last executing test programs: 1m18.20452109s ago: executing program 4 (id=539): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x9da, 0xa, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x70, 0x0, [{{0x9, 0x4, 0x0, 0x5, 0x7, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x8, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x6, 0x98, 0xfc}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='auxv\x00') read$FUSE(r1, &(0x7f0000000340)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioprio_get$pid(0x2, r2) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x14, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0xa, {[@global=@item_012={0x1, 0x1, 0x8, "1f"}, @main=@item_012={0x2, 0x0, 0x8, 'Q;'}, @local=@item_4={0x3, 0x2, 0x2, "15ca5a8d"}]}}, 0x0}, 0x0) (async) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x14, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0xa, {[@global=@item_012={0x1, 0x1, 0x8, "1f"}, @main=@item_012={0x2, 0x0, 0x8, 'Q;'}, @local=@item_4={0x3, 0x2, 0x2, "15ca5a8d"}]}}, 0x0}, 0x0) syz_usb_connect$lan78xx(0x4, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) (async) r3 = syz_usb_connect$lan78xx(0x4, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r3, &(0x7f0000000180)={0xc, &(0x7f00000000c0)={0x40, 0x1, 0xa9, {0xa9, 0x7, "639e9268ad3f1016c58604f2202d9d79a7b714b606f02bd7e5cdd2f8fa0b39438630cf3ce50ac9b913d21323d82a458ca39f4c4912263c67e555af67cf79eb725d33e9a20882b29f3eaf05fb431139fe2722165853d8364fa1349b18f3a1ae7c9393a861953432389295533f41b5c2bc93b78aa31867fb22ba11ad84a51c4ab83507fbcb2217daf8ebc6245ef4954c69ae81b6c691542fe1c15e33b3ca226a825c1240cc42ee32"}}, &(0x7f0000000200)={0x0, 0x3, 0xe4, @string={0xe4, 0x3, "bbfd2407eaa0a07797ad02ccbdb4946ebc746f8720505fe31a8749ca5fd053521185cf59ac62b7ee63d9b5882064764898b028a5db8a12ccf6987b428b1f3c857c54250e620a6d599b39d9eb1fe4bf00c69bd5d4ce82e99d0dc99313ef8eb2fb1330015a5fd151340365e969cc31de5fea7f7436f01b05ab9b0c4c0e9bb58cc13f6fd1cf48f332a98490a34e9cde7f8bcc356f54147439a049fa8663b4f5f9aee7e9441e1cbe4631dbbc4f35c852c0d63b40f18c04ad3dc02ab123f4a31f1216d08addee1140d20ee123c6ad5fc03e28af272f15be871d32974f4527c9b9e6cc51e8"}}}, &(0x7f00000004c0)={0x1c, &(0x7f0000000300)={0x20, 0x10, 0x6f, "f80630476fb29fb3f4499a615ea626a9678555d8700cb93d8e68a099319a9d24ba3205b847d0ef7b317cdab66ea29ca4026d73cf367e7659e8f54298e4b437878624ebc164a69cfd81e58180921a0bfa55d1bf29bf330a89c716cd5c9841b3bc804223f4f818cdac9a369cb7b85a05"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x81}, &(0x7f0000000400)={0xc0, 0xa1, 0x4, 0xfffffffa}, &(0x7f0000000440)={0x40, 0xa0, 0x4, 0xc7f}, &(0x7f0000000480)={0xc0, 0xa2, 0x2f, "e2a6ccf429450de1b918783db1fddefd2f6b55e60a9794197efc062f68ddd218bbeee075df1ea845403a0f00d7d967"}}) 1m14.951621005s ago: executing program 4 (id=553): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001b80)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x6, 0x7}, {}, {0xa, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x40010) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r6, {0xc, 0xc}, {0x73, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 1m14.611065459s ago: executing program 4 (id=555): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='blkio.bfq.empty_time\x00', 0x26e1, 0x0) fstatfs(r0, &(0x7f0000000000)=""/47) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) syz_io_uring_setup(0x74d, &(0x7f0000000100)={0x0, 0x59c4, 0x8, 0x1000, 0x5cc}, 0x0, 0x0) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) 1m14.393088661s ago: executing program 4 (id=556): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0/file0\x00') chroot(&(0x7f00000001c0)='./file0/../file0/../file0/../file0\x00') 1m14.156197898s ago: executing program 4 (id=559): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r1, 0x29, 0x31, 0x0, &(0x7f00000000c0)) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3000000020000000fedbdf25020000000000000302000100140011006772653000"/44], 0x30}}, 0x0) (async) r2 = socket$vsock_stream(0x28, 0x1, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="480000001000010027bd7000fbdbdf2500000000", @ANYRES32=r2, @ANYBLOB="04040100000000001400030076657468315f746fdf626f6e6400000014001680100001800c000700fcffffff060000"], 0x48}, 0x1, 0x0, 0x0, 0x4000850}, 0x60000090) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f000000c300)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x4000000}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4}]}], {0x14}}, 0x64}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010003904000000000010000000000000", @ANYRES32=0x0, @ANYBLOB="01980000031300001c0012800900010069706970000000000c00028008000300a4000001"], 0x3c}}, 0x4040014) 1m13.516029139s ago: executing program 4 (id=561): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000005b574e69622bf85eda07b3"], 0x0}, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUCODE(r2, 0xc018480d, &(0x7f00000011c0)={0x3, 0x100, 0x0, 0x5, 0x590f, 0x2}) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f00000000c0)) 1m12.831125348s ago: executing program 32 (id=561): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000005b574e69622bf85eda07b3"], 0x0}, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUCODE(r2, 0xc018480d, &(0x7f00000011c0)={0x3, 0x100, 0x0, 0x5, 0x590f, 0x2}) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f00000000c0)) 9.419545878s ago: executing program 5 (id=785): syz_usb_connect(0x5, 0x1bb, &(0x7f0000000880)=ANY=[@ANYBLOB="12010000a677c120229062d60eb3000000010902a90101000000000904"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r0, 0x707, &(0x7f00000004c0)={&(0x7f0000000480)=[{0xfffb, 0x3001, 0x0, 0x0}], 0x1}) 8.078302392s ago: executing program 3 (id=787): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$sock_buf(r0, 0x1, 0x3d, &(0x7f00000002c0)=""/220, &(0x7f00000000c0)=0xdc) (async, rerun: 32) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x10000, @mcast2, 0x7}, 0x1c) (async, rerun: 32) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x6c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_TIMEOUT={0x8}, @CTA_HELP={0xc, 0x5, 0x0, 0x1, {0x8, 0x1, 'RAS\x00'}}]}, 0x6c}}, 0x80) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}}, 0x40000) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x2, 0x180, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x5, 0x0, 0x9, 0x0, 0x6, 0x0, 0xbdb], 0xffff1001, 0x120182}) (async) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000200)={0x0, 0x0, 0x300f}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async, rerun: 64) ioctl$KVM_RUN(r4, 0xae80, 0x0) (rerun: 64) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) (async) sendto$inet6(r0, &(0x7f0000000300), 0x16, 0x3b00, 0x0, 0xfffffffffffffdfd) 7.649638084s ago: executing program 5 (id=792): socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r0 = socket(0x1e, 0x1, 0x0) recvmmsg(r0, &(0x7f0000002700)=[{{0x0, 0xff54, 0x0}, 0x8000009}], 0x1, 0x40, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="0f0700000000fcffffff0c00000008000300", @ANYRES32], 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12015002eebc1240ac052a021b5701f5020109022400010d1f10a70904020502034a02ff0905021b284d0905090905040300"], &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x2c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="b40500000000000079108f00000000000500000000000000950000000000000078489f08c77bb3516e7171adaa4e23ce8183b003b906d0539215ad50a0aa1f84d2fb2517068dd2ec0a4290d328ab4e24726c9bf955cdee186fa93c8e9b398c09caf370bea08fc9f89bd18ba57d2c980b8457f6f0f0405c484edfee91d58f397a163ce37502061b171edb29b7725be06a3faa1c69ae47292a05c7a3da0bf9fd6c4f50f4276f4ed27de8c88ee40cdbc66000"/189], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x22e, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r8 = socket$packet(0x11, 0x3, 0x300) r9 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r9, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r9, 0x107, 0x1, &(0x7f0000000300)={r10, 0x1, 0x0, @broadcast}, 0x49) setsockopt$packet_add_memb(r9, 0x107, 0x1, &(0x7f0000000200)={r10, 0x11, 0x6, @random="bdf19b71a0f9"}, 0x10) sendmsg$nl_route(r6, &(0x7f0000000180)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c0000001800000125bd7000ffdbdf25801a8003ff03ff0a00220000080007000000000008000100ac1e0001080006006c06000008000300", @ANYRES32=r10, @ANYBLOB="08000500e000000208000400", @ANYRES32=r7, @ANYBLOB="a31706c5503964c30ff82bf8a34151c3fa704330"], 0x4c}, 0x1, 0x0, 0x0, 0x48080}, 0x4004035) dup3(r6, r4, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000009c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r12, {0x0, 0xd}, {0x6, 0xb}, {0xa, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_NAT={0x8, 0xb, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2001c061}, 0x4008000) sendto$packet(r8, &(0x7f0000000240)="800000800000210ee7decd7a0000", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0xd, r7, 0x1, 0xd8, 0x6, @broadcast}, 0x14) 6.915123887s ago: executing program 0 (id=793): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r4, 0x0, 0x40000000, 0xffffffffffffffff) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x92, 0x5, 0x6, 0x4}, 0x3a, [0x8000, 0x2c95a, 0xf, 0x8, 0x80, 0x1, 0x3, 0x80000000, 0x20000006, 0x4d, 0x6, 0x5d, 0x8, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x5, 0x3c5b, 0x1, 0x24, 0xd, 0x7, 0x0, 0x800, 0x4, 0x4, 0x7, 0x3, 0x8, 0x4c75, 0x80000000, 0x2, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x40017, 0x0, 0x7, 0x5, 0x3e, 0x3, 0x6, 0xffff, 0x0, 0x6, 0x4, 0x8008, 0x400, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x201, 0x40], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e6, 0x40c8, 0xf9, 0xe, 0x82c0, 0x6c7, 0x8, 0xfffffffc, 0x3, 0xfffffffc, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x5, 0xea4, 0x0, 0xb94, 0x7, 0x7fff, 0x1c000, 0x3fe, 0x403, 0x200006, 0x1, 0x9, 0x5, 0x1000005, 0x5f31, 0x2d, 0x4e4, 0x5, 0x4, 0xb, 0x2000004, 0x9, 0x80000001, 0x9, 0x6, 0x47, 0x8200, 0x1, 0xfe000000, 0x8, 0xffffffff, 0x4, 0x4, 0x3, 0x50, 0x9, 0x1, 0x3, 0x3, 0x81, 0x48c93690, 0x42, 0x3], [0x7, 0x407, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0xa2, 0x8000, 0x0, 0x5, 0xb, 0x5, 0x5, 0x5, 0x4000000, 0x1eb, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0xfffffffe, 0x3, 0x20000008, 0x4, 0x6d01, 0x2, 0x38, 0x800083, 0x200, 0x80, 0x3, 0x8000004, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x4005, 0x6, 0x6, 0xca, 0x1ff, 0x3, 0x7ff, 0xbe, 0x4, 0x7, 0xe, 0x0, 0x5, 0x1c, 0x8, 0x4, 0x8, 0x80a2ed, 0x4, 0x3c484551], [0x9, 0xbb33, 0x3, 0xb, 0x5, 0x2, 0x5, 0x3, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x9, 0x1, 0x101, 0x10000, 0x2000004, 0x7fff, 0xffff, 0xa620, 0x2, 0x2, 0x6, 0x8, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0xffffffd9, 0xfffff000, 0x10010000, 0x0, 0x7e, 0x9, 0x9602, 0x40007, 0xaf, 0x5, 0x6, 0x227, 0x2, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf3c, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x1, 0xb1e, 0x2000d7, 0x201, 0xffff3441, 0x4]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x100000000000000, &(0x7f0000000580)="b3"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f0000002880)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f0000003f80)=[{{&(0x7f0000000380)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000880)=""/88, 0x58}, {&(0x7f0000000900)=""/240, 0xf0}, {&(0x7f0000000a00)=""/227, 0xe3}, {&(0x7f0000001040)=""/4096, 0x1000}, {&(0x7f0000002e80)=""/4096, 0x1000}, {&(0x7f0000000b00)=""/202, 0xca}, {&(0x7f0000000c00)=""/165, 0xa5}], 0x7, &(0x7f0000000d00)=""/210, 0xd2}, 0x6}, {{&(0x7f0000000e00)=@in={0x2, 0x0, @multicast2}, 0x80, &(0x7f0000000f80)=[{&(0x7f0000000e80)=""/216, 0xd8}], 0x1}, 0x4}, {{&(0x7f0000002040)=@x25, 0x80, &(0x7f0000002280), 0x0, &(0x7f00000022c0)=""/135, 0x87}, 0x7f}, {{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000002380)=""/122, 0x7a}, {&(0x7f0000002400)=""/219, 0xdb}, {&(0x7f0000002500)=""/127, 0x7f}], 0x3, &(0x7f00000025c0)=""/117, 0x75}, 0x10000}, {{&(0x7f0000002640)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000002780)=[{&(0x7f00000026c0)=""/133, 0x85}], 0x1, &(0x7f0000006ac0)=""/4099, 0x1003}, 0x8}, {{&(0x7f00000027c0)=@phonet, 0x80, &(0x7f0000002a00)=[{&(0x7f0000002840)=""/21, 0x15}, {&(0x7f0000002900)=""/199, 0xc7}], 0x2}, 0x8}, {{&(0x7f0000002a40)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f0000003f40)=[{&(0x7f0000002ac0)=""/232, 0xe8}, {&(0x7f0000002bc0)=""/37, 0x25}, {&(0x7f00000020c0)=""/115, 0x73}, {&(0x7f0000002d40)=""/143, 0x8f}, {&(0x7f0000002e00)}, {&(0x7f0000003e80)=""/40, 0x28}, {&(0x7f0000003ec0)=""/117, 0x75}], 0x7, &(0x7f0000005ac0)=""/4096, 0x1000}, 0xf381}], 0x7, 0x2, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) r8 = syz_io_uring_setup(0x497, &(0x7f0000002c80)={0x0, 0xe3d3, 0x8, 0x800005, 0x1f0}, &(0x7f0000000440)=0x0, &(0x7f0000002d00)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r11 = socket(0x1d, 0x2, 0x6) getsockname$tipc(r11, 0x0, &(0x7f0000000180)) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r7, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000002e40)="f8", 0x1}], 0x1}, 0x0, 0x24000890, 0x1}) io_uring_enter(r8, 0x3516, 0x0, 0x41, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f0000000000), &(0x7f0000000040)=0x8) 6.451488219s ago: executing program 3 (id=795): r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000000)=""/102, &(0x7f0000000080)=0x66) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000000c0)={0x0, 0x0, 0x2, 0x0, '\x00', [{0x3, 0x1, 0x5, 0x2, 0x9, 0xffff}, {0x1000, 0xfe, 0x8, 0x6, 0x4, 0x81}], ['\x00', '\x00']}) r1 = openat$null(0xffffff9c, &(0x7f0000000200), 0x127600, 0x0) setsockopt$sock_timeval(r1, 0x1, 0xffb17c24d1840d78, &(0x7f0000000240), 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e24, @broadcast}], 0x20) ioctl$BLKTRACESETUP(r1, 0xc0401273, &(0x7f00000002c0)={'\x00', 0x3069, 0x2cae, 0xfffffffa, 0x2, 0xad, 0xffffffffffffffff}) r3 = syz_open_procfs(r2, &(0x7f0000000300)='net/ip_vs_stats\x00') ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r3, 0xc018937b, &(0x7f0000000340)={{0x1, 0x1, 0x18, r1, {0xffffffffffffffff}}, './file0\x00'}) ioctl$RFKILL_IOC_MAX_SIZE(r4, 0x2, &(0x7f0000000380)=0x1000) sendto$inet(r1, &(0x7f00000003c0)="be82744487e52c711638bf7928cce065ac363babee75c00c3d614451630d603a7f940ba90c3eecfdbdee52bd2d6d509fc5241f6e9cbc857e19818cefd765276a6977629ebea08b566cfb684ae21788574c6f8516d48939bb58e4cf69c9b2ae3389c41d3ffdf04d69d85627cc46997299517118485144d54f12bbe60fdd8620bad0a8063f65b29c4c10ed1e13bf1297ea8273e696c9d73f8bab58a1e24d62dd6923b93a9b30f8aa0d06c30f4593c46b41a02a40db8918df18e0c83bd7eca91041a919219ceb63b6", 0xc7, 0x20000000, &(0x7f00000004c0)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) mprotect(&(0x7f0000fef000/0x11000)=nil, 0x11000, 0x100000e) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000500)={0x0, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x4e21, @rand_addr=0x64010102}, {0x2, 0x4e24, @broadcast}, 0x1d3, 0x0, 0x0, 0x0, 0x2d2, 0x0, 0x5, 0x1000, 0x4}) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000, 0x2, &(0x7f0000ff4000/0x1000)=nil) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) remap_file_pages(&(0x7f0000ff3000/0x2000)=nil, 0x2000, 0x2000000, 0x81, 0x80000) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000580)={r1}, 0x8) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000600), r4) sendmsg$IPVS_CMD_NEW_SERVICE(r6, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xac, r7, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x50000000}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x60}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x9}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1000}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}]}, 0xac}}, 0x40000) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000940)={'wg2\x00', 0x0}) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=@bloom_filter={0x1e, 0x9, 0x1, 0x5, 0x0, 0x1, 0x5, '\x00', 0x0, r5, 0xcd3, 0x3, 0x2}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000b40)=@bpf_lsm={0x1d, 0x10, &(0x7f0000000780)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3447ed05, 0x0, 0x0, 0x0, 0x549b}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@jmp={0x5, 0x0, 0x7, 0x4, 0x7, 0x0, 0x10}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000800)='GPL\x00', 0xfffffff9, 0xf0, &(0x7f0000000840)=""/240, 0x41100, 0xb, '\x00', r8, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000980)={0x0, 0x4}, 0x8, 0x10, &(0x7f00000009c0)={0x4, 0xc, 0x10, 0x8}, 0x10, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000a80)=[r1, r9], &(0x7f0000000ac0)=[{0x3, 0x4, 0x0, 0x8}, {0x4, 0x2, 0x6, 0x4}, {0x4, 0x3, 0x7, 0x1}, {0x2, 0x5, 0xc, 0x3}, {0x4, 0x2, 0x8, 0xa}, {0x5, 0x5, 0x7, 0x5}, {0x4, 0x4, 0x1, 0x7}], 0x10, 0x80000000}, 0x94) write$UHID_CREATE2(r5, &(0x7f0000000c00)={0xb, {'syz1\x00', 'syz1\x00', 'syz1\x00', 0xbf, 0x1750, 0xe, 0x72, 0xa94, 0x6, "d8063e6f195fd69c2cae2eec30c743a7028bce5648789b676712c0fb7861f356e5f638bec5119611c2479883bf26abe8765d34642232956ebbc3e3240cd3206d6a3d966507180676c930e27ce57ca0a779cc4e6b7e6bb5e9ad7a3d267537e344999bbc6b946dcdae73695df2ac4419b72dc843ece70d7d65463b5c1907cd951befef4647be37a52b2df1a142a069de9d9b3a48e7220f6be4baeb0cc535168ed53767eab877396caa03bd2a60c74c0fc4613545c28b85bd69636a01464c0ca7"}}, 0x1d7) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000e00)) r10 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r10, 0x84, 0x16, &(0x7f0000000e40)={0x5, [0x31, 0x7, 0xa24, 0x1, 0x8000]}, 0xe) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000e80)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x56a, 0x32a, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x5, 0x0, 0x2, [{{0x9, 0x4, 0x0, 0x9, 0x2, 0x3, 0x1, 0x3, 0x3, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0xdea}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x8, 0x1, 0x3}}}}}]}}]}}, &(0x7f0000001280)={0xa, &(0x7f0000000ec0)={0xa, 0x6, 0x200, 0xb, 0x80, 0xb0, 0x40, 0xf8}, 0x22, &(0x7f0000000f00)={0x5, 0xf, 0x22, 0x5, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x6, 0x4, 0x3, 0x66e}, @ptm_cap={0x3}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x8, 0x67, 0x1, 0x112}]}, 0x8, [{0xbf, &(0x7f0000000f40)=@string={0xbf, 0x3, "073d6db76cf5da83d3fe89f03bd37a600e0434c22c1d4dea1b85d6ce749149e42bf226d78ffee4e8d898bb6622892e681a45cbbb53b69ce409ff7107198624f3e420ebf16136315a0e5b11d85269b57fd29b07ea67de022e0d02c1ffc8fe69a310986666d0857a6290f9266b934c8570ab2af98fbb5b4f7cde3b3c497b275353760bc11a6a4459e75a1a964561b33369911549c6b5ccd4a26227a960951a5387234f54207f65fdfd1c805e8c81d6ede91cdc26faca7f13e96ca357e95c"}}, {0x54, &(0x7f0000001000)=@string={0x54, 0x3, "18c094b572b21cc5985e7f76ce6f38f3aad9e6245fc36f79ab83be0300e5c36851eda4fc6f33ea19d6f46a6c620f8011a573a85306867802b4e5f6dad34f0c5b163ca222c02a57ebf418fd5f1e7ca04b2a55"}}, {0x4, &(0x7f0000001080)=@lang_id={0x4, 0x3, 0x843}}, {0x84, &(0x7f00000010c0)=@string={0x84, 0x3, "6950554cf2f9d2497bdbbdc77638522ee51f73da48e6fbe39fd4e45df17db05f66d004fe43f5c061a0a1335f3954294a862929e277761e9f95c40fa25de4fa63f66149b7f10bd4e554b1d6f6cafff54d0219e4d16b89c11f8bf50e0b1bd8e7ed61633f01b8a2162b7437a8c99abc910751d3f53490c7aea2c09160b0c14f0d3a735a"}}, {0x23, &(0x7f0000001180)=@string={0x23, 0x3, "f858103144dbb8eb5fd37b51ed827a7070da3503cf213e56198c7a3f7d7ced1758"}}, {0x4, &(0x7f00000011c0)=@lang_id={0x4, 0x3, 0x448}}, {0x1d, &(0x7f0000001200)=@string={0x1d, 0x3, "d4800f8e3efb9b1750ebb14bcafd204f5ce35df8f41b9fe2f92718"}}, {0x4, &(0x7f0000001240)=@lang_id={0x4}}]}) sendmsg$SMC_PNETID_GET(r4, &(0x7f00000013c0)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001380)={&(0x7f0000001340)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'nicvf0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x804}, 0x10) signalfd4(r5, &(0x7f0000001400)={[0x3, 0x3]}, 0x8, 0x80800) 5.845085105s ago: executing program 0 (id=799): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) close(0x3) r1 = userfaultfd(0x80400) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xc, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) syz_genetlink_get_family_id$batadv(&(0x7f0000002100), 0xffffffffffffffff) syz_genetlink_get_family_id$batadv(&(0x7f0000002180), 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') fchmod(r0, 0x138) syz_genetlink_get_family_id$nl80211(&(0x7f00000020c0), r2) read$FUSE(r2, &(0x7f00000021c0)={0x2020}, 0xde1) r3 = socket(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)=@newtaction={0x9c, 0x30, 0x300, 0x70bd28, 0x0, {}, [{0x88, 0x1, [@m_nat={0x84, 0xf, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x4, 0x3, 0x6, 0x9, 0xa}, @broadcast, @empty, 0xffffff00}}]}, {0x31, 0x6, "36d7227f21f087cf85c41cf5050b340b2e2153bfdaf6f0d4958f4f0c32ce2e993abb8ea906fc01d8bb3e594812"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x2}}}}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x4}, 0x40) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) r5 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc01cf509, &(0x7f0000000040)={r0, 0x0, 0x56a, 0xfffffffffffffffc}) syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x1e5901) socket$key(0xf, 0x3, 0x2) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000140)=r6, 0x4) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x400000b0, 0x0, 0x4002}]}) sendmsg$IPSET_CMD_CREATE(r3, 0x0, 0x4000010) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r3, 0x111, 0x2, 0x1, 0x4) openat$tcp_mem(0xffffff9c, &(0x7f0000002080)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) 5.296572374s ago: executing program 0 (id=800): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x403, 0x70bd2d, 0xfe0f, {0x0, 0x0, 0x0, 0x0, 0x215, 0x2140}, [@IFLA_LINK={0x8, 0x5, r1}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_MTU={0x8, 0x4, 0x5dc}]}, 0x4c}, 0x1, 0xba01}, 0x4000040) 5.126778258s ago: executing program 0 (id=802): syz_usb_connect(0x5, 0x1bb, &(0x7f0000000880)=ANY=[@ANYBLOB="12010000a677c120229062d60eb3000000010902a90101000000000904"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r0, 0x707, &(0x7f00000004c0)={&(0x7f0000000480)=[{0xfffb, 0x3001, 0x0, 0x0}], 0x1}) 4.762809632s ago: executing program 5 (id=806): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000400)={&(0x7f00000000c0)={0xa, 0x4e20, 0x0, @loopback={0xff00}, 0x4002}, 0x1c, 0x0, 0x0, &(0x7f0000000440)=[@dstopts_2292={{0x14, 0x29, 0x3b, {0x62}}}], 0x14}, 0x4004091) 4.702638028s ago: executing program 3 (id=807): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x80003, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) close(0x3) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000002c80)={0xa, 0x14e24}, 0x1c) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x85c3}}) io_uring_enter(0xffffffffffffffff, 0x32d7, 0x0, 0x46, 0x0, 0x0) 4.571002579s ago: executing program 5 (id=808): syz_emit_ethernet(0x35, &(0x7f0000000740)=ANY=[@ANYBLOB="0180c2000806030b0a000609000a0000000000009486478e29d807a024aaaaaaaaaa17dec20000000000000000000000000000000046c9ff78ca91dfc19c1082e95c0b3472d2747a84cd708c772bb00d8a911a4e4d2847b69e2cf89b619b33bf465995953ecabff921d27c1f2231f2496e4ee9dcb97db80944ff4e25341f02b6f9bc4aac8164ce1c4ebf9638f66ad1f6215a995c6469faa24a1fe8d24e28bcb702f2c14575aa670eff58477f5f"], 0x0) r0 = syz_open_dev$dri(&(0x7f0000009c00), 0x1, 0x8e00) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) tee(0xffffffffffffffff, r1, 0x3, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) recvmsg$unix(r3, &(0x7f0000001b40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x17}, 0x12000) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_attach_bpf(r5, 0x10f, 0x8a, &(0x7f0000000180)=r4, 0x4) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x15}}, 0x6}, 0x1c) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000180)='veth0_macvtap\x00', 0x10) r7 = fcntl$dupfd(r6, 0x0, r6) sendmsg$TIPC_NL_NAME_TABLE_GET(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4040011) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r7, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x7fff, @dev={0xfe, 0x80, '\x00', 0x1d}, 0x7}, @ib={0x1b, 0x9, 0xffffffff, {"306fcffa586bd190fcaa6963f7b1ebc8"}, 0x101, 0xfffffffffffffff0, 0x81}}}, 0x118) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0) fdatasync(r8) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@bloom_filter={0x1e, 0xffff8001, 0x4, 0x2, 0x3000c, 0xffffffffffffffff, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x1, 0xf}, 0x50) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="174725a2564c17b3080000c8a900000000000000", @ANYRES32, @ANYBLOB="0100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000020000000400"/28], 0x50) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)={0x1b, 0x0, 0x0, 0x3, 0x0, 0x1, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4}, 0x50) r12 = openat$nvme_fabrics(0xffffffffffffff9c, 0x0, 0x402, 0x0) r13 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r14 = fanotify_init(0x200, 0x0) fanotify_mark(r14, 0x1, 0x4800003e, r13, 0x0) renameat(r12, &(0x7f0000000240)='./file0\x00', r13, &(0x7f00000025c0)='./file0\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x1e, &(0x7f0000000580)=ANY=[@ANYBLOB="180000000a000000000000000400000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000004ce50c00040000001860000008000000000000000000280018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70200000000000085000000860000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008b7030000040000008500000006000000bf9100000000b7020000020000008540000084000000b70000000000000095000000000000000000982a24b3de4d8bcd0845d92740fcf6c54ee91275aab4d16a1ead528b006c08874feeb57c719e4207c846f9f45d0b44ccea0a6373409b12196385eb052ea99b8afadbcfd9b600aeffd12cd9bf6f7628cf1f1b3db2a590a1c4c9f052b028dc08aacc994f523e6a45d592dbdbdd68193dd529b5a27992168ca26e191c391d"], &(0x7f0000000200)='GPL\x00', 0xc, 0x1f, &(0x7f0000000240)=""/31, 0x41000, 0x40, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000000280)={0x3, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x0, 0x9, 0xcc, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000480)=[r7, r8, r9, r10, r11, r12], 0x0, 0x10, 0x3}, 0x94) ioctl$DRM_IOCTL_GET_CAP(r0, 0xc010640c, &(0x7f0000009c40)={0x17}) 3.986127937s ago: executing program 2 (id=810): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x6, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0x2}, 0x50) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4c21, 0x84, @mcast1, 0x5}, 0x1c) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000000c0)=0x560, 0x4) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x28) recvmsg(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x40002000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x4048851}, 0x490) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r5, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x28000) 3.710608195s ago: executing program 2 (id=812): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x403, 0x70bd2d, 0xfe0f, {0x0, 0x0, 0x0, 0x0, 0x215, 0x2140}, [@IFLA_LINK={0x8, 0x5, r1}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_MTU={0x8, 0x4, 0x5dc}]}, 0x4c}, 0x1, 0xba01}, 0x4000040) 3.546451263s ago: executing program 0 (id=813): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x200000000000011, 0x2, 0x0) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1, 0x0, 0x7fffffff, 0x34}, 0x1c) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) unshare(0x8000000) shmget$private(0x0, 0xfffffffffeffffff, 0x4800, &(0x7f0000ffc000/0x3000)=nil) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = dup3(0xffffffffffffffff, r5, 0x80000) r7 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x3000, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r8, 0xc008561c, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000540)={0x2, @win={{0x2, 0x1, 0x80000000, 0xcb81}, 0x1, 0x9, &(0x7f00000007c0)={{0x4, 0xf, 0xbaf, 0x8000}}, 0x7f, 0x0, 0x6}}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) memfd_create(0x0, 0x3) 3.498674511s ago: executing program 1 (id=814): r0 = socket$inet(0x2, 0x3, 0x2) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, 0x0) gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x2, @thr={&(0x7f0000000180), 0x0}}, &(0x7f0000bbdffc)) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000640)={0x11, 0x0, 0x0}, 0x0) r2 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000007c0)=0xffffffffffffffff, 0x4) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001a40)=@bpf_lsm={0x1d, 0xf, &(0x7f0000000880)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x81}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000940)='syzkaller\x00', 0xffff, 0x1000, &(0x7f0000000980)=""/4096, 0x40f00, 0x40, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000001980)=[0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x10000}, 0x94) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001b00)={0xffffffffffffffff, 0x9, 0x18}, 0xc) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) bpf$PROG_LOAD(0x5, &(0x7f0000001bc0)={0x16, 0x14, &(0x7f00000006c0)=@raw=[@cb_func={0x18, 0x5, 0x4, 0x0, 0x1}, @tail_call, @cb_func={0x18, 0x6, 0x4, 0x0, 0x5}, @initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xba3}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x72}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], &(0x7f0000000440)='GPL\x00', 0x3, 0x76, &(0x7f0000000580)=""/118, 0x41000, 0x10, '\x00', r1, @fallback=0x3d, r2, 0x8, &(0x7f0000000800)={0x2, 0x2}, 0x8, 0x10, &(0x7f0000000840)={0x3, 0x5, 0x420, 0xdea}, 0x10, 0x0, r3, 0x1, &(0x7f0000001b40)=[r4, r6], &(0x7f0000001b80)=[{0x0, 0x1, 0x8, 0x7}], 0x10, 0x80}, 0x94) r7 = socket$kcm(0x2, 0x5, 0x84) setsockopt$sock_attach_bpf(r7, 0x84, 0x10, &(0x7f0000000000), 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x487, &(0x7f000000e6c0)={{{@in6=@local}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000080)=0xe8) listen(0xffffffffffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r9 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') ioctl$VFAT_IOCTL_READDIR_SHORT(r9, 0x82307202, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) r11 = io_uring_setup(0x661, &(0x7f0000000340)={0x0, 0xcfc5, 0x0, 0xfffffffe, 0xffdfffff}) io_uring_register$IORING_REGISTER_PERSONALITY(r11, 0x9, 0x0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r11, 0x9, 0x0, 0x0) close_range(r11, 0xffffffffffffffff, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900010073797a30000000000900030073797a3000000000140004800800024000000000080001400000000571000000060a010400000008000000000100000008000b4000000000400004803c0001800a0001006d617463680000002c0002800800010065636e000c000300e4edf2b75cc7c0a308000240000000000c000100706b7474797065000900010073797a30"], 0xf0}}, 0x0) 3.496577287s ago: executing program 2 (id=815): r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in=@local, @in=@rand_addr=0x64010101, 0xfffd, 0xfffe, 0x0, 0x0, 0x2, 0x20}, {0x0, 0x0, 0x2, 0x0, 0xffffffffffff235b, 0x0, 0x9, 0x1000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x4d5, 0x6c}, 0x2, @in6=@loopback, 0x0, 0x2, 0x0, 0x0, 0xffdffffc, 0x1000000}}, 0xe8) (async, rerun: 64) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x10002, 0x2, 0x5000, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async, rerun: 64) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="9402000021000100fcffffff00000000ac1414aae5fffff8b49ed9825133a900fc0100000000000000070000000000000000add500200000000000801aeaaec1", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000700004e6706362632874776f666973682900000000000000000000000480000000000000000000000000000000000000000000000000000000000000000000000000000040010000dc06216ef2c68e9f6da05d886dbc3273ef99796b36698e2bd5179c3eea5474fc78c9720bfc4f90a708001f0001000000cc0111"], 0x294}}, 0x0) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) (rerun: 64) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) (async) syz_80211_join_ibss(&(0x7f0000000300)='wlan1\x00', &(0x7f00000003c0)=@random='4', 0x1, 0x2) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), r0) (rerun: 64) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r4, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r5, 0x400, 0x70bd2d, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}}, 0x28}, 0x1, 0x0, 0x0, 0x1004}, 0x40) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) 3.141455599s ago: executing program 5 (id=817): socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r0 = socket(0x1e, 0x1, 0x0) recvmmsg(r0, &(0x7f0000002700)=[{{0x0, 0xff54, 0x0}, 0x8000009}], 0x1, 0x40, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="0f0700000000fcffffff0c00000008000300", @ANYRES32], 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12015002eebc1240ac052a021b5701f5020109022400010d1f10a70904020502034a02ff0905021b284d0905090905040300"], &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x2c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="b40500000000000079108f00000000000500000000000000950000000000000078489f08c77bb3516e7171adaa4e23ce8183b003b906d0539215ad50a0aa1f84d2fb2517068dd2ec0a4290d328ab4e24726c9bf955cdee186fa93c8e9b398c09caf370bea08fc9f89bd18ba57d2c980b8457f6f0f0405c484edfee91d58f397a163ce37502061b171edb29b7725be06a3faa1c69ae47292a05c7a3da0bf9fd6c4f50f4276f4ed27de8c88ee40cdbc66000"/189], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x22e, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r8 = socket$packet(0x11, 0x3, 0x300) r9 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r9, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r9, 0x107, 0x1, &(0x7f0000000300)={r10, 0x1, 0x0, @broadcast}, 0x49) setsockopt$packet_add_memb(r9, 0x107, 0x1, &(0x7f0000000200)={r10, 0x11, 0x6, @random="bdf19b71a0f9"}, 0x10) sendmsg$nl_route(r6, &(0x7f0000000180)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c0000001800000125bd7000ffdbdf25801a8003ff03ff0a00220000080007000000000008000100ac1e0001080006006c06000008000300", @ANYRES32=r10, @ANYBLOB="08000500e000000208000400", @ANYRES32=r7, @ANYBLOB="a31706c5503964c30ff82bf8a34151c3fa704330"], 0x4c}, 0x1, 0x0, 0x0, 0x48080}, 0x4004035) dup3(r6, r4, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000009c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r12, {0x0, 0xd}, {0x6, 0xb}, {0xa, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_NAT={0x8, 0xb, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2001c061}, 0x4008000) sendto$packet(r8, &(0x7f0000000240)="800000800000210ee7decd7a0000", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0xd, r7, 0x1, 0xd8, 0x6, @broadcast}, 0x14) 3.083759703s ago: executing program 2 (id=818): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private0, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff]}}, 0x5c) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0xe0881) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x19, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@call={0x85, 0x0, 0x0, 0xa0}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x2bb33502, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r5, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, "0000000000000208", "5171bb74cd3660dab9e200", "d8a024e5", "20000926000200"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet6_tcp_int(r5, 0x6, 0x18, &(0x7f0000000040)=0xa, 0x4) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x80042, 0x0) r6 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x1a6c42) r7 = dup(r6) write$UHID_INPUT(r7, &(0x7f0000001c00)={0x8, {"b0476b76ba5d044f65271519727e4ff1ff0d12c0e6bdf3ea1f52e24f60ca698457b32832b83d7e96694c1feb5809bd67002f71e0b97c0d5270c04ffa64f63b2e18ee4b7b572fe2f4d03cad38bcd106ff12f53b443ac6fc81da518f54b9004a44859529c07a2b1b8feddc0180a0f37b13babba1dd0813b7ea56dac4b7ffe9a2ef54221439ecc55223ef2d40f4ba8108c10387ddffbaed25d41e7692bf26ddfa747a666caff49843e38c86cac7323f784a17df6beaa49c3f4a98fb4013f4e573e2ef77b0965d4bfbdf7d5eada69406ca93f422495e00addfca1518085a40f10284ff59388ecf476a12ef1a540163922098d600519ae8cf3ef544344e9d968f341af618503b455f3976b76975270e94d714302382c63de5b7c1fad1fa373b369916cb3b4d583a9ebbaeb262884d25a0e1d9fb141de60df7e64cb38b6f7167991f8fba06bffe2d49133bbb462cd8a9493177eee5f03875b15c7a92c3cd6a3fdfc64f236e14fa05a0e8d3c45f13eecd22e13528c74186dc50e0e2af44177e26bded1161e5533375508dadb83db5126cc810f4e30d4e24ec12c3b99e5220aacf42c58f2960bd43c337dbd318aeeb5c9a6cd5ffd3bf1497bb48ab7bcb32c9c33c9f5b9bc4645b96f23f9e0d826b780030444ffb925f55df587ef5ca5ea74ccd66afc7981da496d6f037efbb0b08f3f5078c60ffb4db18d1b59996bd9b1513442785bf4ece8587b39d8176dc9c735d5ea25133b2053bba227b81faab7220326f8814a9df4eba4ecc6acdd82f70b653b56a18cc9dfa4deb0a112c797ab89a51a103c3a9085d828523370c4d79d9484f4dc910735a2c9b5b85197cd9c073df7a54b40df8e1bf595bab957900c2a1a7dc40e88ed0c55c362ffbb7f88a0725a6ae73b936a639e951faf9c45ae74a2ece2f6f88e425ee41d2c60cb083a2fd6d07381908a7f629e32f89a553cf0794f54b8bdc7bd541d88464a4f80ac0b8b625a803a55de4b05a95fc7f8fc3d6d79858ccb269b7b8b21657654164a9aa29f4e8462377e9d234a41ea69841a4aaa1e5f89f9b074f6f71cb1ffaa450c3160b0e319ec81ad30101db66218b0c69f97c234465dc45849fcfd62d396f2b50ddcc0ed7dd8651431534232ab6d1186d7760770a1fc6c77553a79d0297194f794997ee47781094a76d9dccf632dcbb527b3e68950d9bb534245c7f08ae1d6ef2750292ae28e5e6dcfe2a69737dd7a1e453f3902ae90789e98c212905422099904d3bfb949bde187682a59c01aa8e6a9972a63d6aaef4d4139b10a24e063707f1aba79bd59e3f9709a873dff401d1f356c4be5e449ae0e2633a1fe50ed367fe56b0499957c3b6cabb42256547995ea998f3937d153897d1c83f1ad922d6835bdfa3b986dc6f4bd927a4ca13fbaa99b7b43758e2329d588f40fac718b16cca855468643f3818496b4915fe9a2bdd3e68889fea24bc1dfa6287a801d49a7bb84654147448550d2919e4df3a943a88cf616befea4e7a4fddb7969311c6837f9529966241be1e57ed2d773debc542986d09866905a3f63b6e1820086d52a70f039154e839da7ea852c33bf3722a048f61bbf068519e050b8788370fb130a42e9f5322dfff65b15d588f9e926b70e4530e8b66697cabb1e8514831431fa0eaecb49f9613ed5fd7bc50f897bda36d24d4296e143e2480e325ec09a77c03a07b4f86eb703085313ebeee94ef5b1cde3f6a7efd785772eb4034039f598c07819b769416a223fab824c4ac50086e78042a1ccf47b6c7ede8540cded4bd4c920ce6c2b7493a5634c5e96bb761373623ab473b121d555bfd5a8bc3f5c5418bed83ffd0d6492840550fccc0c35746370396d0190b7b1d2cadcc150877e0d197f692f97cec790c95e3d3959dc7c68aca37306c1bc13ad33848395dba5e3c9ce8090bc0e7e8312091773641be56411921e3d473321c6d8bd10b7d3f5aedd6620bcaa06474bbb298bc77297b8b5dcb9e6b33dbe676460cca825609857724cee245306d07fda287d5fe57c424c27cf9b6cf0f16d2c6a8071bd57c826d7371841cf43dab1b42421ce416d0d3a9c80bc807d2e6761e53f06b3e63c0af1b4548d820118421205f040f4ab35307871e4c7a21ff28082c29e02e89486064661898c0eb1811c70a6124c1f25d62c38794a3e87c312c870db7b60d0df8b57860c94d1a9c561b327fae3a68ce9ff4551e418eb00766f0341c5e796e3cbbbe6b4864928b966110256d5475eb1fd7b2893b60e19e859baaf23c9233a1b064771671ee2d07c151e2e99c37a116a338788052a726a8519b8335e9ff4f71d00ab634543c20ddea1bf57d4f2b797182ff19618b6974d2b69d9f052934d527a1830bf2785842f35eaf32b65b7c9fdd6f0c41756072a59c0cce0b7305740729f1daa14e0092da9d022321b726d658fcef55affa2bbf36ad788f1f423b7dfd328435b4d5df315143d8b8028ba4bea6134a3dc9720c73d5e66b8b8168752eea6b78c75f04efd9677dbe419f13f5e1c9764276a83821b710307d8f85359b34d038ff17de45e8739d4b647fd1a8d794a3273d922af3374f5d3c75b8345b9dfdabb2c0418a358921e0e73d0fe88caab1741b913673e22ff4b59afa0f653a423d9b2bb20cbf07951a349eea18a891b4f4dc6df8e42a6181284f643de5fd2924ae54f672a1920343476c67333e1e8205bf4877b1251a83f417936714edb1c6975ba7969d2fcc2e69024a4669ac2f998116ade1bd84568b8f3f1fccbe95df9ed21db77315b7469f30bfae418415d9cb5aeea627ba6811e30d56d4f4bfe5f794ea4243e3cdfad3ef55199699b8433083b6f72f95effc5f2f613cfcefaf0b94e801ebcb7095a1474ee93142b82c9bf9886617b6bf69d08c83c76cd21d4cce5872d99de8e54bbff915ab923b2d24bb3aa178dd50b44fd0eb880ef33ca51d4bf5f0fbc8ffe18afe4245397f277e4efad955baa10cf56613481253d69c02e7661714b68be0fd64f29bdafbc8b4a0b30bd6709c67fe8e8915d0479b3902b1d0169fb5486b02e966ad5d8a2bcf42ecba59177cd85e17239667f6b045d1f873ce24733ae17e2d8432709062e786a32ac925121f1b0d46c66d4fb9088f4aa0cfe2149f6c2cb5b75d45349bc88fbd47e01ea07e7cd573335aab8d389846566800dd084bc3caa95f7632719c651f2d33be0fb56347c063b3c6e3e75c5e58caeb4c37574859b78c1ed018fbeed788a4305a9ee1c1ef65a0c83a7cd717a8c08ecd4e86370ffffd6d40a89a0b1e8c15a10ad5406e867e49319ad83bfbb925d5e240b4bd44fd751e7510d5ea03a6cab95f37155d1fd69aaea1db4a1f53714eb90e669209cf634f84a50c85bdc51838ebbb545b4387790df67f0122740c2abc910cf83230394172a56c9ffda6675bb8bb39846730a1bf764aeb92407c90a194da880cb8a4efb5b57a8311d864209c7fd226b93582b6b11eec559abfbba653c0569c219d3a2e60555cb739f9d32d564f23c4e98be78aa553610822af426f961df0df2185c61ccaa22b2a6aa6fb3e917bdfb2be9c3ffb8a50821321119c4cf4917db39548abc17bfba267fa50f6af15c560a21055f967f1ca6f656ddb556f9c7e17a771eeef7e80940d1c14ddf2c27647686fd0526460036aeea395fb10abef2be2ea96c9bb380370c08d1568d30eea0f3e6b7cf8f7edc7b36d4d0affd249330707b54ee620f208d885791171eb67a25a80fcc6922e0258c9673b6576564949dfa5bed9a0299bf952aade654de16e22d54fcd391ded6adab94ff621efcd91ef69acf8dfa1b22692ba3e49cd1d3fbed6db1402065ab37e457056877977ebac33ef566f28a19b9acb67a9cc53feb156814e880b3dd5a9119ffdbc5a45c20ea375f2882575b9a28740eebf63f2895d9ffac1ec33cbdcdede98a201424d000df1efd64dd7268cc1b2366ccfb09754822dafdb1821de5e6ebee09608e82e679fafb7a5100172f26998d31d7f27c2b310f0372c3b5e888f8e6efb56074177bf6a2a5bbd9ed070ad5aaf23ce144d1ac86cad110e5916a8a57e1e7fc3d37353f84f2f6d43d92ab8b35040467f3f8b1d23fac021bbac3710edc8e2e26d794db38e48020f63e94d4b4dca3e015537a8e3008274d55f81af931a0faf1a438444b6a0489b93f7b88f81f761eae0f82e60cb0cf2745ca8c9e30d3cc189c1405b1994ed71b00d90ea7a94102916cdc915620c363d04e51eabaaca6c2814a7c1e7aaeec80bdc13135b813e6d0eea83446a5c57ec29695c302c0d8da65b61fe8ada51a36e1aff34d449f9eb70cb94931226121ab121a971c2fc070ca84272d122c1696f52fbd5ed06783abe188dcf133c4d41e10295f6ffda69fa8c5a7c0fec3425a2d60523a60d280b5ce34eac5911268172e772fefba63a6f5c6dafa9e500a5e1355fb614613f8fc1ef5e5466fa19212bcdc349a865f4cee6ea80b11a410bb6e4ad677393973e38621d25ff6c4876ef8a8d2ba651be4a78d2ba9fafadcea8eff9cca3f4ab71a0b84917794e521220dad099ac8aaf32abd162348879e4299e4d46395f9d55267b635e18ca2e2fc96146b96c8a8055130b8d8cb10cc31382df34057bd8637f86e48adc854af408226752a04df8d0362db263e0959f2bd7e8a4d33a8c4b257e19d308280baf40cced1b3cd3a86ee22df0da49d750539eee1104e99a9f8a065e5499c73125a8a8430eda7aee156821a97c237611b50f682a2cccd0969304f0a50ae98800dfb32ee1bcfeab98182c34a51e67fa5bd738c22c44fc1269ce73f464edd2f31296e92e62df51cf55798ae2e3c33c57b09f4ecd13469122095a3563f95f0a04cf58dcea4aed5e8bdda7617863cbc37a97ebadb46d679f7e30014d96d0ac7ce9484368fa5fd19cbc3d139410a2bd7ffacef1bdf76dd1d5f34d2392fcb91c7585fc1ae7d8ba2aa8ded9645d5a5e76e2279b6e0692101137da946dfbd3836476f5dad7fed70115d716dce87b5ad755e5653a709f5aa42265ec9657ed406cc9256af3628c0116b8e1d23306983e9adbc19dec354870c98e2e76566895df933a80c4c36b617db4bbda1a4ca7d6c80a43734471fc92d0bdeacfc125dddd73febd8f7ef84f221d52ae71372cee802d59013a15958e850f8fdf46d8fd3b874633daf3b1f346470456c05722258480959dd6afcffa1f3f2ca033011339c5cb85b7d1c9b5916fb8dc9c2783df64eb5cca5af83a74fe5bb259f93722842eb4ac851e71f3cfd67a39590e7f8e20f018744b9277e6eb46b5f211df5f767ef29dc9a972e14c40ea2d4624f187f301c1116d3a61adeb5c6f7ccc021ac5e18d8b40d7f1f19daf4445c06e72db8701c267c0144c92cddd49af7a87aca5aa05d0e380dd27cc780d2f7db3bef26cc4fd358543e19d73179b879f7bdc702ab405270c93a3ed64153e20b5b663773a2ad4e8e3e1e8eaf39ec80d75d02f74ff94f0e095240a564eeece4fc9bcf19bf2243c700e1dae14a1b0217013977bfa05f681abc37714fe462d0a632044ce52fdaa1c1a806b1eb4370e23ca0247e536165aa9f1c2af8adfea369ee1f4a2c7823a7baef028a1e77501db48db6aa0d7e30969f7197368db02d443803b53b2899315f7e2ba9c5ae952a3866b4ea60f3d669e0a91f7ef640cd938646bf8822fe455f0302fccf87c7fad6daf38fde038fa596b83a9fd5bf675669a6cb2bab44c6617f07950bf34edb93bbcb4174630f275dbda7a0631c4b456e5f80eb6258c1874e77d426743e478917fe44b73dc203baa2cc442b84b5818409abae99d97a28754969bd393df", 0x1000}}, 0xfffffe38) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, 0x0, 0x0) connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x58) setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000001840), 0x4) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setown(r8, 0x8, 0xffffffffffffffff) openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x2) 2.984421334s ago: executing program 3 (id=819): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$kcm(0x10, 0x5, 0x4) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r1, 0x0) ppoll(&(0x7f0000000000)=[{r1, 0xa1b3a606282007e}], 0x1, &(0x7f0000000040)={0x0, 0x3938700}, 0x0, 0x0) r2 = syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x3000008, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d3030303030303030303030ff30303030303132303030302c757365725f69643d", @ANYRESDEC, @ANYBLOB=',group_id=', @ANYRESDEC=0xee00, @ANYBLOB="2c616c6c6f775f6f746865722c7375626a5f726f6c653d5c2726075e2c6d6561737572652c66736d616769633d3078303030303030303030303030303030322c6f626a5f726f6c653d7d2f2e2f5d2d8b2e247b2c00"], 0x0, 0x0, &(0x7f0000000200)="a57f31c27295558596134aa9a70eb1558eef1c8c84a0f5d40b5b4216e1f456a9e83a258eff8a095d439a343166befd7e25a77ae6ebcc7856c81c34ee25d6e33837c663d7cc27cffbbe3296121e6bec01138696080ec067f452329f9eb5fb706a8f30b493e161356d09ea8278de8cd98acb5d430bba104ba3e190ad42246f1db887f19b4a00e2d1854ceb33801133b3513100473fafbe6f25f2422834dcb2e067e4cd147ebc1069f0c5136665b1b54af8f0cfbf1e3b90d436c2d38c38c56d21d3be9208c57b02bf65120f2209a9cb1431") mknodat(r2, &(0x7f0000000080)='./file0\x00', 0x80, 0x800) sendmsg$inet(r0, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="97eb000014006bcd9e", 0xeb97}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600) socket(0x40000000015, 0x5, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x91e3, 0x8, 0x8000, 0x40024d}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, 0x7}) write$UHID_CREATE2(r6, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) syz_io_uring_submit(0x0, r5, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0, 0x60, 0x185100, 0x23456}) io_uring_enter(r3, 0x627, 0xc1040000, 0x43, 0x0, 0x0) 1.556718181s ago: executing program 3 (id=820): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$kcm(0x10, 0x5, 0x4) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r1, 0x0) ppoll(&(0x7f0000000000)=[{r1, 0xa1b3a606282007e}], 0x1, &(0x7f0000000040)={0x0, 0x3938700}, 0x0, 0x0) r2 = syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x3000008, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d3030303030303030303030ff30303030303132303030302c757365725f69643d", @ANYRESDEC, @ANYBLOB=',group_id=', @ANYRESDEC=0xee00, @ANYBLOB="2c616c6c6f775f6f746865722c7375626a5f726f6c653d5c2726075e2c6d6561737572652c66736d616769633d3078303030303030303030303030303030322c6f626a5f726f6c653d7d2f2e2f5d2d8b2e247b2c00"], 0x0, 0x0, &(0x7f0000000200)="a57f31c27295558596134aa9a70eb1558eef1c8c84a0f5d40b5b4216e1f456a9e83a258eff8a095d439a343166befd7e25a77ae6ebcc7856c81c34ee25d6e33837c663d7cc27cffbbe3296121e6bec01138696080ec067f452329f9eb5fb706a8f30b493e161356d09ea8278de8cd98acb5d430bba104ba3e190ad42246f1db887f19b4a00e2d1854ceb33801133b3513100473fafbe6f25f2422834dcb2e067e4cd147ebc1069f0c5136665b1b54af8f0cfbf1e3b90d436c2d38c38c56d21d3be9208c57b02bf65120f2209a9cb1431") mknodat(r2, &(0x7f0000000080)='./file0\x00', 0x80, 0x800) sendmsg$inet(r0, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="97eb000014006bcd9e", 0xeb97}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600) socket(0x40000000015, 0x5, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x91e3, 0x8, 0x8000, 0x40024d}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, 0x7}) write$UHID_CREATE2(r6, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) syz_io_uring_submit(0x0, r5, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0, 0x60, 0x185100, 0x23456}) io_uring_enter(r3, 0x627, 0xc1040000, 0x43, 0x0, 0x0) 1.101812736s ago: executing program 3 (id=821): syz_io_uring_setup(0x10b, &(0x7f00000003c0)={0x0, 0x334b, 0x80, 0x3, 0x805}, 0x0, 0x0) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') open_by_handle_at(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="20000000f10002000600000000000000000002"], 0x0) openat$sequencer(0xffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x44f, 0xb323, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x6, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xc}}}}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000040)={0x18, &(0x7f00000000c0)=ANY=[@ANYBLOB='@#\t'], 0x0, 0x0, 0x0, 0x0}, 0x0) 511.462333ms ago: executing program 1 (id=822): socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x800) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_open_dev$vim2m(&(0x7f0000000080), 0x9, 0x2) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0xa, 0x801, 0x84) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f00000000c0)=0xfff, 0x4) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) sendmmsg(r1, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 462.34982ms ago: executing program 2 (id=823): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x48e80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x200) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000003c0)={0x2, 0x1900, @ioapic={0xe6fe0000, 0xb5, 0xa9c1, 0x6ffffdff, 0x0, [{0x0, 0x80}, {0xc, 0x5, 0x10, '\x00', 0x10}, {0xfc, 0x44}, {0x2, 0x90, 0x7, '\x00', 0xff}, {0xc, 0x2, 0x5, '\x00', 0x3}, {0x0, 0x60}, {0x0, 0x85, 0xbe}, {0x0, 0x6, 0xd0}, {0x0, 0xff, 0x0, '\x00', 0x2}, {0xc, 0x4, 0xfe, '\x00', 0x42}, {0x0, 0x2}, {0x4, 0xe, 0xb}, {0x2, 0xfc, 0x31, '\x00', 0x3}, {0x3, 0x81, 0x4}, {0x2, 0x2, 0x4, '\x00', 0xfe}, {0x0, 0x3, 0x1, '\x00', 0x6}, {0x1, 0x0, 0x8, '\x00', 0x4}, {0x0, 0x40, 0x7, '\x00', 0xe0}, {0x2, 0x1, 0x7, '\x00', 0x6}, {0x80, 0x0, 0xe, '\x00', 0x5}, {0x4, 0xe5}, {0xc6, 0xc, 0x0, '\x00', 0x72}, {0x1, 0x6, 0xfe, '\x00', 0xe}, {0x10, 0x83, 0xe, '\x00', 0xf4}]}}) 410.456327ms ago: executing program 0 (id=824): syz_usb_connect(0x5, 0x1bb, &(0x7f0000000880)=ANY=[@ANYBLOB="12010000a677c120229062d60eb3000000010902a90101000000000904"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r0, 0x707, &(0x7f00000004c0)={&(0x7f0000000480)=[{0xfffb, 0x3001, 0x0, 0x0}, {0x1900, 0xc200, 0x0, 0x0}], 0x2}) 316.730941ms ago: executing program 1 (id=825): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000700)={'syz0\x00', {0x0, 0xe5e4, 0x0, 0x9}, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x80000000, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2000001, 0x0, 0x4, 0x0, 0x0, 0x4000000, 0x0, 0xfffffffc, 0x4, 0xfffffefe, 0x0, 0xf6, 0x0, 0x0, 0x3, 0x1, 0x9, 0x0, 0x80000, 0x8000, 0x4, 0x0, 0x1, 0x7fffffff, 0x2, 0x4000000, 0x9, 0x5, 0x0, 0xfdfffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5, 0xfffffffe, 0xffffffff, 0x7b67], [0x0, 0x0, 0x0, 0x3, 0x3, 0x0, 0x9, 0x3, 0x0, 0x0, 0x9b05, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0xfffffff8, 0xfffffffc, 0x2, 0x7, 0x5, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x10, 0x1, 0x0, 0x7, 0xfffffffc, 0x4, 0x0, 0x8, 0x0, 0x0, 0x0, 0x6, 0x1, 0xffffffff, 0xfffffffc, 0x0, 0x0, 0xc33, 0xffffffff, 0x1a0d, 0x39, 0xaecd, 0x10, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc], [0x1, 0x0, 0x567, 0x4, 0x0, 0x0, 0x4, 0x9, 0x8, 0x0, 0x0, 0x0, 0xfffff800, 0x0, 0x0, 0x8000005, 0x0, 0x0, 0x0, 0x0, 0x3, 0x10000000, 0x0, 0x103, 0xfffffffe, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffd, 0x0, 0xfffffffc, 0x4000000d, 0xffffffff, 0x0, 0x9, 0x3, 0x0, 0x5, 0x1, 0x0, 0x400a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x1d, 0x400, 0x0, 0x8, 0x4000002, 0x0, 0x100000], [0x0, 0x1ff, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffe, 0xf7b, 0x0, 0x0, 0x0, 0xaad, 0x10000, 0x80000, 0x0, 0x8, 0x0, 0x3e8, 0xfffffffd, 0x10000001, 0x0, 0x0, 0x5861, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000009, 0x0, 0x0, 0x40, 0x0, 0x0, 0xd, 0x0, 0x0, 0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x101, 0xfffffffe, 0x0, 0x5, 0x0, 0x1]}, 0x45c) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="40000000180015ffe0000000ffffffff0a2000000002000000000000240009801c00000008000000140005"], 0x40}], 0x1}, 0x0) 249.49468ms ago: executing program 1 (id=826): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000000140)=0x2, 0x4) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000180)={0x2, 0x1}, 0x4) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x6, &(0x7f0000000080)=0x9, 0x4) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) 218.23738ms ago: executing program 2 (id=827): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats\x00') unshare(0x2080800) pread64(r0, 0x0, 0x0, 0x800008) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) r2 = memfd_create(&(0x7f0000000380)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf9\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xccd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4hi\v\x00\x00\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xeb\x05\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\xd1x\x004]PZ\x9e\xd5Y\xf0L\xa4\xbc\x86\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\x97\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev\x15h$\x01\xdd\xe5\xce\xf8*\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x01\x04\x00\x00\x00\x00\x00\x00h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2\x05\x00\x00\x00\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xa2\xab\xf6\x84\xe0\xcf1\x9a\xbc\x8d\xed\xf3\x98\x96\x84\xd7\xc2\x88\b\xcc6\xa44\xd7\xed\xc1\x8f\xa7K\xc9KeEk\xd1\xb7\xfb\x88\x12\xd0i\xef(\xddUP\xee;Dk\x84\xfcD\xf0\xd6\xe9\x96B!\x8c\xb8\xc6\'~\x99\x1d2\xdb\xfd=\xa7\x86\x06\x03\xc6Y\xc6\x87\xd13\xd0Y\x90\xe9*~$jQ\xb9\x84\xec\xe9{\xa8%}/\xcaP\xb1a\xa6\xd9\xb2\xe9\xa7\x1b\x00\xb8\x9d\xb0\x01\x04Y6\xcb\xaa\xa9\vE\xd0Q\xcd/#%J\x0f\x97\x96\xa0\xeeb\xe2R\xf5\x16\x1f\xe554q\xbdp\x0f)\x99\xec\xe4\xf9~\x91\x00[B$p\x92\x03i\x7f\x1c\xaf\x06\t\xda\xff\xb8\xf1\xc9\xd7\xc3\xfaN\xeel 40XJ\xe1\xe4Hv=\x81\xdaZ\xd6\aT\x86\xf5\x13+\xa9\x14x\xe7\x19?\xa9#2\xba\x7f1\xf2\xb8$\xa2\xb5*\xef\xd3\x8d\xe4Q\xe6C\xb3AU\xcb\xae\xdcN\xb7Mp\xc8\x04]\x84\x7f\x19\xd3#\x8b@\x9d\x1a\xc5\xc8n^e\xeak\xea9\x15\x9b\x1d\xb7\xe8\xca\xac;\n\\\xa9{B&uO\xb6\xd8\xa6\xb8\xfaA\x1f\xfb\xdcm)}q\x17\x7f\x86b\x1bq\xcb\x81\r\xc2\bb\xd9\xc7t\x88Y\f/\x0f_\x0e\xae\x92\x91\xf8B{\x16\x8a\xa7\xed\x01\x8c\xe9%', 0x7) execveat(r2, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='fdinfo/3\x00') write$evdev(r1, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x1, 0x2}, {{0x0, 0x2710}, 0x14, 0xffff, 0xb3}], 0x20) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_dev$vbi(&(0x7f0000000180), 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000001c0)={0x0, 0x4, 0x2, 0x0, 0x8d}) r4 = syz_open_dev$vim2m(&(0x7f0000000100), 0x7, 0x2) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) ioctl$vim2m_VIDIOC_TRY_FMT(r4, 0xc0cc5640, &(0x7f0000001a00)={0x1, @pix={0x5, 0x1, 0x32344d59, 0xb, 0x2, 0xd0, 0x2, 0x2, 0x0, 0x8, 0x0, 0x1}}) ioctl$KVM_SET_GUEST_DEBUG_x86(0xffffffffffffffff, 0x4048ae9b, &(0x7f0000000080)={0x1d0003, 0x0, {[0x200, 0x800000004, 0x83, 0xffffffffefffff15, 0x3, 0x2000000000004, 0x4, 0x4]}}) r5 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r5, 0x29, 0x24, &(0x7f00000000c0), 0x19) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f0000000180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7fe, 0xf83, 0x8}, 0x1c) sendmsg$kcm(r5, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x28e, @mcast1, 0x9}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000140)="f4000900062b2c25fe80000000000000dc8b850f238466ccfe8000000000e82ff6ed88672eb00944", 0x28}], 0x1}, 0x24040884) dup(0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x40000) r7 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000340)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r7, 0x83, 0x90, &(0x7f0000000280)=ANY=[@ANYBLOB="00000088f40713dd6c9b567573dd90ce2f9afab83a9347ecbc95f855839c91f40a9309ae495d2dba8a1db824589b10450d789de45a30e75deaa37c08dcb8e07ae7f500e0f6350afaacac5ad1039caa9caf4e28cd9b38c281d58d53a30688dccee5f5560fa49451162af2a00ee1bed026e9bf57c1ae0f6cbf3aa28b5a85639448d739cb"]) 168.359117ms ago: executing program 1 (id=828): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000c, 0x204031, 0xffffffffffffffff, 0xffffd000) ioctl$TUNSETVNETBE(r0, 0x400454de, &(0x7f00000000c0)) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newlink={0x48, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x4, 0x0, 0x300}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gre={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @private=0xa010101}, @IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x2}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x81}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40084}, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) ioctl$USBDEVFS_WAIT_FOR_RESUME(r2, 0x5523) 114.752924ms ago: executing program 5 (id=829): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x80003, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) close(0x3) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000002c80)={0xa, 0x14e24}, 0x1c) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) r3 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x0, 0xbfdfffbc}, &(0x7f00000000c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x85c3}}) io_uring_enter(r3, 0x32d7, 0x0, 0x46, 0x0, 0x0) 0s ago: executing program 1 (id=830): socket$key(0xf, 0x3, 0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="5800000002060108000034e40000000001000000050001000600000005000400000000000900020073797a3100000000050005000200000011000300686173683a6e65742c6e6574000000000c000780050014000d000000a5668ebe4260a28673f864f9fa7616ca9393cc306c33920c578ccb3710474d988a86e1b8954a089495883767be9bca6517a220a439d07392fcbff9bafe9bfa31f0564a41a60d35000000"], 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x2) r1 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\a'], 0xfe33) r2 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000600)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee6, 0x8031, 0xffffffffffffffff, 0x85494000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x40, 0x6000000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x58b2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_io_uring_setup(0x66be, &(0x7f0000000600)={0x0, 0x31ab, 0x1535, 0x0, 0x1a}, &(0x7f00000005c0), &(0x7f0000000240)) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_GET(r6, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24004000}, 0xf3ebace019453e2e) io_uring_register$IORING_REGISTER_PBUF_RING(r5, 0x16, &(0x7f0000000040)={&(0x7f0000001000), 0x0, 0x1}, 0x1) socket$inet_mptcp(0x2, 0x1, 0x106) r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000003fc0), 0x20000, 0x0) ioctl$SOUND_MIXER_READ_DEVMASK(r7, 0xc0044dff, &(0x7f0000004000)) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x0) r8 = accept4$packet(r2, &(0x7f0000000140), &(0x7f0000000100)=0x14, 0x80800) setsockopt$packet_rx_ring(r8, 0x107, 0x5, &(0x7f00000001c0)=@req3={0x9, 0x0, 0x400, 0x6, 0xfff, 0x3ff, 0x40}, 0x1c) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r9, &(0x7f0000004180)={0x2020}, 0x2020) kernel console output (not intermixed with test programs): tached by 'DViCO FusionHDTV5 USB Gold' [ 216.977957][ T6036] usb usb3-port1: unable to enumerate USB device [ 217.440750][ T5921] rc_core: IR keymap rc-dvico-portable not found [ 217.450023][ T5921] Registered IR keymap rc-empty [ 217.487366][ T5921] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 217.557680][ T5921] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input22 [ 217.591759][ T5921] dvb-usb: schedule remote query interval to 100 msecs. [ 217.614299][ T5921] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 217.687809][ T7502] x_tables: duplicate underflow at hook 1 [ 217.721711][ T5921] dvb-usb: bulk message failed: -22 (1/0) [ 217.861798][ T5921] dvb-usb: bulk message failed: -22 (1/0) [ 218.102966][ T5921] dvb-usb: bulk message failed: -22 (1/0) [ 218.212264][ T5921] dvb-usb: bulk message failed: -22 (1/0) [ 218.323092][ T5921] dvb-usb: bulk message failed: -22 (1/0) [ 218.358091][ T5921] usb 1-1: USB disconnect, device number 30 [ 218.484884][ T7516] syzkaller0: entered promiscuous mode [ 218.523021][ T7516] syzkaller0: entered allmulticast mode [ 218.532345][ T5921] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 218.811471][ T6036] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 219.041654][ T6036] usb 5-1: unable to get BOS descriptor or descriptor too short [ 219.060077][ T6036] usb 5-1: config 13 has an invalid interface number: 2 but max is 0 [ 219.102878][ T6036] usb 5-1: config 13 has no interface number 0 [ 219.109096][ T6036] usb 5-1: config 13 interface 2 altsetting 5 endpoint 0x2 has invalid maxpacket 17704, setting to 1024 [ 219.305767][ T7538] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.350228][ T6036] usb 5-1: config 13 interface 2 altsetting 5 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 219.375557][ T6036] usb 5-1: config 13 interface 2 altsetting 5 endpoint 0x4 has invalid wMaxPacketSize 0 [ 219.403246][ T7538] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.416102][ T6036] usb 5-1: config 13 interface 2 has no altsetting 0 [ 219.451936][ T6036] usb 5-1: New USB device found, idVendor=05ac, idProduct=022a, bcdDevice=57.1b [ 219.481710][ T6036] usb 5-1: New USB device strings: Mfr=1, Product=245, SerialNumber=2 [ 219.517528][ T6036] usb 5-1: Product: syz [ 219.536856][ T6036] usb 5-1: Manufacturer: syz [ 219.554001][ T6036] usb 5-1: SerialNumber: syz [ 219.581596][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 219.586944][ T30] audit: type=1326 audit(1765579977.400:531): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7528 comm="syz.1.471" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 219.627813][ T7516] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 219.702364][ T30] audit: type=1326 audit(1765579977.400:532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7528 comm="syz.1.471" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 219.892197][ T30] audit: type=1326 audit(1765579977.400:533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7528 comm="syz.1.471" exe="/root/syz-executor" sig=0 arch=40000003 syscall=428 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 219.925278][ T7516] batadv_slave_0: entered promiscuous mode [ 219.944575][ T7515] batadv_slave_0: left promiscuous mode [ 219.966467][ T6036] appletouch 5-1:13.2: Could not find int-in endpoint [ 220.006390][ T6036] appletouch 5-1:13.2: probe with driver appletouch failed with error -5 [ 220.010232][ T30] audit: type=1326 audit(1765579977.400:534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7528 comm="syz.1.471" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 220.048117][ T6036] usbhid 5-1:13.2: couldn't find an input interrupt endpoint [ 220.161778][ T6036] usb 5-1: USB disconnect, device number 23 [ 220.178107][ T30] audit: type=1326 audit(1765579977.400:535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7528 comm="syz.1.471" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 220.260781][ T30] audit: type=1326 audit(1765579977.400:536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7528 comm="syz.1.471" exe="/root/syz-executor" sig=0 arch=40000003 syscall=125 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 220.332353][ T30] audit: type=1326 audit(1765579977.410:537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7528 comm="syz.1.471" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 220.413037][ T30] audit: type=1326 audit(1765579977.410:538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7528 comm="syz.1.471" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 220.470766][ T30] audit: type=1326 audit(1765579977.460:539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7528 comm="syz.1.471" exe="/root/syz-executor" sig=0 arch=40000003 syscall=426 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 220.549521][ T30] audit: type=1326 audit(1765579977.460:540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7528 comm="syz.1.471" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 220.701272][ T7551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 220.750902][ T7551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 220.795124][ T7549] sctp: [Deprecated]: syz.3.475 (pid 7549) Use of struct sctp_assoc_value in delayed_ack socket option. [ 220.795124][ T7549] Use struct sctp_sack_info instead [ 221.160915][ T7541] netlink: 9 bytes leftover after parsing attributes in process `syz.3.475'. [ 221.176682][ T7541] netlink: 9 bytes leftover after parsing attributes in process `syz.3.475'. [ 221.996964][ T7577] netlink: 4 bytes leftover after parsing attributes in process `syz.1.486'. [ 222.351390][ T7217] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 222.524286][ T7217] usb 4-1: Using ep0 maxpacket: 32 [ 222.757857][ T7217] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 222.768249][ T7217] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.957481][ T7217] usb 4-1: config 0 descriptor?? [ 223.051351][ T10] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 223.071684][ T7593] syzkaller0: entered promiscuous mode [ 223.083854][ T7593] syzkaller0: entered allmulticast mode [ 223.226526][ T10] usb 1-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 223.258957][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 223.285737][ T10] usb 1-1: Product: syz [ 223.301306][ T10] usb 1-1: Manufacturer: syz [ 223.319520][ T10] usb 1-1: SerialNumber: syz [ 223.340822][ T5920] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 223.358022][ T10] usb 1-1: config 0 descriptor?? [ 223.431495][ T7217] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 223.475192][ T7217] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 223.509277][ T5920] usb 5-1: unable to get BOS descriptor or descriptor too short [ 223.510449][ T7217] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 223.574707][ T7217] usb 4-1: media controller created [ 223.658028][ T5920] usb 5-1: config 13 has an invalid interface number: 2 but max is 0 [ 223.676365][ T10] usb 1-1: ignoring: probably an ADSL modem [ 223.683761][ T5920] usb 5-1: config 13 has no interface number 0 [ 223.704221][ T7217] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 223.708877][ T5920] usb 5-1: config 13 interface 2 altsetting 5 endpoint 0x2 has invalid maxpacket 17704, setting to 1024 [ 223.759192][ T5920] usb 5-1: config 13 interface 2 altsetting 5 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 223.782434][ T5920] usb 5-1: config 13 interface 2 altsetting 5 endpoint 0x4 has invalid wMaxPacketSize 0 [ 223.830788][ T5920] usb 5-1: config 13 interface 2 has no altsetting 0 [ 223.859274][ T5920] usb 5-1: New USB device found, idVendor=05ac, idProduct=022a, bcdDevice=57.1b [ 223.885068][ T5920] usb 5-1: New USB device strings: Mfr=1, Product=245, SerialNumber=2 [ 223.894423][ T7599] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 223.932904][ T5920] usb 5-1: Product: syz [ 223.940009][ T7599] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 223.953266][ T5920] usb 5-1: Manufacturer: syz [ 223.966462][ T5920] usb 5-1: SerialNumber: syz [ 223.979520][ T7599] az6027: more than 2 i2c messages at a time is not handled yet. TODO. [ 224.003967][ T7593] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 224.077884][ T10] cxacru 1-1:0.0: usbatm_usb_probe: bind failed: -19! [ 224.252965][ T7593] batadv_slave_0: entered promiscuous mode [ 224.291920][ T7592] batadv_slave_0: left promiscuous mode [ 224.297662][ T7589] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 224.328228][ T5920] appletouch 5-1:13.2: Could not find int-in endpoint [ 224.338683][ T7589] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 224.350373][ T5920] appletouch 5-1:13.2: probe with driver appletouch failed with error -5 [ 224.375232][ T5920] usbhid 5-1:13.2: couldn't find an input interrupt endpoint [ 224.454160][ T794] usb 1-1: USB disconnect, device number 31 [ 224.496599][ T5920] usb 5-1: USB disconnect, device number 24 [ 224.958606][ T7217] az6027: usb out operation failed. (-71) [ 224.962343][ T7604] sctp: [Deprecated]: syz.2.495 (pid 7604) Use of struct sctp_assoc_value in delayed_ack socket option. [ 224.962343][ T7604] Use struct sctp_sack_info instead [ 225.009145][ T7217] az6027: usb out operation failed. (-71) [ 225.017207][ T7217] stb0899_attach: Driver disabled by Kconfig [ 225.026049][ T7217] az6027: no front-end attached [ 225.026049][ T7217] [ 225.081649][ T7217] az6027: usb out operation failed. (-71) [ 225.132999][ T7217] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 225.176831][ T7217] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input23 [ 225.242397][ T7217] dvb-usb: schedule remote query interval to 400 msecs. [ 225.249426][ T7217] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 225.317807][ T7217] usb 4-1: USB disconnect, device number 24 [ 225.483321][ T7601] netlink: 9 bytes leftover after parsing attributes in process `syz.2.495'. [ 225.523009][ T794] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 225.823517][ T7217] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 225.824948][ T7601] netlink: 9 bytes leftover after parsing attributes in process `syz.2.495'. [ 225.930956][ T794] usb 1-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 225.940344][ T794] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.956633][ T794] usb 1-1: Product: syz [ 225.965270][ T794] usb 1-1: Manufacturer: syz [ 225.986243][ T794] usb 1-1: SerialNumber: syz [ 226.002137][ T794] usb 1-1: config 0 descriptor?? [ 226.284573][ T794] usb 1-1: ignoring: probably an ADSL modem [ 226.320796][ T980] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 226.441387][ T7217] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 226.502993][ T980] usb 3-1: Using ep0 maxpacket: 16 [ 226.513444][ T980] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 226.536533][ T980] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 226.551193][ T980] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 226.563492][ T980] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.589909][ T7627] netlink: 'syz.1.502': attribute type 1 has an invalid length. [ 226.591554][ T980] usb 3-1: Product: syz [ 226.613769][ T7217] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 226.623320][ T980] usb 3-1: Manufacturer: syz [ 226.637092][ T980] usb 3-1: SerialNumber: syz [ 226.641808][ T7217] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 226.641841][ T7217] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 226.641865][ T7217] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 226.641911][ T7217] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 226.641936][ T7217] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.701174][ T794] cxacru 1-1:0.0: usbatm_usb_probe: bind failed: -19! [ 226.702394][ T7217] usb 4-1: config 0 descriptor?? [ 226.759428][ T7631] netlink: 24 bytes leftover after parsing attributes in process `syz.1.502'. [ 226.810600][ T980] usb 3-1: config 0 descriptor?? [ 226.816295][ T980] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 226.816326][ T980] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 226.908975][ T7614] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 226.909587][ T7614] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 226.913759][ T794] usb 1-1: USB disconnect, device number 32 [ 226.976094][ T7627] 8021q: adding VLAN 0 to HW filter on device bond1 [ 226.980123][ T7629] syz_tun: entered promiscuous mode [ 227.015722][ T7629] bond1: (slave syz_tun): making interface the new active one [ 227.020740][ T7629] bond1: (slave syz_tun): Enslaving as an active interface with an up link [ 227.147825][ T7217] plantronics 0003:047F:FFFF.0009: ignoring exceeding usage max [ 227.168749][ T7217] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 227.467609][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 227.467627][ T30] audit: type=1326 audit(1765579985.280:545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7610 comm="syz.3.498" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa6539 code=0x7ffc0000 [ 227.517453][ T30] audit: type=1326 audit(1765579985.280:546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7610 comm="syz.3.498" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa6539 code=0x7ffc0000 [ 227.550020][ T980] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 227.557152][ T30] audit: type=1326 audit(1765579985.280:547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7610 comm="syz.3.498" exe="/root/syz-executor" sig=0 arch=40000003 syscall=428 compat=1 ip=0xf7fa6539 code=0x7ffc0000 [ 227.579573][ T980] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 227.623917][ T30] audit: type=1326 audit(1765579985.280:548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7610 comm="syz.3.498" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa6539 code=0x7ffc0000 [ 227.646430][ T30] audit: type=1326 audit(1765579985.280:549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7610 comm="syz.3.498" exe="/root/syz-executor" sig=0 arch=40000003 syscall=125 compat=1 ip=0xf7fa6539 code=0x7ffc0000 [ 227.674281][ T30] audit: type=1326 audit(1765579985.290:550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7610 comm="syz.3.498" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa6539 code=0x7ffc0000 [ 227.698165][ T30] audit: type=1326 audit(1765579985.360:551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7610 comm="syz.3.498" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa6539 code=0x7ffc0000 [ 227.845452][ T30] audit: type=1326 audit(1765579985.360:552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7610 comm="syz.3.498" exe="/root/syz-executor" sig=0 arch=40000003 syscall=329 compat=1 ip=0xf7fa6539 code=0x7ffc0000 [ 227.869074][ T30] audit: type=1326 audit(1765579985.360:553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7610 comm="syz.3.498" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa6539 code=0x7ffc0000 [ 227.918517][ T30] audit: type=1326 audit(1765579985.360:554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7610 comm="syz.3.498" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa6539 code=0x7ffc0000 [ 227.956626][ T7642] netlink: 20 bytes leftover after parsing attributes in process `syz.4.506'. [ 228.181767][ T7646] netlink: 4 bytes leftover after parsing attributes in process `syz.0.504'. [ 228.267511][ T980] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 228.274766][ T980] em28xx 3-1:0.0: No AC97 audio processor [ 228.386067][ T7652] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 228.416757][ T7652] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 228.874028][ T7657] syzkaller0: entered promiscuous mode [ 228.898620][ T7657] syzkaller0: entered allmulticast mode [ 229.237888][ T7661] netlink: 'syz.1.512': attribute type 1 has an invalid length. [ 229.272029][ T24] usb 4-1: USB disconnect, device number 25 [ 229.275317][ T7217] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 229.290392][ T7665] netlink: 12 bytes leftover after parsing attributes in process `syz.1.512'. [ 229.325868][ T7665] netlink: 12 bytes leftover after parsing attributes in process `syz.1.512'. [ 229.443746][ T7217] usb 5-1: unable to get BOS descriptor or descriptor too short [ 229.459397][ T7217] usb 5-1: config 13 has an invalid interface number: 2 but max is 0 [ 229.477106][ T7217] usb 5-1: config 13 has no interface number 0 [ 229.517919][ T7217] usb 5-1: config 13 interface 2 altsetting 5 endpoint 0x2 has invalid maxpacket 17704, setting to 1024 [ 229.543384][ T7661] bond2: entered promiscuous mode [ 229.548911][ T7661] 8021q: adding VLAN 0 to HW filter on device bond2 [ 229.616596][ T7217] usb 5-1: config 13 interface 2 altsetting 5 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 229.650144][ T7667] bond2: (slave bridge1): making interface the new active one [ 229.668539][ T7217] usb 5-1: config 13 interface 2 altsetting 5 endpoint 0x4 has invalid wMaxPacketSize 0 [ 229.686192][ T7667] bridge1: entered promiscuous mode [ 229.701351][ T7217] usb 5-1: config 13 interface 2 has no altsetting 0 [ 229.709137][ T7667] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 229.744373][ T7217] usb 5-1: New USB device found, idVendor=05ac, idProduct=022a, bcdDevice=57.1b [ 229.784999][ T7217] usb 5-1: New USB device strings: Mfr=1, Product=245, SerialNumber=2 [ 229.817624][ T7217] usb 5-1: Product: syz [ 229.817648][ T7217] usb 5-1: Manufacturer: syz [ 229.817665][ T7217] usb 5-1: SerialNumber: syz [ 229.903837][ T7657] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 230.110110][ T7657] batadv_slave_0: entered promiscuous mode [ 230.119932][ T7656] batadv_slave_0: left promiscuous mode [ 230.152920][ T7217] appletouch 5-1:13.2: Could not find int-in endpoint [ 230.248633][ T7217] appletouch 5-1:13.2: probe with driver appletouch failed with error -5 [ 230.397635][ T7217] usbhid 5-1:13.2: couldn't find an input interrupt endpoint [ 230.433195][ T7217] usb 5-1: USB disconnect, device number 25 [ 230.966064][ T980] usb 3-1: USB disconnect, device number 35 [ 230.980463][ T980] em28xx 3-1:0.0: Disconnecting em28xx [ 231.001146][ T980] em28xx 3-1:0.0: Freeing device [ 231.571274][ T9] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 231.731337][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 231.742399][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 231.762750][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 231.804263][ T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 231.827267][ T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 231.849705][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 231.878985][ T9] usb 4-1: New USB device found, idVendor=0505, idProduct=a4a1, bcdDevice= 0.40 [ 231.895266][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 231.912961][ T9] usb 4-1: SerialNumber: syz [ 231.921297][ T7217] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 231.943809][ T7689] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 231.960902][ T9] cdc_acm 4-1:1.0: Control and data interfaces are not separated! [ 231.980980][ T9] cdc_acm 4-1:1.0: probe with driver cdc_acm failed with error -12 [ 232.092074][ T7217] usb 5-1: Using ep0 maxpacket: 32 [ 232.112585][ T7217] usb 5-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 232.124740][ T7690] bridge0: port 2(bridge_slave_1) entered disabled state [ 232.133530][ T7690] bridge0: port 1(bridge_slave_0) entered disabled state [ 232.146054][ T7217] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.264953][ T7217] usb 5-1: Product: syz [ 232.269157][ T7217] usb 5-1: Manufacturer: syz [ 232.313859][ T7217] usb 5-1: SerialNumber: syz [ 232.488954][ T7217] usb 5-1: config 0 descriptor?? [ 232.540165][ T7217] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 232.719584][ T7217] dvb-usb: bulk message failed: -22 (2/0) [ 232.771870][ T7217] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 232.803355][ T7708] netlink: 4 bytes leftover after parsing attributes in process `syz.2.522'. [ 232.817678][ T7217] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 232.836429][ T7217] usb 5-1: media controller created [ 232.947370][ T7217] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 232.993064][ T7689] ptrace attach of "./syz-executor exec"[5853] was attempted by "./syz-executor exec"[7689] [ 233.526279][ T7217] usb 5-1: selecting invalid altsetting 7 [ 233.544550][ T7689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.570174][ T7689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.684326][ T7217] cxusb: set interface failed [ 233.689080][ T7217] dvb-usb: bulk message failed: -22 (1/0) [ 233.836530][ T7690] batadv_slave_0: left promiscuous mode [ 233.877859][ T7690] batadv_slave_0: left allmulticast mode [ 233.980446][ T7690] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 234.077222][ T7217] DVB: Unable to find symbol lgdt330x_attach() [ 234.094497][ T7217] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 234.631556][ T7217] rc_core: IR keymap rc-dvico-portable not found [ 234.653786][ T7217] Registered IR keymap rc-empty [ 234.686656][ T7217] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 234.755020][ T7217] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input24 [ 234.782308][ T7690] sit1: left allmulticast mode [ 234.801789][ T7217] dvb-usb: schedule remote query interval to 100 msecs. [ 234.860893][ T7217] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 234.927075][ T7217] usb 5-1: USB disconnect, device number 26 [ 235.043461][ T10] usb 4-1: USB disconnect, device number 26 [ 235.207686][ T7731] netlink: 20 bytes leftover after parsing attributes in process `syz.3.527'. [ 235.353675][ T1054] netdevsim netdevsim0 : unset [1, 0] type 2 family 0 port 6081 - 0 [ 235.376876][ T7217] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 235.424237][ T1054] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 235.469822][ T7739] netlink: 'syz.4.528': attribute type 10 has an invalid length. [ 235.490291][ T7731] openvswitch: netlink: Flow key attr not present in new flow. [ 235.508961][ T7736] warning: `syz.4.528' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 235.579679][ T7731] usb usb7: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 235.595506][ T7739] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 235.625983][ T1054] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 235.658200][ T1054] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 235.992105][ T7743] 8021q: adding VLAN 0 to HW filter on device bond2 [ 236.345651][ T7747] syzkaller0: entered promiscuous mode [ 236.373047][ T7747] syzkaller0: entered allmulticast mode [ 236.512906][ T7752] fuse: Bad value for 'fd' [ 236.519212][ T7751] input: syz0 as /devices/virtual/input/input25 [ 236.671373][ T7217] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 236.705647][ T7756] netlink: 'syz.0.533': attribute type 1 has an invalid length. [ 236.792575][ T7758] netlink: 12 bytes leftover after parsing attributes in process `syz.0.533'. [ 236.877155][ T7217] usb 3-1: unable to get BOS descriptor or descriptor too short [ 236.903513][ T7758] netlink: 12 bytes leftover after parsing attributes in process `syz.0.533'. [ 236.923839][ T7217] usb 3-1: config 13 has an invalid interface number: 2 but max is 0 [ 236.961371][ T7217] usb 3-1: config 13 has no interface number 0 [ 236.987325][ T7217] usb 3-1: config 13 interface 2 altsetting 5 endpoint 0x2 has invalid maxpacket 17704, setting to 1024 [ 237.049140][ T7756] bond1: entered promiscuous mode [ 237.090858][ T7217] usb 3-1: config 13 interface 2 altsetting 5 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 237.119336][ T7756] 8021q: adding VLAN 0 to HW filter on device bond1 [ 237.128966][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 237.128983][ T30] audit: type=1326 audit(1765579994.930:558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7763 comm="syz.4.536" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 237.181635][ T7217] usb 3-1: config 13 interface 2 altsetting 5 endpoint 0x4 has invalid wMaxPacketSize 0 [ 237.208866][ T7217] usb 3-1: config 13 interface 2 has no altsetting 0 [ 237.247253][ T30] audit: type=1326 audit(1765579994.930:559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7763 comm="syz.4.536" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 237.272172][ T30] audit: type=1326 audit(1765579994.930:560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7763 comm="syz.4.536" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 237.296559][ T7217] usb 3-1: New USB device found, idVendor=05ac, idProduct=022a, bcdDevice=57.1b [ 237.330564][ T7217] usb 3-1: New USB device strings: Mfr=1, Product=245, SerialNumber=2 [ 237.347765][ T30] audit: type=1326 audit(1765579994.930:561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7763 comm="syz.4.536" exe="/root/syz-executor" sig=0 arch=40000003 syscall=246 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 237.407871][ T7762] bond1: (slave bridge2): making interface the new active one [ 237.417092][ T7217] usb 3-1: Product: syz [ 237.428145][ T7217] usb 3-1: Manufacturer: syz [ 237.435834][ T7762] bridge2: entered promiscuous mode [ 237.441937][ T7217] usb 3-1: SerialNumber: syz [ 237.455615][ T7747] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 237.471484][ T30] audit: type=1326 audit(1765579994.980:562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7763 comm="syz.4.536" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 237.496071][ T7762] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 237.561524][ T30] audit: type=1326 audit(1765579994.990:563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7763 comm="syz.4.536" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 237.621362][ T30] audit: type=1326 audit(1765579994.990:564): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7763 comm="syz.4.536" exe="/root/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 237.694829][ T30] audit: type=1326 audit(1765579994.990:565): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7763 comm="syz.4.536" exe="/root/syz-executor" sig=0 arch=40000003 syscall=125 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 237.731689][ T7747] batadv_slave_0: entered promiscuous mode [ 237.742297][ T7746] batadv_slave_0: left promiscuous mode [ 237.750587][ T30] audit: type=1326 audit(1765579994.990:566): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7763 comm="syz.4.536" exe="/root/syz-executor" sig=0 arch=40000003 syscall=175 compat=1 ip=0xf707d539 code=0x7ffc0000 [ 237.773966][ T30] audit: type=1326 audit(1765579994.990:567): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7763 comm="syz.4.536" exe="/root/syz-executor" sig=0 arch=40000003 syscall=435 compat=1 ip=0xf7218b00 code=0x7ffc0000 [ 237.845126][ T7217] appletouch 3-1:13.2: Could not find int-in endpoint [ 237.875309][ T7217] appletouch 3-1:13.2: probe with driver appletouch failed with error -5 [ 237.922135][ T7217] usbhid 3-1:13.2: couldn't find an input interrupt endpoint [ 237.965079][ T7217] usb 3-1: USB disconnect, device number 36 [ 238.291497][ T7217] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 238.512100][ T7217] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 238.534660][ T7217] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 7 [ 238.719363][ T7217] usb 5-1: config 0 interface 0 has no altsetting 0 [ 238.746658][ T7217] usb 5-1: New USB device found, idVendor=09da, idProduct=000a, bcdDevice= 0.00 [ 238.756730][ T7217] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.785229][ T7217] usb 5-1: config 0 descriptor?? [ 239.091465][ T10] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 239.254472][ T7217] a4tech 0003:09DA:000A.000A: item fetching failed at offset 5/7 [ 239.279331][ T7217] a4tech 0003:09DA:000A.000A: parse failed [ 239.285972][ T7217] a4tech 0003:09DA:000A.000A: probe with driver a4tech failed with error -22 [ 239.481420][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 239.488252][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 239.501581][ T10] usb 4-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 239.511224][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.622887][ T10] usb 4-1: config 0 descriptor?? [ 239.658271][ T10] dvb-usb: found a 'TeVii S662' in warm state. [ 239.674764][ T10] dw2102: su3000_power_ctrl: 1, initialized 0 [ 239.696597][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 239.715942][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 239.736156][ T10] dvbdev: DVB: registering new adapter (TeVii S662) [ 239.749372][ T10] usb 4-1: media controller created [ 239.757520][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 239.765358][ T7798] fuse: Bad value for 'fd' [ 239.899158][ T10] dw2102: i2c transfer failed. [ 239.915784][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 239.941290][ T10] dw2102: i2c transfer failed. [ 239.946161][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 239.981866][ T10] dw2102: i2c transfer failed. [ 239.986689][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 240.018550][ T10] dw2102: i2c transfer failed. [ 240.031154][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 240.038698][ T10] dw2102: i2c transfer failed. [ 240.051869][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 240.072156][ T10] dw2102: i2c transfer failed. [ 240.080009][ T10] dvb-usb: MAC address: 02:02:02:02:02:02 [ 240.107932][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 240.178137][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 240.201627][ T10] dw2102: command 0x0e transfer failed. [ 240.207349][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 240.223994][ T10] dw2102: command 0x0e transfer failed. [ 240.538912][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 240.558261][ T10] dw2102: command 0x0e transfer failed. [ 240.585328][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 240.606206][ T10] dw2102: command 0x0e transfer failed. [ 240.618544][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 240.648930][ T10] dw2102: command 0x51 transfer failed. [ 240.666308][ T10] dvb-usb: bulk message failed: -22 (5/0) [ 240.683968][ T10] dw2102: i2c probe for address 0x68 failed. [ 240.700504][ T7817] syzkaller0: entered promiscuous mode [ 240.706299][ T10] dvb-usb: bulk message failed: -22 (5/0) [ 240.706322][ T10] dw2102: i2c probe for address 0x69 failed. [ 240.706336][ T10] dvb-usb: bulk message failed: -22 (5/0) [ 240.706352][ T10] dw2102: i2c probe for address 0x6a failed. [ 240.706364][ T10] dw2102: probing for demodulator failed. Is the external power switched on? [ 240.706377][ T10] dvb-usb: no frontend was attached by 'TeVii S662' [ 240.753509][ T7817] syzkaller0: entered allmulticast mode [ 241.108842][ T45] usb 5-1: USB disconnect, device number 27 [ 241.121335][ T793] usb 1-1: new full-speed USB device number 33 using dummy_hcd [ 241.254070][ T10] rc_core: IR keymap rc-tt-1500 not found [ 241.266258][ T10] Registered IR keymap rc-empty [ 241.298561][ T10] rc rc0: TeVii S662 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 241.314754][ T793] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 30768, setting to 64 [ 241.355509][ T793] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 241.361949][ T7825] netlink: 24 bytes leftover after parsing attributes in process `syz.2.554'. [ 241.378937][ T10] input: TeVii S662 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input26 [ 241.425045][ T7825] netlink: 60 bytes leftover after parsing attributes in process `syz.2.554'. [ 241.435679][ T793] usb 1-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 241.445373][ T793] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.472702][ T793] usb 1-1: config 0 descriptor?? [ 241.481989][ T10] dvb-usb: schedule remote query interval to 250 msecs. [ 241.484610][ T7825] vlan0: entered promiscuous mode [ 241.488964][ T10] dw2102: su3000_power_ctrl: 0, initialized 1 [ 241.562821][ T10] dvb-usb: TeVii S662 successfully initialized and connected. [ 241.650350][ T10] usb 4-1: USB disconnect, device number 27 [ 241.801934][ T10] dvb-usb: TeVii S662 successfully deinitialized and disconnected. [ 241.894963][ T793] hid-multitouch 0003:0457:07DA.000B: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.0-1/input0 [ 242.125560][ T5854] bond0: (slave syz_tun): Releasing backup interface [ 242.161185][ T10] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 242.219602][ T30] kauditd_printk_skb: 95 callbacks suppressed [ 242.219621][ T30] audit: type=1326 audit(1765580000.020:663): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7831 comm="syz.2.558" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 242.258953][ T30] audit: type=1326 audit(1765580000.020:664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7831 comm="syz.2.558" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 242.259004][ T30] audit: type=1326 audit(1765580000.020:665): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7831 comm="syz.2.558" exe="/root/syz-executor" sig=0 arch=40000003 syscall=283 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 242.259047][ T30] audit: type=1326 audit(1765580000.020:666): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7831 comm="syz.2.558" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 242.259088][ T30] audit: type=1326 audit(1765580000.020:667): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7831 comm="syz.2.558" exe="/root/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 242.259129][ T30] audit: type=1326 audit(1765580000.020:668): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7831 comm="syz.2.558" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 242.259171][ T30] audit: type=1326 audit(1765580000.020:669): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7831 comm="syz.2.558" exe="/root/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 242.259218][ T30] audit: type=1326 audit(1765580000.020:670): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7831 comm="syz.2.558" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 242.259261][ T30] audit: type=1326 audit(1765580000.020:671): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7831 comm="syz.2.558" exe="/root/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 242.259302][ T30] audit: type=1326 audit(1765580000.020:672): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7831 comm="syz.2.558" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 242.453391][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 242.454819][ T10] usb 4-1: config 13 has an invalid interface number: 2 but max is 0 [ 242.454846][ T10] usb 4-1: config 13 has no interface number 0 [ 242.454885][ T10] usb 4-1: config 13 interface 2 altsetting 5 endpoint 0x2 has invalid maxpacket 17704, setting to 1024 [ 242.454912][ T10] usb 4-1: config 13 interface 2 altsetting 5 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 242.454945][ T10] usb 4-1: config 13 interface 2 altsetting 5 endpoint 0x4 has invalid wMaxPacketSize 0 [ 242.454967][ T10] usb 4-1: config 13 interface 2 has no altsetting 0 [ 242.459242][ T10] usb 4-1: New USB device found, idVendor=05ac, idProduct=022a, bcdDevice=57.1b [ 242.459269][ T10] usb 4-1: New USB device strings: Mfr=1, Product=245, SerialNumber=2 [ 242.459288][ T10] usb 4-1: Product: syz [ 242.459305][ T10] usb 4-1: Manufacturer: syz [ 242.459315][ T10] usb 4-1: SerialNumber: syz [ 242.466431][ T7819] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 242.492424][ T7814] netlink: 666 bytes leftover after parsing attributes in process `syz.0.551'. [ 242.710510][ T7817] batadv_slave_0: entered promiscuous mode [ 242.713420][ T7816] batadv_slave_0: left promiscuous mode [ 242.718177][ T10] appletouch 4-1:13.2: Could not find int-in endpoint [ 242.718201][ T10] appletouch 4-1:13.2: probe with driver appletouch failed with error -5 [ 242.719135][ T10] usbhid 4-1:13.2: couldn't find an input interrupt endpoint [ 242.724490][ T10] usb 4-1: USB disconnect, device number 28 [ 243.493313][ T5843] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 243.504779][ T5843] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 243.521962][ T5843] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 243.529864][ T5843] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 243.537746][ T5843] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 243.600738][ T7849] netlink: 'syz.3.565': attribute type 6 has an invalid length. [ 244.450964][ T45] usb 1-1: USB disconnect, device number 33 [ 245.526685][ T7847] chnl_net:caif_netlink_parms(): no params data found [ 245.610820][ T5843] Bluetooth: hci4: command tx timeout [ 245.856619][ T7847] bridge0: port 1(bridge_slave_0) entered blocking state [ 245.874310][ T7847] bridge0: port 1(bridge_slave_0) entered disabled state [ 245.889505][ T7847] bridge_slave_0: entered allmulticast mode [ 245.897874][ T7847] bridge_slave_0: entered promiscuous mode [ 245.906884][ T7847] bridge0: port 2(bridge_slave_1) entered blocking state [ 245.915202][ T7847] bridge0: port 2(bridge_slave_1) entered disabled state [ 245.922583][ T7847] bridge_slave_1: entered allmulticast mode [ 245.930405][ T7847] bridge_slave_1: entered promiscuous mode [ 246.001095][ T7873] sctp: [Deprecated]: syz.3.566 (pid 7873) Use of struct sctp_assoc_value in delayed_ack socket option. [ 246.001095][ T7873] Use struct sctp_sack_info instead [ 246.034474][ T7847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 246.066298][ T7847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 246.184994][ T7847] team0: Port device team_slave_0 added [ 246.204451][ T7847] team0: Port device team_slave_1 added [ 246.256034][ T7847] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 246.263734][ T7847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 246.306743][ T7847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 246.323781][ T7847] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 246.331076][ T7847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 246.357288][ T7847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 246.428607][ T7847] hsr_slave_0: entered promiscuous mode [ 246.440414][ T7861] netlink: 9 bytes leftover after parsing attributes in process `syz.3.566'. [ 246.450937][ T7861] netlink: 9 bytes leftover after parsing attributes in process `syz.3.566'. [ 246.482057][ T7847] hsr_slave_1: entered promiscuous mode [ 246.488557][ T7847] debugfs: 'hsr0' already exists in 'hsr' [ 246.513745][ T7847] Cannot create hsr debugfs directory [ 246.782829][ T7847] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 246.800210][ T7847] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 246.813885][ T7847] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 246.828830][ T7847] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 247.099380][ T7847] 8021q: adding VLAN 0 to HW filter on device bond0 [ 247.163094][ T7847] 8021q: adding VLAN 0 to HW filter on device team0 [ 247.178088][ T5977] bridge0: port 1(bridge_slave_0) entered blocking state [ 247.185326][ T5977] bridge0: port 1(bridge_slave_0) entered forwarding state [ 247.203766][ T6012] bridge0: port 2(bridge_slave_1) entered blocking state [ 247.210972][ T6012] bridge0: port 2(bridge_slave_1) entered forwarding state [ 247.325766][ T7847] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 247.389994][ T7847] veth0_vlan: entered promiscuous mode [ 247.405122][ T7847] veth1_vlan: entered promiscuous mode [ 247.444382][ T7847] veth0_macvtap: entered promiscuous mode [ 247.464893][ T7847] veth1_macvtap: entered promiscuous mode [ 247.489595][ T7847] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 247.507548][ T7847] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 247.524720][ T6012] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.537785][ T6012] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.549361][ T6012] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.564713][ T6012] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.667329][ T3643] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 247.689864][ T3643] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 247.699945][ T5843] Bluetooth: hci4: command tx timeout [ 247.740606][ T6012] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 247.749382][ T6012] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 249.125379][ T7897] fuse: Bad value for 'fd' [ 249.208790][ T7899] syzkaller0: entered promiscuous mode [ 249.220763][ T7899] syzkaller0: entered allmulticast mode [ 249.244536][ T7899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.263642][ T7899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.271910][ T7901] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 249.371598][ T5919] usb 4-1: new low-speed USB device number 29 using dummy_hcd [ 249.571448][ T5919] usb 4-1: Invalid ep0 maxpacket: 64 [ 249.701719][ T5919] usb 4-1: new low-speed USB device number 30 using dummy_hcd [ 249.771796][ T5843] Bluetooth: hci4: command tx timeout [ 249.816488][ T7906] sctp: [Deprecated]: syz.2.573 (pid 7906) Use of struct sctp_assoc_value in delayed_ack socket option. [ 249.816488][ T7906] Use struct sctp_sack_info instead [ 249.871388][ T5919] usb 4-1: Invalid ep0 maxpacket: 64 [ 249.877429][ T5919] usb usb4-port1: attempt power cycle [ 250.161772][ T7908] sctp: [Deprecated]: syz.5.576 (pid 7908) Use of struct sctp_assoc_value in delayed_ack socket option. [ 250.161772][ T7908] Use struct sctp_sack_info instead [ 250.377177][ T5919] usb 4-1: new low-speed USB device number 31 using dummy_hcd [ 250.412063][ T5919] usb 4-1: Invalid ep0 maxpacket: 64 [ 250.423566][ T7905] netlink: 9 bytes leftover after parsing attributes in process `syz.5.576'. [ 250.443209][ T7905] netlink: 9 bytes leftover after parsing attributes in process `syz.5.576'. [ 250.482420][ T7895] netlink: 9 bytes leftover after parsing attributes in process `syz.2.573'. [ 250.553476][ T7895] netlink: 9 bytes leftover after parsing attributes in process `syz.2.573'. [ 250.591643][ T5919] usb 4-1: new low-speed USB device number 32 using dummy_hcd [ 250.624480][ T5919] usb 4-1: Invalid ep0 maxpacket: 64 [ 250.642357][ T5919] usb usb4-port1: unable to enumerate USB device [ 250.911870][ T7922] netlink: 8 bytes leftover after parsing attributes in process `syz.1.580'. [ 251.020817][ T980] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 251.041308][ T7930] binder: 7923:7930 ioctl c0306201 80000180 returned -14 [ 251.184549][ T980] usb 6-1: Using ep0 maxpacket: 16 [ 251.198351][ T980] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 251.218489][ T980] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 251.228992][ T980] usb 6-1: New USB device found, idVendor=0b05, idProduct=17e0, bcdDevice= 0.00 [ 251.241492][ T980] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.252990][ T980] usb 6-1: config 0 descriptor?? [ 251.281339][ T5919] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 251.431272][ T5919] usb 1-1: Using ep0 maxpacket: 32 [ 251.438422][ T5919] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 251.453320][ T5919] usb 1-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 251.463395][ T5919] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.475331][ T5919] usb 1-1: config 0 descriptor?? [ 251.496496][ T5919] dvb-usb: found a 'TeVii S662' in warm state. [ 251.504007][ T5919] dw2102: su3000_power_ctrl: 1, initialized 0 [ 251.589327][ T5919] dvb-usb: bulk message failed: -22 (2/0) [ 251.606864][ T5919] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 251.639942][ T5919] dvbdev: DVB: registering new adapter (TeVii S662) [ 251.657706][ T5919] usb 1-1: media controller created [ 251.668834][ T5919] dvb-usb: bulk message failed: -22 (6/0) [ 251.687360][ T5919] dw2102: i2c transfer failed. [ 251.717752][ T5919] dvb-usb: bulk message failed: -22 (6/0) [ 251.737073][ T5919] dw2102: i2c transfer failed. [ 251.757165][ T5919] dvb-usb: bulk message failed: -22 (6/0) [ 251.776210][ T5919] dw2102: i2c transfer failed. [ 251.799712][ T5919] dvb-usb: bulk message failed: -22 (6/0) [ 251.879027][ T5843] Bluetooth: hci4: command tx timeout [ 251.888822][ T5919] dw2102: i2c transfer failed. [ 251.891546][ T980] asus 0003:0B05:17E0.000C: unknown main item tag 0x0 [ 251.918194][ T5919] dvb-usb: bulk message failed: -22 (6/0) [ 251.942781][ T5919] dw2102: i2c transfer failed. [ 251.954217][ T5919] dvb-usb: bulk message failed: -22 (6/0) [ 251.961336][ T5919] dw2102: i2c transfer failed. [ 251.966377][ T5919] dvb-usb: MAC address: 02:02:02:02:02:02 [ 251.989883][ T5919] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 252.005610][ T980] asus 0003:0B05:17E0.000C: unknown main item tag 0x0 [ 252.026443][ T5919] dvb-usb: bulk message failed: -22 (3/0) [ 252.032756][ T5919] dw2102: command 0x0e transfer failed. [ 252.038328][ T5919] dvb-usb: bulk message failed: -22 (3/0) [ 252.045359][ T5919] dw2102: command 0x0e transfer failed. [ 252.220367][ T980] asus 0003:0B05:17E0.000C: unknown main item tag 0x0 [ 252.236985][ T980] asus 0003:0B05:17E0.000C: unknown main item tag 0x0 [ 252.244317][ T980] asus 0003:0B05:17E0.000C: unknown main item tag 0x0 [ 252.269125][ T980] asus 0003:0B05:17E0.000C: hidraw0: USB HID v0.00 Device [HID 0b05:17e0] on usb-dummy_hcd.5-1/input0 [ 252.320098][ T980] asus 0003:0B05:17E0.000C: Asus input not registered [ 252.338861][ T7940] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_to_bridge, syncid = 1, id = 0 [ 252.346664][ T980] asus 0003:0B05:17E0.000C: probe with driver asus failed with error -12 [ 252.621125][ T980] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 252.692867][ T5919] dvb-usb: bulk message failed: -22 (3/0) [ 252.702483][ T10] usb 6-1: USB disconnect, device number 2 [ 252.714117][ T5919] dw2102: command 0x0e transfer failed. [ 252.739234][ T5919] dvb-usb: bulk message failed: -22 (3/0) [ 252.760542][ T5919] dw2102: command 0x0e transfer failed. [ 252.783061][ T5919] dvb-usb: bulk message failed: -22 (1/0) [ 252.784359][ T980] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 252.817715][ T980] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.819941][ T5919] dw2102: command 0x51 transfer failed. [ 252.839352][ T980] usb 3-1: config 0 descriptor?? [ 252.870259][ T5919] dvb-usb: bulk message failed: -22 (5/0) [ 252.898874][ T980] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 252.902907][ T5919] dw2102: i2c probe for address 0x68 failed. [ 252.935405][ T5919] dvb-usb: bulk message failed: -22 (5/0) [ 252.963831][ T5919] dw2102: i2c probe for address 0x69 failed. [ 252.987023][ T5919] dvb-usb: bulk message failed: -22 (5/0) [ 253.002438][ T7949] syzkaller0: entered promiscuous mode [ 253.010292][ T5919] dw2102: i2c probe for address 0x6a failed. [ 253.026123][ T7949] syzkaller0: entered allmulticast mode [ 253.036190][ T5919] dw2102: probing for demodulator failed. Is the external power switched on? [ 253.063207][ T5919] dvb-usb: no frontend was attached by 'TeVii S662' [ 253.156633][ T10] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 253.167232][ T5919] rc_core: IR keymap rc-tt-1500 not found [ 253.199362][ T10] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 253.207354][ T5919] Registered IR keymap rc-empty [ 253.217382][ T5919] rc rc0: TeVii S662 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 253.229668][ T10] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 253.247353][ T10] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 253.256344][ T5919] input: TeVii S662 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input27 [ 253.285728][ T10] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 253.296963][ T5919] dvb-usb: schedule remote query interval to 250 msecs. [ 253.311710][ T45] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 253.323405][ T5919] dw2102: su3000_power_ctrl: 0, initialized 1 [ 253.351441][ T5919] dvb-usb: TeVii S662 successfully initialized and connected. [ 253.359245][ T10] hid-generic 0000:0000:0000.000D: hidraw0: HID v0.03 Device [syz1] on syz1 [ 253.498655][ T45] usb 4-1: unable to get BOS descriptor or descriptor too short [ 253.518924][ T45] usb 4-1: config 13 has an invalid interface number: 2 but max is 0 [ 253.547091][ T980] usb 3-1: USB disconnect, device number 37 [ 253.557728][ T45] usb 4-1: config 13 has no interface number 0 [ 253.574679][ T45] usb 4-1: config 13 interface 2 altsetting 5 endpoint 0x2 has invalid maxpacket 17704, setting to 1024 [ 253.588135][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 253.597191][ T45] usb 4-1: config 13 interface 2 altsetting 5 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 253.618628][ T45] usb 4-1: config 13 interface 2 altsetting 5 endpoint 0x4 has invalid wMaxPacketSize 0 [ 253.623780][ T10] dw2102: i2c transfer failed. [ 253.629214][ T45] usb 4-1: config 13 interface 2 has no altsetting 0 [ 253.646187][ T45] usb 4-1: New USB device found, idVendor=05ac, idProduct=022a, bcdDevice=57.1b [ 253.656989][ T45] usb 4-1: New USB device strings: Mfr=1, Product=245, SerialNumber=2 [ 253.665497][ T45] usb 4-1: Product: syz [ 253.665518][ T45] usb 4-1: Manufacturer: syz [ 253.665534][ T45] usb 4-1: SerialNumber: syz [ 253.681467][ T7949] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 253.912898][ T7949] batadv_slave_0: entered promiscuous mode [ 253.922129][ T7948] batadv_slave_0: left promiscuous mode [ 253.941378][ T5919] dvb-usb: bulk message failed: -22 (1/0) [ 253.942652][ T45] appletouch 4-1:13.2: Could not find int-in endpoint [ 253.947570][ T5919] dw2102: i2c transfer failed. [ 253.977626][ T7957] sctp: [Deprecated]: syz.5.589 (pid 7957) Use of struct sctp_assoc_value in delayed_ack socket option. [ 253.977626][ T7957] Use struct sctp_sack_info instead [ 253.992667][ T45] appletouch 4-1:13.2: probe with driver appletouch failed with error -5 [ 254.032498][ T45] usbhid 4-1:13.2: couldn't find an input interrupt endpoint [ 254.111634][ T45] usb 4-1: USB disconnect, device number 33 [ 254.251463][ T7956] netlink: 9 bytes leftover after parsing attributes in process `syz.5.589'. [ 254.260888][ T793] dvb-usb: bulk message failed: -22 (1/0) [ 254.268000][ T7956] netlink: 9 bytes leftover after parsing attributes in process `syz.5.589'. [ 254.274487][ T793] dw2102: i2c transfer failed. [ 254.323006][ T45] usb 1-1: USB disconnect, device number 34 [ 254.345118][ T7962] FAULT_INJECTION: forcing a failure. [ 254.345118][ T7962] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 254.382777][ T7962] CPU: 0 UID: 0 PID: 7962 Comm: syz.1.591 Tainted: G L syzkaller #0 PREEMPT(full) [ 254.382813][ T7962] Tainted: [L]=SOFTLOCKUP [ 254.382822][ T7962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 254.382835][ T7962] Call Trace: [ 254.382844][ T7962] [ 254.382853][ T7962] dump_stack_lvl+0x189/0x250 [ 254.382887][ T7962] ? __pfx____ratelimit+0x10/0x10 [ 254.382919][ T7962] ? __pfx_dump_stack_lvl+0x10/0x10 [ 254.382944][ T7962] ? __pfx__printk+0x10/0x10 [ 254.382977][ T7962] ? __might_fault+0xb0/0x130 [ 254.383029][ T7962] should_fail_ex+0x414/0x560 [ 254.383064][ T7962] _copy_from_user+0x2d/0xb0 [ 254.383088][ T7962] kstrtouint_from_user+0xc4/0x170 [ 254.383121][ T7962] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 254.383169][ T7962] proc_fail_nth_write+0x88/0x200 [ 254.383194][ T7962] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 254.383224][ T7962] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 254.383249][ T7962] vfs_write+0x27e/0xb30 [ 254.383280][ T7962] ? __pfx_vfs_write+0x10/0x10 [ 254.383303][ T7962] ? __fget_files+0x2a/0x420 [ 254.383336][ T7962] ? __fget_files+0x3a0/0x420 [ 254.383362][ T7962] ? __fget_files+0x2a/0x420 [ 254.383399][ T7962] ksys_write+0x145/0x250 [ 254.383424][ T7962] ? __pfx_ksys_write+0x10/0x10 [ 254.383450][ T7962] ? __do_fast_syscall_32+0xbe/0x570 [ 254.383476][ T7962] __do_fast_syscall_32+0x1f7/0x570 [ 254.383497][ T7962] ? rcu_is_watching+0x15/0xb0 [ 254.383523][ T7962] ? do_fast_syscall_32+0x34/0x80 [ 254.383550][ T7962] do_fast_syscall_32+0x34/0x80 [ 254.383571][ T7962] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 254.383597][ T7962] RIP: 0023:0xf6ffd539 [ 254.383617][ T7962] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 254.383647][ T7962] RSP: 002b:00000000f53ed590 EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 254.383669][ T7962] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f53ed620 [ 254.383684][ T7962] RDX: 0000000000000001 RSI: 00000000f7396ff4 RDI: 0000000000000000 [ 254.383696][ T7962] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 254.383708][ T7962] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 254.383720][ T7962] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 254.383752][ T7962] [ 254.644258][ T7965] syzkaller0: entered promiscuous mode [ 254.653054][ T7965] syzkaller0: entered allmulticast mode [ 254.772729][ T7968] syzkaller0: entered promiscuous mode [ 254.778266][ T7968] syzkaller0: entered allmulticast mode [ 254.827746][ T45] dvb-usb: TeVii S662 successfully deinitialized and disconnected. [ 254.890067][ T7974] binder: 7970:7974 ioctl c0306201 80000180 returned -14 [ 254.940827][ T7714] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 255.487289][ T7714] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 255.547862][ T7714] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.573178][ T7714] usb 3-1: Product: syz [ 255.580009][ T7714] usb 3-1: Manufacturer: syz [ 255.588029][ T7714] usb 3-1: SerialNumber: syz [ 255.616343][ T7714] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 255.680328][ T45] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 255.838796][ T7988] bond1: invalid ARP target 0.0.0.0 specified for addition [ 255.857107][ T7988] bond1: option arp_ip_target: invalid value (0) [ 255.932770][ T7988] bond1 (unregistering): Released all slaves [ 256.154128][ T7963] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 256.173038][ T7963] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 256.224579][ T7963] IPVS: set_ctl: invalid protocol: 255 127.0.0.1:20001 [ 256.298119][ T794] usb 3-1: USB disconnect, device number 38 [ 256.588618][ T7997] netlink: 28 bytes leftover after parsing attributes in process `syz.5.601'. [ 256.756174][ T45] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 256.772896][ T45] ath9k_htc: Failed to initialize the device [ 256.812412][ T794] usb 3-1: ath9k_htc: USB layer deinitialized [ 256.954070][ T8004] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 257.991559][ T8018] netlink: 176 bytes leftover after parsing attributes in process `syz.0.606'. [ 258.001618][ T8018] openvswitch: netlink: Flow key attr not present in new flow. [ 258.413109][ T8020] sctp: [Deprecated]: syz.5.605 (pid 8020) Use of struct sctp_assoc_value in delayed_ack socket option. [ 258.413109][ T8020] Use struct sctp_sack_info instead [ 258.871931][ T8012] netlink: 9 bytes leftover after parsing attributes in process `syz.5.605'. [ 258.881818][ T8012] netlink: 9 bytes leftover after parsing attributes in process `syz.5.605'. [ 259.094125][ T8023] tipc: Started in network mode [ 259.099018][ T8023] tipc: Node identity 2e1a3863fdb3, cluster identity 4711 [ 259.135092][ T8023] tipc: Enabled bearer , priority 0 [ 259.155982][ T8025] FAULT_INJECTION: forcing a failure. [ 259.155982][ T8025] name failslab, interval 1, probability 0, space 0, times 0 [ 259.169459][ T8026] syzkaller0: entered promiscuous mode [ 259.175624][ T8026] syzkaller0: entered allmulticast mode [ 259.195389][ T8025] CPU: 1 UID: 0 PID: 8025 Comm: syz.3.608 Tainted: G L syzkaller #0 PREEMPT(full) [ 259.195421][ T8025] Tainted: [L]=SOFTLOCKUP [ 259.195429][ T8025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 259.195442][ T8025] Call Trace: [ 259.195450][ T8025] [ 259.195459][ T8025] dump_stack_lvl+0x189/0x250 [ 259.195489][ T8025] ? __pfx____ratelimit+0x10/0x10 [ 259.195525][ T8025] ? __pfx_dump_stack_lvl+0x10/0x10 [ 259.195550][ T8025] ? __pfx__printk+0x10/0x10 [ 259.195583][ T8025] ? __pfx___might_resched+0x10/0x10 [ 259.195606][ T8025] ? fs_reclaim_acquire+0x7d/0x100 [ 259.195634][ T8025] should_fail_ex+0x414/0x560 [ 259.195667][ T8025] should_failslab+0xa8/0x100 [ 259.195694][ T8025] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 259.195729][ T8025] ? __alloc_skb+0x255/0x430 [ 259.195758][ T8025] ? napi_skb_cache_get+0x4a5/0x780 [ 259.195787][ T8025] ? napi_skb_cache_get+0x151/0x780 [ 259.195822][ T8025] __alloc_skb+0x255/0x430 [ 259.195855][ T8025] ? __pfx___alloc_skb+0x10/0x10 [ 259.195889][ T8025] ? netlink_autobind+0xdb/0x300 [ 259.195911][ T8025] ? netlink_autobind+0x2c2/0x300 [ 259.195950][ T8025] netlink_sendmsg+0x5c6/0xb30 [ 259.195999][ T8025] ? __pfx_netlink_sendmsg+0x10/0x10 [ 259.196025][ T8025] ? __import_iovec+0x5d4/0x7f0 [ 259.196044][ T8025] ? aa_sock_msg_perm+0xf1/0x1b0 [ 259.196068][ T8025] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 259.196088][ T8025] ? __pfx_netlink_sendmsg+0x10/0x10 [ 259.196113][ T8025] __sock_sendmsg+0x21c/0x270 [ 259.196142][ T8025] ____sys_sendmsg+0x52d/0x820 [ 259.196170][ T8025] ? __pfx_____sys_sendmsg+0x10/0x10 [ 259.196208][ T8025] ___sys_sendmsg+0x21f/0x2a0 [ 259.196231][ T8025] ? __pfx____sys_sendmsg+0x10/0x10 [ 259.196254][ T8025] ? kstrtoull+0x12f/0x1d0 [ 259.196313][ T8025] ? __fget_files+0x2a/0x420 [ 259.196339][ T8025] ? __fget_files+0x3a0/0x420 [ 259.196376][ T8025] __sys_sendmmsg+0x28e/0x430 [ 259.196403][ T8025] ? __pfx___sys_sendmmsg+0x10/0x10 [ 259.196434][ T8025] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 259.196471][ T8025] ? ksys_write+0x22a/0x250 [ 259.196490][ T8025] ? exc_page_fault+0x82/0x100 [ 259.196537][ T8025] ? __pfx_ksys_write+0x10/0x10 [ 259.196561][ T8025] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 259.196587][ T8025] __do_fast_syscall_32+0x1f7/0x570 [ 259.196607][ T8025] ? rcu_is_watching+0x15/0xb0 [ 259.196629][ T8025] ? do_fast_syscall_32+0x34/0x80 [ 259.196653][ T8025] do_fast_syscall_32+0x34/0x80 [ 259.196672][ T8025] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 259.196695][ T8025] RIP: 0023:0xf7fa6539 [ 259.196711][ T8025] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 259.196728][ T8025] RSP: 002b:00000000f549655c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 259.196748][ T8025] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080000000 [ 259.196762][ T8025] RDX: 0000000000000235 RSI: 0000000000000000 RDI: 0000000000000000 [ 259.196773][ T8025] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 259.196784][ T8025] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 259.196795][ T8025] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 259.196823][ T8025] [ 259.581924][ T8022] tipc: Resetting bearer [ 259.637799][ T8022] tipc: Disabling bearer [ 260.525478][ T8047] FAULT_INJECTION: forcing a failure. [ 260.525478][ T8047] name failslab, interval 1, probability 0, space 0, times 0 [ 260.538782][ T8047] CPU: 1 UID: 0 PID: 8047 Comm: syz.1.614 Tainted: G L syzkaller #0 PREEMPT(full) [ 260.538812][ T8047] Tainted: [L]=SOFTLOCKUP [ 260.538819][ T8047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 260.538831][ T8047] Call Trace: [ 260.538840][ T8047] [ 260.538848][ T8047] dump_stack_lvl+0x189/0x250 [ 260.538877][ T8047] ? __pfx____ratelimit+0x10/0x10 [ 260.538907][ T8047] ? __pfx_dump_stack_lvl+0x10/0x10 [ 260.538931][ T8047] ? __pfx__printk+0x10/0x10 [ 260.538964][ T8047] ? __pfx___might_resched+0x10/0x10 [ 260.538986][ T8047] ? fs_reclaim_acquire+0x7d/0x100 [ 260.539013][ T8047] should_fail_ex+0x414/0x560 [ 260.539044][ T8047] should_failslab+0xa8/0x100 [ 260.539072][ T8047] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 260.539109][ T8047] ? __alloc_skb+0x255/0x430 [ 260.539157][ T8047] ? napi_skb_cache_get+0x4a5/0x780 [ 260.539219][ T8047] ? napi_skb_cache_get+0x151/0x780 [ 260.539258][ T8047] __alloc_skb+0x255/0x430 [ 260.539294][ T8047] ? __pfx___alloc_skb+0x10/0x10 [ 260.539326][ T8047] ? __page_table_check_zero+0x397/0x3e0 [ 260.539350][ T8047] ? look_up_lock_class+0x74/0x150 [ 260.539391][ T8047] alloc_skb_with_frags+0xca/0x890 [ 260.539419][ T8047] ? __lock_acquire+0x6b6/0x2cf0 [ 260.539449][ T8047] sock_alloc_send_pskb+0x84d/0x980 [ 260.539493][ T8047] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 260.539520][ T8047] ? __local_bh_enable_ip+0x12d/0x1c0 [ 260.539543][ T8047] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 260.539578][ T8047] j1939_sk_sendmsg+0x6f5/0x1350 [ 260.539608][ T8047] ? aa_sk_perm+0x15f/0x920 [ 260.539649][ T8047] ? __pfx_j1939_sk_sendmsg+0x10/0x10 [ 260.539679][ T8047] ? __import_iovec+0x5d4/0x7f0 [ 260.539699][ T8047] ? aa_sock_msg_perm+0xf1/0x1b0 [ 260.539725][ T8047] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 260.539745][ T8047] ? __pfx_j1939_sk_sendmsg+0x10/0x10 [ 260.539776][ T8047] __sock_sendmsg+0x21c/0x270 [ 260.539807][ T8047] ____sys_sendmsg+0x505/0x820 [ 260.539842][ T8047] ? __pfx_____sys_sendmsg+0x10/0x10 [ 260.539870][ T8047] ? kstrtouint+0x6e/0xe0 [ 260.539907][ T8047] ___sys_sendmsg+0x21f/0x2a0 [ 260.539932][ T8047] ? __pfx____sys_sendmsg+0x10/0x10 [ 260.539963][ T8047] ? rcu_read_lock_any_held+0xb3/0x120 [ 260.540020][ T8047] ? __fget_files+0x2a/0x420 [ 260.540046][ T8047] ? __fget_files+0x3a0/0x420 [ 260.540085][ T8047] __sys_sendmsg+0x164/0x220 [ 260.540110][ T8047] ? __pfx___sys_sendmsg+0x10/0x10 [ 260.540160][ T8047] ? __pfx_ksys_write+0x10/0x10 [ 260.540187][ T8047] ? __do_fast_syscall_32+0xbe/0x570 [ 260.540213][ T8047] __do_fast_syscall_32+0x1f7/0x570 [ 260.540236][ T8047] ? rcu_is_watching+0x15/0xb0 [ 260.540268][ T8047] ? do_fast_syscall_32+0x34/0x80 [ 260.540295][ T8047] do_fast_syscall_32+0x34/0x80 [ 260.540317][ T8047] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.540345][ T8047] RIP: 0023:0xf6ffd539 [ 260.540363][ T8047] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 260.540382][ T8047] RSP: 002b:00000000f53ab55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 260.540411][ T8047] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000800001c0 [ 260.540439][ T8047] RDX: 00000000000000ee RSI: 0000000000000000 RDI: 0000000000000000 [ 260.540452][ T8047] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 260.540466][ T8047] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 260.540479][ T8047] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 260.540516][ T8047] [ 260.985930][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 260.993567][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 261.472511][ T8055] binder: 8053:8055 ioctl c0306201 0 returned -14 [ 261.552179][ T8055] binder: 8053:8055 ioctl 5502 0 returned -22 [ 261.566863][ T8056] netlink: 5 bytes leftover after parsing attributes in process `syz.2.617'. [ 261.579607][ T8055] binder: 8053:8055 ioctl c0306201 0 returned -14 [ 261.831334][ T9] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 261.993195][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 262.003899][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 262.035849][ T9] usb 1-1: config 7 has an invalid interface number: 142 but max is 0 [ 262.049221][ T8062] binder: 8057:8062 ioctl c0306201 80000180 returned -14 [ 262.075424][ T9] usb 1-1: config 7 has no interface number 0 [ 262.092819][ T9] usb 1-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice=dd.6d [ 262.107457][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.153775][ T9] usb 1-1: Product: syz [ 262.162635][ T9] usb 1-1: Manufacturer: syz [ 262.169585][ T9] usb 1-1: SerialNumber: syz [ 262.400107][ T8059] sctp: [Deprecated]: syz.3.618 (pid 8059) Use of struct sctp_assoc_value in delayed_ack socket option. [ 262.400107][ T8059] Use struct sctp_sack_info instead [ 262.433726][ T9] usb 1-1: USB disconnect, device number 35 [ 262.538554][ T8059] netlink: 9 bytes leftover after parsing attributes in process `syz.3.618'. [ 262.548363][ T8059] netlink: 9 bytes leftover after parsing attributes in process `syz.3.618'. [ 262.823411][ T8082] netlink: 112 bytes leftover after parsing attributes in process `syz.3.624'. [ 262.833114][ T8083] netlink: 112 bytes leftover after parsing attributes in process `syz.3.624'. [ 263.780723][ T5921] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 263.825298][ T8100] : entered promiscuous mode [ 263.931154][ T5921] usb 3-1: Using ep0 maxpacket: 32 [ 263.949183][ T5921] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 263.970888][ T5921] usb 3-1: config 0 has no interface number 0 [ 263.990738][ T5921] usb 3-1: config 0 interface 12 has no altsetting 0 [ 264.021477][ T5921] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 264.188592][ T5921] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.230313][ T5921] usb 3-1: Product: syz [ 264.238292][ T5921] usb 3-1: Manufacturer: syz [ 264.252874][ T5921] usb 3-1: SerialNumber: syz [ 264.273225][ T5921] usb 3-1: config 0 descriptor?? [ 265.601842][ T8122] binder: 8116:8122 ioctl c0306201 80000180 returned -14 [ 265.634643][ T8123] binder: 8118:8123 ioctl c0306201 80000180 returned -14 [ 265.864656][ T8115] sctp: [Deprecated]: syz.3.633 (pid 8115) Use of struct sctp_assoc_value in delayed_ack socket option. [ 265.864656][ T8115] Use struct sctp_sack_info instead [ 266.030976][ T8115] netlink: 9 bytes leftover after parsing attributes in process `syz.3.633'. [ 266.043430][ T8115] netlink: 9 bytes leftover after parsing attributes in process `syz.3.633'. [ 266.266885][ T5921] f81534 3-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 266.276897][ T5921] f81534 3-1:0.12: f81534_find_config_idx: read failed: -71 [ 266.284398][ T5921] f81534 3-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 266.312388][ T8142] loop6: detected capacity change from 0 to 524287999 [ 266.328112][ T5921] f81534 3-1:0.12: probe with driver f81534 failed with error -71 [ 266.419635][ T5921] usb 3-1: USB disconnect, device number 39 [ 266.921766][ T7217] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 267.023673][ T8151] netlink: 'syz.0.644': attribute type 5 has an invalid length. [ 267.050558][ T8151] netlink: 28 bytes leftover after parsing attributes in process `syz.0.644'. [ 267.092303][ T8151] netlink: 28 bytes leftover after parsing attributes in process `syz.0.644'. [ 267.105912][ T7217] usb 6-1: not running at top speed; connect to a high speed hub [ 267.121644][ T7217] usb 6-1: config 7 has an invalid interface number: 172 but max is 3 [ 267.130310][ T7217] usb 6-1: config 7 has an invalid interface number: 127 but max is 3 [ 267.147399][ T7217] usb 6-1: config 7 has an invalid interface number: 254 but max is 3 [ 267.168614][ T7217] usb 6-1: config 7 has an invalid interface number: 36 but max is 3 [ 267.222716][ T7217] usb 6-1: config 7 has an invalid descriptor of length 161, skipping remainder of the config [ 267.317576][ T7217] usb 6-1: config 7 has no interface number 0 [ 267.337774][ T7217] usb 6-1: config 7 has no interface number 1 [ 267.748264][ T7217] usb 6-1: config 7 has no interface number 2 [ 267.766332][ T7217] usb 6-1: config 7 has no interface number 3 [ 267.775268][ T7217] usb 6-1: config 7 interface 172 altsetting 14 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 267.786918][ T7217] usb 6-1: config 7 interface 127 altsetting 12 has an invalid descriptor for endpoint zero, skipping [ 267.798887][ T7217] usb 6-1: config 7 interface 127 altsetting 12 has a duplicate endpoint with address 0x7, skipping [ 267.810210][ T7217] usb 6-1: config 7 interface 127 altsetting 12 has a duplicate endpoint with address 0x2, skipping [ 267.842210][ T7217] usb 6-1: config 7 interface 127 altsetting 12 has an invalid descriptor for endpoint zero, skipping [ 267.854281][ T7217] usb 6-1: config 7 interface 127 altsetting 12 endpoint 0x4 has invalid maxpacket 1024, setting to 64 [ 267.866653][ T7217] usb 6-1: config 7 interface 127 altsetting 12 endpoint 0x8 has an invalid bInterval 0, changing to 10 [ 267.879438][ T7217] usb 6-1: config 7 interface 127 altsetting 12 endpoint 0x8 has invalid maxpacket 1024, setting to 64 [ 267.891406][ T7217] usb 6-1: config 7 interface 254 altsetting 5 has a duplicate endpoint with address 0x3, skipping [ 267.911503][ T7217] usb 6-1: config 7 interface 254 altsetting 5 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 267.948412][ T7217] usb 6-1: config 7 interface 254 altsetting 5 has a duplicate endpoint with address 0xD, skipping [ 267.975777][ T7217] usb 6-1: config 7 interface 254 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 268.009972][ T7217] usb 6-1: config 7 interface 254 altsetting 5 has an endpoint descriptor with address 0x15, changing to 0x5 [ 268.041130][ T7217] usb 6-1: config 7 interface 254 altsetting 5 endpoint 0x5 has invalid maxpacket 10442, setting to 64 [ 268.162014][ T7217] usb 6-1: config 7 interface 254 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 268.211381][ T7217] usb 6-1: config 7 interface 254 altsetting 5 has a duplicate endpoint with address 0xD, skipping [ 268.240104][ T7217] usb 6-1: config 7 interface 254 altsetting 5 has a duplicate endpoint with address 0xB, skipping [ 268.274830][ T7217] usb 6-1: config 7 interface 254 altsetting 5 has 8 endpoint descriptors, different from the interface descriptor's value: 7 [ 268.303515][ T7217] usb 6-1: config 7 interface 36 altsetting 2 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 268.333126][ T7217] usb 6-1: config 7 interface 36 altsetting 2 has a duplicate endpoint with address 0x3, skipping [ 268.365101][ T7217] usb 6-1: config 7 interface 36 altsetting 2 has a duplicate endpoint with address 0x7, skipping [ 268.401189][ T7217] usb 6-1: config 7 interface 36 altsetting 2 has a duplicate endpoint with address 0x5, skipping [ 268.421225][ T7217] usb 6-1: config 7 interface 36 altsetting 2 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 268.443833][ T7217] usb 6-1: config 7 interface 36 altsetting 2 has 7 endpoint descriptors, different from the interface descriptor's value: 8 [ 268.471192][ T7217] usb 6-1: config 7 interface 172 has no altsetting 0 [ 268.501468][ T7217] usb 6-1: config 7 interface 127 has no altsetting 0 [ 268.517944][ T8169] sctp: [Deprecated]: syz.3.648 (pid 8169) Use of struct sctp_assoc_value in delayed_ack socket option. [ 268.517944][ T8169] Use struct sctp_sack_info instead [ 268.537393][ T7217] usb 6-1: config 7 interface 254 has no altsetting 0 [ 268.551292][ T7217] usb 6-1: config 7 interface 36 has no altsetting 0 [ 268.565378][ T7217] usb 6-1: New USB device found, idVendor=14cd, idProduct=6116, bcdDevice= 1.5e [ 268.581156][ T7217] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.599350][ T7217] usb 6-1: Product: syz [ 268.614019][ T7217] usb 6-1: Manufacturer: Ⰺ [ 268.621123][ T7217] usb 6-1: SerialNumber: syz [ 268.674896][ T8166] netlink: 9 bytes leftover after parsing attributes in process `syz.3.648'. [ 268.691635][ T8166] netlink: 9 bytes leftover after parsing attributes in process `syz.3.648'. [ 268.803826][ T8172] tipc: Started in network mode [ 268.829300][ T8172] tipc: Node identity ea8a99641ba, cluster identity 4711 [ 268.859309][ T7217] ums-cypress 6-1:7.172: USB Mass Storage device detected [ 268.871205][ T8172] tipc: Enabled bearer , priority 0 [ 268.878703][ T8174] syzkaller0: entered promiscuous mode [ 268.910384][ T8174] syzkaller0: entered allmulticast mode [ 268.982373][ T7217] ums-cypress 6-1:7.127: USB Mass Storage device detected [ 268.998998][ T8172] tipc: Resetting bearer [ 269.016677][ T8170] tipc: Resetting bearer [ 269.079399][ T7217] usbhid 6-1:7.127: couldn't find an input interrupt endpoint [ 269.122502][ T8170] tipc: Disabling bearer [ 269.176693][ T7217] ums-cypress 6-1:7.254: USB Mass Storage device detected [ 269.298851][ T7217] ums-cypress 6-1:7.36: USB Mass Storage device detected [ 269.679466][ T8156] syz.2.643 (8156): drop_caches: 2 [ 269.939448][ T7217] usb 6-1: USB disconnect, device number 3 [ 270.492842][ T7714] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 270.770455][ T7714] usb 3-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 270.831307][ T7714] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 270.839360][ T7714] usb 3-1: Product: syz [ 270.931908][ T7714] usb 3-1: Manufacturer: syz [ 270.937047][ T7714] usb 3-1: SerialNumber: syz [ 271.311710][ T7714] usb 3-1: config 0 descriptor?? [ 271.388680][ T8215] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 271.529136][ T7714] usb 3-1: ignoring: probably an ADSL modem [ 272.208332][ T7714] cxacru 3-1:0.0: usbatm_usb_probe: bind failed: -19! [ 272.372148][ T8231] openvswitch: netlink: Flow actions attr not present in new flow. [ 272.413127][ T8203] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 272.463437][ T8203] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 272.522652][ T45] usb 3-1: USB disconnect, device number 40 [ 272.744769][ T8236] netlink: 4 bytes leftover after parsing attributes in process `syz.1.666'. [ 272.870154][ T8235] ======================================================= [ 272.870154][ T8235] WARNING: The mand mount option has been deprecated and [ 272.870154][ T8235] and is ignored by this kernel. Remove the mand [ 272.870154][ T8235] option from the mount to silence this warning. [ 272.870154][ T8235] ======================================================= [ 272.939041][ T8235] netlink: zone id is out of range [ 272.963682][ T8235] netlink: zone id is out of range [ 272.983417][ T8235] netlink: zone id is out of range [ 272.996783][ T8235] netlink: zone id is out of range [ 273.023928][ T8235] netlink: zone id is out of range [ 273.039770][ T8235] netlink: zone id is out of range [ 273.051026][ T45] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 273.061306][ T8235] netlink: zone id is out of range [ 273.066452][ T8235] netlink: zone id is out of range [ 273.073973][ T8235] netlink: zone id is out of range [ 273.230773][ T45] usb 1-1: Using ep0 maxpacket: 8 [ 273.249353][ T45] usb 1-1: config 0 has an invalid interface number: 122 but max is 0 [ 273.285336][ T45] usb 1-1: config 0 has no interface number 0 [ 273.308641][ T45] usb 1-1: too many endpoints for config 0 interface 122 altsetting 184: 227, using maximum allowed: 30 [ 273.329181][ T45] usb 1-1: config 0 interface 122 altsetting 184 has 0 endpoint descriptors, different from the interface descriptor's value: 227 [ 273.343742][ T45] usb 1-1: config 0 interface 122 has no altsetting 0 [ 273.356586][ T45] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 273.362154][ T8249] FAULT_INJECTION: forcing a failure. [ 273.362154][ T8249] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 273.366017][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.396799][ T45] usb 1-1: Product: syz [ 273.401411][ T45] usb 1-1: Manufacturer: syz [ 273.417840][ T45] usb 1-1: SerialNumber: syz [ 273.419650][ T8249] CPU: 0 UID: 0 PID: 8249 Comm: syz.5.671 Tainted: G L syzkaller #0 PREEMPT(full) [ 273.419686][ T8249] Tainted: [L]=SOFTLOCKUP [ 273.419695][ T8249] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 273.419710][ T8249] Call Trace: [ 273.419720][ T8249] [ 273.419729][ T8249] dump_stack_lvl+0x189/0x250 [ 273.419764][ T8249] ? __pfx____ratelimit+0x10/0x10 [ 273.419799][ T8249] ? __pfx_dump_stack_lvl+0x10/0x10 [ 273.419828][ T8249] ? __pfx__printk+0x10/0x10 [ 273.419887][ T8249] ? __might_fault+0xb0/0x130 [ 273.419937][ T8249] should_fail_ex+0x414/0x560 [ 273.419975][ T8249] _copy_from_iter+0x1cd/0x1630 [ 273.420017][ T8249] ? __build_skb_around+0x22d/0x3c0 [ 273.420063][ T8249] ? __pfx__copy_from_iter+0x10/0x10 [ 273.420097][ T8249] ? __alloc_skb+0x2f1/0x430 [ 273.420134][ T8249] ? __pfx___alloc_skb+0x10/0x10 [ 273.420172][ T8249] ? netlink_sendmsg+0x642/0xb30 [ 273.420198][ T8249] ? skb_put+0x11b/0x210 [ 273.420224][ T8249] netlink_sendmsg+0x6b2/0xb30 [ 273.420261][ T8249] ? __pfx_netlink_sendmsg+0x10/0x10 [ 273.420292][ T8249] ? __import_iovec+0x5d4/0x7f0 [ 273.420313][ T8249] ? aa_sock_msg_perm+0xf1/0x1b0 [ 273.420342][ T8249] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 273.420365][ T8249] ? __pfx_netlink_sendmsg+0x10/0x10 [ 273.420393][ T8249] __sock_sendmsg+0x21c/0x270 [ 273.420427][ T8249] ____sys_sendmsg+0x505/0x820 [ 273.420459][ T8249] ? __pfx_____sys_sendmsg+0x10/0x10 [ 273.420489][ T8249] ? kstrtouint+0x6e/0xe0 [ 273.420527][ T8249] ___sys_sendmsg+0x21f/0x2a0 [ 273.420556][ T8249] ? __pfx____sys_sendmsg+0x10/0x10 [ 273.420587][ T8249] ? rcu_read_lock_any_held+0xb3/0x120 [ 273.420648][ T8249] ? __fget_files+0x2a/0x420 [ 273.420679][ T8249] ? __fget_files+0x3a0/0x420 [ 273.420719][ T8249] __sys_sendmsg+0x164/0x220 [ 273.420748][ T8249] ? __pfx___sys_sendmsg+0x10/0x10 [ 273.420784][ T8249] ? __pfx_ksys_write+0x10/0x10 [ 273.420812][ T8249] ? __do_fast_syscall_32+0xbe/0x570 [ 273.420841][ T8249] __do_fast_syscall_32+0x1f7/0x570 [ 273.420911][ T8249] ? rcu_is_watching+0x15/0xb0 [ 273.420939][ T8249] ? do_fast_syscall_32+0x34/0x80 [ 273.420967][ T8249] do_fast_syscall_32+0x34/0x80 [ 273.420989][ T8249] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 273.421019][ T8249] RIP: 0023:0xf706d539 [ 273.421039][ T8249] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 273.421059][ T8249] RSP: 002b:00000000f545d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 273.421085][ T8249] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 273.421102][ T8249] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000000 [ 273.421116][ T8249] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 273.421130][ T8249] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 273.421143][ T8249] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 273.421177][ T8249] [ 273.774253][ T45] usb 1-1: config 0 descriptor?? [ 274.849162][ T8266] tipc: Enabled bearer , priority 8 [ 275.152884][ T45] usb 1-1: USB disconnect, device number 36 [ 275.338028][ T8277] netlink: 164 bytes leftover after parsing attributes in process `syz.2.677'. [ 275.366036][ T8277] netlink: 164 bytes leftover after parsing attributes in process `syz.2.677'. [ 275.969997][ T5921] tipc: Node number set to 3551082595 [ 276.866231][ T8296] syzkaller0: entered promiscuous mode [ 276.871760][ T8296] syzkaller0: entered allmulticast mode [ 277.110722][ T5921] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 277.272791][ T5921] usb 1-1: unable to get BOS descriptor or descriptor too short [ 277.283888][ T5921] usb 1-1: config 13 has an invalid interface number: 2 but max is 0 [ 277.301477][ T5921] usb 1-1: config 13 has no interface number 0 [ 277.536334][ T5921] usb 1-1: config 13 interface 2 altsetting 5 endpoint 0x2 has invalid maxpacket 17704, setting to 1024 [ 277.639442][ T5921] usb 1-1: config 13 interface 2 altsetting 5 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 277.767976][ T5921] usb 1-1: config 13 interface 2 altsetting 5 endpoint 0x4 has invalid wMaxPacketSize 0 [ 277.931300][ T5921] usb 1-1: config 13 interface 2 has no altsetting 0 [ 277.972200][ T5921] usb 1-1: New USB device found, idVendor=05ac, idProduct=022a, bcdDevice=57.1b [ 277.990755][ T5921] usb 1-1: New USB device strings: Mfr=1, Product=245, SerialNumber=2 [ 278.010654][ T5921] usb 1-1: Product: syz [ 278.014839][ T5921] usb 1-1: Manufacturer: syz [ 278.031192][ T5921] usb 1-1: SerialNumber: syz [ 278.059197][ T8296] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 278.286194][ T8296] batadv_slave_0: entered promiscuous mode [ 278.295033][ T8295] batadv_slave_0: left promiscuous mode [ 278.305803][ T5921] appletouch 1-1:13.2: Could not find int-in endpoint [ 278.322222][ T5921] appletouch 1-1:13.2: probe with driver appletouch failed with error -5 [ 278.351413][ T5921] usbhid 1-1:13.2: couldn't find an input interrupt endpoint [ 278.393470][ T5921] usb 1-1: USB disconnect, device number 37 [ 278.815966][ T8328] netlink: 4 bytes leftover after parsing attributes in process `syz.2.685'. [ 279.015024][ T8334] netlink: 20 bytes leftover after parsing attributes in process `syz.5.688'. [ 279.488804][ T8336] net_ratelimit: 2 callbacks suppressed [ 279.488825][ T8336] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 279.803338][ T8344] sctp: [Deprecated]: syz.0.690 (pid 8344) Use of struct sctp_assoc_value in delayed_ack socket option. [ 279.803338][ T8344] Use struct sctp_sack_info instead [ 280.176752][ T8338] netlink: 9 bytes leftover after parsing attributes in process `syz.0.690'. [ 280.196750][ T8338] netlink: 9 bytes leftover after parsing attributes in process `syz.0.690'. [ 280.322507][ T8350] sctp: [Deprecated]: syz.2.691 (pid 8350) Use of struct sctp_assoc_value in delayed_ack socket option. [ 280.322507][ T8350] Use struct sctp_sack_info instead [ 280.635853][ T8343] netlink: 9 bytes leftover after parsing attributes in process `syz.2.691'. [ 280.652008][ T8343] netlink: 9 bytes leftover after parsing attributes in process `syz.2.691'. [ 281.197351][ T8362] trusted_key: encrypted_key: insufficient parameters specified [ 281.208654][ T8362] netlink: 20 bytes leftover after parsing attributes in process `syz.2.695'. [ 282.944975][ T8378] syzkaller0: entered promiscuous mode [ 282.958235][ T8378] syzkaller0: entered allmulticast mode [ 283.241363][ T6036] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 283.248994][ T7217] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 283.403440][ T7217] usb 6-1: Using ep0 maxpacket: 16 [ 283.411402][ T6036] usb 3-1: unable to get BOS descriptor or descriptor too short [ 283.428385][ T7217] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 283.442760][ T6036] usb 3-1: config 13 has an invalid interface number: 2 but max is 0 [ 283.458334][ T6036] usb 3-1: config 13 has no interface number 0 [ 283.472438][ T7217] usb 6-1: config 0 interface 0 altsetting 1 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 283.485954][ T6036] usb 3-1: config 13 interface 2 altsetting 5 endpoint 0x2 has invalid maxpacket 17704, setting to 1024 [ 283.501379][ T7217] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 283.517059][ T6036] usb 3-1: config 13 interface 2 altsetting 5 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 283.528923][ T7217] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x8F has invalid wMaxPacketSize 0 [ 283.543294][ T6036] usb 3-1: config 13 interface 2 altsetting 5 endpoint 0x4 has invalid wMaxPacketSize 0 [ 283.553895][ T7217] usb 6-1: config 0 interface 0 has no altsetting 0 [ 283.572652][ T6036] usb 3-1: config 13 interface 2 has no altsetting 0 [ 283.579999][ T7217] usb 6-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 283.591310][ T7217] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 283.621914][ T8385] input: syz1 as /devices/virtual/input/input28 [ 283.638908][ T6036] usb 3-1: New USB device found, idVendor=05ac, idProduct=022a, bcdDevice=57.1b [ 283.654243][ T6036] usb 3-1: New USB device strings: Mfr=1, Product=245, SerialNumber=2 [ 283.673420][ T7217] usb 6-1: Product: syz [ 283.689160][ T7217] usb 6-1: Manufacturer: syz [ 283.694745][ T6036] usb 3-1: Product: syz [ 283.702210][ T7217] usb 6-1: SerialNumber: syz [ 283.707130][ T6036] usb 3-1: Manufacturer: syz [ 283.716605][ T6036] usb 3-1: SerialNumber: syz [ 283.723621][ T7217] usb 6-1: config 0 descriptor?? [ 283.759932][ T8381] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 283.949491][ T7217] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input29 [ 283.974001][ T5186] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 283.989762][ T8378] batadv_slave_0: entered promiscuous mode [ 284.002150][ T8376] batadv_slave_0: left promiscuous mode [ 284.009434][ T5186] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 284.038824][ T6036] appletouch 3-1:13.2: Could not find int-in endpoint [ 284.059404][ T5186] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 284.066698][ T6036] appletouch 3-1:13.2: probe with driver appletouch failed with error -5 [ 284.117117][ T6036] usbhid 3-1:13.2: couldn't find an input interrupt endpoint [ 284.135403][ T5186] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 284.155076][ T6036] usb 3-1: USB disconnect, device number 41 [ 284.173277][ T8382] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 284.186365][ T5842] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 284.214936][ T8382] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 284.222956][ T5186] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 284.288428][ T5186] synaptics_usb 6-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 284.423006][ T7217] usb 6-1: USB disconnect, device number 4 [ 284.650472][ T8410] fuse: Bad value for 'fd' [ 285.073134][ T8420] program syz.2.713 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 285.361415][ T8421] trusted_key: encrypted_key: insufficient parameters specified [ 285.474662][ T8421] netlink: 20 bytes leftover after parsing attributes in process `syz.5.712'. [ 286.937817][ T8440] netlink: 104 bytes leftover after parsing attributes in process `syz.2.716'. [ 286.948977][ T8440] netlink: 'syz.2.716': attribute type 13 has an invalid length. [ 286.982690][ T8440] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 287.762983][ T8438] sctp: [Deprecated]: syz.3.717 (pid 8438) Use of struct sctp_assoc_value in delayed_ack socket option. [ 287.762983][ T8438] Use struct sctp_sack_info instead [ 287.906168][ T5921] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 288.046996][ T8438] netlink: 9 bytes leftover after parsing attributes in process `syz.3.717'. [ 288.059478][ T8438] netlink: 9 bytes leftover after parsing attributes in process `syz.3.717'. [ 288.083703][ T5921] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 288.093284][ T5921] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 288.142860][ T5921] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 288.180495][ T5921] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 288.200747][ T8456] netlink: 44 bytes leftover after parsing attributes in process `syz.1.721'. [ 288.229213][ T5921] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 288.260902][ T5921] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 288.386816][ T5921] usb 1-1: Product: syz [ 288.409105][ T5921] usb 1-1: Manufacturer: syz [ 288.461798][ T5921] cdc_wdm 1-1:1.0: skipping garbage [ 288.484231][ T5921] cdc_wdm 1-1:1.0: skipping garbage [ 288.508517][ T5921] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 288.527019][ T5921] cdc_wdm 1-1:1.0: Unknown control protocol [ 288.542919][ T8460] netlink: 36 bytes leftover after parsing attributes in process `syz.3.722'. [ 288.930755][ C1] cdc_wdm 1-1:1.0: Unexpected error -71 [ 288.938097][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 288.944853][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 288.951304][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 288.957924][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 288.964293][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 288.970919][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 288.977388][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 288.983989][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 288.990395][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 288.997098][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 289.003552][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 289.010168][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 289.016460][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 289.023075][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 289.029982][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 289.036591][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 289.037513][ T6036] usb 1-1: USB disconnect, device number 38 [ 289.042682][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 289.170822][ T45] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 289.460729][ T45] usb 4-1: device descriptor read/64, error -71 [ 289.671233][ T8468] syzkaller0: entered promiscuous mode [ 289.687172][ T8468] syzkaller0: entered allmulticast mode [ 289.700776][ T45] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 289.843067][ T45] usb 4-1: device descriptor read/64, error -71 [ 289.867309][ T8470] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 289.931087][ T7714] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 289.952258][ T45] usb usb4-port1: attempt power cycle [ 290.202575][ T7714] usb 3-1: unable to get BOS descriptor or descriptor too short [ 290.291032][ T7714] usb 3-1: config 13 has an invalid interface number: 2 but max is 0 [ 290.309427][ T7714] usb 3-1: config 13 has no interface number 0 [ 290.321735][ T7714] usb 3-1: config 13 interface 2 altsetting 5 endpoint 0x2 has invalid maxpacket 17704, setting to 1024 [ 290.351036][ T45] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 290.359903][ T7714] usb 3-1: config 13 interface 2 altsetting 5 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 290.383393][ T7714] usb 3-1: config 13 interface 2 altsetting 5 endpoint 0x4 has invalid wMaxPacketSize 0 [ 290.393968][ T45] usb 4-1: device descriptor read/8, error -71 [ 290.414253][ T7714] usb 3-1: config 13 interface 2 has no altsetting 0 [ 290.434821][ T7714] usb 3-1: New USB device found, idVendor=05ac, idProduct=022a, bcdDevice=57.1b [ 290.451517][ T7714] usb 3-1: New USB device strings: Mfr=1, Product=245, SerialNumber=2 [ 290.491311][ T7714] usb 3-1: Product: syz [ 290.495532][ T7714] usb 3-1: Manufacturer: syz [ 290.549234][ T7714] usb 3-1: SerialNumber: syz [ 290.582791][ T8468] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 290.661290][ T45] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 290.697769][ T45] usb 4-1: device descriptor read/8, error -71 [ 290.796778][ T8468] batadv_slave_0: entered promiscuous mode [ 290.807992][ T8467] batadv_slave_0: left promiscuous mode [ 290.817795][ T7714] appletouch 3-1:13.2: Could not find int-in endpoint [ 290.832607][ T45] usb usb4-port1: unable to enumerate USB device [ 290.842119][ T7714] appletouch 3-1:13.2: probe with driver appletouch failed with error -5 [ 290.878123][ T7714] usbhid 3-1:13.2: couldn't find an input interrupt endpoint [ 290.905840][ T7714] usb 3-1: USB disconnect, device number 42 [ 291.766863][ T8498] trusted_key: encrypted_key: insufficient parameters specified [ 291.928322][ T8505] netlink: 20 bytes leftover after parsing attributes in process `syz.0.730'. [ 291.948065][ T8503] fuse: Bad value for 'fd' [ 293.070718][ T45] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 293.234735][ T45] usb 6-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 293.290659][ T45] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 293.308844][ T45] usb 6-1: Product: syz [ 293.313201][ T45] usb 6-1: Manufacturer: syz [ 293.317879][ T45] usb 6-1: SerialNumber: syz [ 293.525857][ T45] usb 6-1: config 0 descriptor?? [ 293.591816][ T8524] netlink: 'syz.0.740': attribute type 27 has an invalid length. [ 293.753180][ T45] usb 6-1: ignoring: probably an ADSL modem [ 293.870296][ T8529] netlink: 104 bytes leftover after parsing attributes in process `syz.0.741'. [ 293.879532][ T8529] netlink: 104 bytes leftover after parsing attributes in process `syz.0.741'. [ 293.969300][ T45] cxacru 6-1:0.0: usbatm_usb_probe: bind failed: -19! [ 294.033015][ T45] usb 6-1: USB disconnect, device number 5 [ 295.650754][ T5920] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 296.002235][ T5920] usb 4-1: Using ep0 maxpacket: 32 [ 296.048303][ T5920] usb 4-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 296.070725][ T5920] usb 4-1: config 0 interface 0 has no altsetting 0 [ 296.077601][ T5920] usb 4-1: New USB device found, idVendor=0403, idProduct=97c1, bcdDevice= 0.00 [ 296.089643][ T5920] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.317950][ T8551] sctp: [Deprecated]: syz.2.744 (pid 8551) Use of struct sctp_assoc_value in delayed_ack socket option. [ 296.317950][ T8551] Use struct sctp_sack_info instead [ 296.318710][ T5920] usb 4-1: config 0 descriptor?? [ 296.544369][ T8551] netlink: 9 bytes leftover after parsing attributes in process `syz.2.744'. [ 296.557522][ T8551] netlink: 9 bytes leftover after parsing attributes in process `syz.2.744'. [ 296.607253][ T5920] usbhid 4-1:0.0: can't add hid device: -71 [ 296.614474][ T5920] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 296.659387][ T5920] usb 4-1: USB disconnect, device number 38 [ 298.645551][ T9] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 298.831127][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 298.837997][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 298.852960][ T9] usb 4-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 298.877191][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.904803][ T9] usb 4-1: config 0 descriptor?? [ 298.928542][ T9] dvb-usb: found a 'TeVii S662' in warm state. [ 298.942413][ T9] dw2102: su3000_power_ctrl: 1, initialized 0 [ 298.957427][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 298.988094][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 299.018050][ T9] dvbdev: DVB: registering new adapter (TeVii S662) [ 299.036194][ T9] usb 4-1: media controller created [ 299.047227][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 299.062518][ T9] dw2102: i2c transfer failed. [ 299.068809][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 299.078519][ T9] dw2102: i2c transfer failed. [ 299.086627][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 299.096661][ T9] dw2102: i2c transfer failed. [ 299.113625][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 299.165923][ T9] dw2102: i2c transfer failed. [ 299.171815][ T8591] dvb-usb: bulk message failed: -22 (4/0) [ 299.180178][ T8591] dw2102: i2c transfer failed. [ 299.190295][ T8591] dvb-usb: bulk message failed: -22 (3/0) [ 299.231345][ T8591] dw2102: i2c transfer failed. [ 299.236335][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 299.243298][ T9] dw2102: i2c transfer failed. [ 299.277783][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 299.285359][ T9] dw2102: i2c transfer failed. [ 299.308426][ T9] dvb-usb: MAC address: 02:02:02:02:02:02 [ 299.436798][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 299.554044][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 299.608722][ T9] dw2102: command 0x0e transfer failed. [ 299.618508][ T8601] netlink: 'syz.5.757': attribute type 7 has an invalid length. [ 299.627209][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 299.634081][ T8601] netlink: 'syz.5.757': attribute type 8 has an invalid length. [ 299.642480][ T9] dw2102: command 0x0e transfer failed. [ 299.731389][ T7217] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 299.891367][ T7217] usb 3-1: Using ep0 maxpacket: 16 [ 299.933418][ T7217] usb 3-1: config 0 has an invalid descriptor of length 55, skipping remainder of the config [ 299.951774][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 299.962731][ T9] dw2102: command 0x0e transfer failed. [ 299.968842][ T7217] usb 3-1: New USB device found, idVendor=046d, idProduct=0721, bcdDevice=9c.25 [ 299.985895][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 299.997003][ T7217] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 300.008162][ T9] dw2102: command 0x0e transfer failed. [ 300.028142][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 300.036368][ T7217] usb 3-1: Product: syz [ 300.051554][ T7217] usb 3-1: Manufacturer: syz [ 300.056272][ T9] dw2102: command 0x51 transfer failed. [ 300.063217][ T7217] usb 3-1: SerialNumber: syz [ 300.067930][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 300.080046][ T7217] usb 3-1: config 0 descriptor?? [ 300.096260][ T9] dw2102: i2c probe for address 0x68 failed. [ 300.119130][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 300.139496][ T9] dw2102: i2c probe for address 0x69 failed. [ 300.155911][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 300.169436][ T9] dw2102: i2c probe for address 0x6a failed. [ 300.202009][ T9] dw2102: probing for demodulator failed. Is the external power switched on? [ 300.228016][ T9] dvb-usb: no frontend was attached by 'TeVii S662' [ 300.343235][ T8616] binder: 8610:8616 ioctl c0306201 80000180 returned -14 [ 300.381430][ T9] rc_core: IR keymap rc-tt-1500 not found [ 300.387243][ T9] Registered IR keymap rc-empty [ 300.424164][ T9] rc rc0: TeVii S662 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 300.461821][ T9] input: TeVii S662 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input30 [ 300.497533][ T9] dvb-usb: schedule remote query interval to 250 msecs. [ 300.513597][ T9] dw2102: su3000_power_ctrl: 0, initialized 1 [ 300.528843][ T9] dvb-usb: TeVii S662 successfully initialized and connected. [ 300.559407][ T9] usb 4-1: USB disconnect, device number 39 [ 300.672234][ T9] dvb-usb: TeVii S662 successfully deinitialized and disconnected. [ 300.726987][ T8608] sctp: [Deprecated]: syz.5.760 (pid 8608) Use of struct sctp_assoc_value in delayed_ack socket option. [ 300.726987][ T8608] Use struct sctp_sack_info instead [ 300.891916][ T8608] netlink: 9 bytes leftover after parsing attributes in process `syz.5.760'. [ 300.906774][ T8608] netlink: 9 bytes leftover after parsing attributes in process `syz.5.760'. [ 302.080875][ T5920] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 302.590714][ T5920] usb 1-1: Using ep0 maxpacket: 32 [ 302.599089][ T5920] usb 1-1: config 1 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 48, changing to 9 [ 302.642682][ T7217] usb 3-1: USB disconnect, device number 43 [ 302.661201][ T5920] usb 1-1: config 1 interface 0 has no altsetting 0 [ 302.704417][ T5920] usb 1-1: New USB device found, idVendor=05ac, idProduct=030a, bcdDevice= 0.40 [ 302.744249][ T5920] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 302.801356][ T5920] usb 1-1: Product: syz [ 302.805581][ T5920] usb 1-1: Manufacturer: syz [ 302.850660][ T5920] usb 1-1: SerialNumber: syz [ 303.221910][ T8638] netlink: 'syz.0.766': attribute type 2 has an invalid length. [ 303.243274][ T8638] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 303.344843][ T7217] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 303.453970][ T5920] input: appletouch as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input31 [ 303.495262][ T5920] usb 1-1: USB disconnect, device number 39 [ 303.495271][ C0] appletouch 1-1:1.0: atp_complete: usb_submit_urb failed with result -19 [ 303.541701][ T7217] usb 4-1: Using ep0 maxpacket: 32 [ 303.554399][ T7217] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 303.685147][ T5920] appletouch 1-1:1.0: input: appletouch disconnected [ 303.914709][ T7217] usb 4-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 304.245804][ T7217] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 304.259311][ T7217] usb 4-1: config 0 descriptor?? [ 304.307129][ T7217] dvb-usb: found a 'TeVii S662' in warm state. [ 304.317664][ T7217] dw2102: su3000_power_ctrl: 1, initialized 0 [ 304.325531][ T7217] dvb-usb: bulk message failed: -22 (2/0) [ 304.377075][ T7217] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 304.505778][ T8646] dvb-usb: bulk message failed: -22 (4/0) [ 304.561447][ T8646] dw2102: i2c transfer failed. [ 304.613772][ T7217] dvbdev: DVB: registering new adapter (TeVii S662) [ 304.620502][ T7217] usb 4-1: media controller created [ 304.691281][ T7217] dvb-usb: bulk message failed: -22 (6/0) [ 304.747911][ T7217] dw2102: i2c transfer failed. [ 304.760288][ T7217] dvb-usb: bulk message failed: -22 (6/0) [ 304.777779][ T7217] dw2102: i2c transfer failed. [ 304.820498][ T7217] dvb-usb: bulk message failed: -22 (6/0) [ 304.850458][ T7217] dw2102: i2c transfer failed. [ 304.927980][ T7217] dvb-usb: bulk message failed: -22 (6/0) [ 304.937034][ T7217] dw2102: i2c transfer failed. [ 304.942939][ T7217] dvb-usb: bulk message failed: -22 (6/0) [ 305.003664][ T7217] dw2102: i2c transfer failed. [ 305.011919][ T7217] dvb-usb: bulk message failed: -22 (6/0) [ 305.038176][ T7217] dw2102: i2c transfer failed. [ 305.072406][ T7217] dvb-usb: MAC address: 02:02:02:02:02:02 [ 305.212075][ T7217] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 305.307483][ T7217] dvb-usb: bulk message failed: -22 (3/0) [ 305.337576][ T7217] dw2102: command 0x0e transfer failed. [ 305.381319][ T7217] dvb-usb: bulk message failed: -22 (3/0) [ 305.387097][ T7217] dw2102: command 0x0e transfer failed. [ 305.557114][ T8669] binder: 8664:8669 ioctl c0306201 80000180 returned -14 [ 305.781479][ T7217] dvb-usb: bulk message failed: -22 (3/0) [ 305.787260][ T7217] dw2102: command 0x0e transfer failed. [ 305.847363][ T7217] dvb-usb: bulk message failed: -22 (3/0) [ 305.876153][ T7217] dw2102: command 0x0e transfer failed. [ 305.906082][ T8676] netlink: 4 bytes leftover after parsing attributes in process `syz.5.777'. [ 305.916817][ T7217] dvb-usb: bulk message failed: -22 (1/0) [ 305.933811][ T7217] dw2102: command 0x51 transfer failed. [ 305.939526][ T7217] dvb-usb: bulk message failed: -22 (5/0) [ 305.946267][ T7217] dw2102: i2c probe for address 0x68 failed. [ 305.953593][ T7217] dvb-usb: bulk message failed: -22 (5/0) [ 305.973779][ T8676] netlink: 4 bytes leftover after parsing attributes in process `syz.5.777'. [ 305.985657][ T7217] dw2102: i2c probe for address 0x69 failed. [ 305.996635][ T7217] dvb-usb: bulk message failed: -22 (5/0) [ 306.004442][ T7217] dw2102: i2c probe for address 0x6a failed. [ 306.011983][ T8680] netlink: 120 bytes leftover after parsing attributes in process `syz.5.777'. [ 306.011992][ T7217] dw2102: probing for demodulator failed. Is the external power switched on? [ 306.012007][ T7217] dvb-usb: no frontend was attached by 'TeVii S662' [ 306.078486][ T8680] netlink: 120 bytes leftover after parsing attributes in process `syz.5.777'. [ 306.288430][ T7217] rc_core: IR keymap rc-tt-1500 not found [ 306.315703][ T7217] Registered IR keymap rc-empty [ 306.365242][ T7217] rc rc0: TeVii S662 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 306.408860][ T7217] input: TeVii S662 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input32 [ 306.456855][ T7217] dvb-usb: schedule remote query interval to 250 msecs. [ 306.480580][ T7217] dw2102: su3000_power_ctrl: 0, initialized 1 [ 306.506521][ T7217] dvb-usb: TeVii S662 successfully initialized and connected. [ 306.519556][ T8691] syz_tun: entered allmulticast mode [ 306.571926][ T7217] usb 4-1: USB disconnect, device number 40 [ 306.581062][ T7714] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 306.607730][ T8690] syz_tun: left allmulticast mode [ 306.742782][ T7217] dvb-usb: TeVii S662 successfully deinitialized and disconnected. [ 306.751452][ T7714] usb 3-1: Using ep0 maxpacket: 32 [ 306.870742][ T7714] usb 3-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 306.929167][ T8692] sctp: [Deprecated]: syz.3.775 (pid 8692) Use of struct sctp_assoc_value in delayed_ack socket option. [ 306.929167][ T8692] Use struct sctp_sack_info instead [ 306.953081][ T7714] usb 3-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 307.162742][ T7714] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.181221][ T9] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 307.190744][ T7714] usb 3-1: Product: syz [ 307.194968][ T7714] usb 3-1: Manufacturer: syz [ 307.209140][ T7714] usb 3-1: SerialNumber: syz [ 307.269468][ T7714] imon:imon_find_endpoints: no valid input (IR) endpoint found [ 307.309804][ T7714] imon 3-1:155.0: unable to initialize intf0, err -19 [ 307.319558][ T7714] imon:imon_probe: failed to initialize context! [ 307.331483][ T7714] imon 3-1:155.0: unable to register, err -19 [ 307.352236][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 307.359672][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 307.375813][ T9] usb 6-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 307.415005][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 307.473217][ T8667] netlink: 9 bytes leftover after parsing attributes in process `syz.3.775'. [ 307.483566][ T8667] netlink: 9 bytes leftover after parsing attributes in process `syz.3.775'. [ 307.568919][ T9] usb 6-1: config 0 descriptor?? [ 307.599249][ T9] dvb-usb: found a 'TeVii S662' in warm state. [ 307.626682][ T9] dw2102: su3000_power_ctrl: 1, initialized 0 [ 307.646945][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 307.682041][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 307.711809][ T8687] netlink: 'syz.2.781': attribute type 27 has an invalid length. [ 307.725915][ T9] dvbdev: DVB: registering new adapter (TeVii S662) [ 307.744817][ T9] usb 6-1: media controller created [ 307.761863][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 307.767664][ T9] dw2102: i2c transfer failed. [ 307.784172][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 307.801345][ T9] dw2102: i2c transfer failed. [ 307.806991][ T8699] dvb-usb: bulk message failed: -22 (4/0) [ 307.817097][ T8699] dw2102: i2c transfer failed. [ 307.842844][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 307.873846][ T9] dw2102: i2c transfer failed. [ 307.899780][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 307.916867][ T9] dw2102: i2c transfer failed. [ 307.926671][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 307.949609][ T9] dw2102: i2c transfer failed. [ 307.959358][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 307.966682][ T9] dw2102: i2c transfer failed. [ 307.973874][ T7217] usb 3-1: USB disconnect, device number 44 [ 308.012128][ T9] dvb-usb: MAC address: 02:02:02:02:02:02 [ 308.057384][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 308.104933][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 308.122296][ T9] dw2102: command 0x0e transfer failed. [ 308.127923][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 308.147119][ T9] dw2102: command 0x0e transfer failed. [ 308.471810][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 308.479720][ T9] dw2102: command 0x0e transfer failed. [ 308.494982][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 308.512404][ T9] dw2102: command 0x0e transfer failed. [ 308.528056][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 308.557299][ T9] dw2102: command 0x51 transfer failed. [ 308.586509][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 308.621365][ T9] dw2102: i2c probe for address 0x68 failed. [ 308.627529][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 308.852862][ T8724] syzkaller0: entered promiscuous mode [ 308.858381][ T8724] syzkaller0: entered allmulticast mode [ 308.869381][ T9] dw2102: i2c probe for address 0x69 failed. [ 308.876261][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 308.882783][ T9] dw2102: i2c probe for address 0x6a failed. [ 308.892858][ T9] dw2102: probing for demodulator failed. Is the external power switched on? [ 308.907409][ T9] dvb-usb: no frontend was attached by 'TeVii S662' [ 309.035861][ T8728] binder: 8719:8728 ioctl c0306201 80000180 returned -14 [ 309.055122][ T9] rc_core: IR keymap rc-tt-1500 not found [ 309.110192][ T9] Registered IR keymap rc-empty [ 309.131715][ T9] rc rc0: TeVii S662 as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0 [ 309.179969][ T9] input: TeVii S662 as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0/input33 [ 309.238556][ T9] dvb-usb: schedule remote query interval to 250 msecs. [ 309.258284][ T9] dw2102: su3000_power_ctrl: 0, initialized 1 [ 309.304314][ T9] dvb-usb: TeVii S662 successfully initialized and connected. [ 309.361910][ T9] usb 6-1: USB disconnect, device number 6 [ 309.569134][ T8735] binder: 8732:8735 ioctl c0306201 80000180 returned -14 [ 309.640041][ T9] dvb-usb: TeVii S662 successfully deinitialized and disconnected. [ 309.834905][ T8739] IPVS: length: 102 != 8 [ 310.011892][ T9] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 310.133454][ T45] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 310.174636][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 310.185265][ T9] usb 6-1: config 13 has an invalid interface number: 2 but max is 0 [ 310.202617][ T9] usb 6-1: config 13 has no interface number 0 [ 310.217086][ T9] usb 6-1: config 13 interface 2 altsetting 5 endpoint 0x2 has invalid maxpacket 17704, setting to 1024 [ 310.248921][ T9] usb 6-1: config 13 interface 2 altsetting 5 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 310.283025][ T9] usb 6-1: config 13 interface 2 altsetting 5 endpoint 0x4 has invalid wMaxPacketSize 0 [ 310.300506][ T9] usb 6-1: config 13 interface 2 has no altsetting 0 [ 310.314098][ T45] usb 4-1: config 1 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 310.317165][ T9] usb 6-1: New USB device found, idVendor=05ac, idProduct=022a, bcdDevice=57.1b [ 310.339894][ T9] usb 6-1: New USB device strings: Mfr=1, Product=245, SerialNumber=2 [ 310.349219][ T9] usb 6-1: Product: syz [ 310.357346][ T9] usb 6-1: Manufacturer: syz [ 310.359668][ T45] usb 4-1: config 1 interface 0 has no altsetting 0 [ 310.369980][ T9] usb 6-1: SerialNumber: syz [ 310.383490][ T8724] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 310.424633][ T45] usb 4-1: New USB device found, idVendor=056a, idProduct=032a, bcdDevice= 0.40 [ 310.450961][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 310.459201][ T45] usb 4-1: Product: ࡃ [ 310.507133][ T45] usb 4-1: Manufacturer: 쀘떔뉲씜庘癿濎ⓦ썟祯莫ξ棃ﲤ㍯᧪汪རᆀ玥厨蘆ɸ俓嬌㰖⊢⫀ᣴ忽簞䮠唪 [ 310.529725][ T8755] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.799'. [ 310.536414][ T8752] sctp: [Deprecated]: syz.1.798 (pid 8752) Use of struct sctp_assoc_value in delayed_ack socket option. [ 310.536414][ T8752] Use struct sctp_sack_info instead [ 310.551138][ T45] usb 4-1: SerialNumber: 偩䱕鱗䧒잽㡶⹒ῥ풟巤緱徰큦︄懀ꆠ弳吹䨩⦆癷鼞쒕ꈏ揺懶띉௱녔ￊ䷵ᤂ퇤襫῁଎捡Ŀꊸ⬖㝴즨벚ޑ퍑㓵자ꊮ釀끠俁㨍婳 [ 310.642020][ T8724] batadv_slave_0: entered promiscuous mode [ 310.662323][ T8722] batadv_slave_0: left promiscuous mode [ 310.676491][ T9] appletouch 6-1:13.2: Could not find int-in endpoint [ 310.694195][ T9] appletouch 6-1:13.2: probe with driver appletouch failed with error -5 [ 310.720128][ T9] usbhid 6-1:13.2: couldn't find an input interrupt endpoint [ 310.751533][ T9] usb 6-1: USB disconnect, device number 7 [ 310.832560][ T45] usbhid 4-1:1.0: can't add hid device: -71 [ 310.842782][ T8747] netlink: 9 bytes leftover after parsing attributes in process `syz.1.798'. [ 310.860790][ T45] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 310.873981][ T8747] netlink: 9 bytes leftover after parsing attributes in process `syz.1.798'. [ 310.903253][ T45] usb 4-1: USB disconnect, device number 41 [ 311.313797][ T6036] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 311.348472][ T8773] binder: 8769:8773 ioctl c0306201 80000180 returned -14 [ 311.522719][ T6036] usb 1-1: Using ep0 maxpacket: 32 [ 311.539762][ T6036] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 311.554343][ T6036] usb 1-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 311.589325][ T6036] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.624118][ T6036] usb 1-1: config 0 descriptor?? [ 311.792321][ T6036] dvb-usb: found a 'TeVii S662' in warm state. [ 311.798552][ T6036] dw2102: su3000_power_ctrl: 1, initialized 0 [ 311.812321][ T6036] dvb-usb: bulk message failed: -22 (2/0) [ 311.823129][ T6036] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 311.928584][ T6036] dvbdev: DVB: registering new adapter (TeVii S662) [ 311.948999][ T6036] usb 1-1: media controller created [ 311.955242][ T6036] dvb-usb: bulk message failed: -22 (6/0) [ 311.963176][ T6036] dw2102: i2c transfer failed. [ 311.971899][ T6036] dvb-usb: bulk message failed: -22 (6/0) [ 311.977824][ T6036] dw2102: i2c transfer failed. [ 311.983395][ T6036] dvb-usb: bulk message failed: -22 (6/0) [ 311.991727][ T6036] dw2102: i2c transfer failed. [ 311.996774][ T6036] dvb-usb: bulk message failed: -22 (6/0) [ 312.004569][ T6036] dw2102: i2c transfer failed. [ 312.020458][ T8763] dvb-usb: bulk message failed: -22 (4/0) [ 312.027340][ T8763] dw2102: i2c transfer failed. [ 312.039943][ T6036] dvb-usb: bulk message failed: -22 (6/0) [ 312.050117][ T6036] dw2102: i2c transfer failed. [ 312.056005][ T6036] dvb-usb: bulk message failed: -22 (6/0) [ 312.065230][ T6036] dw2102: i2c transfer failed. [ 312.070456][ T6036] dvb-usb: MAC address: 02:02:02:02:02:02 [ 312.191722][ T6036] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 312.366278][ T6036] dvb-usb: bulk message failed: -22 (3/0) [ 312.368148][ T8795] netlink: 12 bytes leftover after parsing attributes in process `syz.1.811'. [ 312.411527][ T6036] dw2102: command 0x0e transfer failed. [ 312.433720][ T8795] netlink: 12 bytes leftover after parsing attributes in process `syz.1.811'. [ 312.435397][ T6036] dvb-usb: bulk message failed: -22 (3/0) [ 312.491834][ T6036] dw2102: command 0x0e transfer failed. [ 312.861225][ T6036] dvb-usb: bulk message failed: -22 (3/0) [ 312.871253][ T6036] dw2102: command 0x0e transfer failed. [ 313.013073][ T6036] dvb-usb: bulk message failed: -22 (3/0) [ 313.082404][ T6036] dw2102: command 0x0e transfer failed. [ 313.102704][ T6036] dvb-usb: bulk message failed: -22 (1/0) [ 313.108484][ T6036] dw2102: command 0x51 transfer failed. [ 313.117440][ T6036] dvb-usb: bulk message failed: -22 (5/0) [ 313.619686][ T8815] syzkaller0: entered promiscuous mode [ 313.625352][ T8815] syzkaller0: entered allmulticast mode [ 313.644439][ T6036] dw2102: i2c probe for address 0x68 failed. [ 313.722562][ T6036] dvb-usb: bulk message failed: -22 (5/0) [ 314.051297][ T6036] dw2102: i2c probe for address 0x69 failed. [ 314.057437][ T6036] dvb-usb: bulk message failed: -22 (5/0) [ 314.081277][ T6036] dw2102: i2c probe for address 0x6a failed. [ 314.087331][ T6036] dw2102: probing for demodulator failed. Is the external power switched on? [ 314.101159][ T45] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 314.119172][ T6036] dvb-usb: no frontend was attached by 'TeVii S662' [ 314.269815][ T8825] sctp: [Deprecated]: syz.1.814 (pid 8825) Use of struct sctp_assoc_value in delayed_ack socket option. [ 314.269815][ T8825] Use struct sctp_sack_info instead [ 314.378050][ T45] usb 6-1: unable to get BOS descriptor or descriptor too short [ 314.501332][ T6036] rc_core: IR keymap rc-tt-1500 not found [ 314.507109][ T6036] Registered IR keymap rc-empty [ 314.514389][ T45] usb 6-1: config 13 has an invalid interface number: 2 but max is 0 [ 314.536190][ T6036] rc rc0: TeVii S662 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 314.568762][ T45] usb 6-1: config 13 has no interface number 0 [ 314.610848][ T45] usb 6-1: config 13 interface 2 altsetting 5 endpoint 0x2 has invalid maxpacket 17704, setting to 1024 [ 314.649979][ T45] usb 6-1: config 13 interface 2 altsetting 5 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 314.680919][ T45] usb 6-1: config 13 interface 2 altsetting 5 endpoint 0x4 has invalid wMaxPacketSize 0 [ 314.695495][ T45] usb 6-1: config 13 interface 2 has no altsetting 0 [ 314.707307][ T45] usb 6-1: New USB device found, idVendor=05ac, idProduct=022a, bcdDevice=57.1b [ 314.716567][ T45] usb 6-1: New USB device strings: Mfr=1, Product=245, SerialNumber=2 [ 314.725193][ T6036] input: TeVii S662 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input34 [ 314.736922][ T8830] fuse: Bad value for 'fd' [ 314.748058][ T6036] dvb-usb: schedule remote query interval to 250 msecs. [ 314.787163][ T45] usb 6-1: Product: syz [ 314.790784][ T6036] dw2102: su3000_power_ctrl: 0, initialized 1 [ 314.796089][ T45] usb 6-1: Manufacturer: syz [ 314.830723][ T45] usb 6-1: SerialNumber: syz [ 314.831357][ T6036] dvb-usb: TeVii S662 successfully initialized and connected. [ 314.862079][ T6036] usb 1-1: USB disconnect, device number 40 [ 314.921812][ T8815] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 315.101296][ T8801] netlink: 9 bytes leftover after parsing attributes in process `syz.1.814'. [ 315.150515][ T6036] dvb-usb: TeVii S662 successfully deinitialized and disconnected. [ 315.155984][ T8815] batadv_slave_0: entered promiscuous mode [ 315.168068][ T8801] netlink: 9 bytes leftover after parsing attributes in process `syz.1.814'. [ 315.215314][ T8814] batadv_slave_0: left promiscuous mode [ 315.326070][ T45] appletouch 6-1:13.2: Could not find int-in endpoint [ 315.377584][ T45] appletouch 6-1:13.2: probe with driver appletouch failed with error -5 [ 315.416299][ T45] usbhid 6-1:13.2: couldn't find an input interrupt endpoint [ 315.432838][ T8810] syz.0.813 (8810): drop_caches: 2 [ 315.441542][ T5920] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 315.521143][ T45] usb 6-1: USB disconnect, device number 8 [ 315.663352][ T5920] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 315.682062][ T5920] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 315.697330][ T5920] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 315.714066][ T5920] usb 4-1: New USB device found, idVendor=044f, idProduct=b323, bcdDevice= 0.00 [ 315.723539][ T5920] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.741604][ T5920] usb 4-1: config 0 descriptor?? [ 316.080791][ T45] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 316.216304][ T5920] hid_parser_main: 78 callbacks suppressed [ 316.216327][ T5920] thrustmaster 0003:044F:B323.000E: unknown main item tag 0x0 [ 316.242055][ T5920] thrustmaster 0003:044F:B323.000E: unknown main item tag 0x0 [ 316.319605][ T5920] thrustmaster 0003:044F:B323.000E: unknown main item tag 0x0 [ 316.327651][ T5920] thrustmaster 0003:044F:B323.000E: unknown main item tag 0x0 [ 316.327665][ T9] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 316.335361][ T45] usb 1-1: Using ep0 maxpacket: 32 [ 316.353982][ T5920] thrustmaster 0003:044F:B323.000E: unknown main item tag 0x0 [ 316.366716][ T45] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 316.390376][ T45] usb 1-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 316.403006][ T5920] thrustmaster 0003:044F:B323.000E: hidraw0: USB HID v0.00 Device [HID 044f:b323] on usb-dummy_hcd.3-1/input0 [ 316.425214][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 316.440930][ T5920] thrustmaster 0003:044F:B323.000E: no inputs found [ 316.457594][ T45] usb 1-1: config 0 descriptor?? [ 316.476579][ T5920] usb 4-1: USB disconnect, device number 42 [ 316.489671][ T45] dvb-usb: found a 'TeVii S662' in warm state. [ 316.515535][ T45] dw2102: su3000_power_ctrl: 1, initialized 0 [ 316.528522][ T9] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 316.535159][ T45] dvb-usb: bulk message failed: -22 (2/0) [ 316.541460][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.582731][ T45] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 316.591340][ T9] usb 3-1: Product: syz [ 316.604729][ T9] usb 3-1: Manufacturer: syz [ 316.608360][ T45] dvbdev: DVB: registering new adapter (TeVii S662) [ 316.628991][ T45] usb 1-1: media controller created [ 316.634459][ T9] usb 3-1: SerialNumber: syz [ 316.640059][ T45] dvb-usb: bulk message failed: -22 (6/0) [ 316.642181][ T8853] fido_id[8853]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 316.654149][ T45] dw2102: i2c transfer failed. [ 316.677167][ T9] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 316.700283][ T8838] dvb-usb: bulk message failed: -22 (4/0) [ 316.709800][ T8838] dw2102: i2c transfer failed. [ 316.713186][ T6036] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 316.723873][ T8838] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI [ 316.723898][ T8838] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 316.723921][ T8838] CPU: 1 UID: 0 PID: 8838 Comm: syz.0.824 Tainted: G L syzkaller #0 PREEMPT(full) [ 316.723950][ T8838] Tainted: [L]=SOFTLOCKUP [ 316.723958][ T8838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 316.723972][ T8838] RIP: 0010:su3000_i2c_transfer+0x1ad/0xfd0 [ 316.724011][ T8838] Code: 4c 89 f8 48 c1 e8 03 49 bc 00 00 00 00 00 fc ff df 42 80 3c 20 00 74 08 4c 89 ff e8 0d cf 6b fa 49 8b 1f 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 f3 08 00 00 0f b6 1b 48 8b 44 24 38 42 [ 316.724029][ T8838] RSP: 0018:ffffc900033078c8 EFLAGS: 00010202 [ 316.724050][ T8838] RAX: 0000000000000002 RBX: 0000000000000010 RCX: 0000000000000003 [ 316.724064][ T8838] RDX: ffffffff87bc3375 RSI: ffffffff8eebf5d0 RDI: 0000000000001900 [ 316.724079][ T8838] RBP: 0000000000000001 R08: ffff888026663d00 R09: 0000000000000002 [ 316.724092][ T8838] R10: 0000000000001a00 R11: 0000000000000002 R12: dffffc0000000000 [ 316.724107][ T8838] R13: 1ffff1100616ba92 R14: 0000000000000002 R15: ffff888030b5d498 [ 316.724122][ T8838] FS: 0000000000000000(0000) GS:ffff888125f3a000(0063) knlGS:00000000f5426b40 [ 316.724140][ T8838] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 316.724155][ T8838] CR2: 000000003161eff8 CR3: 000000007a9e0000 CR4: 00000000003526f0 [ 316.724173][ T8838] Call Trace: [ 316.724181][ T8838] [ 316.724198][ T8838] __i2c_transfer+0x871/0x2110 [ 316.724233][ T8838] ? i2c_transfer+0x120/0x3a0 [ 316.724256][ T8838] ? __pfx___i2c_transfer+0x10/0x10 [ 316.724289][ T8838] ? rt_mutex_lock_nested+0x172/0x1e0 [ 316.724313][ T8838] ? i2c_transfer+0x120/0x3a0 [ 316.895344][ T8838] i2c_transfer+0x25b/0x3a0 [ 316.899850][ T8838] ? __pfx_i2c_transfer+0x10/0x10 [ 316.904868][ T8838] ? _copy_from_user+0x94/0xb0 [ 316.909635][ T8838] i2cdev_ioctl_rdwr+0x460/0x740 [ 316.914571][ T8838] compat_i2cdev_ioctl+0x5a8/0x5c0 [ 316.919684][ T8838] ? __pfx_compat_i2cdev_ioctl+0x10/0x10 [ 316.925323][ T8838] ? __fget_files+0x3a0/0x420 [ 316.929998][ T8838] ? __fget_files+0x2a/0x420 [ 316.934603][ T8838] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 316.940168][ T8838] __ia32_compat_sys_ioctl+0x543/0x840 [ 316.945646][ T8838] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 316.951637][ T8838] ? __se_sys_futex_time32+0x360/0x3e0 [ 316.957093][ T8838] ? rcu_is_watching+0x15/0xb0 [ 316.961854][ T8838] ? __do_fast_syscall_32+0xbe/0x570 [ 316.967130][ T8838] __do_fast_syscall_32+0x1f7/0x570 [ 316.972318][ T8838] ? rcu_is_watching+0x15/0xb0 [ 316.977098][ T8838] ? do_fast_syscall_32+0x34/0x80 [ 316.982137][ T8838] do_fast_syscall_32+0x34/0x80 [ 316.986975][ T8838] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 316.993293][ T8838] RIP: 0023:0xf7f34539 [ 316.997359][ T8838] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 317.016963][ T8838] RSP: 002b:00000000f542655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 317.025385][ T8838] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000707 [ 317.033438][ T8838] RDX: 00000000800004c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 317.041405][ T8838] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 317.049366][ T8838] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 317.057330][ T8838] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 317.065303][ T8838] [ 317.068314][ T8838] Modules linked in: [ 317.073015][ T8838] ---[ end trace 0000000000000000 ]--- [ 317.091368][ T8838] RIP: 0010:su3000_i2c_transfer+0x1ad/0xfd0 [ 317.102447][ T8838] Code: 4c 89 f8 48 c1 e8 03 49 bc 00 00 00 00 00 fc ff df 42 80 3c 20 00 74 08 4c 89 ff e8 0d cf 6b fa 49 8b 1f 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 f3 08 00 00 0f b6 1b 48 8b 44 24 38 42 [ 317.140401][ T8838] RSP: 0018:ffffc900033078c8 EFLAGS: 00010202 [ 317.182708][ T8838] RAX: 0000000000000002 RBX: 0000000000000010 RCX: 0000000000000003 [ 317.206410][ T8838] RDX: ffffffff87bc3375 RSI: ffffffff8eebf5d0 RDI: 0000000000001900 [ 317.276694][ T8838] RBP: 0000000000000001 R08: ffff888026663d00 R09: 0000000000000002 [ 317.308845][ T8838] R10: 0000000000001a00 R11: 0000000000000002 R12: dffffc0000000000 [ 317.356106][ T8838] R13: 1ffff1100616ba92 R14: 0000000000000002 R15: ffff888030b5d498 [ 317.371949][ T5920] usb 3-1: USB disconnect, device number 45 [ 317.407774][ T8838] FS: 0000000000000000(0000) GS:ffff888125f3a000(0063) knlGS:00000000f5426b40 [ 317.448480][ T8838] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 317.477140][ T8838] CR2: 0000000080187018 CR3: 000000007a9e0000 CR4: 00000000003526f0 [ 317.499706][ T8838] Kernel panic - not syncing: Fatal exception [ 317.506130][ T8838] Kernel Offset: disabled [ 317.510455][ T8838] Rebooting in 86400 seconds..