last executing test programs: 17.675294284s ago: executing program 4 (id=703): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000105509147200ed0000000109022400010000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wg2\x00'}) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x48, 0x13, 0x44, 0x20, 0x424, 0x7500, 0x69ee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb8, 0x7, 0x0, 0x96, 0xd1, 0xca}}]}}]}}, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$BTRFS_IOC_ADD_DEV(r4, 0xff08, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@dellink={0x20, 0x11, 0x1, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, 0x1480, 0x2104}}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x80) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000240)="2294a6"}) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000140), 0x800, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000040)=0xe) setitimer(0x1, &(0x7f0000000000)={{}, {0x20000000000000}}, 0x0) ioctl$KDDISABIO(r7, 0x4b37) 12.495531365s ago: executing program 4 (id=721): fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='source', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000180)={0x1, 0xaa4, 0x0, &(0x7f0000000340)}) ioctl$KVM_SET_CLOCK(r1, 0x4188aec6, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x20000000000000, 0x4}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000024000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000080)="66b9800000c00f326635010000000f3064660f38828e4258260f01c2676ac7440f232012e93bf96766c744240201000000f20f78ecf5543e660f3829544e66b8010000000f01d90f326635002000000f300f01df66b805000000664ab900200000000a000f01c40f019c09000f01c2", 0x6f}], 0x1, 0x7d, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) r2 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280)="d25a9850a9d77f1068109e733e", 0xd, 0xfffffffffffffffe) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ebffffffffffffff280012800b0001006572"], 0x48}, 0x1, 0x0, 0x0, 0x4000011}, 0x0) r3 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 11.58693036s ago: executing program 4 (id=725): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000140)={0x18, r1, 0x2, 0x0, &(0x7f0000000100)=[{0xe26, 0x7fffffffffffffff}, {0x9, 0xb}]}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)=@newsa={0x10c, 0x1a, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2}, {0x0, 0x200000, 0x2}, {0x40000, 0x0, 0xae8}, 0xfffffffc, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}, @etimer_thresh={0x8, 0xc, 0x3}]}, 0x10c}}, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000080), 0x5, 0x1832a3) ioctl$HDIO_GETGEO(r3, 0x301, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000040)={'syztnl0\x00', &(0x7f0000000180)={'syztnl2\x00', 0x0, 0x4, 0x7, 0x5, 0x2b50, 0x20, @mcast2, @empty, 0x7, 0x8000, 0x0, 0x9}}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', r4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r6 = syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dccc) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000000c0)="d800000018008103e00312ba0d8105040a600300ff0f040b067c55a1bc000900b80006990700000015000500fef32702d3001500030001400200000901ac040098007f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04000000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace81ed0b66bce0b42a9ecbee5de6ccd40dd6e4edef3d93452a92307f00000e970300"/216, 0xd8}], 0x1}, 0x48002) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket(0x11, 0xa, 0x5) r8 = socket$packet(0x11, 0x2, 0x300) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000001200)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3", @ANYRES8=r8, @ANYRES64=r8], 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) syz_usb_ep_write$ath9k_ep2(r6, 0x83, 0x8, &(0x7f00000000c0)=ANY=[]) mlock(&(0x7f0000ffd000/0x3000)=nil, 0x3000) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0x18, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0xc3}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) 10.128068761s ago: executing program 1 (id=732): r0 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) r1 = socket(0x2a, 0x2, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x3c, 0x2, [@TCA_FLOWER_ACT={0x38, 0x3, [@m_connmark={0x34, 0x1, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x6c}}, 0x24000000) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xfffa, 0xffe0}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x81}, 0x24004000) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r6 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x1a1281) pwrite64(r6, 0x0, 0x0, 0x6) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0xfffd, 0x7, @mcast2, 0x9}, 0x1c) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x4001) r7 = fsopen(&(0x7f0000000400)='cgroup2\x00', 0x0) r8 = fsmount(r7, 0x0, 0x0) r9 = openat$cgroup_ro(r8, &(0x7f0000000040)='cgroup.controllers\x00', 0x300, 0x0) r10 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x28, 0x14, 0x119, 0x0, 0x0, {0x28}, [@INET_DIAG_REQ_BYTECODE={0x11, 0xfa, "8d747ea4dc9278634a4e3ae552"}]}, 0x28}}, 0x0) ioctl$VIDIOC_G_FREQUENCY(r9, 0xc02c5638, 0x0) read$eventfd(r9, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x2d0, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x100, 0x130, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x330) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x9506, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0x5dc}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 9.75946766s ago: executing program 1 (id=735): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000001d00010027bd7000fcdbdf2502000000", @ANYRES32=r1, @ANYBLOB="0200d0070a0001"], 0x28}, 0x1, 0x0, 0x0, 0x20040100}, 0x800) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfffff000) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f00000000c0)={0x53, 0x0, 0x6, 0x0, @buffer={0x0, 0xe7, &(0x7f00000002c0)=""/231}, &(0x7f0000000080)="08009fd1fede", 0x0, 0xfffffffc, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfbff}) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) sendmsg$inet(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000240)="5c00000014006b03c84e21008bf32c19021800f80200000044000200ac14140e05251e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d4938037e786a6d0bdd77f6f60c1504bb9189d9193e9bd1c1b7800000000000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) copy_file_range(r5, 0x0, r5, &(0x7f0000000000)=0x2, 0x7, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = syz_io_uring_setup(0xd1, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x335}, &(0x7f0000000080)=0x0, &(0x7f00000001c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) io_uring_enter(r7, 0x47ba, 0xda2a, 0x62, 0x0, 0x0) sendmsg$nl_route(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000002100010000000000fedbdf2502000000000000000000000082590424ca738060563766c8d2df2904fe6722ce8c243cb2ab054ea02c9b6bbcce479c2d53d40bbefdce82fdeaf9167e4abba2d8eae8cb29f2130a3d532a0094ba851c17af01daba0acb641d700240c8e1d7deb451f4b776309bec385398b404e4e5e52bbd753c792778f37c9f912a1cf32ef3f866dcf2c310f09e4a5dcaa63cc3fe8383757fe2a6505ad0458468e6e168935c867e51eaaa0b578d8e9d593a35c659022330d290a25872d2df6fb8"], 0x1c}}, 0x44044) 8.07878116s ago: executing program 4 (id=738): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc73}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)=0x3) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) ioctl$TFD_IOC_SET_TICKS(0xffffffffffffffff, 0x40085400, &(0x7f0000000180)=0x8001) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x6], 0x0, 0x8340}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x7f, 0x3, 0xfd, 0x0, 0x1, 0x7e, 0xcb, 0x10, 0x8, 0x5, 0xb, 0x8, 0x0, 0x10003, 0x9, 0xff, 0x4, 0x5, 0x12, '\x00', 0x1}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10, 0x0}, 0x4048041) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x48090) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r6, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) waitid(0x0, r7, 0x0, 0x8, 0xfffffffffffffffd) r8 = socket$netlink(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r8, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfb, 0x800}, 0xc) socket$inet6(0xa, 0x3, 0x7) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000880)=ANY=[], 0xfc}}, 0x40c0) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x7fff, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) 7.987129589s ago: executing program 3 (id=739): signalfd4(0xffffffffffffffff, 0x0, 0x0, 0xc0800) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e23, 0x3, @dev={0xfe, 0x80, '\x00', 0x39}, 0x5}}, 0x5, 0x0, 0x0, 0xd71a, 0x90, 0x4, 0x4}, &(0x7f00000000c0)=0x9c) semop(0x0, &(0x7f0000000040)=[{0x1, 0x800, 0x1800}, {0x1, 0x7fff, 0x1000}], 0x2) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff020002000200f4", 0x1c) 7.810638874s ago: executing program 0 (id=741): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$KVM_GET_REGS(r1, 0x8090ae81, &(0x7f0000000480)) r2 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xf691, 0x10100, 0x0, 0x2b4}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x708, 0x41e3, 0x0, 0x0, 0x0) unshare(0x2c020400) unshare(0x12020000) msgget$private(0x0, 0x240) msgsnd(0x0, &(0x7f0000000180)=ANY=[], 0x2000, 0x0) msgrcv(0x0, 0x0, 0x0, 0xffffff7f00000000, 0x3000) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) syz_open_dev$media(&(0x7f0000000940), 0x1, 0x169902) r6 = syz_io_uring_setup(0x234, &(0x7f0000000580)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r7, r8, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) io_uring_enter(r6, 0x207a98, 0x0, 0x0, 0x0, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000100160085"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000400a8000600200003400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r9, 0x18000000000002a0, 0x0, 0x54, 0x0, 0x0, 0x2, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4}, 0x50) r11 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @desc4}, &(0x7f0000000100)={0x0, "7cdc45495a9da7d2c62b3d7ca009649a82700cc9f4d3c5b71beb9a1ec606a458ce3de3128e638f7d57a382d6e19ac8e5e4162a5aa00532ac04e2e9fa60003b57", 0x2a}, 0x48, 0xfffffffffffffffe) keyctl$setperm(0x5, r11, 0x10000) syz_open_dev$vcsa(&(0x7f0000000040), 0x800000006, 0x48202) r12 = fsopen(&(0x7f0000000340)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r12, 0x6, 0x0, 0x0, 0x0) fsmount(r12, 0x0, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xfffffdff}) fsconfig$FSCONFIG_SET_STRING(r12, 0x1, &(0x7f0000000300)='/dev/snd/controlC#\x00', &(0x7f0000000380)='\x00', 0x0) 7.616064378s ago: executing program 3 (id=742): socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x2000000000000001, 0x0, 0x2, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x57, 0xc2}}}}}}, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x40844) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(0xffffffffffffffff, 0xc0984124, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8983, &(0x7f0000000040)={0x6, 'bond_slave_1\x00', {0x1}, 0xff7f}) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r2, 0x8982, &(0x7f00000023c0)={0x0, 'veth0_vlan\x00', {0xffe}, 0x2b1}) add_key$user(0x0, 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r3 = socket$netlink(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x14, 0x1, 0x1, 0x101, 0x0, 0x0, {0x7, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x8040}, 0x0) writev(r3, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000a6ff00", 0x39}], 0x1) recvmmsg(r3, 0x0, 0x0, 0x40010000, 0x0) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f00000002c0)={0x1, 0x4, 0x0, 0x0, @vifc_lcl_ifindex, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) setsockopt$MRT_FLUSH(r4, 0x0, 0xd4, &(0x7f0000000000)=0xe, 0x4) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000240)=""/254, &(0x7f0000000040)=0xfe) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000080)={0xfefc, 0x7}, 0x4) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x1}, 0x4) 6.518070062s ago: executing program 0 (id=743): r0 = socket(0x1e, 0x4, 0x0) connect$tipc(r0, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) sendmmsg$unix(r0, &(0x7f0000004400), 0x400000000000203, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000000b0000000c00058007000100"], 0x20}}, 0x0) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000240)) socket$inet_smc(0x2b, 0x1, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e24, 0x681f, @ipv4={'\x00', '\xff\xff', @remote}, 0x159}, 0x1c) syz_emit_ethernet(0xd2, &(0x7f00000001c0)=ANY=[@ANYBLOB="0180c2000000ffffffffffff86dd60000000009c1100fe8000000000000000000000000000bbff0200000000000000000000000000014e240e22"], 0x0) 6.023902679s ago: executing program 1 (id=744): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_vs\x00') syz_open_procfs(0x0, &(0x7f0000000240)='stack\x00') socket(0x2, 0x80805, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x40200, 0x0) dup(r0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101000, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB="6400000010000304ffef00"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}}, 0x0) 6.001201775s ago: executing program 0 (id=745): r0 = dup(0xffffffffffffffff) listen(r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6(0x10, 0x80000, 0x3) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x89901) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000002c0)={0x1c, r3, 0x10ada85e65c25359, 0x0, 0x8000000, {{0x6b}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}}, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$radio(&(0x7f0000000100), 0x2, 0x2) r7 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_S_CTRL(r7, 0xc008561c, &(0x7f00000000c0)={0xf0f041}) close_range(r6, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0x3) socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_int(r0, 0x0, 0x15, &(0x7f00000001c0), &(0x7f0000000680)=0x4) syz_80211_inject_frame(&(0x7f00000000c0)=@device_b, &(0x7f00000006c0)=ANY=[@ANYBLOB="4088fd00ffffffffffff0802110000008ae7f1d6e4c2b5dddc1c430101002d1a00080708000000000000004000fdff1400000000080300000007"], 0x3a) socket$kcm(0x10, 0x2, 0x10) 5.382923992s ago: executing program 1 (id=747): r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x6c7881, 0x0) ioctl$TCSETSW2(r0, 0x5433, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0xa) r2 = syz_io_uring_setup(0x3f, &(0x7f0000000040)={0x0, 0xfffffffc, 0x80, 0xffffff7f, 0x2a4}, 0x0, 0x0) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r2, 0x2, &(0x7f0000000180), 0xfe) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) waitid$P_PIDFD(0x3, 0xffffffffffffffff, 0x0, 0x8, 0x0) r3 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) sendfile(r3, r3, 0x0, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) syz_open_dev$sndctrl(0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, 0x0, 0x8, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_io_uring_setup(0x23ed, &(0x7f00000000c0)={0x0, 0x5c18, 0x0, 0xfffffffc, 0x1f3, 0x0, r1}, &(0x7f00000002c0), &(0x7f0000000180)) getuid() 4.085868017s ago: executing program 0 (id=748): r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x6c7881, 0x0) ioctl$TCSETSW2(r0, 0x5433, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0xa) r2 = syz_io_uring_setup(0x3f, &(0x7f0000000040)={0x0, 0xfffffffc, 0x80, 0xffffff7f, 0x2a4}, 0x0, 0x0) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r2, 0x2, &(0x7f0000000180), 0xfe) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) waitid$P_PIDFD(0x3, 0xffffffffffffffff, 0x0, 0x8, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) syz_open_dev$sndctrl(0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, 0x0, 0x8, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_io_uring_setup(0x23ed, &(0x7f00000000c0)={0x0, 0x5c18, 0x0, 0xfffffffc, 0x1f3, 0x0, r1}, &(0x7f00000002c0), &(0x7f0000000180)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r1, &(0x7f0000000280)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0x64, 0x0, 0x8, 0x801, 0x0, 0x0, {0x2, 0x0, 0x2}, [@CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @fccp=[@CTA_TIMEOUT_DCCP_CLOSEREQ={0x8, 0x5, 0x1, 0x0, 0x6}]}, @CTA_TIMEOUT_DATA={0x44, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x100}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x4}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x45}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x7}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x5}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x80000000}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x840}, 0x4000) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000100)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r7, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0x1, 0x2, &(0x7f0000000180)=0x7}) getuid() 3.742042586s ago: executing program 4 (id=749): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r1 = accept4$packet(r0, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14, 0x800) getsockname$packet(r1, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000400)=0x14) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="46060900000000001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r4], 0x4c}, 0x1, 0x0, 0x0, 0x600}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r8, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r8, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x439, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r9, 0x0, 0x1103}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9, 0x0, 0x0, 0x4000000}, 0x0) r11 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r11, 0xc01864c6, &(0x7f0000000100)={0x0, 0x0, 0x800, 0x0, 0xffffffffffffffff}) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000000900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000084000000060a010400000000000000000100000008000b40000000005c000480340001800b000100657874686472000024000280080001400000000c080003400000000008000440000000300500020007000000240001800a0001007265646972000000140002800800014000000012080002400008000e0900010073797a30"], 0xf8}}, 0x0) ioctl$DRM_IOCTL_SET_MASTER(r12, 0x641e) 3.288810331s ago: executing program 1 (id=751): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_CONTINUE(r1, 0xc028aa05, &(0x7f00000000c0)={{&(0x7f0000800000/0x800000)=nil, 0x800000}, 0x1000000}) readv(r1, &(0x7f0000000600)=[{&(0x7f00000002c0)=""/124, 0x7c}, {&(0x7f0000000340)=""/123, 0x7b}, {&(0x7f0000000400)=""/249, 0xf9}, {&(0x7f0000000500)=""/249, 0xf9}, {&(0x7f0000000200)=""/30, 0x1e}], 0x5) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x6b2f, @ipv4={'\x00', '\xff\xff', @multicast2}, 0xa1a2}, 0x1c) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000003640)=[{{&(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000006c0)=[{&(0x7f00000001c0)="f955bee3a60b85a1c537b256045a015f4ff9a24d87ef9af7123a3865f8a3d166daf1bb72b4", 0x25}], 0x1, &(0x7f0000003880)=[@ip_ttl={{0x14}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @rand_addr=0x64010102, @multicast1}}}, @ip_retopts={{0x70, 0x0, 0x7, {[@generic={0x1d1, 0x11, "a503c06c4af66283fc261c6b1ac38e"}, @ssrr={0x89, 0x23, 0xca, [@rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x27}, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010101, @loopback, @empty, @empty]}, @timestamp_addr={0x44, 0x14, 0xcb, 0x1, 0x0, [{@empty, 0x80000001}, {@empty, 0xec04}]}, @lsrr={0x83, 0x3, 0x63}, @lsrr={0x83, 0x13, 0x2b, [@multicast1, @remote, @broadcast, @multicast2]}, @noop]}}}], 0xc0}}, {{&(0x7f0000000840)={0x2, 0x4e24, @private=0xa010101}, 0x10, &(0x7f00000009c0)=[{&(0x7f0000000880)="4d2cd7cd5bf591e89f86a347c8924c658eb3ff15293a94b3037725a33520ff848c63c4547ba038eb9909986e1c82d3c88599fc5015684071c15f090fdeda1f6022fcccf0bd2667c04a7bfb12279676397dfb1ec186ba71d6eb9d4fe5889120d5c982aa66867e1bee36d3cfefe5042736", 0x70}, {&(0x7f0000000900)="ea8e562c84baab969ae0d8b572a4bebdf3944a9419b3d87ac618d9ac2461d055138332c4da1b7cc2d8d626a8df0404f6e5784f096361c0e49b40cb09ac344c00016b9373321e96b2d47c208cb58df4e6591d15da9b37eac700bbc82bb10bdf62bb08bc30978fe2a2168304bdebf6619f23731234f8024bedf1f3fa846b25eb6c81e9ba4cb164c4210c77328d2c8b00f04aab972038fe5b6b", 0x98}], 0x2, &(0x7f0000000a00)=[@ip_ttl={{0x14, 0x0, 0x2, 0xe7}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}], 0x30}}, {{&(0x7f0000000a40)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x22}}, 0x10, &(0x7f0000003180)=[{&(0x7f0000000a80)="973e5f5ab467eaac24ed901a45e87714824222514b0f4544d35d776be0d0d2455978baaf97c8ac0986822d52168197d688779d6c49755469e925d6b4de2b6287b0dc004aa24a24adcd90d2c6e4e93f9569a0fcc87642bc34de2bab0569eb527476d9ae51b9d5b4d5d930c634da20f85d0ef8d76542547643b8d1081ce686f6639db9afda4f90766aa2f06f29f46d77d103afeaa6042b00bd29811aaffb998ba7781cf0131b70ad9c63d782f836c3eaf00e50b7674ad0d52f3517ba9d9a53b039ddd42cd4", 0xc4}, {&(0x7f0000000fc0)="9bdfcbc0d8529cfa6ee90a5b5c64d7a05aec3db9bea01f11b75bc0cd6d52f6d51b336356241e073adf25203776ef86834f72273095e94184ad8ee33770f225daf6bf1d1f26bd98ae30eefca64b4ad7f55b547958cce48329f709ba5b8d4574626f033734808241401f72304615a428b04c902ac9f5e462e6268a878cc6a7dd2957e00ec90bd5ddb0efea74307beada36beb666ffef48b7b1c52f66f11231b7b47e94e73b8adf894b747042ca6b782096ff50d543edcb515a76582db95d1fb42b61e108b791ad075bc0e5472036586b7ead3e72e0542d1ba44df79c9a79fc31b0ba68c01bfa88b10b3065350f845eaf8a6075dd9d9ad1e2e84bc063643b9a0eaaf0abf8ef90c34233b53ed3b9a423d2889b5cc36600a35c482fbae90bc7f0d70abff19f1136de2dd59fab4119eb822d920c06fb6312ed49b845bf88db4032201d1331153eb499a62c7a0f2d06aa83271edd41ac0f13204104d31b5a7e90059789591f7585d0ff72afb4f7f905072465ad60cb6e1649eb14473266c9550d0f0bd8a82b66da7e4d94794b5c4373b9ae08d29ffa3205971df2a2472d4acee5e2d5865aac468145d7bfcc340851b83c2176fb88db0b531b5ab2cfa4ed2bf2623424291c817d28596e6327e3edf69a03d3741d1487b7bd96bd108e0b9ce691c2807c184c3e1038c53e6db10dedf46410bbb9668ee514c585e6da25820a1486c85a128464913b1278bac940f74497c9a790115263c2b414d616baa5d06feead09359a3d2b8ccbec5a6e1a2d4cdea48f10f2f09533400c4e0ccf6ad54dbb9c55345c2fcaf5e488f399d6d73ac69677f02610074f532bebb2d8074ae0094f3b02d0cfbdc3fda8018462af1bafeddd76b7e267a5f27596d93426f010290a74c56758fefa81e1c32193355125f36d529e3f4494935a4bd05bfcc3c0d141072e93b466df89fe91bc1959c230cb229043d49519bdd730dad4051365c800b7d5ef63defdb184e6febf108cd65c9bd241d53341968ae471ba474b720cbc5589b26a7abd41e1fcccfe2350c392736d007880cd617c9cb73bcfb23dff817cf032e073de0795c76f38fa76209fa50e314f96c4d480fee9f012d539d429ddc9153f9925fdf5e95bbb73336b7a46c2dd727b8b178f240674b3477c9d6d201a75126725e8791d8c41a3aafef35c06d6bddb9a3a83cb20b3e4e78f40d38222c57cbe23fa2afbb28a35bbf8fb4c1b7c761b3b001fdd09e025a358591fc10e0227bef74a6ad7e83da7ba7264e414a80f1354c5afd54c8eb1e986900787dc2733807f0a6bb3f52ede7164b1a78b600f0f9669ec4c5035353e378dfd663f3ecc2c7a04349f3debc2649ab046314f505ad513d877b4aecff46b03635ee5b16dd65a77eaa4ce380a2a4151a1638d9c2021cac0a135a1e6f6de336b49b39bc63029e8e08516b42ec24eb344512212e7163382d74149253b312b1b290cc3f71306ca3cfa57ded63cc2b636b423130d9352612d9841f1f82d8fbf01c85d78d0faea281003d36c7e1871a951a5838d00868cd5325f88271f551a4c89d946a7329012b9e1ecb1e35da44f0a947bc6694b207be6fadd8ebcb66792f4a2429b871fbbaf61f19231c00b6f0d8a1215bfe083e5ebae697042eb43290f66f930984fa5a5f063b4df7d29136b71a1c20d195086ec10cfc00957b9d1012ae555ef79b305d37713e717e14af69c8c37050ef450fb0f40c32edc95b4217db4a2a5cc40a3bcc7288581c62302822974364c69fee53fa9d3000bab9cde1121d6496fd5e5fbaf5df81ce48a92e23dd07aaa4413f5474558e089ec18aca7a6f8025867701c82fde6ec29994ad8f81e149f1029ccadf2c1b72492a099952920ac6f044dc19995cd54dfc56eeaeecaa363a74d00e2c52977f44aadbb8471d3e4fee5d325ee5cbe5cb3c38c57af4fbb07933421e251487ea1a8b1b15ef01e007a2279cf097e6cd83e85f5a5c4c3f2ce56db6587ddfdfe0eba8a35f523cf05ac4c23ff319187c9075c20530cc9df83a9112ba22df33ad4434d9901f63a72ba186496379255a6f5a8905a6e32943cc87ab3fbfcdc708aaa71af51eef38a0352e169d3a56c5da8664e70bc1e43ebecd3e01ef966f14a5f3ea487d06f3898d58bd3d7ceb72520d3fa056d1bd007808ab508910750b5bbd3868c870f6c08b24e76df337305b8e1d1105b8783240d03f04c4ce492bb66f218b74dd14e40c23c71c28da7ee090a148d2b92a42f8d7e0a8a3d64622ad7b055ef252632ee76a9860f208fb19941dbb94a9561efa71d328e409a2601a74c991877116ea672e7466398f974f639be4f4aee154092a873edabb5cef53d3cd9b0832d917a6c91e7223d05b4eafbe69a66503a76ce09a5b345f9f63b83c4becc51d61414c98de9f6856b5106a2fe2b782c0639e106d36052e2e3eb5517bdb3a1cb0e1b0f41c90c40690f23f97fe246f09f1f0c12c92c5eb2e086bbc45e51765eb8811d89ea335b6b87b32dd8160a2d5f5f22e2aee44a7734241716ff9e3f49707a33392380f27deb9011d844860abbeda5a434878b5fff23541f93986d7bbfab0bc7d6220c6bc84752e999a46ec99935603232bb7315fad4c288607345b61b24567412726a3c782f982aa6684f85387446853aebd4842b0b5a3418f25d5f2b4385eeae92dabad031094b3be8411e03ffb40a34f90f55939c80913b901789954ae71cf7e1d6f8b63b138641dfeea2ac4026711cc25fcf4b56560c2bd0584da3339b481663edc353526fc96bca2081aa91f23f33d3717c51754e35ba0c0e35334c5a7e4fb783ae8411b0d302eccf3a3682aa497af34ec6beb1042c02f24f5a47cdcd9c1d1acc546254d6b08c68108151a7ef3f4b25e60b8668346636d7e942ad5a5299f625fb7d4b6e6e96d22f643576dbc52128e2b4db60b080cdda53f88207975d304ea637dc4ef3ad5872750140212b08b42e2492c9890b323fbc7ac367308a7fbf71d7434485336d9814344b146e4145296e18e0860c7fb023dfaff957d5ed301a0cc773e4f133bda8aaf725d165e42557ff0a195edfdd34fa9787cdd3da6af2cdc182cb5e9555d9f253c8370692a05e74488a86068535459ec4a54119795d96169643f44e45f5dc662cba81f28f7eece6de775395e086e1b06491cbc8ce44a96a51a179e46397d9e62e2f0347f483964993904a2c2172bd66a2f8290c13e606d7dbf560dfaee1ef0ae1eced36f5ae1e0713ec237208a74eccec0f2dce4ea27e035414b2d0020cd3866dd9d614bada618c7bfdf95cd02e525aeceaec17d642eae13169acc11bcac0a3c759353e72a6b76a4218d3958f2f7a691cd0c6789ed9ad253e1858ee3411bf6017d384f0c78fad626e5521bb78aa4b8497b3749484e8747e4def0a5d729d90886866b9b5447b9264a298277207465351411773e57c70abfb790b75e2a532c7ce9e065166083a9d25893598c63258de3a66987f532be81470e7b3c6fe351e5fec07142b7a8ec0e3d1026bc81f599f29f5588a1aad36146d9a78b83223c6e9d11c98a5b0cfc8834ede6460f60c81e429157646b89992db9f8e2b6a88006735f9ff45919ad64c3a5823993bc4ac3605ee1ada3a3a916991f7356b00af77c47771b9970c91d76041e2b1d6c691044650418e937b0f09611558b043ffac7e6d80015446bb24239a818c64d57f306a7320f7c29516b47c0c4042d4840f6d35ea65df06d12d52181f8d19f94a2424de566978f6370115324b1a29a4886ad26c29e7401db3fbe9ea704a0a9d6001ca6b0ef26a6bdb60e9c04ca2abe10bd9757666b59fc5c6435894118425da200bd4ffedd8718448616e81f188f90efccc791df99ff0f36eb2aced9470128289c739d37de6423f9b006b0168bedbf098754fba531748d4ed7e5b7f915b6b6ca492171101fbe469a465788a3aba5010602fbe8c625ad77cddae4c4a39f050e718b1700d35acd3bda586aa1433e250ef678e8909a1136b1bd55b2dc90f5577d5acbf9590fea628d54a62d5601b0aab335250abf49c1f3670be97c3038cf75fec408d2bcdf02be6a34c70c7370aa058685a355fdf4c622ad9ae834ca92b2b4856c1a88175dc3832cb15fffca1ba9e916e0dfdf526eb2aefe5d00d16d00caca6a5a182c6a29b7b412c08a013c02d5a2b3b070cc3e535ce9631c4119e5c66030cedfade6f04a5e01ebb968dbbf66ebeaa63f378f90910ad388957cd5235119eeb68641e87f2c8452387a6e24631d608ee5f729425ab700e6faaa654b5b07cfa237e88c0e85601a6688aec6063d7ef3d57e5781a74bd43c8c98270f5cb81c4d7dfd945f9f6f0e441943d155d0177334e61379adfb0a62b9598dad2d10039d517b4525a2faee3a9ca08c4a5ef0863de7df0f08edfe35b7ad0c2c07afb329de36ae80f93495c2cd9c534adb6763055df2c868a56c88e9203e92b2c34e746147263c3f2a31ee195e43a7d0413e914b63a2260b356712046ed4df2c9d8a7d65ce29d4f67359e023b762cb98361df1677e5645ceaa44d0034239cd087e82cc4ad41b9bf00bb387736052c902c48788eaa9ca9d891fd67135a6984e7f0e9e9a5db8488b8f5881756507289a4708a6dff9d4f3b4373d2368bb1d90962d7838fcdb77ce0a64f613cff339edb7a4b0a8f15025328db2e57fd364e0ba06c2fcd44f4745c141777f04d196295b44c11e4de77bd09bee6dca6bf17f090d43403efc24b95e745d1eaffd4b22e8c6ed433db3ed268f7b0074cc8aaea01faf29ef542016e9abf4aea9582a5f0e4565e3a6626f3856c57347a493f52d6bf86b042125b03c16a462f149e3cc6d6c43ed7a7d0b3dffb7af7c2522b812d2882a95056526040b3240cb2f70c73eb011fec16223d2cad07f2678ed0a2b7e0939e5bad9d771a25e3a36f44509d78cf1bf05f0a401df8af64ce4e9a2119361a17c49830053faf9522b9d5e5ff9a3a7eddf0939c4ffdefe58a607915f6c5f27d3e427a626f747da03d0b4af6e0e5f598d9262d1a356a78974ffa12a71cad5c24223501340d3e5ca9ec7c065f15d50cc702db2f2a5c02bd883b633306780bf0ea562a10ce3ea4df3713895cf4264afa2eb1df35b45cdae636f4219ed6a4437f2580233dfc187a8891ee4f631a2e900db001eba8627c8b56a6d95ed7162f62aff76233ad20e1aa5cf2744a44370ec0423543ba001bed58705c7af4b8a767ae7eec6c0259d7b279a2b318d091ab15ad5b2f10d14db214fc4269a492a2fca285ec56477befafd69d385e4aeb5d4f9e64eb140c6d63905a54ee4b7ac2cff5cfa76607621fd98b3674043ec4d631128cc53817b0fcff16341929c44b5ddb3599560b5ac4cb3d856528a4c6426dfdc87c2b64f4b9b46f34e5d05494182370a7e18432f6ccfdc2fda21e973c4591b4d2a8d7e6d45a2862926056b7ea548926dff1123d20216c5f161a45eb6364bfebebfb0022463ac8b3b43ec811ded563c49f68f88185df8be8988ce06ab3ee7002442505807e581effb747230a9d9441773e49868d43ff0c8c15924acf4b1a3573ef8e20afc959f8e8fa31c588d4af7e082a13b4805925d38f341fdd1bbbf2623a8a926783301af9702d0a8eb8741c0f8199f8dd5845310ac4eca857fdb00363dd8c92252bdc3b9eda2915fc90becba21fd799deb6c1d4931da6a3b657afb5c0f1e3940b6d3ccba1f6815cea5400b9bb99843d0df3609a5a4c5568955adce9570fd3420c420d7ab1e160c291d5acb9a9fcce6a340bf89314620cab00f637378868c14459544ee62c07031a9acefc0b942bd5ecdef2fd98f3", 0x1000}, {&(0x7f0000000b80)="10ebd9a42a6e26792b911a10b408af130a2a76c4ddd4e2b1ee7e6089b52a2329bc694fea1f5aa4845e905bab0ca51e020478b9ae01181ff28229a2b45a530cf5a3ccf61a9ba18d14564d901e2e37e8184fd30aae4d3cebfa7e0b06f36ac7269e11fc9b5d0b722f750ee332395b88ec0f05140fdd9038dfcd118c045457f589a89320a6c47f2aaf29058e5931da6d4077fefdd70fdb7a0cef411c8e10e8bebbd472ef040810d92d98dc13f97cd4af0bfe1312d2a46e68599212f7da3f2478a8fbfe9d6cd04a66af32983d0332e80c6051aa", 0xd1}, {&(0x7f0000000c80)="8b54b2582f638a896960b8fefbf01f9716f99a3255491865f7a4bc60994b70f9067e3768ab60b76dc0b73e771fd992d33da6b79b24f6a3fa97098d81fad537367f60077c858656e54e3a6dd7b8d06ce3c1a5500d15e33715f8e910f37e5082725bc63b29b7545d586e0a483c9a40bd", 0x6f}, {&(0x7f0000000d00)="c1f7d85684cb16ecb462ad8e2080407a92a051766ffc7e45512d04b337c99a3938ec1cc546cea71e06efb0efd1ff21aadb28f693c3bd21f314cc79b90280e0d55ee54e90e423530e3dacb231b4e83bbe7436b7488d65bdef008b4749170d82ca082d9f0b7687f9e3f0805c469e82113aede2193639cc0b09cee919cf0534dff8fac0154311d4af528337b373ba7c52e45e8c8ade6f0ef6d4b4b84f5b02614c17e6d7830b9e28639376b58eb9bcc2b6ee9378e8171dac829d4772b8490131ebea1342d6e72c5864411328cc1f924d6cc2e4c58e", 0xd3}, {&(0x7f0000000e00)="46ec7122dbd7be8f4652a213be930007c7affdffac648a16e08f1085190e764b77049510e9b5880ada1c0b957e063a89607124e20b964c517638bfa0e9d6ef77237ebec54e86324aee66f4be316c8724042e585c587a77149d7cea266a7d4efbf9ca48c259ffd9f159c62f39b9513fcf6340f6184433680398ffc7e10ff0443f765f04e178a94b508ac8d3ca844767bc9da607505e51f865496ec58738a5ffe04e2081017df8a4a9f540affcc54b6f9555f818d4fd29ac956dbec60c4d1a9869c939fa16575a373aa7020e631be40f4a7c364cb2b5266adddb590728f412", 0xde}, {&(0x7f0000001fc0)="d10d3d12c638f0ddb31bf47c0391b67909a73e1c21d9464ae3f8abd276491c6a677fadf8efccfba00f7ac166ce32736df034652f5c5aaf8f891185b6f53574fb409fe944bc9d6989f82ed3e3968dd08680b1ffb89a86bdb2aaf5e37a458752d55e7206102cc55e39baee8a0009a29246e50abec612db7135b795f0e78e16a9aedaab7c9059027ecad75af7a03793bc5a2b2bc2b16f99298ccb1d692440f344e601eed40b03951b929f815ae24d7e74a7ff540f31f14ff8c554d068a6908808918869c4928e00a98d6bcca3149c323deb7707e5ad480c4272f91b38c5aca94acd397cc193fccc33eda8e486a6336a99156ad79fc42f4216d20689c69fa6c6ae9ffb2a77b52a8bbfcd68950692694c85d7a35444f08581b542c112a87f5a73a0ac4ebe5f8d78243b9262cad02fdd157180fede343cb2ab8eb18ea2f3aa7decdef60a38a71d785d8c9a799c545c9e228ed83d54c7b5634eebd64bdcf46168288a1773f2d4db90591503054d09a20d458f19855b71b374b7db3ec8ca74a30e7fee0a4b7a1ba87c9be64c52c22a6eedc99f0a1fff8e8727a553f40397fae076270ae0d9eaf01138a2e317f3bfdb9a90c71849155a4a2c867aa9b90e89a8c55f9b7a6d7247166831ca40518c840a22f7cf586bd17e8209c6f604428d33adb305e071b34b7be85e56945ccd3bcce5bd0d1466e77341cc1fe5f4327d5b6e6bbf4b324ae736ecd81dbcd3ec0b13b6858ceb165b039714fe74dfd7212c8b2fa153ac01b54f109e6b9b4abcbc5c44cf75c4636abd1de39a7014b4e20216eb69f2c441fa9c589f66c7d8cf74772a961512808c11de3984a6932da766cd27dff5c28f0dc5735fe57a668eee532b9ff24058f7f31fa294beb20ef6b5d6a3f9fcb01f80eb2ab0f7983254617f7057ebb98a3043d681edde3eb0a977032b2a6f5ed87920a461c4e0a909434a25912f4c22d67b916d46ad8b91d9a28b97f5548e0dd63a2122e29d76bb1b6b77f2e4b364a79889b267f2e25f78300e2944a200f8e77c6b9838a17e33174e0fdb0b44c1db9c84d3e546c13b9ddf0e2d57f77f2027eaa4f126b151fa67d5474dd0b50187d1ffb550b83ebfd94a3c461dc96cb49941dc7c5d1515f3a8e36d5ca78c7489648cf92f443d85e9ed2d56f54cb4a78d2fb5787d95226dad37f799a52e6de1e8cfaafb720f262fda0f062f3e2af61be5477eb45db5b9473bb1d964fb5cbeb8663436bce6872bdb939c17b42a6bec10a395edb19abfb36b93ccf0521e40861af06905c4cde0fd955cabaed5cd6e060d0e22e68ead35ae2fb477f717e5cd22d490c6a30bb2341742323a023471bea69810687a281638e3b9f85e217d66b432e4adf959db17784766b1fc22d12dcee02ecd237c2e1b3c983255fd2dd993d98ac42aef52bb11ea5862d7ab9d32a5d636815f39c4729765490c51a11487cf1f65fada9613e7c63f81eec99a0fc22074d34a5fba955ba77bb054b82d4b9253ae4f94ac0625c5e79e54e56e5f7962ef666d8279ccf1bfa6e3491ef69d38a93e53a248035a6b815d3aa236d394ab3866c5146214652b1966325b5979c246f2085be7ca08f15a3539eaa0cfa23f49ee626f3b96d992bf655d39342d91e2adb620c5b6a8cc00dabd275f231d28b1af8bc333f4691c07556eb79121f732b54a149ca63e7a8539b8fba02ec1bf0deefb9eab127489a1b7a698cd4242ddb592207c9bffadfac4af5aba810e2b035b8c1dd38b5c690988a7f609fb97637217a89455268f4e5086b9dd075f5e12191f343cdd830addb6ef994d2a34318fba26b855a675effbc8b0ab5c9aee28d390badc33ed2a5bb75b4e68a4ea21e761648c3f562b2d9866b8fec3622ee559e2a33618a67ca07df3f194a5eda23080d7f663a176c871cb72b243546975938c290b59947c46d6964b21682b45107284ebf4313b6af385367a15e9e664e0691f701a33c4fe8c10d2c89c6349ced7924fff947786aca695efe4c5fa658cefa99bbe1d1abe39a302d46d43d88178575349ccd0541f4a54ba3015dd39c702c87eddc0fc0739e5893f92c124c204ed15b05975fc71e752f6fa6acbdabdd7738c20f91dd67acc474ae7870f508fb260f57a3479bfcf4cde3b1312765a738e6bc3eaf82dc01dc57d62c42c9d5d726c478a3c0d8ec791164c22aaa5df6d7c92a5005f4c74c2f428ecc6651c870b302bd473d2d1e1cbeedb5a99a25d406555a744bb62694e1260ae1184f90dc734db7bf27e6a7d8b38a064f139562b421de1e760ff8d89e2aea201d31b9ea84cd2eb08c700dbdc987bac6e1b4c663c9025b87c120b4ff473b48f41fd8b675981d9cf7f420c5b197429487e56523b5f6775a3890eb575e7356df3f1e99b0c02725d91ec2532d2f3b9b5bb526778f7a41d709e4303d691f680a0650058b11ace922a4264e069fad9363abf4d2ceee5265dc9151c3927ff5129183bbad5b5663600a46d7d3dd1c55426afb82782680f9e30dc516a7088549d51a2707ed8a16f087c9261c8fd22540bef607668da1a0802a722962a68e8b8fecd9bb58db5f7341f2e8024222b7342a129295514a588c612164cbb8ae55582fed43d570bafe6f50c66c80c4bb13f53c6db65bbf5043714485d4eeeb88251dd7d97ab6ddc42754433e131b72e1194311c430867f8a8490b9970fd7e48a2b528ae6d5258df5b45a81d98df8e5c6633f2b058fff4e66c2b23ce11809d31ad27663ebcab41effbf7cf2e51fc1a912b3f354cde990f6ab95a677eb5b6b2fb62b8befcff134938993e0e42c5869ce453765b7deab1dbd0f3dee794e37c10a74549886af469febed93dc1adc2c013e3f3cc77ffe5a19fe8606ba44afbfb0af96ce76c8372416df2ca843c7ce1095dcac1c3d1206ea6c2bbd392d284e5b55963907bff1508f7995bf119adca266926834019422dfb3f820883af6200faeb5898ae4b6c6077a4f69c5e8d0fd663a6fe1c7f5f89fcbda3893647c2f86b66da57770e9b388187f92b3957c864b1a5d0ba3543bf5f6b4429c1bafeed1a23a05dc35d2f70e1a5de383153be0e6593a5a02852bb75870a795c2eb279fda3e882ee87d318c99c41c3b9ae056b6638eb03edfb8faf18a5f2775d0f32285122114c33e37a90b8c818fb819be3865702b450a1be79fb3d955778ac816584ff7b9f677e02aeefa36bce317af2d95b5a37696eb3fb52b4a163fd933de85510149d28226649229969b3ac6dd99288846d6e16a78de72f2c3fdb26392d93d56ac12959ed804c60a053b952c1d3a61a6ced6065af281a3acd8a553650c744c64ad6400a943b865faa406a6b4637f958bde9e562a46769956973a0930f30cb79056e2b40b2b5106ea4d4fddb9e2e2261d8b6ca75fec7a2549963a728e1fd6105535fca0cd33bfb231efbbd2c07fab676b2330c49a4c480eed071120bcf344dd6db85217cdf612b0ea73d745c48d168dd986e0a0ab18f3938126b8f78a67faeb23d7fae9639f1a67ee18c953d9de53a51a86c8404420361f50fc1d40c216279432c91f172b1cee9612f24eb03a9d08bddaa2c1c147ff6da69e1e254c4cd25605f047e2949e90ce4a87a1adf20a8d52ce44cdf43ee243df77561cfb692467c444ce2ebec23cd59884ae8eb3cda3a82662c147903eedf8a65a0d7fcd0a4039da39af9548244e1bfcf5f8456f549a04f861e030b8302caa71f7a2c21404f0de51f5ac36234e15dae61d67dd6f713d47d2296fe41eb0d490f7fd23276f56b8160e9f6f4aa3baf2a582b33d09979b01f7b59521f0029f076fabe3c3c6029b86b8a02392614330634fc5c2e3a3cd18aafc5d1ab64eb5b8422de7dab6e31393200d207af9f91d970e4080648d44bed1771d1b8057aa1305367f427ea3d40f8d9665f9f383ec290256205609065f167b34552b6375292259713da21a4d7b72f645fd88204db4e159f0206c9f2327d23177d7c2bcbc53d6a2c37e49b94c0200d577db70854366ff18f2208b7872d2ae7b213e15fcaa3e59f3cc48bd383877d42b486bbe8ea2c8f196b6de238554442ca021ef676fef431bdf1f7dd128400e753898689a49633a033a66914c9b8e4dfcead289f6da3c73179dc6f44de8d1558fc314167538d57279bd98e96702025ebc8b63e287b56e45510ead74492f9be25d0ca786441a4285f0abd2cfc5a697ca6cc6fef65e2c0230c76d86e9e92c6a2dbcfe1bb7a3fd61a8f2c0d39334d217f6b0cd8602233e0666a06d838865da0ac7c73cf15d2d70b6544ad048f621745e5fb6dffd41cd6516c4a0b34eae2f4310278fc36e7922992bc730f04f93ee9c8e24b137736c7b51b73e558c62e3b3fdc5ec2f5ca972b2e684b74d4a31ede637c21565daa3cb709b0c1bb73339383fdc749023708148c258c5c9558510badec03a87380ec841298931748a49862474b1937980698287f567b7d1e7aa6fddc868d9fe007fb5eb26df076768f58e360892a889a72152a6ceb508eb4554635f78fc678523236b3a79467065b167b63f337481cf690cc53e2c275aa6699f1aaa7a4164fb36f7119fe8245afac62d5654c77868bbcf6d9540fc0a62258eed486cf740f9c9aeea35fdd103d18069c751db9057f9874d68e394a19288aa21a313064ba2d3a262d924a6f25f60b8f3523fe4e9e53a60fb4d989d656fc669f51403047112f6dd402abfcb83e8d7d18f831e376e957f91b7d13493d7755ad4d553cce358413274bda679c4f31a80a7bc83c9746c8a1bd192fc30adcf0477252e0d539f41463b8b0b57c5bcbc3771f812d6c2b2c52c3bad7d8e0c4071773e12de8a69e2b3a7e975bb08314544b1cb9e74bb28b997146adac3885b26607a35f6706b1619be7b7556f4c85f68a378f352df019d1097b1644bb06b8f29c92c0f71fc7835e9b487b8ae7f9afc3cae1b7a6675891cfbd2ca4fea23df5fabd94b6e5e352cbea2e055b665a6a1f79c2b288d89c345d19655d896799cb300bb26a6865b4df2a0c8ed92a6b602a15b7b5a0fd7d9b8df276c25d78530af0a5f78c134d55164d622058b71bfa737fa43e6b977a09dc77bfdec20db30a3db5be263b8f581ca9253164319868c206f4de367d1edebfb4258dc32cd531909a1aef39735a97edb780579eae8cae9c2a1803e0e02e5c927e86cab82d2516dcb4e79d0e845d80eb2e8627aa15f5340fcd4e0ea879238a5839f317e2dd0898418d2647af42bc96908e8b6a90ee16929d0b57743dbb16c95ed39a99355f6231b98c7861111c1694258e7ffcc7be0c2389c4a78bcb8b2faa099bb729cbaab58013917f212e19465fd6200e566e554bcb85059d9ba868ae0a2d753c352b73598df5d86f948c6412403c2de26a54a82bd6dc9ad07fd7a01971c47b2f421d43d7f521fc2c7ef8792a4b64178d389a1ad9ac2cc27b09a37ad2c2fab7ebb2ae97de43d8f14dd4b3ff12bad2f7b1fe8f52d2aa4df9e0149b3679a75eb91f43eb6ab030dd98942d284fa5a981d9e555f27d590f57bd2d655e5f6a662623db7ea53d0233be5103a1da36dd94fce4beb711c95d92ebdf60e3564d12db98e3606a9d946cee508ce1974c1fced0d7ae75c24c66f12fe41bf5c296e1ebc61259ca22b0598fd3abcccf61512d03891b3fa9d38e49c31be26f09d32dd594361653faab281981c7fb62a56b92e2fe10d7f241555405284ddbc41494767935ff4721d39af0df9cf877bd8b5002b00c0e7233269dd0132baefd425d661ec4f4486e2d46b473d0bf6f91e253c31b6a6111908bff8ede66bf61dd1aabf048d931d0b3bca95cf6c6bfd74f69b876c73830b8a6", 0x1000}, {&(0x7f0000002fc0)="e0b3f2459d4311c7966687ea560655ca63ecdc39431829ecc7069fde5b3ee32cd2c4941c9107ae4be2c94d23440fcc5c184ff6ad1a476225f272acbf7c7385fbd75d59fda63df5420d72b1e77174a39d7a1f7c67cfa09d861fe5a52e85be15c59b36fd2ef4446b18146afe8e84fc3c39ee229881caff0b2f36f078d97e92b069d03c072cfdc4d0af417f8a9607a2096101b3609fd0c90c18578a557f649c7aa5c01e4d909449704de5b66d5749cb0923335c9e6adb020bc4d63210c68dd28b638806713904ce32c80c197a6be20ccd5cfc3344e43b", 0xd5}, {&(0x7f0000000f00)="82355819d7ee290d7280f34834386d1e4e4a146bac47b4ca3894e6d3f25c3cd9098e3907f0c11317b1419144dded0560df75435d2de282ae493a41e81d0dd79d2c0e00c3173971a9728fc3b8d31497018ce07863598b80016fa9bab618be86a6c50c14b13ad1476676f1fc226f96", 0x6e}, {&(0x7f00000030c0)="c535a77768253393b6a032eff411a9411f2c83de227232ef4cc9ca61b0b539bd988c04e8a502002f4c66dac789719468ba1380686a512eb64831ef3ef865698ea0579efc591056a6d36fc57d0166abe61f13867ac6591b2a5f464b7e30ad62656a66ee63c50618392c0c9d1d76e1bc6cb3864406bf8d568a248c8285d0c4a2a5c2f9222057f43cbd18d91d05d32f83f610a295aa8be05ba5c04e27534448d0", 0x9f}], 0xa}}, {{&(0x7f0000003240)={0x2, 0x4e24, @local}, 0x10, &(0x7f0000003800)=[{&(0x7f0000003280)="00004d5aec5dee9d08cf61e1c29707f0b2533f8e8029c45b03f64d3a0801683d0811eb84b591547f53c174e93e2a7a73f66220f216f05eede47931ff559b27d7b36bedf108ee58195f682f0b97d0c4aecf7ff7dcc76ee42d3d2c36c84b8c270c183ecf7ddbf3f93d06e786fb3e7500bba80fc80a828a33ecd61fcc860de38b9c7c405c76e743ccd1d5c5c468f8e275d4535db5dd578f34c6697eadf64c37a11d58dc3a5f", 0xa4}, {&(0x7f0000003940)="55e8b400d116037343731d970685fb1e63d33ba7c716ec1bb6cc480b98ebad788aa24e375b01e2888ef6266b410b4142f87c782ba6578290fffa931d9b77b4d0c0c578c44433e0d7e1d683710280a6aa37b4ece20f065f1ef1605ca05b9997d00be77759707485dc381b2789b76ea500400000d0656ecbbcc4a3cbc7e464061b53a203fb030a4748d8c038eb28be875e0a88e2d280985bdc1a1fc34abd28011e9ba751340493b0e4ff08d0b021dfea86f5c61eae7a43bdcf88a7bc4f9ffe478fc37d5a197bdbaf18c9f9ff67c35e69dd3bb40452d01e247bd5d09ec672e13e09a466671a81462e6a9bd606f5269e01b81708aa000000000000", 0xf9}, {&(0x7f0000003400)="863ed733314a218b5666c15eb07c86065924b3cee9f62cba3ac9041a6c5f656d7a348e094525fd80599e50a22352f34e02fef40c9db85db9ffcd8981fbde7ebd7aa5389288eb8e822dabbd76a88740286e184b4d9ee752b68c21bbfcdd5f65e3845a217b8c295db8", 0x68}, {&(0x7f0000003480)="c4cd417e7f7a81b6691b9a6072661828d79a3d5b7ad065e288a7bc1d11e2d73b37b5e99e5532c00a151d8493491be5a76e51531f047228c7a2547365d40f8190af79baeeb512228a531cf7b03aeba9759371afc5aa12e54fe8fa8d9beabb97d1c5276799e78ac2d8488269901607207091d017", 0x73}, {&(0x7f0000000700)="9d6f9a93a8c1c6bd2d4d9dcca6199444701fa61155b3631f94d0dbbc524d62843e7e57adf5975fa77aac8d917bde3bfdef5cbbf74a866c40d6c8fbbecd", 0x3d}, {&(0x7f0000003740)="db676afd8d361bbb9f01979b023fd3640bbe086c3df9056b0bcda3ad357320b44de8e17ff42be10ffeff7f49f4ed5bc237bf9b4973e18c83d88e25563bf7340e6aa941ba68629577b9a8006e58b5de85c85c9cf41f0cc69dfbc7a568358f12f7dd07d889954035bcc1b417fb231e9ebe11617f91d43dd1ada355fe088ddeb9c98e5bb2f79daf3fc0bc242d79f91cb0b95070544e1a687db570bb420fd197eb0846c50b99c629c61e2b7870ed1051", 0xae}, {&(0x7f0000000800)="0b570500000000000000", 0xa}], 0x7, &(0x7f0000003540)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @multicast2, @private=0xa010100}}}, @ip_retopts={{0x24, 0x0, 0x7, {[@rr={0x7, 0x13, 0xa4, [@broadcast, @loopback, @private=0xa010102, @broadcast]}]}}}, @ip_retopts={{0x48, 0x0, 0x7, {[@noop, @generic={0x89, 0xf, "b6275ac42101f1a2b9563cd52e"}, @noop, @timestamp_prespec={0x44, 0x24, 0x8f, 0x3, 0xf, [{@local, 0x6}, {@dev={0xac, 0x14, 0x14, 0xc}, 0x817b}, {@multicast1, 0x6}, {@rand_addr=0x64010100, 0xaa9}]}]}}}, @ip_tos_u8={{0x11}}, @ip_ttl={{0x14}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x7f}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x5ebc}}], 0xf0}}], 0x4, 0x44040) r2 = socket$inet(0x2, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@setneightbl={0x14, 0x43, 0x101, 0x70bd2d, 0x25dfdbfb, {0xa}}, 0x14}}, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x23, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000100)=0x81, 0x4) bind$alg(0xffffffffffffffff, &(0x7f0000000440)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r5 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r5, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r5, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, &(0x7f0000000640)={0x28, 0x0, 0x2710, @local}, 0x10) recvmmsg(r6, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000005c0)=""/77, 0x4d}], 0x1}, 0x5}], 0x40000, 0x0, 0x0) shutdown(r6, 0x0) sendmsg$inet(r6, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000380)="862caa99", 0x4}], 0x1}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'xfrm0\x00', 0x0}) sendto$packet(r4, &(0x7f00000003c0)="12", 0x1, 0x4008014, &(0x7f0000000140)={0x11, 0x8, r8, 0x1, 0xfe, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) 3.039787618s ago: executing program 3 (id=753): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000380)={0x190, 0x0, 0x0, 0xa0, 0x800, 0x0, 0xf, 0x0, {0x4, 0x401}, {}, {}, {}, 0x2000, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x3, 0x5}) 3.027982499s ago: executing program 4 (id=754): r0 = socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000600)=ANY=[@ANYBLOB], 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b40)={{0x14}, [@NFT_MSG_NEWSET={0x28, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x50}}, 0x0) syz_mount_image$fuse(0x0, 0x0, 0x1448005, 0x0, 0x0, 0x0, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) bind$alg(r0, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d1d7a440041601801f440102030109021200010000000009"], 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) r4 = accept4(r0, 0x0, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000580)={{}, {0x77359400}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x7bff, &(0x7f0000000180)={&(0x7f0000000140)=@delqdisc={0xfffffffffffffc9b, 0x25, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xf0}}}, 0x49d32d254ae22f79}}, 0x0) 2.787109169s ago: executing program 2 (id=755): r0 = socket(0x1e, 0x4, 0x0) connect$tipc(r0, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) sendmmsg$unix(r0, &(0x7f0000004400), 0x400000000000203, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000000b0000000c00058007000100"], 0x20}}, 0x0) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000240)) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e24, 0x681f, @ipv4={'\x00', '\xff\xff', @remote}, 0x159}, 0x1c) syz_emit_ethernet(0xd2, &(0x7f00000001c0)=ANY=[@ANYBLOB="0180c2000000ffffffffffff86dd60000000009c1100fe8000000000000000000000000000bbff0200000000000000000000000000014e240e22"], 0x0) 2.78654031s ago: executing program 3 (id=756): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x100000000}, 0x18) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PTP_PEROUT_REQUEST2(r0, 0xc0603d0f, &(0x7f0000000040)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_PAYLOAD_SREG={0x8}, @NFTA_PAYLOAD_OFFSET={0x8}, @NFTA_PAYLOAD_CSUM_TYPE={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}]}], {0x14}}, 0x94}}, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x17) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r3, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_io_uring_setup(0x48ba, &(0x7f0000000000)={0x0, 0xfffffffc, 0x1042, 0x0, 0x333}, &(0x7f0000000080), &(0x7f0000ff4000)) close_range(r2, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x480) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r4, 0x408c5333, &(0x7f0000000300)={0x3, 0x1ff, 0x1, 'queue0\x00', 0x9}) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r5 = syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_G_CTRL(r5, 0xc008561b, &(0x7f00000000c0)={0x6, 0xfff}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) sigaltstack(0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) syz_usb_connect(0x0, 0x5a, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ec13b2106d04f308280b0102030109024800010000000009046900000e0100002b41"], 0x0) 2.552304203s ago: executing program 2 (id=757): r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000400)=[{&(0x7f0000000000)="390000001000111867090707a640400f0021ff3f3100fdff170a001700000000040037000900030001372564b758b9a64411f6bb744dc48f57", 0x39}], 0x1) 1.7974554s ago: executing program 2 (id=758): r0 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) r1 = socket(0x2a, 0x2, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x3c, 0x2, [@TCA_FLOWER_ACT={0x38, 0x3, [@m_connmark={0x34, 0x1, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x6c}}, 0x24000000) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xfffa, 0xffe0}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x81}, 0x24004000) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r6 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x1a1281) pwrite64(r6, 0x0, 0x0, 0x6) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0xfffd, 0x7, @mcast2, 0x9}, 0x1c) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x4001) r7 = fsopen(&(0x7f0000000400)='cgroup2\x00', 0x0) r8 = fsmount(r7, 0x0, 0x0) r9 = openat$cgroup_ro(r8, &(0x7f0000000040)='cgroup.controllers\x00', 0x300, 0x0) r10 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x28, 0x14, 0x119, 0x0, 0x0, {0x28}, [@INET_DIAG_REQ_BYTECODE={0x11, 0xfa, "8d747ea4dc9278634a4e3ae552"}]}, 0x28}}, 0x0) ioctl$VIDIOC_G_FREQUENCY(r9, 0xc02c5638, 0x0) read$eventfd(r9, &(0x7f0000000100), 0x8) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x9506, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0x5dc}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 1.424454036s ago: executing program 1 (id=759): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc73}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)=0x3) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) ioctl$TFD_IOC_SET_TICKS(0xffffffffffffffff, 0x40085400, &(0x7f0000000180)=0x8001) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x6], 0x0, 0x8340}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x7f, 0x3, 0xfd, 0x0, 0x1, 0x7e, 0xcb, 0x10, 0x8, 0x5, 0xb, 0x8, 0x0, 0x10003, 0x9, 0xff, 0x4, 0x5, 0x12, '\x00', 0x1}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10, 0x0}, 0x4048041) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x48090) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r6, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) waitid(0x0, r7, 0x0, 0x8, 0xfffffffffffffffd) r8 = socket$netlink(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r8, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfb, 0x800}, 0xc) socket$inet6(0xa, 0x3, 0x7) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000880)=ANY=[], 0xfc}}, 0x40c0) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x7fff, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) 1.035103013s ago: executing program 2 (id=760): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newlink={0x40, 0x10, 0x503, 0x200000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x15a11}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE2={0x8, 0x2, r1}, @IFLA_HSR_SLAVE1={0x8, 0x1, r2}]}}}]}, 0x40}, 0x1, 0x2000000}, 0x44) 620.875238ms ago: executing program 3 (id=761): r0 = socket$kcm(0x10, 0x2, 0x0) socket$igmp6(0xa, 0x3, 0x2) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffa8, &(0x7f0000000280)=[{&(0x7f00000000c0)="d8000000140081044e81f782db44b904021d080211000000040000a118000200e000000e00000e1208000f0100810401a80016ea1f000840032e5f54c92011148ed08734843c8802033d0803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x48000) socket(0x2, 0x80805, 0x0) (async) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, 0x0, &(0x7f0000001080)=0x2b) socket$alg(0x26, 0x5, 0x0) (async) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes-aesni)\x00'}, 0x58) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) (async) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000180)="f7790066baa00066b86b4266efed66ba42f94deff94def0036c4e35d6f7cee00df0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x53}], 0x1, 0x43, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000180)="f7790066baa00066b86b4266efed66ba42f94deff94def0036c4e35d6f7cee00df0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x53}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = accept4(r2, 0x0, 0x0, 0x0) sendmmsg$inet6(r6, &(0x7f0000003b80)=[{{0x0, 0xd, &(0x7f00000003c0)=[{&(0x7f00000000c0)="e6", 0x2}], 0x1}, 0xff03}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000440)='&', 0x23fff}], 0x7d}}], 0x4000070, 0x8000) (async) sendmmsg$inet6(r6, &(0x7f0000003b80)=[{{0x0, 0xd, &(0x7f00000003c0)=[{&(0x7f00000000c0)="e6", 0x2}], 0x1}, 0xff03}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000440)='&', 0x23fff}], 0x7d}}], 0x4000070, 0x8000) readv(r6, &(0x7f0000000100)=[{&(0x7f0000000240)=""/52, 0x34}, {&(0x7f00000002c0)=""/221, 0xdd}], 0x2) setsockopt$SO_J1939_ERRQUEUE(r6, 0x6b, 0x4, &(0x7f0000000000), 0x4) 487.094581ms ago: executing program 0 (id=762): sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000840)={0x58, 0x0, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [{{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0xfffbfff9}}}]}}]}, 0x58}, 0x1, 0x1000000, 0x0, 0x24004000}, 0x24040840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001fc0)=@delchain={0x1a0, 0x65, 0x2, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_RATE={0x6, 0x5, {0x8, 0x81}}, @filter_kind_options=@f_bpf={{0x8}, {0x15c, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_ACT={0x134, 0x1, [@m_simple={0xcc, 0x1e, 0x0, 0x0, {{0xb}, {0xa0, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x68f6, 0x6, 0x2, 0x8, 0x9}}, @TCA_DEF_DATA={0x9, 0x3, '/-@@\x00'}, @TCA_DEF_DATA={0x3d, 0x3, '\x00\x94\xe4\xe2X\xce\xbar\x069\xf3\xff\x8d\x94\x1ao\xa1,\xa4\xc1\xcc\x1e\x9aS>\a\xd2R\x85\v\x80\xea\x1e\xc8W\xea\x99\xacos\x80\x1d\x8b\xd9`Ewb\xa5&iu@\xfd\x8c\xde\x00'}, @TCA_DEF_DATA={0x1e, 0x3, 'cpuacct.usage_percpu_user\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x0, 0x4a66, 0x4, 0x3, 0x9}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_connmark={0x34, 0x15, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_csum={0x30, 0x8, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}, @TCA_BPF_FLAGS_GEN={0x8}, @TCA_BPF_FD={0x8}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x2}}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x81}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}, 0xca9a3b}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 272.18007ms ago: executing program 2 (id=763): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r1, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000240)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) bind$alg(r0, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x48, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @in6={0xa, 0x4e20, 0x0, @loopback, 0x3}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x15}}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f00000000c0)={r3, 0x8, 0x9, 0xd5}, 0x14) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="ad56b6c5910fae9d6dcd3292ea54c7b6ef", 0x11) 156.032238ms ago: executing program 3 (id=764): socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x2000000000000001, 0x0, 0x2, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x57, 0xc2}}}}}}, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x40844) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(0xffffffffffffffff, 0xc0984124, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8983, &(0x7f0000000040)={0x6, 'bond_slave_1\x00', {0x1}, 0xff7f}) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r2, 0x8982, &(0x7f00000023c0)={0x0, 'veth0_vlan\x00', {0xffe}, 0x2b1}) add_key$user(0x0, 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r3 = socket$netlink(0x10, 0x3, 0x15) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x14, 0x1, 0x1, 0x101, 0x0, 0x0, {0x7, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x8040}, 0x0) writev(r3, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000a6ff00", 0x39}], 0x1) recvmmsg(r3, 0x0, 0x0, 0x40010000, 0x0) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f00000002c0)={0x1, 0x4, 0x0, 0x0, @vifc_lcl_ifindex, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) setsockopt$MRT_FLUSH(r4, 0x0, 0xd4, &(0x7f0000000000)=0xe, 0x4) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x2, &(0x7f0000000240)=""/254, &(0x7f0000000040)=0xfe) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000080)={0xfefc, 0x7}, 0x4) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x1}, 0x4) 2.804603ms ago: executing program 0 (id=765): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$sw_sync(0xffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f00000001c0)={0xbf48ce3, "1803c80300000000000000ffff94d4ff000000000000d63175a60600", 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@newqdisc={0x50, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x24, 0x2, [@TCA_HTB_INIT={0xffffff78}, @TCA_HTB_DIRECT_QLEN={0x3}]}}]}, 0x50}}, 0x0) r7 = syz_open_dev$video4linux(&(0x7f00000000c0), 0xf, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r7, 0xc0305602, &(0x7f0000000240)={0x0, 0x5, 0x3010}) r8 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r8, 0xc0285700, &(0x7f0000000000)={0x2, "fa02c80a3a1e9d4b9aaf000000008d674fe69b5b7638dd031dd7504fe5809639", 0xffffffffffffffff}) r10 = syz_usb_connect$uac1(0x1, 0x71, &(0x7f0000000500)=ANY=[@ANYBLOB="0cfd6b6753ed7517d8530b65a4e97d4dd624707f14a276611365a7c1", @ANYRESOCT=r8, @ANYRESDEC=r5, @ANYRESOCT=r8, @ANYRES32=r8], 0x0) syz_usb_control_io(r10, &(0x7f0000000480)={0x2c, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="00030400000004030b"], 0x0, 0x0, 0x0}, 0x0) ioctl$SYNC_IOC_MERGE(r9, 0xc0303e03, &(0x7f0000000080)={"6739669f274d13b691ebe45b00e4f5b53e0ca34dd02acecdc67c5e3126628168", r3, 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000000)={0x6, "34e6498c25f58dad9987ffe93bbabd18cf504a2700", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r11, 0xc0303e03, &(0x7f0000000240)={"0e337b42cc00d331ff0007000000000000001a00", r12}) ioctl$VIDIOC_S_OUTPUT(r7, 0xc004562f, &(0x7f0000000100)=0x9) r13 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r1) openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) r14 = socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000400), 0xffffffffffffffff) fcntl$F_GET_RW_HINT(r2, 0x40b, &(0x7f0000000300)) r16 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r16, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r16, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x5}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x78}}, 0x0) sendmsg$WG_CMD_SET_DEVICE(r14, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="980000006ea467c8859828f56cc82b6f58db8de2aeb8c7ff4a433a6a12c568df760ea41c2795db7297678c56fbef501b462b13f66f4975f738f9ebd07f48a8ade73a3419f01f55012410dbb2100b2f0d496d6991378614bbfa98be74cb9ed7ca75206f5cb8e759e2a98dfc9d9a9abe159ded8bfa1a914f737f4b4272da1dd9b3b504023e771a51d099dba469012fef18a72a945a5aed639ab74f09e4ede83b256c35f4b05c1359163accc507d17bccf86ae8a4be2ab051a82c4110eedf4b7f9758f420ded40a6543676e00"/215, @ANYRES16=r15, @ANYBLOB="010000000000000000000100000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb54214000200776730000000000000000000000000004c0008804800008008000300020000001400040002004e24ac1414aa00000000000000000400098024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b"], 0x98}, 0x1, 0x0, 0x0, 0x24000855}, 0x0) sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="030000ff03a38947b2a9fa37c0ada12a670a6eb103d1fb", @ANYRES16=r13, @ANYBLOB="01000000000000000000110000002400098008000100ffffffff19ff01000800000008000100010000000000020040010000"], 0x38}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2100}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0xb4, r13, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x78, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffff42}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_NET={0x20, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xf2d}]}, @TIPC_NLA_SOCK={0x4}, @TIPC_NLA_NET={0x4}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4008000}, 0x10) syz_usb_connect(0x2, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0xc7, 0xa6, 0x7d, 0x40, 0x13b1, 0x42, 0xec, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x36, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x9a, 0x0, 0x2, 0x7e, 0xd7, 0x25, 0x92, [], [{{0x9, 0x5, 0x3, 0x8, 0x40, 0x9, 0x1}}, {{0x9, 0x5, 0x2, 0x3, 0x40, 0x8, 0x0, 0x7}}]}}]}}]}}, 0x0) 0s ago: executing program 2 (id=766): socket$xdp(0x2c, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x20040800) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x22000, 0x0) read$FUSE(r2, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000000c0), 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r3, 0x0, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'wp512-generic\x00'}, 0x58) r5 = accept$alg(r4, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000000b80)=[{0xff8d, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)='v', 0xf4240}], 0x1}], 0x1, 0x8004) accept4(r5, 0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) unshare(0x28040680) kernel console output (not intermixed with test programs): adget: couldn't find an available UDC or it's busy [ 186.979211][ T7152] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 187.621712][ T7168] vivid-002: disconnect [ 187.628605][ T7168] vivid-002: reconnect [ 187.651339][ T7168] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 188.998626][ T5921] usb 1-1: USB disconnect, device number 15 [ 189.269799][ T7172] block device autoloading is deprecated and will be removed. [ 189.305147][ T7172] syz.2.336: attempt to access beyond end of device [ 189.305147][ T7172] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 190.119181][ T7189] af_packet: tpacket_rcv: packet too big, clamped from 122 to 4294967286. macoff=82 [ 190.537728][ T5835] usb 3-1: USB disconnect, device number 12 [ 190.633223][ T5962] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 190.740209][ T7200] vlan0: entered promiscuous mode [ 190.794819][ T5962] usb 5-1: no configurations [ 190.802296][ T5962] usb 5-1: can't read configurations, error -22 [ 191.012540][ T5962] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 191.213312][ T5962] usb 5-1: no configurations [ 191.217982][ T5962] usb 5-1: can't read configurations, error -22 [ 191.225046][ T5962] usb usb5-port1: attempt power cycle [ 191.645291][ T5966] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 191.722249][ T5962] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 191.794211][ T5962] usb 5-1: no configurations [ 191.888931][ T7225] binfmt_misc: register: failed to install interpreter file ./file0 [ 191.904932][ T5966] usb 4-1: config 0 has no interfaces? [ 191.910549][ T5962] usb 5-1: can't read configurations, error -22 [ 192.582361][ T5962] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 192.632903][ T5966] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 192.842967][ T5962] usb 5-1: no configurations [ 192.847631][ T5962] usb 5-1: can't read configurations, error -22 [ 192.854035][ T5966] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.898297][ T5962] usb usb5-port1: unable to enumerate USB device [ 192.911318][ T5966] usb 4-1: Product: syz [ 192.943354][ T5966] usb 4-1: Manufacturer: syz [ 192.953839][ T5966] usb 4-1: SerialNumber: syz [ 193.451759][ T5966] usb 4-1: config 0 descriptor?? [ 194.262709][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.269202][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.399147][ T7235] FAULT_INJECTION: forcing a failure. [ 194.399147][ T7235] name failslab, interval 1, probability 0, space 0, times 0 [ 194.562362][ T7235] CPU: 1 UID: 0 PID: 7235 Comm: syz.4.357 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(full) [ 194.562390][ T7235] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 194.562400][ T7235] Call Trace: [ 194.562407][ T7235] [ 194.562413][ T7235] dump_stack_lvl+0x189/0x250 [ 194.562451][ T7235] ? __pfx____ratelimit+0x10/0x10 [ 194.562476][ T7235] ? __pfx_dump_stack_lvl+0x10/0x10 [ 194.562500][ T7235] ? __pfx__printk+0x10/0x10 [ 194.562520][ T7235] ? __pfx___might_resched+0x10/0x10 [ 194.562543][ T7235] ? fs_reclaim_acquire+0x7d/0x100 [ 194.562565][ T7235] should_fail_ex+0x414/0x560 [ 194.562589][ T7235] should_failslab+0xa8/0x100 [ 194.562611][ T7235] kmem_cache_alloc_noprof+0x73/0x3c0 [ 194.562646][ T7235] ? alloc_empty_file+0x55/0x1d0 [ 194.562679][ T7235] alloc_empty_file+0x55/0x1d0 [ 194.562708][ T7235] path_openat+0x107/0x3830 [ 194.562738][ T7235] ? arch_stack_walk+0xfc/0x150 [ 194.562779][ T7235] ? kasan_save_track+0x4f/0x80 [ 194.562801][ T7235] ? kasan_save_track+0x3e/0x80 [ 194.562823][ T7235] ? __kasan_slab_alloc+0x6c/0x80 [ 194.562836][ T7235] ? getname_flags+0xb8/0x540 [ 194.562853][ T7235] ? __pfx_path_openat+0x10/0x10 [ 194.562873][ T7235] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.562903][ T7235] do_filp_open+0x1fa/0x410 [ 194.562924][ T7235] ? __lock_acquire+0xab9/0xd20 [ 194.562947][ T7235] ? __pfx_do_filp_open+0x10/0x10 [ 194.562985][ T7235] ? _raw_spin_unlock+0x28/0x50 [ 194.563011][ T7235] ? alloc_fd+0x64c/0x6c0 [ 194.563035][ T7235] do_sys_openat2+0x121/0x1c0 [ 194.563058][ T7235] ? __pfx_do_sys_openat2+0x10/0x10 [ 194.563083][ T7235] ? __task_pid_nr_ns+0x28/0x470 [ 194.563105][ T7235] __x64_sys_creat+0x8f/0xc0 [ 194.563128][ T7235] do_syscall_64+0xfa/0x3b0 [ 194.563142][ T7235] ? lockdep_hardirqs_on+0x9c/0x150 [ 194.563164][ T7235] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.563179][ T7235] ? clear_bhb_loop+0x60/0xb0 [ 194.563197][ T7235] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.563212][ T7235] RIP: 0033:0x7f278798e929 [ 194.563229][ T7235] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 194.563242][ T7235] RSP: 002b:00007f2788886038 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 194.563258][ T7235] RAX: ffffffffffffffda RBX: 00007f2787bb5fa0 RCX: 00007f278798e929 [ 194.563270][ T7235] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 194.563279][ T7235] RBP: 00007f2788886090 R08: 0000000000000000 R09: 0000000000000000 [ 194.563288][ T7235] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 194.563296][ T7235] R13: 0000000000000000 R14: 00007f2787bb5fa0 R15: 00007f2787cdfa28 [ 194.563318][ T7235] [ 195.604333][ T5966] usb 4-1: USB disconnect, device number 20 [ 196.820824][ T7267] netlink: 8 bytes leftover after parsing attributes in process `syz.4.367'. [ 197.016988][ T7276] sch_tbf: burst 19920 is lower than device lo mtu (65550) ! [ 197.206245][ T7284] random: crng reseeded on system resumption [ 197.244781][ T7287] netlink: 'syz.1.372': attribute type 9 has an invalid length. [ 197.253182][ T7287] netlink: 8 bytes leftover after parsing attributes in process `syz.1.372'. [ 197.262349][ T7288] netlink: 8 bytes leftover after parsing attributes in process `syz.0.373'. [ 197.282232][ T7287] hsr0: entered promiscuous mode [ 197.288954][ T7287] macvlan2: entered promiscuous mode [ 197.290227][ T7284] netlink: 12 bytes leftover after parsing attributes in process `syz.3.374'. [ 197.304205][ T7287] macvlan2: entered allmulticast mode [ 197.309756][ T7287] hsr0: entered allmulticast mode [ 197.317287][ T7287] hsr_slave_0: entered allmulticast mode [ 197.342234][ T10] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 197.365745][ T7287] hsr_slave_1: entered allmulticast mode [ 197.541638][ T7298] netlink: 8 bytes leftover after parsing attributes in process `syz.2.376'. [ 197.552276][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 197.572966][ T10] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 197.595242][ T10] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 197.620196][ T10] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 197.635013][ T10] usb 5-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 197.652215][ T10] usb 5-1: Product: syz [ 197.665794][ T10] usb 5-1: Manufacturer: syz [ 197.695115][ T10] hub 5-1:4.0: USB hub found [ 197.729336][ T7304] kvm: Disabled LAPIC found during irq injection [ 197.845076][ T5962] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 197.898022][ T10] hub 5-1:4.0: 2 ports detected [ 198.023589][ T5962] usb 2-1: Using ep0 maxpacket: 16 [ 198.038891][ T5962] usb 2-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 198.055260][ T5962] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.078688][ T5962] usb 2-1: Product: syz [ 198.098817][ T5962] usb 2-1: Manufacturer: syz [ 198.105204][ T7312] KVM: debugfs: duplicate directory 7312-5 [ 198.112539][ T5962] usb 2-1: SerialNumber: syz [ 198.150752][ T30] audit: type=1326 audit(1750079183.367:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7311 comm="syz.3.379" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9b6918e929 code=0x0 [ 198.177180][ T5962] usb 2-1: config 0 descriptor?? [ 198.357014][ T10] usb 5-1: USB disconnect, device number 32 [ 198.589814][ T5962] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 198.612011][ T5962] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 198.628216][ T5962] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 198.639925][ T5962] usb 2-1: media controller created [ 198.679793][ T5962] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 198.702286][ T5929] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 198.872229][ T5929] usb 3-1: Using ep0 maxpacket: 16 [ 198.898673][ T5929] usb 3-1: config 6 has an invalid interface number: 227 but max is 0 [ 198.949173][ T5929] usb 3-1: config 6 has no interface number 0 [ 198.984193][ T5929] usb 3-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice= 7.79 [ 199.000889][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.021259][ T5929] usb 3-1: Product: syz [ 199.027556][ T5929] usb 3-1: Manufacturer: syz [ 199.043066][ T5929] usb 3-1: SerialNumber: syz [ 199.075904][ T5929] kalmia 3-1:6.227: probe with driver kalmia failed with error -22 [ 199.243166][ T5962] zl10353_read_register: readreg error (reg=127, ret==0) [ 199.250381][ T7300] dtv5100: wlen = 0, aborting. [ 199.256027][ T5962] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 199.272881][ T5962] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 199.331322][ T5962] usb 2-1: USB disconnect, device number 24 [ 199.422295][ T10] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 199.466787][ T7334] netlink: 8 bytes leftover after parsing attributes in process `syz.3.387'. [ 199.476002][ T7334] netlink: 8 bytes leftover after parsing attributes in process `syz.3.387'. [ 199.523974][ T5962] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 199.546152][ T5835] usb 3-1: USB disconnect, device number 13 [ 199.684765][ T10] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 199.740697][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 199.758992][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.771536][ T10] usb 1-1: Product: syz [ 199.778461][ T10] usb 1-1: Manufacturer: syz [ 199.801626][ T10] usb 1-1: SerialNumber: syz [ 200.104542][ T10] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 16 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 200.140715][ T10] usb 1-1: USB disconnect, device number 16 [ 200.169578][ T10] usblp0: removed [ 200.714499][ T7361] tipc: Started in network mode [ 200.750764][ T7361] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 200.806234][ T7361] tipc: New replicast peer: 0000:0000:0000:0000:0000:0000:0000:0000 [ 200.831446][ T7361] tipc: Enabled bearer , priority 10 [ 201.172771][ T7371] vivid-000: disconnect [ 201.178589][ T7371] vivid-000: reconnect [ 201.206160][ T7371] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 201.949461][ T10] tipc: Node number set to 1 [ 202.463439][ T10] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 202.624213][ T10] usb 4-1: config 0 has an invalid interface number: 50 but max is 0 [ 202.634989][ T10] usb 4-1: config 0 has no interface number 0 [ 202.679349][ T10] usb 4-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 202.783771][ T10] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 202.793190][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.801318][ T10] usb 4-1: Product: syz [ 202.815900][ T10] usb 4-1: Manufacturer: syz [ 202.854504][ T10] usb 4-1: SerialNumber: syz [ 202.983076][ T7385] vivid-001: disconnect [ 202.991974][ T7385] vivid-001: reconnect [ 203.011206][ T7385] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 203.069486][ T10] usb 4-1: config 0 descriptor?? [ 203.079736][ T10] yurex 4-1:0.50: USB YUREX device now attached to Yurex #0 [ 203.305859][ T7376] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 203.314737][ T7376] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 203.330513][ T7376] netlink: 'syz.3.397': attribute type 1 has an invalid length. [ 203.542408][ T24] usb 4-1: USB disconnect, device number 21 [ 203.565207][ T24] yurex 4-1:0.50: USB YUREX #0 now disconnected [ 204.147201][ T7393] netlink: 4 bytes leftover after parsing attributes in process `syz.4.403'. [ 204.404583][ T7399] netlink: 28 bytes leftover after parsing attributes in process `syz.1.404'. [ 204.441154][ T7399] netlink: 28 bytes leftover after parsing attributes in process `syz.1.404'. [ 204.904662][ T2156] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 205.082424][ T2156] usb 3-1: device descriptor read/64, error -71 [ 205.093546][ T5835] usb 5-1: new full-speed USB device number 33 using dummy_hcd [ 205.162913][ T7411] FAULT_INJECTION: forcing a failure. [ 205.162913][ T7411] name failslab, interval 1, probability 0, space 0, times 0 [ 205.175710][ T7411] CPU: 1 UID: 0 PID: 7411 Comm: syz.1.408 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(full) [ 205.175735][ T7411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 205.175747][ T7411] Call Trace: [ 205.175755][ T7411] [ 205.175764][ T7411] dump_stack_lvl+0x189/0x250 [ 205.175818][ T7411] ? __pfx____ratelimit+0x10/0x10 [ 205.175857][ T7411] ? __pfx_dump_stack_lvl+0x10/0x10 [ 205.175889][ T7411] ? __pfx__printk+0x10/0x10 [ 205.175918][ T7411] ? __pfx___might_resched+0x10/0x10 [ 205.175949][ T7411] ? fs_reclaim_acquire+0x7d/0x100 [ 205.175979][ T7411] should_fail_ex+0x414/0x560 [ 205.176011][ T7411] should_failslab+0xa8/0x100 [ 205.176035][ T7411] kmem_cache_alloc_noprof+0x73/0x3c0 [ 205.176068][ T7411] ? alloc_empty_file+0x55/0x1d0 [ 205.176099][ T7411] alloc_empty_file+0x55/0x1d0 [ 205.176127][ T7411] path_openat+0x107/0x3830 [ 205.176156][ T7411] ? arch_stack_walk+0xfc/0x150 [ 205.176205][ T7411] ? kasan_save_track+0x4f/0x80 [ 205.176235][ T7411] ? kasan_save_track+0x3e/0x80 [ 205.176264][ T7411] ? __kasan_slab_alloc+0x6c/0x80 [ 205.176282][ T7411] ? getname_flags+0xb8/0x540 [ 205.176306][ T7411] ? __pfx_path_openat+0x10/0x10 [ 205.176333][ T7411] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.176376][ T7411] do_filp_open+0x1fa/0x410 [ 205.176404][ T7411] ? __lock_acquire+0xab9/0xd20 [ 205.176436][ T7411] ? __pfx_do_filp_open+0x10/0x10 [ 205.176489][ T7411] ? _raw_spin_unlock+0x28/0x50 [ 205.176517][ T7411] ? alloc_fd+0x64c/0x6c0 [ 205.176551][ T7411] do_sys_openat2+0x121/0x1c0 [ 205.176582][ T7411] ? __pfx_do_sys_openat2+0x10/0x10 [ 205.176617][ T7411] ? __task_pid_nr_ns+0x28/0x470 [ 205.176647][ T7411] __x64_sys_creat+0x8f/0xc0 [ 205.176679][ T7411] do_syscall_64+0xfa/0x3b0 [ 205.176698][ T7411] ? lockdep_hardirqs_on+0x9c/0x150 [ 205.176729][ T7411] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.176750][ T7411] ? clear_bhb_loop+0x60/0xb0 [ 205.176775][ T7411] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.176796][ T7411] RIP: 0033:0x7fe8c8f8e929 [ 205.176813][ T7411] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 205.176838][ T7411] RSP: 002b:00007fe8c6df6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 205.176859][ T7411] RAX: ffffffffffffffda RBX: 00007fe8c91b5fa0 RCX: 00007fe8c8f8e929 [ 205.176875][ T7411] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 205.176887][ T7411] RBP: 00007fe8c6df6090 R08: 0000000000000000 R09: 0000000000000000 [ 205.176900][ T7411] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 205.176912][ T7411] R13: 0000000000000000 R14: 00007fe8c91b5fa0 R15: 00007fe8c92dfa28 [ 205.176942][ T7411] [ 205.502118][ T5835] usb 5-1: config index 0 descriptor too short (expected 156, got 27) [ 205.510559][ T5835] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 205.539541][ T5835] usb 5-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 205.582259][ T2156] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 205.722406][ T2156] usb 3-1: device descriptor read/64, error -71 [ 205.768425][ T5835] usb 5-1: config 0 interface 0 altsetting 191 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 205.832591][ T2156] usb usb3-port1: attempt power cycle [ 205.868629][ T5835] usb 5-1: config 0 interface 0 has no altsetting 0 [ 205.907143][ T5835] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 205.960154][ T5835] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 206.000145][ T5835] usb 5-1: Product: syz [ 206.014123][ T5835] usb 5-1: Manufacturer: syz [ 206.018840][ T5835] usb 5-1: SerialNumber: syz [ 206.031319][ T5835] usb 5-1: config 0 descriptor?? [ 206.032649][ T5929] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 206.044812][ T24] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 206.173326][ T2156] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 206.194225][ T2156] usb 3-1: device descriptor read/8, error -71 [ 206.202283][ T5929] usb 2-1: Using ep0 maxpacket: 8 [ 206.207464][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 206.219294][ T24] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 206.230245][ T24] usb 4-1: config 0 has no interface number 0 [ 206.236650][ T5929] usb 2-1: unable to get BOS descriptor or descriptor too short [ 206.248605][ T5929] usb 2-1: config 9 has an invalid interface number: 121 but max is 1 [ 206.257682][ T5929] usb 2-1: config 9 has an invalid interface number: 93 but max is 1 [ 206.266192][ T24] usb 4-1: config 0 interface 12 has no altsetting 0 [ 206.274242][ T5929] usb 2-1: config 9 has no interface number 0 [ 206.280849][ T5929] usb 2-1: config 9 has no interface number 1 [ 206.288716][ T5929] usb 2-1: too many endpoints for config 9 interface 121 altsetting 7: 249, using maximum allowed: 30 [ 206.302439][ T24] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 206.313785][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.322916][ T5929] usb 2-1: config 9 interface 121 altsetting 7 endpoint 0x5 has invalid wMaxPacketSize 0 [ 206.336785][ T24] usb 4-1: Product: syz [ 206.344672][ T24] usb 4-1: Manufacturer: syz [ 206.355594][ T24] usb 4-1: SerialNumber: syz [ 206.360438][ T5929] usb 2-1: config 9 interface 121 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 249 [ 206.383964][ T24] usb 4-1: config 0 descriptor?? [ 206.405508][ T5929] usb 2-1: config 9 interface 121 has no altsetting 0 [ 206.426759][ T5929] usb 2-1: config 9 interface 93 has no altsetting 0 [ 206.442369][ T2156] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 206.465634][ T5929] usb 2-1: New USB device found, idVendor=0499, idProduct=1018, bcdDevice=35.13 [ 206.476489][ T2156] usb 3-1: device descriptor read/8, error -71 [ 206.488635][ T5929] usb 2-1: New USB device strings: Mfr=1, Product=0, SerialNumber=3 [ 206.512770][ T5929] usb 2-1: Manufacturer: syz [ 206.517815][ T5929] usb 2-1: SerialNumber: syz [ 206.593636][ T2156] usb usb3-port1: unable to enumerate USB device [ 206.691716][ T5835] ldusb 5-1:0.0: Interrupt in endpoint not found [ 206.713357][ T5835] usb 5-1: USB disconnect, device number 33 [ 206.751098][ T5929] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 206.781491][ T5929] snd-usb-audio 2-1:9.121: probe with driver snd-usb-audio failed with error -2 [ 206.889709][ T5929] usb 2-1: Found UVC 0.00 device (0499:1018) [ 206.911309][ T5929] usb 2-1: No valid video chain found. [ 206.921750][ T5929] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 206.955638][ T5929] snd-usb-audio 2-1:9.93: probe with driver snd-usb-audio failed with error -2 [ 206.967951][ T5929] usb 2-1: USB disconnect, device number 25 [ 207.066170][ T6493] udevd[6493]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:9.93/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 207.219601][ T7433] netlink: 6 bytes leftover after parsing attributes in process `syz.0.416'. [ 207.262849][ T7435] netlink: 'syz.2.418': attribute type 9 has an invalid length. [ 207.286040][ T7435] netlink: 8 bytes leftover after parsing attributes in process `syz.2.418'. [ 207.326336][ T7435] hsr0: entered promiscuous mode [ 207.331484][ T7435] macvlan0: entered promiscuous mode [ 207.361339][ T7435] macvlan0: entered allmulticast mode [ 207.380726][ T7435] hsr0: entered allmulticast mode [ 207.397805][ T7435] hsr_slave_0: entered allmulticast mode [ 207.409500][ T7435] hsr_slave_1: entered allmulticast mode [ 207.419478][ T7442] FAULT_INJECTION: forcing a failure. [ 207.419478][ T7442] name failslab, interval 1, probability 0, space 0, times 0 [ 207.423694][ T7440] netlink: 8 bytes leftover after parsing attributes in process `syz.4.419'. [ 207.438647][ T7442] CPU: 0 UID: 0 PID: 7442 Comm: syz.0.421 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(full) [ 207.438689][ T7442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 207.438704][ T7442] Call Trace: [ 207.438713][ T7442] [ 207.438723][ T7442] dump_stack_lvl+0x189/0x250 [ 207.438768][ T7442] ? __pfx____ratelimit+0x10/0x10 [ 207.438805][ T7442] ? __pfx_dump_stack_lvl+0x10/0x10 [ 207.438854][ T7442] ? __pfx__printk+0x10/0x10 [ 207.438883][ T7442] ? __pfx___might_resched+0x10/0x10 [ 207.438918][ T7442] ? fs_reclaim_acquire+0x7d/0x100 [ 207.438952][ T7442] should_fail_ex+0x414/0x560 [ 207.438987][ T7442] should_failslab+0xa8/0x100 [ 207.439014][ T7442] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 207.439038][ T7442] ? __alloc_skb+0x112/0x2d0 [ 207.439070][ T7442] __alloc_skb+0x112/0x2d0 [ 207.439100][ T7442] alloc_skb_with_frags+0xca/0x890 [ 207.439147][ T7442] sock_alloc_send_pskb+0x857/0x990 [ 207.439202][ T7442] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 207.439249][ T7442] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 207.439288][ T7442] unix_dgram_sendmsg+0x4f6/0x1870 [ 207.439322][ T7442] ? __lock_acquire+0xab9/0xd20 [ 207.439373][ T7442] ? aa_sk_perm+0x81e/0x950 [ 207.439406][ T7442] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 207.439447][ T7442] ? aa_sock_msg_perm+0x94/0x160 [ 207.439479][ T7442] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 207.439511][ T7442] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 207.439546][ T7442] __sock_sendmsg+0x21c/0x270 [ 207.439587][ T7442] ____sys_sendmsg+0x52d/0x830 [ 207.439623][ T7442] ? __pfx_____sys_sendmsg+0x10/0x10 [ 207.439669][ T7442] ? import_iovec+0x74/0xa0 [ 207.439697][ T7442] ___sys_sendmsg+0x21f/0x2a0 [ 207.439730][ T7442] ? __pfx____sys_sendmsg+0x10/0x10 [ 207.439810][ T7442] ? __might_fault+0xb0/0x130 [ 207.439837][ T7442] __sys_sendmmsg+0x227/0x430 [ 207.439873][ T7442] ? __pfx___sys_sendmmsg+0x10/0x10 [ 207.439901][ T7442] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 207.439954][ T7442] ? ksys_write+0x22a/0x250 [ 207.439978][ T7442] ? __pfx_ksys_write+0x10/0x10 [ 207.439997][ T7442] ? rcu_is_watching+0x15/0xb0 [ 207.440041][ T7442] __x64_sys_sendmmsg+0xa0/0xc0 [ 207.440072][ T7442] do_syscall_64+0xfa/0x3b0 [ 207.440094][ T7442] ? lockdep_hardirqs_on+0x9c/0x150 [ 207.440127][ T7442] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.440150][ T7442] ? clear_bhb_loop+0x60/0xb0 [ 207.440179][ T7442] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.440202][ T7442] RIP: 0033:0x7ff846f8e929 [ 207.440222][ T7442] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 207.440243][ T7442] RSP: 002b:00007ff847e85038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 207.440267][ T7442] RAX: ffffffffffffffda RBX: 00007ff8471b5fa0 RCX: 00007ff846f8e929 [ 207.440285][ T7442] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 207.440301][ T7442] RBP: 00007ff847e85090 R08: 0000000000000000 R09: 0000000000000000 [ 207.440316][ T7442] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 207.440329][ T7442] R13: 0000000000000000 R14: 00007ff8471b5fa0 R15: 00007ff8472dfa28 [ 207.440364][ T7442] [ 208.123213][ T7460] netlink: 24 bytes leftover after parsing attributes in process `syz.4.425'. [ 208.461156][ T7466] netlink: 4 bytes leftover after parsing attributes in process `syz.1.427'. [ 208.563490][ T5835] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 208.734632][ T5835] usb 5-1: Using ep0 maxpacket: 32 [ 208.756852][ T5835] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 208.799087][ T5835] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 208.849187][ T5835] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 208.870385][ T5835] usb 5-1: config 1 has no interface number 0 [ 208.891150][ T5835] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 208.918334][ T5835] usb 5-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 208.951572][ T5835] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 208.972872][ T5835] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.003333][ T5835] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 209.149137][ T7479] netlink: 12 bytes leftover after parsing attributes in process `syz.2.429'. [ 209.186353][ T24] f81534 4-1:0.12: f81534_set_register: reg: 1001 data: f1 failed: -71 [ 210.111219][ T5835] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now attached [ 210.275741][ T7478] mmap: syz.0.430 (7478) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 210.372253][ T24] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 210.402674][ T24] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 210.440921][ T24] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 210.488243][ T24] usb 4-1: USB disconnect, device number 22 [ 210.798040][ T7482] netlink: 'syz.0.430': attribute type 5 has an invalid length. [ 210.872279][ T5962] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 210.966999][ T7488] netlink: 16 bytes leftover after parsing attributes in process `syz.3.433'. [ 210.987402][ T7475] use of bytesused == 0 is deprecated and will be removed in the future, [ 211.003436][ T7488] netlink: 24 bytes leftover after parsing attributes in process `syz.3.433'. [ 211.026590][ T5962] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 211.035134][ T5962] usb 2-1: can't read configurations, error -61 [ 211.044675][ T7475] use the actual size instead. [ 211.104000][ T7488] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 211.143654][ T5966] snd_usb_pod 5-1:1.1: line6_send_raw_message_async_part: usb_submit_urb failed (-22) [ 211.187493][ T7488] bond2: entered allmulticast mode [ 211.192787][ T5962] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 211.200849][ T7488] 8021q: adding VLAN 0 to HW filter on device bond2 [ 211.356600][ T5962] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 211.366311][ T5962] usb 2-1: can't read configurations, error -61 [ 211.419145][ T5962] usb usb2-port1: attempt power cycle [ 211.830727][ T5962] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 211.875591][ T5962] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 211.910003][ T5962] usb 2-1: can't read configurations, error -61 [ 211.932018][ T7499] vlan0: entered promiscuous mode [ 211.945859][ T7502] netlink: 148 bytes leftover after parsing attributes in process `syz.0.438'. [ 212.026095][ T5835] usb 5-1: USB disconnect, device number 34 [ 212.063626][ T5835] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 212.102209][ T5962] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 212.136704][ T5962] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 212.186810][ T5962] usb 2-1: can't read configurations, error -61 [ 212.213102][ T5962] usb usb2-port1: unable to enumerate USB device [ 212.280807][ T7514] netlink: 9 bytes leftover after parsing attributes in process `syz.4.443'. [ 212.334816][ T7517] netlink: 24 bytes leftover after parsing attributes in process `syz.0.444'. [ 212.366865][ T7517] netlink: 24 bytes leftover after parsing attributes in process `syz.0.444'. [ 212.479874][ T7521] netlink: 28 bytes leftover after parsing attributes in process `syz.4.446'. [ 212.491979][ T7521] netlink: 28 bytes leftover after parsing attributes in process `syz.4.446'. [ 212.527047][ T7521] dummy0: entered promiscuous mode [ 212.551066][ T7521] bond0: entered promiscuous mode [ 212.559057][ T5835] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 212.584460][ T7521] bond_slave_0: entered promiscuous mode [ 212.591604][ T7521] bond_slave_1: entered promiscuous mode [ 212.733036][ T5835] usb 4-1: Using ep0 maxpacket: 32 [ 212.757174][ T5835] usb 4-1: unable to get BOS descriptor or descriptor too short [ 212.770169][ T5835] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 212.780926][ T5835] usb 4-1: can't read configurations, error -71 [ 212.932886][ T5921] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 213.117753][ T5921] usb 5-1: config 9 has an invalid interface number: 53 but max is 2 [ 213.128368][ T5921] usb 5-1: config 9 has an invalid interface number: 3 but max is 2 [ 213.147028][ T5921] usb 5-1: config 9 has an invalid interface number: 71 but max is 2 [ 213.170444][ T5921] usb 5-1: config 9 has no interface number 0 [ 213.192332][ T5921] usb 5-1: config 9 has no interface number 1 [ 213.198544][ T5921] usb 5-1: config 9 has no interface number 2 [ 213.207313][ T5921] usb 5-1: config 9 interface 53 altsetting 0 endpoint 0xC has invalid maxpacket 512, setting to 64 [ 213.274137][ T5921] usb 5-1: config 9 interface 53 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 213.340702][ T5921] usb 5-1: config 9 interface 53 altsetting 0 endpoint 0x5 has invalid maxpacket 1024, setting to 64 [ 213.369527][ T5921] usb 5-1: config 9 interface 53 altsetting 0 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 213.385369][ T5921] usb 5-1: config 9 interface 53 altsetting 0 endpoint 0x8 has an invalid bInterval 0, changing to 7 [ 213.400271][ T5921] usb 5-1: config 9 interface 53 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 213.412074][ T5921] usb 5-1: config 9 interface 53 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 213.422417][ T5921] usb 5-1: config 9 interface 3 altsetting 255 endpoint 0x1 has invalid maxpacket 1023, setting to 64 [ 213.504576][ T5921] usb 5-1: config 9 interface 3 altsetting 255 has a duplicate endpoint with address 0x2, skipping [ 213.530281][ T5921] usb 5-1: config 9 interface 3 altsetting 255 has a duplicate endpoint with address 0xA, skipping [ 213.559016][ T5921] usb 5-1: config 9 interface 3 altsetting 255 has a duplicate endpoint with address 0x7, skipping [ 213.660059][ T5921] usb 5-1: config 9 interface 3 altsetting 255 has a duplicate endpoint with address 0x1, skipping [ 213.764554][ T5921] usb 5-1: config 9 interface 71 altsetting 16 has a duplicate endpoint with address 0xA, skipping [ 213.834242][ T5966] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 213.869003][ T5921] usb 5-1: config 9 interface 3 has no altsetting 0 [ 213.901915][ T5921] usb 5-1: config 9 interface 71 has no altsetting 0 [ 213.928619][ T5921] usb 5-1: language id specifier not provided by device, defaulting to English [ 213.951174][ T5921] usb 5-1: New USB device found, idVendor=0586, idProduct=3427, bcdDevice=12.5e [ 213.961984][ T5921] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.978877][ T5921] usb 5-1: Product: 뽵䙅ꔤ쌬㤾䵁終哬楺鱕ޒὲၟ㤥됷奮靗ࢧ欼忼ⳓ뙋컝蝑蚁혎철⠡最蛲톔嬮홏粯볌ṃ⻋䯴渊旸᥍ꖵᮥ㠠펢棻賅徺芘횎䆪璱㯈筼듷龞懄ꓶᢽ꺁뷴 [ 214.434614][ T5921] usb 5-1: Manufacturer: ࠐ [ 214.451140][ T5921] usb 5-1: SerialNumber: ࠁ [ 214.545920][ T5966] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 214.567443][ T5966] usb 3-1: can't read configurations, error -61 [ 214.676559][ T5962] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 214.742239][ T5966] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 214.802345][ T5929] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 214.818152][ T5921] dm9601 5-1:9.53: probe with driver dm9601 failed with error -22 [ 214.852332][ T5962] usb 2-1: Using ep0 maxpacket: 8 [ 214.875687][ T5921] hub 5-1:9.3: Invalid hub with more than one config or interface [ 214.902335][ T5921] hub 5-1:9.3: probe with driver hub failed with error -22 [ 214.919973][ T5921] dm9601 5-1:9.3: probe with driver dm9601 failed with error -22 [ 214.956038][ T5966] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 214.973722][ T5921] dm9601 5-1:9.71: probe with driver dm9601 failed with error -22 [ 214.996393][ T5962] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 215.025396][ T5929] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 215.035888][ T5966] usb 3-1: can't read configurations, error -61 [ 215.045333][ T5962] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 215.064571][ T5966] usb usb3-port1: attempt power cycle [ 215.097759][ T5962] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 215.115103][ T5962] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 215.115536][ T5921] usb 5-1: USB disconnect, device number 35 [ 215.130333][ T5962] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 215.230880][ T5962] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 215.250683][ T5962] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.278383][ T5929] usb 4-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 215.381250][ T5929] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.469687][ T5929] usb 4-1: Product: syz [ 215.475893][ T5962] usb 2-1: usb_control_msg returned -32 [ 215.487913][ T5929] usb 4-1: Manufacturer: syz [ 215.487956][ T5962] usbtmc 2-1:16.0: can't read capabilities [ 215.498784][ T5966] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 215.519549][ T5929] usb 4-1: SerialNumber: syz [ 215.539707][ T5966] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 215.549747][ T5966] usb 3-1: can't read configurations, error -61 [ 215.574702][ T5929] usb 4-1: config 0 descriptor?? [ 215.692275][ T5966] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 215.718285][ T5966] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 215.728557][ T5966] usb 3-1: can't read configurations, error -61 [ 215.742340][ T5966] usb usb3-port1: unable to enumerate USB device [ 215.842267][ T5921] usb 5-1: new full-speed USB device number 36 using dummy_hcd [ 215.972975][ T5921] usb 5-1: device descriptor read/64, error -71 [ 216.821194][ T7574] netlink: 4 bytes leftover after parsing attributes in process `syz.0.460'. [ 217.032578][ T5921] usb 4-1: USB disconnect, device number 25 [ 217.135357][ T5966] usb 2-1: USB disconnect, device number 30 [ 217.522258][ T5962] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 217.691667][ T5962] usb 4-1: config 0 has no interfaces? [ 217.711042][ T5962] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 217.724525][ T5962] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 217.836146][ T5962] usb 4-1: Product: syz [ 217.840523][ T5962] usb 4-1: Manufacturer: syz [ 217.848578][ T7589] netlink: 16 bytes leftover after parsing attributes in process `syz.4.464'. [ 217.872516][ T5962] usb 4-1: SerialNumber: syz [ 217.877578][ T7589] netlink: 24 bytes leftover after parsing attributes in process `syz.4.464'. [ 217.908167][ T5962] usb 4-1: config 0 descriptor?? [ 217.936502][ T7589] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 217.962335][ T5835] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 218.073281][ T7589] bond1: entered allmulticast mode [ 218.078815][ T7589] 8021q: adding VLAN 0 to HW filter on device bond1 [ 218.148065][ T5835] usb 1-1: Using ep0 maxpacket: 32 [ 218.169331][ T7582] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.178446][ T7582] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.197977][ T5835] usb 1-1: unable to get BOS descriptor or descriptor too short [ 218.206639][ T5835] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 218.222200][ T5835] usb 1-1: can't read configurations, error -71 [ 218.278712][ T7582] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.296511][ T7582] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 220.965308][ T5835] usb 4-1: USB disconnect, device number 26 [ 221.204588][ T2156] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 221.382616][ T2156] usb 1-1: Using ep0 maxpacket: 32 [ 221.391082][ T2156] usb 1-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 221.404954][ T2156] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.415229][ T7619] FAULT_INJECTION: forcing a failure. [ 221.415229][ T7619] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 221.423135][ T2156] usb 1-1: config 0 descriptor?? [ 221.434489][ T7619] CPU: 0 UID: 0 PID: 7619 Comm: syz.4.472 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(full) [ 221.434517][ T7619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 221.434531][ T7619] Call Trace: [ 221.434540][ T7619] [ 221.434549][ T7619] dump_stack_lvl+0x189/0x250 [ 221.434588][ T7619] ? __pfx____ratelimit+0x10/0x10 [ 221.434620][ T7619] ? __pfx_dump_stack_lvl+0x10/0x10 [ 221.434654][ T7619] ? __pfx__printk+0x10/0x10 [ 221.434677][ T7619] ? __might_fault+0xb0/0x130 [ 221.434717][ T7619] should_fail_ex+0x414/0x560 [ 221.434750][ T7619] _copy_to_iter+0x575/0x16f0 [ 221.434796][ T7619] ? __pfx__copy_to_iter+0x10/0x10 [ 221.434826][ T7619] ? __skb_try_recv_from_queue+0x2b2/0x730 [ 221.434862][ T7619] ? __skb_try_recv_datagram+0x3da/0x4e0 [ 221.434899][ T7619] __skb_datagram_iter+0xf8/0x990 [ 221.434931][ T7619] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 221.434972][ T7619] skb_copy_datagram_iter+0xc5/0x230 [ 221.435008][ T7619] netlink_recvmsg+0x2ab/0xa30 [ 221.435045][ T7619] ? __pfx_netlink_recvmsg+0x10/0x10 [ 221.435077][ T7619] ? aa_sock_msg_perm+0x94/0x160 [ 221.435107][ T7619] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 221.435134][ T7619] ? security_socket_recvmsg+0x7e/0x2e0 [ 221.435168][ T7619] ? __pfx_netlink_recvmsg+0x10/0x10 [ 221.435193][ T7619] sock_recvmsg+0x22c/0x270 [ 221.435230][ T7619] ____sys_recvmsg+0x1c9/0x460 [ 221.435265][ T7619] ? __pfx_____sys_recvmsg+0x10/0x10 [ 221.435308][ T7619] ? import_iovec+0x74/0xa0 [ 221.435334][ T7619] ___sys_recvmsg+0x1b5/0x510 [ 221.435385][ T7619] ? __pfx____sys_recvmsg+0x10/0x10 [ 221.435439][ T7619] ? __fget_files+0x3a0/0x420 [ 221.435476][ T7619] do_recvmmsg+0x307/0x770 [ 221.435512][ T7619] ? __pfx_do_recvmmsg+0x10/0x10 [ 221.435552][ T7619] ? _copy_from_user+0x94/0xb0 [ 221.435589][ T7619] __x64_sys_recvmmsg+0x1af/0x240 [ 221.435620][ T7619] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 221.435647][ T7619] ? rcu_is_watching+0x15/0xb0 [ 221.435684][ T7619] ? do_syscall_64+0xbe/0x3b0 [ 221.435738][ T7619] do_syscall_64+0xfa/0x3b0 [ 221.435756][ T7619] ? lockdep_hardirqs_on+0x9c/0x150 [ 221.435788][ T7619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.435810][ T7619] ? clear_bhb_loop+0x60/0xb0 [ 221.435835][ T7619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.435856][ T7619] RIP: 0033:0x7f278798e929 [ 221.435875][ T7619] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 221.435894][ T7619] RSP: 002b:00007f2788886038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 221.435917][ T7619] RAX: ffffffffffffffda RBX: 00007f2787bb5fa0 RCX: 00007f278798e929 [ 221.435932][ T7619] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 221.435947][ T7619] RBP: 00007f2788886090 R08: 0000200000003700 R09: 0000000000000000 [ 221.435961][ T7619] R10: 0000000002040000 R11: 0000000000000246 R12: 0000000000000001 [ 221.435975][ T7619] R13: 0000000000000000 R14: 00007f2787bb5fa0 R15: 00007f2787cdfa28 [ 221.436007][ T7619] [ 221.448464][ T2156] gspca_main: sq930x-2.14.0 probing 041e:403c [ 221.458355][ T5835] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 221.686688][ C0] vkms_vblank_simulate: vblank timer overrun [ 221.758124][ T5899] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 221.912425][ T5835] usb 4-1: Using ep0 maxpacket: 8 [ 221.917786][ T5899] usb 2-1: Using ep0 maxpacket: 32 [ 221.926097][ T5899] usb 2-1: config 1 has an invalid descriptor of length 236, skipping remainder of the config [ 221.936967][ T5835] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 221.946948][ T5899] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 221.958592][ T5835] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 221.968646][ T5899] usb 2-1: config 1 has no interface number 1 [ 221.974847][ T5835] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 221.985157][ T5899] usb 2-1: config 1 interface 2 altsetting 228 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 221.998547][ T5835] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 222.011753][ T5899] usb 2-1: config 1 interface 2 has no altsetting 1 [ 222.018972][ T5835] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 222.028359][ T5835] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.039533][ T5899] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 222.049201][ T5899] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.095496][ T5899] usb 2-1: Product: syz [ 222.106758][ T5899] usb 2-1: Manufacturer: syz [ 222.116853][ T5899] usb 2-1: SerialNumber: syz [ 222.291189][ T5835] usb 4-1: GET_CAPABILITIES returned 0 [ 222.305463][ T5835] usbtmc 4-1:16.0: can't read capabilities [ 222.323697][ T2156] gspca_sq930x: reg_w 0105 bf00 failed -71 [ 222.395603][ T5899] usb 2-1: USB disconnect, device number 31 [ 222.422346][ T2156] sq930x 1-1:0.0: probe with driver sq930x failed with error -71 [ 222.651718][ T2156] usb 1-1: USB disconnect, device number 19 [ 222.658905][ T6691] udevd[6691]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 222.673807][ T7614] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 222.687304][ T7614] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 222.706384][ T5906] usb 4-1: USB disconnect, device number 27 [ 222.952321][ T5835] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 223.113805][ T5835] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 223.132268][ T5835] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 223.143016][ T5835] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 223.155433][ T5835] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 223.315676][ T5835] usb 3-1: SerialNumber: syz [ 223.491653][ T7634] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 223.532791][ T5906] usb 1-1: new low-speed USB device number 20 using dummy_hcd [ 223.550090][ T5835] usb 3-1: 0:2 : does not exist [ 223.604319][ T5835] usb 3-1: USB disconnect, device number 22 [ 223.675250][ T5906] usb 1-1: device descriptor read/64, error -71 [ 223.695532][ T6493] udevd[6493]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 223.929321][ T7645] netlink: 28 bytes leftover after parsing attributes in process `syz.1.481'. [ 223.952675][ T5899] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 223.956436][ T5906] usb 1-1: new low-speed USB device number 21 using dummy_hcd [ 224.088564][ T7645] netlink: 28 bytes leftover after parsing attributes in process `syz.1.481'. [ 224.122234][ T5899] usb 5-1: Using ep0 maxpacket: 32 [ 224.136826][ T5899] usb 5-1: unable to get BOS descriptor or descriptor too short [ 224.149095][ T5899] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 224.168512][ T7645] dummy0: entered promiscuous mode [ 224.184791][ T5899] usb 5-1: can't read configurations, error -71 [ 224.191483][ T7645] dummy0: left promiscuous mode [ 224.284491][ T5906] usb 1-1: device descriptor read/64, error -71 [ 224.404508][ T5906] usb usb1-port1: attempt power cycle [ 224.782959][ T5906] usb 1-1: new low-speed USB device number 22 using dummy_hcd [ 224.814732][ T5906] usb 1-1: device descriptor read/8, error -71 [ 224.962460][ T5921] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 225.074230][ T5906] usb 1-1: new low-speed USB device number 23 using dummy_hcd [ 225.112380][ T5921] usb 3-1: Using ep0 maxpacket: 32 [ 225.145075][ T5921] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 225.156190][ T5906] usb 1-1: device descriptor read/8, error -71 [ 225.182327][ T5921] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 225.263269][ T5921] usb 3-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 225.282413][ T5906] usb usb1-port1: unable to enumerate USB device [ 225.358235][ T5921] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.480071][ T5921] usb 3-1: config 0 descriptor?? [ 225.522205][ T5899] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 225.688377][ T5835] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 225.747695][ T5899] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 225.798920][ T5899] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 225.827913][ T5899] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 225.860709][ T5899] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 225.929015][ T5899] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 226.067814][ T5835] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 226.130280][ T7669] netlink: 28 bytes leftover after parsing attributes in process `syz.3.488'. [ 226.148546][ T5921] uclogic 0003:5543:0003.0007: item fetching failed at offset 0/3 [ 226.181787][ T7669] netlink: 28 bytes leftover after parsing attributes in process `syz.3.488'. [ 226.204439][ T5921] uclogic 0003:5543:0003.0007: parse failed [ 226.210427][ T5921] uclogic 0003:5543:0003.0007: probe with driver uclogic failed with error -22 [ 226.299863][ T5835] usb 2-1: can't read configurations, error -61 [ 226.310158][ T5899] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 226.377295][ T5899] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 226.396774][ T5899] usb 5-1: Product: syz [ 226.407746][ T5899] usb 5-1: Manufacturer: syz [ 226.441790][ T5899] cdc_wdm 5-1:1.0: skipping garbage [ 226.562225][ T5835] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 226.628500][ T5899] cdc_wdm 5-1:1.0: skipping garbage [ 226.673894][ T5921] usb 3-1: USB disconnect, device number 23 [ 226.682503][ T5899] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 226.688934][ T5899] cdc_wdm 5-1:1.0: Unknown control protocol [ 226.915352][ T5835] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 226.930813][ T5835] usb 2-1: can't read configurations, error -61 [ 226.958159][ T5835] usb usb2-port1: attempt power cycle [ 227.592255][ T5835] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 227.792012][ T5835] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 227.807463][ T5835] usb 2-1: can't read configurations, error -61 [ 227.923386][ T7693] macvlan0: entered promiscuous mode [ 227.930338][ T7693] batadv_slave_0: entered promiscuous mode [ 227.942673][ T7693] debugfs: Directory 'hsr2' with parent 'hsr' already present! [ 227.950462][ T7693] Cannot create hsr debugfs directory [ 227.991452][ T5835] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 228.021399][ T5835] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 228.056793][ T5835] usb 2-1: can't read configurations, error -61 [ 228.063507][ T7693] hsr2: entered allmulticast mode [ 228.078740][ T5835] usb usb2-port1: unable to enumerate USB device [ 228.093517][ T7693] macvlan0: entered allmulticast mode [ 228.106949][ T7693] veth1_vlan: entered allmulticast mode [ 228.117213][ T7693] batadv_slave_0: entered allmulticast mode [ 229.052254][ T45] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 229.243334][ T7687] netlink: 'syz.0.493': attribute type 2 has an invalid length. [ 229.292587][ T45] usb 4-1: Using ep0 maxpacket: 32 [ 229.386092][ T45] usb 4-1: unable to get BOS descriptor or descriptor too short [ 229.413073][ T45] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 229.430827][ T45] usb 4-1: can't read configurations, error -71 [ 229.492502][ T5835] usb 5-1: USB disconnect, device number 39 [ 229.582977][ T7706] FAULT_INJECTION: forcing a failure. [ 229.582977][ T7706] name failslab, interval 1, probability 0, space 0, times 0 [ 229.605164][ T7706] CPU: 0 UID: 0 PID: 7706 Comm: syz.1.497 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(full) [ 229.605193][ T7706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 229.605206][ T7706] Call Trace: [ 229.605214][ T7706] [ 229.605222][ T7706] dump_stack_lvl+0x189/0x250 [ 229.605261][ T7706] ? __pfx____ratelimit+0x10/0x10 [ 229.605294][ T7706] ? __pfx_dump_stack_lvl+0x10/0x10 [ 229.605326][ T7706] ? __pfx__printk+0x10/0x10 [ 229.605356][ T7706] ? __pfx___might_resched+0x10/0x10 [ 229.605387][ T7706] ? fs_reclaim_acquire+0x7d/0x100 [ 229.605418][ T7706] should_fail_ex+0x414/0x560 [ 229.605451][ T7706] should_failslab+0xa8/0x100 [ 229.605476][ T7706] __kmalloc_noprof+0xcb/0x4f0 [ 229.605496][ T7706] ? video_usercopy+0x18f/0x14f0 [ 229.605523][ T7706] video_usercopy+0x18f/0x14f0 [ 229.605577][ T7706] ? __pfx___video_do_ioctl+0x10/0x10 [ 229.605600][ T7706] ? __pfx_video_usercopy+0x10/0x10 [ 229.605636][ T7706] ? __fget_files+0x2a/0x420 [ 229.605676][ T7706] ? __fget_files+0x2a/0x420 [ 229.605698][ T7706] ? __fget_files+0x3a0/0x420 [ 229.605725][ T7706] v4l2_ioctl+0x18d/0x1e0 [ 229.605747][ T7706] ? __pfx_v4l2_ioctl+0x10/0x10 [ 229.605801][ T7706] __se_sys_ioctl+0xf9/0x170 [ 229.605837][ T7706] do_syscall_64+0xfa/0x3b0 [ 229.605855][ T7706] ? lockdep_hardirqs_on+0x9c/0x150 [ 229.605887][ T7706] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 229.605907][ T7706] ? clear_bhb_loop+0x60/0xb0 [ 229.605933][ T7706] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 229.605955][ T7706] RIP: 0033:0x7fe8c8f8e929 [ 229.605972][ T7706] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 229.606001][ T7706] RSP: 002b:00007fe8c6df6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 229.606021][ T7706] RAX: ffffffffffffffda RBX: 00007fe8c91b5fa0 RCX: 00007fe8c8f8e929 [ 229.606035][ T7706] RDX: 00002000000004c0 RSI: 00000000c0cc5616 RDI: 0000000000000003 [ 229.606047][ T7706] RBP: 00007fe8c6df6090 R08: 0000000000000000 R09: 0000000000000000 [ 229.606059][ T7706] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 229.606070][ T7706] R13: 0000000000000000 R14: 00007fe8c91b5fa0 R15: 00007fe8c92dfa28 [ 229.606098][ T7706] [ 230.192388][ T5906] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 230.343709][ T5906] usb 1-1: device descriptor read/64, error -71 [ 230.582230][ T5906] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 230.763673][ T5906] usb 1-1: device descriptor read/64, error -71 [ 230.892710][ T5906] usb usb1-port1: attempt power cycle [ 231.252284][ T5906] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 231.476171][ T7731] x_tables: unsorted entry at hook 1 [ 231.490971][ T5835] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 231.502002][ T5906] usb 1-1: device descriptor read/8, error -71 [ 231.701560][ T5835] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 231.774862][ T5835] usb 5-1: can't read configurations, error -61 [ 231.802242][ T5906] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 231.873308][ T5906] usb 1-1: device descriptor read/8, error -71 [ 231.994418][ T5906] usb usb1-port1: unable to enumerate USB device [ 232.042440][ T5835] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 232.237955][ T5835] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 232.250846][ T5835] usb 5-1: can't read configurations, error -61 [ 232.319733][ T5835] usb usb5-port1: attempt power cycle [ 232.552400][ T5906] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 232.572416][ T45] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 232.672836][ T5835] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 232.692204][ T5906] usb 4-1: device descriptor read/64, error -71 [ 232.704949][ T5835] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 232.714608][ T5835] usb 5-1: can't read configurations, error -61 [ 232.732318][ T45] usb 2-1: Using ep0 maxpacket: 8 [ 232.739438][ T45] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 232.784638][ T45] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 232.822288][ T45] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 232.852355][ T45] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 232.853075][ T5835] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 232.883987][ T45] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 232.916801][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.934042][ T5835] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 232.941920][ T5835] usb 5-1: can't read configurations, error -61 [ 232.972280][ T5906] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 233.021983][ T5835] usb usb5-port1: unable to enumerate USB device [ 233.165339][ T45] usb 2-1: GET_CAPABILITIES returned 0 [ 233.170871][ T45] usbtmc 2-1:16.0: can't read capabilities [ 233.255049][ T5906] usb 4-1: device descriptor read/64, error -71 [ 233.355334][ T7748] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.364159][ T5906] usb usb4-port1: attempt power cycle [ 233.379512][ T7748] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.392285][ T5966] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 233.400340][ T45] usb 2-1: USB disconnect, device number 36 [ 233.562395][ T5966] usb 1-1: Using ep0 maxpacket: 32 [ 233.581942][ T5966] usb 1-1: unable to get BOS descriptor or descriptor too short [ 233.601297][ T5966] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 233.640097][ T5966] usb 1-1: can't read configurations, error -71 [ 233.722324][ T5906] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 233.753015][ T5906] usb 4-1: device descriptor read/8, error -71 [ 234.002251][ T5906] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 234.049661][ T5906] usb 4-1: device descriptor read/8, error -71 [ 234.172777][ T5906] usb usb4-port1: unable to enumerate USB device [ 234.782396][ T5906] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 234.932368][ T5906] usb 2-1: device descriptor read/64, error -71 [ 235.203321][ T5906] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 235.359757][ T5906] usb 2-1: device descriptor read/64, error -71 [ 235.578002][ T5906] usb usb2-port1: attempt power cycle [ 236.072265][ T5906] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 236.236380][ T5906] usb 2-1: device descriptor read/8, error -71 [ 236.242464][ T5835] usb 5-1: new full-speed USB device number 44 using dummy_hcd [ 236.469671][ T5835] usb 5-1: unable to get BOS descriptor or descriptor too short [ 236.491149][ T5835] usb 5-1: not running at top speed; connect to a high speed hub [ 236.499081][ T5966] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 236.526948][ T5906] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 236.563081][ T5906] usb 2-1: device descriptor read/8, error -71 [ 236.578107][ T5835] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 236.673197][ T5906] usb usb2-port1: unable to enumerate USB device [ 236.702425][ T5835] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 236.730932][ T5966] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 236.745298][ T5835] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 236.756532][ T5966] usb 4-1: can't read configurations, error -61 [ 236.801839][ T5835] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.848998][ T5835] usb 5-1: Product: syz [ 236.900352][ T5835] usb 5-1: Manufacturer: syz [ 236.965172][ T5835] usb 5-1: SerialNumber: syz [ 237.076317][ T5966] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 237.313737][ T7801] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 237.322978][ T7801] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 237.529357][ T5966] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 237.545771][ T5966] usb 4-1: can't read configurations, error -61 [ 237.588867][ T5966] usb usb4-port1: attempt power cycle [ 237.942460][ T5966] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 238.283728][ T5966] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 238.321365][ T5966] usb 4-1: can't read configurations, error -61 [ 238.512430][ T5966] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 238.538863][ T5966] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 238.546759][ T5966] usb 4-1: can't read configurations, error -61 [ 238.553613][ T5966] usb usb4-port1: unable to enumerate USB device [ 238.568195][ T7827] FAULT_INJECTION: forcing a failure. [ 238.568195][ T7827] name failslab, interval 1, probability 0, space 0, times 0 [ 238.598995][ T7827] CPU: 0 UID: 0 PID: 7827 Comm: syz.1.531 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(full) [ 238.599025][ T7827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 238.599042][ T7827] Call Trace: [ 238.599051][ T7827] [ 238.599061][ T7827] dump_stack_lvl+0x189/0x250 [ 238.599101][ T7827] ? __pfx____ratelimit+0x10/0x10 [ 238.599136][ T7827] ? __pfx_dump_stack_lvl+0x10/0x10 [ 238.599171][ T7827] ? __pfx__printk+0x10/0x10 [ 238.599218][ T7827] should_fail_ex+0x414/0x560 [ 238.599253][ T7827] should_failslab+0xa8/0x100 [ 238.599279][ T7827] __kmalloc_cache_noprof+0x70/0x3d0 [ 238.599301][ T7827] ? sctp_add_bind_addr+0x8c/0x370 [ 238.599329][ T7827] sctp_add_bind_addr+0x8c/0x370 [ 238.599356][ T7827] sctp_copy_local_addr_list+0x30b/0x4e0 [ 238.599382][ T7827] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 238.599405][ T7827] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 238.599432][ T7827] ? sctp_v4_is_any+0x35/0x60 [ 238.599455][ T7827] ? sctp_copy_one_addr+0x93/0x360 [ 238.599481][ T7827] sctp_bind_addr_copy+0xb3/0x3c0 [ 238.599505][ T7827] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 238.599542][ T7827] sctp_connect_new_asoc+0x2e0/0x690 [ 238.599575][ T7827] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 238.599601][ T7827] ? __local_bh_enable_ip+0x12d/0x1c0 [ 238.599654][ T7827] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 238.599684][ T7827] ? security_sctp_bind_connect+0x7e/0x2e0 [ 238.599712][ T7827] sctp_sendmsg+0x155c/0x2810 [ 238.599763][ T7827] ? __pfx_sctp_sendmsg+0x10/0x10 [ 238.599791][ T7827] ? aa_sk_perm+0x81e/0x950 [ 238.599820][ T7827] ? __pfx_aa_sk_perm+0x10/0x10 [ 238.599847][ T7827] ? sock_rps_record_flow+0x19/0x410 [ 238.599870][ T7827] ? inet_sendmsg+0x2f4/0x370 [ 238.599893][ T7827] __sock_sendmsg+0x19c/0x270 [ 238.599928][ T7827] ____sys_sendmsg+0x505/0x830 [ 238.599959][ T7827] ? __pfx_____sys_sendmsg+0x10/0x10 [ 238.599995][ T7827] ? import_iovec+0x74/0xa0 [ 238.600019][ T7827] ___sys_sendmsg+0x21f/0x2a0 [ 238.600047][ T7827] ? __pfx____sys_sendmsg+0x10/0x10 [ 238.600109][ T7827] ? __fget_files+0x2a/0x420 [ 238.600131][ T7827] ? __fget_files+0x3a0/0x420 [ 238.600163][ T7827] __x64_sys_sendmsg+0x19b/0x260 [ 238.600192][ T7827] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 238.600233][ T7827] ? __pfx_ksys_write+0x10/0x10 [ 238.600249][ T7827] ? rcu_is_watching+0x15/0xb0 [ 238.600285][ T7827] ? do_syscall_64+0xbe/0x3b0 [ 238.600308][ T7827] do_syscall_64+0xfa/0x3b0 [ 238.600328][ T7827] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.600347][ T7827] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 238.600367][ T7827] ? clear_bhb_loop+0x60/0xb0 [ 238.600392][ T7827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.600411][ T7827] RIP: 0033:0x7fe8c8f8e929 [ 238.600429][ T7827] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 238.600446][ T7827] RSP: 002b:00007fe8c6df6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 238.600466][ T7827] RAX: ffffffffffffffda RBX: 00007fe8c91b5fa0 RCX: 00007fe8c8f8e929 [ 238.600480][ T7827] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 0000000000000003 [ 238.600493][ T7827] RBP: 00007fe8c6df6090 R08: 0000000000000000 R09: 0000000000000000 [ 238.600505][ T7827] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 238.600517][ T7827] R13: 0000000000000000 R14: 00007fe8c91b5fa0 R15: 00007fe8c92dfa28 [ 238.600548][ T7827] [ 239.604646][ T5835] usb 5-1: 0:2 : does not exist [ 239.625366][ T5835] usb 5-1: unit 4 not found! [ 239.645721][ T7829] FAULT_INJECTION: forcing a failure. [ 239.645721][ T7829] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 239.671181][ T5835] usb 5-1: 5:0: cannot get min/max values for control 2 (id 5) [ 239.707595][ T7829] CPU: 1 UID: 0 PID: 7829 Comm: syz.2.532 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(full) [ 239.707625][ T7829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 239.707642][ T7829] Call Trace: [ 239.707651][ T7829] [ 239.707660][ T7829] dump_stack_lvl+0x189/0x250 [ 239.707699][ T7829] ? __pfx____ratelimit+0x10/0x10 [ 239.707732][ T7829] ? __pfx_dump_stack_lvl+0x10/0x10 [ 239.707766][ T7829] ? __pfx__printk+0x10/0x10 [ 239.707789][ T7829] ? __might_fault+0xb0/0x130 [ 239.707822][ T7829] should_fail_ex+0x414/0x560 [ 239.707856][ T7829] _copy_from_user+0x2d/0xb0 [ 239.707880][ T7829] ___sys_sendmsg+0x158/0x2a0 [ 239.707912][ T7829] ? __pfx____sys_sendmsg+0x10/0x10 [ 239.707985][ T7829] ? __might_fault+0xb0/0x130 [ 239.708009][ T7829] __sys_sendmmsg+0x227/0x430 [ 239.708044][ T7829] ? __pfx___sys_sendmmsg+0x10/0x10 [ 239.708070][ T7829] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 239.708119][ T7829] ? ksys_write+0x22a/0x250 [ 239.708155][ T7829] ? __pfx_ksys_write+0x10/0x10 [ 239.708173][ T7829] ? rcu_is_watching+0x15/0xb0 [ 239.708215][ T7829] __x64_sys_sendmmsg+0xa0/0xc0 [ 239.708246][ T7829] do_syscall_64+0xfa/0x3b0 [ 239.708265][ T7829] ? lockdep_hardirqs_on+0x9c/0x150 [ 239.708298][ T7829] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 239.708319][ T7829] ? clear_bhb_loop+0x60/0xb0 [ 239.708346][ T7829] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 239.708367][ T7829] RIP: 0033:0x7f0941d8e929 [ 239.708386][ T7829] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 239.708405][ T7829] RSP: 002b:00007f0942be3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 239.708428][ T7829] RAX: ffffffffffffffda RBX: 00007f0941fb5fa0 RCX: 00007f0941d8e929 [ 239.708444][ T7829] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 239.708459][ T7829] RBP: 00007f0942be3090 R08: 0000000000000000 R09: 0000000000000000 [ 239.708473][ T7829] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 239.708486][ T7829] R13: 0000000000000000 R14: 00007f0941fb5fa0 R15: 00007f09420dfa28 [ 239.708518][ T7829] [ 239.715713][ T5835] usb 5-1: 5:0: cannot get min/max values for control 3 (id 5) [ 240.028813][ T5835] usb 5-1: 5:0: cannot get min/max values for control 3 (id 5) [ 240.069138][ T5835] usb 5-1: USB disconnect, device number 44 [ 240.165087][ T6493] udevd[6493]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 240.526735][ T5835] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 240.753529][ T5835] usb 5-1: Using ep0 maxpacket: 16 [ 240.837912][ T5835] usb 5-1: config 0 interface 0 altsetting 32 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 240.851423][ T5835] usb 5-1: config 0 interface 0 has no altsetting 0 [ 240.858481][ T5835] usb 5-1: New USB device found, idVendor=05ac, idProduct=0273, bcdDevice= 0.00 [ 240.868227][ T5835] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 240.896924][ T5835] usb 5-1: config 0 descriptor?? [ 241.258448][ T7834] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.320360][ T7834] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 241.374897][ T5835] usb 5-1: string descriptor 0 read error: -71 [ 241.523167][ T5835] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input14 [ 241.568288][ T5189] bcm5974 5-1:0.0: could not read from device [ 241.577828][ T5189] bcm5974 5-1:0.0: could not read from device [ 241.615166][ T5189] bcm5974 5-1:0.0: could not read from device [ 241.648298][ T5835] usb 5-1: USB disconnect, device number 45 [ 241.738080][ T5189] bcm5974 5-1:0.0: could not read from device [ 241.811653][ T6691] bcm5974 5-1:0.0: could not read from device [ 242.817926][ T7867] netlink: 28 bytes leftover after parsing attributes in process `syz.4.543'. [ 243.662282][ T5835] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 243.713332][ T7892] netlink: 28 bytes leftover after parsing attributes in process `syz.1.550'. [ 243.756987][ T7892] netlink: 28 bytes leftover after parsing attributes in process `syz.1.550'. [ 243.790590][ T7892] dummy0: entered promiscuous mode [ 243.812320][ T7892] dummy0: left promiscuous mode [ 243.888181][ T5835] usb 5-1: config 0 has no interfaces? [ 243.899380][ T5835] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 243.908793][ T5835] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.918660][ T5835] usb 5-1: Product: syz [ 243.923035][ T5835] usb 5-1: Manufacturer: syz [ 243.930080][ T5835] usb 5-1: SerialNumber: syz [ 244.001658][ T5835] usb 5-1: config 0 descriptor?? [ 244.262512][ T7894] netlink: 196 bytes leftover after parsing attributes in process `syz.1.552'. [ 244.587616][ T7899] loop4: detected capacity change from 0 to 524255232 [ 244.642283][ T5906] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 244.803967][ T7903] netlink: 'syz.1.553': attribute type 21 has an invalid length. [ 244.835140][ T5906] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 244.845480][ T5906] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 244.935308][ T5906] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 244.960462][ T5906] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 245.015760][ T5906] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 245.055325][ T5906] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 245.104131][ T5906] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 245.125687][ T5906] usb 4-1: Product: syz [ 245.135585][ T5906] usb 4-1: Manufacturer: syz [ 245.172232][ T5899] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 245.187375][ T5906] cdc_wdm 4-1:1.0: skipping garbage [ 245.192935][ T5906] cdc_wdm 4-1:1.0: skipping garbage [ 245.216597][ T5906] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 245.229602][ T5906] cdc_wdm 4-1:1.0: Unknown control protocol [ 245.399047][ T5899] usb 3-1: New USB device found, idVendor=6189, idProduct=182d, bcdDevice= 1.73 [ 245.409122][ T5899] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.422691][ T5899] usb 3-1: Product: syz [ 245.434440][ T5899] usb 3-1: Manufacturer: syz [ 245.447090][ T5899] usb 3-1: SerialNumber: syz [ 245.478211][ T5899] usb 3-1: config 0 descriptor?? [ 245.679600][ T7914] cdc_wdm 4-1:1.0: Error submitting int urb - -90 [ 246.665544][ T5899] asix 3-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 246.761235][ T5921] usb 5-1: USB disconnect, device number 46 [ 247.053621][ T30] audit: type=1326 audit(1750079232.267:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7921 comm="syz.4.560" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f278798e929 code=0x0 [ 248.177579][ T5921] usb 4-1: USB disconnect, device number 38 [ 248.983201][ T7903] netlink: 'syz.1.553': attribute type 6 has an invalid length. [ 248.991133][ T7903] netlink: 132 bytes leftover after parsing attributes in process `syz.1.553'. [ 249.011952][ T7925] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 249.125414][ T5899] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 249.364394][ T5899] asix 3-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 249.391664][ T5899] asix 3-1:0.0: probe with driver asix failed with error -71 [ 249.425493][ T5899] usb 3-1: USB disconnect, device number 24 [ 249.750163][ T7946] xt_CT: No such helper "snmp" [ 249.892373][ T5929] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 249.992760][ T5906] usb 2-1: new low-speed USB device number 41 using dummy_hcd [ 250.083241][ T5929] usb 5-1: Using ep0 maxpacket: 8 [ 250.154863][ T5906] usb 2-1: device descriptor read/64, error -71 [ 250.189752][ T5929] usb 5-1: config 1 has an invalid descriptor of length 251, skipping remainder of the config [ 250.238320][ T5929] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 64320, setting to 1024 [ 250.269854][ T5929] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 250.314018][ T5929] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 250.354050][ T5929] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 250.363239][ T5929] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 250.371344][ T5929] usb 5-1: Product: syz [ 250.383013][ T5929] usb 5-1: Manufacturer: syz [ 250.387745][ T5929] usb 5-1: SerialNumber: syz [ 250.405337][ T7945] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 250.413409][ T5906] usb 2-1: new low-speed USB device number 42 using dummy_hcd [ 250.436238][ T5929] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 250.446003][ T5929] usbtest 5-1:1.0: couldn't get endpoints, -22 [ 250.454481][ T5929] usbtest 5-1:1.0: probe with driver usbtest failed with error -22 [ 250.573611][ T5906] usb 2-1: device descriptor read/64, error -71 [ 250.773408][ T5906] usb usb2-port1: attempt power cycle [ 250.984732][ T7943] loop2: detected capacity change from 0 to 7 [ 251.043959][ T5899] usb 5-1: USB disconnect, device number 47 [ 251.132635][ T5906] usb 2-1: new low-speed USB device number 43 using dummy_hcd [ 251.182917][ T5906] usb 2-1: device descriptor read/8, error -71 [ 251.291729][ T7973] netlink: 9 bytes leftover after parsing attributes in process `syz.3.573'. [ 251.495079][ T5906] usb 2-1: new low-speed USB device number 44 using dummy_hcd [ 251.558048][ T5906] usb 2-1: device descriptor read/8, error -71 [ 251.675350][ T5906] usb usb2-port1: unable to enumerate USB device [ 252.272595][ T5899] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 252.674025][ T5899] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 252.713007][ T5899] usb 4-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 252.762161][ T5899] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 252.770273][ T5899] usb 4-1: Product: syz [ 252.792572][ T5899] usb 4-1: Manufacturer: syz [ 252.797222][ T5899] usb 4-1: SerialNumber: syz [ 252.825014][ T5899] usb 4-1: config 0 descriptor?? [ 252.870946][ T7997] netlink: 28 bytes leftover after parsing attributes in process `syz.2.581'. [ 252.984453][ T7997] netlink: 28 bytes leftover after parsing attributes in process `syz.2.581'. [ 253.660240][ T8009] loop6: detected capacity change from 0 to 7 [ 253.720087][ T5899] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 253.734649][ T8009] Dev loop6: unable to read RDB block 7 [ 253.740258][ T8009] loop6: unable to read partition table [ 253.747115][ T8009] loop6: partition table beyond EOD, truncated [ 253.928061][ T8009] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 253.952231][ T5899] usb 2-1: Using ep0 maxpacket: 16 [ 253.959803][ T5899] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 8 [ 253.987410][ T5899] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 254.025181][ T5899] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 254.046231][ T5899] usb 2-1: Product: syz [ 254.054978][ T5899] usb 2-1: Manufacturer: syz [ 254.061524][ T5899] usb 2-1: SerialNumber: syz [ 254.078620][ T5899] usb 2-1: config 0 descriptor?? [ 254.098989][ T5899] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 254.127706][ T5899] usb 2-1: Detected FT232R [ 254.183326][ T5929] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 254.308805][ T5899] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 254.323587][ T5929] usb 3-1: device descriptor read/64, error -71 [ 254.562405][ T5899] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 254.572569][ T5929] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 254.712852][ T5929] usb 3-1: device descriptor read/64, error -71 [ 254.825732][ T5929] usb usb3-port1: attempt power cycle [ 254.977954][ T5906] usb 4-1: USB disconnect, device number 39 [ 255.172363][ T5929] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 255.206123][ T5929] usb 3-1: device descriptor read/8, error -71 [ 255.258673][ T8029] bridge0: port 1(bridge_slave_0) entered disabled state [ 255.305517][ T8029] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 255.452399][ T5929] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 255.490912][ T5929] usb 3-1: device descriptor read/8, error -71 [ 255.613778][ T5929] usb usb3-port1: unable to enumerate USB device [ 255.716541][ T8036] bridge0: entered promiscuous mode [ 255.731720][ T8036] vlan0: entered promiscuous mode [ 255.742233][ T5899] usb 5-1: new full-speed USB device number 48 using dummy_hcd [ 255.749874][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.756551][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.771265][ T10] usb 2-1: USB disconnect, device number 45 [ 255.794199][ T10] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 255.814349][ T10] ftdi_sio 2-1:0.0: device disconnected [ 255.893245][ T5899] usb 5-1: device descriptor read/64, error -71 [ 256.222349][ T5899] usb 5-1: new full-speed USB device number 49 using dummy_hcd [ 256.354615][ T5899] usb 5-1: device descriptor read/64, error -71 [ 256.473036][ T5899] usb usb5-port1: attempt power cycle [ 256.812402][ T5899] usb 5-1: new full-speed USB device number 50 using dummy_hcd [ 256.832717][ T5899] usb 5-1: device descriptor read/8, error -71 [ 257.075788][ T5899] usb 5-1: new full-speed USB device number 51 using dummy_hcd [ 257.173128][ T5899] usb 5-1: device descriptor read/8, error -71 [ 257.181158][ T8051] loop6: detected capacity change from 0 to 7 [ 257.233719][ T8051] Dev loop6: unable to read RDB block 7 [ 257.239428][ T8051] loop6: unable to read partition table [ 257.262526][ T8051] loop6: partition table beyond EOD, truncated [ 257.282846][ T5899] usb usb5-port1: unable to enumerate USB device [ 257.391934][ T8051] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 257.602476][ T10] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 257.621372][ T5204] Dev loop6: unable to read RDB block 7 [ 257.641575][ T5204] loop6: unable to read partition table [ 257.652388][ T5204] loop6: partition table beyond EOD, truncated [ 257.891383][ T10] usb 3-1: config 0 has no interfaces? [ 257.940207][ T10] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 257.965472][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.022334][ T10] usb 3-1: Product: syz [ 258.026562][ T10] usb 3-1: Manufacturer: syz [ 258.097248][ T10] usb 3-1: SerialNumber: syz [ 258.132588][ T10] usb 3-1: config 0 descriptor?? [ 258.322294][ T5929] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 258.394281][ T8057] pimreg: entered allmulticast mode [ 258.401487][ T8057] pimreg: left allmulticast mode [ 258.498280][ T8075] netlink: 16 bytes leftover after parsing attributes in process `syz.0.610'. [ 258.552265][ T5929] usb 2-1: device descriptor read/64, error -71 [ 258.736095][ T8086] FAULT_INJECTION: forcing a failure. [ 258.736095][ T8086] name failslab, interval 1, probability 0, space 0, times 0 [ 258.751290][ T8086] CPU: 0 UID: 0 PID: 8086 Comm: syz.4.613 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(full) [ 258.751317][ T8086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 258.751342][ T8086] Call Trace: [ 258.751354][ T8086] [ 258.751363][ T8086] dump_stack_lvl+0x189/0x250 [ 258.751401][ T8086] ? __pfx____ratelimit+0x10/0x10 [ 258.751434][ T8086] ? __pfx_dump_stack_lvl+0x10/0x10 [ 258.751467][ T8086] ? __pfx__printk+0x10/0x10 [ 258.751505][ T8086] should_fail_ex+0x414/0x560 [ 258.751538][ T8086] should_failslab+0xa8/0x100 [ 258.751562][ T8086] __kmalloc_cache_noprof+0x70/0x3d0 [ 258.751583][ T8086] ? sctp_add_bind_addr+0x8c/0x370 [ 258.751609][ T8086] sctp_add_bind_addr+0x8c/0x370 [ 258.751635][ T8086] sctp_copy_local_addr_list+0x30b/0x4e0 [ 258.751661][ T8086] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 258.751683][ T8086] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 258.751710][ T8086] ? sctp_v4_is_any+0x35/0x60 [ 258.751731][ T8086] ? sctp_copy_one_addr+0x93/0x360 [ 258.751756][ T8086] sctp_bind_addr_copy+0xb3/0x3c0 [ 258.751779][ T8086] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 258.751815][ T8086] sctp_connect_new_asoc+0x2e0/0x690 [ 258.751846][ T8086] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 258.751872][ T8086] ? __local_bh_enable_ip+0x12d/0x1c0 [ 258.751912][ T8086] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 258.751952][ T8086] ? security_sctp_bind_connect+0x7e/0x2e0 [ 258.751977][ T8086] sctp_sendmsg+0x155c/0x2810 [ 258.752017][ T8086] ? __pfx_sctp_sendmsg+0x10/0x10 [ 258.752045][ T8086] ? aa_sk_perm+0x81e/0x950 [ 258.752074][ T8086] ? __pfx_aa_sk_perm+0x10/0x10 [ 258.752101][ T8086] ? sock_rps_record_flow+0x19/0x410 [ 258.752124][ T8086] ? inet_sendmsg+0x2f4/0x370 [ 258.752146][ T8086] __sock_sendmsg+0x19c/0x270 [ 258.752180][ T8086] ____sys_sendmsg+0x505/0x830 [ 258.752211][ T8086] ? __pfx_____sys_sendmsg+0x10/0x10 [ 258.752252][ T8086] ? import_iovec+0x74/0xa0 [ 258.752294][ T8086] ___sys_sendmsg+0x21f/0x2a0 [ 258.752323][ T8086] ? __pfx____sys_sendmsg+0x10/0x10 [ 258.752389][ T8086] ? __fget_files+0x2a/0x420 [ 258.752412][ T8086] ? __fget_files+0x3a0/0x420 [ 258.752447][ T8086] __x64_sys_sendmsg+0x19b/0x260 [ 258.752477][ T8086] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 258.752516][ T8086] ? __pfx_ksys_write+0x10/0x10 [ 258.752533][ T8086] ? rcu_is_watching+0x15/0xb0 [ 258.752570][ T8086] ? do_syscall_64+0xbe/0x3b0 [ 258.752594][ T8086] do_syscall_64+0xfa/0x3b0 [ 258.752613][ T8086] ? lockdep_hardirqs_on+0x9c/0x150 [ 258.752643][ T8086] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.752664][ T8086] ? clear_bhb_loop+0x60/0xb0 [ 258.752690][ T8086] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.752711][ T8086] RIP: 0033:0x7f278798e929 [ 258.752729][ T8086] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 258.752747][ T8086] RSP: 002b:00007f2788886038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 258.752769][ T8086] RAX: ffffffffffffffda RBX: 00007f2787bb5fa0 RCX: 00007f278798e929 [ 258.752784][ T8086] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 0000000000000003 [ 258.752797][ T8086] RBP: 00007f2788886090 R08: 0000000000000000 R09: 0000000000000000 [ 258.752809][ T8086] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 258.752821][ T8086] R13: 0000000000000000 R14: 00007f2787bb5fa0 R15: 00007f2787cdfa28 [ 258.752854][ T8086] [ 259.084603][ T5929] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 259.232202][ T5929] usb 2-1: device descriptor read/64, error -71 [ 259.326507][ T8094] netlink: 4 bytes leftover after parsing attributes in process `syz.4.615'. [ 259.343923][ T5929] usb usb2-port1: attempt power cycle [ 259.389012][ T8098] netlink: 9 bytes leftover after parsing attributes in process `syz.0.618'. [ 259.702319][ T5929] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 259.722930][ T5929] usb 2-1: device descriptor read/8, error -71 [ 259.952197][ T2156] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 259.962840][ T5929] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 259.983046][ T5929] usb 2-1: device descriptor read/8, error -71 [ 260.092915][ T5929] usb usb2-port1: unable to enumerate USB device [ 260.365261][ T5906] usb 3-1: USB disconnect, device number 29 [ 260.614747][ T8127] program syz.2.624 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 261.232245][ T2156] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 261.422396][ T2156] usb 4-1: Using ep0 maxpacket: 8 [ 261.450535][ T2156] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 261.472778][ T2156] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.490933][ T2156] usb 4-1: Product: syz [ 261.500876][ T2156] usb 4-1: Manufacturer: syz [ 261.523892][ T2156] usb 4-1: SerialNumber: syz [ 261.556549][ T2156] usb 4-1: config 0 descriptor?? [ 261.584883][ T2156] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 261.669206][ T2156] usb 4-1: setting power ON [ 261.696874][ T2156] dvb-usb: bulk message failed: -22 (2/0) [ 261.743783][ T2156] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 261.910570][ T2156] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 261.939505][ T2156] usb 4-1: media controller created [ 262.031437][ T2156] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 262.069131][ T2156] usb 4-1: selecting invalid altsetting 6 [ 262.076466][ T2156] usb 4-1: digital interface selection failed (-22) [ 262.085847][ T2156] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 262.110904][ T2156] usb 4-1: setting power OFF [ 262.117016][ T2156] dvb-usb: bulk message failed: -22 (2/0) [ 262.123812][ T2156] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 262.144721][ T2156] (NULL device *): no alternate interface [ 262.209573][ T8143] binder: BINDER_SET_CONTEXT_MGR already set [ 262.225825][ T8143] binder: 8142:8143 ioctl 4018620d 200000000040 returned -16 [ 264.118036][ T2156] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 264.151008][ T5929] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 264.203596][ T2156] usb 4-1: USB disconnect, device number 41 [ 264.259728][ T8166] netlink: 868 bytes leftover after parsing attributes in process `syz.3.638'. [ 264.279190][ T8167] netlink: 24 bytes leftover after parsing attributes in process `syz.2.639'. [ 264.290670][ T8167] netlink: 24 bytes leftover after parsing attributes in process `syz.2.639'. [ 264.341679][ T5929] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 264.370840][ T5929] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 264.423294][ T5929] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 264.434164][ T8171] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 264.477207][ T5929] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 264.528099][ T5899] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 264.549257][ T5929] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 264.583347][ T8171] xt_TPROXY: Can be used only with -p tcp or -p udp [ 264.605109][ T5929] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 264.671054][ T5929] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 264.746248][ T5899] usb 1-1: device descriptor read/64, error -71 [ 264.752270][ T5929] usb 2-1: Product: syz [ 264.790442][ T5929] usb 2-1: Manufacturer: syz [ 264.836261][ T5929] cdc_wdm 2-1:1.0: skipping garbage [ 264.858019][ T5929] cdc_wdm 2-1:1.0: skipping garbage [ 264.898532][ T5929] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 264.905968][ T5929] cdc_wdm 2-1:1.0: Unknown control protocol [ 265.002181][ T5966] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 265.022565][ T5899] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 265.267663][ T8189] cdc_wdm 2-1:1.0: Error submitting int urb - -90 [ 265.279923][ T5899] usb 1-1: device descriptor read/64, error -71 [ 265.286364][ T5966] usb 4-1: Using ep0 maxpacket: 32 [ 265.349705][ T8181] netlink: 8 bytes leftover after parsing attributes in process `syz.3.640'. [ 265.376683][ T5966] usb 4-1: unable to get BOS descriptor or descriptor too short [ 265.392411][ T5966] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 265.406895][ T5966] usb 4-1: can't read configurations, error -71 [ 265.415061][ T5899] usb usb1-port1: attempt power cycle [ 265.802132][ T5899] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 265.842974][ T5899] usb 1-1: device descriptor read/8, error -71 [ 266.122277][ T5899] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 266.193009][ T5899] usb 1-1: device descriptor read/8, error -71 [ 266.313462][ T5899] usb usb1-port1: unable to enumerate USB device [ 266.462287][ T5962] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 266.633816][ T5962] usb 3-1: Using ep0 maxpacket: 32 [ 266.641856][ T5962] usb 3-1: config 1 has an invalid descriptor of length 236, skipping remainder of the config [ 266.652759][ T5962] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 266.667408][ T5962] usb 3-1: config 1 has no interface number 1 [ 266.676657][ T5962] usb 3-1: config 1 interface 2 altsetting 228 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 266.892337][ T5962] usb 3-1: config 1 interface 2 has no altsetting 1 [ 266.914060][ T5962] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 266.924375][ T5962] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.973324][ T5962] usb 3-1: Product: syz [ 266.977512][ T5962] usb 3-1: Manufacturer: syz [ 267.012939][ T5962] usb 3-1: SerialNumber: syz [ 267.267051][ T8202] bridge0: entered promiscuous mode [ 267.276920][ T8202] vlan2: entered promiscuous mode [ 267.340271][ T5929] usb 2-1: USB disconnect, device number 50 [ 267.383391][ T5962] usb 3-1: USB disconnect, device number 30 [ 267.545129][ T6493] udevd[6493]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 267.566493][ T8204] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 267.887785][ T8210] netlink: 28 bytes leftover after parsing attributes in process `syz.1.649'. [ 268.167021][ T8217] syz.2.651 (8217): /proc/8216/oom_adj is deprecated, please use /proc/8216/oom_score_adj instead. [ 268.202914][ T8217] binder: 8216:8217 ioctl c0306201 200000000100 returned -14 [ 268.282303][ T5962] usb 5-1: new full-speed USB device number 52 using dummy_hcd [ 268.504249][ T5962] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 268.542360][ T5921] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 268.551635][ T5962] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 268.579032][ T5962] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 268.610365][ T5962] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 268.630079][ T5962] usb 5-1: SerialNumber: syz [ 268.709955][ T5962] usb 5-1: 0:2 : does not exist [ 268.716502][ T5921] usb 2-1: Using ep0 maxpacket: 16 [ 268.738328][ T5962] usb 5-1: unit 4 not found! [ 268.778243][ T5929] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 268.803170][ T5921] usb 2-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 268.820251][ T5921] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 268.845035][ T5921] usb 2-1: Product: syz [ 268.851181][ T5921] usb 2-1: Manufacturer: syz [ 268.952495][ T5921] usb 2-1: SerialNumber: syz [ 268.977079][ T5929] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 268.993510][ T5921] usb 2-1: config 0 descriptor?? [ 269.000552][ T5929] usb 3-1: config 0 has no interface number 0 [ 269.029686][ T5929] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice= 0.07 [ 269.062864][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.099242][ T5929] usb 3-1: Product: syz [ 269.112214][ T5929] usb 3-1: Manufacturer: syz [ 269.122194][ T5929] usb 3-1: SerialNumber: syz [ 269.138780][ T5929] usb 3-1: config 0 descriptor?? [ 269.231643][ T5921] usb 2-1: USB disconnect, device number 51 [ 269.545255][ T8248] netlink: 16 bytes leftover after parsing attributes in process `syz.0.661'. [ 269.936545][ T5929] usb 3-1: Found UVC 0.08 device syz (046d:0823) [ 269.949049][ T8252] netlink: 28 bytes leftover after parsing attributes in process `syz.1.663'. [ 269.955607][ T5929] usb 3-1: No valid video chain found. [ 269.994176][ T5929] usb 3-1: USB disconnect, device number 31 [ 270.214453][ T5966] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 270.271860][ T8262] syz.1.666: vmalloc error: size 2768896, failed to allocated page array size 5408, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 270.273556][ T8260] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 270.282203][ T8262] [ 270.328614][ T8262] CPU: 0 UID: 0 PID: 8262 Comm: syz.1.666 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(full) [ 270.328644][ T8262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 270.328657][ T8262] Call Trace: [ 270.328666][ T8262] [ 270.328675][ T8262] dump_stack_lvl+0x189/0x250 [ 270.328713][ T8262] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 270.328743][ T8262] ? __pfx_dump_stack_lvl+0x10/0x10 [ 270.328777][ T8262] ? __pfx__printk+0x10/0x10 [ 270.328800][ T8262] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 270.328823][ T8262] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 270.328855][ T8262] warn_alloc+0x214/0x310 [ 270.328886][ T8262] ? __pfx_warn_alloc+0x10/0x10 [ 270.328919][ T8262] ? __get_vm_area_node+0x28f/0x300 [ 270.328942][ T8262] ? vb2_vmalloc_alloc+0xef/0x340 [ 270.328968][ T8262] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 270.329023][ T8262] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 270.329054][ T8262] ? __kasan_kmalloc+0x93/0xb0 [ 270.329096][ T8262] vmalloc_user_noprof+0xad/0xf0 [ 270.329119][ T8262] ? vb2_vmalloc_alloc+0xef/0x340 [ 270.329144][ T8262] vb2_vmalloc_alloc+0xef/0x340 [ 270.329167][ T8262] ? __pfx_vb2_vmalloc_alloc+0x10/0x10 [ 270.329191][ T8262] __vb2_queue_alloc+0x9c2/0x15a0 [ 270.329259][ T8262] vb2_core_reqbufs+0xc31/0x1420 [ 270.329314][ T8262] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 270.329347][ T8262] ? vb2_verify_memory_type+0x1fc/0x570 [ 270.329384][ T8262] ? vb2_reqbufs+0x3a9/0x630 [ 270.329427][ T8262] v4l2_m2m_ioctl_reqbufs+0x10d/0x200 [ 270.329459][ T8262] __video_do_ioctl+0xc98/0xdb0 [ 270.329493][ T8262] ? __pfx___video_do_ioctl+0x10/0x10 [ 270.329533][ T8262] video_usercopy+0x871/0x14f0 [ 270.329568][ T8262] ? __pfx___video_do_ioctl+0x10/0x10 [ 270.329591][ T8262] ? __pfx_video_usercopy+0x10/0x10 [ 270.329627][ T8262] ? __fget_files+0x2a/0x420 [ 270.329655][ T8262] ? __fget_files+0x2a/0x420 [ 270.329677][ T8262] ? __fget_files+0x3a0/0x420 [ 270.329705][ T8262] v4l2_ioctl+0x18d/0x1e0 [ 270.329729][ T8262] ? __pfx_v4l2_ioctl+0x10/0x10 [ 270.329750][ T8262] __se_sys_ioctl+0xf9/0x170 [ 270.329785][ T8262] do_syscall_64+0xfa/0x3b0 [ 270.329805][ T8262] ? lockdep_hardirqs_on+0x9c/0x150 [ 270.329836][ T8262] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 270.329857][ T8262] ? clear_bhb_loop+0x60/0xb0 [ 270.329884][ T8262] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 270.329905][ T8262] RIP: 0033:0x7fe8c8f8e929 [ 270.329924][ T8262] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 270.329943][ T8262] RSP: 002b:00007fe8c6db4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 270.329966][ T8262] RAX: ffffffffffffffda RBX: 00007fe8c91b6160 RCX: 00007fe8c8f8e929 [ 270.329982][ T8262] RDX: 0000200000000000 RSI: 00000000c0145608 RDI: 0000000000000005 [ 270.329997][ T8262] RBP: 00007fe8c9010b39 R08: 0000000000000000 R09: 0000000000000000 [ 270.330011][ T8262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 270.330023][ T8262] R13: 0000000000000000 R14: 00007fe8c91b6160 R15: 00007fe8c92dfa28 [ 270.330057][ T8262] [ 270.330077][ T8262] Mem-Info: [ 270.641300][ T8262] active_anon:5868 inactive_anon:0 isolated_anon:0 [ 270.641300][ T8262] active_file:1632 inactive_file:39944 isolated_file:0 [ 270.641300][ T8262] unevictable:768 dirty:176 writeback:0 [ 270.641300][ T8262] slab_reclaimable:10003 slab_unreclaimable:101115 [ 270.641300][ T8262] mapped:30457 shmem:1372 pagetables:1300 [ 270.641300][ T8262] sec_pagetables:0 bounce:0 [ 270.641300][ T8262] kernel_misc_reclaimable:0 [ 270.641300][ T8262] free:1319446 free_pcp:23380 free_cma:0 [ 270.686590][ C0] vkms_vblank_simulate: vblank timer overrun [ 270.696849][ T5966] usb 1-1: Using ep0 maxpacket: 8 [ 270.771623][ T8262] Node 0 active_anon:23368kB inactive_anon:0kB active_file:6484kB inactive_file:159576kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:121784kB dirty:700kB writeback:0kB shmem:3952kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12200kB pagetables:5100kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 270.813418][ T5966] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xAD, changing to 0x8D [ 270.819326][ T8262] Node 1 active_anon:4kB inactive_anon:0kB active_file:44kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:44kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:100kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 270.825811][ T5966] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 271.068369][ T5966] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 0 [ 271.097535][ T5966] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 271.112260][ T8262] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 271.198676][ T5966] usb 1-1: New USB device found, idVendor=0bfd, idProduct=0124, bcdDevice=3a.9f [ 271.198691][ T5929] usb 5-1: USB disconnect, device number 52 [ 271.256090][ T5966] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.275691][ T8262] lowmem_reserve[]: 0 2501 2502 2502 2502 [ 271.281570][ T8262] Node 0 DMA32 free:1390264kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24356kB inactive_anon:0kB active_file:6484kB inactive_file:157704kB unevictable:1536kB writepending:720kB present:3129332kB managed:2561024kB mlocked:0kB bounce:0kB free_pcp:41144kB local_pcp:17416kB free_cma:0kB [ 271.313840][ C0] vkms_vblank_simulate: vblank timer overrun [ 271.475916][ T5966] usb 1-1: Product: syz [ 271.483717][ T5966] usb 1-1: Manufacturer: syz [ 271.488409][ T5966] usb 1-1: SerialNumber: syz [ 271.526164][ T5966] usb 1-1: config 0 descriptor?? [ 271.577528][ T5966] kvaser_usb 1-1:0.0: error -ENODEV: Cannot get usb endpoint(s) [ 271.607174][ T8262] lowmem_reserve[]: 0 0 1 1 1 [ 271.617329][ T8262] Node 0 Normal free:4kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1832kB unevictable:0kB writepending:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:8kB free_cma:0kB [ 271.646375][ C0] vkms_vblank_simulate: vblank timer overrun [ 271.783829][ T5921] usb 1-1: USB disconnect, device number 34 [ 271.822202][ T8262] lowmem_reserve[]: 0 0 0 0 0 [ 271.832374][ T8262] Node 1 Normal free:3870600kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4kB inactive_anon:0kB active_file:44kB inactive_file:200kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:50636kB local_pcp:21964kB free_cma:0kB [ 271.863706][ C0] vkms_vblank_simulate: vblank timer overrun [ 271.935512][ T8262] lowmem_reserve[]: 0 0 0 0 0 [ 271.941249][ T8262] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 272.067783][ T8262] Node 0 DMA32: 714*4kB (UME) 557*8kB (UME) 349*16kB (UME) 915*32kB (UME) 223*64kB (UM) 58*128kB (UME) 41*256kB (UME) 37*512kB (UM) 22*1024kB (UM) 8*2048kB (UME) 307*4096kB (UM) = 1389696kB [ 272.127776][ T8262] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 272.222265][ T8262] Node 1 Normal: 162*4kB (UE) 57*8kB (UE) 16*16kB (UME) 99*32kB (UE) 31*64kB (UE) 5*128kB (UE) 4*256kB (UME) 6*512kB (UME) 5*1024kB (UME) 2*2048kB (UE) 940*4096kB (UM) = 3870704kB [ 272.261095][ T8262] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 272.292628][ T8262] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 272.321814][ T8262] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 272.362255][ T8262] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 272.412246][ T2156] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 272.426618][ T8262] 42923 total pagecache pages [ 272.437817][ T8262] 0 pages in swap cache [ 272.445588][ T8262] Free swap = 124996kB [ 272.454453][ T8262] Total swap = 124996kB [ 272.463303][ T8262] 2097051 pages RAM [ 272.471083][ T8262] 0 pages HighMem/MovableOnly [ 272.482218][ T8262] 424689 pages reserved [ 272.490021][ T8262] 0 pages cma reserved [ 272.742284][ T2156] usb 5-1: Using ep0 maxpacket: 16 [ 272.754075][ T2156] usb 5-1: config index 0 descriptor too short (expected 65316, got 36) [ 272.773111][ T2156] usb 5-1: config 0 has an invalid interface number: 0 but max is -1 [ 272.782837][ T8283] tipc: Enabling of bearer rejected, already enabled [ 272.813316][ T2156] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 272.858798][ T2156] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 272.942214][ T2156] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 272.955852][ T2156] usb 5-1: config 0 interface 0 has no altsetting 0 [ 272.984676][ T2156] usb 5-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 273.007954][ T8286] fuse: Unknown parameter 'roup_id' [ 273.024940][ T2156] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 273.041003][ T2156] usb 5-1: config 0 descriptor?? [ 273.319331][ T2156] hid (null): unknown global tag 0xc [ 273.334402][ T2156] hid (null): report_id 0 is invalid [ 273.360356][ T2156] hid (null): unknown global tag 0xe [ 273.371723][ T2156] hid (null): unknown global tag 0xc [ 273.397641][ T2156] hid (null): unknown global tag 0xd [ 273.408433][ T2156] hid (null): report_id 3636381312 is invalid [ 273.421098][ T2156] hid (null): unknown global tag 0xe [ 273.447093][ T2156] hid (null): invalid report_size 15733 [ 273.462518][ T2156] hid (null): global environment stack underflow [ 273.500199][ T2156] hid (null): invalid report_size 59091 [ 273.518907][ T8297] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 273.522192][ T2156] hid (null): unknown global tag 0xe [ 273.528343][ T8297] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 273.552276][ T2156] hid (null): invalid report_size 659322949 [ 273.560213][ T2156] hid (null): invalid report_size 40509 [ 273.568622][ T8280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 273.584871][ T2156] hid (null): report_id 49840 is invalid [ 273.615820][ T8280] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 273.693861][ T2156] usb 5-1: USB disconnect, device number 53 [ 273.765072][ T5962] usb 2-1: new full-speed USB device number 52 using dummy_hcd [ 273.809921][ T8315] binder: 8314:8315 ioctl c0306201 200000000240 returned -11 [ 273.872252][ T5929] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 273.936907][ T5966] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 273.948063][ T5962] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 273.968580][ T8317] loop8: detected capacity change from 0 to 1 [ 273.975737][ T5962] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 273.980308][ T8319] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 273.989345][ T8317] Dev loop8: unable to read RDB block 1 [ 273.999475][ T8317] loop8: unable to read partition table [ 274.008227][ T8317] loop8: partition table beyond EOD, truncated [ 274.015324][ T5962] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 274.015379][ T8317] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 274.034595][ T5962] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 274.050415][ T5962] usb 2-1: SerialNumber: syz [ 274.064019][ T5929] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 274.075758][ T5962] usb 2-1: 0:2 : does not exist [ 274.082144][ T5929] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 274.082281][ T5962] usb 2-1: unit 4 not found! [ 274.107567][ T5929] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 274.126204][ T5966] usb 3-1: Using ep0 maxpacket: 16 [ 274.131124][ T5929] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 274.146303][ T5966] usb 3-1: unable to get BOS descriptor or descriptor too short [ 274.149526][ T5929] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 274.163719][ T5966] usb 3-1: config 8 has an invalid interface number: 64 but max is 0 [ 274.182183][ T5966] usb 3-1: config 8 has no interface number 0 [ 274.199895][ T5966] usb 3-1: config 8 interface 64 altsetting 2 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 274.220939][ T5966] usb 3-1: config 8 interface 64 has no altsetting 0 [ 274.236491][ T5929] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 274.254608][ T5929] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 274.256667][ T5966] usb 3-1: New USB device found, idVendor=19d2, idProduct=64c6, bcdDevice= e.34 [ 274.283757][ T5929] usb 4-1: Product: syz [ 274.294247][ T5966] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 274.297502][ T5929] usb 4-1: Manufacturer: syz [ 274.315649][ T5966] usb 3-1: Product: syz [ 274.319858][ T5966] usb 3-1: Manufacturer: syz [ 274.336567][ T5966] usb 3-1: SerialNumber: syz [ 274.350609][ T5929] cdc_wdm 4-1:1.0: skipping garbage [ 274.358306][ T5929] cdc_wdm 4-1:1.0: skipping garbage [ 274.369625][ T30] audit: type=1326 audit(1750079259.587:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8320 comm="syz.4.687" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f278798e929 code=0x0 [ 274.401456][ T5929] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 274.408224][ T5929] cdc_wdm 4-1:1.0: Unknown control protocol [ 274.566979][ T8312] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.576541][ T8312] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.585340][ T8312] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.594249][ T8312] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.650160][ T8312] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.672695][ T8312] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.681825][ T8312] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.737017][ T8329] bond2: entered promiscuous mode [ 274.742222][ T8329] bond2: entered allmulticast mode [ 274.748452][ T8329] 8021q: adding VLAN 0 to HW filter on device bond2 [ 274.800304][ T8312] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.814795][ T8312] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.826517][ T8312] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.889202][ T8337] cdc_wdm 4-1:1.0: Error submitting int urb - -90 [ 274.926228][ T5966] cdc_ether 3-1:8.64: invalid descriptor buffer length [ 275.069281][ T5966] usb 3-1: bad CDC descriptors [ 275.106799][ T5966] usb 3-1: USB disconnect, device number 32 [ 275.399677][ T8339] netlink: 'syz.0.690': attribute type 1 has an invalid length. [ 275.407558][ T8339] netlink: 4 bytes leftover after parsing attributes in process `syz.0.690'. [ 276.322274][ T5966] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 276.520764][ T5962] usb 2-1: USB disconnect, device number 52 [ 276.619481][ T8363] netlink: 4 bytes leftover after parsing attributes in process `syz.1.697'. [ 276.648880][ T5966] usb 3-1: config 0 has no interfaces? [ 276.660275][ T5966] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 276.702383][ T5966] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.772224][ T5966] usb 3-1: Product: syz [ 276.792764][ T5966] usb 3-1: Manufacturer: syz [ 276.822912][ T5966] usb 3-1: SerialNumber: syz [ 276.854828][ T5966] usb 3-1: config 0 descriptor?? [ 278.751595][ T5929] usb 4-1: USB disconnect, device number 44 [ 278.765067][ T5962] usb 3-1: USB disconnect, device number 33 [ 278.933701][ T8383] netlink: 28 bytes leftover after parsing attributes in process `syz.3.701'. [ 279.300638][ T5929] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 279.326842][ T8398] FAULT_INJECTION: forcing a failure. [ 279.326842][ T8398] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 279.354399][ T8398] CPU: 0 UID: 0 PID: 8398 Comm: syz.3.707 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(full) [ 279.354427][ T8398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 279.354440][ T8398] Call Trace: [ 279.354449][ T8398] [ 279.354458][ T8398] dump_stack_lvl+0x189/0x250 [ 279.354496][ T8398] ? __pfx____ratelimit+0x10/0x10 [ 279.354534][ T8398] ? __pfx_dump_stack_lvl+0x10/0x10 [ 279.354569][ T8398] ? __pfx__printk+0x10/0x10 [ 279.354595][ T8398] ? fs_reclaim_acquire+0x7d/0x100 [ 279.354631][ T8398] should_fail_ex+0x414/0x560 [ 279.354665][ T8398] prepare_alloc_pages+0x213/0x610 [ 279.354700][ T8398] __alloc_frozen_pages_noprof+0x123/0x370 [ 279.354740][ T8398] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 279.354772][ T8398] ? __lock_acquire+0xab9/0xd20 [ 279.354814][ T8398] alloc_pages_mpol+0x232/0x4a0 [ 279.354842][ T8398] alloc_pages_noprof+0xa9/0x190 [ 279.354866][ T8398] pte_alloc_one+0x21/0x170 [ 279.354901][ T8398] __pte_alloc+0x25/0x1a0 [ 279.354930][ T8398] __handle_mm_fault+0x4b8a/0x5620 [ 279.354984][ T8398] ? __pfx___handle_mm_fault+0x10/0x10 [ 279.355038][ T8398] ? find_vma+0xe7/0x160 [ 279.355058][ T8398] ? __pfx_find_vma+0x10/0x10 [ 279.355080][ T8398] handle_mm_fault+0x40a/0x8e0 [ 279.355125][ T8398] do_user_addr_fault+0x764/0x1390 [ 279.355170][ T8398] exc_page_fault+0x76/0xf0 [ 279.355205][ T8398] asm_exc_page_fault+0x26/0x30 [ 279.355225][ T8398] RIP: 0010:rep_movs_alternative+0xf/0x90 [ 279.355252][ T8398] Code: c4 10 c3 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 83 f9 40 73 44 83 f9 08 73 25 85 c9 74 0f <8a> 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 3d f7 03 00 66 2e [ 279.355270][ T8398] RSP: 0018:ffffc90003c7fd78 EFLAGS: 00050202 [ 279.355289][ T8398] RAX: 00007ffffffff001 RBX: 0000000000000004 RCX: 0000000000000004 [ 279.355303][ T8398] RDX: 0000000000000001 RSI: 0000200000000280 RDI: ffffc90003c7fe00 [ 279.355318][ T8398] RBP: ffffc90003c7fe68 R08: 0000000000000003 R09: 0000000000000004 [ 279.355331][ T8398] R10: dffffc0000000000 R11: fffff5200078ffc0 R12: 0000000000000110 [ 279.355346][ T8398] R13: ffffc90003c7fde0 R14: ffffc90003c7fe00 R15: 0000200000000280 [ 279.355382][ T8398] _copy_from_user+0x7a/0xb0 [ 279.355405][ T8398] do_sock_getsockopt+0x1cd/0x650 [ 279.355435][ T8398] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 279.355461][ T8398] ? do_syscall_64+0x80/0x3b0 [ 279.355479][ T8398] ? __fget_files+0x3a0/0x420 [ 279.355502][ T8398] ? __fget_files+0x2a/0x420 [ 279.355532][ T8398] __x64_sys_getsockopt+0x1a5/0x250 [ 279.355558][ T8398] ? do_syscall_64+0x80/0x3b0 [ 279.355579][ T8398] ? do_syscall_64+0x80/0x3b0 [ 279.355614][ T8398] do_syscall_64+0xfa/0x3b0 [ 279.355630][ T8398] ? lockdep_hardirqs_on+0x9c/0x150 [ 279.355658][ T8398] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 279.355678][ T8398] ? clear_bhb_loop+0x60/0xb0 [ 279.355702][ T8398] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 279.355726][ T8398] RIP: 0033:0x7f9b6918e929 [ 279.355742][ T8398] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 279.355758][ T8398] RSP: 002b:00007f9b6a051038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 279.355778][ T8398] RAX: ffffffffffffffda RBX: 00007f9b693b5fa0 RCX: 00007f9b6918e929 [ 279.355792][ T8398] RDX: 0000000000000006 RSI: 0000000000000110 RDI: 0000000000000003 [ 279.355804][ T8398] RBP: 00007f9b6a051090 R08: 0000200000000280 R09: 0000000000000000 [ 279.355818][ T8398] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 279.355848][ T8398] R13: 0000000000000000 R14: 00007f9b693b5fa0 R15: 00007f9b694dfa28 [ 279.355880][ T8398] [ 279.714133][ C0] vkms_vblank_simulate: vblank timer overrun [ 279.722543][ C0] hrtimer: interrupt took 360441450 ns [ 279.782457][ T5929] usb 5-1: Using ep0 maxpacket: 16 [ 279.789776][ T5929] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 279.800093][ T5929] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 279.822213][ T5929] usb 5-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 279.822798][ C0] vkms_vblank_simulate: vblank timer overrun [ 279.831278][ T5929] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.962650][ T5929] usb 5-1: config 0 descriptor?? [ 280.942264][ T5929] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 281.308517][ T8429] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 281.318908][ T8429] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 281.388914][ T8422] IPVS: set_ctl: invalid protocol: 0 172.20.20.187:20004 [ 282.097724][ T8431] binder: 8430:8431 ioctl c00c620f 2000000001c0 returned -22 [ 283.502221][ T2156] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 284.052895][ T5966] usb 5-1: USB disconnect, device number 54 [ 284.104005][ T8449] vivid-000: disconnect [ 284.108811][ T8449] vivid-000: reconnect [ 284.116297][ T8449] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 284.276150][ T2156] usb 2-1: config 0 has no interfaces? [ 284.322593][ T2156] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 284.346052][ T2156] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.402405][ T2156] usb 2-1: Product: syz [ 284.407291][ T2156] usb 2-1: Manufacturer: syz [ 284.549477][ T2156] usb 2-1: SerialNumber: syz [ 284.580487][ T2156] usb 2-1: config 0 descriptor?? [ 285.165630][ T8441] pimreg: entered allmulticast mode [ 285.392597][ T5966] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 285.498602][ T8468] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 285.592578][ T5966] usb 5-1: Using ep0 maxpacket: 8 [ 285.600345][ T5966] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 285.609200][ T5966] usb 5-1: config 179 has no interface number 0 [ 285.629261][ T5966] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 285.655685][ T5966] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 285.681267][ T5966] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 285.769900][ T5966] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 285.801705][ T5966] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 285.849871][ T5966] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 285.878791][ T5966] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.916550][ T8462] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 285.938683][ T8476] netlink: 28 bytes leftover after parsing attributes in process `syz.3.729'. [ 285.978440][ T8476] netlink: 28 bytes leftover after parsing attributes in process `syz.3.729'. [ 286.057078][ T8476] dummy0: entered promiscuous mode [ 286.083460][ T8476] dummy0: left promiscuous mode [ 286.208661][ T8462] IPv6: Can't replace route, no match found [ 286.385556][ T5835] usb 2-1: USB disconnect, device number 53 [ 286.516190][ T8483] vivid-001: disconnect [ 286.526379][ T8483] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 286.547184][ T8462] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 286.633438][ T8462] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 287.191566][ T8479] vivid-001: reconnect [ 287.417950][ T8496] fuse: Bad value for 'fd' [ 287.749063][ T2156] usb 5-1: USB disconnect, device number 55 [ 287.749079][ C0] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 287.763461][ C0] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 288.070973][ T8498] netlink: 'syz.1.735': attribute type 2 has an invalid length. [ 288.433996][ T8503] xt_hashlimit: max too large, truncated to 1048576 [ 288.447332][ T8503] xt_bpf: check failed: parse error [ 288.643805][ T30] audit: type=1326 audit(1750079273.857:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8499 comm="syz.2.736" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0941d8e929 code=0x7ffc0000 [ 288.740198][ T30] audit: type=1326 audit(1750079273.857:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8499 comm="syz.2.736" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0941d8e929 code=0x7ffc0000 [ 288.852247][ T30] audit: type=1326 audit(1750079273.887:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8499 comm="syz.2.736" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f0941d2ab19 code=0x7ffc0000 [ 289.036243][ T30] audit: type=1326 audit(1750079273.887:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8499 comm="syz.2.736" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f0941d2ab19 code=0x7ffc0000 [ 289.072323][ T5966] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 289.195404][ T8526] netlink: 'syz.0.741': attribute type 21 has an invalid length. [ 289.204519][ T8526] netlink: 128 bytes leftover after parsing attributes in process `syz.0.741'. [ 289.221934][ T8526] netlink: 'syz.0.741': attribute type 4 has an invalid length. [ 289.229709][ T8526] netlink: 3 bytes leftover after parsing attributes in process `syz.0.741'. [ 289.806648][ T30] audit: type=1326 audit(1750079273.887:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8499 comm="syz.2.736" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f0941d2ab19 code=0x7ffc0000 [ 289.986404][ T30] audit: type=1326 audit(1750079273.887:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8499 comm="syz.2.736" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0941d8e929 code=0x7ffc0000 [ 289.987713][ T2156] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 290.195438][ T30] audit: type=1326 audit(1750079273.887:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8499 comm="syz.2.736" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f0941d2ab19 code=0x7ffc0000 [ 290.428874][ T30] audit: type=1326 audit(1750079273.887:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8499 comm="syz.2.736" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0941d8e929 code=0x7ffc0000 [ 290.464060][ T30] audit: type=1326 audit(1750079273.887:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8499 comm="syz.2.736" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0941d8e929 code=0x7ffc0000 [ 290.509131][ T2156] usb 4-1: config 0 has no interfaces? [ 290.550463][ T2156] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 290.571854][ T2156] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.591446][ T2156] usb 4-1: Product: syz [ 290.602795][ T2156] usb 4-1: Manufacturer: syz [ 290.621013][ T2156] usb 4-1: SerialNumber: syz [ 290.641320][ T30] audit: type=1326 audit(1750079273.897:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8499 comm="syz.2.736" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0941d8e929 code=0x7ffc0000 [ 290.695299][ T2156] usb 4-1: config 0 descriptor?? [ 290.845966][ T8537] vlan2: entered promiscuous mode [ 291.017585][ T8544] vivid-001: disconnect [ 291.061673][ T8529] pimreg: entered allmulticast mode [ 291.095058][ T8541] pimreg: left allmulticast mode [ 291.134309][ T8540] vivid-001: reconnect [ 291.174266][ T8544] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 293.044336][ T8557] netlink: 'syz.4.749': attribute type 1 has an invalid length. [ 293.148565][ T8557] 8021q: adding VLAN 0 to HW filter on device bond3 [ 293.259839][ T8559] vlan2: entered allmulticast mode [ 293.287253][ T8559] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 293.395571][ T8559] bond3: (slave vlan2): making interface the new active one [ 293.404636][ T8559] bond3: (slave vlan2): Enslaving as an active interface with an up link [ 293.517491][ T5835] usb 4-1: USB disconnect, device number 45 [ 293.559522][ T8567] netlink: 8 bytes leftover after parsing attributes in process `syz.2.752'. [ 294.269371][ T2156] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 294.293050][ T30] kauditd_printk_skb: 59 callbacks suppressed [ 294.293083][ T30] audit: type=1326 audit(1750079279.507:147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8582 comm="syz.3.756" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b6918e929 code=0x7ffc0000 [ 294.321294][ C1] vkms_vblank_simulate: vblank timer overrun [ 294.363559][ T8588] netlink: 9 bytes leftover after parsing attributes in process `syz.2.757'. [ 294.503714][ T30] audit: type=1326 audit(1750079279.557:148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8582 comm="syz.3.756" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f9b6912ab19 code=0x7ffc0000 [ 294.532309][ T30] audit: type=1326 audit(1750079279.557:149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8582 comm="syz.3.756" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f9b6912ab19 code=0x7ffc0000 [ 294.554369][ C1] vkms_vblank_simulate: vblank timer overrun [ 294.588232][ T2156] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 294.605305][ T2156] usb 5-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 294.616147][ T2156] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.635071][ T2156] usb 5-1: Product: syz [ 294.692422][ T2156] usb 5-1: Manufacturer: syz [ 294.697067][ T2156] usb 5-1: SerialNumber: syz [ 294.708084][ T30] audit: type=1326 audit(1750079279.557:150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8582 comm="syz.3.756" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f9b6912ab19 code=0x7ffc0000 [ 294.766037][ T2156] usb 5-1: config 0 descriptor?? [ 294.827044][ T30] audit: type=1326 audit(1750079279.557:151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8582 comm="syz.3.756" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f9b6912ab19 code=0x7ffc0000 [ 294.903746][ T30] audit: type=1326 audit(1750079279.557:152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8582 comm="syz.3.756" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f9b6912ab19 code=0x7ffc0000 [ 294.963827][ T30] audit: type=1326 audit(1750079279.557:153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8582 comm="syz.3.756" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f9b6912ab19 code=0x7ffc0000 [ 294.986055][ C1] vkms_vblank_simulate: vblank timer overrun [ 295.073942][ T30] audit: type=1326 audit(1750079279.557:154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8582 comm="syz.3.756" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f9b6912ab19 code=0x7ffc0000 [ 295.465040][ T30] audit: type=1326 audit(1750079279.557:155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8582 comm="syz.3.756" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f9b6912ab19 code=0x7ffc0000 [ 295.487254][ C1] vkms_vblank_simulate: vblank timer overrun [ 295.498139][ T30] audit: type=1326 audit(1750079279.557:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8582 comm="syz.3.756" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f9b6912ab19 code=0x7ffc0000 [ 295.520309][ C1] vkms_vblank_simulate: vblank timer overrun [ 295.840034][ T8599] batadv_slave_0: entered promiscuous mode [ 295.872901][ T8599] debugfs: Directory 'hsr2' with parent 'hsr' already present! [ 295.881129][ T8599] Cannot create hsr debugfs directory [ 296.050015][ T8599] hsr2: entered allmulticast mode [ 296.057463][ T8603] netlink: 'syz.3.761': attribute type 2 has an invalid length. [ 296.060486][ T8599] batadv_slave_0: entered allmulticast mode [ 296.081363][ T8603] netlink: 'syz.3.761': attribute type 8 has an invalid length. [ 296.178338][ T8603] netlink: 132 bytes leftover after parsing attributes in process `syz.3.761'. [ 296.625964][ T5962] [ 296.628350][ T5962] ============================================ [ 296.634497][ T5962] WARNING: possible recursive locking detected [ 296.640650][ T5962] 6.16.0-rc2-syzkaller #0 Not tainted [ 296.646019][ T5962] -------------------------------------------- [ 296.652174][ T5962] kworker/0:6/5962 is trying to acquire lock: [ 296.658260][ T5962] ffff88807bfaef30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x19a/0x220 [ 296.667372][ T5962] [ 296.667372][ T5962] but task is already holding lock: [ 296.674743][ T5962] ffff88807b8b2f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x19a/0x220 [ 296.683847][ T5962] [ 296.683847][ T5962] other info that might help us debug this: [ 296.691911][ T5962] Possible unsafe locking scenario: [ 296.691911][ T5962] [ 296.699368][ T5962] CPU0 [ 296.702689][ T5962] ---- [ 296.705973][ T5962] lock(&hsr->seqnr_lock); [ 296.710488][ T5962] lock(&hsr->seqnr_lock); [ 296.715035][ T5962] [ 296.715035][ T5962] *** DEADLOCK *** [ 296.715035][ T5962] [ 296.723188][ T5962] May be due to missing lock nesting notation [ 296.723188][ T5962] [ 296.731510][ T5962] 10 locks held by kworker/0:6/5962: [ 296.736805][ T5962] #0: ffff88802fe76948 ((wq_completion)mld){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 296.747557][ T5962] #1: ffffc900051f7bc0 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 296.760715][ T5962] #2: ffff8880274bd538 (&idev->mc_lock){+.+.}-{4:4}, at: mld_ifc_work+0x2d/0xde0 [ 296.769966][ T5962] #3: ffffffff8e13ed60 (rcu_read_lock){....}-{1:3}, at: mld_sendpack+0x1de/0xd80 [ 296.779256][ T5962] #4: ffffffff8e13ed60 (rcu_read_lock){....}-{1:3}, at: ip6_finish_output2+0x701/0x16a0 [ 296.789135][ T5962] #5: ffffffff8e13edc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27e/0x3a70 [ 296.799091][ T5962] #6: ffff88807b8b2f30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x19a/0x220 [ 296.808612][ T5962] #7: ffffffff8e13ed60 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0x9e/0x2860 [ 296.818126][ T5962] #8: ffffffff8e13edc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27e/0x3a70 [ 296.828077][ T5962] #9: ffffffff8e13edc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27e/0x3a70 [ 296.838023][ T5962] [ 296.838023][ T5962] stack backtrace: [ 296.843919][ T5962] CPU: 0 UID: 0 PID: 5962 Comm: kworker/0:6 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(full) [ 296.843939][ T5962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 296.843951][ T5962] Workqueue: mld mld_ifc_work [ 296.843972][ T5962] Call Trace: [ 296.843979][ T5962] [ 296.843986][ T5962] dump_stack_lvl+0x189/0x250 [ 296.844016][ T5962] ? __pfx_dump_stack_lvl+0x10/0x10 [ 296.844041][ T5962] ? __pfx__printk+0x10/0x10 [ 296.844057][ T5962] ? vlan_dev_hard_start_xmit+0x346/0x5e0 [ 296.844081][ T5962] ? print_lock_name+0xde/0x100 [ 296.844098][ T5962] print_deadlock_bug+0x28b/0x2a0 [ 296.844115][ T5962] validate_chain+0x1a3f/0x2140 [ 296.844136][ T5962] ? kasan_quarantine_put+0xdd/0x220 [ 296.844162][ T5962] __lock_acquire+0xab9/0xd20 [ 296.844188][ T5962] ? hsr_dev_xmit+0x19a/0x220 [ 296.844207][ T5962] lock_acquire+0x120/0x360 [ 296.844229][ T5962] ? hsr_dev_xmit+0x19a/0x220 [ 296.844267][ T5962] ? hsr_dev_xmit+0x19a/0x220 [ 296.844285][ T5962] _raw_spin_lock_bh+0x36/0x50 [ 296.844306][ T5962] ? hsr_dev_xmit+0x19a/0x220 [ 296.844323][ T5962] hsr_dev_xmit+0x19a/0x220 [ 296.844343][ T5962] dev_hard_start_xmit+0x2d4/0x830 [ 296.844370][ T5962] __dev_queue_xmit+0x1adf/0x3a70 [ 296.844393][ T5962] ? unwind_next_frame+0xa5/0x2390 [ 296.844417][ T5962] ? __dev_queue_xmit+0x27e/0x3a70 [ 296.844442][ T5962] ? unwind_next_frame+0xa5/0x2390 [ 296.844464][ T5962] ? unwind_next_frame+0x19ae/0x2390 [ 296.844487][ T5962] ? __pfx___dev_queue_xmit+0x10/0x10 [ 296.844508][ T5962] ? unwind_next_frame+0xa5/0x2390 [ 296.844551][ T5962] ? ret_from_fork_asm+0x1a/0x30 [ 296.844569][ T5962] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 296.844588][ T5962] ? arch_stack_walk+0x11c/0x150 [ 296.844609][ T5962] ? validate_xmit_xfrm+0xbf/0x1130 [ 296.844634][ T5962] ? __pfx_skb_network_protocol+0x10/0x10 [ 296.844658][ T5962] macvlan_start_xmit+0x46d/0x6e0 [ 296.844679][ T5962] ? __pfx_macvlan_start_xmit+0x10/0x10 [ 296.844700][ T5962] dev_hard_start_xmit+0x2d4/0x830 [ 296.844728][ T5962] __dev_queue_xmit+0x1adf/0x3a70 [ 296.844754][ T5962] ? __dev_queue_xmit+0x27e/0x3a70 [ 296.844780][ T5962] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 296.844805][ T5962] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 296.844821][ T5962] ? __pfx___dev_queue_xmit+0x10/0x10 [ 296.844844][ T5962] ? __copy_skb_header+0xa7/0x550 [ 296.844866][ T5962] ? __asan_memcpy+0x40/0x70 [ 296.844888][ T5962] ? __pskb_copy_fclone+0x9b5/0xfb0 [ 296.844911][ T5962] ? __asan_memcpy+0x40/0x70 [ 296.844933][ T5962] ? __pskb_copy_fclone+0x9b5/0xfb0 [ 296.844960][ T5962] ? hsr_addr_subst_dest+0x307/0xac0 [ 296.844983][ T5962] hsr_forward_skb+0x158b/0x2860 [ 296.845012][ T5962] ? hsr_forward_skb+0x9e/0x2860 [ 296.845037][ T5962] ? __pfx_hsr_forward_skb+0x10/0x10 [ 296.845059][ T5962] ? do_raw_spin_lock+0x121/0x290 [ 296.845078][ T5962] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 296.845097][ T5962] ? hsr_dev_xmit+0x19a/0x220 [ 296.845118][ T5962] hsr_dev_xmit+0x1a5/0x220 [ 296.845138][ T5962] dev_hard_start_xmit+0x2d4/0x830 [ 296.845166][ T5962] __dev_queue_xmit+0x1adf/0x3a70 [ 296.845192][ T5962] ? __dev_queue_xmit+0x27e/0x3a70 [ 296.845220][ T5962] ? __pfx___dev_queue_xmit+0x10/0x10 [ 296.845243][ T5962] ? read_seqbegin+0x122/0x250 [ 296.845261][ T5962] ? neigh_connected_output+0x1ea/0x460 [ 296.845277][ T5962] ? lockdep_hardirqs_on+0x9c/0x150 [ 296.845302][ T5962] ? read_seqbegin+0x1ac/0x250 [ 296.845316][ T5962] ? __pfx_read_seqbegin+0x10/0x10 [ 296.845331][ T5962] ? eth_header+0x11b/0x200 [ 296.845352][ T5962] ? __asan_memcpy+0x40/0x70 [ 296.845384][ T5962] ip6_finish_output2+0x11fb/0x16a0 [ 296.845408][ T5962] ? ip6_finish_output2+0x701/0x16a0 [ 296.845432][ T5962] ? __pfx_ip6_finish_output2+0x10/0x10 [ 296.845455][ T5962] ? ip6_mtu+0x7d/0x3f0 [ 296.845474][ T5962] ? ip6_mtu+0x7d/0x3f0 [ 296.845493][ T5962] ip6_finish_output+0x234/0x7d0 [ 296.845513][ T5962] NF_HOOK+0x9e/0x380 [ 296.845533][ T5962] ? NF_HOOK+0x101/0x380 [ 296.845552][ T5962] ? __pfx_NF_HOOK+0x10/0x10 [ 296.845573][ T5962] ? __pfx_dst_output+0x10/0x10 [ 296.845592][ T5962] ? icmp6_dst_alloc+0x3a5/0x420 [ 296.845619][ T5962] ? icmp6_dst_alloc+0x3a5/0x420 [ 296.845640][ T5962] mld_sendpack+0x800/0xd80 [ 296.845666][ T5962] ? mld_sendpack+0x1de/0xd80 [ 296.845686][ T5962] ? __pfx_mld_sendpack+0x10/0x10 [ 296.845714][ T5962] mld_ifc_work+0x835/0xde0 [ 296.845734][ T5962] ? _raw_spin_unlock_irq+0x23/0x50 [ 296.845756][ T5962] ? process_scheduled_works+0x9ef/0x17b0 [ 296.845781][ T5962] process_scheduled_works+0xae1/0x17b0 [ 296.845816][ T5962] ? __pfx_process_scheduled_works+0x10/0x10 [ 296.845846][ T5962] worker_thread+0x8a0/0xda0 [ 296.845861][ T5962] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 296.845887][ T5962] ? __kthread_parkme+0x7b/0x200 [ 296.845906][ T5962] kthread+0x70e/0x8a0 [ 296.845924][ T5962] ? __pfx_worker_thread+0x10/0x10 [ 296.845949][ T5962] ? __pfx_kthread+0x10/0x10 [ 296.845966][ T5962] ? _raw_spin_unlock_irq+0x23/0x50 [ 296.845988][ T5962] ? lockdep_hardirqs_on+0x9c/0x150 [ 296.846011][ T5962] ? __pfx_kthread+0x10/0x10 [ 296.846030][ T5962] ret_from_fork+0x3fc/0x770 [ 296.846054][ T5962] ? __pfx_ret_from_fork+0x10/0x10 [ 296.846078][ T5962] ? __switch_to_asm+0x39/0x70 [ 296.846094][ T5962] ? __switch_to_asm+0x33/0x70 [ 296.846109][ T5962] ? __pfx_kthread+0x10/0x10 [ 296.846127][ T5962] ret_from_fork_asm+0x1a/0x30 [ 296.846149][ T5962] [ 297.499544][ T8621] netlink: 32 bytes leftover after parsing attributes in process `syz.0.765'. [ 297.727576][ T5962] usb 5-1: USB disconnect, device number 56 [ 297.804431][ T5906] usb 1-1: new low-speed USB device number 35 using dummy_hcd [ 297.872210][ T2156] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 298.002481][ T5906] usb 1-1: device descriptor read/64, error -71 [ 298.084231][ T2156] usb 4-1: config 0 has no interfaces? [ 298.163302][ T2156] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 298.175237][ T2156] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.183797][ T2156] usb 4-1: Product: syz [ 298.188997][ T2156] usb 4-1: Manufacturer: syz [ 298.219075][ T2156] usb 4-1: SerialNumber: syz [ 298.241826][ T2156] usb 4-1: config 0 descriptor?? [ 298.262181][ T5906] usb 1-1: new low-speed USB device number 36 using dummy_hcd [ 298.392207][ T5906] usb 1-1: device descriptor read/64, error -71 [ 298.516876][ T8625] pimreg: entered allmulticast mode [ 298.522359][ T5906] usb usb1-port1: attempt power cycle [ 298.571618][ T8634] pimreg: left allmulticast mode [ 298.862236][ T5906] usb 1-1: new low-speed USB device number 37 using dummy_hcd [ 298.883593][ T5906] usb 1-1: device descriptor read/8, error -71 [ 299.122252][ T5906] usb 1-1: new low-speed USB device number 38 using dummy_hcd [ 299.142708][ T5906] usb 1-1: device descriptor read/8, error -71 [ 299.252820][ T5906] usb usb1-port1: unable to enumerate USB device [ 299.784675][ T5906] usb 4-1: USB disconnect, device number 47