a76b21e2e843068f13ea31f8a3880da7c15cf9d832129265729de1a856c6c833cbffbbc2196f5c01c7242f1be85f7f880f2d480263625814d50f19f88632d8978094ee9b2585a54b86898e4c13452954dc5e05a6c0f0910b7b79c9518c68ce7465945168301fa7591fcd7bee81b4e320a8020db23f372977d8c2d50256730393496fc2b667f8339d399de0141a1cd77c3cb33e1894346c580a50bf06b93fa7203a52b85bceaf049e8b4891a84f64fda003542089b0b19807985e7f1ba370e0d5a80a11d63f3a4bf19320fc82fb5a40a0dfb383edf7099f74b487168319f7fa4854ea8fbd4342507c85d8eced60db7791c0317d330b08170a047f3f3e96062655b8d6d44b0dc20f099bc436c6f663acc70f35f1d4be5fad9b72a4b27e899d301d8d2495c6a9ff80ce8c07d969948b7a5d47f2952f4d9740f6246b9208bd1946fc9ad6669b0b6db41441ede157764e828ad85be3e4b6c84a38ae28b4a224db6ac63d9a575f8762d51aa7c837cdede7f3fcae17a6c2954d71aac8a424e989e6a9e9cde5de6a44aa0ee076980f2287bde28fe277c9a255472d5e0b98c9a94bc35a26a51c628de648881f775feb65ed91223faae0acc480e23c2fb38b9c8effd0e83b3d5a3c8f733597c15c1147d6dc476ff157e862f5893158ca282f1ff910720861851b7c46645ce560aa63dc0b06e83d2c9bb7b380f1b80f1f75872f98824078502a367991cdede6f93e2b3a5a1b516ab3fb12504c6498b2aed694491e4d579a2e0fc1a89c8510ce7699f2467918a6653b4572f8dfb0142a34fd8d116b3fb1694cc68d582d566a84f98cb9b689599b8f94ebe572e0f130094173eb584457250529f6fa3dcb28bd585e23df20572a31832b2237738a7119c748b888708d94b51abefc6ad9c032f14f39cff7c00d49086eb91615e841cd9dbee4ef9090965460556224d013ee27fa92b4e799e4dcee75183684abc2227e7853049941b078cdbb0688d3fc48dde3283b5cfc2e7a1d42e2f0913e4b0c7cc79dac6f8332149e49dfdbb8611a9fcaedbccf916809443a16e8ef4514c434117ad1b5efb16a6a964bae09787e53128130f6579b67062f7ffd7fe07ca54bbf2a4266f57e57be46decafb2612be0de98f87b08945cfd21744798ef77ae292", 0x1000}], 0x9}, 0x4008804) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000000c0)=r7, 0x4) 1.861220238s ago: executing program 5 (id=3490): mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) syz_emit_ethernet(0xae, &(0x7f0000000000)=ANY=[], 0x0) 1.575491255s ago: executing program 2 (id=3491): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'veth1_to_batadv\x00', 0x0}) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x30000, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, 0x0, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000800)=@newlink={0x20, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x4100}}, 0x20}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="120100002ec6601037210100352a010203010902120001000000000904"], 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f00000002c0), 0x40081, 0x0) (fail_nth: 8) 1.541467491s ago: executing program 5 (id=3492): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000007d40)='net/mcfilter6\x00') read$FUSE(r1, &(0x7f0000002a40)={0x2020}, 0x2020) readlinkat(r1, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/106, 0x6a) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=@ipv4_newaddr={0x28, 0x14, 0x503, 0x70bd28, 0x25dfdbff, {0x2, 0x18, 0x50, 0x0, r2}, [@IFA_BROADCAST={0x8, 0x4, @loopback}, @IFA_LOCAL={0x8, 0x2, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0xc090}, 0x8000) 1.478100276s ago: executing program 5 (id=3493): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'veth1_to_batadv\x00', 0x0}) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x30000, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, 0x0, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000800)=@newlink={0x20, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x4100}}, 0x20}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="120100002ec6601037210100352a010203010902120001000000000904"], 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f00000002c0), 0x40081, 0x2800) 947.483817ms ago: executing program 0 (id=3494): r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x5, 0x240000) ioctl$USBDEVFS_ALLOW_SUSPEND(r0, 0x5522) syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x0, 0x5ac, 0x30a, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x4, [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x1, 0x0, 0x96, {0x9, 0x21, 0x6, 0x9, 0x1, {0x22, 0xec7}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0xb, 0x0, 0x9}}}}}]}}]}}, &(0x7f00000001c0)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x250, 0xc, 0x0, 0x6, 0x30a7b006eeb067c4, 0x5}, 0x5a, &(0x7f00000000c0)={0x5, 0xf, 0x5a, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "a393154fa267b1098e966146a148b30c"}, @ext_cap={0x7, 0x10, 0x2, 0xa, 0xb, 0x4, 0x7fff}, @ssp_cap={0x1c, 0x10, 0xa, 0x80, 0x4, 0x2, 0xf00, 0x1, [0x60, 0xffff00, 0x3f00, 0x7e3f]}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x8, 0x1, 0x1000}, @ss_container_id={0x14, 0x10, 0x4, 0x6, "d482c36fa96a0ee56461a6849b32733e"}, @ptm_cap={0x3}]}, 0x1, [{0x76, &(0x7f0000000140)=@string={0x76, 0x3, "909c2442715982ee70cf458fe5ce3349bc13fd1731bcad2b52a07ca417d0d08f8f69ac921cbbc53694da631056b7a1c21ab57f1b7e23d835775722e7ad41675c4d52b4b9768a57a0c3413b269dbf6f042badeabf1602a8c12e63c8866dcca7ec7d066e2606d96757b1f8b98761727cc38357a4d5"}}]}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x20, r1, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x5, 0x2}}}}, ["", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x40010}, 0xc010) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000340)={0x0, 0x7}, &(0x7f0000000380)=0x8) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f00000003c0)={r2, 0xc9a9, 0x4}, 0x8) add_key$user(&(0x7f0000000400), &(0x7f0000000440)={'syz', 0x1}, &(0x7f0000000480)="e1068b929b8f0a3b5cd7d382943a01dcf9d0a71186461f3abdadc69fc817d2e609e663241b7953f73b8eb00d021b0f16ba19c845d8bca03280af679f4f37fcbde9501cd4a1e90aced45059e138f5d3465eb978a5c851bfe3c8e3def99a5e14b63d08d5b5539ccfa97fca46ad6905c7535941", 0x72, 0xfffffffffffffffb) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000640)={&(0x7f0000000500)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x60, 0x60, 0x5, [@volatile={0xd, 0x0, 0x0, 0x9, 0x5}, @func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{0x4, 0x1}, {0x2, 0x4}]}, @volatile={0x9, 0x0, 0x0, 0x9, 0x4}, @float={0x1, 0x0, 0x0, 0x10, 0x4}, @decl_tag={0x2, 0x0, 0x0, 0x11, 0x1, 0x8}, @decl_tag={0x3, 0x0, 0x0, 0x11, 0x2, 0x8}]}, {0x0, [0x0, 0x30, 0x5f]}}, &(0x7f0000000580)=""/132, 0x7d, 0x84, 0x1, 0x0, 0x10000, @value}, 0x28) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0xc, 0x6, 0x2, 0x5, 0x2001a, 0xffffffffffffffff, 0x4, '\x00', 0x0, r3, 0x1, 0x3, 0x5, 0x0, @void, @value, @void, @value}, 0x50) execveat(0xffffffffffffffff, &(0x7f0000000700)='./file0\x00', &(0x7f0000000800)={[&(0x7f0000000740)='/dev/bus/usb/00#/00#\x00', &(0x7f0000000780)='nl80211\x00', &(0x7f00000007c0)='syz']}, &(0x7f0000000880)={[&(0x7f0000000840)='\x00']}, 0x100) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000900)={'team0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000940)={'batadv_slave_1\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r5, &(0x7f0000000b40)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000980)={0x150, 0x0, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [{{0x8, 0x1, r6}, {0x134, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xe30}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r7}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}]}}]}, 0x150}, 0x1, 0x0, 0x0, 0x48000}, 0x20000004) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_VERDICT_BATCH(r8, &(0x7f0000000c40)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x3c, 0x3, 0x3, 0x401, 0x0, 0x0, {0x0, 0x0, 0x4}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0xfffffffffffffffb, 0x9}}, @NFQA_VERDICT_HDR={0xc, 0x2, {0x0, 0x1}}, @NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0x9}, @NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24004080}, 0x80) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc(&(0x7f0000000cc0), r5) sendmsg$TIPC_CMD_SHOW_STATS(r9, &(0x7f0000000d80)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, r10, 0x800, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}}, 0x0) r11 = add_key$keyring(&(0x7f0000000e40), &(0x7f0000000e80)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000dc0), &(0x7f0000000e00)={'syz', 0x3}, 0x0, 0x0, r11) r12 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r12, 0x0, 0x40, &(0x7f0000000f00)=@filter={'filter\x00', 0xe, 0x4, 0x4b4, 0xffffffff, 0x0, 0x314, 0x204, 0xffffffff, 0xffffffff, 0x420, 0x420, 0x420, 0xffffffff, 0x4, &(0x7f0000000ec0), {[{{@uncond, 0x0, 0x1e0, 0x204, 0x0, {}, [@common=@inet=@sctp={{0x144}, {[0x4e23, 0x4e23], [0x4e24, 0x4e24], [0x0, 0x100, 0x1, 0x9, 0x0, 0xa5d1, 0x1a, 0x7ff, 0x7, 0x3, 0xfff, 0x81, 0x0, 0x5, 0x9, 0x3ff, 0x2, 0x62cba11b, 0x0, 0x400, 0x8f, 0x3, 0x1, 0x10, 0x9145, 0x84, 0x7, 0x1, 0x9d4, 0x7fff, 0x2, 0x7, 0x3, 0x5, 0xfffffffb, 0x5, 0x8, 0x3ff, 0x2, 0x2, 0x5b, 0x40, 0xffffffae, 0x6, 0x9, 0x0, 0x1871f3d9, 0x100, 0x5, 0x8, 0xffff, 0x4, 0x1ff, 0x7, 0xfffffe00, 0xf77, 0x9, 0x3ffc000, 0x5, 0x7, 0xff, 0xd, 0x2, 0xb], 0x3, [{0x10, 0xc, 0x3}, {0x8, 0xf9, 0x98}, {0x7, 0xa3, 0x6}, {0x2, 0x81, 0xde}], 0x1, 0x2, 0x6}}, @common=@ah={{0x2c}, {[0x4, 0xfffffffe]}}]}, @REJECT={0x24}}, {{@ip={@broadcast, @broadcast, 0xffffffff, 0xff000000, 'veth1_macvtap\x00', 'veth0_to_team\x00', {}, {0xff}, 0x16, 0x3, 0x24}, 0x0, 0xb0, 0x110, 0x0, {}, [@common=@set={{0x40}, {{0x2, [0x0, 0x4, 0x3, 0x6, 0x0, 0x4], 0x4, 0x1}}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x2, 0x9, 0x1, 0x0, 0x3, 0x3], 0x1, 0x2}, {0x0, [0x1, 0x1, 0x1, 0x1, 0x4, 0x3], 0x3, 0x1f88336e0410dfc}}}}, {{@ip={@multicast1, @multicast1, 0x0, 0xffffffff, 'ip6gre0\x00', 'vlan0\x00', {0xff}, {}, 0x11, 0x2, 0x17}, 0x0, 0xb0, 0x10c, 0x0, {}, [@common=@set={{0x40}, {{0x2, [0x4, 0x0, 0x4, 0x0, 0x7], 0x2, 0x1}}}]}, @common=@CLUSTERIP={0x5c, 'CLUSTERIP\x00', 0x0, {0x1, @link_local, 0x6, 0x8, [0x25, 0x35, 0x10, 0x4, 0x36, 0x32, 0x1f, 0x6, 0x15, 0x18, 0x10, 0x1e, 0xf, 0x1c, 0x26, 0x3], 0x0, 0xe5bb, 0xfffffff9}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x510) r13 = openat$dlm_plock(0xffffff9c, &(0x7f0000001440), 0x18240, 0x0) ioctl$KVM_CREATE_VCPU(r13, 0xae41, 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000001480)={{{@in6=@local, @in6=@mcast1}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000001580)=0xe4) add_key$keyring(&(0x7f00000015c0), &(0x7f0000001600)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000001640)=@assoc_value={r2, 0x2}, 0x8) ioprio_set$pid(0x0, 0x0, 0x0) 759.597671ms ago: executing program 3 (id=3495): r0 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r0, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x4, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0xffffffac, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000180)=0xc, 0x4) sendmmsg$inet6(r0, &(0x7f0000002600)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)="a1", 0x1}], 0x1}}], 0x1, 0x1) 0s ago: executing program 0 (id=3496): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x0, 0x25dfdbfc, {0x60, 0x0, 0x0, r2, {0x0, 0xc}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x5, "00000300000000009bf7df1f00"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) getresuid(&(0x7f0000005780), &(0x7f0000003240), &(0x7f0000005700)) fchdir(r3) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) mkdir(&(0x7f0000000100)='./control\x00', 0x184) open(&(0x7f00000000c0)='./control\x00', 0x573382, 0x113) rmdir(&(0x7f0000000280)='./control\x00') r5 = socket$netlink(0x10, 0x3, 0x6) r6 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x4, 0x5) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000240)={'wlan0\x00'}) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x10) sendmsg$NL80211_CMD_GET_MPP(r4, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, 0x0, 0x10, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8}, @val={0xc, 0x99, {0x147a, 0x73}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x8004}, 0x10) rmdir(&(0x7f0000000040)='./control\x00') r7 = openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) sendfile(r7, r7, 0x0, 0x8000002) kernel console output (not intermixed with test programs): mber 66 [ 862.227114][ T5895] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 862.387139][ T5895] usb 3-1: Using ep0 maxpacket: 8 [ 862.400087][T16477] bridge0: port 3(geneve1) entered blocking state [ 862.408210][ T5895] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 862.470882][T16477] bridge0: port 3(geneve1) entered disabled state [ 862.504781][T16477] geneve1: entered allmulticast mode [ 862.512306][ T5895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 862.537298][ T5895] usb 3-1: Product: syz [ 862.537320][ T5895] usb 3-1: Manufacturer: syz [ 862.537335][ T5895] usb 3-1: SerialNumber: syz [ 862.540995][ T5895] usb 3-1: config 0 descriptor?? [ 862.571715][T16477] geneve1: entered promiscuous mode [ 862.613794][T16477] bridge0: port 3(geneve1) entered blocking state [ 862.620959][T16477] bridge0: port 3(geneve1) entered forwarding state [ 863.076596][ T3614] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 863.226615][ T3614] usb 6-1: device descriptor read/64, error -71 [ 863.237015][ T9406] usb 7-1: new high-speed USB device number 92 using dummy_hcd [ 863.397259][ T9406] usb 7-1: Using ep0 maxpacket: 8 [ 863.411779][ T9406] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 863.438070][ T9406] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 863.449881][ T9406] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 863.467102][ T3614] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 863.471514][ T9406] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 863.504861][ T9406] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 863.522503][ T9406] usb 7-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 863.537314][ T9406] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 863.551504][T16503] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3115'. [ 863.552518][ T9406] usb 7-1: config 0 descriptor?? [ 863.596498][ T3614] usb 6-1: device descriptor read/64, error -71 [ 863.637195][ T5895] dvb_usb_rtl28xxu 3-1:0.0: chip type detection failed -110 [ 863.647737][ T5895] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 863.718565][ T3614] usb usb6-port1: attempt power cycle [ 863.825885][T16514] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3116'. [ 863.845539][T16514] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3116'. [ 864.086925][ T3614] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 864.121471][ T3614] usb 6-1: device descriptor read/8, error -71 [ 864.187378][ T9406] usb 4-1: new full-speed USB device number 53 using dummy_hcd [ 864.362062][ T9406] usb 4-1: config 54 has an invalid interface number: 154 but max is 0 [ 864.376486][ T3614] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 864.391267][ T9406] usb 4-1: config 54 has an invalid descriptor of length 0, skipping remainder of the config [ 864.402251][ T9406] usb 4-1: config 54 has no interface number 0 [ 864.408117][ T3614] usb 6-1: device descriptor read/8, error -71 [ 864.411233][ T9406] usb 4-1: config 54 interface 154 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 4 [ 864.430013][ T9406] usb 4-1: config 54 interface 154 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 864.446237][ T9406] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 0.ec [ 864.455912][ T9406] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 864.465605][ T9406] usb 4-1: Product: syz [ 864.470316][ T9406] usb 4-1: Manufacturer: syz [ 864.474957][ T9406] usb 4-1: SerialNumber: syz [ 864.537079][ T3614] usb usb6-port1: unable to enumerate USB device [ 864.718606][ T9406] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 864.733619][ T975] usb 4-1: Failed to submit usb control message: -71 [ 864.745741][ T975] usb 4-1: unable to send the bmi data to the device: -71 [ 864.767278][ T9406] usb 4-1: USB disconnect, device number 53 [ 864.776524][ T975] usb 4-1: unable to get target info from device [ 864.789654][ T975] usb 4-1: could not get target info (-71) [ 864.798508][ T975] usb 4-1: could not probe fw (-71) [ 864.993754][ T5895] usb 3-1: USB disconnect, device number 67 [ 865.402987][ T9406] usb 7-1: USB disconnect, device number 92 [ 865.589540][ T3614] hid-generic 0FFF:DD65:009C.0013: item fetching failed at offset 0/75 [ 865.598602][ T3614] hid-generic 0FFF:DD65:009C.0013: probe with driver hid-generic failed with error -22 [ 866.179043][ T5895] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 866.346932][ T5895] usb 3-1: Using ep0 maxpacket: 32 [ 866.365844][ T5895] usb 3-1: New USB device found, idVendor=04f1, idProduct=1001, bcdDevice=19.63 [ 866.400211][ T5895] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 866.437794][ T5895] usb 3-1: Product: syz [ 866.452384][ T5895] usb 3-1: Manufacturer: syz [ 866.465848][ T5895] usb 3-1: SerialNumber: syz [ 866.522352][ T5895] usb 3-1: config 0 descriptor?? [ 866.602145][ T5895] gspca_main: 04f1:1001 too many config [ 866.798933][ T3614] usb 3-1: USB disconnect, device number 68 [ 866.906747][ T6833] usb 7-1: new high-speed USB device number 93 using dummy_hcd [ 867.069773][T16611] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3127'. [ 867.079082][ T6833] usb 7-1: Using ep0 maxpacket: 32 [ 867.095069][T16611] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3127'. [ 867.112738][ T6833] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 219 [ 867.140467][ T6833] usb 7-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= 5.f5 [ 867.159795][ T6833] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 867.179121][ T6833] usb 7-1: Product: syz [ 867.193646][ T6833] usb 7-1: Manufacturer: syz [ 867.202987][ T6833] usb 7-1: SerialNumber: syz [ 867.229710][ T6833] usb 7-1: config 0 descriptor?? [ 867.236468][T16601] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 867.251668][ T6833] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 867.526977][ T5895] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 867.647315][T16601] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 867.671008][T16601] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 867.742278][ T5895] usb 4-1: Using ep0 maxpacket: 8 [ 867.795700][ T5895] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 867.814261][ T5895] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 867.831248][ T5895] usb 4-1: Product: syz [ 867.855216][ T5895] usb 4-1: Manufacturer: syz [ 867.875096][ T5895] usb 4-1: SerialNumber: syz [ 867.897649][ T5895] usb 4-1: config 0 descriptor?? [ 868.401316][ T6833] usb 7-1: USB disconnect, device number 93 [ 868.508374][T16656] CUSE: info not properly terminated [ 869.007569][ T5895] dvb_usb_rtl28xxu 4-1:0.0: chip type detection failed -110 [ 869.015030][ T5895] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 869.108884][ T7664] udevd[7664]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 869.934226][T16688] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3140'. [ 869.951306][T16684] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3139'. [ 869.961351][T16684] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3139'. [ 870.014710][T16689] vlan0: entered promiscuous mode [ 870.052914][T16689] team0: Port device vlan0 added [ 870.211908][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.219869][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.287494][ T5895] usb 7-1: new high-speed USB device number 94 using dummy_hcd [ 870.314371][ T9406] usb 4-1: USB disconnect, device number 54 [ 870.456973][ T5895] usb 7-1: Using ep0 maxpacket: 8 [ 870.470996][ T5895] usb 7-1: config 0 has an invalid interface number: 145 but max is 0 [ 870.496874][ T5895] usb 7-1: config 0 has no interface number 0 [ 870.524054][ T5895] usb 7-1: New USB device found, idVendor=2833, idProduct=0201, bcdDevice=d8.06 [ 870.586939][ T5895] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 870.608995][ T5895] usb 7-1: Product: syz [ 870.653026][ T5895] usb 7-1: Manufacturer: syz [ 870.667318][ T5895] usb 7-1: SerialNumber: syz [ 870.730034][ T5895] usb 7-1: config 0 descriptor?? [ 870.837033][ T6833] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 870.854876][T12856] bond0: (slave syz_tun): Releasing backup interface [ 870.878421][T12856] bond0: (slave syz_tun): the permanent HWaddr of slave - aa:aa:aa:aa:aa:aa - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 870.953577][ T5895] usb 7-1: USB disconnect, device number 94 [ 871.078551][ T5901] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 871.091748][ T6833] usb 4-1: config 0 has no interfaces? [ 871.103172][ T6833] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 871.118748][ T5849] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 871.119680][ T6833] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 871.137885][ T5849] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 871.147727][ T5849] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 871.155650][ T5849] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 871.164247][ T5849] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 871.222899][ T6833] usb 4-1: Product: syz [ 871.291672][ T5901] usb 6-1: config 0 has no interfaces? [ 871.294925][ T6833] usb 4-1: Manufacturer: syz [ 871.308502][ T5901] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 871.318889][ T5901] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 871.336511][ T6833] usb 4-1: SerialNumber: syz [ 871.337588][ T5901] usb 6-1: Product: syz [ 871.345370][ T5901] usb 6-1: Manufacturer: syz [ 871.356998][ T5901] usb 6-1: SerialNumber: syz [ 871.384199][ T5901] usb 6-1: config 0 descriptor?? [ 871.392061][ T6833] usb 4-1: config 0 descriptor?? [ 873.009148][T16708] chnl_net:caif_netlink_parms(): no params data found [ 873.127668][T16731] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3152'. [ 873.169751][T16731] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3152'. [ 873.249308][ T5849] Bluetooth: hci2: command tx timeout [ 873.455116][T16736] random: crng reseeded on system resumption [ 873.868773][ T3580] bond0 (unregistering): (slave bond3): Releasing backup interface [ 873.878782][ T3580] bond0 (unregistering): Released all slaves [ 873.893129][ T3580] bond1 (unregistering): Released all slaves [ 873.909559][ T3580] bond2 (unregistering): Released all slaves [ 874.068562][ T3580] bond3 (unregistering): Released all slaves [ 874.199857][ T3580] tipc: Disabling bearer [ 874.205936][ T3580] tipc: Left network mode [ 874.314658][T16708] bridge0: port 1(bridge_slave_0) entered blocking state [ 874.343347][T16708] bridge0: port 1(bridge_slave_0) entered disabled state [ 874.356109][T16708] bridge_slave_0: entered allmulticast mode [ 874.391574][T16708] bridge_slave_0: entered promiscuous mode [ 874.425204][ T5901] usb 4-1: USB disconnect, device number 55 [ 874.445097][T16708] bridge0: port 2(bridge_slave_1) entered blocking state [ 874.471421][T16708] bridge0: port 2(bridge_slave_1) entered disabled state [ 874.504927][T16708] bridge_slave_1: entered allmulticast mode [ 874.530612][T16708] bridge_slave_1: entered promiscuous mode [ 874.595924][ T5895] usb 6-1: USB disconnect, device number 25 [ 874.806297][T16708] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 874.900197][T16708] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 875.119870][T16770] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3161'. [ 875.179817][ T3580] hsr_slave_0: left promiscuous mode [ 875.193898][ T3580] hsr_slave_1: left promiscuous mode [ 875.317318][ T5849] Bluetooth: hci2: command tx timeout [ 875.781793][ T3614] usb 7-1: new high-speed USB device number 95 using dummy_hcd [ 875.975366][ T3614] usb 7-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 875.987981][ T3614] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 875.999711][ T3614] usb 7-1: Product: syz [ 876.464055][ T3614] usb 7-1: Manufacturer: syz [ 876.471061][ T3614] usb 7-1: SerialNumber: syz [ 876.501470][ T3614] usb 7-1: config 0 descriptor?? [ 876.522065][ T3614] i2c-tiny-usb 7-1:0.0: version 6d.cc found at bus 007 address 095 [ 876.929335][ T3614] (null): failure reading functionality [ 876.937276][ T3614] i2c i2c-1: failure reading functionality [ 876.949008][ T3614] i2c i2c-1: connected i2c-tiny-usb device [ 877.404466][ T5849] Bluetooth: hci2: command tx timeout [ 877.467602][T16788] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3165'. [ 877.496205][T16788] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3165'. [ 878.057263][T16708] team0: Port device team_slave_0 added [ 878.070596][T16708] team0: Port device team_slave_1 added [ 878.346938][ T3614] usb 7-1: USB disconnect, device number 95 [ 878.451712][T16708] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 878.465027][T16708] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 878.494620][T16708] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 878.542244][T16796] bond0: entered promiscuous mode [ 878.559816][T16796] bond_slave_0: entered promiscuous mode [ 878.566304][T16796] bond_slave_1: entered promiscuous mode [ 878.575462][T16796] batadv0: entered promiscuous mode [ 878.583101][T16796] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 878.591820][T16796] Cannot create hsr debugfs directory [ 878.599696][T16796] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 878.658734][T16796] bond0: left promiscuous mode [ 878.664764][T16796] bond_slave_0: left promiscuous mode [ 878.687242][T16796] bond_slave_1: left promiscuous mode [ 878.697605][T16796] batadv0: left promiscuous mode [ 878.800998][T16708] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 878.830807][T16708] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 878.945170][T16810] FAULT_INJECTION: forcing a failure. [ 878.945170][T16810] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 878.958866][T16708] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 878.995083][T16810] CPU: 0 UID: 0 PID: 16810 Comm: syz.0.3172 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(full) [ 878.995113][T16810] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 878.995124][T16810] Call Trace: [ 878.995130][T16810] [ 878.995137][T16810] dump_stack_lvl+0x241/0x360 [ 878.995165][T16810] ? __pfx_dump_stack_lvl+0x10/0x10 [ 878.995185][T16810] ? __pfx__printk+0x10/0x10 [ 878.995218][T16810] should_fail_ex+0x424/0x570 [ 878.995246][T16810] _copy_to_user+0x31/0xb0 [ 878.995270][T16810] simple_read_from_buffer+0xc4/0x170 [ 878.995296][T16810] proc_fail_nth_read+0x1ef/0x260 [ 878.995316][T16810] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 878.995336][T16810] ? rw_verify_area+0x246/0x630 [ 878.995356][T16810] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 878.995374][T16810] vfs_read+0x21f/0xb90 [ 878.995399][T16810] ? __pfx___mutex_lock+0x10/0x10 [ 878.995417][T16810] ? __pfx_vfs_read+0x10/0x10 [ 878.995441][T16810] ? __fget_files+0x2a/0x420 [ 878.995458][T16810] ? __fget_files+0x39d/0x420 [ 878.995471][T16810] ? __fget_files+0x2a/0x420 [ 878.995492][T16810] ksys_read+0x19d/0x2d0 [ 878.995515][T16810] ? __pfx_ksys_read+0x10/0x10 [ 878.995538][T16810] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 878.995555][T16810] ? lockdep_hardirqs_on+0x9d/0x150 [ 878.995575][T16810] __do_fast_syscall_32+0xb4/0x110 [ 878.995592][T16810] ? exc_page_fault+0x5f8/0x920 [ 878.995613][T16810] do_fast_syscall_32+0x34/0x80 [ 878.995631][T16810] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 878.995648][T16810] RIP: 0023:0xf7ff2539 [ 878.995664][T16810] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 878.995678][T16810] RSP: 002b:00000000f5116590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 878.995698][T16810] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f5116620 [ 878.995710][T16810] RDX: 000000000000000f RSI: 00000000f7482ff4 RDI: 0000000000000000 [ 878.995720][T16810] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 878.995730][T16810] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 878.995739][T16810] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 878.995767][T16810] [ 879.400196][T16708] hsr_slave_0: entered promiscuous mode [ 879.407457][T16708] hsr_slave_1: entered promiscuous mode [ 879.433288][T16823] FAULT_INJECTION: forcing a failure. [ 879.433288][T16823] name failslab, interval 1, probability 0, space 0, times 0 [ 879.477813][ T5849] Bluetooth: hci2: command tx timeout [ 879.525417][T16823] CPU: 1 UID: 0 PID: 16823 Comm: syz.0.3175 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(full) [ 879.525442][T16823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 879.525451][T16823] Call Trace: [ 879.525459][T16823] [ 879.525466][T16823] dump_stack_lvl+0x241/0x360 [ 879.525492][T16823] ? __pfx_dump_stack_lvl+0x10/0x10 [ 879.525510][T16823] ? __pfx__printk+0x10/0x10 [ 879.525532][T16823] ? __pfx___might_resched+0x10/0x10 [ 879.525549][T16823] should_fail_ex+0x424/0x570 [ 879.525573][T16823] should_failslab+0xac/0x100 [ 879.525589][T16823] kmem_cache_alloc_noprof+0x78/0x390 [ 879.525602][T16823] ? vm_area_dup+0x2b/0x5b0 [ 879.525624][T16823] vm_area_dup+0x2b/0x5b0 [ 879.525645][T16823] __split_vma+0x1b8/0xb20 [ 879.525666][T16823] ? __pfx___split_vma+0x10/0x10 [ 879.525693][T16823] vms_gather_munmap_vmas+0x325/0x13d0 [ 879.525728][T16823] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 879.525755][T16823] ? mas_find+0x8c0/0xbb0 [ 879.525774][T16823] mmap_region+0xa13/0x2ea0 [ 879.525819][T16823] ? __pfx_mmap_region+0x10/0x10 [ 879.525880][T16823] ? arch_get_unmapped_area_topdown+0x22a/0xbd0 [ 879.525916][T16823] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 879.525942][T16823] ? cap_mmap_addr+0xaa/0xf0 [ 879.525957][T16823] ? bpf_lsm_mmap_addr+0x9/0x10 [ 879.525974][T16823] ? security_mmap_addr+0x6f/0x250 [ 879.525990][T16823] ? shmem_mapping+0xd/0x50 [ 879.526007][T16823] do_mmap+0xd42/0x1420 [ 879.526035][T16823] ? __pfx_do_mmap+0x10/0x10 [ 879.526049][T16823] ? down_write_killable+0x1a0/0x260 [ 879.526067][T16823] ? vm_mmap_pgoff+0x214/0x530 [ 879.526084][T16823] ? __pfx_down_write_killable+0x10/0x10 [ 879.526101][T16823] ? common_file_perm+0x1a6/0x210 [ 879.526129][T16823] vm_mmap_pgoff+0x2a2/0x530 [ 879.526157][T16823] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 879.526174][T16823] ? __fget_files+0x2a/0x420 [ 879.526188][T16823] ? __fget_files+0x2a/0x420 [ 879.526203][T16823] ? __fget_files+0x39d/0x420 [ 879.526216][T16823] ? __fget_files+0x2a/0x420 [ 879.526234][T16823] ksys_mmap_pgoff+0x4ee/0x720 [ 879.526252][T16823] ? __ia32_sys_mmap_pgoff+0x21/0xf0 [ 879.526271][T16823] __do_fast_syscall_32+0xb4/0x110 [ 879.526284][T16823] ? exc_page_fault+0x5f8/0x920 [ 879.526301][T16823] do_fast_syscall_32+0x34/0x80 [ 879.526322][T16823] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 879.526339][T16823] RIP: 0023:0xf7ff2539 [ 879.526353][T16823] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 879.526367][T16823] RSP: 002b:00000000f511655c EFLAGS: 00000206 ORIG_RAX: 00000000000000c0 [ 879.526385][T16823] RAX: ffffffffffffffda RBX: 0000000080001000 RCX: 0000000000004000 [ 879.526397][T16823] RDX: 0000000000000005 RSI: 0000000000000012 RDI: 0000000000000003 [ 879.526408][T16823] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 879.526418][T16823] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 879.526429][T16823] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 879.526457][T16823] [ 880.026444][ T3614] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 880.143746][ T3580] IPVS: stop unused estimator thread 0... [ 880.176693][ T3614] usb 6-1: device descriptor read/64, error -71 [ 880.254347][T16830] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3177'. [ 880.272045][T16830] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3177'. [ 880.397103][ T5895] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 880.427201][ T3614] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 880.576461][ T3614] usb 6-1: device descriptor read/64, error -71 [ 880.589254][ T5895] usb 4-1: Using ep0 maxpacket: 16 [ 880.608771][ T5895] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 880.637146][ T5895] usb 4-1: config 0 has no interface number 0 [ 880.643311][ T5895] usb 4-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 880.686874][ T5895] usb 4-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 880.710785][ T3614] usb usb6-port1: attempt power cycle [ 880.725360][ T5895] usb 4-1: config 0 interface 41 has no altsetting 0 [ 880.765192][ T5895] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 880.779774][T16850] FAULT_INJECTION: forcing a failure. [ 880.779774][T16850] name failslab, interval 1, probability 0, space 0, times 0 [ 880.783076][ T5895] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 880.815254][ T5895] usb 4-1: Product: syz [ 880.823694][T16850] CPU: 1 UID: 0 PID: 16850 Comm: syz.6.3181 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(full) [ 880.823720][T16850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 880.823731][T16850] Call Trace: [ 880.823739][T16850] [ 880.823747][T16850] dump_stack_lvl+0x241/0x360 [ 880.823785][T16850] ? __pfx_dump_stack_lvl+0x10/0x10 [ 880.823807][T16850] ? __pfx__printk+0x10/0x10 [ 880.823827][T16850] ? __lock_acquire+0xad5/0xd80 [ 880.823858][T16850] should_fail_ex+0x424/0x570 [ 880.823887][T16850] should_failslab+0xac/0x100 [ 880.823907][T16850] kmem_cache_alloc_noprof+0x78/0x390 [ 880.823924][T16850] ? skb_clone+0x20c/0x390 [ 880.823945][T16850] skb_clone+0x20c/0x390 [ 880.823965][T16850] __netlink_deliver_tap+0x3c4/0x7f0 [ 880.823998][T16850] ? netlink_deliver_tap+0x2e/0x1b0 [ 880.824016][T16850] netlink_deliver_tap+0x19d/0x1b0 [ 880.824037][T16850] netlink_unicast+0x7c6/0x9a0 [ 880.824065][T16850] ? __pfx_netlink_unicast+0x10/0x10 [ 880.824084][T16850] ? skb_put+0x114/0x1f0 [ 880.824109][T16850] netlink_sendmsg+0x8c3/0xcd0 [ 880.824143][T16850] ? __pfx_netlink_sendmsg+0x10/0x10 [ 880.824168][T16850] ? aa_sock_msg_perm+0x91/0x160 [ 880.824196][T16850] ? __pfx_netlink_sendmsg+0x10/0x10 [ 880.824214][T16850] __sock_sendmsg+0x221/0x270 [ 880.824238][T16850] ____sys_sendmsg+0x523/0x860 [ 880.824271][T16850] ? __pfx_____sys_sendmsg+0x10/0x10 [ 880.824311][T16850] __sys_sendmsg+0x271/0x360 [ 880.824341][T16850] ? __pfx___sys_sendmsg+0x10/0x10 [ 880.824417][T16850] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 880.824436][T16850] ? lockdep_hardirqs_on+0x9d/0x150 [ 880.824456][T16850] __do_fast_syscall_32+0xb4/0x110 [ 880.824473][T16850] ? exc_page_fault+0x5f8/0x920 [ 880.824494][T16850] do_fast_syscall_32+0x34/0x80 [ 880.824513][T16850] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 880.824533][T16850] RIP: 0023:0xf709d539 [ 880.824549][T16850] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 880.824563][T16850] RSP: 002b:00000000f508d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 880.824583][T16850] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 880.824595][T16850] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 880.824606][T16850] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 880.824616][T16850] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 880.824627][T16850] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 880.824655][T16850] [ 880.829631][ T5895] usb 4-1: Manufacturer: syz [ 880.904091][T16837] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3179'. [ 880.945856][ T5895] usb 4-1: SerialNumber: syz [ 881.106603][ T3614] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 881.187198][ T3614] usb 6-1: device descriptor read/8, error -71 [ 881.322490][ T5895] usb 4-1: config 0 descriptor?? [ 881.349562][T16827] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 881.362046][T16827] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 881.512653][ T3614] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 881.637947][T16827] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 881.645247][T16827] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 881.740122][T16708] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 881.867158][ T3614] usb 6-1: device descriptor read/8, error -71 [ 881.922768][T16708] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 882.002710][ T3614] usb usb6-port1: unable to enumerate USB device [ 882.011007][T16708] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 882.351060][ T5895] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 882.542019][T16708] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 883.523785][ T5895] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -71 [ 883.671315][ T5895] usb 4-1: USB disconnect, device number 56 [ 883.804296][T16708] 8021q: adding VLAN 0 to HW filter on device bond0 [ 883.963118][T16708] 8021q: adding VLAN 0 to HW filter on device team0 [ 883.998397][T16894] bridge0: port 1(bridge_slave_0) entered blocking state [ 884.005645][T16894] bridge0: port 1(bridge_slave_0) entered forwarding state [ 884.108613][T12798] bridge0: port 2(bridge_slave_1) entered blocking state [ 884.115813][T12798] bridge0: port 2(bridge_slave_1) entered forwarding state [ 884.187310][ T5895] usb 7-1: new full-speed USB device number 96 using dummy_hcd [ 884.349172][ T5895] usb 7-1: config 162 has an invalid interface number: 251 but max is 1 [ 884.366072][ T5895] usb 7-1: config 162 has an invalid interface number: 209 but max is 1 [ 884.400714][T16708] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 884.428766][ T5895] usb 7-1: config 162 has no interface number 0 [ 884.435073][ T5895] usb 7-1: config 162 has no interface number 1 [ 884.490349][ T5895] usb 7-1: config 162 interface 251 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 884.543877][ T5895] usb 7-1: config 162 interface 209 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 884.569866][T16708] veth0_vlan: entered promiscuous mode [ 884.595768][T16708] veth1_vlan: entered promiscuous mode [ 884.607620][ T5895] usb 7-1: config 162 interface 209 altsetting 1 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 884.618288][T16913] fuse: Bad value for 'group_id' [ 884.634268][ T5895] usb 7-1: config 162 interface 209 altsetting 1 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 884.635046][T16913] fuse: Bad value for 'group_id' [ 884.667791][T16915] program syz.3.3193 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 884.680892][ T5895] usb 7-1: config 162 interface 209 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 884.698296][ T5895] usb 7-1: config 162 interface 209 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 64 [ 884.702500][T16708] veth0_macvtap: entered promiscuous mode [ 884.737417][ T5895] usb 7-1: config 162 interface 209 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 884.749867][T16708] veth1_macvtap: entered promiscuous mode [ 884.761147][ T5895] usb 7-1: config 162 interface 251 has no altsetting 0 [ 884.770219][ T5895] usb 7-1: config 162 interface 209 has no altsetting 0 [ 884.780817][ T5895] usb 7-1: New USB device found, idVendor=1608, idProduct=0010, bcdDevice=4f.88 [ 884.800978][ T5895] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 884.822976][ T5895] usb 7-1: Product: syz [ 884.833094][ T5895] usb 7-1: Manufacturer: syz [ 884.844500][ T5895] usb 7-1: SerialNumber: syz [ 884.848654][T16708] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 884.879448][T16708] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 884.908142][T16708] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 884.947535][T16708] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 884.967047][T16708] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 884.993039][T16708] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 885.067806][ T5895] io_edgeport 7-1:162.251: required endpoints missing [ 885.090900][T16708] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 885.099329][ T5895] io_edgeport 7-1:162.209: Edgeport 2 port adapter converter detected [ 885.136898][T16708] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 885.156405][T16708] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 885.188482][T16708] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 885.214380][T16708] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 885.224298][T16708] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 885.234001][T16708] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 885.244239][T16708] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 885.442030][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 885.453742][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 885.500491][ T5895] usb 7-1: ꒫ꕪ ä€ detected [ 885.514781][T12798] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 885.535371][T12798] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 885.617017][ T6821] usb 6-1: new full-speed USB device number 30 using dummy_hcd [ 885.705286][ T5895] usb 7-1: Edgeport 2 port adapter converter now attached to ttyUSB0 [ 885.731429][ T5895] usb 7-1: Edgeport 2 port adapter converter now attached to ttyUSB1 [ 885.741543][ T30] audit: type=1326 audit(1745440897.031:878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16938 comm="syz.2.3142" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57539 code=0x7ffc0000 [ 885.772260][T16932] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 885.784534][ T30] audit: type=1326 audit(1745440897.031:879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16938 comm="syz.2.3142" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f57539 code=0x7ffc0000 [ 885.812459][ T30] audit: type=1326 audit(1745440897.041:880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16938 comm="syz.2.3142" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57539 code=0x7ffc0000 [ 885.843605][ T6821] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 885.844136][ T30] audit: type=1326 audit(1745440897.041:881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16938 comm="syz.2.3142" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57539 code=0x7ffc0000 [ 885.865629][ T6821] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 885.901653][ T30] audit: type=1326 audit(1745440897.041:882): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16938 comm="syz.2.3142" exe="/root/syz-executor" sig=0 arch=40000003 syscall=41 compat=1 ip=0xf7f57539 code=0x7ffc0000 [ 885.907310][ T6821] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 885.936214][ T30] audit: type=1326 audit(1745440897.041:883): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16938 comm="syz.2.3142" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57539 code=0x7ffc0000 [ 885.940412][T14789] usb 7-1: USB disconnect, device number 96 [ 885.959107][ C0] usb 7-1: edge_interrupt_callback - Error -19 submitting control urb [ 885.975194][ T6821] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 885.982907][ T30] audit: type=1326 audit(1745440897.041:884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16938 comm="syz.2.3142" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57539 code=0x7ffc0000 [ 885.986427][ T6821] usb 6-1: Product: syz [ 886.010875][ T6821] usb 6-1: Manufacturer: syz [ 886.015558][ T6821] usb 6-1: SerialNumber: syz [ 886.020410][ T30] audit: type=1326 audit(1745440897.041:885): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16938 comm="syz.2.3142" exe="/root/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf7f57539 code=0x7ffc0000 [ 886.020588][T16932] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 886.020618][T16932] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 886.066128][ T47] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 886.072462][ T30] audit: type=1326 audit(1745440897.041:886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16938 comm="syz.2.3142" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57539 code=0x7ffc0000 [ 886.075147][T14789] edgeport_2 ttyUSB0: Edgeport 2 port adapter converter now disconnected from ttyUSB0 [ 886.100116][T16932] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 886.115499][ T30] audit: type=1326 audit(1745440897.041:887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16938 comm="syz.2.3142" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f57539 code=0x7ffc0000 [ 886.144800][T16932] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.151432][T14789] edgeport_2 ttyUSB1: Edgeport 2 port adapter converter now disconnected from ttyUSB1 [ 886.157757][T16936] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 886.172106][T16930] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 886.173863][T16932] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 886.191687][T14789] io_edgeport 7-1:162.209: device disconnected [ 886.259126][ T47] usb 3-1: Using ep0 maxpacket: 8 [ 886.270083][ T47] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 886.290514][ T47] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 886.301800][ T47] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 886.314832][ T47] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 886.326513][ T47] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 886.341662][ T47] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 886.351083][ T47] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.408651][T16934] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3195'. [ 886.469861][T16936] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3195'. [ 886.493999][T16936] bridge0: port 1(bridge_slave_0) entered disabled state [ 886.571227][ T47] usb 3-1: usb_control_msg returned -32 [ 886.580201][ T47] usbtmc 3-1:16.0: can't read capabilities [ 886.787199][T16932] usb 7-1: new high-speed USB device number 97 using dummy_hcd [ 886.935268][T16940] usbtmc 3-1:16.0: stb usb_control_msg returned -32 [ 886.946214][ T5895] usb 3-1: USB disconnect, device number 69 [ 886.961075][T16932] usb 7-1: config index 0 descriptor too short (expected 63186, got 210) [ 886.972933][T16932] usb 7-1: config 0 has an invalid interface number: 106 but max is 0 [ 886.989966][T16932] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 887.002295][T16932] usb 7-1: config 0 has no interface number 0 [ 887.009062][T16932] usb 7-1: config 0 interface 106 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 887.019458][T16932] usb 7-1: config 0 interface 106 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 887.030101][T16932] usb 7-1: config 0 interface 106 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 887.043695][T16932] usb 7-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=df.bb [ 887.053896][T16932] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 887.064715][T16932] usb 7-1: config 0 descriptor?? [ 887.075472][T16932] usb 7-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 887.299072][ T6821] cdc_ncm 6-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 887.305701][ T6821] cdc_ncm 6-1:1.0: setting rx_max = 16384 [ 887.506677][ T6821] cdc_ncm 6-1:1.0: setting tx_max = 56 [ 887.734772][T16930] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 887.827322][T16930] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 888.127309][ T3580] usb 7-1: Failed to submit usb control message: -110 [ 888.139116][ T3580] usb 7-1: unable to send the bmi data to the device: -110 [ 888.150133][ T3580] usb 7-1: unable to get target info from device [ 888.161485][ T3580] usb 7-1: could not get target info (-110) [ 888.170834][ T3580] usb 7-1: could not probe fw (-110) [ 888.277034][ T9406] usb 3-1: new low-speed USB device number 70 using dummy_hcd [ 888.431182][ T3614] usb 4-1: USB disconnect, device number 57 [ 888.447727][ T9406] usb 3-1: Invalid ep0 maxpacket: 64 [ 888.587224][ T9406] usb 3-1: new low-speed USB device number 71 using dummy_hcd [ 888.833968][ T9406] usb 3-1: Invalid ep0 maxpacket: 64 [ 888.840616][ T9406] usb usb3-port1: attempt power cycle [ 888.951152][ T6821] cdc_ncm 6-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.5-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 888.996253][ T6821] usb 6-1: USB disconnect, device number 30 [ 889.012014][ T6821] cdc_ncm 6-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.5-1, CDC NCM (NO ZLP) [ 889.266151][ T9406] usb 3-1: new low-speed USB device number 72 using dummy_hcd [ 889.307121][ T9406] usb 3-1: Invalid ep0 maxpacket: 64 [ 889.317984][T16932] usb 7-1: USB disconnect, device number 97 [ 889.606893][ T9406] usb 3-1: new low-speed USB device number 73 using dummy_hcd [ 889.710732][ T9406] usb 3-1: Invalid ep0 maxpacket: 64 [ 889.739725][ T9406] usb usb3-port1: unable to enumerate USB device [ 890.616566][ T6821] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 890.764417][T16998] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3210'. [ 890.777515][T16998] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3210'. [ 890.796646][ T6821] usb 4-1: Using ep0 maxpacket: 8 [ 890.803730][ T6821] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 890.817369][ T6821] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 890.828501][ T6821] usb 4-1: New USB device strings: Mfr=241, Product=1, SerialNumber=3 [ 890.837697][ T6821] usb 4-1: Product: syz [ 890.842344][ T6821] usb 4-1: Manufacturer: syz [ 890.847462][ T6821] usb 4-1: SerialNumber: syz [ 890.854194][ T6821] usb 4-1: config 0 descriptor?? [ 890.862432][ T6821] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 890.969669][ T5892] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 891.080160][ T6821] gspca_zc3xx: reg_w_i err -71 [ 891.106800][ T5892] usb 6-1: device descriptor read/64, error -71 [ 891.135693][ T5849] Bluetooth: hci2: Malformed HCI Event: 0x22 [ 891.366725][ T5892] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 891.510085][ T5892] usb 6-1: device descriptor read/64, error -71 [ 891.626911][ T5892] usb usb6-port1: attempt power cycle [ 891.676576][ T6821] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 891.686871][ T6821] gspca_zc3xx 4-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 891.704435][ T6821] usb 4-1: USB disconnect, device number 58 [ 892.015421][ T5892] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 892.047255][ T5892] usb 6-1: device descriptor read/8, error -71 [ 892.288407][ T5896] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 892.305939][ T5892] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 892.363333][ T5892] usb 6-1: device descriptor read/8, error -71 [ 892.482831][ T5892] usb usb6-port1: unable to enumerate USB device [ 892.512699][ T5896] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 892.552649][ T5896] usb 4-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=83.9c [ 892.562692][ T5896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 892.625664][ T5896] usb 4-1: Product: syz [ 892.633671][ T5896] usb 4-1: Manufacturer: syz [ 892.645850][ T5896] usb 4-1: SerialNumber: syz [ 892.666692][ T6821] usb 7-1: new high-speed USB device number 98 using dummy_hcd [ 892.683197][ T5896] usb 4-1: config 0 descriptor?? [ 892.700675][ T5896] ims_pcu 4-1:0.0: Missing CDC union descriptor [ 892.713770][ T5896] ims_pcu 4-1:0.0: probe with driver ims_pcu failed with error -22 [ 892.829974][ T6821] usb 7-1: Using ep0 maxpacket: 8 [ 892.839113][ T6821] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 892.848587][ T6821] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 892.857883][ T6821] usb 7-1: Product: syz [ 892.862096][ T6821] usb 7-1: Manufacturer: syz [ 892.866810][ T6821] usb 7-1: SerialNumber: syz [ 892.883763][ T6821] usb 7-1: config 0 descriptor?? [ 892.918546][T17019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 892.930421][T17019] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 892.945534][T17019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 892.956106][T17019] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 893.052206][ T3614] usb 4-1: USB disconnect, device number 59 [ 893.168534][ T5896] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 893.341339][ T5896] usb 3-1: config 0 has an invalid descriptor of length 214, skipping remainder of the config [ 893.354023][ T5896] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 893.377258][ T5896] usb 3-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 893.402365][ T5896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 893.417869][ T5896] usb 3-1: config 0 descriptor?? [ 893.596498][ T3614] usb 4-1: new full-speed USB device number 60 using dummy_hcd [ 893.726701][ T3614] usb 4-1: device descriptor read/64, error -71 [ 893.960806][ T6821] dvb_usb_rtl28xxu 7-1:0.0: chip type detection failed -110 [ 893.986149][ T6821] dvb_usb_rtl28xxu 7-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 893.998438][ T3614] usb 4-1: new full-speed USB device number 61 using dummy_hcd [ 894.099819][ T5896] usb 3-1: string descriptor 0 read error: -71 [ 894.122921][ T5896] usb 3-1: USB disconnect, device number 74 [ 894.158116][ T3614] usb 4-1: device descriptor read/64, error -71 [ 894.286801][ T3614] usb usb4-port1: attempt power cycle [ 894.636685][ T3614] usb 4-1: new full-speed USB device number 62 using dummy_hcd [ 894.785678][ T3614] usb 4-1: device descriptor read/8, error -71 [ 894.859123][T17057] netlink: 'syz.2.3231': attribute type 1 has an invalid length. [ 895.047043][ T3614] usb 4-1: new full-speed USB device number 63 using dummy_hcd [ 895.077144][ T3614] usb 4-1: device descriptor read/8, error -71 [ 895.286494][ T3614] usb usb4-port1: unable to enumerate USB device [ 895.470871][ T5895] usb 7-1: USB disconnect, device number 98 [ 896.114009][T17072] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3233'. [ 896.137092][T17072] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3233'. [ 896.747740][ T30] kauditd_printk_skb: 48 callbacks suppressed [ 896.747760][ T30] audit: type=1400 audit(1745440908.051:936): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=2626200D3AFFFFFFFFFFFFFFFF pid=17087 comm="syz.2.3238" [ 897.217739][ T5895] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 897.367005][ T5895] usb 6-1: Using ep0 maxpacket: 32 [ 897.378774][ T5895] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 897.436968][ T5896] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 897.505255][ T5895] usb 6-1: config 0 has no interface number 0 [ 897.521608][ T5895] usb 6-1: config 0 interface 2 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 897.549855][ T5895] usb 6-1: config 0 interface 2 altsetting 2 endpoint 0x82 has invalid maxpacket 33573, setting to 1024 [ 897.564783][ T5895] usb 6-1: config 0 interface 2 has no altsetting 0 [ 897.577994][ T5895] usb 6-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f0.3f [ 897.588137][ T5895] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 897.596245][ T5895] usb 6-1: Product: syz [ 897.602259][ T5895] usb 6-1: Manufacturer: syz [ 897.607813][ T5895] usb 6-1: SerialNumber: syz [ 897.621016][ T5895] usb 6-1: config 0 descriptor?? [ 897.646992][ T5896] usb 4-1: Using ep0 maxpacket: 8 [ 897.658828][ T5896] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 897.669583][ T5896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 897.680447][ T5896] usb 4-1: Product: syz [ 897.684795][ T5896] usb 4-1: Manufacturer: syz [ 897.690435][ T5896] usb 4-1: SerialNumber: syz [ 897.704745][ T5896] usb 4-1: config 0 descriptor?? [ 897.982541][T17109] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3246'. [ 897.997071][T17109] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3246'. [ 898.757501][ T5896] dvb_usb_rtl28xxu 4-1:0.0: chip type detection failed -110 [ 898.765215][ T5896] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 899.354090][ T30] audit: type=1326 audit(1745440910.651:937): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17128 comm="syz.2.3250" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f57539 code=0x0 [ 899.912834][T17141] fuse: Unknown parameter 'grou00000000000000000000' [ 900.081077][ T5895] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 900.158404][ T5895] usb 6-1: USB disconnect, device number 35 [ 900.178491][T14789] usb 4-1: USB disconnect, device number 64 [ 900.534627][ T5849] Bluetooth: hci0: SCO packet for unknown connection handle 4064 [ 900.695977][T17152] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0' [ 900.726893][ T5895] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 900.899743][ T5895] usb 6-1: unable to get BOS descriptor or descriptor too short [ 900.929756][ T5895] usb 6-1: config 63 has an invalid interface number: 66 but max is 0 [ 900.947231][ T5895] usb 6-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 900.967115][ T5895] usb 6-1: config 63 has no interface number 0 [ 901.050116][ T5895] usb 6-1: config 63 interface 66 has no altsetting 0 [ 901.072267][ T5895] usb 6-1: New USB device found, idVendor=174f, idProduct=8a31, bcdDevice=39.f4 [ 901.092804][ T5895] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.134154][ T5895] usb 6-1: Product: І [ 901.164931][ T5895] usb 6-1: Manufacturer: 䎰衦쫅宙飆鶢룰å‡âŽ¸Ý¡à¤­ì‡šâµµá€ å˜µëš¸ã¹²ç¬¢B望⇎ã½ê‡¸ä–⼭䙿췰⒖璿쿥ᩈ䳗ãµê¦†ê·–究4誓悷 [ 901.233083][ T5895] usb 6-1: SerialNumber: á° [ 901.407059][ T5896] usb 7-1: new high-speed USB device number 99 using dummy_hcd [ 901.602811][T17147] vivid-001: ================= START STATUS ================= [ 901.634666][ T5896] usb 7-1: config 0 has no interfaces? [ 901.649777][ T5896] usb 7-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 901.666899][ T5896] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.679522][ T5896] usb 7-1: Product: syz [ 901.687132][T17147] vivid-001: Radio HW Seek Mode: Bounded [ 901.700326][ T5896] usb 7-1: Manufacturer: syz [ 901.713463][ T5896] usb 7-1: SerialNumber: syz [ 901.761072][T17147] vivid-001: Radio Programmable HW Seek: false [ 901.909829][ T5896] usb 7-1: config 0 descriptor?? [ 901.916028][T17147] vivid-001: RDS Rx I/O Mode: Block I/O [ 901.922680][T17147] vivid-001: Generate RBDS Instead of RDS: false [ 901.943444][T17147] vivid-001: RDS Reception: true [ 901.990560][T17147] vivid-001: RDS Program Type: 0 inactive [ 902.006593][T17147] vivid-001: RDS PS Name: inactive [ 902.032106][T17147] vivid-001: RDS Radio Text: inactive [ 902.050058][ T5852] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 902.061074][ T5852] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 902.087589][ T5852] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 902.127054][ T5852] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 902.137377][ T5852] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 902.197508][T17147] vivid-001: RDS Traffic Announcement: false inactive [ 902.217406][T17147] vivid-001: RDS Traffic Program: false inactive [ 902.257046][T17147] vivid-001: RDS Music: false inactive [ 902.277787][T17147] vivid-001: ================== END STATUS ================== [ 902.387707][ T5895] usb 6-1: Found UVC 0.07 device І (174f:8a31) [ 902.395916][T10997] bond0: (slave syz_tun): Releasing backup interface [ 902.404118][T17165] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 902.423377][ T5895] usb 6-1: No valid video chain found. [ 902.453441][T17165] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 902.487425][ T5895] usb 6-1: USB disconnect, device number 36 [ 902.500192][T17165] netlink: 60 bytes leftover after parsing attributes in process `syz.6.3261'. [ 902.583938][ T30] audit: type=1326 audit(1745440913.861:938): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17156 comm="syz.6.3261" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 902.722551][ T30] audit: type=1326 audit(1745440913.871:939): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17156 comm="syz.6.3261" exe="/root/syz-executor" sig=0 arch=40000003 syscall=6 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 902.767946][ T30] audit: type=1326 audit(1745440913.871:940): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17156 comm="syz.6.3261" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 902.845833][ T7664] udevd[7664]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 902.887876][ T30] audit: type=1326 audit(1745440913.871:941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17156 comm="syz.6.3261" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 903.073396][ T30] audit: type=1326 audit(1745440913.871:942): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17156 comm="syz.6.3261" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 903.118181][ T30] audit: type=1326 audit(1745440913.871:943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17156 comm="syz.6.3261" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 903.144198][ T30] audit: type=1326 audit(1745440913.881:944): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17156 comm="syz.6.3261" exe="/root/syz-executor" sig=0 arch=40000003 syscall=453 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 903.172212][ T30] audit: type=1326 audit(1745440913.911:945): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17156 comm="syz.6.3261" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 903.194952][ T30] audit: type=1326 audit(1745440913.921:946): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17156 comm="syz.6.3261" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 903.337065][ T30] audit: type=1326 audit(1745440913.921:947): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17156 comm="syz.6.3261" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 903.494865][T17175] chnl_net:caif_netlink_parms(): no params data found [ 904.120162][ T9406] usb 7-1: USB disconnect, device number 99 [ 904.208220][ T5849] Bluetooth: hci4: command tx timeout [ 904.262532][T17205] vlan2: entered promiscuous mode [ 904.383144][T17175] bridge0: port 1(bridge_slave_0) entered blocking state [ 904.401159][T17175] bridge0: port 1(bridge_slave_0) entered disabled state [ 904.429556][T17175] bridge_slave_0: entered allmulticast mode [ 904.450963][T17175] bridge_slave_0: entered promiscuous mode [ 904.610600][T17175] bridge0: port 2(bridge_slave_1) entered blocking state [ 904.637251][T17175] bridge0: port 2(bridge_slave_1) entered disabled state [ 904.685211][T17175] bridge_slave_1: entered allmulticast mode [ 904.704918][T17175] bridge_slave_1: entered promiscuous mode [ 904.733862][T17211] fuse: Unknown parameter 'grou00000000000000000000' [ 904.840304][T17175] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 904.853568][T17175] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 904.926930][ T5896] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 905.099744][T17175] team0: Port device team_slave_0 added [ 905.115380][ T5896] usb 3-1: Using ep0 maxpacket: 8 [ 905.158527][T17175] team0: Port device team_slave_1 added [ 905.191708][ T5896] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 905.212132][ T5896] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 905.252547][ T5896] usb 3-1: Product: syz [ 905.305199][ T5895] usb 7-1: new high-speed USB device number 100 using dummy_hcd [ 905.345535][ T5896] usb 3-1: Manufacturer: syz [ 905.491071][ T5896] usb 3-1: SerialNumber: syz [ 905.530358][ T5896] usb 3-1: config 0 descriptor?? [ 905.539388][T17175] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 905.552285][T17175] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 905.583004][T17175] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 905.598403][T17175] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 905.605478][T17175] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 905.637059][T17175] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 905.669843][ T5895] usb 7-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 905.679313][ T5895] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 905.694306][ T5895] usb 7-1: Product: syz [ 905.711669][ T5895] usb 7-1: Manufacturer: syz [ 905.735086][ T5895] usb 7-1: SerialNumber: syz [ 905.786172][ T5895] usb 7-1: config 0 descriptor?? [ 905.815215][ T5895] i2c-tiny-usb 7-1:0.0: version 6d.cc found at bus 007 address 100 [ 905.817798][T17175] hsr_slave_0: entered promiscuous mode [ 905.835078][T17175] hsr_slave_1: entered promiscuous mode [ 905.842235][T17175] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 905.853679][ T3614] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 905.862164][T17175] Cannot create hsr debugfs directory [ 906.035327][ T3614] usb 6-1: Using ep0 maxpacket: 32 [ 906.043834][ T3614] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 906.061672][ T3614] usb 6-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 906.071278][ T3614] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 906.082939][ T3614] usb 6-1: Product: syz [ 906.087819][ T3614] usb 6-1: Manufacturer: syz [ 906.092899][ T3614] usb 6-1: SerialNumber: syz [ 906.107844][ T3614] usb 6-1: config 0 descriptor?? [ 906.116184][ T3614] usb 6-1: bad CDC descriptors [ 906.125147][ T3614] usb 6-1: unsupported MDLM descriptors [ 906.223180][ T5895] (null): failure reading functionality [ 906.230426][ T5895] i2c i2c-1: failure reading functionality [ 906.242366][ T5895] i2c i2c-1: connected i2c-tiny-usb device [ 906.277065][ T5849] Bluetooth: hci4: command tx timeout [ 906.333445][T17175] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 906.372424][T17175] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.598434][ T5896] dvb_usb_rtl28xxu 3-1:0.0: chip type detection failed -110 [ 906.720258][ T5896] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 906.743925][T17175] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 906.772570][T14789] usb 6-1: USB disconnect, device number 37 [ 906.810275][T17175] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.892210][T17175] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 906.903944][T17175] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 907.016082][T17175] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 907.035725][T17175] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 907.113060][T17233] veth1_to_team: entered promiscuous mode [ 907.221214][T17233] team0: Port device team_slave_1 removed [ 907.294926][T17175] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 907.306780][T17175] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 907.318827][T17175] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 907.358592][T17175] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 907.523857][ T5895] usb 7-1: USB disconnect, device number 100 [ 907.569395][T17175] 8021q: adding VLAN 0 to HW filter on device bond0 [ 907.600790][T17175] 8021q: adding VLAN 0 to HW filter on device team0 [ 907.617147][ T5896] usb 4-1: new full-speed USB device number 65 using dummy_hcd [ 907.628384][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 907.635553][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 907.658141][ T9406] usb 3-1: USB disconnect, device number 75 [ 907.674534][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 907.681678][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 907.838741][T17175] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 907.856932][ T5896] usb 4-1: not running at top speed; connect to a high speed hub [ 907.869368][T17175] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 907.881041][ T5896] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 907.898899][ T5896] usb 4-1: config 1 has no interface number 1 [ 907.917557][ T5896] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 907.940698][ T5896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 907.984407][ T5896] usb 4-1: Product: syz [ 908.011802][ T5896] usb 4-1: Manufacturer: syz [ 908.016923][ T5896] usb 4-1: SerialNumber: syz [ 908.028194][T17175] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 908.121523][T17175] veth0_vlan: entered promiscuous mode [ 908.140432][T17175] veth1_vlan: entered promiscuous mode [ 908.216961][ T5895] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 908.273018][T17237] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 908.289102][T17237] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 908.357582][ T5849] Bluetooth: hci4: command tx timeout [ 908.409702][ T5896] usb 4-1: 2:1 : format type 0 is detected, processed as PCM [ 908.455767][ T5895] usb 6-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 908.466818][T17175] veth0_macvtap: entered promiscuous mode [ 908.476050][ T5895] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 908.502431][ T5895] usb 6-1: Product: syz [ 908.507958][ T5896] usb 4-1: failed to enable PITCH for EP 0x82 [ 908.514430][ T5895] usb 6-1: Manufacturer: syz [ 908.520171][T17175] veth1_macvtap: entered promiscuous mode [ 908.575781][T17251] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 908.594121][ T5895] usb 6-1: SerialNumber: syz [ 908.600354][ T5896] usb 4-1: USB disconnect, device number 65 [ 908.619112][ T5895] usb 6-1: config 0 descriptor?? [ 908.638209][ T5895] i2c-tiny-usb 6-1:0.0: version 6d.cc found at bus 006 address 038 [ 908.767238][T17175] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 908.811826][T17175] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 908.823214][T17175] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 908.838618][T17175] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 908.850374][T17175] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 908.884243][T17175] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 908.901132][T17175] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 908.921825][T17175] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 908.923080][T17257] fuse: Unknown parameter 'grou00000000000000000000' [ 908.940259][T17175] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 908.948215][ T5848] udevd[5848]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 908.950502][ T6821] usb 7-1: new high-speed USB device number 101 using dummy_hcd [ 908.998885][T17175] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 909.058432][T17175] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 909.061778][ T5895] (null): failure reading functionality [ 909.085625][T17175] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 909.099058][ T5895] i2c i2c-1: failure reading functionality [ 909.106006][T17175] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 909.110551][ T5895] i2c i2c-1: connected i2c-tiny-usb device [ 909.173104][ T6821] usb 7-1: config 0 has no interfaces? [ 909.183194][T17175] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 909.214416][T17175] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 909.224230][T17175] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 909.352344][T17175] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 909.352422][ T6821] usb 7-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 909.369802][T17175] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 909.954315][ T6821] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 910.216489][ T6821] usb 7-1: Product: syz [ 910.285532][ T6821] usb 7-1: Manufacturer: syz [ 910.437002][ T5849] Bluetooth: hci4: command tx timeout [ 910.446398][ T6821] usb 7-1: SerialNumber: syz [ 910.490733][ T6821] usb 7-1: config 0 descriptor?? [ 910.968360][ T5892] usb 6-1: USB disconnect, device number 38 [ 911.233487][ T975] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 911.265623][ T975] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 911.328428][ T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 911.338963][ T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 911.434833][T17277] 8021q: VLANs not supported on sit0 [ 911.865873][ T5896] usb 7-1: USB disconnect, device number 101 [ 912.107881][T17288] netlink: 'syz.3.3287': attribute type 4 has an invalid length. [ 912.423776][T17285] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3258'. [ 912.481664][T17285] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3258'. [ 912.718505][T17304] pim6reg1: entered promiscuous mode [ 912.723877][T17304] pim6reg1: entered allmulticast mode [ 913.465791][T16932] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 913.719269][T16932] usb 6-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 913.736966][T16932] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 913.780441][T16932] usb 6-1: Product: syz [ 913.784748][T16932] usb 6-1: Manufacturer: syz [ 913.794250][T16932] usb 6-1: SerialNumber: syz [ 913.850325][ T6821] usb 3-1: new full-speed USB device number 76 using dummy_hcd [ 913.921191][T16932] usb 6-1: config 0 descriptor?? [ 913.937165][T16932] i2c-tiny-usb 6-1:0.0: version 6d.cc found at bus 006 address 039 [ 914.082002][ T6821] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 914.100419][ T6821] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 96, setting to 64 [ 914.143791][ T6821] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 914.221637][ T6821] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 914.287264][ T6821] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 914.344042][ T6821] usb 3-1: SerialNumber: syz [ 914.380676][T17320] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 914.399168][T16932] (null): failure reading functionality [ 914.414675][ T6821] hub 3-1:1.0: bad descriptor, ignoring hub [ 914.414879][T16932] i2c i2c-1: failure reading functionality [ 914.436824][ T6821] hub 3-1:1.0: probe with driver hub failed with error -5 [ 914.462567][T16932] i2c i2c-1: connected i2c-tiny-usb device [ 914.527682][T17329] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3298'. [ 914.612438][T17320] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 914.671524][T17332] FAULT_INJECTION: forcing a failure. [ 914.671524][T17332] name failslab, interval 1, probability 0, space 0, times 0 [ 914.736987][T17332] CPU: 0 UID: 0 PID: 17332 Comm: syz.3.3299 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(full) [ 914.737023][T17332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 914.737035][T17332] Call Trace: [ 914.737046][T17332] [ 914.737064][T17332] dump_stack_lvl+0x241/0x360 [ 914.737091][T17332] ? __pfx_dump_stack_lvl+0x10/0x10 [ 914.737105][T17332] ? __pfx__printk+0x10/0x10 [ 914.737121][T17332] ? __pfx___might_resched+0x10/0x10 [ 914.737136][T17332] should_fail_ex+0x424/0x570 [ 914.737167][T17332] should_failslab+0xac/0x100 [ 914.737190][T17332] __kmalloc_noprof+0xdf/0x4d0 [ 914.737210][T17332] ? tomoyo_encode+0x26f/0x540 [ 914.737233][T17332] tomoyo_encode+0x26f/0x540 [ 914.737250][T17332] tomoyo_realpath_from_path+0x59e/0x5e0 [ 914.737271][T17332] tomoyo_path_number_perm+0x245/0x790 [ 914.737282][T17332] ? __lock_acquire+0xad5/0xd80 [ 914.737306][T17332] ? tomoyo_path_number_perm+0x215/0x790 [ 914.737327][T17332] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 914.737384][T17332] ? __fget_files+0x2a/0x420 [ 914.737395][T17332] ? __fget_files+0x2a/0x420 [ 914.737406][T17332] ? __fget_files+0x2a/0x420 [ 914.737418][T17332] security_file_ioctl_compat+0xc6/0x2a0 [ 914.737431][T17332] __ia32_compat_sys_ioctl+0x128/0xc90 [ 914.737450][T17332] ? __fget_files+0x2a/0x420 [ 914.737465][T17332] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 914.737489][T17332] ? __fget_files+0x2a/0x420 [ 914.737511][T17332] ? fput+0x9b/0xd0 [ 914.737530][T17332] ? ksys_write+0x275/0x2d0 [ 914.737549][T17332] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 914.737561][T17332] ? lockdep_hardirqs_on+0x9d/0x150 [ 914.737572][T17332] __do_fast_syscall_32+0xb4/0x110 [ 914.737583][T17332] ? exc_page_fault+0x5f8/0x920 [ 914.737597][T17332] do_fast_syscall_32+0x34/0x80 [ 914.737615][T17332] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 914.737635][T17332] RIP: 0023:0xf7fe4539 [ 914.737651][T17332] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 914.737667][T17332] RSP: 002b:00000000f510655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 914.737687][T17332] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0f8565c [ 914.737694][T17332] RDX: 00000000800001c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 914.737700][T17332] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 914.737706][T17332] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 914.737712][T17332] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 914.737727][T17332] [ 914.737748][T17332] ERROR: Out of memory at tomoyo_realpath_from_path. [ 915.084161][T17337] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 915.093971][T17337] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 915.163303][ T6821] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 915.510370][ T6821] usb 3-1: USB disconnect, device number 76 [ 915.662084][ T5896] usb 6-1: USB disconnect, device number 39 [ 915.723421][T17344] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3302'. [ 915.733296][T17344] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3302'. [ 915.896640][ T6821] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 916.060584][ T6821] usb 3-1: config 68 has an invalid interface number: 213 but max is 0 [ 916.082521][ T6821] usb 3-1: config 68 has no interface number 0 [ 916.099136][ T6821] usb 3-1: config 68 interface 213 altsetting 1 endpoint 0x2 has an invalid bInterval 152, changing to 11 [ 916.120547][ T6821] usb 3-1: config 68 interface 213 altsetting 1 endpoint 0x4 has invalid maxpacket 1024, setting to 64 [ 916.142659][ T6821] usb 3-1: config 68 interface 213 has no altsetting 0 [ 916.158746][ T6821] usb 3-1: New USB device found, idVendor=0b48, idProduct=300d, bcdDevice=3b.bb [ 916.177936][ T6821] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 916.186179][ T6821] usb 3-1: Product: syz [ 916.191090][ T6821] usb 3-1: Manufacturer: syz [ 916.195852][ T6821] usb 3-1: SerialNumber: syz [ 916.457175][ T5896] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 916.648239][ T5896] usb 6-1: Using ep0 maxpacket: 32 [ 916.654956][ T6821] dvb-usb: found a 'Technotrend TT-connect CT-3650' in warm state. [ 916.700353][ T5896] usb 6-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 916.715306][ T6821] dvb-usb: bulk message failed: -22 (4/0) [ 916.717037][ T5896] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 916.727801][ T6821] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 916.733214][ T5896] usb 6-1: Product: syz [ 916.783779][ T5896] usb 6-1: Manufacturer: syz [ 916.789449][ T5896] usb 6-1: SerialNumber: syz [ 916.807364][ T6821] dvb-usb: bulk message failed: -22 (5/0) [ 916.813206][ T6821] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 916.817680][ T5896] usb 6-1: config 0 descriptor?? [ 916.835590][ T5896] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 917.120605][ T6821] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 917.169171][T17359] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 917.436464][ T6821] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 917.525776][T17359] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 917.534309][ T5896] gspca_ov534_9: reg_w failed -110 [ 917.540822][ T6821] dvbdev: DVB: registering new adapter (Technotrend TT-connect CT-3650) [ 917.555933][T17359] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 917.556416][ T6821] usb 3-1: media controller created [ 917.825120][T17359] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 918.049478][ T6821] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 918.087164][ T5896] gspca_ov534_9: Unknown sensor 0000 [ 918.087228][ T5896] ov534_9 6-1:0.0: probe with driver ov534_9 failed with error -22 [ 918.130612][ T6821] ttusb2: set interface to alts=3 failed [ 918.177937][ T5896] usb 6-1: USB disconnect, device number 40 [ 918.230171][ T6821] DVB: Unable to find symbol tda10023_attach() [ 918.246757][ T6821] dvb-usb: no frontend was attached by 'Technotrend TT-connect CT-3650' [ 918.322489][T17388] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3312'. [ 918.376417][ T6821] rc_core: IR keymap rc-tt-1500 not found [ 918.391228][ T6821] Registered IR keymap rc-empty [ 918.419069][ T6821] rc rc0: Technotrend TT-connect CT-3650 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 918.449098][ T6821] input: Technotrend TT-connect CT-3650 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input44 [ 918.530511][ T6821] dvb-usb: schedule remote query interval to 150 msecs. [ 918.557363][ T6821] dvb-usb: bulk message failed: -22 (4/0) [ 918.713187][ T6821] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 918.725785][T14789] dvb-usb: bulk message failed: -22 (4/0) [ 918.733507][T14789] ttusb2: there might have been an error during control message transfer. (rlen = 9, was 0) [ 918.978741][ T6821] dvb-usb: bulk message failed: -22 (5/0) [ 918.984777][T14789] dvb-usb: error -5 while querying for an remote control event. [ 918.992786][ T6821] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 919.005155][ T6821] dvb-usb: Technotrend TT-connect CT-3650 successfully initialized and connected. [ 919.025294][ T6821] usb 3-1: USB disconnect, device number 77 [ 919.039157][T17400] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3315'. [ 919.161183][T14789] dvb-usb: bulk message failed: -22 (4/0) [ 919.280130][T14789] ttusb2: there might have been an error during control message transfer. (rlen = 9, was 0) [ 919.441092][T14789] dvb-usb: error -5 while querying for an remote control event. [ 919.506382][T17400] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3315'. [ 919.682541][ T6821] dvb-usb: Technotrend TT-connect CT-3650 successfully deinitialized and disconnected. [ 920.209756][ T5896] usb 7-1: new high-speed USB device number 102 using dummy_hcd [ 920.367011][T16932] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 920.375414][ T5896] usb 7-1: device descriptor read/64, error -71 [ 920.589222][T16932] usb 6-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 920.599136][T16932] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 920.643319][ T5896] usb 7-1: new high-speed USB device number 103 using dummy_hcd [ 920.653851][T16932] usb 6-1: Product: syz [ 920.677582][T16932] usb 6-1: Manufacturer: syz [ 920.682235][T16932] usb 6-1: SerialNumber: syz [ 920.710559][T17426] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3322'. [ 920.737882][T16932] usb 6-1: config 0 descriptor?? [ 920.759676][T16932] i2c-tiny-usb 6-1:0.0: version 6d.cc found at bus 006 address 041 [ 920.827800][ T5896] usb 7-1: device descriptor read/64, error -71 [ 920.957535][ T5896] usb usb7-port1: attempt power cycle [ 921.032851][T17432] mmap: syz.3.3324 (17432): VmData 45760512 exceed data ulimit 2. Update limits or use boot option ignore_rlimit_data. [ 921.183281][T16932] (null): failure reading functionality [ 921.229789][T16932] i2c i2c-1: failure reading functionality [ 921.258834][T16932] i2c i2c-1: connected i2c-tiny-usb device [ 921.304995][T17436] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3325'. [ 921.307111][ T5896] usb 7-1: new high-speed USB device number 104 using dummy_hcd [ 921.317206][T17436] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3325'. [ 921.363174][T17436] netlink: 'syz.2.3325': attribute type 3 has an invalid length. [ 921.371543][T17433] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(10) [ 921.378184][T17433] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 921.400919][ T5896] usb 7-1: device descriptor read/8, error -71 [ 921.656859][ T5896] usb 7-1: new high-speed USB device number 105 using dummy_hcd [ 921.688115][T17437] could not allocate digest TFM handle sha384-neon [ 921.708329][ T5896] usb 7-1: device descriptor read/8, error -71 [ 921.774002][T17438] vhci_hcd: connection closed [ 921.779417][T17433] vhci_hcd vhci_hcd.0: Device attached [ 921.808830][ T3580] vhci_hcd: stop threads [ 921.815455][ T3580] vhci_hcd: release socket [ 921.820590][ T5896] usb usb7-port1: unable to enumerate USB device [ 921.829225][ T3580] vhci_hcd: disconnect device [ 922.046903][ T6821] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 922.156789][T16932] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 922.246511][ T6821] usb 4-1: Using ep0 maxpacket: 8 [ 922.257055][ T6821] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 922.265585][ T6821] usb 4-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 922.278059][ T6821] usb 4-1: config 179 has no interface number 0 [ 922.284523][ T6821] usb 4-1: config 179 interface 65 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 922.303230][ T6821] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 922.313896][ T6821] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 922.337235][T16932] usb 3-1: Using ep0 maxpacket: 32 [ 922.414429][T16932] usb 3-1: unable to get BOS descriptor or descriptor too short [ 922.444410][T16932] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 922.474139][T16932] usb 3-1: can't read configurations, error -71 [ 922.540905][ T5896] usb 6-1: USB disconnect, device number 41 [ 922.577153][ T30] kauditd_printk_skb: 56 callbacks suppressed [ 922.577171][ T30] audit: type=1326 audit(1745440933.881:1004): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17445 comm="syz.3.3326" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fe4539 code=0x0 [ 922.765403][T17464] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3329'. [ 922.775357][T17464] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3329'. [ 922.893202][T17475] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3333'. [ 923.113733][T17481] loop8: detected capacity change from 0 to 7 [ 923.120726][T17485] fuse: Bad value for 'fd' [ 923.133593][T17483] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3336'. [ 923.154342][T10426] Dev loop8: unable to read RDB block 7 [ 923.163116][T10426] loop8: unable to read partition table [ 923.173278][T10426] loop8: partition table beyond EOD, truncated [ 923.192519][T17481] Dev loop8: unable to read RDB block 7 [ 923.200548][T17481] loop8: unable to read partition table [ 923.207171][T17481] loop8: partition table beyond EOD, truncated [ 923.213443][T17481] loop_reread_partitions: partition scan of loop8 (þ被x) failed (rc=-5) [ 923.406100][T17495] FAULT_INJECTION: forcing a failure. [ 923.406100][T17495] name failslab, interval 1, probability 0, space 0, times 0 [ 923.422010][T17495] CPU: 0 UID: 0 PID: 17495 Comm: syz.2.3341 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(full) [ 923.422036][T17495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 923.422047][T17495] Call Trace: [ 923.422055][T17495] [ 923.422063][T17495] dump_stack_lvl+0x241/0x360 [ 923.422094][T17495] ? __pfx_dump_stack_lvl+0x10/0x10 [ 923.422117][T17495] ? __pfx__printk+0x10/0x10 [ 923.422138][T17495] ? __lock_acquire+0xad5/0xd80 [ 923.422169][T17495] should_fail_ex+0x424/0x570 [ 923.422198][T17495] should_failslab+0xac/0x100 [ 923.422219][T17495] kmem_cache_alloc_noprof+0x78/0x390 [ 923.422237][T17495] ? skb_clone+0x20c/0x390 [ 923.422258][T17495] skb_clone+0x20c/0x390 [ 923.422277][T17495] __netlink_deliver_tap+0x3c4/0x7f0 [ 923.422305][T17495] ? netlink_deliver_tap+0x2e/0x1b0 [ 923.422322][T17495] netlink_deliver_tap+0x19d/0x1b0 [ 923.422342][T17495] netlink_unicast+0x7c6/0x9a0 [ 923.422368][T17495] ? __pfx_netlink_unicast+0x10/0x10 [ 923.422388][T17495] ? skb_put+0x114/0x1f0 [ 923.422425][T17495] netlink_sendmsg+0x8c3/0xcd0 [ 923.422457][T17495] ? __pfx_netlink_sendmsg+0x10/0x10 [ 923.422481][T17495] ? aa_sock_msg_perm+0x91/0x160 [ 923.422507][T17495] ? __pfx_netlink_sendmsg+0x10/0x10 [ 923.422525][T17495] __sock_sendmsg+0x221/0x270 [ 923.422548][T17495] ____sys_sendmsg+0x523/0x860 [ 923.422577][T17495] ? __pfx_____sys_sendmsg+0x10/0x10 [ 923.422613][T17495] __sys_sendmsg+0x271/0x360 [ 923.422642][T17495] ? __pfx___sys_sendmsg+0x10/0x10 [ 923.422715][T17495] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 923.422734][T17495] ? lockdep_hardirqs_on+0x9d/0x150 [ 923.422753][T17495] __do_fast_syscall_32+0xb4/0x110 [ 923.422772][T17495] ? exc_page_fault+0x5f8/0x920 [ 923.422793][T17495] do_fast_syscall_32+0x34/0x80 [ 923.422812][T17495] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 923.422832][T17495] RIP: 0023:0xf7f57539 [ 923.422848][T17495] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 923.422862][T17495] RSP: 002b:00000000f507655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 923.422881][T17495] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800001c0 [ 923.422893][T17495] RDX: 0000000000040050 RSI: 0000000000000000 RDI: 0000000000000000 [ 923.422904][T17495] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 923.422914][T17495] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 923.422924][T17495] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 923.422950][T17495] [ 923.746162][T17498] netlink: 'syz.6.3342': attribute type 1 has an invalid length. [ 923.931070][T17498] 8021q: VLANs not supported on nlmon0 [ 923.937764][T17505] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3344'. [ 923.951772][T17505] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3344'. [ 924.177884][T17519] vlan2: entered promiscuous mode [ 924.307020][T16932] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 924.486992][T16932] usb 3-1: Using ep0 maxpacket: 32 [ 924.497767][T16932] usb 3-1: config 0 interface 0 has no altsetting 0 [ 924.504724][T16932] usb 3-1: New USB device found, idVendor=056a, idProduct=033c, bcdDevice= 0.00 [ 924.547133][T16932] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 924.571155][T16932] usb 3-1: config 0 descriptor?? [ 924.606554][ T6821] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 924.785043][ T6821] usb 6-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 924.840532][ T6821] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 924.854113][ T47] usb 4-1: USB disconnect, device number 66 [ 924.891103][ T6821] usb 6-1: Product: syz [ 924.895698][ T6821] usb 6-1: Manufacturer: syz [ 924.930313][ T6821] usb 6-1: SerialNumber: syz [ 924.964891][ T6821] usb 6-1: config 0 descriptor?? [ 925.042746][T17512] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 925.057935][T17512] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 925.118514][T16932] usbhid 3-1:0.0: can't add hid device: -71 [ 925.148330][T16932] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 925.188753][T16932] usb 3-1: USB disconnect, device number 80 [ 925.196989][ T6821] hso 6-1:0.0: Failed to find BULK IN ep [ 925.291315][ T6821] usb-storage 6-1:0.0: USB Mass Storage device detected [ 925.316485][ T47] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 925.392620][T17521] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 925.407734][T17521] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 925.442100][T16932] usb 6-1: USB disconnect, device number 42 [ 925.473512][T17532] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3352'. [ 925.500026][ T47] usb 4-1: Using ep0 maxpacket: 32 [ 925.513492][ T47] usb 4-1: config 0 has an invalid interface number: 235 but max is 0 [ 925.522272][ T47] usb 4-1: config 0 has no interface number 0 [ 925.530724][ T47] usb 4-1: New USB device found, idVendor=085a, idProduct=0009, bcdDevice=a3.47 [ 925.550365][ T47] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 925.580226][ T47] usb 4-1: Product: syz [ 925.584901][ T47] usb 4-1: Manufacturer: syz [ 925.589856][ T47] usb 4-1: SerialNumber: syz [ 925.600057][ T47] usb 4-1: config 0 descriptor?? [ 926.180565][T16932] usb 7-1: new high-speed USB device number 106 using dummy_hcd [ 926.229658][T17548] kvm: kvm [17544]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x187) = 0x3 [ 926.355780][T17547] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3357'. [ 926.388600][T16932] usb 7-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 926.400378][T16932] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 926.415599][T16932] usb 7-1: Product: syz [ 926.422499][T17547] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3357'. [ 926.434440][T16932] usb 7-1: Manufacturer: syz [ 926.453427][T16932] usb 7-1: SerialNumber: syz [ 926.513941][T16932] usb 7-1: config 0 descriptor?? [ 926.565791][T16932] i2c-tiny-usb 7-1:0.0: version 6d.cc found at bus 007 address 106 [ 927.137149][T16932] (null): failure reading functionality [ 927.144237][T16932] i2c i2c-1: failure reading functionality [ 927.164045][T16932] i2c i2c-1: connected i2c-tiny-usb device [ 927.196494][ T6821] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 927.268427][T17559] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3360'. [ 927.449778][ T6821] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 927.461590][ T6821] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 927.540901][ T6821] usb 6-1: New USB device found, idVendor=07b5, idProduct=0312, bcdDevice= 0.00 [ 927.571879][ T6821] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.612434][ T6821] usb 6-1: config 0 descriptor?? [ 927.873710][T17556] ptrace attach of "./syz-executor exec"[17565] was attempted by "./syz-executor exec"[17556] [ 927.993300][ T30] audit: type=1326 audit(1745440939.281:1005): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17563 comm="syz.2.3361" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57539 code=0x7ffc0000 [ 928.059955][ T30] audit: type=1326 audit(1745440939.281:1006): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17563 comm="syz.2.3361" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f57558 code=0x7ffc0000 [ 928.083427][ T30] audit: type=1326 audit(1745440939.321:1007): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17563 comm="syz.2.3361" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f57558 code=0x7ffc0000 [ 928.098423][ T47] kaweth 4-1:0.235: Firmware present in device. [ 928.152409][ T30] audit: type=1326 audit(1745440939.321:1008): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17563 comm="syz.2.3361" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f57558 code=0x7ffc0000 [ 928.159420][ T6821] usbhid 6-1:0.0: can't add hid device: -71 [ 928.196909][ T47] kaweth 4-1:0.235: Error reading configuration (-71), no net device created [ 928.221758][ T47] kaweth 4-1:0.235: probe with driver kaweth failed with error -5 [ 928.233327][ T30] audit: type=1326 audit(1745440939.321:1009): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17563 comm="syz.2.3361" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f57558 code=0x7ffc0000 [ 928.234969][ T6821] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 928.255563][ C1] vkms_vblank_simulate: vblank timer overrun [ 928.279926][ T47] usb 4-1: USB disconnect, device number 67 [ 928.354256][ T6821] usb 6-1: USB disconnect, device number 43 [ 928.389255][ T30] audit: type=1326 audit(1745440939.321:1010): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17563 comm="syz.2.3361" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f57558 code=0x7ffc0000 [ 928.453374][T17569] FAULT_INJECTION: forcing a failure. [ 928.453374][T17569] name failslab, interval 1, probability 0, space 0, times 0 [ 928.484475][T17569] CPU: 1 UID: 0 PID: 17569 Comm: syz.6.3364 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(full) [ 928.484504][T17569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 928.484515][T17569] Call Trace: [ 928.484523][T17569] [ 928.484532][T17569] dump_stack_lvl+0x241/0x360 [ 928.484565][T17569] ? __pfx_dump_stack_lvl+0x10/0x10 [ 928.484588][T17569] ? __pfx__printk+0x10/0x10 [ 928.484616][T17569] ? __lock_acquire+0xad5/0xd80 [ 928.484643][T17569] should_fail_ex+0x424/0x570 [ 928.484672][T17569] should_failslab+0xac/0x100 [ 928.484692][T17569] __kmalloc_noprof+0xdf/0x4d0 [ 928.484710][T17569] ? sctp_bind_addrs_to_raw+0x103/0x340 [ 928.484742][T17569] sctp_bind_addrs_to_raw+0x103/0x340 [ 928.484768][T17569] ? __pfx_sctp_bind_addrs_to_raw+0x10/0x10 [ 928.484801][T17569] sctp_make_init+0x1e6/0x1290 [ 928.484825][T17569] ? is_bpf_text_address+0x288/0x2a0 [ 928.484850][T17569] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 928.484872][T17569] ? kernel_text_address+0xa7/0xe0 [ 928.484894][T17569] ? __pfx_sctp_make_init+0x10/0x10 [ 928.484910][T17569] ? unwind_get_return_address+0x4d/0x90 [ 928.484931][T17569] ? arch_stack_walk+0xff/0x150 [ 928.484963][T17569] ? stack_trace_save+0x11a/0x1d0 [ 928.484990][T17569] sctp_sf_do_prm_asoc+0xd2/0x3f0 [ 928.485014][T17569] ? __pfx_sctp_pname+0x10/0x10 [ 928.485033][T17569] sctp_do_sm+0x1f3/0x60e0 [ 928.485058][T17569] ? kasan_save_track+0x51/0x80 [ 928.485079][T17569] ? __kasan_kmalloc+0x9d/0xb0 [ 928.485101][T17569] ? sctp_stream_init_ext+0x56/0x180 [ 928.485116][T17569] ? sctp_sendmsg_to_asoc+0x1476/0x19b0 [ 928.485137][T17569] ? __sock_sendmsg+0x1a6/0x270 [ 928.485155][T17569] ? __sys_sendto+0x365/0x4c0 [ 928.485175][T17569] ? __ia32_sys_sendto+0xdd/0x100 [ 928.485195][T17569] ? __do_fast_syscall_32+0xb4/0x110 [ 928.485212][T17569] ? do_fast_syscall_32+0x34/0x80 [ 928.485228][T17569] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 928.485250][T17569] ? __pfx_sctp_do_sm+0x10/0x10 [ 928.485301][T17569] ? __sk_mem_raise_allocated+0xa5f/0x1140 [ 928.485333][T17569] sctp_primitive_ASSOCIATE+0x95/0xc0 [ 928.485361][T17569] sctp_sendmsg_to_asoc+0x11d9/0x19b0 [ 928.485394][T17569] ? sctp_assoc_add_peer+0xcc0/0x1360 [ 928.485428][T17569] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 928.485447][T17569] ? sctp_connect_new_asoc+0x442/0x700 [ 928.485473][T17569] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 928.485499][T17569] ? sctp_endpoint_lookup_assoc+0x7c/0x250 [ 928.485525][T17569] ? sctp_endpoint_lookup_assoc+0x7c/0x250 [ 928.485544][T17569] ? sctp_endpoint_lookup_assoc+0x217/0x250 [ 928.485565][T17569] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 928.485590][T17569] sctp_sendmsg+0x2512/0x3620 [ 928.485633][T17569] ? __pfx_sctp_sendmsg+0x10/0x10 [ 928.485658][T17569] ? aa_sk_perm+0x96f/0xac0 [ 928.485695][T17569] ? inet_sendmsg+0x330/0x390 [ 928.485730][T17569] __sock_sendmsg+0x1a6/0x270 [ 928.485753][T17569] __sys_sendto+0x365/0x4c0 [ 928.485781][T17569] ? __pfx___sys_sendto+0x10/0x10 [ 928.485816][T17569] ? __fget_files+0x2a/0x420 [ 928.485843][T17569] ? ksys_write+0x275/0x2d0 [ 928.485876][T17569] __ia32_sys_sendto+0xdd/0x100 [ 928.485902][T17569] __do_fast_syscall_32+0xb4/0x110 [ 928.485919][T17569] ? exc_page_fault+0x5f8/0x920 [ 928.485941][T17569] do_fast_syscall_32+0x34/0x80 [ 928.485960][T17569] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 928.485978][T17569] RIP: 0023:0xf709d539 [ 928.485993][T17569] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 928.486008][T17569] RSP: 002b:00000000f508d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 928.486027][T17569] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000080 [ 928.486039][T17569] RDX: 0000000000000002 RSI: 0000000020000050 RDI: 0000000080000100 [ 928.486050][T17569] RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 [ 928.486060][T17569] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 928.486070][T17569] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 928.486097][T17569] [ 928.497041][ T30] audit: type=1326 audit(1745440939.321:1011): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17563 comm="syz.2.3361" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f57558 code=0x7ffc0000 [ 928.948687][ T30] audit: type=1326 audit(1745440939.321:1012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17563 comm="syz.2.3361" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f57558 code=0x7ffc0000 [ 928.978314][ T30] audit: type=1326 audit(1745440939.321:1013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17563 comm="syz.2.3361" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f57558 code=0x7ffc0000 [ 929.102267][ T30] audit: type=1326 audit(1745440939.321:1014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17563 comm="syz.2.3361" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f57558 code=0x7ffc0000 [ 929.701557][T17581] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 929.937337][T17591] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3372'. [ 929.998058][T17586] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3369'. [ 930.037249][T17586] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3369'. [ 930.162218][T17604] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3373'. [ 930.466590][T14789] usb 4-1: new low-speed USB device number 68 using dummy_hcd [ 930.479137][ T6821] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 930.639164][T14789] usb 4-1: Invalid ep0 maxpacket: 64 [ 930.673790][ T6821] usb 6-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 930.693442][ T6821] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 930.725670][ T6821] usb 6-1: Product: syz [ 930.742860][ T6821] usb 6-1: Manufacturer: syz [ 930.757209][ T6821] usb 6-1: SerialNumber: syz [ 930.817708][ T6821] usb 6-1: config 0 descriptor?? [ 930.836716][T14789] usb 4-1: new low-speed USB device number 69 using dummy_hcd [ 930.859398][T17609] netlink: 'syz.6.3377': attribute type 27 has an invalid length. [ 930.998648][ T6821] gspca_main: sonixb-2.14.0 probing 0c45:6005 [ 931.027104][T14789] usb 4-1: Invalid ep0 maxpacket: 64 [ 931.033539][T14789] usb usb4-port1: attempt power cycle [ 931.055955][T17609] syz_tun: left promiscuous mode [ 931.131765][T17609] bridge0: port 3(geneve1) entered disabled state [ 931.134459][T17614] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 931.138473][T17609] bridge0: port 2(bridge_slave_1) entered disabled state [ 931.154120][T17609] bridge0: port 1(bridge_slave_0) entered disabled state [ 931.189836][T17614] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 931.476554][T14789] usb 4-1: new low-speed USB device number 70 using dummy_hcd [ 931.543654][T14789] usb 4-1: Invalid ep0 maxpacket: 64 [ 931.738321][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.745728][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.821552][T14789] usb 4-1: new low-speed USB device number 71 using dummy_hcd [ 931.848152][T14789] usb 4-1: Invalid ep0 maxpacket: 64 [ 931.862154][T14789] usb usb4-port1: unable to enumerate USB device [ 932.092933][T14789] usb 7-1: USB disconnect, device number 106 [ 932.544102][T17609] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 932.589847][T17609] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 932.810875][T17609] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 932.822008][T17609] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 932.858830][T17609] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 932.884395][T17609] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 933.029328][T14789] usb 6-1: USB disconnect, device number 44 [ 933.466634][T14789] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 933.557448][ T5895] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 933.637291][T14789] usb 6-1: Using ep0 maxpacket: 16 [ 933.654325][T14789] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 933.667780][T14789] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 933.687395][T14789] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 933.704897][T14789] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 933.714683][T14789] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 933.716794][ T5895] usb 4-1: Using ep0 maxpacket: 32 [ 933.728344][T14789] usb 6-1: Product: syz [ 933.732645][T14789] usb 6-1: Manufacturer: syz [ 933.742835][ T5895] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 933.751910][T14789] usb 6-1: SerialNumber: syz [ 933.753831][ T5895] usb 4-1: config 0 has no interface number 0 [ 933.774762][ T5895] usb 4-1: config 0 interface 12 has no altsetting 0 [ 933.784725][ T5895] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 933.794792][ T5895] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 933.821331][ T5895] usb 4-1: Product: syz [ 933.826815][ T5895] usb 4-1: Manufacturer: syz [ 933.831630][ T5895] usb 4-1: SerialNumber: syz [ 933.841125][T17636] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3386'. [ 933.852131][T17636] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3386'. [ 933.864194][ T5895] usb 4-1: config 0 descriptor?? [ 933.944509][T17640] FAULT_INJECTION: forcing a failure. [ 933.944509][T17640] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 933.958781][T17640] CPU: 1 UID: 0 PID: 17640 Comm: syz.2.3387 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(full) [ 933.958807][T17640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 933.958817][T17640] Call Trace: [ 933.958825][T17640] [ 933.958835][T17640] dump_stack_lvl+0x241/0x360 [ 933.958867][T17640] ? __pfx_dump_stack_lvl+0x10/0x10 [ 933.958890][T17640] ? __pfx__printk+0x10/0x10 [ 933.958923][T17640] should_fail_ex+0x424/0x570 [ 933.958953][T17640] _copy_to_user+0x31/0xb0 [ 933.958976][T17640] video_usercopy+0xcf0/0x1070 [ 933.959010][T17640] ? __pfx___video_do_ioctl+0x10/0x10 [ 933.959033][T17640] ? __pfx_video_usercopy+0x10/0x10 [ 933.959073][T17640] ? __fget_files+0x2a/0x420 [ 933.959094][T17640] v4l2_ioctl+0x189/0x1e0 [ 933.959120][T17640] v4l2_compat_ioctl32+0x1d7/0x260 [ 933.959145][T17640] __ia32_compat_sys_ioctl+0x561/0xc90 [ 933.959171][T17640] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 933.959194][T17640] ? __fget_files+0x2a/0x420 [ 933.959216][T17640] ? fput+0x9b/0xd0 [ 933.959234][T17640] ? ksys_write+0x275/0x2d0 [ 933.959264][T17640] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 933.959281][T17640] ? lockdep_hardirqs_on+0x9d/0x150 [ 933.959301][T17640] __do_fast_syscall_32+0xb4/0x110 [ 933.959318][T17640] ? exc_page_fault+0x5f8/0x920 [ 933.959340][T17640] do_fast_syscall_32+0x34/0x80 [ 933.959358][T17640] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 933.959377][T17640] RIP: 0023:0xf7f57539 [ 933.959392][T17640] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 933.959407][T17640] RSP: 002b:00000000f507655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 933.959426][T17640] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c014563b [ 933.959439][T17640] RDX: 0000000080000180 RSI: 0000000000000000 RDI: 0000000000000000 [ 933.959449][T17640] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 933.959459][T17640] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 933.959469][T17640] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 933.959502][T17640] [ 934.239601][T14789] usb 6-1: 2:1 : format type 0 is detected, processed as PCM [ 934.248939][T14789] usb 6-1: 2:1: cannot set freq 9338507 to ep 0x82 [ 934.278155][T14789] usb 6-1: USB disconnect, device number 45 [ 934.397421][T17650] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3391'. [ 934.464025][T17650] xt_CT: No such helper "snmp" [ 934.523233][T17655] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3393'. [ 934.543117][T17656] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3392'. [ 934.563950][ T5848] udevd[5848]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 935.042993][T17667] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3397'. [ 935.055162][T17667] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3397'. [ 935.817062][ T9406] usb 7-1: new high-speed USB device number 107 using dummy_hcd [ 936.001746][ T9406] usb 7-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 936.011346][ T9406] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 936.020639][ T9406] usb 7-1: Product: syz [ 936.025255][ T9406] usb 7-1: Manufacturer: syz [ 936.030547][ T9406] usb 7-1: SerialNumber: syz [ 936.075574][ T9406] usb 7-1: config 0 descriptor?? [ 936.081641][ T5896] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 936.129888][ T9406] i2c-tiny-usb 7-1:0.0: version 6d.cc found at bus 007 address 107 [ 936.314841][ T5896] usb 3-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 936.325040][ T5896] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 936.334316][ T5896] usb 3-1: Product: syz [ 936.339065][ T5896] usb 3-1: Manufacturer: syz [ 936.343729][ T5896] usb 3-1: SerialNumber: syz [ 936.464759][ T5895] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 936.473740][ T5895] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 936.493919][ T5895] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 936.505299][ T5896] usb 3-1: config 0 descriptor?? [ 936.519014][ T5895] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 936.529795][ T5896] i2c-tiny-usb 3-1:0.0: version 6d.cc found at bus 003 address 081 [ 936.551505][ T5895] usb 4-1: USB disconnect, device number 72 [ 936.568371][ T9406] (null): failure reading functionality [ 936.580491][ T9406] i2c i2c-1: failure reading functionality [ 936.592897][ T9406] i2c i2c-1: connected i2c-tiny-usb device [ 936.845027][T17699] fuse: Bad value for 'user_id' [ 936.850722][T17699] fuse: Bad value for 'user_id' [ 936.911336][T16932] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 936.952739][ T5896] (null): failure reading functionality [ 936.962220][ T5896] i2c i2c-2: failure reading functionality [ 936.978762][ T5896] i2c i2c-2: connected i2c-tiny-usb device [ 937.069534][T16932] usb 6-1: config 0 has an invalid interface number: 50 but max is 0 [ 937.079297][T16932] usb 6-1: config 0 has no interface number 0 [ 937.092647][T16932] usb 6-1: config 0 interface 50 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 937.112612][T16932] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 937.136728][T16932] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 937.156036][T16932] usb 6-1: Product: syz [ 937.340722][T17703] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 937.351570][T16932] usb 6-1: Manufacturer: syz [ 937.362653][T16932] usb 6-1: SerialNumber: syz [ 937.384828][T16932] usb 6-1: config 0 descriptor?? [ 937.423181][T16932] yurex 6-1:0.50: Could not find endpoints [ 937.649961][T17705] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3409'. [ 937.659460][T17705] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3409'. [ 938.240039][T16932] usb 3-1: USB disconnect, device number 81 [ 938.491720][ T6821] usb 7-1: USB disconnect, device number 107 [ 939.043533][T17731] fuse: Bad value for 'fd' [ 939.189217][T17732] netlink: 116 bytes leftover after parsing attributes in process `syz.0.3418'. [ 939.624942][T16932] usb 6-1: USB disconnect, device number 46 [ 939.654190][T17748] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 940.619625][ T5895] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 941.107700][ T5895] usb 6-1: config 0 has no interfaces? [ 941.240403][ T5895] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 941.296838][ T5895] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 941.305006][ T5895] usb 6-1: Product: syz [ 941.368727][ T5895] usb 6-1: Manufacturer: syz [ 941.381981][ T5895] usb 6-1: SerialNumber: syz [ 941.412745][ T5895] usb 6-1: config 0 descriptor?? [ 941.873175][ T5895] IPVS: starting estimator thread 0... [ 942.086592][T17777] IPVS: using max 42 ests per chain, 100800 per kthread [ 942.107262][ T5896] usb 7-1: new high-speed USB device number 108 using dummy_hcd [ 942.272549][ T5896] usb 7-1: Using ep0 maxpacket: 8 [ 942.294239][ T5896] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 942.307148][ T5896] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 942.325603][ T5896] usb 7-1: Product: syz [ 942.342772][ T5896] usb 7-1: Manufacturer: syz [ 942.365334][ T5896] usb 7-1: SerialNumber: syz [ 942.387981][ T5896] usb 7-1: config 0 descriptor?? [ 942.403790][T17783] fuse: Bad value for 'fd' [ 943.089890][T17799] FAULT_INJECTION: forcing a failure. [ 943.089890][T17799] name failslab, interval 1, probability 0, space 0, times 0 [ 943.089941][T17799] CPU: 1 UID: 0 PID: 17799 Comm: syz.2.3434 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(full) [ 943.089980][T17799] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 943.089986][T17799] Call Trace: [ 943.089990][T17799] [ 943.089996][T17799] dump_stack_lvl+0x241/0x360 [ 943.090016][T17799] ? __pfx_dump_stack_lvl+0x10/0x10 [ 943.090030][T17799] ? __pfx__printk+0x10/0x10 [ 943.090053][T17799] ? __pfx___might_resched+0x10/0x10 [ 943.090075][T17799] should_fail_ex+0x424/0x570 [ 943.090105][T17799] should_failslab+0xac/0x100 [ 943.090125][T17799] __kmalloc_noprof+0xdf/0x4d0 [ 943.090136][T17799] ? tomoyo_realpath_from_path+0xc2/0x5e0 [ 943.090155][T17799] ? tomoyo_realpath_from_path+0xcf/0x5e0 [ 943.090170][T17799] tomoyo_realpath_from_path+0xcf/0x5e0 [ 943.090193][T17799] tomoyo_path_number_perm+0x245/0x790 [ 943.090211][T17799] ? __lock_acquire+0xad5/0xd80 [ 943.090236][T17799] ? tomoyo_path_number_perm+0x215/0x790 [ 943.090257][T17799] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 943.090295][T17799] ? __fget_files+0x2a/0x420 [ 943.090304][T17799] ? __fget_files+0x2a/0x420 [ 943.090315][T17799] ? __fget_files+0x2a/0x420 [ 943.090326][T17799] security_file_ioctl_compat+0xc6/0x2a0 [ 943.090343][T17799] __ia32_compat_sys_ioctl+0x128/0xc90 [ 943.090366][T17799] ? __fget_files+0x2a/0x420 [ 943.090382][T17799] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 943.090403][T17799] ? __fget_files+0x2a/0x420 [ 943.090424][T17799] ? fput+0x9b/0xd0 [ 943.090435][T17799] ? ksys_write+0x275/0x2d0 [ 943.090452][T17799] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 943.090463][T17799] ? lockdep_hardirqs_on+0x9d/0x150 [ 943.090474][T17799] __do_fast_syscall_32+0xb4/0x110 [ 943.090485][T17799] ? exc_page_fault+0x5f8/0x920 [ 943.090506][T17799] do_fast_syscall_32+0x34/0x80 [ 943.090524][T17799] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 943.090543][T17799] RIP: 0023:0xf7f57539 [ 943.090558][T17799] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 943.090572][T17799] RSP: 002b:00000000f503455c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 943.090584][T17799] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080064d12 [ 943.090591][T17799] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 943.090597][T17799] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 943.090602][T17799] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 943.090608][T17799] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 943.090622][T17799] [ 943.113455][T17799] ERROR: Out of memory at tomoyo_realpath_from_path. [ 943.317524][ T5892] usb 6-1: USB disconnect, device number 47 [ 943.477236][ T5896] dvb_usb_rtl28xxu 7-1:0.0: chip type detection failed -110 [ 943.620375][ T5896] dvb_usb_rtl28xxu 7-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 943.752261][ T6821] usb 7-1: USB disconnect, device number 108 [ 943.866751][T17808] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 944.262943][T17825] fuse: Bad value for 'fd' [ 944.277208][T16932] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 944.417377][T16932] usb 3-1: device descriptor read/64, error -71 [ 944.657204][T16932] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 944.926981][T16932] usb 3-1: device descriptor read/64, error -71 [ 945.037181][T16932] usb usb3-port1: attempt power cycle [ 945.182725][ T5892] usb 7-1: new high-speed USB device number 109 using dummy_hcd [ 945.336958][ T5892] usb 7-1: Using ep0 maxpacket: 16 [ 945.343985][ T5892] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 945.360946][ T5892] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 945.371585][ T5892] usb 7-1: New USB device found, idVendor=054c, idProduct=05c4, bcdDevice= 0.00 [ 945.377618][T16932] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 945.386391][ T5892] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 945.403272][ T5892] usb 7-1: config 0 descriptor?? [ 945.438881][T16932] usb 3-1: device descriptor read/8, error -71 [ 945.676837][T16932] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 945.698191][T16932] usb 3-1: device descriptor read/8, error -71 [ 945.817176][T16932] usb usb3-port1: unable to enumerate USB device [ 946.035583][ T5892] usbhid 7-1:0.0: can't add hid device: -32 [ 946.042243][ T5892] usbhid 7-1:0.0: probe with driver usbhid failed with error -32 [ 947.166481][ T5892] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 947.240267][T17864] kvm: Disabled LAPIC found during irq injection [ 947.316492][ T5892] usb 6-1: device descriptor read/64, error -71 [ 947.507043][T16932] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 947.586585][ T5892] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 947.638556][ T5895] usb 7-1: USB disconnect, device number 109 [ 947.670025][T16932] usb 3-1: Using ep0 maxpacket: 16 [ 947.684515][T16932] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 947.709972][T16932] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 947.726610][ T5892] usb 6-1: device descriptor read/64, error -71 [ 947.769343][T16932] usb 3-1: config 0 has no interface number 0 [ 947.814870][T16932] usb 3-1: New USB device found, idVendor=0bd3, idProduct=0555, bcdDevice= 0.5b [ 947.838625][T16932] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 947.839615][ T5892] usb usb6-port1: attempt power cycle [ 947.875699][T16932] usb 3-1: config 0 descriptor?? [ 947.885083][T16932] usb 3-1: Found UVC 0.00 device (0bd3:0555) [ 947.895227][T16932] usb 3-1: No valid video chain found. [ 948.090424][T16932] usb 3-1: USB disconnect, device number 86 [ 948.206524][ T5892] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 948.231378][ T5892] usb 6-1: device descriptor read/8, error -71 [ 948.507077][ T5892] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 948.547027][ T5892] usb 6-1: device descriptor read/8, error -71 [ 948.656774][ T5892] usb usb6-port1: unable to enumerate USB device [ 948.892647][T17889] trusted_key: encrypted_key: key user:syz not found [ 949.036534][ T5892] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 949.244061][ T5892] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 949.255631][ T5892] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 949.273340][ T5892] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 949.282695][ T5892] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 949.306066][ T5892] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 949.315668][ T5892] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 949.329344][ T5892] usb 4-1: Product: syz [ 949.333633][ T5892] usb 4-1: Manufacturer: syz [ 949.344970][ T5892] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 949.646070][ T9406] usb 4-1: USB disconnect, device number 73 [ 949.967861][ T9406] usb 4-1: new full-speed USB device number 74 using dummy_hcd [ 950.107140][ T9406] usb 4-1: device descriptor read/64, error -71 [ 950.346920][ T9406] usb 4-1: new full-speed USB device number 75 using dummy_hcd [ 950.366000][T17920] netlink: 'syz.5.3475': attribute type 27 has an invalid length. [ 950.487825][ T9406] usb 4-1: device descriptor read/64, error -71 [ 950.607181][ T9406] usb usb4-port1: attempt power cycle [ 950.642676][T17920] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 950.810493][T17920] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.822000][T17920] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.842688][T17920] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.861700][T17920] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.896936][ T5895] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 950.916246][T17923] bridge: RTM_NEWNEIGH with invalid ether address [ 950.947596][ T9406] usb 4-1: new full-speed USB device number 76 using dummy_hcd [ 950.977622][ T9406] usb 4-1: device descriptor read/8, error -71 [ 951.079217][ T5895] usb 6-1: config 220 has an invalid interface number: 76 but max is 2 [ 951.088724][ T5895] usb 6-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 951.100720][ T5895] usb 6-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 951.112210][ T5895] usb 6-1: config 220 has no interface number 2 [ 951.119413][ T5895] usb 6-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 951.134010][ T5895] usb 6-1: config 220 interface 0 has no altsetting 0 [ 951.192049][ T5895] usb 6-1: config 220 interface 76 has no altsetting 0 [ 951.199822][ T5895] usb 6-1: config 220 interface 1 has no altsetting 0 [ 951.214090][ T5895] usb 6-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 951.223954][ T5895] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 951.235899][T17934] fuse: Invalid gid '00000000000000000012' [ 951.237120][ T9406] usb 4-1: new full-speed USB device number 77 using dummy_hcd [ 951.267102][ T5895] usb 6-1: Product: syz [ 951.271696][ T5895] usb 6-1: Manufacturer: syz [ 951.279490][ T5895] usb 6-1: SerialNumber: syz [ 951.304262][ T9406] usb 4-1: device descriptor read/8, error -71 [ 951.417448][ T9406] usb usb4-port1: unable to enumerate USB device [ 951.556140][ T5895] usb 6-1: selecting invalid altsetting 0 [ 951.563181][ T5895] usb 6-1: Found UVC 7.01 device syz (8086:0b07) [ 951.570802][ T5895] usb 6-1: No valid video chain found. [ 951.588962][ T5895] usb 6-1: selecting invalid altsetting 0 [ 951.635427][ T5895] usbtest 6-1:220.1: probe with driver usbtest failed with error -22 [ 951.661302][ T5895] usb 6-1: USB disconnect, device number 52 [ 952.128396][T17952] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3484'. [ 953.466490][ T5892] usb 7-1: new high-speed USB device number 110 using dummy_hcd [ 953.916745][ T5892] usb 7-1: Using ep0 maxpacket: 32 [ 953.935023][ T5892] usb 7-1: config 0 interface 0 has no altsetting 0 [ 953.953305][ T5892] usb 7-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 953.963383][ T6821] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 953.996513][ T5892] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 954.004569][ T5892] usb 7-1: Product: syz [ 954.043445][ T5892] usb 7-1: Manufacturer: syz [ 954.071399][ T5892] usb 7-1: SerialNumber: syz [ 954.096950][ T5892] usb 7-1: config 0 descriptor?? [ 954.127703][ T5892] gs_usb 7-1:0.0: Required endpoints not found [ 954.150379][ T6821] usb 3-1: Using ep0 maxpacket: 16 [ 954.174047][ T6821] usb 3-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice=2a.35 [ 954.202670][ T6821] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 954.215892][ T6821] usb 3-1: Product: syz [ 954.220781][ T6821] usb 3-1: Manufacturer: syz [ 954.225661][ T6821] usb 3-1: SerialNumber: syz [ 954.227227][ T5895] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 954.241684][ T6821] usb 3-1: config 0 descriptor?? [ 954.252321][ T6821] as10x_usb: device has been detected [ 954.261165][ T6821] dvbdev: DVB: registering new adapter (Sky IT Digital Key (green led)) [ 954.283086][ T6821] usb 3-1: DVB: registering adapter 1 frontend 0 (Sky IT Digital Key (green led))... [ 954.295530][ T6821] as10x_usb: error during firmware upload part1 [ 954.302459][ T6821] Registered device Sky IT Digital Key (green led) [ 954.397126][ T5895] usb 6-1: Using ep0 maxpacket: 16 [ 954.418718][ T5895] usb 6-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice=2a.35 [ 954.429081][ T5895] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 954.440077][ T5895] usb 6-1: Product: syz [ 954.444287][ T5895] usb 6-1: Manufacturer: syz [ 954.450326][ T5895] usb 6-1: SerialNumber: syz [ 954.450330][T17979] random: crng reseeded on system resumption [ 954.452937][ T5895] usb 6-1: config 0 descriptor?? [ 954.459487][T17979] FAULT_INJECTION: forcing a failure. [ 954.459487][T17979] name failslab, interval 1, probability 0, space 0, times 0 [ 954.481074][T17979] CPU: 1 UID: 0 PID: 17979 Comm: syz.2.3491 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(full) [ 954.481103][T17979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 954.481114][T17979] Call Trace: [ 954.481122][T17979] [ 954.481130][T17979] dump_stack_lvl+0x241/0x360 [ 954.481163][T17979] ? __pfx_dump_stack_lvl+0x10/0x10 [ 954.481187][T17979] ? __pfx__printk+0x10/0x10 [ 954.481222][T17979] should_fail_ex+0x424/0x570 [ 954.481254][T17979] should_failslab+0xac/0x100 [ 954.481276][T17979] __kmalloc_cache_noprof+0x73/0x370 [ 954.481292][T17979] ? async_schedule_node_domain+0x5c/0x110 [ 954.481318][T17979] ? __pfx___async_dev_cache_fw_image+0x10/0x10 [ 954.481345][T17979] async_schedule_node_domain+0x5c/0x110 [ 954.481372][T17979] dev_cache_fw_image+0x36f/0x3e0 [ 954.481393][T17979] ? irqentry_exit+0x63/0x90 [ 954.481408][T17979] ? lockdep_hardirqs_on+0x9d/0x150 [ 954.481429][T17979] ? __pfx_dev_cache_fw_image+0x10/0x10 [ 954.481472][T17979] ? __pfx_dev_cache_fw_image+0x10/0x10 [ 954.481494][T17979] dpm_for_each_dev+0x58/0xc0 [ 954.481521][T17979] fw_pm_notify+0x254/0x2f0 [ 954.481543][T17979] ? __pfx_fw_pm_notify+0x10/0x10 [ 954.481562][T17979] ? rcu_is_watching+0x15/0xb0 [ 954.481580][T17979] ? __pfx_autoremove_wake_function+0x10/0x10 [ 954.481602][T17979] ? __mutex_lock+0x380/0x10c0 [ 954.481620][T17979] ? rcu_is_watching+0x15/0xb0 [ 954.481645][T17979] notifier_call_chain+0x1a5/0x3f0 [ 954.481671][T17979] blocking_notifier_call_chain_robust+0xf2/0x1f0 [ 954.481693][T17979] ? __pfx_blocking_notifier_call_chain_robust+0x10/0x10 [ 954.481723][T17979] pm_notifier_call_chain_robust+0x2c/0x60 [ 954.481748][T17979] snapshot_open+0x132/0x280 [ 954.481769][T17979] ? __pfx_snapshot_open+0x10/0x10 [ 954.481795][T17979] misc_open+0x2cc/0x340 [ 954.481822][T17979] chrdev_open+0x514/0x600 [ 954.481842][T17979] ? __pfx_chrdev_open+0x10/0x10 [ 954.481861][T17979] ? file_set_fsnotify_mode_from_watchers+0x123/0x640 [ 954.481891][T17979] ? __pfx_chrdev_open+0x10/0x10 [ 954.481904][T17979] do_dentry_open+0xdec/0x1960 [ 954.481933][T17979] ? vfs_open+0x31/0x370 [ 954.481955][T17979] vfs_open+0x3b/0x370 [ 954.481976][T17979] path_openat+0x2caf/0x35d0 [ 954.482003][T17979] ? __pfx_kstrtoull+0x10/0x10 [ 954.482026][T17979] ? stack_depot_save_flags+0x44/0x940 [ 954.482060][T17979] ? kasan_save_track+0x51/0x80 [ 954.482090][T17979] ? __pfx_path_openat+0x10/0x10 [ 954.482108][T17979] ? do_fast_syscall_32+0x34/0x80 [ 954.482124][T17979] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 954.482165][T17979] do_filp_open+0x284/0x4e0 [ 954.482189][T17979] ? __pfx_do_filp_open+0x10/0x10 [ 954.482207][T17979] ? do_raw_spin_lock+0x151/0x370 [ 954.482268][T17979] do_sys_openat2+0x12b/0x1d0 [ 954.482291][T17979] ? __pfx_do_sys_openat2+0x10/0x10 [ 954.482308][T17979] ? __fget_files+0x2a/0x420 [ 954.482328][T17979] ? __fget_files+0x2a/0x420 [ 954.482351][T17979] __ia32_compat_sys_openat+0x241/0x290 [ 954.482375][T17979] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 954.482403][T17979] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 954.482419][T17979] ? lockdep_hardirqs_on+0x9d/0x150 [ 954.482441][T17979] __do_fast_syscall_32+0xb4/0x110 [ 954.482464][T17979] ? exc_page_fault+0x5f8/0x920 [ 954.482487][T17979] do_fast_syscall_32+0x34/0x80 [ 954.482505][T17979] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 954.482524][T17979] RIP: 0023:0xf7f57539 [ 954.482540][T17979] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 954.482555][T17979] RSP: 002b:00000000f507655c EFLAGS: 00000206 ORIG_RAX: 0000000000000127 [ 954.482576][T17979] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800002c0 [ 954.482588][T17979] RDX: 0000000000040081 RSI: 0000000000000000 RDI: 0000000000000000 [ 954.482599][T17979] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 954.482609][T17979] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 954.482619][T17979] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 954.482649][T17979] [ 954.939518][T17979] [ 954.941892][T17979] ============================================ [ 954.948141][T17979] WARNING: possible recursive locking detected [ 954.954303][T17979] 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 Not tainted [ 954.961576][T17979] -------------------------------------------- [ 954.967721][T17979] syz.2.3491/17979 is trying to acquire lock: [ 954.973777][T17979] ffffffff8f701648 (fw_lock){+.+.}-{4:4}, at: assign_fw+0x56/0x890 [ 954.981726][T17979] [ 954.981726][T17979] but task is already holding lock: [ 954.989079][T17979] ffffffff8f701648 (fw_lock){+.+.}-{4:4}, at: fw_pm_notify+0x23c/0x2f0 [ 954.997339][T17979] [ 954.997339][T17979] other info that might help us debug this: [ 955.005422][T17979] Possible unsafe locking scenario: [ 955.005422][T17979] [ 955.012883][T17979] CPU0 [ 955.016152][T17979] ---- [ 955.019432][T17979] lock(fw_lock); [ 955.023154][T17979] lock(fw_lock); [ 955.026880][T17979] [ 955.026880][T17979] *** DEADLOCK *** [ 955.026880][T17979] [ 955.035990][T17979] May be due to missing lock nesting notation [ 955.035990][T17979] [ 955.044398][T17979] 5 locks held by syz.2.3491/17979: [ 955.049595][T17979] #0: ffffffff8f5afa68 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x54/0x340 [ 955.058084][T17979] #1: ffffffff8ebee028 (system_transition_mutex){+.+.}-{4:4}, at: lock_system_sleep+0x60/0xa0 [ 955.068471][T17979] #2: ffffffff8ec11690 ((pm_chain_head).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain_robust+0xb8/0x1f0 [ 955.080343][T17979] #3: ffffffff8f701648 (fw_lock){+.+.}-{4:4}, at: fw_pm_notify+0x23c/0x2f0 [ 955.089107][T17979] #4: ffffffff8f6fc8c8 (dpm_list_mtx){+.+.}-{4:4}, at: dpm_for_each_dev+0x2b/0xc0 [ 955.098451][T17979] [ 955.098451][T17979] stack backtrace: [ 955.104330][T17979] CPU: 1 UID: 0 PID: 17979 Comm: syz.2.3491 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(full) [ 955.104345][T17979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 955.104352][T17979] Call Trace: [ 955.104358][T17979] [ 955.104363][T17979] dump_stack_lvl+0x241/0x360 [ 955.104381][T17979] ? __pfx_dump_stack_lvl+0x10/0x10 [ 955.104395][T17979] ? __pfx__printk+0x10/0x10 [ 955.104408][T17979] ? print_lock+0x171/0x1a0 [ 955.104424][T17979] print_deadlock_bug+0x2be/0x2d0 [ 955.104433][T17979] validate_chain+0x928/0x24e0 [ 955.104443][T17979] ? _raw_spin_unlock_irqrestore+0x90/0x140 [ 955.104458][T17979] ? lockdep_hardirqs_on+0x9d/0x150 [ 955.104467][T17979] ? _raw_spin_unlock_irqrestore+0xde/0x140 [ 955.104482][T17979] __lock_acquire+0xad5/0xd80 [ 955.104495][T17979] lock_acquire+0x116/0x2f0 [ 955.104507][T17979] ? assign_fw+0x56/0x890 [ 955.104519][T17979] ? dev_cache_fw_image+0x36f/0x3e0 [ 955.104531][T17979] ? fw_pm_notify+0x254/0x2f0 [ 955.104544][T17979] __mutex_lock+0x1a5/0x10c0 [ 955.104553][T17979] ? assign_fw+0x56/0x890 [ 955.104563][T17979] ? do_sys_openat2+0x12b/0x1d0 [ 955.104574][T17979] ? do_fast_syscall_32+0x34/0x80 [ 955.104584][T17979] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 955.104597][T17979] ? assign_fw+0x56/0x890 [ 955.104607][T17979] ? __pfx___mutex_lock+0x10/0x10 [ 955.104619][T17979] ? kasan_quarantine_put+0xdc/0x230 [ 955.104631][T17979] ? lockdep_hardirqs_on+0x9d/0x150 [ 955.104640][T17979] assign_fw+0x56/0x890 [ 955.104659][T17979] ? kmem_cache_free+0x197/0x410 [ 955.104668][T17979] ? _request_firmware+0xf08/0x1540 [ 955.104680][T17979] _request_firmware+0xfd1/0x1540 [ 955.104695][T17979] ? __pfx__request_firmware+0x10/0x10 [ 955.104707][T17979] ? do_raw_spin_lock+0x151/0x370 [ 955.104719][T17979] __async_dev_cache_fw_image+0xf3/0x350 [ 955.104733][T17979] ? __pfx___async_dev_cache_fw_image+0x10/0x10 [ 955.104746][T17979] ? rcu_is_watching+0x15/0xb0 [ 955.104756][T17979] ? kfree+0x54/0x430 [ 955.104763][T17979] ? async_schedule_node_domain+0xa3/0x110 [ 955.104776][T17979] ? async_schedule_node_domain+0x5c/0x110 [ 955.104789][T17979] ? __pfx___async_dev_cache_fw_image+0x10/0x10 [ 955.104802][T17979] async_schedule_node_domain+0xdc/0x110 [ 955.104815][T17979] dev_cache_fw_image+0x36f/0x3e0 [ 955.104827][T17979] ? irqentry_exit+0x63/0x90 [ 955.104839][T17979] ? lockdep_hardirqs_on+0x9d/0x150 [ 955.104855][T17979] ? __pfx_dev_cache_fw_image+0x10/0x10 [ 955.104879][T17979] ? __pfx_dev_cache_fw_image+0x10/0x10 [ 955.104899][T17979] dpm_for_each_dev+0x58/0xc0 [ 955.104922][T17979] fw_pm_notify+0x254/0x2f0 [ 955.104937][T17979] ? __pfx_fw_pm_notify+0x10/0x10 [ 955.104948][T17979] ? rcu_is_watching+0x15/0xb0 [ 955.104957][T17979] ? __pfx_autoremove_wake_function+0x10/0x10 [ 955.104968][T17979] ? __mutex_lock+0x380/0x10c0 [ 955.104977][T17979] ? rcu_is_watching+0x15/0xb0 [ 955.104987][T17979] notifier_call_chain+0x1a5/0x3f0 [ 955.104997][T17979] blocking_notifier_call_chain_robust+0xf2/0x1f0 [ 955.105007][T17979] ? __pfx_blocking_notifier_call_chain_robust+0x10/0x10 [ 955.105019][T17979] pm_notifier_call_chain_robust+0x2c/0x60 [ 955.105032][T17979] snapshot_open+0x132/0x280 [ 955.105044][T17979] ? __pfx_snapshot_open+0x10/0x10 [ 955.105057][T17979] misc_open+0x2cc/0x340 [ 955.105071][T17979] chrdev_open+0x514/0x600 [ 955.105080][T17979] ? __pfx_chrdev_open+0x10/0x10 [ 955.105089][T17979] ? file_set_fsnotify_mode_from_watchers+0x123/0x640 [ 955.105103][T17979] ? __pfx_chrdev_open+0x10/0x10 [ 955.105111][T17979] do_dentry_open+0xdec/0x1960 [ 955.105122][T17979] ? vfs_open+0x31/0x370 [ 955.105132][T17979] vfs_open+0x3b/0x370 [ 955.105141][T17979] path_openat+0x2caf/0x35d0 [ 955.105154][T17979] ? __pfx_kstrtoull+0x10/0x10 [ 955.105165][T17979] ? stack_depot_save_flags+0x44/0x940 [ 955.105180][T17979] ? kasan_save_track+0x51/0x80 [ 955.105193][T17979] ? __pfx_path_openat+0x10/0x10 [ 955.105203][T17979] ? do_fast_syscall_32+0x34/0x80 [ 955.105212][T17979] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 955.105227][T17979] do_filp_open+0x284/0x4e0 [ 955.105238][T17979] ? __pfx_do_filp_open+0x10/0x10 [ 955.105249][T17979] ? do_raw_spin_lock+0x151/0x370 [ 955.105265][T17979] do_sys_openat2+0x12b/0x1d0 [ 955.105276][T17979] ? __pfx_do_sys_openat2+0x10/0x10 [ 955.105285][T17979] ? __fget_files+0x2a/0x420 [ 955.105294][T17979] ? __fget_files+0x2a/0x420 [ 955.105303][T17979] __ia32_compat_sys_openat+0x241/0x290 [ 955.105315][T17979] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 955.105327][T17979] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 955.105336][T17979] ? lockdep_hardirqs_on+0x9d/0x150 [ 955.105345][T17979] __do_fast_syscall_32+0xb4/0x110 [ 955.105355][T17979] ? exc_page_fault+0x5f8/0x920 [ 955.105379][T17979] do_fast_syscall_32+0x34/0x80 [ 955.105389][T17979] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 955.105403][T17979] RIP: 0023:0xf7f57539 [ 955.105412][T17979] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 955.105421][T17979] RSP: 002b:00000000f507655c EFLAGS: 00000206 ORIG_RAX: 0000000000000127 [ 955.105432][T17979] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800002c0 [ 955.105439][T17979] RDX: 0000000000040081 RSI: 0000000000000000 RDI: 0000000000000000 [ 955.105445][T17979] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 955.105451][T17979] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 955.105456][T17979] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 955.105465][T17979]