last executing test programs: 14.850288968s ago: executing program 4 (id=2694): r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000040)=@abs, &(0x7f00000000c0)=0x6e) bind$unix(r0, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) (async) syz_usb_connect(0x3, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x8e, 0xc6, 0x1e, 0x40, 0x7c9, 0x12, 0xc2f4, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0xcb, 0x8e, 0x2f, 0x0, [], [{{0x9, 0x5, 0xf}}, {{0x9, 0x5, 0xd}}, {{0x9, 0x5, 0x9}}]}}]}}]}}, 0x0) 13.115798845s ago: executing program 4 (id=2704): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc00000019000100000002000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000000000000000602d3183000000000000000000000000000a000000000000000000000080400000000000000000000044000500ac1414aa00"], 0xfc}}, 0x0) 12.902775892s ago: executing program 4 (id=2705): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000002c0)=@abs={0x0, 0x0, 0x1001}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) r4 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r4, &(0x7f0000000080)={0x1d, r3, 0x3, {}, 0xfe}, 0x18) syz_open_dev$tty20(0xc, 0x4, 0x1) accept4(r4, 0x0, &(0x7f0000000140), 0x80800) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x14, 0x15, 0x301, 0x0, 0x1000000, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x1000c001}, 0x4000000) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'team0\x00', 0x200}) socket$igmp6(0xa, 0x3, 0x2) r7 = socket$kcm(0x2, 0xa, 0x2) r8 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e7cc6120c4108a81ad7d0102030109021b00010000c0050904230001030000000905"], 0x0) syz_usb_control_io(r8, &(0x7f0000000200)={0x2c, &(0x7f0000000040)={0x40, 0x1, 0x71, {0x71, 0xe, "a6051ad2a4550939501673c990a01beb9a3f6da5c8d3034bfe28af7b4fe6709daddb3cae5c809fd0556b1a143478c95bfa319881fb08ab35cf7cba3c728b58d86e2df9b04abd01050a15f4fe7c25d9d122b7864824c23a349b3423bfbc73b9809f971833af1c0a5281ee6b7cd83aac"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x416}}, &(0x7f0000000140)={0x0, 0xf, 0xf, {0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0xfc, 0x9, 0x5}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0x9, 0x8, 0x0, 0x4, "f0163d18", "5550b62f"}}, 0x0}, &(0x7f00000006c0)={0x84, &(0x7f0000000240)={0x0, 0x13, 0xa5, "22a855198e1f9e8f7f28b587692aff7f985dac765205aaf0ba511d2e5d8bc7df122716e0530444003e4319e90203f572ad7ef15b51730269f07a93be6254c4991a002dec991668b730d3682e4a79b1ebc14ccfdf0783434cdd5117a88b43f4d0dcc127ed9a75370689940fc02b3784b2e19d163459bb8d9f8a6a9615215703bb12997902067b7c01a4df54bbd6ad1d08214321362421f8e748408f8fc160fe89e0c39c6bf9"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0xe}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000380)={0x20, 0x0, 0x4, {0x2}}, &(0x7f00000003c0)={0x20, 0x0, 0x4, {0xe0}}, &(0x7f0000000400)={0x40, 0x7, 0x2, 0x2}, &(0x7f0000000440)={0x40, 0x9, 0x1, 0x1}, &(0x7f0000000480)={0x40, 0xb, 0x2, "e8cb"}, &(0x7f00000004c0)={0x40, 0xf, 0x2, 0x8}, &(0x7f0000000500)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, &(0x7f0000000540)={0x40, 0x17, 0x6}, &(0x7f0000000580)={0x40, 0x19, 0x2, "a23a"}, &(0x7f00000005c0)={0x40, 0x1a, 0x2, 0x1}, &(0x7f0000000600)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000640)={0x40, 0x1e, 0x1, 0x6}, &(0x7f0000000680)={0x40, 0x21, 0x1, 0x1}}) syz_usb_control_io$hid(r8, &(0x7f00000008c0)={0x24, &(0x7f0000000780)={0x40, 0xb, 0x2, {0x2, 0x9}}, &(0x7f0000000800)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x40c}}, &(0x7f0000000840)={0x0, 0x22, 0x6, {[@global=@item_4={0x3, 0x1, 0xa, "5210c535"}, @local=@item_012={0x0, 0x2, 0x2}]}}, &(0x7f0000000880)={0x0, 0x21, 0x9, {0x9, 0x21, 0x6, 0xd, 0x1, {0x22, 0x60d}}}}, &(0x7f0000000ac0)={0x2c, &(0x7f0000000900)={0x40, 0x0, 0x1d, "38114e57e8e2380b46ca7cdbd37cd8961aa2d6211cbe9fa45ed02f816f"}, &(0x7f0000000940)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000980)={0x0, 0x8, 0x1, 0x3}, &(0x7f00000009c0)={0x20, 0x1, 0xb5, "e5629a2a1a67d09378760af549fcb6cfd5abeb87f6b07801e77712bd77e7f53395c6fabd9e6b1a6d2ab70bb8980cfe22debb32c95a17747a1c2ca89fe17bf5cedb9c102cd96d16425279b9693bdd89d6d6367f546d51524311d1dcfc8655f44403561c96fc1055dd76741943190833ec13d05e33107c233af6d98d921a37cefcde24fe226292347a78fdb420599f1c698375bd28d671ce1b14bd32fe1f7d29ac6c189fe5f26f2cea07b74ea53ad2d5232fa0840a09"}, &(0x7f0000000a80)={0x20, 0x3, 0x1, 0x81}}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000340)={'wg2\x00'}) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r6, &(0x7f0000000200)={@void, @void, @eth={@empty, @random="0300", @val, {@mpls_mc={0x8848, {[], @llc={@snap={0xab, 0x1ff, "f8", "d44534", 0x802}}}}}}}, 0x1e) sendmsg$can_j1939(r4, &(0x7f00000001c0)={&(0x7f0000000040), 0x18, &(0x7f0000000180)={&(0x7f00000000c0)="92", 0x1a000}}, 0xee) r9 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) write$apparmor_exec(r9, &(0x7f0000000b00)={'stack ', ':\x00\b\xc4\x99\x10\tI\xc22b\xe8\r\xfa\xc1\xd6-\xe5\xd3-\xce\xeapE\xb5\x83W\xd0\xe5K\x9e\xa5\x8a\xbe\xd0\x14%\xee\\\x92dsO\bP\xdd\xcb\xc2\xc2\xc9\x95\xa7A\xb1\x11\xa7\x10\x1f\x9a(\xc3zk\xf6\x94\xd5.\x9fk\xfcf!U\x8eS(4xP\x9d\xee{{\xd1\x9f\xbc\x1dKI\xe3\xfad\xf8A\a\xeab\xd1\xbf\xf0\xb8\xa6\x01[)0\xb6\x03\x03-Co\xfej~\x14#cc\x1e\x1c\x7f\x8a\xfcq\x05\xea\xd2\x81\xdd\xcb\xac-;\xac\tw\xa4\x94\x11Y\x1c\xa1\x87\xb6\x1d\xcd\x04\xfc\xcc\x96\x82\xde\xa1kA\x87K\x13\xab\xbc\xa0sC\x98\xf8>qxQ$\xfb\x80a\xc6\xfb\x95l\x82\x01\xbe\xbfj9*\xcf'}, 0xc0) 8.173948368s ago: executing program 4 (id=2723): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x5}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}}, 0x2000c004) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) 7.839525046s ago: executing program 3 (id=2724): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x107142, 0x0) socket$alg(0x26, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket(0xa, 0x5, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x5}}, 0x1c) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$AUTOFS_IOC_EXPIRE(r1, 0x810c9365, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x93}, 0xe) sendto$inet6(r5, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r5, 0x1) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f00000013c0)={0x3, 0x2, 0x2, {0x5, @vbi={0xb5, 0x0, 0x3, 0x20363159, [0x0, 0x8000000], [0x8200, 0x1]}}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000001300050002000000000000000700000036b5db5c747b69fb1e5393f77408203bdd0a973d2281cee8050745983da141088fe91ff72528d9997bddede201f02fcea82f83fcb4d17663167187a2190239604f62550aafd9626b714bbc1dd845ed1fb5898e9b8a64f44d0000", @ANYBLOB="0040020000000000"], 0x20}}, 0x0) ioctl$VIDIOC_QBUF(r0, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x0, 0x10, 0x0, {}, {0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, "001500"}, 0x0, 0x2, {}, 0x58603}) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) 7.710595378s ago: executing program 0 (id=2725): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp256-generic\x00'}, 0x58) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xd, 0x400009, 0x8, 0xa}, 0x0) syz_open_dev$media(0x0, 0x0, 0x101d01) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_netfilter(r4, 0x0, 0x0) r5 = accept4$alg(r1, 0x0, 0x0, 0x0) sendmmsg$sock(r5, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000000340)="8224aca5f41b9e0ec5e7a706c919e7c0e343f0cd0a779c17e7f992396b09252009d2d12e9475a57ec39f71417044cf4151af34ac1dfd5d87cdd80bc4c24478821f64d4d971bbc1fc7bdd181a839344917165bb9cd0fa568aac55d8e38ee30fd3a9bc63e2656b6941c812e6ea0692ec276deb2b7b817906cf8c5429a42164e8bb521e216e554d509a0fd0d86729b5f4b9a01fb336bef1be8a68a628452b83a7404087d4bcb64f6ecad05459d12595d5b8b2657f2f29656a15e5a18e3168946dcb5faa59f7b404bad393ba06734d170b0513aeb0d051", 0xd5}, {&(0x7f00000004c0)="62c99e05d98775ed1beb5d67431ead896f7060f03e5b8671b283168d0df1573bef271f3a22b9cac06e27c7e87b34a19188d3e10e670bc070f0d3eb88d2f891d242747e0deec4a10609b12d4058b0fbff28bb01e6e49b533b03b11288ff4da1ab3226a2e3ba5fc47969142f1a1a0ca9ba4cece2ac9a5fcd89343de7e57dfcbb6216499555bd04f2fcb91c3c6c72868a3797ec63f8138ab74b5034878812df8b0445704cb33f81bffed93c3e645a206db134f626a59f4fac53fbf23489cf2f45d05d735e64033376671da045df97bcb989bda1d17ba14afbfd19e32a8222ebf934c17fed237b86aef2e830", 0xea}, {&(0x7f00000005c0)="f2b314c96d500b66f7fd46493862d9eb11d188464208592330ac482436286448", 0x20000}], 0x3}}], 0x1, 0x0) 6.495890971s ago: executing program 4 (id=2729): openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) socket$inet6(0xa, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket$pptp(0x18, 0x1, 0x2) connect$pptp(r2, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x10001, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r3 = io_uring_setup(0x1fc4, &(0x7f0000000bc0)={0x0, 0x0, 0x12, 0x0, 0x320}) r4 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) r5 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000001c0), 0x2) r6 = memfd_create(&(0x7f0000000940)='y\x105\xfb\xf7u\x83%\b\x00\x00\x00\x00\x00\x00\x00\xea_\xccZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x10\x00\x00\x00\x04\x879\xa24\xa9a\b\x00\xb2\xd3\xcbZJ\x7fa\xc4\x1acB\xaa\xc1\xfb Q\x96\xd9xJ2\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea\b\x00\x00\x00\x00\x00\x00\x00\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9V\x01A\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\a\x00\x01vRk\xaabB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\x80\x81\xa0\xa2-g\b\x99\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecn\x02\xc8\xc4\f\x04\x99\xf6\xfc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8L\xae\x1ff\xcf\xb3\xb65\x12\x89\x02\x82t\x0f\xb0\xe89\x16\fO\x19\x91\xfd\x10\x0e\xa7r\x12\xab\xd4\xd1d\xad\f\x11\xb3\xb3c\xe2\xfe\xcd\x9f7\xa1\x14\xfa\xe2\xdf\x7f\xf4NG\xe3\xeb\x18\xde|\xb3\xf5S\x9a\x04\xb4Lry\xa9\xd6\xfb\xbc\n+N\xf7\xf6\x87\x95\xd9+\xd2sc/\x06\xaa#K3,k\xf3(\xcc\xc7\xb47\xfa\xc3\x1c\x91!\xd3\xd2`-\xa2xrR\x1c\x81i\x87u|29Q\xdf\xed\x10\x9b\x930\xa8v\xa0\x88\xa4t\x17\xb2\xca9\x02\x03\xc9P\xcc\xe0\xb7\x9c\x82\xb4\x03\x83e\xee\x95\xccO\x1b\x83\f\n{\xf3\x12\x90\xcf\x10\xb5>\b3\x80\x8d\xb2%7\x10\xeee\xe4\xc3\xb2^\xad\xb6~\xa2\xbdE\xbf\x91\vqt\x81\xbd\x19\xde\x81\tw\xd4p\xd1\x8aNJ\xb3M\a\xc4\xfa\xb0,$\x81j\xb4Hs\x93>\x16U\xd0t\xe4\xca0T\xb7\xf7\x9d4\b\xd9\xdeps\xec\xa0\nJ\xa5\xfe\xda{(\xee\xb5\x11?\xc3I-\x8bc\xc9\xfb\a\xe5\xab\xf8v1\xdc\xc5\x8c\xebs1\x81\xca\x81l\xa12\xff<\xf5\x12\xcc+\xd4\xab\x84\x16\xa4+\x0e\xd4\x02\xe3\xaa1\xeam\x8ce\xb4r\x0eo&3wff\xe6\x91\x7f\xba\xad\x05\xdd\xc0+\"\xa5\x80\'#\xfd\x9dA&\xee \x18\xe5\x17\x1bd\xd0\xb9\x90\xde\xec\xe4M\xe5\x06\x03r\fc\x8c\x10\x99x\xec`e`\xc3F\xdf\xbc\xa8\xff\x05\xe6\xea\xc3u\xd7\t\x88<\"\xf7!\xd6\x0e\xbbE^\xcd\xb0\x15g\xe6\xf2?y1\x9f\xd3\x95\xc4E\xd0\xb4\x16`r\x14\xad\x02\x17\x9a\x86I]\x02f\xd3\xc9\xe1H\xd7c\xcaQ\x8cE7\xcc\xcf=\xf3\xf7\xb9\xf6s\x88\bZi\b*w\xc5;\x88\r\xab\xa1\t\xf1\x02)5\x00\x84', 0xb) ftruncate(r6, 0xffff) fcntl$addseals(r6, 0x409, 0x7) r7 = ioctl$UDMABUF_CREATE(r5, 0x40187542, &(0x7f00000002c0)={r6, 0x0, 0x0, 0x8000}) r8 = fcntl$dupfd(r7, 0x0, r7) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000180)={0x0, 0x0, r8}) r9 = epoll_create1(0x0) r10 = socket$unix(0x1, 0x1, 0x0) close(r10) socket(0x1d, 0x2, 0x6) setsockopt$sock_int(r10, 0x1, 0x2e, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r10, &(0x7f0000000080)={0xa002a008}) close_range(r3, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xffff7000) 5.884906397s ago: executing program 0 (id=2731): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000001c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r2, 0xc02064b9, &(0x7f0000000580)={&(0x7f0000000280)=[0x0, 0x0], &(0x7f0000000300), 0x2, r4}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000380)={0x201, 0x1, &(0x7f0000000240)=[r1], &(0x7f0000000040)=[0x2], &(0x7f0000000200)=[r6, r5, r5], &(0x7f0000000340)}) 5.733328716s ago: executing program 1 (id=2732): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001200576d100000000000000007000000", @ANYRES32=0x0, @ANYBLOB], 0x3c}}, 0x0) 5.657202272s ago: executing program 0 (id=2733): r0 = socket(0x1e, 0x805, 0x0) connect$tipc(r0, &(0x7f0000000040)=@id={0x1e, 0x3, 0x0, {0x4e20}}, 0x10) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1}, 0x4}}, 0x10) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000dae11c105e0484028fa4010203010902240001000000000904000002437d67000905fc"], 0x0) getresuid(0x0, &(0x7f0000000300), 0x0) quotactl$Q_SETINFO(0xffffffff80000601, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x3, 0xf) r3 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x109301) ioctl$USBDEVFS_CLEAR_HALT(r3, 0x80045515, &(0x7f0000000000)={0x1, 0x1}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB="00000000a1effd788100000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000bc2c00000077010000df000000000000001f0000004000000100"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x8, 0x9, &(0x7f0000000080)=ANY=[@ANYBLOB="18060000000000000000000000000000181200", @ANYRES32=r4, @ANYBLOB="0000000000000000b7030000000000008500000005000000b70000000000000085000000c1000000"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="130100002add1e20ef050a023691010203010902240001000000000904"], 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x28042, 0x102) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000440)='\x00'/16, 0x10) r5 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000680)={0x2c, 0x12, 0x1, 0x0, 0x0, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0x0, 0x0, 0x0, @u64}]}, @typed={0xc, 0x36, 0x0, 0x0, @u64}]}, 0x2c}], 0x1}, 0x0) sendmmsg$sock(r5, &(0x7f0000004a00)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000001c0)="7b1cec8460b833cc5e0c96564a40a17e8f68d6ce2974cbd35968831b4ef72e771eb347f6f12fbd98c0f42a21321dfbcc0d1e75d6e09af7e4e13cdf18cd3f570a38c4b1a7e74ce7c1b95bb257b5b1de68953d5400349477f9c0dde67497", 0x5d}], 0x1}}, {{0x0, 0x0, &(0x7f00000031c0)=[{&(0x7f0000002dc0)="def2", 0x2}], 0x1}}], 0x2, 0x4000000) 5.145134146s ago: executing program 3 (id=2735): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000180)={'bond0\x00', &(0x7f0000000040)=@ethtool_pauseparam={0x1}}) r2 = open_tree(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x1500) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f0000000200)={0xffff1000, 0xc000}) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) sendmsg$ETHTOOL_MSG_WOL_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a00)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000fddbdf251b000000200001801400020064766d72703000000000000000000000080001"], 0x34}}, 0x20040010) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@ipv4_newaddr={0x28, 0x14, 0x509, 0x80000, 0x25dfdbfd, {0x2, 0x0, 0x0, 0xfe, r5}, [@IFA_LOCAL={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x15}}, @IFA_RT_PRIORITY={0x8, 0x9, 0x6}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) getsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f00000003c0)={@private0, 0x0}, &(0x7f0000000400)=0x14) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) r11 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000001c0)={'vcan0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r12, {0x0, 0xf}, {0xffff, 0xffff}, {0x4, 0xfff3}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_ECN={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r1, &(0x7f0000000500)={&(0x7f0000000300), 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x4c, r3, 0x804, 0x70bd25, 0x25dfdbfe, {}, [@HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x60008880}, 0x20004080) r13 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)={@cgroup, 0xffffffffffffffff, 0x24, 0x0, 0x0, @void, @value=0x0}, 0x20) r14 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$HIDIOCGUSAGE(r2, 0xc018480b, &(0x7f00000002c0)={0x1, 0x3, 0x400, 0x7, 0x2, 0xf85f}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r13, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)={0x1c, r14, 0x331, 0x70bd2c, 0x0, {0x8}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x14) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r14, 0x101, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x810) 4.957584273s ago: executing program 1 (id=2736): io_uring_setup(0x74f8, &(0x7f00000005c0)) (async) r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f010400000009058303"], 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000080)=0xb309) (async) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000080)=ANY=[]) (async) openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) (async) setxattr$trusted_overlay_upper(&(0x7f0000000380)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 64) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0xfffffffffffffffe}, 0x0) (async, rerun: 64) syz_open_dev$loop(&(0x7f0000000100), 0x7, 0x240) (async, rerun: 64) r3 = io_uring_setup(0x1581, &(0x7f0000000380)={0x0, 0x1b6f, 0x40, 0x0, 0x3bd}) (rerun: 64) r4 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r4, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r4, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r5) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x18, r6, 0x3e8c4ddb697c9f8f, 0x2, 0x0, {0x4}, [@HEADER={0x4}]}, 0x18}}, 0x2000c090) close_range(r3, r4, 0x0) (async, rerun: 64) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) (async, rerun: 64) mmap$IORING_OFF_SQ_RING(&(0x7f0000ac1000/0x3000)=nil, 0x3000, 0x2000000, 0x5d031, 0xffffffffffffffff, 0x0) (async, rerun: 64) r7 = syz_open_dev$dri(0x0, 0x0, 0x0) (rerun: 64) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r7, 0x100000000) socket(0x10, 0x3, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1a00000001000000080000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000020000cc6cf095c80000000000f5192a0007fe6597fec6d4954700000000000000"], 0x50) (async) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000140)={@cgroup, 0xffffffffffffffff, 0x5, 0x2020, 0x0, @void, @void, @value}, 0x20) (async, rerun: 64) r8 = socket$inet(0x2, 0x80001, 0x84) (rerun: 64) connect$inet(r8, &(0x7f0000000040)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10) 4.624915952s ago: executing program 3 (id=2737): r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x42001, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x8000, 0x0) pwrite64(r0, &(0x7f0000000600)="16c722582f913446279abc27a755e1ebec599ccd1a6145d70aa5bcb17fc160c85f9490b46d1661cf52a8033cfcc5c29fb5ca3b088a08b2813d867894e3a23f429277536b4d4473e5c0f6e925b953d50dd9ce3097f19db1d116f85d8638420fbf6eb7e55f300d1f920ce1405ba559f2814941810471296578de5b0765d4d75d5e5016078efc90831d0bc1088f39bcdf66ebf25632a2e038511fe25c3a4a81dc46948d13cd3f271f", 0xa7, 0x4) (async) ioctl$TCSBRKP(r1, 0x5425, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) (async) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) read$alg(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYRES64=r0, @ANYRES32=r6, @ANYBLOB="5a2a8e5abcbc30f1da3e29411b619e05"], 0x20}}, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e00010000000876f92a6def0fb650b9b51c0dda7aa6489e21699626c627746aaa3c9dc0a3de747dc1fa1874ba5450fb694c8475e5cf5365916dd05e51cec92b9f07000000000000000083aa22f7cccde5f1d989f06724ee6062ded03e95378e21a00ab309f45d214197246b725c42553c0e5574d284463bd7b760f0b32694532e66471f0cd5a82f220a3bd8c25cd6588860467f560b20b0688039233c6360045da09d0e73cd67"], 0x24}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) (async) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100}) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) (async) dup3(r8, r2, 0x0) (async) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r9, 0x0) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000003, 0x12, r10, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r10, 0x4018620d, &(0x7f00000001c0)={0x73622a85, 0x100, 0xfffffffffffffffe}) (async) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x2000000, &(0x7f00000004c0)="e0"}) (async) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000400)=[@acquire={0x40046305, 0x3}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @enter_looper, @enter_looper, @request_death={0x400c630e, 0x2}], 0x6, 0x0, 0x0}) 4.083371221s ago: executing program 3 (id=2738): seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x60}, {0x16}]}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='cpuacct.usage_user\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x22002, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x40900) move_mount(r6, &(0x7f0000000300)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000001c0)={'team_slave_0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x44, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="788500000000000000a904000000000000000000", @ANYRESDEC=r7, @ANYRESDEC=r1, @ANYRES32=0x0, @ANYBLOB="060011004e210000080014000400000005001700010000000800140008000000080004000b0000000800010049711ec14080e541e5912330b909f4e0dc", @ANYRES32=r7, @ANYBLOB], 0x78}, 0x1, 0x0, 0x0, 0x8011}, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd607428dd0028fffffe8000000000000000000000000000bbff0200000000000000000000000000018900907800000000ff02000d0000000000000100000000010002122b472e417b93f144f6dffe1de5415f806154a3167b0286ffd14193eb05d912e7d4c49f8a7bc53584944f6ab1c87f7263223010dd4e9d26e2f99dbffe577d58dc99e91d4bb0c3792b8a55768f44bec968ef5c86fae2213e0d219a48748b785d229ac32b38cddb5a4f98c34cd21498d854bdc955d7d46c3544d7ae2e5546441a485af48f0ab90c65b7d18893b485e94bf54ad5ae087a8857168e75ba645ac15208b027ed3b79210f"], 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f0000000100)) ioctl$PPPIOCSACTIVE(r2, 0x40107446, &(0x7f00000000c0)={0x2, &(0x7f0000000080)=[{0x1, 0x8, 0x2, 0x5}, {0x9, 0x81, 0xc2, 0x3}]}) r8 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r8, 0x83, 0x12, &(0x7f0000000200)=@conn_svc_rsp={0x0, 0x0, 0xa, "f7244011", {0x3, 0x107, 0x0, 0x3, 0x803, 0x3, 0x8d}}) syz_usb_ep_write$ath9k_ep1(r8, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e15"]) 2.712965932s ago: executing program 1 (id=2739): r0 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newqdisc={0x58, 0x12, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0xfff2}, {0xb, 0x1}, {0x4}}, [@qdisc_kind_options=@q_taprio={{0x4f}, {0x28, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x9}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x3}]}, {0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0xd5}]}]}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x24008804}, 0x20000040) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="130100002add1e20ef050a023691010203010902240001000000000904000002ea1998000905a6a70000000000090507"], 0x0) 2.482276371s ago: executing program 4 (id=2740): openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/devices\x00', 0x0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000640)={0x6, &(0x7f0000000600)=[{0x2, 0x8, 0x98, 0x6}, {0x80, 0x6, 0x9, 0x6}, {0xc063, 0x2, 0x3, 0x724015f5}, {0x9, 0x5, 0x10, 0x5}, {0x27, 0xff, 0x4, 0x3}, {0x2, 0x6, 0x6, 0x811a}]}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x480, 0x2c, 0xd27, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r4, {0xc, 0x2}, {}, {0x7}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x448, 0x2, [@TCA_CGROUP_POLICE={0x444, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0x6, 0xffffffffffffffff, 0xc, 0x3, 0x80000, {0x6, 0x1, 0x2, 0x0, 0x5, 0x5f}, {0x7, 0x1, 0x33db, 0x8, 0x7fff}, 0x3, 0x3da, 0x6}}, @TCA_POLICE_RATE={0x404, 0x2, [0x9, 0xfffffff8, 0x0, 0x0, 0x3, 0x9, 0x8, 0x9, 0x401, 0x7, 0x1, 0x2, 0x7, 0x7fffffff, 0x4000, 0x4, 0xfffff801, 0x7, 0x80000000, 0x8000, 0x80000001, 0x5, 0x2, 0xe2b9, 0x2, 0x11d, 0x10001, 0x0, 0x9, 0x9, 0x2, 0x5, 0x1, 0x6b, 0x4, 0x9, 0x1, 0x2, 0x3, 0x9, 0xa6, 0x8, 0x625, 0x5f00, 0x3, 0x7, 0x2310, 0x80000000, 0x1, 0x1, 0x1ff, 0xc, 0x0, 0xffffff98, 0x2122c0, 0x3, 0x7fffffff, 0x6, 0x8, 0x2, 0x3e946db0, 0x8001, 0x7ff, 0x4, 0x4982d9f5, 0xc27, 0x8a, 0x9, 0x5, 0x5, 0xff, 0xe365, 0x4, 0xf104, 0x4cd, 0xff, 0x3, 0x5, 0x9, 0x7, 0xfd, 0x401, 0x6, 0x7fff, 0x1, 0x1, 0xfffffffc, 0x9, 0x7ff, 0x27c, 0xed5c, 0xffffffff, 0x4, 0x1000, 0x1, 0x52d, 0x7, 0x7, 0x0, 0x4, 0x1, 0xffff0001, 0x800, 0x7, 0x3, 0x6, 0x1, 0x7, 0x4, 0x6, 0xffffffff, 0x207, 0xe, 0x9, 0x2, 0x3, 0x40, 0x1000, 0xc3, 0x2, 0x8, 0x9, 0x7, 0x8, 0x2, 0x7, 0x3, 0x7fffffff, 0xae, 0x7, 0x9, 0x8, 0x401, 0x2, 0x40, 0x0, 0xfff, 0x3, 0xb, 0x2, 0x9, 0xf8000000, 0xc, 0x1, 0x7, 0x0, 0x8, 0x6, 0xc, 0x1, 0x0, 0x5, 0x2, 0x0, 0x19, 0x7, 0x80000000, 0x9, 0x6, 0x5, 0x3, 0xfffffff7, 0x5, 0x3000000, 0x9e3a, 0x401, 0x0, 0x2, 0x0, 0x7, 0x1fc2, 0xe, 0x0, 0xdf, 0xffffffff, 0x1ff, 0x6ba7b42c, 0x4, 0x0, 0x57fb3de3, 0x6e88, 0xfffffe00, 0x8, 0x1ff, 0x0, 0x30001, 0x7, 0x100, 0x0, 0x9, 0x9, 0xb, 0x1, 0x4, 0x1c0, 0x7, 0x1, 0x1000, 0xea7, 0x5, 0xe7c, 0x6, 0x2000, 0x1000, 0x6, 0x3, 0x10000, 0x2, 0x81, 0x2, 0x1, 0x8, 0x101, 0x6, 0x3c83, 0xa2c, 0x9, 0x49f, 0x200, 0x56, 0x7f, 0x200, 0x9736, 0x401, 0x62, 0xb, 0x7fff, 0x6, 0x3, 0x100, 0xffffff48, 0x1, 0x4, 0x0, 0x7, 0xa, 0x0, 0x8, 0x65b6ceae, 0xfffffffa, 0x6, 0x1, 0x2, 0x583, 0x7, 0x400, 0x80000001, 0x49c, 0x10000, 0x3, 0x8, 0xfffffff3, 0x8, 0x6, 0x7, 0x7]}]}]}}, @TCA_RATE={0x6, 0x5, {0x81, 0x6}}]}, 0x480}, 0x1, 0x0, 0x0, 0x4000080}, 0x40) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[], 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000340)='mountinfo\x00') r6 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141121) r7 = dup(r6) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x82841, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8000, 0x0, 0x800003, 0xffffffffffffffff, 0x2000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0xfffffffffffffffe, 0x4, 0x400000000, 0xb, 0x7fffffff, 0x4}, 0x0, 0x0) sendmsg$IPSET_CMD_TYPE(r5, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0xd, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x4000061}, 0x5) r8 = syz_genetlink_get_family_id$smc(&(0x7f0000000400), r2) sendmsg$SMC_PNETID_GET(r7, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10038}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x48, r8, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'virt_wifi0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x1050}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a3000000000440000001a0a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000000208000840000000013c0000000e0a01020000000000000000010000000900020073797a3200000000100003802f00008008000180040002800900010073797a300000"], 0xc8}}, 0x0) r10 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r10, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) 1.824514553s ago: executing program 2 (id=2741): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x82682, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000400000004"]) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000180)={0x4, 0x2007}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x2000008) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) 1.579105982s ago: executing program 2 (id=2742): r0 = socket$netlink(0x10, 0x3, 0x10) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000040), &(0x7f0000000080)=0x8) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$IPSET_CMD_SWAP(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x14, 0x6, 0x6, 0x5, 0x0, 0x0, {0x5, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x4000810}, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r0) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0xff05, 0x0, 0x700, {0x0, 0x0, 0x4a00, 0x0, 0x157f}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x40}}, 0x20000840) 1.454561735s ago: executing program 2 (id=2743): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)) r4 = socket(0x10, 0x3, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/key-users\x00', 0x0, 0x0) r6 = openat$sysfs(0xffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x1c9a82, 0x0) sendfile(r6, r5, 0x0, 0xbc44) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="7fff0000000000002800128009000100766c616e000000001800028006000100340200000c0002001f0000001e00000008000500", @ANYRES32=r3], 0x50}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) socket(0x22, 0xa, 0x6) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001880)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000060001000004000008000500"], 0x50}}, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r9, {}, {0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) 1.381319277s ago: executing program 2 (id=2744): socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) epoll_create1(0x80000) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_usbip_server_init(0x4) syz_usbip_server_init(0x1) syz_usbip_server_init(0x0) syz_usbip_server_init(0x2) syz_usbip_server_init(0x2) syz_usbip_server_init(0x0) syz_usbip_server_init(0x5) syz_usbip_server_init(0x0) syz_usbip_server_init(0x3) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KDGETKEYCODE(r0, 0x4b4c, &(0x7f00000000c0)={0x0, 0x5}) r1 = syz_io_uring_setup(0x42e6, &(0x7f00000002c0)={0x0, 0x5eda, 0x10100, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpu.stat\x00', 0x275a, 0x0) syz_usbip_server_init(0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x60, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x61, 0x1, {0x1}}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)) write$UHID_CREATE2(r4, &(0x7f00000001c0)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r4, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_POLL_REMOVE={0x7, 0x49, 0x0, 0x0, 0x0, 0x12345, 0x0, 0x0, 0x1}) io_uring_enter(r1, 0x7330, 0x0, 0x0, 0x0, 0x0) 982.444436ms ago: executing program 1 (id=2745): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000200)={'lo\x00', {0x2, 0x4e23, @broadcast}}) (fail_nth: 5) 652.584567ms ago: executing program 1 (id=2746): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001200576d100000000000000007000000", @ANYRES32=0x0, @ANYBLOB], 0x3c}}, 0x0) 602.422783ms ago: executing program 0 (id=2747): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, [@IFLA_NET_NS_FD={0x8}]}, 0x28}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@setlink={0x28, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, [@IFLA_NET_NS_FD={0x8}]}, 0x28}}, 0x0) landlock_create_ruleset(&(0x7f0000000440)={0x6621}, 0x18, 0x0) (async) landlock_create_ruleset(&(0x7f0000000440)={0x6621}, 0x18, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) (async) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$nl_route(0x10, 0x3, 0x0) fchdir(r2) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x34, r4, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r4, 0x400, 0x70bd29, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x20040000) 474.69506ms ago: executing program 0 (id=2748): capset(0x0, &(0x7f0000000080)={0x4, 0x10ffff, 0xfffffffd}) r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0x0, 0x1, 0x4, 0x0, 0x3000000, {}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, "a730b801"}, 0x0, 0x1, {0x0}}) symlinkat(0x0, 0xffffffffffffffff, &(0x7f0000000000)='./file0\x00') setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e2b, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7ff}, 0x1c) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r1 = getpid() syz_pidfd_open(r1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0xfffffffffffffc5d, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5b5d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0x2d, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}]}, @IFLA_ALT_IFNAME={0x14, 0x35, 'wg1\x00'}]}, 0x50}}, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000140)=ANY=[], 0x20) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002940)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}}], 0x800008d, 0x0) 473.992264ms ago: executing program 2 (id=2749): capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, {0x0, 0xa00, 0x40800000000000, 0x800000000000002}, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002280)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) read$FUSE(r1, &(0x7f0000006340)={0x2020, 0x0, 0x0}, 0x2058) write$FUSE_LSEEK(r1, &(0x7f00000021c0)={0x18, 0x0, r2, {0x7}}, 0x18) utimensat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r3 = signalfd(r0, &(0x7f0000000100)={[0x1]}, 0x8) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000980)={0x6}, 0x10) syz_open_dev$dri(&(0x7f00000000c0), 0x7, 0x4000) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)={0x1c, 0x52, 0x1, 0x70bd04, 0x25dfdbfc, {0xa}, [@typed={0x8, 0x1, 0x0, 0x0, @ipv4=@private=0xfeffffff}]}, 0x1c}}, 0x800) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r4, 0x29, 0x41, &(0x7f0000000040)={'filter\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) 447.453794ms ago: executing program 1 (id=2750): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000080)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010102, @local}, {{0x4001, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0xa, 0x0, 0x1, 0x0, 0x0, {[@md5sig={0x13, 0x12, "473ecfd2106a00"}]}}}}}}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$netlink(0x10, 0x3, 0xe) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x3b, 0x2, [{0xfe}, {0xfffffff9}]}}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x4, 0x0, &(0x7f0000000040)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x203, @void, @value}, 0x94) r6 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r6, 0xc4c85512, &(0x7f0000000280)={{0x6, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffefffffffff, 0x0, 0x3, 0x0, 0x0, 0x4, 0x0, 0x0, 0xffffffffbfffffff, 0x0, 0x0, 0x0, 0x3, 0x80000000, 0x3, 0x0, 0x0, 0x4, 0x0, 0x6, 0x0, 0x40, 0x0, 0xfffffffffffffffd, 0x100200000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x9, 0x0, 0x10000, 0x1000, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7, 0x10000, 0x7785, 0x0, 0x4, 0x4, 0x8, 0x0, 0xfffffffffffffffe, 0x0, 0x8, 0x0, 0x0, 0x80000000000, 0x0, 0x4, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000000, 0x0, 0x80000000000000, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x100, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3, 0x2, 0x0, 0x0, 0xc0c0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0xffffffffffeffffc, 0x0, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x80]}) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x2, 0x2ff7afedf}, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f00000008c0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1000}}, {@max_read={'max_read', 0x3d, 0x3}}, {@blksize={'blksize', 0x3d, 0x1000}}, {@max_read={'max_read', 0x3d, 0x3}}, {@blksize={'blksize', 0x3d, 0x1400}}, {@blksize}]}}) read$FUSE(0xffffffffffffffff, &(0x7f0000006380)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) r8 = socket(0x10, 0x2, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x4048aec9, &(0x7f0000000080)={[{0x80000000, 0x0, 0x0, 0x3, 0x0, 0x10, 0x6, 0x0, 0x2, 0x0, 0xa, 0x0, 0x4}, {0xa, 0x0, 0x0, 0x0, 0x40, 0x1, 0x8, 0xff, 0x7, 0x0, 0x4, 0x0, 0xfffffffffffffff7}, {0x200000, 0xc, 0x21, 0x53, 0x0, 0x2, 0x0, 0x0, 0x58, 0xb, 0x0, 0x0, 0x8080}], 0x3fb}) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000780)=ANY=[@ANYBLOB="2ea8d2811b2a246ba8a8a78787aee7bb20c96807b6d8761f859ec6fa331e777591ed11248a94c0cfc19c61fe7c081ddaf685d4d5b414a01ac8d511cfb5d75e8878514da879142e585b1f9213b0f04d67baae20dd2e742f1286afc7a9bb0ad44aa05e2e3db382651792f2945409e7c6dda83d14fef1fb50a3cb8d0a189d28277f501a04c5d4414479db27bd23c1fbdf28124c317129fe42ebf9", @ANYRES8, @ANYRES64, @ANYRESOCT=r2, @ANYRES32, @ANYRES16=r7, @ANYRESDEC=r5], 0x30}, 0x1, 0x0, 0x0, 0xc885}, 0x4000880) 344.753255ms ago: executing program 2 (id=2751): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80040, 0x61) getpgid(0x0) epoll_create1(0x0) creat(0x0, 0x109) r0 = syz_open_dev$dri(0x0, 0x1f, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="280300002d00090027bd7000000000000400000013031780"], 0x328}}, 0x84) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) getrlimit(0xf, &(0x7f00000001c0)) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x458, 0x0, 0x2b8, 0xb0000010, 0x2, 0x5c8f0200, 0x388, 0x3a8, 0x3a8, 0x388, 0x3a8, 0x3, 0x0, {[{{@ipv6={@private1, @local, [], [], 'vlan1\x00', 'veth0_to_team\x00'}, 0x0, 0x248, 0x290, 0x700, {}, [@common=@inet=@hashlimit3={{0x158}, {'geneve1\x00', {0xf1, 0x0, 0x33, 0x0, 0x10000000, 0x1, 0x7fffffff}}}, @common=@unspec=@limit={{0x48}, {0x0, 0x3}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x206, 'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@CONNSECMARK={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b8) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x3, 0x101403) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(0xffffffffffffffff, 0x0, 0x20000000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x3, 0x7fff0000}]}) 342.813212ms ago: executing program 3 (id=2752): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f00000063c0)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000c40)="97b5ee06edbce480b6bdc020061952fd2661e171449c341cf2c2c9b0e932aaba977ec145d6fb273c392cc3e58c475aaf210dcba48c285608", 0x38}], 0x1, &(0x7f00000003c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x14}], 0x1, 0x800) recvmsg$can_raw(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000080)=""/30, 0x1e}, {&(0x7f00000009c0)=""/170, 0xaa}], 0x2}, 0x10081) 107.592535ms ago: executing program 0 (id=2753): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@assoc={0x18, 0x117, 0x4, 0x1fc}], 0x18}, 0x0) sendmsg$nl_route_sched_retired(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) recvmmsg(r1, &(0x7f0000000e40)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xa0}}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000fc0)=""/160, 0xa0}, {&(0x7f0000000240)=""/32, 0x20}, {&(0x7f0000000340)=""/88, 0x58}, {&(0x7f00000004c0)=""/230, 0xe6}], 0x4}}], 0x2, 0x0, 0x0) 0s ago: executing program 3 (id=2754): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000800), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffc, 0x3, 0x0, @buffer={0x2, 0x51, &(0x7f00000000c0)=""/81}, &(0x7f0000000380)="259374", 0x0, 0x0, 0x0, 0x0, 0x0}) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000005, 0xd39e0557a489443d, r2, 0x100000000) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x0, 0x5, 0xa, 0x201, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TYPE={0x0, 0x7, 'filter\x00'}, @NFTA_CHAIN_HANDLE={0x0, 0x2, 0x1, 0x0, 0x2}, @NFTA_CHAIN_NAME={0x0, 0x3, 'syz0\x00'}, @NFTA_CHAIN_COUNTERS={0x0, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0x0, 0x1, 0x1, 0x0, 0x8102}]}, @NFTA_CHAIN_NAME={0x0, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x0, 0x16, 0xa, 0x807, 0x0, 0x0, {0x0, 0x0, 0x4}, [@NFTA_FLOWTABLE_FLAGS, @NFTA_FLOWTABLE_HOOK={0x0, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x0, 0x3, 0x0, 0x1, [{0x0, 0x1, 'veth0\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x0, 0x2, 0x1, 0x0, 0x86f0}]}, @NFTA_FLOWTABLE_HANDLE={0x0, 0x5, 0x1, 0x0, 0x4}]}, @NFT_MSG_DELRULE={0x0, 0x8, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_RULE_HANDLE={0x0, 0x3, 0x1, 0x0, 0x1}, @NFTA_RULE_CHAIN_ID={0x0, 0xb, 0x1, 0x0, 0x1}, @NFTA_RULE_POSITION_ID={0x0, 0xa, 0x1, 0x0, 0x2}, @NFTA_RULE_POSITION_ID={0x0, 0xa, 0x1, 0x0, 0x2}, @NFTA_RULE_ID, @NFTA_RULE_HANDLE={0x0, 0x3, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x10}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="7b0200640000000061114c000000000085000000a40000009500000005007586285866cbd92f204f00000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x6, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x30) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000000)={0x1fd, 0x5, 0x6000, 0x2000, &(0x7f0000010000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000240)={[0x583a, 0x5, 0x6e, 0xe58, 0x8000000000000001, 0x2, 0x1040, 0x4, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0x3, 0x9, 0x5, 0xc14], 0x0, 0x1040d6}) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x4000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xc4, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x3, 0x800000000000002}, 0x0, 0x0, 0x0, 0x1, 0x0, 0x2}, [@mark={0xc, 0x15, {0x10001, 0x13}}]}, 0xc4}}, 0x0) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000880)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x60, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_EXPR={0x10, 0x11, 0x0, 0x1, @last={{0x9}, @void}}]}, @NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xf4}}, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) r12 = socket$nl_rdma(0x10, 0x3, 0x14) accept(r12, &(0x7f0000000300)=@pppol2tp, &(0x7f00000005c0)=0x80) kernel console output (not intermixed with test programs): invalid sa for name 0x0000000000000003 [ 752.254703][ T24] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 752.283929][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 752.321584][ T24] usb 4-1: Product: syz [ 752.347853][ T24] usb 4-1: Manufacturer: syz [ 752.373983][ T24] usb 4-1: SerialNumber: syz [ 752.414972][ T24] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 752.436098][ T44] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 752.480067][T14074] dlm: no locking on control device [ 752.637619][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 752.644351][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 752.870235][ T24] usb 4-1: USB disconnect, device number 121 [ 753.444049][T13121] usb 2-1: new full-speed USB device number 99 using dummy_hcd [ 753.493113][T14090] netlink: 'syz.3.2347': attribute type 1 has an invalid length. [ 753.502706][T14090] netlink: 'syz.3.2347': attribute type 2 has an invalid length. [ 753.518204][T14090] netlink: 'syz.3.2347': attribute type 1 has an invalid length. [ 753.538380][T14090] netlink: 1156 bytes leftover after parsing attributes in process `syz.3.2347'. [ 753.607231][T13121] usb 2-1: config 0 has an invalid interface number: 244 but max is 0 [ 753.610902][ T44] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 753.639831][T13121] usb 2-1: config 0 has no interface number 0 [ 753.648268][ T44] ath9k_htc: Failed to initialize the device [ 753.660446][ T24] usb 4-1: ath9k_htc: USB layer deinitialized [ 753.699563][T13121] usb 2-1: config 0 interface 244 has no altsetting 0 [ 753.902941][T13121] usb 2-1: New USB device found, idVendor=2100, idProduct=9e52, bcdDevice=87.62 [ 753.925778][T11551] usb 3-1: USB disconnect, device number 24 [ 753.940544][T13121] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 753.983608][T13121] usb 2-1: Product: syz [ 753.987839][T13121] usb 2-1: Manufacturer: syz [ 753.992459][T13121] usb 2-1: SerialNumber: syz [ 754.051973][T13121] usb 2-1: config 0 descriptor?? [ 754.115209][T13121] ftdi_sio 2-1:0.244: FTDI USB Serial Device converter detected [ 754.154872][T13121] ftdi_sio ttyUSB0: unknown device type: 0x8762 [ 754.410766][T13121] usb 2-1: USB disconnect, device number 99 [ 754.455458][T13121] ftdi_sio 2-1:0.244: device disconnected [ 754.643590][ T5907] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 754.687400][T14118] program syz.4.2353 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 754.796809][ T5907] usb 3-1: Using ep0 maxpacket: 16 [ 754.807971][ T5907] usb 3-1: config 0 has no interfaces? [ 754.826804][ T5907] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 754.838793][ T5907] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 754.911074][ T5907] usb 3-1: Product: syz [ 754.935579][ T5907] usb 3-1: Manufacturer: syz [ 754.952507][ T5907] usb 3-1: SerialNumber: syz [ 754.974477][ T5907] usb 3-1: config 0 descriptor?? [ 755.343679][ T5907] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 755.582215][ T5907] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 755.626918][ T5907] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 755.684660][ T5907] usb 2-1: Product: syz [ 755.688943][ T5907] usb 2-1: Manufacturer: syz [ 755.747897][ T5907] usb 2-1: SerialNumber: syz [ 755.797612][ T5907] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 755.816086][T13121] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 755.979302][T14138] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 756.096043][T14138] binder: 14134:14138 ioctl c0306201 200000000640 returned -22 [ 756.298018][ T5889] usb 2-1: USB disconnect, device number 100 [ 756.334199][ T5907] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 756.491522][ T5907] usb 1-1: config 0 has no interfaces? [ 756.507803][ T5907] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 756.527352][ T5907] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 756.550215][ T5907] usb 1-1: Product: syz [ 756.562103][ T5907] usb 1-1: Manufacturer: syz [ 756.570405][ T5907] usb 1-1: SerialNumber: syz [ 756.596182][ T5907] usb 1-1: config 0 descriptor?? [ 757.109200][T13121] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 757.232174][T14141] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 757.314111][T13121] ath9k_htc: Failed to initialize the device [ 757.335776][T11551] usb 3-1: USB disconnect, device number 25 [ 757.346986][ T5889] usb 2-1: ath9k_htc: USB layer deinitialized [ 758.339682][T14174] vxcan1: MTU too low for tipc bearer [ 758.345959][T14174] tipc: Enabling of bearer rejected, failed to enable media [ 758.854212][T13121] usb 5-1: new high-speed USB device number 127 using dummy_hcd [ 759.015133][ T5907] usb 1-1: USB disconnect, device number 19 [ 759.064579][T13121] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 759.083235][T13121] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 759.096066][T13121] usb 5-1: Product: syz [ 759.101692][T13121] usb 5-1: Manufacturer: syz [ 759.106524][T13121] usb 5-1: SerialNumber: syz [ 759.145898][T13121] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 759.170451][ T5889] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 759.621893][ T5907] usb 5-1: USB disconnect, device number 127 [ 760.234834][ T5889] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 760.264323][ T5889] ath9k_htc: Failed to initialize the device [ 760.281579][T14204] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2382'. [ 760.311821][ T5907] usb 5-1: ath9k_htc: USB layer deinitialized [ 760.757883][T14215] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2385'. [ 761.223545][ T44] usb 2-1: new full-speed USB device number 101 using dummy_hcd [ 761.526878][ T44] usb 2-1: config 1 has an invalid descriptor of length 207, skipping remainder of the config [ 761.537412][ T44] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 761.564390][ T44] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 761.582265][ T44] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 761.597491][ T44] usb 2-1: Product: syz [ 761.728319][ T44] usb 2-1: Manufacturer: syz [ 761.785704][T14224] vxcan1: MTU too low for tipc bearer [ 761.801593][T14224] tipc: Enabling of bearer rejected, failed to enable media [ 761.837647][ T44] usb 2-1: SerialNumber: syz [ 762.318256][T14229] dlm: no locking on control device [ 763.684172][ T5889] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 763.700243][ T44] usb 2-1: 0:2 : does not exist [ 763.817056][ T44] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 763.849219][ T5889] usb 4-1: config index 0 descriptor too short (expected 8192, got 77) [ 763.897133][ T44] usb 2-1: USB disconnect, device number 101 [ 763.903662][ T5889] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 763.984625][ T5914] udevd[5914]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 764.016572][ T5889] usb 4-1: config 0 has no interfaces? [ 764.088439][ T5889] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 764.104624][T11551] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 764.170836][ T5889] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.257329][ T5889] usb 4-1: Product: syz [ 764.265991][T11551] usb 5-1: config 0 has an invalid interface number: 64 but max is 0 [ 764.275782][T11551] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 764.304354][ T5889] usb 4-1: Manufacturer: syz [ 764.306556][T11551] usb 5-1: config 0 has no interface number 0 [ 764.311141][ T5889] usb 4-1: SerialNumber: syz [ 764.370292][T11551] usb 5-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice= 0.07 [ 764.383486][T11551] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.412778][T11551] usb 5-1: Product: syz [ 764.432293][T11551] usb 5-1: Manufacturer: syz [ 764.436383][ T5889] usb 4-1: config 0 descriptor?? [ 764.543552][T11551] usb 5-1: SerialNumber: syz [ 764.574560][T11551] usb 5-1: config 0 descriptor?? [ 764.826706][T11551] usb 5-1: USB disconnect, device number 2 [ 765.154066][ T5907] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 765.196409][T14247] vivid-002: disconnect [ 765.245610][T14247] macvlan2: entered allmulticast mode [ 765.251248][T14247] mac80211_hwsim hwsim8 wlan0: entered allmulticast mode [ 765.270450][T14247] mac80211_hwsim hwsim8 wlan0: left allmulticast mode [ 765.292305][T14248] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2393'. [ 765.306388][ T5907] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 765.306781][T14248] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2393'. [ 765.330082][T14248] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2393'. [ 765.339234][ T5907] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 765.399418][ T5907] usb 3-1: config 0 has no interface number 0 [ 765.415869][ T5907] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice= 0.07 [ 765.480237][ T5907] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 765.545283][ T5907] usb 3-1: Product: syz [ 765.566114][ T5907] usb 3-1: Manufacturer: syz [ 765.585856][ T5907] usb 3-1: SerialNumber: syz [ 765.627444][ T5907] usb 3-1: config 0 descriptor?? [ 766.311455][ T5889] usb 4-1: USB disconnect, device number 122 [ 766.741009][T14260] netlink: del zone limit has 4 unknown bytes [ 766.748059][T14246] vivid-002: reconnect [ 766.935831][T14266] netlink: 252 bytes leftover after parsing attributes in process `syz.1.2397'. [ 768.168391][ T5907] usb 3-1: USB disconnect, device number 26 [ 769.670913][T14286] dlm: no locking on control device [ 769.992288][T14296] syzkaller1: entered promiscuous mode [ 770.016147][T14296] syzkaller1: entered allmulticast mode [ 770.053655][T14296] usb usb8: usbfs: process 14296 (syz.1.2407) did not claim interface 0 before use [ 770.084860][T14303] netlink: 'syz.2.2408': attribute type 1 has an invalid length. [ 770.095042][T11551] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 770.228272][ T30] audit: type=1326 audit(1748799120.699:677): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14297 comm="syz.2.2408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e70d8e969 code=0x7ffc0000 [ 770.253534][ T44] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 770.295857][T11551] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 770.313278][T11551] usb 5-1: config 0 has no interfaces? [ 770.325194][T11551] usb 5-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 770.335861][ T30] audit: type=1326 audit(1748799120.719:678): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14297 comm="syz.2.2408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e70d8e969 code=0x7ffc0000 [ 770.363062][T11551] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 770.374841][ T30] audit: type=1326 audit(1748799120.719:679): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14297 comm="syz.2.2408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7f2e70d8e969 code=0x7ffc0000 [ 770.399357][T11551] usb 5-1: config 0 descriptor?? [ 770.431465][ T30] audit: type=1326 audit(1748799120.719:680): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14297 comm="syz.2.2408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e70d8e969 code=0x7ffc0000 [ 770.460435][ T44] usb 1-1: Using ep0 maxpacket: 16 [ 770.479458][ T44] usb 1-1: config 252 has an invalid interface number: 2 but max is 0 [ 770.482155][ T30] audit: type=1326 audit(1748799120.719:681): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14297 comm="syz.2.2408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e70d8e969 code=0x7ffc0000 [ 770.489303][ T44] usb 1-1: config 252 has no interface number 0 [ 770.517041][ T30] audit: type=1326 audit(1748799120.759:682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14297 comm="syz.2.2408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f2e70d8e969 code=0x7ffc0000 [ 770.517095][ T30] audit: type=1326 audit(1748799120.759:683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14297 comm="syz.2.2408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e70d8e969 code=0x7ffc0000 [ 770.517141][ T30] audit: type=1326 audit(1748799120.759:684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14297 comm="syz.2.2408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e70d8e969 code=0x7ffc0000 [ 770.517186][ T30] audit: type=1326 audit(1748799120.759:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14297 comm="syz.2.2408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f2e70d8e969 code=0x7ffc0000 [ 770.517231][ T30] audit: type=1326 audit(1748799120.759:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14297 comm="syz.2.2408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2e70d8e969 code=0x7ffc0000 [ 770.586257][ T5889] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 770.649575][T14291] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2406'. [ 770.660577][ T44] usb 1-1: too many endpoints for config 252 interface 2 altsetting 156: 185, using maximum allowed: 30 [ 770.672308][ T44] usb 1-1: config 252 interface 2 altsetting 156 has 0 endpoint descriptors, different from the interface descriptor's value: 185 [ 770.688865][ T44] usb 1-1: config 252 interface 2 has no altsetting 0 [ 770.699503][ T44] usb 1-1: New USB device found, idVendor=0b48, idProduct=300d, bcdDevice=d4.cd [ 770.709054][ T44] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 770.723681][T11551] usb 5-1: USB disconnect, device number 3 [ 770.783721][ T5889] usb 4-1: Using ep0 maxpacket: 16 [ 770.800856][ T5889] usb 4-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 770.812051][ T5889] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 770.856780][ T5889] usb 4-1: config 0 descriptor?? [ 770.879831][ T5889] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 770.966960][T14300] binder: BINDER_SET_CONTEXT_MGR already set [ 770.973045][T14300] binder: 14298:14300 ioctl 4018620d 200000000040 returned -16 [ 771.007181][T14300] binder: 14298:14300 ioctl c0306201 2000000003c0 returned -14 [ 771.044265][ T44] usb 1-1: string descriptor 0 read error: -71 [ 771.073304][ T44] dvb-usb: found a 'Technotrend TT-connect CT-3650' in cold state, will try to load a firmware [ 771.100833][ T44] dvb-usb: did not find the firmware file '(null)' (status -22). You can use /scripts/get_dvb_firmware to get the firmware [ 771.128043][ T44] usb 1-1: USB disconnect, device number 20 [ 771.272774][T14307] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.304246][T14307] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 771.320460][ T5889] gspca_sonixj: reg_r err -71 [ 771.335440][ T5889] sonixj 4-1:0.0: probe with driver sonixj failed with error -71 [ 771.370817][ T5889] usb 4-1: USB disconnect, device number 123 [ 771.430657][T14320] dlm: no locking on control device [ 771.869919][T14340] FAULT_INJECTION: forcing a failure. [ 771.869919][T14340] name failslab, interval 1, probability 0, space 0, times 0 [ 771.883907][T14340] CPU: 1 UID: 0 PID: 14340 Comm: syz.4.2424 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 771.883936][T14340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 771.883950][T14340] Call Trace: [ 771.883959][T14340] [ 771.883969][T14340] dump_stack_lvl+0x189/0x250 [ 771.884007][T14340] ? __pfx____ratelimit+0x10/0x10 [ 771.884034][T14340] ? __pfx_dump_stack_lvl+0x10/0x10 [ 771.884066][T14340] ? __pfx__printk+0x10/0x10 [ 771.884095][T14340] ? __pfx___might_resched+0x10/0x10 [ 771.884122][T14340] ? fs_reclaim_acquire+0x7d/0x100 [ 771.884148][T14340] should_fail_ex+0x414/0x560 [ 771.884181][T14340] should_failslab+0xa8/0x100 [ 771.884214][T14340] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 771.884244][T14340] ? __alloc_skb+0x112/0x2d0 [ 771.884279][T14340] __alloc_skb+0x112/0x2d0 [ 771.884313][T14340] netlink_ack+0x146/0xa50 [ 771.884370][T14340] netlink_rcv_skb+0x28c/0x470 [ 771.884402][T14340] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 771.884432][T14340] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 771.884476][T14340] ? bpf_lsm_capable+0x9/0x20 [ 771.884504][T14340] ? security_capable+0x7e/0x2e0 [ 771.884539][T14340] nfnetlink_rcv+0x26a/0x2520 [ 771.884568][T14340] ? __dev_queue_xmit+0x1cd7/0x3a70 [ 771.884598][T14340] ? kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 771.884629][T14340] ? __dev_queue_xmit+0x27e/0x3a70 [ 771.884653][T14340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.884685][T14340] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 771.884710][T14340] ? __pfx___dev_queue_xmit+0x10/0x10 [ 771.884749][T14340] ? ref_tracker_free+0x63a/0x7d0 [ 771.884787][T14340] ? __copy_skb_header+0xa7/0x550 [ 771.884812][T14340] ? __pfx_ref_tracker_free+0x10/0x10 [ 771.884864][T14340] ? skb_clone+0x246/0x3a0 [ 771.884901][T14340] ? __netlink_deliver_tap+0x807/0x850 [ 771.884931][T14340] ? netlink_deliver_tap+0x2e/0x1b0 [ 771.884968][T14340] ? netlink_deliver_tap+0x2e/0x1b0 [ 771.884997][T14340] ? netlink_deliver_tap+0x2e/0x1b0 [ 771.885033][T14340] netlink_unicast+0x758/0x8d0 [ 771.885071][T14340] netlink_sendmsg+0x805/0xb30 [ 771.885099][T14340] ? __pfx_netlink_sendmsg+0x10/0x10 [ 771.885122][T14340] ? aa_sock_msg_perm+0x94/0x160 [ 771.885151][T14340] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 771.885173][T14340] ? __pfx_netlink_sendmsg+0x10/0x10 [ 771.885194][T14340] __sock_sendmsg+0x219/0x270 [ 771.885223][T14340] ____sys_sendmsg+0x505/0x830 [ 771.885250][T14340] ? __pfx_____sys_sendmsg+0x10/0x10 [ 771.885280][T14340] ? import_iovec+0x74/0xa0 [ 771.885305][T14340] ___sys_sendmsg+0x21f/0x2a0 [ 771.885328][T14340] ? __pfx____sys_sendmsg+0x10/0x10 [ 771.885392][T14340] ? __fget_files+0x2a/0x420 [ 771.885411][T14340] ? __fget_files+0x3a0/0x420 [ 771.885441][T14340] __x64_sys_sendmsg+0x19b/0x260 [ 771.885464][T14340] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 771.885495][T14340] ? __pfx_ksys_write+0x10/0x10 [ 771.885520][T14340] ? rcu_is_watching+0x15/0xb0 [ 771.885552][T14340] ? do_syscall_64+0xbe/0x3b0 [ 771.885582][T14340] do_syscall_64+0xfa/0x3b0 [ 771.885606][T14340] ? lockdep_hardirqs_on+0x9c/0x150 [ 771.885630][T14340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.885650][T14340] ? clear_bhb_loop+0x60/0xb0 [ 771.885675][T14340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.885694][T14340] RIP: 0033:0x7f7f4f58e969 [ 771.885713][T14340] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 771.885732][T14340] RSP: 002b:00007f7f5043c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 771.885753][T14340] RAX: ffffffffffffffda RBX: 00007f7f4f7b5fa0 RCX: 00007f7f4f58e969 [ 771.885769][T14340] RDX: 0000000000000080 RSI: 0000200000000200 RDI: 0000000000000003 [ 771.885782][T14340] RBP: 00007f7f5043c090 R08: 0000000000000000 R09: 0000000000000000 [ 771.885794][T14340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 771.885806][T14340] R13: 0000000000000000 R14: 00007f7f4f7b5fa0 R15: 00007f7f4f8dfa28 [ 771.885837][T14340] [ 772.721706][T14354] xt_recent: hitcount (262143) is larger than allowed maximum (65535) [ 772.836847][T14342] vxcan1: MTU too low for tipc bearer [ 773.094127][T14355] binder: BINDER_SET_CONTEXT_MGR already set [ 773.100153][T14355] binder: 14347:14355 ioctl 4018620d 200000000040 returned -16 [ 773.230876][T14342] tipc: Enabling of bearer rejected, failed to enable media [ 773.241981][T14343] @: renamed from syz_tun (while UP) [ 773.375551][T14361] binder: 14347:14361 ioctl c0306201 2000000003c0 returned -14 [ 773.483596][T14363] CIFS: VFS: Malformed UNC in devname [ 774.404075][ T5889] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 774.564824][ T5889] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 774.575369][ T5889] usb 1-1: config 0 has no interfaces? [ 774.589892][ T5889] usb 1-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 774.633718][ T5889] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 774.665419][ T5889] usb 1-1: config 0 descriptor?? [ 774.773965][ T5907] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 774.880468][T14369] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2429'. [ 774.922768][ T44] usb 1-1: USB disconnect, device number 21 [ 774.933743][ T5907] usb 5-1: Using ep0 maxpacket: 16 [ 774.959407][ T5907] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 774.980856][ T5907] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 775.011593][ T5907] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 775.035277][ T5907] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 576 [ 775.074961][ T5907] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 775.109588][ T5907] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 775.134452][ T5907] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 775.152989][ T5907] usb 5-1: SerialNumber: syz [ 775.168074][T14374] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 775.194915][ T5907] cdc_acm 5-1:1.0: Control and data interfaces are not separated! [ 775.205370][ T5907] cdc_acm 5-1:1.0: probe with driver cdc_acm failed with error -12 [ 775.295090][T11551] usb 2-1: new low-speed USB device number 102 using dummy_hcd [ 775.517337][T11551] usb 2-1: config 6 has an invalid interface number: 137 but max is 0 [ 775.539492][T11551] usb 2-1: config 6 has no interface number 0 [ 775.546312][ T24] usb 5-1: USB disconnect, device number 4 [ 775.633265][T14386] fuse: Bad value for 'group_id' [ 775.649039][T14386] fuse: Bad value for 'group_id' [ 775.690221][T11551] usb 2-1: config 6 interface 137 has no altsetting 0 [ 775.713523][ T44] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 775.782205][T11551] usb 2-1: string descriptor 0 read error: -22 [ 775.795725][T11551] usb 2-1: New USB device found, idVendor=19d2, idProduct=0042, bcdDevice=22.a4 [ 775.829914][T11551] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 775.943165][ T44] usb 3-1: config 0 has no interfaces? [ 775.980591][ T44] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 776.015461][ T44] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 776.055909][ T44] usb 3-1: Product: syz [ 776.063330][ T44] usb 3-1: Manufacturer: syz [ 776.104982][ T44] usb 3-1: SerialNumber: syz [ 776.130138][ T44] usb 3-1: config 0 descriptor?? [ 776.267618][T14380] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 776.276729][T14380] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 776.289122][ T5889] usb 2-1: USB disconnect, device number 102 [ 776.460195][T14384] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 776.469758][T14384] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 776.524447][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 776.524467][ T30] audit: type=1800 audit(1748799126.899:692): pid=14384 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2435" name="file0" dev="tmpfs" ino=2684 res=0 errno=0 [ 776.886539][T14406] CIFS: VFS: Malformed UNC in devname [ 777.104275][ T5907] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 777.361506][ T5907] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 777.431415][ T5907] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 777.462660][ T5907] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 777.514262][ T5907] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 777.645792][ T5907] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 777.914299][ T44] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 777.953033][ T5907] usb 5-1: Manufacturer: syz [ 777.980798][ T5907] usb 5-1: config 0 descriptor?? [ 778.243607][ T5889] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 778.393860][ T5889] usb 1-1: Using ep0 maxpacket: 16 [ 778.407697][ T5889] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 778.432230][ T5889] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 778.477129][ T5889] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 778.520693][ T5889] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 778.621443][T11551] usb 3-1: USB disconnect, device number 27 [ 778.700787][ T44] usb 2-1: config 0 has no interfaces? [ 778.718147][ T5889] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 778.724939][ T44] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 778.735350][ T44] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 778.747077][ T44] usb 2-1: Product: syz [ 778.752484][ T44] usb 2-1: Manufacturer: syz [ 778.771218][ T44] usb 2-1: SerialNumber: syz [ 778.793061][ T44] usb 2-1: config 0 descriptor?? [ 779.066239][ T5889] usb 1-1: config 0 descriptor?? [ 779.147300][T14421] netlink: 'syz.2.2447': attribute type 1 has an invalid length. [ 779.470998][ T44] usb 5-1: USB disconnect, device number 5 [ 780.033711][ T5907] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 780.201452][ T5907] usb 4-1: config 0 has no interfaces? [ 780.214436][ T5907] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 780.226655][ T5907] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.349498][ T5907] usb 4-1: Product: syz [ 780.371846][ T5907] usb 4-1: Manufacturer: syz [ 780.384019][ T5907] usb 4-1: SerialNumber: syz [ 780.460842][ T5907] usb 4-1: config 0 descriptor?? [ 781.911259][ T5907] usb 2-1: USB disconnect, device number 103 [ 782.364101][ T5889] usbhid 1-1:0.0: can't add hid device: -71 [ 782.373865][ T5889] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 782.419078][T14442] netlink: 'syz.2.2451': attribute type 21 has an invalid length. [ 782.431813][ T5889] usb 1-1: USB disconnect, device number 22 [ 782.835884][T14454] netlink: 'syz.0.2454': attribute type 1 has an invalid length. [ 782.926691][T14454] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2454'. [ 782.970643][T14458] loop6: detected capacity change from 0 to 524288000 [ 783.067243][T14454] veth3: entered promiscuous mode [ 783.147634][T14454] bond2: (slave veth3): Enslaving as a backup interface with a down link [ 783.477559][T14466] CIFS: VFS: Malformed UNC in devname [ 783.658864][T14468] syzkaller1: entered promiscuous mode [ 783.669871][ T5889] usb 4-1: USB disconnect, device number 124 [ 783.686353][T14468] syzkaller1: entered allmulticast mode [ 783.702771][T14468] usb usb8: usbfs: process 14468 (syz.1.2459) did not claim interface 0 before use [ 784.239895][T14479] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2464'. [ 784.781335][T14485] vxcan1: MTU too low for tipc bearer [ 784.787889][T14485] tipc: Enabling of bearer rejected, failed to enable media [ 785.204083][T14489] FAULT_INJECTION: forcing a failure. [ 785.204083][T14489] name failslab, interval 1, probability 0, space 0, times 0 [ 785.329893][T14489] CPU: 0 UID: 0 PID: 14489 Comm: syz.4.2467 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 785.329927][T14489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 785.329940][T14489] Call Trace: [ 785.329949][T14489] [ 785.329960][T14489] dump_stack_lvl+0x189/0x250 [ 785.329996][T14489] ? __pfx____ratelimit+0x10/0x10 [ 785.330023][T14489] ? __pfx_dump_stack_lvl+0x10/0x10 [ 785.330054][T14489] ? __pfx__printk+0x10/0x10 [ 785.330083][T14489] ? __pfx___might_resched+0x10/0x10 [ 785.330107][T14489] ? fs_reclaim_acquire+0x7d/0x100 [ 785.330131][T14489] should_fail_ex+0x414/0x560 [ 785.330162][T14489] should_failslab+0xa8/0x100 [ 785.330193][T14489] __kmalloc_noprof+0xcb/0x4f0 [ 785.330219][T14489] ? kfree+0x4d/0x440 [ 785.330240][T14489] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 785.330273][T14489] tomoyo_realpath_from_path+0xe3/0x5d0 [ 785.330302][T14489] ? tomoyo_domain+0xd9/0x130 [ 785.330335][T14489] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 785.330361][T14489] tomoyo_path_number_perm+0x1e8/0x5a0 [ 785.330388][T14489] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 785.330431][T14489] ? __lock_acquire+0xab9/0xd20 [ 785.330476][T14489] ? __fget_files+0x2a/0x420 [ 785.330498][T14489] ? __fget_files+0x2a/0x420 [ 785.330516][T14489] ? __fget_files+0x3a0/0x420 [ 785.330533][T14489] ? __fget_files+0x2a/0x420 [ 785.330557][T14489] security_file_ioctl+0xcb/0x2d0 [ 785.330590][T14489] __se_sys_ioctl+0x47/0x170 [ 785.330620][T14489] do_syscall_64+0xfa/0x3b0 [ 785.330646][T14489] ? lockdep_hardirqs_on+0x9c/0x150 [ 785.330671][T14489] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 785.330692][T14489] ? clear_bhb_loop+0x60/0xb0 [ 785.330717][T14489] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 785.330738][T14489] RIP: 0033:0x7f7f4f58e969 [ 785.330757][T14489] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 785.330775][T14489] RSP: 002b:00007f7f5043c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 785.330796][T14489] RAX: ffffffffffffffda RBX: 00007f7f4f7b5fa0 RCX: 00007f7f4f58e969 [ 785.330812][T14489] RDX: 0000200000002380 RSI: 0000000000008946 RDI: 0000000000000003 [ 785.330825][T14489] RBP: 00007f7f5043c090 R08: 0000000000000000 R09: 0000000000000000 [ 785.330838][T14489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 785.330851][T14489] R13: 0000000000000000 R14: 00007f7f4f7b5fa0 R15: 00007f7f4f8dfa28 [ 785.330884][T14489] [ 785.579995][T14489] ERROR: Out of memory at tomoyo_realpath_from_path. [ 786.453659][T11551] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 786.474597][ T44] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 786.646446][T14509] SET target dimension over the limit! [ 786.684738][ T44] usb 2-1: Using ep0 maxpacket: 32 [ 786.691864][T11551] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 786.701235][T11551] usb 1-1: config 0 has no interface number 0 [ 786.779164][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 786.822175][T11551] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 786.852262][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 786.868985][T11551] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 786.897590][ T44] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 786.910816][T11551] usb 1-1: Product: syz [ 786.915763][T11551] usb 1-1: Manufacturer: syz [ 786.921172][ T44] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 786.934261][T11551] usb 1-1: SerialNumber: syz [ 786.949495][T11551] usb 1-1: config 0 descriptor?? [ 786.962818][ T44] usb 2-1: config 0 descriptor?? [ 787.034180][ T24] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 787.184942][T11551] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 787.202053][T11551] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 787.214453][T11551] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 787.252153][T11551] usb 1-1: media controller created [ 787.257681][ T5883] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 787.292702][ T24] usb 5-1: config 1 has an invalid interface number: 116 but max is 0 [ 787.301294][ T24] usb 5-1: config 1 has no interface number 0 [ 787.307464][ T24] usb 5-1: config 1 interface 116 has no altsetting 0 [ 787.318547][ T24] usb 5-1: New USB device found, idVendor=0499, idProduct=101c, bcdDevice=52.c1 [ 787.328201][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 787.337273][ T24] usb 5-1: Product: syz [ 787.345411][T11551] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 787.357736][ T24] usb 5-1: Manufacturer: syz [ 787.362388][ T24] usb 5-1: SerialNumber: syz [ 787.384305][T14499] netlink: zone id is out of range [ 787.389841][T14499] netlink: zone id is out of range [ 787.399044][T14499] netlink: zone id is out of range [ 787.413891][T14499] netlink: zone id is out of range [ 787.424390][ T5883] usb 4-1: Using ep0 maxpacket: 16 [ 787.431703][T14499] netlink: zone id is out of range [ 787.442900][ T5883] usb 4-1: config 0 has no interfaces? [ 787.455362][ T5883] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 787.465804][ T5883] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 787.474268][ T5883] usb 4-1: Product: syz [ 787.478634][ T5883] usb 4-1: Manufacturer: syz [ 787.483248][ T5883] usb 4-1: SerialNumber: syz [ 787.491080][ T5883] usb 4-1: config 0 descriptor?? [ 787.647827][T14499] netlink: zone id is out of range [ 787.659289][T14499] netlink: zone id is out of range [ 787.691318][T14499] netlink: zone id is out of range [ 787.696763][T14499] netlink: zone id is out of range [ 787.717019][T14499] netlink: zone id is out of range [ 787.742763][ T44] savu 0003:1E7D:2D5A.0012: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.1-1/input0 [ 787.856457][T11551] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 787.955203][ T44] usb 2-1: USB disconnect, device number 104 [ 788.197495][T11551] usb 1-1: USB disconnect, device number 23 [ 788.402288][T14525] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 788.408867][T14525] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 788.421659][T14525] vhci_hcd vhci_hcd.0: Device attached [ 788.432410][T14525] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(11) [ 788.439071][T14525] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 788.448513][T14525] vhci_hcd vhci_hcd.0: Device attached [ 788.462324][T14525] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 788.485941][T14525] vhci_hcd vhci_hcd.0: pdev(1) rhport(3) sockfd(16) [ 788.492688][T14525] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 788.502787][T14525] vhci_hcd vhci_hcd.0: Device attached [ 788.520645][T14525] vhci_hcd vhci_hcd.0: pdev(1) rhport(4) sockfd(18) [ 788.527320][T14525] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 788.537601][T14525] vhci_hcd vhci_hcd.0: Device attached [ 788.544757][T14525] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 788.556541][T14525] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(22) [ 788.563253][T14525] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 788.575488][T14525] vhci_hcd vhci_hcd.0: Device attached [ 788.587022][T14525] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 788.613652][ T44] vhci_hcd: vhci_device speed not set [ 788.622823][T14525] vhci_hcd vhci_hcd.0: pdev(1) rhport(7) sockfd(26) [ 788.629455][T14525] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 788.639264][T14525] vhci_hcd vhci_hcd.0: Device attached [ 788.667547][T14525] vhci_hcd vhci_hcd.0: port 0 already used [ 788.675366][ T44] usb 35-1: new full-speed USB device number 2 using vhci_hcd [ 788.692832][T14536] vhci_hcd: connection closed [ 788.693084][ T9207] vhci_hcd: stop threads [ 788.707603][ T9207] vhci_hcd: release socket [ 788.717701][T14530] vhci_hcd: connection closed [ 788.718512][T14528] vhci_hcd: connection closed [ 788.724184][T14526] vhci_hcd: connection reset by peer [ 788.735177][T14534] vhci_hcd: connection closed [ 788.735390][T14532] vhci_hcd: connection closed [ 788.746230][ T9207] vhci_hcd: disconnect device [ 788.759478][ T9207] vhci_hcd: stop threads [ 788.764730][ T9207] vhci_hcd: release socket [ 788.770962][ T9207] vhci_hcd: disconnect device [ 788.778116][ T9207] vhci_hcd: stop threads [ 788.784003][ T9207] vhci_hcd: release socket [ 788.790599][ T9207] vhci_hcd: disconnect device [ 788.796297][ T9207] vhci_hcd: stop threads [ 788.800674][ T9207] vhci_hcd: release socket [ 788.816673][ T9207] vhci_hcd: disconnect device [ 788.821887][ T9207] vhci_hcd: stop threads [ 788.826822][ T9207] vhci_hcd: release socket [ 788.831441][ T9207] vhci_hcd: disconnect device [ 788.838616][ T9207] vhci_hcd: stop threads [ 788.843038][ T9207] vhci_hcd: release socket [ 788.856423][ T9207] vhci_hcd: disconnect device [ 788.941810][T14543] CIFS: VFS: Malformed UNC in devname [ 789.591328][T14546] usb usb1: usbfs: process 14546 (syz.1.2479) did not claim interface 0 before use [ 789.643782][T14548] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2479'. [ 789.882463][ T24] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 790.134025][ T24] usb 5-1: USB disconnect, device number 6 [ 790.194640][T14553] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2482'. [ 790.287995][T14553] erspan0: entered promiscuous mode [ 790.310620][T14553] macvtap1: entered promiscuous mode [ 790.322426][ T6769] udevd[6769]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.116/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 790.381074][T14553] macvtap1: entered allmulticast mode [ 790.436060][T14553] erspan0: entered allmulticast mode [ 790.686493][T14558] erspan0: left allmulticast mode [ 790.790618][T14558] erspan0: left promiscuous mode [ 790.804884][ T24] usb 4-1: USB disconnect, device number 125 [ 791.221336][T14571] FAULT_INJECTION: forcing a failure. [ 791.221336][T14571] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 791.285521][T14575] vxcan1: MTU too low for tipc bearer [ 791.292775][T14575] tipc: Enabling of bearer rejected, failed to enable media [ 791.384134][T14577] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 791.390712][T14577] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 791.398660][T14577] vhci_hcd vhci_hcd.0: Device attached [ 791.408673][T14577] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(11) [ 791.415289][T14577] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 791.423251][T14577] vhci_hcd vhci_hcd.0: Device attached [ 791.433154][T14571] CPU: 0 UID: 0 PID: 14571 Comm: syz.4.2488 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 791.433181][T14571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 791.433193][T14571] Call Trace: [ 791.433202][T14571] [ 791.433218][T14571] dump_stack_lvl+0x189/0x250 [ 791.433253][T14571] ? __pfx____ratelimit+0x10/0x10 [ 791.433279][T14571] ? __pfx_dump_stack_lvl+0x10/0x10 [ 791.433308][T14571] ? __pfx__printk+0x10/0x10 [ 791.433329][T14571] ? __might_fault+0xb0/0x130 [ 791.433366][T14571] should_fail_ex+0x414/0x560 [ 791.433397][T14571] _copy_from_iter+0x1db/0x16f0 [ 791.433432][T14571] ? __lock_acquire+0xab9/0xd20 [ 791.433465][T14571] ? __pfx__copy_from_iter+0x10/0x10 [ 791.433509][T14571] tun_get_user+0x4ce/0x3ce0 [ 791.433553][T14571] ? aa_file_perm+0x11f/0xed0 [ 791.433579][T14571] ? __pfx_tun_get_user+0x10/0x10 [ 791.433605][T14571] ? aa_file_perm+0x11f/0xed0 [ 791.433628][T14571] ? aa_file_perm+0x3e7/0xed0 [ 791.433667][T14571] ? ref_tracker_alloc+0x318/0x460 [ 791.433690][T14571] ? __lock_acquire+0xab9/0xd20 [ 791.433713][T14571] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 791.433745][T14571] ? tun_get+0x1c/0x2f0 [ 791.433791][T14571] ? tun_get+0x1c/0x2f0 [ 791.433819][T14571] ? tun_get+0x1c/0x2f0 [ 791.433869][T14571] tun_chr_write_iter+0x113/0x200 [ 791.433899][T14571] vfs_write+0x54b/0xa90 [ 791.433931][T14571] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 791.433960][T14571] ? __pfx_vfs_write+0x10/0x10 [ 791.433999][T14571] ? __fget_files+0x2a/0x420 [ 791.434026][T14571] ksys_write+0x145/0x250 [ 791.434057][T14571] ? __pfx_ksys_write+0x10/0x10 [ 791.434081][T14571] ? rcu_is_watching+0x15/0xb0 [ 791.434113][T14571] ? do_syscall_64+0xbe/0x3b0 [ 791.434141][T14571] do_syscall_64+0xfa/0x3b0 [ 791.434166][T14571] ? lockdep_hardirqs_on+0x9c/0x150 [ 791.434190][T14571] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.434210][T14571] ? clear_bhb_loop+0x60/0xb0 [ 791.434242][T14571] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.434262][T14571] RIP: 0033:0x7f7f4f58e969 [ 791.434282][T14571] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 791.434300][T14571] RSP: 002b:00007f7f5043c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 791.434322][T14571] RAX: ffffffffffffffda RBX: 00007f7f4f7b5fa0 RCX: 00007f7f4f58e969 [ 791.434336][T14571] RDX: 0000000000000ffe RSI: 00002000000000c0 RDI: 0000000000000003 [ 791.434350][T14571] RBP: 00007f7f5043c090 R08: 0000000000000000 R09: 0000000000000000 [ 791.434362][T14571] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 791.434375][T14571] R13: 0000000000000000 R14: 00007f7f4f7b5fa0 R15: 00007f7f4f8dfa28 [ 791.434406][T14571] [ 791.434780][T14577] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 791.810448][T14585] vhci_hcd vhci_hcd.0: pdev(1) rhport(3) sockfd(16) [ 791.817091][T14585] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 791.838363][T14585] vhci_hcd vhci_hcd.0: Device attached [ 791.840972][ T30] audit: type=1326 audit(1748799142.309:693): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14583 comm="syz.3.2490" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f210638e969 code=0x0 [ 791.981782][T14588] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2490'. [ 792.044622][T14577] vhci_hcd vhci_hcd.0: pdev(1) rhport(4) sockfd(15) [ 792.051284][T14577] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 792.060002][T14582] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 792.080507][T14577] vhci_hcd vhci_hcd.0: Device attached [ 792.158375][T14592] netlink: 180 bytes leftover after parsing attributes in process `syz.4.2491'. [ 792.182545][T14577] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(20) [ 792.189209][T14577] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 792.220431][T14577] vhci_hcd vhci_hcd.0: Device attached [ 792.230173][T14582] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 792.283374][T14577] vhci_hcd vhci_hcd.0: pdev(1) rhport(7) sockfd(28) [ 792.290037][T14577] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 792.305801][T14577] vhci_hcd vhci_hcd.0: Device attached [ 792.339636][T14596] vhci_hcd: connection closed [ 792.339887][ T9207] vhci_hcd: stop threads [ 792.351518][T14589] vhci_hcd: connection closed [ 792.351527][T14580] vhci_hcd: connection closed [ 792.365183][T14586] vhci_hcd: connection closed [ 792.366011][T14578] vhci_hcd: connection closed [ 792.370292][T14593] vhci_hcd: connection closed [ 792.396411][ T9207] vhci_hcd: release socket [ 792.422202][ T9207] vhci_hcd: disconnect device [ 792.432632][ T9207] vhci_hcd: stop threads [ 792.441434][ T9207] vhci_hcd: release socket [ 792.453822][T13121] usb 5-1: new low-speed USB device number 7 using dummy_hcd [ 792.455469][ T9207] vhci_hcd: disconnect device [ 792.491341][ T9207] vhci_hcd: stop threads [ 792.499235][ T9207] vhci_hcd: release socket [ 792.519122][ T9207] vhci_hcd: disconnect device [ 792.543929][ T9207] vhci_hcd: stop threads [ 792.548259][ T9207] vhci_hcd: release socket [ 792.568595][ T9207] vhci_hcd: disconnect device [ 792.588164][ T9207] vhci_hcd: stop threads [ 792.592504][ T9207] vhci_hcd: release socket [ 792.616733][T13121] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 792.631361][ T9207] vhci_hcd: disconnect device [ 792.631864][T13121] usb 5-1: config 0 has no interface number 0 [ 792.653278][ T9207] vhci_hcd: stop threads [ 792.657933][ T9207] vhci_hcd: release socket [ 792.664937][T13121] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 792.694726][T13121] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 792.714458][ T9207] vhci_hcd: disconnect device [ 792.722612][T13121] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 792.739379][T13121] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 792.751889][T13121] usb 5-1: config 0 descriptor?? [ 792.764507][T14592] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 792.810813][T13121] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 793.082753][ T24] usb 5-1: USB disconnect, device number 7 [ 793.505809][T14616] CIFS: VFS: Malformed UNC in devname [ 793.704693][ T24] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 793.735329][T14603] delete_channel: no stack [ 793.837832][ T44] vhci_hcd: vhci_device speed not set [ 793.964264][ T24] usb 1-1: Using ep0 maxpacket: 16 [ 793.978269][ T24] usb 1-1: config 0 has no interfaces? [ 793.992629][ T24] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 794.009858][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 794.022692][ T24] usb 1-1: Product: syz [ 794.034654][ T24] usb 1-1: Manufacturer: syz [ 794.043985][ T24] usb 1-1: SerialNumber: syz [ 794.065143][ T24] usb 1-1: config 0 descriptor?? [ 794.764472][T13121] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 795.003021][T13121] usb 5-1: config 0 has no interfaces? [ 795.014959][T13121] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 795.025041][T13121] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 795.049320][T13121] usb 5-1: Product: syz [ 795.089293][T13121] usb 5-1: Manufacturer: syz [ 795.137511][T13121] usb 5-1: SerialNumber: syz [ 795.165549][T13121] usb 5-1: config 0 descriptor?? [ 795.455052][T11551] usb usb36-port1: attempt power cycle [ 795.606565][T14624] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 795.618937][T14624] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 795.665129][T14624] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 796.033796][T13121] usb 4-1: new low-speed USB device number 126 using dummy_hcd [ 796.045259][T11551] usb usb36-port1: unable to enumerate USB device [ 796.186658][T14636] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2502'. [ 796.200538][T13121] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 796.252532][T13121] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 796.403208][T13121] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 796.432420][T13121] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 796.469825][T13121] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 796.499377][T14628] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 796.552120][T13121] hub 4-1:1.0: bad descriptor, ignoring hub [ 796.590528][T13121] hub 4-1:1.0: probe with driver hub failed with error -5 [ 796.622104][T13121] cdc_wdm 4-1:1.0: skipping garbage [ 796.639930][T13121] cdc_wdm 4-1:1.0: skipping garbage [ 796.672385][T13121] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 796.691306][T13121] cdc_wdm 4-1:1.0: Unknown control protocol [ 796.870291][ C0] wdm_int_callback: 8 callbacks suppressed [ 796.870313][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 796.882781][ C0] wdm_int_callback: 8 callbacks suppressed [ 796.882806][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 796.896239][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 796.902860][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 796.909160][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 796.915827][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 796.922795][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 796.929411][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 796.936643][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 796.943276][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 796.949694][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 796.956326][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 796.962949][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 796.969580][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 796.976809][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 796.983444][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 796.989898][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 796.996520][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 797.002825][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 797.009439][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 797.015569][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -1 [ 797.433704][T14643] net_ratelimit: 171 callbacks suppressed [ 797.433727][T14643] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 797.707259][T11551] usb 1-1: USB disconnect, device number 24 [ 797.817672][T14647] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 797.824259][T14647] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 797.853068][T14647] vhci_hcd vhci_hcd.0: Device attached [ 797.886275][T13121] usb 4-1: USB disconnect, device number 126 [ 797.924180][T14647] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(11) [ 797.930839][T14647] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 797.974601][T14658] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 797.991307][T14658] vhci_hcd vhci_hcd.0: pdev(1) rhport(3) sockfd(17) [ 797.997948][T14658] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 798.013823][T14647] vhci_hcd vhci_hcd.0: Device attached [ 798.030104][ T5907] usb 5-1: USB disconnect, device number 8 [ 798.034700][T14658] vhci_hcd vhci_hcd.0: Device attached [ 798.036547][ T5889] vhci_hcd: vhci_device speed not set [ 798.075953][T14661] vhci_hcd vhci_hcd.0: pdev(1) rhport(4) sockfd(20) [ 798.082576][T14661] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 798.091326][T14661] vhci_hcd vhci_hcd.0: Device attached [ 798.107127][T14647] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 798.132662][T14647] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(22) [ 798.139313][T14647] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 798.167109][T14647] vhci_hcd vhci_hcd.0: Device attached [ 798.173599][ T5889] usb 35-1: new full-speed USB device number 3 using vhci_hcd [ 798.174749][T11551] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 798.206898][T14647] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 798.288290][T14670] CIFS: VFS: Malformed UNC in devname [ 798.304528][T14647] vhci_hcd vhci_hcd.0: pdev(1) rhport(7) sockfd(29) [ 798.311223][T14647] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 798.357394][T14647] vhci_hcd vhci_hcd.0: Device attached [ 798.370166][T14669] vhci_hcd: connection closed [ 798.370904][ T36] vhci_hcd: stop threads [ 798.380580][T11551] usb 3-1: Using ep0 maxpacket: 32 [ 798.386453][T14664] vhci_hcd: connection closed [ 798.387828][T14662] vhci_hcd: connection closed [ 798.392621][T14659] vhci_hcd: connection closed [ 798.394663][T14673] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2511'. [ 798.399934][T14650] vhci_hcd: connection reset by peer [ 798.415087][T14654] vhci_hcd: connection closed [ 798.416739][ T36] vhci_hcd: release socket [ 798.419439][T11551] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 798.424941][ T36] vhci_hcd: disconnect device [ 798.441808][T11551] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 798.459723][T11551] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 798.464515][ T36] vhci_hcd: stop threads [ 798.473287][T11551] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 798.500888][T11551] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 798.516774][ T36] vhci_hcd: release socket [ 798.525470][ T36] vhci_hcd: disconnect device [ 798.530283][T11551] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 798.557038][ T36] vhci_hcd: stop threads [ 798.563708][ T36] vhci_hcd: release socket [ 798.569305][T11551] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 798.582572][ T36] vhci_hcd: disconnect device [ 798.598478][ T36] vhci_hcd: stop threads [ 798.602921][T11551] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 798.624950][ T36] vhci_hcd: release socket [ 798.634339][ T36] vhci_hcd: disconnect device [ 798.642588][ T36] vhci_hcd: stop threads [ 798.651999][T11551] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 798.668106][ T36] vhci_hcd: release socket [ 798.711136][ T36] vhci_hcd: disconnect device [ 798.718520][T11551] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 798.741392][ T36] vhci_hcd: stop threads [ 798.747420][ T36] vhci_hcd: release socket [ 798.752500][ T36] vhci_hcd: disconnect device [ 798.808577][T11551] usb 3-1: config 0 descriptor?? [ 799.043844][T11551] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 28 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 799.215248][T14679] usb usb1: usbfs: process 14679 (syz.0.2514) did not claim interface 0 before use [ 799.268728][T14685] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2514'. [ 799.472541][T14691] netlink: 'syz.0.2518': attribute type 28 has an invalid length. [ 799.514948][T11551] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 799.743632][T11551] usb 4-1: Using ep0 maxpacket: 32 [ 799.751203][T11551] usb 4-1: too many endpoints for config 0 interface 0 altsetting 32: 253, using maximum allowed: 30 [ 799.791951][T11551] usb 4-1: config 0 interface 0 altsetting 32 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 800.036513][T11551] usb 4-1: config 0 interface 0 altsetting 32 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 800.051017][T11551] usb 4-1: config 0 interface 0 has no altsetting 0 [ 800.065652][T11551] usb 4-1: New USB device found, idVendor=0c12, idProduct=0030, bcdDevice= 0.00 [ 800.079783][T11551] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 800.110504][T11551] usb 4-1: config 0 descriptor?? [ 800.423874][T13761] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 800.462694][T14701] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2522'. [ 800.573681][T11551] zeroplus 0003:0C12:0030.0013: item fetching failed at offset 5/7 [ 800.574883][T13761] usb 1-1: Using ep0 maxpacket: 16 [ 800.582454][T11551] zeroplus 0003:0C12:0030.0013: parse failed [ 800.609759][T13761] usb 1-1: config 0 has no interfaces? [ 800.618881][T13761] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 800.636213][T13761] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 800.661629][T13761] usb 1-1: Product: syz [ 800.667790][T11551] zeroplus 0003:0C12:0030.0013: probe with driver zeroplus failed with error -22 [ 800.670374][T13761] usb 1-1: Manufacturer: syz [ 800.687734][T13761] usb 1-1: SerialNumber: syz [ 800.695868][T13761] usb 1-1: config 0 descriptor?? [ 800.781686][T14684] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 800.853870][T14684] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 800.863173][T14684] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 800.900093][T14684] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 800.969207][T13761] usb 1-1: USB disconnect, device number 25 [ 800.973619][T11551] usb 3-1: USB disconnect, device number 28 [ 800.992694][T14684] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 801.036230][T11551] usblp0: removed [ 801.077342][T14684] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 801.346522][ T44] usb 4-1: USB disconnect, device number 127 [ 802.569919][T14723] netlink: 8896 bytes leftover after parsing attributes in process `syz.1.2529'. [ 802.725409][T14728] FAULT_INJECTION: forcing a failure. [ 802.725409][T14728] name failslab, interval 1, probability 0, space 0, times 0 [ 802.798405][T14728] CPU: 0 UID: 0 PID: 14728 Comm: syz.4.2530 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 802.798437][T14728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 802.798451][T14728] Call Trace: [ 802.798459][T14728] [ 802.798469][T14728] dump_stack_lvl+0x189/0x250 [ 802.798507][T14728] ? __pfx____ratelimit+0x10/0x10 [ 802.798533][T14728] ? __pfx_dump_stack_lvl+0x10/0x10 [ 802.798565][T14728] ? __pfx__printk+0x10/0x10 [ 802.798594][T14728] ? __pfx___might_resched+0x10/0x10 [ 802.798627][T14728] should_fail_ex+0x414/0x560 [ 802.798660][T14728] ? traverse+0xd9/0x570 [ 802.798683][T14728] should_failslab+0xa8/0x100 [ 802.798717][T14728] __kvmalloc_node_noprof+0x168/0x600 [ 802.798748][T14728] ? traverse+0xd9/0x570 [ 802.798778][T14728] traverse+0xd9/0x570 [ 802.798819][T14728] seq_read_iter+0xcfe/0xe10 [ 802.798851][T14728] ? aa_file_perm+0x11f/0xed0 [ 802.798887][T14728] ? __asan_memset+0x22/0x50 [ 802.798920][T14728] seq_read+0x2e2/0x3d0 [ 802.798943][T14728] ? __lock_acquire+0xab9/0xd20 [ 802.798975][T14728] ? __pfx_seq_read+0x10/0x10 [ 802.799020][T14728] ? __pfx_seq_read+0x10/0x10 [ 802.799043][T14728] proc_reg_read+0x1e9/0x2e0 [ 802.799073][T14728] vfs_readv+0x5aa/0x850 [ 802.799096][T14728] ? __pfx_proc_reg_read+0x10/0x10 [ 802.799124][T14728] ? __pfx_vfs_readv+0x10/0x10 [ 802.799162][T14728] ? __fget_files+0x2a/0x420 [ 802.799185][T14728] ? __fget_files+0x3a0/0x420 [ 802.799204][T14728] ? __fget_files+0x2a/0x420 [ 802.799240][T14728] __x64_sys_preadv+0x197/0x2a0 [ 802.799274][T14728] ? __pfx___x64_sys_preadv+0x10/0x10 [ 802.799302][T14728] ? rcu_is_watching+0x15/0xb0 [ 802.799335][T14728] ? do_syscall_64+0xbe/0x3b0 [ 802.799366][T14728] do_syscall_64+0xfa/0x3b0 [ 802.799393][T14728] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 802.799414][T14728] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 802.799434][T14728] ? clear_bhb_loop+0x60/0xb0 [ 802.799460][T14728] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 802.799481][T14728] RIP: 0033:0x7f7f4f58e969 [ 802.799499][T14728] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 802.799516][T14728] RSP: 002b:00007f7f5043c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 802.799538][T14728] RAX: ffffffffffffffda RBX: 00007f7f4f7b5fa0 RCX: 00007f7f4f58e969 [ 802.799554][T14728] RDX: 0000000000000002 RSI: 0000200000000080 RDI: 0000000000000003 [ 802.799567][T14728] RBP: 00007f7f5043c090 R08: 0000000000000000 R09: 0000000000000000 [ 802.799580][T14728] R10: 000000000000000e R11: 0000000000000246 R12: 0000000000000001 [ 802.799593][T14728] R13: 0000000000000000 R14: 00007f7f4f7b5fa0 R15: 00007f7f4f8dfa28 [ 802.799624][T14728] [ 803.155220][T13761] usb 2-1: new low-speed USB device number 105 using dummy_hcd [ 803.263647][ T5889] vhci_hcd: vhci_device speed not set [ 803.323595][T13761] usb 2-1: Invalid ep0 maxpacket: 64 [ 803.454099][T13761] usb 2-1: new low-speed USB device number 106 using dummy_hcd [ 803.606614][T13761] usb 2-1: Invalid ep0 maxpacket: 64 [ 803.638559][T13761] usb usb2-port1: attempt power cycle [ 803.983613][T13761] usb 2-1: new low-speed USB device number 107 using dummy_hcd [ 804.004453][T13761] usb 2-1: Invalid ep0 maxpacket: 64 [ 804.084525][ T5907] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 804.134457][T13761] usb 2-1: new low-speed USB device number 108 using dummy_hcd [ 804.169035][T13761] usb 2-1: Invalid ep0 maxpacket: 64 [ 804.176056][T13761] usb usb2-port1: unable to enumerate USB device [ 804.223554][ T5907] usb 4-1: device descriptor read/64, error -71 [ 804.463538][ T5907] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 804.535682][T13121] usb usb36-port1: attempt power cycle [ 804.613816][ T5907] usb 4-1: device descriptor read/64, error -71 [ 804.751844][ T5907] usb usb4-port1: attempt power cycle [ 805.108055][T13121] usb usb36-port1: unable to enumerate USB device [ 805.115155][ T5907] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 805.133948][ T44] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 805.175984][ T5907] usb 4-1: device descriptor read/8, error -71 [ 805.304660][ T44] usb 1-1: Using ep0 maxpacket: 32 [ 805.317363][ T44] usb 1-1: config 0 has no interfaces? [ 805.335557][ T44] usb 1-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.aa [ 805.353508][ T44] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=4 [ 805.361639][ T44] usb 1-1: SerialNumber: syz [ 805.454637][ T5907] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 805.494520][ T44] usb 1-1: config 0 descriptor?? [ 805.694395][ T5907] usb 4-1: device descriptor read/8, error -71 [ 805.725643][T14752] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 805.744523][T14752] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 805.836916][ T5907] usb usb4-port1: unable to enumerate USB device [ 806.496944][T14781] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 806.504315][T14781] IPv6: NLM_F_CREATE should be set when creating new route [ 806.893647][ T5907] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 807.054321][ T5907] usb 3-1: Using ep0 maxpacket: 16 [ 807.075425][ T5907] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 807.147787][ T5907] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 807.201216][ T5907] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 807.282810][ T5907] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 807.340421][ T5907] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 807.436090][ T5907] usb 3-1: config 0 descriptor?? [ 807.494283][T11551] usb 1-1: USB disconnect, device number 26 [ 807.930731][ T5907] HID 045e:07da: Invalid code 65791 type 1 [ 807.968550][ T5907] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0014/input/input85 [ 807.987829][T14808] netlink: 'syz.1.2560': attribute type 5 has an invalid length. [ 808.755140][ T5907] microsoft 0003:045E:07DA.0014: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 809.414376][T14810] syz.1.2560 (14810): drop_caches: 2 [ 809.671332][T11551] usb 3-1: reset high-speed USB device number 29 using dummy_hcd [ 810.546701][ T44] usb 3-1: USB disconnect, device number 29 [ 811.052184][T14854] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2570'. [ 811.065673][T14854] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2570'. [ 811.077271][T14854] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2570'. [ 812.123518][ T44] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 812.144370][T14871] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2578'. [ 812.377264][ T44] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 812.386449][ T44] usb 4-1: config 0 has no interface number 0 [ 812.402757][ T44] usb 4-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 812.423521][ T44] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 812.551538][ T44] usb 4-1: config 0 descriptor?? [ 812.607433][ T44] usb 4-1: selecting invalid altsetting 1 [ 812.613365][ T44] dvb_ttusb_budget: ttusb_init_controller: error [ 812.623726][ T5907] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 812.652555][ T44] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 812.661322][T14884] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2582'. [ 812.805955][ T5907] usb 2-1: config index 0 descriptor too short (expected 8192, got 77) [ 812.902995][ T44] DVB: Unable to find symbol cx22700_attach() [ 812.918513][ T5907] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 813.014856][ T5907] usb 2-1: config 0 has no interfaces? [ 813.072544][ T5907] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 813.090269][ T5907] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 813.103268][ T5907] usb 2-1: Product: syz [ 813.109007][ T5907] usb 2-1: Manufacturer: syz [ 813.116777][ T5907] usb 2-1: SerialNumber: syz [ 813.174498][ T5907] usb 2-1: config 0 descriptor?? [ 813.315716][ T44] DVB: Unable to find symbol tda10046_attach() [ 813.498321][ T44] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 814.078272][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 814.094581][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 815.365562][T14915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 815.387762][T14915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 815.393807][ T5889] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 815.413674][T14917] sctp: [Deprecated]: syz.2.2591 (pid 14917) Use of int in max_burst socket option deprecated. [ 815.413674][T14917] Use struct sctp_assoc_value instead [ 815.603576][ T5889] usb 1-1: Using ep0 maxpacket: 16 [ 815.635729][ T5889] usb 1-1: unable to get BOS descriptor or descriptor too short [ 815.668338][ T5889] usb 1-1: config 2 has an invalid interface number: 9 but max is 0 [ 815.684060][ T5889] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 815.706620][ T5889] usb 1-1: config 2 has no interface number 0 [ 815.726144][ T5889] usb 1-1: config 2 interface 9 altsetting 10 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 815.773702][ T5889] usb 1-1: config 2 interface 9 altsetting 10 bulk endpoint 0x8E has invalid maxpacket 32 [ 815.863528][ T5889] usb 1-1: config 2 interface 9 altsetting 10 endpoint 0xA has invalid wMaxPacketSize 0 [ 815.893827][ T5907] usb 2-1: USB disconnect, device number 109 [ 815.925366][ T5889] usb 1-1: config 2 interface 9 altsetting 10 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 816.006981][ T5889] usb 1-1: config 2 interface 9 has no altsetting 0 [ 816.025860][ T5889] usb 1-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=6f.97 [ 816.036494][ T5889] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 816.051022][ T5889] usb 1-1: Product: syz [ 816.065246][ T5889] usb 1-1: Manufacturer: syz [ 816.070346][T14927] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2594'. [ 816.083332][ T5889] usb 1-1: SerialNumber: syz [ 816.102378][T14913] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 816.198601][T14931] syz.2.2595 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 816.210032][T14931] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2595'. [ 816.233927][T13121] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 816.326220][T14913] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 816.370179][T14913] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 816.474613][ T44] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 816.581923][T13121] usb 5-1: config 0 has no interfaces? [ 816.594294][T13121] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 816.604716][T13121] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 816.612853][T13121] usb 5-1: Product: syz [ 816.628954][T13121] usb 5-1: Manufacturer: syz [ 816.640242][T13121] usb 5-1: SerialNumber: syz [ 816.670162][T13121] usb 5-1: config 0 descriptor?? [ 816.703630][ T5907] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 816.763975][ T5889] pn533_usb 1-1:2.9: NFC: Could not find bulk-in or bulk-out endpoint [ 816.811172][ T5889] usb 1-1: USB disconnect, device number 27 [ 816.834496][ T44] usb 3-1: config 0 has no interfaces? [ 816.853562][ T5907] usb 2-1: Using ep0 maxpacket: 8 [ 816.869105][ T5907] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 816.883295][ T5907] usb 2-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=20.9d [ 816.912980][ T5907] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=105 [ 816.989161][ T5907] usb 2-1: SerialNumber: syz [ 816.998136][ T44] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 817.012991][ T44] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 817.079169][ T5907] usb 2-1: config 0 descriptor?? [ 817.079172][ T44] usb 3-1: Product: syz [ 817.079211][ T44] usb 3-1: Manufacturer: syz [ 817.100029][ T44] usb 3-1: SerialNumber: syz [ 817.109019][ T5907] usb 2-1: Found UVC 0.00 device (05ac:8501) [ 817.134025][ T44] usb 3-1: config 0 descriptor?? [ 817.181314][ T5907] usb 2-1: Failed to create links for entity 255 [ 817.208824][T14940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 817.233019][ T5907] usb 2-1: Failed to register entities (-22). [ 817.241718][T14940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 817.417698][T14931] xt_hashlimit: size too large, truncated to 1048576 [ 817.425142][T14931] xt_hashlimit: Unknown mode mask 368, kernel too old? [ 818.203763][ T5907] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 818.363017][ T5907] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 818.373300][ T5907] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 818.389981][ T5907] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 818.400977][ T5907] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 818.427944][ T5907] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 818.443140][ T5907] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 818.453284][ T5907] usb 1-1: Product: ї [ 818.462227][ T5907] usb 1-1: Manufacturer: ء [ 818.467730][ T5907] usb 1-1: SerialNumber: 䌮蓼岟嗠ﾆ䨪쇄苁闏沩蜴䐘偁멷춞ḟ쇪呋퓂퇖䬓댴縆ృ諦羦佩߼壜뎊ኹ춙̹뽶ᘊ竡淉ᾑ폃ᬒ폤츚爱ꒋ近髣坡絛뀅诉˽ྡྷӤ⬇㿨㽮틣⼆禵䑋ﱪⰇᖼ㝯鷩繖㟡뭅㦥䵇逄ᮂ [ 818.531697][T14948] raw-gadget.5 gadget.0: fail, usb_ep_enable returned -22 [ 818.909303][ T5907] usb 1-1: 0:2 : does not exist [ 819.141155][ T5907] usb 1-1: USB disconnect, device number 28 [ 819.241028][T11551] usb 5-1: USB disconnect, device number 9 [ 819.501188][T13121] usb 2-1: USB disconnect, device number 110 [ 820.723944][ T44] usb 3-1: USB disconnect, device number 30 [ 821.424560][T11551] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 821.715825][T11551] usb 3-1: config 0 has no interfaces? [ 821.864552][T14978] fuse: Bad value for 'fd' [ 822.076845][T11551] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 822.189775][T11551] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 822.240457][T11551] usb 3-1: Product: syz [ 822.352734][T11551] usb 3-1: Manufacturer: syz [ 822.372944][T11551] usb 3-1: SerialNumber: syz [ 822.528192][T11551] usb 3-1: config 0 descriptor?? [ 824.064644][T11551] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 824.237863][T11551] usb 1-1: config index 0 descriptor too short (expected 8192, got 77) [ 824.247099][T11551] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 824.309420][T11551] usb 1-1: config 0 has no interfaces? [ 824.387668][T11551] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 824.419819][T11551] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 824.467695][ T44] usb 3-1: USB disconnect, device number 31 [ 824.489167][T11551] usb 1-1: Product: syz [ 824.618433][T11551] usb 1-1: Manufacturer: syz [ 824.630224][T11551] usb 1-1: SerialNumber: syz [ 824.656688][T11551] usb 1-1: config 0 descriptor?? [ 826.516578][T11551] usb 1-1: USB disconnect, device number 29 [ 827.154385][ T5907] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 827.339286][ T5907] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 827.365054][ T5907] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 827.383830][ T5907] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 827.549834][ T5907] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 827.573268][ T5907] usb 5-1: SerialNumber: syz [ 827.866007][T15024] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2618'. [ 827.878760][T15024] input: syz1 as /devices/virtual/input/input86 [ 828.177262][T15036] CIFS: VFS: Malformed UNC in devname [ 828.427818][ T5907] usb 5-1: 0:2 : does not exist [ 828.477068][ T5907] usb 5-1: USB disconnect, device number 10 [ 828.643603][T11551] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 828.728450][ T5914] udevd[5914]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 829.077143][T11551] usb 3-1: config 0 has no interfaces? [ 829.091705][T11551] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 829.224274][T11551] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 829.303216][T11551] usb 3-1: Product: syz [ 829.354404][T11551] usb 3-1: Manufacturer: syz [ 829.405918][T11551] usb 3-1: SerialNumber: syz [ 829.423755][T13121] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 829.570370][T11551] usb 3-1: config 0 descriptor?? [ 829.629971][T13121] usb 5-1: config 0 has no interfaces? [ 829.740557][T13121] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 829.774079][T13121] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 829.811818][T13121] usb 5-1: Product: syz [ 829.923122][T13121] usb 5-1: Manufacturer: syz [ 829.930266][T15040] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 829.965397][T15040] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 829.999215][T13121] usb 5-1: SerialNumber: syz [ 830.030120][T15040] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 830.090686][T13121] usb 5-1: config 0 descriptor?? [ 830.149653][T15053] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2626'. [ 830.234508][T15054] FAULT_INJECTION: forcing a failure. [ 830.234508][T15054] name failslab, interval 1, probability 0, space 0, times 0 [ 830.331585][T15054] CPU: 1 UID: 0 PID: 15054 Comm: syz.0.2626 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 830.331616][T15054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 830.331630][T15054] Call Trace: [ 830.331639][T15054] [ 830.331649][T15054] dump_stack_lvl+0x189/0x250 [ 830.331686][T15054] ? __pfx____ratelimit+0x10/0x10 [ 830.331713][T15054] ? __pfx_dump_stack_lvl+0x10/0x10 [ 830.331744][T15054] ? __pfx__printk+0x10/0x10 [ 830.331773][T15054] ? __pfx___might_resched+0x10/0x10 [ 830.331806][T15054] should_fail_ex+0x414/0x560 [ 830.331845][T15054] should_failslab+0xa8/0x100 [ 830.331882][T15054] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 830.331912][T15054] ? __alloc_skb+0x112/0x2d0 [ 830.331948][T15054] __alloc_skb+0x112/0x2d0 [ 830.331983][T15054] netlink_sendmsg+0x5c6/0xb30 [ 830.332012][T15054] ? __pfx_netlink_sendmsg+0x10/0x10 [ 830.332036][T15054] ? aa_sock_msg_perm+0x94/0x160 [ 830.332059][T15054] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 830.332075][T15054] ? __pfx_netlink_sendmsg+0x10/0x10 [ 830.332091][T15054] __sock_sendmsg+0x219/0x270 [ 830.332112][T15054] ____sys_sendmsg+0x505/0x830 [ 830.332132][T15054] ? __pfx_____sys_sendmsg+0x10/0x10 [ 830.332154][T15054] ? import_iovec+0x74/0xa0 [ 830.332172][T15054] ___sys_sendmsg+0x21f/0x2a0 [ 830.332189][T15054] ? __pfx____sys_sendmsg+0x10/0x10 [ 830.332230][T15054] ? __fget_files+0x2a/0x420 [ 830.332244][T15054] ? __fget_files+0x3a0/0x420 [ 830.332266][T15054] __x64_sys_sendmsg+0x19b/0x260 [ 830.332283][T15054] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 830.332306][T15054] ? __pfx_ksys_write+0x10/0x10 [ 830.332330][T15054] ? do_syscall_64+0xbe/0x3b0 [ 830.332353][T15054] do_syscall_64+0xfa/0x3b0 [ 830.332371][T15054] ? lockdep_hardirqs_on+0x9c/0x150 [ 830.332389][T15054] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 830.332404][T15054] ? clear_bhb_loop+0x60/0xb0 [ 830.332422][T15054] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 830.332437][T15054] RIP: 0033:0x7f186ff8e969 [ 830.332450][T15054] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 830.332464][T15054] RSP: 002b:00007f1870db6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 830.332480][T15054] RAX: ffffffffffffffda RBX: 00007f18701b6080 RCX: 00007f186ff8e969 [ 830.332491][T15054] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000012 [ 830.332501][T15054] RBP: 00007f1870db6090 R08: 0000000000000000 R09: 0000000000000000 [ 830.332510][T15054] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 830.332519][T15054] R13: 0000000000000001 R14: 00007f18701b6080 R15: 00007f18702dfa28 [ 830.332541][T15054] [ 830.338306][T15053] macvtap2: entered promiscuous mode [ 830.633943][T15053] macvtap2: entered allmulticast mode [ 830.641355][T15053] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 831.675500][ T24] usb 3-1: USB disconnect, device number 32 [ 831.742380][T15066] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 831.790196][T15066] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 832.315213][T13121] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 832.489105][T13121] usb 3-1: config 0 has no interfaces? [ 832.575510][T13121] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 832.585645][T13761] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 832.679630][T13121] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 832.688391][ T5907] usb 5-1: USB disconnect, device number 11 [ 832.782864][T15087] SET target dimension over the limit! [ 832.805480][T13121] usb 3-1: Product: syz [ 832.811689][T13761] usb 1-1: config 0 has no interfaces? [ 832.906049][T13121] usb 3-1: Manufacturer: syz [ 832.910807][T13121] usb 3-1: SerialNumber: syz [ 832.943105][T13121] usb 3-1: config 0 descriptor?? [ 832.999271][T15090] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 833.008282][T15090] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 833.051289][T13761] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 833.278491][T13761] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 833.322316][T13761] usb 1-1: Product: syz [ 833.666010][T13761] usb 1-1: Manufacturer: syz [ 833.732817][T15074] misc userio: No port type given on /dev/userio [ 833.742014][T15074] misc userio: The device must be registered before sending interrupts [ 833.969458][T15095] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2638'. [ 833.986947][T15099] CIFS: VFS: Malformed UNC in devname [ 834.106865][T13761] usb 1-1: SerialNumber: syz [ 834.123134][T13761] usb 1-1: config 0 descriptor?? [ 835.907912][ T24] usb 3-1: USB disconnect, device number 33 [ 836.756354][T13121] usb 1-1: USB disconnect, device number 30 [ 836.863500][ T24] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 837.590116][ T24] usb 3-1: config 0 has no interfaces? [ 837.600400][T15121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 837.609226][T15121] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 837.657884][ T24] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 837.759026][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 837.783520][ T44] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 837.808705][ T24] usb 3-1: Product: syz [ 837.833657][ T24] usb 3-1: Manufacturer: syz [ 837.848103][ T24] usb 3-1: SerialNumber: syz [ 837.875788][T15125] input: syz1 as /devices/virtual/input/input88 [ 837.901275][ T24] usb 3-1: config 0 descriptor?? [ 837.958486][ T44] usb 1-1: config index 0 descriptor too short (expected 8192, got 77) [ 837.978644][ T44] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 837.991552][T15127] [U] M٭Q& K4 [ 837.997716][T15127] netlink: 'syz.4.2646': attribute type 30 has an invalid length. [ 838.119165][ T44] usb 1-1: config 0 has no interfaces? [ 838.156135][T15109] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 838.165193][T15109] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 838.174456][T15109] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 838.312539][ T44] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 838.354609][ T44] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 838.362701][ T44] usb 1-1: Product: syz [ 838.367112][ T24] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 838.533006][ T44] usb 1-1: Manufacturer: syz [ 838.568018][ T44] usb 1-1: SerialNumber: syz [ 838.590017][ T24] usb 2-1: config 0 has no interfaces? [ 838.608527][ T24] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 838.627160][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 838.637454][ T44] usb 1-1: config 0 descriptor?? [ 838.646287][T15136] CIFS: VFS: Malformed UNC in devname [ 838.694462][ T24] usb 2-1: Product: syz [ 838.730986][ T24] usb 2-1: Manufacturer: syz [ 838.740198][ T24] usb 2-1: SerialNumber: syz [ 838.754267][ T24] usb 2-1: config 0 descriptor?? [ 839.435268][T15140] FAULT_INJECTION: forcing a failure. [ 839.435268][T15140] name failslab, interval 1, probability 0, space 0, times 0 [ 839.464365][T15140] CPU: 0 UID: 0 PID: 15140 Comm: syz.3.2650 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 839.464399][T15140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 839.464412][T15140] Call Trace: [ 839.464420][T15140] [ 839.464430][T15140] dump_stack_lvl+0x189/0x250 [ 839.464467][T15140] ? __pfx____ratelimit+0x10/0x10 [ 839.464493][T15140] ? __pfx_dump_stack_lvl+0x10/0x10 [ 839.464525][T15140] ? __pfx__printk+0x10/0x10 [ 839.464555][T15140] ? __pfx___might_resched+0x10/0x10 [ 839.464582][T15140] ? fs_reclaim_acquire+0x7d/0x100 [ 839.464618][T15140] should_fail_ex+0x414/0x560 [ 839.464658][T15140] should_failslab+0xa8/0x100 [ 839.464692][T15140] __kmalloc_noprof+0xcb/0x4f0 [ 839.464720][T15140] ? process_vm_rw+0x2e7/0xb40 [ 839.464746][T15140] ? process_vm_rw+0x348/0xb40 [ 839.464779][T15140] process_vm_rw+0x348/0xb40 [ 839.464812][T15140] ? get_pid_task+0x20/0x1f0 [ 839.464846][T15140] ? __pfx_process_vm_rw+0x10/0x10 [ 839.464877][T15140] ? rcu_read_lock_any_held+0xb3/0x120 [ 839.464907][T15140] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 839.464947][T15140] ? vfs_write+0x8d8/0xa90 [ 839.464997][T15140] ? __pfx_vfs_write+0x10/0x10 [ 839.465053][T15140] ? ksys_write+0x22a/0x250 [ 839.465084][T15140] ? __pfx_ksys_write+0x10/0x10 [ 839.465118][T15140] ? __task_pid_nr_ns+0x28/0x470 [ 839.465143][T15140] __x64_sys_process_vm_readv+0xe0/0x100 [ 839.465178][T15140] do_syscall_64+0xfa/0x3b0 [ 839.465207][T15140] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 839.465227][T15140] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 839.465249][T15140] ? clear_bhb_loop+0x60/0xb0 [ 839.465275][T15140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 839.465295][T15140] RIP: 0033:0x7f210638e969 [ 839.465314][T15140] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 839.465332][T15140] RSP: 002b:00007f2107110038 EFLAGS: 00000246 ORIG_RAX: 0000000000000136 [ 839.465354][T15140] RAX: ffffffffffffffda RBX: 00007f21065b5fa0 RCX: 00007f210638e969 [ 839.465370][T15140] RDX: 0000000000000002 RSI: 0000200000008400 RDI: 00000000000006bc [ 839.465384][T15140] RBP: 00007f2107110090 R08: 0000000000000286 R09: 0000000000000000 [ 839.465397][T15140] R10: 0000200000008640 R11: 0000000000000246 R12: 0000000000000001 [ 839.465410][T15140] R13: 0000000000000000 R14: 00007f21065b5fa0 R15: 00007f21066dfa28 [ 839.465447][T15140] [ 839.712435][ C0] vkms_vblank_simulate: vblank timer overrun [ 840.497983][ T44] usb 1-1: USB disconnect, device number 31 [ 840.630279][T13761] usb 3-1: USB disconnect, device number 34 [ 841.163833][T13121] usb 2-1: USB disconnect, device number 111 [ 841.193949][T13761] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 841.334849][T13761] usb 3-1: device descriptor read/64, error -71 [ 841.410795][T15162] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2656'. [ 841.563630][ T5907] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 841.574740][T13761] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 841.724615][T13761] usb 3-1: device descriptor read/64, error -71 [ 841.737081][ T5907] usb 5-1: Using ep0 maxpacket: 32 [ 841.758270][ T5907] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 841.778346][ T5907] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 841.806083][ T5907] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 841.820952][ T5907] usb 5-1: Product: syz [ 841.830672][ T5907] usb 5-1: Manufacturer: syz [ 841.835811][T13761] usb usb3-port1: attempt power cycle [ 841.847639][ T5907] usb 5-1: SerialNumber: syz [ 841.871762][ T5907] usb 5-1: config 0 descriptor?? [ 841.881231][T15160] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 841.898149][ T5907] hub 5-1:0.0: bad descriptor, ignoring hub [ 841.908756][ T5907] hub 5-1:0.0: probe with driver hub failed with error -5 [ 841.923968][ T5889] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 842.110937][T15160] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 842.123023][ T5889] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 842.145541][ T5889] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 842.163880][T15160] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 842.183520][T13761] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 842.207224][ T5889] usb 2-1: Product: syz [ 842.211779][ T5889] usb 2-1: Manufacturer: syz [ 842.227717][T15160] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2655'. [ 842.242123][T13761] usb 3-1: device descriptor read/8, error -71 [ 842.265335][ T5889] usb 2-1: SerialNumber: syz [ 842.296787][ T5889] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 842.317458][ T5907] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 842.493714][T13761] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 842.539306][T13761] usb 3-1: device descriptor read/8, error -71 [ 842.684978][T13761] usb usb3-port1: unable to enumerate USB device [ 842.753367][T13761] usb 2-1: USB disconnect, device number 112 [ 842.933588][T15174] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(9) [ 842.940168][T15174] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 842.959471][T15178] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(12) [ 842.966116][T15178] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 842.978510][T15174] vhci_hcd vhci_hcd.0: Device attached [ 843.005586][T15178] vhci_hcd vhci_hcd.0: Device attached [ 843.029956][T15174] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 843.107946][T15174] vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(16) [ 843.114613][T15174] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 843.164625][ T5889] vhci_hcd: vhci_device speed not set [ 843.194255][T15178] vhci_hcd vhci_hcd.0: pdev(3) rhport(4) sockfd(19) [ 843.200881][T15178] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 843.222331][T15174] vhci_hcd vhci_hcd.0: Device attached [ 843.224532][ T5889] usb 39-1: new full-speed USB device number 2 using vhci_hcd [ 843.254273][T15178] vhci_hcd vhci_hcd.0: Device attached [ 843.272417][T15185] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(22) [ 843.279055][T15185] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 843.304145][T15185] vhci_hcd vhci_hcd.0: Device attached [ 843.355546][ T5907] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 843.362597][ T5907] ath9k_htc: Failed to initialize the device [ 843.375571][T15174] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 843.394336][T13761] usb 2-1: ath9k_htc: USB layer deinitialized [ 843.436221][T15174] vhci_hcd vhci_hcd.0: pdev(3) rhport(6) sockfd(24) [ 843.442881][T15174] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 843.456018][T15194] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2663'. [ 843.539010][T15174] vhci_hcd vhci_hcd.0: Device attached [ 843.569723][T15174] vhci_hcd vhci_hcd.0: pdev(3) rhport(7) sockfd(29) [ 843.576359][T15174] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 843.594502][T15174] vhci_hcd vhci_hcd.0: Device attached [ 843.600775][T15194] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2663'. [ 843.614593][T15196] vhci_hcd: connection closed [ 843.615306][T15191] vhci_hcd: connection closed [ 843.620280][T15186] vhci_hcd: connection closed [ 843.635027][T15179] vhci_hcd: connection closed [ 843.636093][T15183] vhci_hcd: connection closed [ 843.640061][T15181] vhci_hcd: connection closed [ 843.645731][T15176] vhci_hcd: connection reset by peer [ 843.666732][ T9222] vhci_hcd: stop threads [ 843.674837][ T9222] vhci_hcd: release socket [ 843.684279][ T9222] vhci_hcd: disconnect device [ 843.698581][ T9222] vhci_hcd: stop threads [ 843.707695][ T9222] vhci_hcd: release socket [ 843.713981][ T9222] vhci_hcd: disconnect device [ 843.726217][ T9222] vhci_hcd: stop threads [ 843.737998][ T9222] vhci_hcd: release socket [ 843.743927][ T5907] usb 5-1: USB disconnect, device number 12 [ 843.776821][ T9222] vhci_hcd: disconnect device [ 843.784212][T13121] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 843.797208][ T9222] vhci_hcd: stop threads [ 843.810034][ T9222] vhci_hcd: release socket [ 843.818103][ T9222] vhci_hcd: disconnect device [ 843.823108][ T9222] vhci_hcd: stop threads [ 843.837099][ T9222] vhci_hcd: release socket [ 843.841837][ T9222] vhci_hcd: disconnect device [ 843.857423][ T9222] vhci_hcd: stop threads [ 843.861765][ T9222] vhci_hcd: release socket [ 843.882661][ T9222] vhci_hcd: disconnect device [ 843.904725][ T9222] vhci_hcd: stop threads [ 843.914815][ T9222] vhci_hcd: release socket [ 843.924884][ T9222] vhci_hcd: disconnect device [ 843.949807][T13121] usb 1-1: config 0 has no interfaces? [ 844.106252][T13121] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 844.115716][T13121] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 844.128547][T13121] usb 1-1: Product: syz [ 844.132759][T13121] usb 1-1: Manufacturer: syz [ 844.173501][T13121] usb 1-1: SerialNumber: syz [ 844.212256][T13121] usb 1-1: config 0 descriptor?? [ 844.538580][T15211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 844.551347][T15211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 844.827986][T11551] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 845.593366][T11551] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 845.727147][T11551] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 845.746665][T11551] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 845.764395][T11551] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 845.782648][T11551] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 845.794543][ T24] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 845.830096][T11551] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 845.859819][T11551] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 845.880180][T11551] usb 5-1: Product: syz [ 845.896660][T11551] usb 5-1: Manufacturer: syz [ 845.937842][T11551] cdc_wdm 5-1:1.0: skipping garbage [ 845.960566][T11551] cdc_wdm 5-1:1.0: skipping garbage [ 845.981109][T11551] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 846.005309][T11551] cdc_wdm 5-1:1.0: Unknown control protocol [ 846.021630][ T24] usb 2-1: config 0 has no interfaces? [ 846.081152][ T24] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 846.120723][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.148969][ T24] usb 2-1: Product: syz [ 846.185820][ T24] usb 2-1: Manufacturer: syz [ 846.212277][ T24] usb 2-1: SerialNumber: syz [ 846.630471][ C1] cdc_wdm 5-1:1.0: Unexpected error -71 [ 846.636624][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 846.643225][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 846.650178][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 846.656780][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 846.663091][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 846.669688][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 846.676630][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 846.683258][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 846.689710][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 846.696319][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 846.704541][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 846.711228][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 846.717506][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 846.724123][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 846.730452][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 846.737046][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 846.743249][T11551] usb 5-1: USB disconnect, device number 13 [ 846.744347][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 846.756841][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 846.762902][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 846.837446][ T24] usb 2-1: config 0 descriptor?? [ 846.943665][T13121] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 847.233981][T13121] usb 3-1: config 0 has no interfaces? [ 847.346019][T13121] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 847.375898][T13121] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 847.478841][T13121] usb 3-1: Product: syz [ 847.483107][T13121] usb 3-1: Manufacturer: syz [ 847.579947][T13121] usb 3-1: SerialNumber: syz [ 847.592790][T13121] usb 3-1: config 0 descriptor?? [ 847.616946][ T5907] usb 1-1: USB disconnect, device number 32 [ 848.379260][T15239] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 848.384805][ T5889] vhci_hcd: vhci_device speed not set [ 848.421807][T15239] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 848.681550][T15243] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 848.688131][T15243] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 848.703723][T15243] vhci_hcd vhci_hcd.0: Device attached [ 848.723863][T15246] vhci_hcd vhci_hcd.0: pdev(4) rhport(1) sockfd(11) [ 848.730599][T15246] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 848.759751][T15246] vhci_hcd vhci_hcd.0: Device attached [ 848.798304][T15243] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 848.810702][T15243] vhci_hcd vhci_hcd.0: pdev(4) rhport(3) sockfd(16) [ 848.817329][T15243] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 848.894533][T15243] vhci_hcd vhci_hcd.0: Device attached [ 848.894545][ T5907] vhci_hcd: vhci_device speed not set [ 848.920226][T15243] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(18) [ 848.926852][T15243] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 848.954625][ T5907] usb 41-1: new full-speed USB device number 3 using vhci_hcd [ 848.977876][T15255] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 849.029871][T15246] vhci_hcd vhci_hcd.0: pdev(4) rhport(4) sockfd(21) [ 849.036545][T15246] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 849.045806][T15243] vhci_hcd vhci_hcd.0: Device attached [ 849.085579][T15246] vhci_hcd vhci_hcd.0: Device attached [ 849.139558][T15243] vhci_hcd vhci_hcd.0: pdev(4) rhport(7) sockfd(30) [ 849.146219][T15243] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 849.171452][T15256] vhci_hcd vhci_hcd.0: pdev(4) rhport(6) sockfd(26) [ 849.178076][T15256] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 849.189888][T13121] usb 2-1: USB disconnect, device number 113 [ 849.265452][T15256] vhci_hcd vhci_hcd.0: Device attached [ 849.279593][T15243] vhci_hcd vhci_hcd.0: Device attached [ 849.340428][T15253] vhci_hcd: connection closed [ 849.340882][T15257] vhci_hcd: connection closed [ 849.342054][ T9222] vhci_hcd: stop threads [ 849.347689][T15249] vhci_hcd: connection closed [ 849.351937][T15244] vhci_hcd: connection reset by peer [ 849.356033][T15247] vhci_hcd: connection closed [ 849.360755][T15251] vhci_hcd: connection closed [ 849.368310][ T9222] vhci_hcd: release socket [ 849.418480][ T9222] vhci_hcd: disconnect device [ 849.456304][ T9222] vhci_hcd: stop threads [ 849.476438][ T24] usb 3-1: USB disconnect, device number 39 [ 849.528517][ T9222] vhci_hcd: release socket [ 849.582405][ T9222] vhci_hcd: disconnect device [ 849.594354][ T9222] vhci_hcd: stop threads [ 849.599228][ T9222] vhci_hcd: release socket [ 849.604642][ T9222] vhci_hcd: disconnect device [ 849.611853][ T9222] vhci_hcd: stop threads [ 849.629773][ T9222] vhci_hcd: release socket [ 849.640459][ T9222] vhci_hcd: disconnect device [ 849.665083][ T9222] vhci_hcd: stop threads [ 849.685440][ T44] usb usb40-port1: attempt power cycle [ 849.690991][ T9222] vhci_hcd: release socket [ 849.701713][ T9222] vhci_hcd: disconnect device [ 849.790280][ T9222] vhci_hcd: stop threads [ 849.795964][ T9222] vhci_hcd: release socket [ 849.802016][ T9222] vhci_hcd: disconnect device [ 849.920972][T15277] SET target dimension over the limit! [ 849.941916][T15259] vhci_hcd: connection closed [ 849.942466][ T9227] vhci_hcd: stop threads [ 849.957419][ T9227] vhci_hcd: release socket [ 849.962116][ T9227] vhci_hcd: disconnect device [ 850.296466][ T44] usb usb40-port1: unable to enumerate USB device [ 850.598372][T15288] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 850.679138][T15288] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 851.789065][T15293] bridge0: entered promiscuous mode [ 851.795825][T15293] macvlan2: entered promiscuous mode [ 852.359355][T15307] program syz.2.2691 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 852.620557][T15317] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 852.620590][T15317] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 852.622515][T15317] vhci_hcd vhci_hcd.0: Device attached [ 852.626737][T15317] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(11) [ 852.626766][T15317] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 852.626810][T15317] vhci_hcd vhci_hcd.0: Device attached [ 852.628944][T15317] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 852.638077][T15317] vhci_hcd vhci_hcd.0: pdev(1) rhport(3) sockfd(16) [ 852.638103][T15317] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 852.638202][T15317] vhci_hcd vhci_hcd.0: Device attached [ 852.639887][T15317] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 852.649206][T15317] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(20) [ 852.649232][T15317] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 852.649370][T15317] vhci_hcd vhci_hcd.0: Device attached [ 852.651045][T15317] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 852.662736][T15317] vhci_hcd vhci_hcd.0: pdev(1) rhport(6) sockfd(24) [ 852.662763][T15317] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 852.662802][T15317] vhci_hcd vhci_hcd.0: Device attached [ 852.702490][T15317] vhci_hcd vhci_hcd.0: pdev(1) rhport(7) sockfd(29) [ 852.702521][T15317] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 852.702659][T15317] vhci_hcd vhci_hcd.0: Device attached [ 852.707285][T15329] vhci_hcd: connection closed [ 852.708310][T15326] vhci_hcd: connection closed [ 852.709128][T15324] vhci_hcd: connection closed [ 852.709934][ T37] vhci_hcd: stop threads [ 852.709950][ T37] vhci_hcd: release socket [ 852.709963][ T37] vhci_hcd: disconnect device [ 852.711198][ T37] vhci_hcd: stop threads [ 852.711212][ T37] vhci_hcd: release socket [ 852.711228][ T37] vhci_hcd: disconnect device [ 852.711457][ T37] vhci_hcd: stop threads [ 852.711468][ T37] vhci_hcd: release socket [ 852.711473][T15322] vhci_hcd: connection closed [ 852.711484][ T37] vhci_hcd: disconnect device [ 852.711948][ T37] vhci_hcd: stop threads [ 852.711960][ T37] vhci_hcd: release socket [ 852.711975][ T37] vhci_hcd: disconnect device [ 852.720902][T15318] vhci_hcd: connection closed [ 852.726151][T15320] vhci_hcd: connection closed [ 852.969384][ T1100] vhci_hcd: stop threads [ 852.969405][ T1100] vhci_hcd: release socket [ 852.969492][ T1100] vhci_hcd: disconnect device [ 853.014517][ T44] vhci_hcd: vhci_device speed not set [ 853.058821][ T9227] vhci_hcd: stop threads [ 853.075050][ T9227] vhci_hcd: release socket [ 853.082624][ T9227] vhci_hcd: disconnect device [ 853.224621][ T5883] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 853.268668][T15334] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2695'. [ 853.405167][ T5883] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 853.420588][ T5883] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 853.473085][ T5883] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 853.506825][ T5883] usb 5-1: New USB device found, idVendor=07c9, idProduct=0012, bcdDevice=c2.f4 [ 853.520551][ T5883] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 853.543217][ T5883] usb 5-1: Product: syz [ 853.556154][ T5883] usb 5-1: Manufacturer: syz [ 853.576832][ T5883] usb 5-1: SerialNumber: syz [ 853.593069][ T5883] usb 5-1: config 0 descriptor?? [ 853.819805][ T5883] usb 5-1: USB disconnect, device number 14 [ 854.013490][ T5889] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 854.063605][ T5907] vhci_hcd: vhci_device speed not set [ 854.176430][ T5889] usb 2-1: config 0 has no interfaces? [ 854.195788][ T5889] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 854.206175][ T5889] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 854.214543][ T5889] usb 2-1: Product: syz [ 854.218933][ T5889] usb 2-1: Manufacturer: syz [ 854.234532][ T5889] usb 2-1: SerialNumber: syz [ 854.256927][ T5889] usb 2-1: config 0 descriptor?? [ 854.516239][T15358] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2704'. [ 854.576737][T15343] Invalid logical block size (-1) [ 854.585440][ T5889] usb 2-1: USB disconnect, device number 114 [ 855.042451][T15376] binder: BINDER_SET_CONTEXT_MGR already set [ 855.049497][T15376] binder: 15374:15376 ioctl 4018620d 200000000040 returned -16 [ 855.148766][T15380] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 855.155358][T15380] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 855.164461][ T44] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 855.226764][T15383] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(12) [ 855.233436][T15383] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 855.245804][T15383] vhci_hcd vhci_hcd.0: Device attached [ 855.302797][T15380] vhci_hcd vhci_hcd.0: Device attached [ 855.303081][T15383] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 855.326121][T15383] vhci_hcd vhci_hcd.0: pdev(1) rhport(3) sockfd(17) [ 855.332783][T15383] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 855.342809][T11551] usb usb42-port1: attempt power cycle [ 855.368632][ T44] usb 5-1: config 0 has no interfaces? [ 855.379325][ T44] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 855.383884][T15383] vhci_hcd vhci_hcd.0: Device attached [ 855.394384][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 855.413565][ T44] usb 5-1: Product: syz [ 855.418047][ T44] usb 5-1: Manufacturer: syz [ 855.425020][ T44] usb 5-1: SerialNumber: syz [ 855.432285][T15380] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 855.437235][ T44] usb 5-1: config 0 descriptor?? [ 855.446372][ T5883] vhci_hcd: vhci_device speed not set [ 855.503542][ T5883] usb 35-1: new full-speed USB device number 5 using vhci_hcd [ 855.516254][T15391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 855.528104][T15391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 855.538305][T15380] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 856.238495][T15380] vhci_hcd vhci_hcd.0: pdev(1) rhport(6) sockfd(25) [ 856.245137][T15380] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 856.307323][T15383] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(22) [ 856.314004][T15383] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 856.316195][T11551] usb usb42-port1: unable to enumerate USB device [ 856.343299][T15380] vhci_hcd vhci_hcd.0: Device attached [ 856.417451][T15383] vhci_hcd vhci_hcd.0: Device attached [ 856.449263][T15395] vhci_hcd vhci_hcd.0: pdev(1) rhport(7) sockfd(30) [ 856.455913][T15395] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 856.483684][T15395] vhci_hcd vhci_hcd.0: Device attached [ 856.494797][T15394] vhci_hcd: connection closed [ 856.496084][T15384] vhci_hcd: connection closed [ 856.497364][T15393] vhci_hcd: connection closed [ 856.500871][ T9227] vhci_hcd: stop threads [ 856.505764][T15381] vhci_hcd: connection reset by peer [ 856.521094][T15386] vhci_hcd: connection closed [ 856.544282][ T9227] vhci_hcd: release socket [ 856.564410][T15403] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2711'. [ 856.575112][ T9227] vhci_hcd: disconnect device [ 856.586370][ T9227] vhci_hcd: stop threads [ 856.605459][ T30] audit: type=1326 audit(1748799207.069:694): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15402 comm="syz.0.2711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f186ff8e969 code=0x7ffc0000 [ 856.637250][ T9227] vhci_hcd: release socket [ 856.654908][T15373] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 856.667765][T15373] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 856.701309][T15403] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2711'. [ 856.712128][ T9227] vhci_hcd: disconnect device [ 856.723839][T15373] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 856.740680][T15405] fuse: Unknown parameter '' [ 856.746891][T15403] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2711'. [ 856.760517][ T9227] vhci_hcd: stop threads [ 856.766106][ T30] audit: type=1326 audit(1748799207.079:695): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15402 comm="syz.0.2711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f186ff8e969 code=0x7ffc0000 [ 856.800149][ T9227] vhci_hcd: release socket [ 856.804069][T15403] netlink: 'syz.0.2711': attribute type 19 has an invalid length. [ 856.825926][T15403] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 856.835423][T15403] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 856.844395][T15403] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 856.853216][T15403] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 856.867105][ T9227] vhci_hcd: disconnect device [ 856.876611][ T9227] vhci_hcd: stop threads [ 856.881097][ T9227] vhci_hcd: release socket [ 856.896841][ T9227] vhci_hcd: disconnect device [ 856.901775][ T30] audit: type=1326 audit(1748799207.079:696): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15402 comm="syz.0.2711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f186ff8e969 code=0x7ffc0000 [ 856.926015][ T9227] vhci_hcd: stop threads [ 856.930405][ T9227] vhci_hcd: release socket [ 856.938312][ T9227] vhci_hcd: disconnect device [ 856.949369][ T30] audit: type=1326 audit(1748799207.109:697): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15402 comm="syz.0.2711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f186ff8e969 code=0x7ffc0000 [ 857.007295][ T30] audit: type=1326 audit(1748799207.109:698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15402 comm="syz.0.2711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f186ff8e969 code=0x7ffc0000 [ 857.086951][T15400] vhci_hcd: connection closed [ 857.089010][ T1058] vhci_hcd: stop threads [ 857.100005][ T1058] vhci_hcd: release socket [ 857.110371][ T1058] vhci_hcd: disconnect device [ 857.502929][ T30] audit: type=1326 audit(1748799207.109:699): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15402 comm="syz.0.2711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f186ff8e969 code=0x7ffc0000 [ 857.592053][T15415] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2714'. [ 857.606130][ T30] audit: type=1326 audit(1748799207.109:700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15402 comm="syz.0.2711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f186ff8e969 code=0x7ffc0000 [ 857.702581][ T30] audit: type=1326 audit(1748799207.109:701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15402 comm="syz.0.2711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f186ff8e969 code=0x7ffc0000 [ 857.754682][ T30] audit: type=1326 audit(1748799207.119:702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15402 comm="syz.0.2711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f186ff8e969 code=0x7ffc0000 [ 857.949594][T15406] delete_channel: no stack [ 857.980703][ T30] audit: type=1326 audit(1748799207.119:703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15402 comm="syz.0.2711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f186ff8e969 code=0x7ffc0000 [ 858.741618][T15430] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2717'. [ 858.761033][T15429] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 858.815341][T15429] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 858.827675][T15429] CIFS: VFS: Malformed UNC in devname [ 859.075372][T15436] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2721'. [ 859.322517][ T44] usb 5-1: USB disconnect, device number 15 [ 860.664753][ T5883] vhci_hcd: vhci_device speed not set [ 860.999456][T15461] fuse: Unknown parameter '000000000000000000000030x0000000000000003' [ 861.693655][ T5907] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 862.024815][ T5907] usb 5-1: config 0 has no interfaces? [ 862.047169][T11551] usb usb36-port1: attempt power cycle [ 862.051278][ T5907] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 862.082543][ T5907] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 862.125143][T15477] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2732'. [ 862.131503][ T5907] usb 5-1: Product: syz [ 862.142683][ T5907] usb 5-1: Manufacturer: syz [ 862.164640][ T5907] usb 5-1: SerialNumber: syz [ 862.449609][ T5907] usb 5-1: config 0 descriptor?? [ 862.684095][ T44] usb 1-1: new full-speed USB device number 33 using dummy_hcd [ 862.749018][T11551] usb usb36-port1: unable to enumerate USB device [ 862.763516][T13761] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 862.994370][T13761] usb 3-1: config 0 has no interfaces? [ 863.012019][T13761] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 863.041059][T13761] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 863.059751][T13761] usb 3-1: Product: syz [ 863.095385][T13761] usb 3-1: Manufacturer: syz [ 863.110265][ T44] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 863.123712][ T5907] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 863.133775][T13761] usb 3-1: SerialNumber: syz [ 863.182325][ T44] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFC, changing to 0x8C [ 863.227161][T13761] usb 3-1: config 0 descriptor?? [ 863.247373][ T44] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8C has invalid wMaxPacketSize 0 [ 863.273681][ T5907] usb 2-1: Using ep0 maxpacket: 8 [ 863.291309][ T5907] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 863.301939][ T5907] usb 2-1: config 179 has no interface number 0 [ 863.334105][ T44] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 863.377593][ T5907] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 863.409700][ T5907] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 863.474832][ T44] usb 1-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 863.506211][ T44] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 863.522957][ T5907] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 863.567761][ T44] usb 1-1: Product: syz [ 863.584796][ T5907] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 863.609461][ T5907] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 863.626513][ T44] usb 1-1: Manufacturer: syz [ 863.631153][ T44] usb 1-1: SerialNumber: syz [ 863.654532][ T44] usb 1-1: config 0 descriptor?? [ 863.673261][ T44] xbox_remote_probe: Unexpected endpoint_in [ 864.342798][T15483] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 864.364321][ T5907] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 864.402655][T15483] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 864.415367][T15485] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 864.434986][T15485] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 864.444184][T15485] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 864.506985][ T5907] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 864.530104][T15492] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 864.542744][ T5907] xpad 2-1:179.65: probe with driver xpad failed with error -5 [ 864.761731][T15500] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 864.788782][T15500] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 864.797191][ T44] usb 2-1: USB disconnect, device number 115 [ 865.026527][T11551] usb 5-1: USB disconnect, device number 16 [ 865.228109][ T44] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 865.403602][ T44] usb 2-1: Using ep0 maxpacket: 32 [ 865.413113][ T44] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 865.425766][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 865.491001][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 865.544581][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 865.561628][ T44] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 865.571323][ T44] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 865.583686][ T44] usb 2-1: Product: syz [ 865.588032][ T44] usb 2-1: Manufacturer: syz [ 865.592792][ T44] usb 2-1: SerialNumber: syz [ 865.597859][T11551] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 865.713544][ T5907] usb 3-1: USB disconnect, device number 40 [ 865.731185][ T44] usb 2-1: config 0 descriptor?? [ 865.843654][T11551] usb 5-1: device descriptor read/64, error -71 [ 865.956471][ T5907] usb 2-1: USB disconnect, device number 116 [ 866.002359][T15512] batadv1: entered promiscuous mode [ 866.083542][T11551] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 866.138940][T15514] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2743'. [ 866.201005][T15516] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(9) [ 866.207551][T15516] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 866.218814][T11551] usb 5-1: device descriptor read/64, error -71 [ 866.225466][T15516] vhci_hcd vhci_hcd.0: Device attached [ 866.240287][T15516] vhci_hcd vhci_hcd.0: pdev(2) rhport(1) sockfd(11) [ 866.246908][T15516] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 866.259214][T15516] vhci_hcd vhci_hcd.0: Device attached [ 866.267178][T15516] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 866.280398][T15516] vhci_hcd vhci_hcd.0: pdev(2) rhport(3) sockfd(15) [ 866.287039][T15516] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 866.295883][T15516] vhci_hcd vhci_hcd.0: Device attached [ 866.306084][T15516] vhci_hcd vhci_hcd.0: pdev(2) rhport(4) sockfd(17) [ 866.312712][T15516] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 866.320758][T15516] vhci_hcd vhci_hcd.0: Device attached [ 866.328607][T15516] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 866.334938][T11551] usb usb5-port1: attempt power cycle [ 866.348625][T15516] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(21) [ 866.355259][T15516] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 866.368718][T15516] vhci_hcd vhci_hcd.0: Device attached [ 866.375651][T15516] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 866.389652][T15516] vhci_hcd vhci_hcd.0: pdev(2) rhport(7) sockfd(25) [ 866.396281][T15516] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 866.409294][T15516] vhci_hcd vhci_hcd.0: Device attached [ 866.413609][ T44] vhci_hcd: vhci_device speed not set [ 866.436665][T15516] vhci_hcd vhci_hcd.0: port 0 already used [ 866.446222][T15527] vhci_hcd: connection closed [ 866.446623][T15525] vhci_hcd: connection closed [ 866.447319][T15523] vhci_hcd: connection closed [ 866.451369][ T9227] vhci_hcd: stop threads [ 866.458596][T15519] vhci_hcd: connection closed [ 866.461599][T15517] vhci_hcd: connection closed [ 866.481441][T15521] vhci_hcd: connection closed [ 866.489121][ T44] usb 37-1: new full-speed USB device number 4 using vhci_hcd [ 866.491329][ T9227] vhci_hcd: release socket [ 866.509014][T15518] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 866.516239][ T9227] vhci_hcd: disconnect device [ 866.524766][ T9227] vhci_hcd: stop threads [ 866.529903][ T9227] vhci_hcd: release socket [ 866.535335][ T9227] vhci_hcd: disconnect device [ 866.540406][ T9227] vhci_hcd: stop threads [ 866.545624][ T9227] vhci_hcd: release socket [ 866.550274][ T9227] vhci_hcd: disconnect device [ 866.562471][ T9227] vhci_hcd: stop threads [ 866.567583][ T9227] vhci_hcd: release socket [ 866.572796][ T9227] vhci_hcd: disconnect device [ 866.587561][ T9227] vhci_hcd: stop threads [ 866.591929][ T9227] vhci_hcd: release socket [ 866.597805][ T9227] vhci_hcd: disconnect device [ 866.602700][ T9227] vhci_hcd: stop threads [ 866.606346][T15532] FAULT_INJECTION: forcing a failure. [ 866.606346][T15532] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 866.608318][ T9227] vhci_hcd: release socket [ 866.620572][T15532] CPU: 1 UID: 0 PID: 15532 Comm: syz.1.2745 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 866.620602][T15532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 866.620617][T15532] Call Trace: [ 866.620627][T15532] [ 866.620638][T15532] dump_stack_lvl+0x189/0x250 [ 866.620678][T15532] ? __pfx____ratelimit+0x10/0x10 [ 866.620707][T15532] ? __pfx_dump_stack_lvl+0x10/0x10 [ 866.620741][T15532] ? __pfx__printk+0x10/0x10 [ 866.620765][T15532] ? __might_fault+0xb0/0x130 [ 866.620811][T15532] should_fail_ex+0x414/0x560 [ 866.620847][T15532] _copy_from_user+0x2d/0xb0 [ 866.620872][T15532] kstrtouint_from_user+0xc4/0x170 [ 866.620908][T15532] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 866.620960][T15532] proc_fail_nth_write+0x88/0x240 [ 866.620985][T15532] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 866.621017][T15532] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 866.621045][T15532] vfs_write+0x27e/0xa90 [ 866.621086][T15532] ? __pfx_vfs_write+0x10/0x10 [ 866.621118][T15532] ? __fget_files+0x2a/0x420 [ 866.621146][T15532] ? __fget_files+0x3a0/0x420 [ 866.621165][T15532] ? __fget_files+0x2a/0x420 [ 866.621196][T15532] ksys_write+0x145/0x250 [ 866.621225][T15532] ? __fget_files+0x3a0/0x420 [ 866.621247][T15532] ? __pfx_ksys_write+0x10/0x10 [ 866.621284][T15532] ? do_syscall_64+0xbe/0x3b0 [ 866.621317][T15532] do_syscall_64+0xfa/0x3b0 [ 866.621343][T15532] ? lockdep_hardirqs_on+0x9c/0x150 [ 866.621369][T15532] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 866.621391][T15532] ? clear_bhb_loop+0x60/0xb0 [ 866.621430][T15532] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 866.621450][T15532] RIP: 0033:0x7fa86e38d41f [ 866.621469][T15532] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 866.621492][T15532] RSP: 002b:00007fa86f12e030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 866.621515][T15532] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa86e38d41f [ 866.621530][T15532] RDX: 0000000000000001 RSI: 00007fa86f12e0a0 RDI: 0000000000000004 [ 866.621550][T15532] RBP: 00007fa86f12e090 R08: 0000000000000000 R09: 0000000000000000 [ 866.621564][T15532] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 866.621576][T15532] R13: 0000000000000000 R14: 00007fa86e5b5fa0 R15: 00007fa86e6dfa28 [ 866.621611][T15532] [ 866.882542][T11551] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 866.905197][T11551] usb 5-1: device descriptor read/8, error -71 [ 866.964110][ T5907] usb 1-1: USB disconnect, device number 33 [ 867.012126][T15534] 8021q: VLANs not supported on ip6_vti0 [ 867.021527][ T9227] vhci_hcd: disconnect device [ 867.068297][T15537] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2746'. [ 867.147396][T11551] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 867.185246][T11551] usb 5-1: device descriptor read/8, error -71 [ 867.315871][T11551] usb usb5-port1: unable to enumerate USB device [ 867.432560][T15555] netlink: 'syz.2.2751': attribute type 23 has an invalid length. [ 867.472668][T15555] xt_hashlimit: max too large, truncated to 1048576 [ 867.483766][T15555] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 867.577865][T15558] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 867.588066][T15558] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 867.598318][T15558] [ 867.600674][T15558] ============================================ [ 867.606828][T15558] WARNING: possible recursive locking detected [ 867.612984][T15558] 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 Not tainted [ 867.619742][T15558] -------------------------------------------- [ 867.625890][T15558] syz.1.2750/15558 is trying to acquire lock: [ 867.631949][T15558] ffff88805a35cd30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: __netdev_update_features+0xcb1/0x1a20 [ 867.642931][T15558] [ 867.642931][T15558] but task is already holding lock: [ 867.650307][T15558] ffff88805a35cd30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: dev_ethtool+0x716/0x1990 [ 867.660177][T15558] and the lock comparison function returns 0: [ 867.666251][T15558] [ 867.666251][T15558] other info that might help us debug this: [ 867.674315][T15558] Possible unsafe locking scenario: [ 867.674315][T15558] [ 867.681774][T15558] CPU0 [ 867.685060][T15558] ---- [ 867.688339][T15558] lock(&dev_instance_lock_key#20); [ 867.693654][T15558] lock(&dev_instance_lock_key#20); [ 867.698958][T15558] [ 867.698958][T15558] *** DEADLOCK *** [ 867.698958][T15558] [ 867.707191][T15558] May be due to missing lock nesting notation [ 867.707191][T15558] [ 867.715515][T15558] 2 locks held by syz.1.2750/15558: [ 867.720707][T15558] #0: ffffffff8f50b248 (rtnl_mutex){+.+.}-{4:4}, at: dev_ethtool+0x1d0/0x1990 [ 867.729684][T15558] #1: ffff88805a35cd30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: dev_ethtool+0x716/0x1990 [ 867.739973][T15558] [ 867.739973][T15558] stack backtrace: [ 867.745861][T15558] CPU: 0 UID: 0 PID: 15558 Comm: syz.1.2750 Not tainted 6.15.0-syzkaller-10769-g7d4e49a77d99 #0 PREEMPT(full) [ 867.745884][T15558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 867.745896][T15558] Call Trace: [ 867.745905][T15558] [ 867.745914][T15558] dump_stack_lvl+0x189/0x250 [ 867.745944][T15558] ? __pfx_dump_stack_lvl+0x10/0x10 [ 867.745970][T15558] ? __pfx__printk+0x10/0x10 [ 867.745988][T15558] ? print_lock_name+0xde/0x100 [ 867.746005][T15558] print_deadlock_bug+0x28b/0x2a0 [ 867.746030][T15558] validate_chain+0x1a3f/0x2140 [ 867.746053][T15558] ? rcu_is_watching+0x15/0xb0 [ 867.746074][T15558] ? trace_sched_exit_tp+0x38/0x120 [ 867.746091][T15558] ? __schedule+0x1713/0x4d00 [ 867.746115][T15558] __lock_acquire+0xab9/0xd20 [ 867.746136][T15558] ? __netdev_update_features+0xcb1/0x1a20 [ 867.746154][T15558] lock_acquire+0x120/0x360 [ 867.746173][T15558] ? __netdev_update_features+0xcb1/0x1a20 [ 867.746196][T15558] __mutex_lock+0x182/0xe80 [ 867.746223][T15558] ? __netdev_update_features+0xcb1/0x1a20 [ 867.746240][T15558] ? rcu_is_watching+0x15/0xb0 [ 867.746260][T15558] ? trace_irq_disable+0x37/0x110 [ 867.746278][T15558] ? preempt_schedule_irq+0xde/0x150 [ 867.746298][T15558] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 867.746318][T15558] ? __netdev_update_features+0xcb1/0x1a20 [ 867.746337][T15558] ? __pfx___mutex_lock+0x10/0x10 [ 867.746362][T15558] ? __netdev_update_features+0xb6a/0x1a20 [ 867.746382][T15558] __netdev_update_features+0xcb1/0x1a20 [ 867.746401][T15558] ? arch_scale_cpu_capacity+0x18/0xb0 [ 867.746427][T15558] ? __pfx___netdev_update_features+0x10/0x10 [ 867.746450][T15558] ? rcu_is_watching+0x15/0xb0 [ 867.746472][T15558] ? trace_sched_exit_tp+0x38/0x120 [ 867.746489][T15558] ? __schedule+0x1713/0x4d00 [ 867.746512][T15558] netdev_change_features+0x72/0xd0 [ 867.746529][T15558] ? __pfx_netdev_change_features+0x10/0x10 [ 867.746546][T15558] ? cfg80211_netdev_notifier_call+0x1ea/0x13c0 [ 867.746565][T15558] ? __pfx___schedule+0x10/0x10 [ 867.746582][T15558] ? netif_set_tso_max_size+0x10e/0x1d0 [ 867.746599][T15558] bond_compute_features+0x615/0x680 [ 867.746626][T15558] ? __pfx_bond_compute_features+0x10/0x10 [ 867.746652][T15558] bond_netdev_event+0x72e/0xe80 [ 867.746672][T15558] ? __pfx_bond_netdev_event+0x10/0x10 [ 867.746693][T15558] ? igmp_netdev_event+0x7c/0x770 [ 867.746712][T15558] ? xfrm_dev_event+0x2f1/0x390 [ 867.746736][T15558] notifier_call_chain+0x1b6/0x3e0 [ 867.746761][T15558] netdev_features_change+0x85/0xc0 [ 867.746783][T15558] ? __pfx_netdev_features_change+0x10/0x10 [ 867.746806][T15558] ? security_capable+0x7e/0x2e0 [ 867.746829][T15558] dev_ethtool+0x1520/0x1990 [ 867.746852][T15558] ? __pfx_dev_ethtool+0x10/0x10 [ 867.746875][T15558] ? dev_load+0x21/0x1f0 [ 867.746909][T15558] dev_ioctl+0x392/0x1150 [ 867.746932][T15558] sock_do_ioctl+0x22c/0x300 [ 867.746952][T15558] ? __pfx_sock_do_ioctl+0x10/0x10 [ 867.746970][T15558] ? __lock_acquire+0xab9/0xd20 [ 867.746994][T15558] sock_ioctl+0x576/0x790 [ 867.747012][T15558] ? __pfx_sock_ioctl+0x10/0x10 [ 867.747030][T15558] ? __fget_files+0x2a/0x420 [ 867.747045][T15558] ? __fget_files+0x3a0/0x420 [ 867.747058][T15558] ? __fget_files+0x2a/0x420 [ 867.747074][T15558] ? bpf_lsm_file_ioctl+0x9/0x20 [ 867.747094][T15558] ? __pfx_sock_ioctl+0x10/0x10 [ 867.747111][T15558] __se_sys_ioctl+0xfc/0x170 [ 867.747132][T15558] do_syscall_64+0xfa/0x3b0 [ 867.747152][T15558] ? lockdep_hardirqs_on+0x9c/0x150 [ 867.747170][T15558] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 867.747186][T15558] ? clear_bhb_loop+0x60/0xb0 [ 867.747203][T15558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 867.747225][T15558] RIP: 0033:0x7fa86e38e969 [ 867.747241][T15558] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 867.747256][T15558] RSP: 002b:00007fa86b98f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 867.747273][T15558] RAX: ffffffffffffffda RBX: 00007fa86e5b6320 RCX: 00007fa86e38e969 [ 867.747286][T15558] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 0000000000000006 [ 867.747297][T15558] RBP: 00007fa86e410ab1 R08: 0000000000000000 R09: 0000000000000000 [ 867.747307][T15558] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 867.747318][T15558] R13: 0000000000000000 R14: 00007fa86e5b6320 R15: 00007fa86e6dfa28 [ 867.747336][T15558] [ 868.346506][T15560] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2754'. [ 871.587536][ T44] vhci_hcd: vhci_device speed not set [ 872.865643][T13761] usb usb38-port1: attempt power cycle [ 873.434643][T13761] usb usb38-port1: unable to enumerate USB device [ 875.515933][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 875.522290][ T1301] ieee802154 phy1 wpan1: encryption failed: -22