last executing test programs: 14.110363886s ago: executing program 3 (id=931): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) keyctl$clear(0x3, 0xfffffffffffffffd) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="5800000010004b0400000000000000007a000000", @ANYRES32=0x0, @ANYBLOB="0020000000000000380012800b0001006272696467650000280002800600060000040000050007000700000005"], 0x58}}, 0x0) 12.252854995s ago: executing program 3 (id=938): rt_sigaction(0x40, &(0x7f0000000500)={&(0x7f0000000380)="2437460f1c2bdfd5c4a2f10027460f38e7418f69d8909ca3000810ffa5c43b3be5c436fe0d4e486df513bb559a00000f75bed5370b1c2665d2950e000000dbf5", 0x4000000, 0x0}, 0x0, 0x8, &(0x7f0000001540)) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') read$FUSE(r0, &(0x7f0000000280)={0x2020}, 0x2020) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) mkdir(&(0x7f0000000140)='./control\x00', 0x5) (async, rerun: 32) r2 = inotify_init1(0x0) (rerun: 32) inotify_add_watch(r2, &(0x7f0000000180)='./control\x00', 0xa4000960) (async, rerun: 32) r3 = socket$unix(0x1, 0x1, 0x0) (rerun: 32) bind$unix(r3, &(0x7f00000001c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x56) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="640000001000010000000000000000000000000a04000000120001"], 0x64}}, 0x0) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) (async) rt_sigsuspend(&(0x7f0000000140)={[0x80000001]}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x10, &(0x7f0000000240)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@ldst={0x2, 0x0, 0x3}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) (async) syz_usb_connect$uac1(0x3, 0xb1, &(0x7f00000003c0)=ANY=[@ANYRES8=r1, @ANYBLOB="8528c6799c81"], 0x0) (async) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x9, 0x1010, r1, 0x4ee0a000) 9.132380971s ago: executing program 3 (id=947): r0 = socket$can_bcm(0x1d, 0x2, 0x2) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, 0x0, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_script(r5, &(0x7f0000000a80)={'#! ', './file0', [{0x20, '+'}, {0x20, 'quota\x00'}, {0x20, 'CONNMARK\x00'}, {0x20, '#'}], 0xa, "0d4f5ef86971c40895a8aa823a71abe26a7cf23e6aa2a4dc123f5e813f8e88b95622d972d7e9c6a2b41a22f12b637ff916331f3bb81c3ba29ade5b69a8e71d063f5695"}, 0x63) close(r5) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[], &(0x7f0000000180), 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x8e79f0352167ea94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000180)=ANY=[@ANYRES32=r6], 0x14) r7 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r5, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f0000000880)={0x144, r3, 0x10, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x1, 0x65}}}}, [@NL80211_ATTR_REKEY_DATA={0xc, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}]}, @NL80211_ATTR_REKEY_DATA={0x70, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="1fbf070c2a8c12ed4f05ef9e23a4cd93"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "9f1b5b5af13b4f2d"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "13369d0fa84ef869"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xfff}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="eae1c86c17332a243e926ad630e99b3100515f03523ecfb4"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xff70}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="aff4b1adcab3c664079b05e44c661843"}]}, @NL80211_ATTR_REKEY_DATA={0xa0, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="7419fb0eed6a7c849d169c0f76396fac"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="543889d92b277391240f1da6e1d847808bf75b8b656a97df555447ccbff2cad4"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x40}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="458d11f0b92ab69246fe32e25b1d463e737848eb08e6b530f77211162b75da86"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="4a3fa2c6094cffe2da2ff6650849bd2a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="97f014c84969ac04f2d6b8b61c491a5adf52ef9e8fa452ff"}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x4000}, 0x1) getpeername$packet(r5, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmsg$can_bcm(r5, &(0x7f0000000480)={&(0x7f00000001c0)={0x1d, r8}, 0x10, &(0x7f0000000340)={&(0x7f0000000b40)=ANY=[@ANYBLOB="05000000000000001a59000000000000", @ANYRES64=0x0, @ANYRES8=r8, @ANYRESHEX, @ANYRES16=r5], 0x80}, 0x1, 0x0, 0x0, 0x20000011}, 0x81) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x8, 0x3, 0x2a8, 0x340, 0x11, 0x148, 0x0, 0x0, 0x440, 0x2a8, 0x2a8, 0x440, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0xc8, 0x110, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x2000000, 0x3, 0x7}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xd0, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x3}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x308) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) ioctl$sock_inet_SIOCSARP(r7, 0x8955, &(0x7f0000000a00)={{0x2, 0x4e24, @multicast1}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x48, {0x2, 0x4e22, @rand_addr=0x64010101}, 'bond_slave_1\x00'}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r9}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x1, 0x840, 0x0, {}, {0x77359400}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "ef1d62ee7e923b0ad9cda5b28dd4753620a2f0271768a8284c18a4e2b5e44dc77098b18fd964df81213608ec503db52d42f1a78c97322f4ae4c8dc89cf2b1440"}}, 0x80}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="0100"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}}, 0x0) 8.728144073s ago: executing program 0 (id=948): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) syz_open_dev$vbi(0x0, 0x0, 0x2) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4) (async) ioctl$SOUND_MIXER_READ_STEREODEVS(0xffffffffffffffff, 0x80044dfb, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'virt_wifi0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c0000001000030400000000fedbdf2500000400", @ANYRES32=0x0, @ANYBLOB="0003000000000000140012800c0001006d6163766c616e00040002", @ANYBLOB, @ANYRES32=r3, @ANYBLOB], 0x4c}, 0x1, 0x0, 0x0, 0x40084}, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x9, 0x8, 0x0, 0x3}, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000200), 0x0) (async) r4 = io_uring_setup(0x2ef1, &(0x7f0000000000)={0x0, 0x5712, 0x10000, 0x0, 0x1}) (async) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000003c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c000000030603000000000000000000050037f5670421a6967993000000190a32abb5a01593fd0000000500e93f07"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x8051) (async) r5 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r5, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev}}, 0x80, &(0x7f0000000140), 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b57000000860f5878c37ffe36e1165814d435be5b317c6c8189587d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988ab013f40afe403041323110f62055394412158e7a3adb148d641aa40d4ab077fe34232aa8b31851466d0998a61d7da0c86d70000001010"], 0x10b8}, 0xff00) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) (async) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) (async) r6 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) (async) close_range(r4, r5, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000300)=[@in={0x2, 0x3, @empty}]}, &(0x7f0000000080)=0x10) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/config', 0x0, 0x0) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x7, 0x0, 0x0, 0x0, 0x2}, 0x94) (async) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="280300002d00090027bd70000000000004000000130317"], 0x328}}, 0x84) lseek(r8, 0x0, 0x4) (async) fanotify_mark(0xffffffffffffffff, 0x0, 0x11, r8, &(0x7f0000000140)='./file0\x00') 7.192864397s ago: executing program 3 (id=955): socket$packet(0x11, 0x2, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x4f, 0x0) recvmmsg(r1, &(0x7f0000008600)=[{{&(0x7f0000000400)=@in={0x2, 0x0, @remote}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000140)=""/40, 0x28}, {&(0x7f0000000640)=""/186, 0xba}, {&(0x7f0000004300)=""/161, 0xa1}], 0x3, &(0x7f0000000480)=""/19, 0x13}, 0x40000000}, {{&(0x7f0000000540)=@l2tp6={0xa, 0x0, 0x0, @empty}, 0x80, &(0x7f0000000a80)=[{&(0x7f00000007c0)=""/113, 0x71}, {&(0x7f0000000fc0)=""/208, 0xd0}, {&(0x7f0000000940)=""/182, 0xb6}, {&(0x7f00000008c0)=""/25, 0x19}, {&(0x7f0000000a40)=""/13, 0xd}], 0x5, &(0x7f00000041c0)=""/69, 0x45}, 0x480}, {{&(0x7f0000000b40)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000000d80)=[{&(0x7f0000000bc0)=""/157, 0x9d}, {&(0x7f0000000c80)=""/210, 0xd2}], 0x2, &(0x7f0000000dc0)=""/147, 0x93}, 0x6}, {{&(0x7f0000000e80)=@nfc_llcp, 0x80, &(0x7f0000000f80)=[{&(0x7f0000000f00)=""/105, 0x69}], 0x1, &(0x7f0000008d00)=""/244, 0xf4}}, {{&(0x7f00000010c0)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000003240)=[{&(0x7f0000001140)=""/63, 0x3f}, {&(0x7f0000000a00)=""/10, 0xa}, {&(0x7f00000011c0)}, {&(0x7f0000001200)=""/4096, 0x1000}, {&(0x7f0000002200)}, {&(0x7f0000002240)=""/4096, 0x1000}], 0x6, &(0x7f0000000840)=""/119, 0x77}, 0xdfff}, {{&(0x7f0000003340)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast1}}, 0x80, &(0x7f0000004a80)=[{&(0x7f00000033c0)=""/116, 0x74}, {&(0x7f0000003440)=""/107, 0x6b}, {&(0x7f0000008e00)=""/4096, 0x1000}, {&(0x7f00000034c0)=""/224, 0xe0}, {&(0x7f0000004cc0)=""/204, 0xcc}, {&(0x7f0000004740)=""/140, 0x8c}, {&(0x7f0000004800)=""/145, 0x91}, {&(0x7f00000048c0)=""/255, 0xff}, {&(0x7f00000049c0)=""/162, 0xa2}], 0x9}, 0x8}, {{&(0x7f0000004b40)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f0000007ec0)=[{&(0x7f0000004bc0)=""/188, 0xbc}, {&(0x7f00000043c0)=""/201, 0xc9}, {&(0x7f00000036c0)=""/17, 0x11}, {&(0x7f0000004dc0)=""/41, 0x29}, {&(0x7f0000004e00)=""/4096, 0x1000}, {&(0x7f0000005e00)=""/4096, 0x1000}, {&(0x7f0000004240)=""/175, 0xaf}, {&(0x7f0000006ec0)=""/4096, 0x1000}], 0x8, &(0x7f0000007f40)=""/109, 0x6d}, 0x5}, {{&(0x7f0000000700)=@pptp={0x18, 0x2, {0x0, @local}}, 0x80, &(0x7f0000008080)=[{&(0x7f0000008040)=""/64, 0x40}], 0x1}, 0x9}, {{&(0x7f00000080c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, 0x80, &(0x7f0000008480)=[{&(0x7f0000008140)=""/148, 0x94}, {&(0x7f0000008200)=""/57, 0x39}, {&(0x7f0000008ac0)=""/203, 0xcb}, {&(0x7f0000008300)=""/214, 0xd6}, {&(0x7f0000008400)=""/98, 0x62}], 0x5, &(0x7f0000008500)=""/205, 0xcd}, 0xc0}], 0x9, 0x122, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r4, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000b00)={0x3c, r5, 0x400, 0x0, 0x0, {0x1d}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc014}, 0x400c190) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000088c0), r4) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000008900)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TESTMODE(r3, &(0x7f0000008a80)={&(0x7f0000008880), 0xc, &(0x7f0000008a40)={&(0x7f0000008940)={0xd8, r7, 0x1, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_TESTDATA={0x1d, 0x45, "447b56979a68d9ee1393c08068c8951c994439147f63ffc66b"}, @NL80211_ATTR_TESTDATA={0x2a, 0x45, "180b6ca1faecd3f7f5a72de7d35634cac72e100bed99ffec73de713f9aac16cd14831be34678"}, @NL80211_ATTR_TESTDATA={0x6e, 0x45, "0118c100305a9cf6ddf606c04f89d8918ba5493769925fb17d01ff39065c7a3467a460b8aea1f2f25205a8bc55f5645054a4e3715b41fb1f241f132ffa603932a122103a9eb9fce0c840ee30c0c4d6c0038b01646dc4c0a670891e87a1e286fa3a5e760a4197ff297da3"}]}, 0xd8}, 0x1, 0x0, 0x0, 0x4000}, 0x40000081) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000011c0)='./binderfs/custom1\x00', 0x800, 0x0) creat(&(0x7f0000000040)='./file0\x00', 0x4) r10 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x8400, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r10, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r10, &(0x7f0000006380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r10, &(0x7f0000000040)={0x50, 0x0, r11, {0x7, 0x1f}}, 0x50) syz_fuse_handle_req(r10, &(0x7f00000021c0)="d56cea33946c0eae3241d3604bfce89adddb2eb96960338db7572fa254eb7c69dc0cb526989630e26224c258c8d70ccacc5564d67723f4756c0399174c5460c4995942d24092c36dc820e97344798b5bb45423f853bf50e374323abacf0388cd091016b7a3d7843f4d3ae1658bd34d967e3323a64908442788dbc99c1f4248da53fb5be2c8001236b994ca594e3b3c588beaf3cb1c32c072d768b9e665e7d87044fdfc1fd6452593e6793963153f3850bf85042a5c139799ba8f6cb8d877fc436c4f1601270d6e29d60a4c80d6315e46f4219494ce897127d0b76f5d681e90f4e9282468ef7993cd92076aed266c1db8b81b93adc4969c9b89b32b8768c9f39f2d148e933dbb651746a9364f49986ef73b4c29f647b82b83216bb8179fe5346fdacdc5fda4bd48875cd2f1cf57a0c9a91e059446bac310a6d68948675c35a8e442168fd84d78d9800e5b05bdbce3a6eac65bee7279a3628f2a08931d3d52ce490652c20f8ae529eaf24bf421dad976c68b234ee6f6210c9f9aac3a55c6939d6aa3805b95619546264ff3ff82d0dc690e8ead61b6ed528c3c117cd771a3b7feb214ce8d720640d97f14b399b7f46dc4aad83117e8e642ccb117d13f345536fc3801c124cfaf8aa7aafff6c8df3fdd4469c077eccbd8ddacad80d9113dfde26ae67b226185743b2d53667fb3016fe114f87484ab614ddf0887c4b2c85351ab21a0ece6c066a154b38b4d7c1792d2db2cc5f8ceb42078187949d354b7a08d1529f3d10814757179c860db031dad4a3dc13ca01d1013238ed5f7a9674fcc77f0d34e2118fb851c970d86ecf9de1cfdb8d3ab197480e263c3207c3d7ebe17f9547c7c56b08e83de875294d0fd68df1926ecac24350b2c70bd73e14122ed480c564353d34049e67c26036fc35d04022cd35d6ac00756d3b8550bb22ae80a4bd630a00268d07fa249b0bf545dfbf01bea2f12b30738c6e13156244eb24e6d69ba7c3acdbbefe8bbc06b821aebf836ca07a3cc7b6b24686ed8f3b23085c893e72188b797651c5ab5cceb1465414a325f793a3af6d06eed7eb734ad05bc1f6619e8485259f570a482a67273ee01fe15dd938afce026f1111c7a38ed6d1aba34f009ce1e99140fd0db2de74150541fd48dd2ec5b1d15669de2ffe3a198184b6186ccda31aa64c585ff8cb65b67fe1455753895a88b6ab4c6bf1bb8329739178147e6f15801bfa707bd9ec9da662573ce07af684bb7c880a7d63b0a0a7300881408c44e95c679ea32b0eab845d0b333f245e8d6006258678704aa8cccdaf80cc46138d5b7a0804fdfa34c91d61a0d2fa6c62e7d1a675e5743f845ab40ea5df0182d6eb9781905c94751c75a411699a76f48433142c5f109d5dfddcc0b1dc6254efd5ea50d6ffbc7b9ca031e1a0123844b63c48b964645c6d24707582825e219bcd61677ed4fc45ee1f4be91b4c1b856d65a86acf22b8b0d588bc473248ac040326b1490c2fea24bc0c0a721e2ed63e39973cd4d38df1001dba9b9d995c229655dd26f3cd3d64077ec111e2c370717cb4cd068e0d3a52f1027d3df953e1f1ac768a7215a3695722b1b6714ce43801451a9532212b651d073c780d61712aebadd145c1cd95c1dc0dcf51850046ae5771e365f45858a36e48afe563ec0afee3803ff6a35bc25217b53eda39bb813b8d3d728c21a0b80d014003143666c0d1398cc46a01aaaf97117edda217f984010e7c5cf32535a669d4f11f6b70e3a3b823987ef7c9f878415063bf05205e13bcf7acb287bd0bb0fce77529a711f0ed145ea2ecf2194658dff17c5681cf8c7ad8521d235a705292af4878b3f124be2df661026c091d6c07aae1a74c919f7478d1083f70b3a0fe00c2e220ab998b4595268b6f7cabbfc85e59dfb6ab7a794cd3fd70d5cc4d70ca933a4452df5a345cb31f3267de53519ba39c915d492cd4652843f1d30a5fb311e3b5d868347969f013c5e3b4841b22240abcb61a14ff567186766ce8f6ae64877f672835dbff4fcf19c8230d8a402397630effb698a8b0c9a28ae028d7938ffde488fd64113085bce504cd0551e0eb3730c3f781cbecf0c41d2338766d3f6096661c1f1bec3162b8a0c4099fccd9480e821df8782c2e070530befb62bccd8539fe9dc7d8d3f9bded1bb34db3f2d6050885c8f1d57f5e603f629de7491f5fd9fafcceb565abeaec838b10a763a00a4607d4330bdcedc066d8cf9790d806e03c219866bb8f053a6e602645436d1f469df1d5008f5dcd4bdb7ce5b76ec015a8f4693cb2a63ceb2be00bcf221f0ca32db4efaf8f7022622b335fa8dea4afdd86be10be6c4d66e5f57416add4480509cb98cf31cdda84644eeb782eea041d4bc0e005a20bccc3c4a08cefcdb91cc2c61d9231c4e36e96f6edd2133f9b34e7da90ce20d1c60ff223c6a204bb942766a359b923573bbbaf2a827d79e4f649e79a840216ac4ddb3409c94e71ff08d109bc3f0cf6583219de7d7131a956f835ecf5c131a0b1e056a86d800a0204243f3b695029578c064306a31db53f28a8f0c0302486cd05970904e9b5c53100ac1aabb3110a89820e4d8307c3d46084999d0456c53fec61a9242b486eb41a90f3300fdfd0d8a472e8da7a842588721d1df1f5e4cc425efebc75a904ef4cc881346a4bc23eef4d492e3efccebab86ae4213f42671370579ee7f8341396e9515619e100a8fae2c5cba0139a088579ece7a603c8b8bab9998223fe862dff8480aeaa5970c90b894e5f71c2784e4dfd50ed3e9ed91036e8356c09464de13b4a95227203133b2c2c71cd6323492f083bda58ad7721b6666b9cd93f93f0288482813fd8aade02cca81cd35257e023504ac4f86be1c7a810b67c6d7077f5cdbd305b618a05c03d196894bfb1a6ff511e59ac8ce45d16cee95e1de0797a543728caaa43e5ae42a12b6bb7910d18d4e1ea89d264491287eb23a76095a12a39c46a7c85349e2969edaed3c1fa6a2150494f63f4c98c65fcdd650ac7424ac1ae64421294356ac1e4dbf9d4c817f081f4f7751ebf56788d799bac29dc0bfe83ead7ab3e338b8b84df4cad2b549aaac4e6048a6fa8f8f6f1f7e0e51c8b3c872f18c466e590222b03230f46bc8e9a0171bbd2096c7a480d6a6f29bd74b60105bebda42e59cc830c4b31f6c52687b4ec2ba869149ae363d711d099f94ceade1ada193e931ed9aea0a280ed5f25ad5ab3b4083f140ca17b43e5f6aef2c24a28a0262c80a040187e052ea7d54a528b6fcc176ed3afc07fe6a661d050fb4a3a6abfa3dac5f3230540b45af060781cb5499c2894d6a4a2bf908ddd48d6b34207f56c31229e206c88db3552ceb6e82a0fa2bf7f97baf603d37d6a8b1f2b1f5f95b251129ed05351681908b7cf5cf6cc86dd854174cc19713b4d262b021952b6da5f20f57bbacca62f5b7124409aa625bbea59819baebc1bc2dd188feba48c998d0dbed60d44b8a4f0ac28f6c1c8c9998f7406f1a34e4ce902be2420f7ff51a5ab3b1faa86ab2ec1edbea2493cae090abde43ff27d685c993dedb24eb255772cc56fbd104f4f5275f10d54d7cacb8cbf188ae1a4d29ea880068fb2696b3ba6e8a7c15939e1f7c394ab4bd4c4bef2383121cbeb18646a8e013d570cee3eeecd7fbe84a619f8aa2e34f2e1e9b99d0c7d7d179d9df8d2e2f1cd7ba2c7e60166dc14e5e4ed9c41195935e2884b5bd0057ed0155a5d4c6482e8f554e4cd0d0aef7d6487801ab54d54eb41755d833ab83883b40f47595063ad2a0fee5c661f86b8ab04ad0047d988ad86b3c520eb78dc3d750a57e777f5d766349f1a687e090f744206cb5d048346061b414060f6826d8a884e93f73f1f1f4cb8bd6e8d1215d436d390dbda35b555f550e11e6d8008fce1c429bd9bbd04a1fbb9de28663c1be4d8d7e506bc681ada28a69014b972919b5f70cbb770349324c9af0b7ee7ff4cc8bfe807fb9faa0a69498448b22192d578a1e82582b943051beb543ddca8b643ee6c76ee32278aa8bc92b44a8439a24ed5040545349ab05e831d4511a8da03ca539659585b2267a73775f1cb7c2c5548d3508c896f99a8e5cb55160ab1267e320ac2d7c8f8b57079dd14d301636a1374e24541f8d453978998ed256b381bcf638bb372ce1ebefb341656c02f4092a7667ffec5505e4938dcb03d404654430e244f9f7f7d0fb4189a93f7c2bd7a4fcb3ccff79e41a98adcac3e4c19eebebaec15bd8cea1df0e509cdef62ae10c66734d162caf35a6e511baa717f769c2e449892224fa8ae78de9138cf6ea1d939998a8cb68b0e83cf604e03b99634796d3d495e4617f8fdd9764631e7ed6eafa797deb1159259777bf2915d48b63286f6d6528ad4ca5783609263d9a03aad41ec8ef1e2e1e77734d27229f801192be238468854945c20dab4e1baff9dd593361efda1de95e04561d33cd73a45dff5f85b2e85b0747a49345ac8d38add8ef9c14685eb3d3432f3f994e3ddd4e45b16005870485253afc4f08d8a6d8023b722284d11d56c6ff9209a5bacb7ce1708244bd21878b8cd5c13ab453bd589f6196322de9faede39ce6f94c75d008d2d7ced27a2375cc62c3d5c15c1c4301a01299d8f4c41e5a44e4130e9555a356d6b19728c7d3c86cb9a1ddf906ab63a9447f8233bcd09bd74cf9749f085f0c4689ef40dbc41a7a299f0f891d9d0d3e39409d4d774da53bfb6e8ce668ce50885558e909add2cb9bda2f7e9232541b1a7f742a99740f486ef4f7c98e4052f2da705c56a18d5a8289ae6cbb9dc7de13a8cf420b7a930abaae813b40517d84ae984dfc94cd1021e0e4a7a9e7de841018d474083ca28a829ee03fe625cafcbedadcdef6621ccd679fcd9c9a9ab2136211f8c9a679895aa39facf2d6668e5098b3dd8e0ad78d8caf250dc38f2c9518bccb353ef3418d3906827514c1959d58344ee11a0ef1c1424495cc1a9910187685a47d6dd91f07e5081c5ac3f1b6e363069694dd9072684c5ab0ba56157c10f5fa8409e5bc43b38b31f24a306ca5f7e3de9a392eac1984e877ecb3dfd044f1449b4ae9b586051b1780c0ce462919f4a4b54ad8011d013c3962fc6697d33c2dc6771fec664c82cb16144619b207deb4391866d6c1976b945c5959d19018f15376ce3b05666747743527f22b54171da4dabee2f4e469a5521067de4f92e2bad02e15e812b6cbd27ec88a9eccf600ce7f5643392da9ff6b6412f8e7c68d8c8b9e0006e41777e2a1363a9556befbbb110dff3a84b179da3838acde0b25f53798733a9fb463d76b630aef7c8a43f6219482b34b893fd99cf3a013ecefde7c5c6528e304c1868ff3fd8dd5aba348a05dc950b1c4c281cbb28b800d6d0da180fdee06ec3bad6f97180295ed1d77078156a885b5b0c501ea563e8871adb97dd6052de0ab369bf2d98f434bb2d172d9967bb73d3eba6b52bb8d55d8963bf58d310afedb51c0f94c7814b6da30fd8056ab7be74ac31b1b75c217e3ab93eadcb2d253e5d8bbe47c0f1a411a9e502cf4301d898d905cd5db828e56a722394fa11cca64a03a42e7fc1b3481b71ca0b6a3d9bd1fc8229f7f9d3e6aa0d48051942579fb759201d4715db9a2d399e0745a66dbbd571accf1f2e15573ce832e91bd1f042ab758d9ec13e354f38454cc42668c8d60358916f7e937015f6c38732bcf6131ecde001892cb20fe47153e7e23b1cd2fc4a22662e7bde09f7df10fcbf475783fe23a0fdcb2c3bd8b28453ce523ac19ff77e68c3e9fa0193b796ea68f44132b3a96adebc04181e503f52be4778ef422ce3e6ca38514fa18b500ca518590479e8c73a7942dc2e237d82cda953ae1b296b97ee8ed62e2e755d6ddea7c0334e1b8d76c278bdc454724003106cb6fdc85340d1e784ac8b6551eaabc33c502163ce0d401627bd22ba6be90089372bfa3f91ee745e45844ef8dc0fe3936bef07f9c1d3aadfa4c8e99be6b038bed6beb9597add881da2acc1a3a471f500d68f639cd2bf6f4afab919a2cf747bcbb42b95684e8741b485c3297cf07c7bd98d6653421b61f701a06b82be0fbeecd32eb00feca9c5732bb5e565bccf8c9feb27a50760a785bbb50402768cbd458811e284a604b3374faf3480e1736743665617de9c32fd10e37105ac6dd5303f1a6dc78950bce56215c2a2f9e0ccbc0bf9fe8ccf7647ed29e2aa4948689d681a7a9fe582631338f3eea3df846f28564038ab75aa2a8ee5416b66ceeda9d8f56ecefe07f6a21ace83a2e15ad408d0a480f56708e3d1c96020b124c58f6ff5247f73aff7f77d389167650b8a0b98c97f87a1e5d6c08fa99874ff144bfa905e9da3812f010eeee00f3c9b594450faab5342e1b6e98fed5714a802b67b3e5b1964a62606aacb8222efd4980823f076675ae859e64de7b08f7a0b3d8bc829e1a93eb3b4975b4761cd7fa743e393da537c91f658ea2b23c94244498cdc4bc32c8b9859b9d9792eeabdce635b2d61c311949204826054dba0880505e2b53cc3521fa8b68bbba2ec05050bd3244c02752af1555625ddf50a3656c0043005c43c26a2dc907d5dd67efa831ad974151067b436a75fe99b8c94c9ca9737279fa1aaa09b0108c48c79c7e4ec1eeccfd43aa8e7ab6cacf5a956fc47d4ce77fe719d6eec1730d3e3b3be71d313f644177b6d16df0180848c28b850fbf71168a1ee4e5639bc46f2555b3984dbb91520538dfa6a1905abfb7238ff344d0a7d760f040718a57cfb56634e7de7584097f69f87630693bcf410796266cc3f50302feacfb556bad2506b7191023817527dfe5973101712bda922472076633133a11a76e8bc7d763a2cdaa53fa8d47d442fcc572f791d66d10d8d6a9058ecbbcd6d3dbe45d67b75e1091dd0368bea33ef0f56ba68885630429c24800922062e1066f2d4c4b795332ab03239548df4e6e01c432fe5eb29e8e63f6c7ba4f2edefa208c69e781786e4717c2f71dc2032a98cf1e6d66c10831e17ee776edc6b060ae20d025dc570a88e17da771acd32b7b93d46e43a917b8e2ba8232ad2707324b9b04dd8ee50c3c5a4372c0b1461ab2b7424faf00c7162bd8e8ffc7fadcb055403b0fa7087226ba4330e746af97a3f915f0b9e105759e81fe94a0df0cd6c324fb0b871491b5516c2fbc82c77b07159e3f4c0b7952b74cb4e203a69f241485191e1afc76d12a56db065b0513a41582f655340603c73cb39b728c97d1e919ecf963b91ec2282d25dc426db873394055beb0f9ba20545e2465ce2d0d962f42e1e4c79bdea4cd2829269ff7ef650bbeb5083d39dc7aad668af0b01c521192c548857473b29991f7bb917b5814fe945f4c3ed9bbe0563f4004b391b76860e9fd6b7c0baae82e4ac033f62a2c6ce6a2311b8700b06b5215e604a9b99d37e00450fc7790e893176e9fecda220f838a078a8ef7da7d499b1fe0eb8780c4b9705a6a10674e61b5c228fae1c13488f98c10c1792fa40229dba44b1cb534f9fab6a14407687761d738c91f4b8d4371a1de1a47bde0563a6fc88c4886be5d48c4cb89078c255eb1639598379daf50a672cbf4d8add2d4af6c02aeb1d0f86b611abd363409c7c7fc0b66f307ad3df24241fe06d0f7617d6c3987bb9e5d8f1712aebf095fad19b3b4fcb9cc4fb39012f333c4b040666259ee7bc43cff299a527a8914d71324e91c774b84e9392e615453e9fc648c539059b66f780c888892fe8b30eba799ed18fab08ebc3b9da8bc12a249456351bc0ebafc9f54d5d24697fb53eeb5e734527d690620989f605f57dc65a15a754d304be592acc616cd528b6986064b4457b96cf1fb0ab383a0585acf9887b18e1d6d3aff1e7f2328ea0313a2b36f6f79d671d9ddc4d34fb8fb55a596b2a16c63757083fb4bd01be2e1d82e47c5a44e052279097c5a18feae9884e102cf087611a3b94467ad61635dae6275974f6e6ca7a42ded0ee4577574d56b142853a8c955d92d1eb780de11dc9289acd193214ed4c9f5f26d0481cb3c0c0b8d4c9ad929c61ffeed66bf2e4f7018049593b99358d93559847d55654cee93da30f6578d2e295909791d227a12c09cd4a0edec25d3155086b64a787997a53265cbffb7fe6a2bfd589e12b4d0e21a600276e920397888443584aa99a06d7cfef8e68eeab8fa739c3d8fb74581ceff295110742e763320bed3a4be982b3ebed15ecde37e849aaa91959327d25149f38854ea1137f870aff99979e5e74cc9e45be12e3f0f9912a0955e718a4917e835bca50f43ce92a6bc60ed006b8f623fbacebbfb3dcb4fabd9941a5487c6f637de9a2005a6bc4062e1210a08a51d6f8a5e3f6f97fe90dc7e2e21d4d2f038c0fbc1918aa00e230a4a0e5c41a4808fb9a731271fcc1e73713c9592aa4b2ddccd0d13c3cb68d51166623153445c9ec955c6870dc8543c0684883186082e34ea5714febf8b46921015c3623220d17529896e1a6edac6e32fea2ba30db203238300353602c17dddad7608cad8170b520f6d9d32cdf0156a1de4e9b9eea78f73255ddc6da6994a6018ff900d9886590602ca6a072d8aa5645e2adac0744e2d5b2e1038c746635d5814692c3498aa9043b68f8ce79c44678c5a7d5bc26c085475853b229b2af3dc822ec58047f313c778aae2b64995148174e42908f3ecacd3921855790c0c5a25814416930293010b4f917979d837f4ef9d2d6dce804f5c0926244097746252124a6e0055559ffab197c38778f717362152af8f6dbf7ee03df050ab9b8909556691c2c2775f0f9c26a545db7ba698a4ce37de877705ea97ac0a002db274ea8360a4aa732c2d5e7417138c60cbea69d3b4993ada6a9d8f51d851543a6500a31bac5a057dbef498001f08a44e3c4141900e18b6d73c28c8c67dca805edeb5376384cefe75be1f127225e4d9724b7047d68fa2ed4629e91711a37c80158a07dbce78918931402b472a98a5d5c6b66a2d116314577e94298c37bc441499a9ecea132d87c5d305a0f8f0b3ed16f3b820941082c73b28391d8482ca0cfa78e1e09aa588b0eb1849c6c7916a6bbe56134a6bd93ea306dec125982628dea1db6d022d210627959e1dc819c841f173ed25f356909222e481a1ebb31185fbaeacbd359d2779efe4554ccdac7f4bcc528f656a45049331e16e9c0c796423ec9c7cba15c69d4a8a7741699910f33cc9798a8bf1e48182f08029a14d0131654fd388225d7509e1d7a484e9c7df34d1680bfc6b8d1f6f3920cc4113509fe42dfbd6b261000da9651f7e18088f6c2564472046e5eb7e8c9f8b5286a7452741a7103ced710bfb8e699fb8b1a85c0ae887cc06ef2ff9e2a2b1a77bb4d44ddd4a4e1ba60afcb92baaef108b60486d409889cbb2b1cc77ddff7e4b6caf8cf3488764d84bf3605eb9df709ac6cb36d1a3de89cdd6657f0e6b4009e6dac5d9be14f4ed997cf61e5aaec932520c321359cf286adf6e2dc3094794ae61a4f16089d06e3dc62c958950e73213c1e865c894fe7b8a30de65f5534a1e9c5d19ed49397980126322cb9c72c46a86d7487571300d85b3b5661555f20ab63a78f846c1b8f51a19610a11ffee44f7ccf0f1d67f4148b2c828d74c7f3993965c9067114467a71d242113a68574e28601fce343a023ecc68a72d75259f9a5dce144a7f61ef327192f6474d2bbd06fde3049fe7fb306ba3f54337008d7dbdeaf28a37a224e38ade23adb076cefd3148efcb62539a96d4dfc53f369e34c3d493ac3a5e8c8881133be630a2a906703da62ce7cc02ace9f666d6c3d4b9763a83548825ee1efb54ee3475b09e2616c5bdde3d193181bf020e8ac9ac25f32604b6c11de8ad1a15b9f908c6d7e79181aad1d741b7434aa92597a835c53b9e4b61d6069fa4ee921824d17c98784a8c04590f8d2cf877662b410cae4ebd1ba3616074c020d8cb6099a095735635490d318821310ddd016150edb80370b8d4e2f05557fd619b17192c13353cdae76d495821c610c8641e5b3dff1e7f2ea77b17810ca7975b8e36b7f501a8710b326ef92672096ef66598510902fe663e2a9ef00c3a052f1cfb1739fccb4371f8f28bb92654de5bf87cc2863e92e6d7e4b45d773f90f434eafc8f8398a48527af829a6cae359e7af5941bef158f53798058351107ce58f79ed21036770f6e10e7da92bbca25f369ee83a0f894bbf366a1361f8125b4ffd8e8b4d47ec68cd6b37c840cc5beb8cf65b2269ea1a0e9c371a571f30458ff8ad9bbf8723c19ddae1de5ca7461a436ffcd103c01a20f3252ba0965ee928cfb0d002b9aa4d4f20c805b77e67c8d991c4d07e5419bec9626a32c115d28253dd5f16c17182c1779edf49bdfe3823d87fec88929801163a27bfaeddfd8cdccae8cc3bfd6a9f2e2fec5971fa560c434debd434ff4d0058dcb05d9f3ac5193c458472d6d1685f9f46c8864900c5edbaeeee08971ee1c087f2e11467ff4766743bccf9e3414feedd6dcb904b92a05eec5de8db95444b920c995c770edcedcf7bffc48836c8f30037dde47f0e66fd79550de0ebc3c0c3eba0b66e2a353542eeb20397800e5f41635c5ec2f9a271461bcee8e570ddf945b186f15ab5cabe2a3123189935c6b9010b31732c425a9b2582b097486a5a7b1880b2f16104484e1ca83fa9c278b87e30e4b0cf6ed66c87a979c05683ac94a295d1c53e6f0975a079dd9a2825fdd6ae0926ba1a69f3f69f408eea9d00fbd43235a52c53d11963a611b81dd9f5e05582e1822398873e883662a64c225be19e0b85e102e23fb73d5dcb11435a5437d7418b0409f2e60793038f55ed54c79882b3a17e74ae2148bd558d131dbf446edeb0d05353492534e216761cfcf6582d066a8235a2bd5eb383350a52d7fc2761514e27b6125cb3e387c103dd62e31f5b789c217811c80ccbe3f10fec7a19ad32dc9271368b6d6ba549c45dfd8018507c40962b6ac6468c3078edb71d8ec7f728be8cc23dea1139ac30c2e8d0fc077280e420fbbffc896863db5f1e76922d7dd8e4479c1be822e74212c6f74765e108f916a1b83f6efc8ea54080e9a28b1ba5813a1fefddbe2d0cda413ee1463985b51b59f818f440c9b6a10e4ebf71d37995ae9694ba5867ca2eb2f7bf4e58d26149f2b25943fba216beb3de1f954bcf1bd32ce358b5d23023ab456ebbc493ead41e25b62b5b4ace6c5c18c9a8d512a9cbb4dd59f33663f6138d6b06bc8eb1ec9caccc0077b2e68e7a09d412dfa352e7e5c3942b710ab1648e16d0adda424d9fc2d15c619f4e8093c2b9521e4cdb3f22e655f52ce0fcc1bfd94e56cba8decadb68214451be53f9286c82d2a4912bd2394d1133be908409d791d6d8c2194ca37a76a38d6d0a1fced6478848891d9264cfc08fa849d720339ce00977cad8d9738372184098a7333dd1564d1d7754b4aa4afd6217585804159d31f53017869cb78b718c837b7fd176ce19e3d6996b6f055ed3ba7cd55b0349676c0c113c33d070081ce4ef29af156c4ac8ce760013688d0295d90271e23ef3ca10ec2b3b889855a153c867ce79297a10a02d21e5e8995fbc10d2f4d4bf521565376053b80937bfafaac688108f9962b7c72cf0111874ac8ae27d024ee2f9d57f15b9910a7486ef7542c6629fb0520c93a445542d", 0x2000, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r12 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xa4c81, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000008840)) write$FUSE_NOTIFY_DELETE(r12, 0x0, 0x33) dup3(r12, r10, 0x0) r13 = getpid() ioctl$BINDER_GET_FROZEN_INFO(r9, 0xc00c620f, &(0x7f0000002200)={r13}) bind$alg(r6, &(0x7f00000005c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) r14 = accept4(r6, 0x0, 0x0, 0x800) recvmmsg$unix(r14, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) syz_usb_connect$uac1(0x0, 0x87, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000086b1d01014000010203010902750003010300000904000000010100000a24010000000201020c2402000000001000000000090401000001020000ef3001010101020000090501090000000000072501000000000904020000010200000904020101010200000a240201000000000f3f0905820900040b017107250102400400"], &(0x7f00000004c0)={0xa, &(0x7f0000000000)={0xa}, 0xbf, &(0x7f0000000180)={0x5, 0xf, 0xbf, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x0, "10123ee0edf71955ca288abaf2b151f3"}, @generic={0xa6, 0x10, 0x0, "c68f076287737e3601cd9076313000b57a84d31489e6c7316e5f57bd1a8b9e032bedddb73216ba827d25965448f106245f5fdc59659a58a65dc1022fa78d764611f5a059d74f48c694147fed9c2e18d0130c1df7740e453ea7d74b392e7f35e7dfd7d159e9ed48348dd1a7dc45b82c65543fd4d12192bbbff5b61ca60b37050bedc1c528d2efc351da341ada6f0e901a46bc6585431cbda419bfbc49f6e1e0a9566870"}]}, 0x6, [{0x4, &(0x7f0000000240)=@lang_id={0x4}}, {0x16, &(0x7f0000000280)=@string={0x16, 0x3, "f50cbb4ff4ea190a2f02a8fe7925c8df9b6c4ba0"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4}}, {0x4, &(0x7f0000000040)=@lang_id={0x4}}, {0x6d, &(0x7f0000000340)=ANY=[@ANYBLOB="6d03f5e0c2ea3bfb4a90eef6005e4dd437b85aa63cee0450baa685175139621b8a8cd5ebd2064681472342ca1d8c1c01c744c91d4cc7acea104a3f17a1cb6fdd5949f12b083e4f83af0cb515a4b680f69cd100f72ffb978ba266b6c71f6ff25b00e0ea67f752f4f654cfaa6ab8"]}, {0xffffff66, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x412}}]}) 6.78456369s ago: executing program 0 (id=957): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) futex(&(0x7f0000000140)=0x1, 0x6, 0x0, &(0x7f0000000340), 0x0, 0x2) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmsg$alg(r4, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r4) syz_emit_ethernet(0x72, &(0x7f00000002c0)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaabb86dd60004000003c3c01207fdd25ef0000000000000040000000ff0200000000000000000000000000010004000000000000c91000000000000000000000000000000001"], 0x0) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/fs/binfmt_misc/syz3\x00', 0x2, 0x0) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) syz_usb_control_io$hid(r6, 0x0, &(0x7f0000000580)={0x2c, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r6, 0x0, &(0x7f00000008c0)={0x90, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000080)="1858b036410f017d0048b8dc4b13b61e0b813a0f23d80f21f835c00000a00f23f8660f2263c4c17c773666420f3a428ce80c00000000fa3e3e6767450f01cf6536460f01f8c422d1b7900000c0fe", 0x4e}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x8002) ioctl$KVM_RUN(r5, 0xae80, 0x0) 6.207005384s ago: executing program 2 (id=962): syz_emit_ethernet(0x4e, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x1, 0x81, 0xc}}}}]}, 0x44}}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000580)=@gettaction={0xf4, 0x32, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x30, 0x1, [{0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xe}}, {0x10, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x14, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xd}}, {0x10, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x7}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xba}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_gd=@TCA_ACT_TAB={0x3c, 0x1, [{0x10, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0x10, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}]}, 0xf4}, 0x1, 0x0, 0x0, 0x55}, 0x4000) r4 = syz_genetlink_get_family_id$smc(&(0x7f00000000c0), r1) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="00000080", @ANYRES16=r4, @ANYBLOB="02002dbd7000fedbdf25010000000900030073797a3100000000"], 0x20}, 0x1, 0x0, 0x0, 0x20008880}, 0x20040000) r5 = dup(r0) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r6, 0xaf01, 0x0) r7 = eventfd2(0x1, 0x1) ioctl$VHOST_SET_VRING_ERR(r6, 0x4008af22, &(0x7f00000001c0)={0x0, r7}) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) r8 = syz_io_uring_setup(0x235, &(0x7f0000000500)={0x0, 0x4733, 0x10100, 0x0, 0x24d, 0x0, r5}, &(0x7f00000001c0)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x1200}, 0x1}) r11 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCGISO7816(r11, 0x80285442, 0x0) io_uring_enter(r8, 0x234f, 0xb1e6, 0x1, 0x0, 0x0) r12 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$tipc(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) bind$tipc(0xffffffffffffffff, 0x0, 0x0) bind$inet6(r12, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r12, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$sock(r12, &(0x7f0000000300)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)='(', 0x1}], 0x1}}], 0x1, 0x40000) 5.909914877s ago: executing program 4 (id=964): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000140)=@sack_info={0x0, 0xffffffa1, 0x2}, 0xc) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={r4, 0xf}, &(0x7f0000000240)=0x8) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r5 = syz_io_uring_setup(0x239, &(0x7f00000000c0)={0x0, 0x1ffffe, 0x10100, 0x0, 0xfffffffd, 0x0, r1}, &(0x7f0000000080)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x230}}) io_uring_enter(r5, 0x2ded, 0x4000, 0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x81c0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x1, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r8, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r9 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r9, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r10 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r11 = dup(r10) write$6lowpan_enable(r11, &(0x7f0000000000)='0', 0xfffffd2c) r12 = syz_io_uring_setup(0x235, &(0x7f0000000380)={0x0, 0x1ffffe, 0x4000, 0x1, 0x4, 0x0, r11}, 0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(0x0, r13, 0x0) r14 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r14, 0x29, 0x40, &(0x7f00000007c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x740, 0x120, 0x2f8, 0x440, 0x510, 0x2f8, 0x670, 0x670, 0x670, 0x670, 0x670, 0x6, 0x0, {[{{@ipv6={@private2, @loopback, [0xff000000, 0xffffffff, 0xffffff00, 0xff000000], [0xff000000, 0xffffff00, 0x0, 0xffffff00], 'vlan1\x00', 'veth1_virt_wifi\x00', {0xff}, {0xff}, 0x0, 0x3, 0x3, 0x14}, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x2}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x6, 0x7}}}, {{@ipv6={@remote, @local, [0x0, 0xffffffff], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11, 0x0, 0x0, 0x4}, 0x0, 0x198, 0x1d8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@unspec=@conntrack3={{0xc8}, {{@ipv6=@remote, [], @ipv6=@private1, [0xffffffff, 0xff000000, 0xffffffff], @ipv4=@multicast2, [0x0, 0xffffffff, 0xffffffff, 0xffffffff], @ipv4=@empty, [0x0, 0x0, 0xff000000, 0xff], 0x0, 0x0, 0x42, 0x4e22, 0x4e24, 0x4e20, 0x4e24, 0x0, 0x23ccf3e9fd2b5143}, 0x0, 0x80, 0x0, 0x4e20, 0x4e24, 0x4e23}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0x100, 0x148, 0x0, {}, [@common=@unspec=@connmark={{0x30}}, @common=@inet=@socket1={{0x28}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@empty, @ipv6=@private2, 0x0, 0xfe}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0xc}}}, {{@uncond, 0x0, 0x118, 0x160, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@dst={{0x48}, {0x0, 0x0, 0x0, [0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x2]}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@dev, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7a0) prctl$PR_SET_NAME(0xf, &(0x7f0000000240)='\xf4\xaa\\k[sC\xae\xd6\x98\x9bY\nI}\xd8\xcc9K\xd7Z+\\\xf8\xdb\x84\xee\xa9\f>\xe4\x81\x88\x90_\xd4\r\xb83\x9e\x13B3\xfe\xcf\xccm\xfdO2\xd7\xa0DD4\x1b*\xdd\xb6\xcf\xacr\xabF\f\xb5\x11Vkp\"\xb1\xa8\xf0\x8d\x00\x18}3utO\x1bQ0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r9, 0xc06864a1, &(0x7f0000000600)={0x0, 0x0, r10}) ioctl$DRM_IOCTL_MODE_CURSOR2(r8, 0xc02464bb, &(0x7f0000000180)={0x1, r10, 0xfffffffe, 0x1, 0xffffffff, 0x1, 0x40, 0x1, 0x1b}) pselect6(0x40, &(0x7f0000000000)={0x1b, 0xff, 0x726, 0x8000000000000001, 0x205, 0x100001, 0x2, 0xd}, 0x0, &(0x7f0000000080)={0x7, 0x7, 0x3, 0x8, 0x1, 0x8000000000000000, 0x0, 0x5}, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={[0x8000000000000001]}, 0x8}) 4.260675258s ago: executing program 1 (id=974): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x8000000000000760, 0xa382) r2 = memfd_create(&(0x7f0000000400)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaA\x061qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0}) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000002840)=ANY=[@ANYBLOB="500000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800b0001006d616373656300001800028005000900010000000c000100000000000000000008000500", @ANYRES32=r5], 0x50}}, 0x800) r6 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_buf(r6, 0x29, 0x45, 0x0, &(0x7f0000000080)) sendfile(r1, r1, 0x0, 0x24002de8) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r7, 0x6, 0x21, &(0x7f0000000040)="024ba05135fae8fa3436554e0f8ff126", 0x10) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x40000004, 0x0, 0x1, 0x18, "28f5c9ea1f1ae4be4111ab18d2da69bde58cd7af40fd150b70aac11c2e16bd5bba7663c435aff94793ddd7aae07ef35f17bf01933bdb6fd7ecdd91b59ca8d541", "07a9310978042a8bfe1406584a128d7469166f4f07b84819e7df4af14e1df82d", [0x6, 0x7]}) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) close(0x3) r9 = socket(0x2b, 0x80801, 0x1) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r9) sendmsg$IPVS_CMD_GET_DEST(r9, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r10, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x10001}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000080}, 0x200400d0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f00000015c0)=@mangle={'mangle\x00', 0x10, 0x6, 0x5b8, 0x228, 0x2f8, 0xf0, 0x2f8, 0x418, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0, 0x0, {0x7a00000000000000}}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@remote, 'hsr0\x00', {0xfffffffffffff800}}}}, {{@ipv6={@dev, @private1={0xfc, 0x1, '\x00', 0x1}, [0x0, 0x0, 0xff000000], [0x0, 0x0, 0xff000000], 'pim6reg\x00', 'geneve1\x00', {}, {0xff}}, 0x0, 0x110, 0x138, 0x0, {}, [@common=@unspec=@physdev={{0x68}, {'rose0\x00', {0xff}, 'veth0_macvtap\x00', {}, 0x1, 0xc}}]}, @HL={0x28, 'HL\x00', 0x0, {0x2}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x33}, @private2={0xfc, 0x2, '\x00', 0x1}, [0x7f8000ff, 0xffffff00, 0xffffff00], [0xffffff00, 0xffffff00, 0xff000000, 0xffff00], 'wlan1\x00', 'macvtap0\x00', {}, {0xff}, 0x88, 0xb, 0x1, 0x4}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @local}, @private2={0xfc, 0x2, '\x00', 0x1}, [0xffffffff, 0xffffff00, 0xffffff00, 0xff], [0xff, 0xff000000, 0xffffff00], 'veth1_to_batadv\x00', 'geneve0\x00', {}, {}, 0x3b, 0xe, 0x6, 0x58}, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x10}}, @common=@ipv6header={{0x28}, {0x31, 0x33}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x3, 0x9}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x618) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x80042, 0x0) pwritev(r0, &(0x7f0000000040)=[{&(0x7f00000003c0)="42e8", 0x2}, {0x0}], 0x2, 0x0, 0x1e0) r11 = syz_open_dev$loop(&(0x7f0000003100), 0x7ff, 0x2) ioctl$LOOP_SET_STATUS(r11, 0x4c02, &(0x7f00000031c0)={0x0, {}, 0x0, {}, 0xfffffffb, 0x5, 0x5, 0xc, "4ca4f6daab7b5ff723f40077da819c51b78030051dcd312a341c73e5011a6b3642628601ab5ac67e501b4fb3b2e8a0d38dee12703063c74a115b77e1bc69a689", "5f0ed1a45df3cf70490e6aadcc6a0207c7393d7212e283da3715b785579b1612", [0x507, 0x4]}) 4.259451196s ago: executing program 2 (id=975): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000080)={&(0x7f0000000040)=[{0xa75d, 0x3000, 0x0, 0x0}], 0x1}) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r2, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10022, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'gre0\x00', 0x0}) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x842, 0x0) write$FUSE_STATFS(r5, &(0x7f0000000200)={0x60, 0x0, 0x0, {{0x9, 0x5, 0x5, 0x2, 0x400069a, 0xae, 0x2400000, 0x800}}}, 0xfffffec2) r6 = open(&(0x7f0000000140)='./file0\x00', 0x2, 0x0) ppoll(&(0x7f00000002c0)=[{r6, 0xc}, {r5, 0x1004}], 0x2, 0x0, 0x0, 0x0) read$FUSE(r6, &(0x7f0000000d00)={0x2020}, 0xfffffead) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000140)=0x8, 0x4) sendto$packet(r3, &(0x7f0000000340)="05030006e8fe091c6202a0ffffffff006003000000007f141434e3177f43055762cb80948864113b022543424aa608", 0xfef2, 0x0, &(0x7f0000000a80)={0x11, 0x88a8, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff}, 0x80) read$watch_queue(r7, &(0x7f0000000380)=""/200, 0xc8) recvmmsg(r3, &(0x7f0000006200)=[{{&(0x7f0000000040)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000000900)=[{&(0x7f00000004c0)=""/211, 0xd3}, {&(0x7f0000000180)=""/167, 0xa7}, {&(0x7f00000005c0)=""/234, 0xea}, {&(0x7f00000000c0)=""/40, 0x28}, {&(0x7f0000000ac0)=""/4096, 0x1000}, {&(0x7f00000006c0)=""/141, 0x8d}, {&(0x7f0000001ac0)=""/4096, 0x1000}, {&(0x7f0000000280)=""/16, 0x10}, {&(0x7f0000000780)=""/182, 0xb6}, {&(0x7f0000000840)=""/141, 0x8d}], 0xa}, 0x7}, {{&(0x7f00000009c0)=@can, 0x80, &(0x7f0000003cc0)=[{&(0x7f0000002ac0)=""/80, 0x50}, {&(0x7f0000002b40)=""/249, 0xf9}, {&(0x7f0000002c40)=""/87, 0x57}, {&(0x7f00000002c0)=""/53, 0x35}, {&(0x7f0000002cc0)=""/4096, 0x1000}, {&(0x7f0000000a40)=""/27, 0x1b}], 0x6, &(0x7f0000003d40)=""/67, 0x43}, 0x7}, {{&(0x7f0000003dc0)=@hci, 0x80, &(0x7f0000003f00)=[{&(0x7f0000003e40)=""/74, 0x4a}, {&(0x7f0000003ec0)=""/1, 0x1}], 0x2}, 0x1000}, {{0x0, 0x0, &(0x7f0000003f40), 0x0, &(0x7f0000003f80)=""/61, 0x3d}}, {{&(0x7f0000003fc0)=@nfc, 0x80, &(0x7f00000051c0)=[{&(0x7f0000004040)=""/112, 0x70}, {&(0x7f00000040c0)=""/29, 0x1d}, {&(0x7f0000004100)=""/4096, 0x1000}, {&(0x7f0000005100)=""/142, 0x8e}], 0x4, &(0x7f0000005200)=""/4096, 0x1000}, 0x7}], 0x5, 0x40002123, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) r9 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r9, 0x8922, &(0x7f0000000b00)={'hsr0\x00', 0x9}) sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000140)="2e00000011008188040f80ec59acbc0413a181003100000001090000000000000e000a000f00e4ff2f8002002d1f", 0x2e}], 0x1}, 0x4000) r10 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r10, 0x0, 0x12, &(0x7f0000000300)=0x1, 0x4) 4.000597351s ago: executing program 3 (id=976): r0 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0xffffffffffffffff) fcntl$setsig(r1, 0xa, 0x12) ppoll(&(0x7f0000000100)=[{r1}], 0x1, 0x0, &(0x7f0000000080)={[0xc]}, 0x8) clock_getres(0x41, 0x0) r3 = dup2(r1, r2) ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7}}, './file0\x00'}) r4 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x5b23, 0x0) poll(&(0x7f0000000200)=[{r5, 0x8110}], 0x1, 0x7f) fcntl$setown(r2, 0x8, r0) tkill(r0, 0x13) 3.990410337s ago: executing program 4 (id=977): syz_emit_ethernet(0x4e, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x1, 0x81, 0xc}}}}]}, 0x44}}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000580)=@gettaction={0xf4, 0x32, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x30, 0x1, [{0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xe}}, {0x10, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x14, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xd}}, {0x10, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x7}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xba}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_gd=@TCA_ACT_TAB={0x3c, 0x1, [{0x10, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0x10, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}]}, 0xf4}, 0x1, 0x0, 0x0, 0x55}, 0x4000) r4 = syz_genetlink_get_family_id$smc(&(0x7f00000000c0), r1) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="00000080", @ANYRES16=r4, @ANYBLOB="02002dbd7000fedbdf25010000000900030073797a3100000000"], 0x20}, 0x1, 0x0, 0x0, 0x20008880}, 0x20040000) r5 = dup(r0) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r6, 0xaf01, 0x0) r7 = eventfd2(0x1, 0x1) ioctl$VHOST_SET_VRING_ERR(r6, 0x4008af22, &(0x7f00000001c0)={0x0, r7}) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) r8 = syz_io_uring_setup(0x235, &(0x7f0000000500)={0x0, 0x4733, 0x10100, 0x0, 0x24d, 0x0, r5}, &(0x7f00000001c0)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x1200}, 0x1}) r11 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCGISO7816(r11, 0x80285442, 0x0) io_uring_enter(r8, 0x234f, 0xb1e6, 0x1, 0x0, 0x0) r12 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$tipc(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) bind$tipc(0xffffffffffffffff, 0x0, 0x0) bind$inet6(r12, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r12, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$sock(r12, &(0x7f0000000300)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)='(', 0x1}], 0x1}}], 0x1, 0x40000) 3.981545259s ago: executing program 1 (id=978): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000001280)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) mkdir(0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(0xffffffffffffffff, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r3, r2, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(0xffffffffffffffff, 0x3b89, &(0x7f0000000200)={0x28, 0x1, r3, r2, 0x0, 0x0, 0xdead, 0x4}) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, 0x0, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x16) preadv(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/4066, 0xfe2}, {&(0x7f0000001380)=""/192, 0xc0}, {&(0x7f0000000040)=""/15, 0xf}], 0x3, 0x2c0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x2, 0x2, 0x0, 0x9, 0x2}, 0x10}, 0x1, 0x7}, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r5, 0x84, 0x1a, &(0x7f0000000100)={r7}, &(0x7f0000000180)=0x8) 2.89823839s ago: executing program 4 (id=979): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000100001000000fffffff0000000fc000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001c08000640ffffff000800034000000028580000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000002c0003802800008008000340000000021c00028018000280080001"], 0xec}}, 0x0) 2.724738974s ago: executing program 4 (id=980): syz_emit_ethernet(0xfdef, &(0x7f0000000140)={@random="5b1a033f2511", @remote, @void, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x0, 0x4578, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x64, 0x0, @wg=@response={0x10, 0x0, 0x0, "fdcdae25a7a296872a8a5290e48e30acf8afc7e67d70a62c979cefa10a0028bd", "ae0000000000000000e4000000000040", {"35f3c07eeca4a20a9858ac1500", "63081fe8fe001a08ed082ad7121d696f"}}}}}}}, 0x0) 2.615468012s ago: executing program 4 (id=981): add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) socket$kcm(0x21, 0x2, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)=@newtaction={0x198, 0x30, 0x100, 0x0, 0x0, {}, [{0x184, 0x1, [@m_gact={0xd0, 0x18, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x21a4, 0x7}}]}, {0x96, 0x6, "fbd4a0064f0c4457cf621b0f6279eebfd4e0a15047c4f09b1d2ffbbfa86a4832ee95945fce7f25821c0c196cc4cd427c7f183af7eb59b7cab7df30800ff789a6125fa2f270ab9260d55a826f7c2646d5028398c01263f9253398344415309d12420af5ee504878808e2359c64404fb14157ee7dc3011e387c91d2f3a380db7b8092c2a7b3176bf64dbb31fca709116e9d2f8"}, {0xc, 0x7, {0x1, 0x7226e92f9a3b96b2}}, {0xc, 0x8, {0x2}}}}, @m_bpf={0xb0, 0x19, 0x0, 0x0, {{0x8}, {0x68, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS={0x4c, 0x4, [{0x2095, 0x9, 0x6, 0x3}, {0x1, 0x3, 0x9, 0x1}, {0x8, 0x9, 0x3, 0x1a2}, {0x4, 0x3, 0x9, 0x8000004}, {0x7, 0x2, 0x6, 0x6}, {0x8, 0x81, 0x7, 0x9}, {0xd09, 0x9, 0x0, 0x8}, {0x7, 0x4, 0x1, 0xc}, {0x5, 0x5, 0x0, 0xc9}]}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x7, 0x1ff, 0x20000000, 0x2b}}]}, {0x23, 0x6, "ff946eacfee2d520c3f6f487fb8864be623c00"/31}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x4}}}}]}]}, 0x198}, 0x1, 0x0, 0x0, 0x844}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0xfffffffc, @mcast2, 0x2}, 0x1c) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0042, 0x0) write$tcp_mem(r4, &(0x7f0000000280)={0x11, 0x2d, 0x0, 0x3a, 0xfffffffffffffffe, 0x2c}, 0x48) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0), 0x2, 0x1) getsockopt$inet6_tcp_buf(r4, 0x6, 0xd, 0x0, &(0x7f0000000280)) close(0xffffffffffffffff) execve(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000500)={[&(0x7f0000000000)='.+-:\x00', &(0x7f0000000540)=' T\xfc\x81\x8e\x9f5\x0e \x043[B\xad\x13\x9f\xae\x8f\xbb\x9a\x0f\x9f\x13\xa5\xfc9\xbb\xa4.\xf4\xeb\x03\xf1\xb6\x8c\xc4E\x93\n&k\xec\xc8\\h\xd6\x1e\xcb\fA\\da/O\xdcn7\x1b@\xbf\xfb\x17J\xaaD\xe4\x01\xbc\xdc\n\x88\xfc\xcci\xc1\xe8\xf8\x1e6&\bE\x8f\x9b\xc6\x8d0\xa7 -\xecC8O*7\xfa&\xf9\aC\xab\x03g\x06\xda\x8c)\xae\xe3\x16\x9dz\x87\xd6OZX\xa4\xee\xa7\xebe\x14Qp\x96\x00\xd0VK\xe2$i\xd4\xcb-\xd4\x82w\x13\x98\xfcW\x9d\xff\xed\xd4\x14;]\xf8\xccS\xddl\x96v\x97\x988\xa7sQ\x1aN\xbdU.\x89\\\xfa\xc2\xcd\xde', &(0x7f0000000100)='security.', 0x0, &(0x7f0000000480)='+.\x00', 0x0]}) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x658cc1, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000003c0)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001f00000000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) 1.739488898s ago: executing program 1 (id=982): socket(0x10, 0x3, 0x2) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0xd7) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r0, 0x11, 0x1, 0x0, 0x0) mkdir(0x0, 0x1f4) openat(0xffffffffffffff9c, 0x0, 0x40000, 0xc2) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0xfef3, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6001010000641100fe8000000000000000000000000000bbfe800000000000fe80000000000000aa4e200e22006490"], 0x0) 1.464861341s ago: executing program 0 (id=983): r0 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0xffffffffffffffff) fcntl$setsig(r1, 0xa, 0x12) ppoll(&(0x7f0000000100)=[{r2, 0x30e0}], 0x1, 0x0, &(0x7f0000000080)={[0x8001a0effffffb]}, 0x8) (fail_nth: 4) dup2(r1, r2) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) fcntl$setown(r2, 0x8, r0) tkill(r0, 0x13) 622.239692ms ago: executing program 4 (id=984): r0 = io_uring_setup(0x6554, &(0x7f0000000140)={0x0, 0x1152, 0x200, 0x3, 0x375}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r1, &(0x7f0000000280)={@val={0x0, 0x88f8}, @val={0x1, 0x1, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xb, 0x0, 0x0, 0x0, 0x1c, {[@window={0xa, 0x3}, @timestamp={0x5, 0xa}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x4e) r2 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x53d8, 0x80, 0x8000, 0x334, 0x0, r0}, &(0x7f0000000080)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x0, 0x0, 0x3}, 0x10) recvmmsg(r5, &(0x7f0000001640)=[{{0x0, 0x52, &(0x7f0000001500)=[{&(0x7f00000014c0)=""/22, 0x16}], 0x50}, 0x7}], 0x1, 0x40000003, 0x0) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_TIMEOUT={0xb, 0x11, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x1, 0x40, 0x1}) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000080)={'caif0\x00', {0x2, 0x4e20, @multicast2}}) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)={0x78, 0x7, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x58, 0x4, 0x0, 0x1, [{0x54, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_META_SREG={0x8}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x9}, @NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x6}]}}}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x40080}, 0x4000) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r7) sendmsg$ETHTOOL_MSG_DEBUG_SET(r7, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000000c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) io_uring_enter(r2, 0x628, 0xc88d, 0x43, 0x0, 0x0) io_uring_setup(0x6554, &(0x7f0000000140)={0x0, 0x1152, 0x200, 0x3, 0x375}) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) write$tun(r1, &(0x7f0000000280)={@val={0x0, 0x88f8}, @val={0x1, 0x1, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xb, 0x0, 0x0, 0x0, 0x1c, {[@window={0xa, 0x3}, @timestamp={0x5, 0xa}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x4e) (async) syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x53d8, 0x80, 0x8000, 0x334, 0x0, r0}, &(0x7f0000000080), &(0x7f0000000040)) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) (async) socket$tipc(0x1e, 0x2, 0x0) (async) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x0, 0x0, 0x3}, 0x10) (async) recvmmsg(r5, &(0x7f0000001640)=[{{0x0, 0x52, &(0x7f0000001500)=[{&(0x7f00000014c0)=""/22, 0x16}], 0x50}, 0x7}], 0x1, 0x40000003, 0x0) (async) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_TIMEOUT={0xb, 0x11, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x1, 0x40, 0x1}) (async) socket$packet(0x11, 0x3, 0x300) (async) ioctl$sock_inet_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000080)={'caif0\x00', {0x2, 0x4e20, @multicast2}}) (async) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)={0x78, 0x7, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x58, 0x4, 0x0, 0x1, [{0x54, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_META_SREG={0x8}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x9}, @NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x6}]}}}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x40080}, 0x4000) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r7) (async) sendmsg$ETHTOOL_MSG_DEBUG_SET(r7, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000000c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) (async) io_uring_enter(r2, 0x628, 0xc88d, 0x43, 0x0, 0x0) (async) 568.634529ms ago: executing program 0 (id=985): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) socket(0x1, 0x803, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/key-users\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0xbc44) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYRES32=0x0, @ANYBLOB="7fff0000000000002800128009000100766c616e000000001800028006000100340200000c0002001f0000001e00000008000500", @ANYRES32], 0x50}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) socket(0x22, 0xa, 0x6) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001880)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000060001000004000008000500", @ANYRES32=r6], 0x50}}, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r7 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r7, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r8, {}, {0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, 0x0, 0x0) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}}, 0x48) syz_io_uring_setup(0x1249, 0x0, 0x0, 0x0) io_uring_enter(r3, 0x47fa, 0x0, 0xf, 0x0, 0x0) syz_usb_connect(0x5, 0x546, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 562.585294ms ago: executing program 1 (id=986): prctl$PR_CAPBSET_DROP(0x18, 0x24) prctl$PR_CAPBSET_DROP(0x18, 0x3) 477.362852ms ago: executing program 3 (id=987): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106a05310300000000000109022400010000c60009040002010300010009210000000122f80409058103"], 0x0) syz_usb_connect(0x3, 0x21c, &(0x7f0000000380)={{0x12, 0x1, 0x110, 0x8b, 0xa2, 0x9a, 0x40, 0x1199, 0x6891, 0x9b0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x20a, 0x2, 0x5, 0x81, 0x80, 0x4, [{{0x9, 0x4, 0x2b, 0x47, 0x8, 0xff, 0xff, 0xff, 0x10, [], [{{0x9, 0x5, 0xa, 0x10, 0x8, 0x0, 0x7, 0x81, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x6, 0x200}, @generic={0x30, 0xb, "857609ad672f8831ea8def721c01d002759a12dd40324fa091b9be21cdfd1c01ec17e38d9100ed1e619c8b0047fc"}]}}, {{0x9, 0x5, 0x5, 0x5, 0x400, 0x10, 0x5, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x9}]}}, {{0x9, 0x5, 0xb, 0x3, 0x10, 0x37, 0x8, 0x2, [@generic={0x79, 0x24, "68a40e763eaea00a8d604e32e62a744372b14d8b18eec38510c938a78b094c051dca3f275d5eeda231ddfb84188aa8c41ea9101586807f9bbf25e85c652099b1fadcd8220f11f6b59cc4f5a3dff844057e738a869bdd0287563077ee2f345a29024fc5fdd4e602497e8138ade5db82f1669f937888ba3d"}, @uac_iso={0x7, 0x25, 0x1, 0x82, 0x1a, 0x40}]}}, {{0x9, 0x5, 0xc, 0xc, 0x20, 0x7, 0xf, 0x5}}, {{0x9, 0x5, 0x6, 0x10, 0x10, 0x1e, 0x5, 0x2}}, {{0x9, 0x5, 0xa, 0x3, 0x40, 0x57, 0x8, 0x87, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x9, 0x8}]}}, {{0x9, 0x5, 0xa, 0x4, 0x20, 0x8a, 0x0, 0x55}}, {{0x9, 0x5, 0xd, 0x2, 0x10, 0x0, 0xb, 0x1d, [@generic={0x48, 0x5, "3f67649968a5512fb5e307202682e1bcb57c3d7e90be0480ae0d89ea8b8d5acc1e477a1a7778f1da86116bb5d90bd5638544318142ec073c04f433576be67dae27ccfdb26f78"}]}}]}}, {{0x9, 0x4, 0xc8, 0x5, 0xa, 0xff, 0xff, 0xff, 0xd, [], [{{0x9, 0x5, 0x5, 0x0, 0x200, 0xfc, 0x0, 0x8c}}, {{0x9, 0x5, 0xe, 0x0, 0x8, 0xc, 0x2, 0x8}}, {{0x9, 0x5, 0x8, 0x0, 0x40, 0x7, 0x5, 0xe0}}, {{0x9, 0x5, 0x3, 0x11, 0x3ff, 0x9, 0x3, 0x7}}, {{0x9, 0x5, 0x80, 0x2, 0x400, 0x3, 0x5, 0x19}}, {{0x9, 0x5, 0x2, 0x3, 0x400, 0x4, 0x10, 0x5, [@generic={0x6, 0xc, '::Y|'}, @generic={0x2a, 0x23, "f7b84682bfaf0354c3804ecc8ef504d5726b87acbf1e3d59081d4b4ab622492570b4644db24c784b"}]}}, {{0x9, 0x5, 0xa, 0x4, 0x30, 0x7, 0x80, 0xd0}}, {{0x9, 0x5, 0xe, 0x0, 0x40, 0x8, 0x7d, 0x8, [@generic={0x2, 0x4}]}}, {{0x9, 0x5, 0xb, 0x2, 0x10, 0x7f, 0x4, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x7}]}}, {{0x9, 0x5, 0xd, 0x1, 0x3ff, 0xe, 0x40, 0x16, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x17, 0x1000}]}}]}}]}}]}}, &(0x7f0000000100)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x200, 0x4d, 0x8, 0x7f, 0x8, 0xd}, 0x32, &(0x7f0000000080)={0x5, 0xf, 0x32, 0x5, [@ssp_cap={0xc, 0x10, 0xa, 0x3, 0x0, 0x4, 0xf00, 0x80}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x5, 0x3d, 0x7, 0x7}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x8, 0xc, 0x8}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0x0, 0x4, 0x2}]}, 0x1, [{0x12, &(0x7f0000000200)=ANY=[@ANYBLOB="1203c367fc43c9f907ccad0a096ea6fc231c3e6c336467dd33b6c3bc0a14e0b4461bdddcdbfa4f2dca95344993f2d488"]}]}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCFLSH(r1, 0x540f, 0x300000000000000) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000005ac0)={0x0, 0x0, &(0x7f0000005a80)={&(0x7f00000058c0)=@polexpire={0xcc, 0x1b, 0x1, 0x70bd2b, 0x25dfdbfd, {{{@in6=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x39}, 0x4e22, 0x1, 0x4e24, 0x5, 0x2, 0xa0, 0x1a0, 0x3b}, {0x9, 0x7, 0x6, 0x2, 0x7, 0xe, 0x4a6, 0x6}, {0x2, 0x0, 0xfffffffffffffff4, 0xfffffffffffffff2}, 0xa79, 0x6e6bb2, 0x1, 0x1, 0x1, 0x1}, 0x5}, [@policy_type={0xa}]}, 0xcc}, 0x1, 0x0, 0x0, 0x44040}, 0x20000004) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.freeze\x00', 0x0, 0x0) recvmsg$can_raw(r3, &(0x7f00000019c0)={&(0x7f0000000180)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, &(0x7f0000001840)=[{&(0x7f0000000240)=""/212, 0xd4}, {&(0x7f00000005c0)=""/211, 0xd3}, {&(0x7f00000006c0)=""/113, 0x71}, {&(0x7f0000000740)=""/21, 0x15}, {&(0x7f0000000780)=""/77, 0x4d}, {&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/64, 0x40}], 0x7, &(0x7f00000018c0)=""/200, 0xc8}, 0x0) 407.335277ms ago: executing program 1 (id=988): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x8000000000000760, 0xa382) r2 = memfd_create(&(0x7f0000000400)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaA\x061qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0}) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000002840)=ANY=[@ANYBLOB="500000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800b0001006d616373656300001800028005000900010000000c000100000000000000000008000500", @ANYRES32=r5], 0x50}}, 0x800) r6 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_buf(r6, 0x29, 0x45, 0x0, &(0x7f0000000080)) sendfile(r1, r1, 0x0, 0x24002de8) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r7, 0x6, 0x21, &(0x7f0000000040)="024ba05135fae8fa3436554e0f8ff126", 0x10) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000001c0)={0x0, {}, 0x0, {}, 0x40000004, 0x0, 0x1, 0x18, "28f5c9ea1f1ae4be4111ab18d2da69bde58cd7af40fd150b70aac11c2e16bd5bba7663c435aff94793ddd7aae07ef35f17bf01933bdb6fd7ecdd91b59ca8d541", "07a9310978042a8bfe1406584a128d7469166f4f07b84819e7df4af14e1df82d", [0x6, 0x7]}) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) close(0x3) r9 = socket(0x2b, 0x80801, 0x1) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0xd, 0x0, 0x0) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r9) sendmsg$IPVS_CMD_GET_DEST(r9, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r10, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x10001}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000080}, 0x200400d0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f00000015c0)=@mangle={'mangle\x00', 0x10, 0x6, 0x5b8, 0x228, 0x2f8, 0xf0, 0x2f8, 0x418, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x4e8, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0, 0x0, {0x7a00000000000000}}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@remote, 'hsr0\x00', {0xfffffffffffff800}}}}, {{@ipv6={@dev, @private1={0xfc, 0x1, '\x00', 0x1}, [0x0, 0x0, 0xff000000], [0x0, 0x0, 0xff000000], 'pim6reg\x00', 'geneve1\x00', {}, {0xff}}, 0x0, 0x110, 0x138, 0x0, {}, [@common=@unspec=@physdev={{0x68}, {'rose0\x00', {0xff}, 'veth0_macvtap\x00', {}, 0x1, 0xc}}]}, @HL={0x28, 'HL\x00', 0x0, {0x2}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x33}, @private2={0xfc, 0x2, '\x00', 0x1}, [0x7f8000ff, 0xffffff00, 0xffffff00], [0xffffff00, 0xffffff00, 0xff000000, 0xffff00], 'wlan1\x00', 'macvtap0\x00', {}, {0xff}, 0x88, 0xb, 0x1, 0x4}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @local}, @private2={0xfc, 0x2, '\x00', 0x1}, [0xffffffff, 0xffffff00, 0xffffff00, 0xff], [0xff, 0xff000000, 0xffffff00], 'veth1_to_batadv\x00', 'geneve0\x00', {}, {}, 0x3b, 0xe, 0x6, 0x58}, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x10}}, @common=@ipv6header={{0x28}, {0x31, 0x33}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x3, 0x9}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x618) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x80042, 0x0) pwritev(r0, &(0x7f0000000040)=[{&(0x7f00000003c0)="42e8", 0x2}, {0x0}], 0x2, 0x0, 0x1e0) syz_open_dev$loop(&(0x7f0000003100), 0x7ff, 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x50032, 0xffffffffffffffff, 0x0) 312.571571ms ago: executing program 2 (id=989): syz_emit_ethernet(0x4e, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x1, 0x81, 0xc}}}}]}, 0x44}}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000580)=@gettaction={0xf4, 0x32, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x30, 0x1, [{0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xe}}, {0x10, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x14, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xd}}, {0x10, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x7}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xba}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_gd=@TCA_ACT_TAB={0x3c, 0x1, [{0x10, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0x10, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}]}, 0xf4}, 0x1, 0x0, 0x0, 0x55}, 0x4000) r4 = syz_genetlink_get_family_id$smc(&(0x7f00000000c0), r1) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="00000080", @ANYRES16=r4, @ANYBLOB="02002dbd7000fedbdf25010000000900030073797a3100000000"], 0x20}, 0x1, 0x0, 0x0, 0x20008880}, 0x20040000) r5 = dup(r0) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r6, 0xaf01, 0x0) r7 = eventfd2(0x1, 0x1) ioctl$VHOST_SET_VRING_ERR(r6, 0x4008af22, &(0x7f00000001c0)={0x0, r7}) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) r8 = syz_io_uring_setup(0x235, &(0x7f0000000500)={0x0, 0x4733, 0x10100, 0x0, 0x24d, 0x0, r5}, &(0x7f00000001c0)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x1200}, 0x1}) r11 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCGISO7816(r11, 0x80285442, 0x0) io_uring_enter(r8, 0x234f, 0xb1e6, 0x1, 0x0, 0x0) r12 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$tipc(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) bind$tipc(0xffffffffffffffff, 0x0, 0x0) bind$inet6(r12, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r12, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$sock(r12, &(0x7f0000000300)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)='(', 0x1}], 0x1}}], 0x1, 0x40000) 0s ago: executing program 1 (id=990): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="27ed304da9f7234cfb2f5aa8890ffea19791367cb8fce96c2c0d2ba8bd39217433e7829042392d0a5e93d6f324659e31b02753dab1f2a4401f6131acffd7c35ada66a6e06be0222c256cc152968b44d2ef5481d72aae44e443ef2f2bad938da9364591532f82b1287f005f4066011241604caf50470ebbd604e3525bda672d91141cb05b1fc4cd"], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0xd0f, 0x470bd2d, 0xfffffffd, {0x60, 0x0, 0x0, r5, {0x3, 0xfff2}, {0xfff1, 0xffff}, {0x10, 0xfff3}}, [@qdisc_kind_options=@q_clsact={0xfffffff1}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x9}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000040}, 0x24088800) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x4000) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x89901) unshare(0x26020480) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x200000, &(0x7f0000000300)=ANY=[@ANYRES64=r5, @ANYRESOCT=r0, @ANYRES16=r1, @ANYRES64=r5, @ANYRES64=r0, @ANYRESDEC=r1, @ANYRESHEX=0x0, @ANYRESDEC=r3, @ANYRES32=r5], 0x0, 0x0, 0x0) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYRES32=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x4014}, 0x40086) r9 = accept4$tipc(r6, &(0x7f0000000140)=@name, &(0x7f0000000240)=0x10, 0x80800) ioctl$sock_inet_SIOCSIFNETMASK(r9, 0x891c, &(0x7f00000002c0)={'veth1_to_team\x00', {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}}) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff}, 0x80) r11 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000380)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$KEYCTL_WATCH_KEY(0x20, r11, r10, 0x39) keyctl$restrict_keyring(0x1d, r11, 0x0, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0x0) r12 = fsopen(&(0x7f0000000080)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r12, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040), 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file3\x00', 0xffffffffffffff9c, 0x0, 0x0) r13 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) close_range(r7, r0, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) socket$netlink(0x10, 0x3, 0x0) kernel console output (not intermixed with test programs): bridge0: port 3(dummy0) entered blocking state [ 159.319970][ T6785] bridge0: port 3(dummy0) entered forwarding state [ 159.366629][ T5939] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 159.614138][ T5923] cp210x 1-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 160.167768][ T5939] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 160.188933][ T5939] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 160.210620][ T5939] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 160.221810][ T5939] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 160.238424][ T5939] usb 2-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 160.250079][ T5939] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 160.278215][ T5939] usb 2-1: config 0 descriptor?? [ 160.741126][ T6789] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 160.794298][ T6789] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 160.824111][ T5939] hdpvr 2-1:0.0: firmware version 0xd dated jl;S11!vOp [ 160.824111][ T5939] 4(r [ 160.824111][ T5939] d2}d~٭^r [ 161.033458][ T5939] hdpvr 2-1:0.0: device init failed [ 161.039050][ T5939] hdpvr 2-1:0.0: probe with driver hdpvr failed with error -12 [ 161.146042][ T5939] usb 2-1: USB disconnect, device number 13 [ 161.334327][ T6806] netlink: 12 bytes leftover after parsing attributes in process `syz.3.275'. [ 161.437491][ T5923] cp210x 1-1:0.0: failed to get vendor val 0x3711 size 2: -71 [ 161.450680][ T5923] cp210x 1-1:0.0: GPIO initialisation failed: -71 [ 161.508110][ T5923] usb 1-1: cp210x converter now attached to ttyUSB0 [ 161.648612][ T5923] usb 1-1: USB disconnect, device number 10 [ 161.693702][ T5923] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 161.752196][ T5923] cp210x 1-1:0.0: device disconnected [ 162.554428][ T6818] bridge0: entered promiscuous mode [ 162.565133][ T6822] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 162.648109][ T6818] macvlan2: entered promiscuous mode [ 162.694098][ T6827] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.280'. [ 162.959704][ T6830] netlink: 12 bytes leftover after parsing attributes in process `syz.1.283'. [ 163.181658][ T6836] netlink: 'syz.0.279': attribute type 10 has an invalid length. [ 163.189471][ T6836] netlink: 40 bytes leftover after parsing attributes in process `syz.0.279'. [ 163.266703][ T6836] bridge0: port 3(dummy0) entered blocking state [ 163.294169][ T6836] bridge0: port 3(dummy0) entered disabled state [ 163.337740][ T6836] dummy0: entered allmulticast mode [ 163.661491][ T6836] dummy0: entered promiscuous mode [ 163.676039][ T6836] bridge0: port 3(dummy0) entered blocking state [ 163.682664][ T6836] bridge0: port 3(dummy0) entered forwarding state [ 164.182688][ T6854] loop4: detected capacity change from 0 to 7 [ 164.252551][ T6854] Dev loop4: unable to read RDB block 7 [ 164.283251][ T6854] loop4: AHDI p1 p2 [ 164.287267][ T6854] loop4: partition table partially beyond EOD, truncated [ 164.303386][ T6854] loop4: p1 size 4227858431 extends beyond EOD, truncated [ 164.601646][ T6852] loop7: detected capacity change from 0 to 147456 [ 164.643049][ T6852] input: syz1 as /devices/virtual/input/input8 [ 165.465828][ T5832] udevd[5832]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 165.858224][ T6867] netlink: 'syz.3.292': attribute type 10 has an invalid length. [ 165.923846][ T6867] netlink: 40 bytes leftover after parsing attributes in process `syz.3.292'. [ 166.076735][ T6867] batman_adv: batadv0: Interface deactivated: dummy0 [ 166.160815][ T6867] batman_adv: batadv0: Removing interface: dummy0 [ 166.188063][ T6867] bridge0: port 3(dummy0) entered blocking state [ 166.197985][ T6867] bridge0: port 3(dummy0) entered disabled state [ 166.213985][ T6867] dummy0: entered allmulticast mode [ 166.237089][ T6867] dummy0: entered promiscuous mode [ 166.258191][ T6867] bridge0: port 3(dummy0) entered blocking state [ 166.264801][ T6867] bridge0: port 3(dummy0) entered forwarding state [ 166.290753][ T6869] netlink: 20 bytes leftover after parsing attributes in process `syz.0.293'. [ 166.702287][ T6881] netlink: 8 bytes leftover after parsing attributes in process `syz.2.298'. [ 166.730789][ T6881] netlink: 24 bytes leftover after parsing attributes in process `syz.2.298'. [ 166.842987][ T6881] netlink: 24 bytes leftover after parsing attributes in process `syz.2.298'. [ 167.839045][ T6902] tipc: Started in network mode [ 167.931074][ T6902] tipc: Node identity , cluster identity 4711 [ 168.393057][ T6909] netlink: 20 bytes leftover after parsing attributes in process `syz.1.306'. [ 168.450743][ T5839] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 168.635634][ T5839] usb 5-1: Using ep0 maxpacket: 8 [ 168.661431][ T5839] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 168.669622][ T5839] usb 5-1: can't read configurations, error -22 [ 168.840801][ T5839] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 169.014609][ T30] audit: type=1326 audit(1751106423.915:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6933 comm="syz.3.314" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f19bf98e929 code=0x0 [ 169.038114][ T5839] usb 5-1: Using ep0 maxpacket: 8 [ 169.054239][ T5839] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 169.067720][ T5839] usb 5-1: can't read configurations, error -22 [ 169.082054][ T5839] usb usb5-port1: attempt power cycle [ 169.266255][ T6939] netlink: 16 bytes leftover after parsing attributes in process `syz.0.316'. [ 169.442805][ T5839] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 169.723005][ T5839] usb 5-1: Using ep0 maxpacket: 8 [ 169.733723][ T5839] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 169.744076][ T5839] usb 5-1: can't read configurations, error -22 [ 169.922359][ T5839] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 169.981287][ T5839] usb 5-1: Using ep0 maxpacket: 8 [ 169.988289][ T5839] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 170.048757][ T5839] usb 5-1: can't read configurations, error -22 [ 170.074922][ T5839] usb usb5-port1: unable to enumerate USB device [ 170.133432][ T6948] tipc: Started in network mode [ 170.147538][ T6948] tipc: Node identity , cluster identity 4711 [ 170.581124][ T43] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 170.661077][ T6958] loop6: detected capacity change from 0 to 524287487 [ 170.672432][ T6958] Buffer I/O error on dev loop6, logical block 0, async page read [ 170.680964][ T6958] Buffer I/O error on dev loop6, logical block 0, async page read [ 170.689232][ T6958] Buffer I/O error on dev loop6, logical block 0, async page read [ 170.707787][ T6958] Buffer I/O error on dev loop6, logical block 0, async page read [ 170.761135][ T6962] loop6: detected capacity change from 524287487 to 0 [ 170.768080][ T6958] Buffer I/O error on dev loop6, logical block 0, async page read [ 170.777026][ T6958] ldm_validate_partition_table(): Disk read failed. [ 170.778785][ T43] usb 1-1: unable to get BOS descriptor or descriptor too short [ 170.788402][ T6958] Dev loop6: unable to read RDB block 0 [ 170.794440][ T43] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 170.798076][ T6958] loop6: unable to read partition table [ 170.819292][ T6958] loop6: partition table beyond EOD, truncated [ 170.825812][ T6958] loop_reread_partitions: partition scan of loop6 (^L A;b@֔:Bw<gnf. -ӑ.i >^.dDd) failed (rc=-5) [ 170.880940][ T43] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 170.906488][ T43] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 170.924544][ T43] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 170.940799][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.970034][ T43] usb 1-1: Product: syz [ 170.978148][ T43] usb 1-1: Manufacturer: syz [ 171.039844][ T43] usb 1-1: SerialNumber: syz [ 171.350494][ T43] usb 1-1: 0:2 : does not exist [ 171.351309][ T9] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 171.520774][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 171.608072][ T43] usb 1-1: USB disconnect, device number 11 [ 171.657486][ T6983] netlink: 12 bytes leftover after parsing attributes in process `syz.4.328'. [ 171.723708][ T9] usb 3-1: config 0 interface 0 has no altsetting 0 [ 171.753883][ T9] usb 3-1: New USB device found, idVendor=05ac, idProduct=abdf, bcdDevice=3d.49 [ 171.763560][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.772690][ T9] usb 3-1: Product: syz [ 171.785011][ T9] usb 3-1: Manufacturer: syz [ 171.793867][ T9] usb 3-1: SerialNumber: syz [ 171.861828][ T9] usb 3-1: config 0 descriptor?? [ 171.919967][ T9] ipheth 3-1:0.0: Unable to find endpoints [ 172.235862][ T6986] netlink: 4 bytes leftover after parsing attributes in process `syz.4.331'. [ 172.244920][ T6986] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 172.470741][ T5839] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 172.530864][ T9] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 172.782976][ T5839] usb 2-1: not running at top speed; connect to a high speed hub [ 172.800804][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 172.818292][ T5839] usb 2-1: config 1 interface 0 has no altsetting 0 [ 172.828483][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 172.828624][ T5839] usb 2-1: New USB device found, idVendor=046d, idProduct=c091, bcdDevice= 0.40 [ 172.859699][ T9] usb 5-1: can't read configurations, error -61 [ 172.935177][ T5839] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.957482][ T5839] usb 2-1: Product: ᐁ [ 172.965806][ T5839] usb 2-1: Manufacturer: 㰁 [ 173.000758][ T9] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 173.018596][ T5839] usb 2-1: SerialNumber: syz [ 173.153048][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 173.160287][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 173.168575][ T9] usb 5-1: can't read configurations, error -61 [ 173.188436][ T9] usb usb5-port1: attempt power cycle [ 173.538433][ T5839] usbhid 2-1:1.0: can't add hid device: -71 [ 173.544101][ T9] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 173.558539][ T5839] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 173.572664][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 173.580228][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 173.588356][ T9] usb 5-1: can't read configurations, error -61 [ 173.705445][ T5839] usb 2-1: USB disconnect, device number 14 [ 173.730876][ T9] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 173.788621][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 173.802154][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 173.810461][ T9] usb 5-1: can't read configurations, error -61 [ 173.829816][ T9] usb usb5-port1: unable to enumerate USB device [ 173.920722][ T5939] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 174.092986][ T5939] usb 4-1: config 0 has no interfaces? [ 174.105844][ T5939] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 174.115641][ T5939] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.158585][ T5939] usb 4-1: Product: syz [ 174.174877][ T5939] usb 4-1: Manufacturer: syz [ 174.236256][ T5939] usb 4-1: SerialNumber: syz [ 174.298766][ T24] usb 3-1: USB disconnect, device number 6 [ 174.302184][ T5939] usb 4-1: config 0 descriptor?? [ 174.361872][ T5839] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 174.576207][ T7012] netlink: 4 bytes leftover after parsing attributes in process `syz.2.338'. [ 174.588338][ T5939] IPVS: starting estimator thread 0... [ 174.609675][ T5839] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 174.649357][ T5839] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 174.684097][ T5839] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 174.697876][ T7014] IPVS: using max 47 ests per chain, 112800 per kthread [ 174.721959][ T5839] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 174.739548][ T5839] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 174.827469][ T5839] usb 2-1: config 0 descriptor?? [ 175.590694][ T5908] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 175.740907][ T5908] usb 3-1: Using ep0 maxpacket: 16 [ 175.753706][ T5908] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 175.772157][ T5908] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 175.848671][ T5908] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.936636][ T5908] usb 3-1: config 0 descriptor?? [ 176.424179][ T5908] mcp2221 0003:04D8:00DD.0001: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 177.421762][ T5923] usb 4-1: USB disconnect, device number 4 [ 177.468332][ T7025] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 177.486312][ T7025] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.539427][ T5908] usb 3-1: USB disconnect, device number 7 [ 177.921612][ T7046] tipc: Started in network mode [ 177.926545][ T7046] tipc: Node identity , cluster identity 4711 [ 178.112087][ T7048] netlink: 4 bytes leftover after parsing attributes in process `syz.0.350'. [ 178.224772][ T7050] netlink: 8 bytes leftover after parsing attributes in process `syz.4.351'. [ 178.600825][ T5923] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 178.743106][ T5839] usbhid 2-1:0.0: can't add hid device: -71 [ 178.753767][ T5839] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 178.790887][ T5923] usb 3-1: Invalid ep0 maxpacket: 9 [ 178.801503][ T5839] usb 2-1: USB disconnect, device number 15 [ 178.941107][ T5923] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 179.171006][ T5923] usb 3-1: Invalid ep0 maxpacket: 9 [ 179.193073][ T5923] usb usb3-port1: attempt power cycle [ 179.560800][ T5923] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 179.594205][ T5923] usb 3-1: Invalid ep0 maxpacket: 9 [ 179.611171][ T5939] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 179.962055][ T7082] netlink: 'syz.0.359': attribute type 10 has an invalid length. [ 179.970153][ T5923] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 179.980628][ T5939] usb 4-1: Using ep0 maxpacket: 16 [ 179.992150][ T5939] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 180.005714][ T5923] usb 3-1: Invalid ep0 maxpacket: 9 [ 180.014949][ T5923] usb usb3-port1: unable to enumerate USB device [ 180.024124][ T5939] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 180.060767][ T5939] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 180.103875][ T5939] usb 4-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 180.150748][ T5939] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.209423][ T7084] netlink: 28 bytes leftover after parsing attributes in process `syz.4.361'. [ 180.216317][ T5939] usb 4-1: config 0 descriptor?? [ 180.390125][ T7088] xt_CT: You must specify a L4 protocol and not use inversions on it [ 180.637332][ T7091] netlink: 4 bytes leftover after parsing attributes in process `syz.4.363'. [ 180.659935][ T5939] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 180.678752][ T5939] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 180.701877][ T5939] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 180.730708][ T5939] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 180.738076][ T5939] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 180.777191][ T5939] input: HID 0955:7214 Haptics as /devices/virtual/input/input9 [ 180.899172][ T5939] shield 0003:0955:7214.0002: Registered Thunderstrike controller [ 180.952084][ T5939] shield 0003:0955:7214.0002: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.3-1/input0 [ 180.977573][ T7099] netlink: 4 bytes leftover after parsing attributes in process `syz.4.366'. [ 181.215447][ T7100] random: crng reseeded on system resumption [ 181.745102][ T7110] netlink: 12 bytes leftover after parsing attributes in process `syz.1.370'. [ 182.114587][ T978] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -ESHUTDOWN [ 182.135044][ T7116] netlink: 4 bytes leftover after parsing attributes in process `syz.2.369'. [ 182.150360][ T978] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 182.220481][ T978] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -EPIPE [ 182.252029][ T5939] usb 4-1: reset high-speed USB device number 5 using dummy_hcd [ 182.272024][ T978] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -EPIPE [ 182.429706][ T5939] usb 4-1: device descriptor read/64, error -32 [ 182.572335][ T7122] netlink: 8 bytes leftover after parsing attributes in process `syz.4.373'. [ 182.582194][ T7122] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 182.671510][ T5939] usb 4-1: reset high-speed USB device number 5 using dummy_hcd [ 182.960782][ T5939] usb 4-1: device descriptor read/64, error -32 [ 183.647799][ T5939] usb 4-1: reset high-speed USB device number 5 using dummy_hcd [ 183.702327][ T5939] usb 4-1: device descriptor read/8, error -32 [ 184.252751][ T7156] netlink: 24 bytes leftover after parsing attributes in process `syz.3.382'. [ 184.553357][ T7159] netlink: 12 bytes leftover after parsing attributes in process `syz.4.383'. [ 184.646238][ T9] usb 4-1: USB disconnect, device number 5 [ 185.133281][ T7174] netlink: 4 bytes leftover after parsing attributes in process `syz.3.389'. [ 185.401314][ T5908] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 185.737426][ T5908] usb 5-1: config 0 has no interfaces? [ 185.934272][ T5908] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 186.018078][ T5908] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.165981][ T5908] usb 5-1: Product: syz [ 186.210635][ T5908] usb 5-1: Manufacturer: syz [ 186.216237][ T5908] usb 5-1: SerialNumber: syz [ 186.345392][ T5908] usb 5-1: config 0 descriptor?? [ 186.511444][ T5939] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 186.651627][ T7176] netlink: 12 bytes leftover after parsing attributes in process `syz.4.388'. [ 186.660889][ T7176] netlink: 48 bytes leftover after parsing attributes in process `syz.4.388'. [ 186.746522][ T5939] usb 4-1: Using ep0 maxpacket: 8 [ 186.787416][ T5939] usb 4-1: New USB device found, idVendor=0ab4, idProduct=0014, bcdDevice=c4.18 [ 186.796617][ T5939] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.815332][ T5939] usb 4-1: Product: syz [ 186.890647][ T5939] usb 4-1: Manufacturer: syz [ 186.895327][ T5939] usb 4-1: SerialNumber: syz [ 186.960867][ T5939] usb 4-1: config 0 descriptor?? [ 186.998901][ T5939] esd_usb 4-1:0.0: sending version message failed [ 187.078022][ T5939] esd_usb 4-1:0.0: probe with driver esd_usb failed with error -22 [ 187.196789][ T24] usb 4-1: USB disconnect, device number 6 [ 188.130671][ T5939] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 188.159308][ T7210] netlink: 4 bytes leftover after parsing attributes in process `syz.2.401'. [ 188.317841][ T5939] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 188.343678][ T5939] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 188.362850][ T5939] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 188.372738][ T5939] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 188.390367][ T5939] usb 4-1: config 0 descriptor?? [ 188.477104][ T10] usb 5-1: USB disconnect, device number 14 [ 188.649442][ T7206] macvlan2: entered promiscuous mode [ 188.685068][ T7206] macvlan2: entered allmulticast mode [ 188.779855][ T7221] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.844209][ T7222] macvlan3: entered promiscuous mode [ 188.895927][ T7221] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.944824][ T7222] macvlan3: entered allmulticast mode [ 189.001149][ T5939] ath6kl: Failed to submit usb control message: -71 [ 189.041463][ T5939] ath6kl: unable to send the bmi data to the device: -71 [ 189.048743][ T5939] ath6kl: Unable to send get target info: -71 [ 189.122320][ T5939] ath6kl: Failed to init ath6kl core: -71 [ 189.128905][ T5939] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 189.173876][ T5939] usb 4-1: USB disconnect, device number 7 [ 189.714525][ T7235] netlink: 16 bytes leftover after parsing attributes in process `syz.2.409'. [ 189.783734][ T7235] bond0: entered promiscuous mode [ 189.797912][ T7235] bond_slave_0: entered promiscuous mode [ 189.808318][ T7235] bond_slave_1: entered promiscuous mode [ 189.828953][ T7235] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 189.854507][ T7235] bond0: left promiscuous mode [ 189.862583][ T7235] bond_slave_0: left promiscuous mode [ 189.874120][ T7242] xt_CT: You must specify a L4 protocol and not use inversions on it [ 189.887559][ T7235] bond_slave_1: left promiscuous mode [ 190.685514][ T5939] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 190.922484][ T5939] usb 1-1: Using ep0 maxpacket: 16 [ 190.936737][ T5939] usb 1-1: config 0 has no interfaces? [ 190.989468][ T5939] usb 1-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 191.017528][ T5939] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.067870][ T5939] usb 1-1: config 0 descriptor?? [ 191.131680][ T7264] netlink: 'syz.3.408': attribute type 10 has an invalid length. [ 191.139574][ T7264] netlink: 40 bytes leftover after parsing attributes in process `syz.3.408'. [ 192.156707][ T7275] netlink: 'syz.1.415': attribute type 10 has an invalid length. [ 192.230919][ T7275] netlink: 40 bytes leftover after parsing attributes in process `syz.1.415'. [ 192.483537][ T7279] netlink: 4 bytes leftover after parsing attributes in process `syz.4.419'. [ 192.574663][ T7275] bridge0: port 3(dummy0) entered blocking state [ 192.652794][ T7275] bridge0: port 3(dummy0) entered disabled state [ 192.717354][ T7275] dummy0: entered allmulticast mode [ 192.973007][ T7275] dummy0: entered promiscuous mode [ 192.999985][ T7275] bridge0: port 3(dummy0) entered blocking state [ 193.006611][ T7275] bridge0: port 3(dummy0) entered forwarding state [ 193.342682][ T10] usb 1-1: USB disconnect, device number 12 [ 193.520950][ T30] audit: type=1326 audit(1751106448.415:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7290 comm="syz.0.422" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8140b8e929 code=0x0 [ 193.600771][ T5908] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 193.692755][ T7297] usb usb8: usbfs: process 7297 (syz.0.422) did not claim interface 0 before use [ 193.752344][ T5908] usb 3-1: config 1 interface 0 has no altsetting 0 [ 193.794417][ T5908] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 193.809118][ T5908] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.829642][ T5908] usb 3-1: Product: syz [ 193.846740][ T5908] usb 3-1: Manufacturer: syz [ 193.856675][ T5908] usb 3-1: SerialNumber: syz [ 194.492535][ T5908] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 12 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 194.767648][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.779507][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.889438][ C1] usblp0: nonzero write bulk status received: -71 [ 194.898430][ T5839] usb 3-1: USB disconnect, device number 12 [ 194.907909][ T5839] usblp0: removed [ 195.141164][ T9] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 195.253295][ T7325] netlink: 12 bytes leftover after parsing attributes in process `syz.3.431'. [ 195.310650][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 195.333088][ T9] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 195.360686][ T9] usb 1-1: config 0 has no interface number 0 [ 195.389472][ T9] usb 1-1: config 0 interface 12 has no altsetting 0 [ 195.399462][ T9] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 195.414926][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.450435][ T9] usb 1-1: Product: syz [ 195.461029][ T9] usb 1-1: Manufacturer: syz [ 195.471049][ T9] usb 1-1: SerialNumber: syz [ 195.503054][ T9] usb 1-1: config 0 descriptor?? [ 195.667207][ T7330] netlink: 4 bytes leftover after parsing attributes in process `syz.3.433'. [ 197.710183][ T9] f81534 1-1:0.12: f81534_set_register: reg: 1003 data: b0 failed: -71 [ 197.741317][ T5908] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 197.749134][ T9] f81534 1-1:0.12: f81534_find_config_idx: read failed: -71 [ 197.792857][ T9] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 197.814061][ T9] f81534 1-1:0.12: probe with driver f81534 failed with error -71 [ 197.916500][ T9] usb 1-1: USB disconnect, device number 13 [ 197.930690][ T5908] usb 4-1: Using ep0 maxpacket: 32 [ 197.955314][ T5908] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 197.977166][ T7360] netlink: 12 bytes leftover after parsing attributes in process `syz.4.441'. [ 198.023023][ T5908] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 198.063134][ T5908] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 198.090693][ T5908] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.158214][ T5908] usb 4-1: config 0 descriptor?? [ 198.654730][ T5908] savu 0003:1E7D:2D5A.0003: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 199.076701][ T10] usb 4-1: USB disconnect, device number 9 [ 199.204191][ T7372] fido_id[7372]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 200.156199][ T7397] netlink: 15 bytes leftover after parsing attributes in process `syz.0.449'. [ 200.168324][ T7398] netlink: 8 bytes leftover after parsing attributes in process `syz.4.450'. [ 200.229207][ T7398] hsr0: entered promiscuous mode [ 200.530162][ T7403] netlink: 28 bytes leftover after parsing attributes in process `syz.2.453'. [ 200.800757][ T5908] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 200.910830][ T5839] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 200.955359][ T5908] usb 5-1: Using ep0 maxpacket: 32 [ 200.996369][ T5908] usb 5-1: config 0 has an invalid interface number: 12 but max is 2 [ 201.008336][ T5908] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 201.035963][ T5908] usb 5-1: config 0 has no interface number 0 [ 201.042709][ T5908] usb 5-1: config 0 interface 12 has no altsetting 0 [ 201.077146][ T5839] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 201.123577][ T5839] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 201.134226][ T5908] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 201.145674][ T5908] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.156001][ T5839] usb 3-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 201.169071][ T5908] usb 5-1: Product: syz [ 201.178778][ T5839] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 201.239444][ T5908] usb 5-1: Manufacturer: syz [ 201.297917][ T5908] usb 5-1: SerialNumber: syz [ 201.304448][ T5839] usb 3-1: config 0 descriptor?? [ 201.331684][ T5908] usb 5-1: config 0 descriptor?? [ 201.470388][ T7417] pim6reg: entered allmulticast mode [ 201.487208][ T7417] pim6reg: left allmulticast mode [ 201.627592][ T7419] binder: 7404:7419 ioctl c0306201 200000000080 returned -14 [ 201.639987][ T7419] binder: 7404:7419 ioctl c02464bb 200000000180 returned -22 [ 201.731258][ T5839] usbhid 3-1:0.0: can't add hid device: -71 [ 201.737511][ T5839] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 201.779223][ T5839] usb 3-1: USB disconnect, device number 13 [ 203.359041][ T7438] xt_CT: You must specify a L4 protocol and not use inversions on it [ 203.669753][ T7442] No such timeout policy "syz0" [ 203.685352][ T5908] f81534 5-1:0.12: required endpoints missing [ 203.685381][ T7444] tipc: Started in network mode [ 203.711653][ T5908] usb 5-1: USB disconnect, device number 15 [ 203.733018][ T7444] tipc: Node identity , cluster identity 4711 [ 203.908719][ T7448] netlink: 'syz.2.460': attribute type 10 has an invalid length. [ 203.930152][ T7448] netlink: 40 bytes leftover after parsing attributes in process `syz.2.460'. [ 204.030643][ T43] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 204.251894][ T43] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 204.285681][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.482277][ T43] usb 1-1: config 0 descriptor?? [ 204.692003][ T7442] netlink: 4 bytes leftover after parsing attributes in process `syz.0.467'. [ 205.249727][ T43] usb 1-1: string descriptor 0 read error: -71 [ 205.288450][ T43] usb 1-1: Cannot read MAC address [ 205.346778][ T43] MOSCHIP usb-ethernet driver 1-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 205.420482][ T43] usb 1-1: USB disconnect, device number 14 [ 205.526372][ T7463] netlink: 8 bytes leftover after parsing attributes in process `syz.2.473'. [ 205.738051][ T7466] netlink: 36 bytes leftover after parsing attributes in process `syz.3.475'. [ 205.790898][ T5839] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 205.942873][ T7470] tipc: Started in network mode [ 205.948016][ T7470] tipc: Node identity , cluster identity 4711 [ 205.962827][ T5839] usb 3-1: config 0 has an invalid interface number: 187 but max is 0 [ 205.972491][ T5839] usb 3-1: config 0 has no interface number 0 [ 205.979906][ T5839] usb 3-1: config 0 interface 187 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 206.017515][ T5839] usb 3-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice=22.4e [ 206.027180][ T5839] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.038761][ T5839] usb 3-1: Product: syz [ 206.049825][ T5839] usb 3-1: Manufacturer: syz [ 206.060737][ T5839] usb 3-1: SerialNumber: syz [ 206.078607][ T5839] usb 3-1: config 0 descriptor?? [ 206.098352][ T7463] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 206.735537][ T43] usb 3-1: USB disconnect, device number 14 [ 207.623398][ T10] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 207.754951][ T7486] netlink: 16 bytes leftover after parsing attributes in process `syz.2.480'. [ 207.779349][ T7486] bond0: entered promiscuous mode [ 207.790097][ T7486] bond_slave_0: entered promiscuous mode [ 207.800071][ T7486] bond_slave_1: entered promiscuous mode [ 207.806273][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 207.827940][ T10] usb 5-1: config 0 has an invalid interface number: 12 but max is 2 [ 207.845804][ T7486] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 207.881089][ T10] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 207.896005][ T10] usb 5-1: config 0 has no interface number 0 [ 207.905565][ T7486] bond0: left promiscuous mode [ 207.918640][ T10] usb 5-1: config 0 interface 12 has no altsetting 0 [ 207.930383][ T7486] bond_slave_0: left promiscuous mode [ 207.943225][ T7486] bond_slave_1: left promiscuous mode [ 207.949883][ T10] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 207.965192][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.975538][ T10] usb 5-1: Product: syz [ 207.979924][ T10] usb 5-1: Manufacturer: syz [ 207.987266][ T10] usb 5-1: SerialNumber: syz [ 208.003936][ T10] usb 5-1: config 0 descriptor?? [ 208.334990][ T7488] netlink: 28 bytes leftover after parsing attributes in process `syz.2.481'. [ 208.385372][ T7489] binder: 7483:7489 ioctl c0306201 200000000080 returned -14 [ 208.433182][ T7489] binder: 7483:7489 ioctl c02464bb 200000000180 returned -22 [ 208.740814][ T5839] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 208.873610][ T5839] usb 3-1: device descriptor read/64, error -71 [ 209.124922][ T5839] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 209.270836][ T5839] usb 3-1: device descriptor read/64, error -71 [ 209.391640][ T5839] usb usb3-port1: attempt power cycle [ 209.680660][ T43] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 209.750744][ T5839] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 209.832946][ T5839] usb 3-1: device descriptor read/8, error -71 [ 209.908160][ T43] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 209.924808][ T43] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 210.010655][ T43] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 210.050666][ T43] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 210.075516][ T43] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 210.116272][ T43] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 210.162088][ T5839] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 210.197774][ T43] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 210.226030][ T43] usb 4-1: Product: syz [ 210.241408][ T5839] usb 3-1: device descriptor read/8, error -71 [ 210.248556][ T43] usb 4-1: Manufacturer: syz [ 210.301234][ T43] cdc_wdm 4-1:1.0: skipping garbage [ 210.355513][ T43] cdc_wdm 4-1:1.0: skipping garbage [ 210.375081][ T5839] usb usb3-port1: unable to enumerate USB device [ 210.411729][ T43] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 210.466334][ T10] f81534 5-1:0.12: required endpoints missing [ 210.474039][ T43] cdc_wdm 4-1:1.0: Unknown control protocol [ 210.540291][ T43] usb 4-1: USB disconnect, device number 10 [ 210.551573][ T10] usb 5-1: USB disconnect, device number 16 [ 211.034643][ T7510] netlink: 'syz.0.489': attribute type 10 has an invalid length. [ 211.450758][ T43] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 211.897694][ T43] usb 5-1: config 0 has an invalid interface number: 214 but max is 0 [ 211.906487][ T43] usb 5-1: config 0 has no interface number 0 [ 211.923365][ T43] usb 5-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid maxpacket 1023, setting to 64 [ 211.967244][ T43] usb 5-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 211.980456][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.994933][ T43] usb 5-1: Product: syz [ 211.999217][ T43] usb 5-1: Manufacturer: syz [ 212.019538][ T43] usb 5-1: SerialNumber: syz [ 212.040126][ T7536] pim6reg: entered allmulticast mode [ 212.157665][ T43] usb 5-1: config 0 descriptor?? [ 212.170677][ T5908] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 212.351281][ T5908] usb 3-1: Using ep0 maxpacket: 32 [ 212.361478][ T5908] usb 3-1: config 0 has an invalid interface number: 12 but max is 2 [ 212.370294][ T5908] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 212.436966][ T5908] usb 3-1: config 0 has no interface number 0 [ 212.646231][ T10] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 212.648520][ T5908] usb 3-1: config 0 interface 12 has no altsetting 0 [ 212.683715][ T5908] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 212.695581][ T5908] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.706904][ T5908] usb 3-1: Product: syz [ 212.716615][ T5908] usb 3-1: Manufacturer: syz [ 212.722456][ T5908] usb 3-1: SerialNumber: syz [ 212.792120][ T5908] usb 3-1: config 0 descriptor?? [ 212.894831][ T10] usb 4-1: config 0 has no interfaces? [ 212.914849][ T10] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 213.110312][ T7542] binder: 7532:7542 ioctl c0306201 200000000080 returned -14 [ 213.120851][ T7542] binder: 7532:7542 ioctl c02464bb 200000000180 returned -22 [ 213.168854][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.241993][ T10] usb 4-1: Product: syz [ 213.265781][ T10] usb 4-1: Manufacturer: syz [ 213.284757][ T10] usb 4-1: SerialNumber: syz [ 213.325311][ T10] usb 4-1: config 0 descriptor?? [ 213.667141][ T7527] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 213.729123][ T7527] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 213.801132][ T7546] netlink: 'syz.0.501': attribute type 13 has an invalid length. [ 213.882741][ T7527] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 213.894598][ T7527] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 214.277321][ T7550] netlink: 28 bytes leftover after parsing attributes in process `syz.1.503'. [ 214.529686][ T7557] FAULT_INJECTION: forcing a failure. [ 214.529686][ T7557] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 214.572102][ T7557] CPU: 1 UID: 0 PID: 7557 Comm: syz.1.505 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 214.572135][ T7557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 214.572147][ T7557] Call Trace: [ 214.572156][ T7557] [ 214.572164][ T7557] dump_stack_lvl+0x189/0x250 [ 214.572200][ T7557] ? __pfx____ratelimit+0x10/0x10 [ 214.572229][ T7557] ? __pfx_dump_stack_lvl+0x10/0x10 [ 214.572259][ T7557] ? __pfx__printk+0x10/0x10 [ 214.572281][ T7557] ? __might_fault+0xb0/0x130 [ 214.572313][ T7557] should_fail_ex+0x414/0x560 [ 214.572343][ T7557] _copy_from_user+0x2d/0xb0 [ 214.572363][ T7557] set_user_sigmask+0xa1/0x1b0 [ 214.572392][ T7557] ? __pfx_set_user_sigmask+0x10/0x10 [ 214.572418][ T7557] ? handle_softirqs+0x717/0x870 [ 214.572457][ T7557] __se_sys_ppoll+0x1ce/0x260 [ 214.572481][ T7557] ? __pfx___se_sys_ppoll+0x10/0x10 [ 214.572511][ T7557] ? do_syscall_64+0xbe/0x3b0 [ 214.572537][ T7557] ? __x64_sys_ppoll+0x20/0xc0 [ 214.572559][ T7557] do_syscall_64+0xfa/0x3b0 [ 214.572588][ T7557] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 214.572615][ T7557] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 214.572634][ T7557] ? clear_bhb_loop+0x60/0xb0 [ 214.572658][ T7557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 214.572676][ T7557] RIP: 0033:0x7f481b38e929 [ 214.572694][ T7557] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 214.572709][ T7557] RSP: 002b:00007f481c138038 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 214.572732][ T7557] RAX: ffffffffffffffda RBX: 00007f481b5b5fa0 RCX: 00007f481b38e929 [ 214.572745][ T7557] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000100 [ 214.572757][ T7557] RBP: 00007f481c138090 R08: 0000000000000008 R09: 0000000000000000 [ 214.572768][ T7557] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 214.572780][ T7557] R13: 0000000000000000 R14: 00007f481b5b5fa0 R15: 00007f481b6dfa28 [ 214.572812][ T7557] [ 214.867047][ T43] usbtouchscreen 5-1:0.214: probe with driver usbtouchscreen failed with error -71 [ 214.940361][ T43] usb 5-1: USB disconnect, device number 17 [ 215.208759][ T5908] f81534 3-1:0.12: required endpoints missing [ 215.286130][ T5908] usb 3-1: USB disconnect, device number 19 [ 215.488249][ T10] usb 4-1: USB disconnect, device number 11 [ 216.543099][ T7587] netlink: 'syz.3.509': attribute type 10 has an invalid length. [ 216.561793][ T7587] netlink: 40 bytes leftover after parsing attributes in process `syz.3.509'. [ 216.690824][ T5839] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 216.863010][ T5839] usb 5-1: Using ep0 maxpacket: 32 [ 216.875471][ T5839] usb 5-1: config 0 has an invalid interface number: 12 but max is 2 [ 216.886810][ T5839] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 216.904640][ T5839] usb 5-1: config 0 has no interface number 0 [ 216.914469][ T5839] usb 5-1: config 0 interface 12 has no altsetting 0 [ 216.928034][ T5839] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 216.937617][ T5839] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.945936][ T5839] usb 5-1: Product: syz [ 216.959279][ T5839] usb 5-1: Manufacturer: syz [ 217.009963][ T5839] usb 5-1: SerialNumber: syz [ 217.038269][ T5839] usb 5-1: config 0 descriptor?? [ 217.309611][ T7593] binder: 7584:7593 ioctl c0306201 200000000080 returned -14 [ 217.319166][ T5843] Bluetooth: hci2: command 0x0406 tx timeout [ 217.325455][ T5844] Bluetooth: hci4: command 0x0406 tx timeout [ 217.325513][ T5152] Bluetooth: hci3: command 0x0406 tx timeout [ 217.332320][ T5844] Bluetooth: hci1: command 0x0406 tx timeout [ 217.340063][ T5152] Bluetooth: hci0: command 0x0406 tx timeout [ 217.354776][ T7593] binder: 7584:7593 ioctl c02464bb 200000000180 returned -22 [ 217.622408][ T7598] tipc: Started in network mode [ 217.634348][ T7598] tipc: Node identity , cluster identity 4711 [ 217.871988][ T7602] FAULT_INJECTION: forcing a failure. [ 217.871988][ T7602] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 217.920448][ T7601] netlink: 'syz.0.522': attribute type 11 has an invalid length. [ 217.920771][ T7602] CPU: 1 UID: 0 PID: 7602 Comm: syz.1.521 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 217.920796][ T7602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 217.920806][ T7602] Call Trace: [ 217.920813][ T7602] [ 217.920821][ T7602] dump_stack_lvl+0x189/0x250 [ 217.920858][ T7602] ? __pfx____ratelimit+0x10/0x10 [ 217.920883][ T7602] ? __pfx_dump_stack_lvl+0x10/0x10 [ 217.920910][ T7602] ? __pfx__printk+0x10/0x10 [ 217.920930][ T7602] ? __might_fault+0xb0/0x130 [ 217.920958][ T7602] should_fail_ex+0x414/0x560 [ 217.920993][ T7602] _copy_from_iter+0x1db/0x16f0 [ 217.921022][ T7602] ? rcu_is_watching+0x15/0xb0 [ 217.921050][ T7602] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 217.921069][ T7602] ? __pfx__copy_from_iter+0x10/0x10 [ 217.921094][ T7602] ? __build_skb_around+0x257/0x3e0 [ 217.921117][ T7602] ? netlink_sendmsg+0x642/0xb30 [ 217.921135][ T7602] ? skb_put+0x11b/0x210 [ 217.921158][ T7602] netlink_sendmsg+0x6b2/0xb30 [ 217.921186][ T7602] ? __pfx_netlink_sendmsg+0x10/0x10 [ 217.921209][ T7602] ? aa_sock_msg_perm+0x94/0x160 [ 217.921232][ T7602] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 217.921253][ T7602] ? __pfx_netlink_sendmsg+0x10/0x10 [ 217.921274][ T7602] __sock_sendmsg+0x21c/0x270 [ 217.921302][ T7602] ____sys_sendmsg+0x505/0x830 [ 217.921328][ T7602] ? __pfx_____sys_sendmsg+0x10/0x10 [ 217.921358][ T7602] ? import_iovec+0x74/0xa0 [ 217.921377][ T7602] ___sys_sendmsg+0x21f/0x2a0 [ 217.921401][ T7602] ? __pfx____sys_sendmsg+0x10/0x10 [ 217.921457][ T7602] ? __fget_files+0x2a/0x420 [ 217.921475][ T7602] ? __fget_files+0x3a0/0x420 [ 217.921505][ T7602] __x64_sys_sendmsg+0x19b/0x260 [ 217.921528][ T7602] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 217.921558][ T7602] ? __pfx_ksys_write+0x10/0x10 [ 217.921572][ T7602] ? rcu_is_watching+0x15/0xb0 [ 217.921602][ T7602] ? do_syscall_64+0xbe/0x3b0 [ 217.921631][ T7602] do_syscall_64+0xfa/0x3b0 [ 217.921654][ T7602] ? lockdep_hardirqs_on+0x9c/0x150 [ 217.921677][ T7602] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.921694][ T7602] ? clear_bhb_loop+0x60/0xb0 [ 217.921715][ T7602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.921731][ T7602] RIP: 0033:0x7f481b38e929 [ 217.921748][ T7602] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 217.921762][ T7602] RSP: 002b:00007f481c138038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 217.921782][ T7602] RAX: ffffffffffffffda RBX: 00007f481b5b5fa0 RCX: 00007f481b38e929 [ 217.921795][ T7602] RDX: 0000000000000000 RSI: 0000200000000940 RDI: 0000000000000003 [ 217.921806][ T7602] RBP: 00007f481c138090 R08: 0000000000000000 R09: 0000000000000000 [ 217.921816][ T7602] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 217.921826][ T7602] R13: 0000000000000000 R14: 00007f481b5b5fa0 R15: 00007f481b6dfa28 [ 217.921854][ T7602] [ 218.170589][ C0] vkms_vblank_simulate: vblank timer overrun [ 218.246134][ T7605] Context (ID=0x0) not attached to queue pair (handle=0x2:0x0) [ 218.310832][ T24] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 218.491726][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 218.507341][ T24] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 218.545168][ T24] usb 1-1: config 0 has no interface number 0 [ 218.560713][ T978] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 218.574901][ T24] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 218.603329][ T24] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 218.630674][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.659470][ T24] usb 1-1: config 0 descriptor?? [ 218.667516][ T7618] FAULT_INJECTION: forcing a failure. [ 218.667516][ T7618] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 218.685418][ T7618] CPU: 0 UID: 0 PID: 7618 Comm: syz.2.526 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 218.685446][ T7618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 218.685457][ T7618] Call Trace: [ 218.685465][ T7618] [ 218.685474][ T7618] dump_stack_lvl+0x189/0x250 [ 218.685509][ T7618] ? __pfx____ratelimit+0x10/0x10 [ 218.685537][ T7618] ? __pfx_dump_stack_lvl+0x10/0x10 [ 218.685566][ T7618] ? __pfx__printk+0x10/0x10 [ 218.685588][ T7618] ? __might_fault+0xb0/0x130 [ 218.685620][ T7618] should_fail_ex+0x414/0x560 [ 218.685647][ T7618] _copy_from_iter+0x1db/0x16f0 [ 218.685679][ T7618] ? rcu_is_watching+0x15/0xb0 [ 218.685722][ T7618] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 218.685743][ T7618] ? __pfx__copy_from_iter+0x10/0x10 [ 218.685771][ T7618] ? __build_skb_around+0x257/0x3e0 [ 218.685795][ T7618] ? netlink_sendmsg+0x642/0xb30 [ 218.685814][ T7618] ? skb_put+0x11b/0x210 [ 218.685838][ T7618] netlink_sendmsg+0x6b2/0xb30 [ 218.685869][ T7618] ? __pfx_netlink_sendmsg+0x10/0x10 [ 218.685895][ T7618] ? aa_sock_msg_perm+0x94/0x160 [ 218.685921][ T7618] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 218.685943][ T7618] ? __pfx_netlink_sendmsg+0x10/0x10 [ 218.685964][ T7618] __sock_sendmsg+0x21c/0x270 [ 218.685994][ T7618] ____sys_sendmsg+0x505/0x830 [ 218.686024][ T7618] ? __pfx_____sys_sendmsg+0x10/0x10 [ 218.686056][ T7618] ? import_iovec+0x74/0xa0 [ 218.686078][ T7618] ___sys_sendmsg+0x21f/0x2a0 [ 218.686102][ T7618] ? __pfx____sys_sendmsg+0x10/0x10 [ 218.686163][ T7618] ? __fget_files+0x2a/0x420 [ 218.686184][ T7618] ? __fget_files+0x3a0/0x420 [ 218.686216][ T7618] __x64_sys_sendmsg+0x19b/0x260 [ 218.686248][ T7618] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 218.686281][ T7618] ? __pfx_ksys_write+0x10/0x10 [ 218.686304][ T7618] ? do_syscall_64+0xbe/0x3b0 [ 218.686334][ T7618] do_syscall_64+0xfa/0x3b0 [ 218.686362][ T7618] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.686378][ T7618] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 218.686397][ T7618] ? clear_bhb_loop+0x60/0xb0 [ 218.686419][ T7618] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.686437][ T7618] RIP: 0033:0x7fb1af38e929 [ 218.686455][ T7618] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 218.686470][ T7618] RSP: 002b:00007fb1b01f0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 218.686491][ T7618] RAX: ffffffffffffffda RBX: 00007fb1af5b5fa0 RCX: 00007fb1af38e929 [ 218.686506][ T7618] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 218.686517][ T7618] RBP: 00007fb1b01f0090 R08: 0000000000000000 R09: 0000000000000000 [ 218.686529][ T7618] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 218.686540][ T7618] R13: 0000000000000000 R14: 00007fb1af5b5fa0 R15: 00007fb1af6dfa28 [ 218.686569][ T7618] [ 218.693249][ T24] iowarrior 1-1:0.1: no interrupt-in endpoint found [ 218.740870][ T978] usb 4-1: Using ep0 maxpacket: 16 [ 218.996378][ T978] usb 4-1: config 8 has an invalid interface number: 206 but max is 0 [ 219.018051][ T5939] usb 1-1: USB disconnect, device number 15 [ 219.049889][ T978] usb 4-1: config 8 has no interface number 0 [ 219.058446][ T978] usb 4-1: config 8 interface 206 has no altsetting 0 [ 219.079367][ T978] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=35.bb [ 219.099936][ T978] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.130317][ T978] usb 4-1: Product: syz [ 219.140420][ T978] usb 4-1: Manufacturer: syz [ 219.152162][ T978] usb 4-1: SerialNumber: syz [ 219.395546][ T7604] program syz.3.523 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 219.500188][ T978] garmin_gps 4-1:8.206: Garmin GPS usb/tty converter detected [ 219.528772][ T978] garmin_gps ttyUSB0: failed to submit interrupt urb: -22 [ 219.540760][ T978] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -22 [ 219.559112][ T5839] f81534 5-1:0.12: required endpoints missing [ 219.577311][ T978] usb 4-1: USB disconnect, device number 12 [ 219.617112][ T5839] usb 5-1: USB disconnect, device number 18 [ 219.648883][ T978] garmin_gps 4-1:8.206: device disconnected [ 220.641146][ T7648] netlink: 8 bytes leftover after parsing attributes in process `syz.2.535'. [ 220.692533][ T7644] netlink: 32 bytes leftover after parsing attributes in process `syz.3.534'. [ 220.761872][ T7648] hsr0: entered promiscuous mode [ 221.033536][ T7655] binder: BINDER_SET_CONTEXT_MGR already set [ 221.044348][ T7655] binder: 7653:7655 ioctl 4018620d 200000000040 returned -16 [ 221.052425][ T7654] netlink: 28 bytes leftover after parsing attributes in process `syz.1.537'. [ 221.808936][ T7668] netlink: 12 bytes leftover after parsing attributes in process `syz.1.541'. [ 221.870869][ T5839] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 222.021186][ T5839] usb 3-1: Using ep0 maxpacket: 32 [ 222.028597][ T5839] usb 3-1: config 0 has an invalid interface number: 12 but max is 2 [ 222.037225][ T5839] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 222.051899][ T5839] usb 3-1: config 0 has no interface number 0 [ 222.058144][ T5839] usb 3-1: config 0 interface 12 has no altsetting 0 [ 222.091701][ T5839] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 222.101090][ T5839] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.111903][ T5839] usb 3-1: Product: syz [ 222.123275][ T5839] usb 3-1: Manufacturer: syz [ 222.136669][ T5839] usb 3-1: SerialNumber: syz [ 222.155820][ T5839] usb 3-1: config 0 descriptor?? [ 222.453244][ T7679] binder: 7661:7679 ioctl c0306201 200000000080 returned -14 [ 222.704216][ T7686] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 222.716945][ T7686] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 223.497173][ T7692] netlink: 12 bytes leftover after parsing attributes in process `syz.4.548'. [ 223.570909][ T7692] netlink: 48 bytes leftover after parsing attributes in process `syz.4.548'. [ 224.216700][ T7697] (unnamed net_device) (uninitialized): ARP target 1.0.0.0 is already present [ 224.226033][ T7697] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (1) [ 224.711195][ T7701] netlink: 'syz.0.547': attribute type 10 has an invalid length. [ 224.719055][ T7701] netlink: 40 bytes leftover after parsing attributes in process `syz.0.547'. [ 225.156909][ T5839] f81534 3-1:0.12: required endpoints missing [ 225.188184][ T7706] netlink: 16 bytes leftover after parsing attributes in process `syz.3.551'. [ 225.188650][ T5839] usb 3-1: USB disconnect, device number 20 [ 225.360295][ T7710] netlink: 28 bytes leftover after parsing attributes in process `syz.3.551'. [ 225.429380][ T7711] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 226.874024][ T7735] netlink: 12 bytes leftover after parsing attributes in process `syz.1.559'. [ 226.893482][ T7735] netlink: 48 bytes leftover after parsing attributes in process `syz.1.559'. [ 227.710997][ T5939] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 227.871540][ T5939] usb 3-1: Using ep0 maxpacket: 32 [ 227.882201][ T5939] usb 3-1: config 0 has an invalid interface number: 12 but max is 2 [ 227.900434][ T5939] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 227.937548][ T5939] usb 3-1: config 0 has no interface number 0 [ 227.956089][ T5939] usb 3-1: config 0 interface 12 has no altsetting 0 [ 228.125396][ T5939] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 228.135164][ T5939] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.173312][ T5939] usb 3-1: Product: syz [ 228.178862][ T5939] usb 3-1: Manufacturer: syz [ 228.184275][ T5939] usb 3-1: SerialNumber: syz [ 228.213730][ T5939] usb 3-1: config 0 descriptor?? [ 228.386932][ T7757] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 228.477077][ T7758] binder: 7741:7758 ioctl c0306201 200000000080 returned -14 [ 229.156687][ T7769] netlink: 20 bytes leftover after parsing attributes in process `syz.1.568'. [ 230.047539][ T5923] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 230.245930][ T5923] usb 1-1: config 0 has no interfaces? [ 230.274795][ T7777] netlink: 12 bytes leftover after parsing attributes in process `syz.3.571'. [ 230.316837][ T5923] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 230.327383][ T5923] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.392763][ T7777] netlink: 48 bytes leftover after parsing attributes in process `syz.3.571'. [ 230.428482][ T5923] usb 1-1: Product: syz [ 230.459201][ T5923] usb 1-1: Manufacturer: syz [ 230.465063][ T5939] f81534 3-1:0.12: required endpoints missing [ 230.475187][ T5923] usb 1-1: SerialNumber: syz [ 230.511623][ T5939] usb 3-1: USB disconnect, device number 21 [ 230.534595][ T5923] usb 1-1: config 0 descriptor?? [ 231.133300][ T7775] netlink: 12 bytes leftover after parsing attributes in process `syz.0.570'. [ 231.146691][ T7775] netlink: 48 bytes leftover after parsing attributes in process `syz.0.570'. [ 232.558898][ T7805] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 232.780191][ T7808] loop2: detected capacity change from 0 to 7 [ 232.825455][ T7808] Dev loop2: unable to read RDB block 7 [ 232.861484][ T7808] loop2: unable to read partition table [ 232.893345][ T7808] loop2: partition table beyond EOD, truncated [ 232.932245][ T7808] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 233.186826][ T5923] usb 1-1: USB disconnect, device number 16 [ 233.790209][ T43] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 233.790300][ T5923] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 233.950654][ T43] usb 1-1: Using ep0 maxpacket: 32 [ 233.981731][ T43] usb 1-1: config 0 has an invalid interface number: 12 but max is 2 [ 233.990840][ T43] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 233.990918][ T5923] usb 3-1: Using ep0 maxpacket: 16 [ 233.995090][ T5923] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 233.999902][ T43] usb 1-1: config 0 has no interface number 0 [ 233.999951][ T43] usb 1-1: config 0 interface 12 has no altsetting 0 [ 234.034135][ T43] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 234.039123][ T5923] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 234.052775][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.075093][ T43] usb 1-1: Product: syz [ 234.076876][ T43] usb 1-1: Manufacturer: syz [ 234.081506][ T43] usb 1-1: SerialNumber: syz [ 234.093987][ T43] usb 1-1: config 0 descriptor?? [ 234.248143][ T5923] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 234.248195][ T5923] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.248210][ T5923] usb 3-1: Product: syz [ 234.248225][ T5923] usb 3-1: Manufacturer: syz [ 234.248241][ T5923] usb 3-1: SerialNumber: syz [ 234.487683][ T7831] binder: 7816:7831 ioctl c0306201 200000000080 returned -14 [ 234.530949][ T5923] usb 3-1: 0:2 : does not exist [ 234.537324][ T5923] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 234.971102][ T5923] usb 3-1: USB disconnect, device number 22 [ 235.266898][ T5848] udevd[5848]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 235.602273][ T7844] macvlan3: entered promiscuous mode [ 235.611489][ T5923] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 235.782878][ T5923] usb 3-1: Using ep0 maxpacket: 16 [ 235.809651][ T5923] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 235.830682][ T5923] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 235.845049][ T5923] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 235.865141][ T5923] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 235.887571][ T5923] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 235.900124][ T5923] usb 3-1: config 0 descriptor?? [ 236.332806][ T5908] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 236.542161][ T43] f81534 1-1:0.12: required endpoints missing [ 236.600194][ T43] usb 1-1: USB disconnect, device number 17 [ 236.681987][ T5908] usb 2-1: config 0 has no interfaces? [ 236.713835][ T5908] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 236.730395][ T5908] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.769022][ T5908] usb 2-1: Product: syz [ 236.795244][ T5908] usb 2-1: Manufacturer: syz [ 236.806349][ T5908] usb 2-1: SerialNumber: syz [ 236.859684][ T5908] usb 2-1: config 0 descriptor?? [ 236.868063][ T7868] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 236.956513][ T5923] usbhid 3-1:0.0: can't add hid device: -71 [ 237.008269][ T5923] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 237.067819][ T5923] usb 3-1: USB disconnect, device number 23 [ 237.155601][ T7854] netlink: 12 bytes leftover after parsing attributes in process `syz.1.593'. [ 237.165120][ T7854] netlink: 48 bytes leftover after parsing attributes in process `syz.1.593'. [ 238.483426][ T5908] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 238.630711][ T5908] usb 1-1: device descriptor read/64, error -71 [ 238.743451][ T7886] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 238.890867][ T5908] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 239.048712][ T43] usb 2-1: USB disconnect, device number 16 [ 239.071852][ T5908] usb 1-1: device descriptor read/64, error -71 [ 239.142573][ T7890] tipc: Started in network mode [ 239.154284][ T7890] tipc: Node identity 0000000000000000212e004, cluster identity 4711 [ 239.211057][ T5908] usb usb1-port1: attempt power cycle [ 239.214271][ T7892] netlink: 28 bytes leftover after parsing attributes in process `syz.2.605'. [ 239.540926][ T9] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 239.551302][ T43] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 239.559293][ T5908] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 239.581491][ T5908] usb 1-1: device descriptor read/8, error -71 [ 239.690743][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 239.698705][ T9] usb 2-1: config 0 has an invalid interface number: 12 but max is 2 [ 239.707477][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 239.716621][ T9] usb 2-1: config 0 has no interface number 0 [ 239.722829][ T43] usb 3-1: Using ep0 maxpacket: 8 [ 239.728654][ T9] usb 2-1: config 0 interface 12 has no altsetting 0 [ 239.737139][ T43] usb 3-1: unable to get BOS descriptor or descriptor too short [ 239.738484][ T9] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 239.756121][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.757504][ T43] usb 3-1: config 1 interface 0 altsetting 13 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 239.772788][ T9] usb 2-1: Product: syz [ 239.782744][ T9] usb 2-1: Manufacturer: syz [ 239.787499][ T9] usb 2-1: SerialNumber: syz [ 239.805357][ T9] usb 2-1: config 0 descriptor?? [ 239.823998][ T43] usb 3-1: config 1 interface 0 altsetting 13 bulk endpoint 0x82 has invalid maxpacket 8 [ 239.834230][ T5908] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 239.846709][ T43] usb 3-1: config 1 interface 0 altsetting 13 bulk endpoint 0x3 has invalid maxpacket 1024 [ 239.857546][ T43] usb 3-1: config 1 interface 0 has no altsetting 0 [ 239.868552][ T43] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 239.878226][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.886819][ T43] usb 3-1: Product: syz [ 239.886967][ T5908] usb 1-1: device descriptor read/8, error -71 [ 239.897392][ T43] usb 3-1: Manufacturer: syz [ 239.902167][ T43] usb 3-1: SerialNumber: syz [ 239.921087][ T7896] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 239.928667][ T7896] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 240.031462][ T5908] usb usb1-port1: unable to enumerate USB device [ 240.123672][ T7903] netlink: 12 bytes leftover after parsing attributes in process `syz.4.609'. [ 240.232044][ T7900] pim6reg: entered allmulticast mode [ 240.242707][ T7900] pim6reg: left allmulticast mode [ 240.631726][ T7907] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 241.668005][ T7915] netlink: 4 bytes leftover after parsing attributes in process `syz.3.613'. [ 242.362246][ T9] f81534 2-1:0.12: required endpoints missing [ 242.560654][ T9] usb 2-1: USB disconnect, device number 17 [ 242.723361][ T43] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 242.902857][ T43] usb 3-1: USB disconnect, device number 24 [ 242.965653][ T5923] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 243.260435][ T5923] usb 1-1: config 0 has no interfaces? [ 243.357569][ T7935] 8021q: VLANs not supported on vcan0 [ 243.400073][ T5923] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 243.455079][ T5923] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.479283][ T5923] usb 1-1: Product: syz [ 243.495014][ T5923] usb 1-1: Manufacturer: syz [ 243.508853][ T5923] usb 1-1: SerialNumber: syz [ 243.534514][ T5923] usb 1-1: config 0 descriptor?? [ 243.864718][ T7949] netlink: 12 bytes leftover after parsing attributes in process `syz.4.622'. [ 243.916831][ T7925] netlink: 12 bytes leftover after parsing attributes in process `syz.0.614'. [ 243.926233][ T7925] netlink: 48 bytes leftover after parsing attributes in process `syz.0.614'. [ 244.214988][ T7951] tipc: Started in network mode [ 244.227826][ T7951] tipc: Node identity 0000000000000000212e004, cluster identity 4711 [ 244.820672][ T43] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 244.980675][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 245.029474][ T43] usb 4-1: config 0 has an invalid interface number: 12 but max is 2 [ 245.038630][ T43] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 245.057190][ T43] usb 4-1: config 0 has no interface number 0 [ 245.125871][ T7956] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 245.135757][ T43] usb 4-1: config 0 interface 12 has no altsetting 0 [ 245.163570][ T43] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 245.176692][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.198656][ T43] usb 4-1: Product: syz [ 245.206966][ T43] usb 4-1: Manufacturer: syz [ 245.237202][ T43] usb 4-1: SerialNumber: syz [ 245.304172][ T43] usb 4-1: config 0 descriptor?? [ 245.410669][ T7962] netlink: 24 bytes leftover after parsing attributes in process `syz.2.628'. [ 245.458316][ T7963] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 245.847182][ T5939] usb 1-1: USB disconnect, device number 22 [ 246.007138][ T7977] binder: 7975:7977 ioctl 4010640d 200000000280 returned -22 [ 246.540745][ T24] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 246.735993][ T24] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 246.754680][ T24] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 246.788065][ T24] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 246.825706][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 246.879246][ T24] usb 1-1: SerialNumber: syz [ 247.192131][ T24] usb 1-1: 0:2 : does not exist [ 247.334636][ T24] usb 1-1: USB disconnect, device number 23 [ 247.453568][ T5922] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 247.539087][ T43] f81534 4-1:0.12: required endpoints missing [ 247.633375][ T7995] udevd[7995]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 247.656048][ T43] usb 4-1: USB disconnect, device number 13 [ 247.794899][ T5922] usb 3-1: config 0 has no interfaces? [ 247.840721][ T5922] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 247.899783][ T5922] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 247.991615][ T8004] netlink: 12 bytes leftover after parsing attributes in process `syz.1.638'. [ 248.089470][ T5922] usb 3-1: Product: syz [ 248.102539][ T5922] usb 3-1: Manufacturer: syz [ 248.160650][ T5922] usb 3-1: SerialNumber: syz [ 248.220972][ T5922] usb 3-1: config 0 descriptor?? [ 248.293007][ T8008] netlink: 28 bytes leftover after parsing attributes in process `syz.0.641'. [ 249.021847][ T9] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 249.363465][ T9] usb 4-1: config 0 has no interfaces? [ 249.474049][ T9] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 249.490852][ T43] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 249.491052][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.507352][ T9] usb 4-1: Product: syz [ 249.511620][ T9] usb 4-1: Manufacturer: syz [ 249.516285][ T9] usb 4-1: SerialNumber: syz [ 249.531394][ T9] usb 4-1: config 0 descriptor?? [ 249.787065][ T8013] netlink: 12 bytes leftover after parsing attributes in process `syz.3.642'. [ 249.796716][ T8013] netlink: 48 bytes leftover after parsing attributes in process `syz.3.642'. [ 249.843291][ T43] usb 1-1: config 0 has no interfaces? [ 249.865250][ T43] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 249.880639][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.900919][ T43] usb 1-1: Product: syz [ 249.909390][ T43] usb 1-1: Manufacturer: syz [ 249.921488][ T43] usb 1-1: SerialNumber: syz [ 250.009783][ T43] usb 1-1: config 0 descriptor?? [ 252.619522][ T24] usb 1-1: USB disconnect, device number 24 [ 252.635052][ T5923] usb 3-1: USB disconnect, device number 25 [ 252.820995][ T43] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 252.835014][ T8044] netlink: 8 bytes leftover after parsing attributes in process `syz.1.650'. [ 252.895668][ T8044] hsr0: entered promiscuous mode [ 253.000924][ T43] usb 5-1: Using ep0 maxpacket: 32 [ 253.014090][ T43] usb 5-1: config 0 has an invalid interface number: 12 but max is 2 [ 253.050988][ T43] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 253.079055][ T43] usb 5-1: config 0 has no interface number 0 [ 253.086389][ T43] usb 5-1: config 0 interface 12 has no altsetting 0 [ 253.099470][ T24] usb 4-1: USB disconnect, device number 14 [ 253.168865][ T43] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 253.178919][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.210729][ T43] usb 5-1: Product: syz [ 253.214977][ T43] usb 5-1: Manufacturer: syz [ 253.219614][ T43] usb 5-1: SerialNumber: syz [ 253.255590][ T8051] random: crng reseeded on system resumption [ 253.318634][ T43] usb 5-1: config 0 descriptor?? [ 253.346340][ T8058] input: syz1 as /devices/virtual/input/input12 [ 253.510964][ T5839] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 253.557901][ T8064] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 253.663223][ T5839] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 253.682732][ T5839] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 253.750812][ T5839] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 253.760740][ T8070] netlink: 'syz.0.659': attribute type 10 has an invalid length. [ 253.772302][ T5839] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 253.792530][ T5839] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 253.904964][ T5839] usb 3-1: config 0 descriptor?? [ 254.578253][ T5839] usbhid 3-1:0.0: can't add hid device: -71 [ 254.607267][ T5839] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 254.655305][ T5839] usb 3-1: USB disconnect, device number 26 [ 254.705828][ T30] audit: type=1326 audit(1751106509.595:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8080 comm="syz.0.662" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8140b8e929 code=0x0 [ 254.809193][ T8082] program syz.0.662 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 255.040671][ T5908] usb 2-1: new full-speed USB device number 18 using dummy_hcd [ 255.214955][ T5908] usb 2-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 255.224843][ T5908] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.242820][ T5908] usb 2-1: config 0 descriptor?? [ 255.266029][ T5908] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 255.801890][ T8084] netlink: 156 bytes leftover after parsing attributes in process `syz.1.663'. [ 255.845592][ T43] f81534 5-1:0.12: required endpoints missing [ 255.885311][ T43] usb 5-1: USB disconnect, device number 19 [ 255.891553][ T24] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 256.158394][ T5908] gp8psk: usb in 128 operation failed. [ 256.179562][ T8100] netlink: 8 bytes leftover after parsing attributes in process `syz.0.666'. [ 256.213734][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.220337][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.220742][ T5908] gp8psk: usb in 137 operation failed. [ 256.237789][ T24] usb 3-1: config 0 has no interfaces? [ 256.286365][ T24] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 256.299989][ T5908] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 256.319072][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.350006][ T5908] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 256.368302][ T24] usb 3-1: Product: syz [ 256.395715][ T24] usb 3-1: Manufacturer: syz [ 256.400407][ T24] usb 3-1: SerialNumber: syz [ 256.516898][ T5908] usb 2-1: USB disconnect, device number 18 [ 256.551837][ T24] usb 3-1: config 0 descriptor?? [ 256.884593][ T8091] netlink: 12 bytes leftover after parsing attributes in process `syz.2.664'. [ 256.894157][ T8091] netlink: 48 bytes leftover after parsing attributes in process `syz.2.664'. [ 256.988358][ T8113] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 256.994946][ T8113] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 257.007004][ T8113] vhci_hcd vhci_hcd.0: Device attached [ 257.082444][ T24] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 257.360723][ T24] usb 5-1: device descriptor read/64, error -71 [ 257.940962][ T5923] vhci_hcd: vhci_device speed not set [ 257.961191][ T8114] vhci_hcd: connection closed [ 258.507682][ T49] vhci_hcd: stop threads [ 258.533850][ T24] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 258.549937][ T49] vhci_hcd: release socket [ 258.560771][ T5923] usb 33-1: new full-speed USB device number 2 using vhci_hcd [ 258.664766][ T49] vhci_hcd: disconnect device [ 258.760767][ T24] usb 5-1: device descriptor read/64, error -71 [ 258.901438][ T24] usb usb5-port1: attempt power cycle [ 258.997811][ T9] usb 3-1: USB disconnect, device number 27 [ 259.230087][ T8137] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 259.277718][ T24] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 259.341145][ T24] usb 5-1: device descriptor read/8, error -71 [ 259.469418][ T8148] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 259.612616][ T24] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 259.691404][ T24] usb 5-1: device descriptor read/8, error -71 [ 259.701948][ T8153] tipc: Cannot configure node identity twice [ 259.845334][ T24] usb usb5-port1: unable to enumerate USB device [ 261.130677][ T5908] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 261.491857][ T8178] netlink: 'syz.4.683': attribute type 10 has an invalid length. [ 261.499661][ T8178] netlink: 40 bytes leftover after parsing attributes in process `syz.4.683'. [ 261.569545][ T5908] usb 2-1: config 0 has no interfaces? [ 261.587182][ T5908] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 261.596364][ T5908] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.620180][ T5908] usb 2-1: Product: syz [ 261.650754][ T5908] usb 2-1: Manufacturer: syz [ 261.689777][ T5908] usb 2-1: SerialNumber: syz [ 261.819554][ T5908] usb 2-1: config 0 descriptor?? [ 261.957946][ T8178] bridge0: port 3(dummy0) entered blocking state [ 262.035709][ T8178] bridge0: port 3(dummy0) entered disabled state [ 262.069914][ T8178] dummy0: entered allmulticast mode [ 262.101925][ T8178] dummy0: entered promiscuous mode [ 262.107943][ T8178] bridge0: port 3(dummy0) entered blocking state [ 262.114507][ T8178] bridge0: port 3(dummy0) entered forwarding state [ 262.215290][ T8174] netlink: 12 bytes leftover after parsing attributes in process `syz.1.685'. [ 262.265184][ T8174] netlink: 48 bytes leftover after parsing attributes in process `syz.1.685'. [ 262.959562][ T8194] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 262.966249][ T8194] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 263.092075][ T8194] vhci_hcd vhci_hcd.0: Device attached [ 263.463207][ T8205] netlink: 14 bytes leftover after parsing attributes in process `syz.0.691'. [ 263.918732][ T978] usb 2-1: USB disconnect, device number 19 [ 264.049195][ T8197] vhci_hcd: connection reset by peer [ 264.087406][ T2937] vhci_hcd: stop threads [ 264.139637][ T2937] vhci_hcd: release socket [ 264.153495][ T2937] vhci_hcd: disconnect device [ 264.220751][ T5923] vhci_hcd: vhci_device speed not set [ 264.588818][ T8218] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 264.888775][ T8225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.699'. [ 265.118354][ T8230] netlink: 12 bytes leftover after parsing attributes in process `syz.1.701'. [ 265.778109][ T30] audit: type=1326 audit(1751106520.675:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8241 comm="syz.0.706" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8140b8e929 code=0x0 [ 265.990911][ T9] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 266.298092][ T9] usb 4-1: config 0 has no interfaces? [ 266.403346][ T9] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 266.420271][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.641519][ T9] usb 4-1: Product: syz [ 266.645838][ T9] usb 4-1: Manufacturer: syz [ 266.674046][ T9] usb 4-1: SerialNumber: syz [ 266.743515][ T9] usb 4-1: config 0 descriptor?? [ 267.057170][ T8246] netlink: 12 bytes leftover after parsing attributes in process `syz.3.704'. [ 267.066525][ T8246] netlink: 48 bytes leftover after parsing attributes in process `syz.3.704'. [ 268.206922][ T8274] netlink: 12 bytes leftover after parsing attributes in process `syz.1.711'. [ 269.676821][ T8287] netlink: 12 bytes leftover after parsing attributes in process `syz.0.716'. [ 269.973418][ T9] usb 4-1: USB disconnect, device number 15 [ 270.128364][ T8294] netlink: 8 bytes leftover after parsing attributes in process `syz.3.718'. [ 270.165799][ T8296] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 270.517584][ T8311] netlink: 24 bytes leftover after parsing attributes in process `syz.3.724'. [ 270.547330][ T8311] netlink: 4 bytes leftover after parsing attributes in process `syz.3.724'. [ 270.690962][ T9] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 270.862659][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 270.875557][ T9] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 270.887198][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.918179][ T9] usb 3-1: config 0 descriptor?? [ 271.116322][ T8323] netlink: 64 bytes leftover after parsing attributes in process `syz.4.727'. [ 271.291769][ T8326] netlink: 'syz.0.729': attribute type 13 has an invalid length. [ 271.370676][ T5939] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 271.580967][ T5939] usb 2-1: config 0 has no interfaces? [ 271.659914][ T5923] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 271.670053][ T5939] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 271.716766][ T5939] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.750567][ T5939] usb 2-1: Product: syz [ 272.115876][ T8333] netlink: 12 bytes leftover after parsing attributes in process `syz.0.731'. [ 272.252448][ T5939] usb 2-1: Manufacturer: syz [ 272.280915][ T5939] usb 2-1: SerialNumber: syz [ 272.320273][ T5939] usb 2-1: config 0 descriptor?? [ 272.559419][ T8324] netlink: 12 bytes leftover after parsing attributes in process `syz.1.728'. [ 272.568868][ T8324] netlink: 48 bytes leftover after parsing attributes in process `syz.1.728'. [ 272.655231][ T8336] input: syz0 as /devices/virtual/input/input13 [ 272.702694][ T8335] binder_alloc: binder_alloc_mmap_handler: 8334 200000ffd000-200001000000 already mapped failed -16 [ 272.728940][ T8336] binder_alloc: 8334: binder_alloc_buf, no vma [ 273.910398][ T8354] netlink: 12 bytes leftover after parsing attributes in process `syz.4.737'. [ 273.974203][ T8357] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 274.042477][ T8362] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (65536) [ 274.053078][ T8362] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535 [ 274.067910][ T9] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 274.084356][ T9] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0088: ffffffb9 [ 274.105060][ T9] asix 3-1:0.0: probe with driver asix failed with error -71 [ 274.134463][ T9] usb 3-1: USB disconnect, device number 28 [ 274.193288][ T24] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 274.222469][ T8366] loop9: detected capacity change from 0 to 7 [ 274.238223][ T8366] Dev loop9: unable to read RDB block 7 [ 274.245912][ T8366] loop9: unable to read partition table [ 274.260912][ T8366] loop9: partition table beyond EOD, truncated [ 274.277409][ T8366] loop_reread_partitions: partition scan of loop9 (被x ) failed (rc=-5) [ 274.332663][ T9] usb 2-1: USB disconnect, device number 20 [ 274.381223][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 274.396395][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 274.419877][ T24] usb 4-1: New USB device found, idVendor=0b05, idProduct=17e0, bcdDevice= 0.00 [ 274.432255][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 274.448427][ T24] usb 4-1: config 0 descriptor?? [ 274.508639][ T8371] netlink: 8 bytes leftover after parsing attributes in process `syz.4.743'. [ 274.693734][ T24] usbhid 4-1:0.0: can't add hid device: -71 [ 274.707965][ T24] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 274.726429][ T24] usb 4-1: USB disconnect, device number 16 [ 274.746783][ T8374] netlink: 24 bytes leftover after parsing attributes in process `syz.4.744'. [ 274.794745][ T43] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 274.955299][ T43] usb 2-1: Using ep0 maxpacket: 16 [ 274.977450][ T43] usb 2-1: unable to get BOS descriptor or descriptor too short [ 275.010210][ T43] usb 2-1: config 8 has an invalid interface number: 64 but max is 0 [ 275.050705][ T43] usb 2-1: config 8 has no interface number 0 [ 275.061711][ T43] usb 2-1: config 8 interface 64 altsetting 2 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 275.100655][ T43] usb 2-1: config 8 interface 64 has no altsetting 0 [ 275.122577][ T43] usb 2-1: New USB device found, idVendor=19d2, idProduct=64c6, bcdDevice= e.34 [ 275.132313][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.161012][ T43] usb 2-1: Product: syz [ 275.180771][ T43] usb 2-1: Manufacturer: syz [ 275.194159][ T43] usb 2-1: SerialNumber: syz [ 275.451649][ T43] cdc_ether 2-1:8.64: invalid descriptor buffer length [ 275.472301][ T43] usb 2-1: bad CDC descriptors [ 275.497791][ T43] usb 2-1: USB disconnect, device number 21 [ 276.344140][ T5923] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 276.699576][ T5923] usb 4-1: config 0 has no interfaces? [ 276.736022][ T5923] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 276.788240][ T5923] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.918387][ T5923] usb 4-1: Product: syz [ 276.940594][ T5923] usb 4-1: Manufacturer: syz [ 277.002387][ T5923] usb 4-1: SerialNumber: syz [ 277.020362][ T5923] usb 4-1: config 0 descriptor?? [ 277.496682][ T8400] netlink: 12 bytes leftover after parsing attributes in process `syz.3.752'. [ 277.506099][ T8400] netlink: 48 bytes leftover after parsing attributes in process `syz.3.752'. [ 277.708040][ T8419] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 278.890102][ T8422] netlink: 'syz.0.758': attribute type 10 has an invalid length. [ 279.176795][ T43] usb 4-1: USB disconnect, device number 17 [ 279.399501][ T8436] input: syz0 as /devices/virtual/input/input14 [ 279.820806][ T5923] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 280.010885][ T5923] usb 1-1: Using ep0 maxpacket: 32 [ 280.483518][ T5923] usb 1-1: config 0 has an invalid interface number: 149 but max is 0 [ 280.510958][ T5923] usb 1-1: config 0 has no interface number 0 [ 280.533584][ T5923] usb 1-1: config 0 interface 149 altsetting 0 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 280.632277][ T5923] usb 1-1: config 0 interface 149 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 280.706621][ T5923] usb 1-1: New USB device found, idVendor=0c72, idProduct=0013, bcdDevice=44.19 [ 280.736784][ T5923] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 280.766560][ T5923] usb 1-1: Product: syz [ 280.777259][ T5923] usb 1-1: Manufacturer: syz [ 280.800811][ T5923] usb 1-1: SerialNumber: syz [ 280.825948][ T8458] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 280.861481][ T5923] usb 1-1: config 0 descriptor?? [ 281.021546][ T8461] fuse: Bad value for 'user_id' [ 281.027395][ T8461] fuse: Bad value for 'user_id' [ 282.102969][ T8476] netlink: 8 bytes leftover after parsing attributes in process `syz.3.774'. [ 282.268253][ T5923] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 283.277195][ T5908] usb 1-1: USB disconnect, device number 26 [ 283.406588][ T5923] usb 2-1: config 0 has no interfaces? [ 283.468773][ T5923] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 283.500799][ T5923] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 283.508866][ T5923] usb 2-1: Product: syz [ 283.539124][ T5923] usb 2-1: Manufacturer: syz [ 283.553668][ T5923] usb 2-1: SerialNumber: syz [ 283.573516][ T8490] openvswitch: netlink: Duplicate or invalid key (type 0). [ 283.581090][ T8490] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 283.603992][ T978] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 283.637783][ T5923] usb 2-1: config 0 descriptor?? [ 283.832394][ T978] usb 3-1: config 0 has an invalid interface number: 117 but max is 0 [ 283.849465][ T978] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 283.932538][ T978] usb 3-1: config 0 has no interface number 0 [ 283.957780][ T978] usb 3-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 283.970759][ T978] usb 3-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 283.986872][ T978] usb 3-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 284.002386][ T978] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.011201][ T978] usb 3-1: Product: syz [ 284.015404][ T978] usb 3-1: Manufacturer: syz [ 284.020110][ T978] usb 3-1: SerialNumber: syz [ 284.043583][ T978] usb 3-1: config 0 descriptor?? [ 284.112550][ T8472] netlink: 12 bytes leftover after parsing attributes in process `syz.1.773'. [ 284.122153][ T8472] netlink: 48 bytes leftover after parsing attributes in process `syz.1.773'. [ 284.535907][ T978] usb 3-1: USB disconnect, device number 29 [ 284.869560][ T8497] macvlan2: entered promiscuous mode [ 285.259360][ T8503] netlink: 28 bytes leftover after parsing attributes in process `syz.2.784'. [ 285.587453][ T8509] netlink: 'syz.4.787': attribute type 13 has an invalid length. [ 285.978779][ T5923] usb 2-1: USB disconnect, device number 22 [ 286.200725][ T5939] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 286.360952][ T5939] usb 1-1: Using ep0 maxpacket: 16 [ 286.383829][ T5939] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 286.419556][ T5939] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 286.437575][ T5939] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 286.459168][ T5939] usb 1-1: New USB device found, idVendor=054c, idProduct=0268, bcdDevice= 0.00 [ 286.459664][ T8530] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(12) [ 286.473420][ T5939] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 286.475030][ T8530] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 286.505491][ T8530] vhci_hcd vhci_hcd.0: Device attached [ 286.528002][ T8535] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(15) [ 286.528972][ T5939] usb 1-1: config 0 descriptor?? [ 286.534827][ T8535] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 286.548013][ T8535] vhci_hcd vhci_hcd.0: Device attached [ 286.577441][ T8530] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(14) [ 286.584123][ T8530] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 286.614967][ T8530] vhci_hcd vhci_hcd.0: Device attached [ 286.641840][ T8535] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 286.709199][ T8530] vhci_hcd vhci_hcd.0: pdev(3) rhport(4) sockfd(18) [ 286.715968][ T8530] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 286.750708][ T43] usb 39-1: new low-speed USB device number 2 using vhci_hcd [ 286.771115][ T8535] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 286.788237][ T8530] vhci_hcd vhci_hcd.0: Device attached [ 286.796962][ T8530] vhci_hcd vhci_hcd.0: pdev(3) rhport(6) sockfd(22) [ 286.803628][ T8530] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 286.900723][ T8530] vhci_hcd vhci_hcd.0: Device attached [ 286.915068][ T8530] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 286.990923][ T8535] vhci_hcd vhci_hcd.0: port 0 already used [ 287.027349][ T5939] sony 0003:054C:0268.0004: unknown main item tag 0x0 [ 287.045710][ T5939] sony 0003:054C:0268.0004: unknown main item tag 0x0 [ 287.058334][ T8544] vhci_hcd: connection closed [ 287.058452][ T8536] vhci_hcd: connection closed [ 287.059491][ T8533] vhci_hcd: connection reset by peer [ 287.074143][ T8540] vhci_hcd: connection closed [ 287.080959][ T36] vhci_hcd: stop threads [ 287.094487][ T36] vhci_hcd: release socket [ 287.100009][ T36] vhci_hcd: disconnect device [ 287.109567][ T8548] vhci_hcd: connection closed [ 287.113324][ T36] vhci_hcd: stop threads [ 287.127141][ T5939] sony 0003:054C:0268.0004: hiddev0,hidraw0: USB HID v80.00 Device [HID 054c:0268] on usb-dummy_hcd.0-1/input0 [ 287.159861][ T36] vhci_hcd: release socket [ 287.175092][ T5939] sony 0003:054C:0268.0004: failed to claim input [ 287.177888][ T36] vhci_hcd: disconnect device [ 287.203081][ T8561] netlink: 8 bytes leftover after parsing attributes in process `syz.2.804'. [ 287.221208][ T36] vhci_hcd: stop threads [ 287.225944][ T36] vhci_hcd: release socket [ 287.230431][ T36] vhci_hcd: disconnect device [ 287.255052][ T5939] usb 1-1: USB disconnect, device number 27 [ 287.268486][ T36] vhci_hcd: stop threads [ 287.294251][ T36] vhci_hcd: release socket [ 287.318766][ T36] vhci_hcd: disconnect device [ 287.329158][ T36] vhci_hcd: stop threads [ 287.338933][ T36] vhci_hcd: release socket [ 287.349142][ T36] vhci_hcd: disconnect device [ 287.389834][ T8562] fido_id[8562]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 287.599366][ T8571] netlink: 4 bytes leftover after parsing attributes in process `syz.2.809'. [ 288.108983][ T8584] team0: Port device bond0 removed [ 288.116488][ T8584] dummy0: left allmulticast mode [ 288.131354][ T8584] dummy0: left promiscuous mode [ 288.137819][ T8584] bridge0: port 3(dummy0) entered disabled state [ 288.241757][ T8598] netlink: 4 bytes leftover after parsing attributes in process `syz.1.816'. [ 288.316324][ T8584] bridge_slave_0: left allmulticast mode [ 288.324914][ T8584] bridge_slave_0: left promiscuous mode [ 288.331860][ T8584] bridge0: port 1(bridge_slave_0) entered disabled state [ 288.522146][ T8598] netlink: 8 bytes leftover after parsing attributes in process `syz.1.816'. [ 288.542762][ T8598] netlink: 'syz.1.816': attribute type 5 has an invalid length. [ 288.569491][ T8598] netlink: 20 bytes leftover after parsing attributes in process `syz.1.816'. [ 288.617700][ T8584] bridge_slave_1: left allmulticast mode [ 288.651055][ T8584] bridge_slave_1: left promiscuous mode [ 288.667276][ T8584] bridge0: port 2(bridge_slave_1) entered disabled state [ 288.721807][ T8584] bond0: (slave bond_slave_0): Releasing backup interface [ 288.744461][ T8584] bond0: (slave bond_slave_1): Releasing backup interface [ 288.843613][ T8584] team0: Port device team_slave_0 removed [ 289.192127][ T8584] team0: Port device team_slave_1 removed [ 289.252871][ T8584] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 289.307856][ T8584] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 289.332104][ T8584] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 289.348489][ T8584] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 289.509523][ T8598] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 289.555869][ T8598] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 289.596301][ T8598] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 289.644033][ T8598] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 289.765615][ T8598] geneve2: entered promiscuous mode [ 289.779911][ T8598] geneve2: entered allmulticast mode [ 290.201199][ T8606] pim6reg: entered allmulticast mode [ 290.242281][ T8608] pim6reg: left allmulticast mode [ 290.479105][ T5922] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 290.812583][ T5922] usb 1-1: config 0 has no interfaces? [ 290.865379][ T5922] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 290.933036][ T5922] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.995075][ T5922] usb 1-1: Product: syz [ 290.999315][ T5922] usb 1-1: Manufacturer: syz [ 291.018979][ T5922] usb 1-1: SerialNumber: syz [ 291.061811][ T5922] usb 1-1: config 0 descriptor?? [ 291.188889][ T8626] capability: warning: `syz.3.824' uses deprecated v2 capabilities in a way that may be insecure [ 291.310996][ T24] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 291.414494][ T8612] can: request_module (can-proto-0) failed. [ 291.523108][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 291.530071][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 291.543834][ T24] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 291.565163][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.589065][ T24] usb 2-1: config 0 descriptor?? [ 291.975323][ T24] usbhid 2-1:0.0: can't add hid device: -71 [ 292.066321][ T43] vhci_hcd: vhci_device speed not set [ 292.081926][ T24] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 292.103490][ T24] usb 2-1: USB disconnect, device number 23 [ 292.764781][ T8646] tipc: Started in network mode [ 292.819997][ T8646] tipc: Node identity , cluster identity 4711 [ 293.092946][ T5939] usb 1-1: USB disconnect, device number 28 [ 293.245830][ T8659] netlink: 28 bytes leftover after parsing attributes in process `syz.0.835'. [ 293.386466][ T8669] netlink: 277 bytes leftover after parsing attributes in process `syz.3.839'. [ 293.575139][ T8677] tipc: Started in network mode [ 293.580161][ T8677] tipc: Node identity , cluster identity 4711 [ 293.741527][ T8684] netlink: 32 bytes leftover after parsing attributes in process `syz.4.845'. [ 293.885361][ T8691] netlink: 24 bytes leftover after parsing attributes in process `syz.4.846'. [ 294.370693][ T24] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 294.569534][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 294.590911][ T24] usb 3-1: config index 0 descriptor too short (expected 65316, got 36) [ 294.599603][ T24] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 294.640814][ T24] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 294.650131][ T24] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 294.738900][ T24] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 294.780728][ T24] usb 3-1: config 0 interface 0 has no altsetting 0 [ 294.787428][ T24] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 294.847637][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 294.898317][ T24] usb 3-1: config 0 descriptor?? [ 295.409705][ T8716] netlink: 4 bytes leftover after parsing attributes in process `syz.0.853'. [ 295.432001][ T24] hid (null): unknown global tag 0xc [ 295.468275][ T24] hid (null): report_id 0 is invalid [ 295.480374][ T24] hid (null): unknown global tag 0xe [ 295.488462][ T24] hid (null): unknown global tag 0xc [ 295.498210][ T24] hid (null): unknown global tag 0xd [ 295.513519][ T8719] tipc: Started in network mode [ 295.518448][ T8719] tipc: Node identity , cluster identity 4711 [ 295.542618][ T24] hid (null): report_id 3636381312 is invalid [ 295.575687][ T24] hid (null): unknown global tag 0xe [ 295.611079][ T24] hid (null): invalid report_size 15733 [ 295.650860][ T24] hid (null): global environment stack underflow [ 295.681251][ T24] hid (null): invalid report_size 59091 [ 295.695159][ T24] hid (null): unknown global tag 0xe [ 295.730657][ T24] hid (null): invalid report_size 659322949 [ 295.744041][ T24] hid (null): invalid report_size 40509 [ 295.764338][ T24] hid (null): report_id 49840 is invalid [ 295.855523][ T24] usb 3-1: USB disconnect, device number 30 [ 296.390630][ T24] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 296.454821][ T8735] xt_CT: You must specify a L4 protocol and not use inversions on it [ 296.550628][ T24] usb 4-1: device descriptor read/64, error -71 [ 296.790918][ T24] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 297.126152][ T24] usb 4-1: device descriptor read/64, error -71 [ 297.255576][ T24] usb usb4-port1: attempt power cycle [ 297.620768][ T24] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 297.645153][ T24] usb 4-1: device descriptor read/8, error -71 [ 297.830679][ T5923] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 297.950732][ T24] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 297.991464][ T24] usb 4-1: device descriptor read/8, error -71 [ 298.002596][ T5923] usb 1-1: config 0 has no interfaces? [ 298.041999][ T5923] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 298.051475][ T5923] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.064424][ T5923] usb 1-1: Product: syz [ 298.068695][ T5923] usb 1-1: Manufacturer: syz [ 298.073882][ T5923] usb 1-1: SerialNumber: syz [ 298.093610][ T5923] usb 1-1: config 0 descriptor?? [ 298.140924][ T24] usb usb4-port1: unable to enumerate USB device [ 299.120935][ T5923] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 299.393197][ T5923] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 299.404835][ T5923] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 299.458411][ T5923] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 299.514551][ T5923] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 299.575538][ T8764] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 299.594819][ T5923] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 299.625069][ T8772] netlink: 'syz.4.870': attribute type 13 has an invalid length. [ 299.947118][ T8764] usb usb1: usbfs: interface 0 claimed by hub while 'syz.1.868' sets config #0 [ 300.063703][ T8777] syz_tun: entered promiscuous mode [ 300.120868][ T8777] vlan2: entered promiscuous mode [ 300.506251][ T8786] xt_CT: You must specify a L4 protocol and not use inversions on it [ 300.556821][ T978] usb 1-1: USB disconnect, device number 29 [ 300.839780][ T8790] pim6reg: entered allmulticast mode [ 300.855981][ T8790] pim6reg: left allmulticast mode [ 301.222883][ T8798] netlink: 28 bytes leftover after parsing attributes in process `syz.1.879'. [ 301.879779][ T8805] netlink: 8 bytes leftover after parsing attributes in process `syz.2.882'. [ 302.091917][ T8816] netlink: 12 bytes leftover after parsing attributes in process `syz.4.885'. [ 302.135792][ T8816] bridge5: entered promiscuous mode [ 302.141357][ T8816] bridge5: entered allmulticast mode [ 302.159449][ T8821] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.887'. [ 302.169467][ T8821] netlink: zone id is out of range [ 302.175333][ T8821] netlink: get zone limit has 8 unknown bytes [ 303.485234][ T5922] usb 2-1: USB disconnect, device number 24 [ 304.640705][ T5922] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 304.763930][ T8838] ip6gre1: entered promiscuous mode [ 304.834474][ T5922] usb 1-1: Using ep0 maxpacket: 32 [ 304.842580][ T5922] usb 1-1: unable to get BOS descriptor or descriptor too short [ 304.858216][ T5922] usb 1-1: config 5 has an invalid interface number: 52 but max is 0 [ 304.868524][ T5922] usb 1-1: config 5 has no interface number 0 [ 304.972513][ T5922] usb 1-1: config 5 interface 52 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 305.026234][ T5922] usb 1-1: string descriptor 0 read error: -22 [ 305.089879][ T5922] usb 1-1: New USB device found, idVendor=16ca, idProduct=1502, bcdDevice=51.58 [ 305.114787][ T5922] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.165722][ T8846] FAULT_INJECTION: forcing a failure. [ 305.165722][ T8846] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 305.197432][ T8831] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 305.206871][ T8846] CPU: 1 UID: 0 PID: 8846 Comm: syz.4.894 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 305.206899][ T8846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 305.206911][ T8846] Call Trace: [ 305.206919][ T8846] [ 305.206932][ T8846] dump_stack_lvl+0x189/0x250 [ 305.206967][ T8846] ? __pfx____ratelimit+0x10/0x10 [ 305.206995][ T8846] ? __pfx_dump_stack_lvl+0x10/0x10 [ 305.207024][ T8846] ? __pfx__printk+0x10/0x10 [ 305.207046][ T8846] ? __might_fault+0xb0/0x130 [ 305.207079][ T8846] should_fail_ex+0x414/0x560 [ 305.207109][ T8846] _copy_from_user+0x2d/0xb0 [ 305.207129][ T8846] set_user_sigmask+0xa1/0x1b0 [ 305.207158][ T8846] ? __pfx_set_user_sigmask+0x10/0x10 [ 305.207187][ T8846] ? __fget_files+0x3a0/0x420 [ 305.207217][ T8846] __se_sys_ppoll+0x1ce/0x260 [ 305.207250][ T8846] ? __pfx___se_sys_ppoll+0x10/0x10 [ 305.207269][ T8846] ? __pfx_ksys_write+0x10/0x10 [ 305.207284][ T8846] ? rcu_is_watching+0x15/0xb0 [ 305.207318][ T8846] ? do_syscall_64+0xbe/0x3b0 [ 305.207342][ T8846] ? __x64_sys_ppoll+0x20/0xc0 [ 305.207364][ T8846] do_syscall_64+0xfa/0x3b0 [ 305.207388][ T8846] ? lockdep_hardirqs_on+0x9c/0x150 [ 305.207413][ T8846] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.207433][ T8846] ? clear_bhb_loop+0x60/0xb0 [ 305.207456][ T8846] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.207474][ T8846] RIP: 0033:0x7fae1698e929 [ 305.207492][ T8846] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 305.207509][ T8846] RSP: 002b:00007fae177bb038 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 305.207531][ T8846] RAX: ffffffffffffffda RBX: 00007fae16bb6080 RCX: 00007fae1698e929 [ 305.207546][ T8846] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000100 [ 305.207557][ T8846] RBP: 00007fae177bb090 R08: 0000000000000008 R09: 0000000000000000 [ 305.207569][ T8846] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 305.207581][ T8846] R13: 0000000000000000 R14: 00007fae16bb6080 R15: 00007fae16cdfa28 [ 305.207610][ T8846] [ 305.424333][ T5922] aircable 1-1:5.52: aircable converter detected [ 305.606465][ T5922] usb 1-1: aircable converter now attached to ttyUSB0 [ 305.636366][ T5923] usb 1-1: USB disconnect, device number 30 [ 305.712441][ T5923] aircable ttyUSB0: aircable converter now disconnected from ttyUSB0 [ 305.748484][ T5923] aircable 1-1:5.52: device disconnected [ 306.614077][ T8861] tipc: Started in network mode [ 306.619149][ T8861] tipc: Node identity 0000000000000000002e0040000022, cluster identity 4711 [ 307.104008][ T8872] netlink: 4268 bytes leftover after parsing attributes in process `syz.0.903'. [ 307.149267][ T8872] netlink: 4268 bytes leftover after parsing attributes in process `syz.0.903'. [ 307.259368][ T8878] fuse: Bad value for 'group_id' [ 307.277539][ T8878] fuse: Bad value for 'group_id' [ 307.336144][ T8881] xt_CT: You must specify a L4 protocol and not use inversions on it [ 307.362661][ T8882] netlink: 4 bytes leftover after parsing attributes in process `syz.3.904'. [ 308.317649][ T8894] netlink: 'syz.2.907': attribute type 10 has an invalid length. [ 308.325764][ T8894] netlink: 40 bytes leftover after parsing attributes in process `syz.2.907'. [ 309.855653][ T8932] capability: warning: `syz.1.923' uses 32-bit capabilities (legacy support in use) [ 309.875278][ T43] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 309.891966][ T978] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 310.030634][ T43] usb 3-1: Using ep0 maxpacket: 8 [ 310.038546][ T43] usb 3-1: unable to get BOS descriptor or descriptor too short [ 310.053032][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 310.071557][ T978] usb 4-1: Using ep0 maxpacket: 8 [ 310.078877][ T978] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 310.089115][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 310.089149][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 310.089171][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 310.089194][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 310.089216][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 310.091912][ T43] usb 3-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 310.125336][ T978] usb 4-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 310.159753][ T978] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 310.168705][ T5939] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 310.245924][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 310.252019][ T978] usb 4-1: config 0 descriptor?? [ 310.268102][ T43] usb 3-1: Product: syz [ 310.289442][ T43] usb 3-1: Manufacturer: syz [ 310.303632][ T43] usb 3-1: SerialNumber: syz [ 310.311285][ T978] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 310.332206][ T43] usb 3-1: config 0 descriptor?? [ 310.342537][ T43] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 310.351310][ T5939] usb 1-1: Using ep0 maxpacket: 8 [ 310.359810][ T5939] usb 1-1: unable to get BOS descriptor or descriptor too short [ 310.370325][ T5939] usb 1-1: config 3 has an invalid interface number: 182 but max is 0 [ 310.379902][ T5939] usb 1-1: config 3 has no interface number 0 [ 310.390089][ T5939] usb 1-1: config 3 interface 182 altsetting 8 endpoint 0xF has invalid wMaxPacketSize 0 [ 310.401736][ T5939] usb 1-1: config 3 interface 182 altsetting 8 endpoint 0xA has an invalid bInterval 129, changing to 11 [ 310.413474][ T5939] usb 1-1: config 3 interface 182 altsetting 8 endpoint 0x3 has an invalid bInterval 92, changing to 10 [ 310.531297][ T5939] usb 1-1: config 3 interface 182 has no altsetting 0 [ 310.545674][ T5939] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=90.57 [ 310.555409][ T5939] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 310.595679][ T5939] usb 1-1: Product: syz [ 310.605848][ T5939] usb 1-1: Manufacturer: syz [ 310.621473][ T5939] usb 1-1: SerialNumber: syz [ 310.703774][ T8926] netlink: 28 bytes leftover after parsing attributes in process `syz.2.920'. [ 310.803518][ T8950] netlink: 'syz.4.924': attribute type 10 has an invalid length. [ 310.816707][ T43] usb 3-1: USB disconnect, device number 31 [ 310.877232][ T6333] udevd[6333]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 310.911519][ T5939] usbtest 1-1:3.182: couldn't get endpoints, -71 [ 310.955371][ T5939] usbtest 1-1:3.182: probe with driver usbtest failed with error -71 [ 310.955413][ T8950] netlink: 40 bytes leftover after parsing attributes in process `syz.4.924'. [ 311.054956][ T5939] usb 1-1: USB disconnect, device number 31 [ 311.155334][ T978] gspca_vc032x: reg_w err -71 [ 311.160211][ T978] vc032x 4-1:0.0: probe with driver vc032x failed with error -71 [ 311.190238][ T978] usb 4-1: USB disconnect, device number 22 [ 311.332000][ T8963] netlink: 4 bytes leftover after parsing attributes in process `syz.1.932'. [ 311.433781][ T8966] netlink: 12 bytes leftover after parsing attributes in process `syz.3.931'. [ 311.864952][ T8972] netlink: 4 bytes leftover after parsing attributes in process `syz.0.934'. [ 312.436469][ T978] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 312.800608][ T978] usb 3-1: Using ep0 maxpacket: 32 [ 312.900397][ T978] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 312.911267][ T8981] macvlan3: entered promiscuous mode [ 313.033265][ T978] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 313.163019][ T978] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 313.332623][ T978] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 313.344701][ T8995] loop6: detected capacity change from 0 to 16384 [ 313.423282][ T978] usb 3-1: config 0 descriptor?? [ 313.513749][ T978] hub 3-1:0.0: USB hub found [ 313.795979][ T8998] loop6: detected capacity change from 16384 to 0 [ 313.818931][ C1] I/O error, dev loop6, sector 3840 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 0 [ 315.042424][ T9008] netlink: 20 bytes leftover after parsing attributes in process `syz.1.941'. [ 315.065884][ T9008] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 315.340628][ T5923] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 315.421222][ T978] hub 3-1:0.0: config failed, can't read hub descriptor (err -22) [ 315.464731][ T978] usbhid 3-1:0.0: can't add hid device: -71 [ 315.482847][ T978] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 315.510680][ T5923] usb 2-1: Using ep0 maxpacket: 16 [ 315.519067][ T5923] usb 2-1: config 5 has an invalid interface number: 168 but max is 0 [ 315.529783][ T5923] usb 2-1: config 5 has no interface number 0 [ 315.531751][ T9010] netlink: 4 bytes leftover after parsing attributes in process `syz.2.942'. [ 315.540595][ T978] usb 3-1: USB disconnect, device number 32 [ 315.546159][ T9010] netlink: 'syz.2.942': attribute type 13 has an invalid length. [ 315.560603][ T5923] usb 2-1: config 5 interface 168 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 315.570156][ T9010] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 315.591024][ T5923] usb 2-1: config 5 interface 168 altsetting 7 endpoint 0x8B has invalid maxpacket 64768, setting to 1024 [ 315.613325][ T9010] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 315.621027][ T5923] usb 2-1: config 5 interface 168 altsetting 7 bulk endpoint 0x8B has invalid maxpacket 1024 [ 315.627112][ T9010] gretap1: entered promiscuous mode [ 315.639065][ T9010] gretap1: entered allmulticast mode [ 315.645627][ T5923] usb 2-1: config 5 interface 168 altsetting 7 bulk endpoint 0x4 has invalid maxpacket 1023 [ 315.676117][ T5923] usb 2-1: config 5 interface 168 has no altsetting 0 [ 315.693554][ T5923] usb 2-1: New USB device found, idVendor=04cc, idProduct=2533, bcdDevice=fc.58 [ 315.707322][ T5923] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.737173][ T5923] usb 2-1: Product: syz [ 315.756939][ T5923] usb 2-1: Manufacturer: syz [ 315.770583][ T5923] usb 2-1: SerialNumber: syz [ 315.784300][ T9008] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 315.800819][ T9008] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 316.055154][ C0] usb 2-1: NFC: Urb failure (status -71) [ 316.085262][ T9019] netlink: 4 bytes leftover after parsing attributes in process `syz.2.945'. [ 316.135094][ C0] usb 2-1: NFC: Urb failure (status -71) [ 316.148697][ T5923] usb 2-1: NFC: Unable to get FW version [ 316.181295][ T5923] pn533_usb 2-1:5.168: probe with driver pn533_usb failed with error -71 [ 316.200459][ T5923] usb 2-1: USB disconnect, device number 25 [ 316.217611][ T9021] netlink: 16 bytes leftover after parsing attributes in process `syz.0.946'. [ 316.275989][ T9021] bond0: entered promiscuous mode [ 316.301094][ T9021] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 316.311477][ T9021] bond0: left promiscuous mode [ 317.634489][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.655038][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.990728][ T978] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 318.162964][ T978] usb 5-1: not running at top speed; connect to a high speed hub [ 318.173870][ T978] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 318.190008][ T978] usb 5-1: config 0 has no interface number 0 [ 318.207674][ T978] usb 5-1: config 0 interface 1 has no altsetting 0 [ 318.223828][ T978] usb 5-1: New USB device found, idVendor=041e, idProduct=0005, bcdDevice=58.e0 [ 318.236730][ T978] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.252076][ T978] usb 5-1: Product: syz [ 318.257490][ T978] usb 5-1: Manufacturer: syz [ 318.263503][ T978] usb 5-1: SerialNumber: syz [ 318.296553][ T978] usb 5-1: config 0 descriptor?? [ 318.623437][ T978] snd-usb-audio 5-1:0.1: probe with driver snd-usb-audio failed with error -22 [ 318.640990][ T5923] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 318.657016][ T978] usb 5-1: USB disconnect, device number 24 [ 318.717913][ T7995] udevd[7995]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 318.800805][ T5923] usb 4-1: Using ep0 maxpacket: 8 [ 318.812568][ T5923] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 318.824384][ T5923] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 318.835034][ T5939] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 318.847962][ T5923] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 318.866216][ T5923] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 318.875459][ T5923] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.900655][ T5923] usb 4-1: Manufacturer: ೵侻ਙȯﺨ╹沛ꁋ [ 319.003082][ T5939] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 319.013926][ T9068] netlink: 36 bytes leftover after parsing attributes in process `syz.2.960'. [ 319.021585][ T5939] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 319.038670][ T5939] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 319.040605][ T43] usb 2-1: new full-speed USB device number 26 using dummy_hcd [ 319.048677][ T5939] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 319.064589][ T5939] usb 1-1: Manufacturer: syz [ 319.074018][ T5939] usb 1-1: config 0 descriptor?? [ 319.234629][ T9074] netlink: 4 bytes leftover after parsing attributes in process `syz.2.962'. [ 319.253210][ T43] usb 2-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 319.265319][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.287122][ T43] usb 2-1: Product: syz [ 319.299072][ T5939] rc_core: IR keymap rc-hauppauge not found [ 319.304164][ T43] usb 2-1: Manufacturer: syz [ 319.330782][ T43] usb 2-1: SerialNumber: syz [ 319.343455][ T5939] Registered IR keymap rc-empty [ 319.366324][ T5939] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 319.390745][ T43] usb 2-1: config 0 descriptor?? [ 319.434409][ T5939] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input16 [ 319.800615][ T43] airspy 2-1:0.0: usb_control_msg() failed -71 request 09 [ 319.818922][ T43] airspy 2-1:0.0: Could not detect board [ 319.827912][ T43] airspy 2-1:0.0: probe with driver airspy failed with error -71 [ 319.857718][ T43] usb 2-1: USB disconnect, device number 26 [ 319.924919][ T24] usb 1-1: USB disconnect, device number 32 [ 321.031249][ T10] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 321.190618][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 321.227911][ T10] usb 1-1: config 0 has an invalid interface number: 12 but max is 2 [ 321.237999][ T5923] usb 4-1: 0:2 : does not exist [ 321.260763][ T10] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 321.311488][ T10] usb 1-1: config 0 has no interface number 0 [ 321.330824][ T10] usb 1-1: config 0 interface 12 has no altsetting 0 [ 321.370627][ T10] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 321.382107][ T5923] usb 4-1: USB disconnect, device number 23 [ 321.405914][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.434343][ T7995] udevd[7995]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 321.447476][ T10] usb 1-1: Product: syz [ 321.454652][ T5908] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 321.462345][ T10] usb 1-1: Manufacturer: syz [ 321.490114][ T9122] netlink: 4 bytes leftover after parsing attributes in process `syz.4.977'. [ 321.715052][ T10] usb 1-1: SerialNumber: syz [ 321.719015][ T5908] usb 3-1: Using ep0 maxpacket: 32 [ 321.734644][ T10] usb 1-1: config 0 descriptor?? [ 321.800132][ T5908] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 321.809526][ T5908] usb 3-1: config 0 has no interface number 0 [ 321.821301][ T5923] usb 4-1: new full-speed USB device number 24 using dummy_hcd [ 321.831597][ T5908] usb 3-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 321.867961][ T5908] usb 3-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 321.882938][ T5908] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.898523][ T5908] usb 3-1: Product: syz [ 321.916565][ T5908] usb 3-1: Manufacturer: syz [ 321.930157][ T5908] usb 3-1: SerialNumber: syz [ 321.946688][ T5908] usb 3-1: config 0 descriptor?? [ 321.975104][ T5908] em28xx 3-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 321.983061][ T5923] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 321.998039][ T5923] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 322.010829][ T5908] em28xx 3-1:0.132: Video interface 132 found: [ 322.017066][ T9131] binder: 9108:9131 ioctl c0306201 0 returned -14 [ 322.030259][ T9131] binder: 9108:9131 ioctl c02464bb 200000000180 returned -22 [ 322.133674][ T5923] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 322.188735][ T5923] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 322.382181][ T5908] em28xx 3-1:0.132: unknown em28xx chip ID (0) [ 322.448311][ T9134] netlink: 12 bytes leftover after parsing attributes in process `syz.4.979'. [ 322.644068][ T5923] usb 4-1: usb_control_msg returned -32 [ 322.649796][ T5923] usbtmc 4-1:16.0: can't read capabilities [ 322.820262][ T9138] macvtap0: mtu less than device minimum [ 322.845920][ T9138] macvtap1: mtu less than device minimum [ 322.870981][ T9138] netlink: 'syz.2.975': attribute type 10 has an invalid length. [ 323.561189][ T5908] em28xx 3-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 323.584910][ T9116] em28xx 3-1:0.132: failed to trigger read from i2c address 0xba (error=-5) [ 323.609910][ T5908] em28xx 3-1:0.132: board has no eeprom [ 323.681368][ T5908] em28xx 3-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 323.689355][ T5908] em28xx 3-1:0.132: analog set to bulk mode. [ 323.747493][ T43] em28xx 3-1:0.132: Registering V4L2 extension [ 323.798283][ T10] f81534 1-1:0.12: required endpoints missing [ 323.854337][ T10] usb 1-1: USB disconnect, device number 33 [ 323.944406][ T9149] netlink: 'syz.4.981': attribute type 10 has an invalid length. [ 323.952360][ T9149] netlink: 40 bytes leftover after parsing attributes in process `syz.4.981'. [ 324.024934][ T43] em28xx 3-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 324.072797][ T43] em28xx 3-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 324.091804][ T43] em28xx 3-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 324.101759][ T43] em28xx 3-1:0.132: failed to trigger read from i2c address 0x40 (error=-5) [ 324.122949][ T9151] FAULT_INJECTION: forcing a failure. [ 324.122949][ T9151] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 324.164773][ T9151] CPU: 0 UID: 0 PID: 9151 Comm: syz.0.983 Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 324.164803][ T9151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 324.164814][ T9151] Call Trace: [ 324.164822][ T9151] [ 324.164831][ T9151] dump_stack_lvl+0x189/0x250 [ 324.164867][ T9151] ? __pfx____ratelimit+0x10/0x10 [ 324.164896][ T9151] ? __pfx_dump_stack_lvl+0x10/0x10 [ 324.164925][ T9151] ? __pfx__printk+0x10/0x10 [ 324.164960][ T9151] should_fail_ex+0x414/0x560 [ 324.164990][ T9151] _copy_to_user+0x31/0xb0 [ 324.165010][ T9151] simple_read_from_buffer+0xe1/0x170 [ 324.165038][ T9151] proc_fail_nth_read+0x1df/0x250 [ 324.165067][ T9151] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 324.165094][ T9151] ? rw_verify_area+0x258/0x650 [ 324.165124][ T9151] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 324.165149][ T9151] vfs_read+0x200/0x980 [ 324.165185][ T9151] ? __pfx___mutex_lock+0x10/0x10 [ 324.165216][ T9151] ? __pfx_vfs_read+0x10/0x10 [ 324.165246][ T9151] ? __fget_files+0x2a/0x420 [ 324.165273][ T9151] ? __fget_files+0x3a0/0x420 [ 324.165295][ T9151] ? __fget_files+0x2a/0x420 [ 324.165327][ T9151] ksys_read+0x145/0x250 [ 324.165359][ T9151] ? __pfx_ksys_read+0x10/0x10 [ 324.165396][ T9151] ? rcu_is_watching+0x15/0xb0 [ 324.165433][ T9151] ? do_syscall_64+0xbe/0x3b0 [ 324.165466][ T9151] do_syscall_64+0xfa/0x3b0 [ 324.165492][ T9151] ? lockdep_hardirqs_on+0x9c/0x150 [ 324.165519][ T9151] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 324.165540][ T9151] ? clear_bhb_loop+0x60/0xb0 [ 324.165564][ T9151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 324.165583][ T9151] RIP: 0033:0x7f8140b8d33c [ 324.165602][ T9151] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 324.165621][ T9151] RSP: 002b:00007f8141a4a030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 324.165644][ T9151] RAX: ffffffffffffffda RBX: 00007f8140db6080 RCX: 00007f8140b8d33c [ 324.165659][ T9151] RDX: 000000000000000f RSI: 00007f8141a4a0a0 RDI: 0000000000000005 [ 324.165672][ T9151] RBP: 00007f8141a4a090 R08: 0000000000000000 R09: 0000000000000000 [ 324.165685][ T9151] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 324.165697][ T9151] R13: 0000000000000000 R14: 00007f8140db6080 R15: 00007f8140edfa28 [ 324.165730][ T9151] [ 324.405137][ C0] vkms_vblank_simulate: vblank timer overrun [ 324.660718][ T43] em28xx 3-1:0.132: failed to trigger read from i2c address 0x84 (error=-5) [ 324.750965][ T43] em28xx 3-1:0.132: failed to trigger read from i2c address 0x86 (error=-5) [ 324.779865][ T9160] netlink: 4 bytes leftover after parsing attributes in process `syz.0.985'. [ 324.785183][ T43] em28xx 3-1:0.132: failed to trigger read from i2c address 0x94 (error=-5) [ 324.812906][ T10] usb 4-1: USB disconnect, device number 24 [ 324.877052][ T43] em28xx 3-1:0.132: failed to trigger read from i2c address 0x96 (error=-5) [ 324.923066][ T5908] usb 3-1: USB disconnect, device number 33 [ 324.933313][ T5908] em28xx 3-1:0.132: Disconnecting em28xx [ 325.118741][ T9173] netlink: 4 bytes leftover after parsing attributes in process `syz.2.989'. [ 325.146056][ T43] em28xx 3-1:0.132: Config register raw data: 0xffffffed [ 325.208097][ T43] em28xx 3-1:0.132: AC97 chip type couldn't be determined [ 325.244391][ T43] em28xx 3-1:0.132: No AC97 audio processor [ 325.303313][ T43] usb 3-1: Decoder not found [ 325.330731][ T10] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 325.389961][ T43] em28xx 3-1:0.132: failed to create media graph [ 325.407604][ T9181] fuse: Bad value for 'group_id' [ 325.414827][ T9181] fuse: Bad value for 'group_id' [ 325.447710][ T43] em28xx 3-1:0.132: V4L2 device video103 deregistered [ 325.492143][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 325.525527][ T10] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 325.547383][ T10] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 325.571987][ T10] usb 4-1: config 0 interface 0 has no altsetting 0 [ 325.583434][ T10] usb 4-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 325.594002][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 325.628377][ T10] usb 4-1: config 0 descriptor?? [ 325.678321][ T9184] ================================================================== [ 325.686593][ T9184] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xc7/0x430 [ 325.693979][ T9184] Read of size 8 at addr ffff88806c614738 by task v4l_id/9184 [ 325.701427][ T9184] [ 325.703751][ T9184] CPU: 0 UID: 0 PID: 9184 Comm: v4l_id Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 325.703767][ T9184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 325.703774][ T9184] Call Trace: [ 325.703780][ T9184] [ 325.703786][ T9184] dump_stack_lvl+0x189/0x250 [ 325.703806][ T9184] ? __virt_addr_valid+0x1c8/0x5c0 [ 325.703818][ T9184] ? rcu_is_watching+0x15/0xb0 [ 325.703835][ T9184] ? __pfx_dump_stack_lvl+0x10/0x10 [ 325.703852][ T9184] ? rcu_is_watching+0x15/0xb0 [ 325.703868][ T9184] ? lock_release+0x4b/0x3e0 [ 325.703884][ T9184] ? __virt_addr_valid+0x1c8/0x5c0 [ 325.703895][ T9184] ? __virt_addr_valid+0x4a5/0x5c0 [ 325.703907][ T9184] print_report+0xd2/0x2b0 [ 325.703922][ T9184] ? v4l2_fh_open+0xc7/0x430 [ 325.703937][ T9184] kasan_report+0x118/0x150 [ 325.703950][ T9184] ? v4l2_fh_open+0xc7/0x430 [ 325.703968][ T9184] v4l2_fh_open+0xc7/0x430 [ 325.703984][ T9184] ? __pfx___mutex_lock+0x10/0x10 [ 325.704002][ T9184] em28xx_v4l2_open+0x157/0x9a0 [ 325.704021][ T9184] v4l2_open+0x20f/0x360 [ 325.704032][ T9184] chrdev_open+0x4c9/0x5e0 [ 325.704045][ T9184] ? __pfx_chrdev_open+0x10/0x10 [ 325.704059][ T9184] ? __pfx_chrdev_open+0x10/0x10 [ 325.704071][ T9184] do_dentry_open+0xdf0/0x1970 [ 325.704088][ T9184] vfs_open+0x3b/0x340 [ 325.704101][ T9184] ? path_openat+0x2ecd/0x3830 [ 325.704117][ T9184] path_openat+0x2ee5/0x3830 [ 325.704132][ T9184] ? arch_stack_walk+0xfc/0x150 [ 325.704157][ T9184] ? __pfx_path_openat+0x10/0x10 [ 325.704173][ T9184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.704189][ T9184] do_filp_open+0x1fa/0x410 [ 325.704204][ T9184] ? __lock_acquire+0xab9/0xd20 [ 325.704219][ T9184] ? __pfx_do_filp_open+0x10/0x10 [ 325.704240][ T9184] ? _raw_spin_unlock+0x28/0x50 [ 325.704254][ T9184] ? alloc_fd+0x64c/0x6c0 [ 325.704268][ T9184] do_sys_openat2+0x121/0x1c0 [ 325.704283][ T9184] ? __pfx_do_sys_openat2+0x10/0x10 [ 325.704298][ T9184] ? exc_page_fault+0x76/0xf0 [ 325.704314][ T9184] ? do_user_addr_fault+0xc8a/0x1390 [ 325.704329][ T9184] __x64_sys_openat+0x138/0x170 [ 325.704345][ T9184] do_syscall_64+0xfa/0x3b0 [ 325.704361][ T9184] ? lockdep_hardirqs_on+0x9c/0x150 [ 325.704377][ T9184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.704388][ T9184] ? clear_bhb_loop+0x60/0xb0 [ 325.704401][ T9184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.704413][ T9184] RIP: 0033:0x7f5165aa7407 [ 325.704424][ T9184] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 325.704436][ T9184] RSP: 002b:00007fff9faeacd0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 325.704450][ T9184] RAX: ffffffffffffffda RBX: 00007f5166164880 RCX: 00007f5165aa7407 [ 325.704459][ T9184] RDX: 0000000000000000 RSI: 00007fff9faecf1b RDI: ffffffffffffff9c [ 325.704467][ T9184] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 325.704474][ T9184] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 325.704482][ T9184] R13: 00007fff9faeaf20 R14: 00007f5166269000 R15: 000055863d8624d8 [ 325.704494][ T9184] [ 325.704498][ T9184] [ 326.010142][ T9184] Allocated by task 43: [ 326.014434][ T9184] kasan_save_track+0x3e/0x80 [ 326.019131][ T9184] __kasan_kmalloc+0x93/0xb0 [ 326.023739][ T9184] __kmalloc_cache_noprof+0x230/0x3d0 [ 326.029309][ T9184] em28xx_v4l2_init+0x10b/0x2e70 [ 326.034692][ T9184] em28xx_init_extension+0x11d/0x1c0 [ 326.039987][ T9184] process_scheduled_works+0xae1/0x17b0 [ 326.045650][ T9184] worker_thread+0x8a0/0xda0 [ 326.050272][ T9184] kthread+0x70e/0x8a0 [ 326.054346][ T9184] ret_from_fork+0x3fc/0x770 [ 326.058945][ T9184] ret_from_fork_asm+0x1a/0x30 [ 326.063833][ T9184] [ 326.066170][ T9184] Freed by task 43: [ 326.069983][ T9184] kasan_save_track+0x3e/0x80 [ 326.074951][ T9184] kasan_save_free_info+0x46/0x50 [ 326.079995][ T9184] __kasan_slab_free+0x62/0x70 [ 326.085298][ T9184] kfree+0x18e/0x440 [ 326.089208][ T9184] em28xx_v4l2_init+0x1683/0x2e70 [ 326.094245][ T9184] em28xx_init_extension+0x11d/0x1c0 [ 326.099541][ T9184] process_scheduled_works+0xae1/0x17b0 [ 326.105204][ T9184] worker_thread+0x8a0/0xda0 [ 326.109807][ T9184] kthread+0x70e/0x8a0 [ 326.113982][ T9184] ret_from_fork+0x3fc/0x770 [ 326.118689][ T9184] ret_from_fork_asm+0x1a/0x30 [ 326.123480][ T9184] [ 326.125907][ T9184] The buggy address belongs to the object at ffff88806c614000 [ 326.125907][ T9184] which belongs to the cache kmalloc-8k of size 8192 [ 326.140086][ T9184] The buggy address is located 1848 bytes inside of [ 326.140086][ T9184] freed 8192-byte region [ffff88806c614000, ffff88806c616000) [ 326.154168][ T9184] [ 326.156498][ T9184] The buggy address belongs to the physical page: [ 326.162914][ T9184] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6c610 [ 326.171770][ T9184] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 326.180364][ T9184] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 326.188345][ T9184] page_type: f5(slab) [ 326.192356][ T9184] raw: 00fff00000000040 ffff88801a442280 0000000000000000 dead000000000001 [ 326.200956][ T9184] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 326.209803][ T9184] head: 00fff00000000040 ffff88801a442280 0000000000000000 dead000000000001 [ 326.218611][ T9184] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 326.227412][ T9184] head: 00fff00000000003 ffffea0001b18401 00000000ffffffff 00000000ffffffff [ 326.236276][ T9184] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 326.244950][ T9184] page dumped because: kasan: bad access detected [ 326.251364][ T9184] page_owner tracks the page as allocated [ 326.257254][ T9184] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5500, tgid 5500 (dhcpcd), ts 61145779802, free_ts 61094533922 [ 326.277667][ T9184] post_alloc_hook+0x240/0x2a0 [ 326.282541][ T9184] get_page_from_freelist+0x21e4/0x22c0 [ 326.288100][ T9184] __alloc_frozen_pages_noprof+0x181/0x370 [ 326.293924][ T9184] alloc_pages_mpol+0x232/0x4a0 [ 326.298796][ T9184] allocate_slab+0x8a/0x3b0 [ 326.303311][ T9184] ___slab_alloc+0xbfc/0x1480 [ 326.308256][ T9184] __kmalloc_cache_noprof+0x296/0x3d0 [ 326.313630][ T9184] tomoyo_init_log+0x111f/0x1f70 [ 326.318581][ T9184] tomoyo_supervisor+0x340/0x1480 [ 326.323613][ T9184] tomoyo_env_perm+0x149/0x1e0 [ 326.328394][ T9184] tomoyo_find_next_domain+0x15cf/0x1aa0 [ 326.334202][ T9184] tomoyo_bprm_check_security+0x11c/0x180 [ 326.340031][ T9184] security_bprm_check+0x89/0x270 [ 326.345153][ T9184] bprm_execve+0x8ee/0x1450 [ 326.349671][ T9184] do_execveat_common+0x510/0x6a0 [ 326.354710][ T9184] __x64_sys_execve+0x94/0xb0 [ 326.359408][ T9184] page last free pid 5496 tgid 5496 stack trace: [ 326.365749][ T9184] __free_frozen_pages+0xc71/0xe70 [ 326.371388][ T9184] __put_partials+0x161/0x1c0 [ 326.376074][ T9184] put_cpu_partial+0x17c/0x250 [ 326.380851][ T9184] __slab_free+0x2f7/0x400 [ 326.385281][ T9184] qlist_free_all+0x97/0x140 [ 326.389969][ T9184] kasan_quarantine_reduce+0x148/0x160 [ 326.395440][ T9184] __kasan_slab_alloc+0x22/0x80 [ 326.400293][ T9184] kmem_cache_alloc_node_noprof+0x1bb/0x3c0 [ 326.406190][ T9184] __alloc_skb+0x112/0x2d0 [ 326.410616][ T9184] alloc_skb_with_frags+0xca/0x890 [ 326.415924][ T9184] sock_alloc_send_pskb+0x857/0x990 [ 326.421145][ T9184] unix_dgram_sendmsg+0x4f6/0x1870 [ 326.426276][ T9184] __sock_sendmsg+0x21c/0x270 [ 326.431223][ T9184] sock_write_iter+0x258/0x330 [ 326.436002][ T9184] vfs_write+0x54b/0xa90 [ 326.440343][ T9184] ksys_write+0x145/0x250 [ 326.444768][ T9184] [ 326.447124][ T9184] Memory state around the buggy address: [ 326.452844][ T9184] ffff88806c614600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 326.461035][ T9184] ffff88806c614680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 326.469202][ T9184] >ffff88806c614700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 326.477275][ T9184] ^ [ 326.483179][ T9184] ffff88806c614780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 326.491245][ T9184] ffff88806c614800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 326.499312][ T9184] ================================================================== [ 326.507622][ C0] vkms_vblank_simulate: vblank timer overrun [ 326.520384][ T43] em28xx 3-1:0.132: Remote control support is not available for this card. [ 326.541467][ T5908] em28xx 3-1:0.132: Closing input extension [ 326.580626][ T9184] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 326.587887][ T9184] CPU: 0 UID: 0 PID: 9184 Comm: v4l_id Not tainted 6.16.0-rc3-syzkaller-00233-g35e261cd95dd #0 PREEMPT(full) [ 326.599562][ T9184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 326.609749][ T9184] Call Trace: [ 326.613070][ T9184] [ 326.616039][ T9184] dump_stack_lvl+0x99/0x250 [ 326.620696][ T9184] ? __asan_memcpy+0x40/0x70 [ 326.625418][ T9184] ? __pfx_dump_stack_lvl+0x10/0x10 [ 326.630679][ T9184] ? __pfx__printk+0x10/0x10 [ 326.635329][ T9184] panic+0x2db/0x790 [ 326.639370][ T9184] ? __pfx_panic+0x10/0x10 [ 326.643821][ T9184] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 326.649847][ T9184] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 326.656279][ T9184] ? print_memory_metadata+0x314/0x400 [ 326.661854][ T9184] ? v4l2_fh_open+0xc7/0x430 [ 326.666459][ T9184] check_panic_on_warn+0x89/0xb0 [ 326.671615][ T9184] ? v4l2_fh_open+0xc7/0x430 [ 326.676216][ T9184] end_report+0x78/0x160 [ 326.680484][ T9184] kasan_report+0x129/0x150 [ 326.685007][ T9184] ? v4l2_fh_open+0xc7/0x430 [ 326.689644][ T9184] v4l2_fh_open+0xc7/0x430 [ 326.694092][ T9184] ? __pfx___mutex_lock+0x10/0x10 [ 326.699309][ T9184] em28xx_v4l2_open+0x157/0x9a0 [ 326.704180][ T9184] v4l2_open+0x20f/0x360 [ 326.708430][ T9184] chrdev_open+0x4c9/0x5e0 [ 326.713118][ T9184] ? __pfx_chrdev_open+0x10/0x10 [ 326.718069][ T9184] ? __pfx_chrdev_open+0x10/0x10 [ 326.723068][ T9184] do_dentry_open+0xdf0/0x1970 [ 326.727951][ T9184] vfs_open+0x3b/0x340 [ 326.732040][ T9184] ? path_openat+0x2ecd/0x3830 [ 326.736831][ T9184] path_openat+0x2ee5/0x3830 [ 326.741434][ T9184] ? arch_stack_walk+0xfc/0x150 [ 326.746475][ T9184] ? __pfx_path_openat+0x10/0x10 [ 326.751691][ T9184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.757791][ T9184] do_filp_open+0x1fa/0x410 [ 326.762393][ T9184] ? __lock_acquire+0xab9/0xd20 [ 326.767346][ T9184] ? __pfx_do_filp_open+0x10/0x10 [ 326.772409][ T9184] ? _raw_spin_unlock+0x28/0x50 [ 326.777268][ T9184] ? alloc_fd+0x64c/0x6c0 [ 326.781700][ T9184] do_sys_openat2+0x121/0x1c0 [ 326.786389][ T9184] ? __pfx_do_sys_openat2+0x10/0x10 [ 326.791608][ T9184] ? exc_page_fault+0x76/0xf0 [ 326.796297][ T9184] ? do_user_addr_fault+0xc8a/0x1390 [ 326.801596][ T9184] __x64_sys_openat+0x138/0x170 [ 326.806641][ T9184] do_syscall_64+0xfa/0x3b0 [ 326.811253][ T9184] ? lockdep_hardirqs_on+0x9c/0x150 [ 326.816650][ T9184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.822902][ T9184] ? clear_bhb_loop+0x60/0xb0 [ 326.827611][ T9184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.833514][ T9184] RIP: 0033:0x7f5165aa7407 [ 326.837977][ T9184] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 326.857764][ T9184] RSP: 002b:00007fff9faeacd0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 326.866277][ T9184] RAX: ffffffffffffffda RBX: 00007f5166164880 RCX: 00007f5165aa7407 [ 326.874444][ T9184] RDX: 0000000000000000 RSI: 00007fff9faecf1b RDI: ffffffffffffff9c [ 326.882683][ T9184] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 326.890921][ T9184] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 326.899106][ T9184] R13: 00007fff9faeaf20 R14: 00007f5166269000 R15: 000055863d8624d8 [ 326.907179][ T9184] [ 326.910483][ T9184] Kernel Offset: disabled [ 326.914818][ T9184] Rebooting in 86400 seconds..