last executing test programs: 6m42.579483821s ago: executing program 1 (id=485): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x3) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) sysinfo(0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x40, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000300), 0x100040000, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) preadv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000480)=""/187, 0xbb}], 0x1, 0x4c, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x8000) socket$nl_generic(0x10, 0x3, 0x10) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x81, 0x3, 0x1, 0x7, 0x3, 0x1, 0x1}, &(0x7f0000000180)={0x400, 0xff, 0x152e0c7c, 0x1, 0x1ff, 0x5, 0x4de, 0xa}, &(0x7f0000000200)={0xffffffffffffffff, 0x1, 0x7, 0x8, 0x6, 0x789, 0x9, 0x1}, &(0x7f0000000280)={r1, r2+10000000}, &(0x7f00000003c0)={&(0x7f0000000340)={[0x3c4]}, 0x8}) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) ftruncate(0xffffffffffffffff, 0xffff) 6m42.222788007s ago: executing program 1 (id=486): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@newqdisc={0x50, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x24, 0x2, [@TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x8001}, @TCA_HTB_INIT={0x18, 0x2, {0x3, 0x9, 0x7}}]}}]}, 0x50}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) ioctl$MON_IOCT_RING_SIZE(0xffffffffffffffff, 0x9204, 0x105063) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r6, 0x10f, 0x80, &(0x7f0000001640)=0x4f1d, 0x4) sendmmsg$inet(r6, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) 6m41.27190911s ago: executing program 1 (id=487): pipe2(0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) syz_io_uring_setup(0x4073, &(0x7f0000000240)={0x0, 0xfffffffe, 0x10100, 0x1}, 0x0, 0x0) syz_open_dev$video(&(0x7f0000000000), 0x7, 0x40) socket$inet6(0xa, 0x1, 0x0) syz_open_dev$usbmon(&(0x7f0000000040), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) pselect6(0x40, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, &(0x7f0000000680)={0x7ff}, 0x0, 0x0) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'ipvlan1\x00', 0x600}) ioctl$BTRFS_IOC_QUOTA_RESCAN(0xffffffffffffffff, 0x4040942c, &(0x7f0000000180)={0x0, 0x7fffffffffffffff, [0x6, 0x9806, 0x5, 0x3ff, 0x4, 0x8]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 6m41.099326752s ago: executing program 1 (id=489): socket$inet6(0xa, 0x200000000003, 0x87) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000004c0)='io\x00') read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0x19}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000440), 0x10000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000000c0)={0x28, 0x7, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r4, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000240)={0x48, 0x7, r5, 0x0, 0x1, 0x0, 0x10000, 0x0, 0x32bf8f}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f00000003c0)={0x48, 0x7, r5, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3ee222}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f00000002c0)={0x48, 0x6, r5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff7b}) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) r7 = socket(0x2000000015, 0x80005, 0x0) bind$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) read(r6, &(0x7f00000000c0)=""/110, 0x6e) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 6m40.701000125s ago: executing program 1 (id=490): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x34, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x6c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x40, 0x3, 0x0, 0x1, [{0x3c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x30, 0xb, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0xffffffffffffffff}, @NFTA_LIMIT_UNIT={0xc}]}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe8}}, 0x0) 6m40.4953382s ago: executing program 1 (id=492): r0 = socket(0x1, 0x80802, 0x0) syz_open_procfs(0x0, &(0x7f0000003c00)='task\x00') fstat(r0, &(0x7f0000000200)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_open_dev$sg(&(0x7f0000000040), 0xa, 0x101080) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000180)='jffs2\x00', 0x8000, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendfile(r1, r2, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000280)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000140), 0x5) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) getpeername$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000340)=0x1c) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r6 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) keyctl$KEYCTL_MOVE(0x19, 0x0, 0xfffffffffffffffe, 0x0, 0x0) r7 = fsmount(r6, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000003c0)={r5, r7, 0x5}, 0x14) 6m25.27768001s ago: executing program 32 (id=492): r0 = socket(0x1, 0x80802, 0x0) syz_open_procfs(0x0, &(0x7f0000003c00)='task\x00') fstat(r0, &(0x7f0000000200)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_open_dev$sg(&(0x7f0000000040), 0xa, 0x101080) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000180)='jffs2\x00', 0x8000, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendfile(r1, r2, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000280)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000140), 0x5) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) getpeername$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000340)=0x1c) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r6 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) keyctl$KEYCTL_MOVE(0x19, 0x0, 0xfffffffffffffffe, 0x0, 0x0) r7 = fsmount(r6, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000003c0)={r5, r7, 0x5}, 0x14) 1m39.800176233s ago: executing program 2 (id=1182): r0 = socket$inet6(0xa, 0x2, 0x3a) readv(r0, &(0x7f00000006c0), 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x0, 0x1) syz_io_uring_submit(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r4 = syz_open_dev$media(&(0x7f0000000080), 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r4, 0xc0347c03, &(0x7f0000000840)={{}, {}, 0x0, [0x2]}) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x80000006}]}, 0x10) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) mount(&(0x7f0000000180)=@nullb, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='bfs\x00', 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r9 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syz_tun\x00', 0x0}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000700)=ANY=[@ANYRES16=r8, @ANYRES32=r10], 0x34}}, 0x0) 1m37.164748982s ago: executing program 2 (id=1187): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) faccessat2(0xffffffffffffffff, 0x0, 0x7, 0x1200) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) 1m36.861711364s ago: executing program 0 (id=1189): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000600)) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) ioctl$MON_IOCT_RING_SIZE(0xffffffffffffffff, 0x9204, 0x105063) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$inet(r5, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r5, 0xc4089434, &(0x7f0000000800)={0x0, 0x2, 0x1, [0x4, 0x1, 0x8, 0x7], [0xc, 0x6fd4, 0xfcff, 0xa, 0x6, 0x6, 0x6a24, 0x4f15, 0x8, 0xfffffffffffff842, 0x800, 0x7, 0x5a, 0x81, 0x10, 0x8001, 0x200, 0x3, 0x5f, 0x8, 0x28, 0x200, 0xffffffffffffffff, 0x9, 0x4, 0x8000000000000001, 0x9, 0x7, 0x1ff, 0x80, 0x8000, 0xa, 0x2, 0x2, 0x2, 0x200, 0xfffffffffffffff6, 0xd2bb, 0x552, 0x9, 0x7, 0x7, 0x3, 0x3394, 0x0, 0xfffffffffffffffb, 0xef, 0x1874, 0xfffffffffffffffd, 0x5, 0x6, 0x7fff, 0x2, 0x100000001, 0x2, 0x1, 0x4, 0xd2ab, 0x5, 0x8000000000000001, 0x1, 0x4, 0xd, 0xe6ff, 0x0, 0xfffffffffffffff8, 0x8d1, 0x3, 0x40, 0x800, 0x0, 0x9, 0x7fffffffffffffff, 0x4, 0x6, 0x6, 0xb, 0x8, 0x8, 0x3, 0x0, 0x80000000, 0x423c, 0x1, 0xd, 0x2be, 0x7, 0xa, 0xb, 0x7, 0x5, 0x3191, 0x5, 0xce, 0x6, 0x5, 0xfffffffffffffffc, 0x6, 0x7f, 0x2, 0x8840, 0x401, 0xee, 0x6431, 0x7fff, 0x1, 0x7, 0x1ff, 0x800, 0x0, 0x5, 0x6, 0x1, 0x6, 0x0, 0x4, 0x7, 0x3, 0x4, 0x1, 0x2]}) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001680)={r6, "9b6d08cad69efaaa69fe3513a20b30ee"}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000000c0)={0x0, 0x0}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x8001, 0x0) 1m35.913807466s ago: executing program 0 (id=1190): openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x1) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'bridge0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0088a8132788a87c643c4a1b7880610cc9", 0x26, 0x0, &(0x7f0000000540)={0xc9, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r2, &(0x7f00000003c0)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) write(r2, &(0x7f00000000c0)="8fa58fa5761700"/24, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$vim2m(0x0, 0x3fe, 0x2) r4 = syz_open_dev$mouse(&(0x7f0000000080), 0x8, 0x200903) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) accept4$rose(r5, 0x0, 0x0, 0x80000) r6 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) write$nbd(r6, &(0x7f0000000240)=ANY=[@ANYBLOB="01"], 0x40) syz_open_dev$vim2m(&(0x7f00000000c0), 0x3, 0x2) syz_open_dev$vim2m(&(0x7f0000000100), 0x5, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r4, 0xc0405602, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r7, &(0x7f0000000300)={0xa, 0x4e20, 0x5, @private2, 0x394}, 0x1c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)=@newtaction={0x14, 0x30, 0xffff}, 0x14}}, 0x0) 1m35.843410256s ago: executing program 2 (id=1191): prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x9, 0x40}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xcb65000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000240), 0x57) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r3 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000002c80)={0xa, 0x14e24}, 0x1c) connect$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0x0) bpf$BPF_GET_PROG_INFO(0x3, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x5) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x7528e000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) 1m34.406647057s ago: executing program 2 (id=1192): r0 = io_uring_setup(0x30d1, &(0x7f0000000240)={0x0, 0x0, 0x40}) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)={'#! ', './file0'}, 0xf000) close_range(r0, 0xffffffffffffffff, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r3 = epoll_create1(0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = socket$inet6(0xa, 0x3, 0x7) inotify_rm_watch(0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@dev={0xfe, 0x80, '\x00', 0xb}, @in6=@dev={0xfe, 0x80, '\x00', 0x1d}, 0x4e24, 0xfffc, 0x4e24, 0x0, 0xa, 0x0, 0x10, 0x2f}, {0x100000000, 0x0, 0xfffffffffffffffe, 0x1, 0xffffffffffffffff, 0xfffffffffffffffc, 0x0, 0x1}, {0x0, 0xfffffffffffffffe, 0x0, 0x9}, 0x4, 0x0, 0x1, 0x0, 0x2, 0x1}, {{@in6=@mcast1, 0x200000, 0x33}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xb}, 0x0, 0x3, 0x3, 0x7, 0x0, 0x1, 0xffffffff}}, 0xe8) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f00000000c0)) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) 1m34.331528569s ago: executing program 0 (id=1193): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x111}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000fee000/0x12000)=nil, 0x12000}, 0x1}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0) read$FUSE(r0, &(0x7f0000000280)={0x2020}, 0x2020) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) epoll_create1(0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000040), 0x76, 0x123301) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r4, 0x80045518, &(0x7f0000000000)=0x7) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, 0x0}], 0x1, 0x77, 0x0, 0x0) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000000)={&(0x7f0000fef000/0xe000)=nil, &(0x7f0000001000/0x2000)=nil, 0xe000, 0x2}) 1m34.168223747s ago: executing program 2 (id=1195): set_mempolicy(0x6, 0x0, 0x4) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYRES16=r1, @ANYRES32=r0], 0x0, 0x8, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$KVM_GET_CLOCK(0xffffffffffffffff, 0x8030ae7c, &(0x7f0000000280)) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) socket$igmp(0x2, 0x3, 0x2) socket$xdp(0x2c, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001dc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r6 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$bt_rfcomm_RFCOMM_LM(r6, 0x12, 0x3, &(0x7f00000000c0), &(0x7f0000000300)=0x4) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x15e, &(0x7f0000000440)=ANY=[@ANYBLOB="0180c20000030180c200000288a810008100000086dd6300000001203aff00000000000000000000000000000000fe8000000000000000000000000000aa3c06040305100a00fe8000000000000000000000000000bbfc000000000000000000000000000000fc0200000000000000000000000000002f000400107001003a01000000ff00000001000401090101000000000000000062000000000000000001000000000000841000000000000007280000000008030101060000000000000009000000000000000080000000000000020000000000000005020005094434a2a269f6c1cfbc77fe7c40dc2904787603b3310a6e269314e9c4547c041df750113751965249fa61cc0914f4538c207d1155b41e72045595a43d5c490ba46267cf7e8707080000000000f6020005020004000000000000890100000000000005020005010200000100000000000000c2040000000500008000907807ff0007"], 0x0) ioctl$SNDCTL_DSP_GETOSPACE(r5, 0x8010500c, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000040)={@broadcast, @multicast1, 0x1, "0d5011f02b7fab96e0aa834d3a9e7cfc12178ac0ab1e6227c2b6ddaa5effda90", 0x5, 0x16, 0xfffffffe, 0x1}, 0x3c) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000000)={@broadcast, @dev={0xac, 0x14, 0x14, 0x10}, 0xfffd, "12ceaac82ab7d944e84b6fbd6178697e3b10c9b81bede26c85ee73daab4158e8", 0x2, 0x6, 0x4, 0x4}, 0x3c) setsockopt$MRT_FLUSH(0xffffffffffffffff, 0x0, 0xd4, &(0x7f0000000240)=0xe, 0x4) 1m33.106633645s ago: executing program 0 (id=1196): syz_io_uring_setup(0x110, 0x0, &(0x7f0000000100), &(0x7f00000000c0)) close(0x4) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) readv(0xffffffffffffffff, &(0x7f0000000600)=[{0x0}], 0x1) ioprio_set$uid(0x3, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x4, 0x200000005c831, 0xffffffffffffffff, 0x0) 1m32.313417198s ago: executing program 0 (id=1199): socket$inet6(0xa, 0x200000000003, 0x87) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000080)={0x19}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000440), 0x10000, 0x0) 1m30.033993188s ago: executing program 2 (id=1206): r0 = syz_usb_connect(0x5, 0x90, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010002202f4c20020402564d660102030109027e0001000000"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000300)={r1}) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x2, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) socket$pptp(0x18, 0x1, 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_io_uring_setup(0xd2, &(0x7f0000000480)={0x0, 0x0, 0x3c00}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000280)=@IORING_OP_TIMEOUT={0xb, 0x0, 0x0, 0x0, 0x2, &(0x7f00000000c0)={0x77359400}}) io_uring_enter(r4, 0x47ba, 0x0, 0x0, 0x0, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x19, 0xf, &(0x7f00000000c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r8}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x19, 0x1, 0x178, [0x200003c0, 0xfffffffffffffffd, 0x3, 0x200003f0, 0x20000420], 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000f8ffffff000000000000000000000000000000000000000000000000000000000000feffffff00000000000000000000000000000000000000f00c0000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000050000000000000008006966623000000000000000000000000064756d6d79300000000000000000000069705f76746930000000000000000000697036746e6c30000000000000000000aaaaaaaaaabb0400000000000182c20000000000000000000000b8000000b8000000e80000006970000000000000000000000000000000000000000000a823c565625b8d720020000000000000007f00004dab14140000000000000000000084200400000000000000000000000041554449540000bcb92dfff07fca0000004600f58f5dc8438b000000000000000800"/376]}, 0x1f0) 1m29.505602332s ago: executing program 0 (id=1207): socket$inet6(0xa, 0x200000000003, 0x87) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) syz_open_procfs(0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000004c0)='io\x00') read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0x19}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000440), 0x10000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000000c0)={0x28, 0x7, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r4, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000240)={0x48, 0x7, r5, 0x0, 0x1, 0x0, 0x10000, 0x0, 0x32bf8f}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f00000003c0)={0x48, 0x7, r5, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3ee222}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f00000002c0)={0x48, 0x6, r5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff7b}) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) pread64(r6, 0x0, 0x0, 0x0) r7 = socket(0x2000000015, 0x80005, 0x0) bind$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) read(r6, &(0x7f00000000c0)=""/110, 0x6e) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 1m14.951810399s ago: executing program 33 (id=1206): r0 = syz_usb_connect(0x5, 0x90, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010002202f4c20020402564d660102030109027e0001000000"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000300)={r1}) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x2, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) socket$pptp(0x18, 0x1, 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_io_uring_setup(0xd2, &(0x7f0000000480)={0x0, 0x0, 0x3c00}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000280)=@IORING_OP_TIMEOUT={0xb, 0x0, 0x0, 0x0, 0x2, &(0x7f00000000c0)={0x77359400}}) io_uring_enter(r4, 0x47ba, 0x0, 0x0, 0x0, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x19, 0xf, &(0x7f00000000c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r8}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x19, 0x1, 0x178, [0x200003c0, 0xfffffffffffffffd, 0x3, 0x200003f0, 0x20000420], 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000f8ffffff000000000000000000000000000000000000000000000000000000000000feffffff00000000000000000000000000000000000000f00c0000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000050000000000000008006966623000000000000000000000000064756d6d79300000000000000000000069705f76746930000000000000000000697036746e6c30000000000000000000aaaaaaaaaabb0400000000000182c20000000000000000000000b8000000b8000000e80000006970000000000000000000000000000000000000000000a823c565625b8d720020000000000000007f00004dab14140000000000000000000084200400000000000000000000000041554449540000bcb92dfff07fca0000004600f58f5dc8438b000000000000000800"/376]}, 0x1f0) 1m13.961710517s ago: executing program 34 (id=1207): socket$inet6(0xa, 0x200000000003, 0x87) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) syz_open_procfs(0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000004c0)='io\x00') read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0x19}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000440), 0x10000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000000c0)={0x28, 0x7, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r4, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000240)={0x48, 0x7, r5, 0x0, 0x1, 0x0, 0x10000, 0x0, 0x32bf8f}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f00000003c0)={0x48, 0x7, r5, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3ee222}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f00000002c0)={0x48, 0x6, r5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff7b}) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) pread64(r6, 0x0, 0x0, 0x0) r7 = socket(0x2000000015, 0x80005, 0x0) bind$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) read(r6, &(0x7f00000000c0)=""/110, 0x6e) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 8.067725122s ago: executing program 7 (id=1403): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000080)={0x0, 'batadv0\x00', {0x8}, 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r2) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8922, 0x0) close(0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=@setlink={0x3c, 0x13, 0x1, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0xa, r5}, @IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}]}, 0x3c}}, 0x0) r6 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r6, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) 7.362531877s ago: executing program 7 (id=1406): r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000480)={0x2020}, 0x2020) 7.142081253s ago: executing program 7 (id=1410): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000406c256d0000000000000109022400050000000009040100010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) syz_usb_control_io$hid(r0, &(0x7f0000001440)={0xfffffffffffffd87, 0x0, 0x0, &(0x7f00000013c0)={0x0, 0x22, 0x5, {[@local=@item_4={0x3, 0x2, 0x0, "741cb976"}]}}, 0x0}, 0x0) 6.623704439s ago: executing program 6 (id=1414): r0 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, r1, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) syz_emit_ethernet(0xfdef, &(0x7f0000000640)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x19}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x65, 0x60, 0x0, 0x3a, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x8000, 0x4e21, 0x10, 0x0, @gue={{0x2, 0x0, 0x3, 0x0, 0x100}}}}}}}, 0x0) 6.423945998s ago: executing program 3 (id=1415): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f00000002c0)={0x0, 0x4533, 0x10100, 0x0, 0x0, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f0000000340)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) syz_open_procfs(0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) recvmsg(r5, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000063c0)=""/4097, 0x1001}], 0x1}, 0x102) 6.25483815s ago: executing program 6 (id=1418): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x18b1, 0x37, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) pipe(0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7ffc0000}]}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x0) migrate_pages(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\"\n'], 0x0}, 0x0) 5.387939109s ago: executing program 4 (id=1424): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) connect$netlink(r0, &(0x7f0000000000)=@unspec={0x0, 0xe803}, 0xc) 5.387703425s ago: executing program 3 (id=1425): unshare(0x22020400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000007290000000000000000850000006d00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) 5.275328238s ago: executing program 3 (id=1426): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)={0x44, r1, 0x1, 0x0, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME={0x28, 0x33, @probe_response={{{0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1}, {}, @device_b, @device_a, @initial, {0xb}}, 0x0, @random=0x3d, 0x0, @void, @void, @void, @void, @void, @void, @void, @void}}]}, 0x44}}, 0x0) 5.243879568s ago: executing program 4 (id=1427): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, 0x0, 0x0, 0x91349f47ceba1578}, 0x1c) 5.171873759s ago: executing program 3 (id=1428): writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560aff820fffff5bab", 0x18}], 0x1) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x2004c8, 0x8000000, 0x0, 0x10000000, 0xfffffffffffffffe, 0x1, 0x0, 0x0, 0x5]}) sendmsg$NL80211_CMD_SET_KEY(r2, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4004841}, 0x4810) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.080017596s ago: executing program 4 (id=1430): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000016c0)=@newlink={0x40, 0x10, 0x437, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x40483}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x81}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x11}, 0x0) 5.019157484s ago: executing program 7 (id=1431): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) socket$qrtr(0x2a, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000004c0)={0x0, 0x465f}, 0x8) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0x4) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x4}, 0x8) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000180)='i', 0x1}], 0x1}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYRES32=r1], 0xc) 4.969235545s ago: executing program 4 (id=1432): open(0x0, 0x60142, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="130100002add1e20ef050a023691010203010902240001000000000904000002ea1998000905a6a70000000000090507", @ANYRES32], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000300)={0x0, 0x5, 0x1, 'O'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000480)={0x44, &(0x7f00000001c0)=ANY=[@ANYBLOB="2016020000004e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read$msr(0xffffffffffffffff, 0x0, 0x0) 4.92745698s ago: executing program 3 (id=1433): r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2717, 0x0, &(0x7f0000000000)) 4.78780236s ago: executing program 3 (id=1434): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b70300000000000085000000720000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x200}]}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x5c}}, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f00000055c0), 0x400023c, 0x0, 0x0) 4.758912219s ago: executing program 7 (id=1435): r0 = syz_usb_connect(0x5, 0x90, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010002202f4c20020402564d660102030109027e0001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000300)) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x2, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) socket$pptp(0x18, 0x1, 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_io_uring_setup(0xd2, &(0x7f0000000480)={0x0, 0x0, 0x3c00}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000280)=@IORING_OP_TIMEOUT={0xb, 0x0, 0x0, 0x0, 0x2, &(0x7f00000000c0)={0x77359400}}) io_uring_enter(r3, 0x47ba, 0x0, 0x0, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x19, 0xf, &(0x7f00000000c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r7}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x19, 0x1, 0x178, [0x200003c0, 0xfffffffffffffffd, 0x3, 0x200003f0, 0x20000420], 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000f8ffffff000000000000000000000000000000000000000000000000000000000000feffffff00000000000000000000000000000000000000f00c0000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000050000000000000008006966623000000000000000000000000064756d6d79300000000000000000000069705f76746930000000000000000000697036746e6c30000000000000000000aaaaaaaaaabb0400000000000182c20000000000000000000000b8000000b8000000e80000006970000000000000000000000000000000000000000000a823c565625b8d720020000000000000007f00004dab14140000000000000000000084200400000000000000000000000041554449540000bcb92dfff07fca0000004600f58f5dc8438b000000000000000800"/376]}, 0x1f0) 4.578302705s ago: executing program 5 (id=1436): r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/netstat\x00') socket$inet6(0xa, 0x3, 0xff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(0xffffffffffffffff, 0x7f) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x0, 0x3e, 0x0, "a1c1dd75a68473ba07d945c3b03e10950cd4b347113e55eb499419be4f9142da0bc21470e441225642855b5f2b4b67efbff2fdf98328de9434031348589b763d46d14810acc5f7000000e3ffffff00"}, 0xd8) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000100)) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0x0) gettid() syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r6 = socket(0x40000000015, 0x5, 0x0) recvmmsg(r6, &(0x7f0000006ac0)=[{{0x0, 0x5a, 0x0}, 0xa0b7}, {{0x0, 0x5c, 0x0, 0x0, &(0x7f00000054c0)=""/18, 0x12}, 0x9}, {{&(0x7f0000005500)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @initdev}}, 0x80, &(0x7f00000055c0), 0x1}}], 0x3, 0x12023, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x4004010) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f00000000c0)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000007000000000000000a20000000000a03000000000000000000010000000900010073797a300000000044000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0800034000000004640000000e0a01020000000000000000010000000900020073797a32000000000900010073797a300000000038000380340000802800018023000100118c7457ff8f99b8233b"], 0xf0}}, 0x0) pread64(r0, &(0x7f000001a240)=""/102400, 0x19000, 0x100008) 4.507849959s ago: executing program 6 (id=1437): socket$inet6(0xa, 0x200000000003, 0x87) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000004c0)='io\x00') read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0x19}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000440), 0x10000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000000c0)={0x28, 0x7, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r4, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000240)={0x48, 0x7, r5, 0x0, 0x1, 0x0, 0x10000, 0x0, 0x32bf8f}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f00000003c0)={0x48, 0x7, r5, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3ee222}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f00000002c0)={0x48, 0x6, r5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff7b}) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) pread64(r6, 0x0, 0x0, 0x0) r7 = socket(0x2000000015, 0x80005, 0x0) bind$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) read(r6, &(0x7f00000000c0)=""/110, 0x6e) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 3.89951103s ago: executing program 6 (id=1438): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x9, 0x0, 0x0) 3.772352275s ago: executing program 6 (id=1439): socket$inet6(0xa, 0x200000000003, 0x87) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000080)={0x19}) openat$iommufd(0xffffffffffffff9c, 0x0, 0x10000, 0x0) 3.272529149s ago: executing program 6 (id=1440): creat(&(0x7f0000000240)='./file0\x00', 0x0) pipe2$9p(0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0xa) r1 = dup(r0) r2 = open(&(0x7f0000000140)='./file1\x00', 0x10f0c2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000200)={0x9, {{0xa, 0x0, 0xffffffff, @mcast1={0xff, 0x7}, 0x4000000}}, {{0xa, 0x20, 0x0, @private2}}}, 0x108) r5 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/mcfilter6\x00') read$FUSE(r5, &(0x7f0000000fc0)={0x2020}, 0x2020) ftruncate(r2, 0x200004) sendfile(r1, r2, 0x0, 0x80001d00c0d1) 1.959932601s ago: executing program 7 (id=1441): r0 = syz_io_uring_setup(0x1f87, &(0x7f0000000080)={0x0, 0x0, 0x13580}, &(0x7f0000000100), &(0x7f0000000280)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) io_uring_enter(r0, 0x0, 0x3, 0x7, 0x0, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000240)={@broadcast, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x6, 0x14, 0x67, 0x0, 0x7, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}, @rand_addr=0x64010101}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x0, 0x2}, {0x0, 0x0, 0x1}, {0x0, 0x0, 0x1}, {0x8, 0x88be, 0x4, {{0x8, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0xf}, 0x1, {0xfffffffc}}}, {0x8, 0x22eb, 0x1, {{0x9, 0x2, 0x4, 0x0, 0x0, 0x2, 0x1, 0x1}, 0x2, {0x10001, 0xff, 0x1, 0x6, 0x1, 0x0, 0x2, 0x0, 0x1}}}}}}}}, 0x0) r2 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000c80)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d1"], 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000040)=0xfffffffc, 0x0, 0x4) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x3) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x80042, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) r5 = dup(r4) write$FUSE_INIT(r5, &(0x7f0000002100)={0x50, 0xffffffffffffffda}, 0x50) read$FUSE(r5, &(0x7f000001aa80)={0x2020}, 0x2020) syz_usb_ep_write$ath9k_ep2(r2, 0x83, 0x10, &(0x7f0000001240)=@ready={0x0, 0x0, 0x8, "de384b3d", {0x1, 0xca1e, 0xc000, 0x9, 0x5}}) syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e15"]) 1.827889732s ago: executing program 5 (id=1442): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000016c0)=@newlink={0x40, 0x10, 0x437, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x40483}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x81}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x11}, 0x0) 1.688012266s ago: executing program 4 (id=1443): openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r1}, 0x20) 1.619510884s ago: executing program 5 (id=1444): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newlink={0x60, 0x10, 0x40b, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x28, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x1c, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0xfd50, 0x4}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x64, {0x80000000, 0x7}}]}, @IFLA_VLAN_ID={0x6, 0x1, 0x3}]}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x60}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) 1.454334157s ago: executing program 4 (id=1445): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x200}]}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x5c}}, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x0, 0x0) 1.388800043s ago: executing program 5 (id=1446): prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x9, 0x40}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xcb65000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000240), 0x57) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000002c80)={0xa, 0x14e24}, 0x1c) connect$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0x0) 385.648136ms ago: executing program 5 (id=1447): r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x8, 0x7f1, 0x0, 0x0) 0s ago: executing program 5 (id=1448): syz_open_dev$I2C(0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'}) syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b36", @ANYRESOCT], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) keyctl$join(0x1, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="04"], 0xf8) kernel console output (not intermixed with test programs): 0 interfaces, different from the descriptor's value: 1 [ 450.311759][ T1201] usb 6-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 450.326352][ T1201] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 450.353983][ T1201] usb 6-1: Product: syz [ 450.364923][ T1201] usb 6-1: Manufacturer: syz [ 450.378123][ T1201] usb 6-1: SerialNumber: syz [ 451.007945][ T1201] usb 6-1: config 0 descriptor?? [ 451.355633][ T29] audit: type=1400 audit(1733082024.936:339): avc: denied { connect } for pid=10444 comm="syz.0.999" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 451.386926][T10445] netlink: 8 bytes leftover after parsing attributes in process `syz.0.999'. [ 451.398436][ T29] audit: type=1400 audit(1733082024.956:340): avc: denied { name_connect } for pid=10444 comm="syz.0.999" dest=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=dccp_socket permissive=1 [ 451.538010][ T29] audit: type=1400 audit(1733082024.966:341): avc: denied { read write } for pid=10444 comm="syz.0.999" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 452.254245][ T29] audit: type=1400 audit(1733082024.966:342): avc: denied { open } for pid=10444 comm="syz.0.999" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 452.278101][ C1] vkms_vblank_simulate: vblank timer overrun [ 452.853051][ T5897] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 453.046301][ T5897] usb 3-1: Using ep0 maxpacket: 8 [ 453.070426][ T5897] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 453.140317][ T5897] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 453.210158][ T5897] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 99 [ 453.332858][ T5897] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 453.535699][ T47] usb 6-1: USB disconnect, device number 18 [ 453.584578][ T25] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 453.598319][ T5897] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 453.607699][ T5897] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.096819][T10469] FAULT_INJECTION: forcing a failure. [ 454.096819][T10469] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 454.110056][T10469] CPU: 1 UID: 0 PID: 10469 Comm: syz.5.1003 Not tainted 6.12.0-syzkaller-12113-gbcc8eda6d349 #0 [ 454.120480][T10469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 454.130535][T10469] Call Trace: [ 454.133818][T10469] [ 454.136757][T10469] dump_stack_lvl+0x16c/0x1f0 [ 454.141448][T10469] should_fail_ex+0x497/0x5b0 [ 454.146143][T10469] _copy_from_user+0x2e/0xd0 [ 454.150740][T10469] copy_msghdr_from_user+0x99/0x160 [ 454.155948][T10469] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 454.161771][T10469] ___sys_sendmsg+0xff/0x1e0 [ 454.166365][T10469] ? __pfx____sys_sendmsg+0x10/0x10 [ 454.171579][T10469] ? __pfx_lock_release+0x10/0x10 [ 454.176606][T10469] ? trace_lock_acquire+0x14e/0x1f0 [ 454.181821][T10469] ? __fget_files+0x206/0x3a0 [ 454.186509][T10469] __sys_sendmsg+0x16e/0x220 [ 454.191104][T10469] ? __pfx___sys_sendmsg+0x10/0x10 [ 454.196234][T10469] do_syscall_64+0xcd/0x250 [ 454.200750][T10469] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.206670][T10469] RIP: 0033:0x7f5178980849 [ 454.211085][T10469] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 454.230704][T10469] RSP: 002b:00007f5179704058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 454.239130][T10469] RAX: ffffffffffffffda RBX: 00007f5178b46160 RCX: 00007f5178980849 [ 454.247193][T10469] RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000007 [ 454.255165][T10469] RBP: 00007f51797040a0 R08: 0000000000000000 R09: 0000000000000000 [ 454.263137][T10469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 454.271107][T10469] R13: 0000000000000000 R14: 00007f5178b46160 R15: 00007fffb418e9c8 [ 454.279094][T10469] [ 454.705829][ T25] usb 5-1: Using ep0 maxpacket: 32 [ 454.723526][ T25] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 454.765055][ T25] usb 5-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 454.782898][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.824842][ T25] usb 5-1: Product: syz [ 454.829036][ T25] usb 5-1: Manufacturer: syz [ 454.964310][ T25] usb 5-1: SerialNumber: syz [ 454.993238][ T5897] usb 3-1: usb_control_msg returned -71 [ 454.998883][ T5897] usbtmc 3-1:16.0: can't read capabilities [ 455.012801][ T5897] usb 3-1: USB disconnect, device number 35 [ 455.067928][ T25] usb 5-1: config 0 descriptor?? [ 455.083038][ T25] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 456.579191][ T25] gspca_m5602: Failed to find a sensor [ 456.631550][ T25] ALi m5602 5-1:0.0: ALi m5602 webcam failed [ 457.256424][ T25] usb 5-1: USB disconnect, device number 33 [ 457.371325][ T29] audit: type=1400 audit(1733082030.416:343): avc: denied { name_bind } for pid=10490 comm="syz.3.1010" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 458.139590][T10521] xt_policy: neither incoming nor outgoing policy selected [ 459.256438][ T29] audit: type=1400 audit(1733082032.836:344): avc: denied { create } for pid=10527 comm="syz.4.1017" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 459.262996][ T5821] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 459.276637][ C0] vkms_vblank_simulate: vblank timer overrun [ 459.291801][ T5821] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 459.658108][T10542] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1020'. [ 460.409523][ T25] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 460.590924][ T25] usb 5-1: Using ep0 maxpacket: 8 [ 460.949841][ T25] usb 5-1: config 0 has an invalid interface number: 44 but max is 0 [ 460.958101][ T25] usb 5-1: config 0 has an invalid descriptor of length 24, skipping remainder of the config [ 460.968555][ T25] usb 5-1: config 0 has no interface number 0 [ 460.974865][ T25] usb 5-1: config 0 interface 44 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 460.988049][ T25] usb 5-1: config 0 interface 44 has no altsetting 0 [ 460.996390][T10551] geneve0: entered promiscuous mode [ 461.170926][ T25] usb 5-1: New USB device found, idVendor=0586, idProduct=2000, bcdDevice=a9.12 [ 461.180005][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.198580][ T25] usb 5-1: Product: syz [ 461.208659][ T25] usb 5-1: Manufacturer: syz [ 461.220583][ T25] usb 5-1: SerialNumber: syz [ 461.236340][ T25] usb 5-1: config 0 descriptor?? [ 461.430651][ T5899] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 461.500661][ T1201] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 461.593483][T10566] tap0: tun_chr_ioctl cmd 1074025677 [ 461.599247][T10566] tap0: linktype set to 823 [ 461.600779][ T5899] usb 6-1: Using ep0 maxpacket: 8 [ 461.654558][ T5899] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 461.666779][ T1201] usb 1-1: Using ep0 maxpacket: 32 [ 461.674400][ T5899] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 461.695906][ T1201] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 461.712577][ T1201] usb 1-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 461.730780][ T1201] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.738825][ T1201] usb 1-1: Product: syz [ 461.743148][ T5899] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 99 [ 461.760747][ T5899] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 461.773870][ T1201] usb 1-1: Manufacturer: syz [ 461.778474][ T1201] usb 1-1: SerialNumber: syz [ 461.801478][ T1201] usb 1-1: config 0 descriptor?? [ 461.806616][ T5899] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 461.823095][ T1201] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 461.829578][ T5899] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.289892][T10581] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 462.815105][ T5899] usb 6-1: GET_CAPABILITIES returned 0 [ 462.820721][ T5899] usbtmc 6-1:16.0: can't read capabilities [ 463.203142][ T25] omninet 5-1:0.44: required endpoints missing [ 463.230256][ T25] usb 5-1: USB disconnect, device number 34 [ 463.379004][ T1201] gspca_m5602: Failed to find a sensor [ 463.390753][ T1201] ALi m5602 1-1:0.0: ALi m5602 webcam failed [ 463.423795][ T1201] usb 1-1: USB disconnect, device number 43 [ 463.525901][ T25] usb 6-1: USB disconnect, device number 19 [ 463.946265][T10605] No source specified [ 464.555617][T10602] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1027'. [ 465.433431][T10602] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1027'. [ 465.768968][T10612] No source specified [ 465.975929][T10629] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 466.737162][T10633] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1034'. [ 466.776538][T10633] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1034'. [ 466.990656][ T5904] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 467.150758][ T5904] usb 6-1: Using ep0 maxpacket: 8 [ 467.162537][ T5904] usb 6-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 467.225432][ T5904] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.436441][ T5904] usb 6-1: Product: syz [ 467.594290][ T5904] usb 6-1: Manufacturer: syz [ 467.611802][ T5904] usb 6-1: SerialNumber: syz [ 467.644971][ T5904] usb 6-1: config 0 descriptor?? [ 467.654416][ T5904] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 467.951323][T10635] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 467.996874][T10635] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 468.330721][ T5904] gspca_sonixj: reg_r err -32 [ 468.335458][ T5904] sonixj 6-1:0.0: probe with driver sonixj failed with error -32 [ 468.910997][T10654] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 469.070095][T10655] xt_CT: You must specify a L4 protocol and not use inversions on it [ 470.710997][ T1201] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 470.950637][ T1201] usb 1-1: Using ep0 maxpacket: 16 [ 471.136039][T10672] xt_CT: You must specify a L4 protocol and not use inversions on it [ 471.700703][ T1201] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 472.117533][T10664] geneve0: entered promiscuous mode [ 472.247286][ T1201] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 472.343870][T10680] xt_CT: You must specify a L4 protocol and not use inversions on it [ 472.934883][ T5904] usb 6-1: USB disconnect, device number 20 [ 472.946021][ T1201] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 472.968264][ T1201] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.980652][ T1201] usb 1-1: Product: syz [ 472.984843][ T1201] usb 1-1: Manufacturer: syz [ 472.989442][ T1201] usb 1-1: SerialNumber: syz [ 473.005389][ T1201] usb 1-1: config 0 descriptor?? [ 473.019593][ T1201] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 473.068143][ T1201] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 473.140082][T10686] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 473.271294][ T1201] em28xx 1-1:0.0: chip ID is em2765 [ 473.350844][ T5863] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 473.550934][ T5863] usb 5-1: Using ep0 maxpacket: 8 [ 473.622171][ T5863] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 473.844378][ T5863] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 474.014009][ T5863] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 99 [ 474.024035][ T5863] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 474.037165][ T5863] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 474.046268][ T5863] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.139631][ T5863] usb 5-1: can't set config #16, error -71 [ 474.148144][ T5863] usb 5-1: USB disconnect, device number 35 [ 474.179313][ T1201] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 474.230684][ T1201] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 474.237667][ T1201] em28xx 1-1:0.0: No AC97 audio processor [ 474.271546][ T1201] usb 1-1: USB disconnect, device number 44 [ 474.279536][ T1201] em28xx 1-1:0.0: Disconnecting em28xx [ 474.298299][ T1201] em28xx 1-1:0.0: Freeing device [ 474.754950][T10686] geneve0: entered promiscuous mode [ 474.780716][ T5850] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 475.153463][ T5850] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 475.164409][ T5850] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.173698][ T5850] usb 4-1: Product: syz [ 475.177960][ T5850] usb 4-1: Manufacturer: syz [ 475.191610][ T5850] usb 4-1: SerialNumber: syz [ 475.236759][T10711] xt_CT: You must specify a L4 protocol and not use inversions on it [ 475.409161][ T25] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 475.694686][ T5850] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 475.706508][ T47] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 475.720716][ T25] usb 6-1: Using ep0 maxpacket: 8 [ 475.729391][ T25] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 475.745996][ T25] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 475.750742][ T1201] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 475.756369][ T25] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 475.773884][ T25] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 475.783993][ T25] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 475.797573][ T25] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 475.806777][ T25] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 475.920704][ T1201] usb 5-1: Using ep0 maxpacket: 32 [ 475.933108][ T1201] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 475.937694][ T25] usbtmc 6-1:16.0: probe with driver usbtmc failed with error -22 [ 476.015305][T10704] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.016170][ T1201] usb 5-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 476.025012][T10704] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.077728][ T1201] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.105964][ T1201] usb 5-1: Product: syz [ 476.110279][ T1201] usb 5-1: Manufacturer: syz [ 476.130953][ T1201] usb 5-1: SerialNumber: syz [ 476.175642][ T1201] usb 5-1: config 0 descriptor?? [ 476.233874][ T1201] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 477.250820][ T47] usb 4-1: Service connection timeout for: 256 [ 477.258021][ T47] ath9k_htc 4-1:1.0: ath9k_htc: Unable to initialize HTC services [ 477.930766][ T47] ath9k_htc: Failed to initialize the device [ 477.950089][ T47] usb 4-1: ath9k_htc: USB layer deinitialized [ 478.261962][ T5897] usb 4-1: USB disconnect, device number 31 [ 478.368511][ T1201] gspca_m5602: Failed to find a sensor [ 478.381841][ T1201] ALi m5602 5-1:0.0: ALi m5602 webcam failed [ 478.432118][ T1201] usb 5-1: USB disconnect, device number 36 [ 478.720915][T10726] FAULT_INJECTION: forcing a failure. [ 478.720915][T10726] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 478.735370][T10726] CPU: 0 UID: 0 PID: 10726 Comm: syz.5.1058 Not tainted 6.12.0-syzkaller-12113-gbcc8eda6d349 #0 [ 478.745910][T10726] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 478.756059][T10726] Call Trace: [ 478.759432][T10726] [ 478.762432][T10726] dump_stack_lvl+0x16c/0x1f0 [ 478.767227][T10726] should_fail_ex+0x497/0x5b0 [ 478.771987][T10726] _copy_from_user+0x2e/0xd0 [ 478.776750][T10726] copy_msghdr_from_user+0x99/0x160 [ 478.782106][T10726] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 478.788052][T10726] ___sys_sendmsg+0xff/0x1e0 [ 478.792774][T10726] ? __pfx____sys_sendmsg+0x10/0x10 [ 478.798094][T10726] ? __pfx_lock_release+0x10/0x10 [ 478.803257][T10726] ? trace_lock_acquire+0x14e/0x1f0 [ 478.808635][T10726] ? __fget_files+0x206/0x3a0 [ 478.813478][T10726] __sys_sendmsg+0x16e/0x220 [ 478.818167][T10726] ? __pfx___sys_sendmsg+0x10/0x10 [ 478.823429][T10726] do_syscall_64+0xcd/0x250 [ 478.828041][T10726] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.834009][T10726] RIP: 0033:0x7f5178980849 [ 478.838474][T10726] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 478.858139][T10726] RSP: 002b:00007f5179746058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 478.866591][T10726] RAX: ffffffffffffffda RBX: 00007f5178b45fa0 RCX: 00007f5178980849 [ 478.874629][T10726] RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 [ 478.882675][T10726] RBP: 00007f51797460a0 R08: 0000000000000000 R09: 0000000000000000 [ 478.890701][T10726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 478.898725][T10726] R13: 0000000000000000 R14: 00007f5178b45fa0 R15: 00007fffb418e9c8 [ 478.906816][T10726] [ 478.987633][ T5899] usb 6-1: USB disconnect, device number 21 [ 479.559164][T10731] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 479.873136][T10733] xt_CT: You must specify a L4 protocol and not use inversions on it [ 480.180754][ T1201] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 480.341131][ T1201] usb 3-1: Using ep0 maxpacket: 8 [ 480.352146][ T1201] usb 3-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 480.367381][ T1201] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 480.376558][ T1201] usb 3-1: Product: syz [ 480.381858][ T1201] usb 3-1: Manufacturer: syz [ 480.386667][ T1201] usb 3-1: SerialNumber: syz [ 480.456885][ T1201] usb 3-1: config 0 descriptor?? [ 480.487958][ T1201] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 480.679618][T10735] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 480.690861][T10735] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 480.950642][ T1201] gspca_sonixj: reg_r err -32 [ 480.960647][ T1201] sonixj 3-1:0.0: probe with driver sonixj failed with error -32 [ 481.067019][T10731] geneve0: entered promiscuous mode [ 481.357257][T10751] xt_CT: You must specify a L4 protocol and not use inversions on it [ 481.980818][ T5899] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 481.991797][ T1201] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 482.622867][ T1201] usb 5-1: Using ep0 maxpacket: 8 [ 482.780486][ T5899] usb 6-1: Using ep0 maxpacket: 8 [ 482.801152][ T1201] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 482.813352][ T1201] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 482.824044][ T1201] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 99 [ 482.837240][ T5899] usb 6-1: device descriptor read/all, error -71 [ 482.844265][ T1201] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 483.094284][T10761] xt_CT: You must specify a L4 protocol and not use inversions on it [ 483.509682][ T1201] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 483.518963][ T1201] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 483.586649][T10763] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 483.646576][ T1201] usb 5-1: can't set config #16, error -71 [ 483.656864][ T1201] usb 5-1: USB disconnect, device number 37 [ 483.910710][T10772] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 483.940746][ T5826] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 484.011075][ T5897] usb 3-1: USB disconnect, device number 36 [ 484.130914][ T5826] usb 4-1: Using ep0 maxpacket: 32 [ 484.146698][ T5826] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 484.162560][ T5826] usb 4-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 484.190859][ T5826] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.223368][ T5826] usb 4-1: Product: syz [ 484.244466][ T5826] usb 4-1: Manufacturer: syz [ 484.279656][ T5826] usb 4-1: SerialNumber: syz [ 484.632222][ T5826] usb 4-1: config 0 descriptor?? [ 484.640106][ T5826] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 484.695618][T10763] geneve0: entered promiscuous mode [ 484.760901][ T5899] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 484.867846][T10772] geneve0: entered promiscuous mode [ 484.913087][ T5899] usb 3-1: Using ep0 maxpacket: 32 [ 484.921270][ T5899] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 484.931695][ T5899] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 484.943226][ T5899] usb 3-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 484.953000][ T5899] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.961046][ T47] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 484.972191][ T5899] usb 3-1: Product: syz [ 484.976424][ T5899] usb 3-1: Manufacturer: syz [ 484.982260][ T5899] usb 3-1: SerialNumber: syz [ 484.993765][ T5899] usb 3-1: config 0 descriptor?? [ 485.110795][ T47] usb 1-1: Using ep0 maxpacket: 8 [ 485.128381][ T47] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 485.139880][ T25] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 485.151936][ T47] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 485.163287][ T47] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 485.173634][ T47] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 485.189370][ T47] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 485.193857][ T5826] gspca_m5602: Failed to find a sensor [ 485.207149][ T47] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 485.208924][ T5826] ALi m5602 4-1:0.0: ALi m5602 webcam failed [ 485.224172][ T47] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.245236][ T47] usbtmc 1-1:16.0: probe with driver usbtmc failed with error -22 [ 485.255484][ T5826] usb 4-1: USB disconnect, device number 32 [ 485.311244][ T25] usb 6-1: Using ep0 maxpacket: 8 [ 485.318498][ T25] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 485.329897][ T25] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 485.340079][ T25] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 485.350152][ T25] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 485.360058][ T25] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 485.374220][ T25] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 485.383418][ T25] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.399887][ T25] usbtmc 6-1:16.0: probe with driver usbtmc failed with error -22 [ 486.102756][ T5821] Bluetooth: unknown link type 128 [ 486.256182][T10792] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 486.262343][T10792] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 486.268798][T10792] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 486.275059][T10792] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 486.281139][T10792] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 486.287662][T10792] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 486.678665][ T29] audit: type=1400 audit(1733082060.256:345): avc: denied { bind } for pid=10799 comm="syz.3.1076" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 486.704930][ T29] audit: type=1400 audit(1733082060.256:346): avc: denied { node_bind } for pid=10799 comm="syz.3.1076" saddr=255.255.255.255 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 486.946835][ T47] usb 1-1: USB disconnect, device number 45 [ 487.097350][T10810] xt_addrtype: ipv6 does not support BROADCAST matching [ 487.106246][T10810] netlink: 'syz.4.1078': attribute type 8 has an invalid length. [ 487.114051][T10810] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1078'. [ 487.787602][ T1201] usb 6-1: USB disconnect, device number 24 [ 487.880847][T10814] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 487.908193][T10815] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 487.932801][ T47] usb 3-1: USB disconnect, device number 37 [ 488.190726][ T5821] Bluetooth: hci0: command 0x0c1a tx timeout [ 488.270681][ T5821] Bluetooth: hci3: command 0x0c1a tx timeout [ 488.276836][ T5821] Bluetooth: hci1: command 0x0c1a tx timeout [ 488.360670][T10823] xt_CT: You must specify a L4 protocol and not use inversions on it [ 488.917765][ T5822] Bluetooth: hci5: command 0x0406 tx timeout [ 488.923961][ T5822] Bluetooth: hci4: command 0x0405 tx timeout [ 490.000768][ T47] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 490.008506][ T5863] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 490.160652][ T5863] usb 6-1: Using ep0 maxpacket: 32 [ 490.165834][ T47] usb 5-1: Using ep0 maxpacket: 8 [ 490.171047][ T25] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 490.182266][ T5863] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 490.193987][ T47] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 490.206449][ T47] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 490.216667][ T5863] usb 6-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 490.227218][ T5863] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.326554][ T5863] usb 6-1: Product: syz [ 490.330937][ T47] usb 5-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 490.344140][ T5863] usb 6-1: Manufacturer: syz [ 490.348745][ T5863] usb 6-1: SerialNumber: syz [ 490.356704][ T47] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 490.372540][ T5863] usb 6-1: config 0 descriptor?? [ 490.990643][ T5821] Bluetooth: hci5: command 0x0406 tx timeout [ 491.011515][ T5863] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 491.018057][ T47] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.026298][ T25] usb 1-1: Using ep0 maxpacket: 8 [ 491.125791][ T25] usb 1-1: device descriptor read/all, error -71 [ 491.275868][ T47] usb 5-1: can't set config #16, error -71 [ 491.314994][ T47] usb 5-1: USB disconnect, device number 38 [ 491.566209][ T5863] gspca_m5602: Failed to find a sensor [ 491.577397][ T5863] ALi m5602 6-1:0.0: ALi m5602 webcam failed [ 491.708739][ T5863] usb 6-1: USB disconnect, device number 25 [ 493.242178][T10877] xt_addrtype: ipv6 does not support BROADCAST matching [ 493.251166][T10877] netlink: 'syz.5.1090': attribute type 8 has an invalid length. [ 493.258913][T10877] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1090'. [ 493.862698][T10871] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 495.006618][ T29] audit: type=1400 audit(1733082068.586:347): avc: denied { setopt } for pid=10892 comm="syz.3.1095" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 495.979013][ T47] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 496.170658][ T47] usb 5-1: Using ep0 maxpacket: 8 [ 496.240737][ T5826] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 496.264024][ T47] usb 5-1: device descriptor read/all, error -71 [ 496.403713][ T5826] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 496.423221][ T5826] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.470718][ T5826] usb 4-1: Product: syz [ 496.486150][ T5826] usb 4-1: Manufacturer: syz [ 496.519044][ T5826] usb 4-1: SerialNumber: syz [ 496.584509][ T5826] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 496.603166][ T1201] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 496.807671][T10908] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 496.821164][T10908] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 496.960784][ T47] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 497.180658][ T47] usb 5-1: Using ep0 maxpacket: 32 [ 497.191795][ T47] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 497.204005][ T47] usb 5-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 497.220700][ T47] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.229373][ T47] usb 5-1: Product: syz [ 497.239196][ T47] usb 5-1: Manufacturer: syz [ 497.247776][ T47] usb 5-1: SerialNumber: syz [ 498.246796][ T47] usb 5-1: config 0 descriptor?? [ 498.357919][ T47] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 498.798070][T10929] xt_addrtype: ipv6 does not support BROADCAST matching [ 498.808549][T10929] netlink: 'syz.0.1103': attribute type 8 has an invalid length. [ 498.816476][T10929] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1103'. [ 499.335528][ T1201] usb 4-1: Service connection timeout for: 256 [ 499.341883][ T1201] ath9k_htc 4-1:1.0: ath9k_htc: Unable to initialize HTC services [ 499.403994][ T1201] ath9k_htc: Failed to initialize the device [ 499.467504][ T1201] usb 4-1: ath9k_htc: USB layer deinitialized [ 499.584998][ T47] gspca_m5602: Failed to find a sensor [ 499.623983][ T47] ALi m5602 5-1:0.0: ALi m5602 webcam failed [ 499.644610][ T1201] usb 4-1: USB disconnect, device number 33 [ 499.650620][ T47] usb 5-1: USB disconnect, device number 40 [ 500.660734][ T29] audit: type=1400 audit(1733082073.706:348): avc: denied { write } for pid=10938 comm="syz.4.1107" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 500.678795][T10944] FAULT_INJECTION: forcing a failure. [ 500.678795][T10944] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 500.715735][T10946] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 500.727561][T10944] CPU: 0 UID: 0 PID: 10944 Comm: syz.0.1108 Not tainted 6.12.0-syzkaller-12113-gbcc8eda6d349 #0 [ 500.737976][T10944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 500.748117][T10944] Call Trace: [ 500.751382][T10944] [ 500.754302][T10944] dump_stack_lvl+0x16c/0x1f0 [ 500.758982][T10944] should_fail_ex+0x497/0x5b0 [ 500.763685][T10944] _copy_from_user+0x2e/0xd0 [ 500.768274][T10944] do_sock_getsockopt+0x5f6/0x800 [ 500.773285][T10944] ? trace_lock_acquire+0x140/0x1f0 [ 500.778492][T10944] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 500.784022][T10944] ? lock_acquire+0x2f/0xb0 [ 500.788503][T10944] ? __fget_files+0x40/0x3a0 [ 500.793105][T10944] ? __fget_files+0x206/0x3a0 [ 500.797787][T10944] __sys_getsockopt+0x12f/0x260 [ 500.802642][T10944] __x64_sys_getsockopt+0xbd/0x160 [ 500.807746][T10944] ? do_syscall_64+0x91/0x250 [ 500.812438][T10944] ? lockdep_hardirqs_on+0x7c/0x110 [ 500.817635][T10944] do_syscall_64+0xcd/0x250 [ 500.822141][T10944] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.828021][T10944] RIP: 0033:0x7feb65780849 [ 500.832435][T10944] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 500.852056][T10944] RSP: 002b:00007feb664aa058 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 500.860489][T10944] RAX: ffffffffffffffda RBX: 00007feb65945fa0 RCX: 00007feb65780849 [ 500.868472][T10944] RDX: 0000000000000003 RSI: 0000000000000001 RDI: 0000000000000003 [ 500.876454][T10944] RBP: 00007feb664aa0a0 R08: 0000000020000140 R09: 0000000000000000 [ 500.884432][T10944] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 500.892409][T10944] R13: 0000000000000000 R14: 00007feb65945fa0 R15: 00007fffd0cd9818 [ 500.900402][T10944] [ 501.967084][ T29] audit: type=1400 audit(1733082075.546:349): avc: denied { create } for pid=10959 comm="syz.4.1112" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 502.417958][ T29] audit: type=1400 audit(1733082075.986:350): avc: denied { connect } for pid=10959 comm="syz.4.1112" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 502.540602][ T117] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 502.694728][T10946] geneve0: entered promiscuous mode [ 502.940068][ T29] audit: type=1400 audit(1733082075.996:351): avc: denied { write } for pid=10959 comm="syz.4.1112" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 502.961712][ T117] usb 3-1: Using ep0 maxpacket: 8 [ 502.968977][ T29] audit: type=1400 audit(1733082076.236:352): avc: denied { getopt } for pid=10959 comm="syz.4.1112" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 503.013128][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 503.020915][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 503.057164][ T117] usb 3-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 503.066740][ T117] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 503.075584][ T117] usb 3-1: Product: syz [ 503.081166][ T117] usb 3-1: Manufacturer: syz [ 503.085970][ T117] usb 3-1: SerialNumber: syz [ 503.110941][ T117] usb 3-1: config 0 descriptor?? [ 503.136918][ T117] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 503.190771][ T47] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 503.310622][ T29] audit: type=1400 audit(1733082076.236:353): avc: denied { getopt } for pid=10959 comm="syz.4.1112" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 503.370657][ T47] usb 4-1: Using ep0 maxpacket: 8 [ 503.383757][T10968] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.408071][ T47] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 503.437885][T10968] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.456623][ T47] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 503.580936][ T47] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 503.625971][ T47] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 503.680852][ T47] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 503.740465][ T47] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 503.787097][ T47] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.804328][ T117] gspca_sonixj: reg_r err -32 [ 503.811699][ T117] sonixj 3-1:0.0: probe with driver sonixj failed with error -32 [ 503.848453][ T47] usbtmc 4-1:16.0: probe with driver usbtmc failed with error -22 [ 504.586501][ T5899] usb 4-1: USB disconnect, device number 34 [ 504.918009][T10979] xt_CT: You must specify a L4 protocol and not use inversions on it [ 506.632299][T10993] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 508.418001][ T5826] usb 3-1: USB disconnect, device number 38 [ 509.680673][ T5899] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 509.973796][ T5899] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 509.983283][ T5899] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.005229][ T5899] usb 1-1: Product: syz [ 510.039144][ T5899] usb 1-1: Manufacturer: syz [ 510.611365][ T5899] usb 1-1: SerialNumber: syz [ 510.623318][ T5899] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 510.745146][ T1201] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 511.218237][T10998] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 511.508095][T10998] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 511.616168][T11028] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 512.002523][ T1201] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 512.009565][ T1201] ath9k_htc: Failed to initialize the device [ 512.468171][ T1201] usb 1-1: ath9k_htc: USB layer deinitialized [ 513.762232][ T5899] usb 1-1: USB disconnect, device number 48 [ 515.130633][ T117] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 515.307016][ T117] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 515.325623][ T117] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 515.338301][ T117] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 515.353191][ T117] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 515.369592][ T117] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 515.397242][ T117] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 515.409366][ T117] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 515.432993][ T117] usb 1-1: Product: syz [ 515.437429][ T117] usb 1-1: Manufacturer: syz [ 515.567934][ T117] cdc_wdm 1-1:1.0: skipping garbage [ 515.573695][ T117] cdc_wdm 1-1:1.0: skipping garbage [ 515.582064][ T117] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 515.590697][ T117] cdc_wdm 1-1:1.0: Unknown control protocol [ 516.248685][ T25] usb 1-1: USB disconnect, device number 49 [ 516.704848][T11073] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 517.381394][ T29] audit: type=1400 audit(1733082090.956:354): avc: denied { view } for pid=11059 comm="syz.5.1135" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 517.549507][T11080] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 517.820599][ T25] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 518.004993][ T25] usb 4-1: Using ep0 maxpacket: 8 [ 518.080627][ T5899] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 518.271067][ T5899] usb 1-1: Using ep0 maxpacket: 8 [ 518.281902][ T5899] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 518.308038][ T5899] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 518.318287][ T5905] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 518.342095][ T5899] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 518.372447][T11073] geneve0: entered promiscuous mode [ 518.377885][ T5899] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 518.397139][ T5899] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 518.443795][ T5899] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 518.456744][ T5899] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 518.477459][ T5905] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 518.495198][ T5905] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.510480][ T5899] usbtmc 1-1:16.0: probe with driver usbtmc failed with error -22 [ 518.528718][ T5905] usb 6-1: Product: syz [ 518.550572][ T5905] usb 6-1: Manufacturer: syz [ 518.557295][ T5905] usb 6-1: SerialNumber: syz [ 518.576570][ T5905] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 518.596763][ T5899] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 518.660734][ T1201] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 518.810605][ T25] usb 4-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 518.819686][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.821629][ T1201] usb 5-1: Using ep0 maxpacket: 8 [ 518.833376][T11088] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 518.840807][ T25] usb 4-1: Product: syz [ 518.844136][T11088] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 518.845834][ T25] usb 4-1: Manufacturer: syz [ 518.865477][ T25] usb 4-1: SerialNumber: syz [ 518.870660][ T1201] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 518.886415][ T1201] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 518.896023][ T25] usb 4-1: config 0 descriptor?? [ 518.896655][ T1201] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 518.911475][ T1201] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 518.921449][ T1201] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 518.934541][ T1201] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 518.943809][ T1201] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 518.960157][ T1201] usbtmc 5-1:16.0: probe with driver usbtmc failed with error -22 [ 518.965101][ T25] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 519.310410][T11082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 519.467708][T11082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 519.697230][ T25] gspca_sonixj: reg_r err -32 [ 519.704636][ T25] sonixj 4-1:0.0: probe with driver sonixj failed with error -32 [ 520.780989][ T1201] usb 1-1: USB disconnect, device number 50 [ 520.901106][ T25] usb 5-1: USB disconnect, device number 41 [ 520.962846][ T47] usb 6-1: USB disconnect, device number 26 [ 520.972520][ T5899] usb 6-1: Service connection timeout for: 256 [ 520.978706][ T5899] ath9k_htc 6-1:1.0: ath9k_htc: Unable to initialize HTC services [ 520.989597][ T5899] ath9k_htc: Failed to initialize the device [ 521.000620][ T47] usb 6-1: ath9k_htc: USB layer deinitialized [ 521.330662][ T1201] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 521.510584][ T1201] usb 1-1: Using ep0 maxpacket: 8 [ 521.529866][ T1201] usb 1-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 522.112492][ T1201] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.139630][ T1201] usb 1-1: Product: syz [ 522.146166][ T1201] usb 1-1: Manufacturer: syz [ 522.153382][ T1201] usb 1-1: SerialNumber: syz [ 522.159998][ T1201] usb 1-1: config 0 descriptor?? [ 522.167131][ T1201] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 522.210646][ T25] usb 4-1: USB disconnect, device number 35 [ 522.403152][T11099] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 522.423589][T11099] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 522.696062][ T1201] gspca_sonixj: reg_r err -32 [ 522.705549][ T1201] sonixj 1-1:0.0: probe with driver sonixj failed with error -32 [ 522.880720][ T25] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 523.220731][ T25] usb 6-1: Using ep0 maxpacket: 8 [ 523.234733][ T25] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 523.456633][ T25] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 523.467211][ T25] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 99 [ 523.477638][ T25] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 523.490688][ T25] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 523.499747][ T25] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 523.847553][ T25] usb 6-1: GET_CAPABILITIES returned 0 [ 523.853274][ T25] usbtmc 6-1:16.0: can't read capabilities [ 523.862349][ T5821] Bluetooth: unknown link type 128 [ 523.986000][T11132] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 524.060515][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.069650][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.078728][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.087811][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.098977][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.108131][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.117222][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.126305][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.135384][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.144458][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.153537][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.163233][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.172382][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.181501][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.190630][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.216974][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 524.354779][T11132] geneve0: entered promiscuous mode [ 524.670857][ T5861] usb 1-1: USB disconnect, device number 51 [ 524.677174][T11130] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 524.683393][T11130] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 524.690212][T11130] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 524.696409][T11130] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 524.702476][T11130] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 524.751096][ T5897] usb 6-1: USB disconnect, device number 27 [ 524.954388][ T1201] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 525.090177][T11142] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 525.273611][ T29] audit: type=1400 audit(1733082098.836:355): avc: denied { write } for pid=11143 comm="syz.2.1156" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 525.716588][ T29] audit: type=1400 audit(1733082099.296:356): avc: denied { create } for pid=11143 comm="syz.2.1156" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 525.740602][ T1201] usb 5-1: Using ep0 maxpacket: 8 [ 525.816663][ T1201] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 525.837180][ T29] audit: type=1400 audit(1733082099.296:357): avc: denied { accept } for pid=11143 comm="syz.2.1156" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 525.884155][ T1201] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 525.927784][ T1201] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 99 [ 525.940724][ T5899] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 525.950607][ T5821] Bluetooth: hci0: command 0x0c1a tx timeout [ 525.989143][ T1201] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 526.130756][T11152] ebtables: ebtables: counters copy to user failed while replacing table [ 526.156626][ T1201] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 526.165828][ T1201] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.190988][ T25] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 526.716634][ T5899] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 526.726337][ T5899] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.735380][ T5899] usb 6-1: Product: syz [ 526.739564][ T5899] usb 6-1: Manufacturer: syz [ 526.745928][ T5899] usb 6-1: SerialNumber: syz [ 526.752225][ T5821] Bluetooth: hci5: command 0x0406 tx timeout [ 526.758302][ T5821] Bluetooth: hci4: command 0x0405 tx timeout [ 526.772849][ T5821] Bluetooth: hci3: command 0x0c1a tx timeout [ 526.779077][ T5821] Bluetooth: hci1: command 0x0c1a tx timeout [ 526.804076][ T5899] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 526.858973][ T5905] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 526.916811][ T25] usb 3-1: config index 0 descriptor too short (expected 100, got 36) [ 526.935327][ T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 526.978114][ T1201] usb 5-1: usb_control_msg returned -32 [ 526.980621][ T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 526.984079][ T1201] usbtmc 5-1:16.0: can't read capabilities [ 527.021099][ T1201] usb 5-1: USB disconnect, device number 42 [ 527.057879][ T25] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 527.089259][T11151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 527.118812][T11151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 527.127059][ T25] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2c24, bcdDevice= 0.00 [ 527.175593][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 527.277361][ T25] usb 3-1: config 0 descriptor?? [ 527.297915][T11142] geneve2: entered promiscuous mode [ 527.560675][ T1201] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 527.720684][ T1201] usb 4-1: Using ep0 maxpacket: 8 [ 527.736500][ T1201] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 527.780575][ T1201] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 527.799424][ T25] pyra 0003:1E7D:2C24.0001: hidraw0: USB HID v0.00 Device [HID 1e7d:2c24] on usb-dummy_hcd.2-1/input0 [ 527.810782][ T1201] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 527.810815][ T1201] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 527.810901][ T1201] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 527.810946][ T1201] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 527.810975][ T1201] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 527.889047][ T1201] usbtmc 4-1:16.0: probe with driver usbtmc failed with error -22 [ 528.294378][ T5905] usb 6-1: Service connection timeout for: 256 [ 528.301565][ T5905] ath9k_htc 6-1:1.0: ath9k_htc: Unable to initialize HTC services [ 528.328913][ T5905] ath9k_htc: Failed to initialize the device [ 528.338008][ T5905] usb 6-1: ath9k_htc: USB layer deinitialized [ 528.405500][T11171] xt_CT: You must specify a L4 protocol and not use inversions on it [ 529.144857][ T5861] usb 3-1: USB disconnect, device number 39 [ 529.235215][ T25] usb 6-1: USB disconnect, device number 28 [ 529.440747][ T5822] Bluetooth: unknown link type 128 [ 530.099580][ T1201] usb 4-1: USB disconnect, device number 36 [ 530.206350][T11180] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 530.223904][T11180] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 530.229916][T11180] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 530.236937][T11180] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 530.244925][T11180] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 530.516056][T11187] FAULT_INJECTION: forcing a failure. [ 530.516056][T11187] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 530.529678][T11187] CPU: 0 UID: 0 PID: 11187 Comm: syz.2.1165 Not tainted 6.12.0-syzkaller-12113-gbcc8eda6d349 #0 [ 530.540104][T11187] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 530.550161][T11187] Call Trace: [ 530.553439][T11187] [ 530.556372][T11187] dump_stack_lvl+0x16c/0x1f0 [ 530.561063][T11187] should_fail_ex+0x497/0x5b0 [ 530.565762][T11187] _copy_from_user+0x2e/0xd0 [ 530.570357][T11187] do_sock_getsockopt+0x5f6/0x800 [ 530.575392][T11187] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 530.580961][T11187] __sys_getsockopt+0x12f/0x260 [ 530.585823][T11187] __x64_sys_getsockopt+0xbd/0x160 [ 530.590937][T11187] ? do_syscall_64+0x91/0x250 [ 530.595625][T11187] ? lockdep_hardirqs_on+0x7c/0x110 [ 530.600831][T11187] do_syscall_64+0xcd/0x250 [ 530.605346][T11187] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.611250][T11187] RIP: 0033:0x7f38beb80849 [ 530.615668][T11187] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 530.635313][T11187] RSP: 002b:00007f38bf8af058 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 530.643740][T11187] RAX: ffffffffffffffda RBX: 00007f38bed46160 RCX: 00007f38beb80849 [ 530.651729][T11187] RDX: 0000000000000483 RSI: 0000000000000000 RDI: 0000000000000005 [ 530.659718][T11187] RBP: 00007f38bf8af0a0 R08: 0000000020000180 R09: 0000000000000000 [ 530.667698][T11187] R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000001 [ 530.675671][T11187] R13: 0000000000000000 R14: 00007f38bed46160 R15: 00007ffeddef4ca8 [ 530.683660][T11187] [ 530.929004][ T5821] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 530.986444][ T1201] IPVS: starting estimator thread 0... [ 531.189753][T11193] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1166'. [ 531.198741][T11193] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1166'. [ 531.806948][ T5821] Bluetooth: hci0: command 0x0c1a tx timeout [ 532.280585][ T5822] Bluetooth: hci5: command 0x0406 tx timeout [ 532.286684][ T5822] Bluetooth: hci4: command 0x0405 tx timeout [ 532.292889][ T5822] Bluetooth: hci3: command 0x0c1a tx timeout [ 532.330585][ T5821] Bluetooth: hci1: command 0x0c1a tx timeout [ 532.344760][T11192] IPVS: using max 33 ests per chain, 79200 per kthread [ 533.690812][ T25] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 535.126111][ T25] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 535.135402][ T25] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 535.146174][ T25] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 535.155288][ T25] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 535.166335][ T25] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 535.264848][ T25] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 535.274726][ T25] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 535.282857][ T25] usb 4-1: Product: syz [ 535.287094][ T25] usb 4-1: Manufacturer: syz [ 535.312416][ T25] cdc_wdm 4-1:1.0: skipping garbage [ 535.317681][ T25] cdc_wdm 4-1:1.0: skipping garbage [ 535.326940][ T25] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 535.332973][ T25] cdc_wdm 4-1:1.0: Unknown control protocol [ 535.429537][ T5905] usb 4-1: USB disconnect, device number 37 [ 535.591122][T11226] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 535.597207][T11226] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 535.603371][T11226] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 535.609406][T11226] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 535.615598][T11226] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 536.676693][T11239] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 537.981571][ T5822] Bluetooth: hci0: command 0x0c1a tx timeout [ 537.987621][ T5822] Bluetooth: hci5: command 0x0406 tx timeout [ 537.994311][ T5822] Bluetooth: hci4: command 0x0405 tx timeout [ 538.001403][ T5816] Bluetooth: hci3: command 0x0c1a tx timeout [ 538.007514][ T5822] Bluetooth: hci1: command 0x0c1a tx timeout [ 538.416787][T11254] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1181'. [ 538.425799][T11254] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1181'. [ 538.455149][ T117] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 539.100621][ T117] usb 6-1: Using ep0 maxpacket: 8 [ 539.137029][ T117] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 539.401531][T11262] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 539.590710][ T117] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 539.822454][T11265] xt_CT: You must specify a L4 protocol and not use inversions on it [ 539.863231][ T117] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 539.897300][ T117] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 539.907399][ T117] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 539.920890][ T117] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 539.930144][ T117] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 540.939158][ T117] usb 6-1: can't set config #16, error -71 [ 541.048558][ T117] usb 6-1: USB disconnect, device number 29 [ 541.994397][T11273] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 542.008106][T11273] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 542.014316][T11273] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 542.021031][T11273] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 542.038414][T11273] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 543.589919][T11250] Bluetooth: hci0: command 0x0c1a tx timeout [ 544.036289][T11250] Bluetooth: hci4: command 0x0405 tx timeout [ 544.043827][T11250] Bluetooth: hci3: command 0x0c1a tx timeout [ 544.047946][ T5821] Bluetooth: hci1: command 0x0c1a tx timeout [ 544.113201][ T5822] Bluetooth: hci5: command 0x0406 tx timeout [ 546.681148][T11333] No source specified [ 548.360882][ T25] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 548.654159][ T25] usb 3-1: Using ep0 maxpacket: 32 [ 548.671967][ T25] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 548.694981][ T25] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 548.744916][ T25] usb 3-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 548.756314][ T25] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.767366][ T25] usb 3-1: Product: syz [ 549.179670][ T25] usb 3-1: Manufacturer: syz [ 549.208690][ T25] usb 3-1: SerialNumber: syz [ 549.236379][ T25] usb 3-1: config 0 descriptor?? [ 549.626864][T11365] xt_CT: You must specify a L4 protocol and not use inversions on it [ 550.566799][T11373] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 552.858440][T11388] block nbd3: NBD_DISCONNECT [ 556.250471][T11407] xt_CT: You must specify a L4 protocol and not use inversions on it [ 557.320083][T11415] No source specified [ 557.423896][T11416] xt_CT: You must specify a L4 protocol and not use inversions on it [ 562.462558][T11450] xt_CT: You must specify a L4 protocol and not use inversions on it [ 563.175886][ T47] usb 3-1: USB disconnect, device number 40 [ 563.486716][T11458] No source specified [ 563.606373][ T5821] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 563.627944][ T5821] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 563.638621][ T5821] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 563.647902][ T5821] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 563.658418][ T5821] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 563.667505][ T5821] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 563.722138][ T3479] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 563.809829][ T3479] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 563.877169][ T3479] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 563.926446][T11459] chnl_net:caif_netlink_parms(): no params data found [ 564.203607][ T3479] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 564.274085][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 564.280627][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.464515][T11472] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 564.891602][T11459] bridge0: port 1(bridge_slave_0) entered blocking state [ 564.939208][T11459] bridge0: port 1(bridge_slave_0) entered disabled state [ 564.974930][T11459] bridge_slave_0: entered allmulticast mode [ 565.079658][T11459] bridge_slave_0: entered promiscuous mode [ 565.139388][T11459] bridge0: port 2(bridge_slave_1) entered blocking state [ 565.167374][T11459] bridge0: port 2(bridge_slave_1) entered disabled state [ 565.205952][T11459] bridge_slave_1: entered allmulticast mode [ 565.215322][T11459] bridge_slave_1: entered promiscuous mode [ 565.393643][T11459] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 565.400682][ T1201] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 565.429816][T11459] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 565.719227][ T5821] Bluetooth: hci0: command tx timeout [ 565.849748][ T1201] usb 4-1: Using ep0 maxpacket: 32 [ 565.870441][ T5822] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 565.880099][ T5822] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 565.889923][ T5822] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 565.898603][ T1201] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 565.911837][ T5822] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 565.920774][ T1201] usb 4-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 565.929932][ T1201] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.938020][ T1201] usb 4-1: Product: syz [ 565.942335][ T1201] usb 4-1: Manufacturer: syz [ 565.946969][ T5822] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 565.955115][ T1201] usb 4-1: SerialNumber: syz [ 565.959899][ T5822] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 565.969385][ T1201] usb 4-1: config 0 descriptor?? [ 565.983085][ T1201] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 566.047643][ T3479] bridge_slave_1: left allmulticast mode [ 566.072604][ T3479] bridge_slave_1: left promiscuous mode [ 566.079511][ T3479] bridge0: port 2(bridge_slave_1) entered disabled state [ 566.096556][ T3479] bridge_slave_0: left allmulticast mode [ 566.117024][ T3479] bridge_slave_0: left promiscuous mode [ 566.122840][ T3479] bridge0: port 1(bridge_slave_0) entered disabled state [ 566.880021][T11486] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 567.142425][ T3479] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 567.176946][ T3479] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 567.203768][ T3479] bond0 (unregistering): Released all slaves [ 567.274772][T11459] team0: Port device team_slave_0 added [ 567.407103][T11459] team0: Port device team_slave_1 added [ 567.646176][T11459] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 567.647621][ T1201] gspca_m5602: Failed to find a sensor [ 567.660604][ T1201] ALi m5602 4-1:0.0: ALi m5602 webcam failed [ 567.670643][T11459] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 567.690951][ T1201] usb 4-1: USB disconnect, device number 38 [ 567.738318][T11459] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 567.773459][T11459] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 567.790976][ T5822] Bluetooth: hci0: command tx timeout [ 567.804243][T11459] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 567.848377][T11459] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 568.021247][ T47] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 568.030781][ T5822] Bluetooth: hci2: command tx timeout [ 568.082289][T11459] hsr_slave_0: entered promiscuous mode [ 568.109667][T11459] hsr_slave_1: entered promiscuous mode [ 568.119908][T11459] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 568.135169][T11459] Cannot create hsr debugfs directory [ 568.264988][ T3479] hsr_slave_0: left promiscuous mode [ 568.277787][ T3479] hsr_slave_1: left promiscuous mode [ 568.287462][ T3479] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 568.290606][ T47] usb 5-1: Using ep0 maxpacket: 8 [ 568.309211][ T3479] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 568.310307][ T47] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 568.331355][ T3479] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 568.339068][ T47] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 568.350716][ T3479] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 568.380455][ T3479] veth1_macvtap: left promiscuous mode [ 568.397036][ T3479] veth0_macvtap: left promiscuous mode [ 568.411435][ T3479] veth1_vlan: left promiscuous mode [ 568.418780][ T3479] veth0_vlan: left promiscuous mode [ 568.420098][ T47] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 99 [ 568.462232][ T47] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 568.486271][ T47] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 568.507095][ T47] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 568.842257][T11509] xt_CT: You must specify a L4 protocol and not use inversions on it [ 569.203832][ T47] usb 5-1: usb_control_msg returned -32 [ 569.242574][ T47] usbtmc 5-1:16.0: can't read capabilities [ 569.337351][ T47] usb 5-1: USB disconnect, device number 43 [ 569.796366][ T117] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 569.877524][ T5822] Bluetooth: hci0: command tx timeout [ 569.964102][ T117] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 569.973409][ T117] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 569.981631][ T117] usb 4-1: Product: syz [ 569.985865][ T117] usb 4-1: Manufacturer: syz [ 569.990463][ T117] usb 4-1: SerialNumber: syz [ 570.017244][ T117] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 570.037399][ T47] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 570.120902][ T5822] Bluetooth: hci2: command tx timeout [ 570.481517][ T3479] team0 (unregistering): Port device team_slave_1 removed [ 570.605864][T11512] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 570.654355][ T3479] team0 (unregistering): Port device team_slave_0 removed [ 570.774231][T11512] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 571.080765][ T47] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 571.185551][ T47] ath9k_htc: Failed to initialize the device [ 571.384518][ T47] usb 4-1: ath9k_htc: USB layer deinitialized [ 571.961056][ T5822] Bluetooth: hci0: command tx timeout [ 572.130638][ T5826] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 572.210743][ T5822] Bluetooth: hci2: command tx timeout [ 572.300727][ T5826] usb 5-1: Using ep0 maxpacket: 8 [ 572.309648][ T5826] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 572.332062][ T5826] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 572.351082][ T5826] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 99 [ 572.373528][ T5826] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 572.415452][ T3479] IPVS: stop unused estimator thread 0... [ 572.424191][ T5826] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 572.466535][ T5826] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 573.165548][ T117] usb 4-1: USB disconnect, device number 39 [ 573.254726][ T3479] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.301070][ T5826] usb 5-1: usb_control_msg returned -32 [ 573.309082][ T5826] usbtmc 5-1:16.0: can't read capabilities [ 573.324495][T11479] chnl_net:caif_netlink_parms(): no params data found [ 573.379427][ T5826] usb 5-1: USB disconnect, device number 44 [ 573.957855][ T3479] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.166439][ T3479] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.270602][ T5822] Bluetooth: hci2: command tx timeout [ 574.282085][T11459] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 574.338207][T11479] bridge0: port 1(bridge_slave_0) entered blocking state [ 574.380739][T11479] bridge0: port 1(bridge_slave_0) entered disabled state [ 574.389140][T11479] bridge_slave_0: entered allmulticast mode [ 574.402325][T11479] bridge_slave_0: entered promiscuous mode [ 574.415476][T11459] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 574.482533][ T3479] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.550289][T11479] bridge0: port 2(bridge_slave_1) entered blocking state [ 574.569561][T11479] bridge0: port 2(bridge_slave_1) entered disabled state [ 574.582924][T11479] bridge_slave_1: entered allmulticast mode [ 574.600913][T11479] bridge_slave_1: entered promiscuous mode [ 574.613870][T11459] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 574.677571][T11459] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 574.811510][T11479] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 574.963117][T11479] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 575.196519][T11571] xt_CT: You must specify a L4 protocol and not use inversions on it [ 575.915237][T11479] team0: Port device team_slave_0 added [ 576.033767][T11479] team0: Port device team_slave_1 added [ 576.077143][T11459] 8021q: adding VLAN 0 to HW filter on device bond0 [ 576.086872][ T3479] bridge_slave_1: left allmulticast mode [ 576.097889][ T3479] bridge_slave_1: left promiscuous mode [ 576.119848][ T3479] bridge0: port 2(bridge_slave_1) entered disabled state [ 576.195199][ T3479] bridge_slave_0: left allmulticast mode [ 576.210339][ T3479] bridge_slave_0: left promiscuous mode [ 576.226614][ T3479] bridge0: port 1(bridge_slave_0) entered disabled state [ 578.192320][ T3479] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 578.198830][T11597] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 578.223243][ T3479] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 578.237037][ T3479] bond0 (unregistering): Released all slaves [ 578.268568][T11479] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 578.285044][T11479] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 578.324473][T11479] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 578.470637][T11459] 8021q: adding VLAN 0 to HW filter on device team0 [ 578.491749][T11479] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 578.508898][T11479] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 578.544862][T11479] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 578.988748][T11459] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 579.019645][T11459] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 579.277934][ T8708] bridge0: port 1(bridge_slave_0) entered blocking state [ 579.285084][ T8708] bridge0: port 1(bridge_slave_0) entered forwarding state [ 579.322114][ T8708] bridge0: port 2(bridge_slave_1) entered blocking state [ 579.329226][ T8708] bridge0: port 2(bridge_slave_1) entered forwarding state [ 579.863602][T11479] hsr_slave_0: entered promiscuous mode [ 580.037632][T11479] hsr_slave_1: entered promiscuous mode [ 580.066871][ T5826] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 580.250814][ T5826] usb 4-1: Using ep0 maxpacket: 8 [ 580.257873][ T5826] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 580.269606][ T5826] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 580.281119][ T5826] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 99 [ 580.291682][ T5826] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 580.305833][ T5826] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 580.314960][ T5826] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 580.436642][T11459] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 580.679624][ T5826] usb 4-1: usb_control_msg returned -32 [ 580.685283][ T5826] usbtmc 4-1:16.0: can't read capabilities [ 580.814573][ T3479] hsr_slave_0: left promiscuous mode [ 580.835380][ T3479] hsr_slave_1: left promiscuous mode [ 580.853703][ T3479] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 580.864718][ T3479] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 580.873516][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 580.882647][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 580.891756][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 580.900871][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 580.909970][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 580.919180][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 580.955618][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 580.965095][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 580.974226][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 580.983308][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 580.992378][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 581.001443][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 581.010527][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 581.020779][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 581.029895][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 581.038998][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 581.050586][ T3479] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 581.067112][ T117] usb 4-1: USB disconnect, device number 40 [ 581.140655][ T3479] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 581.227149][ T3479] veth1_macvtap: left promiscuous mode [ 581.240815][ T3479] veth0_macvtap: left promiscuous mode [ 581.260986][ T3479] veth1_vlan: left promiscuous mode [ 581.278496][ T3479] veth0_vlan: left promiscuous mode [ 582.569134][T11640] xt_CT: You must specify a L4 protocol and not use inversions on it [ 584.417690][ T3479] team0 (unregistering): Port device team_slave_1 removed [ 584.525979][ T3479] team0 (unregistering): Port device team_slave_0 removed [ 585.030696][ T5826] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 585.252308][ T5826] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 585.266237][ T5826] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 585.275166][ T5826] usb 4-1: Product: syz [ 585.280054][ T5826] usb 4-1: Manufacturer: syz [ 585.290177][ T5826] usb 4-1: SerialNumber: syz [ 585.322504][ T5826] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 585.404016][ T5905] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 585.622560][T11479] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 585.672903][T11479] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 585.706677][T11479] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 585.715648][T11655] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 585.758442][T11655] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 585.817146][T11479] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 586.006850][T11674] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 586.196327][ T3479] IPVS: stop unused estimator thread 0... [ 586.270538][T11459] veth0_vlan: entered promiscuous mode [ 586.401333][T11459] veth1_vlan: entered promiscuous mode [ 586.764852][T11479] 8021q: adding VLAN 0 to HW filter on device bond0 [ 586.830708][T11459] veth0_macvtap: entered promiscuous mode [ 586.884584][T11479] 8021q: adding VLAN 0 to HW filter on device team0 [ 586.928061][T11459] veth1_macvtap: entered promiscuous mode [ 586.949340][T11689] i2c i2c-0: Invalid block write size 34 [ 586.997875][ T3434] bridge0: port 1(bridge_slave_0) entered blocking state [ 587.005025][ T3434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 587.073841][ T5905] usb 4-1: Service connection timeout for: 256 [ 587.088809][ T5905] ath9k_htc 4-1:1.0: ath9k_htc: Unable to initialize HTC services [ 587.099078][T11674] geneve0: entered promiscuous mode [ 587.124583][ T8708] bridge0: port 2(bridge_slave_1) entered blocking state [ 587.131748][ T8708] bridge0: port 2(bridge_slave_1) entered forwarding state [ 587.147098][ T5905] ath9k_htc: Failed to initialize the device [ 587.265572][ T5905] usb 4-1: ath9k_htc: USB layer deinitialized [ 587.286761][T11459] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 587.304020][T11459] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 587.319787][T11459] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 587.367191][T11695] xt_CT: You must specify a L4 protocol and not use inversions on it [ 587.416909][ T117] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 587.438469][T11459] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 587.975133][T11459] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 588.081002][T11459] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 588.084600][ T25] usb 4-1: USB disconnect, device number 41 [ 588.115192][T11459] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 588.133897][ T117] usb 6-1: Using ep0 maxpacket: 8 [ 588.145180][ T117] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 588.226175][ T117] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 588.244789][T11459] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 588.261967][ T117] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 99 [ 588.580877][ T117] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 588.596240][T11459] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 588.608381][T11459] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 588.620386][ T117] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 588.629953][T11459] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 588.641438][ T117] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 588.668598][T11459] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 588.714691][T11459] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 588.756428][T11459] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 588.821937][T11459] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 588.842799][T11459] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.022784][T11459] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.025426][ T117] usb 6-1: GET_CAPABILITIES returned 0 [ 589.194955][T11459] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.579006][ T117] usbtmc 6-1:16.0: can't read capabilities [ 589.932762][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 589.942337][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 590.107210][ T5863] usb 6-1: USB disconnect, device number 30 [ 590.801261][ T6981] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 590.843339][T11479] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 590.850418][ T6981] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 592.255505][T11755] xt_CT: You must specify a L4 protocol and not use inversions on it [ 593.231770][T11479] veth0_vlan: entered promiscuous mode [ 593.236458][T11479] veth1_vlan: entered promiscuous mode [ 594.240195][T11479] veth0_macvtap: entered promiscuous mode [ 594.284136][T11479] veth1_macvtap: entered promiscuous mode [ 594.340626][T11479] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 594.390551][T11479] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.446210][T11762] xt_CT: You must specify a L4 protocol and not use inversions on it [ 594.550665][T11479] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 594.605456][T11479] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.634867][ T5863] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 594.743967][T11479] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 594.790962][T11479] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.828006][T11479] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 594.875988][T11479] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 594.886280][ T5863] usb 7-1: Using ep0 maxpacket: 8 [ 594.927940][T11479] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 594.958936][T11479] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 595.007733][T11479] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 595.028039][T11479] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 595.049904][T11479] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 595.157865][ T5863] usb 7-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 595.167036][ T5863] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 595.175168][ T5863] usb 7-1: Product: syz [ 595.176109][T11479] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 595.179334][ T5863] usb 7-1: Manufacturer: syz [ 595.179353][ T5863] usb 7-1: SerialNumber: syz [ 595.213887][ T5863] usb 7-1: config 0 descriptor?? [ 595.760649][T11479] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 595.779674][T11479] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 595.807405][T11479] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 595.825273][T11479] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 595.893802][ T5863] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 595.929736][T11479] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.967571][T11479] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.003928][T11479] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.029896][T11479] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.192298][ T5863] gspca_sonixj: reg_r err -32 [ 596.203210][ T5863] sonixj 7-1:0.0: probe with driver sonixj failed with error -32 [ 596.240597][ T25] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 597.325045][ T3506] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.340715][ T25] usb 5-1: Using ep0 maxpacket: 32 [ 597.348737][ T3506] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.351976][ T25] usb 5-1: config 32 has an invalid interface number: 76 but max is 0 [ 597.376884][ T25] usb 5-1: config 32 has no interface number 0 [ 597.406543][ T25] usb 5-1: config 32 interface 76 altsetting 0 endpoint 0xC has an invalid bInterval 129, changing to 11 [ 597.424902][ T25] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=2b.e3 [ 597.570614][ T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 598.287680][ T25] usbtest 5-1:32.76: Linux gadget zero [ 598.298484][ T25] usbtest 5-1:32.76: high-speed {control in/out int-out} tests (+alt) [ 598.315532][ T6981] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 598.380643][ T6981] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 598.522497][ T25] usb 5-1: USB disconnect, device number 45 [ 598.900210][ T5899] usb 7-1: USB disconnect, device number 2 [ 600.997237][T11838] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1291'. [ 601.006193][T11838] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1291'. [ 601.641047][T11842] xt_CT: You must specify a L4 protocol and not use inversions on it [ 603.016809][ T29] audit: type=1400 audit(1733082176.596:358): avc: denied { write } for pid=11849 comm="syz.4.1295" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 603.072350][ T29] audit: type=1400 audit(1733082176.626:359): avc: denied { sqpoll } for pid=11849 comm="syz.4.1295" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 603.284714][T11855] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 604.852220][T11874] FAULT_INJECTION: forcing a failure. [ 604.852220][T11874] name failslab, interval 1, probability 0, space 0, times 0 [ 604.865210][T11874] CPU: 1 UID: 0 PID: 11874 Comm: syz.4.1299 Not tainted 6.12.0-syzkaller-12113-gbcc8eda6d349 #0 [ 604.875644][T11874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 604.885731][T11874] Call Trace: [ 604.889018][T11874] [ 604.891953][T11874] dump_stack_lvl+0x16c/0x1f0 [ 604.896654][T11874] should_fail_ex+0x497/0x5b0 [ 604.901358][T11874] ? fs_reclaim_acquire+0xae/0x150 [ 604.906511][T11874] should_failslab+0xc2/0x120 [ 604.911231][T11874] __kmalloc_noprof+0xcb/0x510 [ 604.916014][T11874] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 604.921679][T11874] tomoyo_realpath_from_path+0xb9/0x720 [ 604.927253][T11874] ? tomoyo_path_number_perm+0x235/0x590 [ 604.932903][T11874] ? tomoyo_path_number_perm+0x235/0x590 [ 604.938559][T11874] tomoyo_path_number_perm+0x248/0x590 [ 604.944034][T11874] ? tomoyo_path_number_perm+0x235/0x590 [ 604.949684][T11874] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 604.955706][T11874] ? __pfx_lock_release+0x10/0x10 [ 604.960751][T11874] ? trace_lock_acquire+0x14e/0x1f0 [ 604.965980][T11874] ? lock_acquire+0x2f/0xb0 [ 604.970495][T11874] ? __fget_files+0x40/0x3a0 [ 604.975092][T11874] ? __fget_files+0x206/0x3a0 [ 604.979765][T11874] security_file_ioctl+0x9b/0x240 [ 604.984800][T11874] __x64_sys_ioctl+0xb7/0x200 [ 604.989488][T11874] do_syscall_64+0xcd/0x250 [ 604.993994][T11874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.999886][T11874] RIP: 0033:0x7fe722580849 [ 605.004289][T11874] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 605.023891][T11874] RSP: 002b:00007fe7233ea058 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 605.032297][T11874] RAX: ffffffffffffffda RBX: 00007fe722745fa0 RCX: 00007fe722580849 [ 605.040256][T11874] RDX: 00000000200002c0 RSI: 0000000000008946 RDI: 0000000000000003 [ 605.048212][T11874] RBP: 00007fe7233ea0a0 R08: 0000000000000000 R09: 0000000000000000 [ 605.056171][T11874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 605.064148][T11874] R13: 0000000000000000 R14: 00007fe722745fa0 R15: 00007ffc9f8bf688 [ 605.072122][T11874] [ 605.075577][T11874] ERROR: Out of memory at tomoyo_realpath_from_path. [ 605.204185][T11855] geneve0: entered promiscuous mode [ 605.566672][ T5899] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 605.710682][ T5899] usb 7-1: Using ep0 maxpacket: 8 [ 605.730636][ T5899] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 605.730719][ T5899] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 605.730792][ T5899] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 99 [ 605.730857][ T5899] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 605.730976][ T5899] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 605.731040][ T5899] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 606.104859][ T5899] usb 7-1: GET_CAPABILITIES returned 0 [ 606.105082][ T5899] usbtmc 7-1:16.0: can't read capabilities [ 606.415198][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.424298][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.433355][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.442404][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.451460][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.460534][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.469611][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.478663][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.487719][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.496776][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.505855][ C0] vkms_vblank_simulate: vblank timer overrun [ 606.588346][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.597592][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.606682][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.615746][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.624844][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.633905][ C0] usbtmc 7-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 606.643031][ C0] vkms_vblank_simulate: vblank timer overrun [ 606.690131][T11913] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1302'. [ 606.699252][T11913] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1302'. [ 606.815213][ T5822] Bluetooth: unknown link type 128 [ 606.996796][T11917] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 607.002930][ T1201] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 607.022287][T11917] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 607.036793][T11917] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 607.045556][T11917] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 607.053916][T11917] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 607.062086][T11917] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 607.073986][T11917] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 607.080126][T11917] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 607.090332][T11917] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 607.170604][ T1201] usb 8-1: Using ep0 maxpacket: 32 [ 607.177039][ T1201] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 607.200880][ T5897] usb 7-1: USB disconnect, device number 3 [ 607.226295][ T1201] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 607.297796][ T1201] usb 8-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 607.307943][ T1201] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 607.321037][ T1201] usb 8-1: Product: syz [ 607.325793][ T1201] usb 8-1: Manufacturer: syz [ 607.331575][ T1201] usb 8-1: SerialNumber: syz [ 607.339241][ T1201] usb 8-1: config 0 descriptor?? [ 607.667186][T11926] xt_CT: You must specify a L4 protocol and not use inversions on it [ 608.881244][ T5822] Bluetooth: unknown link type 128 [ 608.910658][ T5822] Bluetooth: hci1: command 0x0c1a tx timeout [ 609.077767][ T5822] Bluetooth: hci0: command 0x0c1a tx timeout [ 609.084041][ T5821] Bluetooth: hci5: command 0x0406 tx timeout [ 609.090349][ T5821] Bluetooth: hci3: command 0x0c1a tx timeout [ 609.150626][ T5822] Bluetooth: hci2: command 0x0c1a tx timeout [ 609.390701][T11943] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 609.397443][T11943] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 609.494068][T11943] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 609.500344][T11943] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 609.703771][T11943] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 610.591552][ T117] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 610.879219][ T117] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 610.954927][ T117] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 610.989295][ T117] usb 7-1: Product: syz [ 611.016523][ T117] usb 7-1: Manufacturer: syz [ 611.031628][ T117] usb 7-1: SerialNumber: syz [ 611.105050][ T117] usb 7-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 611.128580][ T5863] usb 7-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 611.416938][T11953] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 611.437014][T11953] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 611.480811][T11250] Bluetooth: hci1: command 0x0c1a tx timeout [ 611.486943][ T5822] Bluetooth: hci3: command 0x0c1a tx timeout [ 611.551777][T11250] Bluetooth: hci5: command 0x0406 tx timeout [ 611.557938][ T5822] Bluetooth: hci0: command 0x0c1a tx timeout [ 611.721862][ T5822] Bluetooth: hci2: command 0x0c1a tx timeout [ 612.522471][ T5897] usb 8-1: USB disconnect, device number 2 [ 613.072343][ T5863] usb 7-1: Service connection timeout for: 256 [ 613.089293][ T5863] ath9k_htc 7-1:1.0: ath9k_htc: Unable to initialize HTC services [ 613.820955][ T5822] Bluetooth: hci0: command 0x0c1a tx timeout [ 613.827377][ T5822] Bluetooth: hci2: command 0x0c1a tx timeout [ 613.901050][ T117] usb 7-1: USB disconnect, device number 4 [ 613.912281][ T5863] ath9k_htc: Failed to initialize the device [ 613.929982][ T117] usb 7-1: ath9k_htc: USB layer deinitialized [ 614.153108][ T29] audit: type=1400 audit(1733082187.736:360): avc: denied { setrlimit } for pid=11995 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=process permissive=1 [ 614.970922][ T29] audit: type=1400 audit(1733082188.556:361): avc: denied { append } for pid=12006 comm="syz.6.1320" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 615.092871][T12007] nfs: Unknown parameter ' [ 615.092871][T12007] ' [ 615.182419][T12012] xt_CT: You must specify a L4 protocol and not use inversions on it [ 615.880570][T11250] Bluetooth: hci0: command 0x0c1a tx timeout [ 616.637795][ T5905] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 617.612481][ T5905] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 617.623659][ T5905] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 617.650587][ T5905] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 617.690985][ T5905] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 617.720232][ T5905] usb 7-1: config 0 descriptor?? [ 617.810786][ T1201] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 617.969546][ T1201] usb 8-1: Using ep0 maxpacket: 32 [ 617.986886][ T1201] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 618.004959][ T1201] usb 8-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 618.038928][ T1201] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 618.067827][ T1201] usb 8-1: Product: syz [ 618.274699][ T1201] usb 8-1: Manufacturer: syz [ 619.131828][ T1201] usb 8-1: SerialNumber: syz [ 619.150923][ T5905] usbhid 7-1:0.0: can't add hid device: -71 [ 619.157276][ T5905] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 619.227737][ T1201] usb 8-1: config 0 descriptor?? [ 619.242001][ T1201] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 619.253068][ T5905] usb 7-1: USB disconnect, device number 5 [ 619.831153][ T5905] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 619.909580][T12051] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 619.916113][T12051] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 619.923214][T12051] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 619.930115][T12051] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 619.936410][T12051] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 620.806831][ T5905] usb 7-1: Using ep0 maxpacket: 32 [ 621.326126][ T5905] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 621.336300][ T5905] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 621.389714][T12068] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 621.418419][ T5905] usb 7-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 621.433419][ T5905] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 621.450355][ T5905] usb 7-1: Product: syz [ 621.458486][ T5905] usb 7-1: Manufacturer: syz [ 621.468988][ T5905] usb 7-1: SerialNumber: syz [ 621.486752][ T5905] usb 7-1: config 0 descriptor?? [ 621.790685][ T5822] Bluetooth: hci1: command 0x0c1a tx timeout [ 621.950951][ T5822] Bluetooth: hci2: command 0x0c1a tx timeout [ 621.957514][T11250] Bluetooth: hci0: command 0x0c1a tx timeout [ 621.963766][T11250] Bluetooth: hci5: command 0x0406 tx timeout [ 621.970206][T11250] Bluetooth: hci3: command 0x0c1a tx timeout [ 622.494124][ T25] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 622.650026][T12102] x_tables: ip_tables: osf match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 622.662368][ T25] usb 5-1: Using ep0 maxpacket: 8 [ 622.669093][ T25] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 622.682145][ T25] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 622.700800][ T25] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 99 [ 622.719960][ T25] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 622.740180][ T25] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 622.749962][ T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 623.085036][ T25] usb 5-1: GET_CAPABILITIES returned 0 [ 623.103835][ T25] usbtmc 5-1:16.0: can't read capabilities [ 623.482365][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.497614][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.507933][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.517065][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.526198][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.535353][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.544480][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.553645][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.807119][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.816276][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.825414][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.834537][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.843664][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.852771][ C1] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.902513][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.911663][ C0] usbtmc 5-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 623.956594][ T1201] gspca_m5602: Failed to find a sensor [ 623.979703][ T117] usb 7-1: USB disconnect, device number 6 [ 624.009126][ T1201] ALi m5602 8-1:0.0: ALi m5602 webcam failed [ 624.065441][ T1201] usb 8-1: USB disconnect, device number 3 [ 624.187646][ T29] audit: type=1400 audit(1733082197.766:362): avc: denied { bind } for pid=12127 comm="syz.5.1336" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 624.235464][ T29] audit: type=1400 audit(1733082197.796:363): avc: denied { listen } for pid=12127 comm="syz.5.1336" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 624.276232][T12136] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1336'. [ 624.333255][T12136] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1336'. [ 624.342657][ T29] audit: type=1400 audit(1733082197.796:364): avc: denied { accept } for pid=12127 comm="syz.5.1336" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 624.400377][ T29] audit: type=1400 audit(1733082197.806:365): avc: denied { call } for pid=12130 comm="syz.7.1337" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 624.425238][T12136] dummy0: entered promiscuous mode [ 624.447097][T12136] bond0: entered promiscuous mode [ 624.452288][ T117] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 624.467646][T12136] bond_slave_0: entered promiscuous mode [ 624.477424][T12136] bond_slave_1: entered promiscuous mode [ 624.518341][ T5905] usb 5-1: USB disconnect, device number 46 [ 624.610560][ T117] usb 4-1: Using ep0 maxpacket: 8 [ 624.630612][ T117] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 624.667665][ T117] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 624.700058][ T117] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 99 [ 624.744638][ T117] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 624.810789][ T117] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 624.830364][ T117] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 625.065703][ T117] usb 4-1: GET_CAPABILITIES returned 0 [ 625.089267][ T117] usbtmc 4-1:16.0: can't read capabilities [ 625.287729][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.296892][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.306031][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.315183][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.324326][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.333446][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.343334][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.352457][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.361584][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.370714][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.379837][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.388970][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.414798][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.423963][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.433096][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.442224][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 625.530368][ T29] audit: type=1400 audit(1733082199.106:366): avc: denied { write } for pid=12183 comm="syz.7.1351" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 625.637898][T12190] loop7: detected capacity change from 0 to 16384 [ 625.713433][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 625.719903][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.921057][T12193] loop7: detected capacity change from 16384 to 16383 [ 626.016510][ T25] usb 4-1: USB disconnect, device number 42 [ 626.307989][ T29] audit: type=1400 audit(1733082199.886:367): avc: denied { ioctl } for pid=12214 comm="syz.5.1356" path="/dev/ptyqe" dev="devtmpfs" ino=133 ioctlcmd=0x5423 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 626.749931][ T29] audit: type=1400 audit(1733082200.286:368): avc: denied { bind } for pid=12258 comm="syz.3.1357" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 626.846000][ T29] audit: type=1400 audit(1733082200.296:369): avc: denied { setopt } for pid=12258 comm="syz.3.1357" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 626.899201][ T5822] Bluetooth: hci2: command 0x0c1a tx timeout [ 627.134332][ T29] audit: type=1400 audit(1733082200.716:370): avc: denied { connect } for pid=12276 comm="syz.4.1361" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 627.153988][ T29] audit: type=1400 audit(1733082200.716:371): avc: denied { setopt } for pid=12276 comm="syz.4.1361" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 628.207110][T12329] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1377'. [ 629.069343][ T5905] kernel write not supported for file /uhid (pid: 5905 comm: kworker/0:8) [ 629.078413][ T5826] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 629.081630][T12363] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1386'. [ 629.266484][ T5826] usb 4-1: config index 0 descriptor too short (expected 45, got 36) [ 629.290991][ T5826] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 629.352463][ T5826] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 629.395966][ T5826] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 629.433723][ T5826] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 629.477100][ T5826] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 629.486041][ T29] kauditd_printk_skb: 10 callbacks suppressed [ 629.486057][ T29] audit: type=1400 audit(1733082203.056:382): avc: denied { bind } for pid=12384 comm="syz.4.1394" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 629.506328][ T5826] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.512643][T12385] atomic_op ffff888035edc998 conn xmit_atomic 0000000000000000 [ 629.526611][ T5826] usb 4-1: config 0 descriptor?? [ 629.549713][T12358] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 629.556370][ T29] audit: type=1400 audit(1733082203.096:383): avc: denied { write } for pid=12384 comm="syz.4.1394" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 629.619996][T12389] vlan2: entered promiscuous mode [ 629.742597][T12393] mac80211_hwsim hwsim16 wlan1: entered allmulticast mode [ 629.812173][ T29] audit: type=1400 audit(1733082203.396:384): avc: denied { write } for pid=12394 comm="syz.4.1399" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 629.812421][T12396] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1399'. [ 629.880272][ T29] audit: type=1400 audit(1733082203.396:385): avc: denied { nlmsg_write } for pid=12394 comm="syz.4.1399" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 630.002864][ T5826] plantronics 0003:047F:FFFF.0002: unknown main item tag 0xd [ 630.012494][ T5826] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 630.043612][ T5826] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 630.068426][T12405] batman_adv: batadv0: Adding interface: dummy0 [ 630.074961][T12405] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 630.159517][T12405] batman_adv: batadv0: Interface activated: dummy0 [ 630.228322][T12405] batadv0: mtu less than device minimum [ 630.230047][T12405] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 630.231799][T12405] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 630.233406][T12405] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 630.235063][T12405] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 630.236785][T12405] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 630.238528][T12405] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 630.240191][T12405] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 630.241774][T12405] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 630.327461][ T29] audit: type=1400 audit(1733082203.806:386): avc: denied { ioctl } for pid=12404 comm="syz.7.1403" path="socket:[39827]" dev="sockfs" ino=39827 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 630.332049][T12405] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 630.403181][ T29] audit: type=1400 audit(1733082203.866:387): avc: denied { read } for pid=12400 comm="syz.6.1401" lport=47244 faddr=fc02::1 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 630.464099][ T5897] usb 4-1: USB disconnect, device number 43 [ 630.565475][T12413] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1404'. [ 630.574728][T12413] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1404'. [ 630.584022][T12413] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1404'. [ 630.593250][T12413] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1404'. [ 630.894988][ T29] audit: type=1400 audit(1733082204.456:388): avc: denied { bind } for pid=12422 comm="syz.4.1408" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 630.982959][T12426] bridge0: port 3(syz_tun) entered blocking state [ 631.008408][T12426] bridge0: port 3(syz_tun) entered disabled state [ 631.031340][T12426] syz_tun: entered allmulticast mode [ 631.053547][T12426] syz_tun: entered promiscuous mode [ 631.171677][T12426] bridge0: port 3(syz_tun) entered blocking state [ 631.178477][T12426] bridge0: port 3(syz_tun) entered forwarding state [ 631.198509][T12435] gre1: entered promiscuous mode [ 631.230915][ T47] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 631.422336][ T47] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 5 [ 631.437066][ T47] usb 8-1: config 0 has no interface number 0 [ 631.490576][ T47] usb 8-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 631.531078][ T47] usb 8-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 631.570427][ T47] usb 8-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 631.648780][ T47] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 631.708470][ T47] usb 8-1: config 0 descriptor?? [ 631.883868][T12465] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 632.061278][ T5826] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 632.153234][ T29] audit: type=1400 audit(1733082205.736:389): avc: denied { getopt } for pid=12479 comm="syz.5.1419" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 632.184225][ T47] uclogic 0003:256C:006D.0003: No inputs registered, leaving [ 632.222244][ T5826] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 632.222699][ T47] uclogic 0003:256C:006D.0003: hidraw0: USB HID v0.00 Device [HID 256c:006d] on usb-dummy_hcd.7-1/input1 [ 632.233512][ T5826] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 632.255298][ T5826] usb 7-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 632.265255][ T5826] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 632.288169][ T5826] usb 7-1: config 0 descriptor?? [ 632.405026][ T47] usb 8-1: USB disconnect, device number 4 [ 632.729938][ T29] audit: type=1326 audit(1733082206.306:390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12469 comm="syz.6.1418" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f66eed80849 code=0x7ffc0000 [ 632.732225][ T5826] petalynx 0003:18B1:0037.0004: item fetching failed at offset 0/5 [ 632.801044][ T5826] petalynx 0003:18B1:0037.0004: parse failed [ 632.823880][ T5826] petalynx 0003:18B1:0037.0004: probe with driver petalynx failed with error -22 [ 632.841025][ T29] audit: type=1326 audit(1733082206.306:391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12469 comm="syz.6.1418" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f66eed80849 code=0x7ffc0000 [ 632.963321][ T5826] usb 7-1: USB disconnect, device number 7 [ 633.233696][T12505] evm: overlay not supported [ 633.440686][ T5826] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 633.550699][ T5905] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 633.626839][ T5826] usb 5-1: Using ep0 maxpacket: 32 [ 633.774237][ T5826] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 633.799300][ T5826] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 633.855059][ T5826] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 633.869589][ T5905] usb 8-1: Using ep0 maxpacket: 32 [ 633.934276][ T5905] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 634.026940][ T5826] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 634.051493][ T5826] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 634.064455][ T5905] usb 8-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=66.4d [ 634.073774][ T5905] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.087219][ T5905] usb 8-1: Product: syz [ 634.094355][ T5826] usb 5-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 634.110611][ T5826] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.118698][ T5905] usb 8-1: Manufacturer: syz [ 634.131917][ T5905] usb 8-1: SerialNumber: syz [ 634.140845][ T5826] usb 5-1: Product: syz [ 634.153105][ T5905] usb 8-1: config 0 descriptor?? [ 634.158151][ T5826] usb 5-1: Manufacturer: syz [ 634.168268][ T5826] usb 5-1: SerialNumber: syz [ 634.175662][ T5905] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 634.192705][ T5826] usb 5-1: config 0 descriptor?? [ 634.910287][ T5826] iforce 5-1:0.0: usb_submit_urb failed: -32 [ 634.931061][ T5826] input input7: Device does not respond to id packet M [ 634.985309][ T5826] iforce 5-1:0.0: usb_submit_urb failed: -32 [ 635.025235][ T29] kauditd_printk_skb: 20 callbacks suppressed [ 635.025252][ T29] audit: type=1400 audit(1733082208.566:412): avc: denied { create } for pid=12538 comm="syz.6.1440" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 635.066252][ T5826] input input7: Device does not respond to id packet P [ 635.236485][ T5826] iforce 5-1:0.0: usb_submit_urb failed: -32 [ 635.242762][ T5826] input input7: Device does not respond to id packet B [ 635.288247][ T5905] gspca_m5602: Failed to find a sensor [ 635.303108][ T5905] ALi m5602 8-1:0.0: ALi m5602 webcam failed [ 635.353028][ T5905] usb 8-1: USB disconnect, device number 5 [ 635.416313][ T29] audit: type=1400 audit(1733082208.996:413): avc: denied { write } for pid=12538 comm="syz.6.1440" path="socket:[40185]" dev="sockfs" ino=40185 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 635.615572][T12548] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1436'. [ 635.624605][T12548] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1436'. [ 635.861153][ T5826] iforce 5-1:0.0: usb_submit_urb failed: -71 [ 635.867642][ T5826] iforce 5-1:0.0: usb_submit_urb failed: -71 [ 635.875122][ T5826] iforce 5-1:0.0: usb_submit_urb failed: -71 [ 635.881690][ T5826] iforce 5-1:0.0: usb_submit_urb failed: -71 [ 635.892010][ T5826] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input7 [ 635.909113][ T5826] usb 5-1: USB disconnect, device number 47 [ 636.003224][ T29] audit: type=1400 audit(1733082209.196:414): avc: denied { read } for pid=12525 comm="syz.5.1436" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 636.550978][ T117] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 636.716442][ T117] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 636.733274][ T117] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 636.875445][ T117] usb 8-1: Product: syz [ 636.879661][ T117] usb 8-1: Manufacturer: syz [ 636.888616][ T117] usb 8-1: SerialNumber: syz [ 637.473504][ T117] usb 8-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 637.703094][ T5863] usb 8-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 637.908719][T12556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 637.954655][T12556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 638.410659][ T5826] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 638.564646][ T5826] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 638.585135][ T5826] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid maxpacket 12592, setting to 1024 [ 638.637368][ T5826] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 1024 [ 638.698292][ T5826] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 638.757387][ T5826] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 638.807693][T12592] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 638.828220][ T5826] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 639.159640][ T5822] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 639.334884][ T5826] usb 6-1: USB disconnect, device number 31 [ 687.156368][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 687.162804][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 692.100618][ C1] sched: DL replenish lagged too much [ 744.750487][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 744.757500][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P52/1:b..l [ 744.765895][ C0] rcu: (detected by 0, t=10502 jiffies, g=51249, q=261 ncpus=2) [ 744.773624][ C0] task:kworker/u8:3 state:R running task stack:24080 pid:52 tgid:52 ppid:2 flags:0x00004000 [ 744.786791][ C0] Workqueue: bat_events batadv_nc_worker [ 744.792542][ C0] Call Trace: [ 744.795831][ C0] [ 744.798769][ C0] __schedule+0xe58/0x5ad0 [ 744.803206][ C0] ? __pfx_mark_lock+0x10/0x10 [ 744.808008][ C0] ? arch_stack_walk+0x95/0x100 [ 744.812926][ C0] ? __pfx_mark_lock+0x10/0x10 [ 744.817722][ C0] ? mark_lock+0xb5/0xc60 [ 744.822081][ C0] ? __pfx___schedule+0x10/0x10 [ 744.826961][ C0] ? __lock_acquire+0xcc5/0x3c40 [ 744.831923][ C0] ? mark_held_locks+0x9f/0xe0 [ 744.836758][ C0] preempt_schedule_irq+0x51/0x90 [ 744.841807][ C0] irqentry_exit+0x36/0x90 [ 744.846241][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 744.852256][ C0] RIP: 0010:lock_release+0x3e5/0x6f0 [ 744.857565][ C0] Code: 7e 83 f8 01 0f 85 fe 01 00 00 9c 58 f6 c4 02 0f 85 e9 01 00 00 48 f7 04 24 00 02 00 00 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 c7 43 08 00 00 00 00 48 8b 84 24 88 [ 744.877201][ C0] RSP: 0018:ffffc90000bd7ac8 EFLAGS: 00000206 [ 744.883287][ C0] RAX: dffffc0000000000 RBX: 1ffff9200017af5b RCX: ffffc90000bd7b18 [ 744.891275][ C0] RDX: 1ffff110045d75e2 RSI: ffffffff8b6cdb40 RDI: ffffffff8bd1b460 [ 744.899263][ C0] RBP: d9f48db66023708a R08: 0000000000000000 R09: fffffbfff20be082 [ 744.907247][ C0] R10: ffffffff905f0417 R11: 0000000000000002 R12: 0000000000000002 [ 744.915224][ C0] R13: 0000000000000003 R14: ffff888022ebaf18 R15: ffff888022eba440 [ 744.923223][ C0] ? batadv_nc_worker+0x887/0x1060 [ 744.928361][ C0] ? __pfx_lock_release+0x10/0x10 [ 744.933398][ C0] ? trace_lock_acquire+0x14e/0x1f0 [ 744.938620][ C0] ? lock_acquire+0x2f/0xb0 [ 744.943221][ C0] ? batadv_nc_worker+0x164/0x1060 [ 744.948356][ C0] batadv_nc_worker+0x88c/0x1060 [ 744.953330][ C0] ? __pfx_batadv_nc_worker+0x10/0x10 [ 744.958728][ C0] ? rcu_is_watching+0x12/0xc0 [ 744.963516][ C0] ? trace_lock_acquire+0x14e/0x1f0 [ 744.968735][ C0] ? process_one_work+0x921/0x1ba0 [ 744.973864][ C0] ? lock_acquire+0x2f/0xb0 [ 744.978385][ C0] ? process_one_work+0x921/0x1ba0 [ 744.983547][ C0] process_one_work+0x9c5/0x1ba0 [ 744.988534][ C0] ? __pfx_batadv_iv_send_outstanding_bat_ogm_packet+0x10/0x10 [ 744.996128][ C0] ? __pfx_process_one_work+0x10/0x10 [ 745.001512][ C0] ? rcu_is_watching+0x12/0xc0 [ 745.006328][ C0] ? assign_work+0x1a0/0x250 [ 745.010931][ C0] worker_thread+0x6c8/0xf00 [ 745.015546][ C0] ? __pfx_worker_thread+0x10/0x10 [ 745.020672][ C0] kthread+0x2c1/0x3a0 [ 745.024759][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 745.030014][ C0] ? __pfx_kthread+0x10/0x10 [ 745.034619][ C0] ret_from_fork+0x45/0x80 [ 745.039042][ C0] ? __pfx_kthread+0x10/0x10 [ 745.043648][ C0] ret_from_fork_asm+0x1a/0x30 [ 745.048471][ C0] [ 745.051494][ C0] rcu: rcu_preempt kthread starved for 9490 jiffies! g51249 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 745.062608][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 745.072576][ C0] rcu: RCU grace-period kthread stack dump: [ 745.078463][ C0] task:rcu_preempt state:R running task stack:27600 pid:17 tgid:17 ppid:2 flags:0x00004000 [ 745.090277][ C0] Call Trace: [ 745.093579][ C0] [ 745.096528][ C0] __schedule+0xe58/0x5ad0 [ 745.100967][ C0] ? __pfx___lock_acquire+0x10/0x10 [ 745.106204][ C0] ? __pfx___schedule+0x10/0x10 [ 745.111082][ C0] ? schedule+0x298/0x350 [ 745.115437][ C0] ? __pfx_lock_release+0x10/0x10 [ 745.120502][ C0] ? lock_acquire+0x2f/0xb0 [ 745.125014][ C0] ? schedule+0x1fd/0x350 [ 745.129357][ C0] schedule+0xe7/0x350 [ 745.133438][ C0] schedule_timeout+0x124/0x280 [ 745.138318][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 745.143732][ C0] ? __pfx_process_timeout+0x10/0x10 [ 745.149114][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 745.154947][ C0] ? prepare_to_swait_event+0xf3/0x470 [ 745.160439][ C0] rcu_gp_fqs_loop+0x1eb/0xb00 [ 745.165226][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 745.170528][ C0] ? rcu_gp_init+0xc82/0x1630 [ 745.175229][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 745.180451][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 745.186284][ C0] rcu_gp_kthread+0x271/0x380 [ 745.190988][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 745.196206][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 745.201423][ C0] ? __kthread_parkme+0x148/0x220 [ 745.206472][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 745.211687][ C0] kthread+0x2c1/0x3a0 [ 745.215775][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 745.220988][ C0] ? __pfx_kthread+0x10/0x10 [ 745.225600][ C0] ret_from_fork+0x45/0x80 [ 745.230038][ C0] ? __pfx_kthread+0x10/0x10 [ 745.234643][ C0] ret_from_fork_asm+0x1a/0x30 [ 745.239439][ C0] [ 745.242458][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 745.248780][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-syzkaller-12113-gbcc8eda6d349 #0 [ 745.258767][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 745.268825][ C0] RIP: 0010:acpi_safe_halt+0x1a/0x20 [ 745.274134][ C0] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 65 48 8b 05 18 f4 d9 74 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 88 66 b3 00 fb f4 c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 745.293751][ C0] RSP: 0018:ffffffff8de07d70 EFLAGS: 00000246 [ 745.299831][ C0] RAX: 0000000000004000 RBX: 0000000000000001 RCX: ffffffff8b29c819 [ 745.307807][ C0] RDX: 0000000000000001 RSI: ffff888144682800 RDI: ffff888144682864 [ 745.315783][ C0] RBP: ffff888144682864 R08: 0000000000000001 R09: ffffed10170c6fed [ 745.323756][ C0] R10: ffff8880b8637f6b R11: 0000000000000000 R12: ffff88801eb6b800 [ 745.331731][ C0] R13: ffffffff8ee14960 R14: 0000000000000000 R15: 0000000000000000 [ 745.339706][ C0] FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 [ 745.348643][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 745.355233][ C0] CR2: 00007f409d016776 CR3: 000000002906a000 CR4: 00000000003526f0 [ 745.363218][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 745.371199][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 745.379178][ C0] Call Trace: [ 745.382458][ C0] [ 745.385303][ C0] ? rcu_check_gp_kthread_starvation+0x31b/0x450 [ 745.391658][ C0] ? do_raw_spin_unlock+0x172/0x230 [ 745.396881][ C0] ? rcu_sched_clock_irq+0x247a/0x3310 [ 745.402370][ C0] ? timekeeping_advance+0x70a/0xa60 [ 745.407666][ C0] ? __pfx_rcu_sched_clock_irq+0x10/0x10 [ 745.413317][ C0] ? __asan_memcpy+0x3c/0x60 [ 745.417925][ C0] ? rcu_is_watching+0x12/0xc0 [ 745.422710][ C0] ? update_process_times+0x178/0x2d0 [ 745.428101][ C0] ? __pfx_update_process_times+0x10/0x10 [ 745.433840][ C0] ? __pfx_tick_nohz_handler+0x10/0x10 [ 745.439337][ C0] ? update_wall_time+0x1c/0x40 [ 745.444199][ C0] ? tick_nohz_handler+0x376/0x530 [ 745.449334][ C0] ? __pfx_tick_nohz_handler+0x10/0x10 [ 745.454809][ C0] ? __hrtimer_run_queues+0x5fb/0xae0 [ 745.460207][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 745.465946][ C0] ? read_tsc+0x9/0x20 [ 745.470038][ C0] ? hrtimer_interrupt+0x392/0x8e0 [ 745.475175][ C0] ? __sysvec_apic_timer_interrupt+0x10f/0x400 [ 745.481350][ C0] ? sysvec_apic_timer_interrupt+0x9f/0xc0 [ 745.487168][ C0] [ 745.490100][ C0] [ 745.493029][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 745.499203][ C0] ? ct_kernel_exit+0x139/0x190 [ 745.504075][ C0] ? acpi_safe_halt+0x1a/0x20 [ 745.508769][ C0] acpi_idle_enter+0xc5/0x160 [ 745.513470][ C0] cpuidle_enter_state+0xaa/0x4f0 [ 745.518512][ C0] ? __pfx_tsc_verify_tsc_adjust+0x10/0x10 [ 745.524337][ C0] cpuidle_enter+0x4e/0xa0 [ 745.528846][ C0] do_idle+0x310/0x3f0 [ 745.532928][ C0] ? __pfx_do_idle+0x10/0x10 [ 745.537533][ C0] cpu_startup_entry+0x4f/0x60 [ 745.542306][ C0] rest_init+0x16b/0x2b0 [ 745.546566][ C0] ? acpi_subsystem_init+0x133/0x180 [ 745.551866][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 745.557443][ C0] start_kernel+0x3e4/0x4d0 [ 745.561980][ C0] x86_64_start_reservations+0x18/0x30 [ 745.567461][ C0] x86_64_start_kernel+0xb2/0xc0 [ 745.572415][ C0] common_startup_64+0x13e/0x148 [ 745.577379][ C0]