last executing test programs: 18m57.020365396s ago: executing program 4 (id=901): bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000f, @void, @value}, 0x94) sendto$inet6(0xffffffffffffffff, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e14", 0xe, 0x840, 0x0, 0x0) 18m56.815176476s ago: executing program 4 (id=905): syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="040e07090908"], 0xa) 18m56.679257391s ago: executing program 4 (id=906): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x161082, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x4, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text32={0x20, 0x0}], 0x1, 0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r3 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r3, &(0x7f0000000000)='2\x00', 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) 18m56.549653669s ago: executing program 4 (id=907): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='./file0/../file0/../file0/../file0\x00') 18m56.489267065s ago: executing program 4 (id=908): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="380000000314010000000000000008000900020073797a310000000008004100736977001400330073797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 18m56.37294082s ago: executing program 4 (id=910): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000002780), 0x2, 0x0) readv(r0, &(0x7f0000000200)=[{&(0x7f0000000300)=""/9, 0x9}], 0x1) 18m56.079100111s ago: executing program 32 (id=910): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000002780), 0x2, 0x0) readv(r0, &(0x7f0000000200)=[{&(0x7f0000000300)=""/9, 0x9}], 0x1) 16.816429751s ago: executing program 0 (id=6617): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="680000001c00", @ANYBLOB="4000ba000a000200aa"], 0x68}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6016000000102b00fc0100000000000000e2ff0000000000fe8000000000000000000400000000aa"], 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0xa}, 0x20) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x40000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020a00090700000000000000fcdbdf2505001a0064010100000000000000000000000000ac1414aa000000000000000500000080ffffff"], 0x38}}, 0x44040) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='v', 0x34000}], 0x1) ioctl$KVM_RUN(r7, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r8, {0x2, 0x0, @dev}, 0x2}}, 0x2e) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000b00)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000700000014000800000000000000000000000000000000000500130000000000050012"], 0x38}}, 0x0) 16.542089568s ago: executing program 0 (id=6620): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r0, r0, &(0x7f0000000040)=0x8, 0x97eb3b9) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000003680)={0x0, 0x0, &(0x7f0000003640)={&(0x7f0000003400)=@getsadinfo={0xbc, 0x23, 0x1, 0x70bd29, 0x25dfdbff, 0x0, [@policy={0xa8, 0x7, {{@in=@local, @in=@remote, 0x4e24, 0x3ff, 0x4e21, 0x75d9, 0xa, 0xa0, 0xa0, 0xd}, {0x8, 0x7fffffffffffffff, 0x400, 0x5b, 0x2, 0xffffffff, 0x65, 0xb}, {0x4a0, 0x8750, 0xe00000, 0x9}, 0x2, 0x6e6bb0, 0x1, 0x1, 0x3, 0x3}}]}, 0xbc}}, 0x40000) (async) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000000a0a01080000ffffffffffffffffe4df574e69e50000000001000002"], 0x14}, 0x1, 0x0, 0x0, 0x1c881}, 0x4) 16.399228267s ago: executing program 0 (id=6622): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = dup(0xffffffffffffffff) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r1, 0x40089413, &(0x7f0000000140)=0x10001) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="12010000b1bd2f087d0403508c2f010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r3, &(0x7f00000000c0)={0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="0000f50000000341e9"], 0x0}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f00000009c0)={0x84, &(0x7f0000000ac0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$IPSET_CMD_CREATE(r2, 0x0, 0x800) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r4, 0x0, 0x81, &(0x7f0000001100)={'nat\x00', 0x0, 0x0, 0x90, [], 0x2, 0x0, 0x0}, &(0x7f0000001180)=0x108) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c0000003e0007010000000000000000047c0000040012801400018008000300", @ANYRES32=0xee00, @ANYBLOB="08000f"], 0x2c}}, 0x0) sendmsg$IPSET_CMD_ADD(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="50000000090601020000000000000000030000000900020073797a31000000000500010007000000280007800c00018008000140ad14143b0c00148008000140ac1414bb0c000280"], 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5758621d46}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket(0x10, 0x3, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="48000000020601000000000000000000000000000e0003006269746d617009697000000005000400000000000900020073797a3000000000050005b92cd812000500010006000000"], 0x48}}, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0xffffff, 0x100000}, 0x10) write(r8, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000fe00000000000000", 0x1c) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="01082cbd7000000000000b000089d5e081f08c1fe8476f1d73d7978ea0b6184ad591780a40ae2dc8df23b00dd6a97b143756d8098e823a94c87a205627c939a92870f84abed9f730", @ANYRES32=r10, @ANYBLOB="30005080110001004abee339084eeef16f162471f400000008000700000000000500020000000000080003000bac0f000a0006000802110000010000"], 0x58}, 0x1, 0x0, 0x0, 0x44151}, 0x0) 12.983315807s ago: executing program 0 (id=6637): socket$netlink(0x10, 0x3, 0x0) socket(0x400000000010, 0x3, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x80400, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r1, 0x0) listen(0xffffffffffffffff, 0x40000000) pselect6(0x40, &(0x7f0000000600)={0x11, 0xfffffffffffffffc, 0x6, 0x0, 0xfffffffffffffffe, 0x8, 0x0, 0x8}, 0x0, &(0x7f0000000680)={0x7fc, 0x2, 0x8, 0xfffffffffffffffe, 0x0, 0xc3ad}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 9.838920832s ago: executing program 0 (id=6652): socket$l2tp6(0xa, 0x2, 0x73) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e20, @multicast2}, 0x10) sendmmsg$sock(r0, 0x0, 0x0, 0x20000000) 9.547239154s ago: executing program 0 (id=6653): syz_open_dev$media(&(0x7f0000000040), 0x4c6c, 0x200) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000000c0), 0x10) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x448}}, 0x0) sendmmsg$inet(r0, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086e3", 0x2c}], 0x2}}, {{0x0, 0x0, &(0x7f0000000100), 0x2}}], 0x40000000000003a, 0x0) 9.025444099s ago: executing program 2 (id=6655): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000080)={0xf0f01a, 0x5}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6016000000102b00fc0100000000000000e2ff0000000000fe8000000000000000000400000000aa"], 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0xa}, 0x20) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x40000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020a00090700000000000000fcdbdf2505001a0064010100000000000000000000000000ac1414aa000000000000000500000080ffffff"], 0x38}}, 0x44040) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='v', 0x34000}], 0x1) ioctl$KVM_RUN(r7, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r8, {0x2, 0x0, @dev}, 0x2}}, 0x2e) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000b00)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000700000014000800000000000000000000000000000000000500130000000000050012"], 0x38}}, 0x0) 8.952092157s ago: executing program 5 (id=6656): ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x402c582b, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x44e, 0x1215, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x9, [{{0x9, 0x4, 0x0, 0x4, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x4, 0x4, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0x0, 0x5}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x14, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='\x00\"\t'], 0x0}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=@newsa={0x138, 0x10, 0x413, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x4e24, 0x0, 0x0, 0xa0, 0x20, 0x0, 0x0, 0xee00}, {@in6=@private2, 0x4d3, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @empty}, {0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x8}, {0x0, 0x8, 0xcc}, {0xfa, 0x0, 0x9}, 0x0, 0x0, 0xa, 0x0, 0x1, 0xf9}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x40}}]}, 0x138}, 0x1, 0x0, 0x0, 0x1}, 0x0) syz_usb_connect$hid(0x2, 0x36, &(0x7f00000006c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x45e, 0x713, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x1, 0x40, 0xf, [{{0x9, 0x4, 0x0, 0xff, 0x2, 0x3, 0x1, 0x3, 0x5, {0x9, 0x21, 0x0, 0x9, 0x1, {0x22, 0x442}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x40, 0x94, 0x2}}}}}]}}]}}, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) sendto$unix(r1, &(0x7f0000000380)="6f2158ea1cd43b772cfad5afe45d845c97f8328effdad46d96a5545ddb0c8b77fed267a599a6304962c1d12543e4bcaca250bc69ba6b14a79237c08f1b825cf5e99439e63b7e81b8c66a2f407a6cd3a470", 0x51, 0x20008020, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r2, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) move_mount(0xffffffffffffffff, 0x0, r1, 0x0, 0x46) syz_usb_connect$cdc_ncm(0x4, 0x6f, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5d, 0x2, 0x1, 0x18, 0x30, 0x3, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x1, "ed"}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x6, 0x9, 0x5, 0xb}, {0x6, 0x24, 0x1a, 0x2, 0x3a}}, {{0x9, 0x5, 0x81, 0x3, 0x208, 0x4, 0x63, 0x5}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0x9, 0xf4}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x8, 0xa4}}}}}}}]}}, &(0x7f0000000300)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x200, 0x7f, 0x93, 0xc, 0x40, 0x5}, 0x12c, &(0x7f00000000c0)={0x5, 0xf, 0x12c, 0x5, [@ssp_cap={0x18, 0x10, 0xa, 0x0, 0x3, 0x7f, 0xf000, 0x40, [0x3f, 0x0, 0x3f]}, @generic={0xea, 0x10, 0xb, "e193c705981691480319206f4c713f19708d1de2622f1e083b688d7004813d0f2bdf25053600454709d1d7583b769c2dc2df929dad4e63c0ff335ec471420b9319730dde56afef885580725cc3c778522a5f049e8b01fa282abdac7e3cd45a16de92d059352fcdcfc6a57ccc943e0eb684db0c8da90e2e62dfdc1088c75015ba4dd1db3d334be41af8fb66befdc03795fc15c0053a35016881b4a41080a43b61808b8a0e82ae5b758685c15db964c69f18fa0afee7ddcf353acbfee73f8c2a298c20cfd3498e78d6fb5c3f49250719a20f98f46829144b3c33977a9abeed64eb55faa0a6da1e89"}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x9, 0xb, 0x7}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x8, 0x11, 0x2, 0xcbd0}, @ss_container_id={0x14, 0x10, 0x4, 0x8, "3453c4beccb79d721b2cc56c970d3024"}]}, 0x1, [{0xc0, &(0x7f0000000200)=@string={0xc0, 0x3, "714bbc3b35214bb88c31cd46fc105d96e03007e85dfff1d8470df2994757ed7fdb5ae807afdad49e6d505e4a8c03b34f0061a4a5c6070982fafe01d2f2e41f4a6997bca3f6ad8cbdf8a2ae6b0ea926982e70420f8637dff5b6cc420582cded97cf161fff94b9ff91c348a465cebd74147cb88efcab4e7bd563a8c945cf4f176db8c90337f74c97af8d53faf283b5285cea4b81fe900bfbd6fa65c36e471132523d40bf66e90b144eb721ef93090e549abd924732babc4a7e203e4980813c"}}]}) 8.582150616s ago: executing program 2 (id=6658): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000000)) r1 = syz_io_uring_setup(0xa0, &(0x7f0000000640)={0x0, 0x105cc6, 0x0, 0x0, 0x207}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0) write$dsp(r0, &(0x7f0000001300)="cf7a7976071f419cf18312fe52a5dc98bb58624d3de9e47d6079f609b47f36da56a364ab081e89c12d9cefee785ae3949a617abe6594f538f7c0f2855494bd", 0x3f) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_WRITE={0x17, 0x8, 0x6000, @fd=r0, 0x7, 0x0, 0x0, 0x5}) io_uring_enter(r1, 0x5fbe, 0x1, 0x6d, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010400000000000000000500fffe0900010073797a30000000002c000000030a01020000000000000000050000000900010073797a30000000000900030073797a3200000000e4040000060a010400000000000000000500000008000b40000000000900010073797a300000000008000940000000020c0005800800014000000000c4000740ab487b1b512f33a8dbd67a8b35f2405127f309901ea13e31d5810f85eae8f528c938c24abb1b1abbda2e7fa6e0758629bb09ed64a8ba5b2ef3c3591fd06d7e10d93c0857ecac854ac51ad69639d98adb2c1464e444cc1a6a2e7ee244622433b51f58606b063f4938101a7e764c957eba2e913b2ac10435471fa769740a1275cb467e5264b71bc8727fc12e9aba46e4a8abf3dda91e0da608d6a0a35573d5524fb25451cc23051887de4df85c8e771260c4943e78905aa1e7493027366ed1bea0d80304804800018008000100667764003c0002800800"], 0x558}}, 0x40) 8.096508108s ago: executing program 3 (id=6659): r0 = syz_open_procfs(0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x4b, 0x41, 0x46, 0x8, 0x1660, 0x932, 0x80ea, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x5, 0x10, 0xf}}]}}]}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=@updpolicy={0x178, 0x19, 0x1, 0x0, 0x3, {{@in=@multicast2, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80}, {}, {}, 0x0, 0x200}, [@tmpl={0xc4, 0x5, [{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4d6, 0x3c}, 0x2, @in=@multicast1, 0x3507, 0x4, 0x3, 0x7, 0x8, 0x4, 0x1}, {{@in6=@dev={0xfe, 0x80, '\x00', 0xc}, 0x4d3, 0x6c}, 0x2, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x3501, 0x1, 0x0, 0x73, 0x8001, 0x4, 0x7}, {{@in6=@loopback, 0x4d4, 0x32}, 0x2, @in6=@mcast1, 0x3502, 0x3, 0x1, 0x7, 0x5, 0x3, 0x7}]}]}, 0x178}}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) writev(r3, &(0x7f0000000200)=[{&(0x7f00000002c0)="69fcc5d50c", 0x5}], 0x1) r4 = socket(0x10, 0x802, 0x0) write(r4, &(0x7f0000000000)="fc00000018000703ab092500090007000a070200000000020000369321000100f9e553b40005d0000000000000b7550c8292773411419da79bb94b46fe000000bc000500ff006c6c256f1a272f2e118934d07302ad031720d7d5bbc91a3e2e80772c05defd5a32e280fc83ab82f605f70c9ddefefe082038f4f8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48f6f0000080548deac270e33429fd3000175e63fb8d38a873cf1587c3b4100"/252, 0xfc) r5 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) r6 = fsopen(&(0x7f0000000180)='hugetlbfs\x00', 0x1) writev(r6, &(0x7f0000000100)=[{&(0x7f0000000380)="eb803814529e4adf38a49686804f28deeecc89d8432d36fb5bac3394688bcb163c4032dfc25f6fdb446d7ccfb30caf17fa30f17ba88f33f63717fd3f83d5ea2b916886678fddaebcfe8e7aad3d3fec86444fe5f6ce", 0x55}], 0x2000000000000033) read$FUSE(r0, &(0x7f0000001200)={0x2020}, 0x2020) r7 = openat$full(0xffffff9c, &(0x7f0000000440), 0x40000, 0x0) read$FUSE(r7, &(0x7f0000003240)={0x2020}, 0x2020) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, 0x0, r9, 0x0, 0x46) ioctl$I2C_RDWR(r5, 0x707, &(0x7f00000000c0)={&(0x7f0000000080)=[{0x8, 0x0, 0x0, 0x0}], 0x1}) socket$can_raw(0x1d, 0x3, 0x1) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000480)={0x35, 0x6, 0x0, {0x3, 0x0, 0xc, 0x0, 'streebog512\x00'}}, 0x35) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x8, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="180a0000000000000000000000000000850000005600000095", @ANYRESHEX=0x0], &(0x7f0000000140)='GPL\x00', 0x7, 0x9, &(0x7f00000002c0)=""/138, 0x40f00, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 7.908823134s ago: executing program 2 (id=6661): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="1201000000000020bd28710000000000001e0902240001000040000904000001ef31a0598eaed13a8e2587030000000921ffff000122020009058103ff01020000"], 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) (async) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$FS_IOC_GETFSUUID(r1, 0x80111500, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x2, {[@main=@item_012={0x1, 0x0, 0x0, ')'}]}}, 0x0}, 0x0) (async) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x2, {[@main=@item_012={0x1, 0x0, 0x0, ')'}]}}, 0x0}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) accept4(r2, 0x0, 0x0, 0x0) (async) r3 = accept4(r2, 0x0, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r4, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) (async) setsockopt$inet6_int(r4, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) (async) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000000)=0x5, 0x4) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x14e22, 0x0, @ipv4}, 0x1c) sendmsg$alg(r3, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x40010}, 0x14000012) sendmsg$nl_route_sched_retired(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100)=@newqdisc={0x24, 0x24, 0x0, 0x70bd25, 0x40000004, {0x0, 0x0, 0x0, 0x0, {0x2}, {0xa}, {0x0, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x8000) recvmsg$can_raw(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)=""/53, 0x35}, {&(0x7f00000000c0)=""/26, 0x1a}], 0x2}, 0x40000142) socket$inet_udp(0x2, 0x2, 0x0) (async) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000009, 0x1010, r7, 0x23277000) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000009, 0x1010, r7, 0x23277000) connect$inet(r6, &(0x7f0000000200)={0x2, 0x0, @remote}, 0x10) 7.047918894s ago: executing program 1 (id=6662): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[], 0x80}}, 0x0) creat(&(0x7f0000000400)='./bus\x00', 0x0) truncate(&(0x7f0000000040)='./bus\x00', 0x8) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000012c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000300000058"], 0x6c}}, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r4 = dup(r3) ioctl$BLKZEROOUT(r4, 0x127f, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r6 = dup(r5) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8931, 0x0) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305-generic\x00'}, 0x58) r8 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) sendmsg$nl_route_sched(r8, 0x0, 0x2000480c) r9 = accept4(r7, 0x0, 0x0, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x44014}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a90000000030a0300000000000000000002e000000c00020000000000000000010900010073797a30"], 0xb8}, 0x1, 0x0, 0x0, 0x20008011}, 0x0) sendmmsg$inet(r9, &(0x7f0000003100)=[{{0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f00000005c0)="96a67b36bd06304a08a67f14f6c3881ca6167592ce060670a396f8ab05ace2caca6b2a", 0x23}, {&(0x7f0000000500)="fc484e55021886bb", 0x8}], 0x2, 0x0, 0x0, 0xf400}}], 0x1, 0x0) 6.546812556s ago: executing program 3 (id=6663): socket$kcm(0x10, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x8000000003c) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x90}}, 0x0) 6.212152538s ago: executing program 5 (id=6664): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x4}, 0x0) r2 = socket(0x6, 0x80805, 0x0) socket(0x400000000010, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x11, 0xa, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$pppl2tp(0x18, 0x1, 0x1) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000640)=@filter={'filter\x00', 0x2, 0x4, 0x548, 0xffffffff, 0x31c, 0x0, 0x31c, 0xfeffffff, 0xffffffff, 0x480, 0x480, 0x480, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0x20c, 0x230, 0x0, {}, [@common=@rt={{0x138}, {0x0, [0x7, 0x3f3], 0x48004, 0x9, 0x0, [@local, @loopback, @private1={0xfc, 0x1, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @remote}, @empty, @private2={0xfc, 0x2, '\x00', 0x2}, @loopback, @empty, @mcast1, @dev={0xfe, 0x80, '\x00', 0x1b}, @private1, @dev={0xfe, 0x80, '\x00', 0x40}, @remote, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, @loopback, @private0={0xfc, 0x0, '\x00', 0x1}], 0xe}}, @common=@ah={{0x30}, {[0x4d3, 0x4d5], 0x0, 0x3, 0x1}}]}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x7}}}, {{@uncond, 0x0, 0xa4, 0xec}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@private=0xa010102, 'syzkaller1\x00', {0x4}}}}, {{@uncond, 0x0, 0x130, 0x164, 0x0, {}, [@common=@srh1={{0x8c}, {0x6774475f98909cb4, 0x0, 0x6, 0x0, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2, @mcast1, [0xffffffff, 0xffffffff, 0xffffffff, 0xff], [0xff, 0xff000000, 0xff000000, 0xffffff00], [0xffffffff, 0xffffffff, 0xff000000], 0xa9c, 0x1801}}]}, @common=@inet=@SET3={0x34}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x5a4) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) 5.954649751s ago: executing program 1 (id=6665): syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x402c582b, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r2 = syz_io_uring_setup(0x23d, &(0x7f0000001080)={0x0, 0xe5d, 0x8, 0x1}, &(0x7f0000000280)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r2, 0x2def, 0x1a38, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000380)={0x2c, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0003ed000000ed03"], 0x0, 0x0, 0x0}, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0x1}, &(0x7f0000000040), &(0x7f0000000080)}, 0x1c) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) r5 = openat$null(0xffffff9c, &(0x7f0000000300), 0x82900, 0x0) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) recvmsg(r7, &(0x7f0000000d40)={0x0, 0x0, 0x0}, 0x40000061) syz_io_uring_setup(0x3a35, &(0x7f00000000c0)={0x0, 0xd2fa, 0x4000, 0x6, 0xaa}, &(0x7f0000000040), &(0x7f00000001c0)=0x0) syz_io_uring_submit(0x0, r8, &(0x7f00000002c0)=@IORING_OP_STATX={0x15, 0xb, 0x0, r5, &(0x7f0000000580), &(0x7f0000000240)='./file0\x00', 0x20, 0x1000}) syz_io_uring_submit(r3, r4, &(0x7f0000002340)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x1}) r9 = openat$cgroup_ro(r6, 0x0, 0x275a, 0x0) write$cgroup_int(r9, &(0x7f0000000340)=0x1000800000000a, 0x12) ioctl$ifreq_SIOCGIFINDEX_wireguard(r7, 0x8933, &(0x7f00000007c0)={'wg0\x00'}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)=ANY=[@ANYRESOCT=r6, @ANYRESHEX=r8, @ANYRES32=0x0, @ANYRESHEX, @ANYRES64=r3], 0x48) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r12, 0xae60) ioctl$KVM_CREATE_PIT2(r12, 0x4040ae77, &(0x7f0000000080)={0x6}) ioctl$KVM_REINJECT_CONTROL(r12, 0xae71, &(0x7f0000000040)) close_range(r10, 0xffffffffffffffff, 0x0) 5.471204552s ago: executing program 2 (id=6666): openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x400001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x801) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0xa031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000339000/0x1000)=nil, 0x800000}) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0x2a}, @TCA_ROUTE4_IIF={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x800) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000280)={0x8, 0x201, 0xfffffff7, 0x60000}, 0x10) r5 = syz_open_dev$vim2m(&(0x7f00000013c0), 0x8, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r5, 0xc0405602, &(0x7f0000000000)={0x13, 0x2, 0x2, "9611ba5a0000000000000000e8f7fa00e9ffffffffffffff83df00", 0x2036315a}) 4.875075653s ago: executing program 1 (id=6667): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32, 0x0, 0x3}, 0x9c) r1 = syz_io_uring_setup(0x23c, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100, 0x0, 0x128}, &(0x7f0000000500)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r1, 0x2ded, 0x4000, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0xd, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r0, 0x1) sendmmsg$inet6(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="77ad70fce78c482afc347b715b31b7a4573de1", 0x13}], 0x1}}], 0x1, 0x1) 4.386230522s ago: executing program 1 (id=6668): r0 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg$unix(0xffffffffffffffff, 0x0, 0x16101) r1 = syz_usb_connect(0x0, 0x62, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000fb5d7d086d04c308166b0102030109025000010000000009041f0000ff0100000a24010400050201020724070500000508240805040004960d24060101030200010006000609240305050306058109240306010304050507240405"], 0x0) syz_usb_control_io$printer(r1, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4}}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x38, r2, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x8, 0x27}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xd}]]}, 0x38}, 0x1, 0x0, 0x0, 0x44850}, 0x20000040) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_POWER_SAVE(r0, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, r2, 0x200, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x8, 0x74}}}}, ["", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) 4.090284769s ago: executing program 3 (id=6669): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4048aec9, &(0x7f0000000080)={0x4, 0xffffffffffffffff, 0xffffffff}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000002100010000000000fddbdf250a000008000000071000000014001100"], 0x30}}, 0x0) 3.970838078s ago: executing program 5 (id=6670): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000840), 0xca800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r2, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_ifindex, @broadcast}, 0x10) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r3, 0x0, 0x23, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r4 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) read$FUSE(r4, &(0x7f00000021c0)={0x2020}, 0x2020) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) syz_fuse_handle_req(r4, &(0x7f0000006380)="a5677f83754b0687c76be56541949e89bbd7c56f946028346c60a61d23a8f9d43dbf9eac36975685445c132c25f139ed4269c2c5cd3a3116fbbb562778c784f869708943197a5a7681f3ff429f6aba9c7b7347d926b98d7d96de5a81b591631f1d99123dd5a2a466a9e4a5b87cab2f28479832383f6341692c34576392c11f306088d7f7b9492a89b7c9080a9d415e7ee86f15bce361265866fd8065fb5a755b15a4b6d48ee401b5e99630344a6ae5857f67a8c89b31fd5003635c481f36a5baff60fd93a7d30511e384b543889521ab32b24bd95e16765458f9f7563fa4c0b0f73ded349951f77d61b881c2df6caa3bdfdb1966b36bd0802282c7bcc47af2977569ecc27c6207e70d40892c4cec28a6cc1c21f1162ed1cc709a5c6d95786f195327865f4d4a50559b10b5dc16dde894fdf59839fda0d92440f9179c227fd2ea3aa7331b5ac73ec9c3105d86790c32cee0c56cc1330975736293be3a6a8eadbf054a51d7df3a2b8234cef7ea0b185b47d1202a174a531d16e7af6e3ffd37d48bac8271882df85ad015397e39ac75cce6c84f86c4b26affb3688542790cda45065ae81860cf45f65771d7d21977d0cbd89403fc65a6633dc97125324ec319981eb68786f35937afdd32018d47da63a1b5b76249d7c7c0ddb9f1de45839c75b9fdd785c6b766483c0c386e338eb2b9075e40852547dfbe2c6fa0ce798973ab41a98fa50d319bc08270f23394bf757f1193f09536c2206a3093f237eb2e668ae1315b351e30372b86cf46f2111856e715dc77af189150a6e921f2dd638dcf95c9a84ff309ae620465ec1fa9a6d0dba4977ca229e11ec77b06fc59d7e1b4cd2d3bd7355f48e20d3a903ddf47f800cf09186896cbbae637086f98e2dbeb1a9304ed990670cd61aea0d96273fbdc9431372517f46f483fc25f0f568b6c60f700306e36575192a03e0de180a768c8e1e4c777c079a2c23f1a5cc38c36cc5987abdbf0e871a640d2084acae7ae16deaefaf241e0b7e9bfc6569aa1db128a641f08fa94013e8f5a0221f14a9482f9e9e3c5fbf3a26cec42aa198da0a30ab8d42ee827141c03f75ab42ce1731606d002c4f45931c110386da962981086d34f7cb3f61b3a10f3ed29de95267b1418a77a74c3873613e4a70e7d47ad80dfc83e4850bc17970d1964e3b1e247234bda749f42f97ad0a8846859bd193385886fe6656b4ace3c0ce68eec5d81cf63143de2032da1f5d407f457515e10df0600d73bb58e783e226b8f1d2a0730885e0aa898b802f77c98eb8e9faacb0188c41a5b8a97fe1403225fbe288aa2060128d266e8f3da0433fe4efcc313c6aab481431366a3327091867d0bcb7aa27945def85a2db764a00722c2099cbd8a252660b2971d56dce6ce7eee622971edbeb16bb61491c41195d5e05c51c5540d6d20a4b31ac573f6be0a014e8b854d11ef0fe5127bdcd24bffb300a81fff5c011869abe53c381fc6dd8c78e848972bc6e0117642876196571697d1f2723cc5f09f73df6cf35e2a17e97d850d99aa5f75c583bab84efccdfb0ac375d8933facc36f0fb7c41954fd13ee3a235f4d9299f57d9ca378bc03a5dbea5b612ca21c500dc8b162554b291069b882272f3c1287888997ae4df2e9530c768e1b991ba7ae7aad1aaa50e80c268898c124e8de984d0cd06775e3c3025a73a3ac80c4899f46511e0dfe82a9479dc0073f0b34ae44a521003bf1618b0c66723b88f91d48c5b2b2aae9ddc1d346484a688da02832d6fd6c2aff88d3ad74b187130be5735daa68344ccd07f6237588c542030b38aee466921a4ea14c1be2a657bd35cb7bf14dc4676db39b1bded4637e27f09c714f60d1654be25159fb1ae719b91f6c2fd1085d826182ed89cdec819f51aa990f81cc3ee6e1e9086266dc41ef12dd1ff2fadb5578026626c471222ab6231fe078cfedf3d8a5e325bd951c18f26c20fc3498bb3bfc8d8e2377c738b69bf7256c541acbfae63343c67afdc59ed4f1ee950bd64b8fce360976778c3b3a10230d9b34feff5991c2d16684c5874f1f026969a9503855674055efe4c9296da541dfb8665275fdc72081213b64ad753eb6db46008b00a3b600073cc99c419bdfb15ef3893a73cde23a08f4855a8b4940c601792ec7dca2fef4ef19e45e4472c68b366aa49be74d6f3675a06edf174f8cf8415207fbc1aa10479c92b5b2bf1517e843b2d7466bef3eac4cabf6499539048649b2a50d0debf78bac95e97652f7cde7370dcf5843f51b33cc38021a91fe16743207ebd5d5d9ab07869c2227dad2fffa132caa7847ed4487e878a2a1436e2a6923c8ff782cef0b4251c862f5b4e2f67ee40844cbc3821c0e04d1aad95e90cd33c818df90dfbb995912b0b9d928dd875177fc2eb636c05552f1c2c573593644d498e62e74abc3c8a1799680d9c39b3d5a26c9b73bea2dd204e4cdace76f055801a20c5b83a383c57983d76c6475172ec0dd0b831213892d4eae542fb3f04d116dccf80f31e9ee7bfde559dc918013e201eae957c715e9726669d2dde6b9b716720cfaf443e1396b7c34f74ab57dd757cb0475004ca1e3ab4c39fd1dc11931519fe261fb9cf81d9a27890e7e3c91e0a2912671e47c0b7916f71380425d28da0ad9cdaa6b7ac07842e93bc35c77a256401a7f6ab5cf3b68f4faa8d3b805ce318f35c68e1df83cae5af72203577605c2951a0694175f4a913aee94aac47ddccd9b15eb13da4c2845e39efb8d9e975afde178cdd899abcfc69d83617517951a17ef65706af60a0baec2bb79b533e79e0f5963b411b61c678369acc7372b9df1b5075e565b617277e6bb61275c95e59e0bfc7e6df726267e89b6093ffed4320349091d56e8e2cea2e2bf36c526e06aed01701f0900f60e8a7bb14d646a1e64e09f164b6a933a901c7c2ac8564e9b07535ef9f52b734d6941a95aed9d705bf72bbb8d3312040100ef57e3b288039a5e5cf8e2af936c9b6f6adb58a21b0f680986d2a6a30b5539c11e0a6e0511f7de87d0ef654144714552c730aeb789a9a373c72f4f816c8766777a4caf908c5d85771be51ad3e79dd588e87b5ba7a3184dedaf0948deccaca2254a411ce7837d211774aab5d222bb6b1d424479afd7fda72f957171137fb8ad6f857bcd241f849cf1681a1203911be23ef75035aa341b577756c9797c2bb389e20b73c6ba75292cdf7fe834eb669b2625f493f4bf32d235f3756c3ec4964c8705e117e2c9baf8d7fc0f8a9a8019849f188ff734b0f98a993aa031d508063874a2d2531c2ae3e543e1ff1efa3c1422cf24beef800e9502350a0cac5f9b0186f6f0ec0722ddc40ad5d10f597c6b3f961714891ca59207b7b68bac6e66afa7a29d845de5d93dfcf7a0e81d68d3908d621c4eab9170d7d7eede983fe661723c38b5268c32ace2afd35e204b1ffb53f66dd4075b2598e98daa1f9ea96c84fd34e33acda582a2e5b52155dfcd529b6e50b128ae9e60393067c6da4af17f84827d8d352c95852db47334754a86d58bf17e3587e9d77a7575f7d78a6a23f84fd991ae141eed524858ae8c915c39ebe380114313d37446625a653aa609ac1bfd1fff40e74e6ad832f04dd1698ff156e40c9c2ff857cb7f9b443ed18ef214fff00bea0f8eaac651b3ad662c71384afa95891abc55dc263b00e3610e823596067c50987694460b7950a86a2be7d415092acc9227ac747aa31062dc993dd81a1876d2542265b9f649536ab9e821a38c1c8d70b09eb128000e333da71a5c818833b43e24c7f339cbd559c62573f631f638db8de589a2f6d0e6204a530bcb8adcd9530e58f76ec35e3ed820ec28097c978b1c186ad052a4a9fd25bef41e2bdbb173f5a6c4897347b80d654a28464daa3957c0c8f4c2e0fc5c443db75d16a83d7ad556f879e4ad0235870a02d37c4fa54f3ecb37766636fc9948f9eb70fc79416581cab02cb4685d15912de6d886511bb462ee20db6b5e2a92e4880aedf400ff01626a64c44a9f7ed298a3bac9dac2f60c27028227cc4d85fafcfce7c8bda3c701c477c13da39f6150ecf6750d8eee011dcaf2e2ebbe9b89da0039837aa01e5d4054cdc0191a2d8e8c5d6cca5ab3964d63b5999057f33bf4b12af94cf45323c2d4612593a82440847c1c391622ebfb5b9f8270c860f4ecb1284ce4efc85b7e02dd56d3dd14db7a8ffdf2c4e55528dcdbe3584493a46f0cf7e004d1e0d8a2b3b5eafd3bc3ba0755b08a833b21b69506484485048309e1d81ed828e53d3806de8c919ac9fc00a9e96c2f0927ec8bbc36f35c75294d654deb0828ce7098acf21bf812d43b001ab034dc7f3c2daf0dc6db479301f01b62556207be4ec295acb2d1429a38e46bae1098f4afc098fb3e623f87d58d54e8994c3476f8480e9a925345e6ee5b0094303beb3bd74254ab735a19ddb3e5448804507614a7b2475bafb3989b1d1beaf123d30d06610df08654e42f10b425606af01271f90e27a1ab9ce8a6ab4c53c0849fe59d014664d86079668b6ebd6aeb3f50fd0166bf7c009b25a52192611cd3083ff53bf72b78f44f1ab030940b08236604c14ff4320e55a17e9201f7f45a2b98b509290241336f8ac8fa453fd2786deb616c3055bebdc0e33c12168f7bf8c3294bfc1aa3f332ee0bb02e38d5c46c28ae86a3a0b9534f537af7574712ccb0838145d3114a4701ef5cc0b66eb2832eeca5d16d55ded9a5fa22cd38a28dbb89a7b5a5d69d1a142498eadcfa5d0a995b01d82d8e0df438ec77f611e6a0b95c2c85cdcc474e69fe024ae117e1f99524ba9277fb67388583d12ec5a7ed9c7f5e7d96713d6dae8ca5d5981fe201ce4cfd0b3bc55c82fea0eae917dd7b55e331721e8925b58f904492b1e16a865fdfb2d24fd5e851ed6b98fe434ca11d1c2e8d32342b28e3ef5e5153b6f20d2913a63e5c54ffbfc6db7e15f865fc6eef390e71e9d9c83c813250db519fd9af5415e064ac8eea828bf0fdda2d3b8064ddecbd1aa1f80c160fa2f0ac72f7d3e3ce376db611ecc1241d38ad42efd721b7662f31162b98493d8a00329eac1834a8a3d4322b6b104328f051cbf14f18e1c7ff736b59b0bef2a7ad261ddf6115c7b0b7d481e612bf0db0967df47543f961d1f0ba86eea56257018216fb3cfe5fd903b348d9fd2f8579eb1bb84f76386e9bf7d433d90c6960bbad273043b8c1b1813b8c833430804f98f9c79f746cda676a45d2b3436985e176e9d6f476ad6083e55540bbdcb8bec7072371e906888da04c73becb45cd0dd2e306233d2843db53eec0fb37f9e17377bc30795a0306049a11a2c1c2aec35947452293d3e1e022e8eb50521e49c2964a44b94ef32b5e03f24b7598fbc02cb86d128a6829f2443e069bf9ca695a7a848c375c131108b0297393f888f0c9cfd2e5f40019582fd9bbe4263b6897c33d1e4eff4efedaf465ac01b9b33ba4cb278596a9f83219540d25bea3aac244b23ed11da95414de7bdc9c22f803c3cd63fdded6e959adb021e8a832041200288f4b5bcd11dea422d04f8c51dad15afa5aa6adb306bebf2c02967728cb5bad42e65d3a56068c1a7d0e1d5dbbd34e742e10f0ba28043dcf64ba88917352463f2fbddcc486baa378e3e9af9ad87af63be07538e44495d46ac053048bd8826455b8606a88a049de6e5cc2ac14091896ad98b7585f09e9fa9d27e6a9db9db9f4a3900fabcf950ca2a59174ccc939c667a5364fbce1206ffa48df37bd0fe45dd1d478ad927c8e556478d3c1f0878aa7b916f9f78daeb0b51b4c72635b671b80bc0c2f2e2624d2a5bbdb986e283eb75216757608ac17e78b80804eb6450486b10ec91b0977b5701834e92ff38148a52281967f5f5336dd33b9f6058beed37006c73b318475e9a0fa06915bf310c0c9ea6b41313ebbe3a50a9bded7c07c67c1fa7da58d25c5b6f1dcf7108b1e51af59efcace199b961c2cfdb4b2385c7032256c8a23f51522afc7d99abbc3dafe81f3444201c51e633f1c883cba731fe70f73db2e3e15dda5be5e2fb08db9378c7226cf56982ec4c9cb434e710eb114835d9644a419e2c838a7f702b09a1194c11046e28ca8e6fa948d457ee2971b3fd450ae8f062381ef0e83e843e1e34e67c45e5c581c9c1a46bb655f9579a1a1179c43754aa3f110da6a046be02e754f7968f679bd427fbaf3886d69f5388ebd7891102a08a534be389ff65ca0d973acacb9384ffc4a098948c1e4c8fa815ddb743288e49fedeaf0f9e4e06e3947cbffb5b46167688fb70500575bdda1145fc134aff5e7055202046f5d09e3f40976d33c6d7d2075352271b4ab5c60e90e11649843105203b20f81576db3c68011932e14f9922b292f5887f2f4f99820864bdcac82308605456b9111793051fa2d5e8ac2ac39ea45352899bb8b58c51defdc8f50afb43d827d997e8bff1fd1d069ee1dcf723f31e4b8d32ad28261ab35d214559a2634628d21bb66c3be1b47e9f6c581cbdaadcaa5cae798bad35218bdada23752f39ce0c1aed4fd85ce5caf3e03d5634d2ba55c0cf83ba9683973ed657e555bf95405af6d60d38e66c21e790c9aca038942cbd692addc847a1abf6656e8b9ab69bc9e9620d1c2b61cc4503a2d73541eccfbbd2f9eb5e6e27da794958985ba2f5b1dd0e22375bfe62b242900987cadcee9726748fd7ac90bb18644946374572c1940f32f2e3e502be96a1b7594d33e05e6e1e933d39a316ed58d4ae78077161e1de86998f26560ddfddb94f39fb1e13fed6c4b1bf14776aa4cf41f3bedd9041f07296d3367eac34e5f727c34bd2d7afbe1ff08a40850963514a82c1d8682a14b8d0298acbb08aee84c824a3a46f196ee531c1979a58fe7dac903dba384a36ae569db4d88f8e4e0c43d783282c94a67d9c3c5196c3759dc99c75012aa214db5eae7abc2ea0125db03e11031769eff90ea1d0a9be73c1647cd22f3089c5ca4b609d7d9f15addb52fcb93fe0202473a37206fc719f7b3bdeb08718124e5b3ce146bbb107108d38fc6c14c821275c3fed5339751968e25a32fb26e998e1e38273a2560f99c6fed323902aaa7e2e46ed62004e55290f07937c798edce3215f6f2aeb2386ec58821be8b2b52b5fb832e4b76ccd37e4fd228a96a613458b83508ff7215eee254516ef34be60756d8134563ac408c854ae3698a5c77f9bcd26643ce91133ef2510b5617d2eea2c76ead2f19b1b6441f2dc1dc148fa0dc451b6ac092cd427084a21ebe1120f854fa54d5d1e32e2c92a3c593be217e9b50963e4f71a6dab78877039be9d1d76898e622e213106a845c27dca6a3d54fae8642bc6749b2542a10516c2909f77c0b8c3d3bf293222581e385a49625c44de99fe517c0b0e97289140ca8daa587ba71d7ce3162e889326297616d7d000e382ffbc07077f4195ace889c0104eff83195758c139bb8022ac3682bd02e1dcab7b41c6a0d39cc27818ac183e8b1c13ceee45c3d085f884b117badf59e633e08a108d2e74a8409e87bd1e9a3617347e78f96865e5851b2b5ce5b88562a51cb37fffd6c4beb3b889c8fc58180b47921b9b645e11431673981d378f4272525a58785a87cecafee244538ce9eadb820273df18d7b7139ba1ca2d1bbafbc9f936535bb6ded733642aed5023556ffd72c7e826fdd0dcccbfb7ceca1bcb6901b0bec8006eb10c404a865b55bf787f5d398af52bd9c30d07d0258dfa1a74729cb12b8f0d2460e67e1c096fd088f5c310e9c7b05898b62d167e00a17c3354e2d79df34812081c1e97852af9d731a0d594c6ea3dc121a3f2c370e77840477d823843d1a36c653897e296f3f6e0c029d5986ade44c954ab21f6d55740348f151db7a9b6ead4460668022bb2e9db6cc8b1efd71f305c9ed8be55c0e83df1c122380328616779afe30157c9178ecdb2e5525c51883053aa9a54f305a11a8a1751712702db1e952a313142a2759e8330ce6bab047e430b3d85d7870de3a9b120c4ded80e0c9929f26e534a642ba8fb8c09d030d0d87b11bc3c4c5867ba55a168fbaa1e340b7daf96899e0320ec90effdfae089c7222bf6fa9b37f7133c2176ba017b5b7b0ac3ff29ae24b3b3e942522112ce9488923d9e82640633db2a3c42a9a3221c4cdbdf9a1d922a120d987e4cf4bad51c963b10beab968e3cc8c631a22d041ea00f044f28a995dfb9480c1cbaf14c9454d8d3597415291c570bc9265f0f08741f0ac713236342fcadf1d3fe68d5cfef9b61f23291e1c2e97e30a4461ff4e2ef89cfe7f2b34c5adfb5d5027ddada4af2484217e470c108b43b13594a3b043592554e3e23ab95714b289fc82933363f800c332699fcdafe01b74b3726b63e001841def4f853985bfa8fd7ac7b56dfcb0ae61c7c8592925843e8658f888eb4016c855d94586ae880fb0000e18352098106e1a04fa6d1fdb7dcb476b8f9d86f307d42e42faa867eb96626e9679fbe50a4ed0d5deed9ecc6e0b1c0658e066e1d1cdcb7daebfdf47d59977a5eb88a6fa819a094e424f2dd7afa6ed9c9cc528a185dcc95db6e4b7f7fb7e6d8c3242be12a9c51583b042028fbb69dafeec5f6273f63e9458067e07dd50b9728506ba9af44d2195de6bb1fbbd990597abea35021bdc8a77d9eaa144abe006a7ea93a8b87b0da87a673fdb924673f1e40ad4d52b5586c834619e57459b968eb4b3f0a4a1a54e9de0d3382f78846c768108fd00ca85843e739c32dfae00332f03d7a2502938eefffff610f51973c56b1cb68059e3c8907ce235773e6257593b00d0fe45d3b64065dce0d8de803053d83f0a12b7baaa38aa819ccbed4c1033f0a7f2a153c3a96dadb81b1273ad80c4630641a8318b0733f7ceb19e708cc4b1a2b25ec1e799277ed5dbd9045fdaa20c9a20f24b469e35b5227d49051d4995718fd8fc66abc4084f8e793b80755361aa7aefa04f49ad5f2a5f7cc530ef349c7107a519931282749fdf861e7ce0662d1eb3f72529cbe434276ee6629c6453d5e03a267132cf054ec92e54da8af68bfe13c3d2334dadca88bdf8a86bab32652ba46f8564cba084401ecc15c2963599972c5cfe71455694912d8f8d8c456a66acb436569f47e38e27837ef493bf5cfecb2ecb130e1c044f7866e79bfe753c29de20c1c86cde5e078778b50003b4bf4b72e29cec3665a2f6171066babfc31398d74406613c8ca6ea1da3386eb3066bbbfbf14f645a650cb7a4abf2cba86b98ad323f6d6081085e9f87b7e2599679f799b248f0280b5649d2d93e472ab41f8b0e63b2bc9b2f0a80673646233d8143733d24133cd7448c0431b81024bcbb3528dd3ff70de886194a2fb7adfa345bb3cebba2a88d0dfdfaf9f353426b5c34dd5b273cc79559e2adcfc566ce30bd29b2c93c037bced7c3365a708a2a928b0bbe42ed877c805004750cc0744ed37b59adaec120957e6d72c42e147a7fb3241b409e13ea519fe1052cdf4be1b3c36ef93e402800b24ce141d44aff6ab2fb58df350407ded1d5b6a6b6d47f5d20e14fdbd908839dd004cb9d420ab38e4fad169e5bf95ae201974fddda064844b4f039f2ef3b98044ec50f5f3d572b6f5c16d4a093b56bef2bf52707ab8f44a6a3aae8dc9d850b729e5b24e1daec272f049917d0d5dc4ff2ee49c027502a00133f1a280393a0bb623bf1c6ade7c42a9fe1c7c0096f90847014ba2f79984fae9e65c940cf2ee2a9a2a2fe4e91b8a55162af7babd3cb40926d455aeccfe4932172291d456194b8fe34d6e888a4294b057a884b7ac346fb5fad9354ca3d6efb63c019a3ce0c8012a397016c219f4d236bead3ca99ab48e24a33273a98008446a2b35a05d2a0fba6cc329e48c50ad01013725099260a5e9115083bd9bd1410d998c89906d5e3d5c1021ba2a4090454815c3d55c94cfb0d3e33270c5669973dc64bd25a656fadd4f590873e000995346e9875d4427c7e5d55e84d3ba5645643cb7eaeee51aa94fd91809aba3e03430bfb07ab8e3fa85e18c7642c3366c8023fe273a0e5049ccb90204f328fda7f26ca47411079f9daeb172b7800699d2d5353d1e2cdd74f7ac7742a8b75bf791594854ff359903172ab68dc15e90f037f57ef572d0945091125cb65f2db5e6e654218b76d5fb954d165eca31bb0f07217922590824b9ec6cdbe36832072e96a9857419fb373e4d55e03345e519aa5e9f23bea7ddb19e407264c790485f2c1353792fa779ae41fb73ab0fc23e293c8f72b72da9576e2a20ec2d8d49a9490d6129cf46f8164c25b24129425c2487e9cf2a97f1014f5ab10d022f9a9cf5fc9a67ac82ec65141ca857e80af4ce8dfe227200535747f504b38423bbbbf85569b991de739a0433631a94730df99046f517070e5ba178b58278cdd1a82669c643431ff030a0df370c34dfca3f8c4ea0350c9dfb8592c128bf601b3ecc927b030c7c578fd6aaa7e413ee4acef0d7ce01ab66be680c023caf69704790d0f31734eb44533e55a43178731a25cd9e6021a58e0251f96b66c19caac7ae1586505a80657a2b71ffe57502f63125fcf3c4ebbf3342d18e331a6f03e193d24a58de6de00f498f47aaae03cdf8b9490dbf18c0c72ca4dad051c251beac3026419cf68fb57b97b509c54bedf10ff2d1dd208d3334728e5a1500aefd2417e66293192a7c95a49eabd92f7a37cffc975a97b6adbf40287033e7b4c7468059bd0571f7c56181b7d2bec2ad64688f1a1e45f4d994cd58e91745731f813390ccf387f2a05a09b1f11f57a75393b74c9adf0d9d928c19ac3718a9b9741d158c5ca28bcaa78ed55724150d374ecc8c5885f397e32491f10fd6b6d2acf4036292d308f8e40ed9efd7ad4f56f2a8cbc2a7684d6add726d795a0821a0d36253cb7b76c353f286a07514ce7bba44560fdae2a44a654cd6f907ea86ff4d00a73d03a1e07b28d264367d931b3ad43ad69819a49cf4aafd00d69fcc710f8174c6a010d452494a6b6a6577ee8d039b2f01ed3937ba318d4ca057384ac482c93e3c1e5412aaec5fadb098bf3a631927df892aaa2462653c52d65f1f8630033ddf87d747f95e4d09bf6f56e60e7c4bd3bd175c40e4d25530b071ba039abe374565f046cbd6a94afa7372133e16664a3104ba07978fb67f44a1450c8e81abb049ef9854e311fd97d12d282f7206369ec53c95d9312224b49a96bf661cc389a615608e86c1810c0a27439f2ce75ab9789546470836d5ad777bf6edaf10e4eeb45da29421714520361f12f3dc23ccad1811e184318ad7b0468d937ec550ba216c673fe727388a52bf7921ef41fc0456ee8f13bb4f2127802b3a29aa32481909c9a2e04d13477314d4957be0181b8b00c43dd729081893fe8816e8db8c0af5f0defd0685d379d3ff5847039cfae79db4eff4c923b1214a43d0d953729c47f28d34976af9f82e9bb834af8521343f1edfcf4ad87d9b9530a2a74ab8d8202e12b3472c257f791aed24f8a6cda7017f8f3273311ab1ee47cbd98b281af0b547b094b06f41b3a73bbf6619125ddbc192231057997969d024dfa9583f97dae77faa866a8679f3dc699aef2a26826c10e7c4963868c2d4f715ebaf51fef0e86c75c0720eeba4c78a98f3c9356a1c50e75111f4465ba1465b7e0c142dc3b", 0x2000, &(0x7f0000001080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c, @empty=0xe0000300, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) 3.76464353s ago: executing program 2 (id=6671): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x256c, 0x6d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001440)={0x24, 0x0, 0x0, &(0x7f00000013c0)={0x0, 0x22, 0x5, {[@local=@item_4={0x3, 0x2, 0x0, "741cb976"}]}}, 0x0}, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000000), 0x7fffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_proto_private(r2, 0x891f, &(0x7f0000000200)) close(r1) fanotify_init(0x200, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002840)=[{{0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000500)="96de3aa060bd33d6df9c7b5c46b727c38f64f2dd081c6c8c2a0662471c09be015c4744d48e13e4ab44e02398290fbc5e2f407ce9fa81afe29bc349706b6dd0762a61b85c1b0b6b88bc39b12b72b2ed4fe6ce2675ceaa8cdff319b73005c9134157d3ecd3b706619c8136203039930f76c425326cdf03d030c2cf01c8698a36b525cd24e4e2b422e9bc1d1ac8ead55dfc0611755754cdbbd45978bd821183030592510820804ffc5e95144dbba8813511b0363daa2bf902e5501c628c4be07d9d6084e9068ebc157cc6e3c247761b2a7950984c200199eba03610135ea760dca0910a10de2d2d81de025e10360c769985fc4ce86969cad635fb4f30b0758442fd2c8d7a70c3fbe0e2f3191049e68d08d14a7b805473273e0b0b92ec615c8fb40cd06de9830415d80f9973a98713e40b790bf4ff37eb6d01bc163573a0bc2478997be301368a92912dffd764c7e3b1ec40e6485bcce87fbad15c3f689ff386e0a8a01d1b4e40bbccec325494c38d0b189014b8dee6085847766e37f67a7acc0802e9b240620a899d9568ee08c7cd24570a3d25080977cd7f32f2bf3573f7fc81053ec0ad9daf8cb38f5024101ef68d23e5ecb454576d46cd54db9baf50ef822ed3918603c76bf014edf049ab2db4c98feb672e61244bc97cc22a8601fc2063ec6f16dd5aac19e627b43318e530511943e044a577d8b2055547ad1f4c69700cd6c7a9df3903bc483d290d1dcb88811f694f547792ac474c9c6c882ba2ce4f9bd0612bb8457a7040a5bc09a7ad7e0e544b31b0727525ba812736476ad721d2c61d1012a47f527db627b52fae514ccb486649ae38bda40ddd654b3bcbbaea1997cf831f20e9bb891c559a6dd79caf571a496f0d93fa246aad48f6f2949bb1cc4c0c74d8598c6dfaec048c5692cf1f8a362b3742659c3be4b96c3859b25e73359e9a826cf6822314e2563b6ba3eba826e54c67d364367c473c6ca7a8085515e709cf7bb8d8880b5ecee24f8bfccce8e4fff9f2f8c3f2e3ca3c21d7bcf11214b7eb7fb4b98c1244d96db338df454febd17e5ff2818b34ae79d4bb812cf09af7b4551ed5314cc5f828af64ea5cfadbf5eba51d86fde78965fcbe2e8e4570a91669febdc9d33d7d20695dc8624f4a7219ea791520f977d846145be1dccc1c0655deeaf4dc3bc150a3523b602a9457a1e4976b4c1a5cfb0ee81d54eb2304605fc6d00d4593d629a9819feec058644c14a078226919fea0755ce3c827602c5a39f93e0c261addf716ff3943bce2699b1baf95d8c51769d79078dafba91ac1ca338c4302cfa61a449b26ce76e66c10bd7a422522de81cac7c26ba2cfb4b27bd443de2e068ded85efb3773814289efb3dcbe2200099e43397bf9064a6455186827746b5ec02e3a53926fd6c68d289c6c4b9df390ff5bcdac1958a1159a0a5f814b846e853839db32e29e43b2d640ca53c0f9084d83a0b8a86a4333ef50340860b4bcb781978af0d01aef55611ac1ed7f19d5ee0f8ea24f83562c9e9e51ff3e95146937cd7e92bfe5324f12d3b0f14f4b24d586f21ca3882b29903a8a8830d4ae1c111f06d33f5f996feca315b7df940cfe8e1e5395d990a68d5f1cd3c5a4883071a643c488394d2441be59c89843108dad9474d893dd78d531cd1806079044c40bdee75b3e8d8bce82a0e2f02b1d8c81316fed4aa4b7edfd8e8a90433c12237cba893d9f4a5fea2b4834c87f86a228917839af978769a807f131e24800a1b3397ee982f2c75713dc004b97c68329ce356a1027de124454842740ab6d9a02b3c2538ef7dd49161b35ce4a96c67940b48e4bdde2b35bb5702e9ab7121a8d40c15fa51f79a5453f3e41292020221448f3c52f42fcb720c7172ffe4783277e86910ea0655495fada4b00a793c379d1efe38383d1812dbca6ab733029dc6e8bc3c058fa902ad8df7fc8548aac1b20d93df0825d7acb60ef430dd83fcfa895fe9c269eae652dfa30331d788893f4e969faa93f62005dd52687c0caa8b2f407d65504d0e2fb73241667898def66f0de08b0e5bee255459c1cd45d4cad147621b26b53928dae70c193d22a889598897c58b256e4b6c20b6430ea49f17106715af58967dc210c1a620925391977f4c61e16373b74e468470f444de49ce38dfb52583f46616e2e5044d883f89e46943819d45b1e8b6675e125c555b2976c7877921190fdf8bc3ebe5b9224046b560e3854946d04ae1dd71f73338868aa3a2f6a84773ca11b499aa1ccd55b2aa99fc51e00401af2ecac93f643f1b886646958a95d7421713f07f266c95787d99e0183dcb2af5627814202edae8998183297be9b6b64d19eb53f150c52fbd01318b79520c357ec1b40748c64bcac7fb663a5273246e8988fbda8a9cdcc77d67d0309cb86b509259029b669ed9fd7ae82b31e19f1790edd5f01dff15c28cb7c7dbd29402a3df1467852209c02169b3488b7d7a26c4f20e0f2c89afa86839d7e0e8bafcadf099e06171560a5d4be3f720a7ae68ffaddbe5b0b4743dbb3859cd00c673dc67e266fe4c087d15b68f50cb6717728e6e7642bf7d7c914a4153b75bf70fadc34f7fe343a3276226bc645b54a2c05ad485648f65796739790c9e6ca575468f5d1f5fdbe35620b2b6168b41129ef51fa3b32a812f3dd466ba4714f5a0cfe44bf001f12ae28bfbd0cfab5b27ed7b67445139e5a0370a5cca0bba822ddb7d94152b7d0bfa458a6cdf83bcc2d2a02f011604abc9f59e8fabba5d9225f86f7806df768910436dc1c139f39c77a631359ad2ce62a1288d97e9ac9e142cd0f9ff", 0x7c0}], 0x1}}], 0x1, 0x40011) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000041436120410e5150e8d5000000010902f98a5c01000000090401001186eee2000905821704"], 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001000370426bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100697036746e6c000014000280060012004e"], 0x44}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0xfffffffffffffea8, &(0x7f00000000c0)=ANY=[@ANYBLOB="18fbd9"]) mmap$usbmon(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x2010, r1, 0xff) io_setup(0x1ff, &(0x7f0000001380)=0x0) io_submit(r5, 0x1, &(0x7f00000000c0)=[&(0x7f0000000100)={0x1000000, 0x0, 0x0, 0x5, 0x7ffc, r1, 0x0, 0x17}]) syz_usb_control_io(r0, &(0x7f0000000480)={0x2c, 0x0, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3445}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f00000009c0)={0x2c, 0x0, &(0x7f0000000380)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, &(0x7f0000000040)={0x0, 0x3, 0xc, @string={0xc, 0x3, "063efe32358daf52ebbc"}}, 0x0, 0x0}, 0x0) 3.659098374s ago: executing program 3 (id=6672): r0 = syz_open_procfs(0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x4b, 0x41, 0x46, 0x8, 0x1660, 0x932, 0x80ea, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x5, 0x10, 0xf}}]}}]}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=@updpolicy={0x178, 0x19, 0x1, 0x0, 0x3, {{@in=@multicast2, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80}, {}, {}, 0x0, 0x200}, [@tmpl={0xc4, 0x5, [{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4d6, 0x3c}, 0x2, @in=@multicast1, 0x3507, 0x4, 0x3, 0x7, 0x8, 0x4, 0x1}, {{@in6=@dev={0xfe, 0x80, '\x00', 0xc}, 0x4d3, 0x6c}, 0x2, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x3501, 0x1, 0x0, 0x73, 0x8001, 0x4, 0x7}, {{@in6=@loopback, 0x4d4, 0x32}, 0x2, @in6=@mcast1, 0x3502, 0x3, 0x1, 0x7, 0x5, 0x3, 0x7}]}]}, 0x178}}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) writev(r3, &(0x7f0000000200)=[{&(0x7f00000002c0)="69fcc5d50c", 0x5}], 0x1) r4 = socket(0x10, 0x802, 0x0) write(r4, &(0x7f0000000000)="fc00000018000703ab092500090007000a070200000000020000369321000100f9e553b40005d0000000000000b7550c8292773411419da79bb94b46fe000000bc000500ff006c6c256f1a272f2e118934d07302ad031720d7d5bbc91a3e2e80772c05defd5a32e280fc83ab82f605f70c9ddefefe082038f4f8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48f6f0000080548deac270e33429fd3000175e63fb8d38a873cf1587c3b4100"/252, 0xfc) r5 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) r6 = fsopen(&(0x7f0000000180)='hugetlbfs\x00', 0x1) writev(r6, &(0x7f0000000100)=[{&(0x7f0000000380)="eb803814529e4adf38a49686804f28deeecc89d8432d36fb5bac3394688bcb163c4032dfc25f6fdb446d7ccfb30caf17fa30f17ba88f33f63717fd3f83d5ea2b916886678fddaebcfe8e7aad3d3fec86444fe5f6ce", 0x55}], 0x2000000000000033) read$FUSE(r0, &(0x7f0000001200)={0x2020}, 0x2020) r7 = openat$full(0xffffff9c, &(0x7f0000000440), 0x40000, 0x0) read$FUSE(r7, &(0x7f0000003240)={0x2020}, 0x2020) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, 0x0, r9, 0x0, 0x46) ioctl$I2C_RDWR(r5, 0x707, &(0x7f00000000c0)={&(0x7f0000000080)=[{0x8, 0x0, 0x0, 0x0}], 0x1}) socket$can_raw(0x1d, 0x3, 0x1) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000480)={0x35, 0x6, 0x0, {0x3, 0x0, 0xc, 0x0, 'streebog512\x00'}}, 0x35) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x8, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="180a0000000000000000000000000000850000005600000095", @ANYRESHEX=0x0], &(0x7f0000000140)='GPL\x00', 0x7, 0x9, &(0x7f00000002c0)=""/138, 0x40f00, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 3.128460103s ago: executing program 5 (id=6673): r0 = socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) getpriority(0x1, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) unshare(0x40600) r2 = socket$can_j1939(0x1d, 0x2, 0x7) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) connect$can_j1939(r2, &(0x7f00000001c0)={0x1d, r4, 0x2, {0x1}, 0xfe}, 0x18) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x48, r1, 0x20, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x7b}, @val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x81}, 0x404c884) 2.904475659s ago: executing program 5 (id=6674): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x256c, 0x6d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001440)={0x24, 0x0, 0x0, &(0x7f00000013c0)={0x0, 0x22, 0x5, {[@local=@item_4={0x3, 0x2, 0x0, "741cb976"}]}}, 0x0}, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000000), 0x7fffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_proto_private(r2, 0x891f, 0x0) close(r1) fanotify_init(0x200, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002840)=[{{0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000500)="96de3aa060bd33d6df9c7b5c46b727c38f64f2dd081c6c8c2a0662471c09be015c4744d48e13e4ab44e02398290fbc5e2f407ce9fa81afe29bc349706b6dd0762a61b85c1b0b6b88bc39b12b72b2ed4fe6ce2675ceaa8cdff319b73005c9134157d3ecd3b706619c8136203039930f76c425326cdf03d030c2cf01c8698a36b525cd24e4e2b422e9bc1d1ac8ead55dfc0611755754cdbbd45978bd821183030592510820804ffc5e95144dbba8813511b0363daa2bf902e5501c628c4be07d9d6084e9068ebc157cc6e3c247761b2a7950984c200199eba03610135ea760dca0910a10de2d2d81de025e10360c769985fc4ce86969cad635fb4f30b0758442fd2c8d7a70c3fbe0e2f3191049e68d08d14a7b805473273e0b0b92ec615c8fb40cd06de9830415d80f9973a98713e40b790bf4ff37eb6d01bc163573a0bc2478997be301368a92912dffd764c7e3b1ec40e6485bcce87fbad15c3f689ff386e0a8a01d1b4e40bbccec325494c38d0b189014b8dee6085847766e37f67a7acc0802e9b240620a899d9568ee08c7cd24570a3d25080977cd7f32f2bf3573f7fc81053ec0ad9daf8cb38f5024101ef68d23e5ecb454576d46cd54db9baf50ef822ed3918603c76bf014edf049ab2db4c98feb672e61244bc97cc22a8601fc2063ec6f16dd5aac19e627b43318e530511943e044a577d8b2055547ad1f4c69700cd6c7a9df3903bc483d290d1dcb88811f694f547792ac474c9c6c882ba2ce4f9bd0612bb8457a7040a5bc09a7ad7e0e544b31b0727525ba812736476ad721d2c61d1012a47f527db627b52fae514ccb486649ae38bda40ddd654b3bcbbaea1997cf831f20e9bb891c559a6dd79caf571a496f0d93fa246aad48f6f2949bb1cc4c0c74d8598c6dfaec048c5692cf1f8a362b3742659c3be4b96c3859b25e73359e9a826cf6822314e2563b6ba3eba826e54c67d364367c473c6ca7a8085515e709cf7bb8d8880b5ecee24f8bfccce8e4fff9f2f8c3f2e3ca3c21d7bcf11214b7eb7fb4b98c1244d96db338df454febd17e5ff2818b34ae79d4bb812cf09af7b4551ed5314cc5f828af64ea5cfadbf5eba51d86fde78965fcbe2e8e4570a91669febdc9d33d7d20695dc8624f4a7219ea791520f977d846145be1dccc1c0655deeaf4dc3bc150a3523b602a9457a1e4976b4c1a5cfb0ee81d54eb2304605fc6d00d4593d629a9819feec058644c14a078226919fea0755ce3c827602c5a39f93e0c261addf716ff3943bce2699b1baf95d8c51769d79078dafba91ac1ca338c4302cfa61a449b26ce76e66c10bd7a422522de81cac7c26ba2cfb4b27bd443de2e068ded85efb3773814289efb3dcbe2200099e43397bf9064a6455186827746b5ec02e3a53926fd6c68d289c6c4b9df390ff5bcdac1958a1159a0a5f814b846e853839db32e29e43b2d640ca53c0f9084d83a0b8a86a4333ef50340860b4bcb781978af0d01aef55611ac1ed7f19d5ee0f8ea24f83562c9e9e51ff3e95146937cd7e92bfe5324f12d3b0f14f4b24d586f21ca3882b29903a8a8830d4ae1c111f06d33f5f996feca315b7df940cfe8e1e5395d990a68d5f1cd3c5a4883071a643c488394d2441be59c89843108dad9474d893dd78d531cd1806079044c40bdee75b3e8d8bce82a0e2f02b1d8c81316fed4aa4b7edfd8e8a90433c12237cba893d9f4a5fea2b4834c87f86a228917839af978769a807f131e24800a1b3397ee982f2c75713dc004b97c68329ce356a1027de124454842740ab6d9a02b3c2538ef7dd49161b35ce4a96c67940b48e4bdde2b35bb5702e9ab7121a8d40c15fa51f79a5453f3e41292020221448f3c52f42fcb720c7172ffe4783277e86910ea0655495fada4b00a793c379d1efe38383d1812dbca6ab733029dc6e8bc3c058fa902ad8df7fc8548aac1b20d93df0825d7acb60ef430dd83fcfa895fe9c269eae652dfa30331d788893f4e969faa93f62005dd52687c0caa8b2f407d65504d0e2fb73241667898def66f0de08b0e5bee255459c1cd45d4cad147621b26b53928dae70c193d22a889598897c58b256e4b6c20b6430ea49f17106715af58967dc210c1a620925391977f4c61e16373b74e468470f444de49ce38dfb52583f46616e2e5044d883f89e46943819d45b1e8b6675e125c555b2976c7877921190fdf8bc3ebe5b9224046b560e3854946d04ae1dd71f73338868aa3a2f6a84773ca11b499aa1ccd55b2aa99fc51e00401af2ecac93f643f1b886646958a95d7421713f07f266c95787d99e0183dcb2af5627814202edae8998183297be9b6b64d19eb53f150c52fbd01318b79520c357ec1b40748c64bcac7fb663a5273246e8988fbda8a9cdcc77d67d0309cb86b509259029b669ed9fd7ae82b31e19f1790edd5f01dff15c28cb7c7dbd29402a3df1467852209c02169b3488b7d7a26c4f20e0f2c89afa86839d7e0e8bafcadf099e06171560a5d4be3f720a7ae68ffaddbe5b0b4743dbb3859cd00c673dc67e266fe4c087d15b68f50cb6717728e6e7642bf7d7c914a4153b75bf70fadc34f7fe343a3276226bc645b54a2c05ad485648f65796739790c9e6ca575468f5d1f5fdbe35620b2b6168b41129ef51fa3b32a812f3dd466ba4714f5a0cfe44bf001f12ae28bfbd0cfab5b27ed7b67445139e5a0370a5cca0bba822ddb7d94152b7d0bfa458a6cdf83bcc2d2a02f011604abc9f59e8fabba5d9225f86f7806df768910436dc1c139f39c77a631359ad2ce62a1288d97e9ac9e142cd0f9ff", 0x7c0}], 0x1}}], 0x1, 0x40011) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000041436120410e5150e8d5000000010902f98a5c01000000090401001186eee2000905821704"], 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001000370426bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100697036746e6c000014000280060012004e"], 0x44}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0xfffffffffffffea8, &(0x7f00000000c0)=ANY=[@ANYBLOB="18fbd9"]) mmap$usbmon(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x2010, r1, 0xff) io_setup(0x1ff, &(0x7f0000001380)=0x0) io_submit(r5, 0x1, &(0x7f00000000c0)=[&(0x7f0000000100)={0x1000000, 0x0, 0x0, 0x5, 0x7ffc, r1, 0x0, 0x17}]) syz_usb_control_io(r0, &(0x7f0000000480)={0x2c, 0x0, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3445}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f00000009c0)={0x2c, 0x0, &(0x7f0000000380)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, &(0x7f0000000040)={0x0, 0x3, 0xc, @string={0xc, 0x3, "063efe32358daf52ebbc"}}, 0x0, 0x0}, 0x0) 2.625447685s ago: executing program 1 (id=6675): r0 = socket$pppoe(0x18, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@delneigh={0x24, 0x1d, 0x10, 0x70bd2d, 0x25dfdbfd, {0x7, 0x0, 0x0, 0x0, 0x1, 0x11, 0x8}, [@NDA_NH_ID={0x8, 0xd, 0x101}]}, 0x24}, 0x1, 0x0, 0x0, 0x24048094}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) add_key(&(0x7f0000000040)='rxrpc\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="24000000200001032abd7000ffdbdf250a"], 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x4000) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[], 0x28}}, 0x0) connect$pppoe(r0, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x2d, &(0x7f0000000180)=0xfffffffd, 0x4) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x8e, 0x88, 0x5, 0x20, 0x8086, 0x9500, 0xb6d8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x1, 0x0, 0x0, 0x15, 0xcc, 0x1c}}]}}]}}, 0x0) syz_usb_control_io$uac1(r4, 0x0, &(0x7f00000006c0)={0x24, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 313.653922ms ago: executing program 3 (id=6676): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32, 0x0, 0x3}, 0x9c) r1 = syz_io_uring_setup(0x23c, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100, 0x0, 0x128}, &(0x7f0000000500)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r1, 0x2ded, 0x4000, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0xd, @dev={0xfe, 0x80, '\x00', 0x1a}}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r0, 0x1) sendmmsg$inet6(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="77ad70fce78c482afc347b715b31b7a4573de1", 0x13}], 0x1}}], 0x1, 0x1) 116.670765ms ago: executing program 2 (id=6677): socket$kcm(0x10, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x8000000003c) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) 46.516418ms ago: executing program 3 (id=6678): socket$kcm(0x10, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x8000000003c) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[], 0x90}}, 0x0) 38.162617ms ago: executing program 5 (id=6679): openat$kvm(0xffffffffffffff9c, &(0x7f0000000840), 0xca800, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2432c1003e000701fcfffffffddbdf25017c0000080036800400020080"], 0x24}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$vbi(&(0x7f0000000200), 0x0, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000001ac0)=@ethtool_regs={0x4, 0x5}}) 0s ago: executing program 1 (id=6680): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect$hid(0x1, 0xffffff69, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/snmp6\x00') io_submit(0x0, 0x1, &(0x7f0000000340)=[0x0]) sendmsg$nl_route(r0, 0x0, 0x240088c5) mount$fuse(0x0, 0x0, 0x0, 0x9b087c, &(0x7f0000000400)=ANY=[@ANYBLOB="47ee65586a27801ba72335c9200d4d712a668134e40ec50cbadb", @ANYRES32, @ANYRESDEC=r0, @ANYRESOCT, @ANYRESDEC=0x0]) add_key$user(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x25dfdbff, {0x0, 0x0, 0x74, r3, {0x0, 0x3}, {0x0, 0x1}, {0x3, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0xf8af8c2a9cd0eaa3}, 0x40) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) write(r4, &(0x7f0000000500)="3c67955277b788a9f5c263d5ada47b92eb4fba83327f063aad9ec104cb3c2165849a7e74960f8a5fb6dfc356727e0084420c05a448192e2ed08adb3b22ffccc830739963de42144c1ac3146a20b8d1640fb5bb487f7e40f612f16962c0263c81afb8637fce6a95897b3a13eabb2d14e9d789861f048ed6a65f9bbb9595a1ce1d74d56ff2740b300a1e1a6208da3fb7908bd09b5b402d56d5bae0b33647ee3ab60cae5a01de54bc5ee563f58488797cd882c3ed8df996b54adf32a28aea7ba713854640507f676c95af5221d144596b8ae2aa60debdd27544a9ca5149517e4ce09037c4", 0xe3) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r6 = dup(r5) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket(0x1e, 0x800, 0xffffffff) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@gettfilter={0x54, 0x2e, 0x400, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, r10, {0x3, 0xd}, {0x0, 0xffe0}, {0x2}}, [{0x8, 0xb, 0x2}, {0x8, 0xb, 0x5}, {0x8, 0xb, 0x16}, {0x8, 0xb, 0xb}, {0x8, 0xb, 0x7}, {0x8, 0xb, 0x124a}]}, 0x54}, 0x1, 0x0, 0x0, 0x9080}, 0x4804) sendmsg$nl_route_sched(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newtfilter={0x24, 0x2c, 0xd27, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r10, {0xe, 0x2}, {0x19, 0xfff1}, {0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x90}, 0x54) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r6, 0x0) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): ed pid=30278 comm="syz.2.6467" exe="/root/syz-executor" sig=0 arch=40000003 syscall=274 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1453.268875][T30285] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6468'. [ 1453.283769][ T5890] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1453.306158][ T5890] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1453.327500][T30285] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6468'. [ 1453.337123][ T30] audit: type=1326 audit(1746931445.076:2276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30278 comm="syz.2.6467" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1453.351431][T30281] fido_id[30281]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 1453.359339][ C1] vkms_vblank_simulate: vblank timer overrun [ 1453.538280][ T5890] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1453.551759][ T5890] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1453.563398][ T30] audit: type=1326 audit(1746931445.076:2277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30278 comm="syz.2.6467" exe="/root/syz-executor" sig=0 arch=40000003 syscall=219 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1453.602618][ T5890] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1453.629456][ T5890] usb 2-1: config 0 descriptor?? [ 1453.647449][ T30] audit: type=1326 audit(1746931445.146:2278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30278 comm="syz.2.6467" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1453.685393][ T30] audit: type=1326 audit(1746931445.146:2279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30278 comm="syz.2.6467" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1453.707565][ C1] vkms_vblank_simulate: vblank timer overrun [ 1453.721134][ T30] audit: type=1326 audit(1746931445.176:2280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30278 comm="syz.2.6467" exe="/root/syz-executor" sig=0 arch=40000003 syscall=219 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1453.775000][ T30] audit: type=1326 audit(1746931445.176:2281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30278 comm="syz.2.6467" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1453.828781][ T30] audit: type=1326 audit(1746931445.176:2282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30278 comm="syz.2.6467" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1453.917386][T15829] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 1454.096781][ T5890] plantronics 0003:047F:FFFF.007C: No inputs registered, leaving [ 1454.108071][T15829] usb 6-1: too many endpoints for config 4 interface 0 altsetting 0: 101, using maximum allowed: 30 [ 1454.116103][ T5890] plantronics 0003:047F:FFFF.007C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 1454.129499][T15829] usb 6-1: config 4 interface 0 altsetting 0 has an endpoint descriptor with address 0xC4, changing to 0x84 [ 1454.150336][T15829] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 240, setting to 64 [ 1454.166626][T15829] usb 6-1: config 4 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 101 [ 1454.243169][T15829] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1454.268312][T15829] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1454.368758][T30274] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1454.408872][T30274] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1454.429854][ T5890] usb 2-1: USB disconnect, device number 89 [ 1454.522217][T15829] ath6kl: Failed to submit usb control message: -71 [ 1454.534932][T30298] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6471'. [ 1454.536037][T15829] ath6kl: unable to send the bmi data to the device: -71 [ 1454.559441][T15829] ath6kl: Unable to send get target info: -71 [ 1454.580967][T15829] ath6kl: Failed to init ath6kl core: -71 [ 1454.624103][T15829] ath6kl_usb 6-1:4.0: probe with driver ath6kl_usb failed with error -71 [ 1454.649202][T15829] usb 6-1: USB disconnect, device number 19 [ 1455.007379][ T5893] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 1455.157472][T30308] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6475'. [ 1455.172480][ T5893] usb 3-1: config index 0 descriptor too short (expected 32804, got 36) [ 1455.188505][ T5893] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1455.197590][T30308] netlink: 'syz.1.6475': attribute type 2 has an invalid length. [ 1455.204425][ T5893] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1455.212470][T30308] netlink: 'syz.1.6475': attribute type 1 has an invalid length. [ 1455.241199][ T5893] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1455.256763][T30308] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6475'. [ 1455.283394][ T5893] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1455.307712][ T5893] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1455.331968][ T5893] usb 3-1: Product: syz [ 1455.336549][ T5893] usb 3-1: Manufacturer: syz [ 1455.365016][ T5893] usb 3-1: SerialNumber: syz [ 1455.383405][ T5893] usb 3-1: config 0 descriptor?? [ 1455.403066][T30303] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1455.414262][T30303] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1455.503378][ T5893] usb 3-1: ucan: probing device on interface #0 [ 1455.641552][T30321] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6479'. [ 1455.661664][T30321] netlink: 48 bytes leftover after parsing attributes in process `syz.3.6479'. [ 1455.724326][ T5893] usb 3-1: ucan: could not read protocol version, ret=0 [ 1455.743458][ T5893] usb 3-1: ucan: probe failed; try to update the device firmware [ 1455.798378][ T5890] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 1455.833350][T30324] FAULT_INJECTION: forcing a failure. [ 1455.833350][T30324] name failslab, interval 1, probability 0, space 0, times 0 [ 1455.847478][T30324] CPU: 0 UID: 0 PID: 30324 Comm: syz.3.6480 Not tainted 6.15.0-rc5-syzkaller-00277-g345030986df8 #0 PREEMPT(full) [ 1455.847508][T30324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1455.847522][T30324] Call Trace: [ 1455.847530][T30324] [ 1455.847539][T30324] dump_stack_lvl+0x189/0x250 [ 1455.847576][T30324] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1455.847606][T30324] ? __pfx__printk+0x10/0x10 [ 1455.847633][T30324] ? __pfx___might_resched+0x10/0x10 [ 1455.847652][T30324] ? fs_reclaim_acquire+0x7d/0x100 [ 1455.847687][T30324] should_fail_ex+0x414/0x560 [ 1455.847725][T30324] should_failslab+0xa8/0x100 [ 1455.847761][T30324] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 1455.847788][T30324] ? __alloc_skb+0x112/0x2d0 [ 1455.847817][T30324] __alloc_skb+0x112/0x2d0 [ 1455.847845][T30324] netlink_ack+0x146/0xa50 [ 1455.847865][T30324] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1455.847888][T30324] ? __lock_acquire+0xaac/0xd20 [ 1455.847930][T30324] netlink_rcv_skb+0x2a0/0x490 [ 1455.847953][T30324] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1455.847975][T30324] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1455.848014][T30324] ? netlink_deliver_tap+0x2e/0x1b0 [ 1455.848036][T30324] ? netlink_deliver_tap+0x2e/0x1b0 [ 1455.848064][T30324] netlink_unicast+0x758/0x8d0 [ 1455.848095][T30324] netlink_sendmsg+0x805/0xb30 [ 1455.848128][T30324] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1455.848155][T30324] ? aa_sock_msg_perm+0x94/0x160 [ 1455.848179][T30324] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1455.848202][T30324] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1455.848226][T30324] __sock_sendmsg+0x219/0x270 [ 1455.848250][T30324] sock_write_iter+0x258/0x330 [ 1455.848283][T30324] ? __pfx_sock_write_iter+0x10/0x10 [ 1455.848325][T30324] ? bpf_lsm_file_permission+0x9/0x20 [ 1455.848349][T30324] ? security_file_permission+0x75/0x290 [ 1455.848388][T30324] vfs_write+0x548/0xa90 [ 1455.848415][T30324] ? __pfx_sock_write_iter+0x10/0x10 [ 1455.848447][T30324] ? __pfx_vfs_write+0x10/0x10 [ 1455.848479][T30324] ? __fget_files+0x2a/0x420 [ 1455.848517][T30324] ksys_write+0x145/0x250 [ 1455.848543][T30324] ? __pfx_ksys_write+0x10/0x10 [ 1455.848568][T30324] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1455.848593][T30324] ? lockdep_hardirqs_on+0x9c/0x150 [ 1455.848620][T30324] __do_fast_syscall_32+0xb4/0x110 [ 1455.848654][T30324] do_fast_syscall_32+0x34/0x80 [ 1455.848679][T30324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1455.848704][T30324] RIP: 0023:0xf706e539 [ 1455.848723][T30324] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1455.848748][T30324] RSP: 002b:00000000f505e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 1455.848769][T30324] RAX: ffffffffffffffda RBX: 000000000000000e RCX: 0000000080000040 [ 1455.848784][T30324] RDX: 000000000000fe33 RSI: 0000000000000000 RDI: 0000000000000000 [ 1455.848796][T30324] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1455.848808][T30324] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1455.848820][T30324] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1455.848850][T30324] [ 1456.224924][ T5893] usb 3-1: USB disconnect, device number 108 [ 1456.274841][ T5890] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1456.288274][ T5890] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1456.330258][ T5890] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1456.393293][ T5890] usb 6-1: config 0 descriptor?? [ 1456.549026][ T5890] pwc: Askey VC010 type 2 USB webcam detected. [ 1456.888375][ T5890] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1456.916805][ T5890] pwc: recv_control_msg error -32 req 02 val 2700 [ 1456.926401][ T5890] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1456.960759][ T5890] pwc: recv_control_msg error -32 req 04 val 1000 [ 1456.971426][ T5890] pwc: recv_control_msg error -32 req 04 val 1300 [ 1457.059603][ T5890] pwc: recv_control_msg error -32 req 04 val 1400 [ 1457.089135][ T5890] pwc: recv_control_msg error -32 req 02 val 2000 [ 1457.109117][ T5890] pwc: recv_control_msg error -32 req 02 val 2100 [ 1457.127534][ T5890] pwc: recv_control_msg error -32 req 04 val 1500 [ 1457.178372][ T5892] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 1457.186452][ T5890] pwc: recv_control_msg error -32 req 02 val 2500 [ 1457.362577][ T5892] usb 4-1: Using ep0 maxpacket: 8 [ 1457.367418][ T5893] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 1457.401193][ T5892] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1457.429822][ T5892] usb 4-1: config 1 has an invalid interface descriptor of length 4, skipping [ 1457.484785][ T5892] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1457.516318][ T5892] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 1457.565288][ T5893] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1457.584317][ T5893] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1457.594324][ T5893] usb 3-1: New USB device found, idVendor=04b4, idProduct=de61, bcdDevice= 0.00 [ 1457.626824][ T5890] pwc: recv_control_msg error -71 req 02 val 2600 [ 1457.630902][ T5893] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1457.642985][ T5890] pwc: recv_control_msg error -71 req 02 val 2900 [ 1457.660585][ T5892] usb 4-1: string descriptor 0 read error: -22 [ 1457.667712][ T5892] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1457.668679][ T5893] usb 3-1: config 0 descriptor?? [ 1457.708359][ T5892] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1457.725187][ T5890] pwc: recv_control_msg error -71 req 02 val 2800 [ 1457.742451][ T5890] pwc: recv_control_msg error -71 req 04 val 1100 [ 1457.855209][ T5890] pwc: recv_control_msg error -71 req 04 val 1200 [ 1457.865282][ T5890] pwc: Registered as video103. [ 1457.902722][ T5890] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input99 [ 1457.959457][ T5890] usb 6-1: USB disconnect, device number 20 [ 1458.188502][ T5893] cypress 0003:04B4:DE61.007D: item fetching failed at offset 5/7 [ 1458.200900][ T5893] cypress 0003:04B4:DE61.007D: parse failed [ 1458.207019][ T5893] cypress 0003:04B4:DE61.007D: probe with driver cypress failed with error -22 [ 1458.336051][ T5892] usb 4-1: USB disconnect, device number 84 [ 1458.564167][T30345] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1458.573240][T30345] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1458.613335][T30356] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6489'. [ 1458.626380][T30345] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1458.635708][T30345] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1458.660296][T30345] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6486'. [ 1458.670803][T30345] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6486'. [ 1458.779527][ T5892] usb 3-1: USB disconnect, device number 109 [ 1458.934902][T30358] netlink: 12439 bytes leftover after parsing attributes in process `syz.5.6490'. [ 1459.605923][T30367] FAULT_INJECTION: forcing a failure. [ 1459.605923][T30367] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1459.631406][T30367] CPU: 0 UID: 0 PID: 30367 Comm: syz.2.6493 Not tainted 6.15.0-rc5-syzkaller-00277-g345030986df8 #0 PREEMPT(full) [ 1459.631436][T30367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1459.631449][T30367] Call Trace: [ 1459.631460][T30367] [ 1459.631469][T30367] dump_stack_lvl+0x189/0x250 [ 1459.631503][T30367] ? __lock_acquire+0xaac/0xd20 [ 1459.631535][T30367] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1459.631564][T30367] ? __pfx__printk+0x10/0x10 [ 1459.631585][T30367] ? __might_fault+0xb0/0x130 [ 1459.631623][T30367] should_fail_ex+0x414/0x560 [ 1459.631661][T30367] _copy_from_iter+0x1db/0x15a0 [ 1459.631694][T30367] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 1459.631717][T30367] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 1459.631744][T30367] ? __pfx__copy_from_iter+0x10/0x10 [ 1459.631770][T30367] ? __build_skb_around+0x257/0x3e0 [ 1459.631799][T30367] ? netlink_sendmsg+0x642/0xb30 [ 1459.631821][T30367] ? skb_put+0x11b/0x210 [ 1459.631850][T30367] netlink_sendmsg+0x6b2/0xb30 [ 1459.631883][T30367] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1459.631909][T30367] ? __import_iovec+0x5d4/0x7f0 [ 1459.631934][T30367] ? aa_sock_msg_perm+0x94/0x160 [ 1459.631958][T30367] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1459.631982][T30367] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1459.632006][T30367] __sock_sendmsg+0x219/0x270 [ 1459.632030][T30367] ____sys_sendmsg+0x505/0x830 [ 1459.632064][T30367] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1459.632107][T30367] ___sys_sendmsg+0x21f/0x2a0 [ 1459.632137][T30367] ? __pfx____sys_sendmsg+0x10/0x10 [ 1459.632201][T30367] ? __fget_files+0x2a/0x420 [ 1459.632226][T30367] ? __fget_files+0x3a0/0x420 [ 1459.632269][T30367] __sys_sendmsg+0x164/0x220 [ 1459.632297][T30367] ? __pfx___sys_sendmsg+0x10/0x10 [ 1459.632340][T30367] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1459.632366][T30367] ? lockdep_hardirqs_on+0x9c/0x150 [ 1459.632393][T30367] __do_fast_syscall_32+0xb4/0x110 [ 1459.632420][T30367] ? lockdep_hardirqs_on+0x9c/0x150 [ 1459.632449][T30367] do_fast_syscall_32+0x34/0x80 [ 1459.632477][T30367] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1459.632503][T30367] RIP: 0023:0xf705e539 [ 1459.632521][T30367] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1459.632539][T30367] RSP: 002b:00000000f504e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1459.632561][T30367] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000080000540 [ 1459.632576][T30367] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1459.632588][T30367] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1459.632600][T30367] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1459.632613][T30367] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1459.632641][T30367] [ 1459.633642][T18326] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 1460.089138][T18326] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1460.133738][T18326] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1460.148902][T18326] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1460.164002][T18326] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1460.183649][T18326] usb 6-1: SerialNumber: syz [ 1460.288752][ T5890] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 1460.405497][T18326] usb 6-1: 0:2 : does not exist [ 1460.470104][ T5890] usb 4-1: Using ep0 maxpacket: 8 [ 1460.482934][T18326] usb 6-1: USB disconnect, device number 21 [ 1460.497699][ T5890] usb 4-1: config 0 has an invalid interface number: 31 but max is 0 [ 1460.505925][ T5890] usb 4-1: config 0 has no interface number 0 [ 1460.560325][ T5890] usb 4-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1460.561204][T28197] udevd[28197]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1460.587237][ T5890] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1460.595282][ T5890] usb 4-1: Product: syz [ 1460.602404][ T5890] usb 4-1: Manufacturer: syz [ 1460.607053][ T5890] usb 4-1: SerialNumber: syz [ 1460.626988][ T5890] usb 4-1: config 0 descriptor?? [ 1460.687326][ T5893] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 1460.837488][ T5893] usb 2-1: Using ep0 maxpacket: 32 [ 1460.848837][ T5893] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1460.856985][ T5893] usb 2-1: config 0 has no interface number 0 [ 1460.868355][ T5893] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1460.879518][ T5893] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1460.889514][ T5890] usb 4-1: Found UVC 0.04 device syz (046d:08c3) [ 1460.895993][ T5890] uvcvideo 4-1:0.31: Entity type for entity Output 6 was not initialized! [ 1460.911648][ T5893] usb 2-1: Product: syz [ 1460.915895][ T5893] usb 2-1: Manufacturer: syz [ 1460.917619][ T5890] usb 4-1: USB disconnect, device number 85 [ 1460.922356][ T5893] usb 2-1: SerialNumber: syz [ 1460.945818][ T5893] usb 2-1: config 0 descriptor?? [ 1460.968860][ T5893] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1461.006636][ T5893] usb 2-1: selecting invalid altsetting 1 [ 1461.013992][ T5893] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1461.025095][ T5893] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1461.036622][ T5893] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1461.045068][ T5893] usb 2-1: media controller created [ 1461.080135][ T5893] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1461.104784][T30378] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6499'. [ 1461.123302][T30378] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6499'. [ 1461.160048][T30380] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6500'. [ 1461.169961][ T5893] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 1461.170045][ T5893] zl10353_read_register: readreg error (reg=127, ret==-32) [ 1461.171230][ T5893] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1461.291635][ T5893] usb 2-1: USB disconnect, device number 90 [ 1461.718061][T15829] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 1461.883993][T15829] usb 6-1: too many endpoints for config 4 interface 0 altsetting 0: 101, using maximum allowed: 30 [ 1461.905703][T15829] usb 6-1: config 4 interface 0 altsetting 0 has an endpoint descriptor with address 0xC4, changing to 0x84 [ 1461.926079][T15829] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 240, setting to 64 [ 1461.947305][T15829] usb 6-1: config 4 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 101 [ 1461.967150][T15829] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1461.987469][T15829] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1462.114774][T30395] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6506'. [ 1462.135841][T30395] netlink: 'syz.1.6506': attribute type 2 has an invalid length. [ 1462.165359][T30395] netlink: 'syz.1.6506': attribute type 1 has an invalid length. [ 1462.192171][T30395] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6506'. [ 1462.218222][T15829] ath6kl: Failed to submit usb control message: -71 [ 1462.248591][T15829] ath6kl: unable to send the bmi data to the device: -71 [ 1462.262491][T15829] ath6kl: Unable to send get target info: -71 [ 1462.280103][T15829] ath6kl: Failed to init ath6kl core: -71 [ 1462.292287][T15829] ath6kl_usb 6-1:4.0: probe with driver ath6kl_usb failed with error -71 [ 1462.325276][T15829] usb 6-1: USB disconnect, device number 22 [ 1462.361209][T30402] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6508'. [ 1462.370555][T30402] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6508'. [ 1463.122799][ T5890] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 1463.277715][ T1164] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 1463.299993][ T5890] usb 4-1: Using ep0 maxpacket: 8 [ 1463.336370][ T5890] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1463.344237][T18326] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 1463.355788][ T5890] usb 4-1: config 1 has an invalid interface descriptor of length 4, skipping [ 1463.366319][ T5890] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1463.437527][ T5890] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 1463.448425][ T1164] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1463.459982][ T1164] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1463.556800][T30418] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6512'. [ 1463.628687][T18326] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1463.634446][T30418] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6512'. [ 1463.684975][T18326] usb 2-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 1463.709570][ T1164] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1463.727280][T18326] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1463.736712][ T1164] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1463.757237][T18326] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1463.778128][ T1164] usb 6-1: SerialNumber: syz [ 1463.926296][ T5890] usb 4-1: string descriptor 0 read error: -22 [ 1463.937323][ T5890] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1463.948064][T30418] team0: entered promiscuous mode [ 1463.955265][ T5890] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1464.007433][T30418] team0: left promiscuous mode [ 1464.008303][ T1164] usb 6-1: 0:2 : does not exist [ 1464.304849][ T1164] usb 6-1: USB disconnect, device number 23 [ 1464.374447][ T5893] usb 4-1: USB disconnect, device number 86 [ 1464.452576][T28197] udevd[28197]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1465.019761][ T1164] usb 3-1: new full-speed USB device number 110 using dummy_hcd [ 1466.428092][T24844] usb 2-1: USB disconnect, device number 91 [ 1466.457787][ T1164] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1466.472788][ T1164] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1466.509358][ T1164] usb 3-1: config 0 descriptor?? [ 1467.495409][T30457] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6520'. [ 1467.505402][T30457] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6520'. [ 1467.525078][T15829] usb 3-1: USB disconnect, device number 110 [ 1467.613593][T30457] team0: entered promiscuous mode [ 1467.678030][T24844] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 1467.690497][T30457] team0: left promiscuous mode [ 1467.729207][T30462] FAULT_INJECTION: forcing a failure. [ 1467.729207][T30462] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1467.743479][T30462] CPU: 0 UID: 0 PID: 30462 Comm: syz.3.6522 Not tainted 6.15.0-rc5-syzkaller-00277-g345030986df8 #0 PREEMPT(full) [ 1467.743509][T30462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1467.743522][T30462] Call Trace: [ 1467.743531][T30462] [ 1467.743540][T30462] dump_stack_lvl+0x189/0x250 [ 1467.743578][T30462] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1467.743617][T30462] ? __pfx__printk+0x10/0x10 [ 1467.743648][T30462] should_fail_ex+0x414/0x560 [ 1467.743685][T30462] _copy_to_user+0x31/0xb0 [ 1467.743716][T30462] simple_read_from_buffer+0xe1/0x170 [ 1467.743746][T30462] proc_fail_nth_read+0x1df/0x250 [ 1467.743779][T30462] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1467.743810][T30462] ? rw_verify_area+0x258/0x650 [ 1467.743829][T30462] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1467.743856][T30462] vfs_read+0x1fd/0x980 [ 1467.743886][T30462] ? __pfx___mutex_lock+0x10/0x10 [ 1467.743914][T30462] ? __pfx_vfs_read+0x10/0x10 [ 1467.743939][T30462] ? __fget_files+0x2a/0x420 [ 1467.743971][T30462] ? __fget_files+0x3a0/0x420 [ 1467.743996][T30462] ? __fget_files+0x2a/0x420 [ 1467.744031][T30462] ksys_read+0x145/0x250 [ 1467.744057][T30462] ? __pfx_ksys_read+0x10/0x10 [ 1467.744083][T30462] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1467.744110][T30462] ? lockdep_hardirqs_on+0x9c/0x150 [ 1467.744137][T30462] __do_fast_syscall_32+0xb4/0x110 [ 1467.744165][T30462] ? lockdep_hardirqs_on+0x9c/0x150 [ 1467.744195][T30462] do_fast_syscall_32+0x34/0x80 [ 1467.744222][T30462] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1467.744248][T30462] RIP: 0023:0xf706e539 [ 1467.744266][T30462] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1467.744284][T30462] RSP: 002b:00000000f505e590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 1467.744306][T30462] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f505e620 [ 1467.744321][T30462] RDX: 000000000000000f RSI: 00000000f73d2ff4 RDI: 0000000000000000 [ 1467.744334][T30462] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 1467.744347][T30462] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1467.744360][T30462] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1467.744392][T30462] [ 1468.118803][T24844] usb 6-1: Using ep0 maxpacket: 32 [ 1468.126017][T24844] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1468.134201][T24844] usb 6-1: config 0 has no interface number 0 [ 1468.143607][T24844] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1468.153202][T24844] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1468.161311][T24844] usb 6-1: Product: syz [ 1468.165472][T24844] usb 6-1: Manufacturer: syz [ 1468.170151][T24844] usb 6-1: SerialNumber: syz [ 1468.176937][T24844] usb 6-1: config 0 descriptor?? [ 1468.186464][T24844] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1468.195333][T24844] usb 6-1: selecting invalid altsetting 1 [ 1468.201258][T24844] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1468.211014][T24844] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1468.228916][T24844] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1468.237957][T24844] usb 6-1: media controller created [ 1468.271434][T24844] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1468.462981][T24844] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 1468.491323][T24844] zl10353_read_register: readreg error (reg=127, ret==-32) [ 1468.508606][T24844] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1468.584008][T24844] usb 6-1: USB disconnect, device number 24 [ 1468.709425][ T5901] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 1468.757358][T15829] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 1468.880660][ T5901] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1468.892093][ T5901] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1468.902948][ T5901] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1468.913793][ T5901] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1468.915156][T15829] usb 3-1: Using ep0 maxpacket: 16 [ 1468.922314][ T5901] usb 4-1: SerialNumber: syz [ 1468.942800][T15829] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1468.963760][T15829] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1468.972024][T15829] usb 3-1: Product: syz [ 1468.976224][T15829] usb 3-1: Manufacturer: syz [ 1468.986769][T15829] usb 3-1: SerialNumber: syz [ 1469.007038][T15829] r8152-cfgselector 3-1: Unknown version 0x0000 [ 1469.018071][T15829] r8152-cfgselector 3-1: config 0 descriptor?? [ 1469.152507][ T5901] usb 4-1: 0:2 : does not exist [ 1469.184571][ T5901] usb 4-1: USB disconnect, device number 87 [ 1469.260384][T28197] udevd[28197]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1469.448272][T15829] r8152-cfgselector 3-1: USB disconnect, device number 111 [ 1469.720803][T28525] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 1469.760003][T30489] FAULT_INJECTION: forcing a failure. [ 1469.760003][T30489] name failslab, interval 1, probability 0, space 0, times 0 [ 1469.773708][T30489] CPU: 1 UID: 0 PID: 30489 Comm: syz.3.6532 Not tainted 6.15.0-rc5-syzkaller-00277-g345030986df8 #0 PREEMPT(full) [ 1469.773780][T30489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1469.773792][T30489] Call Trace: [ 1469.773801][T30489] [ 1469.773809][T30489] dump_stack_lvl+0x189/0x250 [ 1469.773837][T30489] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1469.773858][T30489] ? __pfx__printk+0x10/0x10 [ 1469.773877][T30489] ? __pfx___might_resched+0x10/0x10 [ 1469.773891][T30489] ? fs_reclaim_acquire+0x7d/0x100 [ 1469.773916][T30489] should_fail_ex+0x414/0x560 [ 1469.773942][T30489] should_failslab+0xa8/0x100 [ 1469.773963][T30489] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1469.773981][T30489] ? getname_kernel+0x5a/0x2f0 [ 1469.774004][T30489] getname_kernel+0x5a/0x2f0 [ 1469.774025][T30489] kern_path_create+0x21/0x50 [ 1469.774041][T30489] unix_bind+0x2ad/0xd90 [ 1469.774060][T30489] ? tomoyo_socket_bind_permission+0x1af/0x290 [ 1469.774080][T30489] ? __pfx_unix_bind+0x10/0x10 [ 1469.774098][T30489] ? bpf_lsm_socket_bind+0x9/0x20 [ 1469.774117][T30489] __sys_bind+0x2c3/0x3e0 [ 1469.774134][T30489] ? __pfx___sys_bind+0x10/0x10 [ 1469.774165][T30489] __ia32_sys_bind+0x7a/0x90 [ 1469.774181][T30489] __do_fast_syscall_32+0xb4/0x110 [ 1469.774200][T30489] ? lockdep_hardirqs_on+0x9c/0x150 [ 1469.774220][T30489] do_fast_syscall_32+0x34/0x80 [ 1469.774238][T30489] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1469.774256][T30489] RIP: 0023:0xf706e539 [ 1469.774270][T30489] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1469.774282][T30489] RSP: 002b:00000000f505e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000169 [ 1469.774298][T30489] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080003000 [ 1469.774308][T30489] RDX: 000000000000006e RSI: 0000000000000000 RDI: 0000000000000000 [ 1469.774317][T30489] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1469.774325][T30489] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1469.774334][T30489] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1469.774354][T30489] [ 1469.877348][T28525] usb 6-1: Using ep0 maxpacket: 8 [ 1470.011393][T28525] usb 6-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1470.020666][T28525] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1470.029214][T28525] usb 6-1: Product: syz [ 1470.033418][T28525] usb 6-1: Manufacturer: syz [ 1470.040385][T28525] usb 6-1: SerialNumber: syz [ 1470.048781][T28525] usb 6-1: config 0 descriptor?? [ 1470.057313][T15829] usb 2-1: new full-speed USB device number 92 using dummy_hcd [ 1470.077432][T28525] gspca_main: se401-2.14.0 probing 047d:5003 [ 1470.187514][ T5901] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 1470.209289][T15829] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1470.221378][T15829] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1470.251272][T15829] usb 2-1: config 0 descriptor?? [ 1470.384135][ T5901] usb 4-1: too many endpoints for config 4 interface 0 altsetting 0: 101, using maximum allowed: 30 [ 1470.396255][ T5901] usb 4-1: config 4 interface 0 altsetting 0 has an endpoint descriptor with address 0xC4, changing to 0x84 [ 1470.421741][ T5901] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 240, setting to 64 [ 1470.440779][ T5901] usb 4-1: config 4 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 101 [ 1470.456951][ T5901] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1470.474868][ T5901] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1470.483221][ T5890] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 1470.644601][ T5890] usb 3-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1470.656738][ T5890] usb 3-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 1470.666716][ T5890] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1470.676408][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1470.688176][T28525] input: se401 as /devices/platform/dummy_hcd.5/usb6/6-1/input/input100 [ 1470.716762][ T5901] ath6kl: Failed to submit usb control message: -71 [ 1470.723610][ T5901] ath6kl: unable to send the bmi data to the device: -71 [ 1470.736495][ T5901] ath6kl: Unable to send get target info: -71 [ 1470.768306][ T5901] ath6kl: Failed to init ath6kl core: -71 [ 1470.788393][ T5901] ath6kl_usb 4-1:4.0: probe with driver ath6kl_usb failed with error -71 [ 1470.829758][ T5901] usb 4-1: USB disconnect, device number 88 [ 1470.883766][T30484] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1470.895584][T30484] netlink: 68 bytes leftover after parsing attributes in process `syz.5.6530'. [ 1470.907788][ T5890] usb 6-1: USB disconnect, device number 25 [ 1471.197891][ T5901] usb 2-1: USB disconnect, device number 92 [ 1471.314779][T30501] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6535'. [ 1471.332191][T30501] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6535'. [ 1471.853706][T30519] FAULT_INJECTION: forcing a failure. [ 1471.853706][T30519] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1471.859984][T30521] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 1471.887359][T30519] CPU: 1 UID: 0 PID: 30519 Comm: syz.1.6539 Not tainted 6.15.0-rc5-syzkaller-00277-g345030986df8 #0 PREEMPT(full) [ 1471.887390][T30519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1471.887404][T30519] Call Trace: [ 1471.887413][T30519] [ 1471.887422][T30519] dump_stack_lvl+0x189/0x250 [ 1471.887454][T30519] ? __lock_acquire+0xaac/0xd20 [ 1471.887485][T30519] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1471.887514][T30519] ? __pfx__printk+0x10/0x10 [ 1471.887534][T30519] ? __might_fault+0xb0/0x130 [ 1471.887571][T30519] should_fail_ex+0x414/0x560 [ 1471.887616][T30519] _copy_from_iter+0x1db/0x15a0 [ 1471.887648][T30519] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 1471.887670][T30519] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 1471.887695][T30519] ? __pfx__copy_from_iter+0x10/0x10 [ 1471.887722][T30519] ? __build_skb_around+0x257/0x3e0 [ 1471.887743][T30519] ? netlink_sendmsg+0x642/0xb30 [ 1471.887759][T30519] ? skb_put+0x11b/0x210 [ 1471.887779][T30519] netlink_sendmsg+0x6b2/0xb30 [ 1471.887802][T30519] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1471.887820][T30519] ? __import_iovec+0x5d4/0x7f0 [ 1471.887838][T30519] ? aa_sock_msg_perm+0x94/0x160 [ 1471.887855][T30519] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1471.887872][T30519] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1471.887888][T30519] __sock_sendmsg+0x219/0x270 [ 1471.887905][T30519] ____sys_sendmsg+0x505/0x830 [ 1471.887928][T30519] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1471.887958][T30519] ___sys_sendmsg+0x21f/0x2a0 [ 1471.887979][T30519] ? __pfx____sys_sendmsg+0x10/0x10 [ 1471.888023][T30519] ? __fget_files+0x2a/0x420 [ 1471.888040][T30519] ? __fget_files+0x3a0/0x420 [ 1471.888066][T30519] __sys_sendmsg+0x164/0x220 [ 1471.888086][T30519] ? __pfx___sys_sendmsg+0x10/0x10 [ 1471.888115][T30519] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1471.888135][T30519] ? lockdep_hardirqs_on+0x9c/0x150 [ 1471.888154][T30519] __do_fast_syscall_32+0xb4/0x110 [ 1471.888173][T30519] ? lockdep_hardirqs_on+0x9c/0x150 [ 1471.888193][T30519] do_fast_syscall_32+0x34/0x80 [ 1471.888211][T30519] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1471.888229][T30519] RIP: 0023:0xf711e539 [ 1471.888242][T30519] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1471.888255][T30519] RSP: 002b:00000000f510e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1471.888270][T30519] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 1471.888281][T30519] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1471.888290][T30519] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1471.888298][T30519] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1471.888307][T30519] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1471.888334][T30519] [ 1472.183933][T30521] fuse: Bad value for 'fd' [ 1472.189721][T30521] netlink: 'syz.0.6537': attribute type 21 has an invalid length. [ 1472.198446][T30521] netlink: 'syz.0.6537': attribute type 6 has an invalid length. [ 1472.206259][T30521] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6537'. [ 1472.790749][ T5890] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 1472.959632][ T5890] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1472.989940][ T5890] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1472.996833][ T5890] usb 2-1: New USB device found, idVendor=044e, idProduct=1215, bcdDevice= 0.00 [ 1473.011391][ T5890] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1473.024174][ T5890] usb 2-1: config 0 descriptor?? [ 1473.308881][ T5901] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 1473.455208][ T5890] hid-alps 0003:044E:1215.007E: unknown main item tag 0x0 [ 1473.462667][ T5890] hid-alps 0003:044E:1215.007E: unknown main item tag 0x0 [ 1473.471012][ T5890] hid-alps 0003:044E:1215.007E: unknown main item tag 0x0 [ 1473.480447][ T5890] hid-alps 0003:044E:1215.007E: unknown main item tag 0x0 [ 1473.488063][ T5901] usb 4-1: Using ep0 maxpacket: 32 [ 1473.493444][ T5890] hid-alps 0003:044E:1215.007E: unknown main item tag 0x0 [ 1473.500971][ T5890] hid-alps 0003:044E:1215.007E: unknown main item tag 0x0 [ 1473.509651][ T5890] hid-alps 0003:044E:1215.007E: unknown main item tag 0x0 [ 1473.518951][ T5901] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1473.532058][ T5901] usb 4-1: config 0 has no interfaces? [ 1473.538678][ T5901] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1473.548733][ T5890] hid-alps 0003:044E:1215.007E: hidraw0: USB HID v0.04 Device [HID 044e:1215] on usb-dummy_hcd.1-1/input0 [ 1473.566214][ T5901] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1473.584077][ T5901] usb 4-1: config 0 descriptor?? [ 1473.589260][ T1164] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 1473.655927][ T5901] usb 3-1: USB disconnect, device number 112 [ 1473.667017][T30524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1473.676637][T30524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1473.728928][T28525] usb 2-1: USB disconnect, device number 93 [ 1473.775086][T30537] fido_id[30537]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 1473.795790][ T1164] usb 6-1: config index 0 descriptor too short (expected 32804, got 36) [ 1473.815260][ T1164] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1473.826404][ T1164] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1473.841844][ T1164] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1473.857310][ T1164] usb 6-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1473.874687][ T1164] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1473.883739][ T1164] usb 6-1: Product: syz [ 1473.887982][ T1164] usb 6-1: Manufacturer: syz [ 1473.892610][ T1164] usb 6-1: SerialNumber: syz [ 1473.908915][ T1164] usb 6-1: config 0 descriptor?? [ 1473.914655][T30536] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 1473.923071][T30536] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 1473.939533][ T1164] usb 6-1: ucan: probing device on interface #0 [ 1474.097293][ T5901] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 1474.248418][ T5901] usb 3-1: Using ep0 maxpacket: 16 [ 1474.260911][ T5901] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1474.273917][ T5901] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1474.285516][ T5901] usb 3-1: New USB device found, idVendor=044e, idProduct=120c, bcdDevice= 0.00 [ 1474.294904][ T5901] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1474.309369][ T5901] usb 3-1: config 0 descriptor?? [ 1474.339454][ T1164] usb 6-1: ucan: device reported invalid device info [ 1474.346570][ T1164] usb 6-1: ucan: probe failed; try to update the device firmware [ 1474.627409][T28525] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 1474.723877][T30539] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6546'. [ 1474.746347][ T5901] usbhid 3-1:0.0: can't add hid device: -71 [ 1474.753337][ T5901] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1474.765170][ T5901] usb 3-1: USB disconnect, device number 113 [ 1474.779591][T28525] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1474.791117][T28525] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1474.802090][T28525] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1474.812650][T28525] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1474.825248][T28525] usb 2-1: SerialNumber: syz [ 1475.042002][T28525] usb 2-1: 0:2 : does not exist [ 1475.070958][T28525] usb 2-1: USB disconnect, device number 94 [ 1475.105549][T28197] udevd[28197]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1475.305221][T30543] FAULT_INJECTION: forcing a failure. [ 1475.305221][T30543] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1475.320885][T30543] CPU: 1 UID: 0 PID: 30543 Comm: syz.2.6548 Not tainted 6.15.0-rc5-syzkaller-00277-g345030986df8 #0 PREEMPT(full) [ 1475.320914][T30543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1475.320927][T30543] Call Trace: [ 1475.320936][T30543] [ 1475.320945][T30543] dump_stack_lvl+0x189/0x250 [ 1475.320977][T30543] ? __lock_acquire+0xaac/0xd20 [ 1475.321009][T30543] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1475.321038][T30543] ? __pfx__printk+0x10/0x10 [ 1475.321058][T30543] ? __might_fault+0xb0/0x130 [ 1475.321096][T30543] should_fail_ex+0x414/0x560 [ 1475.321134][T30543] _copy_from_iter+0x1db/0x15a0 [ 1475.321167][T30543] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 1475.321189][T30543] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 1475.321217][T30543] ? __pfx__copy_from_iter+0x10/0x10 [ 1475.321243][T30543] ? __build_skb_around+0x257/0x3e0 [ 1475.321271][T30543] ? netlink_sendmsg+0x642/0xb30 [ 1475.321293][T30543] ? skb_put+0x11b/0x210 [ 1475.321328][T30543] netlink_sendmsg+0x6b2/0xb30 [ 1475.321361][T30543] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1475.321388][T30543] ? __import_iovec+0x5d4/0x7f0 [ 1475.321413][T30543] ? aa_sock_msg_perm+0x94/0x160 [ 1475.321438][T30543] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1475.321462][T30543] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1475.321487][T30543] __sock_sendmsg+0x219/0x270 [ 1475.321510][T30543] ____sys_sendmsg+0x505/0x830 [ 1475.321543][T30543] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1475.321588][T30543] ___sys_sendmsg+0x21f/0x2a0 [ 1475.321616][T30543] ? __pfx____sys_sendmsg+0x10/0x10 [ 1475.321680][T30543] ? __fget_files+0x2a/0x420 [ 1475.321705][T30543] ? __fget_files+0x3a0/0x420 [ 1475.321742][T30543] __sys_sendmsg+0x164/0x220 [ 1475.321770][T30543] ? __pfx___sys_sendmsg+0x10/0x10 [ 1475.321812][T30543] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1475.321839][T30543] ? lockdep_hardirqs_on+0x9c/0x150 [ 1475.321865][T30543] __do_fast_syscall_32+0xb4/0x110 [ 1475.321892][T30543] ? lockdep_hardirqs_on+0x9c/0x150 [ 1475.321919][T30543] do_fast_syscall_32+0x34/0x80 [ 1475.321945][T30543] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1475.321970][T30543] RIP: 0023:0xf705e539 [ 1475.321988][T30543] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1475.322006][T30543] RSP: 002b:00000000f504e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1475.322028][T30543] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000280 [ 1475.322042][T30543] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1475.322054][T30543] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1475.322067][T30543] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1475.322079][T30543] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1475.322108][T30543] [ 1475.897831][T15829] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 1475.969430][T30549] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1475.985845][T30549] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1476.009478][T24844] usb 4-1: USB disconnect, device number 89 [ 1476.057351][T15829] usb 3-1: Using ep0 maxpacket: 8 [ 1476.066993][T15829] usb 3-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1476.080333][T15829] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1476.089228][T15829] usb 3-1: Product: syz [ 1476.093492][T15829] usb 3-1: Manufacturer: syz [ 1476.099122][T15829] usb 3-1: SerialNumber: syz [ 1476.109436][T15829] usb 3-1: config 0 descriptor?? [ 1476.163935][T15829] gspca_main: se401-2.14.0 probing 047d:5003 [ 1476.394293][ T1164] usb 6-1: USB disconnect, device number 26 [ 1476.796632][T15829] input: se401 as /devices/platform/dummy_hcd.2/usb3/3-1/input/input101 [ 1477.014494][T30545] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1477.059539][T30545] netlink: 68 bytes leftover after parsing attributes in process `syz.2.6549'. [ 1477.139168][T15829] usb 3-1: USB disconnect, device number 114 [ 1478.087626][ T1164] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 1478.097709][ T5901] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 1478.239521][ T1164] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1478.261990][ T1164] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1478.271391][ T5901] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1478.282880][ T5901] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1478.293791][ T5901] usb 3-1: New USB device found, idVendor=04b4, idProduct=de61, bcdDevice= 0.00 [ 1478.304517][ T5901] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1478.313052][ T1164] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1478.324666][ T1164] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1478.328011][T24844] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 1478.338531][ T5901] usb 3-1: config 0 descriptor?? [ 1478.355113][ T1164] usb 6-1: SerialNumber: syz [ 1478.494173][T24844] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1478.505474][T15829] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 1478.513887][T24844] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1478.525553][T24844] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1478.540183][T24844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1478.551161][T24844] usb 2-1: SerialNumber: syz [ 1478.591760][ T1164] usb 6-1: 0:2 : does not exist [ 1478.612608][ T1164] usb 6-1: USB disconnect, device number 27 [ 1478.651752][T28197] udevd[28197]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1478.676118][T15829] usb 4-1: config index 0 descriptor too short (expected 32804, got 36) [ 1478.698179][T15829] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1478.708497][T15829] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1478.720368][T15829] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1478.733950][T15829] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1478.743281][T15829] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1478.755862][T15829] usb 4-1: Product: syz [ 1478.759416][ T5901] cypress 0003:04B4:DE61.007F: item fetching failed at offset 5/7 [ 1478.763670][T15829] usb 4-1: Manufacturer: syz [ 1478.786585][ T5901] cypress 0003:04B4:DE61.007F: parse failed [ 1478.791020][T24844] usb 2-1: 0:2 : does not exist [ 1478.793526][ T5901] cypress 0003:04B4:DE61.007F: probe with driver cypress failed with error -22 [ 1478.809388][T15829] usb 4-1: SerialNumber: syz [ 1478.843919][T15829] usb 4-1: config 0 descriptor?? [ 1478.852470][T24844] usb 2-1: USB disconnect, device number 95 [ 1478.859870][T30599] raw-gadget.5 gadget.3: fail, usb_ep_enable returned -22 [ 1478.867433][T30599] raw-gadget.5 gadget.3: fail, usb_ep_enable returned -22 [ 1478.876482][T15829] usb 4-1: ucan: probing device on interface #0 [ 1478.911356][T28197] udevd[28197]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1478.996594][T30588] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1479.006207][T30588] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1479.029720][T30588] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1479.051953][T30588] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1479.070227][T30588] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6559'. [ 1479.082443][T30588] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6559'. [ 1479.122943][T24844] usb 3-1: USB disconnect, device number 115 [ 1479.290114][T15829] usb 4-1: ucan: device reported invalid device info [ 1479.296965][T15829] usb 4-1: ucan: probe failed; try to update the device firmware [ 1479.917115][T30616] FAULT_INJECTION: forcing a failure. [ 1479.917115][T30616] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1479.930870][T30616] CPU: 0 UID: 0 PID: 30616 Comm: syz.5.6572 Not tainted 6.15.0-rc5-syzkaller-00277-g345030986df8 #0 PREEMPT(full) [ 1479.930900][T30616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1479.930912][T30616] Call Trace: [ 1479.930921][T30616] [ 1479.930930][T30616] dump_stack_lvl+0x189/0x250 [ 1479.930962][T30616] ? __lock_acquire+0xaac/0xd20 [ 1479.931016][T30616] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1479.931046][T30616] ? __pfx__printk+0x10/0x10 [ 1479.931067][T30616] ? __might_fault+0xb0/0x130 [ 1479.931112][T30616] should_fail_ex+0x414/0x560 [ 1479.931151][T30616] _copy_from_iter+0x1db/0x15a0 [ 1479.931185][T30616] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 1479.931209][T30616] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 1479.931237][T30616] ? __pfx__copy_from_iter+0x10/0x10 [ 1479.931264][T30616] ? __build_skb_around+0x257/0x3e0 [ 1479.931294][T30616] ? netlink_sendmsg+0x642/0xb30 [ 1479.931316][T30616] ? skb_put+0x11b/0x210 [ 1479.931346][T30616] netlink_sendmsg+0x6b2/0xb30 [ 1479.931379][T30616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1479.931405][T30616] ? __import_iovec+0x5d4/0x7f0 [ 1479.931431][T30616] ? aa_sock_msg_perm+0x94/0x160 [ 1479.931455][T30616] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1479.931478][T30616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1479.931502][T30616] __sock_sendmsg+0x219/0x270 [ 1479.931525][T30616] ____sys_sendmsg+0x505/0x830 [ 1479.931558][T30616] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1479.931603][T30616] ___sys_sendmsg+0x21f/0x2a0 [ 1479.931634][T30616] ? __pfx____sys_sendmsg+0x10/0x10 [ 1479.931699][T30616] ? __fget_files+0x2a/0x420 [ 1479.931729][T30616] ? __fget_files+0x3a0/0x420 [ 1479.931767][T30616] __sys_sendmsg+0x164/0x220 [ 1479.931797][T30616] ? __pfx___sys_sendmsg+0x10/0x10 [ 1479.931840][T30616] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1479.931868][T30616] ? lockdep_hardirqs_on+0x9c/0x150 [ 1479.931895][T30616] __do_fast_syscall_32+0xb4/0x110 [ 1479.931922][T30616] ? lockdep_hardirqs_on+0x9c/0x150 [ 1479.931951][T30616] do_fast_syscall_32+0x34/0x80 [ 1479.931984][T30616] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1479.932010][T30616] RIP: 0023:0xf705e539 [ 1479.932028][T30616] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1479.932047][T30616] RSP: 002b:00000000f504e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1479.932070][T30616] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000140 [ 1479.932085][T30616] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1479.932099][T30616] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1479.932111][T30616] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1479.932124][T30616] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1479.932153][T30616] [ 1480.213315][ T5901] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 1480.497029][T24844] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 1480.525288][T30618] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6573'. [ 1480.537324][T30618] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6573'. [ 1480.638478][ T5901] usb 2-1: Using ep0 maxpacket: 8 [ 1480.651780][ T5901] usb 2-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1480.661261][ T5901] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1480.671120][ T5901] usb 2-1: Product: syz [ 1480.675326][ T5901] usb 2-1: Manufacturer: syz [ 1480.682003][T24844] usb 3-1: config 0 has an invalid interface number: 122 but max is 0 [ 1480.687304][ T5901] usb 2-1: SerialNumber: syz [ 1480.701556][T24844] usb 3-1: config 0 has no interface number 0 [ 1480.702738][ T5901] usb 2-1: config 0 descriptor?? [ 1480.720281][ T5901] gspca_main: se401-2.14.0 probing 047d:5003 [ 1480.734149][T24844] usb 3-1: config 0 interface 122 has no altsetting 0 [ 1480.764586][T24844] usb 3-1: New USB device found, idVendor=13d3, idProduct=3219, bcdDevice=7a.67 [ 1480.780203][T24844] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1480.792334][T24844] usb 3-1: Product: syz [ 1480.796635][T24844] usb 3-1: Manufacturer: syz [ 1480.804915][T24844] usb 3-1: SerialNumber: syz [ 1480.822579][T24844] usb 3-1: config 0 descriptor?? [ 1481.097843][T18326] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 1481.273197][T18326] usb 6-1: Using ep0 maxpacket: 32 [ 1481.305083][T24844] usb 4-1: USB disconnect, device number 90 [ 1481.324596][T18326] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 117, using maximum allowed: 30 [ 1481.340019][ T5901] input: se401 as /devices/platform/dummy_hcd.1/usb2/2-1/input/input102 [ 1481.367342][T18326] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 117 [ 1481.384842][ T5890] usb 3-1: USB disconnect, device number 116 [ 1481.398282][ T5890] dvb-usb: generic DVB-USB module successfully deinitialized and disconnected. [ 1481.421857][T18326] usb 6-1: New USB device found, idVendor=046d, idProduct=0960, bcdDevice=a5.af [ 1481.452705][T18326] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1481.478327][T18326] usb 6-1: Product: syz [ 1481.482616][T18326] usb 6-1: Manufacturer: syz [ 1481.497462][T18326] usb 6-1: SerialNumber: syz [ 1481.543568][T18326] usb 6-1: config 0 descriptor?? [ 1481.568608][T30612] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1481.614338][T30612] netlink: 68 bytes leftover after parsing attributes in process `syz.1.6570'. [ 1481.630390][ T5901] usb 2-1: USB disconnect, device number 96 [ 1481.841191][T18326] gspca_main: sunplus-2.14.0 probing 046d:0960 [ 1481.850117][T18326] gspca_sunplus: reg_w_riv err -71 [ 1481.855348][T18326] sunplus 6-1:0.0: probe with driver sunplus failed with error -71 [ 1481.871558][T18326] usb 6-1: USB disconnect, device number 28 [ 1481.887702][T24844] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 1481.980973][T30638] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 1482.013723][T30638] netlink: 'syz.2.6580': attribute type 21 has an invalid length. [ 1482.023419][T30638] netlink: 'syz.2.6580': attribute type 6 has an invalid length. [ 1482.031881][T30638] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6580'. [ 1482.079513][T24844] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1482.091522][T24844] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1482.102685][T24844] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1482.112267][T24844] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1482.120937][T24844] usb 4-1: SerialNumber: syz [ 1482.298159][T18326] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1482.344640][T24844] usb 4-1: 0:2 : does not exist [ 1482.368439][T24844] usb 4-1: USB disconnect, device number 91 [ 1482.402560][T28197] udevd[28197]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1482.437957][ T5901] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 1482.457368][T18326] usb 6-1: Using ep0 maxpacket: 32 [ 1482.464893][T18326] usb 6-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1482.480954][T18326] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1482.493413][T18326] usb 6-1: config 0 descriptor?? [ 1482.505716][T18326] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1482.587608][ T5901] usb 2-1: Using ep0 maxpacket: 32 [ 1482.595400][ T5901] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1482.607454][ T5901] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1482.617955][ T5901] usb 2-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1482.632089][ T5901] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1482.638924][ T5901] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 1482.648762][ T5901] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1482.665226][ T5901] usb 2-1: config 0 descriptor?? [ 1482.874017][T30645] bridge0: port 3(erspan0) entered blocking state [ 1482.882953][T30645] bridge0: port 3(erspan0) entered disabled state [ 1482.890646][T30645] erspan0: entered allmulticast mode [ 1482.899506][T30645] erspan0: entered promiscuous mode [ 1482.905432][T30645] bridge0: port 3(erspan0) entered blocking state [ 1482.912151][T30645] bridge0: port 3(erspan0) entered forwarding state [ 1482.937648][T30645] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6583'. [ 1483.115367][ T5901] corsair-cpro 0003:1B1C:0C10.0080: hidraw0: USB HID v0.00 Device [HID 1b1c:0c10] on usb-dummy_hcd.1-1/input0 [ 1483.201505][T30652] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6586'. [ 1483.211060][T30652] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6586'. [ 1483.211094][ T5901] corsair-cpro 0003:1B1C:0C10.0080: probe with driver corsair-cpro failed with error -38 [ 1483.242489][ T5890] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 1483.410421][ T5890] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1483.437917][ T5890] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1483.452739][ T5890] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1483.463677][ T5890] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1483.475606][ T5890] usb 4-1: config 0 descriptor?? [ 1484.124834][T30647] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1484.135156][T30647] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1484.170825][T30647] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6584'. [ 1484.185826][T30647] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6584'. [ 1484.197085][T30647] netlink: 'syz.3.6584': attribute type 18 has an invalid length. [ 1484.209277][T30647] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6584'. [ 1484.360365][T18326] gspca_vc032x: reg_r err -32 [ 1484.365245][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.371584][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.391662][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.397149][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.404782][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.410579][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.416537][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.423110][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.429328][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.435098][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.440968][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.446722][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.452794][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.468188][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.483079][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.492402][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.498444][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.512521][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.520406][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.534783][T18326] gspca_vc032x: I2c Bus Busy Wait 00 [ 1484.541255][T18326] gspca_vc032x: Unknown sensor... [ 1484.550173][T18326] vc032x 6-1:0.0: probe with driver vc032x failed with error -22 [ 1484.863111][T30672] FAULT_INJECTION: forcing a failure. [ 1484.863111][T30672] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1484.884326][T30672] CPU: 1 UID: 0 PID: 30672 Comm: syz.0.6592 Not tainted 6.15.0-rc5-syzkaller-00277-g345030986df8 #0 PREEMPT(full) [ 1484.884358][T30672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1484.884372][T30672] Call Trace: [ 1484.884381][T30672] [ 1484.884392][T30672] dump_stack_lvl+0x189/0x250 [ 1484.884425][T30672] ? __lock_acquire+0xaac/0xd20 [ 1484.884458][T30672] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1484.884488][T30672] ? __pfx__printk+0x10/0x10 [ 1484.884510][T30672] ? __might_fault+0xb0/0x130 [ 1484.884548][T30672] should_fail_ex+0x414/0x560 [ 1484.884588][T30672] _copy_from_iter+0x1db/0x15a0 [ 1484.884621][T30672] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 1484.884645][T30672] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 1484.884681][T30672] ? __pfx__copy_from_iter+0x10/0x10 [ 1484.884709][T30672] ? __build_skb_around+0x257/0x3e0 [ 1484.884738][T30672] ? netlink_sendmsg+0x642/0xb30 [ 1484.884760][T30672] ? skb_put+0x11b/0x210 [ 1484.884790][T30672] netlink_sendmsg+0x6b2/0xb30 [ 1484.884824][T30672] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1484.884850][T30672] ? __import_iovec+0x5d4/0x7f0 [ 1484.884876][T30672] ? aa_sock_msg_perm+0x94/0x160 [ 1484.884900][T30672] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1484.884925][T30672] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1484.884950][T30672] __sock_sendmsg+0x219/0x270 [ 1484.884973][T30672] ____sys_sendmsg+0x505/0x830 [ 1484.885008][T30672] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1484.885053][T30672] ___sys_sendmsg+0x21f/0x2a0 [ 1484.885082][T30672] ? __pfx____sys_sendmsg+0x10/0x10 [ 1484.885147][T30672] ? __fget_files+0x2a/0x420 [ 1484.885173][T30672] ? __fget_files+0x3a0/0x420 [ 1484.885211][T30672] __sys_sendmsg+0x164/0x220 [ 1484.885240][T30672] ? __pfx___sys_sendmsg+0x10/0x10 [ 1484.885283][T30672] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1484.885310][T30672] ? lockdep_hardirqs_on+0x9c/0x150 [ 1484.885337][T30672] __do_fast_syscall_32+0xb4/0x110 [ 1484.885364][T30672] ? lockdep_hardirqs_on+0x9c/0x150 [ 1484.885393][T30672] do_fast_syscall_32+0x34/0x80 [ 1484.885420][T30672] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1484.885445][T30672] RIP: 0023:0xf7f37539 [ 1484.885463][T30672] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1484.885481][T30672] RSP: 002b:00000000f505655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1484.885503][T30672] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 1484.885518][T30672] RDX: 0000000004004804 RSI: 0000000000000000 RDI: 0000000000000000 [ 1484.885532][T30672] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1484.885544][T30672] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1484.885557][T30672] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1484.885587][T30672] [ 1485.162772][ C1] vkms_vblank_simulate: vblank timer overrun [ 1485.259298][T18326] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 1485.464985][T18326] usb 3-1: config 0 has an invalid interface number: 122 but max is 0 [ 1485.472060][T15829] usb 6-1: USB disconnect, device number 29 [ 1485.473265][T18326] usb 3-1: config 0 has no interface number 0 [ 1485.485597][T18326] usb 3-1: config 0 interface 122 has no altsetting 0 [ 1485.518743][T18326] usb 3-1: New USB device found, idVendor=13d3, idProduct=3219, bcdDevice=7a.67 [ 1485.531278][T18326] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1485.544471][T18326] usb 3-1: Product: syz [ 1485.636595][T18326] usb 3-1: Manufacturer: syz [ 1485.647734][T18326] usb 3-1: SerialNumber: syz [ 1485.660370][T18326] usb 3-1: config 0 descriptor?? [ 1485.786651][T30680] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 1485.841851][T30681] netlink: 'syz.5.6594': attribute type 21 has an invalid length. [ 1485.858773][T30681] netlink: 'syz.5.6594': attribute type 6 has an invalid length. [ 1485.867470][T30681] netlink: 132 bytes leftover after parsing attributes in process `syz.5.6594'. [ 1486.097912][ T5890] usbhid 4-1:0.0: can't add hid device: -71 [ 1486.134747][ T5890] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1486.166927][ T5890] usb 4-1: USB disconnect, device number 92 [ 1486.208963][T18326] usb 3-1: USB disconnect, device number 117 [ 1486.222868][T18326] dvb-usb: generic DVB-USB module successfully deinitialized and disconnected. [ 1486.391740][T30642] ALSA: mixer_oss: invalid index 40000 [ 1486.403490][ T5901] usb 2-1: USB disconnect, device number 97 [ 1486.568661][ T5890] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 1486.747769][ T5890] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1486.789805][ T5890] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1486.839819][ T5890] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1486.874472][ T5890] usb 4-1: config 0 descriptor?? [ 1486.909532][ T5890] pwc: Askey VC010 type 2 USB webcam detected. [ 1486.948735][T15829] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 1487.067291][T24844] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 1487.110410][T15829] usb 6-1: Using ep0 maxpacket: 32 [ 1487.133409][T15829] usb 6-1: config index 0 descriptor too short (expected 35577, got 27) [ 1487.146280][T15829] usb 6-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 1487.163157][T15829] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 1487.178335][ T5901] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 1487.195268][T15829] usb 6-1: config 1 has no interface number 0 [ 1487.206421][T15829] usb 6-1: config 1 interface 1 altsetting 0 has an endpoint descriptor with address 0x3F, changing to 0xF [ 1487.230345][T24844] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1487.247011][T15829] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 1487.256813][T24844] usb 2-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 1487.272609][T15829] usb 6-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 1487.285697][T24844] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1487.298070][T24844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1487.306237][T15829] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1487.326212][T15829] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1487.350874][ T5890] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1487.357990][ T5901] usb 3-1: Using ep0 maxpacket: 32 [ 1487.385521][ T5901] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1487.395793][ T5890] pwc: recv_control_msg error -32 req 02 val 2700 [ 1487.424886][T15829] snd_usb_pod 6-1:1.1: Line 6 Pocket POD found [ 1487.431868][ T5901] usb 3-1: config 0 has no interface number 0 [ 1487.439321][ T5890] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1487.455239][ T5890] pwc: recv_control_msg error -32 req 04 val 1000 [ 1487.473156][ T5901] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1487.486559][ T5890] pwc: recv_control_msg error -32 req 04 val 1300 [ 1487.496542][ T5901] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1487.511656][ T5890] pwc: recv_control_msg error -32 req 04 val 1400 [ 1487.518936][ T5901] usb 3-1: Product: syz [ 1487.523134][ T5901] usb 3-1: Manufacturer: syz [ 1487.533535][ T5890] pwc: recv_control_msg error -32 req 02 val 2000 [ 1487.544984][ T5901] usb 3-1: SerialNumber: syz [ 1487.550925][ T5890] pwc: recv_control_msg error -32 req 02 val 2100 [ 1487.569821][ T5901] usb 3-1: config 0 descriptor?? [ 1487.578599][T15829] snd_usb_pod 6-1:1.1: endpoint not available, using fallback values [ 1487.596722][T15829] snd_usb_pod 6-1:1.1: invalid control EP [ 1487.602796][ T5890] pwc: recv_control_msg error -32 req 04 val 1500 [ 1487.603691][T15829] snd_usb_pod 6-1:1.1: cannot start listening: -22 [ 1487.622387][T15829] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now disconnected [ 1487.625515][ T5901] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1487.655738][T15829] snd_usb_pod 6-1:1.1: probe with driver snd_usb_pod failed with error -22 [ 1487.693730][ T5901] usb 3-1: selecting invalid altsetting 1 [ 1487.702053][ T5901] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1487.714132][ T5901] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1487.725136][ T5901] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1487.733494][ T5901] usb 3-1: media controller created [ 1487.757292][ T5901] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1487.793818][T30687] 8021q: VLANs not supported on sit0 [ 1487.809148][T15829] usb 6-1: USB disconnect, device number 30 [ 1488.028628][ T5901] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1488.057313][ T5890] pwc: recv_control_msg error -71 req 02 val 2600 [ 1488.070487][ T5890] pwc: recv_control_msg error -71 req 02 val 2900 [ 1488.088351][ T5890] pwc: recv_control_msg error -71 req 02 val 2800 [ 1488.104054][ T5890] pwc: recv_control_msg error -71 req 04 val 1100 [ 1488.117722][ T5890] pwc: recv_control_msg error -71 req 04 val 1200 [ 1488.126294][ T5901] usb 3-1: USB disconnect, device number 118 [ 1488.151662][ T5890] pwc: Registered as video103. [ 1488.174639][ T5890] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input103 [ 1488.214346][ T5890] usb 4-1: USB disconnect, device number 93 [ 1488.877131][T30708] bridge0: port 3(erspan0) entered blocking state [ 1488.891710][T30708] bridge0: port 3(erspan0) entered disabled state [ 1488.904322][T30708] erspan0: entered allmulticast mode [ 1488.920236][T30708] erspan0: entered promiscuous mode [ 1489.187096][T30709] erspan0: left allmulticast mode [ 1489.202668][T30709] erspan0: left promiscuous mode [ 1489.211366][T30709] FAULT_INJECTION: forcing a failure. [ 1489.211366][T30709] name failslab, interval 1, probability 0, space 0, times 0 [ 1489.231197][T30709] CPU: 0 UID: 0 PID: 30709 Comm: syz.3.6604 Not tainted 6.15.0-rc5-syzkaller-00277-g345030986df8 #0 PREEMPT(full) [ 1489.231232][T30709] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1489.231245][T30709] Call Trace: [ 1489.231256][T30709] [ 1489.231266][T30709] dump_stack_lvl+0x189/0x250 [ 1489.231305][T30709] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1489.231343][T30709] ? __pfx__printk+0x10/0x10 [ 1489.231360][T30709] ? __lock_acquire+0xaac/0xd20 [ 1489.231405][T30709] should_fail_ex+0x414/0x560 [ 1489.231453][T30709] should_failslab+0xa8/0x100 [ 1489.231483][T30709] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 1489.231507][T30709] ? rtnl_prop_list_size+0x1ba/0x1e0 [ 1489.231530][T30709] ? __alloc_skb+0x112/0x2d0 [ 1489.231565][T30709] __alloc_skb+0x112/0x2d0 [ 1489.231595][T30709] rtmsg_ifinfo_build_skb+0x84/0x260 [ 1489.231635][T30709] rtmsg_ifinfo+0x8c/0x1a0 [ 1489.231682][T30709] __dev_notify_flags+0xf4/0x2e0 [ 1489.231717][T30709] ? __pfx___dev_notify_flags+0x10/0x10 [ 1489.231744][T30709] ? __pfx_netdev_info+0x10/0x10 [ 1489.231770][T30709] ? __pfx___dev_notify_flags+0x10/0x10 [ 1489.231795][T30709] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1489.231831][T30709] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1489.231870][T30709] __dev_set_promiscuity+0x152/0x590 [ 1489.231904][T30709] netif_set_promiscuity+0x50/0xe0 [ 1489.231932][T30709] dev_set_promiscuity+0x126/0x260 [ 1489.231961][T30709] del_nbp+0x12c/0xa60 [ 1489.232001][T30709] br_del_if+0x146/0x320 [ 1489.232019][T30709] ? br_ioctl_stub+0x85e/0xc80 [ 1489.232051][T30709] br_ioctl_stub+0x869/0xc80 [ 1489.232074][T30709] ? trace_contention_end+0x39/0x120 [ 1489.232098][T30709] ? __pfx_br_ioctl_stub+0x10/0x10 [ 1489.232120][T30709] ? kasan_quarantine_put+0xdd/0x220 [ 1489.232146][T30709] ? sock_ioctl+0x4b4/0x790 [ 1489.232183][T30709] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1489.232218][T30709] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1489.232253][T30709] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1489.232288][T30709] ? inet_compat_ioctl+0x1aa/0x3a0 [ 1489.232321][T30709] ? __pfx_br_ioctl_stub+0x10/0x10 [ 1489.232344][T30709] sock_ioctl+0x4d5/0x790 [ 1489.232384][T30709] ? __pfx_sock_ioctl+0x10/0x10 [ 1489.232436][T30709] compat_sock_ioctl+0x285/0xc80 [ 1489.232478][T30709] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 1489.232515][T30709] ? __fget_files+0x3a0/0x420 [ 1489.232538][T30709] ? __fget_files+0x2a/0x420 [ 1489.232578][T30709] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 1489.232615][T30709] __ia32_compat_sys_ioctl+0x551/0x840 [ 1489.232642][T30709] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1489.232664][T30709] ? __fget_files+0x3a0/0x420 [ 1489.232705][T30709] ? fput+0xa0/0xd0 [ 1489.232735][T30709] ? ksys_write+0x1f0/0x250 [ 1489.232769][T30709] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1489.232802][T30709] ? lockdep_hardirqs_on+0x9c/0x150 [ 1489.232834][T30709] __do_fast_syscall_32+0xb4/0x110 [ 1489.232865][T30709] ? lockdep_hardirqs_on+0x9c/0x150 [ 1489.232895][T30709] do_fast_syscall_32+0x34/0x80 [ 1489.232920][T30709] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1489.232949][T30709] RIP: 0023:0xf706e539 [ 1489.232970][T30709] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1489.233005][T30709] RSP: 002b:00000000f503d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1489.233033][T30709] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000000089a3 [ 1489.233046][T30709] RDX: 0000000080000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 1489.233058][T30709] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1489.233075][T30709] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1489.233090][T30709] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1489.233129][T30709] [ 1489.233238][T30709] bridge0: port 3(erspan0) entered disabled state [ 1489.317377][ T5890] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 1489.798941][ T1164] usb 2-1: USB disconnect, device number 98 [ 1489.838264][ T5890] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1489.855059][ T5890] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1489.870921][ T5890] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1489.884384][ T5890] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1489.894874][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1489.913334][ T5890] usb 3-1: config 0 descriptor?? [ 1490.019742][T30719] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 1490.074563][T30719] netlink: 'syz.5.6607': attribute type 21 has an invalid length. [ 1490.092870][T30719] netlink: 'syz.5.6607': attribute type 6 has an invalid length. [ 1490.104599][T30719] netlink: 132 bytes leftover after parsing attributes in process `syz.5.6607'. [ 1490.327766][T15829] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 1490.392048][ T5890] plantronics 0003:047F:FFFF.0081: No inputs registered, leaving [ 1490.430539][ T5890] plantronics 0003:047F:FFFF.0081: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 1490.490658][T15829] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1490.514429][T15829] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1490.552323][T15829] usb 2-1: New USB device found, idVendor=044e, idProduct=1215, bcdDevice= 0.00 [ 1490.576793][T15829] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1490.613911][T15829] usb 2-1: config 0 descriptor?? [ 1490.678886][T30704] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1490.693446][T30704] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1490.712392][ T5890] usb 3-1: USB disconnect, device number 119 [ 1491.042131][T15829] hid-alps 0003:044E:1215.0082: unknown main item tag 0x0 [ 1491.049675][T15829] hid-alps 0003:044E:1215.0082: unknown main item tag 0x0 [ 1491.057436][T15829] hid-alps 0003:044E:1215.0082: unknown main item tag 0x0 [ 1491.064841][T15829] hid-alps 0003:044E:1215.0082: unknown main item tag 0x0 [ 1491.074320][T15829] hid-alps 0003:044E:1215.0082: unknown main item tag 0x0 [ 1491.082219][T15829] hid-alps 0003:044E:1215.0082: unknown main item tag 0x0 [ 1491.089577][T15829] hid-alps 0003:044E:1215.0082: unknown main item tag 0x0 [ 1491.099160][T15829] hid-alps 0003:044E:1215.0082: hidraw0: USB HID v0.04 Device [HID 044e:1215] on usb-dummy_hcd.1-1/input0 [ 1491.137819][T24844] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 1491.167511][ T5901] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 1491.252749][T30721] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1491.264980][T30721] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1491.285601][T15829] usb 2-1: USB disconnect, device number 99 [ 1491.301819][T24844] usb 4-1: Using ep0 maxpacket: 32 [ 1491.324959][T24844] usb 4-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 1491.331137][ T5901] usb 6-1: config 1 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 96, changing to 10 [ 1491.351044][T24844] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1491.366241][ T5901] usb 6-1: config 1 interface 0 altsetting 2 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1491.373211][T24844] usb 4-1: Product: syz [ 1491.390270][T24844] usb 4-1: Manufacturer: syz [ 1491.394687][ T5901] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1491.395168][T24844] usb 4-1: SerialNumber: syz [ 1491.420987][T24844] usb 4-1: config 0 descriptor?? [ 1491.434784][T24844] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 1491.619249][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 1491.619269][ T30] audit: type=1326 audit(1746931483.696:2288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30732 comm="syz.0.6613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f37539 code=0x7ffc0000 [ 1491.649232][ T30] audit: type=1326 audit(1746931483.696:2289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30732 comm="syz.0.6613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=274 compat=1 ip=0xf7f37539 code=0x7ffc0000 [ 1491.672765][ T30] audit: type=1326 audit(1746931483.696:2290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30732 comm="syz.0.6613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f37539 code=0x7ffc0000 [ 1491.729759][ T30] audit: type=1326 audit(1746931483.696:2291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30732 comm="syz.0.6613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=219 compat=1 ip=0xf7f37539 code=0x7ffc0000 [ 1491.782428][ T30] audit: type=1326 audit(1746931483.796:2292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30732 comm="syz.0.6613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f37539 code=0x7ffc0000 [ 1491.843393][T24844] gspca_stk1135: reg_w 0x0 err -71 [ 1491.852669][T24844] gspca_stk1135: serial bus timeout: status=0x00 [ 1491.873320][ T30] audit: type=1326 audit(1746931483.796:2293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30732 comm="syz.0.6613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f37539 code=0x7ffc0000 [ 1491.907922][T24844] gspca_stk1135: Sensor write failed [ 1491.913285][T24844] gspca_stk1135: serial bus timeout: status=0x00 [ 1491.937653][T24844] gspca_stk1135: Sensor write failed [ 1491.956745][ T30] audit: type=1326 audit(1746931483.866:2294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30732 comm="syz.0.6613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf7f37539 code=0x7ffc0000 [ 1491.973112][T24844] gspca_stk1135: serial bus timeout: status=0x00 [ 1491.982159][ T30] audit: type=1326 audit(1746931483.866:2295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30732 comm="syz.0.6613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f37539 code=0x7ffc0000 [ 1492.007242][T24844] gspca_stk1135: Sensor read failed [ 1492.010320][ T30] audit: type=1326 audit(1746931483.866:2296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30732 comm="syz.0.6613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f37539 code=0x7ffc0000 [ 1492.018876][T24844] gspca_stk1135: serial bus timeout: status=0x00 [ 1492.060335][ T30] audit: type=1326 audit(1746931483.876:2297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30732 comm="syz.0.6613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f37539 code=0x7ffc0000 [ 1492.103015][T24844] gspca_stk1135: Sensor read failed [ 1492.103200][T30731] input: syz0 as /devices/virtual/input/input105 [ 1492.108753][T24844] gspca_stk1135: Detected sensor type unknown (0x0) [ 1492.108806][T24844] gspca_stk1135: serial bus timeout: status=0x00 [ 1492.108819][T24844] gspca_stk1135: Sensor read failed [ 1492.108854][T24844] gspca_stk1135: serial bus timeout: status=0x00 [ 1492.108866][T24844] gspca_stk1135: Sensor read failed [ 1492.108900][T24844] gspca_stk1135: serial bus timeout: status=0x00 [ 1492.108911][T24844] gspca_stk1135: Sensor write failed [ 1492.108945][T24844] gspca_stk1135: serial bus timeout: status=0x00 [ 1492.108958][T24844] gspca_stk1135: Sensor write failed [ 1492.109039][T24844] stk1135 4-1:0.0: probe with driver stk1135 failed with error -71 [ 1492.124624][T24844] usb 4-1: USB disconnect, device number 94 [ 1492.327509][T15829] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 1492.477431][T15829] usb 2-1: Using ep0 maxpacket: 32 [ 1492.486817][T15829] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1492.538083][T15829] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1492.577490][T15829] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1492.632761][T15829] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1492.645214][T15829] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1492.656913][T15829] usb 2-1: Product: syz [ 1492.661968][T15829] usb 2-1: Manufacturer: syz [ 1492.666741][T15829] usb 2-1: SerialNumber: syz [ 1492.700022][T15829] cdc_ncm 2-1:1.0: skipping garbage [ 1492.715570][T15829] cdc_ncm 2-1:1.0: skipping garbage [ 1492.725214][T15829] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 1492.733122][T15829] cdc_ncm 2-1:1.0: bind() failure [ 1492.886518][T28525] usb 2-1: USB disconnect, device number 100 [ 1493.079932][T15829] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 1493.124451][T30757] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 1493.151972][T30757] netlink: 'syz.3.6621': attribute type 21 has an invalid length. [ 1493.161483][T30757] netlink: 'syz.3.6621': attribute type 6 has an invalid length. [ 1493.171086][T30757] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6621'. [ 1493.252318][T15829] usb 3-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1493.263620][T15829] usb 3-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 1493.274617][T15829] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1493.284004][T15829] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1493.473299][T30762] netlink: 'syz.1.6623': attribute type 3 has an invalid length. [ 1493.482071][T30762] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6623'. [ 1493.737765][T15829] usb 2-1: new full-speed USB device number 101 using dummy_hcd [ 1493.890584][T15829] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 1493.902752][T15829] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 1493.916012][T15829] usb 2-1: New USB device found, idVendor=046a, idProduct=0023, bcdDevice= 0.00 [ 1493.926874][T15829] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1493.940673][T15829] usb 2-1: config 0 descriptor?? [ 1493.952831][T30762] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1494.006296][ T5901] usb 6-1: New USB device found, idVendor=18d1, idProduct=5030, bcdDevice= 0.40 [ 1494.029574][ T5901] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1494.055728][ T5901] usb 6-1: can't set config #1, error -71 [ 1494.071942][ T5901] usb 6-1: USB disconnect, device number 31 [ 1494.373901][T15829] cherry 0003:046A:0023.0083: unbalanced collection at end of report description [ 1494.401695][T15829] cherry 0003:046A:0023.0083: probe with driver cherry failed with error -22 [ 1494.573336][T15829] usb 2-1: USB disconnect, device number 101 [ 1494.598424][ T5901] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 1494.757514][ T5901] usb 4-1: Using ep0 maxpacket: 32 [ 1494.764620][ T5901] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1494.774218][ T5901] usb 4-1: config 0 has no interface number 0 [ 1494.783800][ T5901] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1494.793471][ T5901] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1494.801668][ T5901] usb 4-1: Product: syz [ 1494.806035][ T5901] usb 4-1: Manufacturer: syz [ 1494.811760][ T5901] usb 4-1: SerialNumber: syz [ 1494.819641][ T5901] usb 4-1: config 0 descriptor?? [ 1494.832950][ T5901] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1494.842826][ T5901] usb 4-1: selecting invalid altsetting 1 [ 1494.849765][ T5901] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1494.861326][ T5901] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1494.872641][ T5901] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1494.881576][ T5901] usb 4-1: media controller created [ 1494.903905][ T5901] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1494.958115][T24844] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 1495.123141][T24844] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1495.146707][T24844] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1495.163007][T24844] usb 6-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1495.173292][T24844] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1495.193868][T24844] usb 6-1: config 0 descriptor?? [ 1495.248685][ T5901] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1495.347734][ T5901] usb 4-1: USB disconnect, device number 95 [ 1495.799003][ T5901] usb 3-1: USB disconnect, device number 120 [ 1495.834208][T30782] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1495.879236][T30782] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1495.890933][T30782] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6632'. [ 1495.927421][T30782] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6632'. [ 1495.937802][T30782] netlink: 'syz.5.6632': attribute type 18 has an invalid length. [ 1495.945761][T30782] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6632'. [ 1496.028401][T30788] FAULT_INJECTION: forcing a failure. [ 1496.028401][T30788] name failslab, interval 1, probability 0, space 0, times 0 [ 1496.067959][T30788] CPU: 0 UID: 0 PID: 30788 Comm: syz.2.6634 Not tainted 6.15.0-rc5-syzkaller-00277-g345030986df8 #0 PREEMPT(full) [ 1496.067991][T30788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1496.068003][T30788] Call Trace: [ 1496.068029][T30788] [ 1496.068039][T30788] dump_stack_lvl+0x189/0x250 [ 1496.068077][T30788] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1496.068110][T30788] ? __pfx__printk+0x10/0x10 [ 1496.068134][T30788] ? __pfx___might_resched+0x10/0x10 [ 1496.068154][T30788] ? fs_reclaim_acquire+0x7d/0x100 [ 1496.068189][T30788] should_fail_ex+0x414/0x560 [ 1496.068227][T30788] should_failslab+0xa8/0x100 [ 1496.068256][T30788] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 1496.068283][T30788] ? __alloc_skb+0x112/0x2d0 [ 1496.068312][T30788] __alloc_skb+0x112/0x2d0 [ 1496.068342][T30788] alloc_skb_with_frags+0xca/0x890 [ 1496.068367][T30788] ? __might_fault+0xb0/0x130 [ 1496.068406][T30788] sock_alloc_send_pskb+0x857/0x990 [ 1496.068454][T30788] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1496.068490][T30788] ? dev_get_by_index+0x22/0x2e0 [ 1496.068521][T30788] ? dev_get_by_index+0x22/0x2e0 [ 1496.068558][T30788] packet_sendmsg+0x3664/0x5400 [ 1496.068617][T30788] ? __pfx___might_resched+0x10/0x10 [ 1496.068653][T30788] ? __pfx_packet_sendmsg+0x10/0x10 [ 1496.068675][T30788] ? aa_sk_perm+0x81e/0x950 [ 1496.068702][T30788] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 1496.068731][T30788] ? __asan_memset+0x22/0x50 [ 1496.068751][T30788] ? __import_iovec+0x40e/0x7f0 [ 1496.068777][T30788] ? aa_sock_msg_perm+0x94/0x160 [ 1496.068808][T30788] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1496.068832][T30788] ? __pfx_packet_sendmsg+0x10/0x10 [ 1496.068856][T30788] __sock_sendmsg+0x219/0x270 [ 1496.068879][T30788] ____sys_sendmsg+0x505/0x830 [ 1496.068911][T30788] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1496.068955][T30788] ___sys_sendmsg+0x21f/0x2a0 [ 1496.068984][T30788] ? __pfx____sys_sendmsg+0x10/0x10 [ 1496.069047][T30788] ? __fget_files+0x2a/0x420 [ 1496.069071][T30788] ? __fget_files+0x3a0/0x420 [ 1496.069107][T30788] __sys_sendmsg+0x164/0x220 [ 1496.069135][T30788] ? __pfx___sys_sendmsg+0x10/0x10 [ 1496.069176][T30788] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1496.069204][T30788] ? lockdep_hardirqs_on+0x9c/0x150 [ 1496.069230][T30788] __do_fast_syscall_32+0xb4/0x110 [ 1496.069258][T30788] ? lockdep_hardirqs_on+0x9c/0x150 [ 1496.069285][T30788] do_fast_syscall_32+0x34/0x80 [ 1496.069311][T30788] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1496.069336][T30788] RIP: 0023:0xf705e539 [ 1496.069354][T30788] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1496.069371][T30788] RSP: 002b:00000000f504e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1496.069393][T30788] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 1496.069408][T30788] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1496.069421][T30788] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1496.069432][T30788] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1496.069445][T30788] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1496.069474][T30788] [ 1496.388517][ C0] vkms_vblank_simulate: vblank timer overrun [ 1496.607447][ T5901] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 1496.769446][ T5901] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1496.787941][ T5901] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1496.807430][ T5901] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1496.823180][ T5901] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1496.832717][ T5901] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1496.851557][T24844] uclogic 0003:256C:006D.0084: v1 frame probing failed: -71 [ 1496.859824][T24844] uclogic 0003:256C:006D.0084: failed probing parameters: -71 [ 1496.870797][T24844] uclogic 0003:256C:006D.0084: probe with driver uclogic failed with error -71 [ 1496.888462][T24844] usb 6-1: USB disconnect, device number 32 [ 1496.915119][T30800] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6639'. [ 1496.918267][ T5901] usb 4-1: config 0 descriptor?? [ 1496.924961][T30800] netlink: 'syz.1.6639': attribute type 2 has an invalid length. [ 1496.938187][T15829] usb 3-1: new full-speed USB device number 121 using dummy_hcd [ 1496.940955][T30800] netlink: 'syz.1.6639': attribute type 1 has an invalid length. [ 1496.970367][T30800] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6639'. [ 1497.110334][T15829] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1497.120220][T15829] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1497.140350][T15829] usb 3-1: config 0 descriptor?? [ 1497.161835][ T5901] usbhid 4-1:0.0: can't add hid device: -71 [ 1497.178145][ T5901] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1497.194208][ T5901] usb 4-1: USB disconnect, device number 96 [ 1497.741377][T30811] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6643'. [ 1497.758551][T30811] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6643'. [ 1497.806527][T30816] netlink: 'syz.1.6645': attribute type 58 has an invalid length. [ 1497.956142][T30821] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6647'. [ 1498.068232][T28525] usb 3-1: USB disconnect, device number 121 [ 1498.107644][T15829] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 1498.157873][T24844] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 1498.257444][ T5901] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 1498.269152][T15829] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1498.280490][T15829] usb 4-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 1498.289787][T15829] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1498.299344][T15829] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1498.333227][T24844] usb 6-1: too many endpoints for config 4 interface 0 altsetting 0: 101, using maximum allowed: 30 [ 1498.344801][T24844] usb 6-1: config 4 interface 0 altsetting 0 has an endpoint descriptor with address 0xC4, changing to 0x84 [ 1498.356736][T24844] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 240, setting to 64 [ 1498.368860][T24844] usb 6-1: config 4 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 101 [ 1498.382082][T24844] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1498.391328][T24844] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1498.408698][ T5901] usb 2-1: Using ep0 maxpacket: 16 [ 1498.419872][ T5901] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1498.441280][ T5901] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1498.456137][ T5901] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1498.465856][ T5901] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1498.474192][ T5901] usb 2-1: Product: syz [ 1498.480184][ T5901] usb 2-1: Manufacturer: syz [ 1498.484809][ T5901] usb 2-1: SerialNumber: syz [ 1498.493016][ T5901] usb 2-1: config 0 descriptor?? [ 1498.498804][T28525] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 1498.510186][ T5901] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1498.526689][ T5901] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 1498.606375][T24844] ath6kl: Failed to submit usb control message: -71 [ 1498.614000][T24844] ath6kl: unable to send the bmi data to the device: -71 [ 1498.621423][T24844] ath6kl: Unable to send get target info: -71 [ 1498.640561][T24844] ath6kl: Failed to init ath6kl core: -71 [ 1498.648852][T24844] ath6kl_usb 6-1:4.0: probe with driver ath6kl_usb failed with error -71 [ 1498.673286][T28525] usb 3-1: Using ep0 maxpacket: 8 [ 1498.685650][T24844] usb 6-1: USB disconnect, device number 33 [ 1498.694283][T28525] usb 3-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1498.706105][T28525] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1498.724414][T28525] usb 3-1: Product: syz [ 1498.729854][T28525] usb 3-1: Manufacturer: syz [ 1498.734531][T28525] usb 3-1: SerialNumber: syz [ 1498.744507][T28525] usb 3-1: config 0 descriptor?? [ 1498.754823][T28525] gspca_main: se401-2.14.0 probing 047d:5003 [ 1499.125539][ T5901] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 1499.134733][ T5901] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 1499.244861][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 1499.244910][ T30] audit: type=1326 audit(1746931491.316:2318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30832 comm="syz.5.6651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1499.276646][ T30] audit: type=1326 audit(1746931491.316:2319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30832 comm="syz.5.6651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1499.300390][ T30] audit: type=1326 audit(1746931491.316:2320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30832 comm="syz.5.6651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=274 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1499.323262][ T30] audit: type=1326 audit(1746931491.316:2321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30832 comm="syz.5.6651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1499.375961][T28525] input: se401 as /devices/platform/dummy_hcd.2/usb3/3-1/input/input106 [ 1499.420065][ T30] audit: type=1326 audit(1746931491.316:2322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30832 comm="syz.5.6651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=219 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1499.495070][ T30] audit: type=1326 audit(1746931491.316:2323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30832 comm="syz.5.6651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1499.556505][T30824] netlink: 'syz.1.6648': attribute type 1 has an invalid length. [ 1499.576021][ T30] audit: type=1326 audit(1746931491.316:2324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30832 comm="syz.5.6651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1499.576086][T30824] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1499.605716][T30824] IPv6: NLM_F_CREATE should be set when creating new route [ 1499.705833][T30829] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1499.730406][ T30] audit: type=1326 audit(1746931491.346:2325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30832 comm="syz.5.6651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1499.785306][T30829] __nla_validate_parse: 1 callbacks suppressed [ 1499.785328][T30829] netlink: 68 bytes leftover after parsing attributes in process `syz.2.6650'. [ 1499.796405][ T30] audit: type=1326 audit(1746931491.346:2326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30832 comm="syz.5.6651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1499.892873][T28525] usb 3-1: USB disconnect, device number 122 [ 1499.925190][ T5901] em28xx 2-1:0.0: Unknown AC97 audio processor detected! [ 1499.955060][ T30] audit: type=1326 audit(1746931491.346:2327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30832 comm="syz.5.6651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=219 compat=1 ip=0xf705e539 code=0x7ffc0000 [ 1500.557714][ T5901] em28xx 2-1:0.0: AC97 command still being executed: not handled properly! [ 1500.571899][ T5901] em28xx 2-1:0.0: couldn't setup AC97 register 4 [ 1500.745493][ T5901] em28xx 2-1:0.0: couldn't setup AC97 register 6 [ 1500.770382][ T5901] em28xx 2-1:0.0: couldn't setup AC97 register 54 [ 1500.801047][ T5901] em28xx 2-1:0.0: couldn't setup AC97 register 56 [ 1500.847992][T18326] usb 4-1: USB disconnect, device number 97 [ 1500.909544][ T5901] usb 2-1: USB disconnect, device number 102 [ 1501.074978][T30850] FAULT_INJECTION: forcing a failure. [ 1501.074978][T30850] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1501.123349][T30850] CPU: 0 UID: 0 PID: 30850 Comm: syz.3.6657 Not tainted 6.15.0-rc5-syzkaller-00277-g345030986df8 #0 PREEMPT(full) [ 1501.123379][T30850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1501.123392][T30850] Call Trace: [ 1501.123401][T30850] [ 1501.123411][T30850] dump_stack_lvl+0x189/0x250 [ 1501.123448][T30850] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1501.123479][T30850] ? __pfx__printk+0x10/0x10 [ 1501.123513][T30850] should_fail_ex+0x414/0x560 [ 1501.123553][T30850] _copy_to_user+0x31/0xb0 [ 1501.123583][T30850] simple_read_from_buffer+0xe1/0x170 [ 1501.123614][T30850] proc_fail_nth_read+0x1df/0x250 [ 1501.123647][T30850] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1501.123679][T30850] ? rw_verify_area+0x258/0x650 [ 1501.123702][T30850] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1501.123733][T30850] vfs_read+0x1fd/0x980 [ 1501.123762][T30850] ? __pfx___mutex_lock+0x10/0x10 [ 1501.123789][T30850] ? __pfx_vfs_read+0x10/0x10 [ 1501.123814][T30850] ? __fget_files+0x2a/0x420 [ 1501.123845][T30850] ? __fget_files+0x3a0/0x420 [ 1501.123871][T30850] ? __fget_files+0x2a/0x420 [ 1501.123907][T30850] ksys_read+0x145/0x250 [ 1501.123933][T30850] ? __pfx_ksys_read+0x10/0x10 [ 1501.123958][T30850] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1501.123985][T30850] ? lockdep_hardirqs_on+0x9c/0x150 [ 1501.124012][T30850] __do_fast_syscall_32+0xb4/0x110 [ 1501.124039][T30850] ? lockdep_hardirqs_on+0x9c/0x150 [ 1501.124068][T30850] do_fast_syscall_32+0x34/0x80 [ 1501.124094][T30850] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1501.124120][T30850] RIP: 0023:0xf706e539 [ 1501.124137][T30850] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1501.124221][T30850] RSP: 002b:00000000f505e590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 1501.124242][T30850] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f505e620 [ 1501.124257][T30850] RDX: 000000000000000f RSI: 00000000f73d2ff4 RDI: 0000000000000000 [ 1501.124270][T30850] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 1501.124283][T30850] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1501.124296][T30850] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1501.124326][T30850] [ 1501.164197][T30857] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6658'. [ 1501.383720][T30857] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6658'. [ 1501.437281][ T5892] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 1501.585132][T30861] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 1501.632634][ T5892] usb 6-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1501.674524][T29201] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1501.675812][ T5892] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1501.693870][T29201] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1501.716898][T29201] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1501.721541][T30861] netlink: 'syz.1.6660': attribute type 21 has an invalid length. [ 1501.734890][T29201] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1501.735574][ T5892] usb 6-1: New USB device found, idVendor=044e, idProduct=1215, bcdDevice= 0.00 [ 1501.752985][T29201] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1501.758128][ T36] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1501.760718][T15829] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 1501.782895][ T5892] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1501.824039][T30861] netlink: 'syz.1.6660': attribute type 6 has an invalid length. [ 1501.833051][T30861] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6660'. [ 1501.843064][ T5892] usb 6-1: config 0 descriptor?? [ 1501.908093][ T5901] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 1501.924339][ T36] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1501.957965][T15829] usb 4-1: Using ep0 maxpacket: 8 [ 1501.971113][T15829] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1501.985983][T15829] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1502.007853][T15829] usb 4-1: Product: syz [ 1502.012591][T15829] usb 4-1: Manufacturer: syz [ 1502.018705][T15829] usb 4-1: SerialNumber: syz [ 1502.026122][T15829] usb 4-1: config 0 descriptor?? [ 1502.041929][T15829] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 1502.042585][ T36] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1502.052365][T15829] usb 4-1: setting power ON [ 1502.073028][T15829] dvb-usb: bulk message failed: -22 (2/0) [ 1502.078615][ T5901] usb 3-1: Using ep0 maxpacket: 32 [ 1502.084784][ T5901] usb 3-1: too many configurations: 30, using maximum allowed: 8 [ 1502.102106][T15829] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1502.105579][ T5901] usb 3-1: config 0 has an invalid descriptor of length 142, skipping remainder of the config [ 1502.113442][T15829] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 1502.132737][T15829] usb 4-1: media controller created [ 1502.154728][ T5901] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1502.160982][T15829] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1502.199575][ T5901] usb 3-1: config 0 has an invalid descriptor of length 142, skipping remainder of the config [ 1502.201563][T15829] usb 4-1: selecting invalid altsetting 6 [ 1502.214536][ T5901] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1502.223875][T15829] usb 4-1: digital interface selection failed (-22) [ 1502.236893][T15829] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 1502.246322][T15829] usb 4-1: setting power OFF [ 1502.254813][T15829] dvb-usb: bulk message failed: -22 (2/0) [ 1502.259819][ T5901] usb 3-1: config 0 has an invalid descriptor of length 142, skipping remainder of the config [ 1502.263506][T15829] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 1502.281073][T15829] (NULL device *): no alternate interface [ 1502.291716][ T36] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1502.310905][T30869] dvb-usb: bulk message failed: -22 (3/0) [ 1502.316703][T30869] usb 4-1: gpio_write failed. [ 1502.326145][ T5892] hid-alps 0003:044E:1215.0085: unknown main item tag 0x0 [ 1502.333630][T30869] dvb-usb: bulk message failed: -22 (3/0) [ 1502.343765][ T5892] hid-alps 0003:044E:1215.0085: unknown main item tag 0x0 [ 1502.366074][ T5901] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1502.380844][ T5892] hid-alps 0003:044E:1215.0085: unknown main item tag 0x0 [ 1502.388812][ T5892] hid-alps 0003:044E:1215.0085: unknown main item tag 0x0 [ 1502.396255][ T5892] hid-alps 0003:044E:1215.0085: unknown main item tag 0x0 [ 1502.403855][ T5892] hid-alps 0003:044E:1215.0085: unknown main item tag 0x0 [ 1502.431541][ T5901] usb 3-1: config 0 has an invalid descriptor of length 142, skipping remainder of the config [ 1502.443348][ T5901] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1502.459870][ T5892] hid-alps 0003:044E:1215.0085: unknown main item tag 0x0 [ 1502.477309][ T5901] usb 3-1: config 0 has an invalid descriptor of length 142, skipping remainder of the config [ 1502.489256][T30851] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1502.513565][ T5892] hid-alps 0003:044E:1215.0085: hidraw0: USB HID v0.04 Device [HID 044e:1215] on usb-dummy_hcd.5-1/input0 [ 1502.540478][T30851] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1502.556369][ T5901] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1502.645434][ T5892] usb 6-1: USB disconnect, device number 34 [ 1502.658335][ T5901] usb 3-1: config 0 has an invalid descriptor of length 142, skipping remainder of the config [ 1502.719095][ T5901] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1502.743923][T30875] netlink: 100 bytes leftover after parsing attributes in process `syz.1.6662'. [ 1502.776870][T30873] fido_id[30873]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 1502.814887][ T5901] usb 3-1: config 0 has an invalid descriptor of length 142, skipping remainder of the config [ 1502.896912][ T5901] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1502.905371][T30867] chnl_net:caif_netlink_parms(): no params data found [ 1502.963628][T15829] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 1502.978106][ T5901] usb 3-1: config 0 has an invalid descriptor of length 142, skipping remainder of the config [ 1503.009088][ T5901] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1503.052412][T15829] usb 4-1: USB disconnect, device number 98 [ 1503.109351][ T5901] usb 3-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 1503.188431][ T5901] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1503.218522][ T5901] usb 3-1: config 0 descriptor?? [ 1503.464274][ T5901] usb 3-1: string descriptor 0 read error: -71 [ 1503.488156][ T5901] usb 3-1: USB disconnect, device number 123 [ 1503.672340][T30890] --map-set only usable from mangle table [ 1503.858029][T25338] Bluetooth: hci1: command tx timeout [ 1505.308841][ T36] bond0 (unregistering): Released all slaves [ 1505.417529][ T5893] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 1505.579105][ T5893] usb 2-1: Using ep0 maxpacket: 8 [ 1505.610389][ T5893] usb 2-1: config 0 has an invalid interface number: 31 but max is 0 [ 1505.639327][ T5893] usb 2-1: config 0 has no interface number 0 [ 1505.690676][ T5893] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1505.723052][ T5893] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1505.748414][ T5893] usb 2-1: Product: syz [ 1505.752782][ T5893] usb 2-1: Manufacturer: syz [ 1505.765759][ T5893] usb 2-1: SerialNumber: syz [ 1505.774513][ T5893] usb 2-1: config 0 descriptor?? [ 1505.938875][T25338] Bluetooth: hci1: command tx timeout [ 1505.985499][T30867] bridge0: port 1(bridge_slave_0) entered blocking state [ 1505.997621][ T5893] usb 2-1: Found UVC 0.04 device syz (046d:08c3) [ 1506.004090][ T5893] usb 2-1: Failed to initialize entity for entity 6 [ 1506.030453][T30867] bridge0: port 1(bridge_slave_0) entered disabled state [ 1506.046629][ T5893] usb 2-1: Failed to register entities (-22). [ 1506.053425][T30867] bridge_slave_0: entered allmulticast mode [ 1506.072428][T30867] bridge_slave_0: entered promiscuous mode [ 1506.087506][T28525] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 1506.098284][ T1164] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 1506.175409][T30867] bridge0: port 2(bridge_slave_1) entered blocking state [ 1506.195543][T30867] bridge0: port 2(bridge_slave_1) entered disabled state [ 1506.222605][T30867] bridge_slave_1: entered allmulticast mode [ 1506.233001][T30867] bridge_slave_1: entered promiscuous mode [ 1506.260999][ T5892] usb 2-1: USB disconnect, device number 103 [ 1506.263252][T28525] usb 4-1: Using ep0 maxpacket: 8 [ 1506.283299][T28525] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1506.293393][T28525] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1506.318740][ T1164] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1506.336882][T28525] usb 4-1: Product: syz [ 1506.351918][ T1164] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1506.353931][T28525] usb 4-1: Manufacturer: syz [ 1506.373783][T30867] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1506.389796][ T1164] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1506.399140][T28525] usb 4-1: SerialNumber: syz [ 1506.420988][T28525] usb 4-1: config 0 descriptor?? [ 1506.427282][ T36] batadv0: left promiscuous mode [ 1506.444317][T28525] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 1506.457043][T28525] usb 4-1: setting power ON [ 1506.458308][ T1164] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1506.471424][T28525] dvb-usb: bulk message failed: -22 (2/0) [ 1506.485372][T28525] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1506.496953][ T1164] usb 3-1: config 0 descriptor?? [ 1506.502294][ T36] hsr_slave_0: left promiscuous mode [ 1506.522546][ T36] hsr_slave_1: left promiscuous mode [ 1506.523161][T28525] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 1506.548260][T28525] usb 4-1: media controller created [ 1506.590442][T28525] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1506.616906][ T36] veth1_macvtap: left promiscuous mode [ 1506.633653][T28525] usb 4-1: selecting invalid altsetting 6 [ 1506.650117][ T36] veth0_macvtap: left promiscuous mode [ 1506.662917][T28525] usb 4-1: digital interface selection failed (-22) [ 1506.667353][ T36] veth1_vlan: left promiscuous mode [ 1506.675043][T28525] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 1506.686922][ T36] veth0_vlan: left promiscuous mode [ 1506.693596][T28525] usb 4-1: setting power OFF [ 1506.721208][T30941] dvb-usb: bulk message failed: -22 (3/0) [ 1506.753454][T28525] dvb-usb: bulk message failed: -22 (2/0) [ 1506.760290][T30941] usb 4-1: gpio_write failed. [ 1506.769772][T30941] dvb-usb: bulk message failed: -22 (3/0) [ 1506.793069][T28525] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 1506.813687][T28525] (NULL device *): no alternate interface [ 1506.937821][ T5893] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 1507.119567][ T5893] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1507.143128][T30924] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1507.155477][T30924] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1507.157694][ T5893] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1507.168370][T30924] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6671'. [ 1507.182166][ T5893] usb 6-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1507.182199][ T5893] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1507.191345][ T5893] usb 6-1: config 0 descriptor?? [ 1507.216470][T30924] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6671'. [ 1507.250831][T30924] netlink: 'syz.2.6671': attribute type 18 has an invalid length. [ 1507.261237][T30924] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6671'. [ 1507.328605][ T5901] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 1507.508552][ T5901] usb 2-1: Using ep0 maxpacket: 32 [ 1507.522492][ T5901] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1507.542740][ T5901] usb 2-1: config 0 has no interface number 0 [ 1507.552968][ T5901] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1507.565346][ T5901] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1507.574576][ T5901] usb 2-1: Product: syz [ 1507.578970][ T5901] usb 2-1: Manufacturer: syz [ 1507.583655][ T5901] usb 2-1: SerialNumber: syz [ 1507.595632][ T5901] usb 2-1: config 0 descriptor?? [ 1507.604993][ T5901] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1507.619561][ T5901] usb 2-1: selecting invalid altsetting 1 [ 1507.625406][ T5901] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1507.645816][ T5901] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1507.672382][ T5901] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1507.681827][ T5901] usb 2-1: media controller created [ 1507.731537][ T5901] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1507.930788][T30940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1507.948939][T30940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1507.970188][T30940] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6674'. [ 1507.979784][T30940] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6674'. [ 1507.991710][T30940] netlink: 'syz.5.6674': attribute type 18 has an invalid length. [ 1507.999863][T30940] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6674'. [ 1508.028624][T25338] Bluetooth: hci1: command tx timeout [ 1508.611587][T30867] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1508.626680][ T5901] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1508.645808][ T1164] uclogic 0003:256C:006D.0086: v1 frame probing failed: -71 [ 1508.672307][ T5893] uclogic 0003:256C:006D.0087: v1 frame probing failed: -71 [ 1508.679666][ T1164] uclogic 0003:256C:006D.0086: failed probing parameters: -71 [ 1508.679780][ T1164] uclogic 0003:256C:006D.0086: probe with driver uclogic failed with error -71 [ 1508.711593][ T5893] uclogic 0003:256C:006D.0087: failed probing parameters: -71 [ 1508.722292][ T5893] uclogic 0003:256C:006D.0087: probe with driver uclogic failed with error -71 [ 1508.739676][ T1164] usb 3-1: USB disconnect, device number 124 [ 1508.797846][ T5893] usb 6-1: USB disconnect, device number 35 [ 1508.892306][ T5901] usb 2-1: USB disconnect, device number 104 [ 1508.914740][T30867] team0: Port device team_slave_0 added [ 1508.953227][T30867] team0: Port device team_slave_1 added [ 1509.081291][T30867] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1509.104155][T30867] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1509.153860][T28525] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 1509.174437][T30867] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1509.203004][T28525] usb 4-1: USB disconnect, device number 99 [ 1509.254374][T30867] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1509.288636][T30867] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1509.374995][T30867] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1509.598805][T30967] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6677'. [ 1509.608939][T30967] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6677'. [ 1509.674545][T30967] ================================================================== [ 1509.683105][T30967] BUG: KASAN: slab-use-after-free in fib6_ifdown+0xa2/0x4c0 [ 1509.690519][T30967] Read of size 8 at addr ffff88801dfdc8b0 by task syz.2.6677/30967 [ 1509.698442][T30967] [ 1509.700806][T30967] CPU: 0 UID: 0 PID: 30967 Comm: syz.2.6677 Not tainted 6.15.0-rc5-syzkaller-00277-g345030986df8 #0 PREEMPT(full) [ 1509.700836][T30967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1509.700851][T30967] Call Trace: [ 1509.700861][T30967] [ 1509.700870][T30967] dump_stack_lvl+0x189/0x250 [ 1509.700907][T30967] ? __virt_addr_valid+0x18c/0x540 [ 1509.700936][T30967] ? rcu_is_watching+0x15/0xb0 [ 1509.700980][T30967] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1509.701009][T30967] ? rcu_is_watching+0x15/0xb0 [ 1509.701037][T30967] ? lock_release+0x4b/0x3e0 [ 1509.701067][T30967] ? __virt_addr_valid+0x18c/0x540 [ 1509.701093][T30967] ? __virt_addr_valid+0x469/0x540 [ 1509.701120][T30967] print_report+0xb4/0x290 [ 1509.701145][T30967] ? fib6_ifdown+0xa2/0x4c0 [ 1509.701168][T30967] kasan_report+0x118/0x150 [ 1509.701196][T30967] ? fib6_ifdown+0xa2/0x4c0 [ 1509.701222][T30967] fib6_ifdown+0xa2/0x4c0 [ 1509.701248][T30967] ? __pfx_fib6_ifdown+0x10/0x10 [ 1509.701271][T30967] fib6_clean_node+0x24a/0x590 [ 1509.701296][T30967] ? __pfx_fib6_clean_node+0x10/0x10 [ 1509.701322][T30967] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1509.701355][T30967] fib6_walk_continue+0x678/0x910 [ 1509.701384][T30967] fib6_walk+0x149/0x290 [ 1509.701407][T30967] __fib6_clean_all+0x234/0x380 [ 1509.701427][T30967] ? __fib6_clean_all+0x9b/0x380 [ 1509.701448][T30967] ? __pfx_fib6_ifdown+0x10/0x10 [ 1509.701471][T30967] ? __pfx___fib6_clean_all+0x10/0x10 [ 1509.701494][T30967] ? __pfx_fib6_clean_node+0x10/0x10 [ 1509.701516][T30967] ? __pfx_fib6_ifdown+0x10/0x10 [ 1509.701540][T30967] ? __lock_acquire+0xaac/0xd20 [ 1509.701572][T30967] rt6_disable_ip+0x120/0x720 [ 1509.701599][T30967] ? rcu_is_watching+0x15/0xb0 [ 1509.701629][T30967] ? __pfx_rt6_disable_ip+0x10/0x10 [ 1509.701657][T30967] addrconf_ifdown+0x15d/0x1880 [ 1509.701677][T30967] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 1509.701704][T30967] ? __pfx___mutex_lock+0x10/0x10 [ 1509.701730][T30967] ? tls_dev_event+0x717/0xec0 [ 1509.701767][T30967] ? __pfx_addrconf_ifdown+0x10/0x10 [ 1509.701794][T30967] addrconf_notify+0x1bc/0x1010 [ 1509.701822][T30967] notifier_call_chain+0x1b3/0x3e0 [ 1509.701842][T30967] unregister_netdevice_many_notify+0x15d8/0x2330 [ 1509.701870][T30967] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 1509.701900][T30967] ? lockdep_hardirqs_on+0x9c/0x150 [ 1509.701919][T30967] unregister_netdevice_queue+0x33c/0x380 [ 1509.701941][T30967] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 1509.701962][T30967] ? kvfree_call_rcu+0x374/0x410 [ 1509.701983][T30967] hsr_dev_finalize+0x707/0x9f0 [ 1509.702001][T30967] hsr_newlink+0x7d7/0x940 [ 1509.702015][T30967] ? validate_linkmsg+0x765/0x950 [ 1509.702036][T30967] ? __pfx_hsr_newlink+0x10/0x10 [ 1509.702052][T30967] ? __pfx_hsr_newlink+0x10/0x10 [ 1509.702067][T30967] rtnl_newlink_create+0x305/0xaf0 [ 1509.702085][T30967] ? __mutex_lock+0x51b/0xe80 [ 1509.702104][T30967] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1509.702120][T30967] ? rtnl_newlink+0x8db/0x1c70 [ 1509.702135][T30967] ? __pfx___mutex_lock+0x10/0x10 [ 1509.702156][T30967] ? ns_capable+0x8a/0xf0 [ 1509.702169][T30967] rtnl_newlink+0x16d6/0x1c70 [ 1509.702185][T30967] ? kasan_save_track+0x3e/0x80 [ 1509.702204][T30967] ? __pfx_rtnl_newlink+0x10/0x10 [ 1509.702229][T30967] ? kasan_quarantine_put+0xdd/0x220 [ 1509.702245][T30967] ? lockdep_hardirqs_on+0x9c/0x150 [ 1509.702262][T30967] ? nlmon_xmit+0xb0/0x100 [ 1509.702281][T30967] ? kmem_cache_free+0x192/0x3f0 [ 1509.702301][T30967] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1509.702323][T30967] ? lockdep_hardirqs_on+0x9c/0x150 [ 1509.702339][T30967] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1509.702360][T30967] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1509.702385][T30967] ? aa_get_newest_label+0xf7/0x5d0 [ 1509.702401][T30967] ? __lock_acquire+0xaac/0xd20 [ 1509.702428][T30967] ? __pfx_rtnl_newlink+0x10/0x10 [ 1509.702443][T30967] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1509.702459][T30967] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1509.702473][T30967] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1509.702489][T30967] ? ref_tracker_free+0x63a/0x7d0 [ 1509.702503][T30967] ? __copy_skb_header+0xa7/0x550 [ 1509.702528][T30967] netlink_rcv_skb+0x219/0x490 [ 1509.702544][T30967] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1509.702559][T30967] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1509.702593][T30967] ? netlink_deliver_tap+0x2e/0x1b0 [ 1509.702608][T30967] ? netlink_deliver_tap+0x2e/0x1b0 [ 1509.702625][T30967] netlink_unicast+0x758/0x8d0 [ 1509.702642][T30967] netlink_sendmsg+0x805/0xb30 [ 1509.702661][T30967] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1509.702678][T30967] ? __import_iovec+0x5d4/0x7f0 [ 1509.702696][T30967] ? aa_sock_msg_perm+0x94/0x160 [ 1509.702711][T30967] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1509.702726][T30967] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1509.702742][T30967] __sock_sendmsg+0x219/0x270 [ 1509.702756][T30967] ____sys_sendmsg+0x505/0x830 [ 1509.702806][T30967] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1509.702836][T30967] ? preempt_schedule_thunk+0x16/0x30 [ 1509.702863][T30967] ___sys_sendmsg+0x21f/0x2a0 [ 1509.702884][T30967] ? __pfx____sys_sendmsg+0x10/0x10 [ 1509.702904][T30967] ? wake_up_q+0xca/0x110 [ 1509.702938][T30967] ? __fget_files+0x2a/0x420 [ 1509.702956][T30967] ? __fget_files+0x3a0/0x420 [ 1509.702978][T30967] __sys_sendmsg+0x164/0x220 [ 1509.702997][T30967] ? __pfx___sys_sendmsg+0x10/0x10 [ 1509.703022][T30967] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1509.703040][T30967] ? lockdep_hardirqs_on+0x9c/0x150 [ 1509.703057][T30967] __do_fast_syscall_32+0xb4/0x110 [ 1509.703077][T30967] ? lockdep_hardirqs_on+0x9c/0x150 [ 1509.703094][T30967] do_fast_syscall_32+0x34/0x80 [ 1509.703112][T30967] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1509.703131][T30967] RIP: 0023:0xf705e539 [ 1509.703143][T30967] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1509.703157][T30967] RSP: 002b:00000000f504e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1509.703173][T30967] RAX: ffffffffffffffda RBX: 000000000000000f RCX: 00000000800000c0 [ 1509.703184][T30967] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1509.703193][T30967] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1509.703202][T30967] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1509.703211][T30967] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1509.703225][T30967] [ 1509.703231][T30967] [ 1509.790887][T30973] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6680'. [ 1509.793389][T30967] Allocated by task 14974: [ 1509.793404][T30967] kasan_save_track+0x3e/0x80 [ 1509.793432][T30967] __kasan_kmalloc+0x93/0xb0 [ 1510.341899][T30967] __kmalloc_cache_noprof+0x230/0x3d0 [ 1510.347303][T30967] binderfs_binder_device_create+0x17f/0xaf0 [ 1510.353306][T30967] binderfs_fill_super+0xa0e/0xe90 [ 1510.358875][T30967] get_tree_nodev+0xb8/0x150 [ 1510.363483][T30967] vfs_get_tree+0x8f/0x2b0 [ 1510.367904][T30967] do_new_mount+0x24a/0xa40 [ 1510.372440][T30967] __se_sys_mount+0x317/0x410 [ 1510.377122][T30967] __do_fast_syscall_32+0xb4/0x110 [ 1510.382248][T30967] do_fast_syscall_32+0x34/0x80 [ 1510.387110][T30967] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1510.393449][T30967] [ 1510.395796][T30967] Freed by task 15829: [ 1510.399861][T30967] kasan_save_track+0x3e/0x80 [ 1510.404542][T30967] kasan_save_free_info+0x46/0x50 [ 1510.409685][T30967] __kasan_slab_free+0x62/0x70 [ 1510.414455][T30967] kfree+0x193/0x440 [ 1510.418359][T30967] binder_proc_dec_tmpref+0x228/0x4f0 [ 1510.423738][T30967] binder_deferred_func+0x13a5/0x1520 [ 1510.429122][T30967] process_scheduled_works+0xadb/0x17a0 [ 1510.434703][T30967] worker_thread+0x8a0/0xda0 [ 1510.439299][T30967] kthread+0x70e/0x8a0 [ 1510.443511][T30967] ret_from_fork+0x4b/0x80 [ 1510.447932][T30967] ret_from_fork_asm+0x1a/0x30 [ 1510.452700][T30967] [ 1510.455035][T30967] The buggy address belongs to the object at ffff88801dfdc800 [ 1510.455035][T30967] which belongs to the cache kmalloc-512 of size 512 [ 1510.469176][T30967] The buggy address is located 176 bytes inside of [ 1510.469176][T30967] freed 512-byte region [ffff88801dfdc800, ffff88801dfdca00) [ 1510.482989][T30967] [ 1510.485333][T30967] The buggy address belongs to the physical page: [ 1510.491758][T30967] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1dfdc [ 1510.500642][T30967] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1510.509155][T30967] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1510.516735][T30967] page_type: f5(slab) [ 1510.520743][T30967] raw: 00fff00000000040 ffff88801a041c80 dead000000000100 dead000000000122 [ 1510.529338][T30967] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 1510.537928][T30967] head: 00fff00000000040 ffff88801a041c80 dead000000000100 dead000000000122 [ 1510.546612][T30967] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 1510.555288][T30967] head: 00fff00000000002 ffffea000077f701 00000000ffffffff 00000000ffffffff [ 1510.563961][T30967] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 1510.572633][T30967] page dumped because: kasan: bad access detected [ 1510.579057][T30967] page_owner tracks the page as allocated [ 1510.584770][T30967] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5845, tgid 5845 (syz-executor), ts 90777696931, free_ts 90692475808 [ 1510.606142][T30967] post_alloc_hook+0x1d8/0x230 [ 1510.610926][T30967] get_page_from_freelist+0x21ce/0x22b0 [ 1510.616486][T30967] __alloc_frozen_pages_noprof+0x181/0x370 [ 1510.622310][T30967] alloc_pages_mpol+0x232/0x4a0 [ 1510.627178][T30967] allocate_slab+0x8a/0x3b0 [ 1510.631696][T30967] ___slab_alloc+0xbfc/0x1480 [ 1510.636391][T30967] __kmalloc_noprof+0x305/0x4f0 [ 1510.641249][T30967] fib6_info_alloc+0x30/0xf0 [ 1510.645847][T30967] ip6_route_info_create+0x4b3/0x1360 [ 1510.651237][T30967] addrconf_f6i_alloc+0x1c6/0x3f0 [ 1510.656352][T30967] ipv6_add_addr+0x56e/0x1090 [ 1510.661040][T30967] inet6_addr_add+0x387/0xc00 [ 1510.665733][T30967] inet6_rtm_newaddr+0x93d/0xd20 [ 1510.670680][T30967] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1510.675631][T30967] netlink_rcv_skb+0x219/0x490 [ 1510.680490][T30967] netlink_unicast+0x758/0x8d0 [ 1510.685417][T30967] page last free pid 36 tgid 36 stack trace: [ 1510.691406][T30967] __free_frozen_pages+0xb0e/0xcd0 [ 1510.696531][T30967] __put_partials+0x161/0x1c0 [ 1510.701217][T30967] put_cpu_partial+0x17c/0x250 [ 1510.705988][T30967] __slab_free+0x2f7/0x400 [ 1510.710407][T30967] qlist_free_all+0x9a/0x140 [ 1510.715091][T30967] kasan_quarantine_reduce+0x148/0x160 [ 1510.720558][T30967] __kasan_slab_alloc+0x22/0x80 [ 1510.725591][T30967] __kmalloc_noprof+0x224/0x4f0 [ 1510.730453][T30967] fib6_info_alloc+0x30/0xf0 [ 1510.735052][T30967] ip6_route_info_create+0x4b3/0x1360 [ 1510.740433][T30967] ip6_route_add+0x28/0x160 [ 1510.744939][T30967] addrconf_add_dev+0x24f/0x340 [ 1510.749790][T30967] addrconf_init_auto_addrs+0x5cf/0xb50 [ 1510.755347][T30967] addrconf_notify+0xacc/0x1010 [ 1510.760216][T30967] notifier_call_chain+0x1b3/0x3e0 [ 1510.765329][T30967] netif_state_change+0x284/0x3a0 [ 1510.770357][T30967] [ 1510.772678][T30967] Memory state around the buggy address: [ 1510.778320][T30967] ffff88801dfdc780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1510.786489][T30967] ffff88801dfdc800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1510.794552][T30967] >ffff88801dfdc880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1510.802614][T30967] ^ [ 1510.808260][T30967] ffff88801dfdc900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1510.816323][T30967] ffff88801dfdc980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1510.824399][T30967] ================================================================== [ 1510.832719][T30967] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1510.839940][T30967] CPU: 0 UID: 0 PID: 30967 Comm: syz.2.6677 Not tainted 6.15.0-rc5-syzkaller-00277-g345030986df8 #0 PREEMPT(full) [ 1510.852029][T30967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1510.862185][T30967] Call Trace: [ 1510.865472][T30967] [ 1510.868407][T30967] dump_stack_lvl+0x99/0x250 [ 1510.873039][T30967] ? __asan_memcpy+0x40/0x70 [ 1510.877641][T30967] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1510.882869][T30967] ? __pfx__printk+0x10/0x10 [ 1510.887557][T30967] panic+0x2db/0x790 [ 1510.891563][T30967] ? __pfx_panic+0x10/0x10 [ 1510.895994][T30967] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 1510.901892][T30967] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 1510.907883][T30967] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1510.914211][T30967] ? print_memory_metadata+0x314/0x400 [ 1510.919704][T30967] ? fib6_ifdown+0xa2/0x4c0 [ 1510.924220][T30967] check_panic_on_warn+0x89/0xb0 [ 1510.929182][T30967] ? fib6_ifdown+0xa2/0x4c0 [ 1510.933715][T30967] end_report+0x78/0x160 [ 1510.937969][T30967] kasan_report+0x129/0x150 [ 1510.942482][T30967] ? fib6_ifdown+0xa2/0x4c0 [ 1510.947085][T30967] fib6_ifdown+0xa2/0x4c0 [ 1510.951468][T30967] ? __pfx_fib6_ifdown+0x10/0x10 [ 1510.956409][T30967] fib6_clean_node+0x24a/0x590 [ 1510.961181][T30967] ? __pfx_fib6_clean_node+0x10/0x10 [ 1510.966487][T30967] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1510.971876][T30967] fib6_walk_continue+0x678/0x910 [ 1510.977006][T30967] fib6_walk+0x149/0x290 [ 1510.981262][T30967] __fib6_clean_all+0x234/0x380 [ 1510.986122][T30967] ? __fib6_clean_all+0x9b/0x380 [ 1510.991068][T30967] ? __pfx_fib6_ifdown+0x10/0x10 [ 1510.996016][T30967] ? __pfx___fib6_clean_all+0x10/0x10 [ 1511.001397][T30967] ? __pfx_fib6_clean_node+0x10/0x10 [ 1511.006696][T30967] ? __pfx_fib6_ifdown+0x10/0x10 [ 1511.011642][T30967] ? __lock_acquire+0xaac/0xd20 [ 1511.016513][T30967] rt6_disable_ip+0x120/0x720 [ 1511.021205][T30967] ? rcu_is_watching+0x15/0xb0 [ 1511.025985][T30967] ? __pfx_rt6_disable_ip+0x10/0x10 [ 1511.031205][T30967] addrconf_ifdown+0x15d/0x1880 [ 1511.036067][T30967] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 1511.041709][T30967] ? __pfx___mutex_lock+0x10/0x10 [ 1511.046781][T30967] ? tls_dev_event+0x717/0xec0 [ 1511.051567][T30967] ? __pfx_addrconf_ifdown+0x10/0x10 [ 1511.056862][T30967] addrconf_notify+0x1bc/0x1010 [ 1511.061723][T30967] notifier_call_chain+0x1b3/0x3e0 [ 1511.066956][T30967] unregister_netdevice_many_notify+0x15d8/0x2330 [ 1511.073393][T30967] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 1511.080208][T30967] ? lockdep_hardirqs_on+0x9c/0x150 [ 1511.085425][T30967] unregister_netdevice_queue+0x33c/0x380 [ 1511.091183][T30967] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 1511.097458][T30967] ? kvfree_call_rcu+0x374/0x410 [ 1511.102410][T30967] hsr_dev_finalize+0x707/0x9f0 [ 1511.107270][T30967] hsr_newlink+0x7d7/0x940 [ 1511.111702][T30967] ? validate_linkmsg+0x765/0x950 [ 1511.116741][T30967] ? __pfx_hsr_newlink+0x10/0x10 [ 1511.121710][T30967] ? __pfx_hsr_newlink+0x10/0x10 [ 1511.126674][T30967] rtnl_newlink_create+0x305/0xaf0 [ 1511.131811][T30967] ? __mutex_lock+0x51b/0xe80 [ 1511.136509][T30967] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1511.142182][T30967] ? rtnl_newlink+0x8db/0x1c70 [ 1511.147046][T30967] ? __pfx___mutex_lock+0x10/0x10 [ 1511.152096][T30967] ? ns_capable+0x8a/0xf0 [ 1511.156434][T30967] rtnl_newlink+0x16d6/0x1c70 [ 1511.161125][T30967] ? kasan_save_track+0x3e/0x80 [ 1511.165994][T30967] ? __pfx_rtnl_newlink+0x10/0x10 [ 1511.171036][T30967] ? kasan_quarantine_put+0xdd/0x220 [ 1511.176328][T30967] ? lockdep_hardirqs_on+0x9c/0x150 [ 1511.181588][T30967] ? nlmon_xmit+0xb0/0x100 [ 1511.186022][T30967] ? kmem_cache_free+0x192/0x3f0 [ 1511.190981][T30967] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1511.196456][T30967] ? lockdep_hardirqs_on+0x9c/0x150 [ 1511.201670][T30967] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1511.207059][T30967] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1511.212817][T30967] ? aa_get_newest_label+0xf7/0x5d0 [ 1511.218114][T30967] ? __lock_acquire+0xaac/0xd20 [ 1511.222986][T30967] ? __pfx_rtnl_newlink+0x10/0x10 [ 1511.228022][T30967] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1511.232989][T30967] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1511.238119][T30967] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1511.243587][T30967] ? ref_tracker_free+0x63a/0x7d0 [ 1511.248622][T30967] ? __copy_skb_header+0xa7/0x550 [ 1511.253663][T30967] netlink_rcv_skb+0x219/0x490 [ 1511.258449][T30967] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1511.264006][T30967] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1511.269305][T30967] ? netlink_deliver_tap+0x2e/0x1b0 [ 1511.274512][T30967] ? netlink_deliver_tap+0x2e/0x1b0 [ 1511.279723][T30967] netlink_unicast+0x758/0x8d0 [ 1511.284506][T30967] netlink_sendmsg+0x805/0xb30 [ 1511.289297][T30967] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1511.294593][T30967] ? __import_iovec+0x5d4/0x7f0 [ 1511.299454][T30967] ? aa_sock_msg_perm+0x94/0x160 [ 1511.304402][T30967] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1511.309694][T30967] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1511.315117][T30967] __sock_sendmsg+0x219/0x270 [ 1511.319834][T30967] ____sys_sendmsg+0x505/0x830 [ 1511.324617][T30967] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1511.330124][T30967] ? preempt_schedule_thunk+0x16/0x30 [ 1511.335519][T30967] ___sys_sendmsg+0x21f/0x2a0 [ 1511.340231][T30967] ? __pfx____sys_sendmsg+0x10/0x10 [ 1511.345455][T30967] ? wake_up_q+0xca/0x110 [ 1511.349813][T30967] ? __fget_files+0x2a/0x420 [ 1511.354413][T30967] ? __fget_files+0x3a0/0x420 [ 1511.359110][T30967] __sys_sendmsg+0x164/0x220 [ 1511.363722][T30967] ? __pfx___sys_sendmsg+0x10/0x10 [ 1511.369035][T30967] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1511.375633][T30967] ? lockdep_hardirqs_on+0x9c/0x150 [ 1511.380849][T30967] __do_fast_syscall_32+0xb4/0x110 [ 1511.385973][T30967] ? lockdep_hardirqs_on+0x9c/0x150 [ 1511.391181][T30967] do_fast_syscall_32+0x34/0x80 [ 1511.396300][T30967] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1511.402670][T30967] RIP: 0023:0xf705e539 [ 1511.406749][T30967] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1511.426357][T30967] RSP: 002b:00000000f504e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1511.434804][T30967] RAX: ffffffffffffffda RBX: 000000000000000f RCX: 00000000800000c0 [ 1511.442787][T30967] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1511.450806][T30967] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1511.458822][T30967] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1511.466813][T30967] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1511.474810][T30967] [ 1511.478176][T30967] Kernel Offset: disabled [ 1511.482590][T30967] Rebooting in 86400 seconds..