last executing test programs: 22m42.286324659s ago: executing program 3 (id=1199): r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, 0x0, &(0x7f0000000f80)=0x20) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x1e}}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000800)=[{{&(0x7f00000003c0)=@x25={0x9, @remote}, 0x80, &(0x7f00000006c0), 0x0, &(0x7f0000000740)=""/175, 0xaf}, 0x8}], 0x1, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0xfffffffffffffc67) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000380)='kmem_cache_free\x00'}, 0x18) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYRESDEC, @ANYRESOCT=r2], 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) sendto$packet(r5, &(0x7f0000000000)="10", 0x5dc, 0x0, &(0x7f0000000340)={0x11, 0x8100, r6, 0x1, 0x0, 0x6, @local}, 0x14) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4000000) sendto$inet6(r0, 0x0, 0x5c, 0x0, 0x0, 0x0) unshare(0x22020600) r8 = openat$fuse(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r3, 0x8004e500, &(0x7f0000000100)=r8) set_mempolicy(0x3, &(0x7f0000000200)=0x3, 0x3) r9 = open(&(0x7f0000000280)='.\x00', 0x400000, 0x10) fcntl$notify(r9, 0x402, 0x19) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') r11 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_int(r11, 0x0, 0x33, 0x0, &(0x7f0000000080)) ftruncate(r10, 0xad8f) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) 22m41.336419094s ago: executing program 3 (id=1203): syz_usb_connect$cdc_ncm(0x0, 0x72, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)=0x0) timer_settime(r4, 0x1, &(0x7f0000000340), 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000054000000030a01010000000000000000010000000900030073797a3000000000280004800800024000000000080001400000000504000400766574683000000000000000000000000900010073797a300000000014000000000001"], 0x9c}}, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x63, @loopback, 0x7}, 0x1c) creat(0x0, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/fib_triestat\x00') setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000100)='pim6reg1\x00', 0x10) preadv(r6, &(0x7f0000000080)=[{&(0x7f0000000040)=""/46, 0x2e}], 0x1, 0x0, 0x0) r7 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r7, 0x84, 0x21, &(0x7f00000001c0), &(0x7f0000000240)=0x4) connect$inet(0xffffffffffffffff, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r8, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r8, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @multicast1}}, 0xa, 0x0, 0xdd5, 0x7ff, 0x38fa8b00d923ddd5}, 0x9c) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000140)=0x14) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9}, {0xf}, {0xe, 0xd}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x8c0}, 0x0) 22m38.101636027s ago: executing program 3 (id=1214): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r0, &(0x7f0000005140)=[{&(0x7f0000000280)=@in={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000340)="14", 0x1}], 0x1, &(0x7f0000000600)=[@sndinfo={0x20, 0x84, 0x2, {0x6, 0x0, 0x3, 0x61}}], 0x20, 0x24040000}], 0x1, 0x240000c0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x20008004}, 0xc000001) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_256={{0x303, 0x36}, "f1ff5ef2fe010017", "9e8ecc7bb5352776725e1047711330ff2bb17b5508000000000000009bc400", "dc5d3f00", "46b0dc72b7b1d30e"}, 0x38) 22m38.046962665s ago: executing program 3 (id=1215): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000580)=ANY=[@ANYBLOB="1400f5001000050002000000000020000000000a20000000000a05000000000000000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a300000000008000540000000040c00098008000140ff"], 0x90}, 0x1, 0x0, 0x0, 0x8800}, 0x0) 22m37.546070458s ago: executing program 3 (id=1216): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000001080)={{0x12, 0x1, 0x0, 0x78, 0x82, 0xb7, 0x40, 0x2c42, 0x1709, 0xcab7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xbf, 0x60, 0xe7}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000440)={0x40, 0x18, 0x1, "8e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0", 0x49}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e", 0x97}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f00000007c0)=""/78, 0x4e}], 0x2}, 0x1) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000004c0)={0x34, &(0x7f0000000000)={0x60, 0x30, 0xc6, "7507be5b5217841f3945bc2bd4043b2e923385e5f1a6db2f7b3f3f7ac86ca7cc8cb9816d3fbe109ac290b16ea6ffeff4b992e2689f3894368b8a45baf47f8155904271cece3c4fd9817ec3d9c246b8f4724fa38b133fb92e55c2a03b4531972985060fdfa2dca53106009dab2f22b079160d830252f2fefbc243d34304c64f5720504e245fdc59093694776dbcd504b1e2f68ee65081a91f5bad491159889b15a268bbfe001aef4a07df7f38616fc8a685156e8cb44c2eb4e117b5d2bcc800eb2e3d60ad71e5"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000140)={0x20, 0x9, 0x5, "f26ec3354d"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000dc0)={0x2c, &(0x7f00000001c0)={0x20, 0xf, 0xe, "7d0ada00400f47fb2bee32fc1751"}, 0x0, 0x0, 0x0, 0x0}) 22m34.456689552s ago: executing program 3 (id=1227): clock_gettime(0x0, &(0x7f0000002200)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x9, 0x7, 0x80000000, 0x1, 0x4, 0x4, 0xffffffff}, &(0x7f0000000100)={0x5, 0x4, 0x81, 0x200, 0x6, 0x704, 0x9, 0x1}, &(0x7f00000021c0)={0x4, 0x3, 0xd364, 0x5, 0x9, 0x7, 0x34}, &(0x7f0000002240)={r0, r1+60000000}, &(0x7f00000022c0)={&(0x7f0000002280)={[0x100]}, 0x8}) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = landlock_create_ruleset(&(0x7f00000003c0)={0x0, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000080)={0x220, 0x0, 0x1}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) read$FUSE(0xffffffffffffffff, &(0x7f0000000180)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000040)={0x50, 0x0, r6, {0x7, 0x2b, 0xe93a, 0x40, 0x4, 0x7f, 0x3ad, 0x32, 0x0, 0x0, 0x1, 0x7}}, 0x50) r7 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) ioctl$USBDEVFS_CLEAR_HALT(r7, 0x80045515, &(0x7f0000000140)={0x4, 0x1}) 22m19.335904154s ago: executing program 32 (id=1227): clock_gettime(0x0, &(0x7f0000002200)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x9, 0x7, 0x80000000, 0x1, 0x4, 0x4, 0xffffffff}, &(0x7f0000000100)={0x5, 0x4, 0x81, 0x200, 0x6, 0x704, 0x9, 0x1}, &(0x7f00000021c0)={0x4, 0x3, 0xd364, 0x5, 0x9, 0x7, 0x34}, &(0x7f0000002240)={r0, r1+60000000}, &(0x7f00000022c0)={&(0x7f0000002280)={[0x100]}, 0x8}) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = landlock_create_ruleset(&(0x7f00000003c0)={0x0, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000080)={0x220, 0x0, 0x1}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) read$FUSE(0xffffffffffffffff, &(0x7f0000000180)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000040)={0x50, 0x0, r6, {0x7, 0x2b, 0xe93a, 0x40, 0x4, 0x7f, 0x3ad, 0x32, 0x0, 0x0, 0x1, 0x7}}, 0x50) r7 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) ioctl$USBDEVFS_CLEAR_HALT(r7, 0x80045515, &(0x7f0000000140)={0x4, 0x1}) 20m51.508474169s ago: executing program 0 (id=1656): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f0000000400)={0x5, 0x0, '\x00', {0x0, @bt={0x3e1, 0x1000, 0x1, 0x3, 0x5, 0x9, 0x8, 0x7, 0x6, 0x101, 0xfff, 0x3, 0x1, 0x20c, 0x10, 0x19, {0x401, 0x1ff}, 0xe, 0xff}}}) r1 = socket$inet(0x2, 0xa, 0x10000) r2 = syz_open_dev$usbfs(&(0x7f0000000040), 0x20000007d, 0x0) read(r2, &(0x7f0000001a80)=""/4096, 0x12) connect$inet(r1, &(0x7f0000000040)={0x2, 0x3, @local}, 0x10) 20m51.389862304s ago: executing program 0 (id=1657): r0 = socket$kcm(0x29, 0x5, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000000c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000040)={&(0x7f0000000080)={0x28, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x28}}, 0x10) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000580)}, {&(0x7f0000000ac0)="07d98d396058a855921d034d0fb8034a5317ce586c382c8d41f8212309f82dd261e5f9263338a10244d7b49f8608f304ee79d951cd4ca8c44b84d8b2da6feb009a0d53224f69c7a037105aa12b36d0f2fa926dad5b4a129773ae0025ee2dccc42c4cc23ddd896f77e5b427f7950212eaeb0dd9c789f8def4d9fbf6274bbf72f31c5a548464395d9a68564fc12ef2196d7eac2b93ba137c89c360011aa0c15d2a0db9dfc760b6e069968685b051123d404ba4e94ccfdfebeaa7a30c8de388e00edff56b0c6968ec98e00ad8decf9dec77295a37e60510e906474b55034f7f6594c92e49dd422bb4346631b852e64add94f0ee30da8e199a89d8969df24601639c324ea084f8b00dbb3322aa7b1759fde71e4279841257c589725c12070d0cd41423d566d8b73b2936119519e31f4c8243e9207e688e77550867081b9b685d277a4800", 0xfffffd6b}, {&(0x7f0000000640)="74a892e6122d0e9da29a40f6060049f3ab51554d", 0x14}], 0x3, &(0x7f00000005c0)=ANY=[], 0x158}, 0x0) (async) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000), 0x480, 0x0) ioctl$BLKFLSBUF(r2, 0x1261, &(0x7f00000001c0)=0x5) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x4e21, @multicast2}, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e20, @loopback}, 0x153, 0x0, 0x0, 0x0, 0x1, 0x0, 0x200, 0x490, 0x81}) socket$nl_netfilter(0x10, 0x3, 0xc) 20m51.214352684s ago: executing program 0 (id=1658): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000200)={0x3c00, 0x118, 0x780, 0x800, 0x4, 0xfffffffa, 0xf, 0x0, {0x7, 0x9, 0x1}, {0x3, 0x4}, {0x1, 0x3}, {0x6, 0x1ff}, 0x3, 0x1, 0xe, 0x0, 0x1, 0x9, 0x5aeb, 0x0, 0x80, 0x7, 0xac, 0x8, 0x24, 0x100, 0x2, 0x6}) 20m51.166254923s ago: executing program 0 (id=1659): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000001080)={{0x12, 0x1, 0x0, 0xff, 0x0, 0x0, 0x40, 0x572, 0xcb01, 0x2665, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xaa, 0x75, 0xb7}}]}}]}}, 0x0) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000500)={0x14, 0x0, &(0x7f00000004c0)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000f00)={0x24, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x21, @string={0x21, 0x3, "edf5cb14f2ff5859ce7600296aca9f3fbe44262a42cffa2f3510a57c853360"}}, 0x0, 0x0}, 0x0) r1 = socket(0x1f, 0x8e2e494ff9c62d21, 0x8) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000080)={0x8, 0x400d, 0x4, 0x5}, 0x10) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, 0x0, 0x0) 20m48.06617151s ago: executing program 0 (id=1670): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x20400, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$DRM_IOCTL_ADD_BUFS(0xffffffffffffffff, 0xc0206416, &(0x7f0000000100)={0x8, 0x400, 0xffff, 0x74, 0x3, 0x10000}) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000008b"]) syz_clone(0x80280, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r5, &(0x7f0000847fff), 0xfffffffffffffe97, 0x14000180, &(0x7f000005ffe4)={0xa, 0x4e23, 0x2, @remote}, 0x1c) sched_setattr(0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) r6 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x0, 0x0) fchdir(r7) r8 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) ftruncate(r8, 0x2007ffb) close(r8) openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0xc8a02, 0x0) creat(&(0x7f0000000300)='./bus\x00', 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)) r9 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x8, 0x530, 0xc, 0xfffffffffffffffd, 0x59c}) ioctl$SG_BLKTRACETEARDOWN(r9, 0x1276, 0x20000000) socket$kcm(0x10, 0x2, 0x0) 20m46.283696979s ago: executing program 0 (id=1678): r0 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000440)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-generic\x00'}, 0x58) r5 = accept$alg(r4, 0x0, 0x0) r6 = dup(r5) r7 = open(&(0x7f0000000000)='./file1\x00', 0x10f0c2, 0x0) ftruncate(r7, 0x200004) sendfile(r6, r7, 0x0, 0x80001d00c0d1) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-aesni)\x00'}, 0x58) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r1, 0xc02c564a, &(0x7f0000000040)={0x38000000, 0x32314247, 0x0, @stepwise={0xff, 0x5, 0x314, 0x854, 0x5, 0x2}}) socket$alg(0x26, 0x5, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000005580)={0x0, 0x0, &(0x7f0000005540)={&(0x7f0000005280)=@updsa={0xf0, 0x1a, 0x805, 0x70bd2b, 0x25dfdbfc, {{@in6=@mcast1, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4e24, 0x7f, 0x4e23, 0x2, 0xa, 0xa0, 0x20, 0x67}, {@in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x4d6, 0x6c}, @in6=@private1, {0x1, 0x400, 0x2, 0x5, 0x8, 0x200, 0x5}, {0xfffffffffffffff7, 0x218, 0x0, 0x8}, {0xce8b, 0x2, 0xb}, 0x70bd2c, 0x3503, 0x2, 0x1, 0x1, 0x4}}, 0xf0}, 0x1, 0x0, 0x0, 0x20000000}, 0x8010) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000300)=@urb_type_iso={0x0, {0x1, 0x1}, 0x10000, 0x3, 0x0, 0x0, 0x2, 0x1c0, 0x1, 0x10000, 0x1ff, 0x0, [{0x8, 0x9, 0x4}]}) 20m31.116201065s ago: executing program 33 (id=1678): r0 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000440)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-generic\x00'}, 0x58) r5 = accept$alg(r4, 0x0, 0x0) r6 = dup(r5) r7 = open(&(0x7f0000000000)='./file1\x00', 0x10f0c2, 0x0) ftruncate(r7, 0x200004) sendfile(r6, r7, 0x0, 0x80001d00c0d1) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-aesni)\x00'}, 0x58) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r1, 0xc02c564a, &(0x7f0000000040)={0x38000000, 0x32314247, 0x0, @stepwise={0xff, 0x5, 0x314, 0x854, 0x5, 0x2}}) socket$alg(0x26, 0x5, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000005580)={0x0, 0x0, &(0x7f0000005540)={&(0x7f0000005280)=@updsa={0xf0, 0x1a, 0x805, 0x70bd2b, 0x25dfdbfc, {{@in6=@mcast1, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4e24, 0x7f, 0x4e23, 0x2, 0xa, 0xa0, 0x20, 0x67}, {@in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x4d6, 0x6c}, @in6=@private1, {0x1, 0x400, 0x2, 0x5, 0x8, 0x200, 0x5}, {0xfffffffffffffff7, 0x218, 0x0, 0x8}, {0xce8b, 0x2, 0xb}, 0x70bd2c, 0x3503, 0x2, 0x1, 0x1, 0x4}}, 0xf0}, 0x1, 0x0, 0x0, 0x20000000}, 0x8010) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000300)=@urb_type_iso={0x0, {0x1, 0x1}, 0x10000, 0x3, 0x0, 0x0, 0x2, 0x1c0, 0x1, 0x10000, 0x1ff, 0x0, [{0x8, 0x9, 0x4}]}) 4m52.18633794s ago: executing program 6 (id=5086): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x2c, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x8, 0x0, 0x4}, 0x0, 0x0}) 4m51.434376258s ago: executing program 6 (id=5090): pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_usb_connect(0x2, 0x41, &(0x7f0000000200)=ANY=[], 0x0) 4m48.190436068s ago: executing program 6 (id=5100): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000840)={0x2, {{0x2, 0x0, @multicast2}}, 0x0, 0x3, [{{0x2, 0x0, @empty}}, {{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {{0x2, 0x4e21, @empty}}]}, 0x210) 4m48.016988664s ago: executing program 6 (id=5101): r0 = socket$nl_route(0x10, 0x3, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75e5705f6964", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000100)) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000300)='.\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file0\x00', 0x252) prctl$PR_MCE_KILL(0x35, 0x2, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f00000003c0)={0x0, 0x0, "ec9fe44d4dbe56a65274d7c727e7e53c1bb714e315eeb406bfdd73835e57efa94b1a0275781c647aa7e3470c6028642b17832b10b386a6f73791011c26a9aa141f406e312295ee620a9a46577b9249b738fe7750bec83bf6ed5b67213fa7d6c0823fd154ed29ed7eff0d26ff199ee1ff379742c3f0b46caa357d70ee438f901d7645c3f87e4b21482b76f2ad8eaac090272081f98fd2e3e5a63e006204df635e731a5bfcf142f4529517454618de595cd179445b4bdbf698b9986356f0ebf7d25a57774ef474f86a3ad24ae9f0bf94b99e6b87de5f79d383d05bb32701daed400785a49788f08caecc9e0c48a3740bbe6e1c1fd400cfdfe756bcb7d08e36655c"}) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f00000001c0)={0xa1, 0x16, 0x4, 0x300, 0x0, 0x10, 0x0}) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), r2) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="1fe225bd7000fcdbdf250d000000140001b9b628af2eedde0e60c3f3b42fac148006000000000000000800090006000000080004000000000008"], 0x40}, 0x1, 0x0, 0x0, 0x20040811}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000400)=@ethtool_flash={0x33, 0xea5, '.\x00'}}) 4m46.99628867s ago: executing program 6 (id=5107): setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x0, 0xc688, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x34f0a87871305eb2}, 0x9c) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x40, 0xf00, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xb, 0x4, 0x4, 0x0, 0x4, {[@window={0xa, 0x3}, @timestamp={0x5, 0xa}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x4e) 4m46.706240467s ago: executing program 6 (id=5108): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x7e, 0x9e, 0xb4, 0x10, 0x54c, 0x38, 0x16f5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x8, 0xc5, 0x38}}]}}]}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000300)={'bridge_slave_1\x00', &(0x7f0000000880)=@ethtool_test={0x1a, 0x8, 0xe}}) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x8, 0x0, 0x4}, 0x0, 0x0}) 4m46.144909536s ago: executing program 34 (id=5108): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x7e, 0x9e, 0xb4, 0x10, 0x54c, 0x38, 0x16f5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x8, 0xc5, 0x38}}]}}]}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000300)={'bridge_slave_1\x00', &(0x7f0000000880)=@ethtool_test={0x1a, 0x8, 0xe}}) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x8, 0x0, 0x4}, 0x0, 0x0}) 46.386132317s ago: executing program 2 (id=5988): getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x14, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0x1c, &(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB], &(0x7f0000000980)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) userfaultfd(0x3) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) syz_open_dev$audion(&(0x7f0000000200), 0x7ff, 0x40000) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') lseek(r1, 0x1000000, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) r2 = syz_io_uring_setup(0x4b5, &(0x7f0000010400)={0x0, 0x86e1, 0x400, 0x8}, &(0x7f0000010080), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000010300)=[{0x0}, {0x0}], 0x2) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r2, 0x10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)=[{0x0}, {&(0x7f0000000340), 0xa002a0}], &(0x7f00000005c0), 0x2}, 0x20) 46.286968449s ago: executing program 2 (id=5989): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getrandom(&(0x7f0000000000)=""/9, 0x9, 0x1) 46.170258948s ago: executing program 2 (id=5990): r0 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e24, 0x0, @empty, 0x3}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x100000000000000) 45.454188036s ago: executing program 2 (id=5992): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x26020480) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x80000, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x28, r4, 0x1, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x47}]}, 0x28}, 0x1, 0x0, 0x0, 0x811}, 0x4000000) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) 44.88377423s ago: executing program 2 (id=5993): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x8, 0x11, 0xf1ff}]}}]}, 0x38}}, 0xfffffffffffffff1) 44.44225334s ago: executing program 2 (id=5995): r0 = landlock_create_ruleset(&(0x7f00000002c0)={0xe028}, 0x18, 0x3) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(r0, 0x4002f516, &(0x7f0000000300)={0x3, 0x4}) r1 = socket$tipc(0x1e, 0x5, 0x0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x80000) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r2, 0xc2604110, &(0x7f0000000040)={0x0, [[0x9ef8, 0x2], [0x0, 0x1], [0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xfffffffd]], '\x00', [{0xfffffffc, 0xf8}, {}, {0xffffffff}, {0x10000000, 0x10000000, 0x0, 0x1}, {0x3, 0xffffffff}, {0x1}, {}, {0x0, 0x4}, {}, {0x2}, {}, {0xfffffff8}], '\x00', 0x1, 0x0, 0x0, 0xf8}) 43.495613893s ago: executing program 35 (id=5995): r0 = landlock_create_ruleset(&(0x7f00000002c0)={0xe028}, 0x18, 0x3) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(r0, 0x4002f516, &(0x7f0000000300)={0x3, 0x4}) r1 = socket$tipc(0x1e, 0x5, 0x0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x80000) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r2, 0xc2604110, &(0x7f0000000040)={0x0, [[0x9ef8, 0x2], [0x0, 0x1], [0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xfffffffd]], '\x00', [{0xfffffffc, 0xf8}, {}, {0xffffffff}, {0x10000000, 0x10000000, 0x0, 0x1}, {0x3, 0xffffffff}, {0x1}, {}, {0x0, 0x4}, {}, {0x2}, {}, {0xfffffff8}], '\x00', 0x1, 0x0, 0x0, 0xf8}) 9.089668804s ago: executing program 8 (id=6121): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x162a82, 0x0) r1 = dup(r0) fallocate(r1, 0x10, 0x0, 0x72200) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f00000000c0)={'nat\x00', 0x0, 0x0, 0x0, [0x6, 0x0, 0x3, 0x3, 0xa, 0x5]}, &(0x7f0000000140)=0x78) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="0000050011800200240012800b0001006d61637365630000140002800500080003"], 0x44}}, 0x20) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x100) 8.706278752s ago: executing program 8 (id=6123): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000009e602206d0414c340000000000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) syz_usb_connect$printer(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010102000000c72505a8a440000102030109022400710107800b0904000701070102080909fb08"], &(0x7f00000003c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x2, 0x81, 0xfd, 0x40, 0x4}, 0x45, &(0x7f0000000180)={0x5, 0xf, 0x45, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x16, 0x1, 0x5, 0xc0f9}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xa, 0xb, 0x7}, @ss_container_id={0x14, 0x10, 0x4, 0x3, "0195eaf0a0e43124282b40eb0c15157a"}, @ss_container_id={0x14, 0x10, 0x4, 0x10, "613ab1aa23514b43ef5836289b88356d"}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x8, 0x2, 0x94b}]}, 0x6, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x402}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x4ff}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x440a}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x804}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0xc09}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x810}}]}) syz_usb_control_io$hid(r0, &(0x7f0000000200)={0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="200a0900000009090dd5caa87766098860c728ae17abdb477451f7fdbb0736557093a80db43a87a9ceae440233900dc0d1daf78e0c506b9ef9178e2b0c772aac1961efc6759e2bd12ff86778d574cbfec904957bec6b9d1f6862cbfd"], 0x0, &(0x7f0000000100), 0x0}, 0x0) 8.656936964s ago: executing program 4 (id=6124): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="5c0000001000010029bd70000000000014000000", @ANYRES32=0x0, @ANYBLOB="0c71040000000000140003006e657464657673696d30000000000000200016801c00018018000c"], 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 8.109945565s ago: executing program 4 (id=6127): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='net_prio.prioidx\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000000000000ff000000850000000e000000c500000001f0ffff95"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000380)={r2, r4, 0x1, 0x0, @void}, 0x10) r5 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x3, @mcast2, 0x5}, 0x1c) write$binfmt_aout(r5, &(0x7f0000000000)=ANY=[], 0x28) socket$inet6_sctp(0xa, 0x801, 0x84) syz_80211_inject_frame(0x0, 0x0, 0x0) r6 = gettid() timer_create(0x0, 0x0, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r8 = dup(r7) r9 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0xd, &(0x7f0000000340), &(0x7f000001f200)=0x4) fcntl$setown(r7, 0x8, r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r8, 0x0) r10 = openat$fb0(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FBIOGETCMAP(r10, 0x4604, 0x0) 6.816273158s ago: executing program 1 (id=6129): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x2}, 0x38) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) syz_io_uring_setup(0x231, &(0x7f0000000300)={0x0, 0xc463, 0x10101, 0x2}, &(0x7f00000001c0), &(0x7f0000000140)) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000580)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/242, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/60, 0xeeee0000}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) 6.18888247s ago: executing program 8 (id=6130): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="640000000206030004000000000000000000000005000100070000000900020073797a30000000001400078005001500040000000800124000000a00050005000a000000050004000000000015000300686173683a69702c706f72742c6e6574"], 0x64}}, 0x10000) 6.164799111s ago: executing program 7 (id=6131): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x4b, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="08010000130001000000000000000000ac141428000000000000000000000000e000000200"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000000000000000000000000000000000000000000000f7ffffffffffffff00000000000000000400000000000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000feffffff00000000000002000000000044000500ac1414bb000000000000000000000000000000002b000000020000000000000000000000000000000000000000000000010000000400000000000000000000000c0008000800080000000000"], 0x108}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) futex(&(0x7f000000cffc), 0x5, 0x0, 0x0, &(0x7f0000048000), 0x20fffffe) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@RTM_NEWMDB={0x18, 0x55, 0x1e5, 0x70bd28, 0x0, {0x7, r4}}, 0x18}}, 0x0) setsockopt$packet_int(r3, 0x107, 0x7, &(0x7f0000000280)=0x4, 0x4) r5 = gettid() migrate_pages(r5, 0x21, &(0x7f00000001c0)=0x7f, &(0x7f0000000200)=0x7) syz_open_dev$vbi(&(0x7f00000002c0), 0x3, 0x2) timer_getoverrun(r1) 5.968528788s ago: executing program 8 (id=6132): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x1000003f, 0x0, 0x0, 0xf4c, 0x4, 0x0, 0x8000000, 0x3}, 0x0) syz_pidfd_open(0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x8417f, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getpid() openat$sndseq(0xffffffffffffff9c, 0x0, 0x48100) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000040)={0x0, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32={[0xfd]}}], 0xffc8) 5.862340496s ago: executing program 4 (id=6133): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={@map, 0xffffffffffffffff, 0x31, 0x0, 0x0, @void, @value}, 0x20) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001400)=ANY=[@ANYBLOB="3c0000001000010800"/20, @ANYRES32=r2, @ANYBLOB="00410000000000001c002b8008000100", @ANYRES32, @ANYBLOB="0800030019000000080008"], 0x3c}}, 0x0) syz_usb_connect(0x1, 0x2d, &(0x7f0000000540)=ANY=[@ANYBLOB="12012000f1048108cd060202d4920000000109021b1901000000d40904150001da40df0009056132"], 0x0) 5.615280048s ago: executing program 1 (id=6134): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000b00)=ANY=[@ANYBLOB="020300000b0000000000002000000000030006000000000002000000e000000100000000000000000200010000001c000000fb18000000000300050000000000020000007f0000010000000000000000010018"], 0x58}, 0x1, 0x7}, 0x0) 5.07013071s ago: executing program 1 (id=6135): r0 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000000c0)="6880a642beaf34317f0dd3122a90ad0d2b", 0x11}], 0x1}, 0x0) socket$kcm(0x10, 0x2, 0x4) ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f0000000940)={0x2, 0x100, 0x4, {0xc000, 0x4, 0x4, 0x2}}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3e0, 0x0, 0x218, 0x0, 0x218, 0x218, 0x348, 0x348, 0x348, 0x348, 0x348, 0x6, 0x0, {[{{@ip={@remote, @multicast2, 0x0, 0xff, 'veth0_to_bridge\x00', 'ipvlan1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x2, 0x10000, 0x2}}]}, @TTL={0x28}}, {{@ip={@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'pim6reg1\x00', 'macvtap0\x00'}, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x2, 0x8}}}, {{@ip={@broadcast, @private, 0x0, 0x0, 'hsr0\x00', 'syzkaller1\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@local, @rand_addr, 0x0, 0x0, 'ip6erspan0\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x38}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x440) 4.782313764s ago: executing program 5 (id=6137): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) (async) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x20000004004, r0, 0x2}) (async) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000bc0), 0x8002, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) (async) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000001400)) (async) read$dsp(r3, &(0x7f0000000180)=""/208, 0xd0) (async) mmap$dsp(&(0x7f0000fff000/0x1000)=nil, 0x1002, 0x0, 0x11, r2, 0x0) 4.64681029s ago: executing program 1 (id=6138): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r2 = epoll_create1(0x0) fcntl$dupfd(r2, 0x2, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={0x0}, 0x18) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_emit_ethernet(0x95, &(0x7f0000000240)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}, @multicast, @val={@void, {0x8100, 0x3, 0x0, 0x1}}, {@x25={0x805, {0x0, 0x8, 0xfb, "a2f1ff80114502115efa2edffe20909cab2da7c0ba8cc356fcdb59c3048b9ae94577115ca453482522b4556c46525a96e82073a9b6b5f9dba7f68e1ecd9b71d2615886c26b036bef2c5ce88ea55818abc98ace892033dfe821fa6263b648e2bd1fcc2e0f5a7088bd59ef54b91786f90f4626ddac800b260e2f6292f759b1c6d9"}}}}, &(0x7f00000000c0)={0x1, 0x1, [0xf74, 0x8bf, 0xe4b, 0xa20]}) syz_open_dev$usbfs(&(0x7f0000000100), 0x775, 0x8000) munlockall() r5 = socket(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r7) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r8, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902120001000010000904430000317d550061987583e2224a41a5c9ca2cff8c7f9afcf7dc44cc64f3a7d5755000b9a1d3f1c34f4ec473d68115f877993766"], 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001d00)=@newtfilter={0x64, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0xc}, {0xfff2}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0x38, 0x2, [@TCA_BPF_ACT={0x34, 0x1, [@m_vlan={0x30, 0x9, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x64}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) dup(r3) r9 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r9, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000000)={0x28, 0x6, r1, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000}) 4.550128114s ago: executing program 7 (id=6139): syz_open_procfs$pagemap(0x0, &(0x7f0000000140)) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x3, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xfbc6, 0x10100, 0x8000003}, &(0x7f0000000080)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x230}}) add_key$keyring(&(0x7f00000000c0), 0x0, 0x0, 0x0, 0xffffffffffffffff) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="c4010000100033060000000004000000ac14142500000000000000b000000000b108d01350faf10200"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000003200000000000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000cd2d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000048000200656362286369706865725f6e756c6c2900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000890001006d64350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008020000fd2f480f2e2ebb04183ebcaed78f40b20e8473b935f6cf6f3d2c402e34b339e1b0cd2b29cd33e8f258cf85e6c1348f664a094fe82198b2247fe438734b6b8a3542000000"], 0x1c4}}, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r6) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r7, 0x0) r8 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r8, 0x29, 0xb, &(0x7f0000000100)=0x3, 0x4) setsockopt$inet6_int(r8, 0x29, 0x8, &(0x7f0000000000)=0xffffff80, 0x4) getsockopt$inet6_buf(r8, 0x29, 0x6, 0x0, &(0x7f0000000180)) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r9, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r10 = accept(r6, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(r9, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) sendmsg(r9, &(0x7f00000014c0)={&(0x7f0000000240)=@pppol2tpv3in6={0x18, 0x1, {0x0, r10, 0x20000001, 0x1, 0x4, 0x0, {0xa, 0x4e23, 0x12f, @local, 0x2}}}, 0x80, &(0x7f0000001440)=[{&(0x7f0000001b80)="322a84d436adc3f124551212948b3b8449a56829085fc5b97a1baa1676d5c9c1d7fc6480519649e39c4343c757a1ee0ef36b584d7fe2c5281ff7c24de3d4d880afdf4dd6ab476c30263d8c1dfe3f7d5cd2e050ea82f1e264061cbd741b3da18088754bffe581dc09e7b314a541e018f10859b7ce2977a4e47e485f5ed5439936c8d64cdda137ad5bdd3037970f4427bdeb6dc6b1bcaa7de9fba3609ece26276bc9cd25d693c2c6fb81d6b9d68ba1ee53f646375d4a8b0ef62392d05b5210fc84e683a5ae89e2379a039f214f0af3ec0c59fd74e365c2d25238eb7b2d4e8f3aebe1eb795ee1d8fb66eddac34e45d491d0d19d564eeb2db7aec18c02a72e5cee8154160edcef9196edfcf85c82a48ecc4aab6389504cf90bcabee60d59b717cbb16396c2b413ef8ee392974689b0541eae7d9c714ec605ea60f2322cf6f1e0b0a5e59a2f2d87e2a04cf78aef1b1c979635432bf82265c2e25ce1234fe67ed6672c712b36f9e74d6558495d6b395ca4ab30ffb12fb3f81667224bb8831392979d68ccf83aa3d7a961df64282017547eeb307a0051cc4dcf915c60ac1735984dc274d8508cbc1ce75afdc641c4604a4700df837a7ef80440d2f883952c9cf4dab5f57b6dbdf06385ea1f2adf9f858054749df1b5812bd2167a9697431d11357ef0d2215da30425ecfa6ca3323db819b4b318b4f72032c60dd8093e33af496dd265e8be520d97b26c850efca4da4faeb999646ee4b01a01d39e9516d2abad8c34d8bd321e0224f6009f4dbe43007fba610f97728c18ff39a5648816af94401bd59ad33c6a0e97cb0e54fda293d5e3d655386a82915ee40383892c77d6018ca714e5c860c8002ecf29b307b2f435e372b95ab0d2da543f58ad07df73f473e20e2566832d6331814941fa04658f80dab480a590d32545ba859dd180d6277504ec2dff9b0fc7d7fc13b900b799ecca157516aa9555293b0eadfe4c611984b5df9debc78955cf796479e14ab9ab983a6e7d0ccbbe4e333be767086a69678a3e74c91a8b3d743e9223637f7257c7cedb2c555c3cdc3fe70e5faea2d5f60f04d10cdf411f7de6d9ceb4f48c0859dff7093aea5c255b2ef6b05822c062a9a0ccff2d60aa3d80e8149239fc396da2343721b6a1784132baa60268e7c952d83939714e0ff44cf083ecebfad7340b5162d9fdd914ada56c7192b8f9c583bc1689a53a0440c5d78c81916e4e7599718525d458a61a745f902bea194c28dbf472edc04eecfb3e6bbe47958f682fe7909976ba7d23362dd4e3209fb1f78634a2ec36918671bb65268b2b0252cd9c26e9c90bc643929c826342c708e93cbff616e2dae8d349ecdc431bc08c23235c125796bf85be1184491cc63a8482717be00395722faccc051b7498b789d61390c9e7ce9288a193f3b54a053ec50ae0f3f4dcd203de04747a18d0142dcba42b4709a09c37d3641b53e021a3f765d1d2f5c7848cee0c94fd15a051a0c8ebe714dd0ddf8d8840528082d5482f35693f645076d004e651495634914b628f5eaa2754e135f50a77f28a02c20d01e8a41fb108b03d498412226bac799564be7e296a654a91b8ba64f4e9bdda29457031ab7021142e8758d081e5daf23291af2e0e0f4cc828b3b6ed3f084e0ad5de4b6095c80d936fa6480bfa99f9d100104d2e367c06da31457f0c755cc7f3cfa91c8ae655502652619f0c52eba7814bc40ac737b86573fdc9d610cc4603468d15f615cc7bd063f1cb8a3267cc37eacd4a296c05ccb375e56925f20a604dabab48bdfc435cb0624abef6088c8ec0f2505acd15c11e99f3ac75bfcef4798a24ad263e68da512a936bba21ecb302061b69767271c94bb43f803025297a110ae05fa0d404d34e1c47764717c7b51b9a0d12bc6dc78da2e4c3cd97d3c27e9eb3706e8a4a9ebd59ca2ad744f9dc83d1cb223ff3dab658143d100a1d418e4d0dc7d1d5c45b6ed74c2ac8f33185ba915493fa5a115a036ba7a98eb763bf7a87225e1b25ed38b196f6d99ea061ec273b4efd9afb58cb375a6cfd19e5d28046e50f469f3d72a20527fbffc2f1bbeaba10b6229e7f503a8ad85cefc2ac7735f8b36c60061276ae23135f935ae5eb8924fcc7846e05d4ab857efb6361fd688608569dfa0bcdede9db648b0155621cfbab64c5c67336d74b0fcadf829a2b55853a9a281024351762b6518015b0d5875e9317e055cd406eb2618b366382292a3fdffe374c23e2a4faf4e2452cb8d4f260d1f57f2c7f791629aa176318041608cfb95aa8d1e413508178a78097c096d175d736f8b683859b55eec904626ac70e185ef7d7b2edc53758ac894edbc29df929d58c63ae19729db04282b45909557c72d73a1329db2a8f7a9968bb1d79929db508d1bcb4a97db54be3d9ebd70e94abd8dfb23e110b9be3fceae8621d3b6369e5a2b19188dc04fbf1cc6f8d46917bab20dfa3cd904be4f081e5faf9711d490448b7de8d5f9298c2a5bd335f27bc0d9bd8c82d4bd1594d5034404e8b8ed208457381a14f6efa1b1b1b1f576a66339ae22870082bb8951d536131651b06d5fbcb62d72541aa5be840df996fb7f3127aac972ad91a27e2e336847edd5c9a554db35da6ac3521196d0c11ffc196bb1121fae46b32432ad8c736136c06c8c562c30d105c471b9b223ee06543964174433655a06a50c01d64aac3042f3ff497ce24e8fbcb61fef21c6337a822f83e8d5bf3c322a3e696440db946a283919ffccf506c4427f3d5213c989757083c4d7eeb10665f33a6842d2233c754083ca315af538d875bb17d6151ff769a55fe26732858a4f833af79625da05f6ac8189a5539c20066b23437c8ea5c3ef3ec8ca4882881097ed0da3da88480d0733bb30dfec71dfac314172be5ccb218888ead4ba573a5888c5890e8efab6dbe20431b572c57ee859c38262aca38e657dd3a8e54ddb24d31c415448548bdd29664f2f80311d9fe03d094f25d892cb68ebc027940bd97bdd4bcb343a641ef0656e7758bc2ec1e2e1ca54930f8b661af1245dd4c8962f1b74847ab85583fd13aa197b7c4abf249ca95e9b74aa58e5dd25c258f66a276c1f863c8f903ad22d5c05d2c8b6724f6624e549418231315bd23e2f0b9e6a9a313d820269fd0c5b9358c190fff88d30e14bd863d962c5d08b2be89b61d0d9f0eddbe6bec7f33636a2688572323a3d9e91121817984965e93d4fb50a2ed7c71a3aab635d8a1c65e12f27ad7d85ca8aa1d1bc63611508c8ee62639cbb34d278b1b9273f6d97553283681b0ae0271f1ca8608dd8a2a3ee919c5f3a75e8a90d061e8a7020e644006b775af28683dd834ff7227b796e8a2a2a318e0807753985220bf1f75d7ccfedfc3b7d67deace0a8e0812c5dd30555e03b2a15d0a22753fdff1f58700568dae74e98ed4b41144abf9525e5ebd1a1f6dec30b42711193a066eb7be6cf561bfc2d27187719457da02ec00f8c4755609742f25c78fe1d25dee212336175c33bfc75b4decddf3374ef781ac0c6620e87d6eba6be7f816f15ca641fc16446a5df18d574ac1b276c2b9f512a56d32c6ba374d7d257fce5e307a1b613035ddd44425601ada6b4d1a9dd4348c7941f417fa5ccb76e79aab8ad2df14a927962e81266ab8d4b9b11aed8dd4f0f03d3a6e20fa528af3b47a35f84a04009765f3dfacd6bedab84c7666531226a22b259baba869c19877cea1d2ee1c55c97cbc28f3303666c2df4b2798b0f3b307a551e8dd1938ebe429c59069ee05797b56337bb84d6989e646f25d0e1c2b6691970c48e40c9d8eb4d83f21742b914cd3ffd604ab8f813063f335ed87be750c33098091bd6fc6f6b1205b9e3e00505a5442a998b598310a4d1a7114cee5c847e8b00e416434027cf0bf12ae9cf039159b81e49ec4ae689402c6fa3c219aada820523346e0d954153b32e5a8940e9c522098886666968eb33afb9ffb402b8bbbe23f57928332695d487430978f2f0b57bbdd308c19153d992c90301d26c49ad168e7b73c53b5bebc9715dc6c6fa4a3abe28ffe1af9da0d7985ee5edb028d1b6ea7da81761560265a54384b2072b7f5ffa314cfd051e0800a87f68ac11caac678fd749ad7ee2a4186f351c67161646441da92c0e45bd3f2ad3f0c60464017f1766b46dd3c594378a873ff0ce5056ca6bc36f27fb34bf371dd946b4eee4adc686a80d371febc417824d2070b156dff120d5e53c99f06943cc4d575d8311b28cf5ae85c556f75e6ee8f0dffbcce1ff05b0826daa69541bac1b0f1d94ee662ae35e40eeddf425cdeced581327b224e3ad4b417d811a03b429916e7adba573cebe99e3e21904cdcbca003e35fc22fdc128979dd05756fefb6f130b996600e8ac67e03d967ea96ac0292ab53987829331821401365fefba7b1a64b13e2d68fe3325d99bd87fd31e1b3115af7ab6d2c3a320836cfd80f5f4a5a8687752ea4983b108b298c1c55c3e84b3d4b806f90354bee8ada21250ac9581495fa5bac02e15fef39543117cd2f0455257da0f487963e8b1bf10ed03abce82f015360bf767238179349e75c8d2b5bb4b40a54630d21dd663132e73cfb652ef2a83a041e2fa4c661b219b3b03ca6b93e8020ee9a06412021a24ab11cd80dbddf70d4d6005dcaea4a57ec9f32238aa2df49768830fbc312f4fa08e3e5f28bd1de0e32c8b62002e0c34708be976ace1002384b37424bf8578c453ee1e8b945e40dc7ed1e54749014a559722aeb46d9a4f132e2f0cc45fdfec4dc1984bd06ae45149694724ed499c3e1c0429347abdfd5fbc6e27ef98a6a9e7f847d3146ee63c770674c5596a6ae58c6eeea75276b9391b4b7cefba5c633c846674607bca86fd826e469dcb18cb7f9e6c0f3c2d8615e7e16d12d0f38197285039b1be43032c60912cfab6bfed0892359f9c3cc90474f1d0f89558cace0e82a2e16365db72dde0bdcbf3b01de2429cca3de2fa78113ea9070799b8ccb9090082aa38dac73949779abecbf2d4ee1475911970e918e5831513687e3d3e3e5633791078ddf1fe66e7e14bddee1d71f45a07b5f7adb55e3aecd4a02e139d4cb8e01f3d1a65b873770634cc70ec10f74672127e62e9a37572e2cd39dd4edda23938170ad804cd181889466a223bb3eb3a8ab33a8ea076300628c13e917c7ed7022d49895d81aa4e7e7216f12ae903950c656871ec29ec292ca2068734aac17c582c0e13fccefeb975a4a83e471645cb351fa474940aef15255716ad1380154dac0cf1a26d358c0d4080f2562e50fe5c7fda4e29d59a2e161137a1b6cc656d92a0abc2b90c99bdcef92a9a396ff8430451bf8b557a252b37a152a49283faa92137017567e0054b14a6cff256ad4488facef80417fd4a579a299ed9f298cb4b4e520d27503a6dfcb4a41615289e8a24a551e7acadaefea6c4a4223321e1241eff8fcabd2ae46b7d7ba11a176840700687891f0b40d8456972df1afe36cb5a8c7509488c472974a7244150e9ca873d44aa50eded85d4db36f5c2468dddc2b54b601c69da53c8cd0f9efd2409b45b2cde8f051e61ba053708473f7e95abb49f1dc32a8529bc5ffab580877d8e856929f21a8da281a536ab836c53b4c7c65d43daa59b215d761cefeb59f986908ff4486d6ee9da1905cba1b039faa03d608e1de9950657c2960cf9f91452983e267c25dfd8783d0aa1605f1066f8046617291a44b640d6260fc5f5ffb22533b0eb204f137490d56d84941d9b60fc983d0537a0c620131f31c5d6305d740ababbc4a948b843d087acc38cf36261b6850eba815948332804d9101", 0x1000}, {&(0x7f00000010c0)="4b561ee26e1ff16618c49f8a0155c8cbc14b821a1110d2", 0x17}, {&(0x7f0000001100)="bc9341b9f8ea2fa79d9ba29a048a0faaa520d20326a2a4954b967f7b56baaedc9fe5653d6c9adeda3825bbbe0273fca141fc2018e1b4a8bd1c437c7f869976f145b8c1fbdba7f5d643b0687c59654353cf39c960360386344a75bc436cc3b4294bd69ba03b39bf59a1eea02013f05204e6bec26831fe172cab531fc632f7f9c235", 0x81}, {&(0x7f00000002c0)="5f02eac11a1585991a2e5fa6ed9becfe91325c6692f72c14da23804864107706f18961b9032ad2d7ee589c5f55aca0ab7f9ef7eac551b15094be0d47b459cbf718287daca101adbf1feee5b5625fd45fa6139075004567ebbbc71883a16db68efa340a96d4ab25b8c40be6ea453f410292b412412c46da9e2b35a53454ec21", 0x77}, {&(0x7f0000001240)="d7321b1e", 0x4}, {&(0x7f0000001280)="1337c070ecef5a", 0x7}, {&(0x7f00000012c0)="79c23b68e7339a841c47c628574ee9aae21fa9c7b1cf71e406e8d47e22c6acd928a67ad450a9b6dc010d5737fdadfb70a774f043d8ef9cc54933a14b7de7fe2a67a6523c17930998a4b9b0661144aafacc1841d014d27b1895d1f2e9918e11d19201a9234e0f975e27377e1af5d714b6efaa224a926121d058c8f106edae", 0x7e}, {&(0x7f0000001340)="d68bd8fcd2f9d41bd55f76744cd7b142b39b975699a9344ee889cc3582fea863b87b2f3db6c4ae3668ff0f81480ab236b67a9e60f149ba9cbd51ce8b476999a98538c7a5a158c2f6f6c794fcb039dccf745f15918b916e9d2fdae09ef5395fa44b1087db1ba6ff257d788f78abe8018b3204934f0e746884524b1350fb122e09655f630d17dcba91c366fcbca1b07396209f6ebe74462fd9915ab3db8cf224ae5878fdd8ead934f190ea13a5f82d26baa8b37a68f50cfbe47b772863c6c00f317546", 0xc2}], 0x7}, 0x80) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mlock2(&(0x7f00002a2000/0x3000)=nil, 0x3000, 0x1) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f00004fd000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f000015a000/0x2000)=nil) 4.475380498s ago: executing program 5 (id=6140): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) syz_open_dev$sndctrl(&(0x7f0000000000), 0x2, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pipe(&(0x7f0000000080)) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x281400}, 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) 3.975111667s ago: executing program 4 (id=6141): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0xe1002) sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x1405, 0x1, 0x70bd25, 0x25dfdbfd}, 0xfffffffffffffd77}, 0x1, 0x0, 0x0, 0x4000000}, 0x10000000) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000040)=ANY=[@ANYRES64=r0]) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x239, &(0x7f00000004c0)={0x0, 0xbf15, 0x10100, 0x0, 0x1f1, 0x0, r3}, &(0x7f0000000080), &(0x7f0000000480)) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0x9, "ac7e9b5c"}]}}, 0x0}, 0x0) 3.478119077s ago: executing program 8 (id=6142): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000040)=0x1c00) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000a00)=ANY=[@ANYBLOB="120100007856bb40da0b53813de20102030109021200010000000009040000000206"], 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x8001000000000000, 0x40, &(0x7f0000001080)=@raw={'raw\x00', 0x8, 0x3, 0x2c8, 0x0, 0x5, 0x148, 0x138, 0x0, 0x260, 0x2a8, 0x2a8, 0x260, 0x2a8, 0x3, 0x0, {[{{@ip={@remote, @loopback, 0x0, 0x0, 'wg0\x00', 'erspan0\x00'}, 0x0, 0x110, 0x138, 0x0, {}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x581b, 0x0, 0x3, {0x4}}}, @common=@unspec=@physdev={{0x68}, {'veth1_to_batadv\x00', {}, 'wlan1\x00', {}, 0x4, 0x6}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1d, 0x3, 0x1}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0x1b}, @multicast2, 0x0, 0xffffff00, 'xfrm0\x00', 'veth0_to_hsr\x00'}, 0x0, 0x98, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xd}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @random="6f79fb339557", 0x0, 0x0, [0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffd, 0x0, 0xffff, 0x0, 0x0, 0x26]}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x328) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000700)={0xffffffffffffffff}) fanotify_init(0x44, 0x101000) sendmmsg(r4, &(0x7f000000a4c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x8800) r5 = add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc1}, &(0x7f0000000080)={0x0, "5d9bc136c963254c661fb620148b6f72ca6ae2a44829bfa79ec13499f8ec9077d85d879711d98bb1687ad36dfe5f14a7b0ce15c1e6be0e7ecabfdfde0dfa00b1"}, 0x48, 0xffffffffffffffff) pipe2$watch_queue(0x0, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r5, 0xffffffffffffffff, 0x7a) r6 = syz_open_dev$evdev(&(0x7f0000000100), 0x0, 0x862b01) r7 = syz_open_dev$evdev(&(0x7f0000000280), 0x0, 0x0) read$hiddev(r7, &(0x7f0000002300)=""/102, 0x66) write$char_usb(r6, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000100), &(0x7f0000000180)={'fscrypt:', @desc1}, &(0x7f00000001c0)={0x0, "968143deb8b76325598ea9ab22edc6596a000089666f0e299e98210fe66bcf59f94d606fd2d5a7e847643cbb1895c225d7e38762f4c5c637f20150d3f064bbb8", 0x3b}, 0x48, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000440)={0x34, &(0x7f0000000140)={0x0, 0x0, 0x4, 'v\x00-p'}, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.266957243s ago: executing program 5 (id=6143): getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x14, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0x1c, &(0x7f0000000040)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) userfaultfd(0x3) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) syz_open_dev$audion(&(0x7f0000000200), 0x7ff, 0x40000) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') lseek(r0, 0x1000000, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x4b5, &(0x7f0000010400)={0x0, 0x86e1, 0x400, 0x8}, &(0x7f0000010080), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000010300)=[{0x0}, {0x0}], 0x2) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r1, 0x10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)=[{0x0}, {&(0x7f0000000340), 0xa002a0}], &(0x7f00000005c0), 0x2}, 0x20) 2.577837217s ago: executing program 5 (id=6144): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x2}, 0x38) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) syz_io_uring_setup(0x231, &(0x7f0000000300)={0x0, 0xc463, 0x10101, 0x2}, &(0x7f00000001c0), &(0x7f0000000140)) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000580)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/242, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/60, 0xeeee0000}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) 2.338197482s ago: executing program 4 (id=6145): syz_usb_connect(0x0, 0x36, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r3, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r6], 0x54}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="200000001000250800170000000000000a000000", @ANYRES32=r9, @ANYBLOB="01"], 0x20}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c000000110001002dbd7000fbdbdf2500000000", @ANYRES32=r6], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.757819334s ago: executing program 7 (id=6146): socket$nl_route(0x10, 0x3, 0x0) r0 = io_uring_setup(0x1c09, &(0x7f0000000000)={0x0, 0x6775, 0x0, 0x3, 0xa9}) io_uring_enter(r0, 0x10f0, 0xebb1, 0x68, &(0x7f0000000080)={[0x9]}, 0x8) socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f00000000c0)={{0x7, 0x0, 0x0, 0x200002, 'syz0\x00', 0x7}, 0x0, [0x0, 0x2000, 0x3, 0xfffffffffffffffe, 0xfffffffff7fffffe, 0x0, 0x5, 0x0, 0x10000, 0x4, 0x400000000004, 0x0, 0x800, 0x2, 0x7, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2, 0x4, 0x10, 0x4, 0x800000000000000, 0x0, 0x6, 0xae4f, 0x0, 0x0, 0x1, 0x0, 0x8, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0x1, 0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfff, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0xfa0, 0x0, 0xfffffffffffffffb, 0xea4d, 0x377, 0xffffffffffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xc84, 0x40000000000001, 0x3, 0xfffffffffffffffd, 0x1, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x400, 0x4000000000000, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4, 0xd30, 0x0, 0x4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x400000000000031, 0x1, 0x0, 0x0, 0x0, 0x1, 0x71, 0x0, 0x2, 0x0, 0x3]}) 1.498084763s ago: executing program 5 (id=6147): r0 = syz_open_procfs(0x0, &(0x7f0000000180)='map_files\x00') fchdir(r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000000)={'veth1_vlan\x00', {0x2, 0x4e20, @local}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x400000000, &(0x7f00000002c0)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f0000000040)={0x13, 0x10, 0xfa00, {&(0x7f0000000580), r4, 0x1}}, 0x18) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) pipe2(&(0x7f0000000800)={0x0, 0x0}, 0x80000) splice(r5, 0x0, r6, 0x0, 0x6c, 0xd) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000100), 0xfecc) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) ptrace(0x10, r7) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a88000000060a0b040000000000000000020000005c000480580001800a000100696e6e65720000004800028008000240000000870800034000000007080004400000000f0800014000000000240005800c0001007061796c6e6164001400028008000340000000b908000240000000040900010073797a30000000000900020073797a32"], 0xb0}}, 0x0) ptrace$poke(0x5, r7, &(0x7f0000000080), 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r6, 0xc058565d, &(0x7f0000000140)=@mmap={0x7f, 0x2, 0x4, 0xe000, 0x5, {r9, r10/1000+10000}, {0x5, 0xc, 0x7, 0x8, 0x9, 0x8, "d553dc6c"}, 0x4, 0x1, {}, 0x4, 0x0, r6}) socket$packet(0x11, 0x3, 0x300) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000040), 0x6, 0x400000) 1.472413505s ago: executing program 7 (id=6148): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x4000, &(0x7f00000013c0)=ANY=[@ANYBLOB="0000205626da3a2772b4f3c280a4465c56e478cb9ad5ca0d5fa55d092878047accb22e4be4c2dc114bbbafbbaf7f2bf8561b210666471a34a62fbbc8273003079c836d4561ef0a0f540a7ea7094b176f598b28e9fb07e56717e0782736e4366978cfd983536b88092a", @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',allow_other,max_read=0x0000000000008000,\x00'], 0x0, 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) io_setup(0x1, 0x0) io_submit(0x0, 0x1, &(0x7f0000001d00)=[0x0]) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) syz_io_uring_setup(0xec5, 0x0, &(0x7f0000000080), 0x0) openat$sysfs(0xffffff9c, &(0x7f0000000080)='/sys/kernel/config', 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='stack\x00') lseek(r1, 0xae7d, 0x0) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000340)={0x0, 0x4}, 0x8) sendmmsg$inet6(r2, &(0x7f0000002640)=[{{&(0x7f0000000080)={0xa, 0x4e22, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4}, 0x1c, &(0x7f0000000540)=[{&(0x7f0000000100)="b22041a342", 0x5}], 0x1}}, {{&(0x7f00000005c0)={0xa, 0x4e22, 0x6, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x1ff}, 0x1c, &(0x7f0000000b00)=[{&(0x7f0000000600)="b5cf31", 0x3}], 0x1}}], 0x2, 0x20000000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000180)={0x0, 0x4, 0x9417}, 0x8) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@newtfilter={0x54, 0x2c, 0xd27, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xffff, 0x7}, {0x0, 0xe800}, {0xa}}, [@filter_kind_options=@f_flow={{0x9}, {0x24, 0x2, [@TCA_FLOW_EMATCHES={0x20, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x14, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0x10, 0x1, 0x0, 0x0, {{0x9, 0x0, 0x1}, "e8"}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}]}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) 1.162204028s ago: executing program 7 (id=6149): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x4b, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="08010000130001000000000000000000ac141428000000000000000000000000e000000200"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000000000000000000000000000000000000000000000f7ffffffffffffff00000000000000000400000000000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000feffffff00000000000002000000000044000500ac1414bb000000000000000000000000000000002b000000020000000000000000000000000000000000000000000000010000000400000000000000000000000c0008000800080000000000"], 0x108}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) futex(&(0x7f000000cffc), 0x5, 0x0, 0x0, &(0x7f0000048000), 0x20fffffe) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@RTM_NEWMDB={0x18, 0x55, 0x1e5, 0x70bd28, 0x0, {0x7, r4}}, 0x18}}, 0x0) setsockopt$packet_int(r3, 0x107, 0x7, &(0x7f0000000280)=0x4, 0x4) r5 = gettid() migrate_pages(r5, 0x21, &(0x7f00000001c0)=0x7f, &(0x7f0000000200)=0x7) syz_open_dev$vbi(&(0x7f00000002c0), 0x3, 0x2) timer_getoverrun(r1) 992.230186ms ago: executing program 7 (id=6150): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8400) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000140)={0x0, 0x9}, 0x8) setsockopt(r1, 0x84, 0x82, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x800, 0x0) sigaltstack(&(0x7f0000003e80)={&(0x7f0000003d80)=""/237, 0x2, 0xed}, &(0x7f0000003f40)={0x0}) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x4e21, 0x7, @mcast2}, {0xa, 0x0, 0xb, @mcast1}, r5, 0x2000000}}, 0x48) r6 = socket$netlink(0x10, 0x3, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000001200)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60b8192300080000fe807a3a0000000000000000001200aafe8000000000000000000000080000aa0000000000000000"], 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x100000, @loopback}], 0x1c) sendto$inet6(r1, &(0x7f0000000040)="ee", 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x101, @loopback, 0x8000005}, 0x1c) r7 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) io_setup(0x8, &(0x7f0000000080)=0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000002c0)={@remote, @empty}, &(0x7f0000000300)=0xc) io_submit(r8, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r7, &(0x7f0000000140)='-3', 0x2}]) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_procfs(0x0, &(0x7f0000000280)='net/fib_trie\x00') sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000003c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000000f8c0000000c0a01080000000000000000010000000900020073797a3200000000600003805c000080080003400000000250000b80200001800a00010071756f7461000000100002800c0001400000000000000000140001800c000100636f756e74657200000000000000058011e70000666c6f775f6f66666c6f6164000000000900010073797a30"], 0x110}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f00000005c0)={0x53, 0x20, 0x6, 0x2, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000240)="4b8d7acda0b2", 0x0, 0x0, 0x0, 0x0, 0x0}) 493.567439ms ago: executing program 4 (id=6151): pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file0\x00', 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x3e, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) open(&(0x7f00000000c0)='.\x00', 0x20800, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) socket$igmp(0x2, 0x3, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB="6400000010000304000000000900000000000000", @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200200000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}}, 0x0) 481.606712ms ago: executing program 1 (id=6152): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x10, &(0x7f00000005c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@call={0x85, 0x0, 0x0, 0x7}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0xbb) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0xa031, 0xffffffffffffffff, 0x0) 110.308002ms ago: executing program 1 (id=6153): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000009010000000900010073797a3000000000440000001a0a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000000208000840000000013c0000000e0a01020000000000000000010000000900020073797a3200000000100003802f00008008000180040002800900010073797a300000"], 0xc8}}, 0x0) 1.305168ms ago: executing program 5 (id=6154): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001a0001002bbd7000030000000a000000", @ANYRES32=0x0, @ANYBLOB="04000004140003000700000000000000000000000000000014000100fc00"], 0x44}, 0x1, 0xe0ffff00000000, 0x0, 0x1}, 0x40000) 0s ago: executing program 8 (id=6155): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000900), 0x2, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0x4000000105002, 0x0) syz_io_uring_setup(0x5d05, &(0x7f0000000500)={0x0, 0x86fa, 0x10101}, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) socket$inet6_mptcp(0xa, 0x1, 0x106) writev(r0, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f6400940005006850d1b4000000000000008004000000ffe809000000fff5dd00000008", 0x49}], 0x1) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_REINJECT_CONTROL(r4, 0xae64, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r5, 0x4048aecb, &(0x7f0000000080)=ANY=[@ANYRES16=r2]) ioctl$KVM_GET_VCPU_EVENTS(r5, 0xc048aeca, &(0x7f0000000140)) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000086d040ec2000000000001090224000100000000090400000103000081030000"], 0x0) syz_usb_connect$cdc_ecm(0x1, 0x4d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010003"], 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_keypress_notify={{0x3c, 0x7}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x4}}}, 0xa) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) write$binfmt_script(r6, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x1000) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) kernel console output (not intermixed with test programs): lNumber: syz [ 1651.760888][ T30] audit: type=1326 audit(1749694940.634:2447): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25512 comm="syz.7.5756" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1651.790709][ T43] usb 2-1: config 0 descriptor?? [ 1651.808008][ T30] audit: type=1326 audit(1749694940.634:2448): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25512 comm="syz.7.5756" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1651.854886][ T43] smsc95xx v2.0.0 [ 1651.861046][ T43] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 1651.874268][ T9] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1651.942169][T19203] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1651.957191][ T43] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -22 [ 1651.958733][ T9] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 1651.979472][T19203] usb 6-1: New USB device found, idVendor=05a4, idProduct=8003, bcdDevice= 0.00 [ 1651.990688][T19203] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1652.010616][ T9] usb 3-1: media controller created [ 1652.029502][T19203] usb 6-1: config 0 descriptor?? [ 1652.161730][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1652.316850][ T9] i2c i2c-2: ec100: i2c rd failed=-71 reg=33 [ 1652.350902][T25532] pim6reg: entered allmulticast mode [ 1652.379342][T25532] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5762'. [ 1652.487187][T25519] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1652.497992][T19203] ortek 0003:05A4:8003.003F: invalid report_count 1553694380 [ 1652.509608][T19203] ortek 0003:05A4:8003.003F: item 0 4 1 9 parsing failed [ 1652.526331][T19203] ortek 0003:05A4:8003.003F: probe with driver ortek failed with error -22 [ 1652.560653][ T9] usb 3-1: USB disconnect, device number 27 [ 1652.871309][T25539] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5765'. [ 1652.988569][ T9] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 1653.066160][T25513] fuse: blksize only supported for fuseblk [ 1653.093694][T25513] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1653.104160][T25513] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1653.134202][T25513] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1653.149287][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 1653.154637][T25513] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1653.156212][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1653.177082][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1653.194253][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 1653.204709][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1653.222165][ T9] usb 3-1: config 0 descriptor?? [ 1653.445311][T25536] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1653.463204][T25536] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1653.472763][T20287] Bluetooth: hci3: Unknown advertising packet type: 0x75 [ 1653.472805][T20287] Bluetooth: hci3: Malformed LE Event: 0x0d [ 1653.578448][ T9] usb 3-1: string descriptor 0 read error: -71 [ 1653.583332][T25545] netlink: 16 bytes leftover after parsing attributes in process `syz.7.5767'. [ 1653.652889][ T9] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1653.699497][ T9] usb 3-1: USB disconnect, device number 28 [ 1653.820682][T19203] usb 2-1: USB disconnect, device number 72 [ 1654.139106][T15462] usb 6-1: USB disconnect, device number 52 [ 1654.185999][T25559] netlink: 84 bytes leftover after parsing attributes in process `syz.5.5776'. [ 1654.499934][T25576] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5778'. [ 1657.489069][T25605] program syz.5.5787 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1657.702410][ T9] usb 3-1: new low-speed USB device number 29 using dummy_hcd [ 1657.818630][ T5930] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 1657.877706][ T9] usb 3-1: device descriptor read/64, error -71 [ 1657.950878][T25608] netlink: 'syz.4.5789': attribute type 2 has an invalid length. [ 1658.107639][T25609] kAFS: unable to lookup cell '.,' [ 1658.120995][ T9] usb 3-1: new low-speed USB device number 30 using dummy_hcd [ 1658.148991][ T5930] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1658.482928][ T9] usb 3-1: device descriptor read/64, error -71 [ 1658.786862][ T5930] usb 6-1: New USB device found, idVendor=05a4, idProduct=8003, bcdDevice= 0.00 [ 1659.078437][ T5930] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1659.091715][ T5930] usb 6-1: config 0 descriptor?? [ 1659.189079][ T9] usb usb3-port1: attempt power cycle [ 1659.657820][T25621] FAULT_INJECTION: forcing a failure. [ 1659.657820][T25621] name failslab, interval 1, probability 0, space 0, times 0 [ 1659.673099][ T5930] ortek 0003:05A4:8003.0040: invalid report_count 1553694380 [ 1659.682523][ T5930] ortek 0003:05A4:8003.0040: item 0 4 1 9 parsing failed [ 1659.691087][ T5930] ortek 0003:05A4:8003.0040: probe with driver ortek failed with error -22 [ 1659.718511][T25621] CPU: 0 UID: 0 PID: 25621 Comm: syz.1.5788 Not tainted 6.16.0-rc1-syzkaller-00005-g488ef3560196 #0 PREEMPT(full) [ 1659.718541][T25621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1659.718554][T25621] Call Trace: [ 1659.718564][T25621] [ 1659.718574][T25621] dump_stack_lvl+0x189/0x250 [ 1659.718610][T25621] ? __pfx____ratelimit+0x10/0x10 [ 1659.718641][T25621] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1659.718671][T25621] ? __pfx__printk+0x10/0x10 [ 1659.718698][T25621] ? __mutex_trylock_common+0x153/0x260 [ 1659.718728][T25621] should_fail_ex+0x414/0x560 [ 1659.718769][T25621] should_failslab+0xa8/0x100 [ 1659.718794][T25621] __kmalloc_cache_noprof+0x70/0x3d0 [ 1659.718814][T25621] ? __hw_addr_add_ex+0x1f4/0x770 [ 1659.718846][T25621] __hw_addr_add_ex+0x1f4/0x770 [ 1659.718881][T25621] dev_addr_init+0x14f/0x230 [ 1659.718912][T25621] ? __pfx_dev_addr_init+0x10/0x10 [ 1659.718935][T25621] ? alloc_netdev_mqs+0xa6/0x11e0 [ 1659.718981][T25621] alloc_netdev_mqs+0x2f3/0x11e0 [ 1659.719008][T25621] ? __pfx_vlan_setup+0x10/0x10 [ 1659.719040][T25621] rtnl_create_link+0x31f/0xd10 [ 1659.719077][T25621] rtnl_newlink_create+0x25c/0xb00 [ 1659.719111][T25621] ? __pfx_aa_get_newest_label+0x10/0x10 [ 1659.719142][T25621] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1659.719165][T25621] ? rtnl_newlink+0x8db/0x1c70 [ 1659.719190][T25621] ? __pfx___mutex_lock+0x10/0x10 [ 1659.719223][T25621] ? ns_capable+0x8a/0xf0 [ 1659.719258][T25621] rtnl_newlink+0x16d6/0x1c70 [ 1659.719282][T25621] ? netlink_sendmsg+0x805/0xb30 [ 1659.719321][T25621] ? __pfx_rtnl_newlink+0x10/0x10 [ 1659.719370][T25621] ? kasan_quarantine_put+0xdd/0x220 [ 1659.719400][T25621] ? lockdep_hardirqs_on+0x9c/0x150 [ 1659.719437][T25621] ? nlmon_xmit+0xb0/0x100 [ 1659.719465][T25621] ? kmem_cache_free+0x18f/0x400 [ 1659.719493][T25621] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1659.719523][T25621] ? lockdep_hardirqs_on+0x9c/0x150 [ 1659.719554][T25621] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1659.719582][T25621] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1659.719617][T25621] ? __dev_queue_xmit+0x27e/0x3a70 [ 1659.719660][T25621] ? __lock_acquire+0xab9/0xd20 [ 1659.719718][T25621] ? __pfx_rtnl_newlink+0x10/0x10 [ 1659.719746][T25621] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1659.719773][T25621] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1659.719794][T25621] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1659.719813][T25621] ? ref_tracker_free+0x63a/0x7d0 [ 1659.719838][T25621] ? __copy_skb_header+0xa7/0x550 [ 1659.719867][T25621] ? __pfx_ref_tracker_free+0x10/0x10 [ 1659.719908][T25621] netlink_rcv_skb+0x208/0x470 [ 1659.719933][T25621] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1659.719958][T25621] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1659.719998][T25621] ? netlink_deliver_tap+0x2e/0x1b0 [ 1659.720022][T25621] ? netlink_deliver_tap+0x2e/0x1b0 [ 1659.720052][T25621] netlink_unicast+0x75b/0x8d0 [ 1659.720088][T25621] netlink_sendmsg+0x805/0xb30 [ 1659.720125][T25621] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1659.720154][T25621] ? aa_sock_msg_perm+0x94/0x160 [ 1659.720181][T25621] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1659.720206][T25621] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1659.720231][T25621] __sock_sendmsg+0x219/0x270 [ 1659.720266][T25621] ____sys_sendmsg+0x505/0x830 [ 1659.720297][T25621] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1659.720333][T25621] ? import_iovec+0x74/0xa0 [ 1659.720358][T25621] ___sys_sendmsg+0x21f/0x2a0 [ 1659.720385][T25621] ? __pfx____sys_sendmsg+0x10/0x10 [ 1659.720460][T25621] ? __fget_files+0x2a/0x420 [ 1659.720483][T25621] ? __fget_files+0x3a0/0x420 [ 1659.720517][T25621] __x64_sys_sendmsg+0x19b/0x260 [ 1659.720547][T25621] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1659.720586][T25621] ? __pfx_ksys_write+0x10/0x10 [ 1659.720603][T25621] ? rcu_is_watching+0x15/0xb0 [ 1659.720639][T25621] ? do_syscall_64+0xbe/0x3b0 [ 1659.720664][T25621] do_syscall_64+0xfa/0x3b0 [ 1659.720682][T25621] ? lockdep_hardirqs_on+0x9c/0x150 [ 1659.720712][T25621] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1659.720732][T25621] ? clear_bhb_loop+0x60/0xb0 [ 1659.720773][T25621] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1659.720793][T25621] RIP: 0033:0x7fd52f18e929 [ 1659.720812][T25621] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1659.720831][T25621] RSP: 002b:00007fd53001e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1659.720854][T25621] RAX: ffffffffffffffda RBX: 00007fd52f3b5fa0 RCX: 00007fd52f18e929 [ 1659.720870][T25621] RDX: 0000000004000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 1659.720884][T25621] RBP: 00007fd53001e090 R08: 0000000000000000 R09: 0000000000000000 [ 1659.720898][T25621] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1659.720911][T25621] R13: 0000000000000000 R14: 00007fd52f3b5fa0 R15: 00007fd52f4dfa28 [ 1659.720945][T25621] [ 1660.271873][T25623] use of bytesused == 0 is deprecated and will be removed in the future, [ 1660.280469][T25623] use the actual size instead. [ 1660.293411][ T30] kauditd_printk_skb: 603 callbacks suppressed [ 1660.293429][ T30] audit: type=1326 audit(1749694950.634:3052): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25622 comm="syz.4.5793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f571c78e929 code=0x7ffc0000 [ 1660.334584][T25625] netlink: 136 bytes leftover after parsing attributes in process `syz.1.5794'. [ 1660.388468][T25625] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 1660.436910][ T30] audit: type=1326 audit(1749694950.634:3053): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25622 comm="syz.4.5793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f571c78e929 code=0x7ffc0000 [ 1660.460664][ T30] audit: type=1326 audit(1749694950.634:3054): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25622 comm="syz.4.5793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f571c78e929 code=0x7ffc0000 [ 1660.484380][ T30] audit: type=1326 audit(1749694950.634:3055): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25622 comm="syz.4.5793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f571c78e929 code=0x7ffc0000 [ 1660.507297][ T30] audit: type=1326 audit(1749694950.634:3056): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25622 comm="syz.4.5793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f571c78e929 code=0x7ffc0000 [ 1660.530346][ T30] audit: type=1326 audit(1749694950.634:3057): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25622 comm="syz.4.5793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f571c78e929 code=0x7ffc0000 [ 1660.553332][ T30] audit: type=1326 audit(1749694950.634:3058): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25622 comm="syz.4.5793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f571c78e929 code=0x7ffc0000 [ 1660.576441][ T30] audit: type=1326 audit(1749694950.634:3059): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25622 comm="syz.4.5793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f571c78e929 code=0x7ffc0000 [ 1660.599234][ T30] audit: type=1326 audit(1749694950.634:3060): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25622 comm="syz.4.5793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f571c78d290 code=0x7ffc0000 [ 1660.622181][ T30] audit: type=1326 audit(1749694950.634:3061): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25622 comm="syz.4.5793" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f571c78e929 code=0x7ffc0000 [ 1661.391253][T15462] usb 6-1: USB disconnect, device number 53 [ 1662.006175][T25651] netlink: 56 bytes leftover after parsing attributes in process `syz.2.5803'. [ 1662.015967][T25649] program syz.5.5801 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1662.036317][T25651] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5803'. [ 1662.086437][T25650] netlink: 56 bytes leftover after parsing attributes in process `syz.2.5803'. [ 1662.109629][T25650] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5803'. [ 1662.388796][T15462] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 1662.660678][T15462] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1662.704057][T15462] usb 6-1: New USB device found, idVendor=05a4, idProduct=8003, bcdDevice= 0.00 [ 1662.796601][T15462] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1662.833277][T15462] usb 6-1: config 0 descriptor?? [ 1663.216810][ T5908] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 1663.659528][T25662] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5805'. [ 1664.048331][T19203] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 1664.057717][ C0] raw-gadget.3 gadget.2: ignoring, device is not running [ 1664.125127][T15462] ortek 0003:05A4:8003.0041: invalid report_count 1553694380 [ 1664.132896][T15462] ortek 0003:05A4:8003.0041: item 0 4 1 9 parsing failed [ 1664.141437][T15462] ortek 0003:05A4:8003.0041: probe with driver ortek failed with error -22 [ 1664.198240][T19203] usb 3-1: device descriptor read/64, error -32 [ 1664.198256][ T5908] usb 2-1: Using ep0 maxpacket: 8 [ 1664.202423][ T5908] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1664.367014][ T5908] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1664.375140][ T5908] usb 2-1: Product: syz [ 1664.379378][ T5908] usb 2-1: Manufacturer: syz [ 1664.384038][ T5908] usb 2-1: SerialNumber: syz [ 1664.392769][ T5908] usb 2-1: config 0 descriptor?? [ 1664.488525][T19203] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 1664.696064][T19203] usb 3-1: Using ep0 maxpacket: 32 [ 1664.772486][T19203] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 1664.812120][T19203] usb 3-1: config 0 has no interface number 0 [ 1664.822008][ T5908] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1664.866449][T19203] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1664.937821][T19203] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1664.987017][T19203] usb 3-1: Product: syz [ 1665.027875][ T5930] usb 6-1: USB disconnect, device number 54 [ 1665.063177][T19203] usb 3-1: Manufacturer: syz [ 1665.077814][T25672] netlink: 'syz.5.5809': attribute type 12 has an invalid length. [ 1665.085957][T25672] netlink: 9472 bytes leftover after parsing attributes in process `syz.5.5809'. [ 1665.113426][T19203] usb 3-1: SerialNumber: syz [ 1665.238714][T19203] usb 3-1: config 0 descriptor?? [ 1665.276446][T19203] smsc95xx v2.0.0 [ 1665.281960][T19203] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 1665.321478][T19203] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -22 [ 1665.465415][ T5908] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 1665.764821][T25680] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5810'. [ 1665.825643][T25680] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5810'. [ 1665.920629][T25660] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1666.118305][T25669] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1666.281659][T25686] program syz.4.5812 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1666.514011][T19203] usb 2-1: USB disconnect, device number 73 [ 1666.648267][ T5930] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 1666.916876][T25697] netlink: 'syz.1.5815': attribute type 2 has an invalid length. [ 1667.258315][ T5930] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1667.378264][ T5930] usb 5-1: New USB device found, idVendor=05a4, idProduct=8003, bcdDevice= 0.00 [ 1667.388675][ T43] usb 3-1: USB disconnect, device number 33 [ 1667.396694][ T5930] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1667.438010][ T5930] usb 5-1: config 0 descriptor?? [ 1668.031483][ T5930] ortek 0003:05A4:8003.0042: invalid report_count 1553694380 [ 1668.039019][ T5930] ortek 0003:05A4:8003.0042: item 0 4 1 9 parsing failed [ 1668.047073][ T5930] ortek 0003:05A4:8003.0042: probe with driver ortek failed with error -22 [ 1668.298270][ T43] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 1668.928611][T19203] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1668.963057][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.970362][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1669.052452][ T43] usb 2-1: Using ep0 maxpacket: 32 [ 1669.086000][ T43] usb 2-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 1669.115264][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1669.177967][ T43] usb 2-1: config 0 descriptor?? [ 1669.279354][ T43] gspca_main: sunplus-2.14.0 probing 041e:400b [ 1669.348259][T19203] usb 3-1: Using ep0 maxpacket: 8 [ 1669.361019][T19203] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1669.370225][T19203] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1669.379159][T19203] usb 3-1: Product: syz [ 1669.387322][T19203] usb 3-1: Manufacturer: syz [ 1669.396911][T19203] usb 3-1: SerialNumber: syz [ 1669.414043][T19203] usb 3-1: config 0 descriptor?? [ 1669.443033][T15462] usb 5-1: USB disconnect, device number 112 [ 1669.647476][T19203] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1669.921363][T25727] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5826'. [ 1670.204769][T25733] netlink: 'syz.7.5827': attribute type 2 has an invalid length. [ 1670.213582][T25733] netlink: 'syz.7.5827': attribute type 1 has an invalid length. [ 1670.231424][T25733] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5827'. [ 1670.240920][T25733] netlink: 56 bytes leftover after parsing attributes in process `syz.7.5827'. [ 1670.390902][T15462] usb 6-1: new full-speed USB device number 55 using dummy_hcd [ 1670.555147][T15462] usb 6-1: not running at top speed; connect to a high speed hub [ 1670.574295][T15462] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1670.593205][T15462] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1670.603799][ T43] gspca_sunplus: reg_w_riv err -110 [ 1670.609660][ T43] sunplus 2-1:0.0: probe with driver sunplus failed with error -110 [ 1670.633130][T15462] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1670.645797][T15462] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1670.671746][T15462] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1670.680227][T15462] usb 6-1: Product: Ð [ 1670.694304][T15462] usb 6-1: Manufacturer: и [ 1670.700498][T15462] usb 6-1: SerialNumber: Ј [ 1671.232466][T25742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1671.313762][T25742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1671.327095][T19203] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1671.341691][T19203] dvbdev: DVB: registering new adapter (TerraTec NOXON DAB Stick) [ 1671.395076][ T5908] usb 2-1: USB disconnect, device number 74 [ 1671.435570][T19203] usb 3-1: media controller created [ 1671.507893][T25744] input: syz0 as /devices/virtual/input/input274 [ 1671.606595][T19203] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1671.686763][T25750] FAULT_INJECTION: forcing a failure. [ 1671.686763][T25750] name failslab, interval 1, probability 0, space 0, times 0 [ 1671.722934][T25750] CPU: 1 UID: 0 PID: 25750 Comm: syz.1.5831 Not tainted 6.16.0-rc1-syzkaller-00005-g488ef3560196 #0 PREEMPT(full) [ 1671.722966][T25750] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1671.722978][T25750] Call Trace: [ 1671.722987][T25750] [ 1671.722996][T25750] dump_stack_lvl+0x189/0x250 [ 1671.723038][T25750] ? __pfx____ratelimit+0x10/0x10 [ 1671.723066][T25750] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1671.723097][T25750] ? __pfx__printk+0x10/0x10 [ 1671.723125][T25750] ? __pfx___might_resched+0x10/0x10 [ 1671.723154][T25750] ? fs_reclaim_acquire+0x7d/0x100 [ 1671.723184][T25750] should_fail_ex+0x414/0x560 [ 1671.723215][T25750] should_failslab+0xa8/0x100 [ 1671.723240][T25750] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 1671.723261][T25750] ? __pfx_nf_tables_abort+0x10/0x10 [ 1671.723286][T25750] ? __alloc_skb+0x112/0x2d0 [ 1671.723313][T25750] __alloc_skb+0x112/0x2d0 [ 1671.723350][T25750] netlink_ack+0x146/0xa50 [ 1671.723380][T25750] ? __kasan_kmalloc+0x93/0xb0 [ 1671.723411][T25750] nfnetlink_rcv+0x2290/0x2520 [ 1671.723476][T25750] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1671.723524][T25750] ? ref_tracker_free+0x63a/0x7d0 [ 1671.723585][T25750] ? __netlink_deliver_tap+0x807/0x850 [ 1671.723619][T25750] ? netlink_deliver_tap+0x2e/0x1b0 [ 1671.723642][T25750] ? netlink_deliver_tap+0x2e/0x1b0 [ 1671.723671][T25750] netlink_unicast+0x75b/0x8d0 [ 1671.723706][T25750] netlink_sendmsg+0x805/0xb30 [ 1671.723749][T25750] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1671.723777][T25750] ? aa_sock_msg_perm+0x94/0x160 [ 1671.723804][T25750] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1671.723830][T25750] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1671.723856][T25750] __sock_sendmsg+0x219/0x270 [ 1671.723890][T25750] ____sys_sendmsg+0x505/0x830 [ 1671.723923][T25750] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1671.723959][T25750] ? import_iovec+0x74/0xa0 [ 1671.723983][T25750] ___sys_sendmsg+0x21f/0x2a0 [ 1671.724012][T25750] ? __pfx____sys_sendmsg+0x10/0x10 [ 1671.724078][T25750] ? __fget_files+0x2a/0x420 [ 1671.724099][T25750] ? __fget_files+0x3a0/0x420 [ 1671.724133][T25750] __x64_sys_sendmsg+0x19b/0x260 [ 1671.724162][T25750] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1671.724199][T25750] ? __pfx_ksys_write+0x10/0x10 [ 1671.724216][T25750] ? rcu_is_watching+0x15/0xb0 [ 1671.724262][T25750] ? do_syscall_64+0xbe/0x3b0 [ 1671.724286][T25750] do_syscall_64+0xfa/0x3b0 [ 1671.724304][T25750] ? lockdep_hardirqs_on+0x9c/0x150 [ 1671.724333][T25750] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1671.724365][T25750] ? clear_bhb_loop+0x60/0xb0 [ 1671.724391][T25750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1671.724412][T25750] RIP: 0033:0x7fd52f18e929 [ 1671.724431][T25750] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1671.724450][T25750] RSP: 002b:00007fd53001e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1671.724473][T25750] RAX: ffffffffffffffda RBX: 00007fd52f3b5fa0 RCX: 00007fd52f18e929 [ 1671.724488][T25750] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1671.724502][T25750] RBP: 00007fd53001e090 R08: 0000000000000000 R09: 0000000000000000 [ 1671.724514][T25750] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1671.724527][T25750] R13: 0000000000000000 R14: 00007fd52f3b5fa0 R15: 00007fd52f4dfa28 [ 1671.724560][T25750] [ 1671.768785][T19203] i2c i2c-2: Added multiplexed i2c bus 3 [ 1672.082979][T19203] rtl2832 2-0010: Realtek RTL2832 successfully attached [ 1672.095744][T19203] usb 3-1: DVB: registering adapter 2 frontend 0 (Realtek RTL2832 (DVB-T))... [ 1672.117623][T19203] dvbdev: dvb_create_media_entity: media entity 'Realtek RTL2832 (DVB-T)' registered. [ 1672.411202][T25764] program syz.1.5835 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1672.497923][T19203] usb 3-1: USB disconnect, device number 34 [ 1672.656980][T25769] veth1_macvtap: entered promiscuous mode [ 1672.662861][T25769] veth1_macvtap: entered allmulticast mode [ 1672.669309][T25769] macsec0: left allmulticast mode [ 1672.674425][T25769] veth1_macvtap: left allmulticast mode [ 1672.886334][ T5930] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 1673.428554][ T5930] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1673.460577][ T5930] usb 2-1: New USB device found, idVendor=05a4, idProduct=8003, bcdDevice= 0.00 [ 1673.469782][ T5930] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1673.481642][ T5930] usb 2-1: config 0 descriptor?? [ 1673.911619][ T5930] ortek 0003:05A4:8003.0043: invalid report_count 1553694380 [ 1673.945570][ T5930] ortek 0003:05A4:8003.0043: item 0 4 1 9 parsing failed [ 1673.970755][T15462] usb 6-1: 0:2 : does not exist [ 1674.028303][ T43] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 1674.033131][ T5930] ortek 0003:05A4:8003.0043: probe with driver ortek failed with error -22 [ 1674.368851][T15462] usb 6-1: USB disconnect, device number 55 [ 1674.596404][ T43] usb 5-1: Using ep0 maxpacket: 32 [ 1674.801948][ T43] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1674.815412][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1674.828321][ T5930] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 1674.841107][ T43] usb 5-1: config 0 descriptor?? [ 1674.939018][T15462] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 1675.113845][ T43] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1675.121274][T15462] usb 6-1: Using ep0 maxpacket: 32 [ 1675.140213][ T5930] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1675.151832][ T5930] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1675.162177][ T5930] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1675.175295][ T5930] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1675.184861][ T5930] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1675.206339][ T5930] usb 3-1: config 0 descriptor?? [ 1675.381991][T15462] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1675.407239][T19203] usb 2-1: USB disconnect, device number 75 [ 1675.410321][T15462] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1675.422336][ T43] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1675.435343][ T43] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1675.444438][T15462] usb 6-1: config 0 descriptor?? [ 1675.450431][ T43] usb 5-1: media controller created [ 1675.486282][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1675.521356][ T43] az6027: usb out operation failed. (-71) [ 1675.528786][ T43] az6027: usb out operation failed. (-71) [ 1675.534587][ T43] stb0899_attach: Driver disabled by Kconfig [ 1675.543219][ T43] az6027: no front-end attached [ 1675.543219][ T43] [ 1675.554702][ T43] az6027: usb out operation failed. (-71) [ 1675.576245][ T43] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1675.598485][ T43] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input275 [ 1675.632029][T25780] tipc: Enabled bearer , priority 0 [ 1675.643350][T25780] syzkaller0: entered promiscuous mode [ 1675.649383][ T43] dvb-usb: schedule remote query interval to 400 msecs. [ 1675.655811][ T5930] plantronics 0003:047F:FFFF.0044: ignoring exceeding usage max [ 1675.656532][ T43] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1675.675224][T25780] syzkaller0: entered allmulticast mode [ 1675.682525][ T5930] plantronics 0003:047F:FFFF.0044: ignoring exceeding usage max [ 1675.708299][ T5930] plantronics 0003:047F:FFFF.0044: usage index exceeded [ 1675.718934][ T5930] plantronics 0003:047F:FFFF.0044: item 0 1 2 2 parsing failed [ 1675.731224][ T43] usb 5-1: USB disconnect, device number 113 [ 1675.740275][ T5930] plantronics 0003:047F:FFFF.0044: parse failed [ 1675.751693][ T5930] plantronics 0003:047F:FFFF.0044: probe with driver plantronics failed with error -22 [ 1675.846056][ T43] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1675.897829][T25777] netlink: 'syz.2.5840': attribute type 30 has an invalid length. [ 1675.935780][T25777] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5840'. [ 1675.948576][T25777] (unnamed net_device) (uninitialized): option arp_missed_max: invalid value (0) [ 1675.978482][ T5908] usb 2-1: new full-speed USB device number 76 using dummy_hcd [ 1675.978544][T25777] (unnamed net_device) (uninitialized): option arp_missed_max: allowed values 1 - 255 [ 1675.990564][T25783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1676.035241][T25783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1676.150850][ T5908] usb 2-1: not running at top speed; connect to a high speed hub [ 1676.165936][ T5908] usb 2-1: config 95 has an invalid interface number: 1 but max is 0 [ 1676.175299][ T5908] usb 2-1: config 95 has no interface number 0 [ 1676.187213][ T5908] usb 2-1: config 95 interface 1 has no altsetting 0 [ 1676.198371][ T5908] usb 2-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 1676.207883][ T5908] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1676.222861][ T5908] usb 2-1: Product: syz [ 1676.227132][ T5908] usb 2-1: Manufacturer: syz [ 1676.232554][ T5908] usb 2-1: SerialNumber: syz [ 1676.367484][ T43] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 1676.473427][T25779] tipc: Resetting bearer [ 1676.506706][T25779] tipc: Disabling bearer [ 1676.548393][ T43] usb 5-1: Using ep0 maxpacket: 32 [ 1676.570618][ T5930] usb 3-1: USB disconnect, device number 35 [ 1676.583279][ T43] usb 5-1: config 0 has an invalid interface number: 146 but max is 0 [ 1676.592207][ T43] usb 5-1: config 0 has no interface number 0 [ 1676.599638][ T43] usb 5-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1676.629551][ T43] usb 5-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1676.644124][ T43] usb 5-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 1676.675957][ T43] usb 5-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1676.709546][ T43] usb 5-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 1676.717726][T25787] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1676.738565][ T43] usb 5-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1676.760996][T25787] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5843'. [ 1676.768245][ T43] usb 5-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1676.797142][ T43] usb 5-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 19968, setting to 1024 [ 1676.818716][ T43] usb 5-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 1676.835339][ T43] usb 5-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1676.856951][ T5908] usb 2-1: USB disconnect, device number 76 [ 1676.902882][ T43] usb 5-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 1676.919708][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1676.979733][ T43] usb 5-1: Product: syz [ 1676.983997][ T43] usb 5-1: Manufacturer: syz [ 1676.988962][ T43] usb 5-1: SerialNumber: syz [ 1677.005451][ T43] usb 5-1: config 0 descriptor?? [ 1677.023491][T25784] raw-gadget.5 gadget.4: fail, usb_ep_enable returned -22 [ 1677.031485][T25784] raw-gadget.5 gadget.4: fail, usb_ep_enable returned -22 [ 1677.062481][T19585] udevd[19585]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:95.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1677.084384][ T43] microtek usb (rev 0.4.3): will this work? Response EP is not usually 3 [ 1677.098651][ T43] microtek usb (rev 0.4.3): will this work? Image data EP is not usually 2 [ 1677.115580][ T43] scsi host1: microtekX6 [ 1677.302037][ T5908] usb 5-1: USB disconnect, device number 114 [ 1677.385219][T15462] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 1677.424286][T15462] usb 6-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 1677.430334][ T5930] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 1677.460805][T15462] usb 6-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 1677.618481][ T5930] usb 3-1: Using ep0 maxpacket: 8 [ 1677.641100][ T5930] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1677.659702][ T5930] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1677.678960][ T5930] usb 3-1: Product: syz [ 1677.692772][ T5930] usb 3-1: Manufacturer: syz [ 1677.738492][ T5930] usb 3-1: SerialNumber: syz [ 1677.822773][ T5930] usb 3-1: config 0 descriptor?? [ 1678.040471][ T5930] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1678.606671][T25796] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1679.078260][ T43] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 1679.207883][ T5908] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 1679.330511][ T43] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1679.337189][ T43] usb 5-1: New USB device found, idVendor=28bd, idProduct=0075, bcdDevice= 0.00 [ 1679.354532][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1679.422415][ T43] usb 5-1: config 0 descriptor?? [ 1679.453869][ T5908] usb 2-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 1679.469763][ T5908] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1679.532547][ T5908] usb 2-1: Product: syz [ 1679.550793][ T5908] usb 2-1: Manufacturer: syz [ 1679.558362][ T5908] usb 2-1: SerialNumber: syz [ 1679.584733][ T5908] r8152-cfgselector 2-1: Unknown version 0x0000 [ 1679.591470][ T5908] r8152-cfgselector 2-1: config 0 descriptor?? [ 1679.887340][ T5930] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1679.908329][ T5930] dvbdev: DVB: registering new adapter (TerraTec NOXON DAB Stick) [ 1679.916263][ T5930] usb 3-1: media controller created [ 1679.933078][ T43] uclogic 0003:28BD:0075.0045: interface is invalid, ignoring [ 1680.016010][ T5930] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1680.132167][T19203] usb 5-1: USB disconnect, device number 115 [ 1680.332887][ T5930] i2c i2c-2: Added multiplexed i2c bus 3 [ 1680.341911][T25825] FAULT_INJECTION: forcing a failure. [ 1680.341911][T25825] name failslab, interval 1, probability 0, space 0, times 0 [ 1680.351286][ T5930] rtl2832 2-0010: Realtek RTL2832 successfully attached [ 1680.355395][T25825] CPU: 1 UID: 0 PID: 25825 Comm: syz.7.5856 Not tainted 6.16.0-rc1-syzkaller-00005-g488ef3560196 #0 PREEMPT(full) [ 1680.355423][T25825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1680.355435][T25825] Call Trace: [ 1680.355443][T25825] [ 1680.355451][T25825] dump_stack_lvl+0x189/0x250 [ 1680.355483][T25825] ? __pfx____ratelimit+0x10/0x10 [ 1680.355511][T25825] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1680.355538][T25825] ? __pfx__printk+0x10/0x10 [ 1680.355565][T25825] ? __pfx___might_resched+0x10/0x10 [ 1680.355597][T25825] should_fail_ex+0x414/0x560 [ 1680.355627][T25825] should_failslab+0xa8/0x100 [ 1680.355648][T25825] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 1680.355669][T25825] ? __alloc_skb+0x112/0x2d0 [ 1680.355694][T25825] __alloc_skb+0x112/0x2d0 [ 1680.355719][T25825] netlink_sendmsg+0x5c6/0xb30 [ 1680.355751][T25825] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1680.355777][T25825] ? aa_sock_msg_perm+0x94/0x160 [ 1680.355802][T25825] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1680.355824][T25825] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1680.355847][T25825] __sock_sendmsg+0x219/0x270 [ 1680.355878][T25825] ____sys_sendmsg+0x505/0x830 [ 1680.355908][T25825] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1680.355940][T25825] ? import_iovec+0x74/0xa0 [ 1680.355963][T25825] ___sys_sendmsg+0x21f/0x2a0 [ 1680.355989][T25825] ? __pfx____sys_sendmsg+0x10/0x10 [ 1680.356048][T25825] ? __fget_files+0x2a/0x420 [ 1680.356067][T25825] ? __fget_files+0x3a0/0x420 [ 1680.356097][T25825] __x64_sys_sendmsg+0x19b/0x260 [ 1680.356123][T25825] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1680.356156][T25825] ? __pfx_ksys_write+0x10/0x10 [ 1680.356171][T25825] ? rcu_is_watching+0x15/0xb0 [ 1680.356203][T25825] ? do_syscall_64+0xbe/0x3b0 [ 1680.356226][T25825] do_syscall_64+0xfa/0x3b0 [ 1680.356242][T25825] ? lockdep_hardirqs_on+0x9c/0x150 [ 1680.356276][T25825] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1680.356294][T25825] ? clear_bhb_loop+0x60/0xb0 [ 1680.356317][T25825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1680.356335][T25825] RIP: 0033:0x7ffaa998e929 [ 1680.356352][T25825] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1680.356368][T25825] RSP: 002b:00007ffaaa856038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1680.356390][T25825] RAX: ffffffffffffffda RBX: 00007ffaa9bb5fa0 RCX: 00007ffaa998e929 [ 1680.356411][T25825] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000006 [ 1680.356423][T25825] RBP: 00007ffaaa856090 R08: 0000000000000000 R09: 0000000000000000 [ 1680.356434][T25825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1680.356445][T25825] R13: 0000000000000000 R14: 00007ffaa9bb5fa0 R15: 00007ffaa9cdfa28 [ 1680.356474][T25825] [ 1680.679923][ T5930] usb 3-1: DVB: registering adapter 2 frontend 0 (Realtek RTL2832 (DVB-T))... [ 1680.777745][ T5930] dvbdev: dvb_create_media_entity: media entity 'Realtek RTL2832 (DVB-T)' registered. [ 1681.083297][ T5930] usb 3-1: USB disconnect, device number 36 [ 1681.297475][T25849] openvswitch: netlink: Duplicate or invalid key (type 0). [ 1681.322848][T25850] openvswitch: netlink: Duplicate or invalid key (type 0). [ 1681.543729][T25847] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5862'. [ 1681.558318][T25850] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1681.576883][T25849] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1681.835881][T25854] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5864'. [ 1681.866836][T25854] bond0: entered promiscuous mode [ 1681.875350][T25854] bond_slave_0: entered promiscuous mode [ 1681.895993][T25854] bond_slave_1: entered promiscuous mode [ 1681.908404][ T5908] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 1681.928377][T25854] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1681.951667][T25854] batman_adv: batadv0: Adding interface: macvlan2 [ 1681.974013][ T43] r8152-cfgselector 2-1: USB disconnect, device number 77 [ 1682.015432][T25854] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1682.079331][ T5908] usb 5-1: Using ep0 maxpacket: 32 [ 1682.110652][ T5908] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 1682.123106][ T5908] usb 5-1: config 0 has no interface number 0 [ 1682.138878][ T5908] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1682.153734][ T5908] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1682.166704][ T5908] usb 5-1: Product: syz [ 1682.180769][ T5908] usb 5-1: Manufacturer: syz [ 1682.191115][ T5908] usb 5-1: SerialNumber: syz [ 1682.207568][ T5908] usb 5-1: config 0 descriptor?? [ 1682.219593][T25854] batman_adv: batadv0: Interface activated: macvlan2 [ 1682.227802][ T5908] smsc95xx v2.0.0 [ 1682.234778][ T5908] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 1682.262918][ T5908] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -22 [ 1682.451265][T25859] could not allocate digest TFM handle hmac(sha1-avx2) [ 1682.498423][ T43] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 1682.535649][T25867] FAULT_INJECTION: forcing a failure. [ 1682.535649][T25867] name failslab, interval 1, probability 0, space 0, times 0 [ 1682.586103][T25847] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1682.675645][T25867] CPU: 0 UID: 0 PID: 25867 Comm: syz.2.5867 Not tainted 6.16.0-rc1-syzkaller-00005-g488ef3560196 #0 PREEMPT(full) [ 1682.675677][T25867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1682.675685][T25867] Call Trace: [ 1682.675690][T25867] [ 1682.675696][T25867] dump_stack_lvl+0x189/0x250 [ 1682.675719][T25867] ? __pfx____ratelimit+0x10/0x10 [ 1682.675738][T25867] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1682.675756][T25867] ? __pfx__printk+0x10/0x10 [ 1682.675773][T25867] ? ref_tracker_alloc+0x318/0x460 [ 1682.675792][T25867] should_fail_ex+0x414/0x560 [ 1682.675811][T25867] should_failslab+0xa8/0x100 [ 1682.675826][T25867] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1682.675844][T25867] ? skb_clone+0x212/0x3a0 [ 1682.675863][T25867] skb_clone+0x212/0x3a0 [ 1682.675881][T25867] __netlink_deliver_tap+0x404/0x850 [ 1682.675903][T25867] ? netlink_deliver_tap+0x2e/0x1b0 [ 1682.675918][T25867] netlink_deliver_tap+0x19c/0x1b0 [ 1682.675933][T25867] netlink_unicast+0x72f/0x8d0 [ 1682.675952][T25867] netlink_sendmsg+0x805/0xb30 [ 1682.675972][T25867] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1682.675988][T25867] ? aa_sock_msg_perm+0x94/0x160 [ 1682.676005][T25867] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1682.676020][T25867] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1682.676035][T25867] __sock_sendmsg+0x219/0x270 [ 1682.676055][T25867] ____sys_sendmsg+0x505/0x830 [ 1682.676074][T25867] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1682.676095][T25867] ? import_iovec+0x74/0xa0 [ 1682.676110][T25867] ___sys_sendmsg+0x21f/0x2a0 [ 1682.676126][T25867] ? __pfx____sys_sendmsg+0x10/0x10 [ 1682.676162][T25867] ? __fget_files+0x2a/0x420 [ 1682.676175][T25867] ? __fget_files+0x3a0/0x420 [ 1682.676195][T25867] __x64_sys_sendmsg+0x19b/0x260 [ 1682.676212][T25867] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1682.676233][T25867] ? __pfx_ksys_write+0x10/0x10 [ 1682.676243][T25867] ? rcu_is_watching+0x15/0xb0 [ 1682.676271][T25867] ? do_syscall_64+0xbe/0x3b0 [ 1682.676285][T25867] do_syscall_64+0xfa/0x3b0 [ 1682.676295][T25867] ? lockdep_hardirqs_on+0x9c/0x150 [ 1682.676312][T25867] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1682.676324][T25867] ? clear_bhb_loop+0x60/0xb0 [ 1682.676339][T25867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1682.676350][T25867] RIP: 0033:0x7fbab858e929 [ 1682.676362][T25867] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1682.676373][T25867] RSP: 002b:00007fbab94c7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1682.676388][T25867] RAX: ffffffffffffffda RBX: 00007fbab87b5fa0 RCX: 00007fbab858e929 [ 1682.676397][T25867] RDX: 0000000000000000 RSI: 0000200000001200 RDI: 0000000000000003 [ 1682.676405][T25867] RBP: 00007fbab94c7090 R08: 0000000000000000 R09: 0000000000000000 [ 1682.676413][T25867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1682.676420][T25867] R13: 0000000000000000 R14: 00007fbab87b5fa0 R15: 00007fbab88dfa28 [ 1682.676438][T25867] [ 1682.989749][ T43] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1682.997851][ T43] usb 2-1: config 0 has no interface number 0 [ 1683.052031][ T43] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1683.070082][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1683.111567][ T43] usb 2-1: Product: syz [ 1683.127791][ T43] usb 2-1: Manufacturer: syz [ 1683.143234][ T43] usb 2-1: SerialNumber: syz [ 1683.166365][ T43] usb 2-1: config 0 descriptor?? [ 1683.234136][T25870] vlan3: entered promiscuous mode [ 1683.377623][T25856] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5865'. [ 1683.386912][T25856] netlink: 84 bytes leftover after parsing attributes in process `syz.1.5865'. [ 1683.402019][ T43] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 1683.414104][ T43] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1683.427927][ T43] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 1683.443202][ T43] usb 2-1: media controller created [ 1683.464773][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1683.611152][ T43] i2c i2c-2: ec100: i2c rd failed=-71 reg=33 [ 1683.660604][ T43] usb 2-1: USB disconnect, device number 78 [ 1683.884910][T25872] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5869'. [ 1684.302055][ T43] usb 5-1: USB disconnect, device number 116 [ 1684.353234][ T5930] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 1684.420258][T25883] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5874'. [ 1684.518317][ T5930] usb 3-1: Using ep0 maxpacket: 8 [ 1684.527078][ T5930] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1684.542154][ T5930] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1684.552463][ T5930] usb 3-1: Product: syz [ 1684.556675][ T5930] usb 3-1: Manufacturer: syz [ 1684.565126][ T5930] usb 3-1: SerialNumber: syz [ 1684.574877][ T5930] usb 3-1: config 0 descriptor?? [ 1684.810195][ T5930] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1684.878968][ T43] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 1685.040540][ T43] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1685.050112][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1685.080556][ T43] usb 5-1: config 0 descriptor?? [ 1685.089714][ T43] cp210x 5-1:0.0: cp210x converter detected [ 1685.208466][ T5908] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 1685.348355][ T5908] usb 2-1: device descriptor read/64, error -71 [ 1685.493868][ T43] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 1685.522515][ T43] usb 5-1: cp210x converter now attached to ttyUSB0 [ 1685.588269][ T5908] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 1685.728237][ T5908] usb 2-1: device descriptor read/64, error -71 [ 1685.848725][ T5908] usb usb2-port1: attempt power cycle [ 1686.024249][T25889] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap2 [ 1686.047299][T25889] batman_adv: batadv0: Adding interface: ip6gretap2 [ 1686.063884][T25889] batman_adv: batadv0: The MTU of interface ip6gretap2 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1686.108358][T25889] batman_adv: batadv0: Interface activated: ip6gretap2 [ 1686.144764][ T9] usb 5-1: USB disconnect, device number 117 [ 1686.182072][ T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1686.194090][ T9] cp210x 5-1:0.0: device disconnected [ 1686.331734][T25901] netlink: 'syz.5.5880': attribute type 3 has an invalid length. [ 1686.398561][ T5908] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 1686.418936][ T5908] usb 2-1: device descriptor read/8, error -71 [ 1686.664358][ T5930] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1686.675800][ T5930] dvbdev: DVB: registering new adapter (TerraTec NOXON DAB Stick) [ 1686.687758][ T5930] usb 3-1: media controller created [ 1686.691933][ T5908] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 1686.729127][ T5908] usb 2-1: device descriptor read/8, error -71 [ 1686.816591][ T5930] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1686.854640][ T5908] usb usb2-port1: unable to enumerate USB device [ 1686.952762][ T5930] i2c i2c-2: Added multiplexed i2c bus 3 [ 1686.972077][ T5930] rtl2832 2-0010: Realtek RTL2832 successfully attached [ 1686.984034][ T5930] usb 3-1: DVB: registering adapter 2 frontend 0 (Realtek RTL2832 (DVB-T))... [ 1686.995379][ T5930] dvbdev: dvb_create_media_entity: media entity 'Realtek RTL2832 (DVB-T)' registered. [ 1687.128619][ T9] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 1687.433186][T25902] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.443044][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 1687.446503][ T9] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 1687.460772][ T9] usb 5-1: config 0 has no interface number 0 [ 1687.467045][ T9] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1687.482626][ T5930] usb 3-1: USB disconnect, device number 37 [ 1687.496364][ T9] usb 5-1: config 0 interface 85 has no altsetting 0 [ 1687.518948][ T9] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1687.564372][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1687.593517][ T9] usb 5-1: Product: syz [ 1687.597887][ T9] usb 5-1: Manufacturer: syz [ 1687.643426][ T9] usb 5-1: SerialNumber: syz [ 1687.664555][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 1687.664578][ T30] audit: type=1326 audit(1749694978.044:3098): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25911 comm="syz.7.5883" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1687.730946][ T9] usb 5-1: config 0 descriptor?? [ 1687.832832][ T30] audit: type=1326 audit(1749694978.054:3099): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25911 comm="syz.7.5883" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1687.863107][ T30] audit: type=1326 audit(1749694978.054:3100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25911 comm="syz.7.5883" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1687.892134][ T30] audit: type=1326 audit(1749694978.054:3101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25911 comm="syz.7.5883" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1687.957658][ T30] audit: type=1326 audit(1749694978.054:3102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25911 comm="syz.7.5883" exe="/root/syz-executor" sig=0 arch=c000003e syscall=269 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1688.112965][ T30] audit: type=1326 audit(1749694978.054:3103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25911 comm="syz.7.5883" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1688.182443][ T9] appletouch 5-1:0.85: Geyser mode initialized. [ 1688.184800][ T30] audit: type=1326 audit(1749694978.054:3104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25911 comm="syz.7.5883" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1688.191522][ T9] input: appletouch as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.85/input/input276 [ 1688.220598][ T30] audit: type=1326 audit(1749694978.054:3105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25911 comm="syz.7.5883" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1688.261576][ T30] audit: type=1326 audit(1749694978.054:3106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25911 comm="syz.7.5883" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1688.323678][ T30] audit: type=1326 audit(1749694978.054:3107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25911 comm="syz.7.5883" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1688.949445][ T9] usb 5-1: USB disconnect, device number 118 [ 1688.955569][ C0] appletouch 5-1:0.85: atp_complete: usb_submit_urb failed with result -19 [ 1689.176250][ T9] appletouch 5-1:0.85: input: appletouch disconnected [ 1689.426322][ T5908] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 1689.546721][T25938] FAULT_INJECTION: forcing a failure. [ 1689.546721][T25938] name failslab, interval 1, probability 0, space 0, times 0 [ 1689.583947][T25938] CPU: 0 UID: 0 PID: 25938 Comm: syz.4.5892 Not tainted 6.16.0-rc1-syzkaller-00005-g488ef3560196 #0 PREEMPT(full) [ 1689.583979][T25938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1689.583992][T25938] Call Trace: [ 1689.584001][T25938] [ 1689.584010][T25938] dump_stack_lvl+0x189/0x250 [ 1689.584047][T25938] ? __pfx____ratelimit+0x10/0x10 [ 1689.584077][T25938] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1689.584108][T25938] ? __pfx__printk+0x10/0x10 [ 1689.584147][T25938] should_fail_ex+0x414/0x560 [ 1689.584180][T25938] should_failslab+0xa8/0x100 [ 1689.584205][T25938] __kmalloc_cache_noprof+0x70/0x3d0 [ 1689.584225][T25938] ? sctp_add_bind_addr+0x8c/0x370 [ 1689.584250][T25938] sctp_add_bind_addr+0x8c/0x370 [ 1689.584277][T25938] sctp_copy_local_addr_list+0x30b/0x4e0 [ 1689.584303][T25938] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 1689.584325][T25938] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1689.584349][T25938] ? sctp_v6_is_any+0x64/0x80 [ 1689.584375][T25938] ? sctp_copy_one_addr+0x93/0x360 [ 1689.584400][T25938] sctp_bind_addr_copy+0xb3/0x3c0 [ 1689.584423][T25938] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1689.584458][T25938] sctp_connect_new_asoc+0x2e0/0x690 [ 1689.584488][T25938] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1689.584531][T25938] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1689.584570][T25938] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1689.584597][T25938] ? security_sctp_bind_connect+0x7e/0x2e0 [ 1689.584623][T25938] sctp_sendmsg+0x155c/0x2810 [ 1689.584661][T25938] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1689.584688][T25938] ? aa_sk_perm+0x81e/0x950 [ 1689.584717][T25938] ? __pfx_aa_sk_perm+0x10/0x10 [ 1689.584743][T25938] ? sock_rps_record_flow+0x19/0x410 [ 1689.584769][T25938] ? inet_sendmsg+0x2f4/0x370 [ 1689.584793][T25938] __sock_sendmsg+0x19c/0x270 [ 1689.584829][T25938] __sys_sendto+0x3bd/0x520 [ 1689.584856][T25938] ? __pfx___sys_sendto+0x10/0x10 [ 1689.584875][T25938] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 1689.584911][T25938] ? __fget_files+0x3a0/0x420 [ 1689.584953][T25938] ? ksys_write+0x22a/0x250 [ 1689.584975][T25938] ? __pfx_ksys_write+0x10/0x10 [ 1689.584991][T25938] ? rcu_is_watching+0x15/0xb0 [ 1689.585027][T25938] __x64_sys_sendto+0xde/0x100 [ 1689.585055][T25938] do_syscall_64+0xfa/0x3b0 [ 1689.585074][T25938] ? lockdep_hardirqs_on+0x9c/0x150 [ 1689.585103][T25938] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1689.585123][T25938] ? clear_bhb_loop+0x60/0xb0 [ 1689.585150][T25938] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1689.585170][T25938] RIP: 0033:0x7f571c78e929 [ 1689.585189][T25938] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1689.585208][T25938] RSP: 002b:00007f571d5da038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1689.585230][T25938] RAX: ffffffffffffffda RBX: 00007f571c9b5fa0 RCX: 00007f571c78e929 [ 1689.585246][T25938] RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000004 [ 1689.585259][T25938] RBP: 00007f571d5da090 R08: 0000200000000080 R09: 000000000000001c [ 1689.585273][T25938] R10: 0000000000000051 R11: 0000000000000246 R12: 0000000000000002 [ 1689.585285][T25938] R13: 0000000000000000 R14: 00007f571c9b5fa0 R15: 00007f571cadfa28 [ 1689.585320][T25938] [ 1689.901134][ C0] vkms_vblank_simulate: vblank timer overrun [ 1690.194584][ T5908] usb 3-1: Using ep0 maxpacket: 8 [ 1690.345316][ T5908] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1690.355996][ T5908] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1690.452827][ T5908] usb 3-1: Product: syz [ 1690.470594][ T5908] usb 3-1: Manufacturer: syz [ 1690.493328][ T5908] usb 3-1: SerialNumber: syz [ 1690.519556][ T5908] usb 3-1: config 0 descriptor?? [ 1690.661846][T25944] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5894'. [ 1690.742112][ T5908] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1691.088253][T19203] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 1691.250571][T19203] usb 2-1: config 0 has an invalid interface number: 117 but max is 0 [ 1691.250595][T19203] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1691.250607][T19203] usb 2-1: config 0 has no interface number 0 [ 1691.250648][T19203] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1691.250673][T19203] usb 2-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1691.252975][T19203] usb 2-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1691.252998][T19203] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1691.253019][T19203] usb 2-1: Product: syz [ 1691.253036][T19203] usb 2-1: Manufacturer: syz [ 1691.253053][T19203] usb 2-1: SerialNumber: syz [ 1691.255968][T19203] usb 2-1: config 0 descriptor?? [ 1691.766614][ T5908] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 1691.898253][T10424] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 1691.967198][ T5908] usb 2-1: USB disconnect, device number 83 [ 1692.098296][T10424] usb 5-1: device descriptor read/64, error -71 [ 1692.338240][T10424] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 1692.468275][T10424] usb 5-1: device descriptor read/64, error -71 [ 1692.583802][T10424] usb usb5-port1: attempt power cycle [ 1692.651758][T25967] fuse: Unknown parameter 'groUp_id' [ 1692.938393][T10424] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 1692.958780][T10424] usb 5-1: device descriptor read/8, error -71 [ 1693.199263][T10424] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 1693.239182][T10424] usb 5-1: device descriptor read/8, error -71 [ 1693.359322][T10424] usb usb5-port1: unable to enumerate USB device [ 1693.518516][T10424] usb 3-1: USB disconnect, device number 38 [ 1693.798477][T25988] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5909'. [ 1693.814472][T25988] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5909'. [ 1693.824485][T25988] netlink: 'syz.5.5909': attribute type 12 has an invalid length. [ 1693.938366][ T5908] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 1693.946036][T10424] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 1694.128804][ T5908] usb 2-1: Using ep0 maxpacket: 8 [ 1694.128979][T10424] usb 3-1: Using ep0 maxpacket: 8 [ 1694.132574][T10424] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1694.132607][T10424] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x93, changing to 0x83 [ 1694.132635][T10424] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1694.132664][T10424] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1694.139631][T10424] usb 3-1: New USB device found, idVendor=15c2, idProduct=003b, bcdDevice=66.3e [ 1694.139665][T10424] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1694.139687][T10424] usb 3-1: Product: syz [ 1694.139704][T10424] usb 3-1: Manufacturer: syz [ 1694.139721][T10424] usb 3-1: SerialNumber: syz [ 1694.142883][ T5908] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1694.142916][ T5908] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1694.142939][ T5908] usb 2-1: Product: syz [ 1694.142955][ T5908] usb 2-1: Manufacturer: syz [ 1694.142971][ T5908] usb 2-1: SerialNumber: syz [ 1694.149725][T10424] usb 3-1: config 0 descriptor?? [ 1694.151236][ T5908] usb 2-1: config 0 descriptor?? [ 1694.210670][T10424] input: iMON Panel, Knob and Mouse(15c2:003b) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input278 [ 1694.378396][ T5908] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1695.038461][ T9] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 1695.221124][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1695.267760][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1695.293810][T10424] rc_core: IR keymap rc-imon-pad not found [ 1695.312502][ T9] usb 5-1: New USB device found, idVendor=0b05, idProduct=184a, bcdDevice= 0.00 [ 1695.318257][T10424] Registered IR keymap rc-empty [ 1695.336930][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1695.339743][T10424] imon 3-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 1695.359746][ T9] usb 5-1: config 0 descriptor?? [ 1695.377316][T10424] imon 3-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1695.387021][T10424] imon:send_packet: packet tx failed (-71) [ 1695.418403][T10424] imon 3-1:0.0: remote input dev register failed [ 1695.426794][T10424] imon 3-1:0.0: imon_init_intf0: rc device setup failed [ 1695.457949][T10424] imon 3-1:0.0: unable to initialize intf0, err 0 [ 1695.464646][T10424] imon:imon_probe: failed to initialize context! [ 1695.471356][T10424] imon 3-1:0.0: unable to register, err -19 [ 1695.483072][T10424] usb 3-1: USB disconnect, device number 39 [ 1696.118081][ T9] usbhid 5-1:0.0: can't add hid device: -71 [ 1696.127994][ T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1696.147057][ T9] usb 5-1: USB disconnect, device number 123 [ 1696.173775][T26017] 8021q: VLANs not supported on vxcan1 [ 1696.401712][T26026] netlink: 788 bytes leftover after parsing attributes in process `syz.2.5920'. [ 1696.503617][T26028] netlink: 368 bytes leftover after parsing attributes in process `syz.2.5921'. [ 1696.513203][T26028] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5921'. [ 1697.001525][ T9] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 1697.160288][ T9] usb 5-1: config 0 has no interfaces? [ 1697.168278][ T9] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1697.179333][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1697.201915][ T9] usb 5-1: Product: syz [ 1697.207855][ T9] usb 5-1: Manufacturer: syz [ 1697.220168][ T9] usb 5-1: SerialNumber: syz [ 1697.234494][ T9] usb 5-1: config 0 descriptor?? [ 1697.327765][ T5908] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1697.347239][ T5908] usb 2-1: USB disconnect, device number 84 [ 1697.590867][T26029] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1697.748005][T26033] all: renamed from lo [ 1697.791951][T26033] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1697.801960][T26033] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1697.921678][T10424] usb 5-1: USB disconnect, device number 124 [ 1698.024317][T26039] netlink: 60 bytes leftover after parsing attributes in process `syz.1.5924'. [ 1698.063948][T26039] netlink: 35 bytes leftover after parsing attributes in process `syz.1.5924'. [ 1698.345606][T26049] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5927'. [ 1698.398093][T26049] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1698.427841][T26051] dummy0: entered promiscuous mode [ 1698.433483][T26051] vlan5: entered promiscuous mode [ 1698.587997][T26056] hsr0: entered promiscuous mode [ 1699.718826][ T5908] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 1699.919151][ T5908] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 1699.940571][ T5908] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1699.972439][ T5908] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 201, changing to 11 [ 1700.345585][ T5908] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 254 [ 1700.458595][T10424] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 1700.470387][ T5908] usb 2-1: New USB device found, idVendor=1b1c, idProduct=1c0c, bcdDevice= 0.00 [ 1700.497861][ T5908] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1700.557504][ T5908] usb 2-1: config 0 descriptor?? [ 1700.649870][T10424] usb 3-1: config 0 has no interfaces? [ 1700.660124][T10424] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1700.669943][T10424] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1700.677959][T10424] usb 3-1: Product: syz [ 1700.688281][T10424] usb 3-1: Manufacturer: syz [ 1700.799217][T10424] usb 3-1: config 0 descriptor?? [ 1701.022867][ T5908] corsair-psu 0003:1B1C:1C0C.0046: unknown main item tag 0x0 [ 1701.041926][T10424] usb 3-1: USB disconnect, device number 40 [ 1701.093678][ T5908] corsair-psu 0003:1B1C:1C0C.0046: unknown main item tag 0x0 [ 1701.108266][ T5908] corsair-psu 0003:1B1C:1C0C.0046: unknown main item tag 0x0 [ 1701.128929][ T5908] corsair-psu 0003:1B1C:1C0C.0046: hidraw0: USB HID v0.00 Device [HID 1b1c:1c0c] on usb-dummy_hcd.1-1/input0 [ 1701.257945][ T5908] corsair-psu 0003:1B1C:1C0C.0046: unable to initialize device (-71) [ 1701.302137][ T5908] corsair-psu 0003:1B1C:1C0C.0046: probe with driver corsair-psu failed with error -71 [ 1701.352884][ T5908] usb 2-1: USB disconnect, device number 85 [ 1701.478688][T19203] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 1701.628701][T19203] usb 5-1: device descriptor read/64, error -71 [ 1701.757845][T26125] macvtap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1701.782921][T26125] macvtap1: entered allmulticast mode [ 1701.806355][T26129] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5942'. [ 1701.812065][T26125] batadv0: entered allmulticast mode [ 1701.832226][T26125] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 1701.908810][T19203] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 1701.967086][T26135] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5946'. [ 1702.069190][T19203] usb 5-1: device descriptor read/64, error -71 [ 1702.195553][T26141] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1702.214915][T19203] usb usb5-port1: attempt power cycle [ 1702.593121][T19203] usb 5-1: new high-speed USB device number 127 using dummy_hcd [ 1702.658458][T19203] usb 5-1: device descriptor read/8, error -71 [ 1702.730323][T26163] veth1_macvtap: left promiscuous mode [ 1702.735946][T26163] macsec0: entered allmulticast mode [ 1702.748649][T26163] veth1_macvtap: entered promiscuous mode [ 1702.754443][T26163] veth1_macvtap: entered allmulticast mode [ 1702.760435][T26163] macsec0: left allmulticast mode [ 1702.765521][T26163] veth1_macvtap: left allmulticast mode [ 1702.919581][T19203] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 1702.952863][T19203] usb 5-1: device descriptor read/8, error -71 [ 1703.078906][T19203] usb usb5-port1: unable to enumerate USB device [ 1703.381018][T26179] netlink: 17 bytes leftover after parsing attributes in process `syz.1.5954'. [ 1704.352539][T26193] netlink: 72 bytes leftover after parsing attributes in process `syz.5.5957'. [ 1704.568963][T26197] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5958'. [ 1705.258479][T10424] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 1705.283065][T26205] _ÐZ`Ô€@: entered promiscuous mode [ 1705.310149][T26207] netlink: 'syz.7.5962': attribute type 1 has an invalid length. [ 1705.419614][T10424] usb 3-1: Using ep0 maxpacket: 32 [ 1705.449286][T10424] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1705.481250][T10424] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1705.549858][T10424] usb 3-1: config 0 descriptor?? [ 1705.815531][T10424] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1705.839388][T10424] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1705.884911][T10424] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1705.911301][T10424] usb 3-1: media controller created [ 1705.995153][T10424] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1706.019759][T26203] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5960'. [ 1706.163555][T10424] az6027: usb out operation failed. (-71) [ 1706.195517][T10424] az6027: usb out operation failed. (-71) [ 1706.212291][T10424] stb0899_attach: Driver disabled by Kconfig [ 1706.234791][T10424] az6027: no front-end attached [ 1706.234791][T10424] [ 1706.253295][T10424] az6027: usb out operation failed. (-71) [ 1706.270728][T10424] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1706.297333][T10424] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input280 [ 1706.363150][T10424] dvb-usb: schedule remote query interval to 400 msecs. [ 1706.393578][T10424] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1706.444777][T10424] usb 3-1: USB disconnect, device number 41 [ 1706.659405][T10424] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1706.770806][T26216] vlan3: entered allmulticast mode [ 1706.793024][T26216] vlan1: entered allmulticast mode [ 1706.819403][T26216] veth0_vlan: entered allmulticast mode [ 1707.691816][T26237] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1707.798662][T19203] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 1707.978246][T19203] usb 5-1: Using ep0 maxpacket: 16 [ 1708.312647][T10424] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 1708.488225][T10424] usb 3-1: Using ep0 maxpacket: 16 [ 1708.563066][T10424] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1708.582964][T10424] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1708.623452][T10424] usb 3-1: Product: syz [ 1708.627682][T10424] usb 3-1: Manufacturer: syz [ 1708.651295][T10424] usb 3-1: SerialNumber: syz [ 1708.677727][T10424] usb 3-1: config 0 descriptor?? [ 1709.177368][T10424] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1709.253192][T10424] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1709.311433][T10424] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1709.391235][T10424] usb 3-1: media controller created [ 1709.566549][T10424] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1710.104294][T19203] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1710.131270][T19203] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1710.146563][T19203] usb 5-1: can't read configurations, error -71 [ 1710.158652][T10424] zl10353_read_register: readreg error (reg=127, ret==0) [ 1710.166269][T10424] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1710.175873][T10424] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1710.286819][T26261] program syz.4.5981 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1711.119704][ T5157] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1711.129213][ T5157] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1711.173170][ T5157] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1711.188580][ T5157] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1711.199902][ T5157] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1711.269579][T19203] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 1711.473084][T19203] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1711.563182][T19203] usb 5-1: New USB device found, idVendor=05a4, idProduct=8003, bcdDevice= 0.00 [ 1711.626716][T19203] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1711.705757][T19203] usb 5-1: config 0 descriptor?? [ 1711.953411][T26270] FAULT_INJECTION: forcing a failure. [ 1711.953411][T26270] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1711.980120][T26270] CPU: 1 UID: 0 PID: 26270 Comm: syz.5.5983 Not tainted 6.16.0-rc1-syzkaller-00005-g488ef3560196 #0 PREEMPT(full) [ 1711.980152][T26270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1711.980165][T26270] Call Trace: [ 1711.980173][T26270] [ 1711.980182][T26270] dump_stack_lvl+0x189/0x250 [ 1711.980218][T26270] ? __pfx____ratelimit+0x10/0x10 [ 1711.980248][T26270] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1711.980277][T26270] ? __pfx__printk+0x10/0x10 [ 1711.980301][T26270] ? __might_fault+0xb0/0x130 [ 1711.980332][T26270] should_fail_ex+0x414/0x560 [ 1711.980364][T26270] _copy_from_iter+0x575/0x16f0 [ 1711.980409][T26270] ? __pfx__copy_from_iter+0x10/0x10 [ 1711.980441][T26270] ? __build_skb_around+0x257/0x3e0 [ 1711.980468][T26270] ? netlink_sendmsg+0x642/0xb30 [ 1711.980491][T26270] ? skb_put+0x11b/0x210 [ 1711.980519][T26270] netlink_sendmsg+0x6b2/0xb30 [ 1711.980554][T26270] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1711.980584][T26270] ? aa_sock_msg_perm+0x94/0x160 [ 1711.980610][T26270] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1711.980636][T26270] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1711.980662][T26270] __sock_sendmsg+0x219/0x270 [ 1711.980698][T26270] ____sys_sendmsg+0x505/0x830 [ 1711.980730][T26270] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1711.980766][T26270] ? import_iovec+0x74/0xa0 [ 1711.980792][T26270] ___sys_sendmsg+0x21f/0x2a0 [ 1711.980821][T26270] ? __pfx____sys_sendmsg+0x10/0x10 [ 1711.980892][T26270] ? __fget_files+0x2a/0x420 [ 1711.980914][T26270] ? __fget_files+0x3a0/0x420 [ 1711.980948][T26270] __x64_sys_sendmsg+0x19b/0x260 [ 1711.980978][T26270] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1711.981023][T26270] ? __pfx_ksys_write+0x10/0x10 [ 1711.981049][T26270] ? do_syscall_64+0xbe/0x3b0 [ 1711.981074][T26270] do_syscall_64+0xfa/0x3b0 [ 1711.981091][T26270] ? lockdep_hardirqs_on+0x9c/0x150 [ 1711.981119][T26270] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1711.981140][T26270] ? clear_bhb_loop+0x60/0xb0 [ 1711.981165][T26270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1711.981184][T26270] RIP: 0033:0x7f41c578e929 [ 1711.981203][T26270] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1711.981221][T26270] RSP: 002b:00007f41c6680038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1711.981245][T26270] RAX: ffffffffffffffda RBX: 00007f41c59b5fa0 RCX: 00007f41c578e929 [ 1711.981261][T26270] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1711.981274][T26270] RBP: 00007f41c6680090 R08: 0000000000000000 R09: 0000000000000000 [ 1711.981287][T26270] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1711.981300][T26270] R13: 0000000000000000 R14: 00007f41c59b5fa0 R15: 00007f41c5adfa28 [ 1711.981331][T26270] [ 1712.299211][ T43] usb 3-1: USB disconnect, device number 42 [ 1712.334908][ T43] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1712.440274][T26277] FAULT_INJECTION: forcing a failure. [ 1712.440274][T26277] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1712.453847][T26277] CPU: 1 UID: 0 PID: 26277 Comm: syz.2.5984 Not tainted 6.16.0-rc1-syzkaller-00005-g488ef3560196 #0 PREEMPT(full) [ 1712.453875][T26277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1712.453887][T26277] Call Trace: [ 1712.453896][T26277] [ 1712.453906][T26277] dump_stack_lvl+0x189/0x250 [ 1712.453951][T26277] ? __pfx____ratelimit+0x10/0x10 [ 1712.453982][T26277] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1712.454011][T26277] ? __pfx__printk+0x10/0x10 [ 1712.454049][T26277] should_fail_ex+0x414/0x560 [ 1712.454082][T26277] _copy_to_user+0x31/0xb0 [ 1712.454106][T26277] simple_read_from_buffer+0xe1/0x170 [ 1712.454134][T26277] proc_fail_nth_read+0x1df/0x250 [ 1712.454162][T26277] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1712.454191][T26277] ? rw_verify_area+0x258/0x650 [ 1712.454220][T26277] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1712.454247][T26277] vfs_read+0x200/0x980 [ 1712.454282][T26277] ? __pfx___mutex_lock+0x10/0x10 [ 1712.454303][T26277] ? __pfx_vfs_read+0x10/0x10 [ 1712.454335][T26277] ? __fget_files+0x2a/0x420 [ 1712.454364][T26277] ? __fget_files+0x3a0/0x420 [ 1712.454384][T26277] ? __fget_files+0x2a/0x420 [ 1712.454417][T26277] ksys_read+0x145/0x250 [ 1712.454439][T26277] ? __pfx_ksys_read+0x10/0x10 [ 1712.454465][T26277] ? rcu_is_watching+0x15/0xb0 [ 1712.454502][T26277] ? do_syscall_64+0xbe/0x3b0 [ 1712.454527][T26277] do_syscall_64+0xfa/0x3b0 [ 1712.454545][T26277] ? lockdep_hardirqs_on+0x9c/0x150 [ 1712.454572][T26277] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1712.454593][T26277] ? clear_bhb_loop+0x60/0xb0 [ 1712.454619][T26277] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1712.454638][T26277] RIP: 0033:0x7fbab858d33c [ 1712.454657][T26277] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1712.454675][T26277] RSP: 002b:00007fbab94c7030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1712.454698][T26277] RAX: ffffffffffffffda RBX: 00007fbab87b5fa0 RCX: 00007fbab858d33c [ 1712.454713][T26277] RDX: 000000000000000f RSI: 00007fbab94c70a0 RDI: 0000000000000005 [ 1712.454726][T26277] RBP: 00007fbab94c7090 R08: 0000000000000000 R09: 0000000000000000 [ 1712.454739][T26277] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1712.454752][T26277] R13: 0000000000000000 R14: 00007fbab87b5fa0 R15: 00007fbab88dfa28 [ 1712.454786][T26277] [ 1712.793508][T26284] loop8: detected capacity change from 0 to 1 [ 1712.825149][T19585] Dev loop8: unable to read RDB block 1 [ 1712.837645][T26267] chnl_net:caif_netlink_parms(): no params data found [ 1712.845857][T26285] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5986'. [ 1712.906072][T19585] loop8: unable to read partition table [ 1712.935892][T19203] usbhid 5-1:0.0: can't add hid device: -71 [ 1712.944383][T19585] loop8: partition table beyond EOD, truncated [ 1712.959637][T19203] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1712.967816][T26284] Dev loop8: unable to read RDB block 1 [ 1712.981359][T26284] loop8: unable to read partition table [ 1712.987226][T26284] loop8: partition table beyond EOD, truncated [ 1713.008391][T26284] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 1713.008764][T19203] usb 5-1: USB disconnect, device number 4 [ 1713.103443][T26267] bridge0: port 1(bridge_slave_0) entered blocking state [ 1713.121455][T26267] bridge0: port 1(bridge_slave_0) entered disabled state [ 1713.134206][T26267] bridge_slave_0: entered allmulticast mode [ 1713.145443][T26267] bridge_slave_0: entered promiscuous mode [ 1713.163656][T26267] bridge0: port 2(bridge_slave_1) entered blocking state [ 1713.171142][T26267] bridge0: port 2(bridge_slave_1) entered disabled state [ 1713.178710][T26267] bridge_slave_1: entered allmulticast mode [ 1713.186956][T26267] bridge_slave_1: entered promiscuous mode [ 1713.247344][T26267] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1713.266516][T26267] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1713.278499][ T5157] Bluetooth: hci0: command tx timeout [ 1713.334397][T26267] team0: Port device team_slave_0 added [ 1713.347623][T26267] team0: Port device team_slave_1 added [ 1713.410011][T26267] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1713.417023][T26267] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1713.445306][T26267] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1713.460239][T26267] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1713.467341][T26267] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1713.518495][T26267] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1713.677220][T26267] hsr_slave_0: entered promiscuous mode [ 1713.687239][T26267] hsr_slave_1: entered promiscuous mode [ 1713.694300][T26267] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1713.702030][T26267] Cannot create hsr debugfs directory [ 1714.322454][T26300] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5991'. [ 1714.678435][T10424] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 1714.849362][T10424] usb 5-1: Using ep0 maxpacket: 32 [ 1714.896554][T10424] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 1714.925408][T10424] usb 5-1: config 0 has no interface number 0 [ 1714.954433][T10424] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1714.997546][T10424] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1715.006137][T10424] usb 5-1: Product: syz [ 1715.010611][T10424] usb 5-1: Manufacturer: syz [ 1715.036688][T10424] usb 5-1: SerialNumber: syz [ 1715.061732][T10424] usb 5-1: config 0 descriptor?? [ 1715.085090][T10424] smsc95xx v2.0.0 [ 1715.089315][T10424] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 1715.145932][T10424] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -22 [ 1715.262009][T26267] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1715.363434][ T5157] Bluetooth: hci0: command tx timeout [ 1715.522988][T26267] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1716.041657][T26301] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1716.260095][T26267] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1716.447043][ T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1716.711747][T26267] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1716.861444][ T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1716.985427][ T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1717.003795][T20287] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1717.013994][T20287] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1717.022974][T20287] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1717.031205][T20287] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1717.041282][T20287] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1717.152401][ T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1717.223289][ T5930] usb 5-1: USB disconnect, device number 5 [ 1717.331701][T26267] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1717.355142][T26339] netlink: 136 bytes leftover after parsing attributes in process `syz.4.6002'. [ 1717.365221][T26339] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 1717.394943][T26267] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1717.444328][T20287] Bluetooth: hci0: command tx timeout [ 1717.481718][T26267] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1717.506998][T26267] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1717.605930][ T13] dummy0: left allmulticast mode [ 1717.611650][ T13] bridge0: port 3(dummy0) entered disabled state [ 1717.621280][ T13] bridge_slave_1: left allmulticast mode [ 1717.626964][ T13] bridge_slave_1: left promiscuous mode [ 1717.633924][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 1717.645749][ T13] bridge_slave_0: left promiscuous mode [ 1717.651602][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 1717.750853][ T5930] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 1717.954808][ T5930] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1717.965027][ T5930] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1717.973262][ T5930] usb 5-1: Product: syz [ 1717.978428][ T5930] usb 5-1: Manufacturer: syz [ 1717.983058][ T5930] usb 5-1: SerialNumber: syz [ 1718.004849][ T5930] usb 5-1: config 0 descriptor?? [ 1718.331419][ T13] batman_adv: batadv0: Interface deactivated: macvlan2 [ 1718.342226][ T13] bond0 (unregistering): left promiscuous mode [ 1718.351531][ T13] bond_slave_0: left promiscuous mode [ 1718.357200][ T13] bond_slave_1: left promiscuous mode [ 1718.380056][ T13] batman_adv: batadv0: Removing interface: macvlan2 [ 1718.393976][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1718.406202][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1718.416972][ T13] bond0 (unregistering): Released all slaves [ 1718.452477][T26343] netlink: 'syz.4.6003': attribute type 1 has an invalid length. [ 1718.649496][ T13] bond1 (unregistering): Released all slaves [ 1718.842619][ T13] bond2 (unregistering): Released all slaves [ 1719.029636][ T13] _ÐZ`Ô€@: left promiscuous mode [ 1719.095280][ T13] _ÐZ`Ô€@: left promiscuous mode [ 1719.118470][T20287] Bluetooth: hci3: command tx timeout [ 1719.141482][ T13] : left promiscuous mode [ 1719.175107][ T5930] usb 5-1: Firmware version (0.0) predates our first public release. [ 1719.196817][ T5930] usb 5-1: Please update to version 0.2 or newer [ 1719.197711][T26267] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1719.239811][T26337] chnl_net:caif_netlink_parms(): no params data found [ 1719.311761][ T13] tipc: Left network mode [ 1719.338740][ T5930] usb 5-1: USB disconnect, device number 6 [ 1719.505792][T26267] 8021q: adding VLAN 0 to HW filter on device team0 [ 1719.518852][ T5157] Bluetooth: hci0: command tx timeout [ 1719.664914][T24261] bridge0: port 1(bridge_slave_0) entered blocking state [ 1719.672179][T24261] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1719.722297][T24261] bridge0: port 2(bridge_slave_1) entered blocking state [ 1719.729551][T24261] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1720.195795][T26380] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6007'. [ 1720.227647][T26337] bridge0: port 1(bridge_slave_0) entered blocking state [ 1720.248225][T26380] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6007'. [ 1720.257344][T26337] bridge0: port 1(bridge_slave_0) entered disabled state [ 1720.280896][T26337] bridge_slave_0: entered allmulticast mode [ 1720.302243][T26337] bridge_slave_0: entered promiscuous mode [ 1720.417325][T26337] bridge0: port 2(bridge_slave_1) entered blocking state [ 1720.430323][T26337] bridge0: port 2(bridge_slave_1) entered disabled state [ 1720.450286][T26337] bridge_slave_1: entered allmulticast mode [ 1720.469303][T26337] bridge_slave_1: entered promiscuous mode [ 1720.689339][T26337] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1720.734888][T26337] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1720.776190][ T13] hsr_slave_0: left promiscuous mode [ 1720.783929][ T13] hsr_slave_1: left promiscuous mode [ 1720.790316][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1720.798072][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1720.810266][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1720.826934][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1720.864517][ T13] batadv0: left allmulticast mode [ 1720.869828][ T13] veth1_macvtap: left promiscuous mode [ 1720.875336][ T13] veth0_macvtap: left promiscuous mode [ 1720.885831][ T13] veth1_vlan: left allmulticast mode [ 1720.891725][ T13] veth1_vlan: left promiscuous mode [ 1720.898572][ T13] veth0_vlan: left promiscuous mode [ 1721.205081][T20287] Bluetooth: hci3: command tx timeout [ 1721.372795][ T13] pim6reg (unregistering): left allmulticast mode [ 1722.086047][ T13] team_slave_1 (unregistering): left promiscuous mode [ 1722.104665][ T13] team0 (unregistering): Port device team_slave_1 removed [ 1722.160367][ T13] team_slave_0 (unregistering): left promiscuous mode [ 1722.175215][ T13] team0 (unregistering): Port device team_slave_0 removed [ 1722.767286][T26267] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1722.863803][T26400] kthread_run failed with err -4 [ 1722.876064][T26405] netdevsim netdevsim5: Direct firmware load for /.€ failed with error -2 [ 1722.899037][T26405] netdevsim netdevsim5: Falling back to sysfs fallback for: /.€ [ 1722.954032][T26337] team0: Port device team_slave_0 added [ 1722.994102][T26337] team0: Port device team_slave_1 added [ 1723.252062][T26337] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1723.289090][T20287] Bluetooth: hci3: command tx timeout [ 1723.298591][T26337] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1723.336856][ T5908] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 1723.392899][T26337] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1723.442056][T26337] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1723.453167][T26418] IPVS: sync thread started: state = MASTER, mcast_ifn = ip6tnl0, syncid = 3, id = 0 [ 1723.520380][T26337] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1723.569958][ T5908] usb 5-1: not running at top speed; connect to a high speed hub [ 1723.585675][ T5908] usb 5-1: config 95 has an invalid interface number: 1 but max is 0 [ 1723.597639][ T5908] usb 5-1: config 95 has no interface number 0 [ 1723.602095][T26337] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1723.622681][ T5908] usb 5-1: config 95 interface 1 has no altsetting 0 [ 1723.656124][ T5908] usb 5-1: New USB device found, idVendor=0763, idProduct=2030, bcdDevice=79.79 [ 1723.671181][ T5908] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1723.686588][ T5908] usb 5-1: Product: syz [ 1723.691772][ T5908] usb 5-1: Manufacturer: syz [ 1723.696583][ T5908] usb 5-1: SerialNumber: syz [ 1723.989593][T26337] hsr_slave_0: entered promiscuous mode [ 1723.997702][T26337] hsr_slave_1: entered promiscuous mode [ 1724.031103][T26267] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1724.490871][ T5908] usb 5-1: USB disconnect, device number 7 [ 1724.527805][T26431] netlink: 28 bytes leftover after parsing attributes in process `syz.7.6016'. [ 1724.706385][T19585] udevd[19585]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:95.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1724.851043][T26267] veth0_vlan: entered promiscuous mode [ 1725.087192][T26267] veth1_vlan: entered promiscuous mode [ 1725.307284][T26267] veth0_macvtap: entered promiscuous mode [ 1725.350283][T26267] veth1_macvtap: entered promiscuous mode [ 1725.358571][T20287] Bluetooth: hci3: command tx timeout [ 1725.421719][T26337] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1725.447006][T26337] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1725.493375][T26267] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1725.503256][T26337] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1725.520196][T26337] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1725.597952][T26267] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1725.645315][T26267] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1725.656399][T26267] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1725.670031][T26267] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1725.680486][T26267] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1726.026155][T26337] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1726.047599][T26337] 8021q: adding VLAN 0 to HW filter on device team0 [ 1726.157315][T12337] bridge0: port 1(bridge_slave_0) entered blocking state [ 1726.164507][T12337] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1726.397817][T12337] bridge0: port 2(bridge_slave_1) entered blocking state [ 1726.405197][T12337] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1726.540749][T12337] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1726.575266][T12337] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1726.714682][T12337] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1726.780322][T12337] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1726.952198][T26337] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1727.167392][T26337] veth0_vlan: entered promiscuous mode [ 1727.220300][T26337] veth1_vlan: entered promiscuous mode [ 1727.443315][T26337] veth0_macvtap: entered promiscuous mode [ 1727.467659][T26337] veth1_macvtap: entered promiscuous mode [ 1727.504357][T26486] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6026'. [ 1727.532641][T26337] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1727.704683][T26337] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1727.752095][T26491] futex_wake_op: syz.7.6029 tries to shift op by -1; fix this program [ 1727.770735][T26337] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1727.815266][T26337] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1727.832334][T26337] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1727.845704][T26337] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1728.069099][T19203] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 1728.246678][T19203] usb 2-1: config 0 has an invalid interface number: 117 but max is 0 [ 1728.273629][T24263] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1728.293320][T19203] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1728.318699][T24263] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1728.335344][T19203] usb 2-1: config 0 has no interface number 0 [ 1728.375725][T19203] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1728.418717][T19203] usb 2-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1728.473569][T12337] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1728.493981][T19203] usb 2-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1728.508871][T12337] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1728.516327][T19203] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1728.551498][T19203] usb 2-1: Product: syz [ 1728.581477][T19203] usb 2-1: Manufacturer: syz [ 1728.605895][T19203] usb 2-1: SerialNumber: syz [ 1728.629706][T19203] usb 2-1: config 0 descriptor?? [ 1728.869213][T26493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1728.918673][T26493] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1729.249479][T26514] netlink: 56 bytes leftover after parsing attributes in process `syz.8.5996'. [ 1729.528267][ T5942] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 1729.921405][ T5942] usb 9-1: config 0 has no interfaces? [ 1730.029220][ T5942] usb 9-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1730.048623][ T5942] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1730.056715][ T5942] usb 9-1: Product: syz [ 1730.116878][T19203] usbtouchscreen 2-1:0.117: probe with driver usbtouchscreen failed with error -71 [ 1730.136829][ T5942] usb 9-1: Manufacturer: syz [ 1730.167501][ T5942] usb 9-1: SerialNumber: syz [ 1730.189329][T19203] usb 2-1: USB disconnect, device number 86 [ 1730.279687][ T5942] usb 9-1: config 0 descriptor?? [ 1730.462074][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 1730.469742][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1731.175258][ T5157] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1731.189171][ T5157] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1731.204361][ T5157] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1731.228231][ T5157] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1731.239788][ T5157] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1731.506895][T26514] : entered promiscuous mode [ 1732.458341][T20676] usb 2-1: new full-speed USB device number 87 using dummy_hcd [ 1732.712374][T20676] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1732.724025][T20676] usb 2-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.00 [ 1733.001201][T20676] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1733.042193][T20676] usb 2-1: config 0 descriptor?? [ 1733.265258][T26530] chnl_net:caif_netlink_parms(): no params data found [ 1733.278525][T20287] Bluetooth: hci4: command tx timeout [ 1733.462480][ T43] usb 9-1: USB disconnect, device number 2 [ 1733.515133][T20676] usbhid 2-1:0.0: can't add hid device: -71 [ 1733.521736][T20676] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1733.541485][T20676] usb 2-1: USB disconnect, device number 87 [ 1733.681470][T26530] bridge0: port 1(bridge_slave_0) entered blocking state [ 1733.707778][T26530] bridge0: port 1(bridge_slave_0) entered disabled state [ 1733.721016][T26530] bridge_slave_0: entered allmulticast mode [ 1733.736482][T26530] bridge_slave_0: entered promiscuous mode [ 1733.767705][T26530] bridge0: port 2(bridge_slave_1) entered blocking state [ 1733.814523][T26530] bridge0: port 2(bridge_slave_1) entered disabled state [ 1733.864400][T26530] bridge_slave_1: entered allmulticast mode [ 1733.892896][T26530] bridge_slave_1: entered promiscuous mode [ 1734.118073][T26530] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1734.188897][T26530] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1734.272965][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 1734.272979][ T30] audit: type=1326 audit(1749695024.684:3114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26570 comm="syz.8.6043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3c4338e929 code=0x7ffc0000 [ 1734.568998][ T30] audit: type=1326 audit(1749695024.684:3115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26570 comm="syz.8.6043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3c4338e929 code=0x7ffc0000 [ 1734.797235][ T30] audit: type=1326 audit(1749695024.684:3116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26570 comm="syz.8.6043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f3c4332ab19 code=0x7ffc0000 [ 1734.822111][T26530] team0: Port device team_slave_0 added [ 1734.846456][T26530] team0: Port device team_slave_1 added [ 1734.946576][ T30] audit: type=1326 audit(1749695024.684:3117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26570 comm="syz.8.6043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3c4338e929 code=0x7ffc0000 [ 1735.011884][ T30] audit: type=1326 audit(1749695024.684:3118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26570 comm="syz.8.6043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3c4338e929 code=0x7ffc0000 [ 1735.097008][ T30] audit: type=1326 audit(1749695024.684:3119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26570 comm="syz.8.6043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f3c4332ab19 code=0x7ffc0000 [ 1735.120270][ T43] usb 2-1: new full-speed USB device number 88 using dummy_hcd [ 1735.184720][T26530] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1735.194434][T26530] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1735.221155][ T30] audit: type=1326 audit(1749695024.684:3120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26570 comm="syz.8.6043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3c4338e929 code=0x7ffc0000 [ 1735.275160][T26530] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1735.291207][ T30] audit: type=1326 audit(1749695024.804:3121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26570 comm="syz.8.6043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f3c4332ab19 code=0x7ffc0000 [ 1735.336630][ T43] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1735.358375][T20287] Bluetooth: hci4: command tx timeout [ 1735.358485][ T43] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1735.375804][T26530] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1735.391436][T26530] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1735.421505][ T30] audit: type=1326 audit(1749695024.804:3122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26570 comm="syz.8.6043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f3c4332ab19 code=0x7ffc0000 [ 1735.481913][ T43] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1735.493706][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1735.505039][ T30] audit: type=1326 audit(1749695024.804:3123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26570 comm="syz.8.6043" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f3c4338e929 code=0x7ffc0000 [ 1735.534579][T26530] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1735.545567][ T43] usb 2-1: Product: syz [ 1735.555630][ T43] usb 2-1: Manufacturer: syz [ 1735.565799][ T43] usb 2-1: SerialNumber: syz [ 1735.823775][ T43] usb 2-1: cannot find UAC_HEADER [ 1735.918057][T26530] hsr_slave_0: entered promiscuous mode [ 1735.928613][ T43] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1735.932365][T26530] hsr_slave_1: entered promiscuous mode [ 1735.966268][ T43] usb 2-1: USB disconnect, device number 88 [ 1736.121351][T26530] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1736.238633][T26530] Cannot create hsr debugfs directory [ 1736.246578][T19585] udevd[19585]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1736.718374][ T43] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 1736.892707][ T43] usb 2-1: config 0 has an invalid interface number: 48 but max is 0 [ 1736.916226][ T43] usb 2-1: config 0 has no interface number 0 [ 1736.934264][ T43] usb 2-1: too many endpoints for config 0 interface 48 altsetting 120: 102, using maximum allowed: 30 [ 1736.934706][T26530] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1736.965755][T26530] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1736.980799][ T43] usb 2-1: config 0 interface 48 altsetting 120 has 0 endpoint descriptors, different from the interface descriptor's value: 102 [ 1737.014052][ T43] usb 2-1: config 0 interface 48 has no altsetting 0 [ 1737.031567][ T43] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1737.078180][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1737.119512][ T43] usb 2-1: config 0 descriptor?? [ 1737.226673][T26530] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1737.282861][T26530] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1737.443234][T20287] Bluetooth: hci4: command tx timeout [ 1737.488472][ T43] usb 2-1: string descriptor 0 read error: -71 [ 1737.897838][ T43] cp210x 2-1:0.48: cp210x converter detected [ 1737.916306][T26530] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1737.933978][ T43] cp210x 2-1:0.48: failed to get vendor val 0x370b size 1: -71 [ 1737.948723][T26530] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1738.352921][ T43] cp210x 2-1:0.48: querying part number failed [ 1738.419843][ T43] usb 2-1: cp210x converter now attached to ttyUSB0 [ 1738.488704][ T43] usb 2-1: USB disconnect, device number 89 [ 1738.547011][ T43] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1738.599759][ T43] cp210x 2-1:0.48: device disconnected [ 1738.746391][T26640] netlink: 8 bytes leftover after parsing attributes in process `syz.7.6058'. [ 1739.489270][T26530] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1739.518791][T20287] Bluetooth: hci4: command tx timeout [ 1739.527412][T26530] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1739.575951][T26530] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1739.607087][T26530] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1739.788444][ T43] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 1739.909571][T26530] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1739.960777][ T43] usb 9-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 1739.968757][T26530] 8021q: adding VLAN 0 to HW filter on device team0 [ 1739.990288][ T43] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1740.024389][T24261] bridge0: port 1(bridge_slave_0) entered blocking state [ 1740.031654][T24261] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1740.040998][ T43] usb 9-1: Product: syz [ 1740.045245][ T43] usb 9-1: Manufacturer: syz [ 1740.065306][ T43] usb 9-1: SerialNumber: syz [ 1740.087253][T24261] bridge0: port 2(bridge_slave_1) entered blocking state [ 1740.094552][T24261] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1740.119275][ T43] r8152-cfgselector 9-1: Unknown version 0x0000 [ 1740.125652][ T43] r8152-cfgselector 9-1: config 0 descriptor?? [ 1740.281432][ T5930] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 1740.412185][T26530] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1740.438356][ T5930] usb 2-1: Using ep0 maxpacket: 8 [ 1740.464044][ T5930] usb 2-1: New USB device found, idVendor=07ca, idProduct=b800, bcdDevice=31.1f [ 1740.479716][ T5930] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1740.487982][ T5930] usb 2-1: Product: syz [ 1740.494822][ T5930] usb 2-1: Manufacturer: syz [ 1740.502526][ T5930] usb 2-1: SerialNumber: syz [ 1740.531199][T26530] veth0_vlan: entered promiscuous mode [ 1740.531458][ T5930] usb 2-1: config 0 descriptor?? [ 1740.554722][ T5930] (null): radio-mr800 - initialization failed [ 1740.568981][ T5930] radio-mr800 2-1:0.0: probe with driver radio-mr800 failed with error -22 [ 1740.577087][T26530] veth1_vlan: entered promiscuous mode [ 1740.588299][ T5930] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 1740.601086][T20676] r8152-cfgselector 9-1: USB disconnect, device number 3 [ 1740.652398][T15462] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 1740.703234][T15462] dvb_usb_az6027 6-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 1740.736009][T26530] veth0_macvtap: entered promiscuous mode [ 1740.745106][T15462] usb 6-1: USB disconnect, device number 56 [ 1740.765685][T26530] veth1_macvtap: entered promiscuous mode [ 1740.781717][ T43] usb 2-1: USB disconnect, device number 90 [ 1740.851821][T26530] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1740.890480][T26530] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1740.913149][T26530] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1740.934268][T26530] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1740.947601][T26530] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1740.964021][T26530] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1741.148378][T15462] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 1741.165201][T24261] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1741.183412][T24261] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1741.317476][T15462] usb 6-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 1741.321990][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1741.345232][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1741.345715][T15462] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1741.372614][T15462] usb 6-1: config 0 descriptor?? [ 1741.402499][T15462] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 1741.557063][T19203] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 1741.778251][T19203] usb 9-1: device descriptor read/64, error -71 [ 1742.018494][T19203] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 1742.168376][T19203] usb 9-1: device descriptor read/64, error -71 [ 1742.281149][T19203] usb usb9-port1: attempt power cycle [ 1742.641664][T19203] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 1742.659842][T19203] usb 9-1: device descriptor read/8, error -71 [ 1742.898361][T19203] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 1742.919704][T19203] usb 9-1: device descriptor read/8, error -71 [ 1743.028736][T19203] usb usb9-port1: unable to enumerate USB device [ 1743.039133][T15462] gspca_cpia1: usb_control_msg 01, error -110 [ 1743.039160][T15462] cpia1 6-1:0.0: only firmware version 1 is supported (got: 0) [ 1743.336391][T26745] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6082'. [ 1743.378510][T26745] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6082'. [ 1743.482380][T15462] usb 6-1: USB disconnect, device number 57 [ 1743.948242][T15462] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 1744.057533][T26775] vlan3: entered allmulticast mode [ 1744.180392][T15462] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1744.189994][T15462] usb 6-1: config 0 has no interface number 0 [ 1744.213325][T15462] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1744.308307][T15462] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1744.349220][T26778] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6091'. [ 1744.370056][T15462] usb 6-1: Product: syz [ 1744.374281][T15462] usb 6-1: Manufacturer: syz [ 1744.401013][T15462] usb 6-1: SerialNumber: syz [ 1744.441293][T15462] usb 6-1: config 0 descriptor?? [ 1744.634263][T26780] team0: Device gtp0 is of different type [ 1744.654100][T26757] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1744.862090][T26757] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1744.895637][T26757] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1744.937774][T26757] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1744.988006][T26757] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6086'. [ 1745.045148][T15462] dvb_usb_ec168 6-1:0.1: probe with driver dvb_usb_ec168 failed with error -71 [ 1745.112270][T15462] usb 6-1: USB disconnect, device number 58 [ 1745.264659][T26789] team0: Port device vlan2 added [ 1745.524628][T26794] tipc: Started in network mode [ 1745.544955][T26794] tipc: Node identity 4, cluster identity 4711 [ 1745.568288][T26794] tipc: Node number set to 4 [ 1745.658223][ T1212] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 1745.871844][ T1212] usb 9-1: Using ep0 maxpacket: 32 [ 1745.895989][ T1212] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1745.909824][ T1212] usb 9-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 1745.962835][ T1212] usb 9-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 1745.983569][ T1212] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1746.028269][ T1212] usb 9-1: Product: syz [ 1746.048290][ T1212] usb 9-1: Manufacturer: syz [ 1746.063852][ T1212] usb 9-1: SerialNumber: syz [ 1746.318735][ T1212] usb 9-1: Limiting number of CPorts to U8_MAX [ 1746.339047][ T1212] usb 9-1: Not enough endpoints found in device, aborting! [ 1746.683309][T15462] usb 9-1: USB disconnect, device number 8 [ 1746.778564][ T5930] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 1746.975948][T26833] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6105'. [ 1746.988229][ T5930] usb 5-1: Using ep0 maxpacket: 8 [ 1747.004775][ T5930] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1747.032430][ T5930] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 1747.056147][T26833] vlan3: entered promiscuous mode [ 1747.072426][ T5930] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1747.116454][ T5930] usb 5-1: config 0 descriptor?? [ 1747.140389][ T5930] gspca_main: spca501-2.14.0 probing 0000:0000 [ 1747.422544][T26840] netlink: 'syz.1.6108': attribute type 2 has an invalid length. [ 1747.448276][T26840] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6108'. [ 1747.487650][T26843] netlink: 368 bytes leftover after parsing attributes in process `syz.8.6109'. [ 1747.536879][T26843] netlink: 4 bytes leftover after parsing attributes in process `syz.8.6109'. [ 1747.639522][T26847] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1747.675000][T26848] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1747.769560][T26848] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1747.841284][ T5930] gspca_spca501: reg write: error -71 [ 1747.868238][ T5930] spca501 5-1:0.0: Reg write failed for 0x02,0xa048,0x00 [ 1747.875427][ T5930] spca501 5-1:0.0: probe with driver spca501 failed with error -22 [ 1747.920641][ T5930] usb 5-1: USB disconnect, device number 8 [ 1748.259271][T26868] ptrace attach of "./syz-executor exec"[22990] was attempted by "./syz-executor exec"[26868] [ 1750.736975][T26898] netlink: 8 bytes leftover after parsing attributes in process `syz.8.6121'. [ 1750.855170][T26903] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1751.104703][T26906] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6124'. [ 1751.241139][T26906] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 1751.338551][ T5930] usb 9-1: new full-speed USB device number 9 using dummy_hcd [ 1751.565558][T26914] program syz.7.6126 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1751.609731][ T5930] usb 9-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1751.744065][ T5930] usb 9-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1751.793325][ T5930] usb 9-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1751.878041][T26925] sctp: [Deprecated]: syz.4.6127 (pid 26925) Use of int in maxseg socket option. [ 1751.878041][T26925] Use struct sctp_assoc_value instead [ 1751.968534][ T5942] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 1751.986325][ T5930] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1752.270289][ T5930] hub 9-1:4.0: USB hub found [ 1752.347579][ T5942] usb 6-1: device descriptor read/64, error -71 [ 1752.460928][T26907] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1752.488797][T26907] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1752.499714][ T5930] hub 9-1:4.0: 13 ports detected [ 1752.504734][ T5930] usb 9-1: selecting invalid altsetting 1 [ 1752.510828][T26917] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1752.536300][ T5930] hub 9-1:4.0: Using single TT (err -22) [ 1752.544669][T26929] program syz.1.6128 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1752.577139][ T5930] hub 9-1:4.0: insufficient power available to use all downstream ports [ 1752.645164][ T5942] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 1752.711928][ T5930] hub 9-1:4.0: hub_hub_status failed (err = -71) [ 1752.782500][ T5930] hub 9-1:4.0: config failed, can't get hub status (err -71) [ 1752.874645][ T5942] usb 6-1: device descriptor read/64, error -71 [ 1753.110708][ T5930] usb 9-1: USB disconnect, device number 9 [ 1753.209633][ T5942] usb usb6-port1: attempt power cycle [ 1753.566261][ T5942] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 1753.629309][ T5942] usb 6-1: device descriptor read/8, error -71 [ 1753.834995][T26946] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1753.849180][T26946] batadv_slave_1: entered promiscuous mode [ 1753.868429][ T5942] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 1753.876217][ T30] kauditd_printk_skb: 902 callbacks suppressed [ 1753.876231][ T30] audit: type=1326 audit(1749695044.274:4026): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26937 comm="syz.7.6131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ffaa992ab19 code=0x7ffc0000 [ 1753.924339][ T30] audit: type=1326 audit(1749695044.274:4027): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26937 comm="syz.7.6131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1753.951962][ T5942] usb 6-1: device descriptor read/8, error -71 [ 1754.071123][ T30] audit: type=1326 audit(1749695044.274:4028): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26937 comm="syz.7.6131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ffaa992ab19 code=0x7ffc0000 [ 1754.140341][ T5942] usb usb6-port1: unable to enumerate USB device [ 1754.198345][ T1212] usb 5-1: new low-speed USB device number 9 using dummy_hcd [ 1754.286939][ T30] audit: type=1326 audit(1749695044.274:4029): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26937 comm="syz.7.6131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ffaa992ab19 code=0x7ffc0000 [ 1754.393721][ T1212] usb 5-1: config index 0 descriptor too short (expected 6427, got 27) [ 1754.403486][ T1212] usb 5-1: config 0 has an invalid interface number: 21 but max is 0 [ 1754.419985][ T30] audit: type=1326 audit(1749695044.274:4030): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26937 comm="syz.7.6131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ffaa992ab19 code=0x7ffc0000 [ 1754.496552][ T30] audit: type=1326 audit(1749695044.274:4031): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26937 comm="syz.7.6131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1754.536334][ T1212] usb 5-1: config 0 has no interface number 0 [ 1754.628693][ T30] audit: type=1326 audit(1749695044.274:4032): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26937 comm="syz.7.6131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1754.656613][ T1212] usb 5-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0x61, changing to 0x1 [ 1754.675069][ T1212] usb 5-1: config 0 interface 21 altsetting 0 endpoint 0x1 is Bulk; changing to Interrupt [ 1754.700994][ T1212] usb 5-1: config 0 interface 21 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1754.756793][ T1212] usb 5-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1754.757247][T26960] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1754.773798][ T30] audit: type=1326 audit(1749695044.274:4033): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26937 comm="syz.7.6131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ffaa992ab19 code=0x7ffc0000 [ 1754.826135][ T1212] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1754.859800][ T1212] usb 5-1: config 0 descriptor?? [ 1754.896869][ T30] audit: type=1326 audit(1749695044.274:4034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26937 comm="syz.7.6131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffaa998e929 code=0x7ffc0000 [ 1754.998311][ T30] audit: type=1326 audit(1749695044.274:4035): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26937 comm="syz.7.6131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ffaa992ab19 code=0x7ffc0000 [ 1755.090112][ T1212] usb 5-1: USB disconnect, device number 9 [ 1755.792516][T26978] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6138'. [ 1755.857746][T26987] program syz.4.6141 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1756.148220][ T1212] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 1756.457370][ T1212] usb 2-1: Using ep0 maxpacket: 32 [ 1756.528871][ T1212] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 1756.570512][ T1212] usb 2-1: config 0 has no interface number 0 [ 1756.630601][ T1212] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1756.682948][ T1212] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1756.698895][ T1212] usb 2-1: Product: syz [ 1756.703099][ T1212] usb 2-1: Manufacturer: syz [ 1756.707712][ T1212] usb 2-1: SerialNumber: syz [ 1756.715686][ T1212] usb 2-1: config 0 descriptor?? [ 1756.753576][ T1212] smsc95xx v2.0.0 [ 1756.789900][ T43] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 1756.922812][ T1212] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 1756.962178][ T1212] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -22 [ 1757.000286][ T43] usb 9-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 1757.098089][ T43] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1757.217592][ T43] usb 9-1: Product: syz [ 1757.222736][ T43] usb 9-1: Manufacturer: syz [ 1757.227392][ T43] usb 9-1: SerialNumber: syz [ 1757.313095][ T43] r8152-cfgselector 9-1: Unknown version 0x0000 [ 1757.328315][ T43] r8152-cfgselector 9-1: config 0 descriptor?? [ 1757.504764][T27016] netlink: 'syz.4.6145': attribute type 1 has an invalid length. [ 1757.805830][T27020] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6145'. [ 1759.058236][T27049] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6150'. [ 1759.068184][T27049] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6150'. [ 1759.078220][T27049] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6150'. [ 1759.117986][ T10] usb 2-1: USB disconnect, device number 91 [ 1759.464843][T27055] team_slave_0: entered promiscuous mode [ 1759.471190][T27055] team_slave_1: entered promiscuous mode [ 1759.503190][T27055] vlan3: entered promiscuous mode [ 1759.520639][T27055] team0: entered promiscuous mode [ 1759.543675][T27055] vlan2: entered promiscuous mode [ 1759.552129][ T1212] r8152-cfgselector 9-1: USB disconnect, device number 10 [ 1759.642628][T27055] [ 1759.645013][T27055] ====================================================== [ 1759.652059][T27055] WARNING: possible circular locking dependency detected [ 1759.659093][T27055] 6.16.0-rc1-syzkaller-00005-g488ef3560196 #0 Not tainted [ 1759.666202][T27055] ------------------------------------------------------ [ 1759.673221][T27055] syz.4.6151/27055 is trying to acquire lock: [ 1759.679286][T27055] ffff88801e69cd30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: dev_set_promiscuity+0x10e/0x260 [ 1759.689762][T27055] [ 1759.689762][T27055] but task is already holding lock: [ 1759.697126][T27055] ffff88802a80ce00 (team->team_lock_key#14){+.+.}-{4:4}, at: team_change_rx_flags+0x38/0x220 [ 1759.707334][T27055] [ 1759.707334][T27055] which lock already depends on the new lock. [ 1759.707334][T27055] [ 1759.717744][T27055] [ 1759.717744][T27055] the existing dependency chain (in reverse order) is: [ 1759.726766][T27055] [ 1759.726766][T27055] -> #1 (team->team_lock_key#14){+.+.}-{4:4}: [ 1759.735043][T27055] lock_acquire+0x120/0x360 [ 1759.740086][T27055] __mutex_lock+0x182/0xe80 [ 1759.745205][T27055] team_device_event+0x182/0xa20 [ 1759.750670][T27055] notifier_call_chain+0x1b3/0x3e0 [ 1759.756318][T27055] dev_close_many+0x29c/0x410 [ 1759.761526][T27055] vlan_device_event+0x1748/0x1d00 [ 1759.767169][T27055] notifier_call_chain+0x1b3/0x3e0 [ 1759.772813][T27055] __dev_notify_flags+0x18d/0x2e0 [ 1759.778374][T27055] netif_change_flags+0xe8/0x1a0 [ 1759.783861][T27055] do_setlink+0xc55/0x41c0 [ 1759.788831][T27055] rtnl_newlink+0x160b/0x1c70 [ 1759.794484][T27055] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1759.799966][T27055] netlink_rcv_skb+0x208/0x470 [ 1759.805273][T27055] netlink_unicast+0x75b/0x8d0 [ 1759.810574][T27055] netlink_sendmsg+0x805/0xb30 [ 1759.815866][T27055] __sock_sendmsg+0x219/0x270 [ 1759.821076][T27055] ____sys_sendmsg+0x505/0x830 [ 1759.826376][T27055] ___sys_sendmsg+0x21f/0x2a0 [ 1759.831601][T27055] __x64_sys_sendmsg+0x19b/0x260 [ 1759.837065][T27055] do_syscall_64+0xfa/0x3b0 [ 1759.842095][T27055] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1759.848524][T27055] [ 1759.848524][T27055] -> #0 (&dev_instance_lock_key#20){+.+.}-{4:4}: [ 1759.857063][T27055] validate_chain+0xb9b/0x2140 [ 1759.862356][T27055] __lock_acquire+0xab9/0xd20 [ 1759.867565][T27055] lock_acquire+0x120/0x360 [ 1759.872596][T27055] __mutex_lock+0x182/0xe80 [ 1759.877629][T27055] dev_set_promiscuity+0x10e/0x260 [ 1759.883268][T27055] __dev_set_promiscuity+0x534/0x740 [ 1759.889085][T27055] netif_set_promiscuity+0x50/0xe0 [ 1759.894726][T27055] dev_set_promiscuity+0x126/0x260 [ 1759.900366][T27055] team_change_rx_flags+0x123/0x220 [ 1759.906101][T27055] __dev_set_promiscuity+0x534/0x740 [ 1759.911915][T27055] netif_set_promiscuity+0x50/0xe0 [ 1759.917554][T27055] dev_set_promiscuity+0x126/0x260 [ 1759.923195][T27055] __dev_set_promiscuity+0x534/0x740 [ 1759.929007][T27055] __dev_change_flags+0x41b/0x6d0 [ 1759.934564][T27055] rtnl_newlink_create+0x555/0xb00 [ 1759.940376][T27055] rtnl_newlink+0x16d6/0x1c70 [ 1759.945584][T27055] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1759.951047][T27055] netlink_rcv_skb+0x208/0x470 [ 1759.956341][T27055] netlink_unicast+0x75b/0x8d0 [ 1759.961632][T27055] netlink_sendmsg+0x805/0xb30 [ 1759.966924][T27055] __sock_sendmsg+0x219/0x270 [ 1759.972140][T27055] ____sys_sendmsg+0x505/0x830 [ 1759.977433][T27055] ___sys_sendmsg+0x21f/0x2a0 [ 1759.982638][T27055] __x64_sys_sendmsg+0x19b/0x260 [ 1759.988110][T27055] do_syscall_64+0xfa/0x3b0 [ 1759.993144][T27055] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1759.999569][T27055] [ 1759.999569][T27055] other info that might help us debug this: [ 1759.999569][T27055] [ 1760.009804][T27055] Possible unsafe locking scenario: [ 1760.009804][T27055] [ 1760.017255][T27055] CPU0 CPU1 [ 1760.022620][T27055] ---- ---- [ 1760.027986][T27055] lock(team->team_lock_key#14); [ 1760.033032][T27055] lock(&dev_instance_lock_key#20); [ 1760.040856][T27055] lock(team->team_lock_key#14); [ 1760.048423][T27055] lock(&dev_instance_lock_key#20); [ 1760.053727][T27055] [ 1760.053727][T27055] *** DEADLOCK *** [ 1760.053727][T27055] [ 1760.061964][T27055] 3 locks held by syz.4.6151/27055: [ 1760.067163][T27055] #0: ffffffff8fa30870 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 1760.076688][T27055] #1: ffffffff8f510048 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 1760.085756][T27055] #2: ffff88802a80ce00 (team->team_lock_key#14){+.+.}-{4:4}, at: team_change_rx_flags+0x38/0x220 [ 1760.096408][T27055] [ 1760.096408][T27055] stack backtrace: [ 1760.102303][T27055] CPU: 1 UID: 0 PID: 27055 Comm: syz.4.6151 Not tainted 6.16.0-rc1-syzkaller-00005-g488ef3560196 #0 PREEMPT(full) [ 1760.102325][T27055] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1760.102335][T27055] Call Trace: [ 1760.102343][T27055] [ 1760.102349][T27055] dump_stack_lvl+0x189/0x250 [ 1760.102377][T27055] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1760.102408][T27055] ? __pfx__printk+0x10/0x10 [ 1760.102426][T27055] ? print_lock_name+0xde/0x100 [ 1760.102443][T27055] print_circular_bug+0x2ee/0x310 [ 1760.102461][T27055] check_noncircular+0x134/0x160 [ 1760.102479][T27055] validate_chain+0xb9b/0x2140 [ 1760.102495][T27055] ? __pfx___irq_work_queue_local+0x10/0x10 [ 1760.102518][T27055] ? console_unlock+0x21b/0x270 [ 1760.102533][T27055] ? __pfx_console_unlock+0x10/0x10 [ 1760.102552][T27055] __lock_acquire+0xab9/0xd20 [ 1760.102576][T27055] ? dev_set_promiscuity+0x10e/0x260 [ 1760.102595][T27055] lock_acquire+0x120/0x360 [ 1760.102615][T27055] ? dev_set_promiscuity+0x10e/0x260 [ 1760.102638][T27055] __mutex_lock+0x182/0xe80 [ 1760.102654][T27055] ? dev_set_promiscuity+0x10e/0x260 [ 1760.102674][T27055] ? __pfx__printk+0x10/0x10 [ 1760.102691][T27055] ? dev_set_promiscuity+0x10e/0x260 [ 1760.102709][T27055] ? __netdev_printk+0x365/0x4d0 [ 1760.102733][T27055] ? __pfx___mutex_lock+0x10/0x10 [ 1760.102748][T27055] ? netdev_info+0x10a/0x160 [ 1760.102768][T27055] ? __pfx_netdev_info+0x10/0x10 [ 1760.102786][T27055] ? __mutex_lock+0x330/0xe80 [ 1760.102803][T27055] dev_set_promiscuity+0x10e/0x260 [ 1760.102823][T27055] ? __pfx_vlan_dev_change_rx_flags+0x10/0x10 [ 1760.102845][T27055] __dev_set_promiscuity+0x534/0x740 [ 1760.102864][T27055] ? netdev_info+0x10a/0x160 [ 1760.102885][T27055] netif_set_promiscuity+0x50/0xe0 [ 1760.102904][T27055] dev_set_promiscuity+0x126/0x260 [ 1760.102924][T27055] team_change_rx_flags+0x123/0x220 [ 1760.102951][T27055] ? __pfx_team_change_rx_flags+0x10/0x10 [ 1760.102975][T27055] __dev_set_promiscuity+0x534/0x740 [ 1760.102996][T27055] netif_set_promiscuity+0x50/0xe0 [ 1760.103016][T27055] dev_set_promiscuity+0x126/0x260 [ 1760.103035][T27055] ? __pfx_vlan_dev_change_rx_flags+0x10/0x10 [ 1760.103056][T27055] __dev_set_promiscuity+0x534/0x740 [ 1760.103076][T27055] __dev_change_flags+0x41b/0x6d0 [ 1760.103097][T27055] ? __pfx___dev_change_flags+0x10/0x10 [ 1760.103120][T27055] rtnl_newlink_create+0x555/0xb00 [ 1760.103143][T27055] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1760.103161][T27055] ? rtnl_newlink+0x8db/0x1c70 [ 1760.103178][T27055] ? __pfx___mutex_lock+0x10/0x10 [ 1760.103195][T27055] ? ns_capable+0x8a/0xf0 [ 1760.103219][T27055] rtnl_newlink+0x16d6/0x1c70 [ 1760.103237][T27055] ? netlink_sendmsg+0x805/0xb30 [ 1760.103267][T27055] ? __pfx_rtnl_newlink+0x10/0x10 [ 1760.103291][T27055] ? kasan_quarantine_put+0xdd/0x220 [ 1760.103314][T27055] ? lockdep_hardirqs_on+0x9c/0x150 [ 1760.103340][T27055] ? nlmon_xmit+0xb0/0x100 [ 1760.103362][T27055] ? kmem_cache_free+0x18f/0x400 [ 1760.103380][T27055] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1760.103410][T27055] ? lockdep_hardirqs_on+0x9c/0x150 [ 1760.103434][T27055] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1760.103457][T27055] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1760.103482][T27055] ? __dev_queue_xmit+0x27e/0x3a70 [ 1760.103508][T27055] ? __lock_acquire+0xab9/0xd20 [ 1760.103536][T27055] ? __pfx_rtnl_newlink+0x10/0x10 [ 1760.103552][T27055] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1760.103571][T27055] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1760.103586][T27055] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1760.103602][T27055] ? ref_tracker_free+0x63a/0x7d0 [ 1760.103623][T27055] ? __copy_skb_header+0xa7/0x550 [ 1760.103644][T27055] ? __pfx_ref_tracker_free+0x10/0x10 [ 1760.103669][T27055] netlink_rcv_skb+0x208/0x470 [ 1760.103688][T27055] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1760.103705][T27055] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1760.103727][T27055] ? netlink_deliver_tap+0x2e/0x1b0 [ 1760.103745][T27055] ? netlink_deliver_tap+0x2e/0x1b0 [ 1760.103766][T27055] netlink_unicast+0x75b/0x8d0 [ 1760.103785][T27055] netlink_sendmsg+0x805/0xb30 [ 1760.103807][T27055] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1760.103827][T27055] ? aa_sock_msg_perm+0x94/0x160 [ 1760.103848][T27055] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1760.103870][T27055] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1760.103888][T27055] __sock_sendmsg+0x219/0x270 [ 1760.103914][T27055] ____sys_sendmsg+0x505/0x830 [ 1760.103936][T27055] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1760.103959][T27055] ? import_iovec+0x74/0xa0 [ 1760.103976][T27055] ___sys_sendmsg+0x21f/0x2a0 [ 1760.103997][T27055] ? __pfx____sys_sendmsg+0x10/0x10 [ 1760.104028][T27055] ? __fget_files+0x2a/0x420 [ 1760.104045][T27055] ? __fget_files+0x3a0/0x420 [ 1760.104065][T27055] __x64_sys_sendmsg+0x19b/0x260 [ 1760.104086][T27055] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1760.104110][T27055] ? rcu_is_watching+0x15/0xb0 [ 1760.104136][T27055] ? do_syscall_64+0xbe/0x3b0 [ 1760.104153][T27055] do_syscall_64+0xfa/0x3b0 [ 1760.104167][T27055] ? lockdep_hardirqs_on+0x9c/0x150 [ 1760.104190][T27055] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1760.104206][T27055] ? clear_bhb_loop+0x60/0xb0 [ 1760.104224][T27055] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1760.104239][T27055] RIP: 0033:0x7f7fd738e929 [ 1760.104254][T27055] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1760.104270][T27055] RSP: 002b:00007f7fd8250038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1760.104287][T27055] RAX: ffffffffffffffda RBX: 00007f7fd75b6080 RCX: 00007f7fd738e929 [ 1760.104300][T27055] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000011 [ 1760.104311][T27055] RBP: 00007f7fd7410b39 R08: 0000000000000000 R09: 0000000000000000 [ 1760.104322][T27055] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1760.104332][T27055] R13: 0000000000000000 R14: 00007f7fd75b6080 R15: 00007f7fd76dfa28 [ 1760.104349][T27055] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1761.525206][T12337] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1761.727946][T12337] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1761.862588][T12337] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1761.977671][T12337] vlan2 (unregistering): left promiscuous mode [ 1761.985244][T12337] team0: Port device vlan2 removed [ 1761.993527][T12337] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1762.057099][T12337] bridge_slave_1: left allmulticast mode [ 1762.067760][T12337] bridge_slave_1: left promiscuous mode [ 1762.075888][T12337] bridge0: port 2(bridge_slave_1) entered disabled state [ 1762.084494][T12337] bridge_slave_0: left allmulticast mode [ 1762.090621][T12337] bridge_slave_0: left promiscuous mode [ 1762.096265][T12337] bridge0: port 1(bridge_slave_0) entered disabled state [ 1762.183752][T12337] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1762.195250][T12337] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1762.205061][T12337] bond0 (unregistering): Released all slaves [ 1762.505783][T12337] hsr_slave_0: left promiscuous mode [ 1762.515481][T12337] hsr_slave_1: left promiscuous mode [ 1762.521849][T12337] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1762.529379][T12337] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1762.537004][T12337] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1762.547451][T12337] veth1_macvtap: left promiscuous mode [ 1762.553030][T12337] veth0_macvtap: left promiscuous mode [ 1762.561006][T12337] veth1_vlan: left promiscuous mode [ 1762.566250][T12337] veth0_vlan: left promiscuous mode [ 1762.720881][T12337] team_slave_1 (unregistering): left promiscuous mode [ 1762.728647][T12337] team0 (unregistering): Port device team_slave_1 removed [ 1762.743831][T12337] team_slave_0 (unregistering): left promiscuous mode [ 1762.751194][T12337] team0 (unregistering): Port device team_slave_0 removed [ 1763.172336][T12337] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.230436][T12337] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.265028][T12337] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.326902][T12337] vlan2 (unregistering): left promiscuous mode [ 1763.338504][T12337] netdevsim netdevsim7 netdevsim0 (unregistering): left promiscuous mode [ 1763.348041][T12337] team0: Port device vlan2 removed [ 1763.364112][T12337] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.475948][T12337] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.534006][T12337] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.582732][T12337] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.656865][T12337] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.768770][T12337] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.818071][T12337] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.877235][T12337] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1763.925324][T12337] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1764.065407][T12337] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1764.124105][T12337] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1764.186146][T12337] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1764.233994][T12337] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1764.349990][T12337] bridge_slave_1: left allmulticast mode [ 1764.355697][T12337] bridge_slave_1: left promiscuous mode [ 1764.363738][T12337] bridge0: port 2(bridge_slave_1) entered disabled state [ 1764.381405][T12337] bridge_slave_0: left promiscuous mode [ 1764.387133][T12337] bridge0: port 1(bridge_slave_0) entered disabled state [ 1764.402586][T12337] dummy0: left allmulticast mode [ 1764.407748][T12337] bridge0: port 3(dummy0) entered disabled state [ 1764.415793][T12337] bridge_slave_1: left allmulticast mode [ 1764.423932][T12337] bridge_slave_1: left promiscuous mode [ 1764.430281][T12337] bridge0: port 2(bridge_slave_1) entered disabled state [ 1764.440218][T12337] bridge_slave_0: left promiscuous mode [ 1764.445860][T12337] bridge0: port 1(bridge_slave_0) entered disabled state [ 1764.463489][T12337] bridge_slave_1: left allmulticast mode [ 1764.469312][T12337] bridge_slave_1: left promiscuous mode [ 1764.475026][T12337] bridge0: port 2(bridge_slave_1) entered disabled state [ 1764.486869][T12337] bridge_slave_0: left allmulticast mode [ 1764.495603][T12337] bridge_slave_0: left promiscuous mode [ 1764.505160][T12337] bridge0: port 1(bridge_slave_0) entered disabled state [ 1764.515179][T12337] bridge_slave_1: left allmulticast mode [ 1764.523281][T12337] bridge_slave_1: left promiscuous mode [ 1764.530759][T12337] bridge0: port 2(bridge_slave_1) entered disabled state [ 1764.541522][T12337] bridge_slave_0: left allmulticast mode [ 1764.547206][T12337] bridge_slave_0: left promiscuous mode [ 1764.553284][T12337] bridge0: port 1(bridge_slave_0) entered disabled state [ 1764.836356][T12337] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1764.846760][T12337] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1764.856529][T12337] bond0 (unregistering): Released all slaves [ 1764.927654][T12337] bond2 (unregistering): (slave erspan0): Releasing backup interface [ 1765.093837][T12337] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1765.102940][T12337] bond_slave_0: left promiscuous mode [ 1765.110132][T12337] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1765.119106][T12337] bond_slave_1: left promiscuous mode [ 1765.125227][T12337] bond0 (unregistering): Released all slaves [ 1765.270588][T12337] bond1 (unregistering): Released all slaves [ 1765.283954][T12337] bond2 (unregistering): Released all slaves [ 1765.345910][T12337] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1765.355772][T12337] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1765.366219][T12337] bond0 (unregistering): Released all slaves [ 1765.472957][T12337] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1765.483940][T12337] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1765.493351][T12337] bond0 (unregistering): Released all slaves [ 1765.595735][T12337] : left promiscuous mode [ 1765.659474][T12337] tipc: Left network mode [ 1765.680873][T12337] IPVS: stopping master sync thread 26418 ... [ 1765.714399][T12337] batman_adv: batadv0: Removing interface: wlan1 [ 1766.423428][T12337] hsr_slave_0: left promiscuous mode [ 1766.432331][T12337] hsr_slave_1: left promiscuous mode [ 1766.438274][T12337] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1766.446067][T12337] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1766.456517][T12337] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1766.464263][T12337] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1766.473934][T12337] hsr_slave_0: left promiscuous mode [ 1766.480099][T12337] hsr_slave_1: left promiscuous mode [ 1766.490798][T12337] hsr_slave_0: left promiscuous mode [ 1766.496756][T12337] hsr_slave_1: left promiscuous mode [ 1766.503000][T12337] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1766.512116][T12337] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1766.520289][T12337] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1766.527746][T12337] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1766.539017][T12337] hsr_slave_0: left promiscuous mode [ 1766.544917][T12337] hsr_slave_1: left promiscuous mode [ 1766.551171][T12337] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1766.559296][T12337] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1766.567681][T12337] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1766.575271][T12337] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1766.592408][T12337] veth1_macvtap: left promiscuous mode [ 1766.597945][T12337] veth0_macvtap: left promiscuous mode [ 1766.604636][T12337] veth1_vlan: left promiscuous mode [ 1766.609949][T12337] veth0_vlan: left promiscuous mode [ 1766.615885][T12337] veth1_macvtap: left promiscuous mode [ 1766.623539][T12337] veth0_macvtap: left promiscuous mode [ 1766.629801][T12337] veth1_macvtap: left promiscuous mode [ 1766.635301][T12337] veth0_macvtap: left promiscuous mode [ 1766.641008][T12337] veth1_vlan: left promiscuous mode [ 1766.646360][T12337] veth0_vlan: left promiscuous mode [ 1766.652559][T12337] veth1_macvtap: left promiscuous mode [ 1766.658200][T12337] veth0_macvtap: left promiscuous mode [ 1766.663755][T12337] veth1_vlan: left promiscuous mode [ 1766.669208][T12337] veth0_vlan: left promiscuous mode [ 1766.922827][T12337] team_slave_1 (unregistering): left promiscuous mode [ 1766.930233][T12337] team0 (unregistering): Port device team_slave_1 removed [ 1766.946277][T12337] team_slave_0 (unregistering): left promiscuous mode [ 1766.953851][T12337] team0 (unregistering): Port device team_slave_0 removed [ 1767.216017][T12337] team_slave_1 (unregistering): left promiscuous mode [ 1767.225940][T12337] team0 (unregistering): Port device team_slave_1 removed [ 1767.255974][T12337] team_slave_0 (unregistering): left promiscuous mode [ 1767.263549][T12337] team0 (unregistering): Port device team_slave_0 removed [ 1767.497957][T12337] team0 (unregistering): Port device team_slave_1 removed [ 1767.510613][T12337] team0 (unregistering): Port device team_slave_0 removed [ 1767.746541][T12337] team0 (unregistering): Port device team_slave_1 removed [ 1767.783051][T12337] team0 (unregistering): Port device team_slave_0 removed