last executing test programs: 9m44.632636168s ago: executing program 3 (id=3055): openat$vimc2(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) ioctl$RTC_WKALM_SET(0xffffffffffffffff, 0x4028700f, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0xffffffffffffff6b, 0x0, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) r3 = socket$l2tp6(0xa, 0x2, 0x73) connect$inet6(r3, &(0x7f00000002c0)={0xa, 0xfffd, 0x1, @private2, 0x5}, 0x1c) ioctl$VIDIOC_S_TUNER(0xffffffffffffffff, 0x4054561e, &(0x7f0000000040)={0x0, "a055babd9b8c29abbdd772a44c5518bc1661222efc50f8f5555dcf4617da81d7", 0x5, 0x400, 0x3, 0x5, 0x2, 0x4, 0xfffffff9, 0x5}) mmap(&(0x7f00003e9000/0x9000)=nil, 0x9000, 0x300000a, 0x10, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x5, 0x0, 0x4, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x21, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000000000000000000000000000000000023cd3e68832d067498a2256e1f0ec82c2f06a7a58ea707f529f73f2b11f298c0a2d6c0bad7c48fdd230906969d852c43faf6", @ANYRES32, @ANYRES32, @ANYBLOB="0000000000000000b7080000030000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000018110000", @ANYRES32, @ANYBLOB], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r4, 0x40a85321, &(0x7f00000004c0)={{0x80}, 'port0\x00', 0x8, 0x140075, 0x7ffe, 0x4, 0x1ff, 0x0, 0x0, 0x0, 0x6}) 9m42.989901619s ago: executing program 3 (id=3060): r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r2 = socket$unix(0x1, 0x2, 0x0) connect$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r2, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) r3 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000200), 0x511300, 0x0) ppoll(&(0x7f0000000240)=[{r1, 0x3328}, {r1, 0x81}, {r3, 0x204}], 0x3, 0x0, 0x0, 0x0) close(r1) r4 = fsopen(&(0x7f0000000580)='overlay\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="4500000003"], 0x45) syz_emit_ethernet(0x7e, &(0x7f0000008480)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd6015fe0800482f00fc020000000000000000000000000000ff020000000000000000000000000001242088a8000000000003000500000600000086dd88a888be080000001000a0000100000000000000080022eb00000000200000000200000000000000fffc00000800655800000000"], 0x0) r5 = syz_io_uring_setup(0x15e1, &(0x7f0000000080)={0x0, 0x6cac, 0x10, 0x1, 0x122}, &(0x7f0000000000), &(0x7f0000000100)) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r6, 0x6, 0x3, &(0x7f0000000000)=0x5, 0x4) bind$inet(r6, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) r7 = signalfd(r0, &(0x7f0000000280)={[0x9]}, 0x8) fchmod(r7, 0x0) io_uring_setup(0x463b, &(0x7f0000000140)={0x0, 0xb247, 0x10000, 0x0, 0x31, 0x0, r5}) 9m42.120151181s ago: executing program 3 (id=3061): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f00000003c0)=ANY=[@ANYRESHEX, @ANYBLOB=',rootmode=0000000\x00\x0000', @ANYRESDEC=0x0, @ANYRESDEC=0x0]) setfsgid(0x0) lseek(0xffffffffffffffff, 0x5, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[], 0x40}}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) socket(0x400000000010, 0x3, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000100)='mountstats\x00') sendmsg$NL80211_CMD_GET_STATION(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x80, 0x0, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_STA_VLAN={0x8}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_WME={0x2c, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x2}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0xff}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0xa}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0xa9}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x9}]}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x82}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x1}, @NL80211_ATTR_STA_EXT_CAPABILITY={0xc, 0xac, "9e40340a91819fd5"}, @NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xc}]}, 0x80}, 0x1, 0x0, 0x0, 0x40080}, 0x400c000) read$FUSE(r7, &(0x7f0000002640)={0x2020}, 0x2020) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48000000100001040000", @ANYRES32=r6, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008", @ANYRESHEX, @ANYRESOCT=r6], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_inet_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000000c0)) 9m40.247652976s ago: executing program 3 (id=3068): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1000}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x20d036, 0x0, 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x89901) mount_setattr(r3, &(0x7f0000001d80)='.\x00', 0x0, &(0x7f0000001dc0)={0xb, 0x0, 0x80000}, 0x20) io_setup(0x6, &(0x7f0000000000)) io_setup(0x5, &(0x7f00000000c0)=0x0) io_setup(0x4, &(0x7f0000000040)) chmod(&(0x7f0000000100)='./file0\x00', 0x24c) io_setup(0xfff, &(0x7f00000044c0)) io_setup(0x1, &(0x7f0000004980)) r5 = socket(0x10, 0x803, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000340)=ANY=[@ANYRES64, @ANYRES32=0x0, @ANYRESDEC=r4, @ANYRESOCT=r2, @ANYRES32=0x0, @ANYBLOB="00000000008af800"/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r7, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6b, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FIONREAD(r8, 0x541b, &(0x7f00000001c0)) r9 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') read$FUSE(r9, &(0x7f0000001680)={0x2020}, 0x2020) r10 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r10, &(0x7f0000000b40)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x68, 0x14, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0xa}, {0xb}, {0x4}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x40, 0xfc, 0x600, 0x400a, 0x0, 0xfffffffd, 0x7e}}, {0x4}}, {{0x1c, 0x1, {0x9, 0x4, 0x18, 0x40d, 0x0, 0x8, 0x2}}, {0x4}}]}]}, 0x68}}, 0x20000040) syz_kvm_setup_cpu$x86(r9, r9, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000080)="ded70f20d86635080000000f22d89a73ff2a01660fc7360000660fc735660f388252740ff90d0b4a00baf80c66b880477e8e66efbafc0cb8f037efbaf80c66b840ed778b66efbafc0cb80700ef", 0x4d}], 0x1, 0x9, &(0x7f0000000140), 0x0) setreuid(0xffffffffffffffff, 0xee01) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0x7}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) 9m38.589607018s ago: executing program 3 (id=3074): syz_open_dev$tty20(0xc, 0x4, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f7410262e66f36d0f330f09660f3a0cb90000a6752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x31}], 0x1, 0x4498bda7e2139f37, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x8000000000000000, 0x40, 0x40, 0x0, 0x3, 0x2004cc, 0x4000000000000000, 0xfffffffffffffffe, 0x3, 0x0, 0x2, 0x0, 0x2, 0xfffffffffffffffc, 0x1], 0x80a0000, 0x450}) ioctl$KVM_RUN(r2, 0xae80, 0xfffffffe) 9m38.268278295s ago: executing program 3 (id=3077): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f00000003c0)=ANY=[@ANYRESHEX, @ANYBLOB=',rootmode=0000000\x00\x0000', @ANYRESDEC=0x0, @ANYRESDEC=0x0]) setfsgid(0x0) lseek(0xffffffffffffffff, 0x5, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[], 0x40}}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) socket(0x400000000010, 0x3, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000100)='mountstats\x00') sendmsg$NL80211_CMD_GET_STATION(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x80, 0x0, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_STA_VLAN={0x8}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_WME={0x2c, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x2}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0xff}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0xa}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0xa9}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x9}]}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x82}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x1}, @NL80211_ATTR_STA_EXT_CAPABILITY={0xc, 0xac, "9e40340a91819fd5"}, @NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xc}]}, 0x80}, 0x1, 0x0, 0x0, 0x40080}, 0x400c000) read$FUSE(r7, &(0x7f0000002640)={0x2020}, 0x2020) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48000000100001040000", @ANYRES32=r6, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008", @ANYRESHEX, @ANYRESOCT=r6], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_inet_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000000c0)) 9m37.003423833s ago: executing program 32 (id=3077): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f00000003c0)=ANY=[@ANYRESHEX, @ANYBLOB=',rootmode=0000000\x00\x0000', @ANYRESDEC=0x0, @ANYRESDEC=0x0]) setfsgid(0x0) lseek(0xffffffffffffffff, 0x5, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[], 0x40}}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) socket(0x400000000010, 0x3, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000100)='mountstats\x00') sendmsg$NL80211_CMD_GET_STATION(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x80, 0x0, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_STA_VLAN={0x8}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_WME={0x2c, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x2}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0xff}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0xa}, @NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0xa9}, @NL80211_STA_WME_MAX_SP={0x5, 0x2, 0x9}]}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x82}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x1}, @NL80211_ATTR_STA_EXT_CAPABILITY={0xc, 0xac, "9e40340a91819fd5"}, @NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xc}]}, 0x80}, 0x1, 0x0, 0x0, 0x40080}, 0x400c000) read$FUSE(r7, &(0x7f0000002640)={0x2020}, 0x2020) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48000000100001040000", @ANYRES32=r6, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008", @ANYRESHEX, @ANYRESOCT=r6], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_inet_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000000c0)) 6.833550298s ago: executing program 5 (id=5717): syz_open_dev$vim2m(&(0x7f0000000100), 0x5, 0x2) syz_emit_ethernet(0x3e, &(0x7f0000000140)=ANY=[], 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x9}, 0x20) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8001, 0x0, 0x9, 0x4b, 0x8, 0xfa11, 0x7}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) kexec_load(0x0, 0x0, 0x0, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000340)={0x0, 0xff, 0x1c}, 0xc) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, &(0x7f00000001c0)=0x3b) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_usb_connect(0x6, 0x1fc, &(0x7f0000000780)=ANY=[@ANYBLOB="12015002b8005108101407a0683e010203010902ea01030e00300309040309027f54cc00090502040004040403800109661bede31b6d40ffd5a6457d3483a7c64a2cf09c6b30e3afe9caf13ed9a2924ed053d2b4b24aedb4035d4212c8a5f7df3b67916187c245f81035efe9b53a8d79988d4b00a8aa5926f8b9103fd0e543cebd14ca5d0825146c7ff12ef0b8fe612538542d6f5c9fdc7894374795b8ccb6bdb303b42aa86746d3370ad7a31c090504104000050209072501830200040725018101070009045b060c317135060905051008000600d30725018002000009050610200080ff0407250101060200090500100004090401090504104000ab0005090505022000060d0d48007672bf7524ef90e0a086de3562bf356642bc0201de8fa807c3b757b1c182c0f4c59af7c59293e1bc41956912be0eafd96bdf03aa6117bc3e50fbee59a6e5dfc7206516e091fce94c0c778a134b5368d1af31d240535b0725018002010009050b08000401a9050725010332f60b0725010206ac15090502140000c7070e0905010400020805800905051000020802ae07250103fbff0009050010400008000309050c040002030d07410f8c1ea652c620acd24cbf2bfeb921dfc3f2c147f7c05a53e4f7db6742a64c76fe8d2f319387c80165b1ad6b9054e93ae7385d785e1c040f2c4e5c2388ef8791090509002000010802"], 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000940)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r4, @ANYBLOB="00000000000000001c001a800800028008000200080000003e127a510800020010"], 0x44}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[], 0xa0}}, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0xfff0) 6.682583475s ago: executing program 1 (id=5718): newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x800) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x50, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x3, 0x0, @vifc_lcl_addr=@local, @local}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, 0x0, 0x0) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0xfb, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @echo_reply={0x0, 0x0, 0x0, 0x64, 0xd2}}}}}, 0x0) syz_emit_ethernet(0x5d, &(0x7f0000000080)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x3f, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @remote, @multicast1=0xe0000300}, @address_request}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000200)={@multicast2, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1d48fc3c7b00", 0xf3, 0xfffffff7, 0x4, 0x40000006}, 0x3c) 6.633511653s ago: executing program 1 (id=5719): openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x1682, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) shutdown(0xffffffffffffffff, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) getsockname$packet(r1, 0x0, 0x0) connect$tipc(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0x2a, 0x2, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000240)="f2435f0100088000000000850800", 0xe, 0x40080, &(0x7f0000000200)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c00000013000100000000000000000000000002", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n', @ANYRES32=r4, @ANYBLOB="1400350064756d6d7930"], 0x3c}}, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) 6.559657217s ago: executing program 1 (id=5720): socket$inet(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="312000000000000014002b800800030004400000080003000200000008001b0000000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20048054}, 0x20000050) socket$inet(0x2, 0x4000000000000001, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) close(r3) 5.446810987s ago: executing program 2 (id=5723): r0 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) symlinkat(&(0x7f0000000000)='.\x00', r1, &(0x7f0000000140)='./file0\x00') syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) unlinkat(r1, &(0x7f00000001c0)='./file0/../file0/file0\x00', 0x3000000) 5.042878414s ago: executing program 2 (id=5725): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000800)=ANY=[@ANYBLOB="a400000013002f0a26bd70000000000007006800", @ANYRES32=r1, @ANYBLOB="688900004502030084001a8009000100766c616e0000000074000480700004"], 0xa4}, 0x1, 0x0, 0x0, 0x20000861}, 0x8004) 5.004818215s ago: executing program 2 (id=5726): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000007c0)={{{@in6=@remote, @in6=@dev={0xfe, 0x80, '\x00', 0x16}, 0x4e24, 0x0, 0x4e22, 0x0, 0x2}, {0xffffffffffffffff, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x4000}}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x2f}, 0x200000, 0x2, 0x0, 0x0, 0x0, 0x5}}, 0xe8) syz_emit_ethernet(0x3e, &(0x7f0000000500)={@local, @random="f368656e065b", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, @time_exceeded={0x4, 0x0, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @dev}}}}}}, 0x0) (fail_nth: 3) 4.777248972s ago: executing program 2 (id=5730): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x7, 0x4010, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps_rollup\x00') socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x77c}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, 0x0) ioctl$BTRFS_IOC_GET_FEATURES(r0, 0x80189439, &(0x7f00000002c0)) mremap(&(0x7f00007ff000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000580000/0x4000)=nil) mremap(&(0x7f0000580000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00007ff000/0x2000)=nil) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x2007, &(0x7f0000000980)=0x0) eventfd2(0x9, 0x0) io_pgetevents(r5, 0x2, 0x0, 0x0, 0x0, 0x0) io_submit(r5, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000000, 0x5d032, 0xffffffffffffffff, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f00001cd000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x9, &(0x7f00000002c0), 0x0, 0xc303, 0x0, 0x0, 0x0, 0x64}) r6 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r6, 0xc100565c, &(0x7f0000000040)={0x0, 0x1, 0x4, {0x9, @pix_mp={0x12, 0x5be7, 0xb5315258, 0x6, 0xb, [{0x80000004, 0x7}, {0x7ff, 0x5}, {0x10000001, 0x9}, {0x63d, 0x7fd}, {0x1, 0xb}, {0x7, 0x489aa92e}, {0x1}, {0xff, 0x7}], 0x1, 0xc, 0x2, 0x0, 0x3}}, 0xfffffffd}) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000140)=""/122, 0x7a}], 0x1) 3.657356338s ago: executing program 4 (id=5732): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) syz_open_dev$video(0x0, 0x75, 0x101040) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x4008032, 0xffffffffffffffff, 0x2000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000100), 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x60600, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r4, 0xc040aed5, &(0x7f00000000c0)={0x100000, 0x21d000}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') syz_open_procfs(0x0, &(0x7f0000000180)='cpuset\x00') openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', &(0x7f0000000140)={0x5750c0}, 0x18) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000000), &(0x7f0000000200)=0x4) 3.656260946s ago: executing program 5 (id=5733): syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r0, 0x707, &(0x7f00000000c0)={&(0x7f0000000200)=[{0x6, 0x11, 0x1, &(0x7f0000000080)="d7"}], 0x1}) 3.532707369s ago: executing program 0 (id=5734): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) accept4(r0, 0x0, 0x0, 0x800) (async) r1 = accept4(r0, 0x0, 0x0, 0x800) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]}) r2 = socket$nl_route(0x10, 0x3, 0x0) socket(0x11, 0x80a, 0x0) (async) r3 = socket(0x11, 0x80a, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020100000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a32000000001400000011001f"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a54000000060a0b0400000000000000000200000028000480240001800a00010071400003000006000340002400000c00034000000000000082020900020073797a3200000000140000001100010000000000000000000500000a00"/124], 0x7c}}, 0x40) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r5, &(0x7f0000000640)="58104053af45d43ac86fac32e9896a21b244f2282a91327f763641d55a372a9ab104fd4c31abfb4148ce7826605fe632c6cc31e66f4706030aaa0320d92b0b8b41fd21ee32f2e3d86cda67dd197273e2e0381241a4220e", 0x57, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) recvmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f00000003c0)=""/118, 0x76}], 0x32}, 0x0) (async) recvmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f00000003c0)=""/118, 0x76}], 0x32}, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88, 0x1, 0x0, 0x3}, 0xe) shutdown(r5, 0x1) recvmmsg(r5, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x406, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x4, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xca63, 0x8, 0x80, 0x2, 0x3, 0x80000000, 0x20000006, 0x4d, 0x9, 0x5, 0x9, 0x5, 0xffff2d36, 0x1, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0xd, 0xe, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x47, 0x4c74, 0x80000000, 0x242, 0x3, 0x4, 0x0, 0x80008071, 0x7, 0x8, 0x3, 0x7, 0x5, 0x3e, 0x8c, 0x6, 0xffff, 0x3, 0xe0, 0x4, 0x8008, 0x400, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2c0, 0x7, 0x209, 0x800, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0x3, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f2e, 0xd, 0x4e2, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x9000047, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0x81, 0x24f, 0x42, 0x3], [0x7, 0x408, 0x2, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x3, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x0, 0x4, 0x2950bfaf, 0x1000, 0x4b2760ed, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xca, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x1, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2eb, 0x0, 0x3c484551], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x93a, 0x5, 0x6, 0x1, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x2000004, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x201, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0xfffffff9, 0xfffff000, 0x10000, 0x6b, 0x7e, 0x100, 0x9603, 0x7, 0xaf, 0x5, 0x6, 0x9, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x400007, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x1ff, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400007fbe15c724c30001110102000000000000000002000009"], 0x14}, 0x1, 0x0, 0x0, 0x406c450}, 0x80) (async) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400007fbe15c724c30001110102000000000000000002000009"], 0x14}, 0x1, 0x0, 0x0, 0x406c450}, 0x80) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="780000001000010400"/20, @ANYRES32=r6, @ANYBLOB="60300300001400005800128009000100626f6e6400000000480002802c0008"], 0x78}}, 0x0) r7 = landlock_create_ruleset(&(0x7f0000000140)={0x8b28, 0x3}, 0x18, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r9 = getpgid(0x0) fcntl$setown(r8, 0x8, r9) (async) fcntl$setown(r8, 0x8, r9) sched_setscheduler(r9, 0x2, &(0x7f00000000c0)=0x800) landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) (async) r10 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r10, 0x1, &(0x7f0000000080)={0x0, r10}, 0x0) (async) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r10, 0x1, &(0x7f0000000080)={0x0, r10}, 0x0) landlock_restrict_self(r7, 0x0) sendmmsg$alg(r1, &(0x7f0000004a00)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="48e5d0", 0x3}], 0x1, &(0x7f0000000080)=[@assoc={0x18, 0x117, 0x4, 0x2}], 0x18, 0x80}], 0x1, 0x4800) 3.388643657s ago: executing program 1 (id=5735): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x40) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r2, 0x40045010, &(0x7f0000000040)=0xc) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='syscall\x00') r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r5, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x5, 0xc9b, 0x1, {0x77359400}, {0x0, 0x2710}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "645b6048a2e4931133f6d9919fd48557d76811cd874f3c107bbfc1c8831026d40798a2be4cc414e02216198977dc3d41ed0880c64c39e5f4059bae641ed15112"}}, 0x80}}, 0x4) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) syz_io_uring_setup(0x131, 0x0, &(0x7f0000ffe000), 0x0) pread64(r3, &(0x7f0000000100)=""/133, 0x85, 0x8) ioctl$SNDCTL_DSP_SETTRIGGER(r2, 0x40045010, &(0x7f0000000080)=0x7) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000740)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x28}, 0x1, 0x0, 0x0, 0x400c4}, 0x20008000) 3.03599525s ago: executing program 0 (id=5736): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'veth0_macvtap\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000005e0001002abd7000fedbdb2500000000", @ANYRES32=r1, @ANYRES64=r0], 0x1c}, 0x1, 0x0, 0x0, 0x400c801}, 0x0) 2.999232154s ago: executing program 0 (id=5737): syz_open_procfs(0x0, &(0x7f00000005c0)='mountinfo\x00') socket$xdp(0x2c, 0x3, 0x0) syz_io_uring_setup(0x1e7f, &(0x7f0000000540)={0x0, 0xac24, 0x10000, 0x1, 0xc}, &(0x7f0000000080), &(0x7f0000000000)) r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) ftruncate(0xffffffffffffffff, 0xffff) close(0x3) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f00000001c0)={0xffffffffffffffff, 0x1, 0x0, 0x8000}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pselect6(0x7e, &(0x7f0000000100)={0x0, 0x0, 0x1000000000000}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x3, 0x0, 0x5}, 0x0, 0x0) 2.96140921s ago: executing program 0 (id=5738): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000001b40)=ANY=[], 0xfffffe3e) (fail_nth: 15) 2.877563851s ago: executing program 2 (id=5739): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x1e6702, 0x0) ioctl$IOC_PR_RELEASE(r0, 0x401070ca, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x1c, 0x0, 0x209, 0x0, 0x0, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @multicast1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008080}, 0x4000080) (async, rerun: 32) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0xa, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'geneve0\x00', 0x0}) (async) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000280)={0x4000}, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000011c0)={0x14, 0x1a, 0xa01, 0x0, 0x0, {0x81, 0x2}}, 0x14}}, 0x0) (async, rerun: 32) sendto$packet(r3, &(0x7f0000000080)="0b036800e0ff64000200475400f6a13bb10000000800894f4820", 0x1a, 0x400c0, &(0x7f0000000140)={0x11, 0x3, r4}, 0xffffffffffffff29) (async, rerun: 32) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io$hid(r1, 0x0, 0x0) (async) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000480)={0x2c, &(0x7f00000002c0)={0x0, 0xd, 0x1, 'q'}, 0x0, 0x0, 0x0, 0x0}) 2.652001647s ago: executing program 0 (id=5740): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = socket(0x1, 0x80802, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0_to_batadv\x00'}) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000), 0x8) r2 = socket$packet(0x11, 0x2, 0x300) bind$packet(r2, 0x0, 0x0) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) 2.647374612s ago: executing program 5 (id=5741): newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x800) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x50, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x3, 0x0, @vifc_lcl_addr=@local, @local}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, 0x0, 0x0) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0xfb, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @echo_reply={0x0, 0x0, 0x0, 0x64, 0xd2}}}}}, 0x0) syz_emit_ethernet(0x5d, &(0x7f0000000080)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x3f, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @remote, @multicast1=0xe0000300}, @address_request}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000200)={@multicast2, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1d48fc3c7b00", 0xf3, 0xfffffff7, 0x4, 0x40000006}, 0x3c) 2.635360437s ago: executing program 0 (id=5742): pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f00000012c0)=[{0xffffffffffffffff, 0x480}], 0x1, 0x0, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x7f, 0x4000006, 0x3, "42341f9b1000007e4f00"}) r1 = syz_open_pts(0xffffffffffffffff, 0x103100) dup3(r1, 0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x7ffff000, 0x0) 2.549364442s ago: executing program 5 (id=5743): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) write$UHID_INPUT(r1, &(0x7f0000000080)={0x8, {"762b45da60c199cf825756935dc70293d27acdd97c084f39a47602158895bb8fd55712efe0bee55723ef9783ef5c01fb33ed458ff08d967e4418f0284baee2e245a06888781ee01505d3245cef5cd3166ae5234ec116e3a97f0dc35221e0eebc5558d2f048c409d96f6214aa931955521684e6f317d2e0acc184762025dfe33d8ae07740e8533dfcc16a910ec8457e7d4d79b9f3e443ff9b14544408482e9c6361c692a67e391f7725b81c0180df1bec5e88eedad06a1d06f75d3c4cdaf38bc354198fb268658d3e456b524aedd1e9f9d9eb133ca6f28dc9e1f9eae2edb398235f9d42e1e11b2f43ce5368970768f85492f06d5b7c31e0eab554ff4c35577265d109f0339a6d87b46d1694b6f319dbd688544ef9745adbf2afd24b09127e19e8ea569ad721605731d810603f00e6209e29459465c0471b55cb55146732f0f61a97fe84d98490829b851c3fd4cc865027a65e5ca29a46bbfaf16add491810b164a8276cc81318f4608737cab6628c3e9630711b73bab97f3218cb13bc4766290aeb797bd469960c586e8b7f5a3f4f94b119f6241d9bd2de494e35436c3584128f22e6d28b40818810fd3669959021fbcd7f8a69500ba07595e523923d1986bb2f4a043e94a1157bd217d969123686acfefdcc8c3e93eb07664214a94f0a78e0f7c1d8441f23088a9c33b05e2ae082c31a9f93c44e1f058df5c8e6b0c5a4a6f516eb96523a6e2bb25083e7bc7a8c3f51bb0727a49731f795a4a9da9c72e4caf70b8b955333844f07d70acb2bbbfce9fdbf738fb67d11c05d6d21a53c8c0c3304d0b92bda4a57e7261c4e98ebffd3f452c77aaa585a435c96268861eaee3b33c2c752eb39bc6333153d5147fe3a111aa484de7500e9d0635299d68a4c534b1e1b14ed4360fb319f10a222af4f021948615df731086c61001451715eb3cb092232da51827e9c3c7be8e31d739232c9089a7d75453493a1232b081ec0898a767edd5026517ab1151579e5f8face26566ed8d1b330f7556781c23c578ef98ff11ac436de750d7592d1e7c8d0d322719488f62e717bcc286323a49ff178b8a7597de625e1313a43883e7db2ade5e730a4bf93549fda7122a48c31aaadc034966d1803a6d497d90dfdbe35db10fc248a43cec3d0f79ed2fa251119e9d1f5ad196e950d5c5cb570989941042bc0893c43f4058797c12787577c37d1db704ee42056455923d16bddf3c8cb10043d1c17dd0817094a1ba1e4ae173e25c50f9d5010b82a038fdb784c224a28942aaa37c94c396cbc455a82a820434df5dcf7371781f31063f95b7c0b8dfce39c9a6eb1337f515949d838ad2418e3f776d94dfabcaa437b6c42a4e10d48ab9684b23fe976eb17b5150ec241c4346a944792b00bb7158c8079c34b2f0561eb74d930c7d7e939df85cbdd2c0392a848701b35fe144058f5a718181443070caaeb34a1d55a0e48c8544b65af4a8145e3fdd363d6402301b660efdd59dd6e12381f5f498417d26a1d1a16017260d66df8052478efb94b2e0324c585a83bbef603b0ae4d99301f8e9c32afacf021048f9d2636cd12714ee0e9ea1c722d1361f6822f8855c22cc87160a701614a75020eea5d70badeda8efba7ff2394e06fd468fe1e1630913b584dfab6ea761e92f65ee2a795b5d0e6c3d6803e3c767134cd0008696a4475e336ea7545d8dda3b4d64fe9930a24fb589f6eb213219cc4726a874cf934c7214c35cec5e7ff4bb7a5caddabfe305b3c8b3dc10933ca0352233df5d47b376a42000ed15eeedd70f5549b666100c54a8f7aa2f25c125f1d5faba0ce24305438a89046096190248d5e48d6a930d5f352615ee584c7a6a571b62afc975a5de2cb5ea4667a708f31a20e5132d693fa5bb6d87ea7c384e251f5767fd6683edfcdf54b122bdfb7fa52360075632119a74fa0c551d7780c825891de2a648cce1bd9e3b2faa1f3a07d3fbb4c9f360683b4d93616f6c33689644ed5f8238300cd203980b60364d2ca6bd01a33b36afa7a1708e7263e55c7e20813472c8e2a8f9fe7d3553e0d2ab8db08d5fe9df88c4938d944da9359048d2fcf68a94980a79e1afa9847411235a886bc5e3c3da92081c672be4465725ceef8c876dbc404c714053f28da9306d8772ec6782486fb438043ca582fa1598101e1c1e738ec00e1984afd9a34fbc2faf34ca6eb98cb84c483c69a09a233653b8a84ced2c96f6b90823fb588333cd749fd39ddb568b37a5f672ba2ef93d716b9f3fae9537dd113b21e4a6d2b238dc1b886494fbf7ef909281ed95a15cc0a8c6b2087cf13677a07820d0c4d4925fbd49aa0cd57e707dc6070488aa17eaf24d5fb58538f5a9898bbb16e25e2fd5e4de960e150a065c036ce907b05f2992939023267f790f07956f1a96dab2964a11845cdf1f992b50468311ec7b5d5b4e6c78cee13a3f77b0312ffef0e78c02f07075ccb64353031b21f4c8f92fc8ab47721cf0edda8aa513fac12121ea0dca2507fbdbf57a5e33e946dba62aabc9bf4f9c156dc58b56b3dea5953fc4ce9ad0fcd12d843f746b99f8aedc34fcb2b5422968c9b31ad076d42af0a350c107cfa622bee6933007184198a6e3a493b806f10c4be7999533003e0088bf07034e3630c3194e5e717e1d85948d16d79141f10b7ba9e2fb31498a96d1f2999d84c4e2d93be5d5196ccb1ab5d71af50b1b2e200a0aa83e158624773c99d32d8f7caa56d6ddd548a506be8853268e9cb9145698198d6dcf4ade5c3a196dc400c37cf5bd2e8e43c64e2e9624ac7f1eeb912c315fbc92af3efbed9735123932ecdbeece38fb967e0697f8e91e2b3c8a3480572c351f645fdcb9255c9830629d6a24c5db3350a6a7a85a2d84878c484f2160c8d35a8c4c98ed485a15fb82a6b23974a029190f13206eb0fb7608b69dae3e59c34252e88a227166573c7ae62e80b94626ac5c39b63a8c143b76965a97f582bb7d2833b3fc79d4b572cc8e860dd8f364f4f7ba94aa3cb97f0c81aa9286603cf71b3fe3b93ae8b15e7c8d9c9114648b305c412ba44b37c982300ba844238a3ed1d9ee658d0c62499db1b9b8475ccdc40d3f0686a33dd82cdde923ffddc7c189140236d950145f30d7e4a543b02047b9ceadcb395a42697957bf735831f8fe6682a1029719ff271a78569b975b141f970c71f115f20c5fe8e908c315b59fff39e16488d613edd3ddcc2d31eeb7a4c8355b72b54c1b0442e5eace3f52f443cf7661d51504c5e446daced996838f21a759c84b8b69a4adc0e5cc67e3314bc939c415f00d74676b8bff4ffb2afdb8f7bdad2f414f5553590fef27b9aa4f86182349b265ef4793bbd33b79eec61baa455916b4958af258bbe855da2fc0f077dce98f2e00bea6fa20bfaa7f0a533579381b9ff1b5b610d09a586ce0d2d817854fe0a987e30183450d04ead462a6dfd334d6eb0fe99994983be2f57994d9fb40ee406257c5360782ff2561c210e962005676c88c523867ac7952ada256023ae83d371f5b009ec6a4f42554ba914a0a2a34928beb5783ebc2ffc440774361416e66192aa23a91fb209a3a657f0d700faf98bd8ea69bbb6fb3e92678d47aa5850546418159a21aced978c38db4370858c0b84482f35792439319aa84f964fe32f29e0d4885f9ab380c43dcccd3539cf57a7eb615b2d428f90ad57213f83909463a332c4df44b766ec9a335b9147441eaa21372481f9da94ffe4b543d68fe765263f976c9ef87f0074ef1a930afe02b53a73a066e3f4729cdba2a8f6095f50319d32766656344089eab030bcec42d4dce46160926c0243f4b498f9929265af90167c8c78258281d5d810200a8784623500929e1a5675f7fdaa1cfb8946e43bb7be870936dd3cc45f192852ab12a3fe2934f5cc8776b9c2c4311eccdb794b6498e3da4737465d9cd00e8253951f220fba8ae3c3a1659a8b14528f8c7084ea30d4dc76111d180dd650b84031a0e6d89ce55a55d00002f24db651132f21b4d279f3a51bf1ed723f5feac32ca2422eb84fc5947122519ba770f9d345c3cb5d59679529569b8977a4bba4ce6dea33e312a27b0faf27877b0a99781630c99108743d7362e6199e42d24926f34451613070f81f5741b433f056af194a51fd765989321672ce10e2c6e3ccb91394619df5bc0f2cc0190c495a6a2996be7aae233887e6cc3e6696fbb9caf7bd2f71ccb0317ec76a346c0ef7c27d32a76097967dad83946ab3cf2a90fb625f679fb516a279ec18934b40410851389ed268bfaf21b83f25777d32ff6405a7d2f714016d7a21a3b961cb3048f736dff6e553cdb2ab2f6cc2c4c96eeae91eb9fb044444e5a991938151da43e39ae33c9450174d6b0cc646fb4a692ec6c6b00cdeb80594697bcbc8731b96ef44b0a2ea7e1b1ac070aab664cd66abf603cd7545c6230376ec1abc345a618eb42e86f3335ab7e361d5787a8d6af2d073c73d229cb7860fa369a5d578fac97fe62e48d4bcf783578eeca0f88053284938163c938b092fde881ecbac93588abe5d2f6b1009735c676ab5a121855072d0f3ddec8d12d01630f2d5406b7da590ed758b17f5935ff6a1e5b4a24018e4eea9ccd9adf0417ea7967b2ba17caf39cedd54350e856efe3b0a48ab2002ca1eb5c5c1a6973c92c28882997c9b638c1c09d8ddc56b66489c86900e94ffdfd133cfde58a96e7ab8b5cff674d7393092a2c3566789405e15b6a5203fce2c8dcd4b3fd8e37ac1d7a89bae796af97dafc56f2f4035b53d7f73d010d7d16fe2c7306057f6dd268a0d3ebb8c9e6e5690ccc61f574a6f976867015a19b28fe77004ec0936d89fd14793c98312f71402bb501773c548a073ca2f705209993fc41d784e6ba0e471d4a18833a6bbaff9d01b594745e8996c89b1e40484dd75a1537b25132882e059e7a60fcbad42ca519d99b3c3015f22f77a58f7268ae747fa83deb4a9f107770714cee93fba523af347e51238383b2f5effca039f5ac9f894f1852aafc6ab9ced36fbf2512711cf6ce6a1dc12f6deced10a01016629810331bdb5224a585a706ed97e365d05ccf85cbec67ea73b683ced506becac5f16668cf284bdc4fc569281f885a2be7d555a37e24719a660968019ebccfa767a046d288bb1bdd43ded613f99bae4526be512444b918580922c883fd45c6a04230f5a511986fc8f8be9c63458b52163069f5e97397904853ee379bb3ab583281a9b606321c8024b62dcf40e6624d60e29589d03ba90e6ec6a028f2921768c064ec07c20a4878026aef1de9c39fff7ab27875462bc10b07f75b6360fe0dad96a8290a3a0ca18271db6d1d2ea359df5aead9a8ab19f5956af7271eea650e88ae0c211e127943f6566608273469b93550dcf385117609e1883398408cc59470465ae8f7c850d07262c84c7d2abbe9813d27d5973d9712832c8da46d0fc85ce129654a7b1acfffede6295e534159a40ac6b54f691922d6f34f793daaac88f7df3a0f9879e0657e512375b255826b0285fbcfefd9eeac4ef3ed9de15cb27abff0381d8fbf4a6442b62b94f718431ae4e151fd31984318a4a189f52e2505074b7cbd70827df2cc4c6464fc516c7f47d125d1fd6940659e0d18e717ba211a94be697a71e00290de581c0464360e0b5b32eb44893ed2ed3b0714e9f7df8607604a10052c4d9173bd3c1fdb9b54d56085774a45d7c7aa5a55c1a309ae3fe7246b4640d48b847d94fcf18a8c24f57e2c248d81b309b720bb142ed87ab4ff9eefdf87f97d9ea45d9a59285b241051adeef736812b2a878e11a1ec0ca288ca7bf4c04", 0x1000}}, 0x1006) r2 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000000000/0x4000)=nil) shmctl$IPC_RMID(r2, 0x0) shmctl$SHM_UNLOCK(r2, 0xc) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x6, &(0x7f0000000040)=0x9, 0x8, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 2.369303968s ago: executing program 4 (id=5744): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x6, &(0x7f0000000000)=0x9, 0x8, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (fail_nth: 15) 2.344971535s ago: executing program 5 (id=5745): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) set_mempolicy(0x4003, &(0x7f0000000200)=0x7, 0x3) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='freezer.self_freezing\x00', 0x275a, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000014da2108ab12a390ce1e000000010902240001b30000040904610017ff5d810009050f1f01040000000905"], 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRES16=r2], 0xec}, 0x1, 0x0, 0x0, 0x44081}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = socket(0x2, 0x3, 0x6) sendto$inet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000140), 0x1, 0x181502) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f000043c000/0x1000)=nil, 0x1000, 0x15) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000000940)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000640)="985e44efeabe001cabcf3d8673c3a254a9a2d3197970cb347b70a243bf77139a94bc3ae91684aaf7b7dff691deb8f8aef2d915fb3a0794a9a9b431a819bca6122c350637808dde804a048fd8696e524b2934126c443ce93d82e931eb9918e6c0827686e59209d2e02c9210fd8048f04ad6c42200fd9232f5aa6a361816bf21afb8473a064f1988536d4b5888807b3aaafaf59f53121782a0a9370dc0feae13c8c2a1dcc8a3122aaa3dcd5b9247a915378e6492e5b94073dcdc87e7c794fb262a7e9ee0b943", 0xc5}], 0x1}}, {{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000a00)="449f6aed247d19", 0x7}, {&(0x7f0000000a40)="cc5a4dbac0affd0a979c63ea8352d608a51fc8625318716ddf62b7752be4540c4ac7d344c53a3ad28313abc2437b60b03c0e587cafcf9a435bf90c618351f70a828238fdf90bc5d36c7d614b82552649954e0185662defd28f78449f073bad544f586136c5076a6f0f1b6fc9adf80557eb44db1b41824e9ef104c15e999766bbf27d74ad5d8fa63210cde65d384dd3e87c3fedaec3144d1ee66a0eb0750363e346cb9556a649fb246fd788930dae6109df6b9955bf8af119b5c9a86622af4ff8b5949fb90f8edbde416d046d61512fe4c453bb601a780e1bbc00dbedc5e50d3cd9bc920810eaefd5f9a171e9d32ab46b42e3e78c60087318bab42e94653cbd9e52fba37c5a31d095500e91d02256f101e82447e34733220cdaaabc947f5b815080b5214c94a06fe96450ea42f48086c032b24d9e8d722841b7c7244b1d2cc012fcda1f7472fdbabb670900000000000000715b3f5cef6ef951abab80a4a0f5f8574395c5820fa25d07a119e23b39a87cb3b763fbfb0491121eec3e05eacbe7835e79e76881d1179013622a2a6421d51c974e6abd48a9882c8fcadbcee369346a", 0x1a0}], 0x2}}], 0x2, 0x54004) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000740)=ANY=[@ANYBLOB="0600000004000000008000005c00000000000000", @ANYRES32=r2, @ANYBLOB="00000000000000000000000000000055c2409d59e45ec02e3c5253fbf83e508b55e32e9c72bc4b91ce183da12e0ded0561d33dd92474bb1ad5a65dbfab68c7234e7ebbadb4f9c571da3261ce142d5695a59a1d1dac87b58e195cc59ad2f8ccd117cfc2", @ANYBLOB="c9b200c4a5a7ad1b7eb18ba7670fa7ca203ed2c91471ffd461f2fe22a606d05556c0d29e9b95e339902370e838759b", @ANYRES32, @ANYBLOB="00000000feffffff00"/28], 0x48) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 2.102157902s ago: executing program 4 (id=5746): socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x40010, 0xffffffffffffffff, 0xd06d000) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x84}}, 0x4008400) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, &(0x7f0000000140)={0x0, 0x0, 0x100800, 0x0, 0xffffffffffffffff}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x10001, 0xfffffe0000000005, 0xfa11, 0xffffffff}, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x4e23, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(0xffffffffffffffff, 0x0, 0x30, 0x0, 0x18c) unshare(0x8000000) semget$private(0x0, 0x4, 0x43c) r4 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x141341) ioctl$USBDEVFS_CONNECTINFO(r4, 0x40085511, 0xffffffffffffffff) r5 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r5, 0x29, 0x16, &(0x7f0000fcb000), 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000c00)=ANY=[], 0xc8}}, 0x0) socket$tipc(0x1e, 0x2, 0x0) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x0, 0x0, 0xa}, 0x10) semctl$SETALL(0x0, 0x0, 0x14, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000340)={0xc}) 1.697818737s ago: executing program 2 (id=5747): r0 = socket(0x10, 0x3, 0x4) capset(&(0x7f0000000500)={0x19980330}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7, 0x7}) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0x25dfdbfe, {0x2, 0x0, 0x0, 0x0, {0x4, 0xb}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0xfc, 0x200, 0x1080000a, 0x0, 0x1, 0x7ff}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x18, 0xd, 0x1, 0x4, 0xfffffffe}}, {0x4}}]}]}, 0x68}}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000500)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="0d00000000000000000087f2", @ANYRES32=0x0, @ANYBLOB, @ANYRES64=0x0], 0x20) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0xab, @loopback, 0x10001}, 0x1c) r2 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$sierra_net(r2, 0x0, 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r3, 0x707, &(0x7f00000002c0)={&(0x7f00000001c0)=[{0x2, 0x8411, 0x22, &(0x7f00000006c0)="0203204bdcc36cda8907f47563863d1428f47b34551c000bce0f6bc6584f11a7489c"}, {0x7fff, 0x10, 0x0, 0x0}], 0x2}) syz_usb_control_io$uac1(r2, &(0x7f0000000180)={0x14, &(0x7f00000003c0)={0x40, 0x10, 0x83, {0x83, 0x2, "2bcff982b0586db06caeeddc90f6f4662e997cd7ed78d8b5337c95fb15c8c87eebc823cbf01f093b350ad8890f35165202709a2195b139ea5459b1c49595935037f10cd36d22de643d13b16e625f0ae3a1411e311bdd0cf4001c76eadadf23465659cf2fd7313f145993cff0512e9b10a3a79d0ba599fcaf1ad4141a8ca51058ca"}}, &(0x7f0000000080)={0x0, 0x3, 0xb, @string={0xb, 0x3, "44d3596b4914d7153b"}}}, &(0x7f0000000600)={0x44, &(0x7f0000000240)={0x20, 0x9, 0x45, "a269dd536dc656059958d8fd973590d22bed686ee4893cdabb1cd78407d0bc674461d09a9a47ed0fff0c8baf7ce29a5c260e1c336eaa40bf9f41d6ca7cc4c0356d79e5df82"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x31}, &(0x7f0000000480)={0x20, 0x81, 0x3, "b43cb6"}, &(0x7f00000004c0)={0x20, 0x82, 0x2, "fbe8"}, &(0x7f0000000540)={0x20, 0x83, 0x2, "125b"}, &(0x7f0000000580)={0x20, 0x84, 0x2, "03a4"}, &(0x7f00000005c0)={0x20, 0x85, 0x3, "81efbb"}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) 813.35562ms ago: executing program 4 (id=5749): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) ioctl$RTC_PIE_ON(r1, 0x7005) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000540)={0x1, 0x0, [{0x80000007, 0x1, 0x2, 0x5, 0xf04, 0x6}]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, 0x0, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@migrate={0xec, 0x21, 0x1, 0x0, 0x1, {{@in, @in6=@remote}}, [@migrate={0x9c, 0x11, [{@in=@empty, @in=@private=0xa010100, @in=@multicast2, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x6c, 0x1, 0x0, 0x3506, 0x2, 0xa}, {@in=@empty, @in=@private=0xa010100, @in6=@remote, @in6=@mcast2, 0x33, 0x2, 0x0, 0x0, 0xa, 0xa}]}]}, 0xec}}, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x1, 0x3}, 0x10) sendmsg$tipc(r3, &(0x7f00000000c0)={&(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1}, 0x1}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc084}, 0x20000090) 755.251405ms ago: executing program 4 (id=5750): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) (async, rerun: 32) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000680), &(0x7f00000006c0)='./file0\x00', 0x1000404, &(0x7f0000000700)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="1a00"], 0x1, 0x0, 0x0) (async) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) ioctl$FUSE_DEV_IOC_CLONE(r2, 0x8004e500, &(0x7f0000000200)=r1) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e13d6a206419010015d4010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$printer(r3, 0x0, 0x0) (rerun: 32) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$hid(r0, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0}) (rerun: 32) syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 575.63809ms ago: executing program 5 (id=5751): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000980)=ANY=[]) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f00000001c0)={0x50, 0x0, 0x560c, {0x805, 0x5d5}, {0xfffa, 0x2}, @cond=[{0xff6a, 0x1, 0xb619, 0x2, 0x7, 0x6}, {0x5c9, 0x0, 0x0, 0x3, 0x1000, 0xf5c9}]}) 256.301304ms ago: executing program 1 (id=5752): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = socket(0x1, 0x80802, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0_to_batadv\x00'}) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000), 0x8) r2 = socket$packet(0x11, 0x2, 0x300) bind$packet(r2, 0x0, 0x0) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) 181.793391ms ago: executing program 1 (id=5753): r0 = syz_usb_connect(0x5, 0x24, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r1, 0x707, &(0x7f00000000c0)={&(0x7f0000000200)=[{0x6, 0x11, 0x1, &(0x7f0000000080)="d7"}], 0x1}) 0s ago: executing program 4 (id=5754): r0 = socket(0x1e, 0x1, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r0, &(0x7f0000000340), 0x2000011a) sendmsg$AUDIT_TRIM(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc810}, 0x4814) recvmmsg$unix(r0, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000700)=""/4096, 0x1000}], 0x1}}], 0x1, 0x40000040, 0x0) kernel console output (not intermixed with test programs): ddress+0x26/0x2b0 [ 1105.399632][T23905] ? kernel_text_address+0xa5/0xe0 [ 1105.399657][T23905] ? __kernel_text_address+0xd/0x40 [ 1105.399680][T23905] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1105.399705][T23905] ? arch_stack_walk+0xfc/0x150 [ 1105.399733][T23905] ? stack_trace_save+0x9c/0xe0 [ 1105.399756][T23905] ? __pfx_path_openat+0x10/0x10 [ 1105.399773][T23905] ? __lock_acquire+0x6b6/0x2cf0 [ 1105.399801][T23905] do_filp_open+0x1fa/0x410 [ 1105.399818][T23905] ? __pfx_do_filp_open+0x10/0x10 [ 1105.399850][T23905] ? _raw_spin_unlock+0x28/0x50 [ 1105.399865][T23905] ? alloc_fd+0x64c/0x6c0 [ 1105.399903][T23905] io_openat2+0x3e0/0x5c0 [ 1105.399924][T23905] ? __pfx_io_openat2+0x10/0x10 [ 1105.399942][T23905] ? getname_flags+0x1e5/0x540 [ 1105.399968][T23905] __io_issue_sqe+0x181/0x4b0 [ 1105.399992][T23905] io_issue_sqe+0x165/0x1060 [ 1105.400020][T23905] io_submit_sqes+0xbf4/0x2140 [ 1105.400070][T23905] __se_sys_io_uring_enter+0x2e0/0x2b60 [ 1105.400106][T23905] ? ksys_write+0x1cb/0x250 [ 1105.400125][T23905] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 1105.400145][T23905] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1105.400164][T23905] ? __pfx_vfs_write+0x10/0x10 [ 1105.400182][T23905] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1105.400205][T23905] ? __fget_files+0x3a0/0x420 [ 1105.400230][T23905] ? fput+0xa0/0xd0 [ 1105.400251][T23905] ? ksys_write+0x22a/0x250 [ 1105.400269][T23905] ? __pfx_ksys_write+0x10/0x10 [ 1105.400289][T23905] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 1105.400312][T23905] do_syscall_64+0xec/0xf80 [ 1105.400330][T23905] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1105.400347][T23905] ? trace_irq_disable+0x37/0x100 [ 1105.400368][T23905] ? clear_bhb_loop+0x60/0xb0 [ 1105.400388][T23905] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1105.400404][T23905] RIP: 0033:0x7f5b51f8f749 [ 1105.400420][T23905] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1105.400434][T23905] RSP: 002b:00007f5b52db1038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1105.400453][T23905] RAX: ffffffffffffffda RBX: 00007f5b521e5fa0 RCX: 00007f5b51f8f749 [ 1105.400466][T23905] RDX: 0000000000007721 RSI: 0000000000002219 RDI: 0000000000000000 [ 1105.400477][T23905] RBP: 00007f5b52db1090 R08: 0000000000000000 R09: 0000000000000000 [ 1105.400489][T23905] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000001 [ 1105.400499][T23905] R13: 00007f5b521e6038 R14: 00007f5b521e5fa0 R15: 00007f5b5230fa28 [ 1105.400525][T23905] [ 1106.639063][ T795] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 1106.819254][T12986] net_ratelimit: 29 callbacks suppressed [ 1106.819277][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1107.349302][ T795] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1107.383830][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1107.418956][ T30] audit: type=1326 audit(1768293775.683:2780): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23928 comm="syz.1.5208" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1107.441571][ T795] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1107.636032][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1107.689012][ T795] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1107.721958][ T795] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1107.747234][ T30] audit: type=1326 audit(1768293775.683:2781): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23928 comm="syz.1.5208" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1107.776324][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1107.797100][T23922] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1107.827092][ T30] audit: type=1326 audit(1768293775.703:2782): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23928 comm="syz.1.5208" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1107.877917][ T30] audit: type=1326 audit(1768293775.703:2783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23928 comm="syz.1.5208" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1107.900737][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1107.976026][T23942] netlink: 'syz.5.5211': attribute type 3 has an invalid length. [ 1108.012333][ T795] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1108.019978][T12980] bond1: (slave lo): failed to get link speed/duplex [ 1108.030201][ T30] audit: type=1326 audit(1768293775.703:2784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23928 comm="syz.1.5208" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1108.217277][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1108.222585][ T30] audit: type=1326 audit(1768293775.703:2785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23928 comm="syz.1.5208" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1108.251727][ T30] audit: type=1326 audit(1768293775.703:2786): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23928 comm="syz.1.5208" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1108.280351][ T30] audit: type=1326 audit(1768293775.703:2787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23928 comm="syz.1.5208" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1108.406364][ T30] audit: type=1326 audit(1768293775.703:2788): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23928 comm="syz.1.5208" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1108.432410][T23951] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1108.479228][ T1001] bond1: (slave lo): failed to get link speed/duplex [ 1108.580815][ T30] audit: type=1326 audit(1768293775.703:2789): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23928 comm="syz.1.5208" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1108.609156][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1108.749602][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1109.579032][ T795] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 1109.658219][T23973] loop7: detected capacity change from 0 to 7 [ 1109.678683][ T5917] usb 1-1: USB disconnect, device number 78 [ 1109.713120][T23974] binder: 23971:23974 ioctl c0306201 2000000001c0 returned -14 [ 1109.776486][ T795] usb 5-1: Using ep0 maxpacket: 32 [ 1109.813656][ T795] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1109.823074][ T795] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1109.859802][ T795] usb 5-1: config 0 descriptor?? [ 1109.919020][T17794] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 1110.069093][T23973] Dev loop7: unable to read RDB block 7 [ 1110.077922][T23973] loop7: unable to read partition table [ 1110.091281][T23973] loop7: partition table beyond EOD, truncated [ 1110.099454][T23973] loop_reread_partitions: partition scan of loop7 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ«`ÉæÖ€ù…ˆ{í©Ö˜Èµ4FLQkÝŠ) failed (rc=-5) [ 1110.138879][T17794] usb 3-1: Using ep0 maxpacket: 8 [ 1110.145675][T17794] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1110.157475][T17794] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1110.168837][T17794] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1110.179294][T17794] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1110.192844][T17794] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1110.202914][T17794] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1110.220075][ T795] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1110.238529][ T795] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1110.262474][ T795] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1110.291408][ T795] usb 5-1: media controller created [ 1110.323687][ T795] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1110.329965][ T5917] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 1110.428113][ T795] DVB: Unable to find symbol dib7000p_attach() [ 1110.444558][ T795] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1110.451897][T17794] usb 3-1: GET_CAPABILITIES returned 0 [ 1110.476725][T17794] usbtmc 3-1:16.0: can't read capabilities [ 1110.495351][ T5917] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1110.549562][ T5917] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1110.583376][ T5917] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1110.607345][ T5917] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1110.621256][ T5917] usb 1-1: SerialNumber: syz [ 1110.654511][ T795] rc_core: IR keymap rc-dib0700-rc5 not found [ 1110.655652][T23972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1110.661335][ T795] Registered IR keymap rc-empty [ 1110.679509][T23972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1110.702577][ T795] dvb-usb: could not initialize remote control. [ 1110.711552][ T795] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 1110.808801][ C1] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1110.892089][T23977] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5219'. [ 1110.901868][T23972] usbtmc 3-1:16.0: Unable to send data, error -71 [ 1110.905943][T23977] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1110.917783][T23977] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1110.931196][T23977] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5219'. [ 1110.945677][T23977] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5219'. [ 1110.961701][T23977] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1110.973396][T23977] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1110.990986][T15286] usb 3-1: USB disconnect, device number 115 [ 1111.921115][ T1001] net_ratelimit: 21 callbacks suppressed [ 1111.921137][ T1001] bond1: (slave lo): failed to get link speed/duplex [ 1111.999642][ T5917] usb 1-1: 0:2 : does not exist [ 1112.051564][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1112.091765][ T5917] usb 1-1: USB disconnect, device number 79 [ 1112.181215][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1112.196705][T11570] udevd[11570]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1112.299080][ T1001] bond1: (slave lo): failed to get link speed/duplex [ 1112.346975][ T795] usb 5-1: USB disconnect, device number 10 [ 1112.447108][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1112.500257][ T795] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1112.509143][ T5917] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 1112.609114][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1112.742437][ T5917] usb 1-1: Using ep0 maxpacket: 8 [ 1112.750087][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1112.780178][ T5917] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1112.839111][ T5917] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1112.905821][ T5917] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1112.919333][ T1001] bond1: (slave lo): failed to get link speed/duplex [ 1112.951857][ T5917] pvrusb2: ********** [ 1112.970909][ T5917] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1113.007658][ T5917] pvrusb2: Important functionality might not be entirely working. [ 1113.018972][ T5917] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1113.059947][ T1001] bond1: (slave lo): failed to get link speed/duplex [ 1113.075846][ T5917] pvrusb2: ********** [ 1113.105105][ T2345] pvrusb2: Invalid write control endpoint [ 1113.179420][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1113.218206][ T2345] pvrusb2: Invalid write control endpoint [ 1113.250460][ T2345] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1113.265806][ T2345] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1113.282102][ T2345] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1113.295906][ T2345] pvrusb2: Device being rendered inoperable [ 1113.312932][ T2345] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1113.334076][T17793] usb 1-1: USB disconnect, device number 80 [ 1113.362625][ T2345] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_d) [ 1113.390320][ T2345] pvrusb2: Attached sub-driver cx25840 [ 1113.403433][ T2345] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1113.416862][ T2345] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1113.589844][T24033] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5239'. [ 1113.620491][T24035] netlink: 32 bytes leftover after parsing attributes in process `syz.5.5240'. [ 1113.887928][T24046] syzkaller1: entered promiscuous mode [ 1113.894285][T24042] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5243'. [ 1113.894774][T24046] syzkaller1: entered allmulticast mode [ 1114.017453][T24051] netlink: 'syz.1.5247': attribute type 12 has an invalid length. [ 1114.056724][T24051] netlink: 'syz.1.5247': attribute type 29 has an invalid length. [ 1114.086930][T24051] netlink: 148 bytes leftover after parsing attributes in process `syz.1.5247'. [ 1114.137852][T24051] netlink: 59 bytes leftover after parsing attributes in process `syz.1.5247'. [ 1114.205015][T24059] netlink: 108 bytes leftover after parsing attributes in process `syz.4.5249'. [ 1114.373978][T24066] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5255'. [ 1114.427671][T24070] bond0: (slave bridge0): Releasing backup interface [ 1114.466421][T24075] netlink: 'syz.5.5257': attribute type 10 has an invalid length. [ 1114.475355][T24070] bond1: (slave bond0): Releasing backup interface [ 1114.487924][T24070] bridge_slave_0: left allmulticast mode [ 1114.493748][T24070] bridge_slave_0: left promiscuous mode [ 1114.500305][T24070] bridge0: port 1(bridge_slave_0) entered disabled state [ 1114.510724][T24070] bridge_slave_1: left allmulticast mode [ 1114.517234][T24070] bridge_slave_1: left promiscuous mode [ 1114.523857][T24070] bridge0: port 2(bridge_slave_1) entered disabled state [ 1114.533969][T24070] bond0: (slave bond_slave_0): Releasing backup interface [ 1114.543333][T24070] bond0: (slave bond_slave_1): Releasing backup interface [ 1114.553201][T24070] team0: Port device team_slave_0 removed [ 1114.562852][T24070] team0: Port device team_slave_1 removed [ 1114.570961][T24070] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1114.580171][T24070] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1114.615509][T24075] bond0: (slave wlan1): Opening slave failed [ 1115.344335][T24113] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1115.402083][T24113] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1115.934138][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.940626][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.099308][ T795] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 1116.254827][ T5836] Bluetooth: hci3: unexpected event for opcode 0x0c1a [ 1116.269200][ T795] usb 5-1: Using ep0 maxpacket: 8 [ 1116.296919][ T795] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 1116.322060][ T795] usb 5-1: config 0 has no interface number 0 [ 1116.347430][ T795] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1116.374645][ T795] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1116.391431][ T795] usb 5-1: Product: syz [ 1116.402531][ T795] usb 5-1: Manufacturer: syz [ 1116.423568][ T795] usb 5-1: SerialNumber: syz [ 1116.444276][ T795] usb 5-1: config 0 descriptor?? [ 1116.677938][ T795] uvcvideo 5-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 1116.706558][ T795] uvcvideo 5-1:0.31: No valid video chain found. [ 1116.769242][ T795] usb 5-1: USB disconnect, device number 11 [ 1116.858762][ T5836] Bluetooth: hci2: unexpected event for opcode 0x2010 [ 1117.122565][T12987] net_ratelimit: 31 callbacks suppressed [ 1117.122593][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1117.280726][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1117.429046][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1117.559281][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1117.690126][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1117.801408][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1117.909594][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1118.056053][T24207] syzkaller0: entered promiscuous mode [ 1118.069990][T24207] syzkaller0: entered allmulticast mode [ 1118.249201][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1118.379250][ T1001] bond1: (slave lo): failed to get link speed/duplex [ 1118.419351][T17792] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 1118.489286][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1118.600141][T17792] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1119.149167][T17792] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1119.162035][T17792] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1119.175250][T17792] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1119.184377][T17792] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1119.200608][T17792] usb 3-1: config 0 descriptor?? [ 1119.651413][T17792] plantronics 0003:047F:FFFF.0022: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 1119.774104][T24261] usb usb8: usbfs: process 24261 (syz.5.5338) did not claim interface 0 before use [ 1119.891882][T17792] usb 3-1: USB disconnect, device number 116 [ 1120.076551][ T30] kauditd_printk_skb: 101 callbacks suppressed [ 1120.076570][ T30] audit: type=1326 audit(1768293788.373:2891): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24263 comm="syz.5.5339" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1120.149141][ T30] audit: type=1326 audit(1768293788.423:2892): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24263 comm="syz.5.5339" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1120.202194][ T30] audit: type=1326 audit(1768293788.433:2893): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24263 comm="syz.5.5339" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1120.269011][ T30] audit: type=1326 audit(1768293788.433:2895): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24263 comm="syz.5.5339" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1120.307152][ T30] audit: type=1326 audit(1768293788.433:2894): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24263 comm="syz.5.5339" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1120.357372][ T30] audit: type=1326 audit(1768293788.433:2896): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24263 comm="syz.5.5339" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1120.438998][ T30] audit: type=1326 audit(1768293788.433:2897): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24263 comm="syz.5.5339" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1120.659729][ T30] audit: type=1326 audit(1768293788.433:2898): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24263 comm="syz.5.5339" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1120.728970][ T30] audit: type=1326 audit(1768293788.433:2899): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24263 comm="syz.5.5339" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1120.818458][ T30] audit: type=1326 audit(1768293788.483:2900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24263 comm="syz.5.5339" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1121.339315][T17792] usb 3-1: new full-speed USB device number 117 using dummy_hcd [ 1121.354785][T24288] __nla_validate_parse: 2 callbacks suppressed [ 1121.354804][T24288] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5348'. [ 1121.500887][T17792] usb 3-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 1121.516771][T17792] usb 3-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 12592, setting to 64 [ 1121.550832][T17792] usb 3-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 1121.570382][T15286] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 1121.587175][T17792] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1121.602826][T24279] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1121.726508][T24298] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5354'. [ 1121.775362][T15286] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1121.787582][T15286] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1121.798030][T15286] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1121.811530][T15286] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1121.823995][T24279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1121.842572][T24279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1121.851454][T15286] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1121.871268][T17792] usb 3-1: string descriptor 0 read error: -71 [ 1121.907765][T15286] usb 1-1: config 0 descriptor?? [ 1121.975446][T17792] usb 3-1: USB disconnect, device number 117 [ 1122.159288][ T36] net_ratelimit: 28 callbacks suppressed [ 1122.159310][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1122.290178][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1122.360547][T15286] plantronics 0003:047F:FFFF.0023: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 1122.400340][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1122.444846][ T5917] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 1122.511357][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1122.609100][ T5917] usb 5-1: Using ep0 maxpacket: 16 [ 1122.616075][T17792] usb 1-1: USB disconnect, device number 81 [ 1122.616338][ T5917] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1122.634310][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1122.649629][ T5917] usb 5-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1122.660276][ T5917] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1122.672554][ T5917] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1122.684095][ T5917] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1122.692459][ T5917] usb 5-1: Product: syz [ 1122.696870][ T5917] usb 5-1: Manufacturer: syz [ 1122.702948][ T5917] usb 5-1: SerialNumber: syz [ 1122.759068][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1123.132014][ T5917] usb 5-1: 0:2 : does not exist [ 1123.159050][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1123.173900][ T5917] usb 5-1: USB disconnect, device number 12 [ 1123.204638][T11570] udevd[11570]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1123.289017][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1123.399696][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1123.510793][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1124.216186][T24354] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5368'. [ 1124.266450][ T5836] Bluetooth: hci1: connection err: -111 [ 1125.389082][ T5917] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 1125.557056][ T5917] usb 6-1: config 1 interface 0 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1023 [ 1125.589613][ T5917] usb 6-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1125.620941][ T5917] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1125.631602][ T5917] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1125.641647][ T5917] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1125.650623][ T5917] usb 6-1: SerialNumber: syz [ 1125.677255][T24378] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1125.922646][ T5917] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -71 [ 1125.961024][ T5917] usb 6-1: USB disconnect, device number 80 [ 1126.859724][T24426] syzkaller1: entered promiscuous mode [ 1126.865341][T24426] syzkaller1: entered allmulticast mode [ 1126.900662][T24428] syz_tun: entered allmulticast mode [ 1126.911001][T24427] syz_tun: left allmulticast mode [ 1127.011956][T17792] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 1127.169027][T17792] usb 6-1: Using ep0 maxpacket: 8 [ 1127.182877][T17792] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1127.210801][T17792] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1127.220980][T17792] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1127.231300][T17792] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1127.245821][ T5987] net_ratelimit: 31 callbacks suppressed [ 1127.245840][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1127.268862][T17792] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1127.278318][T17792] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1127.409823][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1127.450843][ T5917] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 1127.502222][T17792] usb 6-1: usb_control_msg returned -32 [ 1127.522665][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1127.535119][T17792] usbtmc 6-1:16.0: can't read capabilities [ 1127.566775][T17792] usb 6-1: USB disconnect, device number 81 [ 1127.609175][ T5917] usb 2-1: Using ep0 maxpacket: 16 [ 1127.616309][ T5917] usb 2-1: config 0 has no interfaces? [ 1127.640558][ T5917] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 1127.659001][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1127.659043][T15286] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 1127.665769][ T5917] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1127.687766][ T5917] usb 2-1: Product: syz [ 1127.692310][ T5917] usb 2-1: Manufacturer: syz [ 1127.696931][ T5917] usb 2-1: SerialNumber: syz [ 1127.709691][ T5917] usb 2-1: config 0 descriptor?? [ 1127.769067][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1127.798374][T24452] tipc: Enabled bearer , priority 0 [ 1127.858003][T24454] syz_tun: entered allmulticast mode [ 1127.867019][T15286] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1127.888988][T15286] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 64, changing to 10 [ 1127.895256][T24453] syz_tun: left allmulticast mode [ 1127.905447][T15286] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1127.919471][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1127.924456][T15286] usb 5-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1127.939362][T15286] usb 5-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1127.968037][T15286] usb 5-1: Manufacturer: syz [ 1127.982738][T15286] usb 5-1: config 0 descriptor?? [ 1128.011710][ T5836] Bluetooth: hci3: unexpected event for opcode 0x1004 [ 1128.019857][T24458] program syz.1.5413 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1128.039378][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1128.149019][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1128.200590][T15286] usbhid 5-1:0.0: can't add hid device: -71 [ 1128.206637][T15286] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1128.248541][T15286] usb 5-1: USB disconnect, device number 13 [ 1128.268119][ T5917] usb 2-1: USB disconnect, device number 117 [ 1128.269078][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1128.413928][ T30] kauditd_printk_skb: 22 callbacks suppressed [ 1128.413941][ T30] audit: type=1326 audit(1768293796.713:2923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24469 comm="syz.5.5425" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1128.442632][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1128.517555][T24471] netlink: 'syz.0.5426': attribute type 23 has an invalid length. [ 1128.541750][T24471] input: syz0 as /devices/virtual/input/input86 [ 1128.571900][ T30] audit: type=1326 audit(1768293796.743:2924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24469 comm="syz.5.5425" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1128.670077][ T30] audit: type=1326 audit(1768293796.773:2925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24469 comm="syz.5.5425" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1128.703715][ T30] audit: type=1326 audit(1768293796.773:2926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24469 comm="syz.5.5425" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1128.705405][T24468] syzkaller1: entered promiscuous mode [ 1128.773158][ T30] audit: type=1326 audit(1768293796.773:2927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24469 comm="syz.5.5425" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1128.773633][T24468] syzkaller1: entered allmulticast mode [ 1128.873085][ T30] audit: type=1326 audit(1768293796.773:2928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24469 comm="syz.5.5425" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1128.936040][ T30] audit: type=1326 audit(1768293796.773:2929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24469 comm="syz.5.5425" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1128.958818][ T30] audit: type=1326 audit(1768293796.773:2930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24469 comm="syz.5.5425" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1128.982803][ T30] audit: type=1326 audit(1768293796.773:2931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24469 comm="syz.5.5425" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1129.070609][ T30] audit: type=1326 audit(1768293796.773:2932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24469 comm="syz.5.5425" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb586b8f749 code=0x7ffc0000 [ 1129.147197][ T795] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 1129.299007][ T795] usb 5-1: Using ep0 maxpacket: 16 [ 1129.303808][T24489] Invalid argument reading file caps for ./file0 [ 1129.308321][ T795] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1129.330442][ T795] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1129.343880][ T795] usb 5-1: Product: syz [ 1129.349305][ T795] usb 5-1: Manufacturer: syz [ 1129.353982][ T795] usb 5-1: SerialNumber: syz [ 1129.380225][ T795] usb 5-1: config 0 descriptor?? [ 1129.796132][ T795] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1129.809604][ T795] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1129.866060][ T795] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1129.891372][ T795] usb 5-1: media controller created [ 1129.900225][T24504] syz_tun: entered allmulticast mode [ 1129.911686][ T795] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1129.966284][T24503] syz_tun: left allmulticast mode [ 1130.299504][T15286] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 1130.499115][ T5917] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 1130.500782][ T795] zl10353_read_register: readreg error (reg=127, ret==0) [ 1130.517081][ T795] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1130.525229][ T795] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1130.534566][T24484] dtv5100: wlen = 0, aborting. [ 1130.650633][T15286] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1130.662513][T15286] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1130.676060][T15286] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1130.693335][T15286] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1130.719480][ T5917] usb 3-1: Using ep0 maxpacket: 8 [ 1130.747482][ T5917] usb 3-1: New USB device found, idVendor=2801, idProduct=0201, bcdDevice=2a.d5 [ 1130.749923][ T795] usb 5-1: USB disconnect, device number 14 [ 1130.766953][ T5917] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1130.785627][T24502] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 1130.796524][ T5917] usb 3-1: config 0 descriptor?? [ 1130.797462][T15286] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1130.821515][ T5917] uvcvideo 3-1:0.0: Found UVC 0.00 device (2801:0201) [ 1130.843175][ T5917] uvcvideo 3-1:0.0: No valid video chain found. [ 1130.882711][ T795] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1131.119071][T24501] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1131.129776][T24501] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1131.392295][ T795] usb 3-1: USB disconnect, device number 118 [ 1132.107513][ T5836] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 1132.117768][ T5836] Bluetooth: hci3: Injecting HCI hardware error event [ 1132.127378][ T5834] Bluetooth: hci3: hardware error 0x00 [ 1132.269272][ T36] net_ratelimit: 29 callbacks suppressed [ 1132.269350][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1132.409332][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1132.561406][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1132.680807][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1132.809430][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1132.929051][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1133.288671][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1133.409852][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1133.438750][T24536] netlink: 'syz.2.5442': attribute type 1 has an invalid length. [ 1133.690380][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1133.805087][ T795] usb 1-1: USB disconnect, device number 82 [ 1133.821131][ T5917] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 1133.829156][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1133.975049][T24539] binder: BINDER_SET_CONTEXT_MGR already set [ 1133.981200][T24539] binder: 24538:24539 ioctl 4018620d 200000004a80 returned -16 [ 1134.059005][ T5917] usb 6-1: Using ep0 maxpacket: 16 [ 1134.102511][ T5917] usb 6-1: config 0 has no interfaces? [ 1134.120225][ T5917] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1134.146798][ T5917] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1134.162716][ T5917] usb 6-1: Manufacturer: syz [ 1134.188425][ T5917] usb 6-1: config 0 descriptor?? [ 1134.239039][ T5834] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 1134.272991][ T30] kauditd_printk_skb: 37 callbacks suppressed [ 1134.273003][ T30] audit: type=1326 audit(1768293802.573:2970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24541 comm="syz.0.5446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1134.529242][ T30] audit: type=1326 audit(1768293802.573:2971): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24541 comm="syz.0.5446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1134.552286][ T30] audit: type=1326 audit(1768293802.573:2972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24541 comm="syz.0.5446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1134.577879][ T30] audit: type=1326 audit(1768293802.573:2973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24541 comm="syz.0.5446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1134.609276][ T30] audit: type=1326 audit(1768293802.573:2974): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24541 comm="syz.0.5446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1134.900360][ T30] audit: type=1326 audit(1768293802.573:2975): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24541 comm="syz.0.5446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1135.040788][ T30] audit: type=1326 audit(1768293802.573:2976): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24541 comm="syz.0.5446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1135.095553][ T30] audit: type=1326 audit(1768293802.573:2977): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24541 comm="syz.0.5446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1135.323799][ T30] audit: type=1326 audit(1768293802.583:2978): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24541 comm="syz.0.5446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1135.428404][ T30] audit: type=1326 audit(1768293802.583:2979): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24541 comm="syz.0.5446" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1135.442475][T24499] syz.1.5434 (24499): drop_caches: 1 [ 1135.623928][T24498] syz.1.5434 (24498): drop_caches: 1 [ 1135.799265][T15286] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 1135.969292][T15286] usb 5-1: Using ep0 maxpacket: 16 [ 1135.995259][T15286] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1136.023804][T15286] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1136.047877][T15286] usb 5-1: Product: syz [ 1136.062113][T15286] usb 5-1: Manufacturer: syz [ 1136.078143][T15286] usb 5-1: SerialNumber: syz [ 1136.090805][ T5917] usb 6-1: USB disconnect, device number 82 [ 1136.131452][T15286] usb 5-1: config 0 descriptor?? [ 1136.873049][T15286] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1136.892607][T15286] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1136.989665][T15286] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1137.043714][T15286] usb 5-1: media controller created [ 1137.063035][T15286] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1137.114107][T24555] dtv5100: wlen = 0, aborting. [ 1137.243427][T24585] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1137.297849][T17792] hid-generic 0000:0000:0000.0024: unknown main item tag 0x0 [ 1137.311480][T12986] net_ratelimit: 27 callbacks suppressed [ 1137.311501][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1137.324589][T17792] hid-generic 0000:0000:0000.0024: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1137.341312][T15286] zl10353_read_register: readreg error (reg=127, ret==0) [ 1137.372537][T15286] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1137.411089][T15286] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1137.459121][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1137.465999][T15286] usb 5-1: USB disconnect, device number 15 [ 1137.560516][T15286] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1137.629159][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1137.749111][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1137.869172][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1137.999068][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1138.129300][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1138.272914][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1138.546867][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1138.676028][T12980] bond1: (slave lo): failed to get link speed/duplex [ 1140.060698][T24635] syz_tun: entered allmulticast mode [ 1140.067969][T24634] syz_tun: left allmulticast mode [ 1140.469296][ T5917] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 1140.509051][T17793] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 1140.550693][T24641] mac80211_hwsim hwsim25 syzkaller0: entered promiscuous mode [ 1140.558226][T24641] mac80211_hwsim hwsim25 syzkaller0: entered allmulticast mode [ 1140.649023][ T5917] usb 3-1: Using ep0 maxpacket: 16 [ 1140.657680][ T5917] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1140.667323][T17793] usb 1-1: Using ep0 maxpacket: 8 [ 1140.673303][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1140.682835][T24645] binder: 24644:24645 ioctl 4b4e 30 returned -22 [ 1140.684403][ T5917] usb 3-1: Product: syz [ 1140.695855][T17793] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1140.705337][T17793] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1140.713540][ T5917] usb 3-1: Manufacturer: syz [ 1140.718392][ T5917] usb 3-1: SerialNumber: syz [ 1140.731080][ T5917] usb 3-1: config 0 descriptor?? [ 1140.748747][T17793] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1140.759796][T17793] pvrusb2: ********** [ 1140.763842][T17793] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1140.774931][T17793] pvrusb2: Important functionality might not be entirely working. [ 1140.783672][T17793] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1140.797049][T17793] pvrusb2: ********** [ 1140.829076][T17794] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 1140.930130][ T30] kauditd_printk_skb: 76 callbacks suppressed [ 1140.930148][ T30] audit: type=1326 audit(1768293809.233:3056): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24649 comm="syz.1.5481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1140.962803][ T2345] pvrusb2: Invalid write control endpoint [ 1140.972272][ T30] audit: type=1326 audit(1768293809.273:3057): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24649 comm="syz.1.5481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1140.995573][T17794] usb 5-1: Using ep0 maxpacket: 16 [ 1141.003019][ T30] audit: type=1326 audit(1768293809.313:3058): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24649 comm="syz.1.5481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1141.003066][T17794] usb 5-1: config 0 has an invalid interface number: 176 but max is 0 [ 1141.076036][T17794] usb 5-1: config 0 has no interface number 0 [ 1141.099028][ T30] audit: type=1326 audit(1768293809.333:3059): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24649 comm="syz.1.5481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1141.131716][T17794] usb 5-1: New USB device found, idVendor=1004, idProduct=61aa, bcdDevice=18.b3 [ 1141.144966][T17794] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1141.145033][ T30] audit: type=1326 audit(1768293809.343:3060): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24649 comm="syz.1.5481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1141.166823][T17793] usb 1-1: USB disconnect, device number 83 [ 1141.198502][ T5917] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1141.211872][T17794] usb 5-1: Product: syz [ 1141.213258][ T30] audit: type=1326 audit(1768293809.343:3061): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24649 comm="syz.1.5481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1141.220409][T17794] usb 5-1: Manufacturer: syz [ 1141.278987][ T30] audit: type=1326 audit(1768293809.343:3062): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24649 comm="syz.1.5481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1141.279955][ T2345] pvrusb2: Invalid write control endpoint [ 1141.315016][ T5917] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1141.331990][ T30] audit: type=1326 audit(1768293809.343:3063): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24649 comm="syz.1.5481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1141.355092][ T5917] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1141.358277][ T30] audit: type=1326 audit(1768293809.343:3064): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24649 comm="syz.1.5481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1141.363684][ T2345] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1141.386608][ T30] audit: type=1326 audit(1768293809.343:3065): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24649 comm="syz.1.5481" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1141.395303][T17794] usb 5-1: SerialNumber: syz [ 1141.422619][ T5917] usb 3-1: media controller created [ 1141.435838][ T5917] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1141.472544][T17794] usb 5-1: config 0 descriptor?? [ 1141.480617][ T2345] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1141.491584][T17794] usb 5-1: bad CDC descriptors [ 1141.496370][ T2345] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1141.525069][ T5917] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1141.534809][ T2345] pvrusb2: Device being rendered inoperable [ 1141.542335][ T5917] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1141.553616][ T2345] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1141.562530][ T2345] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_e) [ 1141.599075][ T2345] pvrusb2: Attached sub-driver cx25840 [ 1141.612230][ T2345] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1141.626153][ T2345] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1141.726200][T15286] usb 5-1: USB disconnect, device number 16 [ 1142.359038][ T2140] net_ratelimit: 27 callbacks suppressed [ 1142.359059][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1142.439168][T17793] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 1142.489067][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1142.549265][T17794] usb 6-1: new high-speed USB device number 83 using dummy_hcd [ 1142.601158][T17793] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1142.611935][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1142.627167][T17793] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1142.644086][T17793] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1142.663209][T17793] usb 1-1: config 0 descriptor?? [ 1142.681390][T17793] pwc: Askey VC010 type 2 USB webcam detected. [ 1142.699590][T17794] usb 6-1: Using ep0 maxpacket: 8 [ 1142.706406][T17794] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1142.724306][T17794] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1142.734385][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1142.742134][T17794] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1142.752673][T17794] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1142.766693][T17794] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1142.792897][T17794] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1142.849059][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1142.968810][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1143.053533][T17794] usb 6-1: GET_CAPABILITIES returned 0 [ 1143.080398][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1143.109780][T17794] usbtmc 6-1:16.0: can't read capabilities [ 1143.192772][T17794] usb 3-1: USB disconnect, device number 119 [ 1143.251645][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1143.256800][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1143.315224][T17792] usb 6-1: USB disconnect, device number 83 [ 1143.320222][T17794] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1143.388709][T24676] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5489'. [ 1144.056879][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1144.179895][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1144.768986][T17792] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 1145.015349][T17792] usb 5-1: Using ep0 maxpacket: 8 [ 1145.027483][T17792] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1145.044490][T17792] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1145.159780][T17792] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1145.179370][T17792] pvrusb2: ********** [ 1145.192825][T17792] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1145.225696][T17792] pvrusb2: Important functionality might not be entirely working. [ 1145.243280][T17792] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1145.285661][T17792] pvrusb2: ********** [ 1145.354725][ T2345] pvrusb2: Invalid write control endpoint [ 1145.444710][T24698] syzkaller0: entered promiscuous mode [ 1145.452121][T24698] syzkaller0: entered allmulticast mode [ 1145.558864][T17792] usb 5-1: USB disconnect, device number 17 [ 1145.574544][ T2345] pvrusb2: Invalid write control endpoint [ 1145.585450][ T2345] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1145.629362][ T2345] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1145.637303][T17793] pwc: recv_control_msg error -71 req 02 val 2b00 [ 1145.694359][T17793] pwc: recv_control_msg error -71 req 02 val 2700 [ 1145.709570][ T2345] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1145.721962][ T2345] pvrusb2: Device being rendered inoperable [ 1145.728056][T17793] pwc: recv_control_msg error -71 req 02 val 2c00 [ 1145.735709][ T2345] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1145.770558][T17793] pwc: recv_control_msg error -71 req 04 val 1000 [ 1145.777809][ T2345] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_f) [ 1145.796775][T17793] pwc: recv_control_msg error -71 req 04 val 1300 [ 1145.805379][T17793] pwc: recv_control_msg error -71 req 04 val 1400 [ 1145.873249][T17793] pwc: recv_control_msg error -71 req 02 val 2000 [ 1145.880075][ T2345] pvrusb2: Attached sub-driver cx25840 [ 1145.948665][ T2345] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1145.961663][T17793] pwc: recv_control_msg error -71 req 02 val 2100 [ 1145.975728][T17793] pwc: recv_control_msg error -71 req 04 val 1500 [ 1146.000938][T17793] pwc: recv_control_msg error -71 req 02 val 2500 [ 1146.040457][ T2345] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1146.057332][T17793] pwc: recv_control_msg error -71 req 02 val 2400 [ 1146.091621][T17793] pwc: recv_control_msg error -71 req 02 val 2600 [ 1146.156429][T17793] pwc: recv_control_msg error -71 req 02 val 2900 [ 1146.198620][T17793] pwc: recv_control_msg error -71 req 02 val 2800 [ 1146.250045][T17793] pwc: recv_control_msg error -71 req 04 val 1100 [ 1146.267486][T17793] pwc: recv_control_msg error -71 req 04 val 1200 [ 1146.312876][T17793] pwc: Registered as video103. [ 1146.353955][T17793] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input87 [ 1146.542529][T17793] usb 1-1: USB disconnect, device number 84 [ 1146.751579][T24716] netlink: 72 bytes leftover after parsing attributes in process `syz.1.5498'. [ 1146.862196][T24720] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5499'. [ 1147.027303][T17792] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 1147.219104][T17792] usb 2-1: Using ep0 maxpacket: 8 [ 1147.227316][T17792] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1147.237060][T17792] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1147.247128][T17792] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1147.250909][T24725] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5500'. [ 1147.269272][T15286] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 1147.278045][T17792] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1147.292884][T17792] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1147.306269][T17792] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1147.315381][T17792] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1147.450966][T15286] usb 6-1: Using ep0 maxpacket: 32 [ 1147.460711][T15286] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1147.489163][T15286] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1147.498561][T15286] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1147.510502][T15286] usb 6-1: Product: syz [ 1147.541926][T15286] usb 6-1: Manufacturer: syz [ 1147.548003][T17792] usb 2-1: GET_CAPABILITIES returned 0 [ 1147.553709][T17792] usbtmc 2-1:16.0: can't read capabilities [ 1147.594643][T15286] usb 6-1: SerialNumber: syz [ 1147.617888][T15286] usb 6-1: config 0 descriptor?? [ 1147.628656][T24722] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1147.668728][T15286] hub 6-1:0.0: bad descriptor, ignoring hub [ 1147.689095][T15286] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1147.812280][T15286] usb 2-1: USB disconnect, device number 118 [ 1147.821308][T24716] usbtmc 2-1:16.0: usb_control_msg returned -71 [ 1148.810304][T15286] usb 6-1: USB disconnect, device number 84 [ 1149.544284][T24714] syz_tun: entered allmulticast mode [ 1149.550164][T24710] syz_tun: left allmulticast mode [ 1149.568363][T24725] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1149.576744][T24725] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1149.721579][ T1001] net_ratelimit: 6 callbacks suppressed [ 1149.721601][ T1001] bond1: (slave lo): failed to get link speed/duplex [ 1149.765960][T24731] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 1149.926125][T24737] syz_tun: entered allmulticast mode [ 1149.949718][ T1001] bond1: (slave lo): failed to get link speed/duplex [ 1149.956893][T24732] syz_tun: left allmulticast mode [ 1150.069051][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1150.199660][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1150.319057][T17793] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 1150.329594][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1150.479066][T17793] usb 5-1: Using ep0 maxpacket: 8 [ 1150.507627][T12980] bond1: (slave lo): failed to get link speed/duplex [ 1150.544287][T17793] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1150.665986][T17793] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1150.733918][T17793] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1150.794324][T17793] pvrusb2: ********** [ 1150.881789][T17793] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1150.910961][T17793] pvrusb2: Important functionality might not be entirely working. [ 1150.926488][T17793] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1150.955350][ T30] kauditd_printk_skb: 79 callbacks suppressed [ 1150.955366][ T30] audit: type=1326 audit(1768293819.103:3145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24757 comm="syz.0.5509" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1150.969582][T17793] pvrusb2: ********** [ 1151.006044][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1151.023378][ T2345] pvrusb2: Invalid write control endpoint [ 1151.081300][ T30] audit: type=1326 audit(1768293819.293:3146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24757 comm="syz.0.5509" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1151.130106][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1151.255679][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1151.259801][T17793] usb 5-1: USB disconnect, device number 18 [ 1151.305331][ T30] audit: type=1326 audit(1768293819.293:3147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24757 comm="syz.0.5509" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1151.419082][ T30] audit: type=1326 audit(1768293819.293:3148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24757 comm="syz.0.5509" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1151.448276][ T30] audit: type=1326 audit(1768293819.293:3149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24757 comm="syz.0.5509" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1151.529014][T12980] bond1: (slave lo): failed to get link speed/duplex [ 1151.529936][ T2345] pvrusb2: Invalid write control endpoint [ 1151.541453][ T30] audit: type=1326 audit(1768293819.293:3150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24757 comm="syz.0.5509" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1151.639586][ T2345] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1151.669042][ T2345] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1151.678463][ T30] audit: type=1326 audit(1768293819.293:3151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24757 comm="syz.0.5509" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1151.709026][ T2345] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1151.738883][ T2345] pvrusb2: Device being rendered inoperable [ 1151.759143][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1151.763600][ T2345] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1151.931433][ T30] audit: type=1326 audit(1768293819.293:3152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24757 comm="syz.0.5509" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1152.020359][T24771] FAULT_INJECTION: forcing a failure. [ 1152.020359][T24771] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1152.034375][ T30] audit: type=1326 audit(1768293819.293:3153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24757 comm="syz.0.5509" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1152.070129][T24771] CPU: 1 UID: 0 PID: 24771 Comm: syz.4.5513 Tainted: G L syzkaller #0 PREEMPT(full) [ 1152.070153][T24771] Tainted: [L]=SOFTLOCKUP [ 1152.070157][T24771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1152.070165][T24771] Call Trace: [ 1152.070170][T24771] [ 1152.070176][T24771] dump_stack_lvl+0xe8/0x150 [ 1152.070195][T24771] should_fail_ex+0x414/0x560 [ 1152.070215][T24771] _copy_from_user+0x2d/0xb0 [ 1152.070229][T24771] memdup_sockptr_noprof+0x95/0x100 [ 1152.070247][T24771] ipv6_set_opt_hdr+0x1e7/0x6b0 [ 1152.070263][T24771] do_ipv6_setsockopt+0x135a/0x2eb0 [ 1152.070276][T24771] ? get_pid_task+0x20/0x1f0 [ 1152.070293][T24771] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 1152.070307][T24771] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 1152.070320][T24771] ? get_pid_task+0x20/0x1f0 [ 1152.070334][T24771] ? get_pid_task+0x20/0x1f0 [ 1152.070394][T24771] ? __lock_acquire+0x6b6/0x2cf0 [ 1152.070412][T24771] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1152.070424][T24771] ? aa_sk_perm+0x15f/0x920 [ 1152.070436][T24771] ? aa_sk_perm+0x7ee/0x920 [ 1152.070450][T24771] ? __pfx_aa_sk_perm+0x10/0x10 [ 1152.070463][T24771] ? __fget_files+0x2a/0x420 [ 1152.070476][T24771] ? aa_sock_opt_perm+0xff/0x1a0 [ 1152.070491][T24771] ipv6_setsockopt+0x59/0x170 [ 1152.070504][T24771] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1152.070516][T24771] do_sock_setsockopt+0x17c/0x1b0 [ 1152.070531][T24771] __x64_sys_setsockopt+0x13f/0x1b0 [ 1152.070546][T24771] do_syscall_64+0xec/0xf80 [ 1152.070558][T24771] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1152.070568][T24771] ? trace_irq_disable+0x37/0x100 [ 1152.070581][T24771] ? clear_bhb_loop+0x60/0xb0 [ 1152.070598][T24771] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1152.070608][T24771] RIP: 0033:0x7f20b4f8f749 [ 1152.070618][T24771] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1152.070628][T24771] RSP: 002b:00007f20b5d40038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1152.070640][T24771] RAX: ffffffffffffffda RBX: 00007f20b51e5fa0 RCX: 00007f20b4f8f749 [ 1152.070648][T24771] RDX: 0000000000000039 RSI: 0000000000000029 RDI: 0000000000000003 [ 1152.070655][T24771] RBP: 00007f20b5d40090 R08: 0000000000000018 R09: 0000000000000000 [ 1152.070662][T24771] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 1152.070669][T24771] R13: 00007f20b51e6038 R14: 00007f20b51e5fa0 R15: 00007f20b530fa28 [ 1152.070685][T24771] [ 1152.330159][ T30] audit: type=1326 audit(1768293819.293:3154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24757 comm="syz.0.5509" exe="/root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7f5b51f8f749 code=0x7ffc0000 [ 1152.499862][ T2345] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_f) [ 1152.542827][ T2345] pvrusb2: Attached sub-driver cx25840 [ 1152.548320][ T2345] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1152.611630][T24774] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5514'. [ 1152.651565][ T2345] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1153.113811][T24778] bridge0: entered promiscuous mode [ 1153.120285][T24778] bridge0: entered allmulticast mode [ 1153.558098][T17793] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 1153.760089][T17793] usb 5-1: Using ep0 maxpacket: 16 [ 1153.778052][T15286] IPVS: starting estimator thread 0... [ 1153.894065][T24816] IPVS: using max 53 ests per chain, 127200 per kthread [ 1153.899150][T17793] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 1153.923964][T17793] usb 5-1: config 0 has no interface number 0 [ 1153.932047][T17793] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1153.945173][T17793] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1154.149105][T17793] usb 5-1: config 0 interface 41 has no altsetting 0 [ 1154.149129][T15286] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 1154.178070][T17793] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 1154.214505][T17793] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1154.243798][T17793] usb 5-1: Product: syz [ 1154.264742][T17793] usb 5-1: Manufacturer: syz [ 1154.309026][T15286] usb 2-1: Using ep0 maxpacket: 16 [ 1154.361154][T17793] usb 5-1: SerialNumber: syz [ 1154.391230][T15286] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1154.402933][T15286] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1154.419077][T17793] usb 5-1: config 0 descriptor?? [ 1154.432606][T24790] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1154.445388][T24790] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1154.464903][T15286] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1154.546514][T24825] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5527'. [ 1154.575890][T15286] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1154.607630][T15286] usb 2-1: Product: syz [ 1154.619859][T15286] usb 2-1: Manufacturer: syz [ 1154.624495][T15286] usb 2-1: SerialNumber: syz [ 1154.659612][T24790] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1154.666938][T24790] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1154.676542][T15286] usb 2-1: config 0 descriptor?? [ 1154.702389][T15286] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1154.780666][T15286] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 1154.819126][ T8466] net_ratelimit: 13 callbacks suppressed [ 1154.819149][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1154.949988][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1155.069088][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1155.116996][T17793] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -22 [ 1155.179020][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1155.307209][T15286] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 1155.309109][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1155.325685][T15286] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 1155.449057][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1155.569061][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1155.689057][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1155.800648][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1155.919567][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1155.991086][T15286] em28xx 2-1:0.0: Unknown AC97 audio processor detected! [ 1155.999026][T15286] em28xx 2-1:0.0: couldn't setup AC97 register 2 [ 1156.006318][T15286] em28xx 2-1:0.0: couldn't setup AC97 register 4 [ 1156.029653][T15286] em28xx 2-1:0.0: couldn't setup AC97 register 6 [ 1156.047280][T15286] em28xx 2-1:0.0: couldn't setup AC97 register 54 [ 1156.080198][T17793] usb 5-1: USB disconnect, device number 19 [ 1156.268781][T15286] em28xx 2-1:0.0: couldn't setup AC97 register 56 [ 1156.280585][T15286] usb 2-1: USB disconnect, device number 119 [ 1156.599146][T17793] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 1156.788995][T17793] usb 5-1: Using ep0 maxpacket: 8 [ 1156.799622][T17793] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 1156.815448][T24857] syz_tun: entered allmulticast mode [ 1156.824910][T24855] syz_tun: left allmulticast mode [ 1156.839299][T17793] usb 5-1: config 179 has no interface number 0 [ 1156.845626][T17793] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1156.938999][T17793] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1156.959439][T17793] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1156.985782][T17793] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1157.040828][T17793] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1157.060089][T17793] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1157.069499][T17793] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1157.083296][T24846] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1157.152018][T24863] netlink: 'syz.1.5539': attribute type 3 has an invalid length. [ 1157.280220][T24861] netlink: 'syz.0.5538': attribute type 23 has an invalid length. [ 1157.305083][T17793] input: Generic X-Box pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input88 [ 1157.395198][T24861] input: syz0 as /devices/virtual/input/input90 [ 1157.508183][T17793] usb 5-1: USB disconnect, device number 20 [ 1157.514279][ C1] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1157.514311][ C1] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1158.070176][T24871] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1158.179741][T24879] syz_tun: entered allmulticast mode [ 1158.242034][T24878] syz_tun: left allmulticast mode [ 1158.676633][T24893] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5545'. [ 1158.710817][T24894] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3343437945 (53495007120 ns) > initial count (52285443328 ns). Using initial count to start timer. [ 1158.731187][T24893] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5545'. [ 1159.980082][ T2140] net_ratelimit: 32 callbacks suppressed [ 1159.980096][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1160.139672][T12980] bond1: (slave lo): failed to get link speed/duplex [ 1160.229056][T15440] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 1160.249071][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1160.261675][T24907] sit0: entered promiscuous mode [ 1160.298863][T24907] netlink: 'syz.4.5551': attribute type 1 has an invalid length. [ 1160.322914][T24907] netlink: 1 bytes leftover after parsing attributes in process `syz.4.5551'. [ 1160.350380][T24915] syz_tun: entered allmulticast mode [ 1160.356128][T24916] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5551'. [ 1160.365567][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1160.376684][T24914] syz_tun: left allmulticast mode [ 1160.389081][T15440] usb 3-1: Using ep0 maxpacket: 16 [ 1160.398473][T15440] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1160.459742][ T30] kauditd_printk_skb: 75 callbacks suppressed [ 1160.459753][ T30] audit: type=1326 audit(1768293828.763:3230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24909 comm="syz.1.5552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1160.489345][T12980] bond1: (slave lo): failed to get link speed/duplex [ 1160.604659][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1160.616124][T15440] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1160.635739][T15440] usb 3-1: Product: syz [ 1160.641367][T15440] usb 3-1: Manufacturer: syz [ 1160.646242][T15440] usb 3-1: SerialNumber: syz [ 1160.656606][ T30] audit: type=1326 audit(1768293828.793:3231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24909 comm="syz.1.5552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1160.660483][T15440] usb 3-1: config 0 descriptor?? [ 1160.720540][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1160.728391][ T30] audit: type=1326 audit(1768293828.793:3232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24909 comm="syz.1.5552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1160.792765][T24922] netlink: 'syz.0.5554': attribute type 1 has an invalid length. [ 1160.834688][T24922] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1160.854745][ T30] audit: type=1326 audit(1768293828.793:3233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24909 comm="syz.1.5552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1160.886431][T24922] bond3: (slave gretap1): making interface the new active one [ 1160.927748][T24924] netlink: 'syz.0.5554': attribute type 10 has an invalid length. [ 1160.941772][T24922] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 1160.953765][ T30] audit: type=1326 audit(1768293828.793:3234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24909 comm="syz.1.5552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1160.976919][T24924] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5554'. [ 1160.998676][T24924] dummy0: entered promiscuous mode [ 1161.005690][ T30] audit: type=1326 audit(1768293828.793:3235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24909 comm="syz.1.5552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1161.028988][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1161.061881][ T30] audit: type=1326 audit(1768293828.793:3236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24909 comm="syz.1.5552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1161.120928][ T30] audit: type=1326 audit(1768293828.793:3237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24909 comm="syz.1.5552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1161.143754][T15440] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1161.159603][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1161.178655][T24926] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5555'. [ 1161.178676][T15440] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1161.208524][ T30] audit: type=1326 audit(1768293828.793:3238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24909 comm="syz.1.5552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1161.249994][T15440] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1161.262841][T15440] usb 3-1: media controller created [ 1161.276827][ T30] audit: type=1326 audit(1768293828.793:3239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24909 comm="syz.1.5552" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f8d9a78f749 code=0x7ffc0000 [ 1161.324960][T15440] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1161.333394][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1161.357012][T24926] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1161.379603][T17793] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1161.396089][T24903] dtv5100: wlen = 0, aborting. [ 1161.661515][T15440] zl10353_read_register: readreg error (reg=127, ret==0) [ 1161.700094][T15440] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1161.808087][T15440] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1161.855628][T15440] usb 3-1: USB disconnect, device number 120 [ 1161.958792][T24941] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1161.967735][T15440] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1162.399221][T17793] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1163.283391][T24963] RDS: rds_bind could not find a transport for ::ffff:172.30.1.6, load rds_tcp or rds_rdma? [ 1164.550483][T15440] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 1164.629056][T15286] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 1164.787168][T25004] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5574'. [ 1164.805881][T15440] usb 2-1: Using ep0 maxpacket: 8 [ 1164.813823][T15440] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1164.824660][T15286] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1164.835077][T15440] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1164.848262][T15286] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1164.862403][T15286] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1164.876643][T15440] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1164.883993][T15440] pvrusb2: ********** [ 1164.887995][T15440] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1164.898511][T15440] pvrusb2: Important functionality might not be entirely working. [ 1164.906883][T15440] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1164.919974][T15440] pvrusb2: ********** [ 1164.925594][T15286] usb 1-1: config 0 descriptor?? [ 1164.934767][T15286] pwc: Askey VC010 type 2 USB webcam detected. [ 1165.090086][ T2345] pvrusb2: Invalid write control endpoint [ 1165.099053][ T2140] net_ratelimit: 23 callbacks suppressed [ 1165.099079][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1165.126550][ T795] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 1165.239085][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1165.301275][T24990] pvrusb2: Invalid write control endpoint [ 1165.313176][T15440] usb 2-1: USB disconnect, device number 120 [ 1165.323515][T25010] syz_tun: entered allmulticast mode [ 1165.331137][ T795] usb 5-1: device descriptor read/64, error -71 [ 1165.331414][T25009] syz_tun: left allmulticast mode [ 1165.338608][ T2345] pvrusb2: Invalid write control endpoint [ 1165.359466][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1165.367696][ T2345] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1165.379023][ T2345] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1165.386633][ T2345] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1165.398074][ T2345] pvrusb2: Device being rendered inoperable [ 1165.410967][ T2345] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1165.418173][ T2345] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_f) [ 1165.436878][ T2345] pvrusb2: Attached sub-driver cx25840 [ 1165.451289][ T2345] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1165.461588][ T2345] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1165.699422][ T795] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 1165.779219][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1165.849038][ T795] usb 5-1: device descriptor read/64, error -71 [ 1165.889031][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1165.959316][ T795] usb usb5-port1: attempt power cycle [ 1165.999155][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1166.038510][T25017] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5581'. [ 1166.120260][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1166.229034][ T36] bond1: (slave lo): failed to get link speed/duplex [ 1166.328999][ T795] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 1166.333181][T17793] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 1166.351768][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1166.391769][ T795] usb 5-1: device descriptor read/8, error -71 [ 1166.479528][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1166.549014][T17793] usb 3-1: Using ep0 maxpacket: 8 [ 1166.557139][T17793] usb 3-1: config 179 has an invalid interface number: 97 but max is 0 [ 1166.565642][T17793] usb 3-1: config 179 has no interface number 0 [ 1166.578303][T17793] usb 3-1: config 179 interface 97 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1166.605856][T17793] usb 3-1: config 179 interface 97 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1166.634231][T17793] usb 3-1: config 179 interface 97 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1166.659216][ T795] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 1166.671353][T17793] usb 3-1: config 179 interface 97 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1166.694692][ T795] usb 5-1: device descriptor read/8, error -71 [ 1166.706849][T17793] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.ce [ 1166.726532][T17793] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1166.754838][T25015] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1166.810653][ T795] usb usb5-port1: unable to enumerate USB device [ 1166.979509][ T795] usb 3-1: USB disconnect, device number 121 [ 1167.315460][T25028] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5584'. [ 1167.325162][T25028] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1167.333048][T25028] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1167.392836][T15286] pwc: recv_control_msg error -71 req 02 val 2b00 [ 1167.399772][T15286] pwc: recv_control_msg error -71 req 02 val 2700 [ 1167.421510][T15286] pwc: recv_control_msg error -71 req 02 val 2c00 [ 1167.428269][T15286] pwc: recv_control_msg error -71 req 04 val 1000 [ 1167.446081][T15286] pwc: recv_control_msg error -71 req 04 val 1300 [ 1167.455065][T15286] pwc: recv_control_msg error -71 req 04 val 1400 [ 1167.469026][T15286] pwc: recv_control_msg error -71 req 02 val 2000 [ 1167.493298][T15286] pwc: recv_control_msg error -71 req 02 val 2100 [ 1167.500346][T15286] pwc: recv_control_msg error -71 req 04 val 1500 [ 1167.515926][T15286] pwc: recv_control_msg error -71 req 02 val 2500 [ 1167.529756][T15286] pwc: recv_control_msg error -71 req 02 val 2400 [ 1167.541979][T15286] pwc: recv_control_msg error -71 req 02 val 2600 [ 1167.559820][T15286] pwc: recv_control_msg error -71 req 02 val 2900 [ 1167.566731][T15286] pwc: recv_control_msg error -71 req 02 val 2800 [ 1167.590126][T15286] pwc: recv_control_msg error -71 req 04 val 1100 [ 1167.599049][T17793] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 1167.630252][T15286] pwc: recv_control_msg error -71 req 04 val 1200 [ 1167.671442][T15286] pwc: Registered as video103. [ 1167.681020][T15286] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input91 [ 1167.754790][T15286] usb 1-1: USB disconnect, device number 85 [ 1167.789102][T17793] usb 6-1: Using ep0 maxpacket: 16 [ 1167.815949][T17793] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1167.833775][T17793] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1167.849467][T17793] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1167.859297][T25046] syz_tun: entered allmulticast mode [ 1167.874425][T25044] syz_tun: left allmulticast mode [ 1167.885302][T17793] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1167.907089][T17793] usb 6-1: Product: syz [ 1167.919340][T17793] usb 6-1: Manufacturer: syz [ 1167.956970][T17793] usb 6-1: SerialNumber: syz [ 1167.992570][T17793] usb 6-1: config 0 descriptor?? [ 1168.009730][ T795] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 1168.025553][T17793] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1168.051679][T17793] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 1168.189016][ T795] usb 5-1: Using ep0 maxpacket: 8 [ 1168.200985][ T795] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1168.217168][ T795] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1168.258297][ T795] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1168.274435][ T795] pvrusb2: ********** [ 1168.299772][ T795] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1168.310260][ T795] pvrusb2: Important functionality might not be entirely working. [ 1168.318194][ T795] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1168.358291][ T795] pvrusb2: ********** [ 1168.454058][ T2345] pvrusb2: Invalid write control endpoint [ 1168.557750][ T2345] pvrusb2: Invalid write control endpoint [ 1168.576130][ T2345] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1168.592298][ T2345] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1168.608570][ T2345] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1168.620356][T17793] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 1168.632258][ T2345] pvrusb2: Device being rendered inoperable [ 1168.638668][T17793] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 1168.671086][T25043] pvrusb2: Attempted to execute control transfer when device not ok [ 1168.700462][ T2345] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1168.707955][ T795] usb 5-1: USB disconnect, device number 25 [ 1168.710608][ T2345] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_g) [ 1168.724925][ T2345] pvrusb2: Attached sub-driver cx25840 [ 1168.731022][ T2345] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1168.742607][ T2345] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1169.417920][T17793] em28xx 6-1:0.0: Unknown AC97 audio processor detected! [ 1169.426853][T17793] em28xx 6-1:0.0: couldn't setup AC97 register 2 [ 1169.574222][T25076] sit0: left promiscuous mode [ 1169.602895][T25076] bridge0: left promiscuous mode [ 1169.608041][T25076] bridge0: left allmulticast mode [ 1169.637800][ T795] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1169.914823][T25079] netlink: 'syz.0.5595': attribute type 1 has an invalid length. [ 1169.949081][ T5917] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 1170.049129][T17793] em28xx 6-1:0.0: AC97 command still being executed: not handled properly! [ 1170.061058][T17793] em28xx 6-1:0.0: couldn't setup AC97 register 6 [ 1170.170533][T12987] net_ratelimit: 28 callbacks suppressed [ 1170.170557][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1170.231818][ T5917] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1170.249298][ T5917] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1170.250637][T17793] em28xx 6-1:0.0: couldn't setup AC97 register 54 [ 1170.267476][ T5917] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1170.320361][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1170.327337][ T5917] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1170.336307][T17793] em28xx 6-1:0.0: couldn't setup AC97 register 56 [ 1170.378137][T25076] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1170.409154][T15286] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1170.409299][T17793] usb 6-1: USB disconnect, device number 85 [ 1170.442714][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1170.453751][ T5917] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1170.576842][T25089] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1170.636513][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1170.835860][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1170.849120][T17794] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 1170.950326][T25094] syz_tun: entered allmulticast mode [ 1170.991227][T25093] syz_tun: left allmulticast mode [ 1171.030130][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1171.071239][T17794] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1171.082642][T17794] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1171.117203][T17794] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1171.159044][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1171.186862][T17794] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1171.273595][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1171.302807][T25090] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1171.316911][T17794] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1171.389776][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1172.770690][ T795] usb 5-1: USB disconnect, device number 26 [ 1172.901250][T25117] syz_tun: entered allmulticast mode [ 1172.915352][T25116] syz_tun: left allmulticast mode [ 1173.454636][ T795] usb 3-1: USB disconnect, device number 122 [ 1173.662089][T25128] syz_tun: entered allmulticast mode [ 1173.692915][T25127] syz_tun: left allmulticast mode [ 1175.472450][ T6409] net_ratelimit: 25 callbacks suppressed [ 1175.472466][ T6409] bond1: (slave lo): failed to get link speed/duplex [ 1175.590443][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1175.768995][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1175.899067][T12980] bond1: (slave lo): failed to get link speed/duplex [ 1176.019096][T12980] bond1: (slave lo): failed to get link speed/duplex [ 1176.077782][T25171] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5624'. [ 1176.122074][T25176] syz_tun: entered allmulticast mode [ 1176.134205][T25175] syz_tun: left allmulticast mode [ 1176.149018][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1176.260923][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1176.369184][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1176.399207][T15286] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 1176.490313][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1176.559008][T15286] usb 2-1: Using ep0 maxpacket: 8 [ 1176.574487][T15286] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 1176.590443][T15286] usb 2-1: config 179 has no interface number 0 [ 1176.602691][T15286] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1176.609145][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1176.620722][T15286] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1176.645015][T15286] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1176.677731][T15286] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1176.704807][T15286] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1176.733095][T15286] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1176.742495][T15286] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1176.780929][T25177] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1177.083685][T15286] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input92 [ 1177.303538][T25171] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1177.325301][T25171] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1177.385483][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.392081][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.414712][T17794] usb 2-1: USB disconnect, device number 121 [ 1177.414781][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1177.429443][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1178.245813][T25211] netlink: 48 bytes leftover after parsing attributes in process `syz.1.5634'. [ 1178.460103][T17794] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 1178.639043][T17794] usb 3-1: Using ep0 maxpacket: 16 [ 1178.683452][T17794] usb 3-1: config 0 has no interfaces? [ 1178.704525][T17794] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1178.714670][T25219] syz_tun: entered allmulticast mode [ 1178.722088][T25216] syz_tun: left allmulticast mode [ 1178.753323][T17794] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1178.777040][T17794] usb 3-1: Manufacturer: syz [ 1178.796405][T17794] usb 3-1: config 0 descriptor?? [ 1179.049203][ T5917] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 1179.229241][ T5917] usb 2-1: Using ep0 maxpacket: 32 [ 1179.294487][ T5917] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1179.323976][ T5917] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1179.350578][ T5917] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1179.378294][ T5917] usb 2-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 1179.405938][ T5917] usb 2-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 1179.464208][ T5917] usb 2-1: Product: syz [ 1179.468454][ T5917] usb 2-1: Manufacturer: syz [ 1179.486145][ T5917] usb 2-1: SerialNumber: syz [ 1179.592643][ T5917] input: appletouch as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input93 [ 1179.810491][T25229] GUP no longer grows the stack in syz.1.5641 (25229): 200000011000-200000018000 (20000000e000) [ 1179.821983][T25229] CPU: 0 UID: 0 PID: 25229 Comm: syz.1.5641 Tainted: G L syzkaller #0 PREEMPT(full) [ 1179.822003][T25229] Tainted: [L]=SOFTLOCKUP [ 1179.822008][T25229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1179.822015][T25229] Call Trace: [ 1179.822021][T25229] [ 1179.822027][T25229] dump_stack_lvl+0xe8/0x150 [ 1179.822045][T25229] __get_user_pages+0x2465/0x29f0 [ 1179.822075][T25229] get_user_pages_remote+0x2f1/0xac0 [ 1179.822089][T25229] ? __pfx_mtree_load+0x10/0x10 [ 1179.822104][T25229] ? __pfx_get_user_pages_remote+0x10/0x10 [ 1179.822118][T25229] ? __access_remote_vm+0xa0/0x7d0 [ 1179.822132][T25229] ? __access_remote_vm+0x367/0x7d0 [ 1179.822150][T25229] __access_remote_vm+0x211/0x7d0 [ 1179.822168][T25229] ? __pfx___access_remote_vm+0x10/0x10 [ 1179.822185][T25229] ? alloc_pages_noprof+0xbe/0x190 [ 1179.822200][T25229] proc_pid_cmdline_read+0x430/0x810 [ 1179.822215][T25229] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 1179.822227][T25229] ? rw_verify_area+0x2a6/0x4d0 [ 1179.822244][T25229] vfs_readv+0x5aa/0x850 [ 1179.822258][T25229] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 1179.822269][T25229] ? __pfx_vfs_readv+0x10/0x10 [ 1179.822289][T25229] ? __fget_files+0x2a/0x420 [ 1179.822304][T25229] ? __fget_files+0x3a0/0x420 [ 1179.822316][T25229] ? __fget_files+0x2a/0x420 [ 1179.822332][T25229] __x64_sys_preadv+0x197/0x2a0 [ 1179.822345][T25229] ? __pfx___x64_sys_preadv+0x10/0x10 [ 1179.822362][T25229] do_syscall_64+0xec/0xf80 [ 1179.822373][T25229] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1179.822383][T25229] ? clear_bhb_loop+0x60/0xb0 [ 1179.822395][T25229] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1179.822406][T25229] RIP: 0033:0x7f8d9a78f749 [ 1179.822417][T25229] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1179.822426][T25229] RSP: 002b:00007f8d9b652038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 1179.822438][T25229] RAX: ffffffffffffffda RBX: 00007f8d9a9e5fa0 RCX: 00007f8d9a78f749 [ 1179.822447][T25229] RDX: 0000000000000001 RSI: 0000200000001200 RDI: 0000000000000005 [ 1179.822453][T25229] RBP: 00007f8d9a813f91 R08: 0000000000006a76 R09: 0000000000000000 [ 1179.822461][T25229] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000000 [ 1179.822467][T25229] R13: 00007f8d9a9e6038 R14: 00007f8d9a9e5fa0 R15: 00007f8d9ab0fa28 [ 1179.822483][T25229] [ 1180.362034][ T5917] usb 2-1: USB disconnect, device number 122 [ 1180.380484][ T5917] appletouch 2-1:1.0: input: appletouch disconnected [ 1180.549198][T12978] net_ratelimit: 19 callbacks suppressed [ 1180.549218][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1180.822462][ T5917] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 1180.882849][T12986] bond1: (slave lo): failed to get link speed/duplex [ 1180.999287][ T5917] usb 5-1: Using ep0 maxpacket: 32 [ 1180.999958][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1181.147526][T17794] usb 3-1: USB disconnect, device number 123 [ 1181.156379][ T5917] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1181.190767][ T5917] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1181.242763][ T5917] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1181.263049][T25252] FAULT_INJECTION: forcing a failure. [ 1181.263049][T25252] name failslab, interval 1, probability 0, space 0, times 0 [ 1181.283713][ T5917] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1181.300558][T25252] CPU: 1 UID: 0 PID: 25252 Comm: syz.2.5647 Tainted: G L syzkaller #0 PREEMPT(full) [ 1181.300591][T25252] Tainted: [L]=SOFTLOCKUP [ 1181.300599][T25252] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1181.300611][T25252] Call Trace: [ 1181.300626][T25252] [ 1181.300635][T25252] dump_stack_lvl+0xe8/0x150 [ 1181.300664][T25252] should_fail_ex+0x414/0x560 [ 1181.300698][T25252] should_failslab+0xa8/0x100 [ 1181.300722][T25252] kmem_cache_alloc_noprof+0x88/0x710 [ 1181.300749][T25252] ? __netlink_lookup+0xbd/0x8a0 [ 1181.300776][T25252] ? skb_clone+0x212/0x3a0 [ 1181.300805][T25252] skb_clone+0x212/0x3a0 [ 1181.300833][T25252] __netlink_deliver_tap+0x404/0x850 [ 1181.300870][T25252] ? netlink_deliver_tap+0x2e/0x1b0 [ 1181.300896][T25252] netlink_deliver_tap+0x19c/0x1b0 [ 1181.300921][T25252] netlink_unicast+0x7fa/0x9e0 [ 1181.300949][T25252] ? __pfx_netlink_unicast+0x10/0x10 [ 1181.300971][T25252] ? __alloc_skb+0x198/0x3a0 [ 1181.300991][T25252] ? netlink_sendmsg+0x642/0xb30 [ 1181.301013][T25252] ? skb_put+0x11b/0x210 [ 1181.301038][T25252] netlink_sendmsg+0x805/0xb30 [ 1181.301072][T25252] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1181.301101][T25252] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1181.301126][T25252] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1181.301144][T25252] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1181.301174][T25252] __sock_sendmsg+0x21c/0x270 [ 1181.301205][T25252] ____sys_sendmsg+0x505/0x820 [ 1181.301235][T25252] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1181.301267][T25252] ? import_iovec+0x74/0xa0 [ 1181.301294][T25252] ___sys_sendmsg+0x21f/0x2a0 [ 1181.301321][T25252] ? __pfx____sys_sendmsg+0x10/0x10 [ 1181.301380][T25252] ? __fget_files+0x2a/0x420 [ 1181.301405][T25252] ? __fget_files+0x3a0/0x420 [ 1181.301436][T25252] __x64_sys_sendmsg+0x19b/0x260 [ 1181.301460][T25252] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1181.301493][T25252] ? __pfx_ksys_write+0x10/0x10 [ 1181.301524][T25252] do_syscall_64+0xec/0xf80 [ 1181.301542][T25252] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1181.301558][T25252] ? trace_irq_disable+0x37/0x100 [ 1181.301581][T25252] ? clear_bhb_loop+0x60/0xb0 [ 1181.301602][T25252] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1181.301618][T25252] RIP: 0033:0x7fe568f8f749 [ 1181.301642][T25252] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1181.301659][T25252] RSP: 002b:00007fe569e5d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1181.301680][T25252] RAX: ffffffffffffffda RBX: 00007fe5691e5fa0 RCX: 00007fe568f8f749 [ 1181.301695][T25252] RDX: 0000000000004010 RSI: 0000200000000280 RDI: 0000000000000003 [ 1181.301708][T25252] RBP: 00007fe569e5d090 R08: 0000000000000000 R09: 0000000000000000 [ 1181.301720][T25252] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1181.301732][T25252] R13: 00007fe5691e6038 R14: 00007fe5691e5fa0 R15: 00007fe56930fa28 [ 1181.301763][T25252] [ 1181.670061][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1181.672950][ T5917] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1181.687002][ T5917] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1181.695398][ T5917] usb 5-1: Product: syz [ 1181.699933][ T5917] usb 5-1: Manufacturer: syz [ 1181.707269][ T5917] usb 5-1: SerialNumber: syz [ 1181.797755][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1181.833725][ C1] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 1181.861784][ T5917] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input94 [ 1181.939041][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1181.982729][ T5917] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 1182.023261][ T5917] (id 0x00) [ 1182.078576][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1182.189770][ T5917] rc_core: IR keymap rc-imon-pad not found [ 1182.205112][ T5917] Registered IR keymap rc-empty [ 1182.229744][ T182] bond1: (slave lo): failed to get link speed/duplex [ 1182.230578][ T5917] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 1182.256600][T25261] netlink: 'syz.1.5648': attribute type 322 has an invalid length. [ 1182.331638][ T5917] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1182.349053][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1182.362684][ T5917] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0 [ 1182.393325][ T5917] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0/input95 [ 1182.452551][ T5917] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:27> initialized [ 1182.461235][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1182.810259][T25291] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5656'. [ 1183.473236][T25301] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5659'. [ 1184.758557][ T5917] usb 5-1: USB disconnect, device number 27 [ 1185.241872][T25334] binder: 25333:25334 ioctl 4b4e 30 returned -22 [ 1185.326768][T25336] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5667'. [ 1185.505214][T25347] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5671'. [ 1185.899039][T12978] net_ratelimit: 24 callbacks suppressed [ 1185.899054][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1186.009160][ T5917] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 1186.019020][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1186.035850][T25367] mac80211_hwsim hwsim29 syzkaller0: Caught tx_queue_len zero misconfig [ 1186.142179][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1186.169916][ T5917] usb 3-1: Using ep0 maxpacket: 16 [ 1186.180933][ T5917] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1186.206539][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1186.217902][ T5917] usb 3-1: Product: syz [ 1186.222425][ T5917] usb 3-1: Manufacturer: syz [ 1186.258735][ T5917] usb 3-1: SerialNumber: syz [ 1186.270001][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1186.296414][ T5917] usb 3-1: config 0 descriptor?? [ 1186.399068][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1186.529039][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1186.649007][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1186.723437][ T5917] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1186.747021][ T5917] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1186.756957][T25383] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5684'. [ 1186.767117][ T5917] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1186.775269][ T5917] usb 3-1: media controller created [ 1186.775561][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1186.817094][ T5917] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1186.917642][T25389] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5685'. [ 1186.930541][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1187.159693][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1187.236831][T25402] xt_hashlimit: size too large, truncated to 1048576 [ 1187.379366][ T5917] zl10353_read_register: readreg error (reg=127, ret==0) [ 1187.393388][ T5917] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1187.402106][ T5917] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1187.416366][ T5917] usb 3-1: USB disconnect, device number 124 [ 1187.457323][ T5917] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1187.473321][T15286] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 1187.589171][T17794] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 1187.639058][T15286] usb 2-1: Using ep0 maxpacket: 16 [ 1187.648284][T15286] usb 2-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1187.657695][T15286] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1187.666414][T15286] usb 2-1: Product: syz [ 1187.670825][T15286] usb 2-1: Manufacturer: syz [ 1187.675792][T15286] usb 2-1: SerialNumber: syz [ 1187.683933][T15286] usb 2-1: config 0 descriptor?? [ 1187.741592][T17794] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1187.769130][T17794] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1187.800505][T17794] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1188.141343][T17794] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1188.166201][T17794] usb 6-1: Product: syz [ 1188.176322][T17794] usb 6-1: Manufacturer: syz [ 1188.219408][T17794] usb 6-1: SerialNumber: syz [ 1188.241581][T17794] cdc_mbim 6-1:1.0: skipping garbage [ 1188.338229][T15286] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1188.375612][T15286] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1188.429816][T15286] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1188.494253][T15286] usb 2-1: media controller created [ 1188.572989][T25402] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1188.619782][T25400] dtv5100: wlen = 0, aborting. [ 1188.620769][T15286] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1188.821481][T15286] zl10353_read_register: readreg error (reg=127, ret==0) [ 1188.860959][T15286] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1188.882544][T15286] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1188.942877][T15286] usb 2-1: USB disconnect, device number 123 [ 1189.084820][T15286] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1189.233296][T25402] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1189.244162][T17794] cdc_mbim 6-1:1.0: dwNtbInMaxSize=4 is too small. Using 2048 [ 1189.251883][T17794] cdc_mbim 6-1:1.0: setting rx_max = 2048 [ 1189.305201][T25424] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5696'. [ 1189.454517][T17794] cdc_mbim 6-1:1.0: setting tx_max = 16384 [ 1189.470060][T17794] cdc_mbim 6-1:1.0: cdc-wdm0: USB WDM device [ 1189.494051][T25431] netlink: 'syz.4.5693': attribute type 1 has an invalid length. [ 1189.566689][T17794] wwan wwan0: port wwan0mbim0 attached [ 1189.585656][T17794] cdc_mbim 6-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.5-1, CDC MBIM, 0a:9c:92:bf:4c:f6 [ 1189.625645][T17794] usb 6-1: USB disconnect, device number 86 [ 1189.638538][T17794] cdc_mbim 6-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.5-1, CDC MBIM [ 1189.722883][T17794] wwan wwan0: port wwan0mbim0 disconnected [ 1190.240121][T25438] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5699'. [ 1190.750774][T25453] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1190.929810][ T6409] net_ratelimit: 30 callbacks suppressed [ 1190.929834][ T6409] bond1: (slave lo): failed to get link speed/duplex [ 1190.949045][T15286] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 1191.055081][ T6409] bond1: (slave lo): failed to get link speed/duplex [ 1191.109063][T15286] usb 1-1: Using ep0 maxpacket: 32 [ 1191.118168][T15286] usb 1-1: config 0 has an invalid interface number: 101 but max is 0 [ 1191.136464][T15286] usb 1-1: config 0 has no interface number 0 [ 1191.143480][T25464] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5708'. [ 1191.161559][T15286] usb 1-1: config 0 interface 101 has no altsetting 0 [ 1191.169031][ T6409] bond1: (slave lo): failed to get link speed/duplex [ 1191.182581][T15286] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 1191.191947][T15286] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1191.204377][T15286] usb 1-1: Product: syz [ 1191.209604][T15286] usb 1-1: Manufacturer: syz [ 1191.224189][T15286] usb 1-1: SerialNumber: syz [ 1191.235317][T25465] netlink: 'syz.5.5704': attribute type 1 has an invalid length. [ 1191.288772][T15286] usb 1-1: config 0 descriptor?? [ 1191.293928][ T5987] bond1: (slave lo): failed to get link speed/duplex [ 1191.362415][T25467] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5709'. [ 1191.423985][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1191.542275][ T8466] bond1: (slave lo): failed to get link speed/duplex [ 1191.542347][T25470] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5710'. [ 1191.704664][T15286] RobotFuzz Open Source InterFace, OSIF 1-1:0.101: version d4.15 found at bus 001 address 086 [ 1191.819320][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1191.870036][T25474] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5711'. [ 1191.979052][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1192.090161][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1192.229024][ T2140] bond1: (slave lo): failed to get link speed/duplex [ 1192.574434][T25491] syz_tun: entered allmulticast mode [ 1192.630130][T25493] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5719'. [ 1192.931564][T25500] sit0: left promiscuous mode [ 1193.010028][T25500] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1193.229090][T17793] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 1193.398167][T17793] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1193.409730][T17793] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1193.420733][T17793] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1193.432904][T17793] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1193.486748][T25501] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1193.506844][T17793] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1193.759392][T25452] i2c i2c-1: failure reading data [ 1193.764818][T25483] i2c i2c-1: failure reading data [ 1194.012670][T17793] usb 1-1: USB disconnect, device number 86 [ 1194.152565][T25510] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5724'. [ 1194.666346][T25526] syz_tun: entered allmulticast mode [ 1195.847316][T17793] usb 2-1: USB disconnect, device number 124 [ 1195.949291][ T1001] net_ratelimit: 35 callbacks suppressed [ 1195.949311][ T1001] bond1: (slave lo): failed to get link speed/duplex [ 1196.032532][T25544] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5734'. [ 1196.041876][T25544] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5734'. [ 1196.087771][ T1001] bond1: (slave lo): failed to get link speed/duplex [ 1196.122649][T25545] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5734'. [ 1196.199082][T17793] usb 2-1: new full-speed USB device number 125 using dummy_hcd [ 1196.219061][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1196.329035][T12980] bond1: (slave lo): failed to get link speed/duplex [ 1196.374751][T17793] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1196.390675][T17793] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1196.404932][T17793] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1196.415520][T17793] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1196.427827][T17793] usb 2-1: Product: syz [ 1196.432834][T17793] usb 2-1: Manufacturer: syz [ 1196.437790][T17793] usb 2-1: SerialNumber: syz [ 1196.443810][ T1001] bond1: (slave lo): failed to get link speed/duplex [ 1196.456463][T17793] usb 2-1: config 0 descriptor?? [ 1196.559132][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1196.608361][T25559] syz_tun: entered allmulticast mode [ 1196.669022][ T1001] bond1: (slave lo): failed to get link speed/duplex [ 1196.689508][T17793] usb 3-1: new high-speed USB device number 125 using dummy_hcd [ 1196.737927][T25563] FAULT_INJECTION: forcing a failure. [ 1196.737927][T25563] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1196.753569][T25563] CPU: 0 UID: 0 PID: 25563 Comm: syz.4.5744 Tainted: G L syzkaller #0 PREEMPT(full) [ 1196.753598][T25563] Tainted: [L]=SOFTLOCKUP [ 1196.753605][T25563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1196.753616][T25563] Call Trace: [ 1196.753624][T25563] [ 1196.753634][T25563] dump_stack_lvl+0xe8/0x150 [ 1196.753665][T25563] should_fail_ex+0x414/0x560 [ 1196.753697][T25563] prepare_alloc_pages+0x22b/0x650 [ 1196.753726][T25563] __alloc_frozen_pages_noprof+0x123/0x370 [ 1196.753748][T25563] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1196.753780][T25563] ? policy_nodemask+0xa0/0x720 [ 1196.753817][T25563] alloc_pages_mpol+0x232/0x4a0 [ 1196.753844][T25563] vma_alloc_folio_noprof+0xe4/0x200 [ 1196.753866][T25563] ? page_table_check_set+0x148/0x610 [ 1196.753887][T25563] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1196.753909][T25563] ? css_rstat_updated+0x239/0x520 [ 1196.753940][T25563] ? ___pte_offset_map+0x29/0x240 [ 1196.753968][T25563] folio_prealloc+0x30/0x180 [ 1196.753988][T25563] do_pte_missing+0x14e8/0x3330 [ 1196.754026][T25563] handle_mm_fault+0x1b26/0x32b0 [ 1196.754053][T25563] ? __pte_offset_map_lock+0x13e/0x210 [ 1196.754086][T25563] ? handle_mm_fault+0xdb/0x32b0 [ 1196.754117][T25563] ? __pfx_handle_mm_fault+0x10/0x10 [ 1196.754145][T25563] ? follow_page_pte+0x7ef/0x13e0 [ 1196.754180][T25563] ? __pfx_follow_page_pte+0x10/0x10 [ 1196.754216][T25563] __get_user_pages+0x1650/0x29f0 [ 1196.754265][T25563] populate_vma_page_range+0x29f/0x3a0 [ 1196.754293][T25563] ? __pfx_populate_vma_page_range+0x10/0x10 [ 1196.754320][T25563] ? down_read+0x274/0x2e0 [ 1196.754343][T25563] ? __mm_populate+0x160/0x380 [ 1196.754371][T25563] __mm_populate+0x24c/0x380 [ 1196.754397][T25563] ? __pfx___mm_populate+0x10/0x10 [ 1196.754432][T25563] do_mlock+0x612/0x720 [ 1196.754465][T25563] ? __pfx_do_mlock+0x10/0x10 [ 1196.754489][T25563] ? fput+0xa0/0xd0 [ 1196.754514][T25563] ? ksys_write+0x22a/0x250 [ 1196.754534][T25563] ? __pfx_ksys_write+0x10/0x10 [ 1196.754557][T25563] __x64_sys_mlock+0x60/0x70 [ 1196.754581][T25563] do_syscall_64+0xec/0xf80 [ 1196.754601][T25563] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1196.754618][T25563] ? trace_irq_disable+0x37/0x100 [ 1196.754642][T25563] ? clear_bhb_loop+0x60/0xb0 [ 1196.754664][T25563] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1196.754683][T25563] RIP: 0033:0x7f20b4f8f749 [ 1196.754702][T25563] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1196.754720][T25563] RSP: 002b:00007f20b5d40038 EFLAGS: 00000246 ORIG_RAX: 0000000000000095 [ 1196.754742][T25563] RAX: ffffffffffffffda RBX: 00007f20b51e5fa0 RCX: 00007f20b4f8f749 [ 1196.754757][T25563] RDX: 0000000000000000 RSI: 0000000000800000 RDI: 0000200000000000 [ 1196.754771][T25563] RBP: 00007f20b5d40090 R08: 0000000000000000 R09: 0000000000000000 [ 1196.754783][T25563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1196.754805][T25563] R13: 00007f20b51e6038 R14: 00007f20b51e5fa0 R15: 00007f20b530fa28 [ 1196.754835][T25563] [ 1196.859005][T17793] usb 3-1: Using ep0 maxpacket: 16 [ 1196.873413][T12978] bond1: (slave lo): failed to get link speed/duplex [ 1196.990413][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1197.013370][T17793] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1197.149694][T17793] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1197.166530][T17793] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1197.169062][T12987] bond1: (slave lo): failed to get link speed/duplex [ 1197.176056][T17793] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1197.191470][T17793] usb 3-1: Product: syz [ 1197.196220][T17793] usb 3-1: Manufacturer: syz [ 1197.201555][T17793] usb 3-1: SerialNumber: syz [ 1197.208870][T17793] usb 3-1: config 0 descriptor?? [ 1197.219487][T17793] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1197.229363][T17793] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 1197.449040][T15286] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 1197.529487][T17793] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 1197.550201][T17793] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 1197.600293][T17793] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 1197.607322][T17793] em28xx 3-1:0.0: No AC97 audio processor [ 1197.619083][T15286] usb 6-1: Using ep0 maxpacket: 8 [ 1197.637959][T15286] usb 6-1: config 179 has an invalid interface number: 97 but max is 0 [ 1197.646705][T15286] usb 6-1: config 179 has no interface number 0 [ 1197.659505][T17793] usb 3-1: USB disconnect, device number 125 [ 1197.668406][T15286] usb 6-1: config 179 interface 97 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1197.701799][T17793] em28xx 3-1:0.0: Disconnecting em28xx [ 1197.705292][T15286] usb 6-1: config 179 interface 97 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1197.723056][T17793] em28xx 3-1:0.0: Freeing device [ 1197.754210][T15286] usb 6-1: config 179 interface 97 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1197.790483][T15286] usb 6-1: config 179 interface 97 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1197.839212][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1197.855082][T15286] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.ce [ 1197.881604][T15286] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1197.912917][T25570] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1198.020152][T17793] usb 3-1: new high-speed USB device number 126 using dummy_hcd [ 1198.044578][ T5836] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1198.056172][ T5836] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1198.066420][ T5836] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1198.074720][ T5836] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1198.082779][ T5836] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1198.135819][T17794] usb 6-1: USB disconnect, device number 87 [ 1198.179178][T17793] usb 3-1: Using ep0 maxpacket: 16 [ 1198.193247][T17793] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1198.212745][T17793] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1198.249022][T17793] usb 3-1: Product: syz [ 1198.259020][T17793] usb 3-1: Manufacturer: syz [ 1198.263669][T17793] usb 3-1: SerialNumber: syz [ 1198.310413][T17793] usb 3-1: config 0 descriptor?? [ 1198.380089][T21655] syz_tun (unregistering): left allmulticast mode [ 1198.581858][T25584] chnl_net:caif_netlink_parms(): no params data found [ 1198.741891][T15286] usb 5-1: new full-speed USB device number 28 using dummy_hcd [ 1198.762847][T17793] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1198.778107][T17793] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1198.789320][T17793] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1198.797320][T17793] usb 3-1: media controller created [ 1198.814269][T17793] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1198.851100][T25584] bridge0: port 1(bridge_slave_0) entered blocking state [ 1198.858345][T25584] bridge0: port 1(bridge_slave_0) entered disabled state [ 1198.866056][T25584] bridge_slave_0: entered allmulticast mode [ 1198.873400][T25584] bridge_slave_0: entered promiscuous mode [ 1198.882969][T25584] bridge0: port 2(bridge_slave_1) entered blocking state [ 1198.890318][T25584] bridge0: port 2(bridge_slave_1) entered disabled state [ 1198.897658][T25584] bridge_slave_1: entered allmulticast mode [ 1198.906170][T15440] usb 2-1: USB disconnect, device number 125 [ 1198.907014][T25584] bridge_slave_1: entered promiscuous mode [ 1198.917532][T15286] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1198.937779][T15286] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1198.952200][T15286] usb 5-1: Product: syz [ 1198.956490][T15286] usb 5-1: Manufacturer: syz [ 1198.961948][T15286] usb 5-1: SerialNumber: syz [ 1198.969121][ T795] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 1198.978977][T15286] usb 5-1: config 0 descriptor?? [ 1199.025238][T17793] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1199.034315][T25584] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1199.059022][T17793] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1199.075507][T25584] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1199.149125][ T795] usb 6-1: Using ep0 maxpacket: 8 [ 1199.160061][ T795] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 1199.169123][ T795] usb 6-1: config 179 has no interface number 0 [ 1199.175551][ T795] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1199.187200][T25584] team0: Port device team_slave_0 added [ 1199.193466][ T795] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1199.206465][ T795] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1199.224591][T15286] dvb_usb_rtl28xxu 5-1:0.0: chip type detection failed -71 [ 1199.246364][T25584] team0: Port device team_slave_1 added [ 1199.252558][T15286] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1199.264757][T25580] dtv5100: wlen = 0, aborting. [ 1199.270187][ T795] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1199.291264][T25601] ------------[ cut here ]------------ [ 1199.296772][T25601] usb 3-1: BOGUS control dir, pipe 80007e80 doesn't match bRequestType c0 [ 1199.305476][T25601] WARNING: drivers/usb/core/urb.c:414 at usb_submit_urb+0x105c/0x18d0, CPU#0: syz.1.5753/25601 [ 1199.316154][T25601] Modules linked in: [ 1199.320739][T25601] CPU: 0 UID: 0 PID: 25601 Comm: syz.1.5753 Tainted: G L syzkaller #0 PREEMPT(full) [ 1199.331763][T25601] Tainted: [L]=SOFTLOCKUP [ 1199.336099][T25601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1199.346213][T25601] RIP: 0010:usb_submit_urb+0x111c/0x18d0 [ 1199.351969][T25601] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 b7 f2 ff ff 89 e9 [ 1199.373018][T25601] RSP: 0018:ffffc90014aff920 EFLAGS: 00010246 [ 1199.379173][T25601] RAX: 0000000000000000 RBX: ffff88802843f300 RCX: 0000000080007e80 [ 1199.387166][T25601] RDX: ffff88802770ae20 RSI: ffffffff8c140d20 RDI: ffffffff8f8ee730 [ 1199.395226][T25601] RBP: 1ffff110289f39e0 R08: 00000000000000c0 R09: 0000000000000000 [ 1199.403465][T25601] R10: ffffc90014affa20 R11: fffff5200295ff50 R12: ffff88804d3d4100 [ 1199.411672][T25601] R13: ffff888144f9cf00 R14: 0000000080007e80 R15: ffff88802770ae20 [ 1199.419705][T25601] FS: 00007f8d9b6526c0(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000 [ 1199.429387][T25601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1199.436005][T25601] CR2: 0000000000000000 CR3: 000000007ed74000 CR4: 00000000003526f0 [ 1199.444141][T25601] Call Trace: [ 1199.447438][T25601] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1199.450448][T25601] ? __init_swait_queue_head+0xa9/0x150 [ 1199.456025][T25601] usb_start_wait_urb+0x115/0x4f0 [ 1199.462048][T25601] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1199.467673][T25601] usb_control_msg+0x232/0x3e0 [ 1199.472628][T25601] dtv5100_i2c_msg+0x231/0x2f0 [ 1199.477428][T25601] dtv5100_i2c_xfer+0x1a4/0x3c0 [ 1199.482373][T25601] __i2c_transfer+0x79a/0x1f00 [ 1199.487172][T25601] ? i2c_transfer+0xc8/0x2d0 [ 1199.491859][T25601] i2c_transfer+0x1cc/0x2d0 [ 1199.496385][T25601] i2cdev_ioctl_rdwr+0x460/0x740 [ 1199.501450][T25601] i2cdev_ioctl+0x64b/0x820 [ 1199.505973][T25601] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1199.511104][T25601] ? __fget_files+0x3a0/0x420 [ 1199.515836][T25601] ? __fget_files+0x2a/0x420 [ 1199.520492][T25601] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1199.525453][T25601] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1199.530583][T25601] __se_sys_ioctl+0xfc/0x170 [ 1199.535210][T25601] do_syscall_64+0xec/0xf80 [ 1199.539805][T25601] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1199.545896][T25601] ? trace_irq_disable+0x37/0x100 [ 1199.551001][T25601] ? clear_bhb_loop+0x60/0xb0 [ 1199.555713][T25601] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1199.561861][T25601] RIP: 0033:0x7f8d9a78f749 [ 1199.566304][T25601] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1199.586011][T25601] RSP: 002b:00007f8d9b652038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1199.594557][T25601] RAX: ffffffffffffffda RBX: 00007f8d9a9e5fa0 RCX: 00007f8d9a78f749 [ 1199.602608][T25601] RDX: 00002000000000c0 RSI: 0000000000000707 RDI: 0000000000000003 [ 1199.610717][T25601] RBP: 00007f8d9a813f91 R08: 0000000000000000 R09: 0000000000000000 [ 1199.618711][T25601] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1199.626747][T25601] R13: 00007f8d9a9e6038 R14: 00007f8d9a9e5fa0 R15: 00007f8d9ab0fa28 [ 1199.634803][T25601] [ 1199.637834][T25601] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1199.645117][T25601] CPU: 0 UID: 0 PID: 25601 Comm: syz.1.5753 Tainted: G L syzkaller #0 PREEMPT(full) [ 1199.656055][T25601] Tainted: [L]=SOFTLOCKUP [ 1199.660375][T25601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1199.670427][T25601] Call Trace: [ 1199.673703][T25601] [ 1199.676626][T25601] vpanic+0x1e0/0x670 [ 1199.680611][T25601] panic+0xb9/0xc0 [ 1199.684330][T25601] ? __pfx_panic+0x10/0x10 [ 1199.688761][T25601] __warn+0x317/0x4b0 [ 1199.692749][T25601] ? usb_submit_urb+0x105c/0x18d0 [ 1199.697782][T25601] ? usb_submit_urb+0x105c/0x18d0 [ 1199.702800][T25601] __report_bug+0x288/0x500 [ 1199.707298][T25601] ? unwind_get_return_address+0x4d/0x90 [ 1199.712928][T25601] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1199.719086][T25601] ? usb_submit_urb+0x105c/0x18d0 [ 1199.724114][T25601] ? __pfx___report_bug+0x10/0x10 [ 1199.729135][T25601] ? __pfx_stack_trace_save+0x10/0x10 [ 1199.734510][T25601] ? stack_depot_save_flags+0x33/0x810 [ 1199.739969][T25601] report_bug_entry+0x19a/0x290 [ 1199.744820][T25601] ? usb_submit_urb+0x111c/0x18d0 [ 1199.749835][T25601] ? usb_submit_urb+0x1121/0x18d0 [ 1199.754863][T25601] handle_bug+0xca/0x200 [ 1199.759104][T25601] exc_invalid_op+0x1a/0x50 [ 1199.763607][T25601] asm_exc_invalid_op+0x1a/0x20 [ 1199.768448][T25601] RIP: 0010:usb_submit_urb+0x111c/0x18d0 [ 1199.774076][T25601] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 b7 f2 ff ff 89 e9 [ 1199.793680][T25601] RSP: 0018:ffffc90014aff920 EFLAGS: 00010246 [ 1199.799755][T25601] RAX: 0000000000000000 RBX: ffff88802843f300 RCX: 0000000080007e80 [ 1199.807728][T25601] RDX: ffff88802770ae20 RSI: ffffffff8c140d20 RDI: ffffffff8f8ee730 [ 1199.815699][T25601] RBP: 1ffff110289f39e0 R08: 00000000000000c0 R09: 0000000000000000 [ 1199.823671][T25601] R10: ffffc90014affa20 R11: fffff5200295ff50 R12: ffff88804d3d4100 [ 1199.831653][T25601] R13: ffff888144f9cf00 R14: 0000000080007e80 R15: ffff88802770ae20 [ 1199.839644][T25601] ? __init_swait_queue_head+0xa9/0x150 [ 1199.845196][T25601] usb_start_wait_urb+0x115/0x4f0 [ 1199.850221][T25601] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1199.855780][T25601] usb_control_msg+0x232/0x3e0 [ 1199.860553][T25601] dtv5100_i2c_msg+0x231/0x2f0 [ 1199.865318][T25601] dtv5100_i2c_xfer+0x1a4/0x3c0 [ 1199.870176][T25601] __i2c_transfer+0x79a/0x1f00 [ 1199.874945][T25601] ? i2c_transfer+0xc8/0x2d0 [ 1199.879532][T25601] i2c_transfer+0x1cc/0x2d0 [ 1199.884041][T25601] i2cdev_ioctl_rdwr+0x460/0x740 [ 1199.888986][T25601] i2cdev_ioctl+0x64b/0x820 [ 1199.893483][T25601] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1199.898506][T25601] ? __fget_files+0x3a0/0x420 [ 1199.903181][T25601] ? __fget_files+0x2a/0x420 [ 1199.907770][T25601] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1199.912706][T25601] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1199.917741][T25601] __se_sys_ioctl+0xfc/0x170 [ 1199.922338][T25601] do_syscall_64+0xec/0xf80 [ 1199.926836][T25601] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1199.932930][T25601] ? trace_irq_disable+0x37/0x100 [ 1199.938043][T25601] ? clear_bhb_loop+0x60/0xb0 [ 1199.942734][T25601] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1199.948625][T25601] RIP: 0033:0x7f8d9a78f749 [ 1199.953038][T25601] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1199.972732][T25601] RSP: 002b:00007f8d9b652038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1199.981236][T25601] RAX: ffffffffffffffda RBX: 00007f8d9a9e5fa0 RCX: 00007f8d9a78f749 [ 1199.989207][T25601] RDX: 00002000000000c0 RSI: 0000000000000707 RDI: 0000000000000003 [ 1199.997173][T25601] RBP: 00007f8d9a813f91 R08: 0000000000000000 R09: 0000000000000000 [ 1200.005172][T25601] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1200.013141][T25601] R13: 00007f8d9a9e6038 R14: 00007f8d9a9e5fa0 R15: 00007f8d9ab0fa28 [ 1200.021124][T25601] [ 1200.024601][T25601] Kernel Offset: disabled [ 1200.028925][T25601] Rebooting in 86400 seconds..