last executing test programs: 13.003848572s ago: executing program 2 (id=740): r0 = epoll_create1(0x0) r1 = mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\x01\x00\x00\x00a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|\x00\x17\xc0\xa3\xd5\xf9\xaa\x98/\xa4v\xe4)I\xf3+[e\x95\x89\x99\xca\x8e\xc5\xd3\\T\xf0\x1a|5\xfff\xff\x99\xa4\xbb\x9e#oR\xa4\xf1\xba\x04c\xb3-\xf7R\xb85\xb5\xdb\xe9?\xfa/\xdf\xb4R\xbfx=\v_j\x8e\xb0\'\xf4\xe5\xff!\xe1\xbf\x82e\xb1\x9b\x8d\xf3L\t\xd21\x9cbwV\xc8\xcc\xe4\x96M_w\xbc\xdf9\b\r\xf6\x95\xae\xb5,\x92\x8c\xc0DQm\x80\xd1w\xa2\x1a\x12Z\xe5\xf4H\xf7D\n\x96J\x93\xfb\xf0$\x9f\xf7\xa2\xae$O\xa3\xb6\xf5\x98\xd3\v\x00\x86\xa5\x8b\x81\x04\xaf\x03s\xe5\x86>\x0e\xa6\xe6\x1aV\x17\x8b\xed\xa7\'\xd0\r_\xe8,XVR\x13\xe5%\xb9\x88\xb8W@D\'\x17A\xc8\x80\x02J\xd4V\x00wH(\xc5v\f\xc9\xb6\xdf..$\xe6P(_\xf1\'\xc1:\xa3\xcb\xd9\xd1\xc7\x13\x99Md\x1dc\xf1\'j\x03!\x13\xd1\xb8\xbf\xe6\xb2M\b/\rp\xa5\x00\x00\x00\x00', 0x40, 0x9, 0x0) fcntl$setlease(r1, 0x400, 0x0) r2 = openat$binfmt_register(0xffffff9c, &(0x7f0000000040), 0x1, 0x0) pwrite64(r2, &(0x7f0000000100)="e67ab166972ce298f4681ef5c755f60473b17b7887d68440dd904bf7ccc3fe022acf3e2c9b5958bc69f6c3c5238bebfbce42365029d64c37eeaeec2d13731c56a864da45a465e64d9a", 0x49, 0x3) r3 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r3, &(0x7f00000004c0)={&(0x7f0000000280)=@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000440)=[{&(0x7f00000002c0)="f82d53373e", 0x5}], 0x1, &(0x7f00000005c0)=ANY=[@ANYBLOB="1400000084000000020000000600040000008078d06e67fc16d1994a11005890ebc1bb687c573ea97d3b31844686f3520c7029ec9343cda0ed802fd6a1aa217d3160187e98c8941aaf97b4370bd908d88b45af07ce6c7c961d3d53852dc647e2eb14f3dd9e5236e4df1da9e5ed8462e4dc7597b421011b86695464fb7ccb1825aba71d871d7dd79e9ed3c41529d7ad77d978e6e2fc5f09779caa41a519ac16c6a9b50081de48141904ba964a171b995cb3e85de95a78f621ca8cca3bf35774c3ad3a2720f9"], 0x14, 0x488d0}, 0x80) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x8040, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000040)={0x2, 0x1e5, 0xffffff80, 0x0, 0x5, "ff00f7000000000000000000af88008300"}) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f00000006c0), 0x0, 0x40) recvmsg(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/79, 0x4f}, {&(0x7f0000000200)=""/75, 0x4b}], 0x2}, 0x40010141) syz_open_pts(r4, 0x141c00) r7 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r7, 0x40000000af01, 0x0) ioctl$VHOST_SET_LOG_FD(r7, 0x4004af07, &(0x7f0000000000)) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYRES16=r6, @ANYRES16=r4, @ANYRES32=r7], &(0x7f0000000980)='GPL\x00', 0x30, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000080)={@mcast2, @local, 0x1d, 0x1e}}) mq_unlink(&(0x7f0000000340)='eth0\x00') close_range(r0, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$DEVLINK_CMD_RATE_DEL(r6, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x34, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x41000) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) r8 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r8, 0x40045612, &(0x7f0000000740)=0x1) 12.779951367s ago: executing program 2 (id=741): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) socket(0x1e, 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x7, 0x80, 0x2, 0x3, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0xfffffffe, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x418, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x0, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x400001, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0x400, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0x80af, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="08000000fe0000000b00000000000000c7912eedc70a33b6d7"], 0xfe) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x60, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x4c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xffffffff}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) io_uring_setup(0x3e45, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xcb}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'veth1_macvtap\x00'}) syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r8 = openat$vnet(0xffffffffffffff9c, &(0x7f00000038c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r8, 0xaf01, 0x0) eventfd(0x80000001) timer_create(0x0, 0x0, 0x0) 10.393923097s ago: executing program 4 (id=751): r0 = epoll_create1(0x0) r1 = mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\x01\x00\x00\x00a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|\x00\x17\xc0\xa3\xd5\xf9\xaa\x98/\xa4v\xe4)I\xf3+[e\x95\x89\x99\xca\x8e\xc5\xd3\\T\xf0\x1a|5\xfff\xff\x99\xa4\xbb\x9e#oR\xa4\xf1\xba\x04c\xb3-\xf7R\xb85\xb5\xdb\xe9?\xfa/\xdf\xb4R\xbfx=\v_j\x8e\xb0\'\xf4\xe5\xff!\xe1\xbf\x82e\xb1\x9b\x8d\xf3L\t\xd21\x9cbwV\xc8\xcc\xe4\x96M_w\xbc\xdf9\b\r\xf6\x95\xae\xb5,\x92\x8c\xc0DQm\x80\xd1w\xa2\x1a\x12Z\xe5\xf4H\xf7D\n\x96J\x93\xfb\xf0$\x9f\xf7\xa2\xae$O\xa3\xb6\xf5\x98\xd3\v\x00\x86\xa5\x8b\x81\x04\xaf\x03s\xe5\x86>\x0e\xa6\xe6\x1aV\x17\x8b\xed\xa7\'\xd0\r_\xe8,XVR\x13\xe5%\xb9\x88\xb8W@D\'\x17A\xc8\x80\x02J\xd4V\x00wH(\xc5v\f\xc9\xb6\xdf..$\xe6P(_\xf1\'\xc1:\xa3\xcb\xd9\xd1\xc7\x13\x99Md\x1dc\xf1\'j\x03!\x13\xd1\xb8\xbf\xe6\xb2M\b/\rp\xa5\x00\x00\x00\x00', 0x40, 0x9, 0x0) fcntl$setlease(r1, 0x400, 0x0) r2 = openat$binfmt_register(0xffffff9c, &(0x7f0000000040), 0x1, 0x0) pwrite64(r2, &(0x7f0000000100)="e67ab166972ce298f4681ef5c755f60473b17b7887d68440dd904bf7ccc3fe022acf3e2c9b5958bc69f6c3c5238bebfbce42365029d64c37eeaeec2d13731c56a864da45a465e64d9a", 0x49, 0x3) r3 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r3, &(0x7f00000004c0)={&(0x7f0000000280)=@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000440)=[{&(0x7f00000002c0)="f82d53373e", 0x5}], 0x1, &(0x7f00000005c0)=ANY=[@ANYBLOB="1400000084000000020000000600040000008078d06e67fc16d1994a11005890ebc1bb687c573ea97d3b31844686f3520c7029ec9343cda0ed802fd6a1aa217d3160187e98c8941aaf97b4370bd908d88b45af07ce6c7c961d3d53852dc647e2eb14f3dd9e5236e4df1da9e5ed8462e4dc7597b421011b86695464fb7ccb1825aba71d871d7dd79e9ed3c41529d7ad77d978e6e2fc5f09779caa41a519ac16c6a9b50081de48141904ba964a171b995cb3e85de95a78f621ca8cca3bf35774c3ad3a2720f9"], 0x14, 0x488d0}, 0x80) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x8040, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000040)={0x2, 0x1e5, 0xffffff80, 0x0, 0x5, "ff00f7000000000000000000af88008300"}) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f00000006c0), 0x0, 0x40) recvmsg(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/79, 0x4f}, {&(0x7f0000000200)=""/75, 0x4b}], 0x2}, 0x40010141) syz_open_pts(r4, 0x141c00) r7 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r7, 0x40000000af01, 0x0) ioctl$VHOST_SET_LOG_FD(r7, 0x4004af07, &(0x7f0000000000)) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYRES16=r6, @ANYRES16=r4, @ANYRES32=r7], &(0x7f0000000980)='GPL\x00', 0x30, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000080)={@mcast2, @local, 0x1d, 0x1e}}) mq_unlink(&(0x7f0000000340)='eth0\x00') close_range(r0, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$DEVLINK_CMD_RATE_DEL(r6, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x34, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x41000) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) r8 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r8, 0x40045612, &(0x7f0000000740)=0x1) 10.107718504s ago: executing program 4 (id=753): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}}, 0x24}}, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000140)=ANY=[@ANYBLOB="40600143b6eecfde56e79567ff7eff817a1aaf0b6db980cec360fe1dad6afcd4a9f9cbdb252734617b5326e341b6c656d341bb171e15386c066933f325eae69b6b6706d8af7da0eba2013b6aa310b6084498e18a570bc4325abd745d476e028e20715b9834fdcf33438693aa58ba285f0ebb92176de05cb45f5118a10bdf77a2"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000780)={0x18, &(0x7f0000000580)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_connect$cdc_ecm(0x6, 0x15d, &(0x7f0000000300)={{0x12, 0x1, 0x10, 0x2, 0x0, 0x0, 0xef, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x14b, 0x1, 0x1, 0x3, 0xc0, 0x5, [{{0x9, 0x4, 0x0, 0x69, 0x3, 0x2, 0x6, 0x0, 0x8a, {{0x8, 0x24, 0x6, 0x0, 0x0, "bee976"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x101, 0xad5, 0x7, 0x8}, [@ncm={0x6, 0x24, 0x1a, 0x3, 0x1e}, @mdlm_detail={0xf9, 0x24, 0x13, 0xa, "bd3397de4fbfc5486542fd3e44cefaf3bb0481801a948baaf340cc9d2cce46013eaa3546845e4c5145aa0ba0bdcfb6adc934f0d62d8c5402ba04a9228e28c3244312eea30e15c5d7eb2801b42701c31f87c5be1ca215599110a740560fea98c3b4efa093d68b61b3b86350f7defe44e3c0b7848403b8ef8643399b52ee7c5b42a61fc371135ef0169da6b91f2b1a4ddd0c0627f367b7c8bc978114c5229e3cde4c4465cf1550718757256d012231c528f29de894d14dac7edac64a3012a3886719f7d9f05ea2d2712994b28d04fd1ca16d21c2dc14afd00768a07618e478d204c927ccb992a8bc24aed4b184fb0b32e9bf44b291bb"}, @ncm={0x6, 0x24, 0x1a, 0x3, 0xc}, @country_functional={0x8, 0x24, 0x7, 0x9, 0x6, [0x7]}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x1, 0x0, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x2, 0xf2, 0x6}}}}}]}}]}}, &(0x7f0000000a00)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x300, 0x7f, 0x9, 0x4, 0x78, 0x4}, 0x40, &(0x7f0000000280)={0x5, 0xf, 0x40, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0x18, 0x3, 0x0, 0x1}, @ss_container_id={0x14, 0x10, 0x4, 0x6, "c26bb88aac115740b1171506606c8fab"}, @ssp_cap={0x20, 0x10, 0xa, 0x7, 0x5, 0x39bc, 0x6ff886602a838d10, 0x80, [0x10100ff, 0xc0, 0x0, 0x3ff0, 0xff0000]}]}, 0xa, [{0xcd, &(0x7f0000000480)=@string={0xcd, 0x3, "1b235c541e79ebbdad807d646874d4759a38809d07f760ef9fe936179231e2d350ddbcb9f978eec7f5b6f2332d2ad9e207dcbf9cbcab80cee44997def39046b637af33c4fa1b5905bf8ba792401c6e5264adcbb03822981bd65dcae31b7a00822d9fcbed1bff98c702d9500d24188d9ff0df55f834b574a9921e4a91ec6c78365ade79e455e401523f7a760ddbd8896c2e62c8df84fe0a1232b2e3d5b9206d61cbc6778bf85bfbb10fc69f71e84269b2cb3c08238b1671c5b9d41d3f6614bd557360ffd80b14517c76c19b"}}, {0xac, &(0x7f0000000680)=@string={0xac, 0x3, "973bf3a4ad971792a459d40be02ff07f25bf2f41a46f55b520d079493c1123b1407997982c6d4dbefe7b69e252d06b56e9916ec8d17cce3ae0b804fcb1ad28c0093e55227c1117d4517ece2ae3423a1ea6addc090521ef3ae0fd8b0889bcc6946054dbd95b679ab0a40965c23a95ca50faec5591a185d24c8776f15402a264f73b32ba65aeba5f0c967a63569ab0a52c8000347e5f6e999786fb9f00fa6ce9cd02c5486e4e7ca8b2fa4d"}}, {0x63, &(0x7f00000007c0)=@string={0x63, 0x3, "6f88d2255f5dca812f3357d1c0a7ed6c7d3552c7bc889d91ae16a67031f2611b03aa13a62b408a836761179b03402abbcdbf4ca6b9ef287f864256a352bc8af50439c97e0293b329747abf169678d0d06f0011b4a530290d4694374b2d47866b0b"}}, {0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0x2c0a}}, {0x1c, &(0x7f0000000840)=@string={0x1c, 0x3, "3a7499d729ceed93472a66db0d3fcde2d089ee2839b8a0e52744"}}, {0x4, &(0x7f0000000880)=@lang_id={0x4, 0x3, 0x180c}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x422}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x425}}, {0x78, &(0x7f0000000940)=@string={0x78, 0x3, "ffdd4d85b569082c818a316ef06ed9b9e1c7150bd18b0fa53ff8d0ac553924ff8581dd1312aba33c21f171ae62bea09fac7cb9391f86df851c7597750012a0465656aa7f1b9786d9df99770d8c13dfcbca6e253f65019e3c76bf5d3980bd123231dd3f3aabbe7f42e63d439d69ec81bd4185fe034b47"}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x1c09}}]}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="2e00000010008188e6b62aa73f72cc9f0b0532950b0000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r3) syz_usb_control_io(r0, 0x0, 0x0) syz_open_dev$loop(&(0x7f0000001600), 0x1, 0x0) r4 = syz_open_dev$loop(&(0x7f0000001640), 0x5, 0x200440) ioctl$LOOP_CHANGE_FD(r4, 0x4c06, r3) syz_usb_control_io(r0, &(0x7f0000001040)={0x18, &(0x7f0000000e40)={0x40, 0xa, 0xf7, {0xf7, 0xf, "3c7d14367ea71be092f3313c388821d49ead1468e022aaec423fe9d03bf515afbaef96ff68b421ac5b417732fb5508f7d9bcf4c25825672a73836b7a9c865126bd71d011320fefc2bf0cc81198d77071cea4d4d08984b83506fbd9feef53c0fb16285e48f81af0a2eebd5f9f0c4f39e2ecbf72d18903b4ee76557939995b5cd33ecca65b795f61a5f85f582c0e2e4104cc1ec69d3b8d1b645e3866141f8a24115e57fce64a9b2e1250775b0b4b1ecc0b844c32c3b9cc1b2f50a6476e5b380b45f47fce26f584fe532a327daf768e123401775dc0ae5ff4457b4dab69df418632f2351e226be2ab21f0ea68965dd363a1ba6e2df7e0"}}, &(0x7f0000000f40)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x860}}, &(0x7f0000000f80)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, &(0x7f0000000fc0)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf9, 0x80, 0x5e, 0x9, "0e614a6c", "e18a993b"}}, &(0x7f0000001000)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x4, 0xc, 0x9, 0x9, 0xf13}}}, &(0x7f0000001580)={0x44, &(0x7f0000001080)={0x0, 0xf606efd46f2114e9, 0xdc, "7d733767da9b648b3c83ca52ef1769ca0bdf0b436bf70e66df82d3f6a459d14e63eb5ca2eaea1e32da76cdfc29b3ffef2c59ac83e40f3ffd78435a7930ba5018bcf0aacf8c3ef5893621ddb0a932748825c5752c7c60d4abf12c22b31ffdf1d25fdc6025b0fbdf491f8f1ffabc1cf551ea982e90026d287c8b591c463add720aae1182ce7f28e13376812f41cea4f4a5c7f2713160aaa4cdbed2d58b6e78e5cf521f343fc180d1dde958fcaf048455450330410607a162b46aa672860c00f769dc59a6d43653d628367c187981918acb75e981745a53464f8438b866"}, &(0x7f0000001180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000011c0)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000001200)={0x20, 0x0, 0x4, {0x1, 0xd69141b5075bdda7}}, &(0x7f0000001240)={0x20, 0x0, 0x8, {0x0, 0x80, [0x0]}}, &(0x7f0000001280)={0x40, 0x7, 0x2, 0x9e64}, &(0x7f0000001300)={0x40, 0x9, 0x1, 0x7f}, &(0x7f0000001340)={0x40, 0xb, 0x2, "1e6c"}, &(0x7f0000001380)={0x40, 0xf, 0x2, 0xe}, &(0x7f00000013c0)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000001400)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}, &(0x7f0000001440)={0x40, 0x19, 0x2, 'Mo'}, &(0x7f0000001480)={0x40, 0x1a, 0x2, 0xffc0}, &(0x7f00000014c0)={0x40, 0x1c, 0x1, 0x8}, &(0x7f0000001500)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000001540)={0x40, 0x21, 0x1, 0xc}}) syz_usb_control_io$uac1(r0, &(0x7f0000000b40)={0xc, &(0x7f0000000a80)={0x20, 0x31, 0x3f, {0x3f, 0xf, "59c52bfbb77d41ade86d8b3ac1b887ef815f9364c86b492ae6e38ec1b2b8075cbb93c4500303f0062b4d79f6098a317b4cc10b452605d1f39a6e3d9f97"}}, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x40a}}}, &(0x7f0000000e00)={0x24, &(0x7f0000000b80)={0x40, 0xe, 0xa1, "ead4df3eca13f3a0f376c0c4713eb5f9c454e324b681b6bd5f1c6b02e6e27b2ad57ce45050056659e4c1a80eb5c3991dd5c8c47ab9e8d2473bcb01cdb31494aef07ccf826110a9331e8caa44cfaa6eb07029cba0f36f17d2a2cb8d4fb002ebaf772e040f51f47e16b4be70b903eaf66ec98c5a3dc20e058dcbed410aa35e66fa3e370bc59ceef772a08e8798daa981eee8a7ceafbc520bd5f9efa1d90f67dd2a20"}, &(0x7f0000000c40)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000c80)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000cc0)={0x20, 0x81, 0x2, "ee39"}, &(0x7f0000000d00)={0x20, 0x82, 0x1, '`'}, &(0x7f0000000d40)={0x20, 0x83, 0x1, "e5"}, &(0x7f0000000d80)={0x20, 0x84, 0x4, 'p-Ud'}, &(0x7f0000000dc0)={0x20, 0x85, 0x3, "0fafad"}}) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200000, 0x200000, 0x7}) openat$procfs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/cgroups\x00', 0x41, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000002c0)={0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="5a4505772db3067dadd541a731e59a8c80c499c63bfef8509a7a6f4d4041745e2a8f2ce0f26d4c4d5985cf007b26c124fd95a7a9385cd392a34737865ea6a599e52db83388899d0a65f80a"], 0x0, 0x0, 0x0, 0x0}) 9.877415321s ago: executing program 0 (id=754): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x4}, 0x10) write(r0, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000f00c00000000", 0x14) recvmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x10000}], 0x2, 0x0, 0x0) 9.708964155s ago: executing program 0 (id=755): syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x3, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) modify_ldt$write(0x1, &(0x7f0000000000)={0x80, 0x0, 0x400}, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000001440)={'nicvf0\x00', &(0x7f00000002c0)=@ethtool_coalesce={0xf, 0x7, 0x9, 0x8401, 0xbce5, 0x6, 0x51d, 0x101, 0x8000, 0xff, 0xc83c, 0x8, 0x8, 0xbf1d, 0x3c5, 0x3, 0x9, 0xcfd, 0x0, 0x1000, 0x8, 0x6, 0x10000}}) syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) r3 = openat$vicodec0(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc0185648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90f, 0x20, '\x00', @p_u8=0x0}}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYRES32], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x3, 0x100}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, 0x8, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x4}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8040}, 0x40) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) openat$tun(0xffffff9c, &(0x7f0000000140), 0x200, 0x0) 9.068382383s ago: executing program 2 (id=758): socket$kcm(0x10, 0x2, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4a2000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000080)={0x1, @pix_mp={0x0, 0x0, 0x0, 0x32314247}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=@newqdisc={0x118, 0x24, 0xd0f, 0x470bd2d, 0xfffffffd, {0x60, 0x0, 0x0, 0x0, {0x0, 0xfff2}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0xffffffff}, @TCA_STAB={0xe0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2f, 0x8, 0x2, 0x2, 0x0, 0x81, 0x0, 0x8}}, {0x14, 0x2, [0x7119, 0x5b, 0x6, 0x9, 0x3, 0x77, 0x0, 0x4cb6]}}, {{0x1c, 0x1, {0xb, 0x6, 0x9, 0x10001, 0x0, 0x2, 0x8, 0x8}}, {0x14, 0x2, [0x2, 0x7, 0x72cc, 0x8001, 0xff, 0x2, 0x3, 0xff]}}, {{0x1c, 0x1, {0x81, 0x8, 0x1000, 0x7, 0x0, 0x6, 0x78a, 0x3}}, {0xa, 0x2, [0x0, 0x2, 0x4]}}, {{0x1c, 0x1, {0x2, 0x0, 0x16a0, 0x8, 0x1, 0x8000000, 0x100}}, {0x4}}, {{0x1c, 0x1, {0x7, 0x0, 0x1d5, 0x5, 0x2, 0x1, 0x9, 0x9}}, {0x16, 0x2, [0x9, 0x0, 0x9, 0x8, 0x10, 0x598, 0xbb4, 0x40, 0xe88a]}}]}]}, 0x118}, 0x1, 0x0, 0x0, 0x24000040}, 0x44080) recvfrom$inet6(0xffffffffffffffff, &(0x7f00000000c0)=""/18, 0x12, 0x40000000, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0) 8.566873804s ago: executing program 1 (id=759): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x34, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xa8}}, 0x0) syz_usb_connect(0x0, 0x57, &(0x7f0000000300)=ANY=[@ANYBLOB="12010102882333404f17318af4390102030109024500013f06400409044207000e0100010a240107000105ff010302070724050107638c092403"], &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0}) 7.681915107s ago: executing program 0 (id=760): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=@newqdisc={0x38, 0x24, 0xd0f, 0x470bd2d, 0xfffffffd, {0x60, 0x0, 0x0, r2, {0x0, 0xfff2}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0xffffffff}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000040}, 0x44080) 7.438981947s ago: executing program 2 (id=761): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000bc0)=@newlink={0x34, 0x10, 0xc3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x4}}}]}, 0x34}}, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2, 0x8f}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="340000000008010800000000000000000200000206000240dada00000900010073797a300003003a000000000000000000000000f03d788fb1b9d681d806b7b31b6f8e45964de692d3b3fa1c4380c682"], 0x34}, 0x1, 0x0, 0x0, 0x24018100}, 0x4000000) unlink(&(0x7f0000000000)='./file0\x00') bind$inet6(0xffffffffffffffff, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000847fff)='X', 0xff80, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) modify_ldt$read(0x0, &(0x7f0000000400)=""/229, 0xe5) r4 = socket$netlink(0x10, 0x3, 0x0) mq_open(&(0x7f0000000180)='\r\x00elinu\xef\xe3elinux\x00\x96\xf6\x92\n#*\xac\x05\xce\xf8D\\\x9a\xe6[]L+\xf6\v\xe8\xf2\xd3\b\x15\n\xb8F!Q9o\x1f#\xbdt\r\xfb\"\x18%\xfdM\xaf_t\xd2\xdcJ\x10\a\xbab\x1a\xdf\xb1\xbdU\xd7Lo\xe7\xac\x81\x10k\xce-\xf5@\xbb\x9d;\xe8\xf6\xffQ\x04\xaai\x92k\x1b;\xddM\xa2\xe1-\x0e\xd8\xde\x00\xff\x18\xdd\bL\xfb\xa2.\xb6{\xb5\x85#\x88\xdc\xf0\x0f\x05\xf1\xc4 \xdeV\x80q\xf7\x04\xf5\x85T\x1f\xc2S]*\xc9lw\xd3J\xc5\xe8\x02\xcb\xbbAHxr\xac\xb77F\xdf\x1c\xcb\xd4\xce\x88L\xf1\xf9[\x98\xd4+pTx\x95\xb5\x1b]x\x1a\x95\xe1c6\xe7`83\xb7n#\xe0\xc1_\xec\xba\xde\a\x8b\xc5\x86woo\xbc\x1c\xa3r\x82\xf3enq-\x90/\xed\xff\xad+\x03\x10\t\xda\xfd\xa2\xd0\xef4\n%\xf1\xd8', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x4}) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="4000000010001fff0000000000000000000600", @ANYRES32=0x0, @ANYBLOB="81ffffff00000000180012800e0001007769726567756172640000000400028008000a005124deacb12e68d5b042fd94802e899d13e0374769b03ac3273b6ab1188023b587e473253682146a9f24b52e89b42d3c836c1702078fbba099e45a9ddb039922f65e595e5fb3172b8fc94fe9185633ff84974096e32e8d6ce93ad1488698052714e15b7763bfe3d117e145752db35e4553df3a7d153e", @ANYRES32, @ANYBLOB], 0x40}}, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c80)={'lo\x00'}) 7.426648524s ago: executing program 0 (id=762): r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom0\x00', 0x802, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@mcast2, @in=@loopback}}, {{@in6=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000000040)=0xe4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000, 0xcb25880a3a34e19c, &(0x7f0000000000/0x3000)=nil) 6.953390457s ago: executing program 3 (id=763): r0 = epoll_create1(0x0) r1 = mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\x01\x00\x00\x00a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|\x00\x17\xc0\xa3\xd5\xf9\xaa\x98/\xa4v\xe4)I\xf3+[e\x95\x89\x99\xca\x8e\xc5\xd3\\T\xf0\x1a|5\xfff\xff\x99\xa4\xbb\x9e#oR\xa4\xf1\xba\x04c\xb3-\xf7R\xb85\xb5\xdb\xe9?\xfa/\xdf\xb4R\xbfx=\v_j\x8e\xb0\'\xf4\xe5\xff!\xe1\xbf\x82e\xb1\x9b\x8d\xf3L\t\xd21\x9cbwV\xc8\xcc\xe4\x96M_w\xbc\xdf9\b\r\xf6\x95\xae\xb5,\x92\x8c\xc0DQm\x80\xd1w\xa2\x1a\x12Z\xe5\xf4H\xf7D\n\x96J\x93\xfb\xf0$\x9f\xf7\xa2\xae$O\xa3\xb6\xf5\x98\xd3\v\x00\x86\xa5\x8b\x81\x04\xaf\x03s\xe5\x86>\x0e\xa6\xe6\x1aV\x17\x8b\xed\xa7\'\xd0\r_\xe8,XVR\x13\xe5%\xb9\x88\xb8W@D\'\x17A\xc8\x80\x02J\xd4V\x00wH(\xc5v\f\xc9\xb6\xdf..$\xe6P(_\xf1\'\xc1:\xa3\xcb\xd9\xd1\xc7\x13\x99Md\x1dc\xf1\'j\x03!\x13\xd1\xb8\xbf\xe6\xb2M\b/\rp\xa5\x00\x00\x00\x00', 0x40, 0x9, 0x0) fcntl$setlease(r1, 0x400, 0x0) r2 = openat$binfmt_register(0xffffff9c, &(0x7f0000000040), 0x1, 0x0) pwrite64(r2, &(0x7f0000000100)="e67ab166972ce298f4681ef5c755f60473b17b7887d68440dd904bf7ccc3fe022acf3e2c9b5958bc69f6c3c5238bebfbce42365029d64c37eeaeec2d13731c56a864da45a465e64d9a", 0x49, 0x3) r3 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r3, &(0x7f00000004c0)={&(0x7f0000000280)=@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000440)=[{&(0x7f00000002c0)="f82d53373e", 0x5}], 0x1, &(0x7f00000005c0)=ANY=[@ANYBLOB="1400000084000000020000000600040000008078d06e67fc16d1994a11005890ebc1bb687c573ea97d3b31844686f3520c7029ec9343cda0ed802fd6a1aa217d3160187e98c8941aaf97b4370bd908d88b45af07ce6c7c961d3d53852dc647e2eb14f3dd9e5236e4df1da9e5ed8462e4dc7597b421011b86695464fb7ccb1825aba71d871d7dd79e9ed3c41529d7ad77d978e6e2fc5f09779caa41a519ac16c6a9b50081de48141904ba964a171b995cb3e85de95a78f621ca8cca3bf35774c3ad3a2720f9"], 0x14, 0x488d0}, 0x80) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x8040, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000040)={0x2, 0x1e5, 0xffffff80, 0x0, 0x5, "ff00f7000000000000000000af88008300"}) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f00000006c0), 0x0, 0x40) recvmsg(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/79, 0x4f}, {&(0x7f0000000200)=""/75, 0x4b}], 0x2}, 0x40010141) syz_open_pts(r4, 0x141c00) r7 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r7, 0x40000000af01, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) ioctl$VHOST_SET_LOG_FD(r7, 0x4004af07, &(0x7f0000000000)) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000080)={@mcast2, @local, 0x1d, 0x1e}}) mq_unlink(&(0x7f0000000340)='eth0\x00') close_range(r0, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$DEVLINK_CMD_RATE_DEL(r6, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x34, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x41000) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) r8 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r8, 0x40045612, &(0x7f0000000740)=0x1) 6.704143761s ago: executing program 3 (id=764): r0 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x81) openat$cgroup_pressure(r1, &(0x7f0000000840)='io.pressure\x00', 0x2, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080)={0x40000014}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f0000000440)={0x7, 0x8002}) 6.008366469s ago: executing program 0 (id=765): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, 0x0) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000240)={0x1, 0x1, 0x0, 0x0, 0x0, 0x8000000}) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4004700e, 0x0) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) set_mempolicy(0x2, 0x0, 0x3) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) clock_settime(0x5, &(0x7f00000000c0)={0x0, 0x989680}) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r3, &(0x7f0000000040), 0x12) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=@gettaction={0x30, 0x32, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x1}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x629}]}, 0x30}, 0x1, 0x0, 0x0, 0x2000c041}, 0x20000000) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x101301) ioctl$USBDEVFS_CONNECTINFO(r4, 0x80045518, &(0x7f0000002a40)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB, @ANYRESOCT], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) gettid() 5.897419527s ago: executing program 1 (id=766): socket$pppl2tp(0x18, 0x1, 0x1) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x60840, 0x112) fcntl$setlease(r1, 0x400, 0x0) fcntl$setlease(r1, 0x400, 0x2) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000280)=0xe13, 0x4) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000001e40)={0x5c, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0xc, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x14, 0x4, @private2}}}]}]}, 0x5c}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) readv(r2, &(0x7f0000000040)=[{&(0x7f0000000340)=""/98, 0x62}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) pread64(r5, &(0x7f0000000180)=""/81, 0x51, 0x0) 4.97135781s ago: executing program 4 (id=767): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket(0x1e, 0x4, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r2, 0x114, 0x7, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x0, 0x2022, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x6, 0x0, 0x0, 0x0, 0x1b49, 0x9, 0x188a, 0x0, 0x3}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) fsopen(&(0x7f00000000c0)='bpf\x00', 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/zoneinfo\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x20000023896) ioctl$LOOP_CHANGE_FD(r6, 0x4c06, 0xffffffffffffffff) setsockopt$inet6_mreq(r1, 0x29, 0x73264d2ad18cfdc0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000380)={0x3, &(0x7f0000000000)=[{0x0, 0x23, 0x9, 0x6}, {0x3, 0xff, 0x9, 0xef17e523}, {0x3, 0xb, 0x3, 0x8000}]}) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000340)="223809003b1f6a000000000000000000", 0x10) r8 = socket(0x26, 0x80000, 0x800) r9 = accept4(r7, 0x0, 0x0, 0x0) read$alg(r8, &(0x7f0000000300)=""/36, 0x24) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x14, 0x0, 0x2, 0x70bd26, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x3}, 0x4) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000080)=0x2) syz_usb_connect(0x2, 0x24, &(0x7f0000000040)=ANY=[@ANYRESHEX=r5, @ANYRESHEX, @ANYRES32=r4], 0x0) 4.600999657s ago: executing program 2 (id=768): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) socket(0x1e, 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x7, 0x80, 0x2, 0x3, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0xfffffffe, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x418, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x0, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x400001, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0x400, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0x80af, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="08000000fe0000000b00000000000000c7912eedc70a33b6d7"], 0xfe) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x60, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x4c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xffffffff}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) io_uring_setup(0x3e45, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xcb}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'veth1_macvtap\x00'}) syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r8 = openat$vnet(0xffffffffffffff9c, &(0x7f00000038c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r8, 0xaf01, 0x0) eventfd(0x80000001) timer_create(0x0, 0x0, 0x0) 4.51354183s ago: executing program 3 (id=769): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = memfd_create(&(0x7f0000000000)='e\xf4E\x88-\x00', 0x0) pwritev(r3, &(0x7f0000000040)=[{&(0x7f0000000480)="db", 0x1}], 0x1, 0x4000001, 0x0) sendfile(r2, r3, 0x0, 0x8000fb00) 4.085121101s ago: executing program 1 (id=770): r0 = request_key(&(0x7f0000000000)='syzkaller\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='%$\xce^\x00', 0xfffffffffffffffd) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x38, 0x701, 0xfffffffc, 0x0, {0x6}}, 0x14}}, 0x0) openat$sndseq(0xffffff9c, &(0x7f0000000300), 0x400) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf}, {0xe, 0xd}}, [@TCA_RATE={0x4, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x4000c00) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f00000001c0)=0x1, 0x4) r3 = syz_open_dev$dri(&(0x7f0000000040), 0x7ff, 0x2000) r4 = inotify_init1(0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x103a42, 0x0) inotify_add_watch(r4, &(0x7f0000000340)='./file0\x00', 0x203) ftruncate(r5, 0x6000000) pread64(r5, &(0x7f0000000200)=""/122, 0x7a, 0x8) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f0000000100)={&(0x7f0000000080)=[0x0], 0x1}) r6 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r6, 0x13) tkill(r6, 0x12) waitid(0x0, 0x0, 0x0, 0x100000e, 0x0) syz_emit_ethernet(0x82, &(0x7f0000000240)={@broadcast, @random="1704b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private, @rand_addr=0x4, {[@lsrr={0x83, 0x3}, @rr={0x7, 0x3}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@multicast1=0xe0000089}, {@private}, {@local}, {@remote}, {@private}, {@dev}, {@private}]}]}}}}}}}, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f00000000c0)={r0, 0xa6, 0x8a}, &(0x7f0000000100)={'enc=', 'raw', ' hash=', {'sha224-ssse3\x00'}}, &(0x7f0000000180)="925b7116eca52efc7c6482e385473261e73dcdc623f553456de47c89fa22f7980206883cfd08818dd1e2225c0de90abf12944c31cc3785a307fc8969accdc79acc9715724f74d24782e980d17eb4b081f93716719b7a54d2e1b1986b23979ea45d6fc224cfb343eac2bd994fdf4933974826a7d47a1fa4d56a9bc3b643d3a9867fad1cf904b83bdd6a4b461a927bed3677562b26d7d655c2f1925978a9c21a84bcfb96c60f5f", &(0x7f00000002c0)="d34a1d26391206c8efa16fc2104a43afda8c476c8a5ffd8e3743cc859527b41ef56e10c3c8d662320a4ba91219d6caa64d9e9ee723734225fdc37e15b9125d43a7aa88151166607396cf68cc68ab80a879bf0983d879534242d0631acca9efbdbaba801d9751e705aeb576b162c487d071837c54db6d2bf0b259ae81b0abf18fd2b5a30a1535627d615d") syz_emit_ethernet(0x86, &(0x7f0000000280)=ANY=[@ANYBLOB="aaaaaaaaaaaa1a18ccacd4b98100000086dd60100000004c2f0000000000002000000000ffff7f000001ff02000000000000000000000000000100000800fcff"], 0x0) 3.75092916s ago: executing program 1 (id=771): r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000080)={0x1d, r1, 0x2, {0x2, 0x0, 0x2}}, 0x18) sendmmsg$unix(r0, &(0x7f0000000840), 0x0, 0x0) 3.323265007s ago: executing program 3 (id=772): syz_emit_ethernet(0x52, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004c000078ac1414000a01010044140503", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) r0 = add_key$user(&(0x7f00000002c0), &(0x7f00000023c0)={'syz', 0x0}, &(0x7f0000000280)="d25a9850a9d77f1068109e733e1a", 0xe, 0xfffffffffffffffe) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, 0x0, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, &(0x7f0000000100)='0.::/', 0x0) r2 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000080)="bc5d", 0x2, 0xfffffffffffffffe) r3 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) r8 = open(&(0x7f0000000180)='./file1\x00', 0x40000, 0x44) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000240)={@private, @local, 0x0}, &(0x7f0000000380)=0xc) bind$xdp(r8, &(0x7f0000000400)={0x2c, 0xf, r9, 0x2c, r6}, 0x10) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r8, 0xc0487c04, &(0x7f0000000a80)={0x0, 0x5, 0x0, &(0x7f0000000480)=[{}, {}, {}, {}, {0x80000000}], 0x4, 0x0, &(0x7f0000000680)=[{}, {}, {}, {}], 0x6, 0x0, &(0x7f0000000880)=[{}, {}, {}, {}, {}, {}], 0x8, 0x0, &(0x7f0000000940)=[{}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$MEDIA_IOC_G_TOPOLOGY(r6, 0xc0487c04, &(0x7f0000000e80)={0x0, 0x2, 0x0, &(0x7f0000000b00)=[{}, {}], 0x3, 0x0, &(0x7f0000000bc0)=[{}, {}, {}], 0x1, 0x0, &(0x7f0000000d40)=[{0x0, 0x80000000, 0x0, {0x0}}], 0x5, 0x0, &(0x7f0000000d80)=[{}, {}, {}, {}, {}]}) r12 = syz_open_dev$media(&(0x7f0000000400), 0xa3c6, 0x20000) r13 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r13, 0xc0287c02, &(0x7f00000005c0)={0x80000000, 0x0, &(0x7f00000003c0)=[{}, {{}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r12, 0xc01c7c02, &(0x7f0000000b80)={r14, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc01c7c02, &(0x7f0000000fc0)={0x80000000, &(0x7f0000000f00), &(0x7f0000000f40)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f0000001000)={{r10, r11, 0x0, [0x1, 0x7d7d]}, {r14, r15, 0x4, [0xf00, 0x1000]}, 0x10000000, [0x7, 0x3]}) 3.197293703s ago: executing program 1 (id=773): r0 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) close(r3) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0x20000014}) epoll_wait(r4, &(0x7f0000000340)=[{}], 0x1, 0x1000) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f0000000100)) syz_io_uring_setup(0x3a30, &(0x7f0000000400)={0x0, 0x79af, 0x3780, 0x3, 0x40024d}, &(0x7f0000000340)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) eventfd2(0xff, 0x80001) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) r8 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r9 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x66, &(0x7f0000000040)={r10, 0x80000001}, &(0x7f00000000c0)=0x8) r11 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r11, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendto$inet6(r11, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @mcast2}, 0x1c) sendmmsg$inet6(r11, &(0x7f0000003300)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="71b4", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)='&rc', 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000380)="9912f0e9cbeab733511eda1d02de1315e920d416160bb18659215cbba391bacab28be9ff29f59b80fa512b48471e9e3cc61be606db92049580fa6875b6bf756922dc1560c0c1c2c019269867817d8db2cfd69b9041294d5a87db9ddc42d4092603fb4e1a926aeecbc58359880020dcfff1bf3b3d929f79cd4a2624705b13452c56e3f9554d3d5a0d777f134a7e215ee8108f4c19e8bf3f7669cf21a80edc680f975d9a80e1ddf31c6bd3685eda89170ea69add6169e2467caa2438e02061d2ab992656fc9df773185f4c5517c676590d5f141dfef614b35661f62ded6e37209e280e9bf2f85a", 0xe6}, {&(0x7f0000000580)="a6f6ac0aa6510920b3fee7489d909e7365968aa73580182434e2826f87d212eae1cb3fd55ef5219015a0ab8c9e483b6580dc403d5c9734ae4518cc9981f5ced88b44f2acb36acb026fac27fdcd1e2f753521f59e38d6587e0c194fb676946233fdb1ddc73fa350bb8e8988385aab7984a616540d5b2e02b433261414041277482d08f4bfa8c76e308acd920a044f6ddd5ddeb76987e3c9dffd6d3beb1fffb1d593f057b01b47d1b184f317a77f97ed72ea78c33b501ca640b738e262f8b6233074371dfd076cf8a37d96456bfc48d052381a545c0fc81c9355c89ff6ba5378df183a086e857d88d98e6db0bef5657e6042671d1e1b67ed620071085e0ce2199f00d1605629df79bf26e13e9885c8ec467666e8daf772a4a1d25fc2e4dff3eea04dd2617a3aa154a9aa46bd59d0dba9669142ebaae6719b6809f65d81d3cb2e062a0dc07dfaca7672bfb43505e6d97f0540445f6ce304f30cfcf10669df5387a443634138768eef4f49f0be0d0a4caf7bd6839a76da308c1ca646bdd95634c87b62ba2b3d2e2f4519c0e4ad6d3560ce1adae7d3a64a92c79825254d8d5b2f97b4fbfb1a7e846deaa5710102bce688756794085a7a8d30a8927347b430cd17fe6ff0772b9212ecade76a0492693e959366047d5e21f955868a0e6c610aef55d1d0731419451c4a06af32cf95ea1ddec3d3f35d675e517fd2d617e87a273d08b0fc81a04f2ead6880d52140e7712e2e8a277c68e1f8b3c4605a9d19feaa6ced26c7cf8d748e74d4d40e8319dc6d0818d30f021f7dfaa0909df2a11e5e1da526f36fddea4f4abf0470917cbd4dbf7700b89c3e4bace98b95bc6fcc904f7970f44826fced4f05beed25a60be339a3fa7ec6ec3bce0a77b88eb32331cb6046df1d3691471658f96cfbc0a2bc52d25c2292994958a3f887d562de8b328c7e2e6304395a5ecc938711169437444c231bab8ba4cdd6f1995255dcebf6bec1b8795048bb721972cf991dddec371bfb7f0edc479ba585448486c114a0e10e7f19977bb5dec06ff93d07e868851158a17666595c332eae2b7ea029e52a031c6ebab4e9ceb456c44a0d82a6233057c92f8ff9bf2b7b9a7544dba04b53a9370d03a2df28525efe5f9a66e865ab67ddf1e385faf33c405ee224ea8457906829d6231096c081f7eb490a8e0378296a2c5f51dc5383238635d6fb096bb2ac667102841c59a190a0b96e9ea1d5c90455e3510b29d4425d3bbf8de4c74678638ef706cdc81997e81f14bf9d4844180c385d69ef2531218883c7d332c13f6b0764ca991ad3a6275099c4561820f2524cd49e4067916508e3097a9ebe39778c052391284bb6036f3330e83017290fe1442c35e77ccec2c500c492f5b4e9aac9aaf9937dd9d4d643a4c2fe60b181b2b6062e60c6bbed4ff84ad0b8a843a08899b000ab37a62ed295f1102e2ac8a9020d138b9b051f2aa03d5e36495e1ec59bb34fb5a39e7d605d11be9a6b12a0d7ed8cf93b133ca06ce175bcb8637cbdbb5f3dec36754a53ed7450c40cb473fc6a06cf5d409bf96c0d2d758455ea48b169df824bff8115da781a5c341f08d52529b6d4328287b1eaf64a882cb81d224f97559a295ff2fd4fb595c268250a4c01733b1b4c721211e33ad0326af821343c97e9d4b6fed97bc80cca5715f761b2227d8044db99e088e7d94ba6e0ecd70f0301ab870fbba12e8fe1025a500a0667", 0x4c1}, {0x0}], 0x3}}, {{&(0x7f0000001a40)={0xa, 0x4e21, 0x0, @remote}, 0x1c, 0x0}}], 0x4, 0x400c404) 2.823566746s ago: executing program 3 (id=774): socket$kcm(0x10, 0x2, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4a2000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000080)={0x1, @pix_mp={0x0, 0x0, 0x0, 0x32314247}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=@newqdisc={0x118, 0x24, 0xd0f, 0x470bd2d, 0xfffffffd, {0x60, 0x0, 0x0, 0x0, {0x0, 0xfff2}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0xffffffff}, @TCA_STAB={0xe0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2f, 0x8, 0x2, 0x2, 0x0, 0x81, 0x0, 0x8}}, {0x14, 0x2, [0x7119, 0x5b, 0x6, 0x9, 0x3, 0x77, 0x0, 0x4cb6]}}, {{0x1c, 0x1, {0xb, 0x6, 0x9, 0x10001, 0x0, 0x2, 0x8, 0x8}}, {0x14, 0x2, [0x2, 0x7, 0x72cc, 0x8001, 0xff, 0x2, 0x3, 0xff]}}, {{0x1c, 0x1, {0x81, 0x8, 0x1000, 0x7, 0x0, 0x6, 0x78a, 0x3}}, {0xa, 0x2, [0x0, 0x2, 0x4]}}, {{0x1c, 0x1, {0x2, 0x0, 0x16a0, 0x8, 0x1, 0x8000000, 0x100}}, {0x4}}, {{0x1c, 0x1, {0x7, 0x0, 0x1d5, 0x5, 0x2, 0x1, 0x9, 0x9}}, {0x16, 0x2, [0x9, 0x0, 0x9, 0x8, 0x10, 0x598, 0xbb4, 0x40, 0xe88a]}}]}]}, 0x118}, 0x1, 0x0, 0x0, 0x24000040}, 0x44080) recvfrom$inet6(0xffffffffffffffff, &(0x7f00000000c0)=""/18, 0x12, 0x40000000, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040), 0x2200, 0x0) 1.587679606s ago: executing program 4 (id=775): r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom0\x00', 0x802, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@mcast2, @in=@loopback}}, {{@in6=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000000040)=0xe4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000, 0xcb25880a3a34e19c, &(0x7f0000000000/0x3000)=nil) 1.537724296s ago: executing program 1 (id=776): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="010000001184f9bb1c0012800b0001006d616373656300000c00028005000f000200000008000500", @ANYRES32=r2], 0x44}}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x4a243) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000007c0)=ANY=[@ANYBLOB="800100001000010003000000fddbdf25ac1414aa000000000000000000000000e0000002000000000000000000000000000000000000000000000000160000003321adb7bb708b9cde4bd1a678fd14bd1ae3b9206054bd5be64de9ed", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414bb0000000000000000000000000000000033000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fdffffffffffffff00000000000001000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000a0000000300000048000200616469616e74756d28656362286369706865725f6e756c6c292c636f6d70726573735f6e756c6c2d67656e657269632c626c616b6532622d3531322d67656e650000000048000100736861312d737373653300"/308], 0x180}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f0000000500)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000140)={&(0x7f00000002c0)=""/228, 0x10000, 0x800, 0xc3, 0x2}, 0x1c) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000003c0)={0x24, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0003f7e8e763585e4c030052de97f0332b22ee1b35df02b1e292054f585a59"], 0x0, 0x0}, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff080045"], 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x2) close(r3) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmmsg$inet(r0, &(0x7f0000000cc0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000003c0)="5453b4b759f9d4f4f33bda880b70e0dadde06223919f4585429ef69078a4956f646ea03bfd4c090a003c01f32b1a175baf38c1eb4572c8b372a4cf9128062e58ff575546876a2804144c3aea98c4a3533396f87e860de8c66bceb0e6b387ec853b7e91c57587d38436637e702ae18eeccefdcd7a3cdd7bfc327b5d619b57d56afe1628b65e2948af5ee0e3f52746a5aff58bb7c6d253a58bf745584d1bc19fe5e42b5534eab9e9d2587b413e81f68b60f56130f82b327f5fe900e3e107bc6b783d1d23a056426d6502133386b51e657046c1c43a2a2c4a7611ee6592a5ee08700d24d832163b3def1f", 0xe9}, {&(0x7f0000000b40)="d48c8225ddfdf2c06c27763617468581389d34126760ba3dd0fe077a7c2ce378dd62cafeeb4ba1493766d09fd561d69a5bf8109ffcd3e43d8c16b9c3fa92d4439c5af1fa4775d01dcf0748a24ab51b52fbe75287a4b9aaa18fd479bdd154b4efe531a242d90a1ca2799c242bfd4ddd8271448d3415bd3a907ad340dc2fa2471393212d02eb25242808cffdc4e7a646211c18ac8602f5fc1e4f82b72871a8d42f37988365ff226c1523bf01617976641421438e16378094c94f2e55a44150d9a358d92606afb12f21a63daadbb143d6ccdae88d53521b9fe51ffabb08ff", 0xdd}, {&(0x7f0000000740)="f52ec22aafecc37a6d9995f1afb5c1727f223f9b84451a110b1dfbf19cc7ed183ba93f6d55645001887fc999262b9c938e22ef5ec46b4b1b535060dcca5cff1f0e5a1d9b32cef2b6e0a61af7968dc1759c4d901867d7d6e9f2521f6a", 0x5c}], 0x3}}], 0x1, 0xc0) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 1.347404473s ago: executing program 0 (id=777): syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x3, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) modify_ldt$write(0x1, &(0x7f0000000000)={0x80, 0x0, 0x400}, 0x10) syz_emit_ethernet(0x46, &(0x7f0000002e80)=ANY=[@ANYBLOB], 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000001440)={'nicvf0\x00', &(0x7f00000002c0)=@ethtool_coalesce={0xf, 0x7, 0x9, 0x8401, 0xbce5, 0x6, 0x51d, 0x101, 0x8000, 0xff, 0xc83c, 0x8, 0x8, 0xbf1d, 0x3c5, 0x3, 0x9, 0xcfd, 0x0, 0x1000, 0x8, 0x6, 0x10000}}) r3 = openat$vicodec0(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc0185648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90f, 0x20, '\x00', @p_u8=0x0}}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYRES32], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x3, 0x100}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, 0x8, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x4}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8040}, 0x40) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) 1.287374098s ago: executing program 2 (id=778): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0xc3ff, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848010000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x4058880) r2 = syz_open_dev$video(&(0x7f0000000000), 0x8, 0x80081) ioctl$VIDIOC_G_CROP(r2, 0xc014563b, &(0x7f0000000300)={0xa, {0x80800, 0x7b, 0x40000006}}) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_sock_diag(0x10, 0x3, 0x4) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000001c0)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd2c, 0x8000, {0x0, 0x0, 0x0, r4, {0x5, 0x7}, {}, {0xa, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_CT_ZONE={0x6, 0x5d, 0x101}, @TCA_FLOWER_CLASSID={0x8, 0x1, {0x10}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x22044028}, 0x84) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000000c0)=0x14) sendmsg$BATADV_CMD_GET_NEIGHBORS(r5, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="310300000000000000000800000008000300", @ANYRES32=r7, @ANYBLOB, @ANYRES32=r8, @ANYBLOB], 0x24}}, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='/proc/1/\x00\x82q\xee\xe5\xa0\xbd\xc2\x98#Y?0W\xb3W\xd2\xbfP\xee'}, 0x30) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) rmdir(&(0x7f0000000000)='./file0\x00') r9 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r10 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r11 = syz_pidfd_open(r10, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000100)={{{@in=@multicast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x2b}, {0x0, 0x0, 0x0, 0x0, 0xc6}, {0x0, 0xfef2}, 0x0, 0x1, 0x1}, {{@in6=@rand_addr=' \x01\x00', 0x0, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0xe4) ioctl$FS_IOC_GETVERSION(r11, 0xc040ff0b, &(0x7f0000000180)) ioctl$DRM_IOCTL_MODE_GET_LEASE(r9, 0xc01064c8, &(0x7f00000003c0)={0xffffffffffffff3d, 0x0, 0x0}) syz_usb_connect(0x3, 0x64, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000002ffa94008191513"], 0x0) setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000400)=0x3, 0x4) 1.067389842s ago: executing program 4 (id=779): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha20\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r1) sendmsg$DEVLINK_CMD_SB_POOL_GET(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000400)={0x14, r2, 0x800, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x10000002) 70.068339ms ago: executing program 3 (id=780): socket$pppl2tp(0x18, 0x1, 0x1) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x60840, 0x112) fcntl$setlease(r1, 0x400, 0x0) fcntl$setlease(r1, 0x400, 0x2) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000280)=0xe13, 0x4) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000001e40)={0x6c, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0xc, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_MASK={0x10, 0x3, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x14, 0x4, @private2}}}]}]}, 0x6c}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) readv(r2, &(0x7f0000000040)=[{&(0x7f0000000340)=""/98, 0x62}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) pread64(r5, &(0x7f0000000180)=""/81, 0x51, 0x0) 0s ago: executing program 4 (id=781): r0 = dup(0xffffffffffffffff) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000000)="93ae81dfb9c96d218b089a6af776c6fc", 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = openat$rtc(0xffffff9c, &(0x7f0000000400), 0x54000, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$unix(r0, &(0x7f00000004c0)={&(0x7f0000000080)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f00000003c0)=[{&(0x7f0000000100)="81782e25ef4bbf0adca95afaae52be3af1444b44744a2167281bbc7d8b2a88fbb9dcaeb3911ee221d9de9ebad1567c", 0x2f}, {&(0x7f0000000140)="8fc77a72c2be9d5437e527a163d9357bb02ce4584cc48b3a4ce2ce631f99dce1737c94c7386d1477f7cced76d02459b497dfb67dd833d0e7416c77f62e6d9d1ad116b9039c23c964e2ed94c168db35b5f0f3cbfe597e6e88900954e2459d01", 0x5f}, {&(0x7f00000001c0)="793f0b6143609f6d7a27f59ffac80eb37ab7475c308418067924807e63503e0622e0d35e7aedad6c0fce5e50fe", 0x2d}, {&(0x7f0000000200)="95104b3659449321710f7d3990aa3cf7342b6ec1956e52722e168b7f3e43cf6233195b4fbc5264dd764db7f989bdf56f31e19bb20ea88a5de6800f71acf17489c6367ffd2a826236b89872a372494b98a9aae938cd07c8f18b5753a72244b84c6da0b014115f1dc0b0215c5da7ae1d1386b6fa528ef9a480eea0e6297285eb935f4adce7a483a443848e210345189e95f070c373d5ebceb3e84e13666439a81097d3f8ef8bd778b41996d29da8515a1006", 0xb1}, {&(0x7f00000002c0)="66b792752de054c74136bbfcfdab53974077824219432e557136940f1c215eb36b79ee8c37dd09c862a376a6a137475528d48236e1127c7f2ba86f18e0f3263ce78a473d750d62b71e1b3f1cbd7d1f0317ab8d0501caa84247beb511655080db9c37ffbd6005ea6d168ec631a323de8a24c9cad27fc8a51847f9f05aa87ad0d9a06c73d69565694ade51d2d71e8ef90b9bbc43d2a42b74565bb78efff0c2e9ef1d57be4ec7c742fb6e77befb22df36c6b16ec95ba00c360d718f654454070ba88bd85be29a6d310fe16228ce54cbd99a50bb40eb1c6cd4b9c40b30c9460b22dacbe42094524dbda37c743e", 0xeb}], 0x5, &(0x7f0000000440)=[@rights={{0x18, 0x1, 0x1, [r1, r2, r0]}}, @rights={{0x1c, 0x1, 0x1, [r3, r1, r0, r1]}}, @rights={{0x20, 0x1, 0x1, [r0, r0, r1, r1, r4]}}], 0x54}, 0x10) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000500)={'batadv_slave_1\x00'}) ioctl$EXT4_IOC_CLEAR_ES_CACHE(0xffffffffffffffff, 0x6628) syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r0) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000580)={0x0, 0xcb1d}, &(0x7f00000005c0)=0x8) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_inet_SIOCDARP(r6, 0x8953, &(0x7f0000000600)={{0x2, 0x4e20, @multicast1}, {0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}, 0x8, {0x2, 0x4e22, @rand_addr=0x64010102}, 'bond_slave_0\x00'}) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000006c0)={0x1, &(0x7f0000000680)=[{0x8, 0x0, 0x3, 0x2}]}) r8 = accept4$inet(r1, 0x0, &(0x7f0000000700), 0x80800) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r8, &(0x7f0000000740)={0x1011}) ioctl$int_in(r0, 0x5452, &(0x7f0000000780)=0xff) setsockopt$inet_int(r6, 0x0, 0x16, &(0x7f00000007c0)=0x835c, 0x4) ioctl$LOOP_SET_FD(r0, 0x4c00, r7) r9 = openat$sysfs(0xffffff9c, &(0x7f0000000800)='/sys/kernel/rcu_normal', 0x40042, 0x0) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f0000000840)={0x9, 0x0, [{0x8ce, 0x0, 0x10000}, {0xb3a, 0x0, 0x4}, {0x2fe, 0x0, 0x5}, {0x86d, 0x0, 0xcdd4}, {0x871, 0x0, 0x80000000}, {0x272, 0x0, 0x4}, {0x281, 0x0, 0x100000001}, {0xf70}, {0xadd, 0x0, 0x6}]}) r10 = socket$tipc(0x1e, 0x2, 0x0) nanosleep(&(0x7f0000000900)={0x77359400}, &(0x7f0000000940)) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)={0xb, {{0x2, 0x4e20, @empty}}, 0x0, 0x1, [{{0x2, 0x4e20, @multicast1}}]}, 0x10c) getsockopt$TIPC_NODE_RECVQ_DEPTH(r10, 0x10f, 0x83, &(0x7f0000000ac0), &(0x7f0000000b00)=0x4) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000d00)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x10042000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000b80)={0x120, 0x2, 0x9, 0x101, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFCTH_TUPLE={0x94, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @rand_addr=0x64010100}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}]}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x8}}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0xf49}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1}, @NFCTH_STATUS={0x8}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_TUPLE={0x2c, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast2}}}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x14}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x1000}]}, 0x120}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000d40)={0x1, 0x2, 0x1, 0x0, 0x7e}) getsockopt$CAN_RAW_LOOPBACK(r9, 0x65, 0x3, &(0x7f0000000d80), &(0x7f0000000dc0)=0x4) kernel console output (not intermixed with test programs): pe=1326 audit(1749093889.370:576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.1.384" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 224.568610][ C0] vkms_vblank_simulate: vblank timer overrun [ 224.576259][ T30] audit: type=1326 audit(1749093889.370:577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.1.384" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 224.598853][ T30] audit: type=1326 audit(1749093889.370:578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.1.384" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 224.620691][ C0] vkms_vblank_simulate: vblank timer overrun [ 224.625121][ T3082] asix 1-1:0.251 (unnamed net_device) (uninitialized): Invalid PHY address 0x80 [ 224.702689][ T30] audit: type=1326 audit(1749093889.380:579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.1.384" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 224.804722][ T30] audit: type=1326 audit(1749093889.380:580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.1.384" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 224.839020][ T3082] usb 1-1: USB disconnect, device number 19 [ 224.894985][ T30] audit: type=1326 audit(1749093889.380:581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.1.384" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 224.974357][ T30] audit: type=1326 audit(1749093889.380:582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7371 comm="syz.1.384" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 225.133557][ T7384] FAULT_INJECTION: forcing a failure. [ 225.133557][ T7384] name failslab, interval 1, probability 0, space 0, times 0 [ 225.187234][ T7384] CPU: 1 UID: 0 PID: 7384 Comm: syz.1.388 Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full) [ 225.187265][ T7384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 225.187278][ T7384] Call Trace: [ 225.187286][ T7384] [ 225.187295][ T7384] dump_stack_lvl+0x189/0x250 [ 225.187336][ T7384] ? __pfx____ratelimit+0x10/0x10 [ 225.187367][ T7384] ? __pfx_dump_stack_lvl+0x10/0x10 [ 225.187399][ T7384] ? __pfx__printk+0x10/0x10 [ 225.187428][ T7384] ? __pfx___might_resched+0x10/0x10 [ 225.187454][ T7384] should_fail_ex+0x414/0x560 [ 225.187493][ T7384] should_failslab+0xa8/0x100 [ 225.187519][ T7384] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 225.187541][ T7384] ? __alloc_skb+0x112/0x2d0 [ 225.187569][ T7384] __alloc_skb+0x112/0x2d0 [ 225.187597][ T7384] netlink_sendmsg+0x5c6/0xb30 [ 225.187633][ T7384] ? __pfx_netlink_sendmsg+0x10/0x10 [ 225.187660][ T7384] ? __import_iovec+0x5d4/0x7f0 [ 225.187684][ T7384] ? aa_sock_msg_perm+0x94/0x160 [ 225.187720][ T7384] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 225.187750][ T7384] ? __pfx_netlink_sendmsg+0x10/0x10 [ 225.187775][ T7384] __sock_sendmsg+0x219/0x270 [ 225.187815][ T7384] ____sys_sendmsg+0x505/0x830 [ 225.187854][ T7384] ? __pfx_____sys_sendmsg+0x10/0x10 [ 225.187899][ T7384] ___sys_sendmsg+0x21f/0x2a0 [ 225.187928][ T7384] ? __pfx____sys_sendmsg+0x10/0x10 [ 225.188002][ T7384] ? __fget_files+0x2a/0x420 [ 225.188026][ T7384] ? __fget_files+0x3a0/0x420 [ 225.188059][ T7384] __sys_sendmsg+0x164/0x220 [ 225.188086][ T7384] ? __pfx___sys_sendmsg+0x10/0x10 [ 225.188124][ T7384] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 225.188156][ T7384] ? lockdep_hardirqs_on+0x9c/0x150 [ 225.188189][ T7384] __do_fast_syscall_32+0xb6/0x2b0 [ 225.188222][ T7384] ? lockdep_hardirqs_on+0x9c/0x150 [ 225.188255][ T7384] do_fast_syscall_32+0x34/0x80 [ 225.188286][ T7384] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 225.188312][ T7384] RIP: 0023:0xf705e539 [ 225.188330][ T7384] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 225.188347][ T7384] RSP: 002b:00000000f504e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 225.188370][ T7384] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080001200 [ 225.188385][ T7384] RDX: 0000000004000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 225.188397][ T7384] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 225.188408][ T7384] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 225.188420][ T7384] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 225.188450][ T7384] [ 225.579559][ T5826] usb 5-1: USB disconnect, device number 13 [ 225.828304][ T7389] netlink: 'syz.1.390': attribute type 13 has an invalid length. [ 226.480525][ T7389] bridge0: port 2(bridge_slave_1) entered disabled state [ 226.488494][ T7389] bridge0: port 1(bridge_slave_0) entered disabled state [ 227.472242][ T7389] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 227.479782][ T7415] openvswitch: netlink: Actions may not be safe on all matching packets [ 227.499934][ T7389] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 227.576288][ T7389] veth1_macvtap: left allmulticast mode [ 227.593935][ T7389] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 227.603305][ T7389] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 227.612485][ T7389] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 227.621455][ T7389] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 227.646708][ T7389] macsec0: left allmulticast mode [ 227.680891][ T7407] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 227.694095][ T7407] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 227.720501][ T5898] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 227.741921][ T7417] netlink: 24 bytes leftover after parsing attributes in process `syz.1.398'. [ 227.896839][ T5898] usb 4-1: Using ep0 maxpacket: 32 [ 227.906924][ T5898] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 227.926556][ T5898] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.962290][ T5898] usb 4-1: config 0 descriptor?? [ 228.015149][ T7422] pim6reg: entered allmulticast mode [ 228.185633][ T5898] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 228.210755][ T5898] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 228.236846][ T5898] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 228.251338][ T5898] usb 4-1: media controller created [ 228.285425][ T5898] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 228.487123][ T7438] netlink: 100 bytes leftover after parsing attributes in process `syz.2.402'. [ 228.500245][ T7438] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 228.559640][ T7438] C: renamed from team_slave_0 [ 228.592898][ T7438] netlink: 'syz.2.402': attribute type 3 has an invalid length. [ 228.606229][ T7438] netlink: 152 bytes leftover after parsing attributes in process `syz.2.402'. [ 228.720811][ T7438] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 228.783955][ T7441] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 228.792414][ T7441] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 228.800384][ T7415] netlink: 4 bytes leftover after parsing attributes in process `syz.3.397'. [ 228.842330][ T5898] az6027: usb out operation failed. (-71) [ 228.848244][ T5898] stb0899_attach: Driver disabled by Kconfig [ 228.910688][ T5898] az6027: no front-end attached [ 228.910688][ T5898] [ 228.947107][ T5898] az6027: usb out operation failed. (-71) [ 228.961076][ T5898] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 229.034796][ T5898] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input10 [ 229.123518][ T5898] dvb-usb: schedule remote query interval to 400 msecs. [ 229.131065][ T5898] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 229.156796][ T5898] usb 4-1: USB disconnect, device number 15 [ 229.666791][ T5898] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 229.832118][ T7446] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 229.838522][ T7446] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 229.915204][ T7450] netlink: 'syz.3.408': attribute type 7 has an invalid length. [ 229.952348][ T7446] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 229.959772][ T7446] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 229.976940][ T7446] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 230.166419][ T7453] ALSA: seq fatal error: cannot create timer (-16) [ 230.735816][ T5898] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 230.929925][ T5898] usb 1-1: config 0 has an invalid interface number: 224 but max is 0 [ 230.938658][ T5898] usb 1-1: config 0 has no interface number 0 [ 230.959964][ T5898] usb 1-1: New USB device found, idVendor=049f, idProduct=ffff, bcdDevice=41.67 [ 230.991814][ T5898] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 231.025723][ T5898] usb 1-1: Product: syz [ 231.040310][ T5898] usb 1-1: Manufacturer: syz [ 231.095837][ T5898] usb 1-1: SerialNumber: syz [ 231.111927][ T5898] usb 1-1: config 0 descriptor?? [ 231.130152][ T5898] safe_serial 1-1:0.224: safe_serial converter detected [ 231.137392][ T5847] Bluetooth: hci1: command 0x0c1a tx timeout [ 231.154324][ T5898] safe_serial 1-1:0.224: probe with driver safe_serial failed with error -22 [ 231.362250][ T5898] usb 1-1: USB disconnect, device number 20 [ 231.539291][ T7479] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 231.927599][ T7473] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 231.934327][ T7473] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 231.940680][ T7473] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 232.015970][ T5843] Bluetooth: hci4: command 0x0c1a tx timeout [ 232.022149][ T5843] Bluetooth: hci2: command 0x0c1a tx timeout [ 232.372941][ T7473] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 232.487559][ T7473] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 233.005759][ T24] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 233.419800][ T24] usb 3-1: config 1 interface 0 has no altsetting 0 [ 233.443509][ T24] usb 3-1: New USB device found, idVendor=05ac, idProduct=0262, bcdDevice= 0.40 [ 233.465760][ T5843] Bluetooth: hci1: command 0x0c1a tx timeout [ 233.618588][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.639990][ T24] usb 3-1: Product: syz [ 233.652976][ T24] usb 3-1: Manufacturer: syz [ 233.657760][ T24] usb 3-1: SerialNumber: syz [ 233.855794][ T10] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 234.022705][ T5843] Bluetooth: hci3: command 0x0c1a tx timeout [ 234.029001][ T5847] Bluetooth: hci0: command 0x0c1a tx timeout [ 234.138227][ T10] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 8 [ 234.148408][ T10] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1023 [ 234.230975][ T10] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 234.285692][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.315183][ T10] usb 2-1: Product: syz [ 234.331212][ T10] usb 2-1: Manufacturer: 蹏훸ⴾ⟎䭖㈜Ẳ侹ߦ터㞧ឈ篊橗굁摵쁆揍촜부Ѯꕠ䋬ｙ [ 234.416193][ T5847] Bluetooth: hci2: command 0x0c1a tx timeout [ 234.424545][ T10] usb 2-1: SerialNumber: syz [ 234.506005][ T5847] Bluetooth: hci4: command 0x0c1a tx timeout [ 235.119268][ T7513] netlink: 'syz.4.426': attribute type 13 has an invalid length. [ 235.582470][ T10] cdc_ncm 2-1:1.0: bind() failure [ 235.609384][ T10] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 235.630324][ T10] cdc_ncm 2-1:1.1: bind() failure [ 235.779206][ T10] usb 2-1: USB disconnect, device number 11 [ 236.358368][ T7524] netlink: 'syz.3.430': attribute type 10 has an invalid length. [ 236.416488][ T7524] FAULT_INJECTION: forcing a failure. [ 236.416488][ T7524] name failslab, interval 1, probability 0, space 0, times 0 [ 236.491426][ T24] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/input/input11 [ 236.528318][ T7524] CPU: 0 UID: 0 PID: 7524 Comm: syz.3.430 Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full) [ 236.528349][ T7524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 236.528359][ T7524] Call Trace: [ 236.528365][ T7524] [ 236.528371][ T7524] dump_stack_lvl+0x189/0x250 [ 236.528399][ T7524] ? __pfx____ratelimit+0x10/0x10 [ 236.528422][ T7524] ? __pfx_dump_stack_lvl+0x10/0x10 [ 236.528445][ T7524] ? __pfx__printk+0x10/0x10 [ 236.528470][ T7524] should_fail_ex+0x414/0x560 [ 236.528497][ T7524] should_failslab+0xa8/0x100 [ 236.528515][ T7524] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 236.528531][ T7524] ? rtnl_prop_list_size+0x1ba/0x1e0 [ 236.528553][ T7524] ? __alloc_skb+0x112/0x2d0 [ 236.528571][ T7524] __alloc_skb+0x112/0x2d0 [ 236.528590][ T7524] rtmsg_ifinfo_build_skb+0x84/0x260 [ 236.528618][ T7524] rtmsg_ifinfo+0x8c/0x1a0 [ 236.528644][ T7524] __dev_notify_flags+0xf4/0x2e0 [ 236.528664][ T7524] ? __pfx___dev_notify_flags+0x10/0x10 [ 236.528679][ T7524] ? __dev_change_flags+0x4cc/0x6d0 [ 236.528700][ T7524] ? __pfx___dev_change_flags+0x10/0x10 [ 236.528717][ T7524] ? __pfx_console_unlock+0x10/0x10 [ 236.528735][ T7524] ? irq_work_queue+0xbc/0x140 [ 236.528759][ T7524] netif_change_flags+0xe8/0x1a0 [ 236.528782][ T7524] do_setlink+0xc55/0x41c0 [ 236.528811][ T7524] ? __pfx_do_setlink+0x10/0x10 [ 236.528828][ T7524] ? _printk+0xcf/0x120 [ 236.528848][ T7524] ? __pfx____ratelimit+0x10/0x10 [ 236.528880][ T7524] ? __lock_acquire+0xab9/0xd20 [ 236.528907][ T7524] ? __mutex_trylock_common+0x153/0x260 [ 236.528925][ T7524] ? __pfx___mutex_trylock_common+0x10/0x10 [ 236.528945][ T7524] ? rcu_is_watching+0x15/0xb0 [ 236.528959][ T7524] ? trace_contention_end+0x39/0x120 [ 236.528975][ T7524] ? __mutex_lock+0x330/0xe80 [ 236.529000][ T7524] ? __pfx_aa_get_newest_label+0x10/0x10 [ 236.529026][ T7524] ? rtnl_newlink+0x8db/0x1c70 [ 236.529039][ T7524] ? rcu_is_watching+0x15/0xb0 [ 236.529054][ T7524] ? __pfx___mutex_lock+0x10/0x10 [ 236.529083][ T7524] ? ns_capable+0x8a/0xf0 [ 236.529107][ T7524] ? rtnl_link_get_net_capable+0x16a/0x350 [ 236.529131][ T7524] rtnl_newlink+0x160b/0x1c70 [ 236.529156][ T7524] ? __pfx_rtnl_newlink+0x10/0x10 [ 236.529177][ T7524] ? __lock_acquire+0xab9/0xd20 [ 236.529207][ T7524] ? __lock_acquire+0xab9/0xd20 [ 236.529243][ T7524] ? is_bpf_text_address+0x26/0x2b0 [ 236.529261][ T7524] ? is_bpf_text_address+0x292/0x2b0 [ 236.529274][ T7524] ? is_bpf_text_address+0x26/0x2b0 [ 236.529289][ T7524] ? kernel_text_address+0xa5/0xe0 [ 236.529319][ T7524] ? __lock_acquire+0xab9/0xd20 [ 236.529360][ T7524] ? __pfx_rtnl_newlink+0x10/0x10 [ 236.529383][ T7524] rtnetlink_rcv_msg+0x7cf/0xb70 [ 236.529410][ T7524] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 236.529432][ T7524] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 236.529468][ T7524] netlink_rcv_skb+0x208/0x470 [ 236.529491][ T7524] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 236.529507][ T7524] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 236.529534][ T7524] ? netlink_deliver_tap+0x2e/0x1b0 [ 236.529551][ T7524] ? netlink_deliver_tap+0x2e/0x1b0 [ 236.529571][ T7524] netlink_unicast+0x75b/0x8d0 [ 236.529595][ T7524] netlink_sendmsg+0x805/0xb30 [ 236.529619][ T7524] ? __pfx_netlink_sendmsg+0x10/0x10 [ 236.529639][ T7524] ? __import_iovec+0x5d4/0x7f0 [ 236.529656][ T7524] ? aa_sock_msg_perm+0x94/0x160 [ 236.529681][ T7524] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 236.529701][ T7524] ? __pfx_netlink_sendmsg+0x10/0x10 [ 236.529720][ T7524] __sock_sendmsg+0x219/0x270 [ 236.529745][ T7524] ____sys_sendmsg+0x505/0x830 [ 236.529769][ T7524] ? __pfx_____sys_sendmsg+0x10/0x10 [ 236.529799][ T7524] ___sys_sendmsg+0x21f/0x2a0 [ 236.529820][ T7524] ? __pfx____sys_sendmsg+0x10/0x10 [ 236.529866][ T7524] ? __fget_files+0x2a/0x420 [ 236.529884][ T7524] ? __fget_files+0x3a0/0x420 [ 236.529910][ T7524] __sys_sendmsg+0x164/0x220 [ 236.529929][ T7524] ? __pfx___sys_sendmsg+0x10/0x10 [ 236.529959][ T7524] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 236.529983][ T7524] ? lockdep_hardirqs_on+0x9c/0x150 [ 236.530007][ T7524] __do_fast_syscall_32+0xb6/0x2b0 [ 236.530031][ T7524] ? lockdep_hardirqs_on+0x9c/0x150 [ 236.530056][ T7524] do_fast_syscall_32+0x34/0x80 [ 236.530079][ T7524] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 236.530097][ T7524] RIP: 0023:0xf708e539 [ 236.530110][ T7524] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 236.530128][ T7524] RSP: 002b:00000000f507e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 236.530145][ T7524] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 236.530155][ T7524] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 236.530164][ T7524] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 236.530172][ T7524] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 236.530181][ T7524] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 236.530206][ T7524] [ 237.049159][ T5190] bcm5974 3-1:1.0: could not read from device [ 237.083298][ T7524] team0: Port device syz_tun added [ 237.206884][ T7530] netlink: 'syz.2.433': attribute type 13 has an invalid length. [ 237.300971][ T7537] netlink: 'syz.3.434': attribute type 10 has an invalid length. [ 237.449671][ T6011] bcm5974 3-1:1.0: could not read from device [ 237.506177][ T24] usb 3-1: USB disconnect, device number 17 [ 237.618685][ T5190] bcm5974 3-1:1.0: could not read from device [ 237.740300][ T6011] udevd[6011]: Error opening device "/dev/input/event4": No such device [ 237.929830][ T6011] udevd[6011]: Unable to EVIOCGABS device "/dev/input/event4" [ 237.983650][ T6011] udevd[6011]: Unable to EVIOCGABS device "/dev/input/event4" [ 238.048382][ T6011] udevd[6011]: Unable to EVIOCGABS device "/dev/input/event4" [ 238.074177][ T7530] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.103525][ T7530] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.125914][ T6011] udevd[6011]: Unable to EVIOCGABS device "/dev/input/event4" [ 238.133881][ T7530] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.200688][ T7530] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.328070][ T7530] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 238.338090][ T7530] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 238.347601][ T7530] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 238.356555][ T7530] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 238.527865][ T7543] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 238.535243][ T7543] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 238.554703][ T7543] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 238.579637][ T7543] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 238.646035][ T7543] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 238.823569][ T7547] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 240.584261][ T5847] Bluetooth: hci3: command 0x0c1a tx timeout [ 240.590466][ T5847] Bluetooth: hci0: command 0x0c1a tx timeout [ 240.596578][ T5843] Bluetooth: hci1: command 0x0c1a tx timeout [ 240.711424][ T5850] Bluetooth: hci4: command 0x0c1a tx timeout [ 240.720363][ T5847] Bluetooth: hci2: command 0x0c1a tx timeout [ 241.241166][ T7571] ALSA: seq fatal error: cannot create timer (-16) [ 241.548078][ T7574] FAULT_INJECTION: forcing a failure. [ 241.548078][ T7574] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 241.582644][ T7574] CPU: 0 UID: 0 PID: 7574 Comm: syz.1.443 Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full) [ 241.582676][ T7574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 241.582696][ T7574] Call Trace: [ 241.582705][ T7574] [ 241.582714][ T7574] dump_stack_lvl+0x189/0x250 [ 241.582754][ T7574] ? __pfx____ratelimit+0x10/0x10 [ 241.582786][ T7574] ? __pfx_dump_stack_lvl+0x10/0x10 [ 241.582820][ T7574] ? __pfx__printk+0x10/0x10 [ 241.582843][ T7574] ? __might_fault+0xb0/0x130 [ 241.582879][ T7574] should_fail_ex+0x414/0x560 [ 241.582917][ T7574] _copy_from_user+0x2d/0xb0 [ 241.582946][ T7574] snd_seq_write+0x300/0x810 [ 241.582994][ T7574] ? __pfx_snd_seq_write+0x10/0x10 [ 241.583029][ T7574] ? bpf_lsm_file_permission+0x9/0x20 [ 241.583060][ T7574] ? security_file_permission+0x75/0x290 [ 241.583090][ T7574] ? rw_verify_area+0x258/0x650 [ 241.583123][ T7574] ? __pfx_snd_seq_write+0x10/0x10 [ 241.583158][ T7574] vfs_write+0x27b/0xa90 [ 241.583188][ T7574] ? __pfx_vfs_write+0x10/0x10 [ 241.583212][ T7574] ? __fget_files+0x2a/0x420 [ 241.583239][ T7574] ? __fget_files+0x2a/0x420 [ 241.583263][ T7574] ? __fget_files+0x3a0/0x420 [ 241.583287][ T7574] ? __fget_files+0x2a/0x420 [ 241.583322][ T7574] ksys_write+0x145/0x250 [ 241.583346][ T7574] ? __pfx_ksys_write+0x10/0x10 [ 241.583369][ T7574] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 241.583403][ T7574] ? lockdep_hardirqs_on+0x9c/0x150 [ 241.583436][ T7574] __do_fast_syscall_32+0xb6/0x2b0 [ 241.583471][ T7574] ? lockdep_hardirqs_on+0x9c/0x150 [ 241.583513][ T7574] do_fast_syscall_32+0x34/0x80 [ 241.583547][ T7574] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 241.583573][ T7574] RIP: 0023:0xf705e539 [ 241.583592][ T7574] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 241.583611][ T7574] RSP: 002b:00000000f504e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 241.583635][ T7574] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 241.583649][ T7574] RDX: 000000000000ffc8 RSI: 0000000000000000 RDI: 0000000000000000 [ 241.583662][ T7574] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 241.583674][ T7574] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 241.583687][ T7574] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 241.583718][ T7574] [ 241.822728][ C0] vkms_vblank_simulate: vblank timer overrun [ 243.075823][ T5901] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 243.166914][ T7607] netlink: 284 bytes leftover after parsing attributes in process `syz.2.451'. [ 243.235723][ T5901] usb 4-1: Using ep0 maxpacket: 32 [ 243.265356][ T5901] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 243.316128][ T5901] usb 4-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 243.370374][ T5901] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.455070][ T7601] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 243.471524][ T5901] usb 4-1: Product: syz [ 243.505716][ T5901] usb 4-1: Manufacturer: syz [ 243.510459][ T5901] usb 4-1: SerialNumber: syz [ 243.550498][ T5901] usb 4-1: config 0 descriptor?? [ 243.574017][ T5901] usb 4-1: bad CDC descriptors [ 243.592362][ T7601] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 243.598875][ T7601] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 243.605159][ T7601] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 243.613508][ T7601] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 243.626602][ T5901] usb 4-1: unsupported MDLM descriptors [ 244.317491][ T10] usb 4-1: USB disconnect, device number 16 [ 244.485843][ T5901] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 244.760587][ T7640] ALSA: seq fatal error: cannot create timer (-16) [ 244.787009][ T5901] usb 2-1: config index 0 descriptor too short (expected 12384, got 96) [ 244.796100][ T5901] usb 2-1: config 55 has too many interfaces: 49, using maximum allowed: 32 [ 244.833569][ T5901] usb 2-1: config 55 has an invalid descriptor of length 0, skipping remainder of the config [ 244.875899][ T5901] usb 2-1: config 55 has 0 interfaces, different from the descriptor's value: 49 [ 244.923239][ T5901] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 244.934400][ T5901] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 244.980407][ T5847] Bluetooth: hci1: command 0x0c1a tx timeout [ 244.992178][ T5901] usb 2-1: Product: syz [ 245.003758][ T5901] usb 2-1: Manufacturer: syz [ 245.615977][ T5847] Bluetooth: hci4: command 0x0c1a tx timeout [ 245.619005][ T5850] Bluetooth: hci2: command 0x0c1a tx timeout [ 245.622291][ T5843] Bluetooth: hci3: command 0x0c1a tx timeout [ 245.628278][ T5852] Bluetooth: hci0: command 0x0c1a tx timeout [ 247.425064][ T5901] usb 2-1: USB disconnect, device number 12 [ 247.516157][ T7661] netlink: 'syz.2.465': attribute type 13 has an invalid length. [ 248.080269][ T5898] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 248.266168][ T5898] usb 5-1: Using ep0 maxpacket: 8 [ 248.282356][ T5898] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 248.295861][ T5898] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 248.371419][ T5898] pvrusb2: Hardware description: Terratec Grabster AV400 [ 248.395489][ T5898] pvrusb2: ********** [ 248.410639][ T5898] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 248.458069][ T5898] pvrusb2: Important functionality might not be entirely working. [ 248.494952][ T5898] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 248.555567][ T5898] pvrusb2: ********** [ 248.583497][ T2346] pvrusb2: Invalid write control endpoint [ 248.597159][ T30] kauditd_printk_skb: 63 callbacks suppressed [ 248.597178][ T30] audit: type=1326 audit(1749093913.670:646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7674 comm="syz.2.470" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 248.804099][ T7669] pvrusb2: Invalid write control endpoint [ 248.874677][ T7669] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 248.887799][ T7669] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 248.952444][ T30] audit: type=1326 audit(1749093913.670:647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7674 comm="syz.2.470" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 249.018527][ T30] audit: type=1326 audit(1749093913.670:648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7674 comm="syz.2.470" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 249.110641][ T2346] pvrusb2: Invalid write control endpoint [ 249.127829][ T30] audit: type=1326 audit(1749093913.670:649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7674 comm="syz.2.470" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 249.153575][ T2346] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 249.177338][ T2346] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 249.205897][ T2346] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 249.205934][ T30] audit: type=1326 audit(1749093913.740:650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7674 comm="syz.2.470" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 249.309949][ T7687] tipc: Enabling of bearer rejected, already enabled [ 249.317782][ T2346] pvrusb2: Device being rendered inoperable [ 249.349528][ T2346] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 249.385019][ T30] audit: type=1326 audit(1749093913.740:651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7674 comm="syz.2.470" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 249.407711][ T2346] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 249.481616][ T2346] pvrusb2: Attached sub-driver cx25840 [ 249.508999][ T2346] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 249.566997][ T5839] usb 1-1: new low-speed USB device number 21 using dummy_hcd [ 249.586469][ T30] audit: type=1326 audit(1749093913.740:652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7674 comm="syz.2.470" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 249.759332][ T5839] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 249.767733][ T2346] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 249.793709][ T5839] usb 1-1: config 0 has no interface number 0 [ 249.825567][ T30] audit: type=1326 audit(1749093913.740:653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7674 comm="syz.2.470" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 249.867006][ T5839] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 249.945773][ T5839] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 249.962471][ T30] audit: type=1326 audit(1749093913.740:654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7674 comm="syz.2.470" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 249.984692][ T5839] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 249.993990][ T5839] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.046671][ T30] audit: type=1326 audit(1749093913.840:655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7674 comm="syz.2.470" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 250.126408][ T5839] usb 1-1: config 0 descriptor?? [ 250.264994][ T7687] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 250.300106][ T5839] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 250.504070][ T7695] tipc: Enabling of bearer rejected, already enabled [ 250.755780][ T5839] usb 2-1: new low-speed USB device number 13 using dummy_hcd [ 250.898288][ T10] usb 5-1: USB disconnect, device number 14 [ 250.968179][ T5839] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 250.976388][ T5839] usb 2-1: config 0 has no interface number 0 [ 250.982514][ T5839] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 250.993787][ T5839] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 251.014359][ T5839] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 251.048053][ T7700] ALSA: seq fatal error: cannot create timer (-16) [ 251.276915][ T5839] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.558141][ T5839] usb 2-1: config 0 descriptor?? [ 251.563958][ T7695] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 251.583871][ T5839] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior1 [ 251.717893][ T7702] netlink: 'syz.4.476': attribute type 13 has an invalid length. [ 252.018503][ T7706] netlink: 'syz.2.477': attribute type 1 has an invalid length. [ 252.308625][ T7710] bond1: (slave bond_slave_0): Enslaving as a backup interface with a down link [ 252.401846][ T10] usb 1-1: USB disconnect, device number 21 [ 252.407995][ C0] iowarrior 1-1:0.1: iowarrior_callback - usb_submit_urb failed with result -19 [ 252.647578][ T7706] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 252.903879][ T7721] netlink: 'syz.3.480': attribute type 13 has an invalid length. [ 253.562998][ T5898] usb 2-1: USB disconnect, device number 13 [ 254.333975][ T7738] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 254.341236][ T7738] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 254.347481][ T7738] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 254.364475][ T7738] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 254.396072][ T7738] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 255.255595][ T7754] netlink: 12 bytes leftover after parsing attributes in process `syz.4.486'. [ 255.270602][ T10] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 255.475734][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 255.485497][ T7753] 8021q: adding VLAN 0 to HW filter on device bond2 [ 255.506838][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 255.516481][ T10] usb 1-1: config index 0 descriptor too short (expected 34347, got 43) [ 255.525451][ T10] usb 1-1: config 31 has too many interfaces: 196, using maximum allowed: 32 [ 255.534355][ T10] usb 1-1: config 31 has an invalid descriptor of length 0, skipping remainder of the config [ 255.545540][ T10] usb 1-1: config 31 has 1 interface, different from the descriptor's value: 196 [ 255.559911][ T10] usb 1-1: config 31 has no interface number 0 [ 255.582758][ T10] usb 1-1: config 31 interface 81 altsetting 3 has an endpoint descriptor with address 0x93, changing to 0x83 [ 255.606056][ T10] usb 1-1: config 31 interface 81 altsetting 3 bulk endpoint 0x83 has invalid maxpacket 150 [ 255.628376][ T10] usb 1-1: config 31 interface 81 has no altsetting 0 [ 255.655943][ T10] usb 1-1: string descriptor 0 read error: -22 [ 255.662355][ T10] usb 1-1: New USB device found, idVendor=0dfc, idProduct=0001, bcdDevice=24.ac [ 255.688543][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.729223][ T7745] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 255.846941][ T10] input: USB Touchscreen 0dfc:0001 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:31.81/input/input12 [ 255.863162][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.869643][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.073651][ T7753] bond2 (unregistering): Released all slaves [ 256.096620][ T5852] Bluetooth: hci1: command 0x0c1a tx timeout [ 256.108891][ T10] usb 1-1: USB disconnect, device number 22 [ 256.415838][ T5852] Bluetooth: hci4: command 0x0c1a tx timeout [ 256.426281][ T5852] Bluetooth: hci2: command 0x0c1a tx timeout [ 256.432419][ T5852] Bluetooth: hci3: command 0x0c1a tx timeout [ 256.438499][ T5850] Bluetooth: hci0: command 0x0c1a tx timeout [ 256.985735][ T7770] netlink: 'syz.4.494': attribute type 13 has an invalid length. [ 257.275825][ T5898] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 257.390208][ T30] kauditd_printk_skb: 233 callbacks suppressed [ 257.390230][ T30] audit: type=1326 audit(1749093922.460:889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7743 comm="syz.1.487" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 257.446610][ T5898] usb 1-1: Using ep0 maxpacket: 16 [ 257.463999][ T5898] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 257.494779][ T30] audit: type=1326 audit(1749093922.460:890): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7743 comm="syz.1.487" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 257.518553][ T5898] usb 1-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 257.553438][ T5898] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.595749][ T5898] usb 1-1: Product: syz [ 257.599981][ T5898] usb 1-1: Manufacturer: syz [ 257.615727][ T30] audit: type=1326 audit(1749093922.460:891): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7743 comm="syz.1.487" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 257.641953][ T5898] usb 1-1: SerialNumber: syz [ 257.666858][ T5898] usb 1-1: config 0 descriptor?? [ 257.694610][ T5898] hub 1-1:0.0: bad descriptor, ignoring hub [ 257.711777][ T5898] hub 1-1:0.0: probe with driver hub failed with error -5 [ 257.735733][ T30] audit: type=1326 audit(1749093922.460:892): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7743 comm="syz.1.487" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 257.740931][ T5898] input: syz syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input13 [ 257.835759][ T30] audit: type=1326 audit(1749093922.460:893): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7743 comm="syz.1.487" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 257.895978][ T7772] netlink: 84 bytes leftover after parsing attributes in process `syz.0.495'. [ 258.024655][ T30] audit: type=1326 audit(1749093922.460:894): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7743 comm="syz.1.487" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 258.024713][ T30] audit: type=1326 audit(1749093922.460:895): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7743 comm="syz.1.487" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 258.024757][ T30] audit: type=1326 audit(1749093922.460:896): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7743 comm="syz.1.487" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 258.236710][ T5898] input: failed to attach handler mousedev to device input13, error: -5 [ 258.356004][ T5898] usb 1-1: USB disconnect, device number 23 [ 258.411971][ T30] audit: type=1326 audit(1749093922.460:897): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7743 comm="syz.1.487" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 258.507424][ T30] audit: type=1326 audit(1749093922.460:898): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7743 comm="syz.1.487" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf705e558 code=0x7ffc0000 [ 259.328270][ T7796] tipc: Started in network mode [ 259.334895][ T7796] tipc: Node identity 7f000001, cluster identity 4711 [ 259.411035][ T7796] tipc: Enabled bearer , priority 10 [ 260.465857][ T5901] tipc: Node number set to 2130706433 [ 260.772190][ T7824] netlink: 12 bytes leftover after parsing attributes in process `syz.1.504'. [ 262.396270][ T30] kauditd_printk_skb: 112 callbacks suppressed [ 262.396289][ T30] audit: type=1326 audit(1749093927.470:1011): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7833 comm="syz.0.512" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 262.631697][ T30] audit: type=1326 audit(1749093927.470:1012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7833 comm="syz.0.512" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 262.653742][ C1] vkms_vblank_simulate: vblank timer overrun [ 262.865817][ T30] audit: type=1326 audit(1749093927.470:1013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7833 comm="syz.0.512" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 262.887852][ C1] vkms_vblank_simulate: vblank timer overrun [ 262.901076][ T30] audit: type=1326 audit(1749093927.470:1014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7833 comm="syz.0.512" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 262.944919][ T30] audit: type=1326 audit(1749093927.470:1015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7833 comm="syz.0.512" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 262.966904][ C1] vkms_vblank_simulate: vblank timer overrun [ 262.977742][ T30] audit: type=1326 audit(1749093927.470:1016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7833 comm="syz.0.512" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 262.999675][ C1] vkms_vblank_simulate: vblank timer overrun [ 263.175812][ T30] audit: type=1326 audit(1749093927.470:1017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7833 comm="syz.0.512" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 263.240064][ T30] audit: type=1326 audit(1749093927.470:1018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7833 comm="syz.0.512" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 263.358205][ T30] audit: type=1326 audit(1749093927.480:1019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7833 comm="syz.0.512" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 263.485740][ T30] audit: type=1326 audit(1749093927.490:1020): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7833 comm="syz.0.512" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 264.116089][ T7853] tipc: Enabling of bearer rejected, already enabled [ 264.400759][ T7860] netlink: 'syz.0.520': attribute type 13 has an invalid length. [ 264.712393][ T7866] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 265.023657][ T7860] bridge0: port 3(dummy0) entered disabled state [ 265.030441][ T7860] bridge0: port 2(bridge_slave_1) entered disabled state [ 265.037986][ T7860] bridge0: port 1(bridge_slave_0) entered disabled state [ 265.275630][ T7860] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 265.293292][ T7860] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 265.385872][ T5839] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 265.491442][ T7860] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.501262][ T7860] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.512215][ T7860] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.548269][ T7860] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.567517][ T5839] usb 2-1: Using ep0 maxpacket: 8 [ 265.645030][ T5839] usb 2-1: config 6 has an invalid interface number: 2 but max is 0 [ 265.655896][ T5839] usb 2-1: config 6 has no interface number 0 [ 265.662050][ T5839] usb 2-1: config 6 interface 2 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 265.684163][ T5839] usb 2-1: config 6 interface 2 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 265.723330][ T5839] usb 2-1: config 6 interface 2 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 265.739728][ T5839] usb 2-1: config 6 interface 2 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 265.819866][ T5839] usb 2-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 265.830611][ T5839] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.847888][ T5839] usb 2-1: Product: syz [ 265.863934][ T5839] usb 2-1: Manufacturer: syz [ 265.876049][ T5839] usb 2-1: SerialNumber: syz [ 265.954938][ T5839] hso 2-1:6.2: Failed to find BULK IN ep [ 265.971275][ T7884] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 266.468937][ T7881] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 266.475332][ T7881] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 266.569562][ T7881] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 266.616382][ T7881] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 266.668156][ T7881] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 266.680047][ T7871] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.691649][ T7871] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 266.808284][ T5839] usb 2-1: USB disconnect, device number 14 [ 267.627101][ T7903] FAULT_INJECTION: forcing a failure. [ 267.627101][ T7903] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 267.658994][ T7902] veth0_to_team: entered promiscuous mode [ 267.664809][ T7902] veth0_to_team: entered allmulticast mode [ 267.683420][ T7902] netlink: 'syz.4.532': attribute type 10 has an invalid length. [ 267.705021][ T7903] CPU: 1 UID: 0 PID: 7903 Comm: syz.1.533 Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full) [ 267.705051][ T7903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 267.705065][ T7903] Call Trace: [ 267.705074][ T7903] [ 267.705083][ T7903] dump_stack_lvl+0x189/0x250 [ 267.705122][ T7903] ? __pfx____ratelimit+0x10/0x10 [ 267.705153][ T7903] ? __pfx_dump_stack_lvl+0x10/0x10 [ 267.705181][ T7903] ? __pfx__printk+0x10/0x10 [ 267.705201][ T7903] ? __might_fault+0xb0/0x130 [ 267.705228][ T7903] should_fail_ex+0x414/0x560 [ 267.705259][ T7903] _copy_from_user+0x2d/0xb0 [ 267.705282][ T7903] kstrtouint_from_user+0xc4/0x170 [ 267.705301][ T7903] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 267.705333][ T7903] proc_fail_nth_write+0x88/0x240 [ 267.705356][ T7903] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 267.705383][ T7903] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 267.705406][ T7903] vfs_write+0x27b/0xa90 [ 267.705430][ T7903] ? __pfx_vfs_write+0x10/0x10 [ 267.705448][ T7903] ? __fget_files+0x2a/0x420 [ 267.705472][ T7903] ? __fget_files+0x3a0/0x420 [ 267.705491][ T7903] ? __fget_files+0x2a/0x420 [ 267.705518][ T7903] ksys_write+0x145/0x250 [ 267.705537][ T7903] ? __pfx_ksys_write+0x10/0x10 [ 267.705556][ T7903] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 267.705583][ T7903] ? lockdep_hardirqs_on+0x9c/0x150 [ 267.705610][ T7903] __do_fast_syscall_32+0xb6/0x2b0 [ 267.705646][ T7903] ? lockdep_hardirqs_on+0x9c/0x150 [ 267.705681][ T7903] do_fast_syscall_32+0x34/0x80 [ 267.705710][ T7903] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 267.705737][ T7903] RIP: 0023:0xf705e539 [ 267.705753][ T7903] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 267.705768][ T7903] RSP: 002b:00000000f504e590 EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 267.705788][ T7903] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f504e620 [ 267.705800][ T7903] RDX: 0000000000000001 RSI: 00000000f73c2ff4 RDI: 0000000000000000 [ 267.705810][ T7903] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 267.705820][ T7903] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 267.705831][ T7903] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 267.705855][ T7903] [ 268.017562][ T7902] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 268.193039][ T5852] Bluetooth: hci1: command 0x0c1a tx timeout [ 268.447097][ T5839] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 268.502835][ T5852] Bluetooth: hci0: command 0x0c1a tx timeout [ 268.644037][ T5839] usb 1-1: Using ep0 maxpacket: 16 [ 268.656427][ T5852] Bluetooth: hci2: command 0x0c1a tx timeout [ 268.662543][ T5850] Bluetooth: hci3: command 0x0c1a tx timeout [ 268.673124][ T7917] netlink: 'syz.1.538': attribute type 13 has an invalid length. [ 268.687981][ T5839] usb 1-1: config 1 interface 0 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 268.701016][ T5839] usb 1-1: config 1 interface 0 has no altsetting 0 [ 268.735791][ T5852] Bluetooth: hci4: command 0x0c1a tx timeout [ 268.829273][ T5839] usb 1-1: string descriptor 0 read error: -22 [ 268.835741][ T5839] usb 1-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 268.844811][ T5839] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.249951][ T7908] netlink: 252 bytes leftover after parsing attributes in process `syz.0.534'. [ 269.270445][ T7908] bond0: entered promiscuous mode [ 269.275988][ T7908] bond_slave_0: entered promiscuous mode [ 269.282373][ T7908] bond_slave_1: entered promiscuous mode [ 270.050654][ T7929] netlink: 40 bytes leftover after parsing attributes in process `syz.1.541'. [ 270.123518][ T24] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 270.295811][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 270.320744][ T24] usb 4-1: config 0 has an invalid interface number: 247 but max is 0 [ 270.329885][ T24] usb 4-1: config 0 has no interface number 0 [ 270.352300][ T24] usb 4-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice= 1.9b [ 270.367211][ T24] usb 4-1: New USB device strings: Mfr=128, Product=0, SerialNumber=0 [ 270.382122][ T24] usb 4-1: Manufacturer: syz [ 270.439509][ T24] usb 4-1: config 0 descriptor?? [ 270.684197][ T10] usb 4-1: USB disconnect, device number 17 [ 271.084775][ T7943] netlink: 4 bytes leftover after parsing attributes in process `syz.1.546'. [ 271.217590][ T5839] usbhid 1-1:1.0: can't add hid device: -71 [ 271.251155][ T5839] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 271.362112][ T30] kauditd_printk_skb: 277 callbacks suppressed [ 271.362133][ T30] audit: type=1326 audit(1749093936.430:1298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7938 comm="syz.4.545" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70ee558 code=0x7ffc0000 [ 271.403561][ T5839] usb 1-1: USB disconnect, device number 24 [ 271.508254][ T30] audit: type=1326 audit(1749093936.460:1299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7938 comm="syz.4.545" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70ee558 code=0x7ffc0000 [ 271.645785][ T30] audit: type=1326 audit(1749093936.460:1300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7938 comm="syz.4.545" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 271.805715][ T30] audit: type=1326 audit(1749093936.460:1301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7938 comm="syz.4.545" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70ee558 code=0x7ffc0000 [ 271.927002][ T30] audit: type=1326 audit(1749093936.460:1302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7938 comm="syz.4.545" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70ee558 code=0x7ffc0000 [ 271.980203][ T7964] netlink: 'syz.4.551': attribute type 13 has an invalid length. [ 272.611944][ T30] audit: type=1326 audit(1749093936.460:1303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7938 comm="syz.4.545" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70ee558 code=0x7ffc0000 [ 272.696037][ T30] audit: type=1326 audit(1749093936.460:1304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7938 comm="syz.4.545" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 272.818770][ T30] audit: type=1326 audit(1749093936.460:1305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7938 comm="syz.4.545" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70ee558 code=0x7ffc0000 [ 272.863060][ T7970] ALSA: seq fatal error: cannot create timer (-16) [ 272.969118][ T30] audit: type=1326 audit(1749093936.460:1306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7938 comm="syz.4.545" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70ee558 code=0x7ffc0000 [ 273.204712][ T30] audit: type=1326 audit(1749093936.460:1307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7938 comm="syz.4.545" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70ee558 code=0x7ffc0000 [ 275.326151][ T5898] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 275.500479][ T5898] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 275.572865][ T8006] ALSA: seq fatal error: cannot create timer (-16) [ 275.667658][ T5898] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 275.682463][ T5898] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 2 [ 275.723620][ T5898] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 275.749019][ T5898] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.774797][ T5898] usb 1-1: Product: syz [ 275.811920][ T5898] usb 1-1: Manufacturer: syz [ 275.825399][ T5898] usb 1-1: SerialNumber: syz [ 276.518722][ T30] kauditd_printk_skb: 150 callbacks suppressed [ 276.518741][ T30] audit: type=1326 audit(1749093941.590:1458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8001 comm="syz.2.561" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 276.615432][ T30] audit: type=1326 audit(1749093941.590:1459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8001 comm="syz.2.561" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 276.637412][ C0] vkms_vblank_simulate: vblank timer overrun [ 276.670613][ T30] audit: type=1326 audit(1749093941.590:1460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8001 comm="syz.2.561" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 276.755784][ T30] audit: type=1326 audit(1749093941.590:1461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8001 comm="syz.2.561" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 276.833827][ T30] audit: type=1326 audit(1749093941.590:1462): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8001 comm="syz.2.561" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 276.855760][ C0] vkms_vblank_simulate: vblank timer overrun [ 276.884151][ T30] audit: type=1326 audit(1749093941.590:1463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8001 comm="syz.2.561" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 276.906068][ C0] vkms_vblank_simulate: vblank timer overrun [ 277.020634][ T8012] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 277.026901][ T8012] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 277.035525][ T8012] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 277.041768][ T8012] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 277.068272][ T8016] netlink: 12 bytes leftover after parsing attributes in process `syz.3.564'. [ 277.097990][ T8016] netlink: 32 bytes leftover after parsing attributes in process `syz.3.564'. [ 277.113949][ T30] audit: type=1326 audit(1749093941.620:1464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8001 comm="syz.2.561" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 277.135942][ C0] vkms_vblank_simulate: vblank timer overrun [ 277.193392][ T8012] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 277.328838][ T30] audit: type=1326 audit(1749093941.620:1465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8001 comm="syz.2.561" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 277.355759][ T30] audit: type=1326 audit(1749093941.620:1466): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8001 comm="syz.2.561" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 277.412923][ T30] audit: type=1326 audit(1749093941.620:1467): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8001 comm="syz.2.561" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 277.704332][ T8018] netlink: 4 bytes leftover after parsing attributes in process `syz.4.566'. [ 277.728920][ T8018] FAULT_INJECTION: forcing a failure. [ 277.728920][ T8018] name failslab, interval 1, probability 0, space 0, times 0 [ 277.780816][ T8018] CPU: 0 UID: 0 PID: 8018 Comm: syz.4.566 Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full) [ 277.780837][ T8018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 277.780847][ T8018] Call Trace: [ 277.780853][ T8018] [ 277.780859][ T8018] dump_stack_lvl+0x189/0x250 [ 277.780887][ T8018] ? __pfx____ratelimit+0x10/0x10 [ 277.780909][ T8018] ? __pfx_dump_stack_lvl+0x10/0x10 [ 277.780932][ T8018] ? __pfx__printk+0x10/0x10 [ 277.780952][ T8018] ? __pfx___might_resched+0x10/0x10 [ 277.780969][ T8018] should_fail_ex+0x414/0x560 [ 277.780995][ T8018] should_failslab+0xa8/0x100 [ 277.781013][ T8018] __kmalloc_node_track_caller_noprof+0xcc/0x4e0 [ 277.781029][ T8018] ? xfrm_add_sa+0x1c3c/0x4050 [ 277.781050][ T8018] kmemdup_noprof+0x2b/0x70 [ 277.781070][ T8018] xfrm_add_sa+0x1c3c/0x4050 [ 277.781093][ T8018] ? __pfx_xfrm_add_sa+0x10/0x10 [ 277.781113][ T8018] ? __nla_parse+0x40/0x60 [ 277.781131][ T8018] xfrm_user_rcv_msg+0x7a3/0xab0 [ 277.781153][ T8018] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 277.781193][ T8018] ? __mutex_trylock_common+0x153/0x260 [ 277.781211][ T8018] ? __pfx___mutex_trylock_common+0x10/0x10 [ 277.781229][ T8018] ? rcu_is_watching+0x15/0xb0 [ 277.781243][ T8018] ? trace_contention_end+0x39/0x120 [ 277.781270][ T8018] netlink_rcv_skb+0x208/0x470 [ 277.781288][ T8018] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 277.781306][ T8018] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 277.781333][ T8018] ? netlink_deliver_tap+0x2e/0x1b0 [ 277.781349][ T8018] ? netlink_deliver_tap+0x2e/0x1b0 [ 277.781366][ T8018] xfrm_netlink_rcv+0x79/0x90 [ 277.781383][ T8018] netlink_unicast+0x75b/0x8d0 [ 277.781405][ T8018] netlink_sendmsg+0x805/0xb30 [ 277.781428][ T8018] ? __pfx_netlink_sendmsg+0x10/0x10 [ 277.781446][ T8018] ? __import_iovec+0x5d4/0x7f0 [ 277.781462][ T8018] ? aa_sock_msg_perm+0x94/0x160 [ 277.781485][ T8018] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 277.781505][ T8018] ? __pfx_netlink_sendmsg+0x10/0x10 [ 277.781522][ T8018] __sock_sendmsg+0x219/0x270 [ 277.781547][ T8018] ____sys_sendmsg+0x505/0x830 [ 277.781568][ T8018] ? __pfx_____sys_sendmsg+0x10/0x10 [ 277.781597][ T8018] ___sys_sendmsg+0x21f/0x2a0 [ 277.781616][ T8018] ? __pfx____sys_sendmsg+0x10/0x10 [ 277.781660][ T8018] ? __fget_files+0x2a/0x420 [ 277.781680][ T8018] ? __fget_files+0x3a0/0x420 [ 277.781704][ T8018] __sys_sendmsg+0x164/0x220 [ 277.781724][ T8018] ? __pfx___sys_sendmsg+0x10/0x10 [ 277.781752][ T8018] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 277.781775][ T8018] ? lockdep_hardirqs_on+0x9c/0x150 [ 277.781798][ T8018] __do_fast_syscall_32+0xb6/0x2b0 [ 277.781822][ T8018] ? lockdep_hardirqs_on+0x9c/0x150 [ 277.781845][ T8018] do_fast_syscall_32+0x34/0x80 [ 277.781868][ T8018] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 277.781886][ T8018] RIP: 0023:0xf70ee539 [ 277.781898][ T8018] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 277.781911][ T8018] RSP: 002b:00000000f50de55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 277.781926][ T8018] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080000ec0 [ 277.781936][ T8018] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 277.781945][ T8018] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 277.781953][ T8018] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 277.781962][ T8018] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 277.781982][ T8018] [ 278.127163][ C0] vkms_vblank_simulate: vblank timer overrun [ 278.198015][ T5898] usb 1-1: USB disconnect, device number 25 [ 278.745875][ T5850] Bluetooth: hci1: command 0x0c1a tx timeout [ 279.074793][ T5850] Bluetooth: hci2: command 0x0c1a tx timeout [ 279.081020][ T5852] Bluetooth: hci3: command 0x0c1a tx timeout [ 279.081034][ T5847] Bluetooth: hci0: command 0x0c1a tx timeout [ 279.227369][ T5847] Bluetooth: hci4: command 0x0c1a tx timeout [ 279.537166][ T8048] netlink: 'syz.3.575': attribute type 13 has an invalid length. [ 279.683584][ T8055] netlink: 'syz.2.576': attribute type 13 has an invalid length. [ 280.457478][ T8063] netlink: 24 bytes leftover after parsing attributes in process `syz.0.580'. [ 281.361126][ T8079] netlink: 8 bytes leftover after parsing attributes in process `syz.0.584'. [ 281.838430][ T8088] netlink: 12 bytes leftover after parsing attributes in process `syz.1.582'. [ 281.849947][ T8088] netlink: 32 bytes leftover after parsing attributes in process `syz.1.582'. [ 282.055876][ T5839] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 282.213626][ T8092] netlink: 'syz.3.588': attribute type 13 has an invalid length. [ 282.231639][ T5839] usb 1-1: Using ep0 maxpacket: 16 [ 282.242523][ T5839] usb 1-1: config 1 interface 0 altsetting 6 bulk endpoint 0x1 has invalid maxpacket 64 [ 282.255541][ T5839] usb 1-1: config 1 interface 0 has no altsetting 0 [ 282.357050][ T8094] netlink: 32 bytes leftover after parsing attributes in process `syz.4.586'. [ 282.501853][ T5839] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 282.543012][ T5839] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.575842][ T5839] usb 1-1: Product: 褢汒⒌坥軐藹뵿ㆫ喣♹쇱຦ឮ鏡톏鿔䦤싈圶ረ룾⑰煗铺㲡똘蝡ᝓ䡱⮦⹔ᑁ莓呋휉ࢢ䞜㪞븗⣿춗痍蝧䔈兄⠑棿彪謀䃆ꯇЬ뻍㮝㚰홂遱鱟秱әꖟ屡၉儽ᩥ뉒鐆鐜ચΙ▱࢓ꌝ磔汸 [ 282.871168][ T5839] usb 1-1: Manufacturer: 㠊 [ 282.904583][ T5839] usb 1-1: SerialNumber: syz [ 282.956184][ T8087] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 283.302299][ T5839] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 26 if 0 alt 6 proto 1 vid 0x0525 pid 0xA4A8 [ 283.330412][ T5839] usb 1-1: USB disconnect, device number 26 [ 283.342697][ T5839] usblp0: removed [ 283.435739][ T5898] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 283.490814][ T30] kauditd_printk_skb: 81 callbacks suppressed [ 283.494301][ T30] audit: type=1326 audit(1749093948.560:1549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8102 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf708e558 code=0x7ffc0000 [ 283.715724][ T30] audit: type=1326 audit(1749093948.560:1550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8102 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf708e558 code=0x7ffc0000 [ 283.740007][ T5898] usb 3-1: Using ep0 maxpacket: 16 [ 283.786174][ T5898] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 103, changing to 10 [ 283.806672][ T30] audit: type=1326 audit(1749093948.560:1551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8102 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 283.826850][ T5898] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 283.878332][ T30] audit: type=1326 audit(1749093948.560:1552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8102 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf708e558 code=0x7ffc0000 [ 283.902601][ T5898] usb 3-1: config 0 interface 0 has no altsetting 0 [ 283.916544][ T5898] usb 3-1: New USB device found, idVendor=227d, idProduct=0709, bcdDevice= 0.00 [ 283.943224][ T5898] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.968053][ T30] audit: type=1326 audit(1749093948.560:1553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8102 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 284.022144][ T5898] usb 3-1: config 0 descriptor?? [ 284.071936][ T30] audit: type=1326 audit(1749093948.560:1554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8102 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 284.143113][ T30] audit: type=1326 audit(1749093948.560:1555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8102 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf708e558 code=0x7ffc0000 [ 284.172806][ T30] audit: type=1326 audit(1749093948.560:1556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8102 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 284.339529][ T5839] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 284.355744][ T30] audit: type=1326 audit(1749093948.560:1557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8102 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf708e558 code=0x7ffc0000 [ 284.385828][ T30] audit: type=1326 audit(1749093948.560:1558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8102 comm="syz.3.591" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf708e558 code=0x7ffc0000 [ 284.448740][ T5898] hid (null): report_id 60507 is invalid [ 284.457325][ T5898] hid (null): invalid report_count 13028 [ 284.463054][ T5898] hid (null): unknown global tag 0xd [ 284.481943][ T5898] hid (null): unknown global tag 0xd [ 284.531100][ T5898] hid (null): unknown global tag 0xd [ 284.565837][ T5839] usb 2-1: Using ep0 maxpacket: 32 [ 284.577495][ T5898] hid (null): invalid report_count 583099849 [ 284.586121][ T5839] usb 2-1: config 0 interface 0 has no altsetting 0 [ 284.612926][ T5839] usb 2-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 284.779967][ T5898] hid-generic 0003:227D:0709.0004: unknown main item tag 0x0 [ 284.787496][ T5898] hid-generic 0003:227D:0709.0004: unknown main item tag 0x0 [ 284.795877][ T5898] hid-generic 0003:227D:0709.0004: unknown main item tag 0x0 [ 284.801525][ T8117] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 284.803306][ T5898] hid-generic 0003:227D:0709.0004: unknown main item tag 0x0 [ 284.821661][ T5898] hid-generic 0003:227D:0709.0004: unknown main item tag 0x0 [ 284.828304][ T5839] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.829182][ T5898] hid-generic 0003:227D:0709.0004: unknown main item tag 0x0 [ 284.845743][ T5898] hid-generic 0003:227D:0709.0004: unknown main item tag 0x0 [ 284.853885][ T5898] hid-generic 0003:227D:0709.0004: unexpected long global item [ 284.863083][ T5898] hid-generic 0003:227D:0709.0004: probe with driver hid-generic failed with error -22 [ 284.874171][ T8117] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 284.887095][ T8117] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 284.915725][ T8117] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 284.920070][ T5839] usb 2-1: Product: syz [ 284.935849][ T5839] usb 2-1: Manufacturer: syz [ 284.952239][ T5839] usb 2-1: SerialNumber: syz [ 284.960068][ T8117] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 284.969612][ T5839] usb 2-1: config 0 descriptor?? [ 285.041556][ T10] usb 3-1: USB disconnect, device number 18 [ 285.325340][ T8124] netlink: 'syz.3.597': attribute type 13 has an invalid length. [ 285.386100][ T5839] gs_usb 2-1:0.0: Configuring for 1 interfaces [ 285.394696][ T5839] gs_usb 2-1:0.0: Couldn't get bit timing const for channel 0 (-EREMOTEIO) [ 285.421919][ T5839] gs_usb 2-1:0.0: probe with driver gs_usb failed with error -121 [ 286.156001][ T5898] usb 2-1: USB disconnect, device number 15 [ 286.195759][ T5839] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 286.244068][ T8151] netlink: 20 bytes leftover after parsing attributes in process `syz.2.601'. [ 286.348128][ T5839] usb 5-1: config 0 has no interfaces? [ 286.361199][ T5839] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 286.378433][ T5839] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 286.429795][ T5839] usb 5-1: Product: syz [ 286.435764][ T5839] usb 5-1: Manufacturer: syz [ 286.450242][ T8149] can: request_module (can-proto-0) failed. [ 286.451548][ T5839] usb 5-1: SerialNumber: syz [ 286.456440][ T24] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 286.472753][ T5839] usb 5-1: config 0 descriptor?? [ 286.903080][ T24] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 286.917043][ T5847] Bluetooth: hci3: command 0x0c1a tx timeout [ 286.924633][ T5847] Bluetooth: hci0: command 0x0c1a tx timeout [ 286.939804][ T24] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 286.973625][ T24] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 286.994686][ T5852] Bluetooth: hci4: command 0x0c1a tx timeout [ 286.994704][ T5847] Bluetooth: hci2: command 0x0c1a tx timeout [ 287.006991][ T24] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 287.151816][ T24] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 287.188134][ T24] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 287.197680][ T24] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 287.243212][ T24] usb 4-1: Product: syz [ 287.272463][ T24] usb 4-1: Manufacturer: syz [ 287.450797][ T8161] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 287.457169][ T8161] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 287.463297][ T8161] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 287.503685][ T24] cdc_wdm 4-1:1.0: skipping garbage [ 287.531536][ T24] cdc_wdm 4-1:1.0: skipping garbage [ 287.537178][ T8161] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 287.560430][ T8161] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 287.638237][ T24] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 287.939612][ T24] cdc_wdm 4-1:1.0: Unknown control protocol [ 288.737823][ T5852] Bluetooth: hci1: command 0x0c1a tx timeout [ 288.749377][ T24] usb 4-1: USB disconnect, device number 18 [ 288.816403][ T5898] usb 5-1: USB disconnect, device number 15 [ 288.938790][ T8177] netlink: 100 bytes leftover after parsing attributes in process `syz.4.610'. [ 288.966563][ T8177] netlink: 352 bytes leftover after parsing attributes in process `syz.4.610'. [ 289.176559][ T5839] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 289.348865][ T5839] usb 1-1: Using ep0 maxpacket: 8 [ 289.354941][ T8184] fuse: Bad value for 'fd' [ 289.367406][ T8185] fuse: Bad value for 'fd' [ 289.377400][ T8184] fuse: Bad value for 'fd' [ 289.390609][ T8184] netlink: 4 bytes leftover after parsing attributes in process `syz.4.613'. [ 289.411875][ T5839] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 289.425859][ T5839] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.426744][ T8184] netlink: 100 bytes leftover after parsing attributes in process `syz.4.613'. [ 289.433882][ T5839] usb 1-1: Product: syz [ 289.433902][ T5839] usb 1-1: Manufacturer: syz [ 289.433920][ T5839] usb 1-1: SerialNumber: syz [ 289.456558][ T10] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 289.469944][ T8187] FAULT_INJECTION: forcing a failure. [ 289.469944][ T8187] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 289.474100][ T8184] netlink: 100 bytes leftover after parsing attributes in process `syz.4.613'. [ 289.498324][ T8187] CPU: 0 UID: 0 PID: 8187 Comm: syz.2.614 Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full) [ 289.498352][ T8187] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 289.498365][ T8187] Call Trace: [ 289.498373][ T8187] [ 289.498382][ T8187] dump_stack_lvl+0x189/0x250 [ 289.498419][ T8187] ? __pfx____ratelimit+0x10/0x10 [ 289.498449][ T8187] ? __pfx_dump_stack_lvl+0x10/0x10 [ 289.498481][ T8187] ? __pfx__printk+0x10/0x10 [ 289.498524][ T8187] should_fail_ex+0x414/0x560 [ 289.498562][ T8187] _copy_to_user+0x31/0xb0 [ 289.498590][ T8187] simple_read_from_buffer+0xe1/0x170 [ 289.498618][ T8187] proc_fail_nth_read+0x1df/0x250 [ 289.498647][ T8187] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 289.498676][ T8187] ? rw_verify_area+0x258/0x650 [ 289.498708][ T8187] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 289.498735][ T8187] vfs_read+0x1fd/0x980 [ 289.498761][ T8187] ? __pfx___mutex_lock+0x10/0x10 [ 289.498793][ T8187] ? __pfx_vfs_read+0x10/0x10 [ 289.498814][ T8187] ? __fget_files+0x2a/0x420 [ 289.498843][ T8187] ? __fget_files+0x3a0/0x420 [ 289.498865][ T8187] ? __fget_files+0x2a/0x420 [ 289.498917][ T8187] ksys_read+0x145/0x250 [ 289.498940][ T8187] ? __pfx_ksys_read+0x10/0x10 [ 289.498962][ T8187] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 289.498996][ T8187] ? lockdep_hardirqs_on+0x9c/0x150 [ 289.499028][ T8187] __do_fast_syscall_32+0xb6/0x2b0 [ 289.499062][ T8187] ? lockdep_hardirqs_on+0x9c/0x150 [ 289.499097][ T8187] do_fast_syscall_32+0x34/0x80 [ 289.499130][ T8187] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 289.499155][ T8187] RIP: 0023:0xf707e539 [ 289.499173][ T8187] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 289.499192][ T8187] RSP: 002b:00000000f506e590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 289.499214][ T8187] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f506e620 [ 289.499228][ T8187] RDX: 000000000000000f RSI: 00000000f73e2ff4 RDI: 0000000000000000 [ 289.499241][ T8187] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 289.499253][ T8187] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 289.499266][ T8187] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 289.499298][ T8187] [ 289.518214][ T8189] netlink: 'syz.3.615': attribute type 13 has an invalid length. [ 289.536444][ T5852] Bluetooth: hci3: command 0x0c1a tx timeout [ 289.544986][ T5847] Bluetooth: hci0: command 0x0c1a tx timeout [ 289.619256][ T5852] Bluetooth: hci4: command 0x0c1a tx timeout [ 289.619305][ T5852] Bluetooth: hci2: command 0x0c1a tx timeout [ 289.771810][ T5839] usb 1-1: config 0 descriptor?? [ 289.795716][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 289.802910][ T10] usb 2-1: config 162 has an invalid interface number: 45 but max is 1 [ 289.811610][ T10] usb 2-1: config 162 has an invalid interface number: 87 but max is 1 [ 289.835703][ T10] usb 2-1: config 162 has no interface number 0 [ 289.842087][ T10] usb 2-1: config 162 has no interface number 1 [ 289.865749][ T10] usb 2-1: config 162 interface 45 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 289.883771][ T10] usb 2-1: config 162 interface 87 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 289.895465][ T10] usb 2-1: config 162 interface 87 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 289.910985][ T10] usb 2-1: config 162 interface 87 altsetting 1 endpoint 0x86 has invalid wMaxPacketSize 0 [ 289.929628][ T10] usb 2-1: config 162 interface 87 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 0 [ 289.949158][ T10] usb 2-1: config 162 interface 87 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 289.966193][ T10] usb 2-1: config 162 interface 45 has no altsetting 0 [ 289.973252][ T10] usb 2-1: config 162 interface 87 has no altsetting 0 [ 290.019112][ T5839] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 290.031384][ T10] usb 2-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice=32.4e [ 290.085705][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.108299][ T10] usb 2-1: Product: syz [ 290.112578][ T10] usb 2-1: Manufacturer: syz [ 290.178363][ T8203] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 290.184629][ T8203] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 290.191232][ T8203] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 290.197730][ T10] usb 2-1: SerialNumber: syz [ 290.202871][ T8203] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 290.241779][ T8203] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 290.436476][ T10] pl2303 2-1:162.45: required endpoints missing [ 290.494139][ T10] pl2303 2-1:162.87: required interrupt-in endpoint missing [ 290.546113][ T10] usb 2-1: USB disconnect, device number 16 [ 291.709565][ T5839] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 291.802595][ T5839] usb 1-1: USB disconnect, device number 27 [ 291.982988][ T8227] netlink: 12 bytes leftover after parsing attributes in process `syz.1.623'. [ 291.995888][ T8227] netlink: 32 bytes leftover after parsing attributes in process `syz.1.623'. [ 292.255976][ T5852] Bluetooth: hci4: command 0x0c1a tx timeout [ 292.262229][ T5852] Bluetooth: hci2: command 0x0c1a tx timeout [ 292.268347][ T5852] Bluetooth: hci3: command 0x0c1a tx timeout [ 292.274360][ T5852] Bluetooth: hci0: command 0x0c1a tx timeout [ 292.280420][ T5852] Bluetooth: hci1: command 0x0c1a tx timeout [ 293.486313][ T8237] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 293.492418][ T8237] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 293.560527][ T8237] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 293.610133][ T8237] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 293.628601][ T8237] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 293.849934][ T8245] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 294.691896][ T8259] FAULT_INJECTION: forcing a failure. [ 294.691896][ T8259] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 294.713697][ T8259] CPU: 0 UID: 0 PID: 8259 Comm: syz.3.633 Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full) [ 294.713719][ T8259] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 294.713729][ T8259] Call Trace: [ 294.713735][ T8259] [ 294.713742][ T8259] dump_stack_lvl+0x189/0x250 [ 294.713769][ T8259] ? __pfx____ratelimit+0x10/0x10 [ 294.713793][ T8259] ? __pfx_dump_stack_lvl+0x10/0x10 [ 294.713816][ T8259] ? __pfx__printk+0x10/0x10 [ 294.713833][ T8259] ? __might_fault+0xb0/0x130 [ 294.713856][ T8259] should_fail_ex+0x414/0x560 [ 294.713883][ T8259] _copy_from_user+0x2d/0xb0 [ 294.713904][ T8259] do_sys_poll+0x242/0x1070 [ 294.713938][ T8259] ? __pfx_do_sys_poll+0x10/0x10 [ 294.713953][ T8259] ? css_rstat_updated+0x1a5/0xca0 [ 294.714020][ T8259] ? rcu_read_lock_any_held+0xb3/0x120 [ 294.714035][ T8259] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 294.714052][ T8259] ? vfs_write+0x8d8/0xa90 [ 294.714082][ T8259] ? set_compat_user_sigmask+0xc1/0x1b0 [ 294.714097][ T8259] ? __pfx_set_compat_user_sigmask+0x10/0x10 [ 294.714111][ T8259] ? count_memcg_event_mm+0x21/0x260 [ 294.714140][ T8259] __ia32_compat_sys_ppoll_time32+0x299/0x300 [ 294.714164][ T8259] ? __pfx___ia32_compat_sys_ppoll_time32+0x10/0x10 [ 294.714187][ T8259] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 294.714211][ T8259] ? lockdep_hardirqs_on+0x9c/0x150 [ 294.714235][ T8259] __do_fast_syscall_32+0xb6/0x2b0 [ 294.714259][ T8259] ? lockdep_hardirqs_on+0x9c/0x150 [ 294.714284][ T8259] do_fast_syscall_32+0x34/0x80 [ 294.714307][ T8259] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 294.714325][ T8259] RIP: 0023:0xf708e539 [ 294.714337][ T8259] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 294.714350][ T8259] RSP: 002b:00000000f507e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000135 [ 294.714366][ T8259] RAX: ffffffffffffffda RBX: 00000000800000c0 RCX: 00000000000000dc [ 294.714376][ T8259] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 294.714385][ T8259] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 294.714393][ T8259] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 294.714401][ T8259] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 294.714422][ T8259] [ 295.375991][ T5850] Bluetooth: hci1: command 0x0c1a tx timeout [ 295.540048][ T5850] Bluetooth: hci0: command 0x0c1a tx timeout [ 295.625746][ T5850] Bluetooth: hci3: command 0x0c1a tx timeout [ 295.695879][ T5850] Bluetooth: hci4: command 0x0c1a tx timeout [ 295.702046][ T5852] Bluetooth: hci2: command 0x0c1a tx timeout [ 296.315032][ T5205] buffer_io_error: 14 callbacks suppressed [ 296.315046][ T5205] Buffer I/O error on dev loop6, logical block 0, async page read [ 296.355831][ T5205] Buffer I/O error on dev loop6, logical block 0, async page read [ 296.375743][ T5205] Buffer I/O error on dev loop6, logical block 0, async page read [ 296.404564][ T5205] Buffer I/O error on dev loop6, logical block 0, async page read [ 296.415049][ T5205] Buffer I/O error on dev loop6, logical block 0, async page read [ 296.433479][ T5205] Buffer I/O error on dev loop6, logical block 0, async page read [ 296.443570][ T5205] Buffer I/O error on dev loop6, logical block 0, async page read [ 296.457110][ T5205] ldm_validate_partition_table(): Disk read failed. [ 296.514644][ T5205] Buffer I/O error on dev loop6, logical block 0, async page read [ 296.524837][ T5205] Buffer I/O error on dev loop6, logical block 0, async page read [ 296.542988][ T5205] Buffer I/O error on dev loop6, logical block 0, async page read [ 296.581768][ T5205] Dev loop6: unable to read RDB block 0 [ 296.602170][ T5205] loop6: unable to read partition table [ 296.652625][ T5205] loop6: partition table beyond EOD, truncated [ 296.845722][ T5839] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 296.996754][ T5839] usb 4-1: Using ep0 maxpacket: 16 [ 297.036753][ T5839] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 297.077845][ T5839] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 297.123303][ T5839] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 297.139533][ T5839] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 297.148798][ T5839] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.179364][ T5839] usb 4-1: config 0 descriptor?? [ 297.310574][ T8298] xt_connbytes: Forcing CT accounting to be enabled [ 297.336087][ T8298] xt_CT: You must specify a L4 protocol and not use inversions on it [ 297.374771][ T8302] FAULT_INJECTION: forcing a failure. [ 297.374771][ T8302] name failslab, interval 1, probability 0, space 0, times 0 [ 297.496803][ T8302] CPU: 1 UID: 0 PID: 8302 Comm: syz.1.647 Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full) [ 297.496836][ T8302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 297.496849][ T8302] Call Trace: [ 297.496858][ T8302] [ 297.496867][ T8302] dump_stack_lvl+0x189/0x250 [ 297.496903][ T8302] ? __pfx____ratelimit+0x10/0x10 [ 297.496926][ T8302] ? __pfx_dump_stack_lvl+0x10/0x10 [ 297.496954][ T8302] ? __pfx__printk+0x10/0x10 [ 297.496985][ T8302] ? __pfx___might_resched+0x10/0x10 [ 297.497005][ T8302] ? fs_reclaim_acquire+0x7d/0x100 [ 297.497035][ T8302] should_fail_ex+0x414/0x560 [ 297.497068][ T8302] ? alloc_netdev_mqs+0xc9e/0x11e0 [ 297.497089][ T8302] should_failslab+0xa8/0x100 [ 297.497107][ T8302] __kvmalloc_node_noprof+0x161/0x5f0 [ 297.497134][ T8302] ? alloc_netdev_mqs+0xc9e/0x11e0 [ 297.497161][ T8302] ? alloc_netdev_mqs+0xc36/0x11e0 [ 297.497194][ T8302] alloc_netdev_mqs+0xc9e/0x11e0 [ 297.497226][ T8302] rtnl_create_link+0x31f/0xd10 [ 297.497253][ T8302] rtnl_newlink_create+0x25c/0xb00 [ 297.497285][ T8302] ? __pfx_aa_get_newest_label+0x10/0x10 [ 297.497321][ T8302] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 297.497343][ T8302] ? rtnl_newlink+0x8db/0x1c70 [ 297.497367][ T8302] ? __pfx___mutex_lock+0x10/0x10 [ 297.497397][ T8302] ? ns_capable+0x8a/0xf0 [ 297.497429][ T8302] rtnl_newlink+0x16d6/0x1c70 [ 297.497469][ T8302] ? __pfx_rtnl_newlink+0x10/0x10 [ 297.497499][ T8302] ? __lock_acquire+0xab9/0xd20 [ 297.497535][ T8302] ? __lock_acquire+0xab9/0xd20 [ 297.497576][ T8302] ? is_bpf_text_address+0x26/0x2b0 [ 297.497603][ T8302] ? is_bpf_text_address+0x292/0x2b0 [ 297.497622][ T8302] ? is_bpf_text_address+0x26/0x2b0 [ 297.497644][ T8302] ? kernel_text_address+0xa5/0xe0 [ 297.497681][ T8302] ? __lock_acquire+0xab9/0xd20 [ 297.497770][ T8302] ? __pfx_rtnl_newlink+0x10/0x10 [ 297.497790][ T8302] rtnetlink_rcv_msg+0x7cf/0xb70 [ 297.497814][ T8302] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 297.497833][ T8302] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 297.497861][ T8302] netlink_rcv_skb+0x208/0x470 [ 297.497878][ T8302] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 297.497901][ T8302] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 297.497938][ T8302] ? netlink_deliver_tap+0x2e/0x1b0 [ 297.497960][ T8302] ? netlink_deliver_tap+0x2e/0x1b0 [ 297.497987][ T8302] netlink_unicast+0x75b/0x8d0 [ 297.498010][ T8302] netlink_sendmsg+0x805/0xb30 [ 297.498034][ T8302] ? __pfx_netlink_sendmsg+0x10/0x10 [ 297.498062][ T8302] ? __import_iovec+0x5d4/0x7f0 [ 297.498086][ T8302] ? aa_sock_msg_perm+0x94/0x160 [ 297.498117][ T8302] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 297.498143][ T8302] ? __pfx_netlink_sendmsg+0x10/0x10 [ 297.498160][ T8302] __sock_sendmsg+0x219/0x270 [ 297.498185][ T8302] ____sys_sendmsg+0x505/0x830 [ 297.498218][ T8302] ? __pfx_____sys_sendmsg+0x10/0x10 [ 297.498261][ T8302] ___sys_sendmsg+0x21f/0x2a0 [ 297.498289][ T8302] ? __pfx____sys_sendmsg+0x10/0x10 [ 297.498334][ T8302] ? __fget_files+0x2a/0x420 [ 297.498356][ T8302] ? __fget_files+0x3a0/0x420 [ 297.498392][ T8302] __sys_sendmsg+0x164/0x220 [ 297.498418][ T8302] ? __pfx___sys_sendmsg+0x10/0x10 [ 297.498453][ T8302] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 297.498476][ T8302] ? lockdep_hardirqs_on+0x9c/0x150 [ 297.498502][ T8302] __do_fast_syscall_32+0xb6/0x2b0 [ 297.498536][ T8302] ? lockdep_hardirqs_on+0x9c/0x150 [ 297.498567][ T8302] do_fast_syscall_32+0x34/0x80 [ 297.498598][ T8302] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 297.498616][ T8302] RIP: 0023:0xf705e539 [ 297.498629][ T8302] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 297.498641][ T8302] RSP: 002b:00000000f504e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 297.498664][ T8302] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 297.498679][ T8302] RDX: 0000000044000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 297.498692][ T8302] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 297.498703][ T8302] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 297.498714][ T8302] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 297.498749][ T8302] [ 297.606451][ T8291] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 297.926394][ T8291] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 297.961097][ T8311] tipc: Enabling of bearer rejected, already enabled [ 298.081210][ T5839] microsoft 0003:045E:07DA.0005: global environment stack underflow [ 298.116346][ T5839] microsoft 0003:045E:07DA.0005: item 0 4 1 11 parsing failed [ 298.205379][ T5839] microsoft 0003:045E:07DA.0005: parse failed [ 298.223812][ T5839] microsoft 0003:045E:07DA.0005: probe with driver microsoft failed with error -22 [ 298.365306][ T8313] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 298.371870][ T8313] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 298.378680][ T8313] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 298.386653][ T5839] usb 4-1: USB disconnect, device number 19 [ 298.390451][ T8313] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 298.401649][ T8313] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 298.656191][ T5898] usb 1-1: new low-speed USB device number 28 using dummy_hcd [ 298.808449][ T5898] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 298.819989][ T24] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 298.869973][ T5898] usb 1-1: config 0 has no interface number 0 [ 298.917427][ T5898] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 298.970880][ T5898] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 299.011865][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 299.030545][ T5898] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 299.051051][ T24] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 299.080846][ T5898] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 299.097387][ T24] usb 3-1: too many endpoints for config 1 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 299.127770][ T5898] usb 1-1: config 0 descriptor?? [ 299.147803][ T24] usb 3-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 299.167929][ T8311] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 299.200800][ T5898] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 299.229783][ T24] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 299.252107][ T24] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 299.262158][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 299.270487][ T24] usb 3-1: Product: syz [ 299.274984][ T24] usb 3-1: Manufacturer: syz [ 299.279689][ T24] usb 3-1: SerialNumber: syz [ 299.296214][ T24] usb 3-1: bad CDC descriptors [ 299.336137][ T5839] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 299.609111][ T24] usb 3-1: USB disconnect, device number 19 [ 299.609163][ T5839] usb 4-1: Using ep0 maxpacket: 8 [ 299.637558][ T5839] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 299.661002][ T5839] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 299.688986][ T5839] usb 4-1: Product: syz [ 299.705442][ T5839] usb 4-1: Manufacturer: syz [ 299.713368][ T5839] usb 4-1: SerialNumber: syz [ 299.740963][ T5839] usb 4-1: config 0 descriptor?? [ 300.164456][ T5839] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 300.260648][ T5852] Bluetooth: hci1: command 0x0c1a tx timeout [ 300.425892][ T5852] Bluetooth: hci4: command 0x0c1a tx timeout [ 300.425914][ T5850] Bluetooth: hci2: command 0x0c1a tx timeout [ 300.425936][ T5847] Bluetooth: hci3: command 0x0c1a tx timeout [ 300.444558][ T5843] Bluetooth: hci0: command 0x0c1a tx timeout [ 300.857802][ T10] usb 1-1: USB disconnect, device number 28 [ 302.080184][ T5839] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 302.203251][ T5839] usb 4-1: USB disconnect, device number 20 [ 302.565761][ T10] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 302.654350][ T8351] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 303.255736][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 303.313401][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 303.328179][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 303.355743][ T10] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 303.375375][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 303.419362][ T10] usb 5-1: config 0 descriptor?? [ 303.865020][ T10] savu 0003:1E7D:2D5A.0006: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.4-1/input0 [ 303.937039][ T8365] netlink: 12 bytes leftover after parsing attributes in process `syz.1.661'. [ 303.952200][ T8365] netlink: 32 bytes leftover after parsing attributes in process `syz.1.661'. [ 304.095793][ T5901] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 304.118352][ T8345] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 304.143495][ T8345] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 304.169789][ T10] usb 5-1: USB disconnect, device number 16 [ 304.258844][ T5901] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 304.287490][ T5901] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 304.305895][ T5901] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 304.315026][ T5901] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 304.328380][ T5901] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 304.343845][ T5901] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 304.356788][ T5901] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 304.364916][ T5901] usb 1-1: Product: syz [ 304.392120][ T5901] usb 1-1: Manufacturer: syz [ 304.471069][ T5901] cdc_wdm 1-1:1.0: skipping garbage [ 304.482919][ T5901] cdc_wdm 1-1:1.0: skipping garbage [ 304.508218][ T5901] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 304.519054][ T5901] cdc_wdm 1-1:1.0: Unknown control protocol [ 304.544623][ T8367] netlink: 'syz.2.667': attribute type 13 has an invalid length. [ 304.825786][ T5901] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 304.995766][ T5901] usb 4-1: Using ep0 maxpacket: 32 [ 305.056626][ T5901] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 305.085981][ T5901] usb 4-1: config 0 has no interface number 0 [ 305.104099][ T5901] usb 4-1: config 0 interface 12 has no altsetting 0 [ 305.115225][ T5901] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 305.125123][ T5901] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.139193][ T5901] usb 4-1: Product: syz [ 305.146939][ T5901] usb 4-1: Manufacturer: syz [ 305.168944][ T5901] usb 4-1: SerialNumber: syz [ 305.351938][ T5901] usb 4-1: config 0 descriptor?? [ 305.360038][ T5901] f81534 4-1:0.12: required endpoints missing [ 306.266269][ T5901] usb 4-1: USB disconnect, device number 21 [ 306.679872][ T8393] netlink: 'syz.4.675': attribute type 13 has an invalid length. [ 307.298822][ T24] usb 1-1: USB disconnect, device number 29 [ 307.352482][ T8407] x_tables: ip6_tables: socket match: used from hooks FORWARD, but only valid from PREROUTING/INPUT [ 307.453954][ T8410] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 309.382708][ T8427] kvm: kvm [8426]: vcpu0, guest rIP: 0x28e Unhandled WRMSR(0x11e) = 0xff01 [ 309.490835][ T8427] kvm: kvm [8426]: vcpu0, guest rIP: 0x28e Unhandled WRMSR(0x186) = 0xff01 [ 309.510617][ T8427] kvm: kvm [8426]: vcpu0, guest rIP: 0x28e Unhandled WRMSR(0x187) = 0xff01 [ 309.562086][ T8427] kvm_intel: kvm [8426]: vcpu0, guest rIP: 0x28e Unhandled WRMSR(0x1d9) = 0xff01 [ 309.623730][ T8434] netlink: 12 bytes leftover after parsing attributes in process `syz.3.682'. [ 309.634544][ T8434] netlink: 32 bytes leftover after parsing attributes in process `syz.3.682'. [ 309.965755][ T24] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 310.168110][ T24] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 310.177072][ T24] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 310.189529][ T24] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 310.198622][ T24] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14129, setting to 64 [ 310.248810][ T24] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 310.261052][ T24] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 310.306001][ T24] usb 5-1: Product: syz [ 310.322062][ T24] usb 5-1: Manufacturer: syz [ 310.393953][ T24] cdc_wdm 5-1:1.0: skipping garbage [ 310.435699][ T24] cdc_wdm 5-1:1.0: skipping garbage [ 310.464556][ T24] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 310.927918][ T8447] netlink: 'syz.1.689': attribute type 13 has an invalid length. [ 311.235382][ T8457] netlink: 'syz.0.694': attribute type 13 has an invalid length. [ 311.404957][ T8465] netlink: 4 bytes leftover after parsing attributes in process `syz.0.695'. [ 311.420344][ T8465] fuse: Unknown parameter 'fd0x0000000000000005' [ 311.606354][ T5901] usb 3-1: new low-speed USB device number 20 using dummy_hcd [ 311.615559][ T8467] netlink: 24 bytes leftover after parsing attributes in process `syz.0.696'. [ 311.777931][ T5901] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 311.789846][ T5901] usb 3-1: config 0 has no interface number 0 [ 311.796641][ T5901] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 311.810634][ T5901] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 311.822703][ T5901] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 311.834571][ T5901] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.853452][ T5901] usb 3-1: config 0 descriptor?? [ 311.865181][ T8463] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 311.887645][ T5901] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 312.005834][ T10] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 312.112904][ T8471] netlink: 48 bytes leftover after parsing attributes in process `syz.3.698'. [ 312.176356][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 312.256866][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 312.270344][ T8479] usb usb8: usbfs: process 8479 (syz.1.700) did not claim interface 0 before use [ 312.304250][ T10] usb 1-1: config 0 has an invalid interface number: 88 but max is 0 [ 312.315955][ T10] usb 1-1: config 0 has no interface number 0 [ 312.322604][ T10] usb 1-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 312.334365][ T10] usb 1-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid wMaxPacketSize 0 [ 312.344767][ T10] usb 1-1: config 0 interface 88 has no altsetting 0 [ 312.359618][ T10] usb 1-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 312.391002][ T10] usb 1-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 312.436159][ T10] usb 1-1: Product: syz [ 312.485173][ T10] usb 1-1: Manufacturer: syz [ 312.563713][ T24] usb 5-1: USB disconnect, device number 17 [ 312.586380][ T10] usb 1-1: SerialNumber: syz [ 312.720326][ T10] usb 1-1: config 0 descriptor?? [ 313.029151][ T24] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 313.038882][ T10] input: syz syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.88/input/input15 [ 313.105075][ T10] usb 1-1: USB disconnect, device number 30 [ 313.223804][ T24] usb 4-1: New USB device found, idVendor=2040, idProduct=9301, bcdDevice=e4.fb [ 313.264485][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 313.322369][ T24] usb 4-1: config 0 descriptor?? [ 313.350640][ T24] dvb-usb: found a 'Hauppauge WinTV-NOVA-T usb2' in warm state. [ 313.360064][ T24] dvb-usb: bulk message failed: -22 (3/0) [ 313.384163][ T24] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 313.400712][ T24] dvbdev: DVB: registering new adapter (Hauppauge WinTV-NOVA-T usb2) [ 313.416874][ T24] usb 4-1: media controller created [ 313.422722][ T24] dvb-usb: bulk message failed: -22 (5/0) [ 313.428792][ T24] dvb-usb: MAC address reading failed. [ 313.443940][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 313.490029][ T24] dvb-usb: bulk message failed: -22 (6/0) [ 313.524196][ T24] dvb-usb: bulk message failed: -22 (6/0) [ 313.534374][ T24] dvb-usb: no frontend was attached by 'Hauppauge WinTV-NOVA-T usb2' [ 313.552465][ T8482] usb usb7: usbfs: process 8482 (syz.3.701) did not claim interface 0 before use [ 313.578868][ T24] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input16 [ 313.656267][ T24] dvb-usb: schedule remote query interval to 100 msecs. [ 313.692705][ T24] dvb-usb: Hauppauge WinTV-NOVA-T usb2 successfully initialized and connected. [ 313.761270][ T8496] sg_write: data in/out 541982686/120 bytes for SCSI command 0x0-- guessing data in; [ 313.761270][ T8496] program syz.3.701 not setting count and/or reply_len properly [ 313.785322][ T8497] netlink: 12 bytes leftover after parsing attributes in process `syz.4.703'. [ 313.803708][ T8497] netlink: 32 bytes leftover after parsing attributes in process `syz.4.703'. [ 313.858990][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 313.872467][ T24] dvb-usb: error while querying for an remote control event. [ 314.005722][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 314.013969][ T24] dvb-usb: error while querying for an remote control event. [ 314.155908][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 314.211769][ T24] dvb-usb: error while querying for an remote control event. [ 314.230066][ T8505] batadv_slave_1: entered promiscuous mode [ 314.381647][ T24] usb 3-1: USB disconnect, device number 20 [ 314.390962][ T5826] dvb-usb: bulk message failed: -22 (2/0) [ 314.397085][ T5826] dvb-usb: error while querying for an remote control event. [ 314.497117][ T10] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 314.566028][ T5826] dvb-usb: bulk message failed: -22 (2/0) [ 314.571883][ T5826] dvb-usb: error while querying for an remote control event. [ 314.699284][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 314.733041][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 314.736136][ T5826] dvb-usb: bulk message failed: -22 (2/0) [ 314.775606][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 314.775863][ T5826] dvb-usb: error while querying for an remote control event. [ 314.810089][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 314.852783][ T10] usb 2-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 314.885870][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.923883][ T10] usb 2-1: config 0 descriptor?? [ 314.926454][ T5826] dvb-usb: bulk message failed: -22 (2/0) [ 314.937878][ T5826] dvb-usb: error while querying for an remote control event. [ 315.061652][ T5826] dvb-usb: bulk message failed: -22 (2/0) [ 315.084223][ T5826] dvb-usb: error while querying for an remote control event. [ 315.181919][ T8505] batadv_slave_1: left promiscuous mode [ 315.193571][ T5826] usb 2-1: USB disconnect, device number 17 [ 315.212419][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 315.220952][ T24] dvb-usb: error while querying for an remote control event. [ 315.325899][ T10] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 315.335858][ T5898] dvb-usb: bulk message failed: -22 (2/0) [ 315.341876][ T5898] dvb-usb: error while querying for an remote control event. [ 315.457149][ T5826] dvb-usb: bulk message failed: -22 (2/0) [ 315.463092][ T5826] dvb-usb: error while querying for an remote control event. [ 315.475858][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 315.483304][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 315.494949][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 315.508466][ T10] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 315.517611][ T24] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 315.525233][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.533561][ T10] usb 3-1: Product: syz [ 315.537968][ T10] usb 3-1: Manufacturer: syz [ 315.542587][ T10] usb 3-1: SerialNumber: syz [ 315.550050][ T10] usb 3-1: config 0 descriptor?? [ 315.563366][ T10] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 315.572707][ T10] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 315.585990][ T5826] dvb-usb: bulk message failed: -22 (2/0) [ 315.591781][ T5826] dvb-usb: error while querying for an remote control event. [ 315.655881][ T24] usb 1-1: device descriptor read/64, error -71 [ 315.709037][ T5826] dvb-usb: bulk message failed: -22 (2/0) [ 315.715104][ T5826] dvb-usb: error while querying for an remote control event. [ 315.754136][ T5901] usb 4-1: USB disconnect, device number 22 [ 315.818298][ T5901] dvb-usb: Hauppauge WinTV-NOVA-T usb2 successfully deinitialized and disconnected. [ 315.896091][ T24] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 316.045996][ T24] usb 1-1: device descriptor read/64, error -71 [ 316.172884][ T10] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 316.183491][ T24] usb usb1-port1: attempt power cycle [ 316.223298][ T10] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 316.243928][ T8537] tipc: Started in network mode [ 316.249187][ T8537] tipc: Node identity 7f000001, cluster identity 4711 [ 316.262242][ T8537] tipc: Enabling of bearer rejected, failed to enable media [ 316.585698][ T24] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 316.628571][ T5901] usb 5-1: new low-speed USB device number 18 using dummy_hcd [ 316.637508][ T24] usb 1-1: device descriptor read/8, error -71 [ 316.799743][ T5901] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 316.815830][ T5901] usb 5-1: config 0 has no interface number 0 [ 316.841598][ T10] em28xx 3-1:0.0: Unknown AC97 audio processor detected! [ 316.854086][ T5901] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 316.915694][ T24] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 316.938197][ T8518] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 316.959232][ T24] usb 1-1: device descriptor read/8, error -71 [ 317.017403][ T5901] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 317.026236][ T8518] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 317.030958][ T5901] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 317.045860][ T5901] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.067550][ T5901] usb 5-1: config 0 descriptor?? [ 317.073520][ T8537] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 317.084212][ T24] usb usb1-port1: unable to enumerate USB device [ 317.106053][ T10] em28xx 3-1:0.0: AC97 command still being executed: not handled properly! [ 317.149760][ T5901] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 317.196430][ T10] em28xx 3-1:0.0: couldn't setup AC97 register 2 [ 317.290693][ T10] em28xx 3-1:0.0: couldn't setup AC97 register 4 [ 317.302556][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.312514][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.358933][ T10] em28xx 3-1:0.0: couldn't setup AC97 register 6 [ 317.456140][ T10] em28xx 3-1:0.0: couldn't setup AC97 register 54 [ 317.516318][ T10] em28xx 3-1:0.0: couldn't setup AC97 register 56 [ 317.561354][ T10] usb 3-1: USB disconnect, device number 21 [ 317.575923][ T24] usb 2-1: new low-speed USB device number 18 using dummy_hcd [ 317.778181][ T24] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 317.788922][ T24] usb 2-1: config 0 has no interface number 0 [ 317.811657][ T24] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 317.859807][ T24] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 317.885534][ T24] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 317.904478][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.933427][ T24] usb 2-1: config 0 descriptor?? [ 317.957276][ T8546] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 317.997899][ T24] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior1 [ 318.745310][ T8558] batadv_slave_1: entered promiscuous mode [ 319.035870][ T24] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 319.204104][ T8561] netlink: 12 bytes leftover after parsing attributes in process `syz.3.722'. [ 319.314303][ T8561] netlink: 32 bytes leftover after parsing attributes in process `syz.3.722'. [ 319.335887][ T24] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 319.360561][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 319.469670][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 319.493724][ T24] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 319.524044][ T24] usb 1-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 319.564126][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 319.614624][ T24] usb 1-1: config 0 descriptor?? [ 319.862285][ T8558] batadv_slave_1: left promiscuous mode [ 319.880921][ T8565] netlink: 28 bytes leftover after parsing attributes in process `syz.2.727'. [ 319.891819][ T8565] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 319.900658][ T30] kauditd_printk_skb: 162 callbacks suppressed [ 319.900675][ T30] audit: type=1326 audit(1749093984.970:1721): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8564 comm="syz.2.727" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf707e539 code=0x0 [ 319.929230][ T24] usb 1-1: USB disconnect, device number 35 [ 320.113564][ C1] iowarrior 5-1:0.1: iowarrior_callback - usb_submit_urb failed with result -1 [ 320.126106][ T10] usb 5-1: USB disconnect, device number 18 [ 320.297783][ T8568] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 320.397008][ T10] usb 2-1: USB disconnect, device number 18 [ 320.554254][ T8576] random: crng reseeded on system resumption [ 320.587788][ T8576] netlink: 120 bytes leftover after parsing attributes in process `syz.0.731'. [ 320.729327][ T8578] (unnamed net_device) (uninitialized): option arp_validate: invalid value (18446744073709551614) [ 320.801880][ T8585] netlink: 'syz.2.735': attribute type 10 has an invalid length. [ 320.812488][ T8585] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 320.825387][ T8585] bond0: (slave lo): refused to change device type [ 321.257902][ T24] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 322.497731][ T8615] netlink: 12 bytes leftover after parsing attributes in process `syz.4.739'. [ 322.508561][ T8615] netlink: 32 bytes leftover after parsing attributes in process `syz.4.739'. [ 322.807492][ T8619] tipc: Enabling of bearer rejected, already enabled [ 323.076507][ T10] usb 3-1: new low-speed USB device number 23 using dummy_hcd [ 323.397954][ T8625] input: syz1 as /devices/virtual/input/input17 [ 323.412260][ T10] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 323.456720][ T10] usb 3-1: config 0 has no interface number 0 [ 323.472813][ T10] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 323.494477][ T10] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 323.505766][ T10] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 323.514862][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.537402][ T10] usb 3-1: config 0 descriptor?? [ 323.564527][ T8619] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 323.614292][ T10] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 324.835734][ T10] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 324.998832][ T10] usb 4-1: config 160 has an invalid interface number: 200 but max is 0 [ 325.021514][ T10] usb 4-1: config 160 has no interface number 0 [ 325.037803][ T10] usb 4-1: config 160 interface 200 has no altsetting 0 [ 325.059538][ T5901] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 325.071506][ T10] usb 4-1: New USB device found, idVendor=21bb, idProduct=2070, bcdDevice=87.0b [ 325.091723][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.109949][ T10] usb 4-1: Product: syz [ 325.117367][ T10] usb 4-1: Manufacturer: syz [ 325.126801][ T10] usb 4-1: SerialNumber: syz [ 325.256064][ T5901] usb 5-1: Using ep0 maxpacket: 16 [ 325.264002][ T5901] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 325.402426][ T5901] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 325.470880][ T10] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 325.511069][ T5901] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 325.593057][ T10] usb 4-1: MIDIStreaming interface descriptor not found [ 325.639508][ T5901] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.766787][ T24] usb 3-1: USB disconnect, device number 23 [ 325.773910][ T5901] usb 5-1: Product: syz [ 325.807247][ T5901] usb 5-1: Manufacturer: syz [ 325.829479][ T5901] usb 5-1: SerialNumber: syz [ 325.995025][ T5901] usb 5-1: config 0 descriptor?? [ 326.131148][ T10] usb 4-1: USB disconnect, device number 23 [ 326.151012][ T5901] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 326.269443][ T5901] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 326.362365][ T6546] udevd[6546]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:160.200/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 327.003129][ T8666] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 327.016014][ T5901] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 327.022942][ T8666] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 327.029346][ T5901] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 327.039854][ T8666] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 327.050669][ T8666] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 327.068707][ T8666] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 327.251212][ T5901] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 327.258496][ T5901] em28xx 5-1:0.0: No AC97 audio processor [ 327.326723][ T10] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 327.426004][ T8670] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 327.477443][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 327.486579][ T10] usb 2-1: config 63 has an invalid interface number: 66 but max is 0 [ 327.494765][ T10] usb 2-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 327.510176][ T10] usb 2-1: config 63 has no interface number 0 [ 327.517551][ T10] usb 2-1: config 63 interface 66 has no altsetting 0 [ 327.747845][ T10] usb 2-1: New USB device found, idVendor=174f, idProduct=8a31, bcdDevice=39.f4 [ 327.912572][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.981560][ T10] usb 2-1: Product: syz [ 327.992284][ T8681] netlink: 'syz.4.753': attribute type 10 has an invalid length. [ 328.004787][ T8681] team0: Port device syz_tun added [ 328.022734][ T10] usb 2-1: Manufacturer: syz [ 328.030147][ T10] usb 2-1: SerialNumber: syz [ 328.193698][ T30] audit: type=1326 audit(1749093993.260:1722): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8676 comm="syz.0.762" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 328.255965][ T30] audit: type=1326 audit(1749093993.260:1723): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8676 comm="syz.0.762" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 328.295906][ T30] audit: type=1326 audit(1749093993.260:1724): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8676 comm="syz.0.762" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 328.334500][ T30] audit: type=1326 audit(1749093993.290:1725): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8676 comm="syz.0.762" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 328.336858][ T10] usb 2-1: USB disconnect, device number 19 [ 328.369384][ T30] audit: type=1326 audit(1749093993.290:1726): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8676 comm="syz.0.762" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f21539 code=0x7ffc0000 [ 328.401303][ T30] audit: type=1326 audit(1749093993.290:1727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8676 comm="syz.0.762" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 328.423449][ T5843] Bluetooth: hci1: command 0x0c1a tx timeout [ 328.434785][ T30] audit: type=1326 audit(1749093993.290:1728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8676 comm="syz.0.762" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f21539 code=0x7ffc0000 [ 328.464797][ T30] audit: type=1326 audit(1749093993.290:1729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8676 comm="syz.0.762" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 328.622311][ T8687] netlink: 12 bytes leftover after parsing attributes in process `syz.2.761'. [ 328.701124][ T30] audit: type=1326 audit(1749093993.290:1730): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8676 comm="syz.0.762" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f21539 code=0x7ffc0000 [ 328.727720][ T8690] netlink: 32 bytes leftover after parsing attributes in process `syz.2.761'. [ 328.748200][ T30] audit: type=1326 audit(1749093993.290:1731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8676 comm="syz.0.762" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f21558 code=0x7ffc0000 [ 329.144995][ T5843] Bluetooth: hci4: command 0x0c1a tx timeout [ 329.158855][ T5850] Bluetooth: hci2: command 0x0c1a tx timeout [ 329.169852][ T5847] Bluetooth: hci3: command 0x0c1a tx timeout [ 329.178132][ T5847] Bluetooth: hci0: command 0x0c1a tx timeout [ 329.505738][ T24] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 329.688023][ T24] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 329.697027][ T24] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 329.745917][ T24] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 329.768113][ T24] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14129, setting to 64 [ 329.802097][ T24] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 329.872829][ T10] usb 5-1: USB disconnect, device number 19 [ 329.891077][ T10] em28xx 5-1:0.0: Disconnecting em28xx [ 329.936014][ T10] em28xx 5-1:0.0: Freeing device [ 329.982654][ T24] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 330.058785][ T24] usb 1-1: Product: syz [ 330.095919][ T24] usb 1-1: Manufacturer: syz [ 330.162366][ T24] cdc_wdm 1-1:1.0: skipping garbage [ 330.171559][ T24] cdc_wdm 1-1:1.0: skipping garbage [ 330.181891][ T24] cdc_wdm 1-1:1.0: probe with driver cdc_wdm failed with error -22 [ 330.405764][ T10] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 330.436250][ T8710] tipc: Enabling of bearer rejected, already enabled [ 330.618544][ T10] usb 5-1: device descriptor read/64, error -71 [ 330.862404][ T8716] netlink: 'syz.1.770': attribute type 13 has an invalid length. [ 330.865784][ T10] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 330.925802][ T24] usb 3-1: new low-speed USB device number 24 using dummy_hcd [ 331.005895][ T10] usb 5-1: device descriptor read/64, error -71 [ 331.126019][ T10] usb usb5-port1: attempt power cycle [ 331.135169][ T24] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 331.143857][ T24] usb 3-1: config 0 has no interface number 0 [ 331.155007][ T24] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 331.166611][ T24] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 331.177748][ T24] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 331.187060][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.200506][ T24] usb 3-1: config 0 descriptor?? [ 331.304751][ T8710] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 331.372139][ T24] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 331.595768][ T10] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 331.629926][ T10] usb 5-1: device descriptor read/8, error -71 [ 331.883431][ T10] usb 5-1: new full-speed USB device number 23 using dummy_hcd [ 331.908597][ T10] usb 5-1: device descriptor read/8, error -71 [ 332.027914][ T10] usb usb5-port1: unable to enumerate USB device [ 333.338890][ T8734] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 333.345508][ T8734] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 333.352118][ T8734] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 333.510498][ T10] usb 1-1: USB disconnect, device number 36 [ 333.571984][ T8734] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 333.581462][ T5901] usb 3-1: USB disconnect, device number 24 [ 333.649436][ T8734] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 333.693136][ T30] kauditd_printk_skb: 61 callbacks suppressed [ 333.693156][ T30] audit: type=1326 audit(1749093998.740:1793): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8735 comm="syz.4.775" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 333.693187][ T8741] netlink: 'syz.2.778': attribute type 10 has an invalid length. [ 333.744169][ T30] audit: type=1326 audit(1749093998.740:1794): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8735 comm="syz.4.775" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 333.795718][ T30] audit: type=1326 audit(1749093998.740:1795): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8735 comm="syz.4.775" exe="/root/syz-executor" sig=0 arch=40000003 syscall=163 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 333.822425][ T8741] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 333.855192][ T8741] bond0: (slave lo): refused to change device type [ 333.875228][ T30] audit: type=1326 audit(1749093998.740:1796): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8735 comm="syz.4.775" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 333.925711][ T5839] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 333.978470][ T30] audit: type=1326 audit(1749093998.760:1797): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8735 comm="syz.4.775" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf70ee558 code=0x7ffc0000 [ 334.031422][ T30] audit: type=1326 audit(1749093998.760:1798): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8735 comm="syz.4.775" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ee539 code=0x7ffc0000 [ 334.178826][ T5839] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 334.220536][ T5839] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 334.363108][ T5839] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 334.433197][ T5839] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 334.585946][ T5826] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 334.595093][ T8739] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 334.610466][ T5839] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 334.757085][ T5826] usb 3-1: device descriptor read/64, error -71 [ 334.908130][ T8753] netlink: 148 bytes leftover after parsing attributes in process `syz.1.776'. [ 335.003369][ T5826] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 335.186064][ T5826] usb 3-1: device descriptor read/64, error -71 [ 335.376991][ T5843] Bluetooth: hci3: command 0x0c1a tx timeout [ 335.377304][ T5847] Bluetooth: hci0: command 0x0c1a tx timeout [ 335.384713][ T5843] Bluetooth: hci1: command 0x0c1a tx timeout [ 335.390278][ T5826] usb usb3-port1: attempt power cycle [ 335.655711][ T5843] Bluetooth: hci2: command 0x0c1a tx timeout [ 335.662962][ T8760] ================================================================== [ 335.671065][ T8760] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 335.679723][ T8760] Write of size 2560 at addr ffffc9001a4e6620 by task vivid-000-vid-c/8760 [ 335.688340][ T8760] [ 335.690713][ T8760] CPU: 0 UID: 0 PID: 8760 Comm: vivid-000-vid-c Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full) [ 335.690741][ T8760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 335.690754][ T8760] Call Trace: [ 335.690763][ T8760] [ 335.690772][ T8760] dump_stack_lvl+0x189/0x250 [ 335.690810][ T8760] ? __pfx_dump_stack_lvl+0x10/0x10 [ 335.690842][ T8760] ? __pfx__printk+0x10/0x10 [ 335.690865][ T8760] ? __pfx__printk+0x10/0x10 [ 335.690885][ T8760] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 335.690914][ T8760] ? __virt_addr_valid+0xdc/0x5c0 [ 335.690938][ T8760] print_report+0xd2/0x2b0 [ 335.690965][ T8760] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 335.690997][ T8760] kasan_report+0x118/0x150 [ 335.691020][ T8760] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 335.691057][ T8760] kasan_check_range+0x2b0/0x2c0 [ 335.691079][ T8760] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 335.691120][ T8760] __asan_memcpy+0x40/0x70 [ 335.691146][ T8760] tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 335.691222][ T8760] vivid_thread_vid_cap_tick+0xfff/0x5fd0 [ 335.691265][ T8760] ? vivid_thread_vid_cap_tick+0xdc1/0x5fd0 [ 335.691299][ T8760] ? load_gs_index+0x169/0x190 [ 335.691337][ T8760] ? ktime_get+0x3e/0x1f0 [ 335.691363][ T8760] ? __pfx_vivid_thread_vid_cap_tick+0x10/0x10 [ 335.691405][ T8760] ? lockdep_hardirqs_on+0x9c/0x150 [ 335.691441][ T8760] vivid_thread_vid_cap+0x8da/0x10d0 [ 335.691488][ T8760] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 335.691520][ T8760] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 335.691549][ T8760] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 335.691582][ T8760] ? __kthread_parkme+0x7b/0x200 [ 335.691603][ T8760] ? __kthread_parkme+0x1a1/0x200 [ 335.691628][ T8760] kthread+0x711/0x8a0 [ 335.691654][ T8760] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 335.691683][ T8760] ? __pfx_kthread+0x10/0x10 [ 335.691708][ T8760] ? _raw_spin_unlock_irq+0x23/0x50 [ 335.691736][ T8760] ? lockdep_hardirqs_on+0x9c/0x150 [ 335.691766][ T8760] ? __pfx_kthread+0x10/0x10 [ 335.691790][ T8760] ret_from_fork+0x3f9/0x770 [ 335.691822][ T8760] ? __pfx_ret_from_fork+0x10/0x10 [ 335.691855][ T8760] ? __switch_to_asm+0x39/0x70 [ 335.691876][ T8760] ? __switch_to_asm+0x33/0x70 [ 335.691898][ T8760] ? __pfx_kthread+0x10/0x10 [ 335.691922][ T8760] ret_from_fork_asm+0x1a/0x30 [ 335.691953][ T8760] [ 335.691961][ T8760] [ 335.918713][ T8760] The buggy address belongs to the virtual mapping at [ 335.918713][ T8760] [ffffc9001a4e1000, ffffc9001a4e8000) created by: [ 335.918713][ T8760] vb2_vmalloc_alloc+0xef/0x340 [ 335.936622][ T8760] [ 335.938953][ T8760] The buggy address belongs to the physical page: [ 335.945368][ T8760] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1deb5 [ 335.954143][ T8760] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 335.961278][ T8760] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 335.969871][ T8760] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 335.978462][ T8760] page dumped because: kasan: bad access detected [ 335.984889][ T8760] page_owner tracks the page as allocated [ 335.990608][ T8760] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), pid 8759, tgid 8752 (syz.3.780), ts 335567847166, free_ts 333234992867 [ 336.009726][ T8760] post_alloc_hook+0x240/0x2a0 [ 336.014505][ T8760] get_page_from_freelist+0x21e4/0x22c0 [ 336.020099][ T8760] __alloc_frozen_pages_noprof+0x181/0x370 [ 336.025940][ T8760] alloc_pages_mpol+0x232/0x4a0 [ 336.030801][ T8760] alloc_pages_noprof+0xa9/0x190 [ 336.035756][ T8760] __vmalloc_node_range_noprof+0x97d/0x12f0 [ 336.041660][ T8760] vmalloc_user_noprof+0xad/0xf0 [ 336.046630][ T8760] vb2_vmalloc_alloc+0xef/0x340 [ 336.051496][ T8760] __vb2_queue_alloc+0x9c2/0x15a0 [ 336.056616][ T8760] vb2_core_reqbufs+0xc31/0x1420 [ 336.061584][ T8760] __vb2_init_fileio+0x318/0xff0 [ 336.066544][ T8760] __vb2_perform_fileio+0x284/0x1600 [ 336.071853][ T8760] vb2_fop_read+0x273/0x360 [ 336.076390][ T8760] v4l2_read+0x199/0x2c0 [ 336.080658][ T8760] vfs_read+0x1fd/0x980 [ 336.084840][ T8760] ksys_pread64+0x126/0x1c0 [ 336.089365][ T8760] page last free pid 8705 tgid 8703 stack trace: [ 336.095701][ T8760] __free_frozen_pages+0xc71/0xe70 [ 336.100842][ T8760] tlb_finish_mmu+0x112/0x1d0 [ 336.105534][ T8760] exit_mmap+0x44c/0xb50 [ 336.109790][ T8760] __mmput+0x118/0x420 [ 336.113879][ T8760] exit_mm+0x1da/0x2c0 [ 336.117968][ T8760] do_exit+0x640/0x22e0 [ 336.122149][ T8760] do_group_exit+0x21c/0x2d0 [ 336.126764][ T8760] get_signal+0x1286/0x1340 [ 336.131297][ T8760] arch_do_signal_or_restart+0x9a/0x750 [ 336.136879][ T8760] exit_to_user_mode_loop+0x75/0x110 [ 336.142189][ T8760] __do_fast_syscall_32+0x1f4/0x2b0 [ 336.147410][ T8760] do_fast_syscall_32+0x34/0x80 [ 336.152284][ T8760] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 336.158640][ T8760] [ 336.160998][ T8760] Memory state around the buggy address: [ 336.166637][ T8760] ffffc9001a4e6f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 336.174707][ T8760] ffffc9001a4e6f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 336.182778][ T8760] >ffffc9001a4e7000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 336.190853][ T8760] ^ [ 336.194953][ T8760] ffffc9001a4e7080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 336.203041][ T8760] ffffc9001a4e7100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 336.211123][ T8760] ================================================================== [ 336.219376][ T5826] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 336.233744][ T5843] Bluetooth: hci4: command 0x0c1a tx timeout [ 336.252443][ T8760] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 336.259696][ T8760] CPU: 0 UID: 0 PID: 8760 Comm: vivid-000-vid-c Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full) [ 336.271785][ T8760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 336.281871][ T8760] Call Trace: [ 336.285175][ T8760] [ 336.288149][ T8760] dump_stack_lvl+0x99/0x250 [ 336.292788][ T8760] ? __asan_memcpy+0x40/0x70 [ 336.297402][ T8760] ? __pfx_dump_stack_lvl+0x10/0x10 [ 336.302638][ T8760] ? __pfx__printk+0x10/0x10 [ 336.307269][ T8760] panic+0x2db/0x790 [ 336.311192][ T8760] ? __pfx_panic+0x10/0x10 [ 336.315668][ T8760] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 336.321601][ T8760] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 336.327952][ T8760] ? print_memory_metadata+0x314/0x400 [ 336.333435][ T8760] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 336.339100][ T8760] check_panic_on_warn+0x89/0xb0 [ 336.344071][ T8760] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 336.349736][ T8760] end_report+0x78/0x160 [ 336.354000][ T8760] kasan_report+0x129/0x150 [ 336.358524][ T8760] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 336.364209][ T8760] kasan_check_range+0x2b0/0x2c0 [ 336.369167][ T8760] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 336.374826][ T8760] __asan_memcpy+0x40/0x70 [ 336.379291][ T8760] tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 336.384811][ T8760] vivid_thread_vid_cap_tick+0xfff/0x5fd0 [ 336.390579][ T8760] ? vivid_thread_vid_cap_tick+0xdc1/0x5fd0 [ 336.396518][ T8760] ? load_gs_index+0x169/0x190 [ 336.401322][ T8760] ? ktime_get+0x3e/0x1f0 [ 336.405676][ T8760] ? __pfx_vivid_thread_vid_cap_tick+0x10/0x10 [ 336.411868][ T8760] ? lockdep_hardirqs_on+0x9c/0x150 [ 336.417103][ T8760] vivid_thread_vid_cap+0x8da/0x10d0 [ 336.422434][ T8760] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 336.428182][ T8760] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 336.434104][ T8760] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 336.440460][ T8760] ? __kthread_parkme+0x7b/0x200 [ 336.445415][ T8760] ? __kthread_parkme+0x1a1/0x200 [ 336.450458][ T8760] kthread+0x711/0x8a0 [ 336.454548][ T8760] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 336.460289][ T8760] ? __pfx_kthread+0x10/0x10 [ 336.464890][ T8760] ? _raw_spin_unlock_irq+0x23/0x50 [ 336.470117][ T8760] ? lockdep_hardirqs_on+0x9c/0x150 [ 336.475346][ T8760] ? __pfx_kthread+0x10/0x10 [ 336.479970][ T8760] ret_from_fork+0x3f9/0x770 [ 336.484601][ T8760] ? __pfx_ret_from_fork+0x10/0x10 [ 336.489733][ T8760] ? __switch_to_asm+0x39/0x70 [ 336.494525][ T8760] ? __switch_to_asm+0x33/0x70 [ 336.499309][ T8760] ? __pfx_kthread+0x10/0x10 [ 336.503915][ T8760] ret_from_fork_asm+0x1a/0x30 [ 336.508732][ T8760] [ 336.511988][ T8760] Kernel Offset: disabled [ 336.516330][ T8760] Rebooting in 86400 seconds..