last executing test programs: 7.220089816s ago: executing program 0 (id=3827): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x149002, 0x0) write$P9_RSTATu(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="930200007d00000005f0001b00000000050000000000000000000000000000000000000000000000000000000000000000001f00046e6f6465767b6376666f7892ffffff8102000000000031ffcebc920000003800704a86cec602007dfa673effeb09b5351f5bde05f7"], 0x232) 7.108193936s ago: executing program 0 (id=3828): ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8922, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@gettaction={0x3c, 0x32, 0x400, 0x70bd2a, 0x25cfdbfd, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81f7}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008000}, 0x4040090) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5c000000100003040000fff30000ea00000004ea", @ANYRES32=r1, @ANYBLOB="60bc010004a701003c00128009000100626f6e6400"], 0x5c}, 0x1, 0x0, 0x0, 0x11}, 0x4000044) 6.962390204s ago: executing program 0 (id=3829): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0xa) r3 = dup(r2) r4 = open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) r5 = openat$kvm(0xffffffffffffff9c, 0x0, 0x80141, 0x0) clock_gettime(0x0, 0x0) ppoll(&(0x7f0000000200)=[{r2, 0x205}, {0xffffffffffffffff, 0x105}, {r5, 0x943e}, {r2, 0x4408}], 0x4, &(0x7f0000000500), &(0x7f0000000540)={[0x5]}, 0x8) ftruncate(r4, 0x200004) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) syz_emit_ethernet(0x46, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x21, &(0x7f00000005c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x38020000}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$apparmor_exec(r4, &(0x7f0000000400)=ANY=[@ANYBLOB="d35cdd00a21e39d7ec9bfc1a5f3ee9187b6e99108cacd609094f8b4cfe33c5240ac65ae16afe7bb0fafd802fe81597e0957e90c951e591689dd46c95c17894f29bad6a23cb61f3e224e34f27f28c9124e34acd7ca1726046aa2d1caed2e507d51e75838e4b7f8d42f57b389839861611d1f0515510d8d69ad2fc06c9ba10e4d8d55bea45641cd14ee8d9ecbc67d7550150fcc62c5e39e87fc8ea3917ee0f3b42cff3727b"], 0x8) sendfile(r3, r4, 0x0, 0x80001d00c0d1) 6.705700633s ago: executing program 2 (id=3831): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0xbb}, @exit], &(0x7f00000000c0)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1000000}, 0x94) 6.502599486s ago: executing program 2 (id=3832): openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/vmcoreinfo', 0x20000, 0x21) syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x180862) r0 = syz_io_uring_setup(0x5ce, &(0x7f0000000240)={0x0, 0x7734, 0x80, 0x40000, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2e, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0xb2752a96f73d6e14, 0x0, 0x0, 0x0, 0x23456}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000000000)='./file0\x00', 0x82000, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',default_permissions'], 0x0, 0x0, 0x0) syz_fuse_handle_req(r3, &(0x7f0000008100)="58785f58471eb4b5b3ff3946acaad41068511507291e72541d949ffc8a54ff637ccef1fe8511899ea7f3c82cbc6539763a34f6760c1608c911801ca672e62708ba4fc023749076ff6a0daba0caa57000acbd9ecf5e97201f7f14e715bc8c089c3d65e92fd65dedb76d61715067ccf6dfec2b56a48f2b274b564d90c3d868f2bdc07b7e636ad78904bca826fa69b7783e7be2b8e7c997b99225467747875695f6d500cb82b479fe9486bb94e06f796f89906bbfccc964830f86986760ade90c3f7a9dde3172a5124c1889075ad30b5ee2a5f257a6ac790a8e89b247ccbc8d241b7b95f8fc649deffc1bc37d51a8c3dfae38ac968eb48695de38df941f9632ef9ad6779e41ccea8a3ff1cac4fa4b47a152a8f9a1bb0094f41580bbf60fa11cfaf2c535a12c866e9414ee9b58226fbdb0d221e1bdc50e3fa300351364f6350030383856f1f809aee19f337f3d3435ae6754916be1eec24643cec1bd1007ffa38418735988cc901603895f66bd6450d54f99e1246ded898499d2a447f899c00368ce1dd4a4f4cf9cdf7d4f8b38dcb98a598ac490f1086ec712b0cb94610abfdb25b0f6947b46e1dd628897ab68445568578049fa6140250a5d821d70f102fadc2fa273a6e486f250712ec847de3b02a121e19775311e8629045f3404bdfa3207aecdac43c3571b86a9423bd716aa67cb688f9ee4f2b14ea42c89f2766c78fd4ec41ab34eebb4256e885bd7e3abe4348772993bb630aa3397084bbc66cdad664d6a9d33767cc375a44dbc0b08931053a6780a796fd31e1d7c512599f9e010883a52c07ec0938ce1acb3fe3baac6af9fb7e9d7942662e41bd3626d240d5ed34ebcbcc0ccf1c3280c76fbf6cdfb04bdb2d3b4ec6a8961b1eb036b211eff6247b95039cc67d222f2ff120040c56d74b4fffa79a202144bb10ad766f1fd6b32abc3e09213da84b36698e5c67dbd76342baf2fdbd26e9563dadd01fce19d7ec025d05d0494e53229379d13c1cae48ec058cff0bc1ccdc94a74b11a9bc87c580bb6a3f45fe15d15d89bf6102dc1085bfe27b2ab462aaf642b8ceed519cf88b31e9e00fdc23e8f6967a72b4c38b2458656dbf26dd75586731bb519a97d0ff43f4358cd40c7ed371ae8a24f46e320d4c4c0a1b8c42f10908a1c283d8032d76f52d4509d78c2f3a0716c37bc0c786ce9174a88d468e88a6d154e4712778aecded0ca5de28e52c04e33672ecea5135438e908aa1bf00e65ba6dacc4bd018b7bb1c30aa5d9acc679220cb5e7207f1759bd7722d10469225aae24973031a21358532a63aab42f33b1f8f40d545fec7799703ba067592b34247fbc7375acdcb3883ace7d34cf33484f2cf662f3f0e18b5c475ae311fb20f6e6b85320b2bc37e56512dc27815b37bfd9f172be1a119197eb53b535c440fd7f24724e1d466309c0f8556965bd02d75c3dbe2baa0c6a515db07af1f77306577d0b38f0aa8cb188cf5523368951b8210f4bfc6afa0d058ad84656d27a46faef225e6268396ecb54a5182591bff3a86792db5454e238afe7c26eae85fd3c1c060760d89223bbdbe8966ae2558f47d799839cd959c974b69ad262cf8ab4fee554288e767ede9bc5d7f0cfba05966ef7858e41db363122680abe978345d45e4b52b73fe9f52ad26371a5b0539d88aa0c572aa01a41b079dde5a14e031ad903629d06c8d85a1643e47feca7d280833f8b3008841fb2d88ea84df65b03aa5baaa29d6234ed5db8db461fc5df77aad38690277cd5dac1ed3c23c9f2778295578561f9a4d31159a826b4b62b2a867e6e8a9514edddaacad22106880e6633fb2f3b17c8d10bec633d6128489f7253b3e3e38e5942743ddd1547dfab27a152549f61891e3a5ad17f733b042f7ef915ad7423b9719fee9142407fe1d10ec8b64a21cd24fd39de4496ca3f394f07149bdbf1393181b5afee090ff40ee31d34a9c6a113e3823fac425fa85e212de1a9f7c4937ba64f3327961fccf85e6fa29be12de9589671d60d4658b1562ce7dedcde8ec79d265c13f5e197b66989c3f067d2801fcd78bb92b45e55fb4089a7cd3b179284af782ae0327ba56fc307a281772384448ee465dccefe41be8d75c8cd0eb5c0217d7ca706848f9b82500b77c2d838cbd536304556af87d3b6fb9183b5dc9cf2d0f7ecbb24d9f790151b9c6092dfb2c14decbe6448362cd7c13515f66a99c37b56134d12e8c7f1a5b75e14e47f84d8658f0b65ea91014e2e4fd361f03dbf8ca509d426ca1bba7e43ce918268393ff16b17d9e1bb49fb2b4f6eeb8b4b226c79303b19412a55b7ea7c8774ccebd8d66abe117a8be9a3c4faea730902136df57aff991b59dd71610ba4c8e1cded8287c21c56526f4fb6c502ea73ae310d56640990b3e695b278de6e1eebd51108cf7547c0e457e5fdf59691baf080dd3f5dc3c9a10bd4cc5e10ba42d4d3d9dc4f7ebe0bd2981a1d6fb06f7457dca1e56fac3f0fa7ca19ec2fb7940ee837e960d93a73bf085eaa2888fe3025aadd33cae85d63273be6ae3a92e35d78602d8e23b9460f04b7c0e0e710d10fdb0dd3fa9b880865603500d81dc7e968e8046569830b526e441f25f8b0af47d524aa80fd7dd9c3f72facec2032e2c06bc33c6b739c5368bf54e32b6acdca9d2d14276a8348ae92bfbd60f6aceecf98f3c6fe70747499b25667a96c52e21236421b27deafbc6b5e2b8a4ea2a0d3cd5ee1a10f3153b529b5c04a1961223a943842e17ee0cd114ce6983536400fc40f3d4708436954803fd60caf2b5ed7e4ce90bc75385e2424191c6a5038fa15d99aade49fa1affe63fb73078a6bb4ee560b0b521aeb33f507bdf876829f4d3f695197468e41503a10870a8e6df800608ac33dfdecc03f64d03fb6180287a684063c7edfc8db1366f6bb502fe446085f4fcc4741b273a0b736f0f55da28967390bc7434db54ad0da9d1d002ceaa5c3e53efa95e7aaa792db32501a072e669da29fb734d771a6fa8c753fb2fcc204e31d668992473e7937fcf751bc79b125db1725f2a495bd2a4207e4db8d44810a4db5113705c5cb8733866ade3375d1bdbcb965cbd927e7d285f2933bf037911959088b64cfac0ff1e39244f2e9416653ed87ec564eb686af1062354a8bd7034c1022cb0d0b6996762ef4a0a3ab4f3deb459f023a867a38fcad2a10fcf0872862b386ff7c5ea7ce13abb112d1f0ed0723870ecce76d16f7e3cc00e28945bb93d9f2bd8e2017993102f0824867ec141f20df951202a2ab1cd796516ca0b4fdd9e6de8b82fcd30f9ab85cf0a5547e1ad1ef1ad5be7a878a16864d7c06b4ae002f3ba485a9bb36b8a591ecb64a4a5c0fd3b4beb015f58ea4cfe190f3b46cc4d9108d10c52a9de859814edac575d2a3d937a9b31db049e70aa76c085ab63d61c1317205c228f7027fa39125de8fec40ed7982e36a7cfa9fedca30f0b692bd4c7794f6b56d69ada1fed168cf03cc57321fe37e3a8cea4bd093e87b657fe5acb13d2591bebb52898362ddf0335810c70a4838faf8fff16301d16707eaa38e52f913f8aa3e27b2387ca1a217ac69966e287ad5cb0286535d5d00b7006661dbc7923a066945c1a2040a4e95d7b0de4dc8217bf100602f07cc671fdd9a5770c21e749b407df8c463a3bf17e47bfcba6a890a0435d3fbb7252fe072b149b7bfeb185b088686dd70e0cacda275497b553aff2b319f7d7b0ed64002c5f9f6ccfc3d55d8c908d314487452f37a650f4561326a84c660b6111702a87db03595b5d080c60288203f091de9f78b997e47233f4bab9b044a98ab118a6c45b7ca746cc2fb90182a923d67216412e24a955c0c2307acc47bdd319955249d8412a5ccf444437f53f524c69ba0167c920f0c1f775cd1a225636200a9e4adf686af0936f628cc589a8d5581c1c8cad0b564a3f38b606473280a3fa586a5ba932fd38eeb23096df29a92ab54c409f88ef4f03217f0bb90fea539e629d8a025c802f6b5c3d735fe950c8ff7136e6db287851dfbffea1ef81491a50cb75a103367e85afa3484d6af865dfbca91dc05632b0d94aa384ee0c585424a5ddf80babe0b913b0a2eedda34c7ea7814642a69f8eae868274b16fe0f52fb60b201e6685dad3f419413d5b8186992855a25ffe0d4773a14c7977181a120cbc42af4f9acca3fee1d54ccc125ea49b62ab60c58a0ecdf50ee7c16f3b6b12b254fc08fcc85d409eef7c3f30cf705617f926a17e6588a9fd7e34be9fd863a7b157a2d9a336356d568c2d2dbaf76c2d2b2ff8703748b860e36f02b04d6e4f2fd49511f12ce395dc18622cd51948a32cc432cd797d8a68838cebbbdd9bcb6f2e85719785706012e894cb043bb9a53998131fd4aae3321d81fc001e718c4a99c0580af1d4a0c81665cc5adcf337c8bc00fc0fb3c7be0d5e5ff6a6fae5891858eafedbed69223170ccc71ce36ae439d769c3520972601fbab930a4908d6950cb7cf1e5a3b32d8c6a975e3adccca0b2ee28a4eb5ca3b0ceb9d31a8f767c3f4486a62215171738007675a55abf5916513f7eb9b21ff291f2b4b48bbfcf394cf861fe016b3680be422a8bff49963ce096d1bc17186822b1392e68b1a05fa6c70bd2d9a164f12301a6e78caa8f4cd43749704829f54c5d93637aeef80794d3f206741363e74fa181c9f1dc47557553de620794f096c59ccd74a178f5adb466ad5a62fffc1886f56ebceca4ed46ed2396bcbc31160b4eb1b7d69642e33315e3adbdbe1b9794931e7babf745ecfca37dd4190013793d530df12d6521bc069a05a94e0ffe91900a0c2209a6914d2f85bd161ff77284198129a9b1ba600bda3e52769d39c1bd61c4a70c627c3ad89aa0bdf0c93a2c35e166da9a08b4d2f92deacb6e9034274305b6d254c4052868ba32bec9aa3cec75debe24e78e43374efffe444722a983935f9007fe3de37dd83c52be16e034d09592a179275dd0c91281be579cd19c0162123886893713f25cdae19cf258926bf2070741111eee6b3df708c3fc416b7d038c948bf8500779c0cd5460e640bb1f860f58052b8087e6eb2f16e48f4984c9f9fc9fb2652ac5305861ece5362db08ae912ba05596766da1322057d0bfa647d98b8d4f1e7ed43ecdf1050c0eb19dae93b8014da57241cdab4ffacf0ec1348d4a89b3e8ff187098d83d8eba34e5c7ad4215f1977968a9d337d08fd1188754e7cf41baf0189ccaa5f3b1005f807b0255ce1920ca7d919e4684af70c3d089a99922727c607a2b06e713dd61122842a913036f6cd64dfb313fbdf639fcbd712852bb85337d056685b0a54225ae27e1e8c7ce5acd1f017b8f712c268b9cc0ee26d26c63955df0591f52ef3ef5e6f0a8b0a40fccec5f945431a2e81c35720d178feb481092e4f51978493c5fd502f252bc0152f145f268ead14932990069169483ecc7abc901657460c8730715c078b61059bd2621f50fb838376e0b808a3f118f761efea45bbac4274016960063cc67c428e72e516685552dc3bf473e442d76f2d3ed07b319694490054302a538b52e3b8496b7e37fbf4a2ffff2b484f98fdb14c66ecb8447834733f8a7a5a3c83de34b6647842dd56d8201f9d9240f3b3a5b5cbccf174a08853d06fd164fe74e04608ae12df8a35b73517d22a87c7ebca60942932d03102ff7e8644611b5520b5ebce950945498ce19210c866e48284d18fb7e049deaa43ee5283e3dfad7316ba85490e93182d13efe7ba64ee5ceeaabcff3eb24d46a3a129dd5a6b82e8c48210cb1e6564833f3e15dda4dec383b4319741cebf6374cf2c5d64722afccf7c4e2d81ae28d45f2c35b764281f1f08fec8f8e9277277ae1ae8a8981d85e041d2450afc9374e978f73b66da9aadb2087223f28e21e946eb07710ec86cdcad0948d4ca93827ea34e28806d172c3feb83471ed2d4d7ada2360b209d16b9d35861082d85b6be3c3589a6bdaf6f9b5d52ac8fd7388e32b24f1d5d34b5442c1ceebde311decd709f075d064f07bc60ab14c101ef51039eed56ae1e0a374e3e956603737b3a16db684a81e9b8998a0bb9b17a0876a92b2a3b9924f44b16ae4c7ff376ea8a8c91b504c1dbeb522cf846fc3ec6b9a01f452eeb35cade34c6a0463b92c46e013ee7906ee934141870ddd1464ae688805933504a2dc7cb1f947e28bf22f5eea6afb5de3b950056bf44065b84fd5589385d0feec4ef1db4fb4b595957130e575dc383e3686f4674143debb23e17b398f32683fb4805f297369d0e5f2e63af6891491e4e37186b4a3dffbbdcfff63d1fea4e12d24ef96fde3ed7a323a3605cdf5eaa43da738004556c2c20aa30c40079bc2e9ebe102c1fcf5259f1e3acc6b2a2bc9da4d0b1252433c58a1810581152a235e93deabf7f728eace350bcc4db4f249d4234bbd858c4e61a0eda4e3db0ae530c78eb63425502d651fd0cb986341ba69c44ede18eb3ebf25b2336cdda02447a9e20426d8206368c63b5fd6828612d3b99f627e331bab0009579de8270c36aa03861c300d34f2a3703870712325190073e6c17d8699f6744acb1b5468f93b57ab0366796181a4f543511d7ea2b32606c33cda61e81ed1c2194d305be47a3f1a9145d023620af12e79ec188573526ec35b9ce44e95fdb3530bd0431dd12a227d0ffe317cda1bbd787979261d6c9cf728b3d6bec3ba6ae15a595a30fc242bc5f25d837c1c642219afcfe043bb68a82965574b8b2139789235b262cf4af9df6e4bd615a376cd96bbc9e0d9802fbb40f80a848225e076219e26e0e63f57330b8bda69ec8dbd8b3272798cbfbb085b1885a1c22b3e2df2a879020ac1110b7af4f53ac97f556596ba0e164df0c85842026a87cf9631c9c9d851549efd8ca37e3b863e88436d5da5f4d3b5b5528e2d08d92b0d3ac6a06a0699653718e93a25b5afe254a068e300751eb6c67e3f5a1813d58d428f1ec108b88ec81444ccb50e8452941510c11f2e80bfd712f64b32b686c92ce922baf6c8eed1e9f0717a654d53b3ce1001880de80b5b15362b20286db9dfdf6c41f48aae84d5ab12ac45310f0eefc56e54113bcf95c1b2a259895af2ae9c679de4e2b898bf8a40a199a2059f8248c1303351dca3fb38906a682f66a94ee6ae6eafa7144758fabbaa60debd6eaaee7b2f1051781084b3c9d626263d011a3daf971b708750a77614753b89b5e1a77a52510ced5708083fb48c554dfd6aacfcf97650f3a3b3f97566050e76da968d4eceb83bc1e005ed1596d6e0ec5e2c90231e62496d7435ec5b28f805e3b7aefdd3718e4ff53065b8e4b15175d80eec59218d8278e711c6049bf6d62ae7069578e957135463d7616b37c1e4bf44d60dac6c7aa04cbbc4a64bb0cc0b059abb6b26f8ed5203232ddd8a6c5882e6e6c53068a71bc84c5834104e85bc96db2163798a3881929248b8c788e5bdc9e46e5f7f3f6ad43fad6fa381a0b924bd938702470b330fb90ba73d557c0d203d55edaed6e3a01aeb53b061dad57713ab27e1a9e0d06b534a65d85beb061bb5258bbb38179ea612a6f402affb8ca018ebf0d6f61d44d5a657c080c7d2dbc9b08c07713b17b0f173ada59b57abb401212f4f1fa026491b48d08cf46a704ab43e46de8ea596d68658523b61a156278b3b77bd1f4491381bfd874ed72b00675fd5b4b7c0ec13c6837434ba8e22230d32e7bb1287e488e14f5c5602cd4ca88012b244c7f23f4897e27027aa862ca139bc8b5fe14be7554832ab02e4ba19699a1e66825d94c7c44451062819a38d3376f0a3716b210c7adf4bfbbc303058aa2e054b3bd53539764f177b11b05451705550f90196997de3d1d480e500cd9d234078cb1a09c63d8911381d327402702c2765fe92b8ba3a0189b2b11b7460996c36eaae3ecb4f4e63bfafd7953ff086dfc0b12e616bbdca4707631467b830d244bd3f4371744bc8a4baac728a397818875d1b6a4a2f0d10be607122a6fe813f52e4456b8a5eb6c9ee0cf889f777a03cc26a055f9f259cfc4f8552b568a4b371260af062619dfb215ecfe7b318f8d627d2777bd5103d6ca2948d19d5812112962b63c2bf3d090ff19185dbc5ad49a580451de717c088cd96669babe88a8b1ab6d0936c4c407878786695f4f102ef06c5c2166b661542c598b6e0551d490946182841184a7a0e669c6ccd73a342f65c4525dc7522dccab15fa72bd07588b5bca71635b9466ca72a504c74cca1c573e8d40d83d1b5c5326481ff8a2055a2e0fb997fe8e4787deaa2a8a57afe74a971e7f1f280895f2fc9d99c41416adef7b70ec47e7a12d0ca3c0ab1dba3c2d65bb172fde1fcd7f97692d3d8c9657e3277ce95947d59bf37dde3f35f7a5d76575f5c14caf7f0926c0896995a5f42efd0d38c42de202bea5b5db39bf697f9a96b54aefec723db523893186634763e7399bfa8029c2708dc817984528601c77a1d78bd4b2c85f10f5ca9363badcdab51a1b315cafa5c2ef64f60395f53efb9d60d89e1b2a5f147508c90d2b09476eee3cb9b0900000077cd2c522909480dea9be3406d1779ffe4539f2e03efb5f8c2d040f0ea776ff869a36862246294d0ced556a10600000000000000c1ef5cfb4e5986ba2f0e063b90e1657d8977b58827a3c4e3d556eb3cf0540685f7c9eda461aa2ecc539fec3d2d56be99a518f11752f2be2f670c5fbe8010ac4eae0ede31c1a48f747ff2eac9fc069d3700a40bf5fcda80a3a4f5fa920f117a72de6da51195d2d7f0cc293c9e7a2f5a8bed564832f582df56b24cf30c8297a826a4bbfe0afeb1da3e986b3d0a95509e0037d212a70178ecb246061e067238ea9238e4c4a9a7c6fc5dcba290970f50c52598423336c523f2de7580d059fb53934cb0beb208585e897fafeba30853e54badefa197478fe6b9f26ed0d33babb53acee7b7221d8e0cad7a6bd0d9383ced6391bf88ca7aa50c75c136075e87b92445f02fbbc92f7cb65fe2bbe0bf0c9fc2577da63a56f1efbeb276c1f4d01da6f6f7a842212d96dd45edcd2aee7f2c553ace15eb9336bb1804ec252998c5c8b25033894b05c01ce7c77b73ec0e239478c67d5378fe5a53fe6269025d54006e9bb1cbd09b81a39615517c609f3d74e377888f641587121f0f097b48d8be7d800295ebab9407978a9cd379966577cb6e1f5261e4305696a2cdd50d8cb1964d3ae18ec730d40f9c782533efba47db8378c6aa15ce85985e211fff2659729599802a7b585cbef3a2762595f67e2054a0fb4457b146e7a656abb2c4b2387d760f7e5b8b7864132317d5ba29a662f50af8dc182d2fbe216db8e997ac856bc59855ca48999699cd6c5576cc47bf8a8c30638c7e08847e5083aa82068940409461d1065c2b53292d3ab145d5bb590bcd278e48ebd34920b18a2e1731c1855ae5a3ed637ff568d205a08cf98c58f5d79c99912e6c1ab257ece0d68ef13d69a56364419aac7df43f43d5faa9ad851c9810648f9050012e55475109ca3ada3452b78a7964377e0d862e022c73ca3ed6cee8c5fbb2d7c12f91c4851fea7c5b02e0a3c5364b7fcca110f20f8858465c498d7e9c6049417fc5c7d4e0059852a6d794af426e938a401cf43b2ba9f4f3f6f0f2eb710ecf3c0c36c4b3072597f805eca9cb14602292ec7d5601e6b1555c8d024aa4bb81a4cff98cb03725cb184ea7dbed6814106a1402bf68a2e51660af930a500d5530651a0dbf2fdc01a31a99be25350b5c8a5fe01155343d028c03e09009ef2c386a24eba8d842cac581402c8faec7dca1623afe25a230d8d4a8bd23df3cf12abedc2a60e387285acf1b3105011a2bdefb204a53b20be213b50f5244511f25852271e05c03fb9a799ac7ea675ffbde8de181368748a9707674e7e70f28a75e4036b6cf9e6cc36e487a234c9db6630067ad8dae030a5b7b9784a206b2f7cfeeefc65aae11fc20190f4d6387bab05fa6e17f0bfbfb0c4f604878771aeace0676d12325e61b19a5317c4d4bb9fe6f3fc8b171f1116528b7cbcc4a91c26a729b512196828075f4d0aeac98887e2a6a19b4e1f1f66233962961c0d49df14c3e6123c9ec8dd7152ad045000107365fd5ed7ce6a6d65ae0736a7e227f77c9b0903d4589ac58ceb691583cdb93ae3fc792c886663cb7c5b0640deb66e29b3c69d2f1a3d1d47d7b672ee3c49e90bd406aa84a0189808924c4e67c5495b045e779c58ca65b42889f52d7315c66be3716dc8592b4875629cd0cb02c29d42bdf9ca5c16bc9051c2a6c09d0695bfba58c19a995838c022e9936c407d8999aa65e4a9d6d8eff99f8dcfac9b561375b6d1293441b9d32533161062c053c63ef09f6100cd748700a710f5bfc2a6297b15242b1f41e21bd004b885d6429a0d334a8c115f7d53d278dad24c9d295b97c50eb340d1e6d523f1757e2014c1605c3bd35f0cfdb74f79850423a37e2f95dfe41c56df09724d21065377f1818311f0c70aaf6fb2d4fc8d9eef576136617371d85481770ce9c390859eacfebba34e75a238ce80bcccadd6c42e8e186be3c15451131fbe9e345c05ab8e23f917d269686a9b5f06dd474f95757b9e5a3328416595539cbdfa69efa9702e5a268b1a70c6e5ff2c118a6e574bfecf17b1576e4f20fee566b0b2b5388476a68562991ac01412fa463b0f9e586ad4bde59e91a4b303268b5d8644cb7996cfbba422facd59875ed6ac057e563412255c412be0928a0b6fdb6f35d7008b5d5528ca796a4a69bd90b993a52da9c7d62f4b71a2763f822bb39f3ed39cc5ad5a4d51b5c27d31d105000f3f1e705ed5c42067106f3fe6d30151021bcab7f3a1ad9175b3d3644325aa676b9e057bf9d9aa3348b1d9b31bd639c59bb63f46a6c18794ae006db3b1ee20368160a82e26aee5a9fdc6b44df8be294f3ac0a1275e57ebf5e384b141ce89dd51aaf2248274468894645ba54bc4e6b9788b1eb5043c1f0dffe2e13c6179d0238d8cd037b6fe3e484445ab458fa09e4e8010d3288aa6e6cdbfba4b62c7984d058da8993d5de1df75a1ce8e3bd5875709fd2ede4cd5843e7102ed4031ed096a0c6e3ae9d522ad95ef4af83599507dd32fe3325819cdd7718c9797e921e6e365175e1dd53991edcd2baf27df8b1670d01967e97b3e3e75d297f908deedf2e3b91bd61973e8aa75a5a6f9db11525dd35556bbd13873602a320af74677832f93bd01f1e0631c882c8ab254a26b73a60a6c90cf9b96bd576e05b9befbce882c5d29198451bd15acaa894a5276ea9d870f49a33ee9d2429ef35a905b281deb75be54fa0c9e47be5876d7dce01986f2d0e7ae6df9b87a0ba6cfa55cec0c65dd386db5adc427eac18a00c9aded475417add4ebb8880ef3dd218a9ec3e6e13456f8de1630774e918fe5288dbaec3dd2a74698ec9e28ad573761b9e78af3d5c7a61e3eefc1a54c25bb841529b3fc9137836a2e7eff5ffae8e44f0257160da51ec0b3d144b92f1f43d2782513705baf5930903602d40cb4de87feca7243d2248a78a5d684e303ae147acc96e0b755eea77092b5f6efa723afc8a4240c75529dfe1c2fb75aa42d67e6b6c9a44c575738725815a9af1ced500", 0x2000, &(0x7f0000000340)={&(0x7f0000000100)={0x50, 0x0, 0x3, {0x7, 0x28, 0x0, 0xa4e802, 0x2f8, 0x0, 0x0, 0x2}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f00000007c0)=@overlay={0x7, 0x3, 0x4, 0x20, 0x6ab6, {0x0, 0xea60}, {0x1, 0x2, 0x5, 0x8, 0x2, 0x3, "0da59d8d"}, 0x9, 0x3, {}, 0x1}) syz_fuse_handle_req(r3, &(0x7f0000002080)="6d797d42fb74562ec642068eb410c60f8cdc42cf09864b1dd1d244ec3efdff103306a02bd120cd2c684eee7cd734914ad7ec2bdd4402eeab7a2972f1672f126c4b5f6c5ff748548170bdf1020c2c3d09186940feb185436981cd578c3a2bdc19c16209468100cc1d67247885420cbc0ea004f07283bc4a5cf8499ad5ef4df93b2fa2eb26895ed9260cc61afbc766adadf7809b3a8f76d9f835acae2dac8abc42896374a6a82a8894552441bd0202daa10048b49d3bc74bba1e5258ab8ac5169facb96d9f68705a7709f6d9a66a9988c13d13a2b8b34d9f234e1c5fae79e4cb76ff3102184ed9032d2402087dcb3eff6bfac7bc4d2fdc9ea25f5289d52ed75ffcd83a2781eb4a23fdd078d1e53495305e3ed5bb4e060e89d6eb2b13586f7f5df32e34390d70f074b4f92c4624312698d86578f3d951021db151806fc314c98d819604d8d9572efc7dd71c0d1a9176ffbd48361908e927e03caa4c1ccc805fe755e616d983442660299e9dd34e5612eff964a45d613a832a0ef8e4410fcdb0313712795b369c08f907c91a4f20e5c18ff903e0ee410d77bc076f49debfd6e411104cace38e0318023527d1c54cec66790638c9ee70c29de0406b3483ca1663245edcda56dc9612e93f40f19cbde5cabb8816d7b75a266e404a8e5364d43c08cf5cc645b533c4b6fe349819c5374fac7a923a7a803ab138c873aee3718921043a60a0ce84df8b991dfa525f0955acbc866182f2409d032981ad824f037ef068501f955898c4500049f0b30014832e3b668f5873305ebd1e094f244caa90610be83a5f674decf451a82d9edca6664da89cad8dc212943828570fb365b41993f89c6d36c579157c4055a77eb1dad1dc466e743129e5e3098f4432fbe289111e102223ff04d02e8108b0925ce76118445efa09233e579f398ab373303c0bb64ff82ddb597040e58a61f82cc56161eaec13ed297a8daa9514468283037e5d0077c9803b69421070718fba4865e4b9c6d7d272c562cc4dd998e16fe288dac68b0bdf05eb2a02fd40b900944d10a94f2b3be9b6c6dc628044aa9eaf34e0474771c10bef03f6af2029643acc1e97efa0748cfca63aa9546bbfa6d7533c4dab0b931ac35b331aef91a80d5ea08ba35cf66e1779298d3338114c12f024970d12af8d67f9b165c15a8b7e37c14c2d512dca76cf6077e2011bb47cc993f3088027b2d53daca574e8b443fddf5c252788854be8aec357db43f2147f23061641d2910a4a503a3a9ca86b3656d37d443e5e4207bb38b6e8879bf3de21309eb90113ccaa75e1d1e0900efc17aecd35078b8f3d579d2d4fb576127278290d6a9ea379e22dcc4ad369d3405311efbc74702020d6cdb31267c2e4dfc6a34bf39c9db32da7f387760909843fbd02e9e291e838fcd8faac4c9ad909cc19440bb775070496ef69250f4cf90372c0f1835dacd4d605a69334d73b1228cce41fe3c6457a37531bbab6d8b15a8214ff3002d29016932de969f05ed64b720ad249b8164ea82fde08303277e7d5f0d3e86bd6021024bdb1d24afe3ae28cece041943db60034fa11c3b6ec7b09c117b086fa4016e68e46678a7c5e91c40d2866295247276109a8778b043b51ffe3ec33dbb665806cf6ca41e7143885b6ca920fd8caf475ddcc698a09d368c721f048efe9e0d372d9cc58deba32f81e7e7f6d53209050d72545bbf04356ea95c9bcec3b8b87f56963111c5454b30a12b8479afc26361a7e00a66c03aae8ebc3348ac2e9b0f52453a32efa9b8ec038e671122dc2965d3b7395051974088f4aa47a76327a0dffce6db0a2cd65e2da5539fd7673911d5605cadf30d85563a60afd58767b6adc549173818de01b0de192894a76bc4e62d8c9e341729e6ef37574cf63c27674081202b8ab9cb9d92d346b1c2dadb253532c1674b2440504f8430c0a2ae5829b016af877831ecce9b13743e821436a6c1c46a1176922dbf2721d9722edf72817f8d15fa5c7ecad046df91bb57b8d16244527c855a40403ddf1757c31361c8bec9b5796547fa2c93e03f264a366a96666e24d7f908f6fa4c3f26722961e70adfc4ccd413c2c05adeda400de500babfb80a4e4ae5e9e04444c55f006337c0a98c33f04ae0a6620a1acbc26b5c7d125c30ca542c64604a109c6022029da452a717b219456cca6bc9959f088a5f2360c390b531baf92ae2429a2d0b6c7a20c137a3a0050ae2216b871c03c56410d28472d1035bb870f94589b93ceb57a504bba5acb7a6f77699fc10ea96d8e8fb913ca78c0af33a8435344b71531207344d78ac349894aab972c1b471d52b266bbe4313ef2ba71e7a4680ff442a358699c1e18322dfd50c55b637b6e6d5f02fa61b0e8ae4ef7cbb6359f70028a6b60fe901b2ad97a62b5d527efaf5ebe23fccd80d80e02eabb1be14d40faac8a56b4785fe47c8ff4ac4ad7fcef2134b1ec599074dd45d2b7a5c45845787e0490d9d7db95b58b18f14ae6ccc39623ba0fdf64c8d027f1e7652cc90e82732d4292f4ab0f959a44ff906484fcf83e222088345541ba2b1c50b63711d8adb63c8556452c142de8a06f4b28a86f629cc1dc713dcddcfebc8b1420a603fb970ddaedfc82250637327beb5c0ad04947477bc9aec0914cd78cbf5060e4ef7806b3443c85dbe79b8e87807b1a8d141583998c412d89c23dca4aa16af321dead51a12a73be98bd8ebb4d58b3ccd2d67ec936f2596afff2ba4166015aa4cc6c433acf33df30e3d40a0d6468944a07d1f9eba1bb9eb03dbfb42ba790dc1e7f66ad1834fad94440bffe3879509120b6a5cd1890281bf0f4c2d1be00fbe6b2d09ebdf594110f2bda035262d4830dbe64aa3152612df991a6fe1d035e0b301cf527d74140c85ad79acc001fd2ddb3f283c21e8d253c6c4685584f753e01aae2dee4158c68e2e612f056eb602ad8199d84784e05b363292956247d1fd8e4201330d6060d66e10e316143015908554e5325550d61b8af87a92237edd75cf687919ed0164de95042cbcfe96b9102fe3b71f43bbb1fc24d9d2d0d81dad29ac18cce353ca7c4a7c32e12e451654addc5dc6a44d001c40913eaaf14dacab7037a68e9875ae51321d1852820794206fcc1cdd51443d5e3fcd1dc4dbf728d1ed8dc29437db0154c2f59d1d0d0b0048cb56ad965682afeda337b172cf6a77be36ab8424b919e493628846bbf485d5fefd73228e40295fa2070027f6f2ed565024b82d1058a1be0d0c364b765f2a58f382e378692d1ca4fc7f09f867ed4684dd82dd4c76e0e640f5f87d1c6c2fafdb733f1cef6572cb5e104ae9c94d26c81cbc9a5fd8fbe61ddbdc683b7f4030132b932abf0d66afafc9a9d3121f0ed962a14294bf0ba7b1d33d7808efa427b5531cd881b5c87ec159bc9557009d9762010a497ad52b57283cde9715b48a3e35a22aec3730a0cb476a59f438684346ce0c14f22d5f1e5826d3f670e9ef60f6dd51a11fd32eed673b9d0a12d8eeb8046b96c51cfc54c21b2c48c4a89273963b8345b01159f53f6b6589333afd871875b930d7a4e2e1f5dfb44157ca004a739b0e98562c83b1d8414220f677f2882ef6ab1039fc5f132d7f55046d0c9545033624338e2ca6bdfcdd9d78306818c6214f524a7d036c80b5506f97fe383c1cae3c73dd2a0c628bff47d13dc7d9f88a3c1bb84ccbcb82fd881c6f5e9aa7516bec86fd6bee49f4db3bbf468922f1ef37c499b011e36173edc0ccb92d13dda668cf88bb99649e606fee23d3d3bc1fcbdfb40c7d4a4a60b89c63e65d02a283137561ccacd0c71cf70c6f039ebd1d29cd58571fa07d74187a7931d3d8b7db3062594b696b0e11a587724440bd77aa01fbe26a031a4c3f16ef3ba7f7544d01e8b7dd0b74f3025fe54cd01be16ee80ab0cd7c56671390f2e9bd62b212cf3ff58da7207846bacf85858130a89a2cb45da85b3ee574e8bb43c6642a3060b6f07228951aeab0fe4f4099b86bf07ec39262acca7319df3d5d057baa794234b89eccf36da5d32e4a5283386a0a271be30f75917ffd9f6d96eb8b50a7f6a0b861c5d12a624f3630a18e3bc94eb58bc835cef0a1b77952df6443cc12f221fb8460f4862f382abe13b409056644ec46fde96e1992e79ec0acdf3066f77bbcd6cf1a24d9b49ce70bd3bc58cd898da801d6b1ab12fd7cecc29894b98d616ccff855116a8985653ca88722dc00aed777dfe1839251be42716824dc0c40b6548319f613faffb2f1900a1f563724b0dcb7aa694110d268e945747d860d4bcaba7837342e3d7f207547ba8c093e8d2a1a5e3e098d19343de5fa773642cfb1a2e49f98df7e13254787cc35b2d689db16e551917c0db1034b175d1f4647c35c4cfe8a871cc7983b052050be9d24ed6e6f70d9d4b7cdebc9ba7a761b8c5f2207761a6fe9db5d4ac975dbe398ae05ed180f028037f2d9684dd3b28135e150db8a8adc6c34d0cca2cb95e6babf8702f26062d0ff0f88fc915caee5597a006e211c61f6fa4ca685e79655af85cb3489f94cd9836af4b80cd20ed23ed8f3f4107814407715b471354c5274595963b00482f3723ca88f4eee346c78bd29d65899163d848c9844991e976ff817120a13ce40aab11632b6fdd9d00acb82a5ac7769a0a7ed5d30ae077bf393f5de5b12114e4d1a32c7297bc5e14b673c78cc675b097d56f7a35c3206b1584996972153e2446465492528e0565718252139e1cf500f05a0ca529d58f5b91fa9bb2822c21248a7a8a92d0a7be5f4d249087176c7c23e27d72bd232fca3f7b36970daf2ccd64be4a798a6c30a068fbae324b4c158715949b37c3942f0eee35b90d2fe9d322420917532f6dceaf8633f4f9618f099ece4186e1adc1323b827c984ba54c887b462e169867c2e063fb60b7906434ef362200559e4d02413667dde0c6111750995824c316305f2ddfa3035ee09fdbc28c7f3c095f5a4382ce033746394a37b4d8a61ae8c7270d3863df7382a4786d7bed9543538166dfd01d122a384a7a3de7958c0272a35856f175fa29ee100d2a0f3a6dacbbe8702cf7e8d307ac0cc7921539a371a1c2e7f834db5a903069c07ff562fee851ac9cc3f2f045146db26b13401258733c67d820d06aa068b789300ac90481f84725311544e9a2363f2ce502c02c100bb41e18a103c79bd2bf14f6b52290fa60d978c284f927829b5027ae0ea842efb3450a8ddcabf0eaff6a6a8300de389e78cee73bd8de9a2809e346ff6c79dceca4277eee4b0dae1a3e1740f306044d6e67a5783e665f9637a8f8154f9ebecf95f48146c750826fccebbb1bef247666a710cd71dcf3ac3aa9d0bccb4c4ad432bba642366e4a3b12981901358ee1d7babbb7e10737cbd8a1c159d8dd9dd521c48d2911ebb8162b51ea32185c37097c299c0e477914b49d04ca00000000a3660f829ce4dfb2f821e6cb19ce37df64f79eca0649ea8c6b41c6c5d08fb1dae021314609946310c833d08d46c026ddc5dbb7ac62f1123be2004729daa8156ee12bdde9529c7498c8d1a3fd59aa07b9ab7870c4e57b2f54dcc26edd206b28870cf346d741b46bcb508a5f9805ed63c6cb03a9334abfea33626b0681e59b1cecb02202c3190260b8e2963ee84d9a6b5e6be99cbf6a17e4a11e154c2a50d625ef1fd4690cb8e030e46e07c891e6db43626525d464302c44dbf65f71a485f9ea05c347b870bf63fddeaaa2336d9eca1d4c56e8a2734287f0f8a185bd8e3165a681175d1ee9d24f48c9182fd40179ea3d128c0b43c4e2c85eeefa4c932fcaf9297488a3d44e602477d94193410728a0ef0f6730e64b8cfb3e2235c6241d1252196f943d9eb9b2ce70f8c5cf21394875081f56ceb6749a8bfa43e0e545fbc6903b63c55b67ba1e064a682d58fb7117eab5407d1c998aa53a0ca190b0a4aaaa657299cee41be166a7622789b81cff0e892ba87c6ff22f29ed512ebe40cf7306b7597607de5c1c6fb2980a03cc0c6f396ecc27b6b5a3fb0a3f3375fccc397527797f6d1e98f9a873882f85a4e5b11eea65cddb12b0cec9e531a3b5de958963e20d8a520aa71588aa3ab92186e64a710ef07debe3fce6313ea69fd5bd45ca3d50e5c98ac632d5479bc0763b05509ffca67158ad8665cb858e4a8eae29ae667cfa8e39dbd15ca03846298faf7169187feae6e84deaee4ae51cd2016a867b3d11c4e6ec3ae39aeb8c8ec36a885e475f3e1e47e1fa464ef9569aba053cd066907a112612de411a5be0868543116f32d0781323c744dfeef87601981afe063122bac14b90590000000001000000c2767cbe79e245d791e8fb222b5134ce684f7dec8fc0630cc9aeb5fbc38dfd19628ece15342c941e52be8abf0d82ed7b0b4bf5e6184edcae53949ef5987fd7fc479fc9921f2f332ae68f5dde23a3dd0b4713c3d18913edd9ce59870f7d50fdf33f3d2e8e5045d35555b4db5f48946e1b8d8d682f0c2bdd2d0de6bfff349e5e826cfb2d18d7bb43347362f13f5e80619451527bf0d3cc617881ef718466bf2efcb5f1404c573df09e00a5c0d1648b04860ee20d9e79d4ebac94a35e0a4919b1ab0db9e9dbdce1324223850e2e137ebb0c0e1cd690a3c5c9f8576538cba5e3831e6ba56809644e389ee984df3ea8e4743d5d03619b713c984fe8b43c589b78715b9147384b5bb15af8898cd82b31aca722cbe7938f119251d9142f2661f09b49f99d8988c66198dfb9db7f225086bed1deffa78995a56f905a7ab978a9c557ea1ad306bc0cd1cd8e5acaec1e4430a42068adec4a73f891c8010f0271c38685ca66c36313d15ab5bb6948c089b1fccf7fbb340eb03446a9bcda34b2d14a11e09f71e799fda19dd85293e2b0e2ca3e68145b4ea5705592562962cc6c0b65c88d06067903716656a0a7e18ffb46162d6a0c1dac8b6c59541c8ef6bfcfa87ad59cb0e8ef6ef1d7f739c0a56cf975f9cca9ee89bac15cae197d02fc72505d23ebc6153491adccd22262979d2909fb8abd25683894e5a776824b81598a833e339a582b9ce3f8d7ce59fc3147eb3e92751867ee9c3506692b25b2d7f38d97280e85c01bf6d71a602d039aec747620d33660a9d5c9cf4010d01f9cb86db4704872307942df56f04cf6c17e57612635e769218cc91da9e2de29aac4563d695a6ebe249c14ba5332b54150a291bec28417febc4c3efae9e14a0323e561dbc80e98bf71deccff5babbcdc8015ef7a86a52781a67a4915645cfb18379084c58110f1294b2e08a6994d1a3dd4fb79437a75cdb05f36a7b3fdb449c0cea5682d37e5b0217676ff7a383a19d48860476b23ccb66779093b0f6b5b6a1ff0cef503dadf5b67382b2a501d0c13d89eec496374f43fcfa751864330479e0d1f7aa0883c2aafbb5c21b06cbea3c8b515fb1f6d061e269c3de372dc48f0b1c0a935de648a0fc4a1a32ce6aaa8432240bbc977a0ece5fd60d92ba49f1443bfc83668e8251260a5b275098e4a072d44726b91d850bd9c2485cacbf2b33be73785421c2fb259b0c1c0955339713f75ca72b9bc56a7167d8a942015385eb4f1bc3e07b23a71779d043a4f420b0fd9e889d398c955f13542c811683636b71a2fb178e951e37ed5519146c5d61e697d1148458c2f224dc6911363edd1b4d30c5cb12d0e2fb035adc33656615c05266f32c2faf5144e24086c97816c87569feb1fd41775263999ff057d9832b872506aba01db7482251f65a74c66cc01b83056970f843ef58df0d89c44f9265d5bfb50c287f330795b30848341dd26683e5df82bfc1cd1a3f2df3dae99fc38edcc614b39c8a8fa6ada4b5dff08914a92b6a16b05f13bbdbdc5e9f14808e827ee5f364ce115e12bce05122f0dea62d8dd41222fafa3c6bdecea63d3fbd0bfdef667d6ac12b6918273631bf0ec25da2783f06f77a9a0ef2490afe43f3e8b0f553c0c1078141ec0d8f426b1924bd464e4240cda50e9b8a97050360a617eb4f88baa158da8672572f641b20ab3bcbab3d38ff3c84c5c3bf309e26c8ba735503700028c0806c29e02d0a0ed73b9c5c2f2a39f57ee08b935e6e056f01733a12b08603987b14aa7fc542c65a0c03e278723127bced6ac65d2386cf847a73057d19795d5a7517e71d5e480b7380866a64da32fcd1158af9a82559898a7931535a4b75326e2769711ff857d180f16acf316130574fd37bdb658b877f06db42ab96641bc75e3d4ad7fdd9028072139dd3019b03aad32907debef345bcc57423ddfc94683884a00c5f864b8c2dd5af081fa970da251d3afc65dd360c661d8ee2ab58dc9060e2d98b39ae95bb89c319cc93c9e653bf9db205338dc5528c11a391137fe496d726f1407945b243a49a1f3a786047fc47d5e5074e0ec678f26f30cba747d50070c00323d16cff4b06089830931ca704d386140f9c201a5b50a116410be001135aeaf30d7918ccdaf35482659fbb2933e97f1a2e0fc20e6a610e37511d06d4cf931e54ce8f5ab5f688e460e3943bbbe6949a8b4ae309ee31330ece6cb9dfcae0035f3808b7295776ae7bdafffadb6113faac5cd966c2875abb7b20f1b298b48cb78c467f1be92cd3a9d0fd35b7720334274a53a6cbd041b85b6f8f9d622293f0e95a8835204de1faeb7fcdcc57fbdf0afc2e6422bc114355cb5bc979f1bf6d0fb6eb31ee98e06cdcaa1ac36ed3246d85cbdaf999da5d6a7187e8622e6d224c5549a2f2802691a08242ed44a47fc9ad627af949ec3ab5b191025ac75ee7746e2762b530a622a716edbf341e4f9e04fa5d3f77c78dcde06f3845f45c8c1954120ac5949da541882d99adbbca4b0e422e4364289ff1a903bfd1ee63faaa40ef43d3e54249909066e1727591a9632cc8440dcedf931a823e9b542d51aee43897bbbc1f652ae774c326e8400a3a6ab8d90a04e5724fb39c05875ce5afff0502bb6164bc65c107593c155da4b77f136a34c9ec39a4e70cdc4f7fec68245402b2c0fb508eac623ab41a184d3bebe5e9f24c6590c1fee571ed55a76b8554b12116a36101691397d532b46924e6ccb688ab52ffc44f8a670d542477ebd3756d6ef5373024d3f915c187a35feaf39b76453ff835f73862bad13f19e76d47c70122911431e5f71b05a9728631df66b162e708584e83349db1a68368a37cfb4e16c9987a956b3018f2f12c639bf90b5fb0f0560fa7c19887a9d12316dab9bb515cddbae2e9056a556919476b47546c0dae631a88eb8bb9da49879f56efd3d1b65d50bb01c8b4ddc20374877189915cc5824200dfac8f422364b7178f2e7799665b464ac9ec54ffd87fc8dc68e08ab178059ec02bff4ae3c683d0c96796765bdc188c1a4ef46cfa9e6376678245f8d0c907e83e6eb78ffb19e75534925b5b5bfa489fb9cd2c68f00a079c9b34dc45e76044bbfc87c75bbdc5ed0ea7ca0f249007be79116fefa74085f982f670f821ccd0bb14e1086b677f379fd1a1c96bbb4a7338e867d3f91f41b0a7eb2f1104c2ed1593691e601f2e045b3db1cac5dc0d3b302b54967558057e767c4a96f0355d97beace9fe05f0513629b2dd4e86e523d16d7e2e129264e1749b07c062d3a92d96fff5cc976855540eb441a3cef8fc59bf236c85e778b04e30fa807c3ea634af17f005fb55b55f082ca54fc154e6b9df95b951ab9612da7223efc8b63f4528dc3353a15988790d507d9fda18dc8c4adefebc12567e040fd49d2d571437bada1c08054f45545e5cb33c8db8e5b4f2d6735a7fad407fea2ac6e516016c186b7a9b5586650178b3c201eb4fcda3a22291c1f5d66557675dfc73b17edd463abd17a3ec0f1b28adeb4c294c37900002665d504610d37de5dc68fa03e16243ebca169797205d2b24cd64cb1e37328530d68c9a279e36aa0c7f718831ac30607633eab2c9e1b8d6b78649a78fd573d07f0edc18d2f52da2213e2ad44a4bfb3a80ae71d8cf57a2ae2658999d542f7c46da5a30f0f4a82296d0c95e4c6f046db42a00d8631b120a64ee260bf4dbf29103d4e2233fed2ec9ae65fb109f212f967c34e0efb52f56a9a7ab4de472f9cdb0fbcd19fed42d80216c4c717e77a5e6a9118423e0a6dc9d2f3cef598fb9bed6b4e66b279ebbc265560a471d132a854ff230673e843338dcb1ae202c797cfa59dd18eb46e313f1b0dcafdb6518c1da6b08aa1c92bd433a0b65358356a8d03a454f96add1237380049b2567a24836b7bfbdfa58186f2e295e0911dcad6c5413fb36a6e637156291efc016e8513664d515d3ddba1d2c63fa6c5a3331c3cb2f5e2eaad83a75588aca785ada46973d8a2d89686a416720a8f98e1a1eaa8c95aa0bea1dad03ec69bc4bf8300a821f67db4e0c1aab57ef1d1e06880130f6ffe76297acc62879f60e03933666a0da462b7a6b584d28041a3fbafe9a08b7a4664c46b8d40ce4f31a14b122ad74cc4a003f591e019e23cf764795d4235cc8d491c58d3be78a781a708d9fda492306a5afa7c0a43f52f39cafc6a6abc850bbbfa6254fdfd5115727210e19ec8a8857c10a9e9d5cb3001c6e04132667a30a6528e8b59661b483e5365761ac0f5c61e339833b35fd8159875177ed2b78df49ef83b45584c4609562ed2e8bb9add69e88fc0774517a15575f0250d26ae8f6f138daba5311b492c986005bef123a6fc3c1912e378cae2b64e58542293489d5a0f8b582b089c1b05f3ad0aec776b9dcfc0feb1386a98b7e2e09671a73f0eca92364d7f6da861280815b71e48934bc3d321da07878290ec81d3c5c64b8d7f55c1d2e2713edbb5fef28bc36d02302b01c4c29e5df4a9692b41e8d9364e2e408c55b9b14d3ad93889a48787df0673c3df6ba3d9222ee348199aba478e2d398b1e4ae012ca19473b3454327e5bfefb3c56576b6a6c035466f7641464806e63d7086223395a58d886b0dbedd365ce840a6990f56d697605b7d0ac60809270e4e392e89413cc94cea1cb277c4aee023bf90ded9910c96eeead4c6a10ca17151c4966f84bea565746eab573e4295e564d41bc5a6cc9df38c3d7cbd4cd618bd9f292daf95472839fe71c1edc202b6b8b5b939250934ab0dc978397fbaa7533fcce0c4b2eed8ad47779aa4b21504307c7d15e0bcb01bb60e5bafabe66e4b689e4873a1067063e17ba7d647a9a047b1b4ef7350402653b564ae1b34b8597a2357891c90ca2af6b68b794680a0511279fd213eec48dfddba7cbeeb9f9335a0679b1e6db44f27b12d898575d157c2159a86f676df18858857582bffdc006d4732257ade5dde2d1b2cf316fe2a7c5b44505cc808eae5427c43d50e9b99f9317e437df2bc640351e3e8ac249c42f782d07886b6d8875c253ee0e489f1196fa604747586df87e18a893721e6cecfe61dd82daf9b3e4f1eb745c93402c121bb639c56b91bdc77262acfa55389ede1f092733d8a69ae759f82ceda537ffbf32b65138aa3e43e8883048eccf0929de8dee297c5eee97ac7633beae01198e1b00c11276502e7660cd1f59ac619200042656c6e9757b082d374c80182290845f1bc8f2589eaf96948f148ebe675ee7fdb83e32a18eade32f99cca160a4d3504c4bea9c82cfdfe1dd80fbda7c484f2c17c20eea00", 0x2000, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x78, 0x0, 0xfffffffffffffc25, {0x400000000003, 0x0, 0x0, {0x5, 0x0, 0x0, 0xd9, 0x7fff, 0x3, 0x0, 0xfffffffd, 0x0, 0x4009, 0x4007, 0x0, 0x0, 0x6, 0xe}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) munmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000) r5 = epoll_create1(0x80000) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000000)={0xa0000001}) r7 = socket(0x2b, 0x803, 0xfffffffc) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000520003002abd7000fbdbdf251c0800060000000000001e89"], 0x1c}, 0x1, 0x0, 0x0, 0x4c800}, 0x4000010) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket(0x40000000015, 0x5, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c00000015000103000000000000e7ff0b00000008000100", @ANYRES32=r9], 0x1c}, 0x1, 0x0, 0x0, 0xc001}, 0x4000000) r10 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r10, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r10, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r10, &(0x7f0000000040)={0x2, 0x6e27, @multicast1}, 0x10) sendmmsg(r10, &(0x7f0000007fc0), 0x800001d, 0x300) epoll_create(0x5) 6.144631568s ago: executing program 3 (id=3834): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0xeeee8000, 0x4, 0xe, 0x40, 0x1, 0xfd, 0xd4, 0xd4, 0x0, 0xd7, 0x7, 0x4f}, {0x5000, 0x2, 0xd, 0x9, 0x8, 0x3, 0x6, 0xb, 0x5, 0xf, 0x3, 0xc0}, {0x8080000, 0xdddd1000, 0xb, 0x1, 0x2, 0x0, 0x4, 0x1, 0x81, 0x0, 0xc4, 0x5}, {0x8000000, 0x2000, 0x8, 0xf8, 0x3, 0x46, 0x2, 0xd, 0x6, 0x3, 0x8, 0x1}, {0x100000, 0x4000, 0x9, 0x1, 0x3, 0x9, 0xd, 0x6, 0x5, 0x4, 0x2e, 0x4b}, {0x6000, 0x0, 0xb, 0x0, 0x3, 0x1, 0x1, 0xff, 0x4, 0x90, 0x1, 0xfc}, {0x6000, 0x0, 0xf, 0xff, 0x3, 0xff, 0x0, 0xb, 0x5, 0x7, 0x9, 0xf8}, {0xf7f63004, 0x8000000, 0xf, 0x5, 0x28, 0x3, 0xa, 0x9, 0x54, 0x1, 0xff, 0x7}, {0xeeef0000, 0x5}, {0x4, 0x9}, 0x40010000, 0x0, 0xffff1000, 0x300, 0x2, 0x2000, 0x100000, [0x3, 0x401, 0x6, 0xc5]}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0x2000, 0x4, 0x9, 0xffffffff, 0x0, [{0x81, 0x1, 0x2, '\x00', 0xff}, {0x6, 0x3, 0x5, '\x00', 0xcf}, {0x1, 0x2, 0x91, '\x00', 0x6}, {0x4, 0xfd, 0x8, '\x00', 0x97}, {0x9, 0xb, 0x80, '\x00', 0x8}, {0xfa, 0x6, 0xf, '\x00', 0x6}, {0x7, 0x15, 0x4, '\x00', 0xcf}, {0x7, 0xd, 0xf, '\x00', 0x1}, {0x98, 0x9, 0x4, '\x00', 0xff}, {0x1, 0x1, 0xfb, '\x00', 0x9}, {0xd, 0xfd, 0x8, '\x00', 0x9}, {0x2, 0x5, 0x10, '\x00', 0x5}, {0xf, 0x6, 0x42, '\x00', 0x7f}, {0x9, 0x1, 0x8, '\x00', 0x8}, {0x81, 0x10, 0x4, '\x00', 0x3d}, {0x1, 0xe, 0x2, '\x00', 0x20}, {0x0, 0xc, 0x20, '\x00', 0x5}, {0x20, 0x40, 0xb, '\x00', 0xfc}, {0xb, 0x2, 0x5, '\x00', 0x4}, {0xf9, 0x5, 0x9, '\x00', 0x8}, {0x1, 0x6, 0x5, '\x00', 0xa}, {0x9, 0xfc, 0x90, '\x00', 0x21}, {0x5, 0xeb, 0xc0}, {0x6, 0x5, 0x0, '\x00', 0xb}]}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/dev_mcast\x00') sendmsg$AUDIT_TTY_GET(r4, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x10, 0x3f8, 0x100, 0x70bd25, 0x25dfdbfb}, 0x10}, 0x1, 0x0, 0x0, 0x8002}, 0x404c084) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d3e457201e040b40e73e000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f0000000080)={0x24, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r5, 0x0, 0x0) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f00000003c0)={r4, 0x4, 0x0, 0x9}) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000180)={0x2c, r6, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_DEBUG_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}]}]}, 0x2c}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) 5.849664321s ago: executing program 2 (id=3835): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0300002e00090027bd70000000002804000000480311802e"], 0x35c}, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) 5.723813815s ago: executing program 1 (id=3837): r0 = syz_io_uring_setup(0x22f, &(0x7f0000019140)={0x0, 0x8ffd, 0x10000, 0x0, 0x100002cf}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f00000009c0)=@IORING_OP_RECVMSG={0xa, 0x25, 0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2000, 0x1, {0x5}}) io_uring_enter(r0, 0x7a98, 0x0, 0x0, 0x0, 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) r4 = syz_open_procfs(0x0, &(0x7f0000000180)='attr/sockcreate\x00') sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x80) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) syz_emit_ethernet(0x36, &(0x7f00000002c0)={@local, @multicast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "b81923", 0x0, 0x3c, 0x1, @local, @local}}}}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r5, 0x8982, &(0x7f0000002800)={0x1, 'vlan0\x00'}) r6 = fsopen(&(0x7f0000000000)='devpts\x00', 0x1) r7 = fcntl$dupfd(r6, 0x0, r6) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) setsockopt$MRT_INIT(r4, 0x0, 0xc8, &(0x7f0000000080), 0x1f) setsockopt$MRT_DEL_VIF(r3, 0x0, 0xcb, 0x0, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="822d34d15a4e1655b4041f86d6f90000000109021200010073a77a000000000000000000"], 0x0) 5.470126491s ago: executing program 0 (id=3838): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000001c0)=@newlink={0x58, 0x10, 0x40d, 0x70bd2a, 0xfffffffc, {0x0, 0x0, 0x0, 0x0, 0x600b2, 0x40e41}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_BC_QUEUE_LEN={0x8, 0x9, 0xfffffff8}, @IFLA_MACVLAN_MACADDR_MODE={0x8, 0x3, 0x2}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x48840}, 0x0) (fail_nth: 7) 4.742471892s ago: executing program 2 (id=3839): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x20, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@nested={0xc, 0x11, 0x0, 0x1, [@generic="31f9e05e2f826cfc"]}]}, 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0300002e00090027bd7000000000000400003f480311802e"], 0x35c}, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) 4.726191693s ago: executing program 0 (id=3840): socket$netlink(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) fchown(0xffffffffffffffff, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) shutdown(r2, 0x57fdb2f0a9f96757) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000200000019000000579f15bb77f402ed1e8b"]) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0x183822, 0x0) r4 = syz_io_uring_setup(0xd1, &(0x7f0000000480)={0x0, 0x0, 0x100, 0x0, 0x333}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r3, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x26, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r4, 0x47ba, 0x0, 0x0, 0x0, 0x0) 4.486409707s ago: executing program 2 (id=3841): openat2(0xffffffffffffff9c, 0x0, &(0x7f00000002c0)={0x600101, 0x361eec5d78782aad, 0x1}, 0x18) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x0, 0x1}) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000440)={0x44, &(0x7f00000001c0)={0x20, 0x5, 0x5, "8631dc94cb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x50, 0x24, 0xd0f, 0x3, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0x3}, {0xffff, 0xffff}, {0x4}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x9, 0x5, 0x5, 0x800, 0x0, 0x1aa2, 0xc}}, {0x4}}]}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x7}]}, 0x50}, 0x1, 0x0, 0x0, 0x1d4}, 0x8840) socket$packet(0x11, 0x3, 0x300) syz_usb_connect(0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000240)={0x0, 0x0, r1, 0x0}) ioctl$DRM_IOCTL_MODE_DIRTYFB(r0, 0xc01864b1, &(0x7f0000000040)={r6, 0x2, 0x1, 0x3, &(0x7f0000000100)=[{0x8001, 0x0, 0x10}, {0x1, 0xff0c, 0xd6, 0x9}, {0xbbfb, 0x5, 0xfffd, 0x101}]}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r7 = socket$kcm(0xa, 0x922000000003, 0x11) recvmsg(r7, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) close(r7) r8 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x0) syz_usb_connect$uac1(0x1, 0x0, 0x0, &(0x7f00000003c0)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x250, 0xf3, 0x9, 0x3, 0x8, 0x1}, 0x0, 0x0}) 3.578961304s ago: executing program 0 (id=3842): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f00000001c0)={0x6, 0x3, 0x2, {0x4, 0x1, 0x2, 0x1}}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) close(r3) pwritev2(r0, &(0x7f00000006c0)=[{&(0x7f0000000200)="d6e61feca157ab9e17f200fcd521d1123785dce185b0f57b257901c5c6426e6151dd6daa061f9259e4", 0x29}, {&(0x7f0000000380)="11a55806bf7d817ddc70f9fe2c0cc91e1d9e40e1641ce96196c1199d90abf992ca4c80c08da491324824d8e5347cf75059bf2d43f650bc4cccb117f4bb027f9ca788a651170be17794ed586541910ada45735b9e09f4931101f936939e3ac0238602cc69756e5eebc9bf48ebb0436730055b309dad794f3a66bfc4d56063fd72e07f4ca01cf5105f9d8d0ecab1b8f0709dde6aaca2b47c765b090524238932a60f33c4990381478fc783ead76b5e32af78a564bcaa387d636d332b9ccb02", 0xbe}, {&(0x7f00000005c0)="2fa2235547df07fd72ec58ad18ff43f8c9019dbfb553791e28a5218b1b2513280af4a1d6eab729d7f1d1b59454d44e1c9feb7df281430da92c7dfee3f2ded86112e433b8b57ea8c03bb37ba9777044bbd771026af439cd94ce485a2e7639779c34ac48ff8e3ad8b974aa8e1fefc6bd763e6ff02d27583bc221e4f778f9495801b28f2394474712f56597524f3e9ad613249840f39d251ff3c8af70536c3fb4d8b153f04f479e25b36b7a494641f018bd586e42aa133971347ea1231a3653884d20878515960834189cd90c8dcf0a7079a875dae60cf117d7", 0xd8}, {&(0x7f0000000480)="471bfd9a3bcad798378c5a91cf0c08a7b848ff6166bcfd6d8137a77fab5a832f237db01a0b63438b1e8fc4652614601667fa835c41fa8d73ed6c7708dde3", 0x3e}], 0x4, 0x4, 0xfc6, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) r4 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000cb768405e0483020b990102030109021b000100000000090400000101292000090509"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = openat$vimc2(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r5, 0xc0d05640, &(0x7f0000000000)={0xa, @pix_mp={0x9, 0x3, 0x32315659, 0x4, 0x1, [{0x400, 0x10}, {0x5, 0xc}, {0x2}, {0x2, 0x3532}, {0x7fff, 0x7}, {0x9, 0xa}, {0x2, 0x1000}, {0x7, 0x401}], 0x0, 0x63, 0x1, 0x0, 0x7}}) shutdown(r0, 0x1) syz_open_dev$audion(&(0x7f00000011c0), 0x3, 0x8c4201) fsopen(&(0x7f0000000580)='overlay\x00', 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x81) r7 = socket$inet(0x10, 0x80000, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) unshare(0x2a020400) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0x4, 0x4, 0x7}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r9}, &(0x7f00000002c0), &(0x7f0000000300)=r8}, 0x20) 2.805307374s ago: executing program 4 (id=3843): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000006b80)=[{{&(0x7f0000000040)={0xa, 0x4e24, 0x0, @local}, 0x1c, 0x0}}, {{&(0x7f0000000340)={0xa, 0x4e24, 0x0, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000003700)=[@dstopts_2292={{0x2e8, 0x29, 0x4, {0x0, 0x5a, '\x00', [@jumbo, @generic={0x0, 0xdf, "aac7f65dde66007550d861b7b537fd49b44ed35b0b7c2ed243f39735881ba7309715165c3b9edec92e7dadb7a5bbdd45a5fd4320d89ed45cf375461e38967ad0f0891dc4bbba54a2c4b99498353dcc9f0233d55a6e0fbf78c3ba4e983f48b6f65060c96fd75c4a82e937f62c958445a04c99c7646db75133bf141405b7db695b0de9a482a9dc8dc3a25f15db0153211c3604213a2baf4222bf165fdfa2ca3fddc94be49ac220c6fec65b5f419d364efc16072c068df6df4ff736f92d14e2d5c87eb699c31f1755ba93bf935b06fb93bdb863bb796b4fa365b5b80e7eacb78b"}, @enc_lim, @calipso={0x7, 0x18, {0x0, 0x4, 0x0, 0x0, [0x0, 0x0]}}, @calipso={0x7, 0xfffffffffffffd74, {0x0, 0xa, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}}, @calipso={0x7, 0x0, {0x0, 0x0, 0x0, 0x97ff, [0x0, 0x0, 0x0]}}]}}}], 0x2e8}}], 0x2, 0x0) 2.705575418s ago: executing program 4 (id=3844): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000000c0)=0xa0000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x13, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_IFNAME={0x0, 0x3, 'veth0_to_hsr\x00'}, @IFLA_MASTER={0x8}]}, 0x4c}}, 0x40000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000040)={@host}) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'gretap0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0x5}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x80000000}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x1}]}}]}, 0x48}}, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_int(r5, 0x0, 0x31, &(0x7f00000001c0)=0x6, 0x4) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f0000000000)={0x0, 0x0, 0x2001}) 2.660273641s ago: executing program 4 (id=3845): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, 0x0, 0x0, 0x12002, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) msgctl$MSG_STAT(0x0, 0xb, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$inet6(0xa, 0x3, 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000240), 0xd21, 0x4000) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42800) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x100011, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x34}, @exit], &(0x7f00000000c0)='GPL\x00', 0x9, 0x20}, 0x94) 2.604534612s ago: executing program 1 (id=3846): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)={{0x14, 0x10, 0x4, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x3000000}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x6c, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x40, 0x3, 0x0, 0x1, [{0x3c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x30, 0xb, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x10}, @NFTA_LIMIT_RATE={0xc}]}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xf0}}, 0x0) 2.514377476s ago: executing program 1 (id=3847): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000040)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a00100000000280", 0x2a}, {&(0x7f0000000400)="03000000", 0x4}], 0x2}, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602240000000e000a000f000006028000001294", 0x2e}], 0x1}, 0x90) 2.46424874s ago: executing program 1 (id=3848): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x81, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000027c0)='/proc/asound/timers\x00', 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) getsockopt$netlink(r3, 0x10e, 0xb, 0x0, 0x0) read$FUSE(r2, &(0x7f0000000180)={0x2020}, 0x2020) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000300)=ANY=[]) add_key$user(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xffffffffffffffff) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000a40)=@raw={'raw\x00', 0x3c1, 0x3, 0x530, 0x0, 0x18c, 0x203, 0x0, 0x19030000, 0x460, 0x2e0, 0x2e0, 0x460, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x300, 0x348, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x60}, {}, {0x0, 0x0, 0x0, 0x2000}, {}, {}, {}, {}, {}, {}, {0x0, 0x80}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x1}, {}, {0x16}, {0xfffc}, {}, {}, {}, {}, {}, {0x0, 0x0, 0xfe}, {}, {}, {}, {0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x9}]}}, @common=@hl={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@ipv6={@local, @mcast1, [0x0, 0xff000000, 0xffff00, 0xffffff00], [0xff, 0xffffffff, 0xffffff00, 0xffffffff], 'bridge_slave_1\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x3a, 0xb, 0x1, 0x2}, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x590) 2.309578338s ago: executing program 1 (id=3849): dup(0xffffffffffffffff) ioctl$TUNSETPERSIST(0xffffffffffffffff, 0x400454c9, 0x1) r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f, {0x0, 0x0, 0x1ff}}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0xffff030c) r1 = syz_open_dev$ndb(&(0x7f0000000180), 0x0, 0x80080) ioctl$BLKSECDISCARD(r1, 0x127d, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/pm_trace', 0x4042, 0x0) write$FUSE_NOTIFY_STORE(r4, 0x0, 0x28) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xc, 0x0, 0x3}, 0x0) fsopen(&(0x7f0000000380)='pipefs\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000180)={'veth0_virt_wifi\x00', &(0x7f0000000100)=@ethtool_rxfh_indir={0x38, 0x8, [0x8, 0x3, 0x4, 0xfffffe01, 0x3, 0x3, 0x9, 0x9]}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000020a01010000000000000000070000000000010073797a01040000000000000000070000000900020073797a31000000000900010073797a300000000008000540000000d0141000000c0a0103000000000000000007000000140000011000010000000000000000000084000a00"/144], 0x90}}, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) mkdir(&(0x7f0000000000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) unshare(0x24020400) unshare(0x2a020400) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = dup(r7) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) 1.934238429s ago: executing program 3 (id=3850): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000200)=[@in={0x2, 0x4e24, @local}], 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000140)=0x8, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1, 0xb, &(0x7f0000001580)=ANY=[@ANYBLOB="18000000010000000000000008000000180500002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000ffffff1fb703000001000000850000006900000095"], &(0x7f0000000000)='syzkaller\x00', 0x6, 0x1ae, &(0x7f00000003c0)=""/4085}, 0x94) socket(0xa, 0x5, 0x0) (async) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000200)=[@in={0x2, 0x4e24, @local}], 0x10) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) (async) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000140)=0x8, 0x4) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1, 0xb, &(0x7f0000001580)=ANY=[@ANYBLOB="18000000010000000000000008000000180500002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000ffffff1fb703000001000000850000006900000095"], &(0x7f0000000000)='syzkaller\x00', 0x6, 0x1ae, &(0x7f00000003c0)=""/4085}, 0x94) (async) 1.842278323s ago: executing program 3 (id=3851): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f00000005c0), r0) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000010000000800050001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5420800050000000000900008808c00008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c640009801c00008006"], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x80) 1.778314723s ago: executing program 3 (id=3852): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000030a01080000000000000000010040000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000088000000060a010400000000000000000100000008000b40000000000900010073797a3000000000600004805c0001800b0001007470726f787900004c0002800800034000000016080001"], 0x110}}, 0x40040) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sysvipc/sem\x00', 0x41, 0x0) 1.567502711s ago: executing program 3 (id=3853): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="fc01000019000100000000000000003cfc0200000000000000000000000000000000000000000000000000000000000000000003000000000200002008000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000000000000000000044010500ac14143b000000000000000000000000000004d22b"], 0x1fc}}, 0x0) 1.330237523s ago: executing program 3 (id=3854): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="170000000000000004000000ff00000000000000", @ANYRES32=0x1, @ANYBLOB="000000ed18b0c30d5300000000000000009c1579a06d744c3a00", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/21], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000000000004000000000000000000000000ac1414aa0000f7ffffffffffffff000000000000000000020a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f400002000000000000080000000000000000010000000000000044000500ac1414bb000000000000000000000000000004d43c00000002000000ffffffff0000000000000000000000000600000004000000010400"/180], 0xfc}}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000780)={@broadcast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00 \x00', 0x18, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, @local, {[], @mld={0x187, 0x0, 0x0, 0x0, 0x0, @local}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x11}, 0x90) syz_io_uring_setup(0xd1, &(0x7f0000000580)={0x0, 0x0, 0x100, 0x0, 0x24c}, &(0x7f0000000000)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0x0, &(0x7f00000002c0)=[{0x0}, {&(0x7f0000000240)=""/66, 0x42}], 0x2}) openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x10000, 0x6) unshare(0x28040600) syz_open_procfs(0x0, &(0x7f0000002080)='pagemap\x00') ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x89f6, &(0x7f0000000040)={'vxcan1\x00', @remote}) r7 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$SO_COOKIE(r4, 0x1, 0x39, &(0x7f00000001c0), &(0x7f0000000200)=0x8) sendmsg$TIPC_NL_KEY_SET(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00', @ANYRES16, @ANYBLOB], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) 1.191048916s ago: executing program 4 (id=3855): set_mempolicy(0x4, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001340)=ANY=[@ANYBLOB="bf16000000000005b70700000100f0ff4870000000000000200000000000e0ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9effff0000751c5c652fbc1626cca2a2ad75806150ae0209e62f55ee988e6e06c8206ac6939fc404004900c788b277be1cb79b0a4dcf3ed410f6accd3641110bec4e90a634199e07f8f6eb9604000e011ea665c45a3449abe802f5ab3e89cf6cfdffffffb8580218ce740068720000074e8b1715807ea0ca469e468eea13c9a77e1c89c5082a703fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000200000000005335000000143ea7042ab40c7cb70cc8943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a330100846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850bf895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2200af6c7784a1975fabc0c4dd418c005479ecab19bdfb15a32a4fd67ce446adb431d7e74853b7978639be2463308af07db79240acaf0910300000077d05d988d6efdffdf48dca02113a38300cabf2b5543ffc166955709009e000000000061622718551c20ec23812770d72c700a417e214680c0fdd3eef2f7fe7545cc44e113d17088fdd00600000f7889b8d7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f740586903500090000000000000000be34b10f9d640dd782ac0c000abcf72846903243d0d0f4bc7fb0a0d7c5000032daaf281c450e64c33aac8ff7e7d1c94c4505a9839688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0400f5e1671bc5eb7739daa7820a91cb0e732df2ae1d39c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b4bfaf5a6b649dd5f13cd776e6c7c4b5c4b0de20e0c81efb5e392a13cdd2ce219e6733b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13f334aae90981ecaf5f744f22f2e45afe2c9e863fef0ad9d1ac32276cffe5f1fc21390797d0244cf1ce269d10525745caaa3f77d1b80116cb385a0242010000000100000091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025e2a9a135c0508af1aec2926627b43bba1229a7466bdca64f514b7911458da09fe8681916d408d753226a83ae2424ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514406b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd911e0e5f00019be25b5910a3193e90be231a05fd82e6003969c3f001000000b50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f55136628090702f70000d0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a58a0aa9a821667c685492a1689ad4218cea744b332ab232a09cf1ec375627074ce2d3d7619936768a84a1465fff4610cf8838b28319e0f79533d87eedba54355434f132ab7b8840558b3f918d675a79907a72a8252cd3fbaea5d3006a03507838231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68196c7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb511164f1502ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f278ea00cee8a2088359946e72f80bb1c9cfcde57b79625e2979fe689a5a246cbbdf6ad488f43f46b2536f175f46dfb27d5229467270246ab53616c46edf34c559d3de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546eb7c32dbecb18a308a0004be94dfab28c2a51dc856df0000000010c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5da0f26126d4cf2c73e5f94030000040000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e68a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d0e68d7eef5d32d5fcc7923d7544fa492aa38717481c55e86dcd7816ad8940bd19953603000000adeb9117e8b94ab422c8d62f858875dccdbc895722313e14f17cb7df1e2885ef5d6df6a9c55f8df763c7c64da7cc017e1e3f5cd4cb9fe6d19b11d4d38239d318016be64dc097982e23462392a0cd05afb2e060fd6424a942ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1af45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5d81aebc0cada819895b377d6cf0a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9573abb0a4da534d735a223626402b308daf7835780fa6f46410000000000fb00000000000000000000b1495213060000000000000049584655c4fce8c5bb7ccb49926c4be9ee4659153d9fa95d07cc4efdab2c355efe8e8d0255d0b748366dafe042d78479c21d832e1431ed6d646d13e8e7230300920a5642bbed1dee9b46b6122f572047ccf3c8edd82660e5d74c52be71d780c30000000000fd00000000000000000000000044ff72f96f084f4b6cdcb1b4a9d8e9f985ed743bd321b4df04c8a0034c09caeeb0e34799b755649883539258a7b33dcef15d8fd1953ebaaa3cff81a0de7a05a440f20f6b273ceb8678f10378b670be7504dabd1471355d853292775d0366891f0bcf0a6087ed4f1f2def52394db3e9d8318bbb9baff3db95bfd69e08ded502cc08a485c804e4fd107a7ca2a64ca081c6b2f7b895cdf98b763ebab9451c65eced6f5f97a541210806d885762ac3150225036c7eccd7a05593abd963f9a02df58085115e54f675e6a08d05b5722cabf989b4bbc562e073b81bae61f05c5e1f90e021340b60cc5fb8fdb09b6d20b0d87a6ed800000000000000000000000000000000006cc6f64f583a26a78f7f417f66c0a832f5194ddfce51e5aff28f621bb2fd2a5ab719df823488d6e869b08d3d4ac7950c60144cf77437e29895a23282e3c65e015d1c324832a90ee77d93596e3f1287552e0c8cdb326c5118d2e9ca8c67c7f3c9b66c9cb03edec184ad1d9544c7a3be250e471dca00000078544d79c0efe4094e561eeb26ee4c81106d03c004bc1589ef6e13648999c8735e26aa90c571fa3c07238697b13c52715055445e96995fe3273b0346b03fc742c06aa3947e0d9cf0c99b5e245ede85893112deea8bd3355a32ec15e1242f170e42f28cea4105541e11c8605628b9ca935bc252fee8b596a52da4984d26bd29cb0623f00c6b0a4c00ad406d729babb8fa16f3182c5b98493a5aa943aa3a777a751f56e0c7a74f7f63d83ff119561acd5fe560563b051dc29ac586b21148ad5a5498369ac347d19660c132b1df58d65418bc824d8b88b699462c2ce6524eaf0905445413033f041a26b189f2553ef218eba22152a4dc979a0e37396ae1a2883b1e4d44c8af7973d5c1f286c26459209db5a9a51dc69d0ba3fb6c884e50be3598ac53295137c97dabe52d98fed0b352c0b68b7e75ed59931ef57bb5fc28d5b1f914fc8abbb444637a5dfbac5035eb0713efb823360a8da80e4265e599f76952a8082b8c5f7890275a922cd2cca2f75dcca6849e89e1bab32fe9b598c60407e4c21d7565dc6ab0a6d43b60f8d08ddf27a286807692d18973edaa6d5401c79b3cafaab4a8d6c946cbe5de350000000022e16a5f72c6d41dc9de8517fdcfa0c0efca880257443cfc3057c353569ffb1588b4bb261a6e99c5936e1b4339d87ec84db99e797f44451fc6b5da1950d24b3d4118f2288804740e605500c1f493c7dc42164cc6c1b01a329ce95272a07a355d4ba705b5e71ce5e1042a0c638e565881e5eedbc62f79407b73ae787c9cdb752eda44aeef962c93ab245f61e8ca5c0d41cc56124840f1"], &(0x7f0000000140)='GPL\x00'}, 0x48) 979.506047ms ago: executing program 2 (id=3856): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) close(0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58) openat$tun(0xffffffffffffff9c, 0x0, 0x20702, 0x0) socket(0x400000000010, 0x3, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000380)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000340), 0x6, 0x6, 0x7}) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x7bff, &(0x7f0000000180)={&(0x7f0000000140)=@delqdisc={0xfffffffffffffc9b, 0x25, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff0}}}, 0x49d32d254ae22f79}}, 0x0) 886.296815ms ago: executing program 4 (id=3857): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="020300000e000000000000000000000505000600000000000a00000000000000000000000000000000000000000000000000000000400000020001000000000000000a18ff00000005000500000000000a"], 0x70}}, 0x0) 764.479262ms ago: executing program 4 (id=3858): madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) timer_create(0x0, &(0x7f0000000280)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f00001cd000/0x1000)=nil, &(0x7f000050b000/0x1000)=nil, 0x9, &(0x7f0000000480)=[{0x800, 0x100000003, 0x1}], 0x1, 0x0, 0x47, 0xd01c0000200000, 0x0, 0x76}) 0s ago: executing program 1 (id=3859): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/crypto\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023893) (async) syz_usb_connect(0x0, 0x3f, &(0x7f0000000440)=ANY=[@ANYBLOB="12011001d31ad240f0031d5842bb0102030109022d0005000000000904c50003ff01070009050502080000030109050c"], 0x0) kernel console output (not intermixed with test programs): river returned -16 [ 650.469756][ T5918] usb 2-1: USB disconnect, device number 116 [ 650.481312][ T5917] usb 5-1: Using ep0 maxpacket: 32 [ 650.503359][ T5917] usb 5-1: config 1 has an invalid interface number: 50 but max is 0 [ 650.514822][ T5917] usb 5-1: config 1 has no interface number 0 [ 650.528793][ T5917] usb 5-1: config 1 interface 50 has no altsetting 0 [ 650.541277][ T5917] usb 5-1: New USB device found, idVendor=04f1, idProduct=3012, bcdDevice=b5.94 [ 650.551053][ T5917] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 650.572445][ T5917] usb 5-1: Product: syz [ 650.576650][ T5917] usb 5-1: Manufacturer: syz [ 650.586680][ T5917] usb 5-1: SerialNumber: syz [ 650.602144][T16320] netlink: 6 bytes leftover after parsing attributes in process `syz.3.3288'. [ 650.617337][ T5917] ipaq 5-1:1.50: PocketPC PDA converter detected [ 650.627652][T16320] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 650.644083][ T5896] dvb-usb: bulk message failed: -22 (1/0) [ 650.656285][ T5896] dvb-usb: error while querying for an remote control event. [ 650.729407][ T5896] usb 4-1: USB disconnect, device number 3 [ 650.762801][ T5896] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 650.821237][ T5917] usb 5-1: PocketPC PDA converter now attached to ttyUSB0 [ 651.024328][ T5918] usb 5-1: USB disconnect, device number 121 [ 651.035116][ T5918] ipaq ttyUSB0: PocketPC PDA converter now disconnected from ttyUSB0 [ 651.045125][ T5918] ipaq 5-1:1.50: device disconnected [ 651.364390][T16354] netlink: 388 bytes leftover after parsing attributes in process `syz.3.3299'. [ 651.491061][T16358] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3301'. [ 652.440013][T16379] loop9: detected capacity change from 0 to 7 [ 652.488530][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 652.593565][T16379] Dev loop9: unable to read RDB block 7 [ 652.597122][T16383] x_tables: duplicate underflow at hook 2 [ 652.624369][T16379] loop9: unable to read partition table [ 652.689396][ T5918] IPVS: starting estimator thread 0... [ 652.690669][T16379] loop9: partition table beyond EOD, truncated [ 652.715635][T16379] loop_reread_partitions: partition scan of loop9 (被x ) failed (rc=-5) [ 652.828450][T16390] IPVS: using max 49 ests per chain, 117600 per kthread [ 652.858621][ T5917] usb 5-1: new low-speed USB device number 122 using dummy_hcd [ 652.981190][T16398] loop2: detected capacity change from 0 to 7 [ 652.997571][ T6414] Dev loop2: unable to read RDB block 7 [ 653.003808][ T6414] loop2: AHDI p1 p2 p3 p4 [ 653.008672][ T6414] loop2: partition table partially beyond EOD, truncated [ 653.017615][ T6414] loop2: p1 start 1601398130 is beyond EOD, truncated [ 653.024767][ T6414] loop2: p2 start 1702059890 is beyond EOD, truncated [ 653.034381][ T6414] loop2: p3 start 9602159 is beyond EOD, truncated [ 653.044139][ T5917] usb 5-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 653.081893][ T5917] usb 5-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 653.092983][ T5917] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 653.140584][T16398] Dev loop2: unable to read RDB block 7 [ 653.168490][T16398] loop2: AHDI p1 p2 p3 p4 [ 653.173130][T16398] loop2: partition table partially beyond EOD, truncated [ 653.186857][T16398] loop2: p1 start 1601398130 is beyond EOD, truncated [ 653.196853][T16398] loop2: p2 start 1702059890 is beyond EOD, truncated [ 653.205504][T16398] loop2: p3 start 9602159 is beyond EOD, truncated [ 653.372343][T16402] xt_hashlimit: max too large, truncated to 1048576 [ 653.382071][T16402] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 653.392591][ T5917] usb 5-1: string descriptor 0 read error: -71 [ 653.403470][T16404] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3317'. [ 653.419014][ T5917] hub 5-1:32.0: bad descriptor, ignoring hub [ 653.438537][ T5917] hub 5-1:32.0: probe with driver hub failed with error -5 [ 653.559348][ T5917] usb 5-1: USB disconnect, device number 122 [ 653.610682][T14171] hid_parser_main: 61 callbacks suppressed [ 653.610703][T14171] hid-generic 0000:0000:0000.0024: unknown main item tag 0x0 [ 653.653077][T14171] hid-generic 0000:0000:0000.0024: hidraw0: HID v0.00 Device [syz1] on syz0 [ 653.725029][T16412] netlink: 388 bytes leftover after parsing attributes in process `syz.0.3320'. [ 653.757177][T16413] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3319'. [ 653.845610][T16416] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3321'. [ 653.903309][T16416] bridge0: port 2(bridge_slave_1) entered disabled state [ 653.955230][T16416] bridge_slave_1: left allmulticast mode [ 653.966151][T16416] bridge_slave_1: left promiscuous mode [ 653.976108][T16416] bridge0: port 2(bridge_slave_1) entered disabled state [ 654.110621][T16423] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3322'. [ 654.140152][T16426] CUSE: unknown device info "" [ 654.150146][T16426] CUSE: unknown device info "" [ 654.155095][T16426] CUSE: unknown device info "" [ 654.160279][T16426] CUSE: unknown device info "" [ 654.165209][T16426] CUSE: unknown device info "" [ 654.170988][T16426] CUSE: unknown device info "" [ 654.175943][T16426] CUSE: unknown device info "" [ 654.184857][T16426] CUSE: unknown device info "" [ 654.212374][T16426] CUSE: zero length info key specified [ 654.296016][T16435] netlink: 'syz.0.3327': attribute type 10 has an invalid length. [ 654.324083][T16435] team0: Port device dummy0 added [ 654.334529][T16435] netlink: 'syz.0.3327': attribute type 10 has an invalid length. [ 654.350108][T16435] team0: Port device dummy0 removed [ 654.358046][T16435] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 654.358444][ T5917] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 654.498463][ T5917] usb 4-1: device descriptor read/64, error -71 [ 654.748451][ T5917] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 654.878611][ T5917] usb 4-1: device descriptor read/64, error -71 [ 654.999756][ T5917] usb usb4-port1: attempt power cycle [ 655.096927][T16446] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3331'. [ 655.153390][T16448] netlink: 'syz.4.3332': attribute type 1 has an invalid length. [ 655.179904][T16448] 8021q: adding VLAN 0 to HW filter on device bond1 [ 655.196865][T16448] bond1: (slave geneve2): making interface the new active one [ 655.205358][T16448] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 655.259550][T16451] netlink: 'syz.4.3333': attribute type 10 has an invalid length. [ 655.267407][T16451] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3333'. [ 655.358711][ T5917] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 655.379291][ T5917] usb 4-1: device descriptor read/8, error -71 [ 655.618508][ T5917] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 655.649044][ T5917] usb 4-1: device descriptor read/8, error -71 [ 655.689212][ T10] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 655.771789][ T5917] usb usb4-port1: unable to enumerate USB device [ 655.876596][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 655.904144][ T10] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 655.941304][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 655.983708][ T10] usb 5-1: Product: syz [ 655.988067][ T10] usb 5-1: Manufacturer: syz [ 656.023571][ T10] usb 5-1: SerialNumber: syz [ 656.040136][ T10] usb 5-1: config 0 descriptor?? [ 656.378582][ T5896] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 656.530121][ T5896] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 656.544720][ T5896] usb 3-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 656.555244][ T5896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 656.567282][ T5896] usb 3-1: config 0 descriptor?? [ 656.908783][T16468] xt_bpf: check failed: parse error [ 656.917271][T16472] netlink: 380 bytes leftover after parsing attributes in process `syz.3.3338'. [ 656.939748][T16470] bond1: option ad_user_port_key: invalid value (49764) [ 656.946758][T16470] bond1: option ad_user_port_key: allowed values 0 - 1023 [ 656.961116][T16470] bond1 (unregistering): Released all slaves [ 657.037890][ T5896] steelseries 0003:1038:12B6.0025: reserved main item tag 0xd [ 657.046429][ T5896] steelseries 0003:1038:12B6.0025: item fetching failed at offset 6/7 [ 657.062317][ T5896] steelseries 0003:1038:12B6.0025: probe with driver steelseries failed with error -22 [ 657.235876][T14171] usb 3-1: USB disconnect, device number 3 [ 657.798655][ T5918] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 657.948441][ T5918] usb 2-1: Using ep0 maxpacket: 32 [ 657.956346][ T5918] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 657.966440][ T5918] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 658.054534][ T5918] usb 2-1: config 0 descriptor?? [ 658.480643][ T5918] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 658.548252][ T5903] usb 5-1: USB disconnect, device number 123 [ 658.553997][ T5918] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 658.632946][ T5918] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 658.642935][ T5918] usb 2-1: media controller created [ 658.702899][T16507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 658.726297][T16507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 658.747123][ T5918] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 658.825201][T16482] pimreg3: entered allmulticast mode [ 659.058203][ T5918] DVB: Unable to find symbol dib7000p_attach() [ 659.069714][ T5918] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 659.128587][ T5910] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 659.238565][ T5918] rc_core: IR keymap rc-dib0700-rc5 not found [ 659.245112][ T5918] Registered IR keymap rc-empty [ 659.252609][ T5918] dvb-usb: could not initialize remote control. [ 659.260841][ T5918] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 659.278897][ T5918] usb 2-1: USB disconnect, device number 117 [ 659.300055][ T5910] usb 5-1: config 0 has no interfaces? [ 659.315385][ T5910] usb 5-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 659.326855][ T5910] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 659.350872][ T5910] usb 5-1: Product: syz [ 659.355074][ T5910] usb 5-1: Manufacturer: syz [ 659.361784][ T5918] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 659.371255][ T5910] usb 5-1: SerialNumber: syz [ 659.382946][ T5910] usb 5-1: config 0 descriptor?? [ 659.448548][ T5903] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 659.588442][ T5903] usb 3-1: device descriptor read/64, error -71 [ 659.598686][T16513] dummy0: entered promiscuous mode [ 659.603859][T16513] vlan2: entered promiscuous mode [ 659.608504][ T5896] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 659.705287][ T5918] usb 5-1: USB disconnect, device number 124 [ 659.800014][ T5896] usb 4-1: config 2 has no interfaces? [ 659.809016][ T5896] usb 4-1: New USB device found, idVendor=19d2, idProduct=1181, bcdDevice=51.48 [ 659.820179][ T5896] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 659.828413][ T5903] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 660.007981][ T5903] usb 3-1: device descriptor read/64, error -71 [ 660.128868][ T5903] usb usb3-port1: attempt power cycle [ 660.237726][ T5910] usb 4-1: USB disconnect, device number 8 [ 660.425213][T16535] syzkaller0: entered promiscuous mode [ 660.434744][T16535] syzkaller0: entered allmulticast mode [ 660.468448][ T5903] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 660.529097][ T5903] usb 3-1: device descriptor read/8, error -71 [ 660.748496][ T5910] usb 2-1: new full-speed USB device number 118 using dummy_hcd [ 660.788478][ T5903] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 660.829650][ T5903] usb 3-1: device descriptor read/8, error -71 [ 660.894265][T16546] xt_hashlimit: max too large, truncated to 1048576 [ 660.904691][T16546] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 660.920504][ T5910] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 660.931062][ T5910] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 660.940386][ T5910] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 660.949589][ T5903] usb usb3-port1: unable to enumerate USB device [ 660.960981][ T5910] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 660.981273][ T5910] usb 2-1: config 0 descriptor?? [ 660.991160][ T5910] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 660.997821][ T5910] dvb-usb: bulk message failed: -22 (3/0) [ 661.017647][ T5910] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 661.029690][ T5910] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 661.039626][ T5910] usb 2-1: media controller created [ 661.050991][ T5910] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 661.073571][ T5896] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 661.081782][ T5910] dvb-usb: bulk message failed: -22 (6/0) [ 661.093134][ T5910] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 661.110055][ T5910] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input66 [ 661.126295][ T5910] dvb-usb: schedule remote query interval to 150 msecs. [ 661.135311][ T5910] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 661.190569][T16552] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3368'. [ 661.221495][T16539] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 661.241972][ T5896] usb 4-1: config 0 interface 0 has no altsetting 0 [ 661.251133][T16539] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 661.259547][ T5896] usb 4-1: New USB device found, idVendor=1b1c, idProduct=0a1e, bcdDevice= 0.00 [ 661.281671][ T5896] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 661.288465][ T5947] dvb-usb: bulk message failed: -22 (1/0) [ 661.295988][ T5947] dvb-usb: error while querying for an remote control event. [ 661.309854][ T5896] usb 4-1: config 0 descriptor?? [ 661.356799][T16558] netlink: 6 bytes leftover after parsing attributes in process `syz.1.3362'. [ 661.386108][T16558] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 661.479107][ T5947] dvb-usb: bulk message failed: -22 (1/0) [ 661.488257][ T5947] dvb-usb: error while querying for an remote control event. [ 661.534570][T16563] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3371'. [ 661.649604][ T5947] dvb-usb: bulk message failed: -22 (1/0) [ 661.655400][ T5947] dvb-usb: error while querying for an remote control event. [ 661.674640][ T5903] usb 2-1: USB disconnect, device number 118 [ 661.718218][T16568] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3373'. [ 661.731773][ T5903] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 661.755186][ T5896] hid-corsair-void 0003:1B1C:0A1E.0026: collection stack underflow [ 661.784187][ T5896] hid-corsair-void 0003:1B1C:0A1E.0026: item 0 0 0 12 parsing failed [ 661.796029][ T5896] hid-corsair-void 0003:1B1C:0A1E.0026: parse failed (reason: -22) [ 661.806820][ T5896] hid-corsair-void 0003:1B1C:0A1E.0026: probe with driver hid-corsair-void failed with error -22 [ 662.315963][T16592] syzkaller1: entered promiscuous mode [ 662.323294][T16592] syzkaller1: entered allmulticast mode [ 662.338606][ T5903] usb 5-1: new full-speed USB device number 125 using dummy_hcd [ 662.405819][T16596] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 662.454425][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 662.454445][ T30] audit: type=1326 audit(1763640475.082:724): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16586 comm="syz.0.3380" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe4b918f749 code=0x0 [ 662.540610][ T5903] usb 5-1: config 0 has an invalid interface number: 176 but max is 0 [ 662.548926][ T5903] usb 5-1: config 0 has no interface number 0 [ 662.557433][ T5903] usb 5-1: config 0 interface 176 altsetting 0 endpoint 0x4 has invalid maxpacket 59391, setting to 64 [ 662.626605][ T5903] usb 5-1: New USB device found, idVendor=0499, idProduct=1039, bcdDevice= c.76 [ 662.635877][ T5903] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.644340][ T5903] usb 5-1: Product: syz [ 662.650792][ T5903] usb 5-1: Manufacturer: syz [ 662.655753][ T5903] usb 5-1: SerialNumber: syz [ 662.664698][ T5903] usb 5-1: config 0 descriptor?? [ 662.681038][T16577] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 662.689594][T16577] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 663.078983][T16604] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 663.208172][T16604] bond1 (unregistering): Released all slaves [ 663.484564][ T5903] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 663.513752][ T5903] usb 5-1: USB disconnect, device number 125 [ 663.668509][ T5910] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 663.834476][ T5910] usb 2-1: config 0 has no interfaces? [ 663.846896][ T5910] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 663.856458][ T5910] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 663.870161][ T5910] usb 2-1: Product: syz [ 663.879446][ T5910] usb 2-1: Manufacturer: syz [ 663.889368][ T5910] usb 2-1: SerialNumber: syz [ 663.901214][ T5910] usb 2-1: config 0 descriptor?? [ 664.043379][ T5910] usb 4-1: USB disconnect, device number 9 [ 664.281295][T16624] netlink: 264 bytes leftover after parsing attributes in process `syz.3.3390'. [ 664.389329][ T5903] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 664.528890][ T5903] usb 5-1: device descriptor read/64, error -71 [ 664.600665][ T5910] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 664.678553][ T10] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 664.760192][ T5910] usb 3-1: config index 0 descriptor too short (expected 64051, got 10) [ 664.768798][ T5910] usb 3-1: config 0 has too many interfaces: 255, using maximum allowed: 32 [ 664.777476][ T5910] usb 3-1: config 0 descriptor has 1 excess byte, ignoring [ 664.778440][ T5903] usb 5-1: new high-speed USB device number 127 using dummy_hcd [ 664.794257][ T5910] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 255 [ 664.807099][ T5910] usb 3-1: New USB device found, idVendor=0456, idProduct=b000, bcdDevice=ab.07 [ 664.816804][ T5910] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.825298][ T5910] usb 3-1: Product: syz [ 664.834981][ T5910] usb 3-1: Manufacturer: syz [ 664.843268][ T5910] usb 3-1: SerialNumber: syz [ 664.885573][ T5910] usb 3-1: config 0 descriptor?? [ 664.892480][ T10] usb 4-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 664.909650][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.927975][ T10] usb 4-1: Product: syz [ 664.937711][ T10] usb 4-1: Manufacturer: syz [ 664.951972][ T10] usb 4-1: SerialNumber: syz [ 664.967088][ T10] usb 4-1: config 0 descriptor?? [ 664.972467][ T5903] usb 5-1: device descriptor read/64, error -71 [ 665.089432][ T5903] usb usb5-port1: attempt power cycle [ 665.126419][T16626] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 665.163189][T16626] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 665.176566][ T10] usb 3-1: USB disconnect, device number 8 [ 665.190796][ T5910] usb 4-1: USB disconnect, device number 10 [ 665.394209][T16628] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3392'. [ 665.403514][T16628] bridge_slave_1: left allmulticast mode [ 665.410397][T16628] bridge_slave_1: left promiscuous mode [ 665.416888][T16628] bridge0: port 2(bridge_slave_1) entered disabled state [ 665.426093][T16628] bridge_slave_0: left allmulticast mode [ 665.433243][T16628] bridge_slave_0: left promiscuous mode [ 665.440179][T16628] bridge0: port 1(bridge_slave_0) entered disabled state [ 665.448938][ T5903] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 665.479313][ T5903] usb 5-1: device descriptor read/8, error -71 [ 665.728672][ T5903] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 665.749095][ T5903] usb 5-1: device descriptor read/8, error -71 [ 665.858626][ T5903] usb usb5-port1: unable to enumerate USB device [ 665.948556][ T5947] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 666.090623][T16635] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3395'. [ 666.110832][ T5947] usb 3-1: Using ep0 maxpacket: 32 [ 666.120276][ T5947] usb 3-1: config 0 has an invalid interface number: 126 but max is 0 [ 666.128873][ T5947] usb 3-1: config 0 has no interface number 0 [ 666.136091][ T5947] usb 3-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 666.148667][ T5947] usb 3-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 666.159659][ T5947] usb 3-1: config 0 interface 126 has no altsetting 0 [ 666.173456][ T5947] usb 3-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 666.183281][ T5947] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.192351][ T5947] usb 3-1: Product: syz [ 666.196784][ T5947] usb 3-1: Manufacturer: syz [ 666.201846][ T5947] usb 3-1: SerialNumber: syz [ 666.212462][ T5947] usb 3-1: config 0 descriptor?? [ 666.219205][T16633] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 666.226604][T16633] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 666.634877][ T5910] usb 2-1: USB disconnect, device number 119 [ 666.644972][ T5947] ir_usb 3-1:0.126: IR Dongle converter detected [ 666.775611][T16643] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3398'. [ 666.895075][ T5947] usb 3-1: IRDA class descriptor not found, device not bound [ 667.100456][ T5903] usb 3-1: USB disconnect, device number 9 [ 667.129658][T16648] tipc: Started in network mode [ 667.135201][T16648] tipc: Node identity 00000000000000000000ffffe0000002, cluster identity 4711 [ 667.152657][T16648] tipc: Enabling of bearer rejected, failed to enable media [ 667.444647][T16656] FAULT_INJECTION: forcing a failure. [ 667.444647][T16656] name failslab, interval 1, probability 0, space 0, times 0 [ 667.458932][T16656] CPU: 0 UID: 0 PID: 16656 Comm: syz.1.3403 Not tainted syzkaller #0 PREEMPT(full) [ 667.458959][T16656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 667.458971][T16656] Call Trace: [ 667.458978][T16656] [ 667.458987][T16656] dump_stack_lvl+0x189/0x250 [ 667.459019][T16656] ? __pfx____ratelimit+0x10/0x10 [ 667.459046][T16656] ? __pfx_dump_stack_lvl+0x10/0x10 [ 667.459072][T16656] ? __pfx__printk+0x10/0x10 [ 667.459099][T16656] ? __pfx___might_resched+0x10/0x10 [ 667.459127][T16656] should_fail_ex+0x414/0x560 [ 667.459163][T16656] should_failslab+0xa8/0x100 [ 667.459186][T16656] __kmalloc_cache_noprof+0x6f/0x6f0 [ 667.459215][T16656] ? xfrm_policy_alloc+0x78/0x2b0 [ 667.459243][T16656] xfrm_policy_alloc+0x78/0x2b0 [ 667.459266][T16656] xfrm_policy_construct+0x39/0x6b0 [ 667.459300][T16656] xfrm_add_policy+0x267/0x800 [ 667.459331][T16656] ? __pfx_xfrm_add_policy+0x10/0x10 [ 667.459354][T16656] ? apparmor_capable+0x137/0x1b0 [ 667.459383][T16656] ? __nla_parse+0x40/0x60 [ 667.459410][T16656] xfrm_user_rcv_msg+0x7a3/0xab0 [ 667.459441][T16656] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 667.459504][T16656] ? __pfx___mutex_trylock_common+0x10/0x10 [ 667.459532][T16656] ? rcu_is_watching+0x15/0xb0 [ 667.459554][T16656] ? trace_contention_end+0x39/0x120 [ 667.459578][T16656] ? __mutex_lock+0x335/0x1350 [ 667.459614][T16656] netlink_rcv_skb+0x208/0x470 [ 667.459636][T16656] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 667.459660][T16656] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 667.459696][T16656] ? netlink_deliver_tap+0x2e/0x1b0 [ 667.459716][T16656] ? netlink_deliver_tap+0x2e/0x1b0 [ 667.459739][T16656] xfrm_netlink_rcv+0x79/0x90 [ 667.459764][T16656] netlink_unicast+0x82f/0x9e0 [ 667.459804][T16656] ? __pfx_netlink_unicast+0x10/0x10 [ 667.459835][T16656] ? netlink_sendmsg+0x642/0xb30 [ 667.459854][T16656] ? skb_put+0x11b/0x210 [ 667.459879][T16656] netlink_sendmsg+0x805/0xb30 [ 667.459917][T16656] ? __pfx_netlink_sendmsg+0x10/0x10 [ 667.459942][T16656] ? aa_sock_msg_perm+0xf1/0x1d0 [ 667.459973][T16656] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 667.459993][T16656] ? __pfx_netlink_sendmsg+0x10/0x10 [ 667.460015][T16656] __sock_sendmsg+0x21c/0x270 [ 667.460047][T16656] ____sys_sendmsg+0x505/0x830 [ 667.460075][T16656] ? __pfx_____sys_sendmsg+0x10/0x10 [ 667.460107][T16656] ? import_iovec+0x74/0xa0 [ 667.460136][T16656] ___sys_sendmsg+0x21f/0x2a0 [ 667.460161][T16656] ? __pfx____sys_sendmsg+0x10/0x10 [ 667.460219][T16656] ? __fget_files+0x2a/0x420 [ 667.460237][T16656] ? __fget_files+0x3a0/0x420 [ 667.460267][T16656] __x64_sys_sendmsg+0x19b/0x260 [ 667.460292][T16656] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 667.460323][T16656] ? __pfx_ksys_write+0x10/0x10 [ 667.460355][T16656] ? do_syscall_64+0xbe/0xfa0 [ 667.460387][T16656] do_syscall_64+0xfa/0xfa0 [ 667.460414][T16656] ? lockdep_hardirqs_on+0x9c/0x150 [ 667.460441][T16656] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.460461][T16656] ? clear_bhb_loop+0x60/0xb0 [ 667.460486][T16656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.460506][T16656] RIP: 0033:0x7ff495f8f749 [ 667.460526][T16656] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 667.460545][T16656] RSP: 002b:00007ff496e75038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 667.460567][T16656] RAX: ffffffffffffffda RBX: 00007ff4961e5fa0 RCX: 00007ff495f8f749 [ 667.460583][T16656] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000004 [ 667.460596][T16656] RBP: 00007ff496e75090 R08: 0000000000000000 R09: 0000000000000000 [ 667.460609][T16656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 667.460622][T16656] R13: 00007ff4961e6038 R14: 00007ff4961e5fa0 R15: 00007ff49630fa28 [ 667.460656][T16656] [ 667.903246][T16659] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3404'. [ 668.067608][T16667] syzkaller0: entered promiscuous mode [ 668.074053][T16667] syzkaller0: entered allmulticast mode [ 668.101911][ T10] IPVS: starting estimator thread 0... [ 668.198422][T16671] IPVS: using max 25 ests per chain, 60000 per kthread [ 668.217539][T16675] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3411'. [ 668.251318][ T5910] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 668.282436][T16675] bridge_slave_1: left allmulticast mode [ 668.282586][ T5903] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 668.288117][T16675] bridge_slave_1: left promiscuous mode [ 668.288517][T16675] bridge0: port 2(bridge_slave_1) entered disabled state [ 668.362037][ T30] audit: type=1326 audit(1763640481.012:725): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16684 comm="syz.3.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f951db8f749 code=0x7ffc0000 [ 668.388212][ T30] audit: type=1326 audit(1763640481.032:726): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16684 comm="syz.3.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f951db8f749 code=0x7ffc0000 [ 668.428474][ T5910] usb 2-1: Using ep0 maxpacket: 16 [ 668.432174][T16687] netlink: 'syz.0.3416': attribute type 1 has an invalid length. [ 668.441493][ T5903] usb 5-1: Using ep0 maxpacket: 16 [ 668.448956][ T5903] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 668.457916][ T5910] usb 2-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 668.460083][ T5903] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 668.477137][ T5910] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 668.509082][ T5903] usb 5-1: New USB device found, idVendor=17ef, idProduct=7309, bcdDevice= 0.00 [ 668.515770][ T30] audit: type=1326 audit(1763640481.062:727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16684 comm="syz.3.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f951db8f749 code=0x7ffc0000 [ 668.519413][ T5903] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.555309][T16687] 8021q: adding VLAN 0 to HW filter on device bond1 [ 668.562107][ T5903] usb 5-1: config 0 descriptor?? [ 668.570888][ T5903] hub 5-1:0.0: USB hub found [ 668.576885][ T30] audit: type=1326 audit(1763640481.062:728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16684 comm="syz.3.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f951db8f749 code=0x7ffc0000 [ 668.584898][ T5910] usb 2-1: Product: syz [ 668.599493][ T30] audit: type=1326 audit(1763640481.062:729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16684 comm="syz.3.3414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f951db8f749 code=0x7ffc0000 [ 668.655455][T16689] bond1: (slave geneve2): making interface the new active one [ 668.664927][ T5910] usb 2-1: Manufacturer: syz [ 668.670037][ T5910] usb 2-1: SerialNumber: syz [ 668.694013][T16689] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 668.694073][ T5910] usb 2-1: config 0 descriptor?? [ 669.081559][T14171] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 669.135517][ T5910] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 669.155794][ T5910] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 669.175618][ T5910] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 669.196112][ T5910] usb 2-1: media controller created [ 669.229301][T14171] usb 4-1: device descriptor read/64, error -71 [ 669.262524][ T5903] hub 5-1:0.0: config failed, can't read hub descriptor (err -22) [ 669.351394][ T5903] usb 5-1: USB disconnect, device number 4 [ 669.445967][ T5910] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 669.480232][T14171] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 669.490493][ T5910] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 669.499039][ T5910] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 669.638653][T14171] usb 4-1: device descriptor read/64, error -71 [ 669.754690][ T5896] usb 2-1: USB disconnect, device number 120 [ 669.768544][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 669.778061][T14171] usb usb4-port1: attempt power cycle [ 669.839416][ T5896] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 670.024213][T16714] xt_CT: You must specify a L4 protocol and not use inversions on it [ 670.129862][ T5903] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 670.195482][T16717] pim6reg: entered allmulticast mode [ 670.206394][T16718] pim6reg: left allmulticast mode [ 670.219295][T14171] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 670.241939][T14171] usb 4-1: device descriptor read/8, error -71 [ 670.278505][ T5903] usb 5-1: Using ep0 maxpacket: 16 [ 670.286359][ T5903] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 670.326794][ T5903] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 670.338387][ T5903] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 670.347190][ T5903] usb 5-1: Product: syz [ 670.382573][ T5903] usb 5-1: Manufacturer: syz [ 670.387220][ T5903] usb 5-1: SerialNumber: syz [ 670.409874][T16722] netlink: 9 bytes leftover after parsing attributes in process `syz.2.3427'. [ 670.427723][ T5903] usb 5-1: config 0 descriptor?? [ 670.480563][T16722] netlink: 9 bytes leftover after parsing attributes in process `syz.2.3427'. [ 670.489857][T14171] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 670.490052][ T5903] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 670.514650][ T5903] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 670.548756][T14171] usb 4-1: device descriptor read/8, error -71 [ 670.668655][T14171] usb usb4-port1: unable to enumerate USB device [ 671.008463][T14171] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 671.149405][ T5903] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 671.362191][T14171] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 671.379688][T14171] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 671.399656][T14171] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.414293][T14171] usb 3-1: Product: syz [ 671.422821][T14171] usb 3-1: Manufacturer: syz [ 671.427455][T14171] usb 3-1: SerialNumber: syz [ 671.455453][T14171] usb 3-1: config 0 descriptor?? [ 671.538657][ T10] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 671.567236][ T5903] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 671.578372][ T5903] em28xx 5-1:0.0: board has no eeprom [ 671.690117][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 671.700099][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 671.711292][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 671.742967][ T10] usb 2-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 671.758837][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 671.802620][ T10] usb 2-1: config 0 descriptor?? [ 671.848556][ T5903] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 671.861755][ T5903] em28xx 5-1:0.0: dvb set to bulk mode. [ 671.904407][ T5917] em28xx 5-1:0.0: Binding DVB extension [ 671.981248][ T5903] usb 5-1: USB disconnect, device number 5 [ 672.016727][ T5903] em28xx 5-1:0.0: Disconnecting em28xx [ 672.045710][ T5917] em28xx 5-1:0.0: Registering input extension [ 672.053813][ T5903] em28xx 5-1:0.0: Closing input extension [ 672.073608][ T5903] em28xx 5-1:0.0: Freeing device [ 672.191766][T16742] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 672.224905][ T10] zydacron 0003:13EC:0006.0027: item fetching failed at offset 0/2 [ 672.233493][ T10] zydacron 0003:13EC:0006.0027: parse failed [ 672.244886][ T10] zydacron 0003:13EC:0006.0027: probe with driver zydacron failed with error -22 [ 672.488538][ T5148] Bluetooth: hci5: command 0x0406 tx timeout [ 672.788751][ T5910] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 672.919182][T16757] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3436'. [ 672.948531][ T5910] usb 5-1: Using ep0 maxpacket: 16 [ 672.961613][ T5910] usb 5-1: config 1 has an invalid descriptor of length 102, skipping remainder of the config [ 672.994099][ T5910] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 673.053290][ T5910] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 673.070527][ T5910] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.087801][ T5910] usb 5-1: Product: syz [ 673.092696][ T5910] usb 5-1: Manufacturer: syz [ 673.097445][ T5910] usb 5-1: SerialNumber: syz [ 673.317211][ T5910] usb 5-1: 0:2 : does not exist [ 673.337380][ T5910] usb 5-1: 5:0: cannot get min/max values for control 4 (id 5) [ 673.371573][ T5910] usb 5-1: 5:0: cannot get min/max values for control 5 (id 5) [ 673.405382][ T5910] usb 5-1: 5:0: cannot get min/max values for control 5 (id 5) [ 673.426630][T16757] xt_CT: No such helper "pptp" [ 673.447394][ T5910] usb 5-1: 5:0: failed to get current value for ch 1 (-22) [ 673.500265][ T5910] usb 5-1: 5:0: cannot get min/max values for control 5 (id 5) [ 673.519471][ T5910] usb 5-1: USB disconnect, device number 6 [ 673.710092][ T5918] usb 3-1: USB disconnect, device number 10 [ 673.793753][T16760] loop9: detected capacity change from 0 to 7 [ 673.811226][ T6414] Dev loop9: unable to read RDB block 7 [ 673.821464][ T6414] loop9: unable to read partition table [ 673.828712][ T6414] loop9: partition table beyond EOD, truncated [ 673.838583][T16760] Dev loop9: unable to read RDB block 7 [ 673.849244][T16760] loop9: unable to read partition table [ 673.855110][T16760] loop9: partition table beyond EOD, truncated [ 673.865296][T16760] loop_reread_partitions: partition scan of loop9 (被x ) failed (rc=-5) [ 674.043410][T16764] netlink: 464 bytes leftover after parsing attributes in process `syz.4.3439'. [ 674.086153][ T10] usb 2-1: USB disconnect, device number 121 [ 674.376824][T16769] Cannot find set identified by id 65534 to match [ 674.405703][T16771] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3442'. [ 674.570552][ T10] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 674.583206][T16777] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 674.740837][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 674.750625][ T10] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 674.760346][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 674.768536][ T5910] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 674.772766][ T10] usb 2-1: New USB device found, idVendor=2040, idProduct=2000, bcdDevice=65.72 [ 674.786899][ T10] usb 2-1: New USB device strings: Mfr=151, Product=0, SerialNumber=0 [ 674.795142][ T10] usb 2-1: Manufacturer: syz [ 674.803025][ T10] usb 2-1: config 0 descriptor?? [ 674.811109][ T10] smsusb:smsusb_probe: board id=9, interface number 0 [ 674.818630][ T10] smsusb:smsusb_probe: Device initialized with return code -19 [ 674.932301][ T5910] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 674.942574][ T5910] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.952060][ T5910] usb 4-1: Product: syz [ 674.956243][ T5910] usb 4-1: Manufacturer: syz [ 674.960934][ T5910] usb 4-1: SerialNumber: syz [ 674.974953][ T5910] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 674.990887][T14171] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 675.043650][ T5910] usb 2-1: USB disconnect, device number 122 [ 675.081822][T16788] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3448'. [ 675.106122][T16788] ip6t_rpfilter: unknown options [ 675.113061][T16788] ip6t_rpfilter: unknown options [ 675.120367][T16788] ip6t_rpfilter: unknown options [ 675.129695][T16788] ip6t_rpfilter: unknown options [ 675.135530][T16788] ip6t_rpfilter: unknown options [ 675.148055][T16788] ip6t_rpfilter: unknown options [ 675.157608][T16788] ip6t_rpfilter: unknown options [ 675.164647][T16788] ip6t_rpfilter: unknown options [ 675.171426][T16788] ip6t_rpfilter: unknown options [ 675.178001][T16788] ip6t_rpfilter: unknown options [ 675.196383][T16779] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 675.220317][T16779] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 675.243989][T16794] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3449'. [ 675.264590][ T10] usb 4-1: USB disconnect, device number 15 [ 675.402561][T16797] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 676.416190][T14171] usb 4-1: Service connection timeout for: 256 [ 676.450347][T14171] ath9k_htc 4-1:1.0: ath9k_htc: Unable to initialize HTC services [ 676.504832][T14171] ath9k_htc: Failed to initialize the device [ 676.605189][ T5918] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 676.714168][ T10] usb 4-1: ath9k_htc: USB layer deinitialized [ 676.969419][ T5918] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 677.378934][ T5918] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 677.424867][ T5918] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.499188][ T5918] usb 5-1: Product: syz [ 677.503410][ T5918] usb 5-1: Manufacturer: syz [ 677.508148][ T5918] usb 5-1: SerialNumber: syz [ 677.515695][ T5918] usb 5-1: config 0 descriptor?? [ 678.223784][T16832] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3461'. [ 678.579992][ T10] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 678.768476][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 678.788079][ T10] usb 2-1: config 9 has an invalid interface number: 150 but max is 2 [ 678.820525][ T10] usb 2-1: config 9 contains an unexpected descriptor of type 0x2, skipping [ 678.875767][ T10] usb 2-1: config 9 has an invalid descriptor of length 0, skipping remainder of the config [ 678.909223][ T10] usb 2-1: config 9 has 1 interface, different from the descriptor's value: 3 [ 678.918481][ T5918] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 678.943299][ T10] usb 2-1: config 9 has no interface number 0 [ 678.959902][ T10] usb 2-1: config 9 interface 150 altsetting 8 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 678.998830][ T10] usb 2-1: config 9 interface 150 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 679.041435][ T10] usb 2-1: config 9 interface 150 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 679.072974][ T10] usb 2-1: config 9 interface 150 altsetting 8 has 6 endpoint descriptors, different from the interface descriptor's value: 13 [ 679.091314][ T5918] usb 3-1: Using ep0 maxpacket: 8 [ 679.105292][ T10] usb 2-1: config 9 interface 150 has no altsetting 0 [ 679.115236][ T10] usb 2-1: New USB device found, idVendor=1199, idProduct=90d2, bcdDevice=86.14 [ 679.125678][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.135702][ T10] usb 2-1: Product: syz [ 679.140476][ T10] usb 2-1: Manufacturer: syz [ 679.145324][ T10] usb 2-1: SerialNumber: syz [ 679.306238][ T5918] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 679.483322][ T5918] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 679.581873][ T10] usb 2-1: USB disconnect, device number 123 [ 680.131638][ T5918] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 680.175991][ T5918] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 680.189933][T16856] netlink: 168 bytes leftover after parsing attributes in process `syz.3.3469'. [ 680.228761][ T5918] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 680.229472][ T60] tipc: Resetting bearer [ 680.248752][ T5918] usb 3-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 680.269175][ T5918] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 680.319073][ T5918] usb 3-1: config 0 descriptor?? [ 680.332481][ T5903] hid-generic 00A0:0006:0003.0028: unknown main item tag 0x3 [ 680.347315][T16859] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3469'. [ 680.374478][ T5903] hid-generic 00A0:0006:0003.0028: unknown main item tag 0x3 [ 680.401608][ T5896] usb 5-1: USB disconnect, device number 7 [ 680.423499][ T5903] hid-generic 00A0:0006:0003.0028: unknown main item tag 0x0 [ 680.442591][ T5903] hid-generic 00A0:0006:0003.0028: unknown main item tag 0x0 [ 680.473178][ T5903] hid-generic 00A0:0006:0003.0028: unknown main item tag 0x0 [ 680.485713][ T5903] hid-generic 00A0:0006:0003.0028: unknown main item tag 0x0 [ 680.498943][T16863] netlink: 456 bytes leftover after parsing attributes in process `syz.4.3472'. [ 680.521434][ T5903] hid-generic 00A0:0006:0003.0028: unknown main item tag 0x0 [ 680.557434][ T5903] hid-generic 00A0:0006:0003.0028: unknown main item tag 0x0 [ 680.593779][ T5903] hid-generic 00A0:0006:0003.0028: unknown main item tag 0x0 [ 680.609902][ T5903] hid-generic 00A0:0006:0003.0028: unknown main item tag 0x0 [ 680.622565][ T5903] hid-generic 00A0:0006:0003.0028: hidraw0: HID v0.05 Device [syz1] on syz0 [ 680.798491][ T5918] usb 2-1: new full-speed USB device number 124 using dummy_hcd [ 680.877682][T16872] netlink: 25 bytes leftover after parsing attributes in process `syz.4.3475'. [ 680.928008][T16872] netlink: 'syz.4.3475': attribute type 4 has an invalid length. [ 680.955467][ T10] usb 3-1: USB disconnect, device number 11 [ 680.977224][ T5918] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 680.993431][T16872] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3475'. [ 681.007002][ T5918] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 681.022762][ T5918] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 681.041487][T16872] binder: 16871:16872 ioctl 4018620d 0 returned -22 [ 681.051146][ T5918] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 681.090151][ T5918] usb 2-1: config 0 descriptor?? [ 681.104382][ T5918] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 681.121819][ T5918] dvb-usb: bulk message failed: -22 (3/0) [ 681.149894][ T5918] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 681.162457][T16874] fuse: Bad value for 'rootmode' [ 681.164994][T16876] fuse: Bad value for 'rootmode' [ 681.177444][ T5918] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 681.199201][ T5918] usb 2-1: media controller created [ 681.207254][ T5918] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 681.243116][ T5918] dvb-usb: bulk message failed: -22 (6/0) [ 681.258560][ T5918] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 681.272004][ T5918] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input69 [ 681.307075][T16865] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 681.328964][ T5918] dvb-usb: schedule remote query interval to 150 msecs. [ 681.343094][T16865] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 681.357641][ T5918] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 681.384700][T16886] syzkaller0: entered promiscuous mode [ 681.390655][T16886] syzkaller0: entered allmulticast mode [ 681.413783][T16886] tipc: Enabled bearer , priority 0 [ 681.424318][T16882] tipc: Resetting bearer [ 681.447791][T16882] tipc: Disabling bearer [ 681.460155][T16887] netlink: 6 bytes leftover after parsing attributes in process `syz.1.3473'. [ 681.471733][T16887] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 681.509943][ T5918] dvb-usb: bulk message failed: -22 (1/0) [ 681.515723][ T5918] dvb-usb: error while querying for an remote control event. [ 681.588512][ T5903] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 681.729342][ T5918] dvb-usb: bulk message failed: -22 (1/0) [ 681.735164][ T5918] dvb-usb: error while querying for an remote control event. [ 681.735631][ T10] usb 2-1: USB disconnect, device number 124 [ 681.776609][ T5903] usb 4-1: config 0 has no interfaces? [ 681.790890][ T5903] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 681.802350][ T5903] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 681.810782][ T5903] usb 4-1: Product: syz [ 681.815882][ T5903] usb 4-1: Manufacturer: syz [ 681.820923][ T5903] usb 4-1: SerialNumber: syz [ 681.829949][ T5903] usb 4-1: config 0 descriptor?? [ 681.871388][ T10] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 681.890469][T16899] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3484'. [ 681.997321][T16902] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 682.028515][ T5918] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 682.133535][ T5910] usb 4-1: USB disconnect, device number 16 [ 682.512000][T16912] bridge0: the hash_elasticity option has been deprecated and is always 16 [ 682.521615][T16912] bridge0: entered allmulticast mode [ 682.596869][ T5918] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 682.878496][ T5910] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 682.886829][ T5918] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 682.897450][ T5918] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 682.913180][ T5918] usb 5-1: Product: syz [ 682.917751][ T5918] usb 5-1: Manufacturer: syz [ 682.924915][ T5918] usb 5-1: SerialNumber: syz [ 682.932642][ T5918] usb 5-1: config 0 descriptor?? [ 682.954615][ T30] audit: type=1800 audit(1763640495.592:730): pid=16933 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3493" name="bus" dev="tmpfs" ino=275 res=0 errno=0 [ 683.090808][ T5910] usb 3-1: New USB device found, idVendor=1934, idProduct=0706, bcdDevice=e2.9e [ 683.126337][T16941] netlink: 388 bytes leftover after parsing attributes in process `syz.0.3499'. [ 683.137065][ T10] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 683.208972][ T5910] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 683.248426][ T5910] usb 3-1: Product: syz [ 683.256716][ T5910] usb 3-1: Manufacturer: syz [ 683.295556][ T5910] usb 3-1: SerialNumber: syz [ 683.300601][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 683.390182][ T5910] usb 3-1: config 0 descriptor?? [ 683.413664][ T5910] f81232 3-1:0.0: f81232 converter detected [ 683.438811][ T5910] usb 3-1: f81232 converter now attached to ttyUSB0 [ 683.439060][ T10] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 683.472085][ T10] usb 2-1: config 1 has no interface number 1 [ 683.492727][ T10] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 683.530887][ T10] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 683.540277][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 683.548275][ T10] usb 2-1: Product: syz [ 683.552523][ T10] usb 2-1: Manufacturer: syz [ 683.557123][ T10] usb 2-1: SerialNumber: syz [ 683.636296][ T5910] usb 3-1: USB disconnect, device number 12 [ 683.672239][ T5910] f81232 ttyUSB0: f81232 converter now disconnected from ttyUSB0 [ 683.727497][ T5910] f81232 3-1:0.0: device disconnected [ 683.792341][ T10] usb 2-1: 2:1 : invalid UAC_AS_GENERAL desc [ 683.824885][ T10] usb 2-1: USB disconnect, device number 125 [ 683.873199][ T6414] udevd[6414]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 684.078388][ T5918] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 684.238425][ T5918] usb 4-1: Using ep0 maxpacket: 8 [ 684.245575][ T5918] usb 4-1: unable to get BOS descriptor or descriptor too short [ 684.254426][ T5918] usb 4-1: too many configurations: 46, using maximum allowed: 8 [ 684.264092][ T5918] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 684.271790][ T5918] usb 4-1: can't read configurations, error -61 [ 684.335427][T16951] binder: 16950:16951 ioctl c0306201 200000000080 returned -14 [ 684.353737][T16951] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3503'. [ 684.408555][ T5918] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 684.458643][ T10] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 684.558483][ T5918] usb 4-1: Using ep0 maxpacket: 8 [ 684.565493][ T5918] usb 4-1: unable to get BOS descriptor or descriptor too short [ 684.574468][ T5918] usb 4-1: too many configurations: 46, using maximum allowed: 8 [ 684.583608][ T5918] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 684.591283][ T5918] usb 4-1: can't read configurations, error -61 [ 684.599026][ T5918] usb usb4-port1: attempt power cycle [ 684.618526][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 684.625288][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 684.635660][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 684.646826][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 684.656567][ T10] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 684.666377][ T5917] usb 2-1: new full-speed USB device number 126 using dummy_hcd [ 684.674202][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 684.689407][ T10] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 684.699542][ T10] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 684.707580][ T10] usb 3-1: Manufacturer: syz [ 684.714316][ T10] usb 3-1: config 0 descriptor?? [ 684.840439][ T5917] usb 2-1: config 0 has an invalid interface number: 120 but max is 0 [ 684.848719][ T5917] usb 2-1: config 0 has no interface number 0 [ 684.854864][ T5917] usb 2-1: config 0 interface 120 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 684.866389][ T5917] usb 2-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 684.875542][ T5917] usb 2-1: New USB device strings: Mfr=32, Product=0, SerialNumber=0 [ 684.883709][ T5917] usb 2-1: Manufacturer: syz [ 684.891055][ T5917] usb 2-1: config 0 descriptor?? [ 684.905263][ T5917] input: syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.120/input/input71 [ 684.938684][ T5918] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 684.972260][ T5918] usb 4-1: Using ep0 maxpacket: 8 [ 684.984298][ T5918] usb 4-1: unable to get BOS descriptor or descriptor too short [ 684.998504][ T5918] usb 4-1: too many configurations: 46, using maximum allowed: 8 [ 685.023535][ T5918] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 685.031749][ T5918] usb 4-1: can't read configurations, error -61 [ 685.060316][ T10] rc_core: IR keymap rc-hauppauge not found [ 685.066451][ T10] Registered IR keymap rc-empty [ 685.071722][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 685.108589][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 685.115873][ T5910] usb 2-1: USB disconnect, device number 126 [ 685.131182][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 685.168532][ T5918] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 685.183677][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input72 [ 685.204102][ T5947] usb 5-1: USB disconnect, device number 8 [ 685.207993][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 685.232537][ T5918] usb 4-1: Using ep0 maxpacket: 8 [ 685.243665][ T5918] usb 4-1: unable to get BOS descriptor or descriptor too short [ 685.258455][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 685.263906][ T5918] usb 4-1: too many configurations: 46, using maximum allowed: 8 [ 685.297860][ T5918] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 685.308539][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 685.324498][ T5918] usb 4-1: can't read configurations, error -61 [ 685.334503][ T5918] usb usb4-port1: unable to enumerate USB device [ 685.348601][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 685.381546][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 685.418480][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 685.451263][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 685.478551][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 685.513466][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 685.538457][ T10] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 685.560637][ T10] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 685.570743][ T10] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 685.588748][ T10] usb 3-1: USB disconnect, device number 13 [ 685.714801][T16964] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3507'. [ 685.727500][T16964] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3507'. [ 685.776247][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.782804][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.940034][T16966] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3508'. [ 686.459501][T16973] team0: Device ipip0 is of different type [ 686.591500][T16983] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3513'. [ 686.653058][T16984] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3512'. [ 686.712745][T16984] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3512'. [ 686.794563][T16984] batadv0: entered promiscuous mode [ 686.827355][T16986] loop7: detected capacity change from 0 to 7 [ 686.858248][T16984] bond0: entered promiscuous mode [ 686.890387][T16984] bond_slave_0: entered promiscuous mode [ 686.897606][T16986] Dev loop7: unable to read RDB block 7 [ 686.933889][T16984] bond_slave_1: entered promiscuous mode [ 686.940848][T16986] loop7: AHDI p1 p2 [ 686.962360][T16986] loop7: partition table partially beyond EOD, truncated [ 686.972045][T16984] dummy0: entered promiscuous mode [ 686.995666][T16984] debugfs: 'hsr1' already exists in 'hsr' [ 686.998998][T16986] loop7: p1 start 1702000233 is beyond EOD, [ 687.010083][T16992] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 687.013671][T16986] truncated [ 687.029653][T16984] Cannot create hsr debugfs directory [ 687.044697][T16984] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 687.568605][ T5918] usb 2-1: new full-speed USB device number 127 using dummy_hcd [ 687.669785][T17009] program syz.3.3521 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 687.730694][T17009] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3521'. [ 687.836477][ T5918] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 687.855051][ T5918] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 687.895300][ T5918] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 688.029420][ T5918] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 688.043179][ T5918] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 688.061712][ T5918] usb 2-1: Product: syz [ 688.070367][ T5918] usb 2-1: Manufacturer: syz [ 688.085598][ T5918] usb 2-1: SerialNumber: syz [ 688.107740][ T5918] usb 2-1: config 0 descriptor?? [ 688.121500][T17000] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 688.137252][ T5918] usb 2-1: ucan: probing device on interface #0 [ 688.151455][ T5918] usb 2-1: ucan: invalid in_ep MaxPacketSize [ 688.167308][ T5918] usb 2-1: ucan: probe failed; try to update the device firmware [ 688.392162][T17000] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 688.393393][T17000] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 688.394772][ T5918] usb 2-1: USB disconnect, device number 127 [ 688.988621][T17031] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3527'. [ 689.092086][T17037] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 689.120320][T17031] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3527'. [ 689.136485][T17031] 8021q: adding VLAN 0 to HW filter on device bond1 [ 691.651995][ T5947] IPVS: starting estimator thread 0... [ 691.798553][T17105] IPVS: using max 32 ests per chain, 76800 per kthread [ 691.902711][T17109] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 691.934675][T17109] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 692.261911][T17131] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3556'. [ 692.271457][T17132] netlink: 9 bytes leftover after parsing attributes in process `syz.3.3557'. [ 692.287462][T17131] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3556'. [ 692.307438][T17132] netlink: 9 bytes leftover after parsing attributes in process `syz.3.3557'. [ 692.541668][T17142] syzkaller0: entered promiscuous mode [ 692.554305][T17142] syzkaller0: entered allmulticast mode [ 692.739203][ T10] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 692.918933][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 692.928603][ T10] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 692.947661][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 692.959025][T17150] netlink: 264 bytes leftover after parsing attributes in process `syz.0.3564'. [ 692.995191][ T10] usb 3-1: Product: syz [ 693.010772][ T10] usb 3-1: Manufacturer: syz [ 693.019195][ T10] usb 3-1: SerialNumber: syz [ 693.041585][ T10] r8152-cfgselector 3-1: Unknown version 0x0000 [ 693.057577][ T10] r8152-cfgselector 3-1: config 0 descriptor?? [ 693.123963][T17151] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 693.156666][T17151] bond2 (unregistering): Released all slaves [ 693.351079][T17138] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 693.388858][T17138] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 693.465020][ T10] r8152-cfgselector 3-1: Unknown version 0x0000 [ 693.539829][ T10] r8152-cfgselector 3-1: bad CDC descriptors [ 693.569059][ T5947] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 693.609773][ T10] r8152-cfgselector 3-1: USB disconnect, device number 14 [ 693.638693][ T5896] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 693.655300][T17167] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 693.749947][ T5947] usb 5-1: Using ep0 maxpacket: 16 [ 693.790085][ T5947] usb 5-1: config 252 has an invalid interface number: 17 but max is 0 [ 693.818228][ T5896] usb 4-1: config 0 has no interfaces? [ 693.825554][ T5947] usb 5-1: config 252 has an invalid descriptor of length 18, skipping remainder of the config [ 693.871972][ T5896] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 693.872224][ T5947] usb 5-1: config 252 has no interface number 0 [ 693.881509][ T5896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 693.895640][ T5896] usb 4-1: Product: syz [ 693.899962][ T5896] usb 4-1: Manufacturer: syz [ 693.904691][ T5896] usb 4-1: SerialNumber: syz [ 693.935828][ T5896] usb 4-1: config 0 descriptor?? [ 693.963169][ T5947] usb 5-1: New USB device found, idVendor=16d6, idProduct=0001, bcdDevice=ee.bb [ 694.020059][ T5947] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 694.028093][ T5947] usb 5-1: Product: syz [ 694.063855][ T5947] usb 5-1: Manufacturer: syz [ 694.072483][ T5947] usb 5-1: SerialNumber: syz [ 694.103854][ T5947] cp210x 5-1:252.17: cp210x converter detected [ 694.198099][T17179] tipc: Started in network mode [ 694.216404][T17179] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 694.255201][T17179] tipc: Enabled bearer , priority 0 [ 694.302964][ T5947] cp210x 5-1:252.17: failed to get vendor val 0x370b size 1: -71 [ 694.321387][ T5947] cp210x 5-1:252.17: querying part number failed [ 694.335435][ T5947] usb 5-1: cp210x converter now attached to ttyUSB0 [ 694.366143][ T5947] usb 5-1: USB disconnect, device number 9 [ 694.394160][ T5947] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 694.414089][ T5947] cp210x 5-1:252.17: device disconnected [ 695.258561][T15495] tipc: Node number set to 11578026 [ 695.648423][ T5896] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 695.831854][ T5896] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 695.908410][ T5896] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 695.935300][ T5896] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 695.973977][ T5896] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 696.058762][ T5896] usb 5-1: config 0 descriptor?? [ 696.089131][ T5947] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 696.091618][ T5896] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 696.147846][ T5896] dvb-usb: bulk message failed: -22 (3/0) [ 696.183137][ T5896] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 696.259972][ T10] usb 4-1: USB disconnect, device number 21 [ 696.281821][ T5896] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 696.283068][ T5947] usb 3-1: config 2 has an invalid interface number: 174 but max is 0 [ 696.310149][ T5896] usb 5-1: media controller created [ 696.325508][ T5896] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 696.342376][ T5947] usb 3-1: config 2 has no interface number 0 [ 696.361138][ T5947] usb 3-1: config 2 interface 174 altsetting 0 has an endpoint descriptor with address 0x9E, changing to 0x8E [ 696.388904][ T5896] dvb-usb: bulk message failed: -22 (6/0) [ 696.394468][ T5947] usb 3-1: config 2 interface 174 altsetting 0 endpoint 0x8E has invalid maxpacket 1023, setting to 64 [ 696.418710][ T5896] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 696.427465][T17207] netlink: 6 bytes leftover after parsing attributes in process `syz.4.3577'. [ 696.436638][ T5947] usb 3-1: config 2 interface 174 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 696.459371][ T5896] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input74 [ 696.482016][ T5947] usb 3-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=22.7e [ 696.492626][T17207] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 696.526795][ T5947] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 696.539133][ T5896] dvb-usb: schedule remote query interval to 150 msecs. [ 696.558231][ T5896] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 696.609682][ T5947] usb 3-1: Product: syz [ 696.613886][ T5947] usb 3-1: Manufacturer: syz [ 696.627887][ T5947] usb 3-1: SerialNumber: syz [ 696.666502][T17199] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 696.723147][ T5917] dvb-usb: bulk message failed: -22 (1/0) [ 696.742150][ T5917] dvb-usb: error while querying for an remote control event. [ 696.938176][ T5918] usb 5-1: USB disconnect, device number 10 [ 697.112340][ T5918] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 697.513576][ T5947] usb 3-1: probing VID:PID(0424:012C) [ 697.553479][ T5947] usb 3-1: vub300 testing BULK IN EndPoint(0) 8E [ 697.580469][ T5947] usb 3-1: vub300 testing BULK IN EndPoint(1) 82 [ 697.619229][ T5947] usb 3-1: Could not find two sets of bulk-in/out endpoint pairs [ 697.627070][ T5947] vub300 3-1:2.174: probe with driver vub300 failed with error -22 [ 697.711174][ T5947] usb 3-1: USB disconnect, device number 15 [ 698.480961][T17243] xt_NFQUEUE: number of total queues is 0 [ 698.749778][T17250] netlink: 'syz.4.3594': attribute type 2 has an invalid length. [ 698.751119][T17251] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3594'. [ 698.853231][T17250] : entered promiscuous mode [ 698.866891][T17250] netlink: 'syz.4.3594': attribute type 2 has an invalid length. [ 698.913039][T17250] netlink: 'syz.4.3594': attribute type 2 has an invalid length. [ 698.928559][T17251] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3594'. [ 698.957148][T17250] netlink: 'syz.4.3594': attribute type 2 has an invalid length. [ 699.002896][T17251] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3594'. [ 699.040743][T17250] netlink: 'syz.4.3594': attribute type 2 has an invalid length. [ 699.092885][T17251] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3594'. [ 699.135368][T17250] netlink: 'syz.4.3594': attribute type 2 has an invalid length. [ 699.176194][T17251] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3594'. [ 699.195325][T17250] netlink: 'syz.4.3594': attribute type 2 has an invalid length. [ 699.237059][T17251] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3594'. [ 699.267749][T17250] netlink: 'syz.4.3594': attribute type 2 has an invalid length. [ 699.278663][T17251] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3594'. [ 699.291287][T17250] netlink: 'syz.4.3594': attribute type 2 has an invalid length. [ 699.334327][T17251] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3594'. [ 699.350056][T17250] netlink: 'syz.4.3594': attribute type 2 has an invalid length. [ 699.378539][T17251] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3594'. [ 699.420119][T17251] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3594'. [ 699.451889][T17263] IPv6: addrconf: prefix option has invalid lifetime [ 699.656379][T17267] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 699.667171][ T10] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 699.868675][ T10] usb 4-1: device descriptor read/64, error -71 [ 700.279226][ T10] usb 4-1: new full-speed USB device number 23 using dummy_hcd [ 700.428515][ T10] usb 4-1: device descriptor read/64, error -71 [ 700.558692][ T10] usb usb4-port1: attempt power cycle [ 700.894041][T17296] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 701.288483][ T10] usb 4-1: new full-speed USB device number 24 using dummy_hcd [ 701.484649][T17300] FAULT_INJECTION: forcing a failure. [ 701.484649][T17300] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 701.518684][ T10] usb 4-1: device descriptor read/8, error -71 [ 701.561882][T17300] CPU: 1 UID: 0 PID: 17300 Comm: syz.0.3610 Not tainted syzkaller #0 PREEMPT(full) [ 701.561899][T17300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 701.561907][T17300] Call Trace: [ 701.561912][T17300] [ 701.561917][T17300] dump_stack_lvl+0x189/0x250 [ 701.561937][T17300] ? __pfx____ratelimit+0x10/0x10 [ 701.561952][T17300] ? __pfx_dump_stack_lvl+0x10/0x10 [ 701.561966][T17300] ? __pfx__printk+0x10/0x10 [ 701.561977][T17300] ? __might_fault+0xb0/0x130 [ 701.561998][T17300] should_fail_ex+0x414/0x560 [ 701.562017][T17300] _copy_from_iter+0x1de/0x1790 [ 701.562033][T17300] ? rcu_is_watching+0x15/0xb0 [ 701.562049][T17300] ? kmalloc_reserve+0xbd/0x290 [ 701.562060][T17300] ? __pfx__copy_from_iter+0x10/0x10 [ 701.562073][T17300] ? __build_skb_around+0x262/0x3f0 [ 701.562085][T17300] ? netlink_sendmsg+0x642/0xb30 [ 701.562095][T17300] ? skb_put+0x11b/0x210 [ 701.562107][T17300] netlink_sendmsg+0x6b2/0xb30 [ 701.562122][T17300] ? __pfx_netlink_sendmsg+0x10/0x10 [ 701.562135][T17300] ? aa_sock_msg_perm+0xf1/0x1d0 [ 701.562151][T17300] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 701.562162][T17300] ? __pfx_netlink_sendmsg+0x10/0x10 [ 701.562173][T17300] __sock_sendmsg+0x21c/0x270 [ 701.562188][T17300] ____sys_sendmsg+0x505/0x830 [ 701.562206][T17300] ? __pfx_____sys_sendmsg+0x10/0x10 [ 701.562222][T17300] ? import_iovec+0x74/0xa0 [ 701.562237][T17300] ___sys_sendmsg+0x21f/0x2a0 [ 701.562250][T17300] ? __pfx____sys_sendmsg+0x10/0x10 [ 701.562279][T17300] ? __fget_files+0x2a/0x420 [ 701.562289][T17300] ? __fget_files+0x3a0/0x420 [ 701.562309][T17300] __x64_sys_sendmsg+0x19b/0x260 [ 701.562322][T17300] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 701.562339][T17300] ? __pfx_ksys_write+0x10/0x10 [ 701.562356][T17300] ? do_syscall_64+0xbe/0xfa0 [ 701.562373][T17300] do_syscall_64+0xfa/0xfa0 [ 701.562386][T17300] ? lockdep_hardirqs_on+0x9c/0x150 [ 701.562401][T17300] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.562411][T17300] ? clear_bhb_loop+0x60/0xb0 [ 701.562424][T17300] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.562434][T17300] RIP: 0033:0x7fe4b918f749 [ 701.562445][T17300] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 701.562455][T17300] RSP: 002b:00007fe4b9fe2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 701.562468][T17300] RAX: ffffffffffffffda RBX: 00007fe4b93e5fa0 RCX: 00007fe4b918f749 [ 701.562476][T17300] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 701.562483][T17300] RBP: 00007fe4b9fe2090 R08: 0000000000000000 R09: 0000000000000000 [ 701.562490][T17300] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 701.562497][T17300] R13: 00007fe4b93e6038 R14: 00007fe4b93e5fa0 R15: 00007fe4b950fa28 [ 701.562514][T17300] [ 702.338615][ T10] usb 4-1: new full-speed USB device number 25 using dummy_hcd [ 702.646993][ T10] usb 4-1: device descriptor read/8, error -71 [ 702.828836][ T10] usb usb4-port1: unable to enumerate USB device [ 703.048515][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 703.648429][ T5896] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 703.772514][T17351] program syz.1.3628 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 703.832344][ T5896] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 703.842983][T17351] __nla_validate_parse: 59 callbacks suppressed [ 703.843001][T17351] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3628'. [ 703.861946][T17353] veth1_to_hsr: entered promiscuous mode [ 703.867628][T17353] macvlan2: entered promiscuous mode [ 703.895502][ T5896] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 703.933755][ T5896] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 703.978335][ T5896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 704.040205][T17357] netlink: 9 bytes leftover after parsing attributes in process `syz.4.3631'. [ 704.096733][ T5896] usb 3-1: config 0 descriptor?? [ 704.102905][T17357] netlink: 9 bytes leftover after parsing attributes in process `syz.4.3631'. [ 704.135229][ T5896] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 704.177444][ T5896] dvb-usb: bulk message failed: -22 (3/0) [ 704.205424][ T5896] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 704.248455][ T5896] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 704.299272][T17359] xt_CT: No such helper "snmp_trap" [ 704.335559][ T5896] usb 3-1: media controller created [ 704.397571][T17336] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 704.421625][ T5896] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 704.431028][T17336] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 704.540873][ T5896] dvb-usb: bulk message failed: -22 (6/0) [ 704.570635][ T5896] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 704.612849][T17368] netlink: 6 bytes leftover after parsing attributes in process `syz.2.3624'. [ 704.641018][ T5896] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input76 [ 704.742039][T17368] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 704.778055][ T5896] dvb-usb: schedule remote query interval to 150 msecs. [ 704.805635][ T5896] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 704.959532][ T5896] dvb-usb: bulk message failed: -22 (1/0) [ 705.152796][ T5896] dvb-usb: error while querying for an remote control event. [ 705.194669][ T5918] usb 3-1: USB disconnect, device number 16 [ 705.278123][ T5918] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 705.859053][ T5917] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 705.958063][T17403] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3645'. [ 705.969061][T17403] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3645'. [ 706.096830][ T5917] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 706.149926][ T5917] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 706.159430][ T5917] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 706.169454][ T5917] usb 5-1: Product: syz [ 706.183456][ T5917] usb 5-1: Manufacturer: syz [ 706.198104][ T5917] usb 5-1: SerialNumber: syz [ 706.220839][ T5917] usb 5-1: config 0 descriptor?? [ 706.319072][ T5918] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 706.492099][T17413] loop2: detected capacity change from 0 to 7 [ 706.529071][T17413] loop2: p1 p4 [ 706.533812][T17413] loop2: partition table partially beyond EOD, truncated [ 706.550101][ T5918] usb 3-1: Using ep0 maxpacket: 32 [ 706.589085][T17413] loop2: p1 size 17068895 extends beyond EOD, truncated [ 706.618999][ T5918] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 706.639824][ T5918] usb 3-1: config 0 has no interface number 0 [ 706.709437][T17413] loop2: p4 start 2495 is beyond EOD, truncated [ 706.717793][ T5918] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 706.834291][ T5824] udevd[5824]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 706.918122][ T5918] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 707.026706][ T5918] usb 3-1: Product: syz [ 707.077276][ T5918] usb 3-1: Manufacturer: syz [ 707.130752][ T5918] usb 3-1: SerialNumber: syz [ 707.249294][ T5918] usb 3-1: config 0 descriptor?? [ 707.258765][ T5918] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 707.471446][ T5918] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 707.622568][ T5918] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 707.660625][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 7 [ 707.875407][T17405] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3646'. [ 707.919546][T17405] validate_nla: 41 callbacks suppressed [ 707.919560][T17405] netlink: 'syz.2.3646': attribute type 10 has an invalid length. [ 707.983235][T17405] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 708.329547][ T5148] Bluetooth: hci2: command 0x0406 tx timeout [ 708.469954][T17430] loop8: detected capacity change from 0 to 8 [ 708.567748][ T6414] Dev loop8: unable to read RDB block 8 [ 708.587057][ T6414] loop8: unable to read partition table [ 708.603941][ T6414] loop8: partition table beyond EOD, truncated [ 708.618643][T17430] Dev loop8: unable to read RDB block 8 [ 708.628734][T17430] loop8: unable to read partition table [ 708.636638][T17430] loop8: partition table beyond EOD, truncated [ 708.647068][T17430] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 708.734377][T17432] loop2: detected capacity change from 0 to 7 [ 708.807598][T17434] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3655'. [ 708.838396][T17432] Dev loop2: unable to read RDB block 7 [ 708.851297][T17432] loop2: unable to read partition table [ 708.895752][T17434] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 708.926522][T17432] loop2: partition table beyond EOD, truncated [ 708.965182][T17432] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 709.137535][ C1] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 709.138043][ T5896] usb 3-1: USB disconnect, device number 17 [ 709.206512][ T5896] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 709.262364][ T5896] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 709.282073][ T5896] quatech2 3-1:0.51: device disconnected [ 709.676199][ T5918] usb 5-1: USB disconnect, device number 11 [ 709.711493][T17445] netlink: 'syz.3.3660': attribute type 10 has an invalid length. [ 709.744935][T17447] netlink: 'syz.2.3661': attribute type 5 has an invalid length. [ 709.762881][T17445] team0: Port device netdevsim0 added [ 710.188829][T17458] qrtr: Invalid version 36 [ 710.296724][T17461] loop9: detected capacity change from 0 to 7 [ 710.323125][T17461] Dev loop9: unable to read RDB block 7 [ 710.330945][T17461] loop9: unable to read partition table [ 710.354147][T17461] loop9: partition table beyond EOD, truncated [ 710.364846][T17461] loop_reread_partitions: partition scan of loop9 (被x ) failed (rc=-5) [ 711.262525][ T30] audit: type=1326 audit(1763640523.902:731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17486 comm="syz.2.3675" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd94318f749 code=0x7ffc0000 [ 711.348440][ T30] audit: type=1326 audit(1763640523.942:732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17486 comm="syz.2.3675" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd94318f749 code=0x7ffc0000 [ 711.417706][ T30] audit: type=1326 audit(1763640523.982:733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17486 comm="syz.2.3675" exe="/root/syz-executor" sig=0 arch=c000003e syscall=190 compat=0 ip=0x7fd94318f749 code=0x7ffc0000 [ 711.503279][ T30] audit: type=1326 audit(1763640523.982:734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17486 comm="syz.2.3675" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd94318f749 code=0x7ffc0000 [ 711.533818][T17485] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3673'. [ 711.596338][ T30] audit: type=1326 audit(1763640523.982:735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17486 comm="syz.2.3675" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd94318f749 code=0x7ffc0000 [ 711.652312][T17497] qrtr: Invalid version 36 [ 711.656942][ T30] audit: type=1326 audit(1763640523.982:736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17486 comm="syz.2.3675" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7fd94318f749 code=0x7ffc0000 [ 711.769113][ T30] audit: type=1326 audit(1763640523.982:737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17486 comm="syz.2.3675" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd94318f749 code=0x7ffc0000 [ 711.859228][ T30] audit: type=1326 audit(1763640523.982:738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17486 comm="syz.2.3675" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd94318f749 code=0x7ffc0000 [ 711.881971][ T30] audit: type=1326 audit(1763640523.982:739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17486 comm="syz.2.3675" exe="/root/syz-executor" sig=0 arch=c000003e syscall=25 compat=0 ip=0x7fd94318f749 code=0x7ffc0000 [ 711.921591][T17500] xt_CT: You must specify a L4 protocol and not use inversions on it [ 711.935055][ T30] audit: type=1326 audit(1763640523.982:740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17486 comm="syz.2.3675" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd94318f749 code=0x7ffc0000 [ 711.957480][ C1] vkms_vblank_simulate: vblank timer overrun [ 711.998048][T17502] binder_alloc: 17498: binder_alloc_buf size 65520 failed, no address space [ 712.020954][T17502] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 8192 (num: 1 largest: 8192) [ 712.104406][T17504] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3679'. [ 712.993689][T17531] FAULT_INJECTION: forcing a failure. [ 712.993689][T17531] name failslab, interval 1, probability 0, space 0, times 0 [ 713.054726][T17531] CPU: 0 UID: 0 PID: 17531 Comm: syz.1.3690 Not tainted syzkaller #0 PREEMPT(full) [ 713.054754][T17531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 713.054767][T17531] Call Trace: [ 713.054775][T17531] [ 713.054785][T17531] dump_stack_lvl+0x189/0x250 [ 713.054817][T17531] ? __pfx____ratelimit+0x10/0x10 [ 713.054846][T17531] ? __pfx_dump_stack_lvl+0x10/0x10 [ 713.054872][T17531] ? __pfx__printk+0x10/0x10 [ 713.054899][T17531] ? __pfx___might_resched+0x10/0x10 [ 713.054925][T17531] should_fail_ex+0x414/0x560 [ 713.054961][T17531] should_failslab+0xa8/0x100 [ 713.054984][T17531] __kmalloc_node_noprof+0xd2/0x800 [ 713.055015][T17531] ? alloc_slab_obj_exts+0x3e/0x100 [ 713.055046][T17531] alloc_slab_obj_exts+0x3e/0x100 [ 713.055073][T17531] __memcg_slab_post_alloc_hook+0x31d/0x7d0 [ 713.055119][T17531] kmem_cache_alloc_node_noprof+0x4e4/0x710 [ 713.055147][T17531] ? __alloc_skb+0x112/0x2d0 [ 713.055172][T17531] __alloc_skb+0x112/0x2d0 [ 713.055194][T17531] alloc_skb_with_frags+0xca/0x890 [ 713.055221][T17531] ? process_measurement+0x72d/0x1a40 [ 713.055250][T17531] sock_alloc_send_pskb+0x84d/0x980 [ 713.055294][T17531] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 713.055327][T17531] ? __pfx_process_measurement+0x10/0x10 [ 713.055348][T17531] ? tomoyo_check_open_permission+0x16a/0x3b0 [ 713.055374][T17531] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 713.055405][T17531] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 713.055438][T17531] unix_dgram_sendmsg+0x461/0x1850 [ 713.055471][T17531] ? __lock_acquire+0xab9/0xd20 [ 713.055509][T17531] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 713.055535][T17531] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 713.055575][T17531] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 713.055602][T17531] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 713.055631][T17531] __sock_sendmsg+0x21c/0x270 [ 713.055660][T17531] ____sys_sendmsg+0x52d/0x830 [ 713.055687][T17531] ? __pfx_____sys_sendmsg+0x10/0x10 [ 713.055717][T17531] ? import_iovec+0x74/0xa0 [ 713.055745][T17531] ___sys_sendmsg+0x21f/0x2a0 [ 713.055770][T17531] ? __pfx____sys_sendmsg+0x10/0x10 [ 713.055829][T17531] ? __fget_files+0x2a/0x420 [ 713.055847][T17531] ? __fget_files+0x3a0/0x420 [ 713.055877][T17531] __sys_sendmmsg+0x227/0x430 [ 713.055905][T17531] ? __pfx___sys_sendmmsg+0x10/0x10 [ 713.055937][T17531] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 713.055985][T17531] ? ksys_write+0x22a/0x250 [ 713.056015][T17531] ? __pfx_ksys_write+0x10/0x10 [ 713.056048][T17531] __x64_sys_sendmmsg+0xa0/0xc0 [ 713.056073][T17531] do_syscall_64+0xfa/0xfa0 [ 713.056101][T17531] ? lockdep_hardirqs_on+0x9c/0x150 [ 713.056129][T17531] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 713.056149][T17531] ? clear_bhb_loop+0x60/0xb0 [ 713.056173][T17531] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 713.056192][T17531] RIP: 0033:0x7ff495f8f749 [ 713.056209][T17531] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 713.056227][T17531] RSP: 002b:00007ff496e75038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 713.056249][T17531] RAX: ffffffffffffffda RBX: 00007ff4961e5fa0 RCX: 00007ff495f8f749 [ 713.056263][T17531] RDX: 0000000000000001 RSI: 0000200000002c40 RDI: 0000000000000003 [ 713.056277][T17531] RBP: 00007ff496e75090 R08: 0000000000000000 R09: 0000000000000000 [ 713.056289][T17531] R10: 0000000000000010 R11: 0000000000000246 R12: 0000000000000001 [ 713.056302][T17531] R13: 00007ff4961e6038 R14: 00007ff4961e5fa0 R15: 00007ff49630fa28 [ 713.056335][T17531] [ 714.177426][T17540] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3692'. [ 714.587769][T17547] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3692'. [ 714.759568][T17545] IPVS: set_ctl: invalid protocol: 58 127.0.0.1:20003 [ 715.947822][T17565] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 715.961005][T17565] syzkaller1: linktype set to 32 [ 715.962047][T17572] netlink: 156 bytes leftover after parsing attributes in process `syz.1.3704'. [ 716.091110][T17574] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3702'. [ 716.374357][ T5917] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 716.549988][ T5917] usb 4-1: Using ep0 maxpacket: 8 [ 716.588404][ T5918] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 716.611209][ T5917] usb 4-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 716.627476][ T5917] usb 4-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 716.653482][ T5917] usb 4-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 716.711569][ T5917] usb 4-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 716.747016][ T5917] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 716.960612][ T5918] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 716.986450][ T5918] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 717.040013][ T5918] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 64 [ 717.113571][ T5918] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 717.205430][ T5918] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 717.235042][ T5918] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 717.320788][ T5918] usb 5-1: Manufacturer: syz [ 717.459533][ T5918] usb 5-1: config 0 descriptor?? [ 718.098818][ T5918] rc_core: IR keymap rc-hauppauge not found [ 718.121881][ T5918] Registered IR keymap rc-empty [ 718.158068][ T5918] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 718.208245][ T5918] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 718.249694][ T5918] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 718.309555][ T5918] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input80 [ 718.355728][T17608] netlink: 'syz.4.3715': attribute type 3 has an invalid length. [ 718.565768][ T5918] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 718.576746][T14405] Bluetooth: hci4: command 0x0406 tx timeout [ 718.623879][ T5918] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 718.640275][ T5896] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 718.672364][ T5918] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 718.784403][ T5918] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 718.834769][ T5918] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 718.837340][ T5896] usb 2-1: unable to get BOS descriptor or descriptor too short [ 718.870927][ T5918] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 718.902051][ T5896] usb 2-1: not running at top speed; connect to a high speed hub [ 718.938746][ T5918] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 718.967726][ T5896] usb 2-1: config 9 has an invalid interface number: 1 but max is 0 [ 718.978947][ T5918] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 718.993231][ T5896] usb 2-1: config 9 has no interface number 0 [ 719.020599][ T5896] usb 2-1: config 9 interface 1 has no altsetting 0 [ 719.038720][ T5896] usb 2-1: New USB device found, idVendor=19d2, idProduct=0025, bcdDevice=ac.91 [ 719.081472][ T5918] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 719.112398][ T5918] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 719.129942][T17618] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3720'. [ 719.180204][ T5918] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 719.199239][ T5918] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 719.230569][ T5896] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 719.251002][ T5918] usb 5-1: USB disconnect, device number 12 [ 719.314289][ T5896] usb 2-1: Product: syz [ 719.382585][ T5896] usb 2-1: Manufacturer: syz [ 719.507327][ T5896] usb 2-1: SerialNumber: syz [ 719.900369][ T5917] usb 4-1: string descriptor 0 read error: -71 [ 719.934477][T17635] netlink: 264 bytes leftover after parsing attributes in process `syz.2.3725'. [ 719.984496][ T5917] usb 4-1: USB disconnect, device number 26 [ 720.082254][ T6414] udevd[6414]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:32.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 720.088421][T17638] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 720.120143][ T5896] qmi_wwan 2-1:9.1: bogus CDC Union: master=0, slave=1 [ 720.156211][ T5896] qmi_wwan 2-1:9.1: probe with driver qmi_wwan failed with error -22 [ 720.224740][T17639] x_tables: unsorted entry at hook 3 [ 720.234672][ T5896] usb 2-1: USB disconnect, device number 2 [ 720.475421][T17644] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3729'. [ 720.485549][T17644] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3729'. [ 721.136638][T17670] syzkaller0: entered promiscuous mode [ 721.143421][T17670] syzkaller0: entered allmulticast mode [ 721.311909][T17679] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3739'. [ 721.321218][T17679] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3739'. [ 721.385118][T17679] dummy0: entered promiscuous mode [ 721.395661][T17679] dummy0: left promiscuous mode [ 721.403501][T17683] netlink: 'syz.3.3740': attribute type 10 has an invalid length. [ 721.425755][T17683] bond0: (slave dummy0): Releasing backup interface [ 721.437592][T17683] team0: Port device dummy0 added [ 721.457395][T17683] netlink: 'syz.3.3740': attribute type 10 has an invalid length. [ 721.491095][T17683] team0: Port device dummy0 removed [ 721.502314][T17683] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 721.630945][ T10] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 721.818456][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 721.840424][ T10] usb 5-1: config 3 has an invalid interface number: 156 but max is 0 [ 721.858394][ T10] usb 5-1: config 3 has no interface number 0 [ 721.874805][ T10] usb 5-1: config 3 interface 156 has no altsetting 0 [ 721.906647][ T10] usb 5-1: New USB device found, idVendor=05e3, idProduct=0502, bcdDevice=f1.d8 [ 721.937808][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 721.958064][ T10] usb 5-1: Product: syz [ 721.967801][ T10] usb 5-1: Manufacturer: syz [ 721.975120][ T10] usb 5-1: SerialNumber: syz [ 722.106464][T17698] syzkaller0: entered promiscuous mode [ 722.112228][T17698] syzkaller0: entered allmulticast mode [ 722.157221][T17698] tipc: Enabled bearer , priority 0 [ 722.170493][ T5896] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 722.199079][T17682] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 722.211346][T17682] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 722.227274][ T10] gl620a 5-1:3.156: probe with driver gl620a failed with error -22 [ 722.228536][T17697] tipc: Resetting bearer [ 722.250647][ T10] usb 5-1: USB disconnect, device number 13 [ 722.327851][T17697] tipc: Disabling bearer [ 722.371754][ T5896] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 722.383405][ T5896] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 722.395657][ T5896] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 722.405666][ T5896] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 722.418562][ T5896] usb 2-1: Manufacturer: syz [ 722.434078][ T5896] usb 2-1: config 0 descriptor?? [ 722.613194][ T5896] rc_core: IR keymap rc-hauppauge not found [ 722.636247][ T5896] Registered IR keymap rc-empty [ 722.665165][ T5896] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 722.753052][ T5896] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input81 [ 722.872794][T17693] netlink: 'syz.1.3744': attribute type 29 has an invalid length. [ 723.219464][ T10] usb 2-1: USB disconnect, device number 3 [ 723.228968][T17727] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3752'. [ 723.271457][T17727] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 723.432101][T17731] loop8: detected capacity change from 0 to 8 [ 723.449200][T17731] Dev loop8: unable to read RDB block 8 [ 723.462657][T17731] loop8: unable to read partition table [ 723.478648][T17731] loop8: partition table beyond EOD, truncated [ 723.488410][T17731] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 723.574430][T17733] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3754'. [ 723.714699][T17735] FAULT_INJECTION: forcing a failure. [ 723.714699][T17735] name failslab, interval 1, probability 0, space 0, times 0 [ 723.767503][T17735] CPU: 0 UID: 0 PID: 17735 Comm: syz.2.3756 Not tainted syzkaller #0 PREEMPT(full) [ 723.767530][T17735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 723.767541][T17735] Call Trace: [ 723.767550][T17735] [ 723.767558][T17735] dump_stack_lvl+0x189/0x250 [ 723.767588][T17735] ? __pfx____ratelimit+0x10/0x10 [ 723.767614][T17735] ? __pfx_dump_stack_lvl+0x10/0x10 [ 723.767638][T17735] ? __pfx__printk+0x10/0x10 [ 723.767659][T17735] ? __pfx___might_resched+0x10/0x10 [ 723.767681][T17735] ? fs_reclaim_acquire+0x7d/0x100 [ 723.767716][T17735] should_fail_ex+0x414/0x560 [ 723.767751][T17735] should_failslab+0xa8/0x100 [ 723.767772][T17735] __kmalloc_cache_noprof+0x6f/0x6f0 [ 723.767801][T17735] ? rtnl_newlink+0xfb/0x1c80 [ 723.767830][T17735] ? kasan_save_track+0x4f/0x80 [ 723.767861][T17735] rtnl_newlink+0xfb/0x1c80 [ 723.767888][T17735] ? netlink_deliver_tap+0x19c/0x1b0 [ 723.767907][T17735] ? netlink_unicast+0x7fa/0x9e0 [ 723.767931][T17735] ? netlink_sendmsg+0x805/0xb30 [ 723.767950][T17735] ? __sock_sendmsg+0x21c/0x270 [ 723.767973][T17735] ? ____sys_sendmsg+0x505/0x830 [ 723.767992][T17735] ? ___sys_sendmsg+0x21f/0x2a0 [ 723.768011][T17735] ? __x64_sys_sendmsg+0x19b/0x260 [ 723.768031][T17735] ? do_syscall_64+0xfa/0xfa0 [ 723.768057][T17735] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.768083][T17735] ? __pfx_rtnl_newlink+0x10/0x10 [ 723.768137][T17735] ? kasan_quarantine_put+0xdd/0x220 [ 723.768163][T17735] ? lockdep_hardirqs_on+0x9c/0x150 [ 723.768198][T17735] ? nlmon_xmit+0xb0/0x100 [ 723.768221][T17735] ? kmem_cache_free+0x19b/0x690 [ 723.768253][T17735] ? __local_bh_enable_ip+0x12d/0x1c0 [ 723.768278][T17735] ? lockdep_hardirqs_on+0x9c/0x150 [ 723.768301][T17735] ? __local_bh_enable_ip+0x12d/0x1c0 [ 723.768320][T17735] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 723.768341][T17735] ? __dev_queue_xmit+0x27b/0x3b50 [ 723.768371][T17735] ? __dev_queue_xmit+0x27b/0x3b50 [ 723.768390][T17735] ? __dev_queue_xmit+0x27b/0x3b50 [ 723.768412][T17735] ? __dev_queue_xmit+0x1d79/0x3b50 [ 723.768433][T17735] ? kasan_save_track+0x3e/0x80 [ 723.768455][T17735] ? __kasan_slab_alloc+0x6c/0x80 [ 723.768488][T17735] ? __lock_acquire+0xab9/0xd20 [ 723.768531][T17735] ? __pfx_rtnl_newlink+0x10/0x10 [ 723.768560][T17735] rtnetlink_rcv_msg+0x7cf/0xb70 [ 723.768594][T17735] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 723.768622][T17735] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 723.768650][T17735] ? ref_tracker_free+0x63a/0x7d0 [ 723.768672][T17735] ? __asan_memcpy+0x40/0x70 [ 723.768696][T17735] ? __pfx_ref_tracker_free+0x10/0x10 [ 723.768714][T17735] ? __skb_clone+0x63/0x7a0 [ 723.768745][T17735] netlink_rcv_skb+0x208/0x470 [ 723.768766][T17735] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 723.768798][T17735] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 723.768829][T17735] ? netlink_deliver_tap+0x2e/0x1b0 [ 723.768857][T17735] netlink_unicast+0x82f/0x9e0 [ 723.768894][T17735] ? __pfx_netlink_unicast+0x10/0x10 [ 723.768925][T17735] ? netlink_sendmsg+0x642/0xb30 [ 723.768944][T17735] ? skb_put+0x11b/0x210 [ 723.768966][T17735] netlink_sendmsg+0x805/0xb30 [ 723.768997][T17735] ? __pfx_netlink_sendmsg+0x10/0x10 [ 723.769022][T17735] ? aa_sock_msg_perm+0xf1/0x1d0 [ 723.769054][T17735] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 723.769073][T17735] ? __pfx_netlink_sendmsg+0x10/0x10 [ 723.769095][T17735] __sock_sendmsg+0x21c/0x270 [ 723.769124][T17735] ____sys_sendmsg+0x505/0x830 [ 723.769149][T17735] ? __pfx_____sys_sendmsg+0x10/0x10 [ 723.769175][T17735] ? import_iovec+0x74/0xa0 [ 723.769203][T17735] ___sys_sendmsg+0x21f/0x2a0 [ 723.769225][T17735] ? __pfx____sys_sendmsg+0x10/0x10 [ 723.769279][T17735] ? __fget_files+0x2a/0x420 [ 723.769296][T17735] ? __fget_files+0x3a0/0x420 [ 723.769323][T17735] __x64_sys_sendmsg+0x19b/0x260 [ 723.769347][T17735] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 723.769384][T17735] ? __pfx_ksys_write+0x10/0x10 [ 723.769413][T17735] ? do_syscall_64+0xbe/0xfa0 [ 723.769443][T17735] do_syscall_64+0xfa/0xfa0 [ 723.769468][T17735] ? lockdep_hardirqs_on+0x9c/0x150 [ 723.769495][T17735] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.769514][T17735] ? clear_bhb_loop+0x60/0xb0 [ 723.769538][T17735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.769558][T17735] RIP: 0033:0x7fd94318f749 [ 723.769576][T17735] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 723.769594][T17735] RSP: 002b:00007fd944078038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 723.769616][T17735] RAX: ffffffffffffffda RBX: 00007fd9433e5fa0 RCX: 00007fd94318f749 [ 723.769631][T17735] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 0000000000000003 [ 723.769644][T17735] RBP: 00007fd944078090 R08: 0000000000000000 R09: 0000000000000000 [ 723.769656][T17735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 723.769669][T17735] R13: 00007fd9433e6038 R14: 00007fd9433e5fa0 R15: 00007fd94350fa28 [ 723.769701][T17735] [ 725.169197][T14171] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 725.340462][T14171] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 725.361688][T14171] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 725.389112][T14171] usb 3-1: config 0 descriptor?? [ 725.410059][T14171] cp210x 3-1:0.0: cp210x converter detected [ 725.653091][T17769] sctp: [Deprecated]: syz.3.3768 (pid 17769) Use of struct sctp_assoc_value in delayed_ack socket option. [ 725.653091][T17769] Use struct sctp_sack_info instead [ 725.758395][T17773] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 725.765400][T17773] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 725.784711][T17773] vhci_hcd vhci_hcd.0: Device attached [ 725.810534][T14171] cp210x 3-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 725.977397][ T5947] vhci_hcd: vhci_device speed not set [ 726.050082][T14171] usb 3-1: cp210x converter now attached to ttyUSB0 [ 726.069453][ T5947] usb 35-1: new full-speed USB device number 2 using vhci_hcd [ 726.324319][T14171] usb 3-1: USB disconnect, device number 18 [ 726.354118][T14171] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 726.456955][T14171] cp210x 3-1:0.0: device disconnected [ 727.892557][T17811] IPv6: addrconf: prefix option has invalid lifetime [ 727.938423][T14171] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 728.110350][T14171] usb 3-1: config 2 has an invalid interface number: 207 but max is 1 [ 728.258433][T14171] usb 3-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 728.283594][T14171] usb 3-1: config 2 has 1 interface, different from the descriptor's value: 2 [ 728.293151][T14171] usb 3-1: config 2 has no interface number 0 [ 728.299697][T14171] usb 3-1: config 2 interface 207 altsetting 73 has 0 endpoint descriptors, different from the interface descriptor's value: 11 [ 728.313615][T14171] usb 3-1: config 2 interface 207 has no altsetting 0 [ 728.334923][T14171] usb 3-1: New USB device found, idVendor=1410, idProduct=9010, bcdDevice=95.7e [ 728.360920][T14171] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.395624][T14171] usb 3-1: Product: syz [ 728.407047][T14171] usb 3-1: Manufacturer: syz [ 728.418517][ T10] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 728.429269][T14171] usb 3-1: SerialNumber: syz [ 728.657364][T14171] qmi_wwan 3-1:2.207: skipping garbage [ 728.686709][T14171] qmi_wwan 3-1:2.207: skipping garbage [ 728.704451][T14171] qmi_wwan 3-1:2.207: bogus CDC Union: master=0, slave=0 [ 728.737653][T14171] qmi_wwan 3-1:2.207: probe with driver qmi_wwan failed with error -22 [ 728.774833][T14171] usb 3-1: USB disconnect, device number 19 [ 728.813733][T14405] Bluetooth: hci0: command 0x0406 tx timeout [ 728.862072][T17822] syzkaller0: entered promiscuous mode [ 728.867732][T17822] syzkaller0: entered allmulticast mode [ 728.890217][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 728.897272][ T10] usb 4-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 728.906484][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 728.916808][ T10] usb 4-1: config 0 descriptor?? [ 728.928763][ T10] gspca_main: sunplus-2.14.0 probing 041e:400b [ 729.174747][ T10] gspca_sunplus: reg_w_riv err -71 [ 729.180272][ T10] sunplus 4-1:0.0: probe with driver sunplus failed with error -71 [ 729.206178][ T10] usb 4-1: USB disconnect, device number 27 [ 729.886033][T17774] vhci_hcd: connection reset by peer [ 729.936340][ T60] vhci_hcd: stop threads [ 729.961313][ T60] vhci_hcd: release socket [ 729.984554][ T60] vhci_hcd: disconnect device [ 730.528428][T17870] netlink: 264 bytes leftover after parsing attributes in process `syz.4.3797'. [ 730.838568][T17886] loop2: detected capacity change from 0 to 7 [ 730.851164][T17886] Dev loop2: unable to read RDB block 7 [ 730.867494][T17886] loop2: unable to read partition table [ 730.887979][T17886] loop2: partition table beyond EOD, truncated [ 730.899478][T17886] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 731.208635][ T5947] vhci_hcd: vhci_device speed not set [ 731.386514][T17913] netlink: 'syz.2.3812': attribute type 3 has an invalid length. [ 731.431244][T17916] xt_CT: You must specify a L4 protocol and not use inversions on it [ 731.545648][T17921] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3815'. [ 731.708668][ T24] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 731.726780][ T5910] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 731.739474][T17928] loop4: detected capacity change from 0 to 7 [ 731.764184][T17928] loop4: [POWERTEC] p1 p2 p3 [ 731.770151][T17928] loop4: p1 start 1600454656 is beyond EOD, truncated [ 731.777221][T17928] loop4: p2 start 3796309757 is beyond EOD, truncated [ 731.786759][T17928] loop4: p3 start 98621423 is beyond EOD, truncated [ 731.868716][ T24] usb 4-1: device descriptor read/64, error -71 [ 731.878492][T14171] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 731.886512][ T5910] usb 2-1: device descriptor read/64, error -71 [ 731.951273][T17931] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3819'. [ 732.050636][T14171] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 732.083921][T14171] usb 3-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 732.108408][ T24] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 732.135496][T14171] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 732.148380][ T5910] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 732.182931][T14171] usb 3-1: config 220 has no interface number 2 [ 732.199002][T14171] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 732.233026][T14171] usb 3-1: config 220 interface 0 has no altsetting 0 [ 732.248221][T14171] usb 3-1: config 220 interface 76 has no altsetting 0 [ 732.264821][T14171] usb 3-1: config 220 interface 1 has no altsetting 0 [ 732.271788][ T24] usb 4-1: device descriptor read/64, error -71 [ 732.290009][T14171] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 732.306312][T14171] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 732.338389][ T5947] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 732.375068][T14171] usb 3-1: Product: syz [ 732.382155][ T24] usb usb4-port1: attempt power cycle [ 732.395290][T14171] usb 3-1: Manufacturer: syz [ 732.410793][T14171] usb 3-1: SerialNumber: syz [ 732.468375][ T5910] usb 2-1: device descriptor read/64, error -71 [ 732.558362][ T5947] usb 5-1: Using ep0 maxpacket: 32 [ 732.588239][ T5947] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 732.623311][ T5910] usb usb2-port1: attempt power cycle [ 732.656358][T14171] usb 3-1: selecting invalid altsetting 0 [ 732.662401][ T5947] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 732.676640][T14171] uvcvideo 3-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 732.695293][ T5947] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 732.704804][T14171] uvcvideo 3-1:220.0: No valid video chain found. [ 732.713817][ T5947] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.728039][T14171] usb 3-1: selecting invalid altsetting 0 [ 732.740614][ T5947] usb 5-1: config 0 descriptor?? [ 732.747701][T14171] usbtest 3-1:220.1: probe with driver usbtest failed with error -22 [ 732.756616][ T24] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 732.780151][ T24] usb 4-1: device descriptor read/8, error -71 [ 732.789093][ T5947] hub 5-1:0.0: USB hub found [ 732.812855][T14171] usb 3-1: USB disconnect, device number 20 [ 732.988440][ T5910] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 733.044032][ T5947] hub 5-1:0.0: config failed, can't read hub descriptor (err -22) [ 733.052085][ T24] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 733.072053][ T5910] usb 2-1: device descriptor read/8, error -71 [ 733.079287][ T24] usb 4-1: device descriptor read/8, error -71 [ 733.249132][ T24] usb usb4-port1: unable to enumerate USB device [ 733.318582][ T5910] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 733.347632][T17936] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 733.369732][T17936] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 733.400392][T17936] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 733.423980][ T5910] usb 2-1: device descriptor read/8, error -71 [ 733.528398][T17936] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 733.638231][T17954] loop2: detected capacity change from 0 to 7 [ 733.647961][ T5910] usb usb2-port1: unable to enumerate USB device [ 733.654776][T17954] Dev loop2: unable to read RDB block 7 [ 733.654979][ T5947] usbhid 5-1:0.0: can't add hid device: -71 [ 733.668139][T17954] loop2: unable to read partition table [ 733.681439][T17954] loop2: partition table beyond EOD, truncated [ 733.687900][T17954] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 733.725007][ T5947] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 733.829023][ T5947] usb 5-1: USB disconnect, device number 14 [ 733.920828][T17960] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3828'. [ 734.872842][T17976] xt_CT: No such helper "snmp_trap" [ 734.962829][T17983] kvm: apic: phys broadcast and lowest prio [ 735.231399][ T5917] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 735.458598][ T5917] usb 4-1: Using ep0 maxpacket: 32 [ 735.474084][ T5917] usb 4-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 735.491405][ T5917] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 735.510767][ T5917] usb 4-1: config 0 descriptor?? [ 735.538476][ T5917] gspca_main: sunplus-2.14.0 probing 041e:400b [ 735.597593][T17991] FAULT_INJECTION: forcing a failure. [ 735.597593][T17991] name failslab, interval 1, probability 0, space 0, times 0 [ 735.611717][T17991] CPU: 0 UID: 0 PID: 17991 Comm: syz.0.3838 Not tainted syzkaller #0 PREEMPT(full) [ 735.611753][T17991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 735.611765][T17991] Call Trace: [ 735.611775][T17991] [ 735.611784][T17991] dump_stack_lvl+0x189/0x250 [ 735.611819][T17991] ? __pfx____ratelimit+0x10/0x10 [ 735.611846][T17991] ? __pfx_dump_stack_lvl+0x10/0x10 [ 735.611874][T17991] ? __pfx__printk+0x10/0x10 [ 735.611909][T17991] should_fail_ex+0x414/0x560 [ 735.611945][T17991] should_failslab+0xa8/0x100 [ 735.611967][T17991] kmem_cache_alloc_node_noprof+0x77/0x710 [ 735.611997][T17991] ? __alloc_skb+0x112/0x2d0 [ 735.612013][T17991] ? rtnl_prop_list_size+0x1ba/0x1e0 [ 735.612047][T17991] __alloc_skb+0x112/0x2d0 [ 735.612071][T17991] rtmsg_ifinfo_build_skb+0x84/0x260 [ 735.612098][T17991] ? netpoll_poll_enable+0xce/0xe0 [ 735.612126][T17991] rtmsg_ifinfo+0x8c/0x1a0 [ 735.612159][T17991] __dev_notify_flags+0xf4/0x2e0 [ 735.612184][T17991] ? __pfx___dev_notify_flags+0x10/0x10 [ 735.612202][T17991] ? __dev_change_flags+0x4cc/0x6d0 [ 735.612230][T17991] ? __pfx___dev_change_flags+0x10/0x10 [ 735.612256][T17991] ? is_bpf_text_address+0x26/0x2b0 [ 735.612283][T17991] netif_change_flags+0xe8/0x1a0 [ 735.612310][T17991] do_setlink+0xc55/0x41c0 [ 735.612335][T17991] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 735.612372][T17991] ? __pfx_do_setlink+0x10/0x10 [ 735.612390][T17991] ? stack_trace_save+0x9c/0xe0 [ 735.612411][T17991] ? __pfx_stack_trace_save+0x10/0x10 [ 735.612440][T17991] ? __lock_acquire+0xab9/0xd20 [ 735.612465][T17991] ? __mutex_trylock_common+0x153/0x260 [ 735.612488][T17991] ? __pfx___mutex_trylock_common+0x10/0x10 [ 735.612518][T17991] ? rcu_is_watching+0x15/0xb0 [ 735.612538][T17991] ? trace_contention_end+0x39/0x120 [ 735.612558][T17991] ? __mutex_lock+0x335/0x1350 [ 735.612587][T17991] ? __lock_acquire+0xab9/0xd20 [ 735.612608][T17991] ? rtnl_newlink+0x8e9/0x1c80 [ 735.612633][T17991] ? macvlan_changelink_sources+0x805/0x1620 [ 735.612667][T17991] ? macvlan_changelink+0x866/0xaa0 [ 735.612696][T17991] rtnl_newlink+0x1619/0x1c80 [ 735.612719][T17991] ? netlink_deliver_tap+0x19c/0x1b0 [ 735.612752][T17991] ? __pfx_rtnl_newlink+0x10/0x10 [ 735.612799][T17991] ? kasan_quarantine_put+0xdd/0x220 [ 735.612822][T17991] ? lockdep_hardirqs_on+0x9c/0x150 [ 735.612853][T17991] ? __pfx_do_softirq+0x10/0x10 [ 735.612878][T17991] ? __local_bh_enable_ip+0x12d/0x1c0 [ 735.612896][T17991] ? lockdep_hardirqs_on+0x9c/0x150 [ 735.612920][T17991] ? __local_bh_enable_ip+0x12d/0x1c0 [ 735.612938][T17991] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 735.612959][T17991] ? __dev_queue_xmit+0x27b/0x3b50 [ 735.612979][T17991] ? __dev_queue_xmit+0x27b/0x3b50 [ 735.612997][T17991] ? __dev_queue_xmit+0x27b/0x3b50 [ 735.613018][T17991] ? __dev_queue_xmit+0x1d79/0x3b50 [ 735.613036][T17991] ? kasan_save_track+0x3e/0x80 [ 735.613058][T17991] ? __kasan_slab_alloc+0x6c/0x80 [ 735.613085][T17991] ? __lock_acquire+0xab9/0xd20 [ 735.613123][T17991] ? __pfx_rtnl_newlink+0x10/0x10 [ 735.613148][T17991] rtnetlink_rcv_msg+0x7cf/0xb70 [ 735.613176][T17991] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 735.613200][T17991] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 735.613224][T17991] ? ref_tracker_free+0x63a/0x7d0 [ 735.613240][T17991] ? __asan_memcpy+0x40/0x70 [ 735.613261][T17991] ? __pfx_ref_tracker_free+0x10/0x10 [ 735.613276][T17991] ? __skb_clone+0x63/0x7a0 [ 735.613302][T17991] netlink_rcv_skb+0x208/0x470 [ 735.613320][T17991] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 735.613347][T17991] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 735.613373][T17991] ? netlink_deliver_tap+0x2e/0x1b0 [ 735.613396][T17991] netlink_unicast+0x82f/0x9e0 [ 735.613429][T17991] ? __pfx_netlink_unicast+0x10/0x10 [ 735.613455][T17991] ? netlink_sendmsg+0x642/0xb30 [ 735.613470][T17991] ? skb_put+0x11b/0x210 [ 735.613490][T17991] netlink_sendmsg+0x805/0xb30 [ 735.613515][T17991] ? __pfx_netlink_sendmsg+0x10/0x10 [ 735.613535][T17991] ? aa_sock_msg_perm+0xf1/0x1d0 [ 735.613562][T17991] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 735.613578][T17991] ? __pfx_netlink_sendmsg+0x10/0x10 [ 735.613596][T17991] __sock_sendmsg+0x21c/0x270 [ 735.613622][T17991] ____sys_sendmsg+0x505/0x830 [ 735.613645][T17991] ? __pfx_____sys_sendmsg+0x10/0x10 [ 735.613672][T17991] ? import_iovec+0x74/0xa0 [ 735.613696][T17991] ___sys_sendmsg+0x21f/0x2a0 [ 735.613717][T17991] ? __pfx____sys_sendmsg+0x10/0x10 [ 735.613772][T17991] ? __fget_files+0x2a/0x420 [ 735.613787][T17991] ? __fget_files+0x3a0/0x420 [ 735.613813][T17991] __x64_sys_sendmsg+0x19b/0x260 [ 735.613834][T17991] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 735.613861][T17991] ? __pfx_ksys_write+0x10/0x10 [ 735.613888][T17991] ? do_syscall_64+0xbe/0xfa0 [ 735.613915][T17991] do_syscall_64+0xfa/0xfa0 [ 735.613938][T17991] ? lockdep_hardirqs_on+0x9c/0x150 [ 735.613961][T17991] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 735.613978][T17991] ? clear_bhb_loop+0x60/0xb0 [ 735.613998][T17991] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 735.614015][T17991] RIP: 0033:0x7fe4b918f749 [ 735.614031][T17991] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 735.614046][T17991] RSP: 002b:00007fe4b9fe2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 735.614065][T17991] RAX: ffffffffffffffda RBX: 00007fe4b93e5fa0 RCX: 00007fe4b918f749 [ 735.614078][T17991] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 0000000000000003 [ 735.614089][T17991] RBP: 00007fe4b9fe2090 R08: 0000000000000000 R09: 0000000000000000 [ 735.614100][T17991] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 735.614110][T17991] R13: 00007fe4b93e6038 R14: 00007fe4b93e5fa0 R15: 00007fe4b950fa28 [ 735.614138][T17991] [ 736.168043][ C0] vkms_vblank_simulate: vblank timer overrun [ 736.199591][ T10] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 736.208830][ T5917] gspca_sunplus: reg_w_riv err -110 [ 736.214183][ T5917] sunplus 4-1:0.0: probe with driver sunplus failed with error -110 [ 736.225990][T17993] debugfs: '.^!l' already exists in 'ieee80211' [ 736.305679][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 736.305695][ T30] audit: type=1326 audit(1763640548.952:768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17994 comm="syz.0.3840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4b918f749 code=0x7ffc0000 [ 736.408373][ T10] usb 2-1: device descriptor read/64, error -71 [ 736.648695][ T10] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 736.778367][ T10] usb 2-1: device descriptor read/64, error -71 [ 736.788702][ T30] audit: type=1326 audit(1763640548.952:769): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17994 comm="syz.0.3840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=93 compat=0 ip=0x7fe4b918f749 code=0x7ffc0000 [ 736.811460][ T30] audit: type=1326 audit(1763640548.952:770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17994 comm="syz.0.3840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4b918f749 code=0x7ffc0000 [ 736.833936][ T30] audit: type=1326 audit(1763640548.952:771): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17994 comm="syz.0.3840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fe4b918f749 code=0x7ffc0000 [ 736.857209][ T30] audit: type=1326 audit(1763640548.952:772): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17994 comm="syz.0.3840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4b918f749 code=0x7ffc0000 [ 736.881102][ T30] audit: type=1326 audit(1763640548.952:773): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17994 comm="syz.0.3840" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fe4b918f749 code=0x7ffc0000 [ 736.903444][ C0] vkms_vblank_simulate: vblank timer overrun [ 736.913882][ T10] usb usb2-port1: attempt power cycle [ 737.098380][ T5896] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 737.258384][ T10] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 737.267051][ T5896] usb 3-1: Using ep0 maxpacket: 32 [ 737.282288][ T10] usb 2-1: device descriptor read/8, error -71 [ 737.290393][ T5896] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 737.299350][ T5896] usb 3-1: config 0 has no interface number 0 [ 737.313402][ T5896] usb 3-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 737.335649][ T5896] usb 3-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 737.352948][ T5896] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 737.369822][ T5896] usb 3-1: Product: syz [ 737.374998][ T5896] usb 3-1: Manufacturer: syz [ 737.380924][ T5896] usb 3-1: SerialNumber: syz [ 737.393977][ T5896] usb 3-1: config 0 descriptor?? [ 737.415412][ T5896] em28xx 3-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 737.425955][ T5896] em28xx 3-1:0.132: Video interface 132 found: [ 737.539964][ T10] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 737.579244][ T10] usb 2-1: device descriptor read/8, error -71 [ 737.749560][ T10] usb usb2-port1: unable to enumerate USB device [ 737.840599][ T5896] em28xx 3-1:0.132: unknown em28xx chip ID (0) [ 738.267784][T18012] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3844'. [ 738.278195][T18012] netlink: 3 bytes leftover after parsing attributes in process `syz.4.3844'. [ 738.480114][T18020] netlink: 'syz.1.3847': attribute type 10 has an invalid length. [ 738.489730][T18020] netlink: 'syz.1.3847': attribute type 10 has an invalid length. [ 738.593609][T18025] xt_bpf: check failed: parse error [ 738.935437][ T10] usb 4-1: USB disconnect, device number 32 [ 739.289145][ T5896] em28xx 3-1:0.132: failed to trigger write to i2c address 0xa0 (error=-5) [ 739.326763][ T5896] em28xx 3-1:0.132: failed to read eeprom (err=-5) [ 739.348021][T18037] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3852'. [ 739.369007][ T5896] em28xx 3-1:0.132: em28xx_i2c_register: em28xx_i2_eeprom failed! retval [-5] [ 739.478458][ T5896] em28xx 3-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 739.506186][ T5896] em28xx 3-1:0.132: analog set to bulk mode. [ 739.555464][ T10] em28xx 3-1:0.132: Registering V4L2 extension [ 739.807416][ T10] em28xx 3-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 739.866545][ T10] em28xx 3-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 739.880885][ T10] em28xx 3-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 739.899534][ T10] em28xx 3-1:0.132: failed to trigger read from i2c address 0x40 (error=-5) [ 739.986806][ T5903] usb 3-1: USB disconnect, device number 21 [ 740.007962][ T5903] em28xx 3-1:0.132: Disconnecting em28xx [ 740.087223][ T10] em28xx 3-1:0.132: Config register raw data: 0xffffffed [ 740.240170][ T10] em28xx 3-1:0.132: AC97 chip type couldn't be determined [ 740.363896][ T10] em28xx 3-1:0.132: No AC97 audio processor [ 740.380665][ T10] usb 3-1: Decoder not found [ 740.385337][ T10] em28xx 3-1:0.132: failed to create media graph [ 740.571308][ T10] em28xx 3-1:0.132: V4L2 device video103 deregistered [ 741.371902][ T5910] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 741.562833][ T5910] usb 2-1: config 0 has an invalid interface number: 197 but max is 4 [ 741.608385][ T5910] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 741.678882][ T5910] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 5 [ 741.742627][ T5910] usb 2-1: config 0 has no interface number 0 [ 741.793115][ T5910] usb 2-1: config 0 interface 197 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 8 [ 741.854568][ T5910] usb 2-1: config 0 interface 197 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 741.924954][ T5910] usb 2-1: config 0 interface 197 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 742.034506][ T5910] usb 2-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=bb.42 [ 742.078864][ T5910] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 742.131583][ T5910] usb 2-1: Product: syz [ 742.135768][ T5910] usb 2-1: Manufacturer: syz [ 742.178929][ T5910] usb 2-1: SerialNumber: syz [ 742.224675][ T5910] usb 2-1: config 0 descriptor?? [ 742.251165][T18065] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 742.344890][ T10] em28xx 3-1:0.132: Remote control support is not available for this card. [ 742.345330][T18060] ================================================================== [ 742.361632][T18060] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 742.369107][T18060] Read of size 8 at addr ffff888031aec740 by task v4l_id/18060 [ 742.376651][T18060] [ 742.378972][T18060] CPU: 1 UID: 0 PID: 18060 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 742.378985][T18060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 742.378993][T18060] Call Trace: [ 742.379000][T18060] [ 742.379006][T18060] dump_stack_lvl+0x189/0x250 [ 742.379023][T18060] ? __virt_addr_valid+0x1c8/0x5c0 [ 742.379038][T18060] ? rcu_is_watching+0x15/0xb0 [ 742.379050][T18060] ? __pfx_dump_stack_lvl+0x10/0x10 [ 742.379063][T18060] ? rcu_is_watching+0x15/0xb0 [ 742.379074][T18060] ? lock_release+0x4b/0x3e0 [ 742.379084][T18060] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 742.379098][T18060] ? __virt_addr_valid+0x1c8/0x5c0 [ 742.379112][T18060] ? __virt_addr_valid+0x4a5/0x5c0 [ 742.379125][T18060] print_report+0xca/0x240 [ 742.379138][T18060] ? v4l2_fh_open+0xac/0x420 [ 742.379148][T18060] kasan_report+0x118/0x150 [ 742.379159][T18060] ? v4l2_fh_open+0xac/0x420 [ 742.379171][T18060] v4l2_fh_open+0xac/0x420 [ 742.379181][T18060] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 742.379204][T18060] em28xx_v4l2_open+0x157/0x9a0 [ 742.379222][T18060] v4l2_open+0x1bf/0x3a0 [ 742.379234][T18060] chrdev_open+0x4cc/0x5e0 [ 742.379245][T18060] ? __pfx_chrdev_open+0x10/0x10 [ 742.379256][T18060] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 742.379268][T18060] ? __pfx_chrdev_open+0x10/0x10 [ 742.379277][T18060] do_dentry_open+0x953/0x13f0 [ 742.379292][T18060] vfs_open+0x3b/0x340 [ 742.379302][T18060] ? path_openat+0x2ecd/0x3830 [ 742.379315][T18060] path_openat+0x2ee5/0x3830 [ 742.379335][T18060] ? __pfx_path_openat+0x10/0x10 [ 742.379352][T18060] do_filp_open+0x1fa/0x410 [ 742.379364][T18060] ? __lock_acquire+0xab9/0xd20 [ 742.379374][T18060] ? __pfx_do_filp_open+0x10/0x10 [ 742.379391][T18060] ? _raw_spin_unlock+0x28/0x50 [ 742.379404][T18060] ? alloc_fd+0x64c/0x6c0 [ 742.379421][T18060] do_sys_openat2+0x121/0x1c0 [ 742.379433][T18060] ? __pfx_do_sys_openat2+0x10/0x10 [ 742.379445][T18060] ? exc_page_fault+0x82/0x100 [ 742.379459][T18060] ? do_user_addr_fault+0xc85/0x1380 [ 742.379470][T18060] __x64_sys_openat+0x138/0x170 [ 742.379483][T18060] do_syscall_64+0xfa/0xfa0 [ 742.379497][T18060] ? lockdep_hardirqs_on+0x9c/0x150 [ 742.379511][T18060] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.379521][T18060] ? clear_bhb_loop+0x60/0xb0 [ 742.379532][T18060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.379542][T18060] RIP: 0033:0x7ff435ea7407 [ 742.379554][T18060] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 742.379563][T18060] RSP: 002b:00007fffdd63c760 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 742.379576][T18060] RAX: ffffffffffffffda RBX: 00007ff43653d880 RCX: 00007ff435ea7407 [ 742.379584][T18060] RDX: 0000000000000000 RSI: 00007fffdd63cf1c RDI: ffffffffffffff9c [ 742.379592][T18060] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 742.379598][T18060] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 742.379604][T18060] R13: 00007fffdd63c9b0 R14: 00007ff436642000 R15: 00005590097474d8 [ 742.379616][T18060] [ 742.379620][T18060] [ 742.681959][T18060] Allocated by task 10: [ 742.686092][T18060] kasan_save_track+0x3e/0x80 [ 742.690758][T18060] __kasan_kmalloc+0x93/0xb0 [ 742.695345][T18060] __kmalloc_cache_noprof+0x3d5/0x6f0 [ 742.700712][T18060] em28xx_v4l2_init+0x10b/0x2e70 [ 742.705637][T18060] em28xx_init_extension+0x120/0x1c0 [ 742.711029][T18060] process_scheduled_works+0xae1/0x17b0 [ 742.716571][T18060] worker_thread+0x8a0/0xda0 [ 742.721145][T18060] kthread+0x711/0x8a0 [ 742.725195][T18060] ret_from_fork+0x4bc/0x870 [ 742.729760][T18060] ret_from_fork_asm+0x1a/0x30 [ 742.734503][T18060] [ 742.736806][T18060] Freed by task 10: [ 742.740588][T18060] kasan_save_track+0x3e/0x80 [ 742.745250][T18060] __kasan_save_free_info+0x46/0x50 [ 742.750427][T18060] __kasan_slab_free+0x5c/0x80 [ 742.755171][T18060] kfree+0x19a/0x6d0 [ 742.759050][T18060] em28xx_v4l2_init+0x1683/0x2e70 [ 742.764084][T18060] em28xx_init_extension+0x120/0x1c0 [ 742.769363][T18060] process_scheduled_works+0xae1/0x17b0 [ 742.774898][T18060] worker_thread+0x8a0/0xda0 [ 742.779484][T18060] kthread+0x711/0x8a0 [ 742.783634][T18060] ret_from_fork+0x4bc/0x870 [ 742.788280][T18060] ret_from_fork_asm+0x1a/0x30 [ 742.793116][T18060] [ 742.795428][T18060] The buggy address belongs to the object at ffff888031aec000 [ 742.795428][T18060] which belongs to the cache kmalloc-8k of size 8192 [ 742.809462][T18060] The buggy address is located 1856 bytes inside of [ 742.809462][T18060] freed 8192-byte region [ffff888031aec000, ffff888031aee000) [ 742.823422][T18060] [ 742.825737][T18060] The buggy address belongs to the physical page: [ 742.832141][T18060] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x31ae8 [ 742.840881][T18060] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 742.849367][T18060] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 742.856902][T18060] page_type: f5(slab) [ 742.860901][T18060] raw: 00fff00000000040 ffff88801a027280 dead000000000122 0000000000000000 [ 742.869580][T18060] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 742.878233][T18060] head: 00fff00000000040 ffff88801a027280 dead000000000122 0000000000000000 [ 742.886905][T18060] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 742.895584][T18060] head: 00fff00000000003 ffffea0000c6ba01 00000000ffffffff 00000000ffffffff [ 742.904244][T18060] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 742.912893][T18060] page dumped because: kasan: bad access detected [ 742.919299][T18060] page_owner tracks the page as allocated [ 742.925000][T18060] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x528c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP), pid 17965, tgid 17961 (syz.0.3829), ts 734810757898, free_ts 729871760907 [ 742.944877][T18060] post_alloc_hook+0x234/0x290 [ 742.949634][T18060] get_page_from_freelist+0x2365/0x2440 [ 742.955164][T18060] __alloc_frozen_pages_noprof+0x181/0x370 [ 742.960948][T18060] alloc_pages_mpol+0x232/0x4a0 [ 742.965799][T18060] allocate_slab+0x96/0x350 [ 742.970290][T18060] ___slab_alloc+0xf56/0x1990 [ 742.974947][T18060] __slab_alloc+0x65/0x100 [ 742.979360][T18060] __kvmalloc_node_noprof+0x6ba/0x910 [ 742.984715][T18060] netlink_alloc_large_skb+0x62/0x110 [ 742.990073][T18060] netlink_sendmsg+0x5c6/0xb30 [ 742.994816][T18060] __sock_sendmsg+0x21c/0x270 [ 742.999474][T18060] sock_sendmsg+0x158/0x230 [ 743.003966][T18060] splice_to_socket+0x8f5/0xf00 [ 743.008800][T18060] direct_splice_actor+0x101/0x160 [ 743.013886][T18060] splice_direct_to_actor+0x5a8/0xcc0 [ 743.019590][T18060] do_splice_direct+0x181/0x270 [ 743.024421][T18060] page last free pid 17853 tgid 17853 stack trace: [ 743.031244][T18060] __free_frozen_pages+0xbc4/0xd30 [ 743.036341][T18060] __slab_free+0x2e7/0x390 [ 743.040738][T18060] qlist_free_all+0x97/0x140 [ 743.045312][T18060] kasan_quarantine_reduce+0x148/0x160 [ 743.050750][T18060] __kasan_slab_alloc+0x22/0x80 [ 743.055580][T18060] kmem_cache_alloc_noprof+0x367/0x6e0 [ 743.061016][T18060] getname_flags+0xb8/0x540 [ 743.065501][T18060] do_sys_openat2+0xbc/0x1c0 [ 743.070086][T18060] __x64_sys_openat+0x138/0x170 [ 743.074928][T18060] do_syscall_64+0xfa/0xfa0 [ 743.079414][T18060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 743.085433][T18060] [ 743.087736][T18060] Memory state around the buggy address: [ 743.093341][T18060] ffff888031aec600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 743.101388][T18060] ffff888031aec680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 743.109428][T18060] >ffff888031aec700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 743.117462][T18060] ^ [ 743.123600][T18060] ffff888031aec780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 743.131643][T18060] ffff888031aec800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 743.139683][T18060] ================================================================== [ 743.169638][ T5903] em28xx 3-1:0.132: Closing input extension [ 743.322282][T18060] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 743.329526][T18060] CPU: 1 UID: 0 PID: 18060 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 743.338555][T18060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 743.348622][T18060] Call Trace: [ 743.351896][T18060] [ 743.354815][T18060] dump_stack_lvl+0x99/0x250 [ 743.359408][T18060] ? __asan_memcpy+0x40/0x70 [ 743.363995][T18060] ? __pfx_dump_stack_lvl+0x10/0x10 [ 743.369186][T18060] ? __pfx__printk+0x10/0x10 [ 743.373776][T18060] vpanic+0x237/0x6d0 [ 743.377768][T18060] ? __pfx_vpanic+0x10/0x10 [ 743.382269][T18060] ? preempt_schedule+0xae/0xc0 [ 743.387118][T18060] ? __pfx_preempt_schedule+0x10/0x10 [ 743.392490][T18060] panic+0xb9/0xc0 [ 743.396206][T18060] ? __pfx_panic+0x10/0x10 [ 743.400617][T18060] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 743.406510][T18060] ? is_module_address+0x17/0xf0 [ 743.411444][T18060] ? v4l2_fh_open+0xac/0x420 [ 743.416028][T18060] check_panic_on_warn+0x89/0xb0 [ 743.421063][T18060] ? v4l2_fh_open+0xac/0x420 [ 743.425657][T18060] end_report+0x78/0x160 [ 743.429894][T18060] kasan_report+0x129/0x150 [ 743.434398][T18060] ? v4l2_fh_open+0xac/0x420 [ 743.438989][T18060] v4l2_fh_open+0xac/0x420 [ 743.443396][T18060] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 743.449376][T18060] em28xx_v4l2_open+0x157/0x9a0 [ 743.454236][T18060] v4l2_open+0x1bf/0x3a0 [ 743.458472][T18060] chrdev_open+0x4cc/0x5e0 [ 743.462882][T18060] ? __pfx_chrdev_open+0x10/0x10 [ 743.467814][T18060] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 743.474135][T18060] ? __pfx_chrdev_open+0x10/0x10 [ 743.479063][T18060] do_dentry_open+0x953/0x13f0 [ 743.483839][T18060] vfs_open+0x3b/0x340 [ 743.487901][T18060] ? path_openat+0x2ecd/0x3830 [ 743.492665][T18060] path_openat+0x2ee5/0x3830 [ 743.497261][T18060] ? __pfx_path_openat+0x10/0x10 [ 743.502199][T18060] do_filp_open+0x1fa/0x410 [ 743.506697][T18060] ? __lock_acquire+0xab9/0xd20 [ 743.511541][T18060] ? __pfx_do_filp_open+0x10/0x10 [ 743.516574][T18060] ? _raw_spin_unlock+0x28/0x50 [ 743.521422][T18060] ? alloc_fd+0x64c/0x6c0 [ 743.525760][T18060] do_sys_openat2+0x121/0x1c0 [ 743.530435][T18060] ? __pfx_do_sys_openat2+0x10/0x10 [ 743.535632][T18060] ? exc_page_fault+0x82/0x100 [ 743.540394][T18060] ? do_user_addr_fault+0xc85/0x1380 [ 743.545669][T18060] __x64_sys_openat+0x138/0x170 [ 743.550515][T18060] do_syscall_64+0xfa/0xfa0 [ 743.555017][T18060] ? lockdep_hardirqs_on+0x9c/0x150 [ 743.560208][T18060] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 743.566264][T18060] ? clear_bhb_loop+0x60/0xb0 [ 743.570935][T18060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 743.576914][T18060] RIP: 0033:0x7ff435ea7407 [ 743.581326][T18060] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 743.600939][T18060] RSP: 002b:00007fffdd63c760 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 743.609347][T18060] RAX: ffffffffffffffda RBX: 00007ff43653d880 RCX: 00007ff435ea7407 [ 743.617313][T18060] RDX: 0000000000000000 RSI: 00007fffdd63cf1c RDI: ffffffffffffff9c [ 743.625374][T18060] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 743.633341][T18060] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 743.641308][T18060] R13: 00007fffdd63c9b0 R14: 00007ff436642000 R15: 00005590097474d8 [ 743.649291][T18060] [ 743.652699][T18060] Kernel Offset: disabled [ 743.657020][T18060] Rebooting in 86400 seconds..