last executing test programs: 16.619300542s ago: executing program 0 (id=1471): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e23, 0x3, 'none\x00', 0x0, 0xd48, 0x55}, {@remote, 0x4e23, 0x2000, 0x3, 0x12d5c, 0x12d5c}}, 0x44) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r3 = socket$inet6(0xa, 0x1, 0x84) setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000080)=0x2, 0x4) sendto$inet6(r3, &(0x7f0000000000)="cc34", 0x2, 0x0, &(0x7f00000000c0)={0xa, 0xfffc, 0x27b6a97, @private2, 0x9}, 0x1c) getsockopt$bt_hci(r3, 0x84, 0x6d, &(0x7f00000006c0)=""/4097, &(0x7f0000000040)=0x1001) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) read(r2, &(0x7f00000004c0)=""/205, 0xcd) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000000f14010000008000fedbdf250c00450072fd45006973736d"], 0x28}, 0x1, 0x0, 0x0, 0x4004011}, 0x0) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[], 0x60}}, 0x20040804) gettid() r6 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, "c8444943470da91b", "42f3ac0e0b8a32be8fe91c368e60693800000000d6e5394b00", "e7198360", "f7a5c1777af05eaa"}, 0x38) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x20003, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000000000000d0000000100000001000000000000800100000006000000fdfffeff"]) sendto$inet6(r6, 0x0, 0x0, 0x8000, 0x0, 0x0) write$binfmt_aout(r6, 0x0, 0xfdef) 14.840453466s ago: executing program 2 (id=1473): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{0x8100}, 'syz1\x00', 0xa}) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x8) socket$inet6_sctp(0xa, 0x801, 0x84) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x80, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6(0x10, 0x80000, 0x3) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x1000, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f00000001c0)=@mmap={0x0, 0x1, 0x4, 0x20, 0x0, {0x77359400}, {0x4, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x291d}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000100)=0x1) socket$inet6_sctp(0xa, 0x801, 0x84) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x893}, 0x24040084) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f00000000c0)=0x1) ioctl$VIDIOC_S_AUDIO(r4, 0x40345622, &(0x7f0000000040)={0xffffff20, "984c323de8fed63723b821c9a59a4006f7feede6e56d4cad6c8ad393b58ba111"}) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xf) ioctl$UI_DEV_CREATE(r0, 0x5501) 14.740039294s ago: executing program 3 (id=1475): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x2, 0x6}}, 0x20) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r2, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000a80)) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x14, 0x0, 0x1}, 0x14}}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x20, r5, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x48050}, 0x0) socket$pppoe(0x18, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1d1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r6 = getpid() sched_setscheduler(r6, 0x1, &(0x7f0000000100)=0x5) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="180000002e00010026bdf000fcdbdf1b04000000040010"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) close(0x3) r8 = syz_open_dev$vim2m(&(0x7f0000000040), 0x40003, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r8, 0xc0405602, &(0x7f0000000000)={0x18, 0x1, 0x0, "6906007722366ccee4ba568eb4f80102f5372f2c74f6024305f11fd3454ad23d", 0x3436324d}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) connect$unix(r9, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) socket$nl_generic(0x10, 0x3, 0x10) close_range(r10, 0xffffffffffffffff, 0x0) 13.560014061s ago: executing program 0 (id=1476): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r0 = socket(0x1e, 0x2, 0x0) r1 = socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x4000000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x1000000000, 0x7, 0xfa11, 0xffffffff}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000480), 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') getdents(r4, &(0x7f0000001fc0)=""/184, 0xb8) mknodat$loop(r4, &(0x7f0000000000)='./file0\x00', 0x4, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f00000002c0)="a879146e918aa89e87e795420a780416137d6a2aa491c1f759c7c60e4407f16b85d033ede3e9fad4bd4f7db71316c936bd022de61626ca024cad913686a797e3acd17ccc499c34cd38e654f024bd54631e411c5586ac9812abae94ce9e456e4c71d2b73ec73327c8b5855c51da1cb6d2fc06239934f041bd898dd72a969f2f65f631d0d7b74234", 0x87, 0x800, &(0x7f0000000400)=@abs={0x1, 0x0, 0x4e23}, 0x6e) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x5}], {0x14}}, 0xa4}}, 0x0) r7 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r7, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r7, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) r8 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r9 = syz_open_pts(r8, 0x0) ioctl$TCSETA(r9, 0x5406, &(0x7f0000000200)={0xfffe, 0x80, 0xe000, 0xb3, 0x17, "041000"}) ioctl$TIOCSTI(r9, 0x5412, &(0x7f0000000140)=0x4) openat$dlm_control(0xffffffffffffff9c, 0x0, 0xad82, 0x0) syz_usb_connect(0x6, 0x3b, &(0x7f0000000100)=ANY=[], 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth0_to_team\x00'}) 12.451107391s ago: executing program 3 (id=1479): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2000000) syz_kvm_setup_cpu$x86(r4, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r4, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0], 0x0, 0x14, &(0x7f0000000300)=[{}], 0x8, 0x10, &(0x7f0000000340), &(0x7f0000000380), 0x8, 0xf9, 0x8, 0x8, &(0x7f00000005c0)}}, 0x10) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000600)={'ip6_vti0\x00', &(0x7f0000000540)={'syztnl2\x00', r7, 0x4, 0x9, 0x0, 0xf7, 0x48, @private2={0xfc, 0x2, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x700, 0x8000, 0x3, 0x3}}) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r8, 0x6, 0x1e, 0x0, &(0x7f0000002000)) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'macsec0\x00', 0x100}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000240)={'macsec0\x00', 0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0xb, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) pipe2$watch_queue(&(0x7f0000000100), 0x80) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = openat$vimc1(0xffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_S_CROP(r10, 0x4014563c, &(0x7f0000000140)={0x2, {0x3, 0x10001, 0x3, 0xfff}}) r11 = socket(0x1, 0x803, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001900)=ANY=[@ANYBLOB="580000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="46060900000000002800128009000100766c616e00000000180002800c0002001f0000001f000000060001000100000008000500", @ANYRES32=r12, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r12], 0x58}, 0x1, 0x0, 0x0, 0x600}, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x1) 11.62595914s ago: executing program 2 (id=1480): socket$inet6_tcp(0xa, 0x1, 0x0) pipe2(&(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) splice(r1, 0x0, r0, 0x0, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket(0x1e, 0x4, 0x0) r5 = syz_open_dev$swradio(&(0x7f0000001a40), 0x0, 0x2) poll(&(0x7f0000002140)=[{r5, 0x240}], 0x1, 0x10000000) ioctl$VIDIOC_QUERYBUF_DMABUF(r5, 0xc04c5609, &(0x7f0000001b00)={0x0, 0xb, 0x4, 0x400, 0x10, {}, {0x1, 0xc, 0x3, 0x7, 0x1, 0x7, "3b6e9a52"}, 0x6, 0x4, {}, 0x3}) r6 = getpgrp(0xffffffffffffffff) r7 = syz_usb_connect$sierra_net(0x3, 0x3f, &(0x7f00000002c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x7, 0x2, 0x3ff, 0x9, 0x0, 0x7}, {0x9, 0x5, 0x8, 0x2, 0x40, 0x9, 0x7, 0x2}, {0x9, 0x5, 0x1, 0x3, 0x40, 0x5, 0x4, 0xff}}}}}}]}}, 0x0) syz_usb_control_io$sierra_net(r7, &(0x7f00000003c0)={0xc, &(0x7f0000000440)={0x40, 0x2, 0xfc, {0xfc, 0x5, "571f525328a1ea7e688293d91566d7f6acd1d7a87f78f71a9c888678aebd8bd4209a72a852bf318b11dd697d9b44922ece6173ddebdad093b75042d4fc4f297cd77331fc77c2bcec5bcfcb870fc95915a0564c126f235f7218230f417e5cc79f06681ed474495e433a057413582839f440dc1e5ea8dea5c745574569a81ab901f98e777d43f87ff0063dfff57be954cf60992a9fa4f18d141287367a1e72afda408a0d28487d6cc5d6c1ff08cb662639a222688c3843d61e2cbf508ad094a3cef632e662b0838f6d36bdf7ca380eeb152504cc40de104e8140f18e629a18dfefe82b7c034de5fbbca4f302259ac1d25d530d4e1a85f7bd99c97e"}}, &(0x7f0000000380)={0x0, 0x3, 0x34, @string={0x34, 0x3, "9750234c4929d563679dc427cf24347c9a56734d0d33d061c1bb154ed13d2d847724a22befea201fa1437b09a58d923dec55"}}}, &(0x7f00000006c0)={0x10, &(0x7f0000000580)={0x20, 0x18, 0xbd, "6cb3a67cffae167a572ff08b9adfc52d7b3265ca93d4b24d524ad11919f28eaf61d4890ae6e570ac57783296ecf6d1cb88f81c0e75eb7186ab97b6d6c3a899318c6de7992aed5712a5dcc8e6f6ad2e0b8d443e5e91c60617a5ca09d7c9860f4ccf6f936d9bdb60063384b8b99759e3e7ef552f13225a4853c4015914cc92b5bc053bf9dd05fff244ae95cbc593a9ff7c9114da88862681776df7a4260aa871395e0a9d59319cd487801477410882a313ce8800227b49d76e4fe66266ed"}, &(0x7f0000000880)={0xa1, 0x1, 0x400, "7786abf0ffa73e293d0fa654de167fd4bfa41e7cb80a492395d2fc89265c165eeb77bc7faab858305cc25e34336bd222808440d4b2324951028adc2f3e1b7acbbd5b05b361b751d5689f7b80c3a6714346768279a6146d3df43c2000f3319fbad351b81dbc769dcbbbcd64f32e5965a50ea561b3665e68c6f301b80e9ab35c9fa8928fb7c8aba311bc741f535eec2c5f5bce5b7715c727a55c2d0abaf2fd588865b7705b0989c204009ad45ed85069626fc5df7f0affc0794ba7c8fb15b5ab86f5bd4de896a4a797ff07ce2724bbeeb14517183caddd970cf3ed112e3bc4b87d8ba35206c91e01677335a41c8691c609bea4c8f8d58e619c929badbc26f452ee0e120d4ac4c7433425a8616eb89542b53c99ee3829427e5d56fd60302472ba4dcbf28a812c3c9ab65952c9c6c134472b84ef43fd5dbb06d9704e51c0cf4b4bc10aac004321982e06f6f58c02ca00edd71fcbaa20385975eb9ee758dd8ace6309936ac2cba37b77d5dbb963ef2427ad3910469ec5518cd85e86d01b35305bddddc9b1d0519d867d0a096e0b5e9b2cf149f5d7fec3af8e7827fe5c15d7bf9a58e006d7ce098d901f5796e7c7ea8020788aee2f4b440e56dc0dd51ab3c6ed87b23dec7aacc5f0b75638abe193becde13da3a30333395a1d503f4dd5ca76c156475c98de420594bf8373d4dae3be5c4751fcbcea34180ce1c3cb714bff2a2bd261359d2b3fa359dcc1e5554c33069f0ee3a71d22346893188b458d3a74f423759a7daf1a9eed2a6df114281b90092fa103cf275478b002a3a9925b805d7238fb9252c9dd20e0d1e53c1b51b156d363e319d3c12d28491a8fe714685ce2bb1e459b645dcbbbaac77783b3fa443b36f409a323adb2e67bd5ec9f0da8d7428a4c3a8698b0cdc5497daabc3421e4054ea1027d5e6109858383e7d87f94e69e4a7915f8afa5fa8a607b0163e1c67addd87e31dd9f568851741efbcd1494b6e7bb1b1fda4cdba64d07bbab2297da3a0de21f532cc0e24d2e1323597d493a64f02e722a80e53632bbfbe4fd2e0cb36d292962edb5a32bf45557cdbc64e0a1de95d6bcb4d0b6b42c463da2cfe5c46545a9d77b9535d0fb7dab4aa319560d8d1d4749bb4a95d8646b0acb0d3baf8a4c5b6198af1226e095c7574ccbc279e4013a49cccee71f8f727a5b41ce030b1dc7ff9ce404fe0551f691d6f66e3381ceb7fe6e7dc8b6d128e5cf77ec105ec30dbccaca9a5061fbd7fe4c03e4ed45d4d9b05a7560a8ae566e15373313b86fa3f860719d04bf94660a88f4ca230584842d8372a5d49aecc4880a614da61bb1edcf7520e8684a66ed177a501ac3b9f1ec02c81f5767a6e23a710a1953f4f095d1a8cdf8a60ce3c859ea937a6b9f94930aa967f6703e3dfd30f671b39fcb9aa16387b845c38c5b637376bd34f66b8a5d242d69c944e8c4bbcdbc"}, &(0x7f0000000680)}) capset(&(0x7f0000000040)={0x20071026, r6}, &(0x7f0000000800)={0x9e0, 0x7fffffff, 0x1, 0x2, 0x4, 0x7}) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req={0xb, 0x6f9f, 0xfffffffb, 0x18000000}, 0x10) recvmsg$unix(r4, &(0x7f0000000100)={0x0, 0x1d, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1}, 0x20) sendmmsg(r4, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmsg$unix(0xffffffffffffffff, 0x0, 0x20) recvmsg$unix(0xffffffffffffffff, 0x0, 0x20) ioctl$VIDIOC_SUBDEV_S_FMT(0xffffffffffffffff, 0xc0585605, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r8 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r8, 0x5000943f, 0x0) unshare(0x24020400) r9 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r9, 0x114, 0xa, &(0x7f0000000700)=ANY=[@ANYBLOB="bbdf190c975f2dd2214ba8429c01fa5201ef21dc142af9ee38dc98a464e85d7afd6017d122eff76ebebed7cceb0b4e364dbee5f9a6131fe4db79a792682392cf7c69c62ac7b76533a27d363530d23019d61bea050e8cab5def4a1a380b049ca4514831beee10ebdfaaf29d392d52de5afcf54164a401ac7e7ec38de735b66201fe78bde4d50052e62fe8a9d49c08419fd5dfda4609b7b4bf86b533ab683603c6552b57dc06aee5cb4be235fae23a3ca4e64704554b704905e723f09529e18fa379801082f34669600ab759c4e94950"], 0x4) 10.563662552s ago: executing program 3 (id=1482): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r2, &(0x7f00000007c0)=[{{&(0x7f00000000c0)={0xa, 0x4e22, 0x4, @remote, 0x7}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000280)="e9", 0x1}], 0x1}}], 0x1, 0x931766f6319ee554) shutdown(r2, 0x1) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000001100)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000200)=@assoc_value, &(0x7f0000001080)=0xffffff98) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, 0x0, &(0x7f0000000180)=0xfffffffffffffd44) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x101, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r5, 0x4008ae90, &(0x7f0000000140)=ANY=[@ANYRES16=r5]) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(r5, 0x4008ae90, &(0x7f0000000040)=ANY=[@ANYRES32=r5]) openat$iommufd(0xffffffffffffff9c, 0x0, 0x12101, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f000057a000/0x1000)=nil, 0x1000, 0x0, 0x3fe, 0x1c0000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r6 = mq_open(&(0x7f000084dff0)='z\xbf\x17', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000040)={0x0, 0x6, 0x101}) syz_io_uring_setup(0x239, 0x0, &(0x7f0000000180), &(0x7f00000001c0)) mq_timedsend(r6, 0x0, 0x0, 0x0, 0x0) 10.562815385s ago: executing program 1 (id=1492): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) writev(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\a\x00\x00B\x00'], 0xfe33) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(0xffffffffffffffff, 0xc25c4110, 0x0) r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="b70b2cbd7000fcdbdf250f0000000e0002"], 0x24}, 0x1, 0x0, 0x0, 0x8}, 0x2000c88c) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, r0, 0x800, 0x70bd2b, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xf}}]}, 0x5c}, 0x1, 0x0, 0x0, 0xc040}, 0x90) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000500)={0x0, 0xb390}, &(0x7f0000000540)=0x8) syz_open_procfs(0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, 0x0) pread64(r1, 0x0, 0x0, 0xadc) mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000080)={0xb, 0x0, 0x40000}, 0x20) timer_create(0x3, 0x0, &(0x7f00000000c0)=0x0) timer_settime(r2, 0x0, 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000f80)={0x18, 0x88, 0xfa00, {0xffffffffffffffff, 0x0, 0x2, @in={0x2, 0x0, @broadcast}}}, 0x90) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r3, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect) ioctl$USBDEVFS_SETCONFIGURATION(r3, 0x80045505, &(0x7f0000000000)=0x1) 10.418132725s ago: executing program 1 (id=1483): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x94, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x74, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x18, 0x3, "c6a41d106c720000000000000000000002000000"}, @NFTA_MATCH_NAME={0xa, 0x1, 'owner\x00'}]}}}, {0x20, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x53}]}}}, {0x10, 0x1, 0x0, 0x1, @numgen={{0xb}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xbc}}, 0x4048010) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) connect$inet(r1, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x529100, 0x0) ioctl$TIOCSLCKTRMIOS(r3, 0x80047437, 0x0) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) 9.924169685s ago: executing program 4 (id=1484): io_setup(0x1fd, &(0x7f0000000480)=0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x11, &(0x7f0000000040)=0x5f, 0x4) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xb, 0x0, 0x0) getrandom(0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_open_dev$sndctrl(&(0x7f0000000240), 0x3, 0x404302) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000380), 0x6d0240, 0x0) symlink(&(0x7f0000000680)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000059c0)='./file0\x00') r3 = syz_io_uring_setup(0x10e, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x3, 0x801}, &(0x7f0000000340)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) ioctl$KVM_GET_MSRS_sys(0xffffffffffffffff, 0xc008ae88, &(0x7f0000001680)={0x8, 0x0, [{0x84f, 0x0, 0x1}, {0x3a2, 0x0, 0x1}, {0x984}, {0xaa0, 0x0, 0x778de50e}, {0x1a6, 0x0, 0x1}, {0x238, 0x0, 0x1000}, {0xa3d, 0x0, 0xf}, {0x814, 0x0, 0x200}]}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000040)='./file0/file0\x00', 0x60, 0x185100}) ioctl$UI_DEV_CREATE(r3, 0x5501) io_uring_enter(r3, 0x7277, 0x0, 0x28, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_open_dev$sndctrl(&(0x7f0000000040), 0x80000000, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r2, 0x942e, 0x0) open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x0) io_submit(r0, 0x0, 0x0) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001940)=ANY=[@ANYRESHEX=r1, @ANYRESDEC=r5, @ANYBLOB="0000000000000000000000087b7be5000000000fb5fc999ef1bd0d6e7190c58604dcc5496ecd71a81f40d4d49f89fcea2a5ec2140931f5f36b529c6e5a7b69479861037b471e45eca57d22a1838d24825d8b513052aa735a07a1aca98f268aad866bcc1b1a539b3c7e25a1e5d0b769ecf59c798795d7b53de8059ae3f4a0a52550c9ed516044c305ebffbb23a04b7a956c1d52d9b0f1b22a89bae77161bebe5264f0953fff65e3b0342ec0696fca037c5e2517178c5e4ed8c2a6fb4cdc18e5b28617053089b7778cd94aad7b1befbdcc6d74498f8cd198dfd6c60242af7475820b47984f6036da899b1462d15e752c8d986d5414da43c2546dc58e8723280fa3eba440ebf328e434db930ec0a59706cde1175430a600f5107cbe26c5f56448b07c03b01ab20dbb7b6771d52e790f9283904ea9bfdb581533e97fb3920417618c524a14a8fada92f6a864e16b9dd2bd1b849bbd7d1424b06a5c7f2c8157c27eecb32adae6f055d0d556f925341ca4fcfe622757973267ed1a89798e57ed696f92c723528ff52560c00b80fc75398273abb9", @ANYRESDEC=r0, @ANYRESDEC=0x0, @ANYRES64=r3], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0xe, &(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000232700007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000020000008500000082000000180000000300000000000000000000809500000000000000"], &(0x7f0000000980)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x38, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) migrate_pages(0x0, 0x3, &(0x7f00000002c0)=0x7f, &(0x7f0000000300)=0xa) 9.048412497s ago: executing program 0 (id=1485): r0 = socket(0x200000000000011, 0x2, 0xd) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'syz_tun\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x800, r1, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) r2 = socket(0x200000000000011, 0x2, 0x0) bind$packet(r2, &(0x7f0000000080)={0x11, 0x800, r1, 0x1, 0x0, 0x6, @random="933c547ecfa7"}, 0x14) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x9}, 0x8) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r4, 0xc0045006, &(0x7f0000000180)=0x70) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) quotactl_fd$Q_SYNC(r4, 0xffffffff80000100, 0x0, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r8 = syz_open_dev$dri(&(0x7f00000008c0), 0x1, 0x400) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r8, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, r9, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r8, 0xc06864ce, &(0x7f0000000340)={r10, 0x0, 0x0, 0x0, 0x1, [0x0], [0x0, 0x7], [0x0, 0x80000006, 0x2], [0x4, 0x0, 0x1, 0x5]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0x806}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r7, 0xc00c642d, &(0x7f0000000080)={r11, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r8, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r12}) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xe0}, 0x2a, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000000)) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x32, &(0x7f0000000040)={@random="e90c610faca2", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2, 0x1, 0x2, 0xc, 0x100}}}}}}}, 0x0) 8.798294997s ago: executing program 4 (id=1486): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x44) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x1370, &(0x7f0000000380)={0x0, 0x49fa, 0x10, 0x1, 0x4e}, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x3, 0x180, 0x4, 0x3, 0xf1, 0x50, 0x7fffffffffffe, 0x5, 0x0, 0x9, 0xfffffffffffffffd, 0x2, 0x9, 0x5], 0xffff1001, 0x120182}) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000200)={0x0, 0x0, 0x300f}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) bind$l2tp(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x40}}, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r10 = dup3(r9, r8, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340), 0x0, 0x0, 0x0}) io_submit(r6, 0x6, &(0x7f0000000880)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0xfffb, r7, &(0x7f0000000180), 0x0, 0x5, 0x0, 0x0, r7}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2, 0x9, r7, &(0x7f00000002c0)="0b2d81286eda73f008b0034a52b0cdc96b7de4af2f", 0x15, 0xffff, 0x0, 0x1}, 0x0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x6, 0x5, r0, &(0x7f0000000480)="143aac26bbdd816b0ad05c9644d01da2a810df005c9b68d173f9c937b335ddc2aa07521a1f5c6e55baffd6561e097d4ffcfce5fc8e285b5786b231dbaf6656192d5ea90b88aac3271636fb9716ece81c4dab20bb793e9c5c439467ab5ea5a91326f718f052975cbda9a3460bd9e4b058e3262de05a1a42adb9cd7a72422d2d582d99715f645eaf72689a8e96011df74f8c8f0e21afe1057197ab84dad3304bdc532959847ba0145c1726b1f919c686791bbf7baa61b053d1f7f52c9f0cb85391c396c13032e738c357d09aa6a3bfcd76f0a749712ed453a8dc587b44bc669258e998c722b401a21d330c369b6cc99d067a42a88aac1a9de593e92f8c", 0xfc, 0x7000000000000000, 0x0, 0x0, r7}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x7, 0x97cf, r0, &(0x7f00000005c0)="c2baa20c52103d00d677cdcec0bac54441e2e3f8aa905a16cf022a36656a57feeb2baed817f3181157ec749fbc86b1780bc53a79d1811c55a13ec74bac395d761223b41bf38870fb1587260b211cffdd3826a46c4efee7ba08b700e9b32355e729f321250d08a51735e52bf0538a305d55434c96562d589defac1409a6c88129812e9949d617777a756dd298bc439eb196dbec2862d7e0c103c1e28cb02f48711164840000fc02d162abe28fea73d06120e364023d0fb3c5a4b62cd0eac66764235e0700cdfb6fefc90e09843bd0f3c9dc406deeb27746b3b9999365886d3ca569e0cd", 0xe3, 0x0, 0x0, 0x3, r7}, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x5, 0x7794, r7, &(0x7f0000000780)="be681e43285d7100bf09425f6578f01e0a0a97ce728c6cde222e3a97b36f70ab3f61b5036017c34a043ede6d119e7c456a9290b617d1b167ff68a1445baa01e441522a781dc16a85d2bb082c216947ab2ee1561c131065af0a5cb5fe8f7911fe749d741175171fc75e81c8845c73eb970eefab51f53aa6b50915a42315b893964736f3e6c716b0b9168286022be2fb8c7d956b91bd2ae3eeaba82ccc7dcd18b17ba2", 0xa2, 0x2, 0x0, 0x0, r7}]) recvfrom$inet6(r7, &(0x7f0000000000)=""/50, 0x32, 0x40000002, &(0x7f00000000c0)={0xa, 0x4e20, 0x5, @local, 0x4000000}, 0x1c) io_submit(r6, 0x0, 0x0) 8.59510817s ago: executing program 1 (id=1487): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r4, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xc0010006, 0x0, 0x8000000000000000}]}) sched_getattr(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) r5 = socket$kcm(0x10, 0x400000002, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0xfca804a0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) write$cgroup_subtree(r5, &(0x7f00000003c0)=ANY=[@ANYBLOB="00070000420091"], 0xfe33) recvmsg(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)=[{0x0}, {&(0x7f0000002500)=""/4137, 0x1029}, {&(0x7f0000000440)=""/171, 0xab}], 0x3}, 0x0) r6 = syz_open_dev$loop(&(0x7f00000002c0), 0x9d, 0x8902) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') lseek(r7, 0x1000000, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000080)='net/netlink\x00') read$FUSE(r8, 0x0, 0x0) setns(r8, 0x80) setsockopt$inet_MCAST_JOIN_GROUP(r7, 0x0, 0x2a, &(0x7f0000000000)={0x0, {{0x2, 0x4e23, @rand_addr=0x64010101}}}, 0x84) r9 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440), 0x42, 0x0) r10 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x8, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r10, 0xc0405602, &(0x7f0000000300)={0x4a, 0x2, 0x1, "444900d730fae90100000004000000060ff697b900", 0x3234564e}) sendfile(r6, r9, 0x0, 0x5) 8.535176486s ago: executing program 3 (id=1488): set_mempolicy(0x1, 0x0, 0x7e) r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) connect$can_j1939(r3, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x2, 0x0, 0x3}, 0xfe}, 0x18) syz_usb_connect$uac1(0x0, 0xac, 0x0, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000200)="adcd1a9a1fc36e9600080ff99e25bd86700e5a7507a1da16e41b0cd665279d95", 0x20) r5 = accept4$alg(r4, 0x0, 0x0, 0x0) sendmmsg(r5, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000003340)=[{0xc, 0x6, 0x1}, {0xc, 0x117, 0x10}], 0x18}}], 0x2, 0x4040894) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="680000000206011e0000000000000000000000000e0003006269746d61703a697000000005000400000000000900020073797a300000000020000780050003001c0000000c0001800800014008000000050014002000000005000500020000000500"], 0x68}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f0000000000)={0x0, 0x2c, 0x0}, 0x4000) r8 = syz_open_dev$video(&(0x7f0000000b40), 0x7, 0x28000) preadv(r8, &(0x7f0000001200)=[{&(0x7f0000000c00)=""/113, 0x71}], 0x1, 0x4, 0xb) ioctl$VIDIOC_LOG_STATUS(r8, 0x5646, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="050000000000e9ffffff0e00000018000300", @ANYRES32=r10, @ANYBLOB="28000e00800000000802110000010802110000010802110000000000000000000000000064000000080026006c09000008000c006400000008000d00a2a40000"], 0x5c}}, 0x0) unshare(0x6a040000) 8.38371087s ago: executing program 2 (id=1489): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r5 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r6 = openat$binfmt(0xffffffffffffff9c, r5, 0x42, 0x1ff) close(r6) execveat$binfmt(0xffffffffffffff9c, r5, 0x0, 0x0, 0x0) execveat$binfmt(0xffffffffffffff9c, r5, 0x0, 0x0, 0x0) ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) r7 = open(&(0x7f0000000000)='./file0\x00', 0x9cab835cfdc52675, 0x0) pwritev(r7, &(0x7f00000002c0)=[{0x0}], 0x1, 0xfffffffffffffffb, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r10 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0xffa1, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r9, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b0700fc670000e4a1", 0xa}], 0x1}, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000100)={0x1, 0x0, @pic={0x7, 0x1, 0x40, 0x6, 0x0, 0x7, 0xe, 0x3, 0xf6, 0x7f, 0xc, 0xea, 0x0, 0x2, 0xae, 0x80}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 6.657367727s ago: executing program 2 (id=1490): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) msgctl$MSG_STAT(0x0, 0xb, 0x0) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0xfffffffb}, {{}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x5}}, {}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, 0x0, 0x9, 0x0, 0x0, 0x40f00, 0x46, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x20004040) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) r5 = syz_clone(0x100011, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x8}, @exit], &(0x7f00000000c0)='GPL\x00', 0x9}, 0x94) r6 = syz_open_dev$vim2m(&(0x7f0000000680), 0x8, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800007, 0x11, r6, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r5, &(0x7f0000001100), 0x0, &(0x7f0000001140)) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x88, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x5c, 0x4, 0x0, 0x1, [{0x58, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x48, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2a, 0x3, "9ac420000461afb9fdd672bad09dfb78c7699c74e891a0c700"/38}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0xe, 0x1, 'IDLETIMER\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000000)=0xb, 0x4) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x70, &(0x7f0000000580)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}], 0x1, 0x0) 5.866767742s ago: executing program 1 (id=1491): syz_open_dev$sndctrl(&(0x7f0000000000), 0x8, 0xa0080) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) pipe(&(0x7f00000000c0)) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) getsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x20, 0x0, &(0x7f0000001040)=0x5d) syz_usb_connect(0x0, 0x12, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) writev(r2, &(0x7f0000002100)=[{&(0x7f0000002080)='T01\n', 0x4}], 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x2f) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x20000, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="b00000000002010400000000000000000700000608000940ffffffff080004400000008108000840000000032000018006"], 0xb0}, 0x1, 0x0, 0x0, 0x8004}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600800a0000200002801c000b8018"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000180)='./control\x00', 0xa4000960) unshare(0x40000000) r4 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x8, 0x200) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x2172, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) futex(&(0x7f0000004000)=0x2, 0x8d, 0xfffffffd, 0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000440)={'erspan0\x00', 0x0}) 5.658112515s ago: executing program 0 (id=1493): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) writev(r2, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\a\x00\x00B\x00'], 0xfe33) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(0xffffffffffffffff, 0xc25c4110, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="b70b2cbd7000fcdbdf250f0000000e0002"], 0x24}, 0x1, 0x0, 0x0, 0x8}, 0x2000c88c) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, r4, 0x800, 0x70bd2b, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xf}}]}, 0x5c}, 0x1, 0x0, 0x0, 0xc040}, 0x90) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000500)={0x0, 0xb390}, &(0x7f0000000540)=0x8) syz_open_procfs(0xffffffffffffffff, 0x0) r5 = syz_open_procfs(0x0, 0x0) pread64(r5, 0x0, 0x0, 0xadc) mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000080)={0xb, 0x0, 0x40000}, 0x20) timer_create(0x3, 0x0, &(0x7f00000000c0)=0x0) timer_settime(r6, 0x0, 0x0, 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000f80)={0x18, 0x88, 0xfa00, {0xffffffffffffffff, 0x0, 0x2, @in={0x2, 0x0, @broadcast}}}, 0x90) ioctl$USBDEVFS_IOCTL(r7, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r7, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect) ioctl$USBDEVFS_SETCONFIGURATION(r7, 0x80045505, &(0x7f0000000000)=0x1) 5.111613799s ago: executing program 4 (id=1494): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) writev(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\a\x00\x00B\x00'], 0xfe33) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(0xffffffffffffffff, 0xc25c4110, 0x0) r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="b70b2cbd7000fcdbdf250f0000000e0002"], 0x24}, 0x1, 0x0, 0x0, 0x8}, 0x2000c88c) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, r0, 0x800, 0x70bd2b, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xf}}]}, 0x5c}, 0x1, 0x0, 0x0, 0xc040}, 0x90) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000500)={0x0, 0xb390}, &(0x7f0000000540)=0x8) syz_open_procfs(0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, 0x0) pread64(r1, 0x0, 0x0, 0xadc) mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000080)={0xb, 0x0, 0x40000}, 0x20) timer_create(0x3, 0x0, &(0x7f00000000c0)=0x0) timer_settime(r2, 0x0, 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000f80)={0x18, 0x88, 0xfa00, {0xffffffffffffffff, 0x0, 0x2, @in={0x2, 0x0, @broadcast}}}, 0x90) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r3, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect) ioctl$USBDEVFS_SETCONFIGURATION(r3, 0x80045505, &(0x7f0000000000)=0x1) 3.800271207s ago: executing program 4 (id=1495): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e23, 0x3, 'none\x00', 0x0, 0xd48, 0x55}, {@remote, 0x4e23, 0x2000, 0x3, 0x12d5c, 0x12d5c}}, 0x44) r3 = socket$inet6(0xa, 0x1, 0x84) setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000080)=0x2, 0x4) sendto$inet6(r3, &(0x7f0000000000)="cc34", 0x2, 0x0, &(0x7f00000000c0)={0xa, 0xfffc, 0x27b6a97, @private2, 0x9}, 0x1c) getsockopt$bt_hci(r3, 0x84, 0x6d, &(0x7f00000006c0)=""/4097, &(0x7f0000000040)=0x1001) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) read(r2, &(0x7f00000004c0)=""/205, 0xcd) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000000f14010000008000fedbdf250c00450072fd45006973736d"], 0x28}, 0x1, 0x0, 0x0, 0x4004011}, 0x0) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x20040804) gettid() r6 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, "c8444943470da91b", "42f3ac0e0b8a32be8fe91c368e60693800000000d6e5394b00", "e7198360", "f7a5c1777af05eaa"}, 0x38) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x20003, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000000000000d0000000100000001000000000000800100000006000000fdfffeff"]) sendto$inet6(r6, 0x0, 0x0, 0x8000, 0x0, 0x0) write$binfmt_aout(r6, 0x0, 0xfdef) 3.345429646s ago: executing program 0 (id=1496): r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x4040aea0, &(0x7f0000000580)=@arm64={0xa, 0x81, 0x4a, '\x00', 0xfffffffffffffffe}) socket$nl_route(0x10, 0x3, 0x0) socket(0x200000000000011, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000001900010000000000000000001c140000fe000001000000000800", @ANYRES64=r1], 0x24}}, 0x4000000) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) bind$packet(r6, &(0x7f0000000180)={0x11, 0x5, r7, 0x1, 0x3, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3f}}, 0x14) getsockname$packet(r6, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000700)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="38000000540001000000000000c4000007008209", @ANYRES32=r8, @ANYBLOB="20000100", @ANYRES32=r10, @ANYBLOB="00000001e000030000000000000000000000000008"], 0x38}, 0x1, 0x0, 0x0, 0x881}, 0x801) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$KVM_SET_MP_STATE(r4, 0x4004ae99, &(0x7f0000000140)=0x3) ioctl$KVM_RUN(r4, 0xae80, 0x0) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r13, 0x0) r14 = openat$nci(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) read$nci(r14, &(0x7f0000000100)=""/243, 0xf3) syz_usb_connect$hid(0xb, 0x36, &(0x7f0000000200)=ANY=[], &(0x7f0000000540)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x300, 0x8, 0x2, 0x7f, 0x8, 0x2}, 0x27, &(0x7f0000000280)={0x5, 0xf, 0x27, 0x5, [@wireless={0xb, 0x10, 0x1, 0x4, 0x40, 0x9, 0x7, 0x2, 0x2}, @ext_cap={0x7, 0x10, 0x2, 0x1d, 0x6, 0x9, 0x7f}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x9, 0xf, 0x7}, @ptm_cap={0x3}]}, 0x3, [{0x0, 0x0}, {0x5, &(0x7f0000000440)=@string={0x5, 0x3, "3fe8eb"}}, {0xac, &(0x7f0000000480)=@string={0xac, 0x3, "77e722fa82ae718ac5433c964f48a25028b7d7bcd7357ccdd36468915350b1e0ee3f138baecbbe195c4ab90f44e9e7a3b47e1e9414f12a5e967b668487585dcbc9a2400b39d555a3b3105ac65e62eed3db0f1c871d596e4651b7b84fe1a55d4d3e1bfa09df07f2bed3db08097fa154d885720e35650d97d310f8b88e31f7c8fffd71ef756a0019650ad4dd54f87c84d17cc7982a15a078a8ebb7e50bfadf791b16b27a884b71e3eba729"}}]}) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) 3.20109931s ago: executing program 3 (id=1497): socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x100000000, 0x8, 0x0, 0x3}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x9, 0xe, &(0x7f0000000300)=ANY=[@ANYBLOB="b7000000001a0000bfa30000000000000703000000feffff620af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000004d44000000000000620a00fe000000007933000000000000b5030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfdce669e51731b2875353193f82ade69d0540059fe6c7fe7c00fb7502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abd47b64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022af46667cf25c5d3038816106dec28eaeb88343261a48a18f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfeff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c55318294270a1ad10d30fef7c24b78b29d83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead8eaf68b0c5dda0467d35a3807000000b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ea1e717d29135753208165b9cdbae037f315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d7012c1b45f6ada1ee7baa5b6a686b50f09b7f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac4d73a008364e0602a594817031fc2ff2c32a1989e00f52f8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e016820f78b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1b8f916b9671b7000000000040f4bee5ad2dea2d14e195265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879d4e7dc00624708042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b85343f9f36bcda9f64b7a5c5b2f5452f5b1de02e6f15c5640bf89d4a74d51dc233dee628c1dfbb5566b98478c174b34eb234481547e484c6af101396b6977dd668b401391c1dc54f2edccf1cabe6be9868d383eb937efdfd9ade018106f544f04fc07ad525497f65fbad3cf145396acf3b0d38e6b46e28d86880fd6f62c373000000000000000000005d194c27cd4d8f6727de79be80fb4493a0ee2e85f59c71dc84311c0f1fb6c87081c7be9355288610c32c2d8c18bf2027212182903687f48262aea54c5f8a315c9aa4a5af1aa2c4007d1baae38c270012b7eb9411ae451204dba30f8321b07a18db97c3e0cf6a15170e515b1cc463a67a5b2b23ec5662ccfa898b8d5075647bdfb390cde56efb8fd42df12c5c8f66bdc58449ec2b38bf12f5f0a49dcbcf4e6f11c47d23fa34793a0000a1cbb1e06e9a8d2449451d7a05ec0a0d3c9716f505ddeba488c60ebf44cac05c2739694359c925148137376dd3f1330ed0e9211f73ee279cc0b5c298422395ce438f48a39ff569375e609f9e904aacc3d8011326d5e4d654c74501cf16bbf72d3984f9b4ef000000003a8a3d49fc837001e4622e58e3a4ef6b55a8dd0680d951cdb6e54ed92a9a6a0e5e494b7b7b0ef4b4bafc5d964551b2a22bfd12b0761ef07a103e51e84917ee44f860b9785e264343f6a80e9318edecf73df6940856cd56c56eb3831445833c701044aaa49439a44a624267580b3c0980d7f87437bf498f6e1915450400000000000000564a02552c0a5fedbcf4da0db6ed03b9dbc224ee76d20aaf1ac74bcb7eb6f202209e64cc4d130dcf6ab3df8ae4911deb4bb5c7df97fc348d151e834be73915f854272f69d88123f666448b6a8e73322b04fffea9cc05e4129debf311c73b4d1a244b1e5b9943028745a0b6477686740ab877315e35624d791e6f71adb1acd3e22cf472ff7e048b16c11c84da9a3b16b92665912132a4dba680052919c20e191311d8092a09f3c609823fed1bd651ce1c34de105790ba2ca3afa26647f66efbf97b109e7226c74e32beb14ff3fd6918e255fc9b42f86b0188cf885afcc9bb77a7fc3ca7ec1015af494add960f8a11422ca005f24006867cd156e0350022943e301b2c07f4d37d07b05ac2fa1f1d5a0d6eb7e992b076bd77509c26034d2a740d578476410b413591884136259693effaf27e7bcfb58efa92625fb9bd68ecca42047f6e7d24b0446ea16a310073c163d1c6aa3ba1fe76b4e88d5f98cc05c6d033e2c28b4990892230d6b4e5c083a601a25145eb22f4f77313117f8147810d95c64fb78b0a000000000000000000000000e92ba8b066e4bd82bb6003d5da8791d838bcd6eefb13000000000000000000000000000000b652ff6fbad82da75114742bc6a27cba894ef490531be709a3a3c81b267dfafa55e6f855200b4e7518682c30f40808cd5bb8f00beb63b4989cc01d8e75a182337b9f9e08430ccec9bda0134d07a9f54b60033182f5d2bb61fd130d65e68bf148d26470060c707a8cf750ca954ee63c78cd975c7f565783383f02edcb7ce4a9ed0c511d18fe32352276d72eefe0d566f97ccae16b3492f60b96574aac4f1862fb6e4932c181dbf8c68ca16b765de9edba0bf5bfb9c4950d19c0bc31db02f374ce62141160436639d4b6cb0033a47ffdc54d55f1136743b1b26946f200000000000000007590ab8f29c7accd9d11786c4ca1271cd2293b572f14a3dfcaa3467f2783fc09e3eee3fa4b82b7b6ce904e05fa797a2f7ff63e4f874bd870821f6460904e05d7a3f8295a9a5fd21e"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000080), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) accept4$inet(0xffffffffffffffff, 0x0, &(0x7f0000000200), 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt(0xffffffffffffffff, 0x6, 0x9, &(0x7f00000001c0)="6ac3", 0x2) sendmsg$NFT_BATCH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000fc0)=ANY=[@ANYBLOB="140000001000010000000000000000000000060000000000000003000000000040000000070000040900010073797a300000000068000000090a010400000000000000000700000408000a40000000000900020073797a31000000000900010073797a3000000000080005400000000c24001280200001800a0001006d61746368000000100002800c000100697072616e6765000800034000000120034bb1e703000000000000001ab26fcc140000000000000000000000000000000084000a3ab534c45b682562837d84b85aaa951ef0db46eac8354e452285439565394223d354429fb938c11e023b15ec4d5636cc48c3115979735544c44e21ce6fb1fe9bdf59dcda58629eb70e7d88e2a0d669d993e2ff5c102a53d82931894564399083fa028fda0f624f7053d1e03f7e3d7977b44ea7120cb40838cd96897ecb0efdf85910acbfd2695a9c48a8009bafee31f51add2861ed87db516f4fbefb60497864bbe35d"], 0xb0}}, 0x20058841) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) getsockopt$sock_timeval(r2, 0x1, 0x43, 0x0, &(0x7f0000000380)) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000000c0), 0x40) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x40701, 0x0) sendfile(r6, r6, 0x0, 0x1) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r7, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$KVM_SET_CPUID2(r8, 0x4008ae90, &(0x7f0000000040)={0x3, 0x0, [{0x2, 0x6, 0x5, 0x5, 0x1, 0x8, 0x8fa}, {0x2, 0x2, 0x0, 0x80a, 0x7, 0x9, 0x102}, {0xc0000000, 0x400, 0x1, 0x0, 0x8, 0x9}]}) 3.090495935s ago: executing program 2 (id=1498): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x94, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x74, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x18, 0x3, "c6a41d106c720000000000000000000002000000"}, @NFTA_MATCH_NAME={0xa, 0x1, 'owner\x00'}]}}}, {0x20, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x53}]}}}, {0x10, 0x1, 0x0, 0x1, @numgen={{0xb}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xbc}}, 0x4048010) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) connect$inet(r1, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x529100, 0x0) ioctl$TIOCSLCKTRMIOS(r3, 0x80047437, 0x0) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) 2.36276409s ago: executing program 1 (id=1499): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) writev(r2, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\a\x00\x00B\x00'], 0xfe33) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(0xffffffffffffffff, 0xc25c4110, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="b70b2cbd7000fcdbdf250f0000000e0002"], 0x24}, 0x1, 0x0, 0x0, 0x8}, 0x2000c88c) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, r4, 0x800, 0x70bd2b, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xf}}]}, 0x5c}, 0x1, 0x0, 0x0, 0xc040}, 0x90) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000500)={0x0, 0xb390}, &(0x7f0000000540)=0x8) syz_open_procfs(0xffffffffffffffff, 0x0) r5 = syz_open_procfs(0x0, 0x0) pread64(r5, 0x0, 0x0, 0xadc) mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000080)={0xb, 0x0, 0x40000}, 0x20) timer_create(0x3, 0x0, &(0x7f00000000c0)=0x0) timer_settime(r6, 0x0, 0x0, 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000f80)={0x18, 0x88, 0xfa00, {0xffffffffffffffff, 0x0, 0x2, @in={0x2, 0x0, @broadcast}}}, 0x90) ioctl$USBDEVFS_IOCTL(r7, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r7, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect) ioctl$USBDEVFS_SETCONFIGURATION(r7, 0x80045505, &(0x7f0000000000)=0x1) 1.884067621s ago: executing program 3 (id=1500): openat$ptmx(0xffffffffffffff9c, 0x0, 0x100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f00007f1000/0x4000)=nil, 0x4000, 0x800000, 0x0, &(0x7f0000130000/0x800000)=nil) getdents(0xffffffffffffffff, &(0x7f0000000140)=""/177, 0xb1) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x20000023896) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r2, 0xc01864b0, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005a1000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000ac4000/0x4000)=nil) r6 = socket$inet_sctp(0x2, 0x1, 0x84) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x38011, r7, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) syz_io_uring_setup(0x39, &(0x7f0000000580)={0x0, 0xe7b7, 0x2, 0x0, 0x127}, &(0x7f0000000240), &(0x7f0000001880)) setsockopt$inet_sctp_SCTP_MAXSEG(r6, 0x84, 0xd, &(0x7f0000000000), 0x4) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) socket(0xa, 0x3, 0x87) 1.882180699s ago: executing program 2 (id=1510): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$SOUND_MIXER_READ_RECSRC(r0, 0x80044dff, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_pidfd_open(0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x1258c1, 0x60) preadv(r3, &(0x7f0000001b00)=[{&(0x7f00000009c0)=""/239, 0xef}], 0x1, 0x2, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120141014813442024040075ee690102030109021200010000100009043b070096d1"], 0x0) read$FUSE(r3, &(0x7f0000005b80)={0x2020}, 0x2020) r4 = gettid() r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180), 0x40e02, 0x0) write$rfkill(r5, &(0x7f0000000300)={0x0, 0x2, 0x3, 0x1, 0x1}, 0x8) setsockopt$RXRPC_SECURITY_KEY(0xffffffffffffffff, 0x110, 0x1, &(0x7f0000000000)='\x00', 0x1) write$rfkill(r5, &(0x7f0000000340)={0x53, 0x8, 0x0, 0x1, 0xcc}, 0x8) timer_create(0x0, &(0x7f0000000040)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000001800ffffffff7bfbfcdbdf250a148000ff01fd07"], 0x1c}}, 0x0) sendmsg(r6, &(0x7f0000001ac0)={&(0x7f0000000400)=@ax25={{0x3, @null, 0x3}, [@null, @bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}, 0x80, &(0x7f0000000700)=[{&(0x7f0000000ac0)="6274a54591408adfa6fb2ea2c19848d48e53d9bd310ae33a794b0391429092b73bde9e5c59369f30a77a0bfc45672803c70daaafa62b1766fd52b7171ba677029ba180b372cb8f2c0c42f41562d4efc6629eda90e984b246513c5d3147822a5e17005e1991884d378d078d6477fa550ad35f6f6bb0d967e76503fff9b07c5ac8dfe2ca51eabf80b8a5449a385f16f9b86687ca7a5d1ef42d125e76141e1f1fdd2cdaa1e6dcfcad5141efa218047ab637498a3152b13135e2959e037c229c80d5af6e20b50b43a3badf7ad141d35a6fd958eff95b4aad76bccc6adc84fe363adf4aeb1c1cac6810f385e0728e77be0e14d9e3695849265bb57defcae842a9ceacba0716210ff4e331a9490a21b8c58105fed540728fbde599a920712029510f25f6305924575d1a5b43f0b41872920028bf2c6d0001b47b1b3707a22e0f143d5d04638d1d239fe39a69e6e49ccae37888eebd2dc3694f014b17c7813f96e10fab4421613abd7526a8870d775db0b417a0b77a495be7a949fceec13cbc0d03f7646beec641726769fb4c5b5cc14f0350b445f13b839284ca9f8936cad708249811b9cf9c0127b2483e36e43051d4418e9cc000ebf996bf79ed439695d99277fa6ed7e8b693ab48a0afdfc5cda486e6a46d5c7cb31fc697aabfc21de3b568965040e10c0cc2642c0eb20abc2ee59213df9c86f7565af932e78f0fb0122dd5177f3e962965fd52f4425d150a3019c80011bcc6e34322590e9c461648d40e7de796f1f76f99f9e53144a956d795e5c07d0d871c0b0c2e19830a7f71df0abd1ee0c90b4358f36ba2d2a14b808609a8fa9a9a3255fa20ac104b0bda25ee0d6eeacd9bdafd9303bf03f32ea746456943d7dfb59efe1dde9344a1af9ff48a9fbaee426b537f56d7a29186d9f076f9bd81233606bf71169d6c6c8ace674e03727767c706eb56c5a5ae4e21b0d6e17e4c2dacf7ebfab0945f8586daf8997a941577d3fea0a69c1e1a7d82e4f706f5d1fa0cd3e781cecd4753666d123005b2dfbf7e20e1af844f26cd9ede474f50035d5542cc624fb7c8ac876ae0585a211080d04d05b2f10c7627de3356a683287fb1c816a88b4fc9c8c77c162f88d6d7fb188653b549d5c12be7994e65fdc97bc1e88aa869edc1eee1f1cbe3a75cee1113325b931bfa5d57733828b89729778f60e46d817b2cf5a3eeadb03c92fd881f3a4a6f4b52c846553a6b1c30a1f37cb5233010c6346cd299b03d05937ce98cd8c8b8669295e604abcf584136f15ffcf290a8a2114cef6a2b7fec56d8570da111f81928cd9661930b22fe33c10b5024384e32a03c5be050f4a983880efd506dc79e63bee20ebca22f1b11ce1dfbac827fa6f2f2c52cea9e5820e67a0126cbe1e5c8328d080fcb4becbc9389c6cdd60e7c600fa10e827095f4768aaa5f22a8e6d987ce355d666573088665adaf1c2896910640d1a48f934fb10c612075f3cf94c7bf148b5a8ea2fa27b17e5a275ecf37b69dc9bc0d395ab6313dde065fe510bc8c98a49df23fba2ea2fbeeb32f10b60ef8cd4218eea7fa96e34fca9221ea7eb8863f73114299fb6b8ccc54aa0331d55a9d296b64384b63850c397d8d763f3d3a92fdf83f8eaeca5eca094a37ebc4c192e2af5e9d2610a26e20b7db865abafbdf6ed29b66c1f116faae837358f8aaf858229802c122673194e80643aa440c172a4a265ba18b0af6bb4d88ac428c022cf8b30d07a695c2c45ba04cfaa512beaa4c770a46ace008983d1eaef8880c8800bb58df86b4b13e168abc035a00f6519c3e5d80d28609d6885cebba1b38f981d37fc857d3fbe255525f249ce5eb348915c211251bb8a4a3303aecd027dfa25aead68998b9215f420f70c76f05e4c83a8fd5ea955c48ddeee9df05580b7ce4a73561c0e9eee66a558e71f74e835894886bd71e789d8f1da199060c0a2efde8c86ea738380889b9cee8c53353496ad98b07ac56b6b0be1a812025b0f4d2ccf37309b9fb7a87a1a87b6fb93fbcd42ede48b2d2a6150bf1b8216df9e159df941e84318b3f533f1ce2eee7b9e95b34afeaf63318926d074e13ebae86ce5423744b3889cc4e7b3622d5f7dd906c8b8e40bf758e04c16b749a3b7cc6702af98e309672bb9ddc1fac57f9cf73c3bd0a05d0df192911b47107534a13d222acbb361b0c4675d48c8f200fe2e9267c056f432a3649ee9b1d2b16b60a9ef7817b366a02e6e00c95690318e1e48f41885bd24a28056e3bd09ebc26c1302a8efc2d5bf8cbb29e490b36f9366bca4e83dd5590026b9f8d8e0ee88e1f4b4dd0c997f75dfc3275bc1efcdd5f49421eb1f14a126e2ba3f0b85c35664cc362185cc90f77b2ae71c9a8c3bd492073bdf7743752638efa32b2042f95529f187ae062aa12b42d70033f9456aba0e82dfa99b2b75049aceb017e9c3cb7cbb26482b6de5973863d0637e1bf51d041fdd13f9a7771bbc04ce299b389721bc947bac4d0a056a799b6c27904800871b41f099aaadeebe7270680e9ea9251296f77866e4910ca22463062fe7bd8714ca9b7332abb7ba7bb29f0667b282471c0fae831ab1ad8a47305b2b2cf2c6241a1a824d2ab78cefa98ce75db7dc1912c839fafaff8ea7ccd6036535b56b0052994af2570d80047b54bff875cee1c4edda68c0980404152aa6f9871c8fbec720c5666bc8a01a09f2fed33dd4830bb8a7e3022f918eee54eebdd1b3a4dcefddb8ee6ce206d22a427cd907e7c9676ac587dad53a66950abe1543caa6e0bded9e765ef7f408583cf6fd4a2613886048baa6c75233d774a9b32b8c45a77a9d4c9ed4474efd33c1e519ea38cc7d0a7dfc3e86ca886f1bbebc1bb9c21af9218d50cbc436d9651e963403f5996636de4a1c1b753af87c011c1bb17d7cd40079a9e6d1b1d907caf94685c30c9b37d7ae04df5aef003b9b10546166902760f4c64b2b3b1f0bf3b300a06a3f76810ff93f27145bb67020d1cbe0e283f3e24915ca571ef7c2e09a34c06a9c85d3f8a6a3c243a70da16de06b778baebd269620636a3683592226936ac18622968cfb0dedb9bff44da0d29827c7295a09821aa239ee02f11c720e8333adbfc7d27d646b06663533c39ab2da2f4e19e4d3323faec77484915f564b3a78a12339f2fbea9ccacd9aa6b67f54e7e9e8cd3539806ccff5e6afbc0aaa64ad56d7f96fc8c7dcb33861a9a8c2623aac1b236547a1aae1a3f7641718886a6b5c9f9aeb360f80dffb0a9c4cbda3c52950cafcbc9c6ea510ec4d37124361862f397b4baaa73736721792c09193baad2e943e1324a46b5a450f084b2c10d467f31018bf19fbd8724c3c2f1e5173b26cdba07f6f5daa6f99e01c7c10cf7f24e2d1b2216b768ec1326662b1146900441a69e8129ba4fb9937f86bbcc3a9f12e126c09539e13436938d93526cb1cc8ca6531d526758333acddcd46290abc762867bb54e5527eb639a30ef1fff1ca2c03e4bbf97e333c5784a870d990bbd145866ce5a5212cce1e5027e228248666497f29cf0bc27ca53864a9e561a95a7c51c77bd5b0a099f2d73838539a9478e25853fdac844ed5b65e4e76a9805815418761b0cf1ca2fd4db7b47ab2d97d5eceec90634f95c334a5a94b435b76ebb879eb2402cd1d692329a389a8db3464ad7fdcea28d86310fff56dd2c38c2982301d2077f1fc2bd7fff84e9ea426c21986375aa79ef0623bd77b25a5aa8d355dbc7f2d47f93640cf059351a0090026fac63ceae46fdb4dc33d87380c4e0676ec6afb3ab22d1224d159217808346fd019c192f4e03e5e0719a7ff89d39099cdfb61e657e7d658e4e5c6efb2aa3dedb675502f083c98889d20d63502aa2bfc24cc5710c1eee47ee0c9d8cfc22b8d5f149bd452dee6f45d411cbcdb8b44f64845825b19bf7ba5cd29cd589f3bc56fb7d32b695ec9f29a140d77d9e3fc5942da9d88a76a0eda5270e021fe9d98cbb2e1afe68d490522149afe5accd220e9f4297a4df1f02e32eb9db846e67ea89535e01634765f305a78eab70626686333f668c11b04598a774ed62f4b1a5fbe35af76c48b3be8ef92a2ae074f3d47a9f970581e26309ebfc502fb9ffd270d8ab675a597c1aa6a12e2615a013d7b91f206c0e54d6e0d099e71139956896de4ce6e7e5599477dfea5d7e0b14048060d8cd25d43681b35d2776ce34e66c633a3d7fc1fccc8ec5ce5a8b4b386d84433715f5c9a5a59d744cf43fb0e5aaa08a7650635108ead49255754dc48dc918c7ed458fa23e90be835d580e152fda0df3ff044b41e2b7f00af23e414ad7ae39f509c3c1982b5e0edd7df7721bdff095ff6802daf6844da8f42c37de3865bff135e4622313c9c725bc7c2df7207c9bc2b28eb3248cc2c4df0b44b7f57f1e76024ec2ed3428aa79970b0d826ac30399b4108fd909b87810d4a0d6cbd8823c315050168ae24df3fded9ccb34a9051bf50f49ce4fc24ac59c57cf51d3f1314a8bec4a2c058de01ec81404b859e15bf8eb334672f2baad1f559eaede9e3c74986ba468ecbb781faa7e7c954ae66a7c40c894030449c20f91f5cee52908a065d458a3e4159497289552a855b7a2d91fb0445dde79521585cc14510043fb3a3d64c1de79fdf71544b977b0844601971ee7dadfaade6dc9d5a0402cd8b2ac5bf3f6a1758deb9d3e55dec26e0f6f70bba7d9250ba8f03367a07393b311cd00c0faa5b2fef94f93a499b8d01319004b262627725c7e32071bf90513856be96b9c3cf58e678f6a420289101bea90a63b715152bb4c8c427e442fa6dc2f2cf7acac0c04da175350556d3762519b4b40c37100913f503929a2461168f266c22d1e55f2b400a1dd6bddef04e16a7b76d13501ab0dcefa5334b658ece282107af7be007006694e99cda531203a3006e347851229d78c1c4a63cf16708bf2313a234310945db5bc687da3e1c8917358d8d12659d01fd42b14bcc0fbf281126c4ff7e6c9efbfc41c17fd9abe24d9a2f5219a2a0d74d2cd57bcc5e4defb9d4dee906ea380a233eb5b3f83ab929d0b22f38aff287a90da6304afcb6b5f3b216c873c69fbbbf4145d6943bde6fc0c45100800050db1a5a5453c754ab3e4ad848c63698e4d0fb3ef3f3949c4c1aa5989c396e3c4f781cc1702816794b583e5410125dccee78549008cb0555004166f8db5b9ad2369c88cfd99da80552a4bf1840a46c8821efcd6bf8375359c4db610d88daee3ef243fd18e76b330909069b1c9c175c02ec7b42022101dbc4169df0365798d1dfc6282030abb79de72d75eaa310ed1dcaf20084f5b27dc33d5461d096d798ffd6ecd492c896dfe8bb840eda764e943a9abc258a35b0b1e581a4aa01aba961725a8d842c2dbf20b8e0ab748de7a7851d3bfd69fa5e0773544783e0388791ae23877d920c16bc8ef5f8946bb2492da071d929f8e4ee97d471a446393f48dcac13fdf431a6c39713ce295d26bc92197114bfb404a156684bf3a6c5ff79d243410a96b266cf78eceea18b78d964a99b69b49901feb776e8c906d04d20a62a7af10954c8a8f5e6f0c34a189b7a48a0341c687aee4646d3efc922a13fac403c298244613a84423491c01a73cb746bb235ef9974e8c613460f6061d7293197acdb3521bfb9f1807db6e9c603b869985df94a685c9a96f86de220ec933e00ec0fccd5911a020209a8fac6105d51c5785fbd43bbd1cc4c0fd2d2b4a6a68a744cf11e06014deac6e6572565f530e7236839dca100ee4a849482b298cd8343cd8820f805b9959d2007731fdc299148eae8e7bab55067b886d7d7627306d026b0e4d97ebb2", 0x1000}, {&(0x7f0000000480)="6fad23149204da40551507fa19b825a932d9305589397c54f7456c17b9ab7608b51ce3be41841e4b5b95eb13c57f4debc9a0e3e90e6dc44a2ba26c8d419a720ab0c5db723c5bd8630e2cce2fec7a90087fa3bcd84ff18786c3ea9b0b41cc945f890ab37b71dcddf8a748902601b394235b34638266c668e611d07eb942bd8fcf587837e25d9bd3f6785a7bf290210381e919938cc4ec6452f5273b9841c9ee91356d20b8a263f47ed293cb4295db309df7e01d04e1fd538b2c3013a9b72be25b964f74e05bdafad2590d9186a08edc93cc90759012a0bdee759bfc2be70d7167ac5404a507ffaf92e60a91", 0xeb}, {&(0x7f0000000580)}, {&(0x7f00000005c0)="5c9e0d3097df31981c070ba9c4d4c4b4f7eb75b3e8adf0127237da945e9b9c8fcbb9", 0x22}, {&(0x7f0000000640)="4e7b5a0fab1e20c191686c0ecc3be393f1c43271bdbdea798215ae95941902b9c222d4d5afcd4b3c596eac3468d24898b37f6ebd7d73abd33a01599943228d80be6c589bf68f6eccbdab75b815f8bae5c4f34fe581ac563d0cdf75ef8e72b5de3cd596cc7da1cf6cd9011ae9034e9a1d53ff31aa861903d2dd7a47c605c74f626ede581f0a8c88ddac92df5826c72d4da308dcf9690120", 0x97}], 0x5, &(0x7f0000000740)=ANY=[@ANYBLOB="c40000001201000005000000438f6e144c26c1e4a29b2ef59aa8ff12f04d2656745530a2b0b1b6e1ed8b77126f3bdfbd53e2d7eaf1fd2bd9fcb108001306b437b793f043c8c58894c2e12235df1b90f2c0235397ef730a0901022118957b1f84fef8dabc2d046adbb09737581418cfca4741f11956444b838cdf9256b2164871b14f8005d4c7c4c6ec235c993f4b03c1cd06a82f4cefbfa9af7caed52667c014825f960f489476f084a50d9e323739bb39bbfc3b58cd46c2fb58adcff6d400e000000010010000d303000011bb5f687ea19d38c8b376dd8e3f2239412328c57c0b274ef60619e52b369c3076b9b5d367f37804aacdb44f375db2f0db90c0ae050012bb2ca21dcbdfa924c362e51504c56ac509d1cbcfd510bbc6d8a317d1c5e66fc8195105a61c170e2e34c4ff54a01c7eafee726c9f43ec4e0d44197563b9b2511e246cc6219a22b91ab6e9fd6692e067cb3ca76eaa211fe437c27e10daedeaff52aaf325cb07d79a779334b95269951ffb23c2c99f6b1630b43d3f58c4aab6d5d8214e240fa76edf2bedc3ee9248e08db95b2ac9a88c78bed7981082000084000000290000000400000068be1b8175e31b242d7eb6d1dafce2fe51e1f13224fb6b2df678e7b4dae2f4588f72b089b9f6fe6c1a4f2b7e7a8c04d70acf1ba96fded73c1e11e39ced7736288245c6c2e2951e1701b7bdc3c4c45ae34b95ea5b7ea8234d74245be8da93c427eb25a5bacc9544d27eb48b997c1fe5c8ac735e8039000000340000003a00000007b300000685af1e067954a12eb238fc6f34f66112a35d7d15e7b00e621af24260b8c027d0d31c3b477c0ead0000000000"], 0x25c}, 0x40004) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f00000003c0)=r3, 0x4) sendmsg$nl_route(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@dellink={0x20, 0x11, 0x1, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, 0x1480, 0x2104}}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x80) 1.858756939s ago: executing program 4 (id=1501): socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) bind$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x140c5) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000080)='cubic', 0x4) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) r4 = socket$kcm(0xa, 0x1, 0x106) setxattr$trusted_overlay_origin(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x0) sendmsg$kcm(r4, 0x0, 0xe07e872420dfefca) close(r4) r5 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="1400000023000b6c8cff", 0xa}], 0x1}, 0x2400c000) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_NOACK_MAP(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r7, 0x1, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40) syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newlink={0x20, 0x10, 0x401}, 0x20}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 167.044174ms ago: executing program 4 (id=1502): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r4, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xc0010006, 0x0, 0x8000000000000000}]}) sched_getattr(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0xfca804a0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB="00070000420091"], 0xfe33) recvmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)=[{0x0}, {&(0x7f0000002500)=""/4137, 0x1029}, {&(0x7f0000000440)=""/171, 0xab}], 0x3}, 0x0) r5 = syz_open_dev$loop(&(0x7f00000002c0), 0x9d, 0x8902) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') lseek(r6, 0x1000000, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='net/netlink\x00') read$FUSE(r7, 0x0, 0x0) setns(r7, 0x80) setsockopt$inet_MCAST_JOIN_GROUP(r6, 0x0, 0x2a, &(0x7f0000000000)={0x0, {{0x2, 0x4e23, @rand_addr=0x64010101}}}, 0x84) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440), 0x42, 0x0) r9 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x8, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r9, 0xc0405602, &(0x7f0000000300)={0x4a, 0x2, 0x1, "444900d730fae90100000004000000060ff697b900", 0x3234564e}) sendfile(r5, r8, 0x0, 0x5) 64.360317ms ago: executing program 1 (id=1503): socket(0x10, 0x3, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000005c00), r3) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, &(0x7f0000005d00)={0x0, 0x0, &(0x7f0000005cc0)={&(0x7f0000005c80)={0x14, r4, 0x711, 0x70bd2b, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4000084}, 0x10) sendmmsg(r1, 0x0, 0x0, 0x4) keyctl$KEYCTL_MOVE(0x1e, 0x0, 0xfffffffffffffffd, 0xfffffffffffffffe, 0x1) mkdirat$cgroup_root(0xffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000002200)='net/netstat\x00') r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x3, 0x0, 0x1, 0x0, {0xa, 0x4e23, 0x3, @private1, 0x7}}}, 0x3a) read$FUSE(r5, &(0x7f00000001c0)={0x2020}, 0x2020) r7 = syz_open_dev$sg(&(0x7f00000004c0), 0x0, 0x20c02) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1f}, @NFTA_SET_EXPR={0x34, 0x11, 0x0, 0x1, @quota={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x2c}, @NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_QUOTA_CONSUMED={0xc, 0x4, 0x1, 0x0, 0x7}]}}}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xb8}, 0x1, 0x0, 0x0, 0xc}, 0x20008844) writev(r7, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r9 = socket(0x2, 0x80805, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r9, 0x89f3, &(0x7f0000000180)={'sit0\x00', &(0x7f0000000280)={'syztnl1\x00', 0x0, 0x1, 0x1, 0x5, 0xffff, {{0x5, 0x4, 0x1, 0x7, 0x14, 0x62, 0x0, 0xd4, 0x0, 0x0, @empty, @empty}}}}) syz_clone(0x630051c0, 0x0, 0x22, 0x0, 0x0, 0x0) 0s ago: executing program 0 (id=1504): r0 = socket$inet_tcp(0x2, 0x1, 0x0) rt_tgsigqueueinfo(0x0, 0x0, 0x4, &(0x7f0000000d00)={0x0, 0x0, 0x6}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3e616dc4010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) syz_usb_control_io(r1, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000280)={0x0, 0x0, 0x1, "12"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x2c}, 0x44004) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r3, 0x8b37, &(0x7f0000000000)={'wlan1\x00', @random="000300000020"}) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f0000000140)=@ethtool_perm_addr={0x1f}}) socket$inet6_sctp(0xa, 0x0, 0x84) r5 = openat$dlm_control(0xffffff9c, &(0x7f0000000040), 0xa0701, 0x0) pwritev2(r5, &(0x7f0000000140)=[{&(0x7f00000001c0)='W', 0x1}], 0x2, 0x0, 0x0, 0x0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f0000000040)={{0x1, 0x1, 0x7fffffff, 0x0, 0x10000}}) r7 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r7, 0xc0405602, &(0x7f00000003c0)={0x8, 0x1, 0x2, "6040a7170200ff0120000000fcff00ff1057e31e940000000000000000aeff00", 0x50313134}) ioctl$SNDRV_TIMER_IOCTL_TREAD64(r6, 0x400454a4, 0x0) unlinkat(0xffffffffffffff9c, 0x0, 0x0) ioctl$SYNC_IOC_FILE_INFO(0xffffffffffffffff, 0xc0383e04, 0x0) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) kernel console output (not intermixed with test programs): acks suppressed [ 691.039609][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 691.285346][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 691.438400][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 691.597722][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 691.734470][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 691.994934][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 692.115496][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 692.231534][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 692.240320][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 692.248622][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 692.278818][T11845] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1077'. [ 692.304546][T11846] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1078'. [ 692.384614][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 692.504614][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 694.748596][T11872] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1082'. [ 695.936848][T11877] hub 1-0:1.0: USB hub found [ 695.987133][T11877] hub 1-0:1.0: 1 port detected [ 696.293149][ T3001] net_ratelimit: 20 callbacks suppressed [ 696.293164][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 696.458299][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 696.635849][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 696.790837][T11893] kAFS: unable to lookup cell '.,' [ 696.816575][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 696.944067][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 696.964468][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 697.013722][T11894] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1088'. [ 697.463693][ T5851] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 697.486944][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 697.725010][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 697.820065][ T5851] usb 1-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 697.834986][ T5851] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 697.835857][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 697.874709][ T5851] usb 1-1: Product: syz [ 697.881219][ T5851] usb 1-1: Manufacturer: syz [ 697.900368][ T5851] usb 1-1: SerialNumber: syz [ 698.021726][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 698.072152][ T5851] usb 1-1: config 0 descriptor?? [ 698.090515][ T5851] gspca_main: sonixb-2.14.0 probing 0c45:6005 [ 698.786999][T11894] netdevsim netdevsim0: Firmware load for '../file0/file0' refused, path contains '..' component [ 699.087032][ T5851] sonixb 1-1:0.0: Error writing register 01: -110 [ 699.101406][ T5851] sonixb 1-1:0.0: probe with driver sonixb failed with error -110 [ 700.035290][T11914] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1091'. [ 700.590543][T11929] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1093'. [ 701.012490][T11931] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1094'. [ 701.129897][ T5851] usb 1-1: USB disconnect, device number 26 [ 701.356668][ T2977] net_ratelimit: 16 callbacks suppressed [ 701.356682][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 701.624679][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 701.737953][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 701.864549][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 702.001760][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 702.149666][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 703.061996][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 703.184082][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 703.390459][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 703.559977][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 703.655964][T11958] hub 1-0:1.0: USB hub found [ 703.666251][T11958] hub 1-0:1.0: 1 port detected [ 704.245637][T11969] hub 1-0:1.0: USB hub found [ 704.254501][T11969] hub 1-0:1.0: 1 port detected [ 704.532029][T11973] EXT4-fs: Conflicting test_dummy_encryption options [ 704.890780][T11974] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1099'. [ 706.256608][T11978] fuse: Bad value for 'fd' [ 706.304918][ T5851] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 706.322697][ T5851] hid-generic 0000:0000:0000.0007: hidraw0: HID v0.00 Device [syz1] on syz0 [ 706.488598][ T3001] net_ratelimit: 21 callbacks suppressed [ 706.488616][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 706.625205][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 706.948686][T11986] geneve2: entered promiscuous mode [ 706.976423][T11986] geneve2: entered allmulticast mode [ 707.096512][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 707.143238][T11981] fido_id[11981]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 707.222467][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 707.354421][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 707.369346][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 707.539281][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 707.824650][T11997] delete_channel: no stack [ 708.055407][T12001] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1106'. [ 708.196478][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 708.305208][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 708.914532][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 709.845315][T12016] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1109'. [ 709.867238][T12016] netlink: 294 bytes leftover after parsing attributes in process `syz.3.1109'. [ 709.893972][T12016] netlink: 294 bytes leftover after parsing attributes in process `syz.3.1109'. [ 711.099562][ T10] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 711.457357][ T10] usb 3-1: config 0 has no interfaces? [ 711.514078][ C0] net_ratelimit: 13 callbacks suppressed [ 711.514097][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 711.518744][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 711.597635][ T10] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 711.691710][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.697577][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 711.739679][ T10] usb 3-1: Product: syz [ 711.760044][ T10] usb 3-1: Manufacturer: syz [ 711.788138][ T10] usb 3-1: SerialNumber: syz [ 711.815187][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 711.823735][ T10] usb 3-1: config 0 descriptor?? [ 711.849837][T12040] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1113'. [ 711.925180][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 712.047257][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 712.254490][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 712.367047][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 712.378826][T12024] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1110'. [ 712.401684][T12024] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 712.413394][T12024] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 712.533565][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 712.582879][T12046] hub 1-0:1.0: USB hub found [ 712.588927][T12046] hub 1-0:1.0: 1 port detected [ 712.654520][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 713.970869][T12053] hub 1-0:1.0: USB hub found [ 713.980335][T12053] hub 1-0:1.0: 1 port detected [ 714.509324][ T939] usb 3-1: USB disconnect, device number 20 [ 714.574904][ T5851] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 714.660372][T12064] hub 1-0:1.0: USB hub found [ 714.666595][T12064] hub 1-0:1.0: 1 port detected [ 715.467752][ T5851] usb 5-1: config 0 has an invalid interface number: 197 but max is 0 [ 715.520571][ T5851] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 715.588071][ T5851] usb 5-1: config 0 has no interface number 0 [ 715.608375][ T5851] usb 5-1: config 0 interface 197 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 8 [ 715.753043][ T5851] usb 5-1: config 0 interface 197 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 715.772729][ T5851] usb 5-1: config 0 interface 197 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 715.832850][T12067] geneve2: entered promiscuous mode [ 715.842847][T12067] geneve2: entered allmulticast mode [ 715.879358][ T5851] usb 5-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=bb.42 [ 715.902445][ T5851] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 715.925993][ T5851] usb 5-1: Product: syz [ 715.936953][ T5851] usb 5-1: Manufacturer: syz [ 716.019467][ T5851] usb 5-1: SerialNumber: syz [ 716.065494][ T5851] usb 5-1: config 0 descriptor?? [ 716.105758][T12055] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 716.535129][ T2977] net_ratelimit: 25 callbacks suppressed [ 716.535151][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 716.654877][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 716.764805][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 716.875337][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 716.985903][T12078] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1120'. [ 717.026880][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 717.174582][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 717.325122][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 717.459791][T12077] netlink: 320 bytes leftover after parsing attributes in process `syz.1.1121'. [ 717.473017][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 717.596032][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 717.744028][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 718.324870][ T2155] usb 5-1: USB disconnect, device number 22 [ 718.894871][ T5851] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 719.168575][ T5851] usb 2-1: config 0 has no interfaces? [ 719.211821][ T5851] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 719.286884][ T5851] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 719.304853][ T5851] usb 2-1: Product: syz [ 719.309037][ T5851] usb 2-1: Manufacturer: syz [ 719.313639][ T5851] usb 2-1: SerialNumber: syz [ 719.351065][T12102] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1127'. [ 719.569652][T12103] syzkaller0: entered promiscuous mode [ 719.575506][T12103] syzkaller0: entered allmulticast mode [ 719.726091][ T5851] usb 2-1: config 0 descriptor?? [ 720.131070][T12095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 720.141684][T12095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 720.250553][T12095] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1124'. [ 720.261211][ T5851] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 720.414470][ T5851] usb 1-1: Using ep0 maxpacket: 8 [ 720.431770][ T5851] usb 1-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=35.76 [ 720.447058][ T5851] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 720.461860][ T5851] usb 1-1: Product: syz [ 720.478675][ T5851] usb 1-1: Manufacturer: syz [ 720.491589][ T5851] usb 1-1: SerialNumber: syz [ 720.516053][ T5851] usb 1-1: config 0 descriptor?? [ 720.559707][ T5851] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 721.596169][T12094] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1125'. [ 721.914077][ C0] net_ratelimit: 17 callbacks suppressed [ 721.914096][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 722.535787][T12126] input: syz1 as /devices/virtual/input/input28 [ 722.946895][ C1] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 723.786568][T12112] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1124'. [ 723.810407][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 723.936606][ T5851] gspca_m5602: Failed to find a sensor [ 723.942064][ T5851] ALi m5602 1-1:0.0: ALi m5602 webcam failed [ 723.955233][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 723.996117][ T5851] usb 1-1: USB disconnect, device number 27 [ 723.997756][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 724.060044][ T939] usb 2-1: USB disconnect, device number 22 [ 724.114900][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 724.225142][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 724.335332][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 724.634987][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 724.715919][T12144] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1134'. [ 724.746108][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 725.092959][ T5150] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 725.255259][T12147] geneve2: entered promiscuous mode [ 725.295465][T12147] geneve2: entered allmulticast mode [ 725.519579][T12149] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1132'. [ 726.187831][T12158] syz.4.1136 (12158): drop_caches: 2 [ 726.983049][ T8161] net_ratelimit: 13 callbacks suppressed [ 726.983067][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 727.421835][T12170] hub 1-0:1.0: USB hub found [ 727.427845][T12170] hub 1-0:1.0: 1 port detected [ 727.448446][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 727.594776][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 727.704865][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 727.794799][ T24] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 727.872541][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 727.964854][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 727.991900][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 728.114402][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 728.154212][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 728.196680][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 728.244489][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 728.267643][T12180] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1141'. [ 728.322853][T12179] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1139'. [ 728.359725][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 728.391014][ T24] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 728.411861][ T24] usb 2-1: New USB device found, idVendor=1608, idProduct=0207, bcdDevice=43.8e [ 728.425107][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 728.477920][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 728.864920][ T24] usb 2-1: config 0 descriptor?? [ 728.882324][ T24] io_ti 2-1:0.0: required endpoints missing [ 729.536278][T12191] geneve2: entered promiscuous mode [ 729.541564][T12191] geneve2: entered allmulticast mode [ 730.025581][T12196] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1143'. [ 730.294830][ T24] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 730.446208][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 730.486351][ T24] usb 3-1: unable to get BOS descriptor or descriptor too short [ 730.496191][ T24] usb 3-1: config 4 interface 0 has no altsetting 0 [ 730.508617][ T24] usb 3-1: string descriptor 0 read error: -22 [ 730.516312][ T24] usb 3-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 730.526121][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 730.548016][ T24] usb 3-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 730.573673][ T24] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 730.595510][ T24] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 730.660424][ T24] usb 3-1: media controller created [ 730.743325][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 730.782102][T12200] netlink: 'syz.3.1144': attribute type 27 has an invalid length. [ 731.086201][ T9167] usb 2-1: USB disconnect, device number 23 [ 731.730944][T12209] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1145'. [ 731.903284][T12212] vivid-008: disconnect [ 731.949265][ T24] zl10353_read_register: readreg error (reg=127, ret==0) [ 731.986157][ T9167] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 732.094745][T12211] syzkaller0: entered promiscuous mode [ 732.100253][T12211] syzkaller0: entered allmulticast mode [ 732.184699][ T9167] usb 2-1: Using ep0 maxpacket: 16 [ 732.218631][ T9167] usb 2-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 732.230589][ T9167] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 732.255875][ T9167] usb 2-1: Product: syz [ 732.269264][ T9167] usb 2-1: Manufacturer: syz [ 732.286958][ T9167] usb 2-1: SerialNumber: syz [ 732.304678][ C0] net_ratelimit: 25 callbacks suppressed [ 732.304692][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 732.393305][ T9167] usb 2-1: config 0 descriptor?? [ 732.616527][ T9167] visor 2-1:0.0: Sony Clie 3.5 converter detected [ 732.643166][T12202] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 732.653168][T12212] vivid-008: reconnect [ 732.655614][T12202] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 732.852862][T12219] usb usb8: usbfs: process 12219 (syz.0.1147) did not claim interface 0 before use [ 732.870826][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 732.870838][ T30] audit: type=1400 audit(1762232590.816:2752): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=3A273A02 pid=12215 comm="syz.0.1147" [ 732.898735][ T9167] usb 2-1: Sony Clie 3.5 converter now attached to ttyUSB0 [ 733.449733][ T24] usb 2-1: USB disconnect, device number 24 [ 733.465468][ T24] clie_3.5 ttyUSB0: Sony Clie 3.5 converter now disconnected from ttyUSB0 [ 733.474722][ T24] visor 2-1:0.0: device disconnected [ 733.919621][ T24] usb 3-1: USB disconnect, device number 21 [ 734.265722][T12228] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1149'. [ 734.394033][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 736.047864][T12249] hub 1-0:1.0: USB hub found [ 736.054436][T12249] hub 1-0:1.0: 1 port detected [ 736.171142][T12250] hub 1-0:1.0: USB hub found [ 736.177323][T12250] hub 1-0:1.0: 1 port detected [ 736.465197][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 737.309478][T12259] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1154'. [ 738.435336][T12226] veth1_macvtap: left promiscuous mode [ 738.440885][T12226] macsec0: entered promiscuous mode [ 738.466142][T12230] vlan2: entered allmulticast mode [ 738.471247][T12230] syz_tun: entered allmulticast mode [ 738.494449][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 738.544594][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 738.664417][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 738.791883][T12270] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1157'. [ 738.862817][T12271] geneve3: entered promiscuous mode [ 738.902773][T12271] geneve3: entered allmulticast mode [ 738.985465][T12276] hub 1-0:1.0: USB hub found [ 738.994455][T12276] hub 1-0:1.0: 1 port detected [ 739.184984][ T24] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 739.256618][T12279] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1161'. [ 739.572115][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 739.684456][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 739.727896][T12284] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1160'. [ 739.800661][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 739.814666][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 739.905213][ T24] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 739.932066][ T24] usb 4-1: config 0 has no interface number 0 [ 739.934355][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 739.956111][ T24] usb 4-1: config 0 interface 184 has no altsetting 0 [ 740.011556][ T24] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 740.023420][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 740.047546][ T24] usb 4-1: Product: syz [ 740.060346][ T24] usb 4-1: Manufacturer: syz [ 740.082070][ T24] usb 4-1: SerialNumber: syz [ 740.217365][ T24] usb 4-1: config 0 descriptor?? [ 740.279637][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 740.292485][ T24] smsc75xx v1.0.0 [ 740.296935][ T24] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 740.327463][ T24] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -22 [ 740.394398][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 740.504688][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 741.132215][T12289] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1162'. [ 741.987534][ T24] usb 4-1: USB disconnect, device number 22 [ 742.068588][T12296] hub 1-0:1.0: USB hub found [ 742.073650][T12296] hub 1-0:1.0: 1 port detected [ 742.430198][T12305] hub 1-0:1.0: USB hub found [ 742.436258][T12305] hub 1-0:1.0: 1 port detected [ 742.595422][T12308] bridge0: port 2(bridge_slave_1) entered disabled state [ 742.604029][T12308] bridge0: port 1(bridge_slave_0) entered disabled state [ 743.334968][ T9167] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 743.555085][ T8159] net_ratelimit: 21 callbacks suppressed [ 743.555100][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 743.734433][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 743.814581][ T9167] usb 2-1: Using ep0 maxpacket: 32 [ 743.852296][ T9167] usb 2-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 743.864872][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 743.932071][ T9167] usb 2-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 743.955197][ T9167] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 743.979677][ T9167] usb 2-1: Product: syz [ 743.984467][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 744.024677][ T9167] usb 2-1: Manufacturer: syz [ 744.029291][ T9167] usb 2-1: SerialNumber: syz [ 744.092553][ T9167] usb 2-1: config 0 descriptor?? [ 744.097819][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 744.122954][T12318] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1168'. [ 744.133625][ T9167] cdc_ether 2-1:0.0: skipping garbage [ 744.185806][ T9167] usb 2-1: bad CDC descriptors [ 744.245888][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 744.254801][ T9167] usb 2-1: unsupported MDLM descriptors [ 744.354723][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 744.457361][T12324] syzkaller0: entered promiscuous mode [ 744.533156][T12324] syzkaller0: entered allmulticast mode [ 744.576930][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 744.784046][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 744.992110][T12333] usb usb8: usbfs: process 12333 (syz.4.1171) did not claim interface 0 before use [ 745.005895][T12334] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1170'. [ 745.074031][T12333] kvm: pic: single mode not supported [ 745.074250][T12333] kvm: pic: non byte read [ 745.130627][T12333] kvm: pic: non byte read [ 745.154767][T12333] kvm: pic: non byte read [ 745.159372][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 745.160930][T12333] kvm: pic: non byte read [ 745.174757][T12333] kvm: pic: non byte read [ 745.289742][T12333] kvm: pic: non byte read [ 745.394592][T12333] kvm: pic: non byte read [ 745.400151][T12333] kvm: pic: non byte read [ 745.409655][T12333] kvm: pic: non byte read [ 747.306741][T12347] hub 1-0:1.0: USB hub found [ 747.314525][T12347] hub 1-0:1.0: 1 port detected [ 747.465096][T12346] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1172'. [ 747.500957][T12346] bridge_slave_1: left allmulticast mode [ 747.524691][T12346] bridge_slave_1: left promiscuous mode [ 747.551104][ T2155] usb 2-1: USB disconnect, device number 25 [ 747.562633][T12346] bridge0: port 2(bridge_slave_1) entered disabled state [ 747.798933][T12346] bridge_slave_0: left allmulticast mode [ 747.927477][T12346] bridge_slave_0: left promiscuous mode [ 747.956873][T12346] bridge0: port 1(bridge_slave_0) entered disabled state [ 748.057385][T12355] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1174'. [ 748.352486][T12359] program syz.2.1175 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 748.944053][ C0] net_ratelimit: 15 callbacks suppressed [ 748.944072][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 749.734774][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 749.845336][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 749.975118][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 750.081243][T12373] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 750.114874][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 750.286867][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 750.307763][T12378] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1179'. [ 750.424860][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 750.469849][ T2155] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 750.544701][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 750.644474][ T9167] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 750.664475][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 750.724822][ T2155] usb 2-1: Using ep0 maxpacket: 16 [ 750.742917][ T2155] usb 2-1: New USB device found, idVendor=0403, idProduct=b8d8, bcdDevice=30.bb [ 750.758632][ T2155] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 750.819385][ T9167] usb 1-1: Using ep0 maxpacket: 16 [ 750.912786][ T9167] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 750.924331][ T9167] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 750.935778][ T2155] usb 2-1: Product: syz [ 750.939923][ T2155] usb 2-1: Manufacturer: syz [ 750.961515][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 751.006716][ T9167] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 751.041987][ T2155] usb 2-1: SerialNumber: syz [ 751.064434][ T9167] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 751.112588][ T9167] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 751.153682][ T9167] usb 1-1: config 0 descriptor?? [ 751.471308][T12385] fuse: Invalid rootmode [ 751.811592][ T9167] microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 [ 751.895513][ T9167] microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 [ 751.902767][ T9167] microsoft 0003:045E:07DA.0008: ignoring exceeding usage max [ 751.942696][ T9167] microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 [ 751.950392][ T9167] microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 [ 751.961864][ T9167] microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 [ 752.245474][ T2155] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 752.274881][T12389] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1182'. [ 752.308595][ T9167] microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 [ 752.325290][ T9167] microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 [ 752.334883][ T9167] microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 [ 752.342296][ T9167] microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 [ 752.351508][ T9167] microsoft 0003:045E:07DA.0008: unknown main item tag 0x0 [ 752.378375][ T9167] microsoft 0003:045E:07DA.0008: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 752.424713][ T9167] microsoft 0003:045E:07DA.0008: no inputs found [ 752.438711][ T9167] microsoft 0003:045E:07DA.0008: could not initialize ff, continuing anyway [ 752.585399][ T2155] snd-usb-audio 2-1:222.0: probe with driver snd-usb-audio failed with error -2 [ 752.609325][ T9167] usb 1-1: USB disconnect, device number 28 [ 752.655847][ T5888] udevd[5888]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:222.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 752.684060][ T2155] usb 2-1: USB disconnect, device number 26 [ 752.877434][T11488] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 753.009516][T12399] fuse: Unknown parameter '00000000000000000000007' [ 753.034431][T11488] usb 5-1: Using ep0 maxpacket: 8 [ 753.043209][T11488] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 753.071078][T11488] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 753.092444][T11488] usb 5-1: New USB device found, idVendor=0c70, idProduct=f00a, bcdDevice= 0.00 [ 753.112498][T11488] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 753.146568][T11488] usb 5-1: config 0 descriptor?? [ 753.406689][T12409] binder: BINDER_SET_CONTEXT_MGR already set [ 753.412851][T12409] binder: 12405:12409 ioctl 4018620d 80000040 returned -16 [ 753.694467][ T2155] usb 3-1: new full-speed USB device number 22 using dummy_hcd [ 753.707661][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 753.716899][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 753.938314][ T939] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 754.057283][ T1166] net_ratelimit: 22 callbacks suppressed [ 754.057300][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 754.166480][ T939] usb 2-1: Using ep0 maxpacket: 32 [ 754.174935][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 754.189757][ T939] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 754.201983][ T939] usb 2-1: config 0 has no interface number 0 [ 754.216455][ T939] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 754.226746][ T939] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 754.239036][ T939] usb 2-1: Product: syz [ 754.247423][ T2155] usb 3-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 754.257276][ T2155] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 754.257380][ T939] usb 2-1: Manufacturer: syz [ 754.526720][ T939] usb 2-1: SerialNumber: syz [ 754.545343][ T2155] usb 3-1: config 0 descriptor?? [ 754.553336][ T939] usb 2-1: config 0 descriptor?? [ 754.563574][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 754.580130][ T939] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 754.596813][ T2155] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 754.684918][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 754.794821][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 755.010064][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 755.135139][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 755.155235][ T939] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 755.184048][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 755.209654][ T939] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 755.254601][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 755.364748][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 755.665051][ C1] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 755.665924][ T10] usb 2-1: USB disconnect, device number 27 [ 755.699537][ T10] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 755.751902][ T10] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 755.794655][ T10] quatech2 2-1:0.51: device disconnected [ 755.923370][T11488] usbhid 5-1:0.0: can't add hid device: -71 [ 755.930192][T11488] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 756.004471][T12426] netlink: 'syz.0.1189': attribute type 10 has an invalid length. [ 756.032597][T12426] team0: Port device dummy0 added [ 756.055006][T12426] netlink: 'syz.0.1189': attribute type 10 has an invalid length. [ 756.065821][T12426] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 756.137533][T11488] usb 5-1: USB disconnect, device number 23 [ 756.237726][T12426] team0: Failed to send options change via netlink (err -105) [ 756.251390][T12426] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 756.282210][T12426] team0: Port device dummy0 removed [ 756.301724][T12426] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 756.540495][ T2155] gp8psk: usb in 128 operation failed. [ 756.554625][ T939] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 756.588784][ T2155] gp8psk: usb in 137 operation failed. [ 756.604374][ T2155] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 756.628684][ T2155] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 756.646012][ T2155] usb 3-1: USB disconnect, device number 22 [ 756.684187][T12435] trusted_key: encrypted key: instantiation of keys using provided decrypted data is disabled since CONFIG_USER_DECRYPTED_DATA is set to false [ 756.882557][T12443] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1193'. [ 756.899442][T12443] netlink: 34 bytes leftover after parsing attributes in process `syz.2.1193'. [ 757.409906][ T939] usb 1-1: New USB device found, idVendor=041e, idProduct=4011, bcdDevice=af.98 [ 757.453050][ T939] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 757.544935][ T939] usb 1-1: config 0 descriptor?? [ 757.572528][T12451] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1192'. [ 757.780343][ T939] pwc: Creative Labs Webcam Pro Ex detected. [ 759.041682][T12462] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1195'. [ 759.122626][ T1166] net_ratelimit: 25 callbacks suppressed [ 759.122644][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 759.334427][T12462] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1195'. [ 759.343998][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 759.584843][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 759.626483][ T939] pwc: Failed to set LED on/off time (-71) [ 759.653676][ T939] pwc: send_video_command error -71 [ 759.665042][ T939] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 759.675557][ T939] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71 [ 759.694506][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 759.717269][ T939] usb 1-1: USB disconnect, device number 29 [ 759.776667][T11488] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 759.854420][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 760.004859][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 760.093177][T11488] usb 2-1: Using ep0 maxpacket: 16 [ 760.105010][T11488] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 760.116183][T11488] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 760.130314][T11488] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 760.141565][T11488] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 760.161478][T11488] usb 2-1: config 0 descriptor?? [ 760.216366][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 760.627399][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 760.635902][T12481] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1199'. [ 760.898164][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 760.931424][T11488] hid_parser_main: 3 callbacks suppressed [ 760.931438][T11488] microsoft 0003:045E:07DA.0009: unknown main item tag 0x0 [ 760.954366][T11488] microsoft 0003:045E:07DA.0009: unknown main item tag 0x0 [ 761.001637][T11488] microsoft 0003:045E:07DA.0009: unknown main item tag 0x0 [ 761.015503][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 761.047840][T11488] microsoft 0003:045E:07DA.0009: unknown main item tag 0x0 [ 761.538972][T11488] microsoft 0003:045E:07DA.0009: unknown main item tag 0x0 [ 761.590128][T11488] microsoft 0003:045E:07DA.0009: unknown main item tag 0x0 [ 761.603828][T11488] microsoft 0003:045E:07DA.0009: unknown main item tag 0x0 [ 761.634386][T11488] microsoft 0003:045E:07DA.0009: unknown main item tag 0x0 [ 761.687419][T11488] microsoft 0003:045E:07DA.0009: unknown main item tag 0x0 [ 761.705032][T11488] microsoft 0003:045E:07DA.0009: unknown main item tag 0x0 [ 761.770268][T12487] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1200'. [ 761.789945][T11488] HID 045e:07da: Invalid code 65791 type 1 [ 761.802225][T11488] HID 045e:07da: Invalid code 768 type 1 [ 761.841612][T11488] HID 045e:07da: Invalid code 769 type 1 [ 761.879471][T11488] HID 045e:07da: Invalid code 770 type 1 [ 761.906688][T11488] HID 045e:07da: Invalid code 771 type 1 [ 761.953983][T11488] HID 045e:07da: Invalid code 772 type 1 [ 761.974770][T11488] HID 045e:07da: Invalid code 773 type 1 [ 761.993044][T11488] HID 045e:07da: Invalid code 774 type 1 [ 762.028140][T11488] HID 045e:07da: Invalid code 775 type 1 [ 762.044910][T11488] HID 045e:07da: Invalid code 776 type 1 [ 762.077658][T11488] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0009/input/input31 [ 762.260134][T11488] microsoft 0003:045E:07DA.0009: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 762.528282][T11488] usb 2-1: USB disconnect, device number 28 [ 762.623431][T12501] fido_id[12501]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 762.696670][T12504] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1202'. [ 762.935483][T12511] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1205'. [ 763.067089][T12514] fuse: Unknown parameter 'mGN8oad' [ 763.746353][ T939] IPVS: starting estimator thread 0... [ 763.844648][T12516] IPVS: using max 50 ests per chain, 120000 per kthread [ 764.205346][ T80] net_ratelimit: 22 callbacks suppressed [ 764.205367][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 764.394596][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 764.445865][T12528] hub 1-0:1.0: USB hub found [ 764.453049][T12528] hub 1-0:1.0: 1 port detected [ 764.755176][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 764.877739][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 764.934607][T12532] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1209'. [ 765.004943][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 765.154118][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 765.311200][T12543] netlink: 'syz.4.1211': attribute type 27 has an invalid length. [ 765.436882][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 765.584721][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 765.599902][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 765.714650][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 766.838048][T12553] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1213'. [ 767.683320][T12564] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1215'. [ 767.958911][T12569] hub 1-0:1.0: USB hub found [ 768.096466][T12568] sctp: [Deprecated]: syz.2.1214 (pid 12568) Use of int in maxseg socket option. [ 768.096466][T12568] Use struct sctp_assoc_value instead [ 768.174252][T12569] hub 1-0:1.0: 1 port detected [ 768.748149][T12577] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1217'. [ 768.894966][T12581] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1218'. [ 769.149240][T12585] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1219'. [ 769.256888][ T8163] net_ratelimit: 22 callbacks suppressed [ 769.256902][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 769.384958][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 769.507592][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 769.645735][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 769.744567][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 769.759449][ T10] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 769.827094][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 770.019246][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 770.054472][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 770.064820][ T10] usb 2-1: config 0 has an invalid interface number: 247 but max is 0 [ 770.073125][ T10] usb 2-1: config 0 has no interface number 0 [ 770.144968][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 770.177322][ T10] usb 2-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 770.254643][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 770.265449][ T10] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 770.318009][ T10] usb 2-1: Product: syz [ 770.348305][ T10] usb 2-1: Manufacturer: syz [ 770.364404][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 770.454603][ T10] usb 2-1: config 0 descriptor?? [ 771.984497][T11488] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 772.001484][T12611] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1223'. [ 772.438268][T11488] usb 3-1: config 0 has no interfaces? [ 772.456921][T11488] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 772.778535][T11488] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 772.830860][T11488] usb 3-1: Product: syz [ 772.846122][T11488] usb 3-1: Manufacturer: syz [ 772.852364][T11488] usb 3-1: SerialNumber: syz [ 772.879137][T11488] usb 3-1: config 0 descriptor?? [ 773.035280][T12617] hub 1-0:1.0: USB hub found [ 773.040851][T12617] hub 1-0:1.0: 1 port detected [ 773.190382][T12608] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1224'. [ 773.220787][T12608] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 773.236126][T12608] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 773.336295][ T939] usb 2-1: USB disconnect, device number 29 [ 773.408978][T12621] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1226'. [ 773.772899][T12628] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1227'. [ 774.239540][T12631] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1228'. [ 774.397296][ T80] net_ratelimit: 28 callbacks suppressed [ 774.397309][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 774.634595][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 774.753012][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 774.894362][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 774.942558][ T2155] usb 3-1: USB disconnect, device number 23 [ 775.004867][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 775.127083][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 775.334401][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 775.446997][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 775.594595][ T10] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 775.624358][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 775.714392][ T2155] usb 1-1: new full-speed USB device number 30 using dummy_hcd [ 775.762539][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 775.843538][ T10] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 775.965739][ T10] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 775.991441][ T10] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 776.022355][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 776.049829][ T2155] usb 1-1: config 0 has no interfaces? [ 776.077092][ T2155] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 776.098060][T12639] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 776.109741][ T10] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 776.131734][ T2155] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 776.261072][T12653] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 776.370245][ T2155] usb 1-1: Product: syz [ 776.436742][ T2155] usb 1-1: Manufacturer: syz [ 776.482529][ T2155] usb 1-1: SerialNumber: syz [ 776.744728][ T2155] usb 1-1: config 0 descriptor?? [ 777.707442][T12663] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1234'. [ 778.165605][ T939] usb 3-1: USB disconnect, device number 24 [ 778.454749][T12672] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1236'. [ 778.783495][ T2155] usb 1-1: USB disconnect, device number 30 [ 779.506088][ T8163] net_ratelimit: 30 callbacks suppressed [ 779.506101][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 779.710818][T12681] geneve2: entered promiscuous mode [ 779.717559][T12681] geneve2: entered allmulticast mode [ 779.825479][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 780.030504][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 780.154013][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 780.169234][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 780.262351][T12692] geneve3: entered promiscuous mode [ 780.270768][T12692] geneve3: entered allmulticast mode [ 780.544573][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 781.011672][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 781.174421][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 781.215405][T12698] hub 1-0:1.0: USB hub found [ 781.232113][T12698] hub 1-0:1.0: 1 port detected [ 781.297803][ T939] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 781.304323][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 781.440033][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 781.488453][T12704] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1242'. [ 781.608767][ T939] usb 3-1: Using ep0 maxpacket: 16 [ 781.620121][ T939] usb 3-1: too many configurations: 185, using maximum allowed: 8 [ 781.655752][ T939] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 781.663370][ T939] usb 3-1: can't read configurations, error -61 [ 781.791762][T12710] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1243'. [ 781.801213][ T939] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 781.809398][ T5830] Bluetooth: hci4: command 0x0405 tx timeout [ 782.001780][ T939] usb 3-1: Using ep0 maxpacket: 16 [ 782.030201][ T939] usb 3-1: too many configurations: 185, using maximum allowed: 8 [ 782.076101][ T939] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 782.096011][ T939] usb 3-1: can't read configurations, error -61 [ 782.132642][ T939] usb usb3-port1: attempt power cycle [ 782.139292][ T2155] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 782.314407][ T2155] usb 1-1: Using ep0 maxpacket: 8 [ 782.326998][ T2155] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 782.341046][ T2155] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 782.409724][ T2155] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 782.502553][ T2155] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 782.525440][ T2155] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 782.552969][ T2155] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 782.562322][ T939] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 782.950049][ T2155] usb 1-1: GET_CAPABILITIES returned 0 [ 783.006038][ T2155] usbtmc 1-1:16.0: can't read capabilities [ 783.205906][ T939] usb 3-1: device descriptor read/8, error -71 [ 783.668948][T12732] usb 1-1: USB disconnect, device number 31 [ 783.685832][T12728] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1246'. [ 783.772647][T12734] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1247'. [ 784.027447][T12732] hub 1-0:1.0: USB hub found [ 784.033609][T12732] hub 1-0:1.0: 1 port detected [ 784.336938][ T2155] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 784.565587][ T2977] net_ratelimit: 23 callbacks suppressed [ 784.565601][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 784.734502][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 784.845059][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 784.927442][T12709] delete_channel: no stack [ 784.955323][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 785.064703][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 785.116415][T12750] fuse: Invalid rootmode [ 785.174733][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 785.284502][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 785.394725][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 785.504742][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 785.581761][T12760] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1251'. [ 785.622093][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 785.680721][T12760] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1251'. [ 786.579528][T12772] netlink: 196 bytes leftover after parsing attributes in process `syz.1.1253'. [ 786.608781][T12772] netlink: 'syz.1.1253': attribute type 8 has an invalid length. [ 787.387090][T12779] fuse: Unknown parameter 'mGN8oad' [ 787.549995][T12781] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1255'. [ 787.788564][ T24] IPVS: starting estimator thread 0... [ 787.884979][T12786] IPVS: using max 29 ests per chain, 69600 per kthread [ 787.971343][T12790] geneve2: entered promiscuous mode [ 787.977437][T12790] geneve2: entered allmulticast mode [ 789.336275][T12806] input: syz0 as /devices/virtual/input/input32 [ 789.624938][ T8159] net_ratelimit: 30 callbacks suppressed [ 789.624955][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 789.753385][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 789.776548][T12810] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1260'. [ 790.080579][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 790.343473][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 790.494827][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 790.544071][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 790.604792][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 790.715103][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 790.851603][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 790.966308][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 791.105734][T12821] netlink: 'syz.1.1261': attribute type 2 has an invalid length. [ 791.310538][T12824] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1262'. [ 791.777009][T12818] GUP no longer grows the stack in syz.1.1261 (12818): 80005000-80008000 (80004000) [ 791.787791][T12818] CPU: 1 UID: 0 PID: 12818 Comm: syz.1.1261 Not tainted syzkaller #0 PREEMPT(full) [ 791.787814][T12818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 791.787825][T12818] Call Trace: [ 791.787833][T12818] [ 791.787841][T12818] dump_stack_lvl+0x189/0x250 [ 791.787876][T12818] ? __pfx_dump_stack_lvl+0x10/0x10 [ 791.787901][T12818] ? __pfx__printk+0x10/0x10 [ 791.787917][T12818] ? find_vma+0xe7/0x160 [ 791.787953][T12818] fixup_user_fault+0x661/0x720 [ 791.787983][T12818] fault_in_user_writeable+0x72/0xe0 [ 791.788008][T12818] futex_lock_pi+0x773/0xa90 [ 791.788035][T12818] ? __pfx_futex_lock_pi+0x10/0x10 [ 791.788075][T12818] ? futex_private_hash_put+0x4b/0x280 [ 791.788102][T12818] ? __pfx_futex_wake_mark+0x10/0x10 [ 791.788127][T12818] ? __pfx_futex_wake+0x10/0x10 [ 791.788143][T12818] ? userfaultfd_unmap_complete+0x278/0x2d0 [ 791.788176][T12818] ? __pfx_userfaultfd_unmap_complete+0x10/0x10 [ 791.788211][T12818] do_futex+0x292/0x420 [ 791.788241][T12818] ? __pfx_do_futex+0x10/0x10 [ 791.788266][T12818] ? __vm_munmap+0x2c1/0x380 [ 791.788293][T12818] __se_sys_futex_time32+0x360/0x3e0 [ 791.788324][T12818] ? __pfx___se_sys_futex_time32+0x10/0x10 [ 791.788352][T12818] ? rcu_is_watching+0x15/0xb0 [ 791.788377][T12818] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 791.788403][T12818] ? __ia32_sys_futex_time32+0x21/0xf0 [ 791.788425][T12818] __do_fast_syscall_32+0xb6/0x2b0 [ 791.788450][T12818] ? asm_int80_emulation+0x1a/0x20 [ 791.788468][T12818] ? do_int80_emulation+0x1f3/0x390 [ 791.788496][T12818] do_fast_syscall_32+0x34/0x80 [ 791.788520][T12818] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 791.788541][T12818] RIP: 0023:0xf709d539 [ 791.788557][T12818] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 791.788572][T12818] RSP: 002b:00000000f502855c EFLAGS: 00000206 ORIG_RAX: 00000000000000f0 [ 791.788591][T12818] RAX: ffffffffffffffda RBX: 0000000080004000 RCX: 000000000000008d [ 791.788603][T12818] RDX: 00000000fffffffd RSI: 0000000000000000 RDI: 0000000000000000 [ 791.788614][T12818] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 791.788624][T12818] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 791.788634][T12818] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 791.788663][T12818] [ 792.640836][T12836] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1264'. [ 793.095538][T12843] hub 1-0:1.0: USB hub found [ 793.100516][T12843] hub 1-0:1.0: 1 port detected [ 794.342731][T12848] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1266'. [ 794.639168][ T2977] net_ratelimit: 25 callbacks suppressed [ 794.639186][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 794.713984][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 794.766780][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 794.835767][ T939] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 794.939529][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 794.976197][T12862] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1269'. [ 795.096613][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 795.142436][T12863] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1270'. [ 795.163540][ T939] usb 2-1: Using ep0 maxpacket: 8 [ 795.234465][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 795.322895][ T939] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 795.354588][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 795.359617][ T939] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 795.403391][ T939] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 795.430084][T12868] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 795.503169][ T939] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 795.504359][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 795.566013][ T939] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 795.658611][T12871] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1271'. [ 795.683317][ T939] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 795.704474][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 795.870061][ T939] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 795.887775][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 796.184547][ T939] usb 2-1: usb_control_msg returned -32 [ 796.190127][ T939] usbtmc 2-1:16.0: can't read capabilities [ 796.736316][T12874] usbtmc 2-1:16.0: usb_control_msg returned -32 [ 796.823155][T12883] fuse: root generation should be zero [ 796.855645][T12882] hub 1-0:1.0: USB hub found [ 796.864936][T12882] hub 1-0:1.0: 1 port detected [ 797.425642][T12894] hub 1-0:1.0: USB hub found [ 797.434881][T12894] hub 1-0:1.0: 1 port detected [ 797.796814][T12892] geneve2: entered promiscuous mode [ 797.802350][T12892] geneve2: entered allmulticast mode [ 798.293321][ T9167] usb 2-1: USB disconnect, device number 30 [ 798.676373][T12902] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1277'. [ 798.929890][T12907] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1278'. [ 799.026761][T12907] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1278'. [ 799.325514][ T939] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 799.846519][ T939] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 799.857901][ T939] usb 1-1: config 0 interface 0 has no altsetting 0 [ 799.862526][ T8163] net_ratelimit: 26 callbacks suppressed [ 799.862541][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 799.867624][ T939] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 799.893343][ T939] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 799.902031][ T939] usb 1-1: Product: syz [ 799.907537][ T939] usb 1-1: Manufacturer: syz [ 799.915721][ T939] usb 1-1: SerialNumber: syz [ 799.928788][ T939] usb 1-1: config 0 descriptor?? [ 799.971516][ T939] usb 1-1: selecting invalid altsetting 0 [ 800.044396][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 800.193808][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 800.309523][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 800.444355][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 800.607018][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 800.735799][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 800.809508][T12921] usb 1-1: USB disconnect, device number 33 [ 800.854414][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 800.954592][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 800.975271][ T2155] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 801.002961][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 801.194544][ T2155] usb 5-1: Using ep0 maxpacket: 16 [ 801.209187][ T2155] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 801.249062][ T2155] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 801.328449][T12925] hub 1-0:1.0: USB hub found [ 801.336657][T12925] hub 1-0:1.0: 1 port detected [ 801.477591][ T939] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 801.565805][ T2155] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 801.602683][T12923] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1281'. [ 801.650547][T12923] netlink: 320 bytes leftover after parsing attributes in process `syz.3.1281'. [ 801.696189][ T2155] usb 5-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 801.709193][ T2155] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 801.743724][ T2155] usb 5-1: Product: syz [ 801.795888][ T2155] usb 5-1: Manufacturer: syz [ 801.876339][ T2155] usb 5-1: SerialNumber: syz [ 801.948022][ T2155] usb 5-1: config 0 descriptor?? [ 801.966566][T12920] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 802.004811][ T2155] mcba_usb 5-1:0.0 can0: failed tx_urb -90 [ 802.091900][T12930] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1283'. [ 802.102597][ T2155] mcba_usb 5-1:0.0 can0: Failed to send cmd (169) [ 802.154537][ T2155] mcba_usb 5-1:0.0 can0: failed tx_urb -90 [ 802.169794][ T2155] mcba_usb 5-1:0.0 can0: Failed to send cmd (169) [ 802.204644][T12920] netlink: 'syz.4.1280': attribute type 5 has an invalid length. [ 802.244670][T12920] ip6erspan0: entered promiscuous mode [ 802.670416][ T2155] mcba_usb 5-1:0.0: Microchip CAN BUS Analyzer connected [ 803.411457][T12937] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1285'. [ 803.496684][T12938] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1284'. [ 803.807782][T12951] input: syz1 as /devices/virtual/input/input33 [ 804.347377][ T939] usb 5-1: USB disconnect, device number 24 [ 804.398689][ T939] mcba_usb 5-1:0.0 can0: device disconnected [ 804.905622][T12971] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.1288'. [ 805.104026][ C0] net_ratelimit: 29 callbacks suppressed [ 805.104043][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 805.255997][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 805.387345][ T2155] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 805.535758][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 805.674721][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 805.780748][ T2155] usb 2-1: config 0 has no interfaces? [ 805.795175][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 805.904934][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 805.945675][ T2155] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 805.955148][ T2155] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 805.963125][ T2155] usb 2-1: Product: syz [ 805.984486][ T2155] usb 2-1: Manufacturer: syz [ 806.009667][ T2155] usb 2-1: SerialNumber: syz [ 806.031571][ T2155] usb 2-1: config 0 descriptor?? [ 806.065095][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 806.163723][T12987] usb usb8: usbfs: process 12987 (syz.0.1291) did not claim interface 0 before use [ 806.219669][T12987] kvm: pic: single mode not supported [ 806.219738][T12987] kvm: pic: non byte read [ 806.233726][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 806.244776][T12987] kvm: pic: non byte read [ 806.254505][T12987] kvm: pic: non byte read [ 806.264624][T12987] kvm: pic: non byte read [ 806.284154][T12987] kvm: pic: non byte read [ 806.292023][T12987] kvm: pic: non byte read [ 806.300869][T12987] kvm: pic: non byte read [ 806.310390][T12987] kvm: pic: non byte read [ 806.322797][T12987] kvm: pic: non byte read [ 806.385693][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 806.524502][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 806.555181][T12971] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 806.636047][T12971] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 807.749248][ T9167] usb 2-1: USB disconnect, device number 31 [ 808.084514][T13013] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1293'. [ 808.122787][T13015] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1295'. [ 808.393442][T13022] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1292'. [ 809.055483][T13027] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1292'. [ 809.620068][T13037] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1296'. [ 809.762635][T13038] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 810.137282][ T8163] net_ratelimit: 23 callbacks suppressed [ 810.137298][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 810.945475][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 811.074785][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 811.192915][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 811.304709][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 811.353999][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 811.392511][T13049] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1299'. [ 811.427875][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 811.545003][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 811.635032][T13058] program syz.0.1301 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 811.675494][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 811.794856][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 812.045579][T13062] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1300'. [ 812.979291][T13069] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1302'. [ 813.765142][T13075] hub 1-0:1.0: USB hub found [ 813.774392][T13075] hub 1-0:1.0: 1 port detected [ 813.936509][T13081] netlink: 196 bytes leftover after parsing attributes in process `syz.2.1304'. [ 813.949809][T13081] netlink: 'syz.2.1304': attribute type 8 has an invalid length. [ 814.111471][T13085] hub 1-0:1.0: USB hub found [ 814.117781][T13085] hub 1-0:1.0: 1 port detected [ 815.109503][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 815.117063][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 815.144502][ T2977] net_ratelimit: 25 callbacks suppressed [ 815.144515][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 815.487281][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 815.504487][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 815.608261][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 815.745604][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 815.864361][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 815.899886][T13093] libceph: resolve '. [ 815.899886][T13093] #)|.fǝa2sow?'%ЏKAqfCzeSb3L)HyoǤYMhE$ [ 815.899886][T13093] ' (ret=-3): failed [ 815.981213][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 816.222225][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 816.251949][T13108] hub 1-0:1.0: USB hub found [ 816.284861][T13108] hub 1-0:1.0: 1 port detected [ 816.314537][ T2155] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 816.435193][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 816.492463][ T2155] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 816.510377][ T2155] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 816.540973][ T2155] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 816.551112][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 816.623340][ T2155] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 816.706265][T13106] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 816.736930][ T2155] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 817.096919][T13116] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 817.489998][T13120] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 818.869248][T13134] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1315'. [ 819.178449][T13136] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1313'. [ 819.370825][ T24] usb 2-1: USB disconnect, device number 32 [ 819.708544][T13142] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1316'. [ 819.870300][T13145] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1317'. [ 820.157025][ T3001] net_ratelimit: 28 callbacks suppressed [ 820.157038][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 820.485507][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 820.614454][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 820.656832][T13150] hub 1-0:1.0: USB hub found [ 820.674447][T13150] hub 1-0:1.0: 1 port detected [ 820.776981][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 820.894359][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 821.096353][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 821.383880][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 821.496718][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 821.647911][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 821.654022][T13159] hub 1-0:1.0: USB hub found [ 821.671029][T13159] hub 1-0:1.0: 1 port detected [ 821.753952][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 821.942539][T13160] usb usb8: usbfs: process 13160 (syz.4.1319) did not claim interface 0 before use [ 821.957020][ T30] audit: type=1400 audit(1762232679.906:2753): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=3A273A02 pid=13153 comm="syz.4.1319" [ 822.394431][T13172] netlink: 'syz.3.1321': attribute type 2 has an invalid length. [ 824.807296][T13193] hub 1-0:1.0: USB hub found [ 824.812250][T13193] hub 1-0:1.0: 1 port detected [ 825.194742][ T8159] net_ratelimit: 22 callbacks suppressed [ 825.194760][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 825.445182][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 825.794532][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 825.904474][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 825.932271][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 826.034970][T13206] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1328'. [ 826.097928][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 826.226630][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 826.354465][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 826.496505][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 826.666547][T13213] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1329'. [ 826.708010][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 826.744796][ T939] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 826.964760][ T939] usb 5-1: Using ep0 maxpacket: 8 [ 826.974886][ T939] usb 5-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=35.76 [ 826.984798][ T939] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 826.997012][ T939] usb 5-1: Product: syz [ 827.003554][ T939] usb 5-1: Manufacturer: syz [ 827.014595][ T939] usb 5-1: SerialNumber: syz [ 827.027568][ T939] usb 5-1: config 0 descriptor?? [ 827.048814][ T939] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 827.430232][T13218] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1331'. [ 827.877244][ T939] gspca_m5602: Failed to find a sensor [ 827.882911][ T939] ALi m5602 5-1:0.0: ALi m5602 webcam failed [ 827.898519][ T939] usb 5-1: USB disconnect, device number 25 [ 828.475659][T13230] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1334'. [ 828.981613][T13238] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1345'. [ 829.732208][T13245] syzkaller0: entered promiscuous mode [ 829.738674][T13245] syzkaller0: entered allmulticast mode [ 829.840414][ T5851] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 830.201022][ T5851] usb 5-1: config 0 has no interfaces? [ 830.260608][ T5851] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 830.291166][ T5851] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 830.455406][ T5851] usb 5-1: Product: syz [ 830.459784][ T5851] usb 5-1: Manufacturer: syz [ 830.466380][ T5851] usb 5-1: SerialNumber: syz [ 830.473430][ T5851] usb 5-1: config 0 descriptor?? [ 831.057983][T13257] netlink: 'syz.3.1338': attribute type 4 has an invalid length. [ 831.178584][T13256] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1337'. [ 831.381666][T13262] netlink: 'syz.3.1338': attribute type 4 has an invalid length. [ 831.677253][T13264] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1339'. [ 832.144966][ C0] net_ratelimit: 24 callbacks suppressed [ 832.144989][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 832.500750][ T9167] usb 5-1: USB disconnect, device number 26 [ 832.851113][T13272] binder: 13269:13272 ioctl c018620c 80000100 returned -1 [ 834.224468][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 834.308308][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 834.464670][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 834.584345][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 834.871216][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 835.033680][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 835.122541][T13291] hub 1-0:1.0: USB hub found [ 835.136173][T13291] hub 1-0:1.0: 1 port detected [ 835.225473][T13295] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1346'. [ 835.266678][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 835.457204][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 835.593373][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 836.354749][T13301] ip6erspan0: left promiscuous mode [ 836.596556][T13310] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1357'. [ 836.644783][ T5851] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 836.914946][ T5851] usb 4-1: Using ep0 maxpacket: 8 [ 836.926617][ T5851] usb 4-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=35.76 [ 836.938727][ T5851] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.957390][ T5851] usb 4-1: Product: syz [ 836.973514][ T5851] usb 4-1: Manufacturer: syz [ 836.988870][ T5851] usb 4-1: SerialNumber: syz [ 837.008671][ T5851] usb 4-1: config 0 descriptor?? [ 837.027363][ T5851] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 837.281196][ T8161] net_ratelimit: 13 callbacks suppressed [ 837.281208][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 837.407801][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 837.529221][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 837.648809][ T5851] gspca_m5602: Failed to find a sensor [ 837.650158][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 837.655432][ T5851] ALi m5602 4-1:0.0: ALi m5602 webcam failed [ 837.726621][ T5851] usb 4-1: USB disconnect, device number 23 [ 837.804411][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 837.937201][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 838.062403][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 838.190722][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 838.317837][T13334] EXT4-fs: Conflicting test_dummy_encryption options [ 838.329215][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 838.383979][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 838.538792][T13343] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1362'. [ 838.681335][T13349] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1352'. [ 840.757145][T13363] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1354'. [ 841.406189][T13370] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1355'. [ 842.040607][T13377] netlink: 'syz.0.1356': attribute type 4 has an invalid length. [ 842.234862][T13378] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1358'. [ 842.313347][ T3001] net_ratelimit: 27 callbacks suppressed [ 842.313363][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 842.506305][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 842.543971][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 842.676876][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 842.815118][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 842.924801][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 843.080790][T13387] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 843.090935][T13387] team0: Port device batadv1 added [ 843.180176][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 843.633154][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 843.814507][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 844.033411][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 844.662892][T13402] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1363'. [ 845.016250][T13410] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1365'. [ 845.615712][T13420] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1367'. [ 846.949465][ T30] audit: type=1326 audit(1762232704.856:2754): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13425 comm="syz.3.1369" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd5539 code=0x7ffc0000 [ 847.139266][ T30] audit: type=1326 audit(1762232704.856:2755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13425 comm="syz.3.1369" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf7fd5539 code=0x7ffc0000 [ 847.163154][ T30] audit: type=1326 audit(1762232704.856:2756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13425 comm="syz.3.1369" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd5539 code=0x7ffc0000 [ 847.267674][T13437] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1370'. [ 847.281429][T13437] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1370'. [ 847.358549][ T8161] net_ratelimit: 27 callbacks suppressed [ 847.358561][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 847.424907][ T30] audit: type=1326 audit(1762232704.856:2757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13425 comm="syz.3.1369" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd5539 code=0x7ffc0000 [ 847.547131][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 847.664581][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 847.844461][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 848.010104][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 848.126951][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 848.172657][T13444] hub 1-0:1.0: USB hub found [ 848.180278][T13444] hub 1-0:1.0: 1 port detected [ 848.244946][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 848.375781][T13449] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1372'. [ 848.660064][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 848.784133][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 848.798932][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 848.926437][T13455] Failed to get privilege flags for destination (handle=0x2:0x0) [ 849.470696][T13458] netlink: 'syz.2.1377': attribute type 10 has an invalid length. [ 849.484948][T13458] syz_tun: entered promiscuous mode [ 849.497063][T13458] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 850.124652][T13469] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1378'. [ 850.324598][T13467] xt_TCPMSS: Only works on TCP SYN packets [ 850.347659][T13471] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1380'. [ 850.688904][ T939] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 850.938675][ T939] usb 2-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 850.958599][ T939] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 850.986162][ T939] usb 2-1: Product: syz [ 851.016338][T13477] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1381'. [ 851.046981][T13481] IPVS: sync thread started: state = BACKUP, mcast_ifn = ip6_vti0, syncid = 1, id = 0 [ 851.061855][ T939] usb 2-1: Manufacturer: syz [ 851.298680][ T939] usb 2-1: SerialNumber: syz [ 851.324702][ T939] usb 2-1: config 0 descriptor?? [ 851.332665][T13483] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1383'. [ 851.437338][ T939] gspca_main: sonixb-2.14.0 probing 0c45:6005 [ 851.845846][T13471] netdevsim netdevsim1: Firmware load for '../file0/file0' refused, path contains '..' component [ 851.862669][ T939] input: sonixb as /devices/platform/dummy_hcd.1/usb2/2-1/input/input35 [ 852.279357][ T2155] usb 2-1: USB disconnect, device number 33 [ 852.377276][ T2977] net_ratelimit: 24 callbacks suppressed [ 852.377290][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 852.544463][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 852.597970][T13498] pim6reg: entered allmulticast mode [ 852.612544][T13498] netlink: 'syz.0.1395': attribute type 10 has an invalid length. [ 852.693699][T13501] EXT4-fs: Conflicting test_dummy_encryption options [ 852.722255][T13500] hub 1-0:1.0: USB hub found [ 852.747391][T13500] hub 1-0:1.0: 1 port detected [ 852.775358][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 852.890510][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 852.944425][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 853.054973][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 853.184800][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 853.304852][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 853.417040][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 853.588862][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 853.686862][T13512] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1388'. [ 853.874440][T13515] hub 1-0:1.0: USB hub found [ 853.879278][T13515] hub 1-0:1.0: 1 port detected [ 854.549219][ T10] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 855.242071][ T10] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 855.256232][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 855.389346][T13535] QAT: failed to copy from user. [ 855.616649][ T10] usb 4-1: Product: syz [ 855.626437][ T10] usb 4-1: Manufacturer: syz [ 855.639255][ T10] usb 4-1: SerialNumber: syz [ 855.660132][ T10] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 856.485582][T13544] Failed to get privilege flags for destination (handle=0x2:0x0) [ 856.594183][ T5851] usb 2-1: new low-speed USB device number 34 using dummy_hcd [ 856.760371][ T9167] usb 4-1: ath9k_htc: Firmware - ath9k_htc/htc_9271-1.4.0.fw download failed [ 856.780995][ T5851] usb 2-1: config index 0 descriptor too short (expected 1307, got 27) [ 856.812173][ T5851] usb 2-1: config 0 has an invalid interface number: 0 but max is -1 [ 856.813150][ T9167] usb 4-1: ath9k_htc: USB layer deinitialized [ 856.852339][ T5851] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 856.913884][ T5851] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 856.970866][ T2155] usb 4-1: USB disconnect, device number 24 [ 856.981350][ T5851] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 857.331207][ T5851] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 857.435601][ T8159] net_ratelimit: 22 callbacks suppressed [ 857.435619][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 857.441392][ T5851] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 857.578080][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 857.610665][ T5851] usb 2-1: string descriptor 0 read error: -22 [ 857.643506][ T5851] usb 2-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 857.686936][ T5851] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 857.784647][T13558] netlink: 'syz.4.1396': attribute type 2 has an invalid length. [ 857.804100][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 858.429066][ T939] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 858.455131][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 858.500693][ T5851] usb 2-1: config 0 descriptor?? [ 858.509876][ T5851] hub 2-1:0.0: bad descriptor, ignoring hub [ 858.607553][ T5851] hub 2-1:0.0: probe with driver hub failed with error -5 [ 858.617018][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 858.745884][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 858.752745][ T5851] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input36 [ 858.843120][ T939] usb 4-1: Using ep0 maxpacket: 16 [ 858.885446][ T939] usb 4-1: config 0 has no interfaces? [ 858.897508][ T939] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 859.055749][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 859.086281][ T939] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 859.157285][ T939] usb 4-1: Manufacturer: syz [ 859.184038][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 859.207036][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 859.277648][ T939] usb 4-1: config 0 descriptor?? [ 859.385832][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 859.422921][T13569] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.1397'. [ 859.684652][T13574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 859.698034][T13574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 859.804380][ T2155] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 860.070812][ T2155] usb 1-1: config 0 has no interfaces? [ 860.310767][ T2155] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 860.327472][ T2155] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 860.348920][ T2155] usb 1-1: Product: syz [ 860.359368][ T2155] usb 1-1: Manufacturer: syz [ 860.367950][ T2155] usb 1-1: SerialNumber: syz [ 860.936275][T13566] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 860.979692][ T2155] usb 1-1: config 0 descriptor?? [ 861.079936][ T939] usb 4-1: USB disconnect, device number 25 [ 861.457124][T13583] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1400'. [ 861.643489][T13569] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 861.655168][T13569] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 861.679624][ T939] usb 2-1: USB disconnect, device number 34 [ 861.881521][T13589] usb 1-1: USB disconnect, device number 35 [ 861.935212][T13589] hub 1-0:1.0: USB hub found [ 861.991009][T13589] hub 1-0:1.0: 1 port detected [ 862.203850][ T9167] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 862.444832][T13569] veth0_vlan: left promiscuous mode [ 862.505540][T13569] veth0_vlan: entered promiscuous mode [ 862.532108][ T8161] net_ratelimit: 15 callbacks suppressed [ 862.533005][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 863.109168][T13603] input: syz1 as /devices/virtual/input/input37 [ 863.135966][T13603] binder: BINDER_SET_CONTEXT_MGR already set [ 863.141981][T13603] binder: 13600:13603 ioctl 4018620d 80000040 returned -16 [ 863.354015][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 864.162300][T13592] dummy0: left allmulticast mode [ 864.183142][T13592] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 864.227943][ T8163] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 864.237889][ T8163] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 864.257541][ T8163] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 864.294622][ T8163] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 864.433153][ T8163] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 864.448600][ T8163] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 864.458171][ T8163] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 864.467601][ T8163] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 864.484748][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 864.665977][T13618] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1408'. [ 865.424445][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 865.558802][T13624] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1410'. [ 865.619459][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 865.744343][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 865.864442][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 865.958312][T13633] netlink: 220 bytes leftover after parsing attributes in process `syz.0.1421'. [ 866.214563][T13633] netlink: 220 bytes leftover after parsing attributes in process `syz.0.1421'. [ 866.295064][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 866.302779][T13634] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 866.848705][ T5830] Bluetooth: hci4: command 0x0405 tx timeout [ 866.879325][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 867.005321][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 867.275913][T13646] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1413'. [ 867.612269][ T8159] net_ratelimit: 5 callbacks suppressed [ 867.613353][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 867.754848][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 867.865141][T13656] netlink: 'syz.0.1412': attribute type 2 has an invalid length. [ 867.908216][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 868.259074][T13640] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 868.510632][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 868.739427][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 868.875678][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 868.888783][ T939] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 869.011629][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 869.085102][ T5851] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 869.117021][ T939] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 869.128630][ T939] usb 4-1: config 1 has no interface number 0 [ 869.135215][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 869.150270][ T939] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 1023 [ 869.244699][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 869.275496][ T5851] usb 3-1: Using ep0 maxpacket: 16 [ 869.365467][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 869.398031][ T939] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 64 [ 869.409580][ T5851] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 869.419763][ T5851] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 869.434902][ T5851] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 869.451484][ T939] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 869.461734][ T939] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 869.470291][ T939] usb 4-1: Product: syz [ 869.476896][ T939] usb 4-1: Manufacturer: syz [ 869.481496][ T939] usb 4-1: SerialNumber: syz [ 869.491375][ T5851] usb 3-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 869.504778][ T5851] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 869.525267][ T5851] usb 3-1: Product: syz [ 869.550610][ T5851] usb 3-1: Manufacturer: syz [ 869.559143][ T5851] usb 3-1: SerialNumber: syz [ 869.565262][T13661] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 869.578170][T13661] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 869.595642][ T939] usb 4-1: Error in usbnet_get_endpoints (-22) [ 869.629321][T13671] netlink: 65039 bytes leftover after parsing attributes in process `syz.4.1417'. [ 869.782213][ T5851] usb 3-1: config 0 descriptor?? [ 869.810714][T13665] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 869.879758][ T5851] mcba_usb 3-1:0.0 can0: failed tx_urb -90 [ 869.894601][ T5851] mcba_usb 3-1:0.0 can0: Failed to send cmd (169) [ 869.908144][ T5851] mcba_usb 3-1:0.0 can0: failed tx_urb -90 [ 869.924861][ T5851] mcba_usb 3-1:0.0 can0: Failed to send cmd (169) [ 870.024433][ T939] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 870.119806][T13665] netlink: 'syz.2.1416': attribute type 5 has an invalid length. [ 870.162792][ T5851] mcba_usb 3-1:0.0: Microchip CAN BUS Analyzer connected [ 870.217371][T13665] ip6erspan0: entered promiscuous mode [ 870.317777][ T939] usb 5-1: config 0 has no interfaces? [ 870.328847][ T939] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 870.338236][ T939] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 870.349055][ T939] usb 5-1: Product: syz [ 870.373673][ T939] usb 5-1: Manufacturer: syz [ 870.379390][ T939] usb 5-1: SerialNumber: syz [ 870.559846][ T939] usb 5-1: config 0 descriptor?? [ 870.738442][ T939] usb 3-1: USB disconnect, device number 29 [ 870.751357][ T939] mcba_usb 3-1:0.0 can0: device disconnected [ 870.944747][T13671] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 870.959269][T13671] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 871.512383][T13671] veth0_vlan: left promiscuous mode [ 871.564998][T13671] veth0_vlan: entered promiscuous mode [ 871.907155][ T939] usb 4-1: USB disconnect, device number 26 [ 872.016020][T13698] vivid-002: disconnect [ 872.694677][ T80] net_ratelimit: 20 callbacks suppressed [ 872.694691][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 872.874340][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 872.957633][T13711] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 872.978904][T13711] input: syz1 as /devices/virtual/input/input39 [ 873.061457][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 873.410335][ T2155] usb 5-1: USB disconnect, device number 27 [ 873.485227][T13698] vivid-002: reconnect [ 873.743961][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 874.065797][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 874.186365][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 874.318136][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 874.460355][T13726] vivid-000: ================= START STATUS ================= [ 874.481543][T13726] vivid-000: Test Pattern: 75% Colorbar [ 874.541345][T13726] vivid-000: Fill Percentage of Frame: 100 [ 874.548944][T13726] vivid-000: Horizontal Movement: Move Right Slow [ 874.558597][T13726] vivid-000: Vertical Movement: No Movement [ 874.588251][T13726] vivid-000: OSD Text Mode: All [ 874.594373][T13726] vivid-000: Show Border: false [ 874.599499][T13726] vivid-000: Show Square: false [ 874.608378][T13726] vivid-000: Sensor Flipped Horizontally: false [ 874.616935][T13726] vivid-000: Sensor Flipped Vertically: false [ 874.623441][T13726] vivid-000: Insert SAV Code in Image: false [ 874.631098][T13726] vivid-000: Insert EAV Code in Image: false [ 874.691126][T13726] vivid-000: Insert Video Guard Band: false [ 874.699878][T13726] vivid-000: Reduced Framerate: false [ 874.708095][T13726] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 874.933029][T13726] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 874.933192][T13733] netlink: 'syz.4.1424': attribute type 3 has an invalid length. [ 875.155979][T13726] vivid-000: Enable Capture Cropping: true grabbed [ 875.170515][T13726] vivid-000: Enable Capture Composing: [ 875.179187][T13733] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1424'. [ 875.254490][T13726] false grabbed [ 875.297959][T13726] vivid-000: Enable Capture Scaler: true grabbed [ 875.331085][T13726] vivid-000: Timestamp Source: End of Frame [ 875.338544][T13726] vivid-000: Colorspace: SMPTE 170M [ 875.346355][T13726] vivid-000: Transfer Function: None [ 875.370610][T13726] vivid-000: Y'CbCr Encoding: Default [ 875.396286][T13726] vivid-000: HSV Encoding: Hue 0-179 [ 875.409719][T13726] vivid-000: Quantization: Default [ 875.469249][T13726] vivid-000: Apply Alpha To Red Only: false [ 875.512737][T13726] vivid-000: Standard Aspect Ratio: 4x3 [ 875.646073][T13726] vivid-000: DV Timings Signal Mode: Current DV Timings inactive [ 875.694566][T13726] vivid-000: DV Timings: 640x480p59 inactive [ 875.703616][T13726] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 875.716480][T13726] vivid-000: Maximum EDID Blocks: 2 [ 875.802113][T13726] vivid-000: Limited RGB Range (16-235): true [ 875.812917][T13757] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1427'. [ 875.831474][T13726] vivid-000: Rx RGB Quantization Range: Automatic [ 875.833933][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 875.844750][T13726] [ 875.858419][T13726] vivid-000: Power Present: 0x00000001 [ 875.867108][T13726] tpg source WxH: 720x576 (Y'CbCr) [ 875.875327][T13726] tpg field: 4 [ 875.912899][T13726] tpg crop: (0,0)/720x576 [ 875.948837][T13726] tpg compose: (0,0)/720x576 [ 876.049682][T13726] tpg colorspace: 1 [ 876.077314][T13726] tpg transfer function: 5/5 [ 876.082052][T13726] tpg Y'CbCr encoding: 0/2 [ 876.088013][T13726] tpg quantization: 0/1 [ 876.097049][T13726] tpg RGB range: 0/1 [ 876.101237][T13726] vivid-000: ================== END STATUS ================== [ 876.226692][ T5150] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 876.614783][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 876.621431][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 876.764429][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 876.927107][T13765] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1428'. [ 877.324935][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 877.714686][ T1166] net_ratelimit: 2 callbacks suppressed [ 877.714701][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 877.865420][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 877.903951][ C0] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: 02:04:00:bf:05:00 [ 877.975922][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 878.124860][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 878.254728][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 878.364382][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 878.380173][T13773] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 878.386844][T13773] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 878.401654][T13773] vhci_hcd vhci_hcd.0: Device attached [ 878.474789][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 878.562589][T13782] netlink: 'syz.1.1432': attribute type 10 has an invalid length. [ 878.562680][T13782] batman_adv: batadv0: Interface deactivated: dummy0 [ 878.563025][T13782] batman_adv: batadv0: Removing interface: dummy0 [ 878.666943][ T5851] usb 34-1: SetAddress Request (2) to port 0 [ 878.667010][ T5851] usb 34-1: new SuperSpeed USB device number 2 using vhci_hcd [ 878.676375][T13785] netlink: 'syz.1.1432': attribute type 10 has an invalid length. [ 878.809428][T13790] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1429'. [ 878.853536][T13782] team0: Port device dummy0 added [ 878.875794][T13785] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 878.917365][T13785] team0: Failed to send options change via netlink (err -105) [ 878.917594][T13785] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 878.923453][T13787] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1430'. [ 878.926343][T13785] team0: Port device dummy0 removed [ 878.980670][T13785] dummy0: entered promiscuous mode [ 878.988089][T13785] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 879.009246][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 879.114426][ T10] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 879.157128][T13774] vhci_hcd: connection reset by peer [ 879.157495][ T1166] vhci_hcd: stop threads [ 879.157511][ T1166] vhci_hcd: release socket [ 879.157548][ T1166] vhci_hcd: disconnect device [ 879.305041][ T10] usb 2-1: New USB device found, idVendor=041e, idProduct=4011, bcdDevice=af.98 [ 879.305072][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 879.385344][ T10] usb 2-1: config 0 descriptor?? [ 879.389737][ T10] pwc: Creative Labs Webcam Pro Ex detected. [ 879.587990][T13797] hub 1-0:1.0: USB hub found [ 879.588202][T13797] hub 1-0:1.0: 1 port detected [ 880.180893][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 880.311741][T13778] tty tty21: ldisc open failed (-12), clearing slot 20 [ 881.250718][T13815] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1437'. [ 881.411298][T13810] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1436'. [ 881.662902][T13820] vivid-000: disconnect [ 882.230328][ T10] pwc: Failed to set LED on/off time (-71) [ 882.236761][ T10] pwc: send_video_command error -71 [ 882.242079][ T10] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 882.317323][ T10] Philips webcam 2-1:0.0: probe with driver Philips webcam failed with error -71 [ 882.588518][T13820] vivid-000: reconnect [ 882.598118][ T10] usb 2-1: USB disconnect, device number 35 [ 882.814775][ T80] net_ratelimit: 17 callbacks suppressed [ 882.814794][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 883.053222][T13832] netlink: 'syz.2.1440': attribute type 4 has an invalid length. [ 883.180722][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 883.199259][T13833] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1441'. [ 883.361314][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 883.476690][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 883.754601][ T5851] usb 34-1: device descriptor read/8, error -110 [ 883.771687][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 883.956607][T13846] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1442'. [ 884.091750][T13844] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 884.152496][T13844] team0: Port device batadv1 added [ 884.184977][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 884.216171][ T5851] usb usb34-port1: attempt power cycle [ 884.416013][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 884.534682][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 884.649167][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 884.936701][ T5851] usb usb34-port1: unable to enumerate USB device [ 884.955469][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 885.869127][T13869] hub 1-0:1.0: USB hub found [ 885.880679][T13869] hub 1-0:1.0: 1 port detected [ 885.900050][T13870] tipc: Enabling of bearer rejected, already enabled [ 886.862866][T13885] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1449'. [ 887.055409][T13882] hub 1-0:1.0: USB hub found [ 887.077110][T13882] hub 1-0:1.0: 1 port detected [ 887.139702][T13886] hub 1-0:1.0: USB hub found [ 887.215206][T13890] netlink: 'syz.2.1447': attribute type 2 has an invalid length. [ 887.227168][ T5922] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 887.252962][T13892] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1448'. [ 887.270298][T13892] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1448'. [ 887.291179][T13892] lo: Caught tx_queue_len zero misconfig [ 887.297473][T13892] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 887.373690][T13886] hub 1-0:1.0: 1 port detected [ 887.534635][ T5922] usb 5-1: Using ep0 maxpacket: 32 [ 887.543618][ T5922] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 887.552978][ T5922] usb 5-1: config 0 has no interface number 0 [ 887.593016][ T5922] usb 5-1: config 0 interface 184 has no altsetting 0 [ 887.887617][ T2977] net_ratelimit: 18 callbacks suppressed [ 887.887634][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 887.910602][ T5922] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 887.926278][ T5922] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 887.954802][ T5922] usb 5-1: Product: syz [ 887.977216][ T5922] usb 5-1: Manufacturer: syz [ 888.085865][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 888.208705][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 888.251521][ T5922] usb 5-1: SerialNumber: syz [ 888.299655][ T5922] usb 5-1: config 0 descriptor?? [ 888.326347][ T5922] smsc75xx v1.0.0 [ 888.329985][ T5922] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 888.344800][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 888.357946][ T5922] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -22 [ 888.464660][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 888.477656][T13899] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1451'. [ 888.871247][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 889.007012][ T80] bond2: (slave bridge1): failed to get link speed/duplex [ 889.277001][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 889.416711][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 889.644424][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 889.955884][T13904] syzkaller1: entered promiscuous mode [ 889.961515][T13904] syzkaller1: entered allmulticast mode [ 890.026686][T13909] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1453'. [ 890.062575][ T10] usb 5-1: USB disconnect, device number 28 [ 891.325870][T13925] netlink: 'syz.1.1456': attribute type 4 has an invalid length. [ 891.420730][T13927] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1455'. [ 891.487770][T13926] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.1454'. [ 891.874912][T13935] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1465'. [ 891.988862][ T5851] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 892.625883][ T5851] usb 4-1: config 0 has no interfaces? [ 892.694510][ T5851] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 892.821193][ T5851] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 893.075749][ T8161] net_ratelimit: 13 callbacks suppressed [ 893.075768][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 893.099858][ T5851] usb 4-1: Product: syz [ 893.114615][ T5851] usb 4-1: Manufacturer: syz [ 893.134816][ T5851] usb 4-1: SerialNumber: syz [ 893.161261][ T5851] usb 4-1: config 0 descriptor?? [ 893.234801][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 893.384408][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 893.512455][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 893.643651][T13948] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1459'. [ 893.666119][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 893.774566][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 894.061951][T13923] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 894.164973][T13923] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 894.242082][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 894.592522][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 894.634000][T13958] veth0_to_bridge: entered promiscuous mode [ 894.640415][T13958] A link change request failed with some changes committed already. Interface veth0_to_bridge may have been left with an inconsistent configuration, please check. [ 894.724488][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 895.120507][T13964] netlink: 196 bytes leftover after parsing attributes in process `syz.1.1462'. [ 895.731702][ T10] usb 4-1: USB disconnect, device number 27 [ 896.511738][T13973] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1464'. [ 897.120811][T13981] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 898.177678][ T8163] net_ratelimit: 21 callbacks suppressed [ 898.177699][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 898.399559][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 898.580434][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 898.734358][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 898.871172][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 898.984374][ T8163] bond2: (slave bridge1): failed to get link speed/duplex [ 899.246513][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 899.392406][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 899.541516][T14001] loop8: detected capacity change from 0 to 7 [ 899.564652][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 899.572047][T14001] Dev loop8: unable to read RDB block 7 [ 899.647679][T14001] loop8: AHDI p1 p2 p3 [ 899.651877][T14001] loop8: partition table partially beyond EOD, truncated [ 899.699430][T14013] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1471'. [ 899.715854][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 899.730077][T14001] loop8: p1 start 1601398130 is beyond EOD, truncated [ 899.881894][T14001] loop8: p2 start 1702059890 is beyond EOD, truncated [ 899.938275][T10172] Dev loop8: unable to read RDB block 7 [ 899.953762][T10172] loop8: AHDI p1 p2 p3 [ 899.963556][T10172] loop8: partition table partially beyond EOD, truncated [ 899.993751][T14017] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1472'. [ 900.053986][T10172] loop8: p1 start 1601398130 is beyond EOD, truncated [ 900.111783][T10172] loop8: p2 start 1702059890 is beyond EOD, truncated [ 901.524959][T14034] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 901.553925][T14034] input: syz1 as /devices/virtual/input/input41 [ 903.331041][ T1166] net_ratelimit: 24 callbacks suppressed [ 903.331060][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 903.602752][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 903.746993][T14057] veth1_macvtap: left promiscuous mode [ 903.795741][T14057] macsec0: entered promiscuous mode [ 903.852523][T14058] 8021q: VLANs not supported on ip6gre0 [ 903.945734][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 904.065375][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 904.175098][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 904.334514][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 904.546249][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 904.664414][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 904.694190][ T10] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 904.774638][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 904.847426][ T10] usb 3-1: config 1 has an invalid interface number: 7 but max is 0 [ 904.855942][ T10] usb 3-1: config 1 has no interface number 0 [ 904.862287][ T10] usb 3-1: config 1 interface 7 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 1023 [ 904.873451][ T10] usb 3-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 64 [ 904.893483][ T10] usb 3-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 904.904321][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 904.904788][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 904.912381][ T10] usb 3-1: Product: syz [ 904.925899][ T10] usb 3-1: Manufacturer: syz [ 904.930573][ T10] usb 3-1: SerialNumber: syz [ 904.947481][T14068] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 904.958047][T14068] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 904.971272][ T10] usb 3-1: Error in usbnet_get_endpoints (-22) [ 905.113170][T14073] hub 1-0:1.0: USB hub found [ 905.122546][T14073] hub 1-0:1.0: 1 port detected [ 905.574640][T14079] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1483'. [ 907.086695][ T5851] usb 3-1: USB disconnect, device number 30 [ 908.439025][ T1166] net_ratelimit: 22 callbacks suppressed [ 908.439037][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 908.590563][T14114] vivid-000: ================= START STATUS ================= [ 908.631526][T14114] vivid-000: Test Pattern: 75% Colorbar [ 908.638799][T14114] vivid-000: Fill Percentage of Frame: 100 [ 908.665850][T14114] vivid-000: Horizontal Movement: Move Right Slow [ 908.672393][T14114] vivid-000: Vertical Movement: No Movement [ 908.675397][T14116] netlink: 'syz.3.1488': attribute type 3 has an invalid length. [ 908.679326][T14114] vivid-000: OSD Text Mode: [ 908.745191][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 908.788718][T14116] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1488'. [ 908.804579][T14114] All [ 908.807187][T14114] vivid-000: Show Border: false [ 908.812192][T14114] vivid-000: Show Square: false [ 908.817614][T14114] vivid-000: Sensor Flipped Horizontally: false [ 908.824794][T14114] vivid-000: Sensor Flipped Vertically: false [ 908.834290][T14114] vivid-000: Insert SAV Code in Image: false [ 908.840319][T14114] vivid-000: Insert EAV Code in Image: false [ 908.864666][T14114] vivid-000: Insert Video Guard Band: false [ 908.870607][T14114] vivid-000: Reduced Framerate: false [ 908.876574][T14114] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 908.885328][T14114] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 908.905646][T14114] vivid-000: Enable Capture Cropping: true grabbed [ 908.927861][T14114] vivid-000: Enable Capture Composing: false grabbed [ 908.944833][T14114] vivid-000: Enable Capture Scaler: true grabbed [ 908.964951][T14114] vivid-000: Timestamp Source: End of Frame [ 908.974623][T14114] vivid-000: Colorspace: SMPTE 170M [ 908.999430][T14114] vivid-000: Transfer Function: None [ 909.005406][T14114] vivid-000: Y'CbCr Encoding: Default [ 909.010879][T14114] vivid-000: HSV Encoding: Hue 0-179 [ 909.016744][T14114] vivid-000: Quantization: Default [ 909.021952][T14114] vivid-000: Apply Alpha To Red Only: false [ 909.028369][T14114] vivid-000: Standard Aspect Ratio: 4x3 [ 909.034016][T14114] vivid-000: DV Timings Signal Mode: Current DV Timings inactive [ 909.041770][T14114] vivid-000: DV Timings: 640x480p59 inactive [ 909.047876][T14114] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 909.055735][T14114] vivid-000: Maximum EDID Blocks: 2 [ 909.060976][T14114] vivid-000: Limited RGB Range (16-235): true [ 909.067620][T14114] vivid-000: Rx RGB Quantization Range: Automatic [ 909.074577][T14114] vivid-000: Power Present: 0x00000001 [ 909.080230][T14114] tpg source WxH: 720x576 (Y'CbCr) [ 909.085857][T14114] tpg field: 4 [ 909.089257][T14114] tpg crop: (0,0)/720x576 [ 909.093602][T14114] tpg compose: (0,0)/720x576 [ 909.098824][T14114] tpg colorspace: 1 [ 909.102646][T14114] tpg transfer function: 5/5 [ 909.108731][T14114] tpg Y'CbCr encoding: 0/1 [ 909.113421][T14114] tpg quantization: 0/2 [ 909.118090][T14114] tpg RGB range: 0/1 [ 909.121991][T14114] vivid-000: ================== END STATUS ================== [ 909.215968][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 909.361551][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 909.516095][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 909.735144][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 909.784503][T14124] No memory to map [ 909.854406][ T1166] bond2: (slave bridge1): failed to get link speed/duplex [ 910.347482][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 910.494914][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 910.817358][T14130] netlink: 'syz.1.1491': attribute type 2 has an invalid length. [ 910.876030][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 911.609547][T14135] hub 1-0:1.0: USB hub found [ 911.670042][T14135] hub 1-0:1.0: 1 port detected [ 912.077260][T14146] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1495'. [ 912.695965][T14162] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1498'. [ 913.483628][T14169] hub 1-0:1.0: USB hub found [ 913.489475][T14169] hub 1-0:1.0: 1 port detected [ 913.604725][ T2977] net_ratelimit: 17 callbacks suppressed [ 913.604744][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 913.745018][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 913.874796][ T2977] bond2: (slave bridge1): failed to get link speed/duplex [ 914.162377][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 914.294356][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 914.324686][ T5922] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 914.469021][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 914.806325][ T8159] bond2: (slave bridge1): failed to get link speed/duplex [ 914.825763][ T5922] usb 3-1: Using ep0 maxpacket: 32 [ 914.956253][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 915.016109][ T5922] usb 3-1: config 0 has an invalid interface number: 59 but max is 0 [ 915.058384][ T5922] usb 3-1: config 0 has no interface number 0 [ 915.070347][ T5922] usb 3-1: config 0 interface 59 has no altsetting 0 [ 915.074380][ T3001] bond2: (slave bridge1): failed to get link speed/duplex [ 915.126412][ T5922] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 915.136027][ T5922] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 915.159029][ T5922] usb 3-1: Product: syz [ 915.201774][ T5922] usb 3-1: Manufacturer: syz [ 915.207181][ T8161] bond2: (slave bridge1): failed to get link speed/duplex [ 915.248401][ T5922] usb 3-1: SerialNumber: syz [ 915.312072][ T5922] usb 3-1: config 0 descriptor?? [ 915.346066][ T5922] smsc75xx v1.0.0 [ 915.355965][ T5922] smsc75xx 3-1:0.59 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 915.386070][ T5922] smsc75xx 3-1:0.59: probe with driver smsc75xx failed with error -22 [ 915.942314][T14180] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 915.951604][T14196] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 915.960005][T14196] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 915.974370][T14180] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 916.017975][T14180] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 916.034345][T14180] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 916.093923][ T10] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 916.130615][T14180] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 916.139920][T14180] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 916.158781][T14180] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 916.165313][T14180] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 916.176399][T14180] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 916.182409][T14180] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 916.197831][T14196] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 916.226333][ T5922] ------------[ cut here ]------------ [ 916.232002][ T5922] workqueue: cannot queue hci_conn_timeout on wq hci4 [ 916.238789][ T5922] WARNING: CPU: 1 PID: 5922 at kernel/workqueue.c:2258 __queue_work+0xd38/0xfb0 [ 916.247793][ T5922] Modules linked in: [ 916.251803][ T5922] CPU: 1 UID: 0 PID: 5922 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT(full) [ 916.261145][ T5922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 916.271176][ T5922] Workqueue: events l2cap_chan_timeout [ 916.276617][ T5922] RIP: 0010:__queue_work+0xd38/0xfb0 [ 916.281879][ T5922] Code: 42 80 3c 20 00 74 08 4c 89 ef e8 03 cd 9b 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 20 eb 69 8b 4c 89 fa e8 b9 31 f9 ff 90 <0f> 0b 90 90 e9 1a f5 ff ff e8 aa 17 36 00 90 0f 0b 90 e9 dd fc ff [ 916.284924][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 916.301459][ T5922] RSP: 0018:ffffc900046f7790 EFLAGS: 00010046 [ 916.301501][ T5922] RAX: 054150d5a8121c00 RBX: 0000000000000020 RCX: ffff88807c5e0000 [ 916.320483][ T5922] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 916.328430][ T5922] RBP: 1ffff11004f29438 R08: ffff8880b8924293 R09: 1ffff11017124852 [ 916.336385][ T5922] R10: dffffc0000000000 R11: ffffed1017124853 R12: dffffc0000000000 [ 916.344334][ T5922] R13: ffff888052548960 R14: ffff88801a078c08 R15: ffff88802794a178 [ 916.352281][ T5922] FS: 0000000000000000(0000) GS:ffff88812623d000(0000) knlGS:0000000000000000 [ 916.361185][ T5922] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 916.367744][ T5922] CR2: 0000000080062018 CR3: 00000000769de000 CR4: 00000000003526f0 [ 916.375691][ T5922] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 916.383636][ T5922] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 916.391586][ T5922] Call Trace: [ 916.394853][ T5922] [ 916.397772][ T5922] ? __queue_delayed_work+0xe1/0x2d0 [ 916.403047][ T5922] queue_delayed_work_on+0x18b/0x280 [ 916.408328][ T5922] ? __pfx___cancel_work+0x10/0x10 [ 916.413429][ T5922] ? __cancel_work+0x254/0x2e0 [ 916.418178][ T5922] ? __pfx_queue_delayed_work_on+0x10/0x10 [ 916.423971][ T5922] ? __pfx___cancel_work+0x10/0x10 [ 916.429066][ T5922] ? do_raw_spin_lock+0x121/0x290 [ 916.434091][ T5922] ? hci_conn_drop+0x14d/0x280 [ 916.438853][ T5922] l2cap_chan_del+0x285/0x5e0 [ 916.443517][ T5922] l2cap_chan_close+0x597/0x980 [ 916.448352][ T5922] ? __pfx_l2cap_chan_close+0x10/0x10 [ 916.453709][ T5922] ? process_scheduled_works+0x9ef/0x17b0 [ 916.459420][ T5922] l2cap_chan_timeout+0x158/0x390 [ 916.464426][ T5922] ? process_scheduled_works+0x9ef/0x17b0 [ 916.470129][ T5922] process_scheduled_works+0xae1/0x17b0 [ 916.475685][ T5922] ? __pfx_process_scheduled_works+0x10/0x10 [ 916.481667][ T5922] worker_thread+0x8a0/0xda0 [ 916.486251][ T5922] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 916.492575][ T5922] ? __kthread_parkme+0x7b/0x200 [ 916.497507][ T5922] kthread+0x711/0x8a0 [ 916.501569][ T5922] ? __pfx_worker_thread+0x10/0x10 [ 916.506668][ T5922] ? __pfx_kthread+0x10/0x10 [ 916.511256][ T5922] ? _raw_spin_unlock_irq+0x23/0x50 [ 916.516451][ T5922] ? lockdep_hardirqs_on+0x9c/0x150 [ 916.521642][ T5922] ? __pfx_kthread+0x10/0x10 [ 916.526224][ T5922] ret_from_fork+0x4bc/0x870 [ 916.530804][ T5922] ? __pfx_ret_from_fork+0x10/0x10 [ 916.535910][ T5922] ? __switch_to_asm+0x39/0x70 [ 916.540760][ T5922] ? __switch_to_asm+0x33/0x70 [ 916.545878][ T5922] ? __pfx_kthread+0x10/0x10 [ 916.550945][ T5922] ret_from_fork_asm+0x1a/0x30 [ 916.556522][ T5922] [ 916.560047][ T5922] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 916.569537][ T5922] CPU: 1 UID: 0 PID: 5922 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT(full) [ 916.580614][ T5922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 916.591035][ T5922] Workqueue: events l2cap_chan_timeout [ 916.597656][ T5922] Call Trace: [ 916.601663][ T5922] [ 916.605482][ T5922] dump_stack_lvl+0x99/0x250 [ 916.610705][ T5922] ? __asan_memcpy+0x40/0x70 [ 916.616084][ T5922] ? __pfx_dump_stack_lvl+0x10/0x10 [ 916.621375][ T5922] ? __pfx__printk+0x10/0x10 [ 916.626460][ T5922] vpanic+0x237/0x6d0 [ 916.631353][ T5922] ? __pfx_vpanic+0x10/0x10 [ 916.636644][ T5922] panic+0xb9/0xc0 [ 916.640581][ T5922] ? __pfx_panic+0x10/0x10 [ 916.645027][ T5922] __warn+0x31b/0x4b0 [ 916.649051][ T5922] ? __queue_work+0xd38/0xfb0 [ 916.653857][ T5922] ? __queue_work+0xd38/0xfb0 [ 916.658572][ T5922] report_bug+0x2be/0x4f0 [ 916.662922][ T5922] ? __queue_work+0xd38/0xfb0 [ 916.667692][ T5922] ? __queue_work+0xd38/0xfb0 [ 916.672638][ T5922] ? __queue_work+0xd3a/0xfb0 [ 916.677313][ T5922] handle_bug+0x84/0x160 [ 916.681795][ T5922] exc_invalid_op+0x1a/0x50 [ 916.686306][ T5922] asm_exc_invalid_op+0x1a/0x20 [ 916.691327][ T5922] RIP: 0010:__queue_work+0xd38/0xfb0 [ 916.696784][ T5922] Code: 42 80 3c 20 00 74 08 4c 89 ef e8 03 cd 9b 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 20 eb 69 8b 4c 89 fa e8 b9 31 f9 ff 90 <0f> 0b 90 90 e9 1a f5 ff ff e8 aa 17 36 00 90 0f 0b 90 e9 dd fc ff [ 916.717793][ T5922] RSP: 0018:ffffc900046f7790 EFLAGS: 00010046 [ 916.723989][ T5922] RAX: 054150d5a8121c00 RBX: 0000000000000020 RCX: ffff88807c5e0000 [ 916.731967][ T5922] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 916.742809][ T5922] RBP: 1ffff11004f29438 R08: ffff8880b8924293 R09: 1ffff11017124852 [ 916.751659][ T5922] R10: dffffc0000000000 R11: ffffed1017124853 R12: dffffc0000000000 [ 916.761736][ T5922] R13: ffff888052548960 R14: ffff88801a078c08 R15: ffff88802794a178 [ 916.769932][ T5922] ? __queue_delayed_work+0xe1/0x2d0 [ 916.775975][ T5922] queue_delayed_work_on+0x18b/0x280 [ 916.782028][ T5922] ? __pfx___cancel_work+0x10/0x10 [ 916.787170][ T5922] ? __cancel_work+0x254/0x2e0 [ 916.792483][ T5922] ? __pfx_queue_delayed_work_on+0x10/0x10 [ 916.800273][ T5922] ? __pfx___cancel_work+0x10/0x10 [ 916.805652][ T5922] ? do_raw_spin_lock+0x121/0x290 [ 916.810958][ T5922] ? hci_conn_drop+0x14d/0x280 [ 916.816193][ T5922] l2cap_chan_del+0x285/0x5e0 [ 916.821319][ T5922] l2cap_chan_close+0x597/0x980 [ 916.826707][ T5922] ? __pfx_l2cap_chan_close+0x10/0x10 [ 916.834910][ T5922] ? process_scheduled_works+0x9ef/0x17b0 [ 916.840957][ T5922] l2cap_chan_timeout+0x158/0x390 [ 916.847145][ T5922] ? process_scheduled_works+0x9ef/0x17b0 [ 916.853745][ T5922] process_scheduled_works+0xae1/0x17b0 [ 916.860382][ T5922] ? __pfx_process_scheduled_works+0x10/0x10 [ 916.866612][ T5922] worker_thread+0x8a0/0xda0 [ 916.872650][ T5922] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 916.879815][ T5922] ? __kthread_parkme+0x7b/0x200 [ 916.885060][ T5922] kthread+0x711/0x8a0 [ 916.890032][ T5922] ? __pfx_worker_thread+0x10/0x10 [ 916.895687][ T5922] ? __pfx_kthread+0x10/0x10 [ 916.901635][ T5922] ? _raw_spin_unlock_irq+0x23/0x50 [ 916.906918][ T5922] ? lockdep_hardirqs_on+0x9c/0x150 [ 916.912517][ T5922] ? __pfx_kthread+0x10/0x10 [ 916.917483][ T5922] ret_from_fork+0x4bc/0x870 [ 916.922722][ T5922] ? __pfx_ret_from_fork+0x10/0x10 [ 916.927858][ T5922] ? __switch_to_asm+0x39/0x70 [ 916.933407][ T5922] ? __switch_to_asm+0x33/0x70 [ 916.938434][ T5922] ? __pfx_kthread+0x10/0x10 [ 916.943151][ T5922] ret_from_fork_asm+0x1a/0x30 [ 916.948291][ T5922] [ 916.952155][ T5922] Kernel Offset: disabled [ 916.956575][ T5922] Rebooting in 86400 seconds..