last executing test programs: 8.968109124s ago: executing program 3 (id=3122): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000000)={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x56e, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x190, 0x1, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x2, 0xfe, 0x1, {0x22, 0x85}}, {{{0x9, 0x5, 0x81, 0x3, 0xdeb9f3d6bebe38e6, 0x0, 0x19}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0xffff, 0x0, @private1, 0x200000}, 0x1c) sendto$inet6(r5, &(0x7f00000001c0)='O', 0x1, 0x80, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) shutdown(r5, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x4}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7c, &(0x7f00000000c0), &(0x7f0000000180)=0x8) syz_usb_control_io(r4, &(0x7f0000000340)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="00218500000085"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000002c0)={{&(0x7f0000000000/0x3000)=nil, 0x3000}, 0x1}) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000007c0)=@acquire={0x16c, 0x17, 0x1, 0x70bd27, 0x25dfdbfe, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d4, 0xff}, @in=@private=0xa010102, {@in=@multicast2, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4e21, 0x100, 0x4e20, 0x3, 0x2, 0xe0, 0x20, 0x3b, 0x0, 0xffffffffffffffff}, {{@in=@local, @in=@broadcast, 0x4e21, 0x9, 0x4e22, 0x83, 0xa, 0x0, 0x0, 0xc}, {0x7f, 0xec2b, 0x5, 0xa, 0xd5, 0x6, 0x6, 0xb}, {0x7, 0xa0, 0x9, 0x200000000000000}, 0xba, 0x0, 0x2, 0x0, 0x0, 0x3}, 0x3, 0x1, 0x200, 0x70bd29}, [@tmpl={0x44, 0x5, [{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d2, 0x2b}, 0x19, @in6=@ipv4={'\x00', '\xff\xff', @multicast2}, 0x3506, 0x4, 0x1, 0x9, 0xab9, 0x9, 0x1}]}]}, 0x16c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r8 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4040aea0, &(0x7f0000000140)=@x86={0x3, 0x8, 0x6, 0x0, 0x0, 0x2, 0x7, 0xfe, 0x1, 0x12, 0xfe, 0x0, 0x0, 0x4, 0xa, 0x0, 0x7f, 0x8, 0xc4, '\x00', 0x4, 0x88000000000002}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000240)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000300)={r9, 0x0, 0x9, 0x0, 0x0, [0x0], [0x9, 0x0, 0x0, 0x8], [0x3, 0x0, 0x100, 0xd], [0x1000000000000, 0x0, 0xfffffffffffffffd]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000080)={r10, 0x0, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000004, 0x13, r11, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, 0x0, &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$SG_IO(r0, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x3, 0x6b, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000040)="a6b4ff", 0x0, 0xfffffffe, 0x0, 0x0, 0x0}) 7.941831654s ago: executing program 4 (id=3127): epoll_pwait2(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}, {}, {}], 0x4, &(0x7f0000000080), &(0x7f00000001c0)={[0x3ff, 0xfccd]}, 0x8) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000240)={'ip6gretap0\x00', {0x2, 0x4e24, @local}}) r2 = epoll_create1(0x80000) sendto$unix(r1, 0x0, 0x0, 0xabc12b3054869407, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000700)={0x10000000}) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x200, 0xff, 0x2}) r4 = syz_open_dev$dri(&(0x7f0000000080), 0xb, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r4, 0xb7181000) socket$pppl2tp(0x18, 0x1, 0x1) syz_open_dev$vim2m(&(0x7f0000000000), 0x20003, 0x2) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000020000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000b56275a038f5bd74dea533e7adac74ab7eb1fcfba803486c5be401b2aa044befe7220e154d23f1f49d8f1641a6a6ac4afc5eecc6de94f602139946dca6f869e3ce6dd4ca0934cbe8db5cf615596673c0b35c865f97bd10fd55bdace72a521f14dfc87c6098a4c1823a43972f5a72f5c61a331aeb5b8bf771660cfb10c23009d2c688e10000"], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x40, 0x6, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) close(0x3) r6 = socket(0x1e, 0x805, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, 0xffffffffffffffff, 0x29) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r5, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x3, &(0x7f0000000000)=[{0x3ff, 0x5, 0x1, 0x40}, {0xd, 0x8, 0xfe, 0x80000001}, {0xff, 0xbb, 0x7f, 0x5}]}) socket$inet6(0xa, 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0xf) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r8, @ANYBLOB="06001500070000000c0016800800010010"], 0x38}}, 0x10) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) r10 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000003c0), 0x8201) ioctl$SNDRV_TIMER_IOCTL_SELECT(r10, 0x40345410, &(0x7f00000083c0)={{0x3, 0x0, 0x0, 0x0, 0x4}}) 7.84762263s ago: executing program 4 (id=3128): socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000001c0), 0x4) r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) write$binfmt_misc(r0, &(0x7f0000000240), 0xfffffecc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x8) 7.074148171s ago: executing program 3 (id=3132): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000000000000060a50000000000001090224008d3d9bfcaf9813fe02014a0000d8dd46eb23cce135f75b5c9c0111ed08210000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect(0x0, 0x61, &(0x7f0000000380)={{0x12, 0x1, 0x310, 0x2c, 0x9c, 0xbb, 0x40, 0xbb4, 0xa83, 0xae99, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4f, 0x1, 0xfa, 0x35, 0xb0, 0x2, [{{0x9, 0x4, 0x78, 0x0, 0x1, 0xae, 0xb3, 0xd8, 0x5, [@cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0x400}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x4, 0x3, 0x8}, {0x6, 0x24, 0x1a, 0x91, 0x5}, [@mdlm_detail={0x4, 0x24, 0x13, 0x28}]}], [{{0x9, 0x5, 0x80, 0x3, 0x10, 0x1, 0x8, 0x81, [@generic={0x13, 0x8, "4576cec5d1b51ccdfad7b1796525899a47"}]}}]}}]}}]}}, 0x0) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=@updpolicy={0xb8, 0x19, 0x1, 0x4, 0x0, {{@in=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x3b}, {}, {}, 0x0, 0x800000}}, 0xb8}, 0x1, 0x0, 0x0, 0x800}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0xfffffe98, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="8400000000010104000000000000000002000000240001801400018008000100ac1404bb08000200ac0314bb0c0002800500010000000000240002801400018008000100ac1414aa08000200ac1414000c0002800500010000000000080007400000000010001700000000000000000000000000100016"], 0x84}}, 0x0) (async) syz_usb_control_io(0xffffffffffffffff, &(0x7f00000001c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000706000000ff"], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 6.929329427s ago: executing program 4 (id=3133): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4010) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000c80)=@filter={'filter\x00', 0x42, 0x4, 0x384, 0xffffffff, 0x0, 0xb0, 0x0, 0xffffffff, 0xffffffff, 0x358, 0x358, 0x358, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @dev, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x3127, 0x70, 0xb0, 0x1ba, {0x46010000}}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "6bc128419cfb67daad5b4809088400ed00000000000000009b0000040500"}}}, {{@uncond, 0x287, 0x128, 0x14c, 0x0, {0x0, 0x4}, [@common=@unspec=@conntrack1={{0xb8}, {{@ipv6=@loopback, [], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0x0, 0x0, 0x0, 0xffffffff], @ipv4=@multicast1, [], @ipv6=@private1}, 0x100}}]}, @common=@inet=@SYNPROXY={0x24}}, {{@uncond, 0x0, 0x94, 0xf4, 0x0, {}, [@common=@inet=@set1={{0x24}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x3e0) 6.873195267s ago: executing program 4 (id=3134): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r0, 0x58, &(0x7f0000000180)}, 0x7) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'adiantum(xchacha20-simd,anubis-generic,nhpoly1305-sse2)\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) close(r3) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[], 0x48}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}, {0xfff3, 0x2}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@delchain={0x24, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x1, 0x1b}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) 6.787926453s ago: executing program 4 (id=3135): r0 = socket$inet6(0xa, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r4, 0x4188aec6, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_STATISTICS(r5, 0x11b, 0x8, &(0x7f00000000c0), &(0x7f0000000040)=0x30) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) userfaultfd(0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) r7 = socket(0x40000000015, 0x5, 0x0) connect$inet(r7, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r7, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) bind$inet(r7, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000380)="67d8902400", 0x5}], 0x1}, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000300)={[0xbb5, 0xffffffffffffffca, 0x100, 0xfffffffffffffff6, 0x6, 0x401, 0x6, 0x2, 0x0, 0x8, 0x100000001, 0xba25, 0x1000, 0x3, 0xfffffffffffffe00, 0x4], 0xeeef0000, 0x40080}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000140)={0x4, 0x3, 0x641352225ed612c7, 0x1000, &(0x7f0000cb0000/0x1000)=nil}) ioctl$KVM_RUN(r6, 0xae80, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x5}}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x32, &(0x7f0000000180)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000081004000080045000020000000000011907864010102e00000014e204e20000c9078a1080000c97d39b152365423671f3b593229a82908a1db1e3cac0313fe497bf98642737d81ef88fe61f8c48b5b81c19ebf05263ee23e6e43c8a9fd725a565e49141e05c2bd8ecc6d19d74f2bd1be69664e1af6bfdc86205e746ce547d9e1145cdd64819b9c1c5440ee"], 0x0) ioctl$AUTOFS_IOC_FAIL(r7, 0x9361, 0x6) 5.690580543s ago: executing program 1 (id=3138): epoll_pwait2(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}, {}, {}], 0x4, &(0x7f0000000080), &(0x7f00000001c0)={[0x3ff, 0xfccd]}, 0x8) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000240)={'ip6gretap0\x00', {0x2, 0x4e24, @local}}) r2 = epoll_create1(0x80000) sendto$unix(r1, 0x0, 0x0, 0xabc12b3054869407, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000700)={0x10000000}) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x200, 0xff, 0x2}) r4 = syz_open_dev$dri(&(0x7f0000000080), 0xb, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r4, 0xb7181000) socket$pppl2tp(0x18, 0x1, 0x1) syz_open_dev$vim2m(&(0x7f0000000000), 0x20003, 0x2) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000020000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000b56275a038f5bd74dea533e7adac74ab7eb1fcfba803486c5be401b2aa044befe7220e154d23f1f49d8f1641a6a6ac4afc5eecc6de94f602139946dca6f869e3ce6dd4ca0934cbe8db5cf615596673c0b35c865f97bd10fd55bdace72a521f14dfc87c6098a4c1823a43972f5a72f5c61a331aeb5b8bf771660cfb10c23009d2c688e10000"], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x40, 0x6, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) close(0x3) r6 = socket(0x1e, 0x805, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, 0xffffffffffffffff, 0x29) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r5, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x3, &(0x7f0000000000)=[{0x3ff, 0x5, 0x1, 0x40}, {0xd, 0x8, 0xfe, 0x80000001}, {0xff, 0xbb, 0x7f, 0x5}]}) socket$inet6(0xa, 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0xf) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r8, @ANYBLOB="06001500070000000c0016800800010010"], 0x38}}, 0x10) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) r10 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000003c0), 0x8201) ioctl$SNDRV_TIMER_IOCTL_SELECT(r10, 0x40345410, &(0x7f00000083c0)={{0x3, 0x0, 0x0, 0x0, 0x4}}) 5.612315168s ago: executing program 1 (id=3139): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000cc0)=""/144, 0x90) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000300)=ANY=[@ANYBLOB="000104"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000080)="00012c615bc20000") r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x50, 0xeb, 0xad, 0x8, 0x1608, 0x207, 0x438e, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8c, 0x66, 0x2e, 0x0, [], [{{0x9, 0x5, 0x3}}, {{0x9, 0x5, 0x2, 0x2}}]}}]}}]}}, 0x0) syz_usb_connect(0x5, 0x8a, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x5a, 0x29, 0x2e, 0x8, 0xc10, 0x0, 0x95a7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x78, 0x2, 0xa2, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xc5, 0x4, 0x3, 0xf1, 0x78, 0xa9, 0x5b, [@uac_control={{0xa, 0x24, 0x1, 0x1, 0x6}, [@extension_unit={0xc, 0x24, 0x8, 0x5, 0x6, 0x7, "0d0a329ce2"}]}], [{{0x9, 0x5, 0x86, 0x10, 0x400, 0xf4, 0x8, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x2f, 0x8}]}}, {{0x9, 0x5, 0x3, 0x4, 0x40, 0x81, 0x3, 0xff}}, {{0x9, 0x5, 0x9, 0x1b, 0x8, 0xc, 0x28, 0x80}}]}}, {{0x9, 0x4, 0x8f, 0x1, 0x4, 0xff, 0x2, 0x8c, 0x3, [], [{{0x9, 0x5, 0x9, 0x0, 0x0, 0x3, 0x0, 0x4}}, {{0x9, 0x5, 0x2, 0x2, 0x200, 0xf7, 0x81, 0x6}}, {{0x9, 0x5, 0x3, 0x3, 0x3ff, 0x8, 0x40, 0x80, [@generic={0x2, 0x5}]}}, {{0x9, 0x5, 0x85, 0x3, 0x40, 0xb, 0x2, 0xb}}]}}]}}]}}, 0x0) r3 = syz_usb_connect(0x0, 0x5a, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000060f94d100d05020027230102030109024840020000000009047d04031d5abf0009050400005539000009050b00000000000009050200000005000009047d01013481af0009a00e00230000690009047dbe"], 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_disconnect(r4) r5 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000140)=ANY=[@ANYBLOB="12015001020000082505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d240f0100000000000000000006241a0000080905810340000000000904010000020d00000904010102020d00000905820300020000"], 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_disconnect(r6) syz_usb_ep_write$ath9k_ep2(r3, 0x83, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000002c0)={0x24, &(0x7f0000000340)={0x20, 0x2, 0xbf, {0xbf, 0x7, "47f33465a55b380ee2d0c0e9d56e732261767eebd5025df4da065012c4b7e4e7a1acd9cf50aadb9b03d858d317bb64e9e46cc1df82a2cd13468ab1f95b01ebdac0743231ed64a0991cc37fef7ed367aaa47f9ae79963ffbedc92e7f5d9c0df29563dcaac9e57f83d4d112dd2cbcfb973cc52f780134d5922dc8ced580130b1cd61c99c9498da9238a72081b65305f2a2cd7477f25233d31143dbcec48e5374a2b46833c6d3e394f0d4cd32797855baf35511972bbed82f8e23b5fa3504"}}, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x809}}, &(0x7f0000000240)={0x0, 0x22, 0xc, {[@local=@item_012={0x1, 0x2, 0x0, '{'}, @local=@item_4={0x3, 0x2, 0x5, "09e5dbf8"}, @global=@item_4={0x3, 0x1, 0x0, "be71f3e4"}]}}, 0x0}, &(0x7f0000000680)={0x2c, &(0x7f0000000440)={0x0, 0x6, 0x8d, "73be2d3e770803b012f1ecf0849b9abe8c823c08f70e5c1a8690cb7fc9929d6fe8a7182d884a023a4e58b01f71f96b151c848bc03c3602ef7e95151d337a6a8b5c27d608b878a32cd23a3e1502bf07f2fefc9eb2a6d0464a368bd58af8a24a995d3daca5a821fd313eaf7722a52137cf7b1ff14a44ecb97cc2ea24b9f7abc83bbfd86af1af37fdb29e906014d4"}, &(0x7f0000000500)={0x0, 0xa, 0x1, 0x40}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000580)={0x20, 0x1, 0xa8, "c635e3c3548ee2ad90fffbfaee0e7498996e458679cc89fe333e57a4120a249cddddbcbb281b03d22cd34a1e105ea0ac3520ada004b307569954ab8a6d0d4b14e72835875ce499a9f88254902da9a223e9760ce6e6b71eb0a06ccc11fe89f39141570f8f2088193f0adf7031776d6fa60efcaa5b7d946aa9e491de0f626b2e33038f2d2f240b9313563cf1300c3866187353ce556cd96d6096c252a7b5151c6b9b4d8186e77f1502"}, &(0x7f0000000640)={0x20, 0x3, 0x1, 0x6}}) 4.681901519s ago: executing program 0 (id=3142): symlink(&(0x7f0000001780)='./file0/../file0\x00', &(0x7f00000017c0)='./file0\x00') unlink(&(0x7f0000000140)='./file0/../file0\x00') 4.63747815s ago: executing program 0 (id=3143): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000000)={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x56e, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x190, 0x1, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x2, 0xfe, 0x1, {0x22, 0x85}}, {{{0x9, 0x5, 0x81, 0x3, 0xdeb9f3d6bebe38e6, 0x0, 0x19}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0xffff, 0x0, @private1, 0x200000}, 0x1c) sendto$inet6(r5, &(0x7f00000001c0)='O', 0x1, 0x80, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) shutdown(r5, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x4}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7c, &(0x7f00000000c0), &(0x7f0000000180)=0x8) syz_usb_control_io(r4, &(0x7f0000000340)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="00218500000085"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000002c0)={{&(0x7f0000000000/0x3000)=nil, 0x3000}, 0x1}) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000007c0)=@acquire={0x16c, 0x17, 0x1, 0x70bd27, 0x25dfdbfe, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d4, 0xff}, @in=@private=0xa010102, {@in=@multicast2, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4e21, 0x100, 0x4e20, 0x3, 0x2, 0xe0, 0x20, 0x3b, 0x0, 0xffffffffffffffff}, {{@in=@local, @in=@broadcast, 0x4e21, 0x9, 0x4e22, 0x83, 0xa, 0x0, 0x0, 0xc}, {0x7f, 0xec2b, 0x5, 0xa, 0xd5, 0x6, 0x6, 0xb}, {0x7, 0xa0, 0x9, 0x200000000000000}, 0xba, 0x0, 0x2, 0x0, 0x0, 0x3}, 0x3, 0x1, 0x200, 0x70bd29}, [@tmpl={0x44, 0x5, [{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d2, 0x2b}, 0x19, @in6=@ipv4={'\x00', '\xff\xff', @multicast2}, 0x3506, 0x4, 0x1, 0x9, 0xab9, 0x9, 0x1}]}]}, 0x16c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r8 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4040aea0, &(0x7f0000000140)=@x86={0x3, 0x8, 0x6, 0x0, 0x0, 0x2, 0x7, 0xfe, 0x1, 0x12, 0xfe, 0x0, 0x0, 0x4, 0xa, 0x0, 0x7f, 0x8, 0xc4, '\x00', 0x4, 0x88000000000002}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000240)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000300)={r9, 0x0, 0x9, 0x0, 0x0, [0x0], [0x9, 0x0, 0x0, 0x8], [0x3, 0x0, 0x100, 0xd], [0x1000000000000, 0x0, 0xfffffffffffffffd]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000080)={r10, 0x0, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000004, 0x13, r11, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000000080)=ANY=[], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$SG_IO(r0, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x3, 0x6b, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000040)="a6b4ff", 0x0, 0xfffffffe, 0x0, 0x0, 0x0}) 4.507443293s ago: executing program 4 (id=3144): bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000001c0), 0x4) r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) write$binfmt_misc(r0, &(0x7f0000000240), 0xfffffecc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x8) 3.908037988s ago: executing program 3 (id=3148): r0 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@dev={0xac, 0x14, 0x14, 0x5}, @in6=@remote, 0xfffd, 0x0, 0x4e20, 0x0, 0x2}, {0x0, 0x4, 0x1, 0x77, 0x0, 0x9}, {0x1ff, 0xffffffffe, 0x4053e5, 0x20}, 0x6, 0x1, 0x1, 0x0, 0x1}, {{@in=@empty, 0x1, 0x32}, 0xa, @in6=@private0, 0x3502, 0x1, 0x0, 0x0, 0x6, 0x1}}, 0xe4) openat$tun(0xffffffffffffff9c, 0x0, 0x121200, 0x0) socket$inet(0x2, 0xa, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x10, 0x701, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) fanotify_init(0x200, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x20, 0x10, 0x1, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21a8}}, 0x20}}, 0x0) 3.681362394s ago: executing program 3 (id=3150): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x40400) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) r3 = syz_usb_connect(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r3, &(0x7f0000000080)={0xc, &(0x7f0000000000)={0x40, 0x24, 0x7, {0x7, 0xf, "7a22d97dfd"}}, &(0x7f0000000300)={0x0, 0x3, 0x9d, @string={0x9d, 0x3, "44647cafae2e0940241d9fb97bda8e4085e44dfd6689bc503ac5b40da8a036e02d056f2384f52ce3dd4e2b1bf3fcf569b58cdf3f079b9211ec582ec0a65f751e74316dd4a33463e0e0b57bc648ec877b3d773ca9a7d88b4f53b6a67df382e4abdfa8e7560d595cc467110122feb5fbd5d591fa1549cb9b4e4aef7f9b0a7c3a390ea5b4f4809406ab3347698c92c651e763f01a8c277bb9abdc9c77"}}}, &(0x7f00000005c0)={0x24, &(0x7f0000000440)={0x0, 0x1, 0xd5, "41fd5408a6e3ab2a2cfd4c2ecf3a49e30c22ca6f3282d409de4b77d6762620ed83368aed4811de16afad77888a72390ee40b2a72f15cc5f6beb5dd3901b6781e8763e7158ec5b128613232341e92696dcb5ce25ff8f61e5990a307c8795b4646b11409eef435acec230b6cecdf4c9f27a83d013ac734ccac5095a7a727b0c1cd7d24dc2f5e0ab23a2b95873711b9b31f95440ab351752fbc7b50bd5d9a07ed254bbee149dd1e65a71572023811a7ec2053fe7d7a243acbc59f3d1638ccbdead9e2f6b657bc84106a4858529d8a5031710400b9361d"}, &(0x7f0000000100)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000180)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000001c0)={0x20, 0x81, 0x2, "799c"}, &(0x7f0000000240)={0x20, 0x82, 0x1, ')'}, &(0x7f0000000280)={0x20, 0x83, 0x2, "822d"}, &(0x7f0000000540)={0x20, 0x84, 0x3, "71dd51"}, &(0x7f0000000580)={0x20, 0x85, 0x3, "0f930e"}}) sendmsg$NFT_BATCH(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002100)={{0x14}, [@NFT_MSG_NEWSETELEM={0x2c, 0xc, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x54}}, 0x0) userfaultfd(0x0) ioctl$HIDIOCSREPORT(r1, 0x81044804, &(0x7f0000000400)={0x1, 0x200, 0x3ff}) 2.486453582s ago: executing program 2 (id=3154): r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0xff}, 0x2}, 0x1c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, 0xffffffffffffffff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_INPUT(r2, &(0x7f00000012c0)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964ded28f79c862e674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db593d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a0bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe786bdbae823d4980bb967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005dfd871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1273eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3ff000000000000007a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17a48245045cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bf0400000000000000f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20474dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a9786cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f67ec371bc44fbc1ac5704d41889a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd326923d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4b2f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c56b2d1921a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6922463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8622c6e15ab09b1af2e6b9af1facc32be4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b200fedea1c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea513d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25ade162ba3c91bb844aaf6fd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e5706000000000000000000000000000000000000000000000000000000000000000000200", 0x1000}}, 0xffffffffffffff8b) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r2, 0x0) madvise(&(0x7f000068d000/0x2000)=nil, 0x2000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$P9_RREADLINK(r2, &(0x7f0000001280)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) sched_setattr(0x0, 0x0, 0x0) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f00000002c0)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(r3, &(0x7f00000000c0), 0x2) read(r3, &(0x7f00000001c0)=""/93, 0x5d) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000040)={0x2, 0x13}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000180)={0x2, 0xfc}, 0x2) get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000117000/0x2000)=nil, 0x2) pselect6(0x0, 0x0, &(0x7f0000000200), 0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0x3, 0x400]}, 0x8}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="020003000000000400000700000008000400ff0100000c000180060005004e200000"], 0x28}}, 0x0) r6 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000080)=ANY=[@ANYRES16=r4], 0x44) socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x2, 0x3, 0x6) bind$inet(r7, &(0x7f0000000080)={0x2, 0xfffa, @local}, 0x10) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f00000000c0)=0x6, 0x4) 2.340225058s ago: executing program 1 (id=3155): socket$inet_sctp(0x2, 0x5, 0x84) r0 = syz_io_uring_setup(0x5bf, &(0x7f0000000440)={0x0, 0xe7a4, 0x0, 0x1, 0x294}, &(0x7f0000000240)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000004c0)=@IORING_OP_READ=@pass_buffer={0x16, 0xa, 0x0, @fd_index=0x9, 0xc, 0x0, 0x0, 0x2}) io_uring_enter(r0, 0x6e2, 0x3900, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x100000c, 0x4031, 0xffffffffffffffff, 0x0) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_open_dev$loop(0x0, 0x80000001, 0x80000) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, 0x0, 0x0) r4 = socket$inet6(0xa, 0x3, 0x4) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback, 0x6}, 0x1c) lsetxattr$security_capability(&(0x7f0000000000)='.\x00', 0x0, 0x0, 0x0, 0x3) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCDELRT(r5, 0x890c, &(0x7f0000000680)={0x0, {0x2, 0x4e23, @remote}, {0x2, 0x4e23, @multicast2}, {0x2, 0x4e21, @local}, 0x202, 0x0, 0x0, 0x0, 0x10, 0x0, 0x3, 0x1, 0x81}) setsockopt$ARPT_SO_SET_REPLACE(r5, 0x0, 0x60, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) r6 = syz_open_dev$amidi(&(0x7f0000000600), 0x8, 0x440000) fremovexattr(r6, &(0x7f0000000640)=@random={'security.', '-[(!-\x00'}) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r7, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000140)=""/82, 0x328000, 0x1800}, 0x20) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) io_uring_enter(r0, 0xc54, 0xc993, 0x1, 0x0, 0x0) 2.219964132s ago: executing program 0 (id=3156): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x3, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000002f80)={0x2800c000, 0x9}) 2.154624531s ago: executing program 2 (id=3157): socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = io_uring_setup(0x191a, &(0x7f0000000000)={0x0, 0x761, 0x40, 0x81, 0x1b5}) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r1 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r1, &(0x7f0000000100), 0x0) 2.021415561s ago: executing program 0 (id=3158): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="180000000300000000000000000000004afaadff08a9091701091f8c4d425d2595000000006e260d6b7209893cbfd92a0c61327771ba2d6406625739e635a39d479a1f554d6bfb0deff4414d915af75d642b5da6927977d4ec256969072697b09961a350e8c16a534cdec5c4e94a9b7dbfb88b227a4d09acf94f0cf97f4f115cd6b2b130bb512e57ec8147b0b7d131ee0a37ff9e7e5a433bbb3e1deef5b692afc7f55dba12a325cb63383da9a31376193b21a245b70f3914ff979b2383708a7261db91e9a14d060d5ca09eeed48262dee7604a3955fd01e89f4d33396c028b0331c0d4ebc1b48a375bae99595bd326189e8de7ed9f74a7a9e663b87a9f99dfeec2d354e26e2035eec6c983c5181c24a2f1c421a22a1f690a1a04f76ecadd8f235485503462b6cedad175b5b8e51b58164a7449416b9b5d8c5e6f690fe2a284d6e729196766cadd7823ff42ba477a3cecebd793703f"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$dri(0x0, 0xfffffff6, 0x8100) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200), 0xc0200, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000100)=0x3) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r2, 0x4004743d, 0x110e22fff6) r3 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x3afb, 0x8, 0x2, 0xa5}, &(0x7f0000000480)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmmsg(r5, &(0x7f0000006900)=[{{&(0x7f0000000280)=@nl=@kern={0x10, 0x0, 0x0, 0x8}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000cc0)="ddb13373", 0x4}], 0x1, &(0x7f0000001600)=[{0xc, 0x115, 0x7}], 0xc}}], 0x1, 0x20008054) io_uring_enter(r3, 0x627, 0xc1040000, 0x43, 0x0, 0x0) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) r7 = socket(0x400000000010, 0x80000, 0xfffffffe) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x28, 0x2d, 0x9, 0x70bd27, 0x0, {0x5}, [@typed={0x14, 0xa, 0x0, 0x0, @ipv6=@loopback={0xb00000000000000}}]}, 0x28}}, 0x84) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) r12 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r12, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r12, 0x0) r13 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r13, &(0x7f00000002c0)=[{&(0x7f0000000280)='3', 0x1}], 0x1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r11, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f0000000140), &(0x7f00000001c0)}, 0x1c) sendmsg$nl_generic(r7, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000300)={&(0x7f0000000600)={0x604, 0x32, 0x300, 0x70bd2c, 0x25dfdbfe, {0xa}, [@typed={0x60, 0x148, 0x0, 0x0, @binary="4be1588feb12b9647c67ad9f1cb744efd43f8a5fee173d0cb70fd3f9fa84d3780b6b3cc84f3226b097ad4f959d8691fad35974fad0c7474823c6d60281b8fb636b47a6bae5182c8369cc2f812757c77d68424b96b481a8f564cc3c28"}, @generic="63c9d2fe9d608a84cb80843e6f3045a175f90a40bdf2ad4bd0764aea66a27c1f809961553520063cfc8846ed79930ae7", @nested={0x205, 0x133, 0x0, 0x1, [@nested={0x4, 0x43}, @nested={0x4, 0xb9}, @generic="183bb9933bcb9b0f3ad206715f5788431e219a7beb7b5bb476ebbc06baf1d98163e6f0ef76a6b01e2edffb8b4ac840a4fdf0d1434207892368911ed82e62b3fb200260dce2be545b6f6d82ea5699231b3a0202cd55067788fe688fc43ca3800209658cf8fa2ccc43e3f09908c51d6ae0b2ea45e1b344a189862273b24884b9c80df4dc7d1df68e6e28", @generic="7d6cf3a91c708ba68d6443ef018ced4cc51dff776c71aa8c4a9e126a4d1b79418b58429e0da460794be93834d104e1a8dcbae9c0e58653d2af336a019118dfd6233d1d3165a16fa0281332827a4e2f5c3de88467432ceb81c59186a47e", @typed={0x82, 0xd9, 0x0, 0x0, @binary="394b600ea01cd408295aecafb5994db9ad6b86bc8772542f145396136b303d2024e65696ea2cca85935d77b3499a487cc15a22cb045f45ed6bafa27d5a2f3b489fe1cc74cb1f3660a1b0b8d8f9c4ed6dfcec2526fe1a2a50e7c2bee11a9aab84ad6760923c7672b47a0c1a01ff30e407e6ea3601a6cefb30b01b38e2cebe"}, @typed={0x20, 0x12, 0x0, 0x0, @binary="3bae94a7dae170bcf72408bd74b5d9e58fcfb2acd8218f1d39bc3ac0"}, @nested={0x4, 0xc6}, @generic="cf5988c488cbe1d8e073e924b6078f87fbc6c90aafe1dc28ba4a98a6758e627f2a0e09b14bb287055f6815cbe3a28c25e16d305bbc322f55d759b348f7b20f17ac046a5d83009e17aad9aa7db117012de9b8c4eeea3503324a92c7848e3e4c5b586eea", @typed={0x8, 0xa0, 0x0, 0x0, @ipv4=@rand_addr=0x64010100}]}, @nested={0x270, 0xa8, 0x0, 0x1, [@typed={0x8, 0xaa, 0x0, 0x0, @u32=0xb}, @typed={0x4, 0x50}, @typed={0xc1, 0xf9, 0x0, 0x0, @binary="e369b97ef350d4bd3e4f53f093e023635c0a4d202b1d196f042a01f4efac4f950d6db2442bf00171daf99aaed5771fbca23399add5c93dbd2a3b9c7a1c60629b6021bdad89ed0a317e1ed3bd34fd7b14be7dcd7b86ad6e4515e2ffd04c9f336561669a7dc7579a7b1806e43fb117dc1ff73964c2360c0c40f109925550cd4093ae4a6bedf6ee18a87ef3ef78253bd5f52ea3200d258580ab958cd10795b1d1e44355a20720dd6d1004a6eb95c9faf8ccaca6357527469d26cd878cd476"}, @generic="7f0fb0c6fcfaaff7e8a20cfdfc0e23451781c3981bcedcfb23810ee07f47778280db3d2ef972aa1280032d423f0b05ead11ae0b702f0ee11f451361dee6eabd1dc8eb7cb0c5723c48a444cd55e3c1157a6b968f1bbe6cc7f976ecc2b8371fc2622285578061eb9c34ead9d18d55194df077440439884462ad8cef95e76528c5f64336827b57074d6e5f7ddba85666581029af49dacafd94e0e06d3df4788899d04dc275e261e0ea7ec3e488b598c6081c4cdaf1a585c32a18fc45f7f3db234afd777b0192741f03a775d37b776945518671ea709508b4db146431aca73c81fdf063ac69d72d9229669b1d6aba760e7ee", @generic="d571946876441d8d83c3ad8486a85e4cfda4b65582539d81cceaba147b3b18b626555f7ada05f15458af841482ad2c4da63aa8f3be6953dccb13ae9d4edb332434e108895616eb60b143de23afc47b9791cf041dd7c9b93f2052f2a1f663a412450a59b37c3375d60ddd2a1207c2fc362929559101a43eb9429e254afba96761e29cc4cc0cbd26eb1604e04c8b83a145ca9039d76e4ec33beebb18d3dd2eabd8", @typed={0xc, 0x14d, 0x0, 0x0, @u64=0xb5c00000000}]}, @typed={0x6, 0x1a, 0x0, 0x0, @str='(\x00'}, @typed={0x1b, 0xfd, 0x0, 0x0, @binary="985102a15528d9886f5e0be643be2f89f1959b65b4a90c"}, @nested={0x10, 0x147, 0x0, 0x1, [@nested={0x4, 0x115}, @typed={0x8, 0x107, 0x0, 0x0, @fd=r6}]}, @typed={0xb4, 0x88, 0x0, 0x0, @binary="6ce576e5d342520437dd0a0ed7af46c79cdd442a99a87b9a37ad1aada93878f7d21f9afcb61c156eb034b163302ea64619edf966a43b7cd0af70655b6eaed0b015eec86adeb839c361349244397c1a549d96f2d58861bd6d11b92206b7128e99778d12cf2ac1fcc5312b943ec86d8fbf316509e0791f19086c87db3760aface9be6ece92cedee8c0080ad855a8d04d8c201a3281ebf2fa94351a0c3a12a632ab5c6ed01fd15e5de3ac2ac6cc21f757e8"}]}, 0x604}, 0x1, 0x0, 0x0, 0x40000}, 0x4) 1.732384448s ago: executing program 2 (id=3159): socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = io_uring_setup(0x191a, &(0x7f0000000000)={0x0, 0x761, 0x40, 0x81, 0x1b5}) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r1 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r1, &(0x7f0000000100), 0x0) 1.705457407s ago: executing program 0 (id=3160): r0 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@dev={0xac, 0x14, 0x14, 0x5}, @in6=@remote, 0xfffd, 0x0, 0x4e20, 0x0, 0x2}, {0x0, 0x4, 0x1, 0x77, 0x0, 0x9}, {0x1ff, 0xffffffffe, 0x4053e5, 0x20}, 0x6, 0x1, 0x1, 0x0, 0x1}, {{@in=@empty, 0x1, 0x32}, 0xa, @in6=@private0, 0x3502, 0x1, 0x0, 0x0, 0x6, 0x1}}, 0xe4) openat$tun(0xffffffffffffff9c, 0x0, 0x121200, 0x0) socket$inet(0x2, 0xa, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x10, 0x701, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) fanotify_init(0x200, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x20, 0x10, 0x1, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21a8}}, 0x20}}, 0x0) 1.628146547s ago: executing program 3 (id=3161): epoll_pwait2(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}, {}, {}], 0x4, &(0x7f0000000080), &(0x7f00000001c0)={[0x3ff, 0xfccd]}, 0x8) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000240)={'ip6gretap0\x00', {0x2, 0x4e24, @local}}) r2 = epoll_create1(0x80000) sendto$unix(r1, 0x0, 0x0, 0xabc12b3054869407, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000700)={0x10000000}) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000180)={0x200, 0xff, 0x2}) r4 = syz_open_dev$dri(&(0x7f0000000080), 0xb, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x2000000, 0x12, r4, 0xb7181000) socket$pppl2tp(0x18, 0x1, 0x1) syz_open_dev$vim2m(&(0x7f0000000000), 0x20003, 0x2) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000020000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000b56275a038f5bd74dea533e7adac74ab7eb1fcfba803486c5be401b2aa044befe7220e154d23f1f49d8f1641a6a6ac4afc5eecc6de94f602139946dca6f869e3ce6dd4ca0934cbe8db5cf615596673c0b35c865f97bd10fd55bdace72a521f14dfc87c6098a4c1823a43972f5a72f5c61a331aeb5b8bf771660cfb10c23009d2c688e1000000"], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x40, 0x6, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) close(0x3) r6 = socket(0x1e, 0x805, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, 0xffffffffffffffff, 0x29) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r5, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x3, &(0x7f0000000000)=[{0x3ff, 0x5, 0x1, 0x40}, {0xd, 0x8, 0xfe, 0x80000001}, {0xff, 0xbb, 0x7f, 0x5}]}) socket$inet6(0xa, 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0xf) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r8, @ANYBLOB="06001500070000000c0016800800010010"], 0x38}}, 0x10) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) r10 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000003c0), 0x8201) ioctl$SNDRV_TIMER_IOCTL_SELECT(r10, 0x40345410, &(0x7f00000083c0)={{0x3, 0x0, 0x0, 0x0, 0x4}}) 1.431635918s ago: executing program 1 (id=3162): bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) write$binfmt_misc(r0, &(0x7f0000000240), 0xfffffecc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x8) 1.325432364s ago: executing program 2 (id=3163): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x630040, 0x0) (async) r1 = openat$cgroup_root(0xffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='memory.stat\x00', 0x0, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) (async) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000140)=@ipv4_newroute={0x1c, 0x1a, 0x1, 0x0, 0x0, {0xa, 0x80, 0x80, 0x0, 0xfc}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000801}, 0x180) (async, rerun: 32) r4 = socket$kcm(0x10, 0x2, 0x0) (rerun: 32) sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000140)="2e00000011008188040f80ec59acbc0413a181003100000001010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x38011, r0, 0x0) ioctl$KDENABIO(r2, 0x4b36) (async, rerun: 32) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (rerun: 32) 1.301721109s ago: executing program 0 (id=3164): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000cc0)=""/144, 0x90) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000300)=ANY=[@ANYBLOB="000104"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000080)="00012c615bc20000") r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x50, 0xeb, 0xad, 0x8, 0x1608, 0x207, 0x438e, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8c, 0x66, 0x2e, 0x0, [], [{{0x9, 0x5, 0x3}}, {{0x9, 0x5, 0x2, 0x2}}]}}]}}]}}, 0x0) syz_usb_connect(0x5, 0x8d, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x5a, 0x29, 0x2e, 0x8, 0xc10, 0x0, 0x95a7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7b, 0x2, 0xa2, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xc5, 0x4, 0x3, 0xf1, 0x78, 0xa9, 0x5b, [@uac_control={{0xa, 0x24, 0x1, 0x1, 0x6}, [@extension_unit={0xc, 0x24, 0x8, 0x5, 0x6, 0x7, "0d0a329ce2"}]}], [{{0x9, 0x5, 0x86, 0x10, 0x400, 0xf4, 0x8, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x2f, 0x8}]}}, {{0x9, 0x5, 0x3, 0x4, 0x40, 0x81, 0x3, 0xff}}, {{0x9, 0x5, 0x9, 0x1b, 0x8, 0xc, 0x28, 0x80}}]}}, {{0x9, 0x4, 0x8f, 0x1, 0x4, 0xff, 0x2, 0x8c, 0x3, [], [{{0x9, 0x5, 0x9, 0x0, 0x0, 0x3, 0x0, 0x4}}, {{0x9, 0x5, 0x2, 0x2, 0x200, 0xf7, 0x81, 0x6}}, {{0x9, 0x5, 0x3, 0x3, 0x3ff, 0x8, 0x40, 0x80, [@generic={0x5, 0x5, "a6c641"}]}}, {{0x9, 0x5, 0x85, 0x3, 0x40, 0xb, 0x2, 0xb}}]}}]}}]}}, 0x0) r3 = syz_usb_connect(0x0, 0x5a, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000060f94d100d05020027230102030109024840020000000009047d04031d5abf0009050400005539000009050b00000000000009050200000005000009047d01013481af0009a00e00230000690009047dbe"], 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_disconnect(r4) r5 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000140)=ANY=[@ANYBLOB="12015001020000082505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d240f0100000000000000000006241a0000080905810340000000000904010000020d00000904010102020d00000905820300020000"], 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_disconnect(r6) syz_usb_ep_write$ath9k_ep2(r3, 0x83, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000002c0)={0x24, &(0x7f0000000340)={0x20, 0x2, 0xbf, {0xbf, 0x7, "47f33465a55b380ee2d0c0e9d56e732261767eebd5025df4da065012c4b7e4e7a1acd9cf50aadb9b03d858d317bb64e9e46cc1df82a2cd13468ab1f95b01ebdac0743231ed64a0991cc37fef7ed367aaa47f9ae79963ffbedc92e7f5d9c0df29563dcaac9e57f83d4d112dd2cbcfb973cc52f780134d5922dc8ced580130b1cd61c99c9498da9238a72081b65305f2a2cd7477f25233d31143dbcec48e5374a2b46833c6d3e394f0d4cd32797855baf35511972bbed82f8e23b5fa3504"}}, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x809}}, &(0x7f0000000240)={0x0, 0x22, 0xc, {[@local=@item_012={0x1, 0x2, 0x0, '{'}, @local=@item_4={0x3, 0x2, 0x5, "09e5dbf8"}, @global=@item_4={0x3, 0x1, 0x0, "be71f3e4"}]}}, 0x0}, &(0x7f0000000680)={0x2c, &(0x7f0000000440)={0x0, 0x6, 0x8d, "73be2d3e770803b012f1ecf0849b9abe8c823c08f70e5c1a8690cb7fc9929d6fe8a7182d884a023a4e58b01f71f96b151c848bc03c3602ef7e95151d337a6a8b5c27d608b878a32cd23a3e1502bf07f2fefc9eb2a6d0464a368bd58af8a24a995d3daca5a821fd313eaf7722a52137cf7b1ff14a44ecb97cc2ea24b9f7abc83bbfd86af1af37fdb29e906014d4"}, &(0x7f0000000500)={0x0, 0xa, 0x1, 0x40}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000580)={0x20, 0x1, 0xa8, "c635e3c3548ee2ad90fffbfaee0e7498996e458679cc89fe333e57a4120a249cddddbcbb281b03d22cd34a1e105ea0ac3520ada004b307569954ab8a6d0d4b14e72835875ce499a9f88254902da9a223e9760ce6e6b71eb0a06ccc11fe89f39141570f8f2088193f0adf7031776d6fa60efcaa5b7d946aa9e491de0f626b2e33038f2d2f240b9313563cf1300c3866187353ce556cd96d6096c252a7b5151c6b9b4d8186e77f1502"}, &(0x7f0000000640)={0x20, 0x3, 0x1, 0x6}}) 1.230345176s ago: executing program 3 (id=3165): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000000)={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x56e, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x190, 0x1, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x2, 0xfe, 0x1, {0x22, 0x85}}, {{{0x9, 0x5, 0x81, 0x3, 0xdeb9f3d6bebe38e6, 0x0, 0x19}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0xffff, 0x0, @private1, 0x200000}, 0x1c) sendto$inet6(r5, &(0x7f00000001c0)='O', 0x1, 0x80, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) shutdown(r5, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x4}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7c, &(0x7f00000000c0), &(0x7f0000000180)=0x8) syz_usb_control_io(r4, &(0x7f0000000340)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="00218500000085"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000002c0)={{&(0x7f0000000000/0x3000)=nil, 0x3000}, 0x1}) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000007c0)=@acquire={0x16c, 0x17, 0x1, 0x70bd27, 0x25dfdbfe, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d4, 0xff}, @in=@private=0xa010102, {@in=@multicast2, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4e21, 0x100, 0x4e20, 0x3, 0x2, 0xe0, 0x20, 0x3b, 0x0, 0xffffffffffffffff}, {{@in=@local, @in=@broadcast, 0x4e21, 0x9, 0x4e22, 0x83, 0xa, 0x0, 0x0, 0xc}, {0x7f, 0xec2b, 0x5, 0xa, 0xd5, 0x6, 0x6, 0xb}, {0x7, 0xa0, 0x9, 0x200000000000000}, 0xba, 0x0, 0x2, 0x0, 0x0, 0x3}, 0x3, 0x1, 0x200, 0x70bd29}, [@tmpl={0x44, 0x5, [{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d2, 0x2b}, 0x19, @in6=@ipv4={'\x00', '\xff\xff', @multicast2}, 0x3506, 0x4, 0x1, 0x9, 0xab9, 0x9, 0x1}]}]}, 0x16c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r8 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4040aea0, &(0x7f0000000140)=@x86={0x3, 0x8, 0x6, 0x0, 0x0, 0x2, 0x7, 0xfe, 0x1, 0x12, 0xfe, 0x0, 0x0, 0x4, 0xa, 0x0, 0x7f, 0x8, 0xc4, '\x00', 0x4, 0x88000000000002}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000240)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000300)={r9, 0x0, 0x9, 0x0, 0x0, [0x0], [0x9, 0x0, 0x0, 0x8], [0x3, 0x0, 0x100, 0xd], [0x1000000000000, 0x0, 0xfffffffffffffffd]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000080)={r10, 0x0, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000004, 0x13, r11, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000000080)=ANY=[], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$SG_IO(r0, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x3, 0x6b, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000040)="a6b4ff", 0x0, 0xfffffffe, 0x0, 0x0, 0x0}) 844.434539ms ago: executing program 2 (id=3166): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, 0x0, 0x0, 0x0, &(0x7f0000003700)={0x77359400}) 709.995745ms ago: executing program 2 (id=3167): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000000)={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x56e, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x190, 0x1, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x2, 0xfe, 0x1, {0x22, 0x85}}, {{{0x9, 0x5, 0x81, 0x3, 0xdeb9f3d6bebe38e6, 0x0, 0x19}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0xffff, 0x0, @private1, 0x200000}, 0x1c) sendto$inet6(r5, &(0x7f00000001c0)='O', 0x1, 0x80, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) shutdown(r5, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x4}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7c, &(0x7f00000000c0), &(0x7f0000000180)=0x8) syz_usb_control_io(r4, &(0x7f0000000340)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="00218500000085"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000002c0)={{&(0x7f0000000000/0x3000)=nil, 0x3000}, 0x1}) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000007c0)=@acquire={0x16c, 0x17, 0x1, 0x70bd27, 0x25dfdbfe, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d4, 0xff}, @in=@private=0xa010102, {@in=@multicast2, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4e21, 0x100, 0x4e20, 0x3, 0x2, 0xe0, 0x20, 0x3b, 0x0, 0xffffffffffffffff}, {{@in=@local, @in=@broadcast, 0x4e21, 0x9, 0x4e22, 0x83, 0xa, 0x0, 0x0, 0xc}, {0x7f, 0xec2b, 0x5, 0xa, 0xd5, 0x6, 0x6, 0xb}, {0x7, 0xa0, 0x9, 0x200000000000000}, 0xba, 0x0, 0x2, 0x0, 0x0, 0x3}, 0x3, 0x1, 0x200, 0x70bd29}, [@tmpl={0x44, 0x5, [{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d2, 0x2b}, 0x19, @in6=@ipv4={'\x00', '\xff\xff', @multicast2}, 0x3506, 0x4, 0x1, 0x9, 0xab9, 0x9, 0x1}]}]}, 0x16c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r8 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4040aea0, &(0x7f0000000140)=@x86={0x3, 0x8, 0x6, 0x0, 0x0, 0x2, 0x7, 0xfe, 0x1, 0x12, 0xfe, 0x0, 0x0, 0x4, 0xa, 0x0, 0x7f, 0x8, 0xc4, '\x00', 0x4, 0x88000000000002}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000240)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000300)={r9, 0x0, 0x9, 0x0, 0x0, [0x0], [0x9, 0x0, 0x0, 0x8], [0x3, 0x0, 0x100, 0xd], [0x1000000000000, 0x0, 0xfffffffffffffffd]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000080)={r10, 0x0, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000004, 0x13, r11, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x3, 0x6b, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000040)="a6b4ff", 0x0, 0xfffffffe, 0x0, 0x0, 0x0}) 331.164615ms ago: executing program 1 (id=3168): socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = io_uring_setup(0x191a, &(0x7f0000000000)={0x0, 0x761, 0x40, 0x81, 0x1b5}) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r1 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r1, &(0x7f0000000100)=[{0x0}], 0x1) 0s ago: executing program 1 (id=3169): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x29, 0x0, &(0x7f00000000c0)=0x11e) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r1, &(0x7f00000000c0)="3f03fe7fd877140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) mbind(&(0x7f00004ca000/0x2000)=nil, 0x2000, 0x8003, &(0x7f0000000000)=0x1, 0x9, 0x3) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x6, 0x0) kernel console output (not intermixed with test programs): er on device bond4 [ 732.663266][T15147] FAULT_INJECTION: forcing a failure. [ 732.663266][T15147] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 732.681567][T15147] CPU: 1 UID: 0 PID: 15147 Comm: syz.3.2893 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 732.681594][T15147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 732.681606][T15147] Call Trace: [ 732.681620][T15147] [ 732.681625][T15147] dump_stack_lvl+0x241/0x360 [ 732.681646][T15147] ? __pfx_dump_stack_lvl+0x10/0x10 [ 732.681660][T15147] ? __pfx__printk+0x10/0x10 [ 732.681680][T15147] should_fail_ex+0x424/0x570 [ 732.681694][T15147] _copy_from_user+0x2d/0xb0 [ 732.681708][T15147] do_fb_ioctl+0x30c/0x7e0 [ 732.681720][T15147] ? __pfx_do_fb_ioctl+0x10/0x10 [ 732.681746][T15147] ? tomoyo_path_number_perm+0x215/0x790 [ 732.681762][T15147] ? __lock_acquire+0xad5/0xd80 [ 732.681774][T15147] ? tomoyo_path_number_perm+0x215/0x790 [ 732.681789][T15147] fb_compat_ioctl+0x2d8/0xce0 [ 732.681809][T15147] ? __pfx_fb_compat_ioctl+0x10/0x10 [ 732.681834][T15147] ? __fget_files+0x2a/0x420 [ 732.681843][T15147] ? __fget_files+0x2a/0x420 [ 732.681853][T15147] ? __fget_files+0x2a/0x420 [ 732.681868][T15147] __se_compat_sys_ioctl+0x50e/0xc30 [ 732.681882][T15147] ? __pfx___se_compat_sys_ioctl+0x10/0x10 [ 732.681897][T15147] ? __fget_files+0x2a/0x420 [ 732.681909][T15147] ? fput+0x9b/0xd0 [ 732.681918][T15147] ? ksys_write+0x275/0x2d0 [ 732.681934][T15147] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 732.681946][T15147] ? lockdep_hardirqs_on+0x9d/0x150 [ 732.681959][T15147] __do_fast_syscall_32+0xb4/0x110 [ 732.681971][T15147] ? exc_page_fault+0x5f8/0x920 [ 732.681984][T15147] do_fast_syscall_32+0x34/0x80 [ 732.681996][T15147] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 732.682008][T15147] RIP: 0023:0xf7f01579 [ 732.682017][T15147] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 732.682025][T15147] RSP: 002b:00000000f502655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 732.682036][T15147] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000004601 [ 732.682043][T15147] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 732.682050][T15147] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 732.682055][T15147] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 732.682061][T15147] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 732.682075][T15147] [ 732.914641][ C1] vkms_vblank_simulate: vblank timer overrun [ 732.929730][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 733.235832][ T30] kauditd_printk_skb: 191 callbacks suppressed [ 733.235844][ T30] audit: type=1326 audit(1744519172.504:2086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15144 comm="syz.4.2892" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe1579 code=0x7ffc0000 [ 733.322760][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 733.349102][ T30] audit: type=1326 audit(1744519172.504:2087): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15144 comm="syz.4.2892" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe1579 code=0x7ffc0000 [ 733.372289][T15153] netlink: 'syz.3.2895': attribute type 29 has an invalid length. [ 733.504496][ T30] audit: type=1326 audit(1744519172.534:2088): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15144 comm="syz.4.2892" exe="/root/syz-executor" sig=0 arch=40000003 syscall=49 compat=1 ip=0xf7fe1579 code=0x7ffc0000 [ 733.730726][ T30] audit: type=1326 audit(1744519172.534:2089): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15144 comm="syz.4.2892" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe1579 code=0x7ffc0000 [ 733.838261][ T30] audit: type=1326 audit(1744519172.534:2090): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15144 comm="syz.4.2892" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe1579 code=0x7ffc0000 [ 734.205065][ T30] audit: type=1326 audit(1744519172.534:2091): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15144 comm="syz.4.2892" exe="/root/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf7fe1579 code=0x7ffc0000 [ 734.259310][ T30] audit: type=1326 audit(1744519172.534:2092): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15144 comm="syz.4.2892" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe1579 code=0x7ffc0000 [ 734.352955][ T30] audit: type=1326 audit(1744519172.534:2093): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15144 comm="syz.4.2892" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe1579 code=0x7ffc0000 [ 734.354414][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 734.375060][ C1] vkms_vblank_simulate: vblank timer overrun [ 734.389816][ T30] audit: type=1326 audit(1744519172.534:2094): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15144 comm="syz.4.2892" exe="/root/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf7fe1579 code=0x7ffc0000 [ 734.495736][ T30] audit: type=1326 audit(1744519172.534:2095): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15144 comm="syz.4.2892" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe1579 code=0x7ffc0000 [ 734.533215][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 735.203603][ T5890] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 735.318275][T15190] netlink: 'syz.1.2904': attribute type 1 has an invalid length. [ 735.360514][T15190] 8021q: adding VLAN 0 to HW filter on device bond9 [ 735.368452][ T5890] usb 5-1: Using ep0 maxpacket: 32 [ 735.386086][ T5890] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 735.411036][ T5890] usb 5-1: config 0 has no interfaces? [ 735.436611][ T5890] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 735.450858][ T5890] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 735.459599][ T5890] usb 5-1: Product: syz [ 735.464489][ T5890] usb 5-1: Manufacturer: syz [ 735.469112][ T5890] usb 5-1: SerialNumber: syz [ 735.485895][ T5890] usb 5-1: config 0 descriptor?? [ 735.512963][ T10] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 735.643032][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 735.712595][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 735.723098][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 735.755988][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 735.771817][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8422, setting to 1024 [ 735.822609][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 735.870233][ T10] usb 4-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice= 0.00 [ 735.898234][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 735.946004][ T10] usb 4-1: config 0 descriptor?? [ 736.406554][ T10] elecom 0003:056E:00FD.0062: report_id 0 is invalid [ 736.423234][ T10] elecom 0003:056E:00FD.0062: item 0 1 1 8 parsing failed [ 736.469064][ T10] elecom 0003:056E:00FD.0062: probe with driver elecom failed with error -22 [ 736.720112][T15187] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2903'. [ 736.793235][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 736.904266][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 736.939509][T13781] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 736.949300][T13781] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 736.962178][T13781] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 736.971678][T13781] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 736.979425][T13781] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 737.003348][ T5890] usb 4-1: USB disconnect, device number 122 [ 737.112153][T15213] gtp0: entered promiscuous mode [ 737.130121][T15213] gtp0: entered allmulticast mode [ 737.145816][T13748] raw-gadget.0 gadget.1: failed to queue disconnect event [ 737.647370][T15214] chnl_net:caif_netlink_parms(): no params data found [ 737.901341][T15235] netlink: 'syz.3.2916': attribute type 1 has an invalid length. [ 737.924335][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 737.980421][T15214] bridge0: port 1(bridge_slave_0) entered blocking state [ 738.004150][T15214] bridge0: port 1(bridge_slave_0) entered disabled state [ 738.011585][T15214] bridge_slave_0: entered allmulticast mode [ 738.040987][T15214] bridge_slave_0: entered promiscuous mode [ 738.048428][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 738.066664][ T978] usb 5-1: USB disconnect, device number 17 [ 738.171436][T15235] 8021q: adding VLAN 0 to HW filter on device bond7 [ 738.220228][T15214] bridge0: port 2(bridge_slave_1) entered blocking state [ 738.237853][T15214] bridge0: port 2(bridge_slave_1) entered disabled state [ 738.246396][T15214] bridge_slave_1: entered allmulticast mode [ 738.254724][T15214] bridge_slave_1: entered promiscuous mode [ 738.404069][T15214] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 738.467543][T15214] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 738.576291][T15252] FAULT_INJECTION: forcing a failure. [ 738.576291][T15252] name failslab, interval 1, probability 0, space 0, times 0 [ 738.622605][T15252] CPU: 0 UID: 0 PID: 15252 Comm: syz.4.2923 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 738.622633][T15252] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 738.622643][T15252] Call Trace: [ 738.622650][T15252] [ 738.622658][T15252] dump_stack_lvl+0x241/0x360 [ 738.622690][T15252] ? __pfx_dump_stack_lvl+0x10/0x10 [ 738.622714][T15252] ? __pfx__printk+0x10/0x10 [ 738.622735][T15252] ? __lock_acquire+0xad5/0xd80 [ 738.622764][T15252] should_fail_ex+0x424/0x570 [ 738.622788][T15252] should_failslab+0xac/0x100 [ 738.622814][T15252] kmem_cache_alloc_noprof+0x78/0x390 [ 738.622836][T15252] ? skb_clone+0x20c/0x390 [ 738.622860][T15252] skb_clone+0x20c/0x390 [ 738.622882][T15252] __netlink_deliver_tap+0x3c4/0x7f0 [ 738.622918][T15252] ? netlink_deliver_tap+0x2e/0x1b0 [ 738.622939][T15252] netlink_deliver_tap+0x19d/0x1b0 [ 738.622965][T15252] netlink_unicast+0x7c6/0x9a0 [ 738.622994][T15252] ? __pfx_netlink_unicast+0x10/0x10 [ 738.623019][T15252] ? skb_put+0x114/0x1f0 [ 738.623041][T15252] netlink_sendmsg+0x8c3/0xcd0 [ 738.623078][T15252] ? __pfx_netlink_sendmsg+0x10/0x10 [ 738.623106][T15252] ? __import_iovec+0x585/0x830 [ 738.623127][T15252] ? aa_sock_msg_perm+0x91/0x160 [ 738.623156][T15252] ? __pfx_netlink_sendmsg+0x10/0x10 [ 738.623178][T15252] __sock_sendmsg+0x221/0x270 [ 738.623204][T15252] ____sys_sendmsg+0x523/0x860 [ 738.623240][T15252] ? __pfx_____sys_sendmsg+0x10/0x10 [ 738.623276][T15252] __sys_sendmsg+0x271/0x360 [ 738.623301][T15252] ? __pfx___sys_sendmsg+0x10/0x10 [ 738.623370][T15252] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 738.623392][T15252] ? lockdep_hardirqs_on+0x9d/0x150 [ 738.623415][T15252] __do_fast_syscall_32+0xb4/0x110 [ 738.623436][T15252] ? exc_page_fault+0x5f8/0x920 [ 738.623461][T15252] do_fast_syscall_32+0x34/0x80 [ 738.623483][T15252] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 738.623503][T15252] RIP: 0023:0xf7fe1579 [ 738.623517][T15252] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 738.623532][T15252] RSP: 002b:00000000f510655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 738.623551][T15252] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 738.623563][T15252] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 738.623573][T15252] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 738.623583][T15252] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 738.623594][T15252] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 738.623621][T15252] [ 738.982618][ T10] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 738.984315][T15214] team0: Port device team_slave_0 added [ 739.032790][ T5846] Bluetooth: hci2: command tx timeout [ 739.048117][T15214] team0: Port device team_slave_1 added [ 739.150225][T15214] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 739.158203][T15214] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 739.159940][T15267] netlink: 'syz.0.2929': attribute type 1 has an invalid length. [ 739.191475][T15214] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 739.205732][T15214] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 739.213235][T15214] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 739.214925][T15268] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2929'. [ 739.239177][ C1] vkms_vblank_simulate: vblank timer overrun [ 739.254501][ T978] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 739.257964][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 739.263576][T15214] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 739.281050][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 739.296872][ T10] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 739.308631][ T10] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 739.323985][ T10] usb 3-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 739.332673][T15269] 8021q: adding VLAN 0 to HW filter on device bond7 [ 739.337201][ T10] usb 3-1: config 1 interface 1 has no altsetting 0 [ 739.359571][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 739.363806][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 739.368774][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 739.384790][ T10] usb 3-1: Product: syz [ 739.389151][ T10] usb 3-1: Manufacturer: syz [ 739.394138][ T10] usb 3-1: SerialNumber: syz [ 739.402571][ T978] usb 4-1: Using ep0 maxpacket: 32 [ 739.410157][ T978] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 739.430766][ T978] usb 4-1: config 0 has no interfaces? [ 739.439764][ T978] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 739.449133][ T978] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 739.457294][ T978] usb 4-1: Product: syz [ 739.461559][ T978] usb 4-1: Manufacturer: syz [ 739.466261][ T978] usb 4-1: SerialNumber: syz [ 739.475210][ T978] usb 4-1: config 0 descriptor?? [ 739.550852][T15214] hsr_slave_0: entered promiscuous mode [ 739.560069][T15214] hsr_slave_1: entered promiscuous mode [ 739.572357][T15214] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 739.586702][T15214] Cannot create hsr debugfs directory [ 739.658410][ T5846] Bluetooth: hci5: unexpected event for opcode 0x1003 [ 739.666573][ T10] usb 3-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 739.710606][ T10] usb 3-1: MIDIStreaming interface descriptor not found [ 739.860377][ T10] usb 3-1: USB disconnect, device number 49 [ 740.039685][T15214] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 740.194317][T15278] udevd[15278]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 740.234979][T15214] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 740.380522][T15214] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 740.404153][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 740.533832][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 740.664002][T15214] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 740.694070][T15294] dccp_invalid_packet: P.Data Offset(10) too large [ 740.711463][T15294] FAULT_INJECTION: forcing a failure. [ 740.711463][T15294] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 740.728876][T15294] CPU: 0 UID: 0 PID: 15294 Comm: syz.2.2932 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 740.728901][T15294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 740.728913][T15294] Call Trace: [ 740.728920][T15294] [ 740.728928][T15294] dump_stack_lvl+0x241/0x360 [ 740.728960][T15294] ? __pfx_dump_stack_lvl+0x10/0x10 [ 740.728985][T15294] ? __pfx__printk+0x10/0x10 [ 740.729020][T15294] should_fail_ex+0x424/0x570 [ 740.729044][T15294] _copy_to_user+0x31/0xb0 [ 740.729071][T15294] simple_read_from_buffer+0xc4/0x170 [ 740.729101][T15294] proc_fail_nth_read+0x1ef/0x260 [ 740.729124][T15294] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 740.729146][T15294] ? rw_verify_area+0x246/0x630 [ 740.729164][T15294] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 740.729185][T15294] vfs_read+0x21f/0xb90 [ 740.729210][T15294] ? __pfx___mutex_lock+0x10/0x10 [ 740.729233][T15294] ? __pfx_vfs_read+0x10/0x10 [ 740.729256][T15294] ? __fget_files+0x2a/0x420 [ 740.729274][T15294] ? __fget_files+0x39d/0x420 [ 740.729288][T15294] ? __fget_files+0x2a/0x420 [ 740.729314][T15294] ksys_read+0x19d/0x2d0 [ 740.729336][T15294] ? __pfx_ksys_read+0x10/0x10 [ 740.729359][T15294] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 740.729379][T15294] ? lockdep_hardirqs_on+0x9d/0x150 [ 740.729403][T15294] __do_fast_syscall_32+0xb4/0x110 [ 740.729423][T15294] ? exc_page_fault+0x5f8/0x920 [ 740.729448][T15294] do_fast_syscall_32+0x34/0x80 [ 740.729468][T15294] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 740.729488][T15294] RIP: 0023:0xf743d579 [ 740.729504][T15294] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 740.729518][T15294] RSP: 002b:00000000f50c6590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 740.729537][T15294] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f50c6620 [ 740.729549][T15294] RDX: 000000000000000f RSI: 00000000f742dff4 RDI: 0000000000000000 [ 740.729560][T15294] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 740.729571][T15294] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 740.729581][T15294] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 740.729609][T15294] [ 741.112788][ T5846] Bluetooth: hci2: command tx timeout [ 741.400107][T15214] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 741.456674][T15214] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 741.500002][T15214] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 741.548325][T15214] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 741.699106][T15214] 8021q: adding VLAN 0 to HW filter on device bond0 [ 741.763773][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 741.792468][T15214] 8021q: adding VLAN 0 to HW filter on device team0 [ 741.885804][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 741.887188][T13907] bridge0: port 1(bridge_slave_0) entered blocking state [ 741.900719][T13907] bridge0: port 1(bridge_slave_0) entered forwarding state [ 742.017350][T15316] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 742.047888][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 742.055024][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 742.069691][T15316] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 742.143791][T15316] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2941'. [ 742.165961][ T5889] usb 4-1: USB disconnect, device number 123 [ 742.327814][T15319] netlink: 'syz.2.2943': attribute type 5 has an invalid length. [ 742.450612][T15214] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 742.622675][ T5892] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 742.636045][T15214] veth0_vlan: entered promiscuous mode [ 742.663289][T15214] veth1_vlan: entered promiscuous mode [ 742.748746][T15214] veth0_macvtap: entered promiscuous mode [ 742.771074][T15214] veth1_macvtap: entered promiscuous mode [ 742.777996][ T5892] usb 5-1: device descriptor read/64, error -71 [ 742.851993][T15214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 742.888155][T15214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 742.912868][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 742.932305][T15214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 742.954824][T15214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 742.991912][T15214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 743.010087][T15214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 743.027097][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 743.030758][T15214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 743.035498][ T5892] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 743.058162][T15214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 743.075274][T15214] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 743.140623][T15214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 743.152248][T15214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 743.171198][T15214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 743.193723][ T5846] Bluetooth: hci2: command tx timeout [ 743.206047][T15214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 743.223207][ T5892] usb 5-1: device descriptor read/64, error -71 [ 743.223584][T15214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 743.240487][T15214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 743.252124][T15214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 743.265298][T15214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 743.317712][T15214] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 743.333670][T15214] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 743.343080][ T5892] usb usb5-port1: attempt power cycle [ 743.352374][T15214] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 743.366024][T15214] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 743.379649][T15214] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 743.647265][T15343] netlink: 'syz.2.2948': attribute type 1 has an invalid length. [ 743.674938][ T5846] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 743.683107][ T5892] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 743.691270][ T5846] Bluetooth: hci5: Injecting HCI hardware error event [ 743.702343][T13781] Bluetooth: hci5: hardware error 0x00 [ 743.715243][ T5892] usb 5-1: device descriptor read/8, error -71 [ 743.765132][T15343] 8021q: adding VLAN 0 to HW filter on device bond5 [ 743.843167][T15346] bond5: (slave ip6gretap2): making interface the new active one [ 743.882218][T15346] bond5: (slave ip6gretap2): Enslaving as an active interface with an up link [ 744.043298][ T5892] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 744.073826][ T5892] usb 5-1: device descriptor read/8, error -71 [ 744.134483][ T12] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 744.153005][ T1334] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 744.174865][ T1334] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 744.195740][ T5892] usb usb5-port1: unable to enumerate USB device [ 744.235119][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 744.277442][T13907] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 744.295361][T13907] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 744.557869][T15360] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 744.577218][T15360] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 744.613059][ T53] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 744.753438][ T5889] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 744.806918][ T53] usb 3-1: Using ep0 maxpacket: 32 [ 744.861351][ T53] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 744.919346][ T53] usb 3-1: config 0 has no interfaces? [ 744.931810][ T53] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 744.941020][ T5889] usb 4-1: Using ep0 maxpacket: 16 [ 744.968493][ T53] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 744.970580][ T5889] usb 4-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 744.989354][ T53] usb 3-1: Product: syz [ 744.998626][ T53] usb 3-1: Manufacturer: syz [ 745.006000][ T53] usb 3-1: SerialNumber: syz [ 745.010801][ T5889] usb 4-1: config 0 interface 0 altsetting 1 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 745.026298][ T53] usb 3-1: config 0 descriptor?? [ 745.037933][ T5889] usb 4-1: config 0 interface 0 altsetting 1 endpoint 0x89 has invalid wMaxPacketSize 0 [ 745.052066][ T5889] usb 4-1: config 0 interface 0 has no altsetting 0 [ 745.084375][ T5889] usb 4-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 745.103909][ T5889] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.125209][ T5889] usb 4-1: Product: syz [ 745.147121][ T5889] usb 4-1: Manufacturer: syz [ 745.151900][ T5889] usb 4-1: SerialNumber: syz [ 745.168739][ T5889] usb 4-1: config 0 descriptor?? [ 745.273000][ T5846] Bluetooth: hci2: command tx timeout [ 745.316362][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 745.403785][ T5889] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input83 [ 745.443367][ T5892] usb 1-1: USB disconnect, device number 113 [ 745.522937][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 745.537070][ T5201] synaptics_usb 4-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 745.635865][ T5201] synaptics_usb 4-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 745.763341][T15358] synaptics_usb 4-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 745.878478][ T5201] synaptics_usb 4-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 745.923095][T13781] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 746.320682][T15182] synaptics_usb 4-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 746.429441][ T5846] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 746.439678][ T5846] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 746.449683][ T5846] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 746.457687][ T5846] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 746.471867][ T5846] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 746.586835][ T5201] synaptics_usb 4-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 746.676839][ T5201] synaptics_usb 4-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 746.733110][ T5201] synaptics_usb 4-1:0.0: synusb_open - usb_submit_urb failed, error: -90 [ 746.755404][T15347] usb 4-1: USB disconnect, device number 124 [ 747.039774][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 747.120827][T15164] bridge0: port 3(syz_tun) entered disabled state [ 747.156213][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 747.180073][T15164] syz_tun (unregistering): left allmulticast mode [ 747.189280][ T10] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 747.201042][T15164] syz_tun (unregistering): left promiscuous mode [ 747.221061][T15164] bridge0: port 3(syz_tun) entered disabled state [ 747.228704][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.235201][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.454873][ T5888] usb 3-1: USB disconnect, device number 50 [ 747.720469][T15383] chnl_net:caif_netlink_parms(): no params data found [ 747.762673][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 747.879999][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 747.924961][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 747.948580][ T10] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 747.971682][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 747.996598][ T10] usb 5-1: config 0 descriptor?? [ 748.052335][ T10] hub 5-1:0.0: USB hub found [ 748.205258][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 748.269936][T15401] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2961'. [ 748.333982][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 748.381451][T15406] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 748.406383][T15406] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 748.416267][T15406] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 748.425946][T15406] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 748.429006][T15383] bridge0: port 1(bridge_slave_0) entered blocking state [ 748.454922][T15383] bridge0: port 1(bridge_slave_0) entered disabled state [ 748.462379][T15383] bridge_slave_0: entered allmulticast mode [ 748.465910][ T10] hub 5-1:0.0: config failed, can't read hub descriptor (err -22) [ 748.479250][T15383] bridge_slave_0: entered promiscuous mode [ 748.495954][T15383] bridge0: port 2(bridge_slave_1) entered blocking state [ 748.503553][T15383] bridge0: port 2(bridge_slave_1) entered disabled state [ 748.508876][ T10] usbhid 5-1:0.0: can't add hid device: -71 [ 748.511099][T15383] bridge_slave_1: entered allmulticast mode [ 748.524969][ T10] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 748.525380][T15383] bridge_slave_1: entered promiscuous mode [ 748.554660][T13781] Bluetooth: hci1: command tx timeout [ 748.603207][ T96] usb 2-1: new low-speed USB device number 36 using dummy_hcd [ 748.617782][ T10] usb 5-1: USB disconnect, device number 22 [ 748.633683][T15347] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 748.634014][T15383] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 748.660103][T15383] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 748.729667][T15383] team0: Port device team_slave_0 added [ 748.741530][T15383] team0: Port device team_slave_1 added [ 748.773316][T15383] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 748.774645][ T96] usb 2-1: config 0 interface 0 altsetting 129 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 748.780367][T15383] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 748.818362][ T96] usb 2-1: config 0 interface 0 altsetting 129 endpoint 0x81 has invalid wMaxPacketSize 0 [ 748.818392][ T96] usb 2-1: config 0 interface 0 altsetting 129 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 748.818418][ T96] usb 2-1: config 0 interface 0 has no altsetting 0 [ 748.818454][ T96] usb 2-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 748.818475][ T96] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 748.821046][ T96] usb 2-1: config 0 descriptor?? [ 748.839355][T15383] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 748.843323][T15347] usb 3-1: Using ep0 maxpacket: 8 [ 748.851814][T15383] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 748.897322][T15383] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 748.898580][T15347] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 748.925512][T15383] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 748.963735][T15347] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 748.996934][T15347] usb 3-1: New USB device found, idVendor=0755, idProduct=2626, bcdDevice= 0.00 [ 749.040390][T15347] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 749.068962][T15347] usb 3-1: config 0 descriptor?? [ 749.146129][T15383] hsr_slave_0: entered promiscuous mode [ 749.154031][T15383] hsr_slave_1: entered promiscuous mode [ 749.160429][T15383] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 749.168648][T15383] Cannot create hsr debugfs directory [ 749.191287][T15401] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 749.206793][T15401] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 749.283319][T15347] usbhid 3-1:0.0: can't add hid device: -71 [ 749.304988][T15347] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 749.393255][T15347] usb 3-1: USB disconnect, device number 51 [ 749.425777][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 749.467135][ T96] usbhid 2-1:0.0: can't add hid device: -71 [ 749.474547][ T3465] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 749.520857][ T96] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 749.599091][ T96] usb 2-1: USB disconnect, device number 36 [ 750.007833][T15383] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.193478][ T53] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 750.250424][T15383] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.352795][ T53] usb 4-1: Using ep0 maxpacket: 16 [ 750.370527][ T53] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 750.436537][ T53] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8422, setting to 1024 [ 750.439734][T15383] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.452152][ T53] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 750.472114][ T5840] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 750.494171][ T53] usb 4-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice= 0.00 [ 750.504253][ T53] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 750.515271][ T53] usb 4-1: config 0 descriptor?? [ 750.542748][ T3465] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 750.566852][T15383] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.622666][ T5840] usb 5-1: Using ep0 maxpacket: 16 [ 750.630849][ T5840] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 750.634455][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 750.642806][T13781] Bluetooth: hci1: command tx timeout [ 750.654712][ T5840] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 750.664595][ T96] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 750.666254][ T5840] usb 5-1: config 0 interface 0 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 750.684070][ T5840] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 750.698846][ T5840] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 750.708270][ T5840] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 750.716644][ T5840] usb 5-1: Manufacturer: syz [ 750.727470][ T5840] usb 5-1: config 0 descriptor?? [ 750.834617][ T96] usb 2-1: Using ep0 maxpacket: 16 [ 750.835680][T15383] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 750.841595][ T96] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 65, using maximum allowed: 30 [ 750.859843][ T96] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 750.871165][ T96] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 65 [ 750.884404][ T96] usb 2-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 750.886281][T15383] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 750.907156][ T96] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 750.931612][ T96] usb 2-1: config 0 descriptor?? [ 750.951277][T15383] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 750.976218][ T53] elecom 0003:056E:00FD.0063: report_id 0 is invalid [ 750.989725][T15383] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 750.992753][ T53] elecom 0003:056E:00FD.0063: item 0 1 1 8 parsing failed [ 751.023403][ T53] elecom 0003:056E:00FD.0063: probe with driver elecom failed with error -22 [ 751.054267][T15429] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2969'. [ 751.153913][T15442] netlink: 'syz.2.2974': attribute type 1 has an invalid length. [ 751.200345][T15420] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2968'. [ 751.234816][ T53] usb 5-1: USB disconnect, device number 23 [ 751.328651][T15383] 8021q: adding VLAN 0 to HW filter on device bond0 [ 751.346343][ T96] samsung 0003:0419:0001.0064: unknown main item tag 0x0 [ 751.349044][T15383] 8021q: adding VLAN 0 to HW filter on device team0 [ 751.365337][ T5840] usb 4-1: USB disconnect, device number 125 [ 751.369306][ T96] samsung 0003:0419:0001.0064: unknown main item tag 0x0 [ 751.383446][ T96] samsung 0003:0419:0001.0064: unknown main item tag 0x0 [ 751.386880][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 751.390988][ T96] samsung 0003:0419:0001.0064: unknown main item tag 0x0 [ 751.397737][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 751.435810][ T96] samsung 0003:0419:0001.0064: hidraw0: USB HID v0.00 Device [HID 0419:0001] on usb-dummy_hcd.1-1/input0 [ 751.449352][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 751.456580][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 751.472919][ T5892] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 751.566014][T15383] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 751.567007][T15436] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 751.584732][T15436] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 751.606078][T15436] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 751.619197][T15436] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 751.630557][ T10] usb 2-1: USB disconnect, device number 37 [ 751.637856][ T5892] usb 3-1: Using ep0 maxpacket: 32 [ 751.647676][T15383] veth0_vlan: entered promiscuous mode [ 751.659975][ T5892] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 751.668173][T15383] veth1_vlan: entered promiscuous mode [ 751.694338][ T12] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 751.695824][ T5892] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 751.712810][ T5892] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 751.721873][ T5892] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 751.734910][ T5892] usb 3-1: config 0 descriptor?? [ 751.742866][ T5892] hub 3-1:0.0: USB hub found [ 751.758790][T15383] veth0_macvtap: entered promiscuous mode [ 751.772332][T15383] veth1_macvtap: entered promiscuous mode [ 751.797035][T15383] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 751.809374][T15383] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 751.819538][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 751.826173][T15383] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 751.838741][T15383] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 751.848802][T15383] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 751.860204][T15383] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 751.876651][T15383] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 751.887641][T15383] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 751.898413][T15383] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 751.909799][T15383] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 751.921830][T15383] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 751.966981][T15383] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 751.968238][ T5892] hub 3-1:0.0: 1 port detected [ 751.988633][T15383] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 752.013897][T15383] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 752.025201][T15383] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 752.035184][T15383] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 752.046031][T15383] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 752.057719][T15383] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 752.071465][T15383] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 752.088310][T15383] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 752.110097][T15383] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 752.122282][T15383] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 752.161405][T15383] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 752.183604][T15383] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 752.205836][T15383] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 752.220271][T15383] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 752.302314][T15456] FAULT_INJECTION: forcing a failure. [ 752.302314][T15456] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 752.341043][T15456] CPU: 0 UID: 0 PID: 15456 Comm: syz.3.2979 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 752.341072][T15456] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 752.341082][T15456] Call Trace: [ 752.341090][T15456] [ 752.341098][T15456] dump_stack_lvl+0x241/0x360 [ 752.341128][T15456] ? __pfx_dump_stack_lvl+0x10/0x10 [ 752.341151][T15456] ? __pfx__printk+0x10/0x10 [ 752.341187][T15456] should_fail_ex+0x424/0x570 [ 752.341212][T15456] _copy_from_user+0x2d/0xb0 [ 752.341236][T15456] kstrtouint_from_user+0xce/0x1a0 [ 752.341259][T15456] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 752.341282][T15456] ? __lock_acquire+0xad5/0xd80 [ 752.341312][T15456] proc_fail_nth_write+0xac/0x2d0 [ 752.341331][T15456] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 752.341355][T15456] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 752.341379][T15456] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 752.341398][T15456] vfs_write+0x2bc/0xd10 [ 752.341424][T15456] ? fdget_pos+0x247/0x310 [ 752.341445][T15456] ? __pfx_vfs_write+0x10/0x10 [ 752.341468][T15456] ? __fget_files+0x2a/0x420 [ 752.341485][T15456] ? __fget_files+0x39d/0x420 [ 752.341500][T15456] ? __fget_files+0x2a/0x420 [ 752.341525][T15456] ksys_write+0x19d/0x2d0 [ 752.341547][T15456] ? __pfx_ksys_write+0x10/0x10 [ 752.341570][T15456] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 752.341592][T15456] ? lockdep_hardirqs_on+0x9d/0x150 [ 752.341622][T15456] __do_fast_syscall_32+0xb4/0x110 [ 752.341643][T15456] ? exc_page_fault+0x5f8/0x920 [ 752.341668][T15456] do_fast_syscall_32+0x34/0x80 [ 752.341690][T15456] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 752.341711][T15456] RIP: 0023:0xf7f01579 [ 752.341726][T15456] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 752.341740][T15456] RSP: 002b:00000000f5026590 EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 752.341759][T15456] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f5026620 [ 752.341771][T15456] RDX: 0000000000000001 RSI: 00000000f738dff4 RDI: 0000000000000000 [ 752.341782][T15456] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 752.341792][T15456] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 752.341803][T15456] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 752.341830][T15456] [ 752.449927][ T3465] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 752.590491][ T3465] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 752.613499][T15442] bond0: entered promiscuous mode [ 752.619902][T15442] bond_slave_0: entered promiscuous mode [ 752.629995][T15442] bond_slave_1: entered promiscuous mode [ 752.638235][T15442] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 752.651435][T15442] bond6: (slave macvlan2): Enslaving as a backup interface with an up link [ 752.677071][ T5892] usb 3-1: USB disconnect, device number 52 [ 752.693121][ T53] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 752.713427][T13781] Bluetooth: hci1: command tx timeout [ 752.738663][T13907] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 752.748659][T13907] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 752.855616][ T53] usb 5-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 752.856997][ T10] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 752.874553][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 752.886255][ T53] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 752.924073][ T53] usb 5-1: config 0 descriptor?? [ 752.944038][ T53] gspca_main: spca508-2.14.0 probing 8086:0110 [ 752.971045][T15470] netlink: 'syz.1.2984': attribute type 1 has an invalid length. [ 753.013043][ T3465] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 753.044674][ T10] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 753.076772][ T10] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 753.099972][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 753.124283][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 753.146808][ T53] gspca_spca508: reg_read err -32 [ 753.148360][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 753.173525][ T53] gspca_spca508: reg_read err -32 [ 753.186244][ T10] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 753.203228][ T53] gspca_spca508: reg_read err -71 [ 753.230206][ T10] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 753.232049][ T53] gspca_spca508: reg_read err -71 [ 753.261660][ T53] gspca_spca508: reg_read err -71 [ 753.270259][ T10] usb 4-1: Product: syz [ 753.285005][ T10] usb 4-1: Manufacturer: syz [ 753.291590][ T53] gspca_spca508: reg write: error -71 [ 753.305622][ T53] spca508 5-1:0.0: probe with driver spca508 failed with error -71 [ 753.318537][ T10] cdc_wdm 4-1:1.0: skipping garbage [ 753.334618][ T53] usb 5-1: USB disconnect, device number 24 [ 753.340641][ T10] cdc_wdm 4-1:1.0: skipping garbage [ 753.358591][ T10] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 753.381786][ T10] cdc_wdm 4-1:1.0: Unknown control protocol [ 753.612750][ T5888] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 753.623084][ T5892] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 753.772797][ T5888] usb 3-1: Using ep0 maxpacket: 16 [ 753.791924][ T5888] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 753.815793][ T5892] usb 2-1: config 252 has an invalid interface number: 251 but max is 0 [ 753.822926][ T5888] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8422, setting to 1024 [ 753.832182][ T5892] usb 2-1: config 252 has no interface number 0 [ 753.841819][ T5888] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 753.842061][ T5892] usb 2-1: New USB device found, idVendor=0c45, idProduct=6280, bcdDevice=d5.fc [ 753.882669][ T5888] usb 3-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice= 0.00 [ 753.901978][ T5888] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 753.902539][ T5892] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 753.935543][ T5888] usb 3-1: config 0 descriptor?? [ 753.979304][ T5892] gspca_main: gspca_sn9c20x-2.14.0 probing 0c45:6280 [ 753.996463][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 754.141619][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 754.152326][T15461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 754.167011][T15484] FAULT_INJECTION: forcing a failure. [ 754.167011][T15484] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 754.172915][T15461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 754.186697][T15484] CPU: 1 UID: 0 PID: 15484 Comm: syz.4.2988 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 754.186723][T15484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 754.186733][T15484] Call Trace: [ 754.186741][T15484] [ 754.186752][T15484] dump_stack_lvl+0x241/0x360 [ 754.186784][T15484] ? __pfx_dump_stack_lvl+0x10/0x10 [ 754.186807][T15484] ? __pfx__printk+0x10/0x10 [ 754.186845][T15484] should_fail_ex+0x424/0x570 [ 754.186868][T15484] _copy_from_user+0x2d/0xb0 [ 754.186892][T15484] kstrtouint_from_user+0xce/0x1a0 [ 754.186915][T15484] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 754.186939][T15484] ? __lock_acquire+0xad5/0xd80 [ 754.186968][T15484] proc_fail_nth_write+0xac/0x2d0 [ 754.186985][T15484] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 754.187009][T15484] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 754.187032][T15484] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 754.187051][T15484] vfs_write+0x2bc/0xd10 [ 754.187076][T15484] ? fdget_pos+0x247/0x310 [ 754.187095][T15484] ? __pfx_vfs_write+0x10/0x10 [ 754.187118][T15484] ? __fget_files+0x2a/0x420 [ 754.187135][T15484] ? __fget_files+0x39d/0x420 [ 754.187148][T15484] ? __fget_files+0x2a/0x420 [ 754.187173][T15484] ksys_write+0x19d/0x2d0 [ 754.187194][T15484] ? __pfx_ksys_write+0x10/0x10 [ 754.187217][T15484] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 754.187237][T15484] ? lockdep_hardirqs_on+0x9d/0x150 [ 754.187260][T15484] __do_fast_syscall_32+0xb4/0x110 [ 754.187282][T15484] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 754.187298][T15484] ? lockdep_hardirqs_on+0x9d/0x150 [ 754.187321][T15484] do_fast_syscall_32+0x34/0x80 [ 754.187342][T15484] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 754.187361][T15484] RIP: 0023:0xf7fe1579 [ 754.187376][T15484] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 754.187389][T15484] RSP: 002b:00000000f5106590 EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 754.187407][T15484] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f5106620 [ 754.187419][T15484] RDX: 0000000000000001 RSI: 00000000f746dff4 RDI: 0000000000000000 [ 754.187429][T15484] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 754.187439][T15484] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 754.187449][T15484] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 754.187475][T15484] [ 754.570914][ T5888] elecom 0003:056E:00FD.0065: report_id 0 is invalid [ 754.589007][ T5888] elecom 0003:056E:00FD.0065: item 0 1 1 8 parsing failed [ 754.593104][T15461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 754.619874][T15486] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2990'. [ 754.628283][ T5888] elecom 0003:056E:00FD.0065: probe with driver elecom failed with error -22 [ 754.646828][T15461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 754.691905][T15486] netlink: 168 bytes leftover after parsing attributes in process `syz.4.2990'. [ 754.711420][T15486] netlink: 168 bytes leftover after parsing attributes in process `syz.4.2990'. [ 754.720065][T15461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 754.750432][T15461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 754.803613][T13781] Bluetooth: hci1: command tx timeout [ 754.821893][T15476] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2986'. [ 754.976221][ T96] usb 3-1: USB disconnect, device number 53 [ 755.007077][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x4 [ 755.014186][T15461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 755.017230][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x2 [ 755.027286][T15461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 755.051094][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.052249][T15461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 755.061204][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.069513][T15461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 755.075498][ T5840] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 755.106886][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.114965][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.129107][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.137622][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.155189][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.164440][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.177585][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.189585][T15497] sctp: [Deprecated]: syz.0.2993 (pid 15497) Use of int in maxseg socket option. [ 755.189585][T15497] Use struct sctp_assoc_value instead [ 755.192825][ T5892] gspca_sn9c20x: Write register 1002 failed -110 [ 755.210900][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.219567][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.235936][ T5892] gspca_sn9c20x: Device initialization failed [ 755.242428][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.251922][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.265785][ T5892] gspca_sn9c20x 2-1:252.251: probe with driver gspca_sn9c20x failed with error -110 [ 755.270032][ T5840] usb 5-1: Using ep0 maxpacket: 16 [ 755.286554][ T5888] hid-generic 0000:3000000:0000.0066: unknown main item tag 0x0 [ 755.298824][ T5840] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 755.316500][ T5888] hid-generic 0000:3000000:0000.0066: hidraw0: HID v0.00 Device [sy] on syz0 [ 755.328267][ T5840] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8422, setting to 1024 [ 755.358489][ T5840] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 755.375043][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 755.385193][ T5840] usb 5-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice= 0.00 [ 755.396446][ T5840] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 755.436043][ T5888] usb 4-1: USB disconnect, device number 126 [ 755.474592][ T5840] usb 5-1: config 0 descriptor?? [ 755.497462][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 755.920399][T15507] netlink: 'syz.0.2996': attribute type 1 has an invalid length. [ 755.951197][T15507] team0: Port device ip6gretap1 added [ 756.036869][ T5840] elecom 0003:056E:00FD.0067: report_id 0 is invalid [ 756.069103][ T5840] elecom 0003:056E:00FD.0067: item 0 1 1 8 parsing failed [ 756.103771][ T5840] elecom 0003:056E:00FD.0067: probe with driver elecom failed with error -22 [ 756.323731][ T5892] usb 2-1: USB disconnect, device number 38 [ 756.334647][T15491] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2992'. [ 756.503555][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 756.606909][ T5890] usb 5-1: USB disconnect, device number 25 [ 756.675868][ T12] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 757.912743][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 758.055772][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 759.097659][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 759.253336][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 759.861808][T15564] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3012'. [ 759.902674][ T5840] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 759.981197][T15347] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 760.042796][ T96] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 760.065166][ T5840] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 760.082788][ T5840] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 760.102781][ T5840] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 760.142432][ T5840] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 760.171531][ T5840] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 760.193126][T15347] usb 4-1: Using ep0 maxpacket: 8 [ 760.200324][ T5840] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 760.205078][T15347] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 760.222690][ T5840] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 760.242280][T15347] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 760.242919][ T5840] usb 1-1: Product: syz [ 760.250697][ T96] usb 3-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=a0.b5 [ 760.279789][ T96] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 760.280489][ T5840] usb 1-1: Manufacturer: syz [ 760.296862][T15347] usb 4-1: config 0 descriptor?? [ 760.306175][ T96] usb 3-1: config 0 descriptor?? [ 760.325930][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 760.338781][ T5840] cdc_wdm 1-1:1.0: skipping garbage [ 760.356188][ T5840] cdc_wdm 1-1:1.0: skipping garbage [ 760.365622][ T5840] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 760.371565][ T5840] cdc_wdm 1-1:1.0: Unknown control protocol [ 760.403587][T15576] netlink: 'syz.4.3015': attribute type 10 has an invalid length. [ 760.462654][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 760.719371][ T96] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 760.740472][ T96] asix 3-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 760.752221][ T96] asix 3-1:0.0: probe with driver asix failed with error -71 [ 760.780178][ T96] usb 3-1: USB disconnect, device number 54 [ 761.209801][T15556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 761.238048][T15556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 761.279351][T15556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 761.346620][T15556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 761.387205][T15556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 761.397904][T15556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 761.420170][T15596] tipc: Trying to set illegal importance in message [ 761.433704][ T96] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 761.475811][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 761.594515][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 761.612892][ T96] usb 2-1: Using ep0 maxpacket: 8 [ 761.629973][ T96] usb 2-1: config 162 has an invalid interface number: 84 but max is 2 [ 761.639590][ T96] usb 2-1: config 162 has an invalid interface number: 3 but max is 2 [ 761.648707][ T96] usb 2-1: config 162 has no interface number 0 [ 761.655722][ T96] usb 2-1: config 162 has no interface number 1 [ 761.662347][ T96] usb 2-1: config 162 interface 84 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 761.664321][T15556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 761.687144][ T96] usb 2-1: config 162 interface 2 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 761.710663][ T96] usb 2-1: config 162 interface 2 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 761.723860][T15556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 761.739534][ T96] usb 2-1: config 162 interface 2 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024 [ 761.781103][T15556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 761.788214][ T96] usb 2-1: config 162 interface 2 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024 [ 761.815469][ T96] usb 2-1: config 162 interface 2 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 761.817185][T15556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 761.862806][ T96] usb 2-1: config 162 interface 84 has no altsetting 0 [ 761.873306][ T5892] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 761.886865][ T96] usb 2-1: config 162 interface 2 has no altsetting 0 [ 761.905120][ T96] usb 2-1: config 162 interface 3 has no altsetting 0 [ 761.930724][ T96] usb 2-1: New USB device found, idVendor=0e8d, idProduct=763f, bcdDevice=9b.23 [ 761.952007][ T96] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 761.971731][ T96] usb 2-1: Product: syz [ 761.985365][ T96] usb 2-1: Manufacturer: syz [ 761.999957][ T96] usb 2-1: SerialNumber: syz [ 762.048501][ T5892] usb 3-1: config 0 interface 0 altsetting 60 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 762.070485][ T10] usb 1-1: USB disconnect, device number 114 [ 762.087909][ T5892] usb 3-1: config 0 interface 0 has no altsetting 0 [ 762.119652][ T5892] usb 3-1: New USB device found, idVendor=2294, idProduct=425a, bcdDevice=ae.ad [ 762.152119][ T5892] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 762.179736][ T5892] usb 3-1: config 0 descriptor?? [ 762.231775][T15593] IPVS: length: 95 != 24 [ 762.286637][T15593] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 762.299319][T15593] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 762.344566][T13781] Bluetooth: hci0: Opcode 0x0c03 failed: -71 [ 762.365069][ T96] usb 2-1: USB disconnect, device number 39 [ 762.541786][T15596] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 762.561445][T15596] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 762.603413][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 762.746851][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 762.746867][ T30] audit: type=1326 audit(1744519202.014:2123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15602 comm="syz.0.3022" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf746d579 code=0x0 [ 762.753761][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 763.783097][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 763.838090][T15347] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x8001: -71 [ 763.897499][ T3465] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 763.915054][T15347] asix 4-1:0.0: probe with driver asix failed with error -71 [ 763.950135][T15347] usb 4-1: USB disconnect, device number 127 [ 763.992753][ T5840] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 764.167171][ T5840] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 764.197825][ T5840] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 764.230515][ T5840] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 764.261063][ T5840] usb 1-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 764.279145][ T5840] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 764.331439][ T5840] usb 1-1: config 0 descriptor?? [ 764.354370][ T5840] em28xx 1-1:0.0: error: skipping audio endpoint 0x83, because it uses bulk transfers ! [ 764.432666][T15347] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 764.604695][T15347] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 764.625843][T15347] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 764.655791][T15347] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 764.681960][T15347] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 764.702915][T15347] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 764.716830][T15347] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 764.726767][T15347] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 764.742920][T15347] usb 4-1: Product: syz [ 764.747299][T15347] usb 4-1: Manufacturer: syz [ 764.763339][T15347] cdc_wdm 4-1:1.0: skipping garbage [ 764.770036][T15347] cdc_wdm 4-1:1.0: skipping garbage [ 764.779157][T15347] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 764.785347][T15347] cdc_wdm 4-1:1.0: Unknown control protocol [ 764.859546][T15347] usb 1-1: USB disconnect, device number 115 [ 764.954349][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 765.063821][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 765.597297][T15627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 765.673237][T15627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 765.743979][T15627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 765.811698][T15627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 765.876741][T15627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 765.907928][T15627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 765.921285][T15658] openvswitch: netlink: IP tunnel dst address not specified [ 766.116749][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 766.142731][T15627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 766.202719][ T5892] usb 3-1: string descriptor 0 read error: -71 [ 766.235772][ T5892] usb 3-1: ucan: probing device on interface #0 [ 766.245223][T15627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 766.253129][ T5892] usb 3-1: ucan: invalid endpoint configuration [ 766.261131][ T5892] usb 3-1: ucan: probe failed; try to update the device firmware [ 766.269025][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 766.284286][T15627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 766.346187][T15627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 766.721725][ T5890] usb 4-1: USB disconnect, device number 2 [ 766.790029][ T5892] usb 3-1: USB disconnect, device number 55 [ 766.972032][T15684] can: request_module (can-proto-5) failed. [ 767.162732][T11551] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 767.344627][T11551] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 767.402733][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 767.428992][T11551] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 767.478121][T11551] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 10 [ 767.519629][T11551] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 65535, setting to 64 [ 767.530967][T11551] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 767.541187][T11551] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 767.562964][ T5892] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 767.576472][T11551] usb 2-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 767.586327][T11551] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 767.600205][T11551] usb 2-1: Product: syz [ 767.604906][T11551] usb 2-1: Manufacturer: syz [ 767.609550][T11551] usb 2-1: SerialNumber: syz [ 767.618464][T11551] usb 2-1: config 0 descriptor?? [ 767.624217][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 767.650162][T15676] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 767.650811][ T5890] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 767.679462][T11551] ati_remote 2-1:0.0: ati_remote_probe: Unexpected endpoint_out [ 767.722775][ T5892] usb 1-1: Using ep0 maxpacket: 16 [ 767.778744][ T5892] usb 1-1: config 0 has an invalid interface number: 105 but max is 0 [ 767.792692][T15705] FAULT_INJECTION: forcing a failure. [ 767.792692][T15705] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 767.806022][ T5892] usb 1-1: config 0 descriptor has 1 excess byte, ignoring [ 767.814056][ T5892] usb 1-1: config 0 has no interface number 0 [ 767.820219][T15705] CPU: 0 UID: 0 PID: 15705 Comm: syz.3.3057 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 767.820250][T15705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 767.820261][T15705] Call Trace: [ 767.820269][T15705] [ 767.820277][T15705] dump_stack_lvl+0x241/0x360 [ 767.820310][T15705] ? __pfx_dump_stack_lvl+0x10/0x10 [ 767.820334][T15705] ? __pfx__printk+0x10/0x10 [ 767.820371][T15705] should_fail_ex+0x424/0x570 [ 767.820395][T15705] _copy_from_user+0x2d/0xb0 [ 767.820419][T15705] kstrtouint_from_user+0xce/0x1a0 [ 767.820443][T15705] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 767.820469][T15705] ? __lock_acquire+0xad5/0xd80 [ 767.820499][T15705] proc_fail_nth_write+0xac/0x2d0 [ 767.820518][T15705] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 767.820543][T15705] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 767.820568][T15705] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 767.820588][T15705] vfs_write+0x2bc/0xd10 [ 767.820615][T15705] ? fdget_pos+0x247/0x310 [ 767.820635][T15705] ? __pfx_vfs_write+0x10/0x10 [ 767.820659][T15705] ? __fget_files+0x2a/0x420 [ 767.820677][T15705] ? __fget_files+0x39d/0x420 [ 767.820691][T15705] ? __fget_files+0x2a/0x420 [ 767.820718][T15705] ksys_write+0x19d/0x2d0 [ 767.820740][T15705] ? __pfx_ksys_write+0x10/0x10 [ 767.820764][T15705] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 767.820786][T15705] ? lockdep_hardirqs_on+0x9d/0x150 [ 767.820810][T15705] __do_fast_syscall_32+0xb4/0x110 [ 767.820832][T15705] ? exc_page_fault+0x5f8/0x920 [ 767.820858][T15705] do_fast_syscall_32+0x34/0x80 [ 767.820880][T15705] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 767.820901][T15705] RIP: 0023:0xf7f01579 [ 767.820916][T15705] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 767.820929][T15705] RSP: 002b:00000000f5026590 EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 767.820952][T15705] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f5026620 [ 767.820965][T15705] RDX: 0000000000000001 RSI: 00000000f738dff4 RDI: 0000000000000000 [ 767.820976][T15705] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 767.820985][T15705] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 767.820996][T15705] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 767.821023][T15705] [ 768.056170][ C0] vkms_vblank_simulate: vblank timer overrun [ 768.212110][ T5892] usb 1-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 768.221333][ T5892] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 768.229817][ T5892] usb 1-1: Product: syz [ 768.234103][ T5892] usb 1-1: Manufacturer: syz [ 768.238725][ T5892] usb 1-1: SerialNumber: syz [ 768.248135][ T5892] usb 1-1: config 0 descriptor?? [ 768.256426][ T5892] usb 1-1: Found UVC 0.00 device syz (046d:08f3) [ 768.263354][ T5892] usb 1-1: No valid video chain found. [ 768.277185][ T5890] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 768.302270][ T5890] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 768.316407][ T5890] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 768.334336][T15674] netlink: 'syz.1.3046': attribute type 1 has an invalid length. [ 768.338001][ T5890] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 768.356502][T15674] netlink: 'syz.1.3046': attribute type 2 has an invalid length. [ 768.390210][ T5890] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 768.403536][ T5890] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 768.411782][ T5890] usb 3-1: Manufacturer: syz [ 768.419967][T15707] netlink: 'syz.3.3058': attribute type 10 has an invalid length. [ 768.437933][ T5890] usb 3-1: config 0 descriptor?? [ 768.491253][ T5840] usb 1-1: USB disconnect, device number 116 [ 768.753486][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 768.860857][T15699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 768.888094][T15699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 768.931296][ T5890] appleir 0003:05AC:8243.0068: unknown main item tag 0x0 [ 768.941449][ T5890] appleir 0003:05AC:8243.0068: No inputs registered, leaving [ 768.957764][ T5890] appleir 0003:05AC:8243.0068: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 768.973472][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 769.132652][ T5890] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 769.165900][T15699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 769.176881][T15699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 769.243646][T15699] netlink: 43 bytes leftover after parsing attributes in process `syz.2.3054'. [ 769.286234][ T5840] usb 3-1: USB disconnect, device number 56 [ 769.306503][ T5890] usb 4-1: config 0 has no interfaces? [ 769.348052][ T5890] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 769.361464][ T5890] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 769.402582][ T5890] usb 4-1: Product: syz [ 769.405563][T15717] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3062'. [ 769.406772][ T5890] usb 4-1: Manufacturer: syz [ 769.406792][ T5890] usb 4-1: SerialNumber: syz [ 769.473328][ T5890] usb 4-1: config 0 descriptor?? [ 769.502864][T15717] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3062'. [ 769.541896][T15717] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3062'. [ 769.661355][ T5888] usb 2-1: USB disconnect, device number 40 [ 769.742688][ T5840] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 769.848479][T15727] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 769.876271][T15727] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 769.904874][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 769.923468][ T5840] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 769.952462][ T5840] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 769.989015][ T5840] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 770.016469][ T5840] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 770.031181][ T5840] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 770.053199][ T5840] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 770.065329][ T5840] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 770.078188][ T5840] usb 5-1: Product: syz [ 770.104152][ T5840] usb 5-1: Manufacturer: syz [ 770.129065][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 770.168048][ T5840] cdc_wdm 5-1:1.0: skipping garbage [ 770.193298][ T5840] cdc_wdm 5-1:1.0: skipping garbage [ 770.220819][T15733] netlink: 'syz.0.3069': attribute type 10 has an invalid length. [ 770.230345][ T5840] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 770.244625][ T5840] cdc_wdm 5-1:1.0: Unknown control protocol [ 770.687079][T15752] netlink: 'syz.0.3071': attribute type 1 has an invalid length. [ 770.952730][ T5892] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 771.013628][T15720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.049716][T15720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 771.068238][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 771.088908][T15720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.123859][ T5892] usb 1-1: Using ep0 maxpacket: 32 [ 771.150775][T15720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 771.176284][ T5892] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 771.243654][T15720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.258507][ T5892] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 771.286993][T15720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 771.295161][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 771.304479][ T5892] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 771.316638][ T5892] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 771.337723][ T5892] usb 1-1: config 0 descriptor?? [ 771.401592][ T5892] hub 1-1:0.0: USB hub found [ 771.531327][T15720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.569892][T15720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 771.580386][T15762] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3074'. [ 771.591172][T15720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.638064][T15720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 771.698087][ T5892] hub 1-1:0.0: config failed, can't read hub descriptor (err -22) [ 771.727896][ T5892] usbhid 1-1:0.0: can't add hid device: -71 [ 771.746909][ T5892] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 771.814794][ T5892] usb 1-1: USB disconnect, device number 117 [ 771.876826][ T5890] usb 5-1: USB disconnect, device number 26 [ 772.022773][ T5840] usb 3-1: new full-speed USB device number 57 using dummy_hcd [ 772.185384][ T5840] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 772.206215][ T5840] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 772.218642][ T5840] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 772.230337][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 772.241641][ T5840] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 772.261125][ T5840] usb 3-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 772.270515][ T5840] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 772.286127][ T5840] usb 3-1: config 0 descriptor?? [ 772.453244][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 772.589410][T15773] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 772.765093][ T5888] usb 4-1: USB disconnect, device number 3 [ 772.802132][ T5840] lenovo 0003:17EF:6047.0069: item fetching failed at offset 1/5 [ 772.814545][ T5840] lenovo 0003:17EF:6047.0069: hid_parse failed [ 772.820877][ T5840] lenovo 0003:17EF:6047.0069: probe with driver lenovo failed with error -22 [ 772.995376][T15766] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 773.075676][T15766] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 773.145064][ T5840] usb 3-1: USB disconnect, device number 57 [ 773.424385][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 773.652913][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 774.182798][T11551] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 774.342650][T11551] usb 3-1: Using ep0 maxpacket: 16 [ 774.344300][T11551] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 774.344320][T11551] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8422, setting to 1024 [ 774.344335][T11551] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 774.344359][T11551] usb 3-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice= 0.00 [ 774.344371][T11551] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 774.378112][T11551] usb 3-1: config 0 descriptor?? [ 774.592993][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 774.814285][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 774.834981][T11551] elecom 0003:056E:00FD.006A: report_id 0 is invalid [ 774.835007][T11551] elecom 0003:056E:00FD.006A: item 0 1 1 8 parsing failed [ 774.835797][T11551] elecom 0003:056E:00FD.006A: probe with driver elecom failed with error -22 [ 775.090393][T15789] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3083'. [ 775.215514][ T5892] usb 3-1: USB disconnect, device number 58 [ 775.322806][ T5888] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 775.472988][T11551] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 775.482611][ T5888] usb 4-1: Using ep0 maxpacket: 32 [ 775.498394][ T5888] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 775.517006][ T5888] usb 4-1: New USB device found, idVendor=0ac8, idProduct=c301, bcdDevice=82.d5 [ 775.542641][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 775.550681][ T5888] usb 4-1: Product: syz [ 775.562633][ T5888] usb 4-1: Manufacturer: syz [ 775.567657][ T5888] usb 4-1: SerialNumber: syz [ 775.585263][ T5888] usb 4-1: config 0 descriptor?? [ 775.625511][T11551] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 775.635032][T11551] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 775.646444][T11551] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 775.656186][T11551] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 775.684129][T11551] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 775.706303][T11551] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 775.718953][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 775.734493][T15813] netlink: 'syz.1.3093': attribute type 1 has an invalid length. [ 775.738628][T11551] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 775.771972][T11551] usb 5-1: Product: syz [ 775.779874][T11551] usb 5-1: Manufacturer: syz [ 775.819979][T15801] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 775.850809][T15801] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 775.883018][T11551] cdc_wdm 5-1:1.0: skipping garbage [ 775.894951][T15819] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3094'. [ 775.930284][T11551] cdc_wdm 5-1:1.0: skipping garbage [ 775.941650][T15801] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 775.964992][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 775.977133][T11551] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 775.983488][T15819] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3094'. [ 775.997254][T15801] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 776.006786][T11551] cdc_wdm 5-1:1.0: Unknown control protocol [ 776.014474][T15819] FAULT_INJECTION: forcing a failure. [ 776.014474][T15819] name failslab, interval 1, probability 0, space 0, times 0 [ 776.033710][ T10] usb 4-1: USB disconnect, device number 4 [ 776.044049][T15347] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 776.065398][T15819] CPU: 0 UID: 0 PID: 15819 Comm: syz.2.3094 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 776.065423][T15819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 776.065433][T15819] Call Trace: [ 776.065440][T15819] [ 776.065448][T15819] dump_stack_lvl+0x241/0x360 [ 776.065489][T15819] ? __pfx_dump_stack_lvl+0x10/0x10 [ 776.065513][T15819] ? __pfx__printk+0x10/0x10 [ 776.065544][T15819] should_fail_ex+0x424/0x570 [ 776.065567][T15819] should_failslab+0xac/0x100 [ 776.065591][T15819] __kmalloc_cache_noprof+0x73/0x370 [ 776.065613][T15819] ? sctp_add_bind_addr+0x89/0x3a0 [ 776.065641][T15819] sctp_add_bind_addr+0x89/0x3a0 [ 776.065667][T15819] sctp_copy_local_addr_list+0x313/0x500 [ 776.065693][T15819] ? sctp_copy_local_addr_list+0xad/0x500 [ 776.065715][T15819] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 776.065761][T15819] ? sctp_v6_is_any+0x60/0x70 [ 776.065784][T15819] ? sctp_copy_one_addr+0x94/0x360 [ 776.065813][T15819] sctp_bind_addr_copy+0xad/0x3b0 [ 776.065836][T15819] ? sctp_assoc_set_bind_addr_from_ep+0x75/0x190 [ 776.065858][T15819] sctp_connect_new_asoc+0x337/0x700 [ 776.065879][T15819] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 776.065894][T15819] ? sctp_sendmsg+0xf30/0x3620 [ 776.065915][T15819] ? sctp_endpoint_lookup_assoc+0xc9/0x250 [ 776.065930][T15819] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 776.065950][T15819] sctp_sendmsg+0x2009/0x3620 [ 776.065984][T15819] ? __pfx_sctp_sendmsg+0x10/0x10 [ 776.066004][T15819] ? aa_sk_perm+0x96f/0xac0 [ 776.066042][T15819] ? inet_sendmsg+0x330/0x390 [ 776.066067][T15819] __sock_sendmsg+0x1a6/0x270 [ 776.066093][T15819] __sys_sendto+0x365/0x4c0 [ 776.066115][T15819] ? __pfx___sys_sendto+0x10/0x10 [ 776.066144][T15819] ? __fget_files+0x2a/0x420 [ 776.066170][T15819] ? ksys_write+0x275/0x2d0 [ 776.066198][T15819] __ia32_sys_sendto+0xdd/0x100 [ 776.066218][T15819] __do_fast_syscall_32+0xb4/0x110 [ 776.066239][T15819] ? exc_page_fault+0x5f8/0x920 [ 776.066264][T15819] do_fast_syscall_32+0x34/0x80 [ 776.066286][T15819] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 776.066307][T15819] RIP: 0023:0xf743d579 [ 776.066321][T15819] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 776.066335][T15819] RSP: 002b:00000000f50c655c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 776.066354][T15819] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000240 [ 776.066366][T15819] RDX: 0000000000000001 RSI: 0000000004000051 RDI: 0000000080000080 [ 776.066377][T15819] RBP: 000000000000001c R08: 0000000000000000 R09: 0000000000000000 [ 776.066387][T15819] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 776.066397][T15819] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 776.066423][T15819] [ 776.348206][ C0] vkms_vblank_simulate: vblank timer overrun [ 776.622806][T15347] usb 2-1: Using ep0 maxpacket: 32 [ 776.629998][T15347] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 776.641140][T15347] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 776.651424][T15347] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 776.660650][T15347] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 776.689187][T15347] usb 2-1: config 0 descriptor?? [ 776.723050][T15347] hub 2-1:0.0: USB hub found [ 776.862607][ T53] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 776.962070][T15813] bond0: entered promiscuous mode [ 776.990060][T15813] bond_slave_0: entered promiscuous mode [ 777.004133][T15813] bond_slave_1: entered promiscuous mode [ 777.010774][T15813] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 777.032148][T15813] bond1: (slave macvlan2): Enslaving as a backup interface with an up link [ 777.053165][ T53] usb 3-1: Using ep0 maxpacket: 8 [ 777.070656][ T53] usb 3-1: config 252 has an invalid interface number: 165 but max is 0 [ 777.080339][ T53] usb 3-1: config 252 has no interface number 0 [ 777.086381][T15347] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 777.094834][T15803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 777.105436][T15803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 777.126282][T15347] usbhid 2-1:0.0: can't add hid device: -71 [ 777.132343][T15347] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 777.143016][ T53] usb 3-1: config 252 interface 165 has no altsetting 0 [ 777.160929][T15803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 777.184079][ T53] usb 3-1: New USB device found, idVendor=0502, idProduct=16e1, bcdDevice=33.06 [ 777.197054][T15803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 777.206246][ T53] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 777.207662][T15347] usb 2-1: USB disconnect, device number 41 [ 777.216290][T15803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 777.238628][ T53] usb 3-1: Product: syz [ 777.243779][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 777.253567][ T53] usb 3-1: Manufacturer: syz [ 777.288372][T15803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 777.323600][ T53] usb 3-1: SerialNumber: syz [ 777.467387][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 777.514237][T15803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 777.532642][ T10] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 777.558477][ T53] usb 3-1: USB disconnect, device number 59 [ 777.569489][T15803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 777.791661][T15803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 777.817434][T15803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 777.989960][ T10] usb 4-1: config 0 has no interfaces? [ 778.212073][ T10] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 778.302740][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 778.367388][ T10] usb 4-1: Product: syz [ 778.371600][ T10] usb 4-1: Manufacturer: syz [ 778.437639][ T10] usb 4-1: SerialNumber: syz [ 778.490168][ T10] usb 4-1: config 0 descriptor?? [ 778.563272][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 778.772754][ T53] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 778.790398][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 778.995388][ T53] usb 2-1: Using ep0 maxpacket: 16 [ 779.019810][ T53] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 779.057689][ T53] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8422, setting to 1024 [ 779.102939][ T53] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 779.116884][ T53] usb 2-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice= 0.00 [ 779.126126][ T53] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 779.141425][ T53] usb 2-1: config 0 descriptor?? [ 779.186854][ T5840] usb 5-1: USB disconnect, device number 27 [ 779.586944][ T53] elecom 0003:056E:00FD.006B: report_id 0 is invalid [ 779.683388][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 779.693686][ T53] elecom 0003:056E:00FD.006B: item 0 1 1 8 parsing failed [ 779.796545][ T53] elecom 0003:056E:00FD.006B: probe with driver elecom failed with error -22 [ 779.832314][T15860] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3104'. [ 779.973040][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 780.000432][T15873] PKCS7: Unknown OID: [4] 0.38.35.0.951690.11253 [ 780.053059][T15876] netlink: 'syz.2.3107': attribute type 1 has an invalid length. [ 780.072288][T15873] PKCS7: Only support pkcs7_signedData type [ 780.153459][T15876] 8021q: adding VLAN 0 to HW filter on device bond7 [ 780.185523][ T53] usb 2-1: USB disconnect, device number 42 [ 780.254024][T15878] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3107'. [ 780.318165][T15347] usb 4-1: USB disconnect, device number 5 [ 780.378591][T15873] bond7: (slave veth3): Enslaving as an active interface with a down link [ 780.636491][T15886] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3111'. [ 780.647586][T15886] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3111'. [ 780.656829][T15886] FAULT_INJECTION: forcing a failure. [ 780.656829][T15886] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 780.670211][T15886] CPU: 0 UID: 0 PID: 15886 Comm: syz.2.3111 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 780.670227][T15886] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 780.670233][T15886] Call Trace: [ 780.670239][T15886] [ 780.670244][T15886] dump_stack_lvl+0x241/0x360 [ 780.670264][T15886] ? __pfx_dump_stack_lvl+0x10/0x10 [ 780.670277][T15886] ? __pfx__printk+0x10/0x10 [ 780.670296][T15886] should_fail_ex+0x424/0x570 [ 780.670310][T15886] _copy_to_user+0x31/0xb0 [ 780.670326][T15886] simple_read_from_buffer+0xc4/0x170 [ 780.670343][T15886] proc_fail_nth_read+0x1ef/0x260 [ 780.670355][T15886] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 780.670367][T15886] ? rw_verify_area+0x246/0x630 [ 780.670377][T15886] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 780.670388][T15886] vfs_read+0x21f/0xb90 [ 780.670401][T15886] ? __pfx___mutex_lock+0x10/0x10 [ 780.670414][T15886] ? __pfx_vfs_read+0x10/0x10 [ 780.670426][T15886] ? __fget_files+0x2a/0x420 [ 780.670436][T15886] ? __fget_files+0x39d/0x420 [ 780.670444][T15886] ? __fget_files+0x2a/0x420 [ 780.670458][T15886] ksys_read+0x19d/0x2d0 [ 780.670470][T15886] ? __pfx_ksys_read+0x10/0x10 [ 780.670482][T15886] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 780.670493][T15886] ? lockdep_hardirqs_on+0x9d/0x150 [ 780.670506][T15886] __do_fast_syscall_32+0xb4/0x110 [ 780.670518][T15886] ? exc_page_fault+0x5f8/0x920 [ 780.670531][T15886] do_fast_syscall_32+0x34/0x80 [ 780.670543][T15886] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 780.670555][T15886] RIP: 0023:0xf743d579 [ 780.670564][T15886] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 780.670572][T15886] RSP: 002b:00000000f50c6590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 780.670583][T15886] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f50c6620 [ 780.670590][T15886] RDX: 000000000000000f RSI: 00000000f742dff4 RDI: 0000000000000000 [ 780.670596][T15886] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 780.670601][T15886] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 780.670607][T15886] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 780.670622][T15886] [ 780.894634][ C0] vkms_vblank_simulate: vblank timer overrun [ 781.124395][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 781.343554][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 781.600533][ T5889] hid-generic 0000:0000:0000.006C: unknown main item tag 0x0 [ 781.618707][ T5889] hid-generic 0000:0000:0000.006C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 781.702733][ T5840] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 781.762693][ T53] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 781.763892][T15347] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 781.842805][ T5840] usb 3-1: device descriptor read/64, error -71 [ 781.931814][ T53] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 781.944950][ T53] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 781.955357][ T53] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 781.965531][ T53] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 781.976882][T15347] usb 2-1: Using ep0 maxpacket: 16 [ 781.983692][T15347] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 781.989583][ T53] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 782.017919][ T53] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 782.018393][T15347] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8422, setting to 1024 [ 782.027814][ T53] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 782.053204][ T53] usb 1-1: Product: syz [ 782.057386][ T53] usb 1-1: Manufacturer: syz [ 782.068833][ T53] cdc_wdm 1-1:1.0: skipping garbage [ 782.073373][T15347] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 782.076408][ T53] cdc_wdm 1-1:1.0: skipping garbage [ 782.101212][ T53] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 782.107335][T15347] usb 2-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice= 0.00 [ 782.108088][ T53] cdc_wdm 1-1:1.0: Unknown control protocol [ 782.122811][ T5840] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 782.126946][T15347] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 782.151504][T15908] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3118'. [ 782.173848][T15347] usb 2-1: config 0 descriptor?? [ 782.273003][ T5840] usb 3-1: device descriptor read/64, error -71 [ 782.280642][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 782.383549][ T5840] usb usb3-port1: attempt power cycle [ 782.489354][T15912] netlink: 'syz.4.3119': attribute type 1 has an invalid length. [ 782.497666][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 782.620612][T15347] elecom 0003:056E:00FD.006D: report_id 0 is invalid [ 782.629816][T15347] elecom 0003:056E:00FD.006D: item 0 1 1 8 parsing failed [ 782.655639][T15347] elecom 0003:056E:00FD.006D: probe with driver elecom failed with error -22 [ 782.732745][ T5840] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 782.753501][ T5840] usb 3-1: device descriptor read/8, error -71 [ 782.856022][T15901] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3117'. [ 782.949203][T15903] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 782.958637][T15903] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 782.972729][T15903] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 782.982770][ T5889] usb 2-1: USB disconnect, device number 43 [ 782.983955][T15903] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 782.995425][ T5840] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 783.008300][T15903] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 783.021469][T15903] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 783.047933][ T5840] usb 3-1: device descriptor read/8, error -71 [ 783.102642][ T53] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 783.163000][ T5840] usb usb3-port1: unable to enumerate USB device [ 783.253167][T15903] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 783.256173][ T53] usb 4-1: Using ep0 maxpacket: 16 [ 783.267379][T15903] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 783.295908][ T53] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 783.297036][T15903] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 783.319291][ T53] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8422, setting to 1024 [ 783.324654][T15903] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 783.345061][ T53] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 783.361984][ T53] usb 4-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice= 0.00 [ 783.371897][ T53] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 783.384862][ T53] usb 4-1: config 0 descriptor?? [ 783.423014][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 783.558306][ T5840] usb 1-1: USB disconnect, device number 118 [ 783.598259][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 783.730310][T15938] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 783.849342][ T53] elecom 0003:056E:00FD.006E: report_id 0 is invalid [ 783.859723][ T53] elecom 0003:056E:00FD.006E: item 0 1 1 8 parsing failed [ 783.871590][ T53] elecom 0003:056E:00FD.006E: probe with driver elecom failed with error -22 [ 783.944291][T15940] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3126'. [ 784.065687][T15920] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3122'. [ 784.197401][ T5840] usb 4-1: USB disconnect, device number 6 [ 784.212790][ T5892] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 784.373394][ T5892] usb 2-1: Using ep0 maxpacket: 8 [ 784.375347][ T5892] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 784.377322][ T5892] usb 2-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 784.377348][ T5892] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 784.377368][ T5892] usb 2-1: Product: syz [ 784.377383][ T5892] usb 2-1: Manufacturer: syz [ 784.377397][ T5892] usb 2-1: SerialNumber: syz [ 784.381236][ T5892] usb 2-1: config 0 descriptor?? [ 784.385646][ T5892] streamzap 2-1:0.0: streamzap_probe: Unexpected desc.bNumEndpoints (0) [ 784.552698][ T10] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 784.554474][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 784.604900][ T5892] usb 2-1: USB disconnect, device number 44 [ 784.621582][T15955] fuse: root generation should be zero [ 784.714559][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 784.714613][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 784.714649][ T10] usb 1-1: New USB device found, idVendor=1532, idProduct=010e, bcdDevice= 0.00 [ 784.714661][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 784.714691][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 784.728263][ T10] usb 1-1: config 0 descriptor?? [ 784.890092][T15347] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 785.054993][T15347] usb 3-1: Using ep0 maxpacket: 16 [ 785.061023][T15347] usb 3-1: too many configurations: 123, using maximum allowed: 8 [ 785.062730][ T5889] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 785.072801][T15347] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 785.088479][T15347] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 785.100371][T15347] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 785.123885][T15347] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 785.164877][T15347] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 785.185851][ T10] razer 0003:1532:010E.006F: item fetching failed at offset 3/5 [ 785.205528][ T5889] usb 4-1: device descriptor read/64, error -71 [ 785.210881][T15347] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 785.233455][ T10] razer 0003:1532:010E.006F: probe with driver razer failed with error -22 [ 785.257798][T15347] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 785.284297][T15968] FAULT_INJECTION: forcing a failure. [ 785.284297][T15968] name failslab, interval 1, probability 0, space 0, times 0 [ 785.308384][T15347] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 785.328730][T15968] CPU: 0 UID: 0 PID: 15968 Comm: syz.1.3136 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 785.328755][T15968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 785.328766][T15968] Call Trace: [ 785.328773][T15968] [ 785.328781][T15968] dump_stack_lvl+0x241/0x360 [ 785.328812][T15968] ? __pfx_dump_stack_lvl+0x10/0x10 [ 785.328834][T15968] ? __pfx__printk+0x10/0x10 [ 785.328855][T15968] ? __lock_acquire+0xad5/0xd80 [ 785.328882][T15968] should_fail_ex+0x424/0x570 [ 785.328905][T15968] should_failslab+0xac/0x100 [ 785.328929][T15968] kmem_cache_alloc_noprof+0x78/0x390 [ 785.328951][T15968] ? skb_clone+0x20c/0x390 [ 785.328975][T15968] skb_clone+0x20c/0x390 [ 785.328999][T15968] __netlink_deliver_tap+0x3c4/0x7f0 [ 785.329033][T15968] ? netlink_deliver_tap+0x2e/0x1b0 [ 785.329053][T15968] netlink_deliver_tap+0x19d/0x1b0 [ 785.329077][T15968] netlink_unicast+0x7c6/0x9a0 [ 785.329104][T15968] ? __pfx_netlink_unicast+0x10/0x10 [ 785.329125][T15968] ? skb_put+0x114/0x1f0 [ 785.329144][T15968] netlink_sendmsg+0x8c3/0xcd0 [ 785.329176][T15968] ? __pfx_netlink_sendmsg+0x10/0x10 [ 785.329213][T15968] ? __import_iovec+0x585/0x830 [ 785.329235][T15968] ? aa_sock_msg_perm+0x91/0x160 [ 785.329262][T15968] ? __pfx_netlink_sendmsg+0x10/0x10 [ 785.329283][T15968] __sock_sendmsg+0x221/0x270 [ 785.329308][T15968] ____sys_sendmsg+0x523/0x860 [ 785.329334][T15968] ? __pfx_____sys_sendmsg+0x10/0x10 [ 785.329369][T15968] __sys_sendmsg+0x271/0x360 [ 785.329393][T15968] ? __pfx___sys_sendmsg+0x10/0x10 [ 785.329458][T15968] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 785.329479][T15968] ? lockdep_hardirqs_on+0x9d/0x150 [ 785.329501][T15968] __do_fast_syscall_32+0xb4/0x110 [ 785.329520][T15968] ? exc_page_fault+0x5f8/0x920 [ 785.329544][T15968] do_fast_syscall_32+0x34/0x80 [ 785.329566][T15968] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 785.329585][T15968] RIP: 0023:0xf740d579 [ 785.329600][T15968] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 785.329612][T15968] RSP: 002b:00000000f509655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 785.329631][T15968] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 785.329643][T15968] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 785.329653][T15968] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 785.329664][T15968] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 785.329674][T15968] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 785.329697][T15968] [ 785.329878][T15968] netlink: 'syz.1.3136': attribute type 21 has an invalid length. [ 785.558325][T15949] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3130'. [ 785.607151][ T5889] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 785.652966][T15347] usb 3-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 785.682607][T15347] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 785.691039][T15969] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3130'. [ 785.702600][T15347] usb 3-1: SerialNumber: syz [ 785.724254][T15347] usb 3-1: config 0 descriptor?? [ 785.737654][T15347] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input86 [ 785.741356][ T53] usb 1-1: USB disconnect, device number 119 [ 785.749694][T15968] netlink: 'syz.1.3136': attribute type 6 has an invalid length. [ 785.783041][ T5889] usb 4-1: device descriptor read/64, error -71 [ 785.838259][T15968] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3136'. [ 785.933300][ T5889] usb usb4-port1: attempt power cycle [ 785.947943][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 785.983452][T11551] usb 3-1: USB disconnect, device number 64 [ 785.983485][ T5201] bcm5974 3-1:0.0: could not read from device [ 786.055483][T15182] bcm5974 3-1:0.0: could not read from device [ 786.072207][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 786.312942][ T5889] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 786.354687][ T5889] usb 4-1: device descriptor read/8, error -71 [ 786.492617][ T53] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 786.613058][ T5889] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 786.675608][ T5889] usb 4-1: device descriptor read/8, error -71 [ 786.710089][ T53] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 786.795459][T15982] netlink: 'syz.2.3141': attribute type 1 has an invalid length. [ 786.811258][ T53] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 786.862445][ T5889] usb usb4-port1: unable to enumerate USB device [ 786.928570][ T53] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 786.944268][ T53] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 786.958733][ T53] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 786.972852][ T53] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 786.991057][ T53] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 787.009632][ T53] usb 2-1: Product: syz [ 787.019664][ T53] usb 2-1: Manufacturer: syz [ 787.126151][ T53] cdc_wdm 2-1:1.0: skipping garbage [ 787.141410][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 787.172152][ T53] cdc_wdm 2-1:1.0: skipping garbage [ 787.229951][ T53] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 787.266610][ T53] cdc_wdm 2-1:1.0: Unknown control protocol [ 787.273112][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 787.493316][T15347] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 787.662645][T15347] usb 1-1: Using ep0 maxpacket: 16 [ 787.679916][T15347] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 787.703651][T15347] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8422, setting to 1024 [ 787.716722][T15347] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 787.730488][T15347] usb 1-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice= 0.00 [ 787.743865][T15347] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 787.795513][T15347] usb 1-1: config 0 descriptor?? [ 787.811470][T15999] netlink: 'syz.2.3146': attribute type 1 has an invalid length. [ 787.906184][T15993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 787.906684][T15993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 787.908114][T15993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 787.908489][T15993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 787.910286][T15993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 787.910610][T15993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 788.120197][T15993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 788.120571][T15993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 788.127779][T15993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 788.128152][T15993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 788.223594][T15347] elecom 0003:056E:00FD.0070: report_id 0 is invalid [ 788.230994][T15347] elecom 0003:056E:00FD.0070: item 0 1 1 8 parsing failed [ 788.239994][T15347] elecom 0003:056E:00FD.0070: probe with driver elecom failed with error -22 [ 788.293097][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 788.317888][T16012] netlink: 'syz.2.3151': attribute type 21 has an invalid length. [ 788.326470][T16012] netlink: 'syz.2.3151': attribute type 6 has an invalid length. [ 788.335848][T16012] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3151'. [ 788.416131][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 788.442674][ T10] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 788.468725][T15988] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3143'. [ 788.605495][ T10] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 788.676514][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 788.700475][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 788.727092][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 788.776642][ T10] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 788.791966][ T10] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 788.815425][ T10] usb 4-1: Manufacturer: syz [ 788.831128][ T10] usb 4-1: config 0 descriptor?? [ 788.979397][T15347] usb 1-1: USB disconnect, device number 120 [ 789.067856][ T5846] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 789.078268][ T5846] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 789.086570][ T5846] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 789.095069][ T5846] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 789.106032][ T5846] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 789.299892][ T10] appleir 0003:05AC:8243.0071: unknown main item tag 0x0 [ 789.341685][ T10] appleir 0003:05AC:8243.0071: No inputs registered, leaving [ 789.367566][ T10] appleir 0003:05AC:8243.0071: hiddev1,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 789.413978][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 789.429701][ T5892] usb 2-1: USB disconnect, device number 45 [ 789.545704][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 789.584403][T16010] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 789.621531][T16010] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 789.654720][T15921] usb 4-1: USB disconnect, device number 11 [ 789.826237][T16018] chnl_net:caif_netlink_parms(): no params data found [ 789.998312][T16040] netlink: 'syz.0.3158': attribute type 10 has an invalid length. [ 790.271625][T16018] bridge0: port 1(bridge_slave_0) entered blocking state [ 790.299204][T16018] bridge0: port 1(bridge_slave_0) entered disabled state [ 790.317145][T16018] bridge_slave_0: entered allmulticast mode [ 790.337821][T16018] bridge_slave_0: entered promiscuous mode [ 790.355152][T16018] bridge0: port 2(bridge_slave_1) entered blocking state [ 790.380242][T16018] bridge0: port 2(bridge_slave_1) entered disabled state [ 790.399957][T16018] bridge_slave_1: entered allmulticast mode [ 790.414573][T16018] bridge_slave_1: entered promiscuous mode [ 790.514251][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 790.681328][T16058] netlink: 'syz.2.3163': attribute type 10 has an invalid length. [ 790.687499][T16018] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 790.690896][T16018] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 790.696808][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 790.760958][T16058] hsr_slave_0: left promiscuous mode [ 790.761723][T16058] hsr_slave_1: left promiscuous mode [ 790.862781][T11551] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 790.911623][T16018] team0: Port device team_slave_0 added [ 790.930037][T16018] team0: Port device team_slave_1 added [ 790.993372][ T5892] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 791.021589][T11551] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 791.036814][T11551] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 791.051908][T11551] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 791.052492][T11551] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 791.057415][T11551] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 791.059545][T11551] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 791.059570][T11551] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 791.059589][T11551] usb 1-1: Product: syz [ 791.059603][T11551] usb 1-1: Manufacturer: syz [ 791.080221][T11551] cdc_wdm 1-1:1.0: skipping garbage [ 791.080242][T11551] cdc_wdm 1-1:1.0: skipping garbage [ 791.083370][T16018] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 791.083387][T16018] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 791.083410][T16018] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 791.086825][T16018] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 791.086840][T16018] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 791.086862][T16018] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 791.088061][T11551] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 791.088209][T11551] cdc_wdm 1-1:1.0: Unknown control protocol [ 791.184151][ T5892] usb 4-1: Using ep0 maxpacket: 16 [ 791.200579][T13781] Bluetooth: hci0: command tx timeout [ 791.202146][ T5892] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 791.202176][ T5892] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8422, setting to 1024 [ 791.202201][ T5892] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 791.202239][ T5892] usb 4-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice= 0.00 [ 791.202257][ T5892] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 791.212374][ T5892] usb 4-1: config 0 descriptor?? [ 791.242203][T16018] hsr_slave_0: entered promiscuous mode [ 791.422822][T16018] hsr_slave_1: entered promiscuous mode [ 791.429264][T16018] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 791.437297][T16018] Cannot create hsr debugfs directory [ 791.543021][T15921] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 791.636598][ T5892] elecom 0003:056E:00FD.0072: report_id 0 is invalid [ 791.644198][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 791.664655][ T5892] elecom 0003:056E:00FD.0072: item 0 1 1 8 parsing failed [ 791.676817][ T5892] elecom 0003:056E:00FD.0072: probe with driver elecom failed with error -22 [ 791.704330][T15921] usb 3-1: Using ep0 maxpacket: 16 [ 791.730151][T15921] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 791.760153][T15921] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8422, setting to 1024 [ 791.818350][T15921] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 791.857105][T16063] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3165'. [ 791.868295][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 791.873399][T16018] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 791.894615][T15921] usb 3-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice= 0.00 [ 791.906845][T15921] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 791.908809][T16057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 791.943474][T16018] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 791.955247][T15921] usb 3-1: config 0 descriptor?? [ 791.960325][T16057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 791.999760][T16057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 792.038624][T16057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 792.052945][T16057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 792.061904][T16057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 792.115666][T11551] usb 4-1: USB disconnect, device number 12 [ 792.192189][T16018] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 792.212155][T16018] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 792.231609][T16078] [ 792.233965][T16078] ====================================================== [ 792.240972][T16078] WARNING: possible circular locking dependency detected [ 792.247980][T16078] 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 Not tainted [ 792.255093][T16078] ------------------------------------------------------ [ 792.262098][T16078] syz.1.3169/16078 is trying to acquire lock: [ 792.268146][T16078] ffffffff900fd488 (rtnl_mutex){+.+.}-{4:4}, at: do_ip_getsockopt+0x11ae/0x2ba0 [ 792.277189][T16078] [ 792.277189][T16078] but task is already holding lock: [ 792.284621][T16078] ffff88807dbb7228 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_getsockopt+0x131/0x400 [ 792.294710][T16078] [ 792.294710][T16078] which lock already depends on the new lock. [ 792.294710][T16078] [ 792.305102][T16078] [ 792.305102][T16078] the existing dependency chain (in reverse order) is: [ 792.314099][T16078] [ 792.314099][T16078] -> #2 (&smc->clcsock_release_lock){+.+.}-{4:4}: [ 792.322696][T16078] lock_acquire+0x116/0x2f0 [ 792.327722][T16078] __mutex_lock+0x1a5/0x10c0 [ 792.332832][T16078] smc_switch_to_fallback+0x35/0xda0 [ 792.338633][T16078] smc_sendmsg+0x11f/0x530 [ 792.343562][T16078] __sock_sendmsg+0x221/0x270 [ 792.348753][T16078] __sys_sendto+0x365/0x4c0 [ 792.353768][T16078] __ia32_sys_sendto+0xdd/0x100 [ 792.359130][T16078] __do_fast_syscall_32+0xb4/0x110 [ 792.364752][T16078] do_fast_syscall_32+0x34/0x80 [ 792.370116][T16078] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 792.376959][T16078] [ 792.376959][T16078] -> #1 (sk_lock-AF_INET){+.+.}-{0:0}: [ 792.384597][T16078] lock_acquire+0x116/0x2f0 [ 792.389611][T16078] lock_sock_nested+0x48/0x100 [ 792.394888][T16078] do_ip_setsockopt+0x17e9/0x39c0 [ 792.400423][T16078] ip_setsockopt+0x63/0x100 [ 792.405433][T16078] do_sock_setsockopt+0x3b1/0x710 [ 792.410963][T16078] __ia32_sys_setsockopt+0x1f2/0x280 [ 792.416757][T16078] __do_fast_syscall_32+0xb4/0x110 [ 792.422376][T16078] do_fast_syscall_32+0x34/0x80 [ 792.427740][T16078] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 792.434596][T16078] [ 792.434596][T16078] -> #0 (rtnl_mutex){+.+.}-{4:4}: [ 792.441817][T16078] validate_chain+0xa69/0x24e0 [ 792.447103][T16078] __lock_acquire+0xad5/0xd80 [ 792.452293][T16078] lock_acquire+0x116/0x2f0 [ 792.457306][T16078] __mutex_lock+0x1a5/0x10c0 [ 792.462407][T16078] do_ip_getsockopt+0x11ae/0x2ba0 [ 792.467960][T16078] ip_getsockopt+0xef/0x2e0 [ 792.472993][T16078] tcp_getsockopt+0x16f/0x1d0 [ 792.478192][T16078] smc_getsockopt+0x1c6/0x400 [ 792.483387][T16078] do_sock_getsockopt+0x391/0x740 [ 792.488924][T16078] __ia32_sys_getsockopt+0x2a1/0x370 [ 792.494747][T16078] __do_fast_syscall_32+0xb4/0x110 [ 792.500373][T16078] do_fast_syscall_32+0x34/0x80 [ 792.505736][T16078] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 792.512577][T16078] [ 792.512577][T16078] other info that might help us debug this: [ 792.512577][T16078] [ 792.522812][T16078] Chain exists of: [ 792.522812][T16078] rtnl_mutex --> sk_lock-AF_INET --> &smc->clcsock_release_lock [ 792.522812][T16078] [ 792.536401][T16078] Possible unsafe locking scenario: [ 792.536401][T16078] [ 792.543853][T16078] CPU0 CPU1 [ 792.549208][T16078] ---- ---- [ 792.554574][T16078] lock(&smc->clcsock_release_lock); [ 792.559959][T16078] lock(sk_lock-AF_INET); [ 792.566897][T16078] lock(&smc->clcsock_release_lock); [ 792.574798][T16078] lock(rtnl_mutex); [ 792.578791][T16078] [ 792.578791][T16078] *** DEADLOCK *** [ 792.578791][T16078] [ 792.586933][T16078] 1 lock held by syz.1.3169/16078: [ 792.592035][T16078] #0: ffff88807dbb7228 (&smc->clcsock_release_lock){+.+.}-{4:4}, at: smc_getsockopt+0x131/0x400 [ 792.602568][T16078] [ 792.602568][T16078] stack backtrace: [ 792.608443][T16078] CPU: 0 UID: 0 PID: 16078 Comm: syz.1.3169 Not tainted 6.15.0-rc1-syzkaller-00308-gecd5d67ad602 #0 PREEMPT(full) [ 792.608462][T16078] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 792.608472][T16078] Call Trace: [ 792.608480][T16078] [ 792.608488][T16078] dump_stack_lvl+0x241/0x360 [ 792.608513][T16078] ? __pfx_dump_stack_lvl+0x10/0x10 [ 792.608534][T16078] ? __pfx__printk+0x10/0x10 [ 792.608553][T16078] ? print_lock+0x171/0x1a0 [ 792.608571][T16078] print_circular_bug+0x2e1/0x300 [ 792.608589][T16078] check_noncircular+0x142/0x160 [ 792.608610][T16078] validate_chain+0xa69/0x24e0 [ 792.608630][T16078] ? rcu_is_watching+0x15/0xb0 [ 792.608655][T16078] __lock_acquire+0xad5/0xd80 [ 792.608672][T16078] lock_acquire+0x116/0x2f0 [ 792.608685][T16078] ? do_ip_getsockopt+0x11ae/0x2ba0 [ 792.608706][T16078] __mutex_lock+0x1a5/0x10c0 [ 792.608728][T16078] ? do_ip_getsockopt+0x11ae/0x2ba0 [ 792.608745][T16078] ? __lock_acquire+0xad5/0xd80 [ 792.608760][T16078] ? do_ip_getsockopt+0x11ae/0x2ba0 [ 792.608778][T16078] ? __pfx___mutex_lock+0x10/0x10 [ 792.608803][T16078] do_ip_getsockopt+0x11ae/0x2ba0 [ 792.608822][T16078] ? __pfx_do_ip_getsockopt+0x10/0x10 [ 792.608842][T16078] ? schedule+0x163/0x360 [ 792.608857][T16078] ? look_up_lock_class+0x7b/0x170 [ 792.608873][T16078] ? register_lock_class+0x54/0x330 [ 792.608889][T16078] ? __lock_acquire+0xad5/0xd80 [ 792.608903][T16078] ? __mutex_trylock_common+0x184/0x2e0 [ 792.608926][T16078] ? __pfx___mutex_trylock_common+0x10/0x10 [ 792.608947][T16078] ip_getsockopt+0xef/0x2e0 [ 792.608965][T16078] ? __pfx_ip_getsockopt+0x10/0x10 [ 792.608984][T16078] ? smc_getsockopt+0x131/0x400 [ 792.609000][T16078] tcp_getsockopt+0x16f/0x1d0 [ 792.609021][T16078] ? __pfx_tcp_getsockopt+0x10/0x10 [ 792.609040][T16078] ? aa_sk_perm+0x96f/0xac0 [ 792.609061][T16078] ? sock_common_getsockopt+0x2e/0xb0 [ 792.609082][T16078] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 792.609100][T16078] smc_getsockopt+0x1c6/0x400 [ 792.609116][T16078] ? __pfx_smc_getsockopt+0x10/0x10 [ 792.609132][T16078] ? aa_sock_opt_perm+0x79/0x120 [ 792.609151][T16078] ? __pfx_smc_getsockopt+0x10/0x10 [ 792.609167][T16078] do_sock_getsockopt+0x391/0x740 [ 792.609184][T16078] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 792.609200][T16078] ? __fget_files+0x2a/0x420 [ 792.609213][T16078] ? __fget_files+0x39d/0x420 [ 792.609224][T16078] ? __fget_files+0x2a/0x420 [ 792.609237][T16078] __ia32_sys_getsockopt+0x2a1/0x370 [ 792.609254][T16078] ? __pfx___ia32_sys_getsockopt+0x10/0x10 [ 792.609269][T16078] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 792.609286][T16078] ? lockdep_hardirqs_on+0x9d/0x150 [ 792.609302][T16078] __do_fast_syscall_32+0xb4/0x110 [ 792.609322][T16078] ? ret_from_fork_asm+0x1a/0x30 [ 792.609336][T16078] ? lockdep_hardirqs_on+0x9d/0x150 [ 792.609353][T16078] do_fast_syscall_32+0x34/0x80 [ 792.609370][T16078] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 792.609387][T16078] RIP: 0023:0xf740d579 [ 792.609401][T16078] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 792.609413][T16078] RSP: 002b:00000000f507555c EFLAGS: 00000206 ORIG_RAX: 000000000000016d [ 792.609428][T16078] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 792.609438][T16078] RDX: 0000000000000029 RSI: 0000000000000000 RDI: 00000000800000c0 [ 792.609447][T16078] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 792.609458][T16078] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 792.609468][T16078] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 792.609482][T16078] [ 792.644853][T15921] elecom 0003:056E:00FD.0073: report_id 0 is invalid [ 792.647686][ C0] vkms_vblank_simulate: vblank timer overrun [ 792.654292][T15921] elecom 0003:056E:00FD.0073: item 0 1 1 8 parsing failed [ 792.731785][T16071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 792.750042][T15921] elecom 0003:056E:00FD.0073: probe with driver elecom failed with error -22 [ 792.753291][T16071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 793.011399][ C0] vkms_vblank_simulate: vblank timer overrun [ 793.040101][T16057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 793.050740][T16057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 793.068940][T16070] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3167'. [ 793.083473][T16018] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 793.094323][T16018] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 793.176069][T16018] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 793.187181][T16018] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 793.187799][ T5892] usb 3-1: USB disconnect, device number 65 [ 793.256673][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 793.270478][ T5840] usb 1-1: USB disconnect, device number 121 [ 793.284208][T13781] Bluetooth: hci0: command tx timeout [ 793.299522][T16018] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 793.319245][T16018] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 793.328065][T16018] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 793.336620][T16018] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 793.380997][T16018] 8021q: adding VLAN 0 to HW filter on device bond0 [ 793.396434][T16018] 8021q: adding VLAN 0 to HW filter on device team0 [ 793.409368][ T1243] bridge0: port 1(bridge_slave_0) entered blocking state [ 793.416513][ T1243] bridge0: port 1(bridge_slave_0) entered forwarding state [ 793.443164][ T1334] bridge0: port 2(bridge_slave_1) entered blocking state [ 793.450336][ T1334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 793.495286][T16018] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 793.523077][T16018] veth0_vlan: entered promiscuous mode [ 793.531647][T16018] veth1_vlan: entered promiscuous mode [ 793.551991][T16018] veth0_macvtap: entered promiscuous mode [ 793.560608][T16018] veth1_macvtap: entered promiscuous mode [ 793.574565][T16018] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 793.585219][T16018] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 793.593983][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 793.595153][T16018] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 793.613365][T16018] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 793.623294][T16018] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 793.633994][T16018] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 793.643957][T16018] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 793.656394][T16018] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 793.666409][T16018] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 793.679396][T16018] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 793.689692][T16018] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 793.702923][T16018] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 793.715405][T16018] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 793.727551][T16018] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 793.738942][T16018] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 793.749741][T16018] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 793.761211][T16018] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 793.771294][T16018] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 793.781817][T16018] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 793.799492][T16018] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 793.810408][T16018] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 793.820292][T16018] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 793.830914][T16018] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 793.840875][T16018] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 793.851606][T16018] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 793.862284][T16018] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 793.873738][T16018] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 793.882473][T16018] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 793.892331][T16018] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 793.902437][T16018] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 793.930562][T16018] ieee80211 phy26: Selected rate control algorithm 'minstrel_ht' [ 793.952434][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 793.954108][T16018] ieee80211 phy27: Selected rate control algorithm 'minstrel_ht' [ 793.965937][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 793.988421][ T1243] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 793.996694][ T1243] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 794.382804][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 794.713717][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 795.362669][T13781] Bluetooth: hci0: command tx timeout [ 795.493125][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 795.823249][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 796.613088][ T12] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 796.943203][ T1243] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 797.432717][T13781] Bluetooth: hci0: command tx timeout [ 797.762685][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 798.062705][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 798.862786][ T3527] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 799.173046][ T12] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 799.993345][ T12] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 800.292851][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 801.102669][ T36] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 801.393462][ T1334] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 802.212935][T13907] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured!