last executing test programs: 13.518801337s ago: executing program 3 (id=729): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0xe0881) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000007c0)=[{{&(0x7f00000000c0)={0xa, 0x4e22, 0x4, @remote, 0x7}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000280)="e9", 0x1}], 0x1}}, {{&(0x7f0000000440)={0xa, 0x4e23, 0x5, @remote, 0x3}, 0x1c, &(0x7f00000005c0)=[{&(0x7f0000000480)}], 0x1}}], 0x2, 0x931766f6319eed44) shutdown(0xffffffffffffffff, 0x1) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x80, &(0x7f0000002100)=""/4127, &(0x7f0000000000)=0x101f) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, "0000000000000208", "5171bb74cd3660dab9e200", "d8a024e5", "20000926000200"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x18, &(0x7f0000000040)=0xa, 0x4) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0x311200, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x1a6c42) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r4 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x9e3a, 0x10100, 0x80000, 0x1bd}, &(0x7f0000002000), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f0000000580)=[{&(0x7f0000000380)=""/113, 0x71}], 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) syz_clone(0x80040000, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f0000001ac0)={r2, 0x0, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1c, "339f020bbe82b398000000000000000000000d0ec0b1c4369d03760250ceaac594b1b3d741dd16c1c50d38ef2a565ef1e83323691c58d64500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374cb4a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200", [0x0, 0x7fff]}}) dup(r3) 12.363020829s ago: executing program 3 (id=732): set_mempolicy(0x1, 0x0, 0x7e) r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x2, 0x0, 0x3}, 0xfe}, 0x18) r3 = fcntl$getown(0xffffffffffffffff, 0x9) sched_setattr(r3, &(0x7f0000000280)={0x38, 0x6, 0x10, 0x100, 0x2fc, 0x5, 0x7ff, 0x4ac, 0x1, 0x9}, 0x0) syz_usb_connect$uac1(0x0, 0xac, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000680), r4) r5 = syz_open_dev$video(&(0x7f0000000b40), 0x7, 0x28000) r6 = syz_open_dev$video(&(0x7f0000000000), 0xa7, 0x0) ioctl$VIDIOC_S_PARM(r6, 0xc0cc5616, &(0x7f0000000100)={0x2, @capture={0x1000, 0x0, {0x10001, 0xa3}, 0xfffffffe, 0x4}}) preadv(r5, &(0x7f0000001200), 0x0, 0x4, 0xb) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x1a, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYRESHEX=r3], 0xe0}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="60000000020601046c0001000000000000000000050005000a000000050001000600000005000400000000000900020073797a300000000014000300686173683a69702c706f72742c697000140007800800084000002f54080006"], 0x60}}, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) ioctl$VIDIOC_LOG_STATUS(r5, 0x5646, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="000000000000000072132790738a00000000", @ANYRES32=r9, @ANYBLOB], 0x1c}}, 0x0) unshare(0x2a060a80) 7.843243853s ago: executing program 3 (id=746): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x801, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1181}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000040)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f00000001c0)="f80041bee80749b97fa223d47e03ab2bef57686f7ab73c9ced0ba93920e6cf074f4544ba864ee271cee5c307936ed0af4102886ccb0f8aa2dd4fc10956e2f830f0042b81e8a82dc75e7425d5ec6b9ec6"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000e00)=[@request_death={0x400c6313}], 0x0, 0x0, 0x0}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000003480)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000000480)={0x2020}, 0x2020) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000200)="9ecba966ec0544ed2c1f5c7fb3d11e23564c90bdbd9dda884c0161f2dd98fa977dfc46", 0x23}], 0x1}, 0x4000010) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@delneigh={0x38, 0x1a, 0x1, 0x70bd2b, 0x0, {0xa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4}, [@NDA_CACHEINFO={0x14, 0x3, {0x9}}, @NDA_VNI={0x8, 0x7, 0x8}]}, 0x38}}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) r5 = openat$ttyS3(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r6, 0x4945, 0x0, 0x2, 0x0, 0x0) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f0000000000)={0x0, 0x0, 0x1020, 0x0, 0x0, "dd0400", 0x0, 0xffff9832}) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x840, 0x8e) ioctl$FS_IOC_FSSETXATTR(r10, 0x401c5820, &(0x7f0000000580)={0x10800, 0x0, 0x87}) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008103e00f80ecdb4cb9f207c804a00f00000088080ffb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) preadv(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000140)=""/102, 0x66}, {&(0x7f00000001c0)=""/49, 0x31}], 0x2, 0x40, 0x6) accept4(r3, &(0x7f00000002c0)=@nl, &(0x7f0000000340)=0x80, 0x0) r11 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$bt_hci(r11, 0x0, 0x1a, &(0x7f0000001800)=""/2, &(0x7f0000001840)=0x2) 7.177709982s ago: executing program 3 (id=749): socket$inet6_udplite(0xa, 0x2, 0x88) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_IRQ_LINE(r3, 0x4008ae61, &(0x7f0000000080)={0x10000, 0x80000000}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x0, 0x4008000) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000040)={'ipvlan0\x00', &(0x7f0000000140)=@ethtool_pauseparam={0x8}}) syz_usb_connect(0x6, 0x4e5, &(0x7f0000000240)={{0x12, 0x1, 0x250, 0x2c, 0xda, 0xc5, 0x20, 0x54c, 0x58, 0x85c0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4d3, 0x3, 0x5, 0x8, 0x0, 0x4, [{{0x9, 0x4, 0x27, 0x8, 0x6, 0x7f, 0x62, 0x53, 0xf5, [], [{{0x9, 0x5, 0x8, 0x0, 0x8, 0x3, 0xe, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x3, 0x9}, @generic={0x5, 0xb, "846438"}]}}, {{0x9, 0x5, 0x8, 0x8, 0x200, 0x6, 0x1, 0x5}}, {{0x9, 0x5, 0x8, 0x0, 0x200, 0x7, 0x1, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x6d, 0xf}, @generic={0x16, 0xd, "84a0ae1019abb5ee3f830a1b47b56329f6e242eb"}]}}, {{0x9, 0x5, 0x8, 0x2, 0x20, 0x3e, 0x3, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0xf, 0xe}, @uac_iso={0x7, 0x25, 0x1, 0x3, 0x4, 0x3}]}}, {{0x9, 0x5, 0xc, 0x0, 0x10, 0x81, 0x1, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x7, 0x9}]}}, {{0x9, 0x5, 0x0, 0x1, 0x200, 0x2, 0x1, 0x0, [@generic={0x17, 0x0, "115ec74c3285b473b33d5e654d4e153457d80ac588"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x3, 0x9}]}}]}}, {{0x9, 0x4, 0x45, 0x0, 0x3, 0x36, 0xdf, 0xe7, 0x8, [@uac_control={{0xa, 0x24, 0x1, 0x3, 0x2}, [@output_terminal={0x9, 0x24, 0x3, 0x3, 0x305, 0x3, 0x5, 0x4}, @input_terminal={0xc, 0x24, 0x2, 0x1, 0x203, 0x5, 0x8, 0x4, 0x5, 0x2}, @extension_unit={0x9, 0x24, 0x8, 0x2, 0x24, 0x4, "15fc"}, @extension_unit={0xd, 0x24, 0x8, 0x3, 0x6, 0x7, "a4653732e5c7"}, @mixer_unit={0x6, 0x24, 0x4, 0x1, 0xb7, '$'}]}], [{{0x9, 0x5, 0x4, 0x10, 0x10, 0x7e, 0x9, 0xa2}}, {{0x9, 0x5, 0x6, 0x10, 0x40, 0xff, 0x4, 0x4}}, {{0x9, 0x5, 0x6, 0x0, 0x8, 0x9, 0x5, 0x1, [@generic={0x2, 0x30}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x0, 0x7ff}]}}]}}, {{0x9, 0x4, 0x8c, 0x74, 0x9, 0xff, 0xff, 0xff, 0x0, [@cdc_ecm={{0x7, 0x24, 0x6, 0x0, 0x0, '\f9'}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x101, 0xfff, 0x7, 0x9}, [@acm={0x4, 0x24, 0x2, 0x3}, @acm={0x4, 0x24, 0x2, 0x3}, @acm={0x4, 0x24, 0x2, 0x9}, @network_terminal={0x7, 0x24, 0xa, 0x5, 0x0, 0x4, 0x2}, @mbim={0xc, 0x24, 0x1b, 0x5, 0x6, 0x2, 0x5, 0x1, 0x40}, @mdlm_detail={0x101, 0x24, 0x13, 0xdf, "caa99f21fef914eb562986b20a38a7e60a873a3c980b7e16f960f403713e518a7755fd3d8073aa4322d32d490df11e0adf113de1fb7527b2fc82e129e6fca4ffecbedf6d3f6e01a7e37899da21964f7ac3bb96edf99ce24ee29a6f14ff99d89479211f1fc53052cf9d01864668f00b606e735d1b4d4a49e93bd7f4cf68307981a6b748f044b309fa5fe3984c4be5bcf0baef1a2098b6a6f861b27821d5798e866174d1ac93a922e3989b02e58eba79c93247a9ee5ab450faced74d929c4223dbf57c408f8fe9414bdf36f5095e583e5696574d00afeb00f2908ac513567c68eb2c402bded0e2e083773c75a1515d7677885a441d78ff9bc66211bebf2e"}]}], [{{0x9, 0x5, 0x5, 0x0, 0x10, 0x1, 0x0, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0xf, 0x8b}]}}, {{0x9, 0x5, 0x4, 0x2, 0x20, 0x18, 0x81, 0x45, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x51, 0x5849}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0xa0, 0x40}]}}, {{0x9, 0x5, 0x2, 0x0, 0x3ff, 0x5, 0xac, 0xf8, [@generic={0xb6, 0x22, "b4ce82f9d3e76e09df7ff031396dc00733df9acd72afb89897bcc5b0eea75baa7f74ffcd3b3167a00de9bc53f38e934d4a5c86b479ec36cf17bcd4d76550fdc49101ee143e8684335758bc47cd4feadd9065f58ef6ca4d4189e79f1a2548f7d699d9527678479b627329cc180ff5a0d5969f36f85c9afe6c1029d2e817a5d080cc2d5f080393500e0194be852cf576c749b75f2d55ecd2f6d80fc2eab86f59f09e589113e18cb4d3f69ab2aa7c0be9836798428a"}]}}, {{0x9, 0x5, 0xe, 0x0, 0x3e7, 0xff, 0x3, 0x4}}, {{0x9, 0x5, 0x6, 0x7, 0x20, 0x8, 0x2, 0x10}}, {{0x9, 0x5, 0xa, 0x4, 0x8, 0x9, 0x4, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0xc0, 0x7, 0x6}, @generic={0x83, 0x22, "a8538b1e1ae18720b440ea0b3659dd2acb327e511a51562ed730e9cec5474b4e741c5ca3d409f752fe8b62388778cf4ff1ac49248d4622dd42a4e86347b1c90e9c5b2197ebb4a543a17798b8383dff019eaaa1523be755dc8fc97db7fdea58cb4a2aa2282c00595a095fede3ed05723096bcbaf8d54de25646e5a18e60d559fd29"}]}}, {{0x9, 0x5, 0xe, 0x4, 0x40, 0x3, 0x24, 0x0, [@generic={0xd2, 0x22, "4644eb504f7c03b4421b67d17fb47d8744293af9113b95d7caa099aa8bdcf1be6d32fe5125267208749f76546d004c928d9d0833a3e76cf885a01a17a85db4ab33b9d1960dcaeb61f6cc415c406230951bc1eafac1bffd2c5161386f609b93ea5b01049e08caf1545fd8d98cf8de221466ba81b299c3cff19af07b2126acc5d0ca2ea46c1a356654340ac80fea37225353d9b2044e6e57908b24c811992252d724cc57e36ee87b0821cae4287181c8440a38306d620679c7e6a1b8cfe94a11802f2e0541c4525f5e8298633998c90296"}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x5, 0x4}]}}, {{0x9, 0x5, 0x8, 0xc, 0x3ff, 0xb, 0x8, 0xbf}}, {{0x9, 0x5, 0xd, 0x4, 0x20, 0x2, 0xf1, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x9, 0x6}]}}]}}]}}]}}, &(0x7f0000000d80)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x110, 0xa, 0x9, 0x6, 0xff, 0x1}, 0x5, &(0x7f00000000c0)={0x5, 0xf, 0x5}, 0x9, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0xd0b0}}, {0x75, &(0x7f0000000a40)=@string={0x75, 0x3, "c7fa066d39c01c91511510a91b53540c2fe760c26b34bd081627ce7b9aa1e92d35c1db4ee738d0ca2b913a79cfafd2e2efedb2cbe3c763b0755602425209e9f84b223ba4bce3a492192009ea3aa03f575f17d3070b9daed39ef4060ea1c0549484f43b4300b1a906484ca462a6eb335cb59fb2"}}, {0xfd, &(0x7f0000000ac0)=@string={0xfd, 0x3, "49de45222be4fdd61eda728a84824094ae2c587cc17a224228422e11c6f08ef11cbf4556c0b0499a4677b246d96071e0644ef6139d8d08951058fa6d8046c2906cfd491217c9a80c5fadd797cf2fa544be4ab29b36df11cbbf40d11296ccf4ffff6a467739548ebd9d8af69d63011338ba0ea41ec5fe02b98f5b4557c790e680ac537115b6579be1a8dc17984214fae4f31d73e306c895f7cafb9eedda3246bcac69bd6d5dc6860eddc6f52aaecd2b8a49726730ac30bdaa172f829a4b138a31039af1d60db90ad3e78ef67dbc37263c8a014ee165676fa37afebbff73ad7e950e3b47b5af0b6b6dfbcc32086d60d2b89baedf3e30f5142d478843"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x4c5a}}, {0x4, &(0x7f0000000bc0)=@lang_id={0x4, 0x3, 0x443}}, {0x4, &(0x7f0000000c00)=@lang_id={0x4, 0x3, 0x2401}}, {0x8a, &(0x7f0000000c40)=@string={0x8a, 0x3, "78044c68e24c7d15a38d42a951486a0681702472265455570f5856a9db9c02ff95a1effc746038adbf69b79ebfe5f98ddadc57347e3ea47487cc4d71eac5b2f45ad6c534304bfe24d6e2e93dd642d21b6ad53dbe111c292a9d66c93b178cf65fe4dfada9a737f95e4fcf1428b9259c06321c2ef06202cc7f4bda36b9ee08f68d53756b4ad9cb383e"}}, {0xd, &(0x7f0000000d00)=@string={0xd, 0x3, "e5ede113786685fc94b87a"}}, {0x19, &(0x7f0000000d40)=@string={0x19, 0x3, "b5fe2642fccc1f68aeb3badeee3c841fdf33623bb62b27"}}]}) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r6 = dup(r5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r6, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x2000000, 0x12, r7, 0x0) 6.692429779s ago: executing program 4 (id=750): r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_GET_XSAVE(r0, 0x9000aea4, &(0x7f0000000000)) mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000000) r1 = signalfd4(r0, &(0x7f0000001000)={[0x7fff, 0x8]}, 0x8, 0x0) r2 = openat$full(0xffffff9c, &(0x7f0000001240), 0x84040, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001300)={0x0, 0x0}, 0x8) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001580)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xf875}, [@jmp={0x5, 0x0, 0x5, 0x4, 0x4, 0xffffffffffffffe0, 0x8}, @map_val={0x18, 0x1, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x6}, @printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}]}, &(0x7f00000013c0)='GPL\x00', 0x1cab4000, 0xaf, &(0x7f0000001400)=""/175, 0xc3300, 0x59, '\x00', 0x0, 0x18, 0xffffffffffffffff, 0x8, &(0x7f00000014c0)={0x4, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x28b3a, 0xffffffffffffffff, 0x2, &(0x7f0000001500)=[0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x1], &(0x7f0000001540)=[{0x2, 0x4, 0xc, 0x5}, {0x5, 0x4, 0x5, 0xa}], 0x10, 0x6}, 0x94) r5 = openat2(0xffffffffffffffff, &(0x7f0000001640)='./file0\x00', &(0x7f0000001680)={0x2000, 0x8}, 0x18) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000016c0)={0x1b, 0x0, 0x0, 0xd, 0x0, 0x1, 0xfffffff7, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x1}, 0x50) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001740)={0x0, 0x6, 0x10}, 0xc) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001780)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x7f, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000001880)={0xc, 0x1d, &(0x7f0000001040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8000}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @map_fd={0x18, 0x5, 0x1, 0x0, r1}, @jmp={0x5, 0x0, 0x8, 0x5, 0xb, 0xffffffffffffff7f, 0xfffffffffffffffc}, @exit, @jmp={0x5, 0x1, 0x5, 0x7, 0x0, 0x50, 0x1}, @printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3c34000}}]}, &(0x7f0000001140)='syzkaller\x00', 0xf, 0xb9, &(0x7f0000001180)=""/185, 0x41000, 0x0, '\x00', 0x0, @fallback=0x59a2ae349d0be83e, r2, 0x8, &(0x7f0000001280)={0x3, 0x4}, 0x8, 0x10, &(0x7f00000012c0)={0x2, 0xd, 0xffffffb7, 0x400}, 0x10, r3, r4, 0x0, &(0x7f0000001800)=[0x1, r5, r6, r7, r8, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000001840), 0x10, 0x8}, 0x94) r9 = socket$nl_sock_diag(0x10, 0x3, 0x4) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0x7, &(0x7f0000001940)={0xd, 0x7, 0x1000, 0x7}, 0x10) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r2, 0x80605414, &(0x7f0000001980)) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000001a00)=r3, 0x4) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r1, 0xf507, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001d40)={r2, 0xe0, &(0x7f0000001c40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000001a80)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x7, &(0x7f0000001ac0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001b00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbe, &(0x7f0000001b40)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000001b80), &(0x7f0000001bc0), 0x8, 0x93, 0x8, 0x8, &(0x7f0000001c00)}}, 0x10) sendmsg$nl_route_sched(r10, &(0x7f0000001e40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001e00)={&(0x7f0000001d80)=@gettfilter={0x54, 0x2e, 0x100, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x7, 0xffff}, {0xd, 0x6}, {0xffe0}}, [{0x8, 0xb, 0x200}, {0x8, 0xb, 0x1}, {0x8, 0xb, 0x1}, {0x8, 0xb, 0x4}, {0x8, 0xb, 0x8}, {0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x4810) ioctl$AUTOFS_IOC_CATATONIC(r0, 0x9362, 0x0) ioctl$VHOST_VDPA_GET_DEVICE_ID(r5, 0x8004af70, &(0x7f0000001e80)) socket$nl_generic(0x10, 0x3, 0x10) renameat(r1, &(0x7f0000001ec0)='./file0\x00', r2, &(0x7f0000001f00)='./file0\x00') sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r5, &(0x7f0000002000)={&(0x7f0000001f40)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001fc0)={&(0x7f0000001f80)={0x18, 0x140e, 0x4, 0x70bd29, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x18}, 0x1, 0x0, 0x0, 0x800}, 0x884) r12 = memfd_secret(0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r5, 0x400c6615, &(0x7f0000002040)={0x0, @aes128, 0x0, @desc4}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f0000002100)={'syztnl0\x00', &(0x7f0000002080)={'ip6tnl0\x00', r11, 0x2f, 0xb, 0x1, 0x4db, 0x19, @local, @mcast2, 0x80, 0x40, 0x2, 0x2}}) r13 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002480)={0x6, 0x16, &(0x7f0000002140)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffff}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r5}}, @btf_id={0x18, 0x0, 0x3, 0x0, 0x4}, @initr0={0x18, 0x0, 0x0, 0x0, 0xffff0a27, 0x0, 0x0, 0x0, 0xfffffffb}, @map_fd={0x18, 0x4, 0x1, 0x0, r2}, @map_val={0x18, 0xb, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0xb}, @generic={0x3, 0x5, 0x7, 0x8000, 0x8}], &(0x7f0000002200)='GPL\x00', 0x9, 0x83, &(0x7f0000002240)=""/131, 0x41000, 0x30, '\x00', r11, 0x25, r1, 0x8, &(0x7f0000002300)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000002340)={0x5, 0x4, 0xb538, 0x800}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000002380)=[r6, r12, r7, r2, r8, r8], &(0x7f00000023c0)=[{0x2, 0x2, 0x4, 0xb}, {0x5, 0x5, 0x4, 0x2}, {0x3, 0x5, 0xc, 0xc}, {0x3, 0x1, 0xc, 0x9}, {0x1, 0x2, 0x2, 0x5}, {0x1, 0x5, 0x7, 0xc}, {0x0, 0x2, 0x1, 0x5}, {0x4, 0x4, 0xc, 0x8}, {0x1, 0x4, 0x0, 0xa}], 0x10, 0xc796}, 0x94) bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f0000002680)={r13, 0x0, 0xca, 0x0, &(0x7f0000002540)="c9f14ef9cec48b275c89a10ae59779020ecb0bbb2ea234b390c51671d024e3c8ca89dd90d44ea61b339e16776a401124dc487142f65327d7e2c7183edad6cbad854d72e2ea2d442c9b498885bd02f48d9fe036486f69a344aa067f9f5b3058886279ced65a35329560ed28200a87cfbca0a99e9ef3df7e2cd4d5690fff598961ad6c845bddc3e87294a295d5fb34fb19ec5bfeedb9a9226a968a4af336288ae54f518c372f662e27a7ae3949f17299e25d87537ec75b35157cef8d20854777d019e7d3c8693f099c5708", 0x0, 0x7ff, 0x0, 0x29, 0x0, &(0x7f0000002640)="135c528215ed048cc9c73f139ffdce473300fcfff18154ec2f21d6538ef26be9392e8536f87b9c6336", 0x0, 0x2, 0x0, 0x3}, 0x4c) 6.43510614s ago: executing program 4 (id=752): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}, 0x1, 0x0, 0x60000000}, 0x0) sendmsg$NL80211_CMD_GET_MPP(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}}, 0x0) 6.143010344s ago: executing program 4 (id=756): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x76a9bba1a690db0f, 0x0, 0x0, {0xa, 0x0, 0x2005}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3cb140bb}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r1 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000000080), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x4, @loopback, 0xffffffff, 0xfffffffe}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000280)="f4000900062b2c25fe80000000000000dc8b850f2323fcb11ea3548466cc00007a000000ad", 0x25}, {&(0x7f0000000600)="efbfb33c5e", 0x5}], 0x2, 0x0, 0x0, 0xff000000}, 0x0) 5.749305734s ago: executing program 4 (id=758): socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r2, 0x28, 0x1, &(0x7f0000001300)=""/4123, &(0x7f00000000c0)=0x78c) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$dri(0x0, 0x1, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000540), 0x40, 0x0) ioctl$FBIOPUTCMAP(r4, 0x4605, &(0x7f0000000080)={0x8, 0x1, &(0x7f0000000040)=[0x2], &(0x7f00000000c0), &(0x7f0000000600), 0xffffffffffffffff}) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000000240)=0x3) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f0000000000)) read$dsp(r3, &(0x7f0000000300)=""/79, 0x4f) syz_open_dev$tty20(0xc, 0x4, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$AUTOFS_IOC_CATATONIC(r5, 0x9362, 0x0) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xd}]}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x5c}}, 0x0) sendmsg$IPSET_CMD_ADD(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x44, 0x9, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x1}, @IPSET_ATTR_ADT={0x14, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_ETHER={0xa, 0x11, @local}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x44000) syz_usb_connect(0x5, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x9, 0x6d, 0x5c, 0x40, 0x2304, 0x23e, 0xd769, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xd9, 0x0, 0x0, 0x37, 0x10, 0xeb}}]}}]}}, 0x0) r7 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000100)={@mcast1, 0x0, 0x0, 0x1, 0x5, 0x4010}, 0x20) ioctl$IMCLEAR_L2(0xffffffffffffffff, 0x80044946, &(0x7f00000000c0)=0x9b) pwritev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f0000000380)='\f', 0xfff5}], 0x1, 0x5, 0xb2) 5.374543938s ago: executing program 2 (id=761): socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x48, &(0x7f0000000380)=ANY=[@ANYBLOB="0809000000000000c91000000000000000000000000000000001072800000000080104100400000000000000070000000000000002000000002000000600000000000004c910fe8000000000000000000000000000bb0000b761df8c770e527fa200c236bf977aac1cbc0fa60f73ffbf751422f1de884ace3cfaf035406f8d7a8dd2c14da625e221701d336e5d539409b9c5d3a960ac6e85c3c93d484b84c75fa7910998e476286db9f83941c93465f51d03ae8e5cad77be8b3696c638dc7767"], 0x58) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x3, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r3, 0x9, 0x1, &(0x7f0000001300)=""/4123, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r4 = socket(0x26, 0x3, 0x101) setsockopt$MRT6_ADD_MFC_PROXY(r4, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, {0xa, 0x0, 0x0, @empty}, 0xfffd, {[0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x4]}}, 0x5c) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$dri(0x0, 0x1, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000540), 0x40, 0x0) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_CONNECT(r6, &(0x7f0000000740)={0x6, 0x118, 0xfa00, {{0x1, 0x8, "4ca4625e00b5aa95a443d782d859cb2df816a3bc9bd3bf1d11d8b4a7ba9fc6dfb72a8a253215874b349abc806123fd11b1d23eb79cf0385a4cd78694621f0b26b593bbccdfdf13db1591568ce14c99b5b462555908260a0e7c7c33fc1ba12df6d0d8fc11847c4b29bd4752fa2767e26e11475a905215a4d1cfb8a8cc88d605e68145d97c3c2836b7d85d47a8ca52fe5b7c2083596186c5b4e98f1052759d2233c3fb1e62e4333f0898f89b770b6abe57c92ba6f0e1c64a714686c6f22f7c8f6f79ee56c56d09e95001654229a197d0462e6f00000000000000000000000000000000000000000800", 0x34, 0x4, 0x5, 0xf, 0x2d, 0x0, 0xe, 0x1}, r7}}, 0x120) r8 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_TRANSLATE(r8, 0xc018ae85, &(0x7f00000001c0)={0x80a0000, 0x6000, 0x4, 0x10, 0x9}) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, &(0x7f0000000240)=0x3) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f0000000000)) syz_open_dev$sndmidi(0x0, 0x2, 0x145101) r9 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="021608030500000073bd7000fddbdf2502000100000004d600000000000000000000000000000002"], 0x28}}, 0x4) 4.434711849s ago: executing program 1 (id=762): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x87, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x0, 0x0, 0x8001, 0x0, 0xaf, 0x0, 0xfffffe0000000001, 0x7, 0xffffffff}, 0x0) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f00000006c0)=@security={'security\x00', 0xe, 0x4, 0x290, 0xffffffff, 0xdc, 0xdc, 0xdc, 0xffffffff, 0xffffffff, 0x26c, 0x26c, 0x26c, 0xffffffff, 0x4, 0x0, {[{{@ip={@multicast2, @rand_addr=0x64010101, 0xffffffff, 0xff, 'wg0\x00', 'team0\x00', {}, {0xff}, 0x33, 0x1, 0x11}, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x1ff, 0x1}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0xebfc88fc6af3c5ee, 0x3, 0x0, 0x7, 0x7, 0x4], 0x9, 0x2}, {0x2, [0x1, 0x4, 0x7, 0x4, 0x3, 0x1], 0x3, 0x5}}}}, {{@ip={@remote, @rand_addr=0x3, 0xff, 0xff000000, 'macvlan0\x00', 'macvtap0\x00', {0xff}, {}, 0x32, 0x2, 0x80}, 0x0, 0x70, 0x94}, @common=@inet=@TCPMSS={0x24, 'TCPMSS\x00', 0x0, {0x4}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x2ec) r6 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r6, &(0x7f0000000080)={0x1d, r4, 0x1, {0x0, 0xff, 0x2}, 0xff}, 0x18) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x200000800000, 0xfffffffffffffffc}, {0x0, 0xa00, 0x4, 0x800000000000002}, 0x0, 0x0, 0x1, 0x1, 0x2, 0x2}}, 0xb8}}, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@updpolicy={0xc4, 0x19, 0x1, 0xfffffffc, 0x0, {{@in=@dev={0xac, 0x14, 0x14, 0x2c}, @in6=@local, 0x4e22, 0x0, 0x4e24, 0x0, 0xa, 0x0, 0x60}, {0x0, 0x1000000000000401, 0xfffffffffffffffe, 0x40000000, 0x0, 0x1a, 0x1, 0xfffffffffffffffe}, {0x7a, 0x5, 0x0, 0x7fff}, 0x8, 0x0, 0x1, 0x0, 0x3}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xc4}}, 0x8044) sendto$inet6(r7, &(0x7f0000000240)="c8", 0x1, 0x51, &(0x7f0000000080)={0xa, 0x3, 0x1, @dev={0xfe, 0x80, '\x00', 0x36}, 0x9}, 0x1c) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r2, 0x8982, &(0x7f00000001c0)={0x1, 'tunl0\x00', {}, 0x7}) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0cc5605, &(0x7f00000000c0)={0x1, @pix={0x0, 0x0, 0x35315258, 0x0, 0x0, 0x0, 0x7, 0x400}}) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000002500010325bd7000fcffffff110000000800030047"], 0x1c}, 0x1, 0x0, 0x0, 0x2004c0d3}, 0x200040c4) 3.931658358s ago: executing program 2 (id=764): ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x6}}, './file0\x00'}) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x95a, 0x101, 0xf929, 0x4, 0xe}, 0x14) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0086426, &(0x7f00000000c0)={0x8, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {0x0}, {0x0}, {}]}) ioctl$DRM_IOCTL_RM_CTX(r0, 0xc0086421, &(0x7f0000000100)={r1, 0x1}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x37, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6e27, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xffff}, @call={0x85, 0x0, 0x0, 0x3e}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x3}, @ldst={0x1, 0x0, 0x4, 0x4, 0x9, 0x18, 0xfffffffffffffffc}, @printk={@ld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8}}, @alu={0x4, 0x1, 0x1, 0x4, 0x2, 0x1, 0xfffffffffffffffe}, @map_idx_val={0x18, 0x5, 0x6, 0x0, 0xb, 0x0, 0x0, 0x0, 0x1ff}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}, @map_fd={0x18, 0x13, 0x1, 0x0, r0}, @printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x7}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000300)='GPL\x00', 0x4, 0xc9, &(0x7f0000000340)=""/201, 0x41100, 0x30, '\x00', 0x0, 0x25, r0, 0x8, &(0x7f0000000440)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000480)={0x3, 0x5, 0xb, 0x401}, 0x10, 0x0, 0x0, 0x3, 0x0, &(0x7f00000004c0)=[{0x2, 0x4, 0x10, 0x8}, {0x1, 0x5, 0x7, 0xb}, {0x0, 0x5, 0xc, 0x1}], 0x10, 0xffffff15}, 0x94) r3 = socket$l2tp(0x2, 0x2, 0x73) connect$l2tp(r3, &(0x7f00000005c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, 0x10) r4 = openat$mice(0xffffff9c, &(0x7f0000000600), 0x2001) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000640)={0x0, 0x1, r4}) r5 = socket(0x26, 0x6, 0x9) ioctl$FS_IOC_ENABLE_VERITY(r5, 0x40806685, &(0x7f0000000780)={0x1, 0x1, 0x1000, 0x21, &(0x7f0000000680)="df591d77dcebb5ef6837b4ca12d2cf6943748207e1f0d76a9c1aca181bd8afff09", 0x98, 0x0, &(0x7f00000006c0)="f81535897f48eb883ea43d24a5318cd1cc40d3925f3a6257bf533d75fa874366aecd73863c4c205abfd7aa1a0ccdba4eb742b26a6be36373e2ac4f595e151468552a9080e0d9d94f8836f3e07ac7dce030d32fb06deea632362dd16be8daeb8a0b28a4c3eda0e5b5d3d87b015316402f8bf59697c5fab9bd1d7759dcaa9f1de85b6d1b858e895099ca0d4dabe8e91eecef52c2adc4b72a15"}) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000900)={&(0x7f0000000840)={0xbc, 0x3ed, 0x2, 0x70bd2a, 0x25dfdbfd, "3a46d71b0cd620f0c64bdae9bf41be3aaf95d377b5374f5f5dbd18743d9ffe023f07040e5c2efcc5e405304b9a909cb67fa7c34d69dcab6a5e5ac3de464511f3bdc2170a4383e330c2e74c39cd766332a26db25e4c7dbf90387483b723a9d8fd5b6ea9c6fba8eacef471246565fd50457315f1def1d194bc962ea0e8db402c341ff5919511a918420f6cb691d5dabb19dad4a60a3042ccf66b16938c9ce49b5ea3e4db5dea706733294d", [""]}, 0xbc}, 0x1, 0x0, 0x0, 0x4000000}, 0x2060800) sendmsg(r0, &(0x7f0000000e80)={&(0x7f0000000980)=@nl=@unspec, 0x80, &(0x7f0000000d00)=[{&(0x7f0000000a00)="198e512630a67dd64cf5053e95a50dee8cfafaa1c36c8435d585f50e4dba58f3a6c586ba451cbc37da5fe1715a4393c7f5d6e950ee0d056742c68340f7cf80a5525c6b0c1cba745a1ffb26a305f35c53ec128097ee22eede779dc11e5fb77a2adbd6a7b3abe67c229404b026e1d43855677776e139fe5e99936b338079b7c77a964e34c07bcfb31930396ee802cffbcd216784a1b5f22299e88f77fe05e4363f0e24529203be82752d3028055a16a59ba68f6698e45d5e480e25f65f2eafdcc1331abe6bc0933872b32e0f5d26531ccb0a9aa83a38bd28b5679e76763a974dc7278666", 0xe3}, {&(0x7f0000000b00)="fa45f5be763f553cb7f66f6df5aaad3a7153fc96236088dce38c08afb89689a2bd2618f27e4a37e31bce6c4f8231a0f8825e072024b5ac844c4024bacb66899d580e40fd29b9fced9f0ec77f40880d5c5cebc3cff6783654fc51e46c30c5fa8d2aeec3afe208ce801f1a6f60a916f506d9604a71bed468bc1e726f762ec1", 0x7e}, {&(0x7f0000000b80)="348236ca7705f294d2c6dfe39bc8d22aa48466eefbb7501c482a128c7e90b32f09d3da424e8c4fd7b840e2291e80bc8eedc8c60ce59e3a1e5b2ade7ff8df55f125d8ef93855b33e1fc2313559d2d945b39f4d4f4766e36c10ffa015344de296e5205d03c01a2b1930c841a66f83837f76b1520e16eaaa312ac037f1e5f5de2952611d5483d71e3821bbc98abcc270bcf40b90ab0543026d1748d9d0ede86ee66a572f128b87232f4259b74664a6c635dd600ed99887b7ab0123982e20ecd8593e101ebfb829f1cec7f6a72cd", 0xcc}, {&(0x7f0000000c80)="e44a12f9151950989d36595720ad3e12a1b15cb9edeff74f7affba2297bc6eb750f2db8d06ed4a4c6438a9c087dabd72dd26564fb0537a76aaab6c6a17f12e9efba1b9774517325ee63a984d9a29b7840a040365d7483e4b17111e14637b8b961a71d0561a391d0df5", 0x69}], 0x4, &(0x7f0000000d40)=[{0x20, 0x117, 0x2, "d9fa8d0a6eab766e1bcd3468c29a0df23dd6"}, {0xfc, 0x108, 0x3, "3da5fbd64aa78c298771e38c433dc302bd3951b6b96a2b2a5bb9dbe2c8eb5028a48309e33da67133148821d452807c7db588d34d22a82291400e2bae8baa80fc71e10f0b6ad5c27704f435f23be43675ca695056684ef327405adf26dda5d61005104ac0db9746baade1bd1accf63bfa7f78623619ece41306d135da4016afd90888396b56088e0ca44f01cee8af669e487f1a75cbdbdb82af73b9215f2bdd69e55ad73ed1661ad0872bf228d23fd0e4467a045cd8c7b7cf6537d0a18e87ad3b9fe3304104d26daeb9d9d5a8851470ced4f9dd0e9d3b9cfb7e4fd95d08b585dd21b35fe9ba3d28648bbec2e44cb355"}], 0x11c}, 0x11) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000ec0)='cubic', 0x5) ioctl$DRM_IOCTL_GET_CTX(r4, 0xc0086423, &(0x7f0000000f00)={r2, 0x1}) write$UHID_INPUT(r4, &(0x7f0000000f40)={0x8, {"129381002a43a5546d480d2f8103a446a495ab5843e6e374d165577d422ce5bd795838141caa373c46076bf307fb5b7842a753175dd510eb31e67ef464ee434a39cc411bfd621c4ccfc7b5d41a9c08a0abb19d5ce50f5668e3b9dd6a91277c1ca9b32d87bd4f55d99070378da8c00177f615bd2584bc02dd567fe352b9817953526939bfad6621d2d042fca479c446214232faec0a73d1bf35b5fc81daa108c605da8713bb27c5cc88c1e9d55e173b571e160b471559a8616a28a0a9361e75d12412997f562ad9abb1d0fb3e487aa3d867998d9b2e308abb2fe5a44472cb0c417137df1d15deb352a12e74dffd3d780ecb9f8e7b0a5ae417edf639a6ecfbbb3718fbcbb150b704c20858c342a2ab67704788029cce5fac68ef7b3a4b05dfc176116c963002fad62119cc3ca225ce556c2e5de57c51dfacf47697bd245d3326b6311e8a1b03adfeb56f3acabc9ad52157d25aa0939b79e0d1d4a314d77c3d2d49afd7602907660cc74af2c5473f549f8110dea5696bf4c41f42e0c79fdb9be841d1d63b9bca5acc07eda140bee9ff3b26350f8406b6e860a04a327816905dd74df3770d3a03ba4cda486f20538969adad1506a86fc321c60e4ca237b4b1399aeacad7376a73f2c38ebb4166711050eefcfd163a6cbf270f2026b52cd305004a0810373a1c22db6b299e6027a817df79c61a46df653285ac874c7f3d121b9a39f65da4fd97308f3805ca4cdff3e3145f46f5dadf1864a619246acc2b923a0fa8e80cb4183685d0164bf5028e1f1cae035e2d77fc69df51362c4dba7e620a148591801dd125ee987589f4fe76c3b580a0323b097a2972dcc6ed66d8e2e8189c7133eb535bcbd641ce4d1ae2d395db2083d2df5a2fa40febdadd2da1700774251118d949f3c213a3300a27aed4cf9b37142ae924ee9970db46feee6b96a4ad2d4975f2762a8168d2353068000693b399fe83ff91d4f34a5a222f9325d9b27a06855760438d66be18fa567f8330df75b2b0910087fdbb2775d01a0e9e9320f289a4406637d6e8d2e0f9df622359a6974c228c3b0a24458ff49aa1df9be1014a20a67ea0a15a9a8df852344935559b2a56f1570d69ec12f1d8f0a32e6af6151158e684598f5a36423e52caf4650a730cdde81082995047660f8c45319a4700eb29ef75950d95114892a3d75bc29a7ca0822250310f98dc80d3b0637f2da462bf70b7b82e07bacbe0779fcf45291b8594800db8bcedf02a2a82aabdc8552dd8749c97953e758b329ee50df4a96a4495d5c9923f76bec545a2c097a6a2e4d23102c1ee45497340f1476f90b538b927317ace851bd09309c6fb48a409d47cd883d0e0e2ad5b5fbadb5957226c22586d19061987963606acf95a82383d3646230c7b5df481673c22c816f37cbebc4e5d7d1f2eafda50eb3d8cd132814412db3aea036f991503484528ffdbcee311ffee6b6af8cdbc8549111dbc53069ed780ea06d4c441bc2f44d45f05b567abe495dc0666ff55e39b93fb195d515e788021390f7456e6f948bcb57322d2392ba558435ee064ef0abb7573c797f41af05698d4b516d97980f52ea6c96bb8d97baf5f2087771eb7ad930e1f1f71fa9b099b70bb55943d69196dd42475fa40ce9fbf57744a8778fac40c3adf6a84d4125aaf28cd4eaa5a5b135d47e4b4de17498ba418a887b2a3f4294ec39db3ce0d5cf68e1ba140ceeb02716f2c5ee008c996bfeca712b3a453b3c2088b04c9c73434500e9360e13f173261df29c8c09c8a8c5feb0b15be438f88dda655d593a35df16b2a52f20aab69a4a2507b6da55f0662e945196eed8302f399a6d83b9083220a6208eab16871f04f2e0013afcf36b6a98622075f5fb8855541432dfffbd4d6cf754a78b5cf900b40bc1b717ccdf95731c09cd9c7d15b96e321036c024467bd7418c6875a8d7e87e390ac160f00bfe9286325ab33fe0c083186e9e14198a25c5b07e6a57532e05ea3103ced44615ec3c4906fa5e4c8337c4debb2bd1c8b858686003a0658607377ed90d2a24b27fc28ac6d1c4aa56dd1cdab8c22f62364888e7bc9b9497b67f8695c2330098f7d2a6ddca120a9a036c0dba4be5f5f568963b2875f141980874f3be9f13794bda2aed429deba532935aad156a820a56e6a8034312f44bd3d188031d5d151e6471c0234122a2451846cd830847536594168ee041036661d9c3ece66b04ef961b395e7a58f2dbb7504b782f9868534ac0d0a526ef4e0cc4513dbbcac07bc7e66f516ef51948bc3a7f6d4fe3fe591a858fe4d007b9c439cd6c4cb40f5abe66a4995012035a08518b5f2c4854c4369dabd33cb54c688ffe310b208c24ec461cabe41464d0908409cc2abdc3236423ea43806a2b3bc3c44b1a8b5581f1a7595a768303e5dbeb12c587d6539c46381a9054569e21b17180305f0ffbb474a4da0bac9bf8f1c61092a29dad0f386af17ef3150280078c6777812dcff35732af4119383d450c9315247b6896407ff4a00f52b17fe4277c02ed80787a1d39006e4b4f0045a4c82cac0d647ed45efbb755b2395ee99152a5f2aa046c6925258dba1f4a19539493184c3fcde79d140928128b9d9fd2a7bc91cf69dc01b5743cfb45a66aefd6daa94dfcddfebe204566a458aad1254fa9973e1bdbedeb6b2a13da2e2350c15fe5e546364e15d0ac348cd348e52bfa6d918242b97a970c91e63b5d57a437c8a8d6982fd4cab06436f6a8d178f088ecaba161c1d7f52b951913be773f25db0210500f9e47dd81e787a10ee023b7902aaad97fcd2d778b3b30be3c0a8f42ebf154529cc447a3eaf39ee0cc379d13782fc6162eb7868efcf9e0cb05129c054dc76b187c43c56e71df6a432b1c115a7ceaf0e59d750328c4e0fe9d77eeddad298773ffb6a232e4b23acf572a13c9206aa1468e2dbfd947a1fc3543d5917988c2d246cc48207014b4ae6fc532efc9a0053f71e9cfcb9e4d8165e00207c7b72604d97a0d94ff2fab1f1ea510214265d7a0b1d67eddfc60e129d29fa85883f16db945970fdcd860ce11062228ad1c217188f4e7ded63649acafff94991af7d8387b3723bc1beb358521e7481a05d3c5aaef08994dfd877de19f11a1e2c1794d40e6e84e1a968b0a842faaf268f7bcd049ab6ae6f057c96281aaee343ba069ae9a6c398accdcd9d57ef2ea57891300411cfecf3e099ef55445d4e6141b15a88da9cf5c342af6bf4b905b27b7a3fe79468658ce318644401810890d24fc44d2756bd10feee6c18897c8a09b348ae3b0096df17025a5b128226333b22673cbdeedc4dcf6aa48543e427bd54efb6dbed7107cadc5625e48afa7f1327491b707d230d2d842847e8ce4e009a617a65006b7d719e784bd9179a7ecb013992bde208f9da4d7f666aeab89f9c55ffe218b6fae363acc92d6e9b5cf82752a8a2b57a6673b7b8adc998af7227617843d03adb13d8375d84deee04ddb451196d75b75055b8a209ac5d3429bfa656cafbf6718972a242e662691d558b256e87f8ac5164325e0311b0b50dc368e0788524722b11ef94eca84c9cb0d0f86446c7b94c092d66aa488d59795d63973c004ba1becccfc9ea906967b0da5fcceb46725743b662b2d9f1188792e41249c1daa0810ae33ec788a15967bd96ea3fef022f3e15970956302e55f45d2b279f8cc1d56d2a2e2bb68f265f4931cc8ffeacd4f75c61a00705aec5e4408eddea20e1e19d0acb7ccd3193cbdbdd93821f3801da4eaa4b52e4ed464f0916b746443bc8c9eead2e055e1e9aff8462e74845e84c19bc18542072ce937090d035f1f1a35d437138a5f6e37700740bafcc66946856ff77d644f1b757863884f424b73df7d8664203bf77cb76b232ae27144b13f0cdb8f4f3f67bf9c9887dd640d366ebdc97077fe91b372327497792602da2702802ab777f6d04da8f721ba01b875e6e8451b7643b3aec6669c1593817ee5935da7555f265bfebe3649df8ffee49594210752d41227ed33230b774a8c7f69860a971db8883c4c5e9d8b12e64f1138b638897de30d5b6a6c70d67ff1a48d5f71b7ce3ea0f37afdb89b3912b1c238ce03884b7b18672d7a0879c6d1352c859f321eba2ea71705a90c9f58850dbdacbff9ba9b48ce402f3f98de48326670c701258c762fc0411156bc34dfbe8cfee066d8b2a100a6eaccf300de3d55d4ce6f51a7ceb23716abb54157407842ef833f7b435e269f160f13c445c34c924b1cfce3c52bbc3da9fd5c1a17fc45100b11491fe03b38d23b8d70bad76dd2c344703ae6fc3e303eab0219f969d96de02255cf8dd14978a7bee48b94917b2c6cfa07e0a8b3b23d66a25daf38b411f0ccb05964b1718db314051e8d6495d85a6845a680b9ee5677ffc26ed73e2069133c8255dd4b9014121f600fbaed6b47ec5597b01a2e483c8ce5e987cdfe30c7255f55894a5398f577d2e8bce037ea57343fa93ccfdecac23cb2a09ca293a53618d869ae4ac6c3ce3c5426b7b5498575296e2b79971b63f8aabe4caf999fc4fbd12d91bc53797b2e58837692f40412152745a3101bb966b37fe0766cf4dd735bca8ba9edac4df3b5ecdc17b3637214707d2600b8bb617ec36bdb89bab442032a284d33b681613771b85b187cddb20bf1ac4d562995dd6e750cc493c0cf77e7c094dbd057df5a012212775235518820d9e0ae9b1f1c28c466b970151333970a19deb4ac4c53647831489186ee452be02f451bbf219e15f08e59426334763d012e6037cc52ecff67a7d6ffee64124970a4f08c628530045e204ec99756eff8965269a6675025f1068d47f339ad269464dcecb8e0c47eddb1405ad6f944ab9e6e2426b43e8dc263ffc21510c4d879e5c6a0bd6364d917d0d16adbf4ec52f403d710881fbd3cb24d43ed669dbb980a06109b7bd2d22f0bd531496cf976f190bc9f5b27e907dbee1f31a23e9857a3e70d573a3d0fb82f8cde5cbdd483e31d5c70117d057ad3bd78b51c0a0c2a1ba8ea4d104b6c8ebdfab7b6fdad9178ac39d399e6eba0294c46906e801f75a3bf50b3c056152679aa4fb97728b36929131776b8c8a91cc021da9a5f76fb05cf7f38d7796a46bc29c1a9301890346ee29ee3085d28353f403d08318e51295084cfd3ff5daad3f1b4b80739d92da7e671f2085d8c22de9512e22213015dd6c7fdbe12fb8173c2bf63ae57f8e9b343e3fa40d8d5eab655999d124585e05b64545fe576b94166c89c7c6abf47b0ba77b1e77f9c06aa4ed9ed3fb94224b7e4f37a4bf497406f5bb3762fcfc75afa89c0c3502589863acd35fac15c1c72a4cab91c55a667297b03c38ad125d7baa8e17e54df250a378c43601296be02f650ac89120b3ba856e1e53adb20e46ac8ecadc6b858c9b548bf48f178fe3b117432e54621181b903df5af1e215349580ff722000ffc10b42e272c20a0c057468dbd2d058f70dc86999b3935cf2d88ed4c0922e2c68f8a337aea939283efd0530a679a488f876f7c95144ed4829579d2d5aff35dfde4458f5bd71e4fbfc20c87614b0b401f48a753808e56038d2031fe5ae7780746ed10e1aa05ab42876bb001cc711afbe57ae88604c619fb6158beb06b767eb4a6b7846bb3ba6fd70058cf57bebf588177a04b91e5774f4f665fc4e95682d823bd11a2e49fe6b1c559ed8fe5b86177d1c40cfd4c1deb17a9fedb95caea33e51580059a51f597af3a87c96ee83baa7b068f29a7aef00e3cf0d3777fc5d3d7bb787dfe6e3fbc3df27d5a886da6b80cda046473e0c3bb694ab4c44b1d46e6a57c423fa809ac4cdd40d707393f3", 0x1000}}, 0x1006) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000001f80)={0x0, 0x80000}) listxattr(&(0x7f0000001fc0)='./file0\x00', &(0x7f0000002000)=""/38, 0x26) r6 = getpgrp(0x0) ioctl$BINDER_GET_FROZEN_INFO(r4, 0xc00c620f, &(0x7f0000002040)={r6}) ioctl$FS_IOC_GETVERSION(r0, 0x80047601, &(0x7f0000002080)) openat$ttyS3(0xffffff9c, &(0x7f00000020c0), 0x6002, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000002100)='team0\x00', 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$inet(r0, &(0x7f0000002140)={0x2, 0x4e23, @local}, 0x10) ioctl$sock_inet_SIOCSIFNETMASK(r7, 0x891c, &(0x7f0000002180)={'veth1_virt_wifi\x00', {0x2, 0x4e23, @local}}) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002200), r0) getsockopt$inet_mreqn(r5, 0x0, 0x20, &(0x7f0000002240)={@local, @loopback, 0x0}, &(0x7f0000002280)=0xc) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000022c0)={'batadv_slave_1\x00', 0x0}) sendmsg$ETHTOOL_MSG_WOL_GET(r0, &(0x7f0000002580)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000002540)={&(0x7f0000002480)={0x90, r8, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@HEADER={0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x20040851}, 0x800) 3.927729869s ago: executing program 3 (id=765): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000010000)=[{{&(0x7f0000000000)={0xa, 0x4e20, 0x7, @remote, 0x5}, 0x1c, 0x0}}, {{&(0x7f0000001540)={0xa, 0x4e21, 0x8, @mcast2, 0x5}, 0x1c, 0x0, 0x0, &(0x7f0000002940)}}], 0x2, 0x4000) 3.805771565s ago: executing program 3 (id=766): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) mq_open(0x0, 0x0, 0x0, &(0x7f0000000180)={0x8001}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000240), 0xd21, 0x4000) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42800) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x40f00, 0x46, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000880)={0x30, 0x40, 0x119, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0xc, 0x142, 0x0, 0x1, [@typed={0x8, 0x9, 0x0, 0x0, @u32=0x2892348f}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x4, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x48814}, 0xc000) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) r4 = syz_clone(0x100011, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) wait4(r4, 0x0, 0x0, &(0x7f0000001140)) keyctl$dh_compute(0x17, &(0x7f0000000040), 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) socketpair$unix(0x1, 0x1, 0x0, 0x0) 3.169489896s ago: executing program 2 (id=768): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x2, 0x57fc02) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@newqdisc={0x24, 0x29, 0xa19702d202eff97b, 0x70bd2d, 0xfffffdfc, {0x0, 0x0, 0x0, r2, {0x0, 0x8100}, {0xffff, 0xffff}, {0x0, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x40400dc}, 0x4000080) ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000100)=""/204) r3 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x400, 0x2}, &(0x7f0000000100), &(0x7f0000000080)) io_uring_register$IORING_REGISTER_PBUF_RING(r3, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) io_uring_register$IORING_REGISTER_PBUF_STATUS(r3, 0x1a, &(0x7f0000000140), 0x1) io_setup(0x10001, &(0x7f0000000140)) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(des-generic)\x00'}, 0x4d) 3.09652017s ago: executing program 0 (id=769): r0 = socket$inet_udp(0x2, 0x2, 0x0) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000400)) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x248, 0xd8, 0x11, 0x148, 0x1b4, 0x0, 0x1b4, 0x2a8, 0x2a8, 0x1b4, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr=0x64010102, @multicast2, 0x0, 0xff000000, 'wg1\x00', 'dvmrp0\x00', {}, {0xff}, 0x67, 0x3, 0x2}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1f, 0x9, 0x8, 0x8, '\x00', 'syz1\x00', {0x2}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0xffffffff, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xb8, 0xdc, 0x0, {}, [@common=@ttl={{0x24}, {0x2, 0x40}}, @inet=@rpfilter={{0x24}, {0x18}}]}, @common=@unspec=@STANDARD={0x24, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x2a4) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_LOOPBACK(r2, 0x65, 0x3, &(0x7f0000000300)=0x1, 0x4) socket$inet_udp(0x2, 0x2, 0x0) (async) pipe2$watch_queue(&(0x7f00000002c0), 0x80) (async) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000400)) (async) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x248, 0xd8, 0x11, 0x148, 0x1b4, 0x0, 0x1b4, 0x2a8, 0x2a8, 0x1b4, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr=0x64010102, @multicast2, 0x0, 0xff000000, 'wg1\x00', 'dvmrp0\x00', {}, {0xff}, 0x67, 0x3, 0x2}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1f, 0x9, 0x8, 0x8, '\x00', 'syz1\x00', {0x2}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0xffffffff, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xb8, 0xdc, 0x0, {}, [@common=@ttl={{0x24}, {0x2, 0x40}}, @inet=@rpfilter={{0x24}, {0x18}}]}, @common=@unspec=@STANDARD={0x24, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x2a4) (async) socket$can_raw(0x1d, 0x3, 0x1) (async) setsockopt$CAN_RAW_LOOPBACK(r2, 0x65, 0x3, &(0x7f0000000300)=0x1, 0x4) (async) 2.935343958s ago: executing program 2 (id=770): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r1, 0x7}}, 0x48) 2.917364975s ago: executing program 1 (id=771): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000bc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) poll(&(0x7f0000000280)=[{r1, 0x2188}], 0x1, 0x8001) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0xfcffffff, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 2.633601434s ago: executing program 0 (id=772): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="020300030f00000000070000000000000a000900e000000001d78771b90bd8a3b4914783c58777003d5b9538a9d03e6e9bfdac5500000000030006000000000002008e34000000000000000000000000020001000000000000000a1600000000030005000000000002"], 0x78}, 0x1, 0x7}, 0x0) 2.571057262s ago: executing program 2 (id=773): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x87, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000480)="d25a9850a9a91163f76c5357f3bbadf2656e10d77f85d1028e60ab", 0x1b, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f00000006c0)=@security={'security\x00', 0xe, 0x4, 0x290, 0xffffffff, 0xdc, 0xdc, 0xdc, 0xffffffff, 0xffffffff, 0x26c, 0x26c, 0x26c, 0xffffffff, 0x4, 0x0, {[{{@ip={@multicast2, @rand_addr=0x64010101, 0xffffffff, 0xff, 'wg0\x00', 'team0\x00', {}, {0xff}, 0x33, 0x1, 0x11}, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x1ff, 0x1}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0xebfc88fc6af3c5ee, 0x3, 0x0, 0x7, 0x7, 0x4], 0x9, 0x2}, {0x2, [0x1, 0x4, 0x7, 0x4, 0x3, 0x1], 0x3, 0x5}}}}, {{@ip={@remote, @rand_addr=0x3, 0xff, 0xff000000, 'macvlan0\x00', 'macvtap0\x00', {0xff}, {}, 0x32, 0x2, 0x80}, 0x0, 0x70, 0x94}, @common=@inet=@TCPMSS={0x24, 'TCPMSS\x00', 0x0, {0x4}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x2ec) r6 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r6, &(0x7f0000000080)={0x1d, r4, 0x1, {0x0, 0xff, 0x2}, 0xff}, 0x18) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x200000800000, 0xfffffffffffffffc}, {0x0, 0xa00, 0x4, 0x800000000000002}, 0x0, 0x0, 0x1, 0x1, 0x2, 0x2}}, 0xb8}}, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@updpolicy={0xc4, 0x19, 0x1, 0xfffffffc, 0x0, {{@in=@dev={0xac, 0x14, 0x14, 0x2c}, @in6=@local, 0x4e22, 0x0, 0x4e24, 0x0, 0xa, 0x0, 0x60}, {0x0, 0x1000000000000401, 0xfffffffffffffffe, 0x40000000, 0x0, 0x1a, 0x1, 0xfffffffffffffffe}, {0x7a, 0x5, 0x0, 0x7fff}, 0x8, 0x0, 0x1, 0x0, 0x3}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xc4}}, 0x8044) sendto$inet6(r7, &(0x7f0000000240)="c8", 0x1, 0x51, &(0x7f0000000080)={0xa, 0x3, 0x1, @dev={0xfe, 0x80, '\x00', 0x36}, 0x9}, 0x1c) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r2, 0x8982, &(0x7f00000001c0)={0x1, 'tunl0\x00', {}, 0x7}) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0cc5605, &(0x7f00000000c0)={0x1, @pix={0x0, 0x0, 0x35315258, 0x0, 0x0, 0x0, 0x7, 0x400}}) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000002500010325bd7000fcffffff110000000800030047"], 0x1c}, 0x1, 0x0, 0x0, 0x2004c0d3}, 0x200040c4) 2.4230606s ago: executing program 0 (id=774): r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_io_uring_setup(0x4795, &(0x7f00000003c0)={0x0, 0x277b, 0x20, 0x3, 0x2c0, 0x0, r0}, 0x0, &(0x7f00000001c0)) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x20000080) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x1, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x30, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x9, 0x3000000}, {}, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x4000) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 1.97144751s ago: executing program 0 (id=775): r0 = openat$tun(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000002280)={'pim6reg0\x00', 0x2102}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000080)={'nicvf0\x00', 0x400}) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000e3a000/0x2000)=nil, 0x2000, 0x17) madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x8) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000280)='2', 0x1}], 0x1) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)=0x8) 1.818913775s ago: executing program 1 (id=776): r0 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000001340)=@hci={0x1f, 0x5865, 0x31}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000040)="b8b2821400000081000000008100", 0xe}], 0x1}, 0x4000080) (fail_nth: 5) 1.043096479s ago: executing program 0 (id=777): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) fsopen(0x0, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @broadcast}, 0x10) close(0x3) socket$igmp(0x2, 0x3, 0x2) ioctl$PPPIOCSACTIVE(0xffffffffffffffff, 0x40107446, 0x0) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000006000008001b"], 0x30}}, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f00000000c0)=0x7fff, 0x4) sendto(r1, &(0x7f00000002c0)='%', 0x300000, 0x0, 0x0, 0x0) 1.042729992s ago: executing program 1 (id=778): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) fsopen(0x0, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @broadcast}, 0x10) close(0x3) socket$igmp(0x2, 0x3, 0x2) ioctl$PPPIOCSACTIVE(0xffffffffffffffff, 0x40107446, 0x0) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000006000008001b"], 0x30}}, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f00000000c0)=0x7fff, 0x4) sendto(r1, &(0x7f00000002c0)='%', 0x300000, 0x0, 0x0, 0x0) (fail_nth: 1) 748.262208ms ago: executing program 2 (id=779): r0 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f000028d000/0x2000)=nil, 0x2000, 0xb635773f06ebbee0, 0x8031, r0, 0x3000) setsockopt$sock_timeval(r0, 0x1, 0x43, &(0x7f0000000000)={0x0, 0x2710}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0xa, &(0x7f0000000200)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x300) 687.923151ms ago: executing program 4 (id=780): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/resume', 0x141a82, 0x2) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000080)=[@in6={0xa, 0x4e20, 0x7, @empty, 0xf}, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e20, @multicast2}, @in={0x2, 0x4e24, @remote}, @in6={0xa, 0x4e24, 0x0, @loopback, 0x1}, @in={0x2, 0x4e22, @rand_addr=0x64010101}], 0x78) write$cgroup_int(r0, &(0x7f0000000040)=0x7ff, 0x12) 427.192026ms ago: executing program 1 (id=781): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="ad56b6c5823cae9d6dcd3292ea54c7be", 0x20) 250.473586ms ago: executing program 4 (id=782): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x20004, r0, 0x2}) r3 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_GEM_FLINK(r3, 0xc008640a, &(0x7f0000000300)={r4}) ioctl$DRM_IOCTL_GEM_FLINK(r3, 0xc00864d2, &(0x7f00000001c0)={r4}) 221.168913ms ago: executing program 1 (id=783): r0 = syz_usb_connect(0x1, 0x24, &(0x7f0000000000)=ANY=[@ANYRES8=0x0], 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000080)={@mcast1, @ipv4={'\x00', '\xff\xff', @local}, @dev={0xfe, 0x80, '\x00', 0x38}, 0x0, 0x9, 0x0, 0x0, 0x1, 0xbe37142ed522cf92}) (async) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000080)={@mcast1, @ipv4={'\x00', '\xff\xff', @local}, @dev={0xfe, 0x80, '\x00', 0x38}, 0x0, 0x9, 0x0, 0x0, 0x1, 0xbe37142ed522cf92}) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="00000100000012"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="00000100000012"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$vicodec0(0xffffff9c, &(0x7f0000000100), 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_udp_int(r3, 0x11, 0xb, &(0x7f0000000200)=0x6, 0x4) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x4e24, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000300)={@local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x68, 0x0, 0x0, 0x88, 0x0, @remote, @local}, {0xfffe, 0x4e24, 0x4d, 0x0, @wg=@initiation={0x1, 0x4, "497a1d08fd3d0ee007022798bb6374ed840b4f36f41fc4d035e9ebe414aa958d", "4bbef5e4007898221aa606d083cd59745493938f1e2de8fdadd3823fedd2c01b2aff03050a4ca5d10fd1b6b06f47ea42", "ef7c9d6a98e3943f6892078bb952854743fe4dddd2e7c0ce70a4ac7d", {"a851525b16af17fe87acbae2ab0b233d", "01422d01cd53c3abe94331d0b7918724"}}}}}}}, 0x0) r4 = syz_usb_connect(0x3, 0x24, &(0x7f0000000400)=ANY=[@ANYBLOB="06010000e4c5ad101d0620c0159c010203010902120001000000000904"], 0x0) syz_usb_control_io$printer(r4, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000300)={0x20, 0x1, 0x3, "745202"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) r5 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fdc01a40f30c74933bbc0000000109021b0001000000000904000001a7a00f000905820200"], 0x0) syz_usb_ep_write$ath9k_ep1(r5, 0x82, 0x0, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x83, 0x0, 0x0) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x83, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, 0x0) fallocate(r2, 0x0, 0x80000001, 0x8001) (async) fallocate(r2, 0x0, 0x80000001, 0x8001) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='gid_map\x00') 0s ago: executing program 0 (id=784): openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000140)=@req3={0x7, 0x401, 0x3, 0x2, 0x7e, 0x7}, 0x1c) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x40300, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x4002004c8, 0x1004, 0x45c5, 0xc595, 0x7, 0x2, 0xffffffffffffffff, 0x0, 0x80000004000000, 0x200000000c], 0x80a0000, 0x2010d3}) r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000080), 0x2) ioctl$UDMABUF_CREATE_LIST(r3, 0x40087543, &(0x7f00000000c0)=ANY=[@ANYBLOB="000000000200"]) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) kernel console output (not intermixed with test programs): rer: syz [ 202.368126][ T89] usb 2-1: SerialNumber: syz [ 202.389278][ T89] usb 2-1: config 0 descriptor?? [ 202.477088][ T7429] 8021q: adding VLAN 0 to HW filter on device bond2 [ 202.973372][ T7436] bond1: (slave netdevsim0): Releasing active interface [ 202.996347][ T7436] bond2: (slave netdevsim0): Enslaving as an active interface with a down link [ 203.255234][ T89] iowarrior 2-1:0.186: IOWarrior product=0x1505, serial= interface=186 now attached to iowarrior0 [ 203.405475][ T89] usb 2-1: USB disconnect, device number 11 [ 204.396228][ T10] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 204.578545][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 204.590006][ T10] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 204.599888][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.627395][ T10] usb 1-1: config 0 descriptor?? [ 204.848102][ T10] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 204.894035][ T10] usb 1-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 204.931081][ T10] usb 1-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 205.401363][ T7469] netlink: 'syz.3.382': attribute type 39 has an invalid length. [ 205.472740][ T7469] syz_tun (unregistering): left promiscuous mode [ 205.498352][ T24] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 205.658444][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 205.677990][ T24] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 205.717766][ T24] usb 5-1: config 0 interface 0 has no altsetting 0 [ 205.738655][ T24] usb 5-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 205.747777][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.781929][ T24] usb 5-1: config 0 descriptor?? [ 205.926648][ T7479] tipc: Enabling of bearer rejected, failed to enable media [ 206.061442][ T5887] hid-generic 0003:0004:0000.000D: unknown main item tag 0x0 [ 206.078426][ T5887] hid-generic 0003:0004:0000.000D: unknown main item tag 0x0 [ 206.106342][ T5887] hid-generic 0003:0004:0000.000D: unknown main item tag 0x0 [ 206.146878][ T5887] hid-generic 0003:0004:0000.000D: hidraw0: USB HID v0.00 Device [syz0] on syz1 [ 206.253386][ T24] nzxt-smart2 0003:1E71:2009.000E: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.4-1/input0 [ 206.412500][ T7487] fido_id[7487]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 206.519093][ T7496] tipc: Enabled bearer , priority 0 [ 206.527169][ T7496] syzkaller0: entered promiscuous mode [ 206.537891][ T7496] syzkaller0: entered allmulticast mode [ 206.642514][ T7496] tipc: Resetting bearer [ 206.670677][ T5887] usb 5-1: USB disconnect, device number 10 [ 206.705739][ T7498] fido_id[7498]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 206.721207][ T7494] tipc: Resetting bearer [ 206.755068][ T7494] tipc: Disabling bearer [ 207.337028][ T7505] macvtap0: entered promiscuous mode [ 207.379703][ T5931] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 207.480195][ T7520] netlink: 24 bytes leftover after parsing attributes in process `syz.4.397'. [ 207.591057][ T5931] usb 2-1: Using ep0 maxpacket: 8 [ 207.616597][ T5931] usb 2-1: config 1 has an invalid descriptor of length 251, skipping remainder of the config [ 207.654585][ T5931] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 64256, setting to 64 [ 207.708691][ T5931] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 207.749103][ T5931] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 207.915204][ T5931] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.931689][ T5931] usb 2-1: Product: syz [ 209.006496][ T5931] usb 2-1: Manufacturer: syz [ 209.014086][ T7529] netlink: 56 bytes leftover after parsing attributes in process `syz.2.398'. [ 209.478052][ T5931] usb 2-1: SerialNumber: syz [ 209.728640][ T5931] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 209.738010][ T5931] usbtest 2-1:1.0: couldn't get endpoints, -22 [ 209.816149][ T5931] usbtest 2-1:1.0: probe with driver usbtest failed with error -22 [ 210.182952][ T7513] loop2: detected capacity change from 0 to 7 [ 210.278589][ T24] usb 2-1: USB disconnect, device number 12 [ 210.624551][ T7544] netlink: 'syz.3.404': attribute type 1 has an invalid length. [ 210.916155][ T7546] bond4: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 211.200368][ T7550] netlink: 4 bytes leftover after parsing attributes in process `syz.0.405'. [ 211.211314][ T7550] netlink: 4 bytes leftover after parsing attributes in process `syz.0.405'. [ 211.685216][ T7544] 8021q: adding VLAN 0 to HW filter on device bond4 [ 211.694706][ T36] bond4: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 211.741184][ T7544] veth5: entered promiscuous mode [ 211.750472][ T7544] bond4: (slave veth5): Enslaving as a backup interface with a down link [ 211.888797][ T36] bond4: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 212.008651][ T5931] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 212.179573][ T5931] usb 2-1: Using ep0 maxpacket: 16 [ 212.187016][ T5931] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 212.209004][ T5931] usb 2-1: config 0 interface 0 has no altsetting 0 [ 212.215771][ T5931] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 212.238369][ T5931] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.267573][ T5931] usb 2-1: config 0 descriptor?? [ 212.308680][ T24] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 212.460489][ T7562] loop6: detected capacity change from 0 to 515899392 [ 212.488555][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 212.505452][ T24] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 212.517323][ T24] usb 5-1: config 0 interface 0 has no altsetting 0 [ 212.728183][ T24] usb 5-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 212.737370][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.763674][ T5931] nzxt-smart2 0003:1E71:2009.000F: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.1-1/input0 [ 212.792247][ T24] usb 5-1: config 0 descriptor?? [ 213.495099][ T24] nzxt-smart2 0003:1E71:2009.0010: hidraw1: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.4-1/input0 [ 213.533593][ T5931] usb 2-1: USB disconnect, device number 13 [ 213.542903][ T7570] team_slave_0: entered promiscuous mode [ 213.548808][ T7570] team_slave_1: entered promiscuous mode [ 213.687272][ T7570] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 213.771169][ T24] usb 5-1: USB disconnect, device number 11 [ 214.103069][ T7578] fido_id[7578]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 214.443269][ T7596] netlink: 8 bytes leftover after parsing attributes in process `syz.0.417'. [ 214.479831][ T7596] netlink: 12 bytes leftover after parsing attributes in process `syz.0.417'. [ 214.562978][ T5931] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 214.796585][ T5931] usb 4-1: Using ep0 maxpacket: 16 [ 214.818418][ T5931] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 214.829553][ T5931] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 214.874767][ T5931] usb 4-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 214.895760][ T5931] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.928451][ T24] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 214.959884][ T5931] usb 4-1: config 0 descriptor?? [ 214.973446][ T5931] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 215.098695][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 215.106437][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 215.137889][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 215.195718][ T24] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 215.242702][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 215.423686][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 215.444402][ T24] usb 2-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 215.455060][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.463752][ T24] usb 2-1: Product: syz [ 215.469513][ T24] usb 2-1: Manufacturer: syz [ 215.475563][ T24] usb 2-1: SerialNumber: syz [ 215.507338][ T24] usb 2-1: config 0 descriptor?? [ 215.514895][ T7602] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 215.540653][ T7591] random: crng reseeded on system resumption [ 215.569079][ T24] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input13 [ 215.605856][ T5183] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 215.651786][ T5183] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 215.689685][ T5183] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 215.854327][ T5183] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 216.053939][ T5183] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 216.405222][ T5939] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 216.505110][ T5183] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 216.936908][ C1] xpad 2-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 217.018701][ T7604] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 217.181885][ T5183] xpad 2-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 217.286956][ T7617] bond3: (slave netdevsim0): Releasing active interface [ 217.922053][ T5887] usb 2-1: USB disconnect, device number 14 [ 218.097795][ T7633] netlink: 8 bytes leftover after parsing attributes in process `syz.4.426'. [ 218.118132][ T7633] netlink: 12 bytes leftover after parsing attributes in process `syz.4.426'. [ 218.341854][ T7638] input: syz0 as /devices/virtual/input/input14 [ 218.830522][ T9] usb 4-1: USB disconnect, device number 11 [ 219.103225][ T7642] netlink: 'syz.2.431': attribute type 1 has an invalid length. [ 219.350127][ T89] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 219.612265][ T89] usb 2-1: Using ep0 maxpacket: 16 [ 219.620315][ T89] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 219.652561][ T89] usb 2-1: config 0 interface 0 has no altsetting 0 [ 219.667120][ T89] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 219.845978][ T7648] bond3: (slave netdevsim0): Releasing active interface [ 220.000070][ T89] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.132478][ T89] usb 2-1: config 0 descriptor?? [ 220.858860][ T89] nzxt-smart2 0003:1E71:2009.0011: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.1-1/input0 [ 221.371808][ T43] usb 2-1: USB disconnect, device number 15 [ 221.751574][ T7670] netlink: 8 bytes leftover after parsing attributes in process `syz.2.436'. [ 221.837289][ T7672] netlink: 'syz.4.437': attribute type 3 has an invalid length. [ 222.040997][ T7677] netlink: 4 bytes leftover after parsing attributes in process `syz.2.438'. [ 222.061627][ T7680] netlink: 'syz.0.439': attribute type 10 has an invalid length. [ 222.072629][ T7680] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 222.096079][ T7677] netlink: 4 bytes leftover after parsing attributes in process `syz.2.438'. [ 222.438489][ T5931] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 222.628318][ T5931] usb 2-1: Using ep0 maxpacket: 16 [ 222.655143][ T5931] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 222.856407][ T7693] netlink: 8 bytes leftover after parsing attributes in process `syz.3.443'. [ 222.865451][ T5931] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 223.066231][ T7697] netlink: 'syz.2.444': attribute type 1 has an invalid length. [ 223.138182][ T5931] usb 2-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 223.160272][ T5931] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.487438][ T5931] usb 2-1: config 0 descriptor?? [ 223.613546][ T5931] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 223.774871][ T7703] netlink: 8 bytes leftover after parsing attributes in process `syz.3.447'. [ 224.123470][ T7712] random: crng reseeded on system resumption [ 224.635786][ T7720] netlink: 80 bytes leftover after parsing attributes in process `syz.3.450'. [ 224.764667][ T5894] usb 2-1: USB disconnect, device number 16 [ 225.259337][ T5894] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 225.421403][ T5894] usb 4-1: Using ep0 maxpacket: 16 [ 225.434672][ T5894] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 225.545170][ T5894] usb 4-1: config 0 interface 0 has no altsetting 0 [ 225.584171][ T5894] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 225.598048][ T5894] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.626236][ T5894] usb 4-1: config 0 descriptor?? [ 225.786962][ T7730] netlink: 4 bytes leftover after parsing attributes in process `syz.4.453'. [ 226.085098][ T7733] netlink: 'syz.4.454': attribute type 10 has an invalid length. [ 226.141639][ T5894] nzxt-smart2 0003:1E71:2009.0012: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.3-1/input0 [ 226.147152][ T7733] team0: Port device dummy0 added [ 226.176208][ T7734] netlink: 'syz.4.454': attribute type 10 has an invalid length. [ 226.214140][ T7734] team0: Port device dummy0 removed [ 226.407683][ T7727] pim6reg: entered allmulticast mode [ 226.593766][ T7728] netlink: 'syz.2.452': attribute type 3 has an invalid length. [ 226.661349][ T5894] usb 4-1: USB disconnect, device number 12 [ 226.857987][ T7724] pim6reg: left allmulticast mode [ 227.241278][ T7750] vlan2: entered promiscuous mode [ 227.246738][ T7750] geneve1: entered promiscuous mode [ 227.253300][ T7750] vlan2: entered allmulticast mode [ 227.259970][ T7750] geneve1: entered allmulticast mode [ 227.312522][ T7755] netlink: 4 bytes leftover after parsing attributes in process `syz.4.459'. [ 227.330702][ T5894] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 227.362892][ T7755] netlink: 4 bytes leftover after parsing attributes in process `syz.4.459'. [ 227.600201][ T5894] usb 2-1: device descriptor read/64, error -71 [ 227.776297][ T7761] netlink: 'syz.2.462': attribute type 1 has an invalid length. [ 227.979420][ T5894] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 228.198452][ T5894] usb 2-1: device descriptor read/64, error -71 [ 228.309744][ T5894] usb usb2-port1: attempt power cycle [ 228.668573][ T5894] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 228.693722][ T5894] usb 2-1: device descriptor read/8, error -71 [ 228.938430][ T5894] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 228.961261][ T5894] usb 2-1: device descriptor read/8, error -71 [ 229.083348][ T5894] usb usb2-port1: unable to enumerate USB device [ 229.934981][ T7778] netlink: 8 bytes leftover after parsing attributes in process `syz.4.467'. [ 230.440783][ T7787] FAULT_INJECTION: forcing a failure. [ 230.440783][ T7787] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 230.454887][ T7787] CPU: 1 UID: 0 PID: 7787 Comm: syz.1.470 Not tainted syzkaller #0 PREEMPT(full) [ 230.454907][ T7787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 230.454915][ T7787] Call Trace: [ 230.454920][ T7787] [ 230.454925][ T7787] dump_stack_lvl+0x189/0x250 [ 230.454947][ T7787] ? __pfx____ratelimit+0x10/0x10 [ 230.454962][ T7787] ? __pfx_dump_stack_lvl+0x10/0x10 [ 230.454976][ T7787] ? __pfx__printk+0x10/0x10 [ 230.454988][ T7787] ? __might_fault+0xb0/0x130 [ 230.455010][ T7787] should_fail_ex+0x414/0x560 [ 230.455031][ T7787] _copy_from_iter+0x404/0x1790 [ 230.455053][ T7787] ? __pfx__copy_from_iter+0x10/0x10 [ 230.455069][ T7787] ? dev_get_by_index+0x22/0x2e0 [ 230.455082][ T7787] ? dev_get_by_index+0x22/0x2e0 [ 230.455099][ T7787] packet_sendmsg+0x3072/0x5080 [ 230.455122][ T7787] ? match_mnt_path_str+0x570/0xb40 [ 230.455148][ T7787] ? __pfx___might_resched+0x10/0x10 [ 230.455170][ T7787] ? __pfx_packet_sendmsg+0x10/0x10 [ 230.455185][ T7787] ? aa_sk_perm+0x81e/0x950 [ 230.455202][ T7787] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 230.455220][ T7787] ? __asan_memset+0x22/0x50 [ 230.455235][ T7787] ? __import_iovec+0x40e/0x7f0 [ 230.455247][ T7787] ? aa_sock_msg_perm+0xf1/0x1d0 [ 230.455264][ T7787] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 230.455275][ T7787] ? __pfx_packet_sendmsg+0x10/0x10 [ 230.455291][ T7787] __sock_sendmsg+0x21c/0x270 [ 230.455308][ T7787] ____sys_sendmsg+0x505/0x830 [ 230.455325][ T7787] ? __pfx_____sys_sendmsg+0x10/0x10 [ 230.455346][ T7787] ___sys_sendmsg+0x21f/0x2a0 [ 230.455360][ T7787] ? __pfx____sys_sendmsg+0x10/0x10 [ 230.455393][ T7787] ? __fget_files+0x2a/0x420 [ 230.455403][ T7787] ? __fget_files+0x3a0/0x420 [ 230.455419][ T7787] __sys_sendmsg+0x164/0x220 [ 230.455444][ T7787] ? __pfx___sys_sendmsg+0x10/0x10 [ 230.455468][ T7787] ? __pfx_ksys_write+0x10/0x10 [ 230.455485][ T7787] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 230.455501][ T7787] ? lockdep_hardirqs_on+0x9c/0x150 [ 230.455518][ T7787] __do_fast_syscall_32+0xb6/0x2b0 [ 230.455533][ T7787] ? lockdep_hardirqs_on+0x9c/0x150 [ 230.455549][ T7787] do_fast_syscall_32+0x34/0x80 [ 230.455564][ T7787] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 230.455579][ T7787] RIP: 0023:0xf7f91539 [ 230.455592][ T7787] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 230.455601][ T7787] RSP: 002b:00000000f548655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 230.455616][ T7787] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 230.455625][ T7787] RDX: 0000000000048081 RSI: 0000000000000000 RDI: 0000000000000000 [ 230.455632][ T7787] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 230.455638][ T7787] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 230.455645][ T7787] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 230.455663][ T7787] [ 231.171363][ T5887] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 231.328539][ T5887] usb 4-1: Using ep0 maxpacket: 16 [ 231.341875][ T7798] : renamed from bridge_slave_0 (while UP) [ 231.406235][ T5887] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 231.420452][ T5887] usb 4-1: config 0 interface 0 has no altsetting 0 [ 231.429436][ T5887] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 231.443500][ T5887] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 231.454662][ T5887] usb 4-1: config 0 descriptor?? [ 232.043970][ T5887] nzxt-smart2 0003:1E71:2009.0013: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.3-1/input0 [ 232.121761][ T7803] syzkaller0: entered promiscuous mode [ 232.127550][ T7803] syzkaller0: entered allmulticast mode [ 232.442860][ T5830] usb 4-1: USB disconnect, device number 13 [ 232.472689][ T7811] FAULT_INJECTION: forcing a failure. [ 232.472689][ T7811] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 232.546492][ T7811] CPU: 1 UID: 0 PID: 7811 Comm: syz.2.476 Not tainted syzkaller #0 PREEMPT(full) [ 232.546521][ T7811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 232.546531][ T7811] Call Trace: [ 232.546539][ T7811] [ 232.546547][ T7811] dump_stack_lvl+0x189/0x250 [ 232.546576][ T7811] ? __pfx____ratelimit+0x10/0x10 [ 232.546600][ T7811] ? __pfx_dump_stack_lvl+0x10/0x10 [ 232.546625][ T7811] ? __pfx__printk+0x10/0x10 [ 232.546675][ T7811] should_fail_ex+0x414/0x560 [ 232.546711][ T7811] _copy_to_user+0x31/0xb0 [ 232.546739][ T7811] simple_read_from_buffer+0xe1/0x170 [ 232.546775][ T7811] proc_fail_nth_read+0x1b3/0x220 [ 232.546805][ T7811] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 232.546834][ T7811] ? rw_verify_area+0x2a6/0x4d0 [ 232.546858][ T7811] ? __lock_acquire+0xab9/0xd20 [ 232.546875][ T7811] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 232.546899][ T7811] vfs_read+0x200/0xa30 [ 232.546924][ T7811] ? fdget_pos+0x247/0x320 [ 232.546947][ T7811] ? __pfx___mutex_lock+0x10/0x10 [ 232.546974][ T7811] ? __pfx_vfs_read+0x10/0x10 [ 232.547000][ T7811] ? __fget_files+0x2a/0x420 [ 232.547024][ T7811] ? __fget_files+0x3a0/0x420 [ 232.547041][ T7811] ? __fget_files+0x2a/0x420 [ 232.547071][ T7811] ksys_read+0x145/0x250 [ 232.547101][ T7811] ? __pfx_ksys_read+0x10/0x10 [ 232.547131][ T7811] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 232.547160][ T7811] ? lockdep_hardirqs_on+0x9c/0x150 [ 232.547190][ T7811] __do_fast_syscall_32+0xb6/0x2b0 [ 232.547219][ T7811] ? lockdep_hardirqs_on+0x9c/0x150 [ 232.547249][ T7811] do_fast_syscall_32+0x34/0x80 [ 232.547277][ T7811] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 232.547300][ T7811] RIP: 0023:0xf705d539 [ 232.547318][ T7811] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 232.547334][ T7811] RSP: 002b:00000000f544d590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 232.547357][ T7811] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f544d620 [ 232.547371][ T7811] RDX: 000000000000000f RSI: 00000000f73f6ff4 RDI: 0000000000000000 [ 232.547383][ T7811] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 232.547395][ T7811] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 232.547406][ T7811] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 232.547438][ T7811] [ 232.783520][ C1] vkms_vblank_simulate: vblank timer overrun [ 232.975466][ T7808] fido_id[7808]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 233.725637][ T7823] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 233.756007][ T7827] FAULT_INJECTION: forcing a failure. [ 233.756007][ T7827] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 233.771694][ T7827] CPU: 0 UID: 0 PID: 7827 Comm: syz.3.483 Not tainted syzkaller #0 PREEMPT(full) [ 233.771716][ T7827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 233.771725][ T7827] Call Trace: [ 233.771732][ T7827] [ 233.771739][ T7827] dump_stack_lvl+0x189/0x250 [ 233.771766][ T7827] ? __pfx____ratelimit+0x10/0x10 [ 233.771787][ T7827] ? __pfx_dump_stack_lvl+0x10/0x10 [ 233.771808][ T7827] ? __pfx__printk+0x10/0x10 [ 233.771825][ T7827] ? __might_fault+0xb0/0x130 [ 233.771858][ T7827] should_fail_ex+0x414/0x560 [ 233.771887][ T7827] _copy_from_iter+0x1de/0x1790 [ 233.771923][ T7827] ? __pfx__copy_from_iter+0x10/0x10 [ 233.771957][ T7827] bcm_sendmsg+0x15b/0x6a0 [ 233.771978][ T7827] ? __pfx_bcm_sendmsg+0x10/0x10 [ 233.772000][ T7827] ? aa_sock_msg_perm+0xf1/0x1d0 [ 233.772024][ T7827] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 233.772040][ T7827] ? __pfx_bcm_sendmsg+0x10/0x10 [ 233.772056][ T7827] __sock_sendmsg+0x21c/0x270 [ 233.772091][ T7827] sock_write_iter+0x279/0x360 [ 233.772117][ T7827] ? __pfx_sock_write_iter+0x10/0x10 [ 233.772147][ T7827] ? bpf_lsm_file_permission+0x9/0x20 [ 233.772173][ T7827] ? security_file_permission+0x75/0x290 [ 233.772197][ T7827] ? rw_verify_area+0x255/0x4d0 [ 233.772218][ T7827] ? import_ubuf+0xfb/0x1d0 [ 233.772243][ T7827] aio_write+0x535/0x7a0 [ 233.772270][ T7827] ? __pfx_aio_write+0x10/0x10 [ 233.772305][ T7827] ? __might_fault+0xb0/0x130 [ 233.772358][ T7827] io_submit_one+0x78b/0x1310 [ 233.772395][ T7827] ? __pfx_io_submit_one+0x10/0x10 [ 233.772418][ T7827] ? __might_fault+0xb0/0x130 [ 233.772456][ T7827] ? __might_fault+0xb0/0x130 [ 233.772484][ T7827] __ia32_compat_sys_io_submit+0x1c7/0x330 [ 233.772509][ T7827] ? __pfx___ia32_compat_sys_io_submit+0x10/0x10 [ 233.772527][ T7827] ? ksys_write+0x22a/0x250 [ 233.772561][ T7827] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 233.772589][ T7827] ? lockdep_hardirqs_on+0x9c/0x150 [ 233.772599][ T7821] netlink: 4 bytes leftover after parsing attributes in process `syz.1.480'. [ 233.772617][ T7827] __do_fast_syscall_32+0xb6/0x2b0 [ 233.772643][ T7827] ? lockdep_hardirqs_on+0x9c/0x150 [ 233.772667][ T7827] do_fast_syscall_32+0x34/0x80 [ 233.772690][ T7827] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 233.772710][ T7827] RIP: 0023:0xf701d539 [ 233.772726][ T7827] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 233.772741][ T7827] RSP: 002b:00000000f540d55c EFLAGS: 00000206 ORIG_RAX: 00000000000000f8 [ 233.772761][ T7827] RAX: ffffffffffffffda RBX: 00000000f7f1d000 RCX: 0000000000000001 [ 233.772774][ T7827] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 233.772785][ T7827] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 233.772795][ T7827] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 233.772805][ T7827] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 233.772833][ T7827] [ 233.814013][ T7828] fuse: Unknown parameter 'fGoHd' [ 234.084803][ T7821] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 234.275422][ T7821] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 234.422289][ T7832] kvm: user requested TSC rate below hardware speed [ 234.506532][ T7837] netlink: 'syz.0.486': attribute type 1 has an invalid length. [ 234.557429][ T7837] 8021q: adding VLAN 0 to HW filter on device bond3 [ 235.050041][ T5830] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 235.109801][ T7850] FAULT_INJECTION: forcing a failure. [ 235.109801][ T7850] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 235.144045][ T7850] CPU: 0 UID: 0 PID: 7850 Comm: syz.3.490 Not tainted syzkaller #0 PREEMPT(full) [ 235.144068][ T7850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 235.144076][ T7850] Call Trace: [ 235.144081][ T7850] [ 235.144087][ T7850] dump_stack_lvl+0x189/0x250 [ 235.144107][ T7850] ? __pfx____ratelimit+0x10/0x10 [ 235.144122][ T7850] ? __pfx_dump_stack_lvl+0x10/0x10 [ 235.144137][ T7850] ? __pfx__printk+0x10/0x10 [ 235.144149][ T7850] ? __might_fault+0xb0/0x130 [ 235.144171][ T7850] should_fail_ex+0x414/0x560 [ 235.144192][ T7850] _copy_from_user+0x2d/0xb0 [ 235.144206][ T7850] kvm_arch_vcpu_ioctl+0x1087/0x2b40 [ 235.144219][ T7850] ? __lock_acquire+0xab9/0xd20 [ 235.144234][ T7850] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 235.144250][ T7850] ? __lock_acquire+0xab9/0xd20 [ 235.144268][ T7850] ? __lock_acquire+0xab9/0xd20 [ 235.144291][ T7850] ? is_bpf_text_address+0x26/0x2b0 [ 235.144306][ T7850] ? is_bpf_text_address+0x292/0x2b0 [ 235.144318][ T7850] ? is_bpf_text_address+0x26/0x2b0 [ 235.144331][ T7850] ? kernel_text_address+0xa5/0xe0 [ 235.144357][ T7850] ? arch_stack_walk+0xfc/0x150 [ 235.144383][ T7850] ? __lock_acquire+0xab9/0xd20 [ 235.144399][ T7850] ? __mutex_trylock_common+0x153/0x260 [ 235.144415][ T7850] ? __pfx___mutex_trylock_common+0x10/0x10 [ 235.144427][ T7850] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 235.144443][ T7850] ? rcu_is_watching+0x15/0xb0 [ 235.144456][ T7850] ? trace_contention_end+0x39/0x120 [ 235.144469][ T7850] ? __mutex_lock+0x335/0x1350 [ 235.144492][ T7850] ? kvm_vcpu_ioctl+0x22e/0xe90 [ 235.144509][ T7850] ? __pfx___mutex_lock+0x10/0x10 [ 235.144529][ T7850] ? lockdep_hardirqs_on+0x9c/0x150 [ 235.144548][ T7850] kvm_vcpu_ioctl+0x74d/0xe90 [ 235.144568][ T7850] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 235.144580][ T7850] ? do_vfs_ioctl+0xbe8/0x1430 [ 235.144596][ T7850] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 235.144618][ T7850] ? __lock_acquire+0xab9/0xd20 [ 235.144641][ T7850] kvm_vcpu_compat_ioctl+0x203/0x390 [ 235.144657][ T7850] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 235.144672][ T7850] ? __fget_files+0x3a0/0x420 [ 235.144682][ T7850] ? __fget_files+0x2a/0x420 [ 235.144695][ T7850] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 235.144711][ T7850] __ia32_compat_sys_ioctl+0x543/0x840 [ 235.144727][ T7850] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 235.144741][ T7850] ? __fget_files+0x3a0/0x420 [ 235.144756][ T7850] ? fput+0xa0/0xd0 [ 235.144768][ T7850] ? ksys_write+0x22a/0x250 [ 235.144782][ T7850] ? exc_page_fault+0x82/0x100 [ 235.144796][ T7850] ? __pfx_ksys_write+0x10/0x10 [ 235.144812][ T7850] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 235.144827][ T7850] ? lockdep_hardirqs_on+0x9c/0x150 [ 235.144842][ T7850] __do_fast_syscall_32+0xb6/0x2b0 [ 235.144858][ T7850] ? lockdep_hardirqs_on+0x9c/0x150 [ 235.144874][ T7850] do_fast_syscall_32+0x34/0x80 [ 235.144889][ T7850] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 235.144901][ T7850] RIP: 0023:0xf701d539 [ 235.144913][ T7850] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 235.144922][ T7850] RSP: 002b:00000000f540d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 235.144936][ T7850] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000004040aea0 [ 235.144945][ T7850] RDX: 0000000080000140 RSI: 0000000000000000 RDI: 0000000000000000 [ 235.144952][ T7850] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 235.144958][ T7850] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 235.144965][ T7850] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 235.144983][ T7850] [ 235.188381][ T5830] usb 5-1: device descriptor read/64, error -71 [ 235.712199][ T7851] bond2: (slave netdevsim0): Releasing active interface [ 236.226966][ T7860] xt_hashlimit: max too large, truncated to 1048576 [ 236.329509][ T5830] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 236.468514][ T5830] usb 5-1: device descriptor read/64, error -71 [ 236.579756][ T5830] usb usb5-port1: attempt power cycle [ 236.989377][ T7878] netlink: 'syz.0.496': attribute type 2 has an invalid length. [ 236.997204][ T5830] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 237.005375][ T7878] netlink: 'syz.0.496': attribute type 2 has an invalid length. [ 237.013564][ T7878] netlink: 8 bytes leftover after parsing attributes in process `syz.0.496'. [ 237.439219][ T5830] usb 5-1: device descriptor read/8, error -71 [ 237.679134][ T5830] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 237.709162][ T5830] usb 5-1: device descriptor read/8, error -71 [ 237.788308][ T5914] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 237.818776][ T5830] usb usb5-port1: unable to enumerate USB device [ 238.051298][ T5914] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 238.063626][ T5914] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 238.075026][ T5914] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 238.091387][ T5914] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 238.154732][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.215001][ T5914] usb 4-1: config 0 descriptor?? [ 238.671211][ T5914] plantronics 0003:047F:FFFF.0014: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 239.006875][ T5887] usb 4-1: USB disconnect, device number 14 [ 239.453715][ T7899] netlink: 4 bytes leftover after parsing attributes in process `syz.1.503'. [ 239.939482][ T7908] netlink: 16 bytes leftover after parsing attributes in process `syz.1.507'. [ 240.497757][ T7921] netlink: 'syz.2.510': attribute type 1 has an invalid length. [ 240.545524][ T7921] 8021q: adding VLAN 0 to HW filter on device bond4 [ 240.582610][ T7924] bridge0: port 2(bridge_slave_1) entered disabled state [ 240.847231][ T30] audit: type=1326 audit(1762388981.895:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7932 comm="syz.3.514" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701d539 code=0x7ffc0000 [ 240.875959][ T30] audit: type=1326 audit(1762388981.925:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7932 comm="syz.3.514" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701d539 code=0x7ffc0000 [ 240.989333][ T30] audit: type=1326 audit(1762388981.925:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7932 comm="syz.3.514" exe="/root/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf701d539 code=0x7ffc0000 [ 241.335911][ T30] audit: type=1326 audit(1762388981.925:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7932 comm="syz.3.514" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701d539 code=0x7ffc0000 [ 241.363760][ T30] audit: type=1326 audit(1762388981.925:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7932 comm="syz.3.514" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701d539 code=0x7ffc0000 [ 241.489942][ T30] audit: type=1326 audit(1762388981.925:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7932 comm="syz.3.514" exe="/root/syz-executor" sig=0 arch=40000003 syscall=42 compat=1 ip=0xf701d539 code=0x7ffc0000 [ 241.858559][ T30] audit: type=1326 audit(1762388981.925:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7932 comm="syz.3.514" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701d539 code=0x7ffc0000 [ 241.906160][ T30] audit: type=1326 audit(1762388981.925:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7932 comm="syz.3.514" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701d539 code=0x7ffc0000 [ 241.958560][ T30] audit: type=1326 audit(1762388981.925:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7932 comm="syz.3.514" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf701d539 code=0x7ffc0000 [ 242.151842][ T30] audit: type=1326 audit(1762388981.925:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7932 comm="syz.3.514" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701d539 code=0x7ffc0000 [ 242.458342][ T5887] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 242.628611][ T5887] usb 4-1: Using ep0 maxpacket: 32 [ 242.651638][ T5887] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 242.743035][ T5887] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 242.778556][ T5887] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 242.908310][ T5887] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 242.969601][ T5887] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 243.005658][ T5887] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 243.018257][ T5887] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.650635][ T5887] usb 4-1: Product: syz [ 243.702611][ T5887] usb 4-1: Manufacturer: syz [ 243.817615][ T5887] usb 4-1: SerialNumber: syz [ 243.863421][ T5887] usb 4-1: config 0 descriptor?? [ 243.926838][ T7955] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 243.984134][ T5887] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input15 [ 244.150732][ T5183] xpad 4-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 244.248994][ T5183] xpad 4-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 244.408324][ T5914] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 244.521683][ T5880] xpad 4-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 244.643854][ T5914] usb 2-1: config 0 has no interfaces? [ 244.654347][ T5914] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 244.668931][ T5914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.676997][ T5914] usb 2-1: Product: syz [ 244.688543][ T5914] usb 2-1: Manufacturer: syz [ 244.700995][ T5183] xpad 4-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 244.703531][ T5914] usb 2-1: SerialNumber: syz [ 244.766732][ T5914] usb 2-1: config 0 descriptor?? [ 244.789659][ T7979] netlink: 16 bytes leftover after parsing attributes in process `syz.4.525'. [ 244.818718][ T5183] xpad 4-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 244.966330][ T7949] xpad 4-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 244.986337][ T5183] xpad 4-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 245.062446][ T43] usb 4-1: USB disconnect, device number 15 [ 245.127813][ T7973] loop6: detected capacity change from 0 to 524288000 [ 245.358786][ T7982] support for the xor transformation has been removed. [ 246.228648][ T5914] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 246.428307][ T5914] usb 4-1: Using ep0 maxpacket: 16 [ 246.477345][ T5914] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 246.517443][ T5914] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 246.537703][ T5914] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 246.568146][ T5914] usb 4-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 246.606507][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.648904][ T5914] usb 4-1: config 0 descriptor?? [ 247.021310][ T8002] macvtap1: entered allmulticast mode [ 247.035783][ T8002] veth0_macvtap: entered allmulticast mode [ 247.086168][ T5914] shield 0003:0955:7214.0015: unknown main item tag 0x2 [ 247.141132][ T8004] netdevsim netdevsim4 : renamed from netdevsim0 [ 247.165469][ T5914] shield 0003:0955:7214.0015: item fetching failed at offset 4/5 [ 247.174635][ T5914] shield 0003:0955:7214.0015: Parse failed [ 247.180748][ T5914] shield 0003:0955:7214.0015: probe with driver shield failed with error -22 [ 247.207952][ T8004] netdevsim netdevsim4 : left allmulticast mode [ 247.406827][ T8006] netlink: 'syz.4.534': attribute type 10 has an invalid length. [ 247.417667][ T7992] random: crng reseeded on system resumption [ 247.442081][ T8006] team0: Port device dummy0 added [ 248.022604][ T89] usb 2-1: USB disconnect, device number 21 [ 248.761779][ T8021] netlink: 'syz.1.537': attribute type 10 has an invalid length. [ 248.775008][ T8021] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 248.914082][ T8025] netlink: 4 bytes leftover after parsing attributes in process `syz.4.538'. [ 248.932210][ T8025] netlink: 4 bytes leftover after parsing attributes in process `syz.4.538'. [ 249.165276][ T89] usb 4-1: USB disconnect, device number 16 [ 249.271455][ T8031] netlink: 'syz.3.539': attribute type 39 has an invalid length. [ 251.028515][ T89] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 251.036238][ T5887] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 251.258531][ T5887] usb 5-1: Using ep0 maxpacket: 32 [ 251.280897][ T5887] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 251.332866][ T89] usb 2-1: Using ep0 maxpacket: 16 [ 251.339407][ T5887] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 251.456354][ T89] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 251.466749][ T5887] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 251.476858][ T5887] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.486218][ T89] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 251.503781][ T5887] usb 5-1: config 0 descriptor?? [ 251.508915][ T89] usb 2-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 251.525467][ T5887] hub 5-1:0.0: USB hub found [ 251.535859][ T89] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.564711][ T89] usb 2-1: config 0 descriptor?? [ 251.576112][ T89] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 251.731361][ T8047] netlink: 'syz.4.545': attribute type 10 has an invalid length. [ 251.846072][ T5887] hub 5-1:0.0: 1 port detected [ 252.194624][ T8061] random: crng reseeded on system resumption [ 252.372081][ T8063] loop6: detected capacity change from 0 to 7 [ 252.489982][ T8063] Dev loop6: unable to read RDB block 7 [ 252.499740][ T8063] loop6: unable to read partition table [ 252.526144][ T8063] loop6: partition table beyond EOD, truncated [ 252.572889][ T8063] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 252.897748][ T43] usb 2-1: USB disconnect, device number 22 [ 253.119682][ T5887] hub 5-1:0.0: hub_hub_status failed (err = -110) [ 253.146999][ T5887] hub 5-1:0.0: config failed, can't get hub status (err -110) [ 253.166419][ T5887] usbhid 5-1:0.0: can't add hid device: -32 [ 253.183902][ T5887] usbhid 5-1:0.0: probe with driver usbhid failed with error -32 [ 253.246669][ T8070] netlink: 'syz.0.550': attribute type 10 has an invalid length. [ 254.541528][ T8047] team0: Failed to send options change via netlink (err -105) [ 254.549353][ T8047] team0: Port device  added [ 254.558821][ T8070] bridge0: port 3(netdevsim0) entered blocking state [ 254.615776][ T8070] bridge0: port 3(netdevsim0) entered disabled state [ 254.655500][ T8070] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 254.938782][ T5894] usb 5-1: USB disconnect, device number 16 [ 254.968535][ T30] kauditd_printk_skb: 47 callbacks suppressed [ 254.968555][ T30] audit: type=1326 audit(1762388996.015:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8084 comm="syz.4.554" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 255.067416][ T30] audit: type=1326 audit(1762388996.055:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8084 comm="syz.4.554" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 255.180361][ T30] audit: type=1326 audit(1762388996.055:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8084 comm="syz.4.554" exe="/root/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 255.279752][ T43] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 255.283890][ T30] audit: type=1326 audit(1762388996.055:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8084 comm="syz.4.554" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 255.319704][ T30] audit: type=1326 audit(1762388996.055:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8084 comm="syz.4.554" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 255.352479][ T30] audit: type=1326 audit(1762388996.055:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8084 comm="syz.4.554" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 255.389626][ T30] audit: type=1326 audit(1762388996.055:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8084 comm="syz.4.554" exe="/root/syz-executor" sig=0 arch=40000003 syscall=262 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 255.418764][ T30] audit: type=1326 audit(1762388996.055:107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8084 comm="syz.4.554" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 255.455123][ T43] usb 4-1: Using ep0 maxpacket: 8 [ 255.460678][ T30] audit: type=1326 audit(1762388996.075:108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8084 comm="syz.4.554" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 255.467948][ T43] usb 4-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 255.519860][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.535706][ T30] audit: type=1326 audit(1762388996.075:109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8084 comm="syz.4.554" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 255.537097][ T43] usb 4-1: Product: syz [ 255.603120][ T43] usb 4-1: Manufacturer: syz [ 255.614768][ T43] usb 4-1: SerialNumber: syz [ 255.658694][ T43] usb 4-1: config 0 descriptor?? [ 255.691413][ T43] gspca_main: se401-2.14.0 probing 047d:5003 [ 255.883857][ T8108] netlink: 'syz.0.557': attribute type 21 has an invalid length. [ 255.907526][ T8108] netlink: 128 bytes leftover after parsing attributes in process `syz.0.557'. [ 255.915340][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.923591][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.113641][ T43] gspca_se401: write req failed req 0x57 val 0x00 error -71 [ 256.123876][ T43] se401 4-1:0.0: probe with driver se401 failed with error -71 [ 256.153716][ T43] usb 4-1: USB disconnect, device number 17 [ 257.098874][ T43] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 257.272826][ T43] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 257.283290][ T43] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 257.298015][ T43] usb 4-1: config 1 has no interface number 0 [ 257.304599][ T43] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 257.315864][ T43] usb 4-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 257.328451][ T43] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 257.337653][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.346045][ T43] usb 4-1: Product: syz [ 257.350449][ T43] usb 4-1: Manufacturer: syz [ 257.355193][ T43] usb 4-1: SerialNumber: syz [ 257.388510][ T8108] netlink: 'syz.0.557': attribute type 4 has an invalid length. [ 257.396294][ T8108] netlink: 3 bytes leftover after parsing attributes in process `syz.0.557'. [ 257.546465][ T8115] netlink: 'syz.1.561': attribute type 1 has an invalid length. [ 257.588078][ T43] cdc_ncm 4-1:1.1: bind() failure [ 257.605308][ T43] usb 4-1: USB disconnect, device number 18 [ 257.647539][ T8115] 8021q: adding VLAN 0 to HW filter on device bond2 [ 258.425667][ T5887] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 258.600735][ T8123] bond1: (slave netdevsim0): Releasing active interface [ 258.708611][ T5887] usb 5-1: config 0 has an invalid interface number: 11 but max is 0 [ 258.816357][ T5887] usb 5-1: config 0 has no interface number 0 [ 258.826493][ T5887] usb 5-1: config 0 interface 11 altsetting 253 bulk endpoint 0x7 has invalid maxpacket 1024 [ 258.847185][ T5887] usb 5-1: config 0 interface 11 has no altsetting 0 [ 259.304862][ T8134] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3952259481 (15809037924 ns) > initial count (8318055364 ns). Using initial count to start timer. [ 259.324123][ T5887] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 259.359945][ T5887] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 259.386485][ T5887] usb 5-1: config 0 descriptor?? [ 259.416971][ T8135] netlink: 200032 bytes leftover after parsing attributes in process `syz.3.564'. [ 259.456705][ T8126] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 259.472838][ T5887] keyspan 5-1:0.11: Keyspan 2 port adapter converter detected [ 259.504813][ T5887] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 87 [ 259.530491][ T8137] netlink: 'syz.1.565': attribute type 1 has an invalid length. [ 259.557661][ T5887] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 81 [ 259.631176][ T5887] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 82 [ 259.685356][ T5887] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 1 [ 259.711075][ T5887] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 2 [ 259.768662][ T5887] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 85 [ 259.838448][ T5887] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 5 [ 259.871450][ T8137] 8021q: adding VLAN 0 to HW filter on device bond3 [ 259.898886][ T5887] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 259.928573][ T5887] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 83 [ 259.998879][ T5887] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 84 [ 260.064629][ T5887] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 3 [ 260.219876][ T5887] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 4 [ 260.227676][ T5887] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 86 [ 260.243359][ T5887] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 6 [ 260.253759][ T8146] netlink: 'syz.3.567': attribute type 10 has an invalid length. [ 260.344026][ T5887] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 260.400434][ T5887] usb 5-1: USB disconnect, device number 17 [ 260.475790][ T5887] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 261.013593][ T5887] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 261.073234][ T5887] keyspan 5-1:0.11: device disconnected [ 261.349164][ T8159] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 261.428716][ T8166] netlink: 'syz.4.573': attribute type 10 has an invalid length. [ 261.757651][ T8170] FAULT_INJECTION: forcing a failure. [ 261.757651][ T8170] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 261.842246][ T8170] CPU: 0 UID: 0 PID: 8170 Comm: syz.4.574 Not tainted syzkaller #0 PREEMPT(full) [ 261.842267][ T8170] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 261.842275][ T8170] Call Trace: [ 261.842279][ T8170] [ 261.842285][ T8170] dump_stack_lvl+0x189/0x250 [ 261.842306][ T8170] ? __pfx____ratelimit+0x10/0x10 [ 261.842321][ T8170] ? __pfx_dump_stack_lvl+0x10/0x10 [ 261.842338][ T8170] ? __pfx__printk+0x10/0x10 [ 261.842360][ T8170] ? fs_reclaim_acquire+0x7d/0x100 [ 261.842400][ T8170] should_fail_ex+0x414/0x560 [ 261.842434][ T8170] prepare_alloc_pages+0x213/0x610 [ 261.842461][ T8170] __alloc_frozen_pages_noprof+0x123/0x370 [ 261.842480][ T8170] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 261.842490][ T8170] ? vmx_vcpu_load+0x1b0/0x260 [ 261.842509][ T8170] ? policy_nodemask+0x27c/0x720 [ 261.842518][ T8170] ? __lock_acquire+0xab9/0xd20 [ 261.842534][ T8170] alloc_pages_mpol+0x232/0x4a0 [ 261.842560][ T8170] vma_alloc_folio_noprof+0xe4/0x200 [ 261.842578][ T8170] ? kvm_sched_in+0x7c/0xe0 [ 261.842600][ T8170] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 261.842633][ T8170] folio_prealloc+0x30/0x180 [ 261.842660][ T8170] __handle_mm_fault+0x2a8b/0x5400 [ 261.842685][ T8170] ? __pfx___handle_mm_fault+0x10/0x10 [ 261.842709][ T8170] ? follow_page_pte+0x7ef/0x13e0 [ 261.842729][ T8170] handle_mm_fault+0x40a/0x8e0 [ 261.842764][ T8170] __get_user_pages+0x165c/0x2a00 [ 261.842831][ T8170] get_user_pages_unlocked+0x1e3/0x720 [ 261.842870][ T8170] hva_to_pfn+0x313/0xc90 [ 261.842907][ T8170] ? __pfx_hva_to_pfn+0x10/0x10 [ 261.842942][ T8170] ? xas_start+0x390/0x770 [ 261.842966][ T8170] ? xa_load+0x60/0x210 [ 261.843001][ T8170] ? kvm_follow_pfn+0x21a/0x3c0 [ 261.843038][ T8170] __kvm_faultin_pfn+0xaa/0x100 [ 261.843075][ T8170] kvm_mmu_faultin_pfn+0x73c/0x1590 [ 261.843127][ T8170] ? __pfx_kvm_mmu_faultin_pfn+0x10/0x10 [ 261.843161][ T8170] kvm_tdp_page_fault+0x273/0x370 [ 261.843190][ T8170] kvm_mmu_do_page_fault+0x2c5/0x640 [ 261.843222][ T8170] ? __pfx_kvm_mmu_do_page_fault+0x10/0x10 [ 261.843263][ T8170] ? vmx_handle_exit_irqoff+0x2a3/0x940 [ 261.843291][ T8170] kvm_mmu_page_fault+0x22f/0xb70 [ 261.843324][ T8170] ? __pfx_handle_ept_violation+0x10/0x10 [ 261.843348][ T8170] vmx_handle_exit+0x10a4/0x18c0 [ 261.843371][ T8170] ? vcpu_run+0x361b/0x7040 [ 261.843408][ T8170] vcpu_run+0x43aa/0x7040 [ 261.843440][ T8170] ? vcpu_run+0x361b/0x7040 [ 261.843526][ T8170] ? __pfx_vcpu_run+0x10/0x10 [ 261.843551][ T8170] ? kvm_arch_vcpu_ioctl_run+0x1f3/0x1940 [ 261.843590][ T8170] ? rcu_is_watching+0x15/0xb0 [ 261.843619][ T8170] kvm_arch_vcpu_ioctl_run+0xfc9/0x1940 [ 261.843654][ T8170] ? __mutex_trylock_common+0x153/0x260 [ 261.843684][ T8170] ? kvm_arch_vcpu_ioctl_run+0x1f3/0x1940 [ 261.843713][ T8170] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 261.843744][ T8170] ? rcu_is_watching+0x15/0xb0 [ 261.843766][ T8170] ? trace_contention_end+0x39/0x120 [ 261.843788][ T8170] ? __mutex_lock+0x335/0x1350 [ 261.843828][ T8170] ? kvm_vcpu_ioctl+0x22e/0xe90 [ 261.843860][ T8170] ? __pfx___mutex_lock+0x10/0x10 [ 261.843896][ T8170] ? lockdep_hardirqs_on+0x9c/0x150 [ 261.843933][ T8170] kvm_vcpu_ioctl+0x95c/0xe90 [ 261.843966][ T8170] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 261.843990][ T8170] ? do_vfs_ioctl+0xbe8/0x1430 [ 261.844017][ T8170] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 261.844059][ T8170] ? __lock_acquire+0xab9/0xd20 [ 261.844109][ T8170] kvm_vcpu_compat_ioctl+0x203/0x390 [ 261.844139][ T8170] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 261.844166][ T8170] ? __fget_files+0x3a0/0x420 [ 261.844184][ T8170] ? __fget_files+0x2a/0x420 [ 261.844207][ T8170] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 261.844235][ T8170] __ia32_compat_sys_ioctl+0x543/0x840 [ 261.844263][ T8170] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 261.844289][ T8170] ? __fget_files+0x3a0/0x420 [ 261.844316][ T8170] ? fput+0xa0/0xd0 [ 261.844337][ T8170] ? ksys_write+0x22a/0x250 [ 261.844360][ T8170] ? exc_page_fault+0x82/0x100 [ 261.844386][ T8170] ? __pfx_ksys_write+0x10/0x10 [ 261.844417][ T8170] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 261.844446][ T8170] ? lockdep_hardirqs_on+0x9c/0x150 [ 261.844476][ T8170] __do_fast_syscall_32+0xb6/0x2b0 [ 261.844505][ T8170] ? lockdep_hardirqs_on+0x9c/0x150 [ 261.844535][ T8170] do_fast_syscall_32+0x34/0x80 [ 261.844561][ T8170] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 261.844585][ T8170] RIP: 0023:0xf707d539 [ 261.844604][ T8170] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 261.844621][ T8170] RSP: 002b:00000000f546d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 261.844643][ T8170] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 261.844657][ T8170] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 261.844668][ T8170] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 261.844679][ T8170] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 261.844690][ T8170] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 261.844723][ T8170] [ 262.341307][ C0] vkms_vblank_simulate: vblank timer overrun [ 263.646312][ T8184] pim6reg: entered allmulticast mode [ 263.657808][ T8184] netlink: 'syz.3.578': attribute type 3 has an invalid length. [ 264.085355][ T8180] pim6reg: left allmulticast mode [ 264.300658][ T8201] netlink: 4 bytes leftover after parsing attributes in process `syz.2.583'. [ 264.313031][ T8201] netlink: 4 bytes leftover after parsing attributes in process `syz.2.583'. [ 264.673988][ T8205] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 264.717167][ T8205] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 264.994199][ T8211] netlink: 108 bytes leftover after parsing attributes in process `syz.4.586'. [ 265.776239][ T8217] netlink: 4 bytes leftover after parsing attributes in process `syz.3.587'. [ 265.813034][ T8217] netlink: 4 bytes leftover after parsing attributes in process `syz.3.587'. [ 266.163672][ T10] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 266.186860][ T10] dvb_usb_az6027 1-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 266.209496][ T10] usb 1-1: USB disconnect, device number 17 [ 266.313794][ T5931] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 266.362873][ T8231] netlink: 4 bytes leftover after parsing attributes in process `syz.2.592'. [ 266.374784][ T8231] netlink: 4 bytes leftover after parsing attributes in process `syz.2.592'. [ 266.598365][ T5931] usb 5-1: Using ep0 maxpacket: 32 [ 266.615557][ T5931] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 266.703028][ T5931] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 266.820276][ T8235] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 266.888274][ T5931] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 267.231794][ T5931] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 267.580643][ T5931] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 267.683454][ T5931] usb 5-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 267.696349][ T5931] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.718332][ T5931] usb 5-1: Product: syz [ 267.727046][ T5931] usb 5-1: Manufacturer: syz [ 267.735397][ T5931] usb 5-1: SerialNumber: syz [ 267.750323][ T5931] usb 5-1: config 0 descriptor?? [ 267.763059][ T8227] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 267.787342][ T5931] input: Generic X-Box pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input16 [ 267.863641][ T5183] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 268.000797][ T5183] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 268.192286][ T8245] can: request_module (can-proto-3) failed. [ 268.364544][ T5183] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 268.448558][ T5939] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 268.530296][ T5183] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 268.652485][ T8226] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 268.694369][ T5183] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 268.849294][ T43] usb 5-1: USB disconnect, device number 18 [ 268.849404][ C0] xpad 5-1:0.0: xpad_irq_in - usb_submit_urb failed with result -19 [ 268.999311][ T5931] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 269.173537][ T8260] pim6reg: entered allmulticast mode [ 269.183288][ T8260] netlink: 'syz.1.597': attribute type 3 has an invalid length. [ 269.433563][ T8253] pim6reg: left allmulticast mode [ 269.498299][ T5931] usb 4-1: Using ep0 maxpacket: 16 [ 269.521509][ T5931] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 269.533606][ T5931] usb 4-1: config 0 interface 0 has no altsetting 0 [ 269.540650][ T5931] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 269.606136][ T5931] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 269.672403][ T5931] usb 4-1: config 0 descriptor?? [ 269.787512][ T8269] netlink: 8 bytes leftover after parsing attributes in process `syz.2.602'. [ 270.040315][ T8273] netlink: 'syz.2.604': attribute type 10 has an invalid length. [ 270.063504][ T8273] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 270.080928][ T8275] netlink: 4 bytes leftover after parsing attributes in process `syz.1.605'. [ 270.095176][ T5931] nzxt-smart2 0003:1E71:2009.0016: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.3-1/input0 [ 270.265389][ T5830] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 270.329827][ T8279] netlink: 8 bytes leftover after parsing attributes in process `syz.1.606'. [ 270.358484][ T8279] netlink: 12 bytes leftover after parsing attributes in process `syz.1.606'. [ 270.365855][ T8281] netlink: 8 bytes leftover after parsing attributes in process `syz.2.607'. [ 270.419222][ T8281] syz_tun: entered promiscuous mode [ 270.433569][ T8281] syz_tun: left promiscuous mode [ 270.461591][ T5830] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 270.482892][ T5830] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 270.515361][ T5830] usb 5-1: New USB device found, idVendor=0079, idProduct=1846, bcdDevice= 0.00 [ 270.525241][ T5830] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.550348][ T5830] usb 5-1: config 0 descriptor?? [ 270.598837][ T5931] usb 4-1: USB disconnect, device number 19 [ 270.603492][ T8286] netlink: 8 bytes leftover after parsing attributes in process `syz.0.609'. [ 270.709539][ T8288] netlink: 4 bytes leftover after parsing attributes in process `syz.1.608'. [ 270.721225][ T8288] netlink: 4 bytes leftover after parsing attributes in process `syz.1.608'. [ 270.875630][ T8292] loop6: detected capacity change from 0 to 7 [ 270.923374][ T8292] Dev loop6: unable to read RDB block 7 [ 270.929506][ T8292] loop6: unable to read partition table [ 270.944544][ T8292] loop6: partition table beyond EOD, truncated [ 270.964526][ T8292] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 271.169121][ T5830] hid_mf 0003:0079:1846.0017: hidraw0: USB HID v0.00 Device [HID 0079:1846] on usb-dummy_hcd.4-1/input0 [ 271.192937][ T8298] netlink: 4 bytes leftover after parsing attributes in process `syz.0.612'. [ 271.207088][ T5830] hid_mf 0003:0079:1846.0017: Invalid report, this should never happen! [ 271.250617][ T5830] hid_mf 0003:0079:1846.0017: Force feedback init failed. [ 271.546503][ T10] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 271.666559][ T10] hid-generic 0000:0000:0000.0018: hidraw0: HID v0.00 Device [syz0] on syz0 [ 271.696395][ T8303] netlink: 4 bytes leftover after parsing attributes in process `syz.0.614'. [ 271.886532][ T8307] fido_id[8307]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 272.243751][ T8314] FAULT_INJECTION: forcing a failure. [ 272.243751][ T8314] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 272.290859][ T8314] CPU: 0 UID: 0 PID: 8314 Comm: syz.0.617 Not tainted syzkaller #0 PREEMPT(full) [ 272.290888][ T8314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 272.290898][ T8314] Call Trace: [ 272.290907][ T8314] [ 272.290916][ T8314] dump_stack_lvl+0x189/0x250 [ 272.290946][ T8314] ? __pfx____ratelimit+0x10/0x10 [ 272.290970][ T8314] ? __pfx_dump_stack_lvl+0x10/0x10 [ 272.291004][ T8314] ? __pfx__printk+0x10/0x10 [ 272.291022][ T8314] ? __might_fault+0xb0/0x130 [ 272.291059][ T8314] should_fail_ex+0x414/0x560 [ 272.291094][ T8314] _copy_from_iter+0x1de/0x1790 [ 272.291122][ T8314] ? rcu_is_watching+0x15/0xb0 [ 272.291147][ T8314] ? kmalloc_reserve+0xbd/0x290 [ 272.291166][ T8314] ? __pfx__copy_from_iter+0x10/0x10 [ 272.291189][ T8314] ? __build_skb_around+0x262/0x3f0 [ 272.291222][ T8314] ? netlink_sendmsg+0x642/0xb30 [ 272.291239][ T8314] ? skb_put+0x11b/0x210 [ 272.291261][ T8314] netlink_sendmsg+0x6b2/0xb30 [ 272.291290][ T8314] ? __pfx_netlink_sendmsg+0x10/0x10 [ 272.291311][ T8314] ? __import_iovec+0x5d4/0x7f0 [ 272.291332][ T8314] ? aa_sock_msg_perm+0xf1/0x1d0 [ 272.291360][ T8314] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 272.291379][ T8314] ? __pfx_netlink_sendmsg+0x10/0x10 [ 272.291397][ T8314] __sock_sendmsg+0x21c/0x270 [ 272.291425][ T8314] ____sys_sendmsg+0x505/0x830 [ 272.291453][ T8314] ? __pfx_____sys_sendmsg+0x10/0x10 [ 272.291493][ T8314] ___sys_sendmsg+0x21f/0x2a0 [ 272.291517][ T8314] ? __pfx____sys_sendmsg+0x10/0x10 [ 272.291580][ T8314] ? __fget_files+0x2a/0x420 [ 272.291598][ T8314] ? __fget_files+0x3a0/0x420 [ 272.291624][ T8314] __sys_sendmsg+0x164/0x220 [ 272.291647][ T8314] ? __pfx___sys_sendmsg+0x10/0x10 [ 272.291678][ T8314] ? __pfx_ksys_write+0x10/0x10 [ 272.291709][ T8314] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 272.291738][ T8314] ? lockdep_hardirqs_on+0x9c/0x150 [ 272.291767][ T8314] __do_fast_syscall_32+0xb6/0x2b0 [ 272.291794][ T8314] ? lockdep_hardirqs_on+0x9c/0x150 [ 272.291824][ T8314] do_fast_syscall_32+0x34/0x80 [ 272.291851][ T8314] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 272.291874][ T8314] RIP: 0023:0xf7f15539 [ 272.291892][ T8314] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 272.291908][ T8314] RSP: 002b:00000000f540655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 272.291930][ T8314] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800003c0 [ 272.291944][ T8314] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 272.291955][ T8314] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 272.291966][ T8314] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 272.291978][ T8314] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 272.292020][ T8314] [ 273.077276][ T8326] IPVS: set_ctl: invalid protocol: 59 172.20.20.34:20002 [ 273.160508][ T8330] macvtap0: entered promiscuous mode [ 273.371166][ T5830] usb 5-1: USB disconnect, device number 19 [ 273.547751][ T8338] FAULT_INJECTION: forcing a failure. [ 273.547751][ T8338] name failslab, interval 1, probability 0, space 0, times 0 [ 273.565194][ T8338] CPU: 1 UID: 0 PID: 8338 Comm: syz.3.626 Not tainted syzkaller #0 PREEMPT(full) [ 273.565221][ T8338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 273.565233][ T8338] Call Trace: [ 273.565241][ T8338] [ 273.565249][ T8338] dump_stack_lvl+0x189/0x250 [ 273.565282][ T8338] ? __pfx____ratelimit+0x10/0x10 [ 273.565309][ T8338] ? __pfx_dump_stack_lvl+0x10/0x10 [ 273.565334][ T8338] ? __pfx__printk+0x10/0x10 [ 273.565359][ T8338] ? __pfx___might_resched+0x10/0x10 [ 273.565385][ T8338] should_fail_ex+0x414/0x560 [ 273.565419][ T8338] should_failslab+0xa8/0x100 [ 273.565441][ T8338] kmem_cache_alloc_noprof+0x74/0x6e0 [ 273.565467][ T8338] ? getname_kernel+0x5a/0x2f0 [ 273.565492][ T8338] getname_kernel+0x5a/0x2f0 [ 273.565515][ T8338] kern_path+0x1d/0x50 [ 273.565536][ T8338] lookup_bdev+0xc0/0x280 [ 273.565556][ T8338] ? trace_kmalloc+0x1f/0xd0 [ 273.565580][ T8338] ? __pfx_lookup_bdev+0x10/0x10 [ 273.565606][ T8338] ? kstrndup+0xbf/0x160 [ 273.565640][ T8338] resume_store+0x169/0x460 [ 273.565664][ T8338] ? sysfs_file_kobj+0x1a/0x230 [ 273.565688][ T8338] ? __pfx_resume_store+0x10/0x10 [ 273.565716][ T8338] ? sysfs_file_kobj+0x1a/0x230 [ 273.565735][ T8338] ? sysfs_file_kobj+0x1a/0x230 [ 273.565752][ T8338] ? sysfs_file_kobj+0x1a/0x230 [ 273.565772][ T8338] ? sysfs_file_kobj+0x1e4/0x230 [ 273.565792][ T8338] ? sysfs_kf_write+0x166/0x260 [ 273.565818][ T8338] ? __pfx_sysfs_kf_write+0x10/0x10 [ 273.565838][ T8338] kernfs_fop_write_iter+0x3af/0x540 [ 273.565866][ T8338] vfs_write+0x5c9/0xb30 [ 273.565900][ T8338] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 273.565920][ T8338] ? __pfx_vfs_write+0x10/0x10 [ 273.565971][ T8338] ? __fget_files+0x2a/0x420 [ 273.566002][ T8338] ksys_write+0x145/0x250 [ 273.566027][ T8338] ? exc_page_fault+0x82/0x100 [ 273.566055][ T8338] ? __pfx_ksys_write+0x10/0x10 [ 273.566085][ T8338] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 273.566113][ T8338] ? lockdep_hardirqs_on+0x9c/0x150 [ 273.566152][ T8338] __do_fast_syscall_32+0xb6/0x2b0 [ 273.566180][ T8338] ? lockdep_hardirqs_on+0x9c/0x150 [ 273.566211][ T8338] do_fast_syscall_32+0x34/0x80 [ 273.566238][ T8338] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 273.566261][ T8338] RIP: 0023:0xf701d539 [ 273.566279][ T8338] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 273.566294][ T8338] RSP: 002b:00000000f540d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 273.566317][ T8338] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 273.566330][ T8338] RDX: 0000000000000012 RSI: 0000000000000000 RDI: 0000000000000000 [ 273.566341][ T8338] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 273.566352][ T8338] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 273.566363][ T8338] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 273.566397][ T8338] [ 273.598552][ T10] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 274.612612][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 274.626058][ T10] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 274.644648][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 274.662206][ T10] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 274.756660][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 274.806681][ T10] usb 1-1: config 0 descriptor?? [ 275.256463][ T10] nzxt-smart2 0003:1E71:2009.0019: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.0-1/input0 [ 275.614494][ T8368] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 275.761975][ T10] usb 1-1: USB disconnect, device number 18 [ 276.258475][ T10] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 276.587656][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 276.611426][ T8381] FAULT_INJECTION: forcing a failure. [ 276.611426][ T8381] name failslab, interval 1, probability 0, space 0, times 0 [ 276.612903][ T10] usb 2-1: New USB device found, idVendor=0fe9, idProduct=db01, bcdDevice=e9.9b [ 276.624847][ T8381] CPU: 1 UID: 0 PID: 8381 Comm: syz.0.638 Not tainted syzkaller #0 PREEMPT(full) [ 276.624873][ T8381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 276.624884][ T8381] Call Trace: [ 276.624891][ T8381] [ 276.624899][ T8381] dump_stack_lvl+0x189/0x250 [ 276.624928][ T8381] ? __pfx____ratelimit+0x10/0x10 [ 276.624959][ T8381] ? __pfx_dump_stack_lvl+0x10/0x10 [ 276.624982][ T8381] ? __pfx__printk+0x10/0x10 [ 276.625007][ T8381] ? __rt6_find_exception_rcu+0x127/0x4c0 [ 276.625032][ T8381] should_fail_ex+0x414/0x560 [ 276.625062][ T8381] should_failslab+0xa8/0x100 [ 276.625079][ T8381] ? __pfx_ip6_dst_gc+0x10/0x10 [ 276.625097][ T8381] kmem_cache_alloc_noprof+0x74/0x6e0 [ 276.625121][ T8381] ? dst_alloc+0x105/0x170 [ 276.625143][ T8381] ? __pfx_ip6_dst_gc+0x10/0x10 [ 276.625162][ T8381] dst_alloc+0x105/0x170 [ 276.625187][ T8381] ip6_pol_route+0xa21/0x1180 [ 276.625206][ T8381] ? ip6_pol_route+0x162/0x1180 [ 276.625231][ T8381] ? __pfx_ip6_pol_route+0x10/0x10 [ 276.625255][ T8381] ? lockdep_hardirqs_on+0x9c/0x150 [ 276.625279][ T8381] ? __local_bh_enable_ip+0x12d/0x1c0 [ 276.625306][ T8381] fib6_rule_lookup+0x1fc/0x6f0 [ 276.625330][ T8381] ? __pfx_ip6_pol_route_output+0x10/0x10 [ 276.625351][ T8381] ? __pfx_fib6_rule_lookup+0x10/0x10 [ 276.625375][ T8381] ? ip6_route_output_flags+0x2e/0x5d0 [ 276.625398][ T8381] ? ip6_route_output_flags+0x2e/0x5d0 [ 276.625435][ T8381] ip6_route_output_flags+0x364/0x5d0 [ 276.625455][ T8381] ? ip6_route_output_flags+0x2e/0x5d0 [ 276.625479][ T8381] icmpv6_rt_has_prefsrc+0x4f/0x3e0 [ 276.625502][ T8381] icmp6_send+0xd56/0x1940 [ 276.625521][ T8381] ? icmp6_send+0x1e9/0x1940 [ 276.625560][ T8381] ? __pfx_icmp6_send+0x10/0x10 [ 276.625604][ T8381] ? __ip6_local_out+0x82c/0x870 [ 276.625628][ T8381] ? __ip6_local_out+0x609/0x870 [ 276.625648][ T8381] ? __pfx___ip6_local_out+0x10/0x10 [ 276.625676][ T8381] ip6_pkt_drop+0x53d/0x620 [ 276.625700][ T8381] ip6_pkt_discard_out+0xf2/0x120 [ 276.625715][ T8381] ? ip6_send_skb+0x10f/0x390 [ 276.625740][ T8381] ip6_send_skb+0x1d5/0x390 [ 276.625768][ T8381] udp_v6_send_skb+0xc17/0x1830 [ 276.625811][ T8381] udpv6_sendmsg+0x1d62/0x2510 [ 276.625844][ T8381] ? __pfx_udplite_getfrag+0x10/0x10 [ 276.625874][ T8381] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 276.625904][ T8381] ? __pfx___might_resched+0x10/0x10 [ 276.625924][ T8381] ? get_page_from_freelist+0x2365/0x2440 [ 276.625963][ T8381] ? aa_sk_perm+0x81e/0x950 [ 276.626001][ T8381] ? inet_send_prepare+0x5c/0x270 [ 276.626031][ T8381] ? inet6_sendmsg+0xe4/0x120 [ 276.626052][ T8381] __sock_sendmsg+0xe5/0x270 [ 276.626079][ T8381] ____sys_sendmsg+0x52d/0x830 [ 276.626104][ T8381] ? __pfx_____sys_sendmsg+0x10/0x10 [ 276.626141][ T8381] ___sys_sendmsg+0x21f/0x2a0 [ 276.626163][ T8381] ? __pfx____sys_sendmsg+0x10/0x10 [ 276.626183][ T8381] ? __lock_acquire+0xab9/0xd20 [ 276.626237][ T8381] ? __fget_files+0x2a/0x420 [ 276.626252][ T8381] ? __fget_files+0x3a0/0x420 [ 276.626280][ T8381] __sys_sendmmsg+0x28e/0x430 [ 276.626305][ T8381] ? __pfx___sys_sendmmsg+0x10/0x10 [ 276.626320][ T8381] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 276.626372][ T8381] ? ksys_write+0x22a/0x250 [ 276.626393][ T8381] ? exc_page_fault+0x82/0x100 [ 276.626415][ T8381] ? __pfx_ksys_write+0x10/0x10 [ 276.626446][ T8381] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 276.626469][ T8381] __do_fast_syscall_32+0xb6/0x2b0 [ 276.626493][ T8381] ? lockdep_hardirqs_on+0x9c/0x150 [ 276.626519][ T8381] do_fast_syscall_32+0x34/0x80 [ 276.626543][ T8381] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 276.626562][ T8381] RIP: 0023:0xf7f15539 [ 276.626579][ T8381] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 276.626593][ T8381] RSP: 002b:00000000f540655c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 276.626613][ T8381] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080003a00 [ 276.626625][ T8381] RDX: 0000000000000002 RSI: 0000000000001000 RDI: 0000000000000000 [ 276.626636][ T8381] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 276.626646][ T8381] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 276.626657][ T8381] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 276.626687][ T8381] [ 277.469635][ T8389] __nla_validate_parse: 2 callbacks suppressed [ 277.469651][ T8389] netlink: 4 bytes leftover after parsing attributes in process `syz.2.639'. [ 277.758406][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.766680][ T10] usb 2-1: Product: syz [ 277.771107][ T10] usb 2-1: Manufacturer: syz [ 277.775752][ T10] usb 2-1: SerialNumber: syz [ 277.784106][ T10] usb 2-1: config 0 descriptor?? [ 277.793676][ T10] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in warm state. [ 277.802530][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 277.829501][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 277.846691][ T10] dvbdev: DVB: registering new adapter (DViCO FusionHDTV DVB-T USB (LGZ201)) [ 277.861603][ T10] usb 2-1: media controller created [ 277.906858][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 277.966573][ T8394] netlink: 'syz.0.642': attribute type 10 has an invalid length. [ 277.996889][ T8377] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 278.014092][ T8377] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 278.115451][ T10] cxusb: set interface failed [ 278.127552][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 278.230740][ T8401] netlink: 4 bytes leftover after parsing attributes in process `syz.2.644'. [ 278.241332][ T8401] netlink: 4 bytes leftover after parsing attributes in process `syz.2.644'. [ 278.351762][ T10] DVB: Unable to find symbol mt352_attach() [ 278.357717][ T10] dvb-usb: no frontend was attached by 'DViCO FusionHDTV DVB-T USB (LGZ201)' [ 278.799919][ T10] rc_core: IR keymap rc-dvico-portable not found [ 278.811026][ T10] Registered IR keymap rc-empty [ 278.869612][ T89] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 279.025981][ T5887] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 279.047544][ T10] rc rc0: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 279.121590][ T10] input: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input17 [ 279.174886][ T10] dvb-usb: schedule remote query interval to 100 msecs. [ 279.182405][ T10] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized and connected. [ 279.192713][ T89] usb 5-1: Using ep0 maxpacket: 16 [ 279.217621][ T89] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 279.238288][ T89] usb 5-1: config 0 interface 0 has no altsetting 0 [ 279.245153][ T10] usb 2-1: USB disconnect, device number 23 [ 279.251277][ T5887] usb 1-1: Using ep0 maxpacket: 16 [ 279.267090][ T89] usb 5-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 279.308424][ T5914] dvb-usb: bulk message failed: -22 (1/0) [ 279.330429][ T89] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.338779][ T5887] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 279.397826][ T5887] usb 1-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 279.421211][ T89] usb 5-1: config 0 descriptor?? [ 279.433198][ T5887] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.483868][ T5887] usb 1-1: config 0 descriptor?? [ 279.505608][ T10] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully deinitialized and disconnected. [ 279.521150][ T5887] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 279.690366][ T8421] FAULT_INJECTION: forcing a failure. [ 279.690366][ T8421] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 279.703787][ T8421] CPU: 1 UID: 0 PID: 8421 Comm: syz.3.651 Not tainted syzkaller #0 PREEMPT(full) [ 279.703824][ T8421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 279.703833][ T8421] Call Trace: [ 279.703839][ T8421] [ 279.703845][ T8421] dump_stack_lvl+0x189/0x250 [ 279.703866][ T8421] ? __pfx____ratelimit+0x10/0x10 [ 279.703880][ T8421] ? __pfx_dump_stack_lvl+0x10/0x10 [ 279.703904][ T8421] ? __pfx__printk+0x10/0x10 [ 279.703937][ T8421] should_fail_ex+0x414/0x560 [ 279.703977][ T8421] _copy_to_user+0x31/0xb0 [ 279.703997][ T8421] simple_read_from_buffer+0xe1/0x170 [ 279.704017][ T8421] proc_fail_nth_read+0x1b3/0x220 [ 279.704034][ T8421] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 279.704055][ T8421] ? rw_verify_area+0x2a6/0x4d0 [ 279.704079][ T8421] ? __lock_acquire+0xab9/0xd20 [ 279.704096][ T8421] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 279.704120][ T8421] vfs_read+0x200/0xa30 [ 279.704142][ T8421] ? fdget_pos+0x247/0x320 [ 279.704156][ T8421] ? __pfx___mutex_lock+0x10/0x10 [ 279.704172][ T8421] ? __pfx_vfs_read+0x10/0x10 [ 279.704188][ T8421] ? __fget_files+0x2a/0x420 [ 279.704204][ T8421] ? __fget_files+0x3a0/0x420 [ 279.704227][ T8421] ? __fget_files+0x2a/0x420 [ 279.704254][ T8421] ksys_read+0x145/0x250 [ 279.704277][ T8421] ? exc_page_fault+0x82/0x100 [ 279.704301][ T8421] ? __pfx_ksys_read+0x10/0x10 [ 279.704320][ T8421] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 279.704335][ T8421] ? lockdep_hardirqs_on+0x9c/0x150 [ 279.704351][ T8421] __do_fast_syscall_32+0xb6/0x2b0 [ 279.704370][ T8421] ? lockdep_hardirqs_on+0x9c/0x150 [ 279.704398][ T8421] do_fast_syscall_32+0x34/0x80 [ 279.704424][ T8421] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 279.704445][ T8421] RIP: 0023:0xf701d539 [ 279.704461][ T8421] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 279.704470][ T8421] RSP: 002b:00000000f540d590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 279.704485][ T8421] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f540d620 [ 279.704493][ T8421] RDX: 000000000000000f RSI: 00000000f73b6ff4 RDI: 0000000000000000 [ 279.704500][ T8421] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 279.704507][ T8421] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 279.704513][ T8421] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 279.704543][ T8421] [ 279.978509][ T10] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 280.029881][ T89] nzxt-smart2 0003:1E71:2009.001A: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.4-1/input0 [ 280.238419][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 280.288031][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 280.322351][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 280.333206][ T10] usb 2-1: New USB device found, idVendor=05ac, idProduct=024b, bcdDevice= 0.00 [ 280.357094][ T8414] random: crng reseeded on system resumption [ 280.367502][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 280.460756][ T10] usb 2-1: config 0 descriptor?? [ 280.562685][ T5931] usb 5-1: USB disconnect, device number 20 [ 280.616947][ T8429] netlink: 4 bytes leftover after parsing attributes in process `syz.2.654'. [ 280.627926][ T8429] netlink: 104 bytes leftover after parsing attributes in process `syz.2.654'. [ 280.649310][ T8429] netlink: 104 bytes leftover after parsing attributes in process `syz.2.654'. [ 280.712261][ T8429] kvm: user requested TSC rate below hardware speed [ 281.282338][ T8416] bridge2: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 281.312773][ T8436] netlink: 'syz.2.655': attribute type 10 has an invalid length. [ 281.513478][ T10] usbhid 2-1:0.0: can't add hid device: -71 [ 281.522250][ T10] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 281.567782][ T10] usb 2-1: USB disconnect, device number 24 [ 281.848088][ T8447] netlink: 8 bytes leftover after parsing attributes in process `syz.4.659'. [ 281.861831][ T8447] netlink: 40 bytes leftover after parsing attributes in process `syz.4.659'. [ 282.012853][ T8451] FAULT_INJECTION: forcing a failure. [ 282.012853][ T8451] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 282.081947][ T8451] CPU: 1 UID: 0 PID: 8451 Comm: syz.4.660 Not tainted syzkaller #0 PREEMPT(full) [ 282.081977][ T8451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 282.081985][ T8451] Call Trace: [ 282.081991][ T8451] [ 282.081996][ T8451] dump_stack_lvl+0x189/0x250 [ 282.082017][ T8451] ? __pfx____ratelimit+0x10/0x10 [ 282.082032][ T8451] ? __pfx_dump_stack_lvl+0x10/0x10 [ 282.082046][ T8451] ? __pfx__printk+0x10/0x10 [ 282.082058][ T8451] ? __might_fault+0xb0/0x130 [ 282.082079][ T8451] should_fail_ex+0x414/0x560 [ 282.082099][ T8451] copy_fpstate_to_sigframe+0xa8d/0xce0 [ 282.082115][ T8451] ? do_fast_syscall_32+0x34/0x80 [ 282.082132][ T8451] ? copy_fpstate_to_sigframe+0x181/0xce0 [ 282.082151][ T8451] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 282.082184][ T8451] ? fpu__alloc_mathframe+0xad/0x130 [ 282.082201][ T8451] get_sigframe+0x58d/0x7d0 [ 282.082220][ T8451] ? __pfx_get_sigframe+0x10/0x10 [ 282.082243][ T8451] ia32_setup_rt_frame+0x106/0xb70 [ 282.082256][ T8451] ? _raw_spin_unlock_irq+0x23/0x50 [ 282.082269][ T8451] ? lockdep_hardirqs_on+0x9c/0x150 [ 282.082285][ T8451] ? _raw_spin_unlock_irq+0x2e/0x50 [ 282.082297][ T8451] ? get_signal+0x1150/0x1340 [ 282.082313][ T8451] ? __pfx_ia32_setup_rt_frame+0x10/0x10 [ 282.082327][ T8451] ? arch_do_signal_or_restart+0x385/0x790 [ 282.082345][ T8451] arch_do_signal_or_restart+0x429/0x790 [ 282.082362][ T8451] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 282.082388][ T8451] ? exit_to_user_mode_loop+0x40/0x130 [ 282.082401][ T8451] exit_to_user_mode_loop+0x72/0x130 [ 282.082413][ T8451] __do_fast_syscall_32+0x1f4/0x2b0 [ 282.082428][ T8451] ? lockdep_hardirqs_on+0x9c/0x150 [ 282.082444][ T8451] do_fast_syscall_32+0x34/0x80 [ 282.082459][ T8451] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 282.082472][ T8451] RIP: 0023:0xf707d539 [ 282.082483][ T8451] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 282.082493][ T8451] RSP: 002b:00000000f546d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 282.082507][ T8451] RAX: ffffffffffffffe0 RBX: 0000000000000001 RCX: 0000000080003c00 [ 282.082516][ T8451] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 282.082523][ T8451] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 282.082529][ T8451] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 282.082536][ T8451] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 282.082553][ T8451] [ 282.356042][ T10] usb 1-1: USB disconnect, device number 19 [ 282.408404][ T5887] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 282.829067][ T5887] usb 4-1: Using ep0 maxpacket: 32 [ 282.839557][ T5887] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 282.859021][ T5887] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 282.884083][ T8461] netlink: 4 bytes leftover after parsing attributes in process `syz.4.662'. [ 282.895535][ T8461] netlink: 4 bytes leftover after parsing attributes in process `syz.4.662'. [ 283.004120][ T5887] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 283.025642][ T5887] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 283.046026][ T8465] netlink: 'syz.0.664': attribute type 1 has an invalid length. [ 283.054162][ T5887] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 283.075756][ T5887] usb 4-1: Product: syz [ 283.089705][ T5887] usb 4-1: Manufacturer: syz [ 283.096875][ T5887] usb 4-1: SerialNumber: syz [ 283.132616][ T5887] usb 4-1: config 0 descriptor?? [ 283.578686][ T8469] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 283.585964][ T8469] bridge0: port 3(netdevsim0) entered disabled state [ 283.809897][ T5830] usb 4-1: USB disconnect, device number 20 [ 284.578821][ T5887] usb 5-1: new low-speed USB device number 21 using dummy_hcd [ 284.654309][ T8477] netlink: 'syz.1.668': attribute type 10 has an invalid length. [ 284.738551][ T5887] usb 5-1: Invalid ep0 maxpacket: 32 [ 284.798289][ T5914] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 284.819898][ T10] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 284.931122][ T5887] usb 5-1: new low-speed USB device number 22 using dummy_hcd [ 285.018997][ T5914] usb 4-1: Using ep0 maxpacket: 16 [ 285.028596][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 285.036477][ T5914] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 285.050455][ T5914] usb 4-1: config 0 interface 0 has no altsetting 0 [ 285.057291][ T10] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 285.079881][ T5914] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 285.094088][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 285.101938][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.110648][ T10] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 285.120269][ T5887] usb 5-1: Invalid ep0 maxpacket: 32 [ 285.126707][ T5887] usb usb5-port1: attempt power cycle [ 285.136480][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.146386][ T5914] usb 4-1: config 0 descriptor?? [ 285.171730][ T8485] netlink: 'syz.2.672': attribute type 10 has an invalid length. [ 285.183605][ T10] usb 1-1: config 0 descriptor?? [ 285.210450][ T8487] netlink: 28 bytes leftover after parsing attributes in process `syz.1.671'. [ 285.219690][ T8487] netlink: 28 bytes leftover after parsing attributes in process `syz.1.671'. [ 285.355036][ T8491] netlink: 'syz.1.674': attribute type 1 has an invalid length. [ 285.388787][ T8491] 8021q: adding VLAN 0 to HW filter on device bond4 [ 285.498461][ T5887] usb 5-1: new low-speed USB device number 23 using dummy_hcd [ 285.519764][ T5887] usb 5-1: Invalid ep0 maxpacket: 32 [ 285.578250][ T5914] nzxt-smart2 0003:1E71:2009.001B: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.3-1/input0 [ 285.640876][ T10] nzxt-smart2 0003:1E71:2009.001C: hidraw1: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.0-1/input0 [ 285.688660][ T5887] usb 5-1: new low-speed USB device number 24 using dummy_hcd [ 285.729439][ T5887] usb 5-1: Invalid ep0 maxpacket: 32 [ 285.751401][ T5887] usb usb5-port1: unable to enumerate USB device [ 286.020331][ T5894] usb 4-1: USB disconnect, device number 21 [ 286.076329][ T5830] usb 1-1: USB disconnect, device number 20 [ 286.612761][ T8501] netlink: 'syz.1.676': attribute type 3 has an invalid length. [ 287.328339][ T10] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 287.518429][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 287.525948][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 287.547853][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 287.578430][ T8509] netlink: 'syz.3.679': attribute type 10 has an invalid length. [ 287.590351][ T10] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 287.651757][ T10] usb 1-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 287.680695][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.708632][ T10] usb 1-1: Product: syz [ 287.716586][ T10] usb 1-1: Manufacturer: syz [ 287.748992][ T8513] netlink: 24 bytes leftover after parsing attributes in process `syz.4.681'. [ 287.751329][ T10] usb 1-1: SerialNumber: syz [ 287.814806][ T10] usb 1-1: config 0 descriptor?? [ 288.118562][ T10] usb 1-1: USB disconnect, device number 21 [ 288.595320][ T8531] process 'syz.1.685' launched './file1' with NULL argv: empty string added [ 289.978603][ T5887] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 290.384542][ T5887] usb 1-1: Using ep0 maxpacket: 16 [ 290.404482][ T5887] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 290.428473][ T5887] usb 1-1: config 0 interface 0 has no altsetting 0 [ 290.468826][ T5887] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 290.474767][ T8545] FAULT_INJECTION: forcing a failure. [ 290.474767][ T8545] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 290.518588][ T5887] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.536970][ T8545] CPU: 1 UID: 0 PID: 8545 Comm: syz.4.690 Not tainted syzkaller #0 PREEMPT(full) [ 290.536995][ T8545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 290.537002][ T8545] Call Trace: [ 290.537007][ T8545] [ 290.537014][ T8545] dump_stack_lvl+0x189/0x250 [ 290.537033][ T8545] ? __pfx____ratelimit+0x10/0x10 [ 290.537049][ T8545] ? __pfx_dump_stack_lvl+0x10/0x10 [ 290.537063][ T8545] ? __pfx__printk+0x10/0x10 [ 290.537075][ T8545] ? __might_fault+0xb0/0x130 [ 290.537101][ T8545] should_fail_ex+0x414/0x560 [ 290.537122][ T8545] _copy_from_iter+0x1de/0x1790 [ 290.537139][ T8545] ? rcu_is_watching+0x15/0xb0 [ 290.537155][ T8545] ? kmalloc_reserve+0xbd/0x290 [ 290.537167][ T8545] ? __pfx__copy_from_iter+0x10/0x10 [ 290.537180][ T8545] ? __build_skb_around+0x262/0x3f0 [ 290.537198][ T8545] ? netlink_sendmsg+0x642/0xb30 [ 290.537209][ T8545] ? skb_put+0x11b/0x210 [ 290.537222][ T8545] netlink_sendmsg+0x6b2/0xb30 [ 290.537239][ T8545] ? __pfx_netlink_sendmsg+0x10/0x10 [ 290.537251][ T8545] ? __import_iovec+0x5d4/0x7f0 [ 290.537263][ T8545] ? aa_sock_msg_perm+0xf1/0x1d0 [ 290.537280][ T8545] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 290.537291][ T8545] ? __pfx_netlink_sendmsg+0x10/0x10 [ 290.537303][ T8545] __sock_sendmsg+0x21c/0x270 [ 290.537319][ T8545] ____sys_sendmsg+0x505/0x830 [ 290.537335][ T8545] ? __pfx_____sys_sendmsg+0x10/0x10 [ 290.537356][ T8545] ___sys_sendmsg+0x21f/0x2a0 [ 290.537370][ T8545] ? __pfx____sys_sendmsg+0x10/0x10 [ 290.537402][ T8545] ? __fget_files+0x2a/0x420 [ 290.537413][ T8545] ? __fget_files+0x3a0/0x420 [ 290.537429][ T8545] __sys_sendmsg+0x164/0x220 [ 290.537442][ T8545] ? __pfx___sys_sendmsg+0x10/0x10 [ 290.537459][ T8545] ? __pfx_ksys_write+0x10/0x10 [ 290.537476][ T8545] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 290.537493][ T8545] ? lockdep_hardirqs_on+0x9c/0x150 [ 290.537509][ T8545] __do_fast_syscall_32+0xb6/0x2b0 [ 290.537524][ T8545] ? lockdep_hardirqs_on+0x9c/0x150 [ 290.537540][ T8545] do_fast_syscall_32+0x34/0x80 [ 290.537555][ T8545] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 290.537568][ T8545] RIP: 0023:0xf707d539 [ 290.537579][ T8545] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 290.537589][ T8545] RSP: 002b:00000000f546d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 290.537603][ T8545] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000180 [ 290.537612][ T8545] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 290.537618][ T8545] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 290.537625][ T8545] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 290.537631][ T8545] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 290.537649][ T8545] [ 290.599547][ T5887] usb 1-1: config 0 descriptor?? [ 291.276063][ T8552] pim6reg: entered allmulticast mode [ 291.314657][ T8554] netlink: 24 bytes leftover after parsing attributes in process `syz.4.693'. [ 291.349608][ T8555] netlink: 24 bytes leftover after parsing attributes in process `syz.1.694'. [ 291.404465][ T8556] netlink: 4 bytes leftover after parsing attributes in process `syz.3.692'. [ 291.420455][ T8556] netlink: 4 bytes leftover after parsing attributes in process `syz.3.692'. [ 291.708827][ T8542] pim6reg: left allmulticast mode [ 292.085800][ T5887] nzxt-smart2 0003:1E71:2009.001D: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.0-1/input0 [ 292.554910][ T8564] netlink: 40 bytes leftover after parsing attributes in process `syz.1.695'. [ 292.567971][ T8564] netlink: 40 bytes leftover after parsing attributes in process `syz.1.695'. [ 292.628079][ T10] usb 1-1: USB disconnect, device number 22 [ 292.722572][ T8562] fido_id[8562]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 294.372559][ T8588] netlink: 'syz.0.701': attribute type 2 has an invalid length. [ 294.937548][ T8597] FAULT_INJECTION: forcing a failure. [ 294.937548][ T8597] name failslab, interval 1, probability 0, space 0, times 0 [ 294.957624][ T8597] CPU: 1 UID: 0 PID: 8597 Comm: syz.0.703 Not tainted syzkaller #0 PREEMPT(full) [ 294.957654][ T8597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 294.957666][ T8597] Call Trace: [ 294.957674][ T8597] [ 294.957682][ T8597] dump_stack_lvl+0x189/0x250 [ 294.957712][ T8597] ? __pfx____ratelimit+0x10/0x10 [ 294.957736][ T8597] ? __pfx_dump_stack_lvl+0x10/0x10 [ 294.957762][ T8597] ? __pfx__printk+0x10/0x10 [ 294.957788][ T8597] ? __pfx___might_resched+0x10/0x10 [ 294.957814][ T8597] should_fail_ex+0x414/0x560 [ 294.957846][ T8597] should_failslab+0xa8/0x100 [ 294.957865][ T8597] __kmalloc_noprof+0xcb/0x7f0 [ 294.957888][ T8597] ? kfree+0x4d/0x6d0 [ 294.957906][ T8597] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 294.957941][ T8597] tomoyo_realpath_from_path+0xe3/0x5d0 [ 294.957969][ T8597] ? tomoyo_domain+0xd9/0x130 [ 294.957993][ T8597] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 294.958016][ T8597] tomoyo_path_number_perm+0x1e8/0x5a0 [ 294.958043][ T8597] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 294.958088][ T8597] ? __lock_acquire+0xab9/0xd20 [ 294.958142][ T8597] ? __fget_files+0x2a/0x420 [ 294.958165][ T8597] ? __fget_files+0x3a0/0x420 [ 294.958186][ T8597] ? __fget_files+0x2a/0x420 [ 294.958208][ T8597] security_file_ioctl_compat+0xcb/0x2d0 [ 294.958234][ T8597] __ia32_compat_sys_ioctl+0x128/0x840 [ 294.958262][ T8597] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 294.958288][ T8597] ? __fget_files+0x3a0/0x420 [ 294.958312][ T8597] ? fput+0xa0/0xd0 [ 294.958333][ T8597] ? ksys_write+0x22a/0x250 [ 294.958357][ T8597] ? exc_page_fault+0x82/0x100 [ 294.958383][ T8597] ? __pfx_ksys_write+0x10/0x10 [ 294.958411][ T8597] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 294.958439][ T8597] ? lockdep_hardirqs_on+0x9c/0x150 [ 294.958467][ T8597] __do_fast_syscall_32+0xb6/0x2b0 [ 294.958494][ T8597] ? lockdep_hardirqs_on+0x9c/0x150 [ 294.958522][ T8597] do_fast_syscall_32+0x34/0x80 [ 294.958549][ T8597] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 294.958572][ T8597] RIP: 0023:0xf7f15539 [ 294.958590][ T8597] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 294.958606][ T8597] RSP: 002b:00000000f540655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 294.958628][ T8597] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000000ae80 [ 294.958642][ T8597] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 294.958652][ T8597] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 294.958663][ T8597] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 294.958674][ T8597] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 294.958707][ T8597] [ 295.286519][ T8578] netlink: 4 bytes leftover after parsing attributes in process `syz.2.700'. [ 295.298123][ T8604] PKCS7: Unknown OID: [5] (bad) [ 295.336511][ T8604] PKCS7: Only support pkcs7_signedData type [ 295.353658][ T8597] ERROR: Out of memory at tomoyo_realpath_from_path. [ 295.393957][ T43] IPVS: starting estimator thread 0... [ 295.418081][ T8603] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 295.426779][ T8603] tipc: Enabled bearer , priority 10 [ 295.498384][ T8607] IPVS: using max 23 ests per chain, 55200 per kthread [ 295.548623][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 295.688322][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 295.828572][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 295.968301][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 296.064837][ T8616] netlink: 4 bytes leftover after parsing attributes in process `syz.1.708'. [ 296.079724][ T8616] netlink: 4 bytes leftover after parsing attributes in process `syz.1.708'. [ 296.108294][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 296.242177][ T8621] Cannot find add_set index 0 as target [ 296.248303][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 296.388435][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 296.433951][ T8625] Cannot find add_set index 0 as target [ 296.479524][ T10] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 296.533149][ T5894] tipc: Node number set to 2023593592 [ 296.545486][ T8627] netlink: 'syz.3.711': attribute type 10 has an invalid length. [ 296.668288][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 296.768271][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 296.841186][ T10] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 296.852889][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 296.863393][ T10] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 296.872759][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.938296][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 297.205028][ T10] usb 1-1: config 0 descriptor?? [ 297.729631][ T10] nzxt-smart2 0003:1E71:2009.001E: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.0-1/input0 [ 297.968387][ T5887] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 298.195399][ T5887] usb 4-1: Using ep0 maxpacket: 8 [ 298.203208][ T8649] ucma_write: process 525 (syz.2.716) changed security contexts after opening file descriptor, this is not allowed. [ 298.236995][ T5887] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 298.246201][ T5887] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 298.263842][ T8649] ip6t_srh: unknown srh invflags 7160 [ 298.278907][ T5894] usb 1-1: USB disconnect, device number 23 [ 298.303694][ T5887] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 298.346480][ T5887] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 298.387441][ T5887] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 298.421270][ T5887] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 298.460826][ T5887] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.702314][ T8661] netlink: 4 bytes leftover after parsing attributes in process `syz.2.720'. [ 298.815237][ T5887] usb 4-1: usb_control_msg returned -32 [ 298.823624][ T5887] usbtmc 4-1:16.0: can't read capabilities [ 298.847000][ T8661] netlink: 4 bytes leftover after parsing attributes in process `syz.2.720'. [ 299.068340][ T5914] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 299.178245][ T8640] usbtmc 4-1:16.0: usb_control_msg returned -32 [ 299.284219][ T5914] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 299.295947][ T5914] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 299.316808][ T5914] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 299.326693][ T5914] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 299.335687][ T5914] usb 5-1: SerialNumber: syz [ 299.359278][ T5887] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 299.496815][ T8667] netlink: 16 bytes leftover after parsing attributes in process `syz.0.723'. [ 299.576426][ T8662] loop6: detected capacity change from 0 to 524287999 [ 299.587068][ T8662] Buffer I/O error on dev loop6, logical block 0, async page read [ 299.598420][ T5887] usb 2-1: Using ep0 maxpacket: 16 [ 299.608521][ T8662] Buffer I/O error on dev loop6, logical block 0, async page read [ 299.609774][ T5887] usb 2-1: no configurations [ 299.624230][ T5887] usb 2-1: can't read configurations, error -22 [ 299.642641][ T8662] Buffer I/O error on dev loop6, logical block 0, async page read [ 299.653751][ T8662] Buffer I/O error on dev loop6, logical block 0, async page read [ 299.663549][ T8662] Buffer I/O error on dev loop6, logical block 0, async page read [ 299.673315][ T8662] Buffer I/O error on dev loop6, logical block 0, async page read [ 299.683102][ T8662] Buffer I/O error on dev loop6, logical block 0, async page read [ 299.691714][ T8662] Buffer I/O error on dev loop6, logical block 0, async page read [ 299.700864][ T8662] ldm_validate_partition_table(): Disk read failed. [ 299.708408][ T8662] Buffer I/O error on dev loop6, logical block 0, async page read [ 299.718537][ T8662] Buffer I/O error on dev loop6, logical block 0, async page read [ 299.728414][ T8662] Dev loop6: unable to read RDB block 0 [ 299.739271][ T8662] loop6: unable to read partition table [ 299.746695][ T8662] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾x³˜CÖ) failed (rc=-5) [ 299.989014][ T5887] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 300.148680][ T5887] usb 2-1: Using ep0 maxpacket: 16 [ 300.157323][ T5887] usb 2-1: no configurations [ 300.182120][ T5887] usb 2-1: can't read configurations, error -22 [ 300.194316][ T5887] usb usb2-port1: attempt power cycle [ 300.540712][ T5887] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 300.628601][ C1] net_ratelimit: 3 callbacks suppressed [ 300.628625][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 300.750073][ T5887] usb 2-1: Using ep0 maxpacket: 16 [ 300.755926][ T5887] usb 2-1: no configurations [ 300.763860][ T5887] usb 2-1: can't read configurations, error -22 [ 300.938871][ T5887] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 300.954231][ T89] usb 4-1: USB disconnect, device number 22 [ 301.006950][ T5887] usb 2-1: Using ep0 maxpacket: 16 [ 301.016441][ T5887] usb 2-1: no configurations [ 301.032896][ T5887] usb 2-1: can't read configurations, error -22 [ 301.097921][ T5887] usb usb2-port1: unable to enumerate USB device [ 301.668678][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 301.889953][ T5914] usb 5-1: cannot find UAC_HEADER [ 301.924158][ T5198] ldm_validate_partition_table(): Disk read failed. [ 301.956063][ T5914] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 301.965971][ T5198] Dev loop6: unable to read RDB block 0 [ 301.983876][ T5198] loop6: unable to read partition table [ 302.000432][ T5914] usb 5-1: USB disconnect, device number 25 [ 302.085362][ T6504] udevd[6504]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 302.375622][ T8699] PKCS7: Unknown OID: [5] (bad) [ 302.388873][ T8699] PKCS7: Only support pkcs7_signedData type [ 302.642031][ T8703] vivid-000: ================= START STATUS ================= [ 302.650368][ T8703] vivid-000: Test Pattern: 75% Colorbar [ 302.656466][ T8703] vivid-000: Fill Percentage of Frame: 100 [ 302.662581][ T8703] vivid-000: Horizontal Movement: No Movement [ 302.668764][ T8703] vivid-000: Vertical Movement: No Movement [ 302.675735][ T8703] vivid-000: OSD Text Mode: All [ 302.680813][ T8703] vivid-000: Show Border: false [ 302.687857][ T8703] vivid-000: Show Square: false [ 302.708710][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 302.781796][ T8703] vivid-000: Sensor Flipped Horizontally: false [ 302.792432][ T8703] vivid-000: Sensor Flipped Vertically: false [ 302.798724][ T8703] vivid-000: Insert SAV Code in Image: false [ 302.804825][ T8703] vivid-000: Insert EAV Code in Image: false [ 302.811509][ T8703] vivid-000: Insert Video Guard Band: false [ 302.818296][ T8703] vivid-000: Reduced Framerate: false [ 302.824733][ T8703] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 302.832683][ T8703] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 302.840983][ T8703] vivid-000: Enable Capture Cropping: true [ 302.920863][ T8703] vivid-000: Enable Capture Composing: true [ 302.940175][ T8703] vivid-000: Enable Capture Scaler: true [ 302.946120][ T8703] vivid-000: Timestamp Source: End of Frame [ 302.952570][ T8703] vivid-000: Colorspace: sRGB [ 302.957441][ T8703] vivid-000: Transfer Function: Default [ 302.964638][ T8703] vivid-000: Y'CbCr Encoding: Default [ 302.970216][ T8703] vivid-000: HSV Encoding: Hue 0-179 [ 302.975727][ T8703] vivid-000: Quantization: Default [ 302.981297][ T8703] vivid-000: Apply Alpha To Red Only: false [ 302.987394][ T8703] vivid-000: Standard Aspect Ratio: 4x3 [ 302.993199][ T8703] vivid-000: DV Timings Signal Mode: Current DV Timings inactive [ 303.001631][ T8703] vivid-000: DV Timings: 640x480p59 inactive [ 303.007941][ T8703] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 303.015415][ T8703] vivid-000: Maximum EDID Blocks: 2 [ 303.020823][ T8703] vivid-000: Limited RGB Range (16-235): false [ 303.027124][ T8703] vivid-000: Rx RGB Quantization Range: Automatic [ 303.033769][ T8703] vivid-000: Power Present: 0x00000001 [ 303.039495][ T8703] tpg source WxH: 320x180 (R'G'B) [ 303.045605][ T8703] tpg field: 1 [ 303.049137][ T8703] tpg crop: (0,0)/320x180 [ 303.053585][ T8703] tpg compose: (0,0)/320x180 [ 303.058414][ T8703] tpg colorspace: 8 [ 303.062498][ T8703] tpg transfer function: 0/0 [ 303.067352][ T8703] tpg quantization: 0/0 [ 303.077045][ T8703] tpg RGB range: 0/2 [ 303.081161][ T8703] vivid-000: ================== END STATUS ================== [ 303.748690][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 303.778343][ T5931] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 303.810177][ T8721] netlink: 'syz.2.738': attribute type 3 has an invalid length. [ 303.961243][ T5931] usb 2-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 303.978325][ T5931] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 303.995647][ T5931] usb 2-1: Product: syz [ 304.007141][ T5931] usb 2-1: Manufacturer: syz [ 304.010795][ T8723] netlink: 'syz.0.739': attribute type 2 has an invalid length. [ 304.017732][ T5931] usb 2-1: SerialNumber: syz [ 304.112842][ T5931] usb 2-1: config 0 descriptor?? [ 304.155632][ T5931] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 304.500701][ T5931] gspca_sunplus: reg_r err -71 [ 304.522322][ T5931] usb 2-1: USB disconnect, device number 29 [ 304.798872][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 305.048800][ T43] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 305.136742][ T8744] netlink: 120 bytes leftover after parsing attributes in process `syz.2.744'. [ 305.225507][ T8745] fuse: Bad value for 'fd' [ 305.825371][ T43] usb 1-1: Using ep0 maxpacket: 32 [ 305.830724][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 306.301393][ T43] usb 1-1: config 0 has an invalid interface number: 133 but max is 0 [ 306.327024][ T43] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 306.379765][ T43] usb 1-1: config 0 has no interface number 0 [ 306.388370][ T43] usb 1-1: config 0 interface 133 altsetting 0 bulk endpoint 0xB has invalid maxpacket 1024 [ 306.398708][ T43] usb 1-1: config 0 interface 133 altsetting 0 endpoint 0xF has invalid maxpacket 46383, setting to 1024 [ 306.412540][ T43] usb 1-1: config 0 interface 133 altsetting 0 bulk endpoint 0xF has invalid maxpacket 1024 [ 306.422766][ T43] usb 1-1: config 0 interface 133 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 306.445739][ T43] usb 1-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=71.1e [ 306.455558][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.463725][ T43] usb 1-1: Product: syz [ 306.467946][ T43] usb 1-1: Manufacturer: syz [ 306.487789][ T43] usb 1-1: SerialNumber: syz [ 306.509429][ T43] usb 1-1: config 0 descriptor?? [ 306.515424][ T8740] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 306.522967][ T8740] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 306.559197][ T8736] netlink: 'syz.4.740': attribute type 10 has an invalid length. [ 306.577740][ T8736] netlink: 40 bytes leftover after parsing attributes in process `syz.4.740'. [ 306.664046][ T8736] batadv0: entered promiscuous mode [ 306.678480][ T8736] batadv0: entered allmulticast mode [ 306.725755][ T8736] bridge0: port 3(batadv0) entered blocking state [ 306.742156][ T8736] bridge0: port 3(batadv0) entered disabled state [ 306.765880][ T43] usb 1-1: probing VID:PID(0424:012C) [ 306.773081][ T43] usb 1-1: vub300 testing BULK OUT EndPoint(0) 0B [ 306.779587][ T43] usb 1-1: vub300 testing BULK OUT EndPoint(1) 0F [ 306.786010][ T43] usb 1-1: Could not find two sets of bulk-in/out endpoint pairs [ 306.794628][ T43] vub300 1-1:0.133: probe with driver vub300 failed with error -22 [ 306.805280][ T8736] bridge0: port 3(batadv0) entered blocking state [ 306.811944][ T8736] bridge0: port 3(batadv0) entered forwarding state [ 306.832545][ T43] usb 1-1: USB disconnect, device number 24 [ 306.868266][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 306.878990][ T5894] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 306.920787][ T8744] syz.2.744 (8744): drop_caches: 2 [ 307.022023][ T8750] netlink: 'syz.3.746': attribute type 3 has an invalid length. [ 307.060001][ T5894] usb 2-1: Using ep0 maxpacket: 32 [ 307.067543][ T5894] usb 2-1: config 0 has no interfaces? [ 307.075857][ T5894] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 307.079148][ T7053] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 307.085751][ T5894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.095045][ T7053] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 307.120323][ T5894] usb 2-1: Product: syz [ 307.125348][ T5894] usb 2-1: Manufacturer: syz [ 307.204704][ T5894] usb 2-1: SerialNumber: syz [ 307.235656][ T5894] usb 2-1: config 0 descriptor?? [ 307.443701][ T8753] FAULT_INJECTION: forcing a failure. [ 307.443701][ T8753] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 307.456417][ T8755] netlink: 'syz.0.748': attribute type 2 has an invalid length. [ 307.496938][ T8748] dummy0: entered promiscuous mode [ 307.509777][ T8748] vlan2: entered promiscuous mode [ 307.532946][ T8753] CPU: 1 UID: 0 PID: 8753 Comm: syz.2.747 Not tainted syzkaller #0 PREEMPT(full) [ 307.532975][ T8753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 307.532987][ T8753] Call Trace: [ 307.532995][ T8753] [ 307.533004][ T8753] dump_stack_lvl+0x189/0x250 [ 307.533036][ T8753] ? __pfx____ratelimit+0x10/0x10 [ 307.533060][ T8753] ? __pfx_dump_stack_lvl+0x10/0x10 [ 307.533084][ T8753] ? __pfx__printk+0x10/0x10 [ 307.533104][ T8753] ? __might_fault+0xb0/0x130 [ 307.533143][ T8753] should_fail_ex+0x414/0x560 [ 307.533176][ T8753] _copy_from_user+0x2d/0xb0 [ 307.533200][ T8753] get_compat_msghdr+0xad/0x4a0 [ 307.533227][ T8753] ? __pfx_get_compat_msghdr+0x10/0x10 [ 307.533260][ T8753] ___sys_sendmsg+0x193/0x2a0 [ 307.533282][ T8753] ? __pfx____sys_sendmsg+0x10/0x10 [ 307.533300][ T8753] ? __lock_acquire+0xab9/0xd20 [ 307.533347][ T8753] ? __fget_files+0x2a/0x420 [ 307.533361][ T8753] ? __fget_files+0x3a0/0x420 [ 307.533382][ T8753] __sys_sendmmsg+0x28e/0x430 [ 307.533407][ T8753] ? __pfx___sys_sendmmsg+0x10/0x10 [ 307.533424][ T8753] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 307.533480][ T8753] ? ksys_write+0x22a/0x250 [ 307.533505][ T8753] ? exc_page_fault+0x82/0x100 [ 307.533530][ T8753] ? __pfx_ksys_write+0x10/0x10 [ 307.533562][ T8753] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 307.533587][ T8753] __do_fast_syscall_32+0xb6/0x2b0 [ 307.533612][ T8753] ? lockdep_hardirqs_on+0x9c/0x150 [ 307.533639][ T8753] do_fast_syscall_32+0x34/0x80 [ 307.533661][ T8753] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 307.533681][ T8753] RIP: 0023:0xf705d539 [ 307.533710][ T8753] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 307.533725][ T8753] RSP: 002b:00000000f544d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 307.533747][ T8753] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000600 [ 307.533762][ T8753] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 307.533772][ T8753] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 307.533783][ T8753] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 307.533792][ T8753] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 307.533820][ T8753] [ 307.908385][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 307.977584][ T89] usb 2-1: USB disconnect, device number 30 [ 308.326610][ T8769] netlink: 4 bytes leftover after parsing attributes in process `syz.0.753'. [ 308.344244][ T8771] netlink: 24 bytes leftover after parsing attributes in process `syz.2.754'. [ 308.600993][ T8779] netlink: 4 bytes leftover after parsing attributes in process `syz.0.755'. [ 308.613046][ T8779] netlink: 4 bytes leftover after parsing attributes in process `syz.0.755'. [ 308.948257][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 309.002946][ T8786] netlink: 8 bytes leftover after parsing attributes in process `syz.1.759'. [ 309.770529][ T8790] Set syz0 is full, maxelem 0 reached [ 309.988261][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 310.038876][ T5894] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 310.295578][ T5894] usb 5-1: config 0 has an invalid interface number: 217 but max is 0 [ 310.346359][ T8803] netlink: 4 bytes leftover after parsing attributes in process `syz.1.762'. [ 310.366506][ T8803] netlink: 4 bytes leftover after parsing attributes in process `syz.1.762'. [ 310.474357][ T5894] usb 5-1: config 0 has no interface number 0 [ 310.522078][ T8805] netlink: 8 bytes leftover after parsing attributes in process `syz.0.763'. [ 310.536723][ T8805] syz_tun: entered promiscuous mode [ 310.544282][ T8805] syz_tun: left promiscuous mode [ 310.614401][ T5894] usb 5-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 310.623932][ T5894] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 310.868396][ T5894] usb 5-1: Product: syz [ 310.878468][ T5894] usb 5-1: Manufacturer: syz [ 311.028305][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 311.302046][ T5894] usb 5-1: SerialNumber: syz [ 311.367699][ T8811] netlink: 4 bytes leftover after parsing attributes in process `syz.0.767'. [ 311.388815][ T8811] netlink: 4 bytes leftover after parsing attributes in process `syz.0.767'. [ 311.529474][ T5894] usb 5-1: config 0 descriptor?? [ 311.625790][ T8815] ipt_rpfilter: unknown options [ 311.655208][ T5894] hub 5-1:0.217: bad descriptor, ignoring hub [ 311.668389][ T5894] hub 5-1:0.217: probe with driver hub failed with error -5 [ 311.744711][ T8815] ipt_rpfilter: unknown options [ 311.796126][ T8790] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 311.963245][ T8823] binder: BINDER_SET_CONTEXT_MGR already set [ 311.972218][ T8823] binder: 8821:8823 ioctl 4018620d 80004a80 returned -16 [ 312.068286][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 312.226068][ T8830] netlink: 4 bytes leftover after parsing attributes in process `syz.0.774'. [ 312.338593][ T8832] netlink: 4 bytes leftover after parsing attributes in process `syz.2.773'. [ 312.361931][ T8832] netlink: 4 bytes leftover after parsing attributes in process `syz.2.773'. [ 312.997066][ T8839] FAULT_INJECTION: forcing a failure. [ 312.997066][ T8839] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 313.098270][ T8839] CPU: 1 UID: 0 PID: 8839 Comm: syz.1.776 Not tainted syzkaller #0 PREEMPT(full) [ 313.098300][ T8839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 313.098312][ T8839] Call Trace: [ 313.098320][ T8839] [ 313.098329][ T8839] dump_stack_lvl+0x189/0x250 [ 313.098367][ T8839] ? __pfx____ratelimit+0x10/0x10 [ 313.098391][ T8839] ? __pfx_dump_stack_lvl+0x10/0x10 [ 313.098416][ T8839] ? __pfx__printk+0x10/0x10 [ 313.098435][ T8839] ? __might_fault+0xb0/0x130 [ 313.098472][ T8839] should_fail_ex+0x414/0x560 [ 313.098495][ T8839] _copy_from_iter+0x1de/0x1790 [ 313.098510][ T8839] ? skb_set_owner_w+0x25b/0x3a0 [ 313.098525][ T8839] ? sock_alloc_send_pskb+0x86b/0x980 [ 313.098542][ T8839] ? __pfx__copy_from_iter+0x10/0x10 [ 313.098559][ T8839] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 313.098574][ T8839] skb_copy_datagram_from_iter+0xf5/0x720 [ 313.098590][ T8839] ? dev_get_by_index+0x22/0x2e0 [ 313.098610][ T8839] ? skb_put+0x11b/0x210 [ 313.098624][ T8839] packet_sendmsg+0x3797/0x5080 [ 313.098647][ T8839] ? aa_af_perm+0x25/0x2c0 [ 313.098673][ T8839] ? __pfx___might_resched+0x10/0x10 [ 313.098695][ T8839] ? __pfx_packet_sendmsg+0x10/0x10 [ 313.098709][ T8839] ? aa_sk_perm+0x81e/0x950 [ 313.098727][ T8839] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 313.098745][ T8839] ? __asan_memset+0x22/0x50 [ 313.098759][ T8839] ? __import_iovec+0x5d4/0x7f0 [ 313.098771][ T8839] ? aa_sock_msg_perm+0xf1/0x1d0 [ 313.098788][ T8839] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 313.098799][ T8839] ? __pfx_packet_sendmsg+0x10/0x10 [ 313.098815][ T8839] __sock_sendmsg+0x21c/0x270 [ 313.098832][ T8839] ____sys_sendmsg+0x505/0x830 [ 313.098851][ T8839] ? __pfx_____sys_sendmsg+0x10/0x10 [ 313.098874][ T8839] ___sys_sendmsg+0x21f/0x2a0 [ 313.098888][ T8839] ? __pfx____sys_sendmsg+0x10/0x10 [ 313.098921][ T8839] ? __fget_files+0x2a/0x420 [ 313.098932][ T8839] ? __fget_files+0x3a0/0x420 [ 313.098948][ T8839] __sys_sendmsg+0x164/0x220 [ 313.098961][ T8839] ? __pfx___sys_sendmsg+0x10/0x10 [ 313.098979][ T8839] ? __pfx_ksys_write+0x10/0x10 [ 313.098997][ T8839] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 313.099014][ T8839] ? lockdep_hardirqs_on+0x9c/0x150 [ 313.099030][ T8839] __do_fast_syscall_32+0xb6/0x2b0 [ 313.099046][ T8839] ? lockdep_hardirqs_on+0x9c/0x150 [ 313.099063][ T8839] do_fast_syscall_32+0x34/0x80 [ 313.099078][ T8839] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 313.099092][ T8839] RIP: 0023:0xf7f91539 [ 313.099103][ T8839] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 313.099113][ T8839] RSP: 002b:00000000f548655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 313.099128][ T8839] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 313.099136][ T8839] RDX: 0000000004000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 313.099143][ T8839] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 313.099150][ T8839] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 313.099157][ T8839] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 313.099174][ T8839] [ 313.423863][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 313.866054][ T5894] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in cold state, will try to load a firmware [ 313.960410][ T5894] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 314.016959][ T5894] dib0700: firmware download failed at 7 with -22 [ 314.048518][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 314.048539][ T30] audit: type=1326 audit(1762389055.095:123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.4.780" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 314.083214][ T5894] usb 5-1: USB disconnect, device number 26 [ 314.173607][ T30] audit: type=1326 audit(1762389055.105:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.4.780" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 314.276083][ T30] audit: type=1326 audit(1762389055.105:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.4.780" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 314.315460][ T30] audit: type=1326 audit(1762389055.105:126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.4.780" exe="/root/syz-executor" sig=0 arch=40000003 syscall=296 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 314.340303][ T30] audit: type=1326 audit(1762389055.105:127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.4.780" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 314.380125][ T30] audit: type=1326 audit(1762389055.105:128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.4.780" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 314.468282][ C1] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 314.634072][ T8859] ------------[ cut here ]------------ [ 314.639798][ T8859] WARNING: CPU: 0 PID: 8859 at drivers/gpu/drm/drm_prime.c:223 drm_prime_destroy_file_private+0x4b/0x60 [ 314.651083][ T8859] Modules linked in: [ 314.654985][ T8859] CPU: 0 UID: 0 PID: 8859 Comm: syz.4.782 Not tainted syzkaller #0 PREEMPT(full) [ 314.664451][ T8859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 314.674577][ T8859] RIP: 0010:drm_prime_destroy_file_private+0x4b/0x60 [ 314.681601][ T8859] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 fd 5a f2 fc 48 83 3b 00 75 0c e8 c2 a5 8c fc 5b e9 cc c3 15 06 cc e8 b6 a5 8c fc 90 <0f> 0b 90 5b e9 bc c3 15 06 cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 [ 314.701880][ T8859] RSP: 0018:ffffc9000b6a7c40 EFLAGS: 00010293 [ 314.708017][ T8859] RAX: ffffffff853360da RBX: ffff888055bef410 RCX: ffff8880253b8000 [ 314.716648][ T8859] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888055bef380 [ 314.724860][ T8859] RBP: ffff888055bef2c8 R08: ffffc9000b6a7bc7 R09: 1ffff920016d4f78 [ 314.733199][ T8859] R10: dffffc0000000000 R11: fffff520016d4f79 R12: dffffc0000000000 [ 314.741445][ T8859] R13: dead000000000100 R14: 0000000000000000 R15: ffff888055bef2d8 [ 314.749541][ T8859] FS: 0000000000000000(0000) GS:ffff88812613d000(0063) knlGS:000000005799f440 [ 314.759013][ T8859] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 314.765780][ T8859] CR2: 00000000f71a72a0 CR3: 0000000077b0e000 CR4: 00000000003526f0 [ 314.773912][ T8859] Call Trace: [ 314.777207][ T8859] [ 314.780186][ T8859] drm_file_free+0x7f2/0xa00 [ 314.784800][ T8859] drm_release+0x2de/0x3f0 [ 314.789581][ T8859] ? __pfx_drm_release+0x10/0x10 [ 314.794674][ T8859] __fput+0x44c/0xa70 [ 314.798749][ T8859] task_work_run+0x1d4/0x260 [ 314.803571][ T8859] ? __pfx_task_work_run+0x10/0x10 [ 314.809100][ T8859] ? exit_to_user_mode_loop+0x40/0x130 [ 314.814709][ T8859] exit_to_user_mode_loop+0xe9/0x130 [ 314.820233][ T8859] __do_fast_syscall_32+0x1f4/0x2b0 [ 314.825461][ T8859] ? lockdep_hardirqs_on+0x9c/0x150 [ 314.830870][ T8859] do_fast_syscall_32+0x34/0x80 [ 314.835785][ T8859] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 314.842251][ T8859] RIP: 0023:0xf707d539 [ 314.846336][ T8859] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 314.866224][ T8859] RSP: 002b:00000000f756faec EFLAGS: 00000206 ORIG_RAX: 00000000000001b4 [ 314.874771][ T8859] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 000000000000001e [ 314.882958][ T8859] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 314.891106][ T8859] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 314.899219][ T8859] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 314.907492][ T8859] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 314.915637][ T8859] [ 314.919078][ T8859] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 314.926385][ T8859] CPU: 0 UID: 0 PID: 8859 Comm: syz.4.782 Not tainted syzkaller #0 PREEMPT(full) [ 314.935656][ T8859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 314.945869][ T8859] Call Trace: [ 314.949154][ T8859] [ 314.952191][ T8859] dump_stack_lvl+0x99/0x250 [ 314.956884][ T8859] ? __asan_memcpy+0x40/0x70 [ 314.961572][ T8859] ? __pfx_dump_stack_lvl+0x10/0x10 [ 314.966954][ T8859] ? __pfx__printk+0x10/0x10 [ 314.971559][ T8859] vpanic+0x237/0x6d0 [ 314.975551][ T8859] ? __pfx_vpanic+0x10/0x10 [ 314.980084][ T8859] panic+0xb9/0xc0 [ 314.983919][ T8859] ? __pfx_panic+0x10/0x10 [ 314.988354][ T8859] __warn+0x31b/0x4b0 [ 314.992360][ T8859] ? drm_prime_destroy_file_private+0x4b/0x60 [ 314.998473][ T8859] ? drm_prime_destroy_file_private+0x4b/0x60 [ 315.004577][ T8859] report_bug+0x2be/0x4f0 [ 315.009020][ T8859] ? drm_prime_destroy_file_private+0x4b/0x60 [ 315.015277][ T8859] ? drm_prime_destroy_file_private+0x4b/0x60 [ 315.021451][ T8859] ? drm_prime_destroy_file_private+0x4d/0x60 [ 315.027614][ T8859] handle_bug+0x84/0x160 [ 315.031961][ T8859] exc_invalid_op+0x1a/0x50 [ 315.036666][ T8859] asm_exc_invalid_op+0x1a/0x20 [ 315.041516][ T8859] RIP: 0010:drm_prime_destroy_file_private+0x4b/0x60 [ 315.048206][ T8859] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 fd 5a f2 fc 48 83 3b 00 75 0c e8 c2 a5 8c fc 5b e9 cc c3 15 06 cc e8 b6 a5 8c fc 90 <0f> 0b 90 5b e9 bc c3 15 06 cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 [ 315.068000][ T8859] RSP: 0018:ffffc9000b6a7c40 EFLAGS: 00010293 [ 315.074078][ T8859] RAX: ffffffff853360da RBX: ffff888055bef410 RCX: ffff8880253b8000 [ 315.082143][ T8859] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888055bef380 [ 315.090119][ T8859] RBP: ffff888055bef2c8 R08: ffffc9000b6a7bc7 R09: 1ffff920016d4f78 [ 315.098186][ T8859] R10: dffffc0000000000 R11: fffff520016d4f79 R12: dffffc0000000000 [ 315.106254][ T8859] R13: dead000000000100 R14: 0000000000000000 R15: ffff888055bef2d8 [ 315.114243][ T8859] ? drm_prime_destroy_file_private+0x4a/0x60 [ 315.120335][ T8859] drm_file_free+0x7f2/0xa00 [ 315.124965][ T8859] drm_release+0x2de/0x3f0 [ 315.129428][ T8859] ? __pfx_drm_release+0x10/0x10 [ 315.134393][ T8859] __fput+0x44c/0xa70 [ 315.138475][ T8859] task_work_run+0x1d4/0x260 [ 315.143165][ T8859] ? __pfx_task_work_run+0x10/0x10 [ 315.148478][ T8859] ? exit_to_user_mode_loop+0x40/0x130 [ 315.153941][ T8859] exit_to_user_mode_loop+0xe9/0x130 [ 315.159317][ T8859] __do_fast_syscall_32+0x1f4/0x2b0 [ 315.164532][ T8859] ? lockdep_hardirqs_on+0x9c/0x150 [ 315.169743][ T8859] do_fast_syscall_32+0x34/0x80 [ 315.174728][ T8859] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 315.181070][ T8859] RIP: 0023:0xf707d539 [ 315.185145][ T8859] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 315.204878][ T8859] RSP: 002b:00000000f756faec EFLAGS: 00000206 ORIG_RAX: 00000000000001b4 [ 315.213328][ T8859] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 000000000000001e [ 315.221394][ T8859] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 315.229365][ T8859] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 315.237858][ T8859] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 315.245918][ T8859] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 315.254005][ T8859] [ 315.257172][ T8859] Kernel Offset: disabled [ 315.261522][ T8859] Rebooting in 86400 seconds..