last executing test programs: 30.229685173s ago: executing program 2 (id=2844): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000300)='blkio.throttle.io_serviced_recursive\x00', 0x0, 0x0) preadv(r3, &(0x7f00000000c0)=[{&(0x7f0000000240)=""/140, 0x8c}], 0x1, 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) r5 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0xd18c9b35, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030036000b05d25a806c8c6f94f90224fc60100005000a000200053582c137153e37000c0980fc0b10000300", 0x33fe0}], 0x1}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0xfc5e, 0x1}) openat$rdma_cm(0xffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r6}) ioctl$DRM_IOCTL_MODE_CURSOR(r3, 0xc01c64a3, &(0x7f0000000000)={0x1, r6, 0x1000, 0x9, 0x53, 0x4, 0x3}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = socket$inet6(0xa, 0x3, 0x6) socket(0x14, 0x80000, 0x9) connect$inet6(r7, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000340)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@mcast2, 0x0, 0x0, 0x1, 0x4, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0xbd1, 0x0, 0x3}, {0x81, 0x2}, 0x1fffffc, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7ffc, 0x2b}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1, 0x0, 0x0, 0x7, 0x7, 0x0, 0x2}}, 0xe4) sendmmsg(r7, &(0x7f0000000480), 0x2e9, 0xffe0) 12.741771715s ago: executing program 3 (id=2910): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x10000000}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket(0x11, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r3, &(0x7f0000000180)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @dev}, 0x14) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000004b00)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000440)="a25e517a0ba797cd49921a2bf3c4d9fbff027d4d71ae80d99867b3740698be4b94d3b5", 0x23}], 0x1, 0x0, 0x0, 0x44000}}], 0x1, 0x0) sendmsg$netlink(r3, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000400)=ANY=[@ANYBLOB="02011400012918000e1a80009f0001140000002f0600ac141430e0000001808a8972bd0b72e41082b1a3d206"], 0xdd12}], 0x1, 0x0, 0x0, 0x4000007}, 0x1) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) unshare(0x22020400) pselect6(0x40, &(0x7f00000000c0)={0x3, 0x401, 0x59eccd1, 0x1, 0x0, 0x5}, &(0x7f0000000240)={0x18, 0x0, 0x1, 0x100000007, 0x2e63, 0x1200, 0x8000000000000, 0x10000}, 0x0, 0x0, 0x0) 12.590423703s ago: executing program 3 (id=2911): dup(0xffffffffffffffff) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000002c0)={0x9, 0x0, 0x5}, 0x20) sendto$inet6(r0, &(0x7f0000000580)="03", 0x34000, 0xfe800000, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 12.296873713s ago: executing program 1 (id=2913): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) write$binfmt_register(0xffffffffffffffff, &(0x7f0000000040)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x356, 0x3a, '\xf1', 0x3a, '', 0x3a, './file0', 0x3a, [0x50]}, 0x29) socket$inet_sctp(0x2, 0x5, 0x84) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_netfilter(r0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82187202, &(0x7f0000000300)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x8b, 0x6576, 0x9}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r4, 0x100000) r5 = socket(0x10, 0x3, 0x0) write(r5, &(0x7f0000000240)="2600000011003f20000000bf8a9d719797efcee3130000000d39036892f3f77156c2aea30a4b", 0x26) close_range(0xffffffffffffffff, r5, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) r6 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f0000000040)={0x1, 0x1, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xe1000, 0x280000b, 0x28011, r6, 0x0) socket$nl_route(0x10, 0x3, 0x0) creat(&(0x7f00000001c0)='./bus\x00', 0x40) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6}]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) 11.537669943s ago: executing program 3 (id=2917): syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="120100004b41460860163209ea800102030109021e0001000000000904"], 0x0) r0 = openat$sndseq(0xffffff9c, &(0x7f0000001240), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0x40a45323, &(0x7f00000000c0)={{0x80}, 'port0\x00'}) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x4) socket$netlink(0x10, 0x3, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x101440, 0x0) syz_io_uring_setup(0x7a, 0x0, &(0x7f0000000180), &(0x7f00000001c0)) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f00009f6000/0x4000)=nil, 0x4000, 0xb635773f06ebbeee, 0x4000010, 0xffffffffffffffff, 0xf204f000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) read(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x0, 0x48810) syz_open_dev$media(0x0, 0x66, 0x180502) pwritev(0xffffffffffffffff, &(0x7f0000000540)=[{&(0x7f0000000040)='_O', 0x2}], 0x1, 0x1, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000002ec0)=[{{&(0x7f0000000280)=@rc={0x1f, @none}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000340)=""/57, 0x39}, {&(0x7f00000003c0)=""/160, 0xa0}, {&(0x7f0000000480)=""/20, 0x14}, {&(0x7f0000000580)=""/141, 0x8d}, {&(0x7f0000000640)=""/226, 0xe2}, {&(0x7f0000000740)=""/245, 0xf5}], 0x6, &(0x7f0000000840)=""/97, 0x61}, 0xfffffffe}, {{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000500)=""/31, 0x1f}, {&(0x7f00000008c0)=""/121, 0x79}, {&(0x7f0000000b00)=""/46, 0x2e}, {&(0x7f0000000980)=""/53, 0x35}], 0x4, &(0x7f0000000a00)=""/71, 0x47}, 0x154}, {{&(0x7f0000000a80)=@sco={0x1f, @none}, 0x80, &(0x7f0000000ec0), 0x0, &(0x7f0000000f00)=""/77, 0x4d}, 0x80000001}, {{&(0x7f0000000f80)=@rc={0x1f, @fixed}, 0x80, &(0x7f0000001200)=[{&(0x7f0000001000)=""/241, 0xf1}, {&(0x7f0000001100)=""/185, 0xb9}, {&(0x7f00000011c0)=""/50, 0x32}, {&(0x7f0000002280)=""/66, 0x42}, {&(0x7f0000002300)=""/157, 0x9d}, {&(0x7f00000023c0)=""/169, 0xa9}], 0x6, &(0x7f0000002480)=""/239, 0xef}, 0x1}, {{&(0x7f0000002580)=@l2tp6={0xa, 0x0, 0x0, @private1}, 0x80, &(0x7f0000002740)=[{&(0x7f0000002600)=""/84, 0x54}, {&(0x7f0000002680)=""/175, 0xaf}], 0x2}, 0x327196b3}, {{&(0x7f0000002780)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, &(0x7f0000002d80)=[{&(0x7f0000002800)=""/215, 0xd7}, {&(0x7f0000002900)=""/24, 0x18}, {&(0x7f0000002940)=""/131, 0x83}, {&(0x7f0000002a00)=""/141, 0x8d}, {&(0x7f0000002ac0)=""/174, 0xae}, {&(0x7f0000002b80)=""/51, 0x33}, {&(0x7f0000002bc0)=""/220, 0xdc}, {&(0x7f0000002cc0)=""/162, 0xa2}], 0x8, &(0x7f0000002dc0)=""/221, 0xdd}, 0x2}], 0x6, 0x2, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, 0x0, 0x8, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r2, 0x0) connect$unix(r1, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r3 = socket$unix(0x1, 0x1, 0x0) unshare(0x2c060000) unshare(0x24020400) connect$unix(r3, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r2) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB(0xffffffffffffffff, 0xc01c64ae, &(0x7f0000000940)={0x0, 0x80000, 0x0, 0xa07, 0x1e, 0x19, 0xffffffff}) 10.28399977s ago: executing program 3 (id=2919): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x11012, r0, 0x0) modify_ldt$write(0x1, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) getrlimit(0xf, &(0x7f0000000040)) syz_clone(0x640c7400, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_TIMERSLACK(0x1d, 0xb) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2e, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x15523ea56aa22b9a, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r5, 0x47bc, 0x0, 0x20, 0x0, 0x52) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) dup(r8) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x9) 10.13027973s ago: executing program 4 (id=2920): socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet6(0xa, 0x3, 0xff) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000000)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="020500020e00000000000000072e9eca7bd039bd7a41d0d999000e000a004e24fffffffdfc010000000002000000988500000000003df3684f00000004d400810005000500000000000a004e22fffff800fc017f8100000000000000004000"/105], 0x70}, 0x1, 0x400000000000000}, 0x0) r4 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x10100, 0x3}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) syz_emit_ethernet(0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB="9b4307000001aaaaaaaaaa000800bc41d14286078bff0001907800000000ffffffffe0009078fffd000062c272fabd74b471b3729d9d2a4566fa8989f867af6040394faffadbfee521aae0cc03c057b95534675ce30b"], 0x0) io_uring_enter(r4, 0x48e9, 0x0, 0x2, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000480)={0xa, 0xfffe, 0x3, @private0, 0x5}, 0x1c) syz_open_dev$vivid(&(0x7f0000000080), 0x3, 0x2) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) r7 = dup2(r2, r2) r8 = socket(0x2b, 0x1, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0xc2a, 0x10100}, &(0x7f0000000180), &(0x7f0000000300)) r9 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r9, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x8000000, 0x0, 0xff, 0x1}, 0x20) futex(&(0x7f00000000c0)=0x1, 0x5, 0x2, &(0x7f0000000100)={0x0, 0x3938700}, &(0x7f0000000140)=0x2, 0x1) r10 = socket(0x2b, 0x1, 0x1) bind$inet6(r10, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @mcast1, 0xb}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000000180)={@mcast1, 0x8000000, 0x0, 0xff, 0x0, 0x4}, 0x20) sendmmsg$unix(r7, &(0x7f0000008380), 0x400000000000174, 0x4008890) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r11 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r11, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) 8.916734923s ago: executing program 3 (id=2921): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) mmap(&(0x7f0000068000/0x2000)=nil, 0x2000, 0x8, 0x110, r0, 0x64b26000) socket(0x10, 0x3, 0x0) socket$kcm(0x11, 0x2, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000880)={[0x200000000]}, 0x8, 0x800) io_setup(0x206, &(0x7f0000000300)=0x0) io_submit(r1, 0x0, 0x0) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)={0x3, 0x2}, 0x4) r2 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x3, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x15523ea56aa22b9a, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r2, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xb) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x7d98, 0x0) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 8.753144363s ago: executing program 1 (id=2922): socket$nl_route(0x10, 0x3, 0x0) unshare(0x22020400) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000009c0)={r0}, 0x4) syz_usbip_server_init(0x1) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) socket(0x2a, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x22) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)}, &(0x7f0000000140)=0xc) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x300000e, 0x2172, 0xffffffffffffffff, 0x0) socket(0x2, 0x80805, 0x0) rmdir(&(0x7f0000000140)='./cgroup/../file0\x00') r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x84, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x5c, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x6}, @NFTA_XFRM_DIR={0x5}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}, {0x2c, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_CMP_DATA={0xc, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, "ac"}]}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xf8}, 0x1, 0x0, 0x0, 0x4}, 0x0) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) ioctl$KVM_CREATE_PIT2(r7, 0x4040ae77, &(0x7f0000000040)) add_key$fscrypt_v1(&(0x7f0000000040), 0x0, 0x0, 0x0, 0xfffffffffffffffd) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_PIT(r7, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x0, 0x0, 0x5, 0x1, 0x0, 0x0, 0x0, 0x0, 0xff}, {0x8000000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfd, 0x0, 0x0, 0x0, 0x800000000000000}, {0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}], 0xfffffffc}) 8.196127859s ago: executing program 0 (id=2925): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000000)=0x10000) syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, 0x500) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) lsm_set_self_attr(0x68, 0x0, 0x20, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r4 = syz_open_dev$usbfs(0x0, 0x76, 0x101301) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r7, &(0x7f00000001c0)=[{&(0x7f0000001400)=""/227, 0x10}], 0x4) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r6, 0x8983, &(0x7f0000000080)={0x0, 'syzkaller1\x00', {0x4}, 0x1}) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) r9 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r9, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r9, 0xc058560f, &(0x7f0000000180)=@multiplanar_fd={0x3, 0x0, 0x4, 0x4, 0x1, {}, {0x5, 0x0, 0x6, 0xb6, 0xe, 0xf8, "48b3dafa"}, 0xe0ed, 0x4, {&(0x7f0000000240)=[{0x81, 0x5e4a, {}, 0x6}, {0x81, 0x9, {}, 0x1ff}]}, 0x30d}) ioctl$vim2m_VIDIOC_STREAMOFF(r9, 0x40045612, &(0x7f0000000080)=0x2) close_range(r5, 0xffffffffffffffff, 0x0) ioctl$USBDEVFS_CLEAR_HALT(r4, 0xc0105502, &(0x7f0000000300)={0x1, 0x1}) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) write$binfmt_script(r1, &(0x7f00000002c0)={'#! ', './file0'}, 0xb) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000100)={@local}) 7.624097259s ago: executing program 1 (id=2926): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendto$inet6(r0, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @mcast2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000005440)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)='\x00', 0x1}], 0x1}}], 0x1, 0x400c404) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6}]}) fanotify_init(0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000000ac0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000440)='T', 0x1}], 0x1}}], 0x1, 0x4040005) 7.406756758s ago: executing program 4 (id=2927): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000040)) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000014c0)={&(0x7f0000ff6000/0x2000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000000340)=0x14) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cgroup_procs(r3, 0x0, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0x4000000044402, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) futex(&(0x7f000000cffc), 0x9, 0x0, 0x0, 0x0, 0x80) futex(&(0x7f000000cffc), 0x5, 0x300, 0x0, &(0x7f00000000c0), 0x1000000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000080)={0x7, 0x3, 0xffff, 0x9, 0x8, 0x7871}) 6.718055915s ago: executing program 1 (id=2928): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000005e00cb7b23bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0500dd00"], 0x1c}, 0x1, 0x0, 0x0, 0x4040040}, 0x4c000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) truncate(0x0, 0x8a) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r4 = syz_open_dev$video4linux(&(0x7f00000017c0), 0x5, 0x0) ioctl$VIDIOC_SUBDEV_G_EDID(r4, 0xc0285628, 0x0) futex_waitv(0x0, 0x0, 0x0, 0x0, 0x1) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000080)=@raw={'raw\x00', 0x8, 0x3, 0x254, 0x100, 0xffffffff, 0xffffffff, 0x100, 0xffffffff, 0x1f0, 0xffffffff, 0xffffffff, 0x1f0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev, [], [], 'batadv0\x00', 'wg1\x00', {}, {}, 0x6}, 0x0, 0xa4, 0xc8, 0x0, {0x0, 0x4c00}}, @common=@inet=@TCPMSS={0x24, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@uncond, 0x0, 0xa4, 0xc4}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x2b0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, 0x0, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8041, 0x0) ioctl$TCSETS(r6, 0x40045431, &(0x7f0000000dc0)={0x0, 0x1, 0x0, 0x0, 0x7, "00629a7d82090100000000000000f7fffffb00"}) r7 = ioctl$TIOCGPTPEER(r6, 0x5441, 0x0) mremap(&(0x7f0000897000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000054000/0x3000)=nil) dup3(r7, r6, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000180)=0x1, 0x4) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x60, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x4}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x60}}, 0x0) 6.092798787s ago: executing program 3 (id=2929): epoll_create(0x81) r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0xd01, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = dup(r3) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f00000000c0)=0xffff) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc00c64b5, &(0x7f0000000300)={&(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0], 0x4}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000500)={&(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000440)=[0x0], &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0], 0x6, 0x5, 0x1, 0x4}) ioctl$DRM_IOCTL_MODE_GETPLANE(r4, 0xc02064b6, &(0x7f0000000580)={r5, 0x0, r6, 0x0, 0x0, 0x4, &(0x7f0000000540)=[0x0, 0x0, 0x0, 0x0]}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r9, @ANYBLOB="0c00990000000000000000000800a0004e16000008009f000d000000080026000816"], 0x40}}, 0x200040b4) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vxcan1\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18020100000000000000000006010000504af4ff1000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x1f, &(0x7f0000000000)=""/31, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x43}, 0x94) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x64, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xb}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x80) bind$can_j1939(r0, &(0x7f0000000100)={0x1d, r10, 0x0, {0x2, 0x1, 0x4}}, 0x18) sendmsg$can_j1939(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x1d, 0x0, 0x16, {0x0, 0x1e1, 0x3}, 0x1}, 0x18, &(0x7f00000004c0)={0x0}}, 0x0) 5.825644129s ago: executing program 4 (id=2930): connect$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x14) syz_usb_disconnect(0xffffffffffffffff) clock_gettime(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000140)=0x7fc, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, &(0x7f0000000080)=0x1, 0x4) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0xf, @empty, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000ac0)=[{{&(0x7f0000000440)={0xa, 0x4e20, 0x2, @empty, 0x206}, 0x1c, 0x0}}], 0x1, 0x200c8059) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r1, 0xffffffffffffffff, 0x0) 5.603358009s ago: executing program 2 (id=2855): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000400)={0xfffffffd, 0x5, 0x0, 'queue0\x00', 0x8}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002580)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f00000034c0)={0x2020}, 0xcac) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000000380)) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/timer\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f0000001d00)={0x2020}, 0x2020) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, 0x0) openat$vga_arbiter(0xffffff9c, &(0x7f00000001c0), 0x40200, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001300)=@newtfilter={0xe84, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r8, {0x0, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_fw={{0x7}, {0xe58, 0x2, [@TCA_FW_ACT={0xe54, 0x4, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0xa68, 0x7, 0x10000004, 0xd, 0x4749}, 0x4}, [{0x2, 0x8, 0x94, 0x6, 0x2, 0x3}, {0x5, 0x3ff, 0x1, 0x3, 0x9a5, 0x716}, {0x4, 0xad3, 0x2, 0x5, 0x6, 0x8}, {0xfffffff8, 0x9, 0x9, 0xf, 0x0, 0xf2a}, {0x6, 0x5, 0x38b, 0x6, 0xfff}, {0x8, 0x0, 0x101, 0x400, 0x5, 0xfffffffa}, {0x6, 0xe23, 0xb5, 0x665, 0xfffffffc, 0x2}, {0x80000001, 0x0, 0xd28, 0x8, 0x8001, 0x3}, {0x438, 0xf4, 0x5, 0x4, 0x1, 0x1ff}, {0x1, 0x7, 0x5, 0x4, 0x6, 0xfff}, {0x1, 0x3, 0x97, 0xb, 0x8000, 0x5}, {0x9, 0x237, 0x3, 0x6, 0x3, 0x7}, {0x9, 0x9, 0x40, 0x4, 0x4, 0x5}, {0x6, 0x4084, 0x7fffffff, 0x6, 0x9, 0xa3}, {0x8, 0x62, 0x5, 0x200, 0x8000, 0xbd}, {0x1, 0x0, 0x4, 0x3, 0x8, 0x6}, {0x10, 0x3, 0x80000000, 0x4, 0x7, 0x5}, {0x2, 0x0, 0x1, 0x5, 0x9, 0x10}, {0x7, 0xb, 0x9, 0x8, 0xffffffff, 0x9}, {0x5, 0x7, 0xffffffc0, 0x7, 0xa479, 0x5}, {0x7ff, 0x0, 0x9, 0xe5a0, 0x101, 0x5}, {0xef, 0xa, 0x3ff, 0xfffffffd, 0xd2, 0x7}, {0x0, 0x6, 0x3, 0x7fffffff, 0x3, 0x5852aea0}, {0x800, 0x8, 0x24, 0x8, 0x6, 0x7}, {0x69b, 0x2, 0x8b, 0x7fff, 0xd, 0x6}, {0x7, 0x4, 0xffff, 0x8, 0x1, 0x1}, {0xa431, 0x3, 0xfd, 0x9b, 0x7, 0x7}, {0x0, 0x3, 0x7, 0x6, 0x3, 0x5}, {0x80000000, 0x6, 0x9, 0x7, 0xe275, 0x8c27}, {0x8, 0x8, 0x1, 0x9, 0x8}, {0x109, 0x6, 0x2, 0x6a, 0x80000001, 0x9}, {0x80000001, 0x7, 0xa, 0x6ba9, 0xcc00, 0xff}, {0x1807, 0x100, 0x6, 0x10000, 0x200, 0x1000}, {0x3, 0x5, 0x10001, 0x3, 0x3f67, 0x9bf}, {0x6, 0x9, 0x4, 0xfffffffe, 0xfffffffb, 0x8}, {0x0, 0xd, 0x1, 0x2, 0x6, 0x6}, {0x5, 0xe9, 0x4734e285, 0x4a, 0x7, 0x2}, {0xfffffffc, 0x5, 0xfffffff8, 0x0, 0x6, 0xd82}, {0x1, 0xfffffff9, 0x9, 0x3, 0x8}, {0x80, 0xe, 0x40000, 0x7, 0x8, 0x2e000}, {0x5, 0x7, 0x6, 0x5, 0x4, 0x2}, {0x7, 0x22b, 0xa181, 0x4, 0x497edc19, 0x8b0c}, {0x4a3, 0x21, 0x3, 0x1, 0x1d, 0x8}, {0x5, 0x1, 0x0, 0x7dcd, 0x3, 0xad}, {0x0, 0x2, 0x8, 0x6fb2, 0x3, 0x7fffffff}, {0x2, 0x7fffffff, 0xfffffff8, 0x7, 0x9, 0x6}, {0x8, 0x3, 0x8, 0x3, 0x361, 0x2}, {0x2, 0x7, 0xffffffff, 0xa, 0x6, 0x9}, {0x6, 0x3, 0xc33, 0x400, 0x800, 0x5}, {0x101, 0x7f, 0x71f, 0xf0, 0x80000001, 0x3}, {0xb698, 0xffffffff, 0x9, 0x8001, 0xbf, 0xf}, {0x6, 0x1, 0x97d3, 0x6, 0x5, 0x7}, {0x2, 0xd7a40, 0xfff, 0xc00, 0x3ff, 0x1}, {0x401, 0x200, 0x9, 0x3, 0xb, 0x8dd}, {0x3, 0x4a, 0x10, 0x9, 0xf5cb, 0x4ca}, {0x5, 0xff, 0x9, 0x904, 0x31bf}, {0xfffffffd, 0x5, 0x1, 0xcaf, 0x9, 0xfffffffd}, {0x400, 0x6, 0x8, 0x695, 0xffff11a3, 0x8}, {0x1ff, 0x4, 0x8000, 0x3, 0x9, 0xd0e}, {0x2, 0x6, 0x5, 0x6, 0x5, 0x8000}, {0x3d86, 0x2, 0x2, 0x3, 0x7, 0x963}, {0x7, 0x9, 0x7, 0xe, 0x9, 0x7}, {0x686, 0xc1f, 0x4f, 0x0, 0x4}, {0x7, 0x6, 0x100, 0xc, 0x8, 0xfffff000}, {0x7, 0x1, 0x3, 0x0, 0x8, 0x7}, {0xfffffff7, 0x9, 0x9, 0xffffffff, 0x7, 0x1}, {0x4, 0x2, 0x6, 0x200, 0x4, 0x1}, {0x3, 0x1, 0x120, 0xe4f1, 0x8, 0x9}, {0xfffffffa, 0x648c, 0x3, 0x170f, 0x9, 0x906}, {0x80000001, 0x40, 0x10001, 0xb, 0x38, 0x7fffffff}, {0x4, 0x6, 0xcb53, 0xfffffbff, 0x94, 0x4}, {0x2, 0x8, 0x1, 0x8, 0x100, 0x2}, {0x4b4, 0x5, 0xe7e8, 0x2, 0xc86, 0xffffe589}, {0xffff7fff, 0x7fffffff, 0x9, 0xffffffff, 0x5, 0x9}, {0x2, 0x1, 0x7fffffff, 0x0, 0x1fe4, 0x1}, {0xc011, 0x8, 0x1, 0x2, 0x1ff, 0xf}, {0x7, 0x10, 0x0, 0x0, 0x3}, {0x0, 0x100, 0x9, 0x0, 0x80000000, 0x1}, {0x8, 0x800, 0x1f, 0x6, 0xff, 0xb}, {0xfffffffb, 0x2, 0x4, 0x7, 0x4, 0xfff}, {0x23, 0x7fffffff, 0xfcb8565, 0x6, 0x81, 0xffffffff}, {0x80000001, 0x2, 0x9, 0x98, 0x4, 0x800}, {0xfffff801, 0x7c, 0x6c31, 0x9, 0xc, 0xb}, {0x10000, 0x3ff, 0x7, 0x8, 0xe, 0x8}, {0xeef3, 0x4, 0x1, 0xa, 0x5, 0x9}, {0x6, 0x40, 0xfff, 0x6, 0x4, 0x8}, {0x30c, 0xcaf879b, 0x0, 0x3, 0x3, 0x6}, {0x101, 0x4, 0x4, 0x7, 0x7, 0x392}, {0x1, 0x6, 0xfff, 0xb1, 0x2, 0x143c5166}, {0x7f, 0x636bb91, 0x7, 0xca, 0x2000036, 0x2}, {0xffffffff, 0x5, 0xfffffff4, 0x7fff, 0x7f, 0xffff}, {0x101, 0x800, 0xde3, 0x0, 0x1, 0x3}, {0xc10, 0xb0, 0x1, 0x4d, 0xfff, 0x3}, {0x9, 0xdb, 0x400, 0x0, 0x0, 0xfffffffd}, {0x39, 0xc, 0x9, 0x5, 0x100, 0x8}, {0x9, 0xc2f, 0x8, 0xe31, 0x3, 0x6}, {0x3, 0x2, 0x7fffffff, 0x3, 0x2, 0xe}, {0x101, 0x3ff, 0x3, 0x6, 0x7, 0x6}, {0x1, 0xd, 0xfc5, 0xffff, 0x9, 0xfffffffd}, {0x2a, 0x7, 0x2, 0x9, 0xfff, 0x4}, {0xf, 0x7ff, 0x6, 0x4, 0x4, 0x2}, {0x5, 0xdb, 0x1, 0x2, 0x7fffffff, 0x9}, {0x0, 0x30, 0x9, 0x6660, 0xc0aa2e0, 0x6}, {0x1000, 0x2, 0x9, 0x3, 0x5d5, 0x9}, {0x2, 0x5, 0x5, 0x7, 0x7, 0x7}, {0xe559, 0x3, 0xe31, 0x8001, 0x4, 0xffffffff}, {0x3, 0x6, 0x8, 0x800, 0x5, 0x1}, {0x1, 0x58b72238, 0x4, 0xa36, 0x0, 0x9}, {0x8, 0x66, 0x8, 0x2, 0x5, 0x81}, {0x6, 0x0, 0x6, 0x3, 0x0, 0x7}, {0x6, 0x8, 0x8, 0x0, 0x2ff92517, 0x2e}, {0x10000, 0x948c, 0x3, 0x5, 0x0, 0xf226}, {0x2c, 0x0, 0x6, 0x1, 0x5, 0x124}, {0x5, 0x8, 0xb, 0x3, 0x2, 0x8}, {0x4, 0x9, 0x0, 0xfffffeff, 0x8, 0x2}, {0x0, 0xe3d, 0x8, 0x2, 0x0, 0x3}, {0x7, 0xbf43, 0xffff972b, 0x9, 0xe, 0x1}, {0x1000000, 0x8, 0x8, 0x8, 0x6, 0x4}, {0x1000, 0x7, 0x7fffffff, 0x9, 0x137, 0xfff}, {0x8, 0x5, 0x9, 0x5, 0x0, 0x100}, {0x7fffffff, 0x5, 0x2, 0x7698d897, 0x4, 0x24}, {0x9, 0x101, 0x100, 0x401, 0x5, 0x6}, {0xac84389, 0x36253a1c, 0x8, 0x5, 0xff, 0x401}, {0x7db5, 0xf, 0x800, 0x1000}, {0x99, 0x6, 0x7, 0xc441, 0xa, 0x7}, {0xbe8, 0x5, 0x5, 0x4, 0x7, 0x3}, {0x0, 0x4, 0x9, 0x562, 0x2, 0xffff}, {0x0, 0xffff, 0x3b, 0x2, 0x3, 0x389}], [{0x1, 0x1}, {}, {0x5}, {}, {0x2, 0x1}, {0x2}, {0x1}, {0x3}, {0x3, 0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x2}, {}, {0x4, 0x1}, {0x2, 0x1}, {0x5}, {0x4, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x1, 0x88bd0b579d2b5a38}, {0x4}, {0x3, 0x1}, {0x4, 0x1}, {0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x3}, {0x1}, {0x7, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x1}, {0x4}, {0x5}, {0x4}, {0x4}, {0x0, 0x1}, {0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x4}, {0x3, 0x1}, {0x4}, {0x3, 0x1}, {0x5}, {0x1}, {0x3, 0x1}, {0x1}, {0x5}, {0x3}, {0x2, 0x1}, {0x3}, {0x2, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x2}, {0x1, 0x1}, {0x4, 0x1}, {0x4}, {0x1}, {0x8048bb5975f18d75, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0xe66ec81e72c5feb1}, {0x4}, {0x4, 0x1}, {0x3, 0x1}, {0x2}, {0x2}, {0x4}, {}, {0x1, 0x1}, {0x1, 0x1}, {0x1}, {0x4}, {0x2, 0x1}, {0x4}, {0x2, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x7}, {0x4, 0x1}, {0x5}, {0x5, 0x1}, {0x2, 0x3bd539a9b35183f7}, {0x3}, {0x4}, {0x2}, {0x1, 0x1}, {0x2, 0x1}, {0x1}, {0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x2}, {0x0, 0x1}, {0x4}, {0x4}, {0x3}, {0x5}, {0x1}, {0x1}, {0x4}, {0x1}, {0xe, 0x1}, {0xb}, {0x5, 0x1}, {}, {}, {0x0, 0x1}, {0x5, 0x3}, {0x3, 0x1}, {0x3, 0x1}, {}, {0x1, 0x1}, {0x2}], 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0xe84}, 0x1, 0x0, 0x0, 0x81}, 0x800) 4.941182374s ago: executing program 2 (id=2932): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_open_dev$tty20(0xc, 0x4, 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x3000c003}, 0x80) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$cgroup_root(0xffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r2, &(0x7f00000000c0)='cgroup.freeze\x00', 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="54000000020601040000000000000000000000000c00078008000640000000010500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e657400000000bffb2648c216955eadf2594f9a8b282112759761b8fbd6cd305a1b3bfee9337edf84371ab0475b8ec7c4416bd2d503c975aaed22ca96f54d7d7cc8c089ab39"], 0x54}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='sched\x00') writev(r3, &(0x7f00000011c0)=[{&(0x7f0000000180)='P', 0x1}, {0x0}], 0x2) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) mlock2(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000083}, 0x80) 4.844980145s ago: executing program 0 (id=2933): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x34, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}, @NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xf4}}, 0x0) 4.778911503s ago: executing program 4 (id=2934): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000000ec0)={'syz0\x00', {0x7}, 0x0, [0x0, 0x5, 0x0, 0x0, 0x0, 0x95, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffe, 0x0, 0xffff], [0x400, 0x0, 0x0, 0xb16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1, 0x5a8fe2e2], [0x88000001, 0x0, 0x4, 0x0, 0x5, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x102, 0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4000, 0xfffffffd, 0xfffffff9, 0x0, 0x7, 0x101, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1000], [0xfffffffc, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x35, 0x0, 0x6, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x8, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000010c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000480)={{0x0, 0xefae, 0x0, 0x3}, 'syz1\x00', 0x4d}) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x2c0) ioctl$UI_DEV_CREATE(r1, 0x5501) close(0x3) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000080)={0x28, r2, 0x801, 0x70bd2c, 0x3, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x6, 0x23}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) 4.535476892s ago: executing program 0 (id=2935): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = epoll_create(0x69b) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, 0xffffffffffffffff, &(0x7f0000000340)={0x80000000}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000200)) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x8, 0x0, 0x3}, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, &(0x7f0000000000)={0x0, &(0x7f0000000140)}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000580)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff48700000020000005c0000000000000095000000000000002ba728041598d6fbd307ce99e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f071326bd9174842fa9ea4318123341cf9d90a0e168c1884d005d94f204e345c652fbc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc84e974a22a550d6f97181980400003e05df3ceb9f1feae5737ecaa81d666963c474c2a19eed87b277be335c75e04ad6ee1cbf9b0a4def23d410f6296b32ae343881dcc7b1b85f3c3d44aeaced3641110bec4e90a634196508000000000000f0f4ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d4dcecb0c005d2a1bcf9436e101040000f73902ebcf0200822775985b231f000000ccb0ecf31b715f5888b2a858ab3f11afc9bd08c676d2b89432fb465b3dad9d2aa7f1521bc9901de2eb879a15943b6dc8ea15aab9dd6968698e3095c4c5c7a156cec33a7bb727667d81ff2757ca1e6bfdd4c968dacf81e65998b9091957d1d11a5730baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba165d876defd3541772f26e27c44cfd7bb5097379cf1756869cebc7b0b2d85d6d29983e830a9cdd1d0a017c100344c52a6f387a1340a1c8889464f90c284a4db539621fbb70f01a2c02dec4cd1f570dd39877dfb2ff1ae66e1ce917474b2e650ae610afd01409d9a337ac5d58bcb5e5fc231514952c5255f22bd8b325d9b76e57f041b665ab0249886c0a65cc99d5893521372c8d8b7bacac24000020a4a24d8dbd75062e1daef9dead619cc6e7baa72706287793c3d2a2661edcd3545236c204682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b993508000000e480cd9d4850a049ee19b67d17ef0477aeb12b1d2502000000d9051f22614d1f62734d678039a97d2b74f9e8e97f4e8e7025123e783df8b8a17e3aa9fe9c502f9acee4f1b56e1f23128d743792cead3c058a5b700d64d160abe33df726608510136ce8bf239414a1d98ea93e3d35dbb6c23b90cf36e83b8a4309b402d264b09f2779a0bcd7cd6dfc06b02e69d384146056d125cf4aadd80800000000000000e88d10acd06864eac44c42fbe334bdc3e9768fc360b130dc6111fe3293e8e02f819a2aa34dba1c25be27945507a3477b437525b81aef2f0b4c4f63483026b5e34d44705b76ef29f7f6e0a2be625eae975e02069f6f24e1e1bc976d965ddabb01085f16bff63a06578d6d184f5de7bfb6aaa75f16996d8d60bd0111a8a237a1536256c02284cb1d3a6fb8eae87691fae365a70c3f15871565bba8dd8a8ca049f798bbe646f738bebdfc9d8a5edd7a19ca6a42bc3f1db37c17f22a287c6d31a13db5dfef409eb1d3c91c6e6f80d215c9e16e0c4736c81936315418f26770cca4e2f89800d18c89d7f46f679df6c9e2005f209dda94302a30003b952ae1ebfd0ca88368ee6ce139e8b5822422cf4c9dde943d34c432e1001171792c65986146666a549092398af45ba38c41df7e0fffeac41824ca1fd0eb68aa243c9035c788d5480e5aee9cde5f2e5a3628995b1531bd20360d33d8f9ffffff5f4bf6ea8a1850c4f83306dbca02ee3686da707b6d85db491ba0cc33f6be92c55969a2b52a25419d1476c73132ca7ca26ce8a7e3ffb700f09e157f9bc31f09834b4788be2a442aa81b259e9eb1bf5314844051f3a642aca9ff98c9036471ccff0522903e7bcf62e18f7796bbc280b95e8e0d6fd5644b0ebde330289d6348d183ed9d3dae3cccf109f7c78e8479a345e805e47dfa82cafc6b64b1f4659834aecbeded44b11a443c5ba92a326dd10921aa79c62800844c7a59f55ee205a11ab50fb402e7da6ada561ec1117cc186b01fd5c2061d22156b1b7d5f80c580dc31b0963ff953ce09148e8dfea9d03a61bbd2bb173518507a3cd0e37c4da0a71eee31071d5d642498181c69cee3b2e414ddd6a12ff4bdf6e96c247b6025d4376067e25357d3b521a5b927d3392a7503718aea24179528f6a0c6de4e61b49cad1e4d6b000000000000005b2d16877299acefc0655bc1422c3d425d988eedebcf242b780a687c9acae2a5a71c2a16a32ceb377f5d54f9b2fa90b2905925e611be56e9ebe20cab20c290a1f6c09272dbc3b2c0ab2b5baa1b07b16e81f278e54a479f1a06bc06e3656cfa196d6c050000000000000000814955c62a7d72b317399e572a7f6a4d57b741eb66c9179ffd097d61fcfd0fa1d46cfb110e3e8cff5579e83f2820f95eaa0c609f666950c24311740e36de8f65708cfffce788c99ef8f62fd2398e999b220125da8eb07947512365abbc5b84ef524bdf184727c67910051f204662264607d548dbdffe14b41dd0843cf3d85bb820656a88a9e52a4cd7b3eeadfe00007267f226019ef0a25bc15da71e893856a2182c3167d8ba73f709294b159a426ce44cd73f000000a66fc501eae0c3504c1400697ba69fd9b7eaf49aff6a6aea529610db8dfef86c3cc698e9fddf1b132876159972281a90c3a4cf415df25fbcdd35cf8368f068c4481844bdd0dda553e1cb0966d5686013d382956d50055dce0d1bc225c1d77612b1ec52e743dbc51f25cc07a202b704577316913cf067fa65e476f688de2d6c54ea192a569eed05d0d7536bccad5983b1cda09e723205c68d4ee0fe318ed3112c76dcf128a1d5595b773ef4c8a7ba4e10381de8808ff02dd0a7b996ecf1c65e6d9db90c87123d9cb3945330f7a270ee0cca35b1331ca8fec0b2f39f505140751b60f29a83e4bc0ef2ffea443e4aa221cc38a503add16a2c98cb589e1dac1912b4142a3be30f50b2d9479c5bde0beb38030d0c0ce0598700130000000000000000000000554361e1628ee0017ad19ca787f2c078aa260701ce0800000080623902000000000000000000003d118a04fa6a80c4928c01ccab57b5f4eb265ad15004f967543fe6e6ddc2a12165fe3a08bf9475ee0eee3539369b0e566fedbd215a6ddd4fe03dcc7a922e16410d820747b7e806c0f3b6f14c884d150a0ff07f2e0000bfb083c56d3bed0a61fab880f8885c612ebff8523d14cfb12aca274c000000005e5155611969f6e67dd83b20206207cb8b2cd2fab6fa6d7fdaed6a27a2e4db1d5adc80014ff11d9dbceba41d8dfce410333a054e82b1d050331ce0aeacb843b94d67f69f49eb4dd3b1b85b018359c32df01db8ebce0dbc36cade09c6b44f6bb956fac1ae4db5624d8a02f7be91bec65e4b3373059587dd6528bbc48e3379d477d482faff738c39c61cac1195043bd5b70cea5fc1083a169a8263e9aec56b9f7795fa27634a7f06359e3058d2dd69c4e5cc11b36d9ed9c4b2867f583de6fc582f789722bd1500e64c495abdb72de2c739d38c72f6f4fb1946081dcc825d5b5b747e9fa1b5226cd31e131263f1fcd7d45a630b46d04af906f0be464d829dd2dfcf7400002b7827f6d957e51bb1f1b44a50200c9dfadfaff2e32baa9c0edaac7144e174dba582a951d2b03c27219cec4fbc7b6e99c3f00188941e3fbf008cbace177ae250fd757a22e21ec05aa45c91e1345ca936184c3fc28153283e13654123cfaf4e661f4b6d430adad1e2116bc385f888405d48f0d386da0cc6747b33395772a68f2ea3fb7e7207000000b24088014c8e64f03d053c4e02ddd08b262e422eff1c9f124b892b0a9462b07d4f88c0693bd9c54ad2ab5227aa59ef2b53ac528c0800000000000000ebfde0c4a37c2d55c176680c4207000000e4aa467f995c9bc99e60441d4dbebead3b436427762618810bac7308c6d3298ea932b66572825e62d18462d3b2342ba48c145ff4674a94fa078cc552d064da2bb69a0d269076f8955076578f44ffb8895f11bd5e06840f8848df72230a28e0304569bfa0350b6dde9e96273de1758505aa1ba89dfb12be7a7c6dd18f6148354df7e60a489dc543ccdee1fff9d8f8d78844de27a77ef1181d5055c2a193a5763ed7749a17296c76818b60426082c86619dacc8a884c4de8572a044faf0c8e4377776c8703ecf2e3f1c3d64100cc000000008369f062639e3ddcf725be54f626448fb7bfc74c183b26e31b71a390ccea4be07278dd12fa16848797397b76908fa03613cd961b98b26a0879ccba4a78c82958764bce07a7f70df1cef6d4db1ddbda1db18e4f41c390fd3cb862216ece39a9ec60bd3be5f9329dcaf33bf2c87cc510557460d14421e1d26322ab64388f2ceae70922989f66827fe9acd2ec3ece39f3b4ffdc4dfea3da6ddb002512e2313253801044e751168e32d7bd6800000000a21008b8d26dabe977c503c30ef7c489e5ea1fff041e54de54cfeb258f2387dad096b72a78d91134927492cfc773c731cca9b13b3f6e7760ab0929c46f51ea5643f3df4f4044f3ad0a6ba739e72d8b8b2935d81534bea8372bc590c111d573e04280659a096eaa495a4154daae7d1800c130d920964845c50c8ba4763b19b6008f6d7a5091895c7a4b7816ab706503be879b18b778b0f61ecfde2f8bbb32cfeb766ec4430ee0ad45a0a263ddc4b2f47680c8d53439f8d388dab87112c83997c83e178be287eb6e8c95badaf8ed85cd5b03a7352a0fb83398566d1bc133582ce2d9f601cd23eba4432180b2d5c3019879cd949a5be1b241b3d0d0d52a3529cc9e704a9d8d54f4f7b776a969a4505e18fe5284985ca7d112c397d776e3baba918b7df456bd970e761e00f3b0efa5ce4246d9f08ba60da3be556c518a1f19504c7cea1491a9eadd27d747ca9cc5f92e30b2ca3cf0b142a8554c87e8026d4e586cf5f7c9d412e6eb4f66a076c8bca6b294305969dabb6c932b57a5dd4234bf1ed3bd095229ee3cbb86883d574c5af4bb78370561de3fbf55bfcd2db3979eb1be120b5795443324023353c959fd965702f1cd5bcb3c16d4b8bdd9fc87c862c247e140379ef098c7b3fa79a6638a245b6a74f14dde9bd4ee48e62cdc70f486ce38641e4e4309aa9f4bd097fa1530db966d9919544ab4890301e51f9525436f5d9591460340f5093161a78a249783945407f2576d6f35a99e3521d7991e3fdfde5ee7f6a8ff8181a68ef15a2ebfe9e22d7c745949ab5cc15b9f5659799b5e00debbf9f623f75bfd4d83c4859ca9b652cea33daeeef07b60c78a21965bcf91919071c7ded19317dc0b7587d9322f8cec9e32675a187465bdfa101bcd9ac680839b375af12c160247dd960e70eb7ee60c52a900440aa9bd9a6b15a4a34dc73c3c4936d8986300fdc264b28537df387e6442c3355fa2a31d24c1ed888a57fcc50400a084a38a3630ffc465f36a4b770fab0946148161184be39134542e934f3a538b011cb3928b430630b8ccc800000000881d4361e7fbd1fc2331b4e34733480bc497662a8234a7eeab3e65d6b0f5d92edff04416eedcd15b9ddbcb3cf9228afda6b17d44a276b205eabd0069f7e26aea50f537dc77b683ed83d2f9110e00a705f48e9d13378cf09bca22e8f45c4f360d5fff8ba35f21c4513bcc0800000000000000dc5cc7ad7290c60bc609bff9be7cd922f474c3faa78fd42cba7c78d6d912656b6313497625e2f9afaba05b17ca242b7ca8d6556175aee38142a8aac5f677c2f8a6967f2cb5e97aae97a5e5579a706243688ac4d38a4601b4aadb2d319fe7d6bf1272fa3fa701338d7bce390e8bf959081ed39e63a431901d615a26ff95e1620a6c26eda4f92d83499a173e7217001f58ed5406bdb59acbc997e8fd3d53b4c2c2a1b314bfe611e5958458af7b3c5319fdb4c40b8d01365fdee93af6fad7c7a8da86460f45c9e99d43264c921b090000000000000000000000000000000000007cf90000008f8a9da7a8a167815c6ffcd1b6863cde9ab45ecd8f06423198bb00cdf76877f407be46b000000000afbb4cb3a8de259a8beb2223f28b855e2bdf4b31b91e5062a42a55bd95e93f77f2499391cf0000000000000000000000000000195007ad27d1d61dc4d5512f117f0ed554c2c88c1713000000000000bb1ff447d6e12da22ee9f0422a84f361684861169f498909c4841f4d5a0f5807a3b7d833075fdcd9c1d169b03d7df7f4150fad8b9e92eaf86992adbda360dd91de51c6df335445492608162fb0804dabdeac6fb71042f906eefd37f1d190a1c8a0d9de7f34dcc8cbd7b565fc675f3bf7aac559411808ee703ec3ad461c6ddc571994cb504c46eabbc2ff4b97df394bc75b5e7f45b4450753b5d2b8b8414a7fe6a17661bdb5b1d080cfd974811e1d60763d8d9509c75aa729a334b55ee76b0c2d5027e81ceec1a6d7441d0b538d7a4d048d156ebcff102e45c15d2a73b40d74807f5182a319d50edbf430f00b1c29a9e4bd92111caacbb1d4541545c2d262646070da42f76e3f3c6d139eed89cc9300000000000000000000000000000000000072d7e605eb8e978d76796d9d3a728c51a3145da8e1ca4973aa8fed855328e9d2509335c5386cac74e862eac50e9ba95b6a2a29e8ef08a9ae29792e77fb9952b1ac5c816db5c23a656d9a28f81f6a9465aec94d701ee8646b30650c84b9510a337e82702baf368d29281d3d54b39014756ca5a1be184d4ebb942f99581a6fbac0b9c9f97c920dfac7e2379ef6bb076118aa9bbb4ee12e64aa530f852bf4f970a08a55531934e39fbae483129949a918115571d76740ca6a1cea59df290f2e63675ca30a289775825fe3e5d6f206f3f395346c0738035dc74368bb035fc65a40f8124369b8950ded31af64855cb18b23517ca935a0fa1b630d70c4ca9acbaf0f08910f327fba506d834029a90d47701102045fff90675adb3c83983d125ae730b9497c681a912a6bb70300a2d7fba051f82b9d6f710426b5bd0d0bc0b08a0f801276789613da406905011bd6ebbac91ff17a21d1ed0882e73394025772f31dc8a3048789c703da20c55746f6fc955046f9332d72150be23c26cbb08d1b438e84b83fefc6a16958fd46dc7b8cbea1da2d541324e373e9157696d698a0b4bc84d7cc2fdb069db8a5a491a9d2bbc0a61b73f75d81d07d778a1577db3b06d20a21b19ea17ecd996d7dea947ee8ce55fa2dea5a000000000000000000000000006f0143d8d4038ef9f57d9e9336f3559558710d1febe7394cf8b02f59dab24d07db3d3c1ebff58f973ba3fc0c3e2fb2c2a674a188614520ecb1d22b49e3550263bf9d669fba198b65ee3512db0e710d2070b5847face7ada12c83f0aea3a8c9e84e6c7406732c952c5695d43bca33d481ef9d442697875e114f4c759af306b3fc8224fdec89bf199234bff488b81438cbe89e4cabdc007139352b5cb69d7987cdf37ab549b7639eeadafd5315d9c9f0e8c9223102e6deaca4ae9cb943a3ad188bcad95e8f97d7fee7c47ea50d222fe67085b4fb3fecfb67dec23b6ab5ee19a5ca5367bff058149acf90a6c4014dea2b763389f77301ea8574d112625300906f480c36f41f82f84991800c37863de349f7"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x300000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002c00)={r3, 0x18000000000002a0, 0x42, 0x0, &(0x7f0000000500)="b9ff0300600d698cb89e14f008001f000c0cae0e4000632177fbac14140ee934a0a662079f4b4d2f87e5feca6aab845013f2325f1a39010108038da1924425181aa5", 0x0, 0x100, 0x60000000, 0x5c, 0xc0, &(0x7f0000000000), &(0x7f0000002c80)="8dc92a8ff39080a675b6565efa3ed46f2a2756e43abbfd8c44686c04d6a0c42f2599fc2b73f432c834dac249597b646035045af99decf86f5b32dc0404e599f56091e15e581ff6805ee283c0313298a5b8ba1c84f1850c217b5a2c2bc547eaf4585e5ba878d1660fa871a275fb61d1fec75942919083919f8d8fdad79615bc5d2d3fa40e054d38d49dfbebc2f137fc7110"}, 0x48) rt_sigaction(0x4, &(0x7f00000000c0)={0x0, 0x48000003, 0x0, {[0x2, 0x3f1]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x8, &(0x7f0000000300)) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="ffbf"]) write$FUSE_NOTIFY_STORE(r4, &(0x7f0000000140)={0x2a, 0x4, 0x0, {0x1, 0xffffffff, 0x2, 0x0, [0x0, 0x0]}}, 0x2a) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0042, 0x11) r6 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) writev(r6, &(0x7f0000000400)=[{&(0x7f0000000080)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000040)="aa1d484ea0fb0000f7fc08fcd111fbdf23ea32db0e8f21d5bc27bd49eb067a0689fff2a41cfbf0e9d85e44", 0x2b}], 0x2) write$tcp_mem(r5, &(0x7f0000000400)={0x6, 0x2d, 0x2, 0x3a, 0x0, 0x2c}, 0x48) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) 4.494998136s ago: executing program 2 (id=2936): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_emit_ethernet(0x3e, &(0x7f0000000040)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x1, 0x31, 0x30, 0x68, 0x0, 0x9, 0x1, 0x0, @rand_addr=0x64010102, @local}, @time_exceeded={0xb, 0x1, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x4, 0x4, 0x68, 0x2, 0x9, 0x4, 0x81, @remote, @rand_addr=0x64010105}}}}}}, 0x0) socket$isdn(0x22, 0x3, 0x11) r1 = dup(r0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x7, '\x00', 0x0, 0x0}, 0x50) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd1, &(0x7f0000000000)=0x9, 0x4) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="18080000ff00000000000000fbffffff18110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000030000008500000005000000bf0908000000000055090100000000009500000000000000b7020000001200007b2af0ff00000000d60908007f000000db9af0fff1000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7050000080000001500000076000000bf9800000000000056080000020000008500000007000000b70000000000000095"], &(0x7f00000002c0)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x46, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000004c0)="99", 0x1}], 0x1}, 0x4048043) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r6, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc73}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) r8 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_TIOCINQ(r8, 0x541b, &(0x7f0000000000)) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r7, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x5, 0x6], 0x0, 0xa340}) r9 = epoll_create(0x1) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r11 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r11, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x1c, 0x52, 0x1, 0x0, 0x0, {0xa}, [@typed={0x8, 0x2, 0x0, 0x0, @uid}]}, 0x1c}}, 0x0) r12 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r12, &(0x7f0000000000)={0xa0002000}) ioctl$KVM_RUN(r7, 0xae80, 0x0) shutdown(r1, 0x0) 4.103000802s ago: executing program 4 (id=2937): r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4d8, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f0000000280)=0xc) r5 = syz_open_dev$media(&(0x7f0000000240), 0x8bf33, 0xe0400) ioctl$MEDIA_IOC_G_TOPOLOGY(r5, 0xc0487c04, &(0x7f0000000400)={0x0, 0xffffffffffffff80, 0x0, 0x0, 0x3, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0}) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000000c0)=@ipv4_newrule={0x30, 0x20, 0x1, 0x70bd26, 0x25dfdbfe, {0x2, 0x1c, 0x0, 0xf, 0x8, 0x0, 0x0, 0x3, 0x1}, [@FRA_GENERIC_POLICY=@FRA_UID_RANGE={0xc, 0x14, {r4, 0xffffffffffffffff}}, @FRA_DST={0x8, 0x1, @multicast2}]}, 0x30}}, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000240)={0x24, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='\x00\"\b'], 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'tunl0\x00'}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=@newlink={0x44, 0x10, 0x40d, 0x70bd2a, 0x40000004, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5019}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR_DATA={0x10, 0x5, 0x0, 0x1, [{0xa, 0x4, @multicast}]}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600800a0000200002801c000b8004"], 0x44}, 0x1, 0x0, 0x0, 0xc000}, 0xc000) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x20, 0x10, 0xffffff1f, 0x70bd2b, 0x0, {0x0, 0x6, 0x0, 0x0, 0xffffff81, 0x14021}}, 0x20}}, 0x0) 3.629278242s ago: executing program 1 (id=2938): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000001080), 0x4) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000f478ef8ed"]) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x7ff, 0x2, 0x0, 0x4002004c4, 0x1004, 0x45c5, 0xc595, 0x7, 0x2, 0xffffffffffffffff, 0x2000000000000000, 0x80000004000000, 0xc], 0x8000000, 0x2010d3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000200)="440f20c0350b000000440f22c0360f09c4217d700c9d0000000028b8010000000f01c166b82e000f00d80f20d835080000000f22d82e0f019885000000b9b1060000b86f8d0000ba0000000066b8b5008ec036363ef3420f51a600000000b9e30b0000b8f233278fba000000000f30", 0x6f}], 0x1, 0x13, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004091}, 0x8080) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="500000001a00000327bd7000fedbdf250a800002fe04fd000002000008000400", @ANYRES32=0x0, @ANYBLOB="0800100005000000100016800c00010000000800000000000c000900df001d03", @ANYRES32=0x0, @ANYBLOB="a49c82e8f101fb80bceec64bb4ded9e3d57b692cb6286763040f901f0a8f09d17bbcf84c476389cb85528b109d85c94882a57f6c2fe48940a4de21f48018332a3c3cbc3d9e8418f1a3aa9b59c987de612c25787731cba5118ecc8be89d8c5726a3a5a087fd89b9650fe6d038b78350afdd2610d130c7b2736614f7c7fc9f3a38d745008256464cabf3d22bdc3446747add753ee194648d7d34042eb329669f58637600e11f6eb5cb1e7caadc4e56998db2d607007a982fe6acfb65d59204e01bd1d1426aae98e39e6b25a83160cf479a14f800f795dd607e18ccab2331169bbe010730f41126466b421327b37d2e9f01200e9ceb190c933751feeb0a013265877fc439eb61a6169781263fef7a0637f91c2a9160c22574", @ANYRES32=0x0, @ANYBLOB], 0x50}, 0x1, 0x0, 0x0, 0x20044844}, 0x8c4) socket$inet6_sctp(0xa, 0x5, 0x84) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0xfffffffd, @local, 0x1}, 0x1c) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x2a, 0x0, 0x0, 0x0) r5 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x15523ea56aa22b9a, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r5, 0x47bc, 0x0, 0x0, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) 2.33169075s ago: executing program 0 (id=2939): r0 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x0, 0x0, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = openat$vicodec1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_EDID(r4, 0xc0245628, &(0x7f0000000100)={0x3, 0x0, 0x2, '\x00', &(0x7f0000001440)}) unshare(0x20000400) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x141000, 0x0) preadv(r5, &(0x7f00000001c0)=[{&(0x7f0000001a80)=""/102400, 0x19000}, {0x0}], 0x2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$dri(0x0, 0xd21, 0x4000) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) syz_open_dev$vbi(0x0, 0x0, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r3, 0x0, 0x0, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) timer_create(0x2, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x1c, 0x15, 0x301, 0x0, 0x0, {0xc}, [@typed={0x8, 0x4, 0x0, 0x0, @u32=0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x4000000) 2.323624602s ago: executing program 2 (id=2940): syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000292966085e04840263f80102030109022400010000000909042600021197f80009050e"], 0x0) r0 = syz_usb_connect$cdc_ecm(0x5, 0x91, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7f, 0x1, 0x1, 0xf, 0x60, 0x95, [{{0x9, 0x4, 0x0, 0x3, 0x3, 0x2, 0x6, 0x0, 0x80, {{0xb, 0x24, 0x6, 0x0, 0x0, "8f922265421f"}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x2, 0x9, 0x3}, [@call_mgmt={0x5, 0x24, 0x1, 0x1, 0x5}, @mbim={0xc, 0x24, 0x1b, 0x0, 0x8, 0xf0, 0x40, 0x800, 0x4}, @acm={0x4, 0x24, 0x2, 0xa}, @acm={0x4, 0x24, 0x2, 0x8}, @network_terminal={0x7, 0x24, 0xa, 0xde, 0x0, 0x3, 0xfc}, @mdlm={0x15, 0x24, 0x12, 0x8}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x0, 0x1, 0xf8, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x3f7, 0x30, 0x1, 0x40}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x6, 0xc, 0x4}}}}}]}}]}}, &(0x7f0000000400)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x300, 0x2, 0x4, 0x7, 0x20, 0x5}, 0x30, &(0x7f0000000100)={0x5, 0xf, 0x30, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x1, 0xc, 0x3}, @ssp_cap={0x10, 0x10, 0xa, 0x7, 0x1, 0x0, 0xf, 0xff, [0x3f]}, @ssp_cap={0x14, 0x10, 0xa, 0x5, 0x2, 0x0, 0xf00f, 0x4, [0x3f30, 0x0]}]}, 0x7, [{0x66, &(0x7f0000000140)=@string={0x66, 0x3, "2d6efd035731ecb80e947c6c2767cb862dd427781818022429d0f93076c498aa266cd1e90c065a36d58c97e4c3662d9ffc75ae5a2802d2585bbc475c2b5673a537cebef4affec7971b128c8fc711c910363e7746d47502e309013c080b63277e89d949ea"}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0xf4ff}}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x1007}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x1c01}}, {0x6e, &(0x7f0000000280)=@string={0x6e, 0x3, "d4e6c75ef3b9b25e5edeafb8374aafd1ee204564a21f2243254a94b8ee985c0887fb34c99671a275f9fd2759515dde033b68d406ae83cae9f8242d0a35e7aa7e1df561c67daef82c5f02a78f87b20fa5385943c13f0ca66c2839b8bfa1ef75312e863d151f56c489c1d327fb"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x407}}, {0x98, &(0x7f0000000340)=@string={0x98, 0x3, "3a24b684dc7b25ac3924a88d57a6438bbf07ff6c2c0811d7ed589417c385ddf28bb95467a782765f021394cb6f84c2edc1ddf1d8c25b68324c712e32197005481b260aaddd6cd04a2341d53c26012ede692c867f32eafea20c0dfcf270cec5c98a2493c00676a4b5a3de27c70d93967c91ef9b0fbfd4a2fff15dd2cd34082a1496cc4c14ce1ab54da54f3cb6fc2675aa5ec156b1a9a5"}}]}) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) read$FUSE(0xffffffffffffffff, &(0x7f0000000700)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_open_procfs(r2, &(0x7f0000002740)='net/ptype\x00') ioctl$PIO_UNIMAP(r1, 0x4b4d, &(0x7f0000000400)={0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000580)={0xc, &(0x7f0000000500)={0x20, 0x32, 0x5d, {0x5d, 0x10, "92356b338bbd3e9bf05013e9fb3b308345e07ce2129e9b8f0037da08d81d81c0a9784aa89ea895ae394f83423bbafcd31feec82dc19b764ceb3e4e011ba73a081c45c708c3a5f450f630a9e575fdd3c449e42309bef7723a9581a1"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000006c0)={0x10, &(0x7f00000005c0)={0x0, 0x14, 0x41, "84df9973b7230c140e97e3a60c107648c1639ae27cfe07d61dfa13401e2c6905d4d876f02235a32b88498019c638d38ca5934392441332e6cb9dfec0de2060a340"}, &(0x7f0000000640)={0x0, 0xa, 0x1, 0xff}, &(0x7f0000000680)={0x0, 0x8, 0x1, 0xf1}}) 2.077796817s ago: executing program 1 (id=2941): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r1, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SOUND_MIXER_READ_RECSRC(r2, 0x80044dff, &(0x7f00000003c0)) bind$packet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r5 = getpid() r6 = syz_pidfd_open(r5, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x1258c1, 0x60) preadv(r7, 0x0, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x48, 0x13, 0x44, 0x20, 0x424, 0x7500, 0x69ee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb8, 0x7, 0x0, 0x96, 0xd1, 0xca}}]}}]}}, 0x0) read$FUSE(r7, 0x0, 0x0) ioctl$BTRFS_IOC_ADD_DEV(r6, 0xff08, 0x0) r8 = gettid() r9 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180), 0x40e02, 0x0) write$rfkill(r9, &(0x7f0000000300)={0x0, 0x2, 0x3, 0x1, 0x1}, 0x8) setsockopt$RXRPC_SECURITY_KEY(0xffffffffffffffff, 0x110, 0x1, &(0x7f0000000000)='\x00', 0x1) write$rfkill(r9, &(0x7f0000000340)={0x53, 0x8, 0x0, 0x1, 0xcc}, 0x8) timer_create(0x0, &(0x7f0000000040)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000001800ffffffff7bfbfcdbdf250a148000ff01fd07"], 0x1c}}, 0x0) 1.516790137s ago: executing program 4 (id=2942): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) mmap(&(0x7f0000068000/0x2000)=nil, 0x2000, 0x8, 0x110, r0, 0x64b26000) socket(0x10, 0x3, 0x0) socket$kcm(0x11, 0x2, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000880)={[0x200000000]}, 0x8, 0x800) io_setup(0x206, &(0x7f0000000300)=0x0) io_submit(r1, 0x0, &(0x7f00000005c0)) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)={0x3, 0x2}, 0x4) r2 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x3, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x15523ea56aa22b9a, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r2, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xb) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x7d98, 0x0) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 1.187717994s ago: executing program 0 (id=2943): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000400)={0xfffffffd, 0x5, 0x0, 'queue0\x00', 0x8}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002580)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f00000034c0)={0x2020}, 0xcac) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000000380)) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/timer\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f0000001d00)={0x2020}, 0x2020) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, 0x0) openat$vga_arbiter(0xffffff9c, &(0x7f00000001c0), 0x40200, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001300)=@newtfilter={0xe84, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r7, {0x0, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_fw={{0x7}, {0xe58, 0x2, [@TCA_FW_ACT={0xe54, 0x4, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0xa68, 0x7, 0x10000004, 0xd, 0x4749}, 0x4}, [{0x2, 0x8, 0x94, 0x6, 0x2, 0x3}, {0x5, 0x3ff, 0x1, 0x3, 0x9a5, 0x716}, {0x4, 0xad3, 0x2, 0x5, 0x6, 0x8}, {0xfffffff8, 0x9, 0x9, 0xf, 0x0, 0xf2a}, {0x6, 0x5, 0x38b, 0x6, 0xfff}, {0x8, 0x0, 0x101, 0x400, 0x5, 0xfffffffa}, {0x6, 0xe23, 0xb5, 0x665, 0xfffffffc, 0x2}, {0x80000001, 0x0, 0xd28, 0x8, 0x8001, 0x3}, {0x438, 0xf4, 0x5, 0x4, 0x1, 0x1ff}, {0x1, 0x7, 0x5, 0x4, 0x6, 0xfff}, {0x1, 0x3, 0x97, 0xb, 0x8000, 0x5}, {0x9, 0x237, 0x3, 0x6, 0x3, 0x7}, {0x9, 0x9, 0x40, 0x4, 0x4, 0x5}, {0x6, 0x4084, 0x7fffffff, 0x6, 0x9, 0xa3}, {0x8, 0x62, 0x5, 0x200, 0x8000, 0xbd}, {0x1, 0x0, 0x4, 0x3, 0x8, 0x6}, {0x10, 0x3, 0x80000000, 0x4, 0x7, 0x5}, {0x2, 0x0, 0x1, 0x5, 0x9, 0x10}, {0x7, 0xb, 0x9, 0x8, 0xffffffff, 0x9}, {0x5, 0x7, 0xffffffc0, 0x7, 0xa479, 0x5}, {0x7ff, 0x0, 0x9, 0xe5a0, 0x101, 0x5}, {0xef, 0xa, 0x3ff, 0xfffffffd, 0xd2, 0x7}, {0x0, 0x6, 0x3, 0x7fffffff, 0x3, 0x5852aea0}, {0x800, 0x8, 0x24, 0x8, 0x6, 0x7}, {0x69b, 0x2, 0x8b, 0x7fff, 0xd, 0x6}, {0x7, 0x4, 0xffff, 0x8, 0x1, 0x1}, {0xa431, 0x3, 0xfd, 0x9b, 0x7, 0x7}, {0x0, 0x3, 0x7, 0x6, 0x3, 0x5}, {0x80000000, 0x6, 0x9, 0x7, 0xe275, 0x8c27}, {0x8, 0x8, 0x1, 0x9, 0x8}, {0x109, 0x6, 0x2, 0x6a, 0x80000001, 0x9}, {0x80000001, 0x7, 0xa, 0x6ba9, 0xcc00, 0xff}, {0x1807, 0x100, 0x6, 0x10000, 0x200, 0x1000}, {0x3, 0x5, 0x10001, 0x3, 0x3f67, 0x9bf}, {0x6, 0x9, 0x4, 0xfffffffe, 0xfffffffb, 0x8}, {0x0, 0xd, 0x1, 0x2, 0x6, 0x6}, {0x5, 0xe9, 0x4734e285, 0x4a, 0x7, 0x2}, {0xfffffffc, 0x5, 0xfffffff8, 0x0, 0x6, 0xd82}, {0x1, 0xfffffff9, 0x9, 0x3, 0x8}, {0x80, 0xe, 0x40000, 0x7, 0x8, 0x2e000}, {0x5, 0x7, 0x6, 0x5, 0x4, 0x2}, {0x7, 0x22b, 0xa181, 0x4, 0x497edc19, 0x8b0c}, {0x4a3, 0x21, 0x3, 0x1, 0x1d, 0x8}, {0x5, 0x1, 0x0, 0x7dcd, 0x3, 0xad}, {0x0, 0x2, 0x8, 0x6fb2, 0x3, 0x7fffffff}, {0x2, 0x7fffffff, 0xfffffff8, 0x7, 0x9, 0x6}, {0x8, 0x3, 0x8, 0x3, 0x361, 0x2}, {0x2, 0x7, 0xffffffff, 0xa, 0x6, 0x9}, {0x6, 0x3, 0xc33, 0x400, 0x800, 0x5}, {0x101, 0x7f, 0x71f, 0xf0, 0x80000001, 0x3}, {0xb698, 0xffffffff, 0x9, 0x8001, 0xbf, 0xf}, {0x6, 0x1, 0x97d3, 0x6, 0x5, 0x7}, {0x2, 0xd7a40, 0xfff, 0xc00, 0x3ff, 0x1}, {0x401, 0x200, 0x9, 0x3, 0xb, 0x8dd}, {0x3, 0x4a, 0x10, 0x9, 0xf5cb, 0x4ca}, {0x5, 0xff, 0x9, 0x904, 0x31bf}, {0xfffffffd, 0x5, 0x1, 0xcaf, 0x9, 0xfffffffd}, {0x400, 0x6, 0x8, 0x695, 0xffff11a3, 0x8}, {0x1ff, 0x4, 0x8000, 0x3, 0x9, 0xd0e}, {0x2, 0x6, 0x5, 0x6, 0x5, 0x8000}, {0x3d86, 0x2, 0x2, 0x3, 0x7, 0x963}, {0x7, 0x9, 0x7, 0xe, 0x9, 0x7}, {0x686, 0xc1f, 0x4f, 0x0, 0x4}, {0x7, 0x6, 0x100, 0xc, 0x8, 0xfffff000}, {0x7, 0x1, 0x3, 0x0, 0x8, 0x7}, {0xfffffff7, 0x9, 0x9, 0xffffffff, 0x7, 0x1}, {0x4, 0x2, 0x6, 0x200, 0x4, 0x1}, {0x3, 0x1, 0x120, 0xe4f1, 0x8, 0x9}, {0xfffffffa, 0x648c, 0x3, 0x170f, 0x9, 0x906}, {0x80000001, 0x40, 0x10001, 0xb, 0x38, 0x7fffffff}, {0x4, 0x6, 0xcb53, 0xfffffbff, 0x94, 0x4}, {0x2, 0x8, 0x1, 0x8, 0x100, 0x2}, {0x4b4, 0x5, 0xe7e8, 0x2, 0xc86, 0xffffe589}, {0xffff7fff, 0x7fffffff, 0x9, 0xffffffff, 0x5, 0x9}, {0x2, 0x1, 0x7fffffff, 0x0, 0x1fe4, 0x1}, {0xc011, 0x8, 0x1, 0x2, 0x1ff, 0xf}, {0x7, 0x10, 0x0, 0x0, 0x3}, {0x0, 0x100, 0x9, 0x0, 0x80000000, 0x1}, {0x8, 0x800, 0x1f, 0x6, 0xff, 0xb}, {0xfffffffb, 0x2, 0x4, 0x7, 0x4, 0xfff}, {0x23, 0x7fffffff, 0xfcb8565, 0x6, 0x81, 0xffffffff}, {0x80000001, 0x2, 0x9, 0x98, 0x4, 0x800}, {0xfffff801, 0x7c, 0x6c31, 0x9, 0xc, 0xb}, {0x10000, 0x3ff, 0x7, 0x8, 0xe, 0x8}, {0xeef3, 0x4, 0x1, 0xa, 0x5, 0x9}, {0x6, 0x40, 0xfff, 0x6, 0x4, 0x8}, {0x30c, 0xcaf879b, 0x0, 0x3, 0x3, 0x6}, {0x101, 0x4, 0x4, 0x7, 0x7, 0x392}, {0x1, 0x6, 0xfff, 0xb1, 0x2, 0x143c5166}, {0x7f, 0x636bb91, 0x7, 0xca, 0x2000036, 0x2}, {0xffffffff, 0x5, 0xfffffff4, 0x7fff, 0x7f, 0xffff}, {0x101, 0x800, 0xde3, 0x0, 0x1, 0x3}, {0xc10, 0xb0, 0x1, 0x4d, 0xfff, 0x3}, {0x9, 0xdb, 0x400, 0x0, 0x0, 0xfffffffd}, {0x39, 0xc, 0x9, 0x5, 0x100, 0x8}, {0x9, 0xc2f, 0x8, 0xe31, 0x3, 0x6}, {0x3, 0x2, 0x7fffffff, 0x3, 0x2, 0xe}, {0x101, 0x3ff, 0x3, 0x6, 0x7, 0x6}, {0x1, 0xd, 0xfc5, 0xffff, 0x9, 0xfffffffd}, {0x2a, 0x7, 0x2, 0x9, 0xfff, 0x4}, {0xf, 0x7ff, 0x6, 0x4, 0x4, 0x2}, {0x5, 0xdb, 0x1, 0x2, 0x7fffffff, 0x9}, {0x0, 0x30, 0x9, 0x6660, 0xc0aa2e0, 0x6}, {0x1000, 0x2, 0x9, 0x3, 0x5d5, 0x9}, {0x2, 0x5, 0x5, 0x7, 0x7, 0x7}, {0xe559, 0x3, 0xe31, 0x8001, 0x4, 0xffffffff}, {0x3, 0x6, 0x8, 0x800, 0x5, 0x1}, {0x1, 0x58b72238, 0x4, 0xa36, 0x0, 0x9}, {0x8, 0x66, 0x8, 0x2, 0x5, 0x81}, {0x6, 0x0, 0x6, 0x3, 0x0, 0x7}, {0x6, 0x8, 0x8, 0x0, 0x2ff92517, 0x2e}, {0x10000, 0x948c, 0x3, 0x5, 0x0, 0xf226}, {0x2c, 0x0, 0x6, 0x1, 0x5, 0x124}, {0x5, 0x8, 0xb, 0x3, 0x2, 0x8}, {0x4, 0x9, 0x0, 0xfffffeff, 0x8, 0x2}, {0x0, 0xe3d, 0x8, 0x2, 0x0, 0x3}, {0x7, 0xbf43, 0xffff972b, 0x9, 0xe, 0x1}, {0x1000000, 0x8, 0x8, 0x8, 0x6, 0x4}, {0x1000, 0x7, 0x7fffffff, 0x9, 0x137, 0xfff}, {0x8, 0x5, 0x9, 0x5, 0x0, 0x100}, {0x7fffffff, 0x5, 0x2, 0x7698d897, 0x4, 0x24}, {0x9, 0x101, 0x100, 0x401, 0x5, 0x6}, {0xac84389, 0x36253a1c, 0x8, 0x5, 0xff, 0x401}, {0x7db5, 0xf, 0x800, 0x1000}, {0x99, 0x6, 0x7, 0xc441, 0xa, 0x7}, {0xbe8, 0x5, 0x5, 0x4, 0x7, 0x3}, {0x0, 0x4, 0x9, 0x562, 0x2, 0xffff}, {0x0, 0xffff, 0x3b, 0x2, 0x3, 0x389}], [{0x1, 0x1}, {}, {0x5}, {}, {0x2, 0x1}, {0x2}, {0x1}, {0x3}, {0x3, 0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x2}, {}, {0x4, 0x1}, {0x2, 0x1}, {0x5}, {0x4, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x1, 0x88bd0b579d2b5a38}, {0x4}, {0x3, 0x1}, {0x4, 0x1}, {0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x3}, {0x1}, {0x7, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x1}, {0x4}, {0x5}, {0x4}, {0x4}, {0x0, 0x1}, {0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x4}, {0x3, 0x1}, {0x4}, {0x3, 0x1}, {0x5}, {0x1}, {0x3, 0x1}, {0x1}, {0x5}, {0x3}, {0x2, 0x1}, {0x3}, {0x2, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x2}, {0x1, 0x1}, {0x4, 0x1}, {0x4}, {0x1}, {0x8048bb5975f18d75, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0xe66ec81e72c5feb1}, {0x4}, {0x4, 0x1}, {0x3, 0x1}, {0x2}, {0x2}, {0x4}, {}, {0x1, 0x1}, {0x1, 0x1}, {0x1}, {0x4}, {0x2, 0x1}, {0x4}, {0x2, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x7}, {0x4, 0x1}, {0x5}, {0x5, 0x1}, {0x2, 0x3bd539a9b35183f7}, {0x3}, {0x4}, {0x2}, {0x1, 0x1}, {0x2, 0x1}, {0x1}, {0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x2}, {0x0, 0x1}, {0x4}, {0x4}, {0x3}, {0x5}, {0x1}, {0x1}, {0x4}, {0x1}, {0xe, 0x1}, {0xb}, {0x5, 0x1}, {}, {}, {0x0, 0x1}, {0x5, 0x3}, {0x3, 0x1}, {0x3, 0x1}, {}, {0x1, 0x1}, {0x2}], 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0xe84}, 0x1, 0x0, 0x0, 0x81}, 0x800) 23.280676ms ago: executing program 0 (id=2944): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x400000, @loopback, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4) socket$kcm(0x2, 0x3, 0x2) r1 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r1, &(0x7f0000002980)={&(0x7f0000000180)={0x2, 0x0, @dev}, 0x10, &(0x7f0000001400)=[{&(0x7f0000001800)='_', 0x1}], 0x1}, 0x4000000) syz_open_dev$tty1(0xc, 0x4, 0x2) socket$inet6(0xa, 0x6, 0x27) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = fcntl$getown(r3, 0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) chdir(&(0x7f0000000480)='./cgroup\x00') mkdir(&(0x7f0000000000)='./control\x00', 0x0) r5 = open(&(0x7f0000022ff6)='./control\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_ABSBIT(r6, 0x40045567, 0x0) ioctl$UI_SET_EVBIT(r6, 0x40045564, 0x3) write$uinput_user_dev(r6, &(0x7f0000001740)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x31, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000], [0x0, 0x0, 0x3, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0xcbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x425eeab6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2, 0x0, 0x0, 0x80, 0x0, 0x0, 0x9, 0x0, 0x7fffffff], [0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xe8c, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfaea, 0x0, 0x2, 0x1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xf, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x45c) ioctl$UI_DEV_CREATE(r6, 0x5501) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="0000090000004fe50deb4ed6a9fed5"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) unlinkat(r5, 0x0, 0x200) 0s ago: executing program 2 (id=2945): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) io_setup(0x222, &(0x7f0000000180)=0x0) io_submit(r1, 0x1, &(0x7f0000000680)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x2, r0, 0x0, 0x0, 0x200}]) kernel console output (not intermixed with test programs): lo_compat_ioctl+0x10/0x10 [ 720.042339][T14472] ? kasan_quarantine_put+0xdd/0x220 [ 720.042361][T14472] ? blkdev_common_ioctl+0xff7/0x2550 [ 720.042385][T14472] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 720.042416][T14472] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 720.042435][T14472] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 720.042458][T14472] ? do_vfs_ioctl+0xbe8/0x1430 [ 720.042479][T14472] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 720.042511][T14472] ? __lock_acquire+0xab9/0xd20 [ 720.042544][T14472] ? __pfx_lo_compat_ioctl+0x10/0x10 [ 720.042564][T14472] compat_blkdev_ioctl+0x5ce/0x780 [ 720.042586][T14472] ? __fget_files+0x2a/0x420 [ 720.042611][T14472] ? __pfx_compat_blkdev_ioctl+0x10/0x10 [ 720.042632][T14472] ? __fget_files+0x2a/0x420 [ 720.042656][T14472] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 720.042683][T14472] __ia32_compat_sys_ioctl+0x540/0x840 [ 720.042705][T14472] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 720.042731][T14472] ? __fget_files+0x3a0/0x420 [ 720.042758][T14472] ? fput+0xa0/0xd0 [ 720.042774][T14472] ? ksys_write+0x22a/0x250 [ 720.042802][T14472] ? lockdep_hardirqs_on+0x9c/0x150 [ 720.042826][T14472] __do_fast_syscall_32+0xb6/0x2b0 [ 720.042848][T14472] ? lockdep_hardirqs_on+0x9c/0x150 [ 720.042871][T14472] do_fast_syscall_32+0x34/0x80 [ 720.042893][T14472] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 720.042911][T14472] RIP: 0023:0xf70be539 [ 720.042925][T14472] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 720.042938][T14472] RSP: 002b:00000000f54ae55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 720.042956][T14472] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000004c0a [ 720.042968][T14472] RDX: 0000000080001100 RSI: 0000000000000000 RDI: 0000000000000000 [ 720.042978][T14472] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 720.042987][T14472] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 720.042995][T14472] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 720.043020][T14472] [ 720.043507][ T5952] usb 1-1: config 0 has no interface number 0 [ 720.491528][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 720.500625][ T5952] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 720.966843][ T5952] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 720.977486][ T5952] usb 1-1: Product: syz [ 720.984660][ T5952] usb 1-1: Manufacturer: syz [ 721.001010][ T5952] usb 1-1: SerialNumber: syz [ 721.028240][ T5952] usb 1-1: config 0 descriptor?? [ 721.531053][ C1] net_ratelimit: 2 callbacks suppressed [ 721.531075][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 721.549620][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 721.675169][ T5952] asix 1-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 721.690971][ T5952] asix 1-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -71 [ 721.709218][ T5952] asix 1-1:0.251: probe with driver asix failed with error -5 [ 721.737961][ T5952] usb 1-1: USB disconnect, device number 92 [ 722.300230][T14501] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 722.377408][T14503] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2377'. [ 722.379360][T14501] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 722.404634][ T5964] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 722.571668][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 722.581019][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 722.599912][ T5964] usb 3-1: Using ep0 maxpacket: 32 [ 722.619727][ T5964] usb 3-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=66.3d [ 722.629366][ T5964] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 722.686992][ T5964] usb 3-1: config 0 descriptor?? [ 722.692964][T14505] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2378'. [ 722.723704][T14505] (unnamed net_device) (uninitialized): option ad_select: invalid value (102) [ 722.732945][ T5964] cx82310_eth 3-1:0.0: probe with driver cx82310_eth failed with error -22 [ 722.734301][ T5964] cxacru 3-1:0.0: usbatm_usb_probe: bind failed: -19! [ 723.154672][T14516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.163363][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.340689][T14516] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.408252][T14515] usb usb1: check_ctrlrecip: process 14515 (syz.1.2380) requesting ep 01 but needs 81 [ 723.471066][T14505] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2378'. [ 723.500970][ T30] audit: type=1326 audit(1756091745.896:1554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14511 comm="syz.1.2380" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 723.610978][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.643528][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.708426][ T30] audit: type=1326 audit(1756091745.996:1555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14511 comm="syz.1.2380" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 723.940208][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.004542][ T30] audit: type=1326 audit(1756091745.996:1556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14511 comm="syz.1.2380" exe="/root/syz-executor" sig=0 arch=40000003 syscall=306 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 724.221132][ T30] audit: type=1326 audit(1756091745.996:1557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14511 comm="syz.1.2380" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 724.337023][ T30] audit: type=1326 audit(1756091745.996:1558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14511 comm="syz.1.2380" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 724.400181][ T30] audit: type=1326 audit(1756091746.136:1559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14511 comm="syz.1.2380" exe="/root/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 724.593556][ T30] audit: type=1326 audit(1756091746.146:1560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14511 comm="syz.1.2380" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 724.806473][ T30] audit: type=1326 audit(1756091746.146:1561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14511 comm="syz.1.2380" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 724.985961][ T43] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 725.328424][ T30] audit: type=1326 audit(1756091746.146:1562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14511 comm="syz.1.2380" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 725.789241][ T43] usb 2-1: Using ep0 maxpacket: 32 [ 725.891606][ T43] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 725.900092][ T43] usb 2-1: config 0 has no interface number 0 [ 725.930176][ T43] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 725.955708][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 725.970808][ T30] audit: type=1326 audit(1756091746.146:1563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14511 comm="syz.1.2380" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 726.015516][ T43] usb 2-1: Product: syz [ 726.065252][ T92] usb 3-1: USB disconnect, device number 94 [ 726.107063][ T43] usb 2-1: Manufacturer: syz [ 726.121192][ T43] usb 2-1: SerialNumber: syz [ 726.208066][ T43] usb 2-1: config 0 descriptor?? [ 726.305477][ T43] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 726.363579][ T43] usb 2-1: selecting invalid altsetting 1 [ 726.378474][ T43] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 726.428461][ T43] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 726.508860][ T43] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 726.537218][ T43] usb 2-1: media controller created [ 726.676784][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 726.731951][ C1] net_ratelimit: 8 callbacks suppressed [ 726.731966][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 726.791200][ T92] usb 3-1: new full-speed USB device number 95 using dummy_hcd [ 726.898407][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 726.953145][ T92] usb 3-1: config 0 has an invalid interface number: 56 but max is 0 [ 727.088588][ T92] usb 3-1: config 0 has no interface number 0 [ 727.095206][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 727.122531][ T92] usb 3-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=c7.76 [ 727.137619][ T92] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 727.154334][ T92] usb 3-1: Product: syz [ 727.158819][ T92] usb 3-1: Manufacturer: syz [ 727.176920][ T92] usb 3-1: SerialNumber: syz [ 727.193465][ T92] usb 3-1: config 0 descriptor?? [ 727.204523][T14555] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 727.211082][T14555] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 727.340967][T14555] vhci_hcd vhci_hcd.0: Device attached [ 727.404023][T14548] program syz.2.2388 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 727.413762][T14546] program syz.2.2388 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 727.454260][ T92] peak_usb 3-1:0.56 can0: unable to request usb[type=0 value=1] err=-71 [ 727.469299][ T92] peak_usb 3-1:0.56: unable to read PCAN-USB X6 firmware info (err -71) [ 727.532911][ T92] peak_usb 3-1:0.56: probe with driver peak_usb failed with error -71 [ 727.577125][ T92] usb 3-1: USB disconnect, device number 95 [ 727.614211][T14529] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 727.621685][ T5964] usb 33-1: new low-speed USB device number 4 using vhci_hcd [ 727.654162][ T43] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 727.669902][ T43] zl10353_read_register: readreg error (reg=127, ret==-32) [ 727.699609][ T43] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 727.770857][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 727.850530][T14570] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2393'. [ 727.898462][ T43] usb 2-1: USB disconnect, device number 90 [ 727.930145][T14570] (unnamed net_device) (uninitialized): option ad_select: invalid value (102) [ 727.939858][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 728.084762][T14573] netlink: 'syz.2.2395': attribute type 58 has an invalid length. [ 728.140901][T14573] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2395'. [ 728.143390][T14575] syz_tun: tun_net_xmit 42 [ 728.155838][T14556] vhci_hcd: connection reset by peer [ 728.171034][ T9599] vhci_hcd: stop threads [ 728.177881][ T9599] vhci_hcd: release socket [ 728.231593][ T9599] vhci_hcd: disconnect device [ 728.364175][T14576] IPVS: Scheduler module ip_vs_ not found [ 728.454046][T14570] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2393'. [ 728.619523][T14570] veth31: entered promiscuous mode [ 728.811605][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 729.042225][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 729.211194][ C0] syz_tun: tun_net_xmit 42 [ 729.850860][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 730.106246][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 730.220474][ T5938] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 730.250805][ C0] syz_tun: tun_net_xmit 42 [ 730.610988][T14625] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 730.617555][T14625] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 730.628593][T14625] vhci_hcd vhci_hcd.0: Device attached [ 730.904303][T14625] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2407'. [ 730.947440][T14629] FAULT_INJECTION: forcing a failure. [ 730.947440][T14629] name failslab, interval 1, probability 0, space 0, times 0 [ 730.981085][ T5952] usb 37-1: new low-speed USB device number 3 using vhci_hcd [ 731.020830][T14629] CPU: 1 UID: 0 PID: 14629 Comm: syz.4.2406 Not tainted syzkaller #0 PREEMPT(full) [ 731.020859][T14629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 731.020871][T14629] Call Trace: [ 731.020880][T14629] [ 731.020889][T14629] dump_stack_lvl+0x189/0x250 [ 731.020918][T14629] ? __pfx____ratelimit+0x10/0x10 [ 731.020947][T14629] ? __pfx_dump_stack_lvl+0x10/0x10 [ 731.020971][T14629] ? __pfx__printk+0x10/0x10 [ 731.021007][T14629] ? __pfx___might_resched+0x10/0x10 [ 731.021033][T14629] should_fail_ex+0x414/0x560 [ 731.021067][T14629] should_failslab+0xa8/0x100 [ 731.021099][T14629] kmem_cache_alloc_noprof+0x73/0x3c0 [ 731.021126][T14629] ? mas_alloc_nodes+0x2e9/0x8e0 [ 731.021159][T14629] mas_alloc_nodes+0x2e9/0x8e0 [ 731.021197][T14629] mas_preallocate+0x3ad/0x6f0 [ 731.021231][T14629] ? __pfx_mas_preallocate+0x10/0x10 [ 731.021272][T14629] ? __mas_set_range+0x12f/0x3c0 [ 731.021303][T14629] __split_vma+0x2fa/0xa00 [ 731.021333][T14629] ? lru_gen_update_size+0x7bd/0xd20 [ 731.021362][T14629] ? __pfx___split_vma+0x10/0x10 [ 731.021412][T14629] vma_modify+0x12c3/0x1970 [ 731.021458][T14629] vma_modify_flags+0x1e8/0x230 [ 731.021485][T14629] ? __pfx_vma_modify_flags+0x10/0x10 [ 731.021527][T14629] ? mas_next_slot+0xc20/0xcf0 [ 731.021555][T14629] mprotect_fixup+0x407/0x9c0 [ 731.021586][T14629] ? __pfx_mprotect_fixup+0x10/0x10 [ 731.021628][T14629] do_mprotect_pkey+0x8cd/0xce0 [ 731.021650][T14629] ? ksys_write+0x1cb/0x250 [ 731.021689][T14629] ? __pfx_do_mprotect_pkey+0x10/0x10 [ 731.021754][T14629] __ia32_sys_mprotect+0x7f/0x90 [ 731.021775][T14629] __do_fast_syscall_32+0xb6/0x2b0 [ 731.021817][T14629] ? lockdep_hardirqs_on+0x9c/0x150 [ 731.021850][T14629] do_fast_syscall_32+0x34/0x80 [ 731.021878][T14629] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 731.021902][T14629] RIP: 0023:0xf7fe4539 [ 731.021920][T14629] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 731.021938][T14629] RSP: 002b:00000000f54e555c EFLAGS: 00000206 ORIG_RAX: 000000000000007d [ 731.021961][T14629] RAX: ffffffffffffffda RBX: 000000008021f000 RCX: 0000000000004000 [ 731.021975][T14629] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000000 [ 731.021988][T14629] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 731.022000][T14629] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 731.022012][T14629] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 731.022045][T14629] [ 731.584719][T14626] vhci_hcd: connection reset by peer [ 731.645740][ T9604] vhci_hcd: stop threads [ 731.650070][ T9604] vhci_hcd: release socket [ 731.684311][ T9604] vhci_hcd: disconnect device [ 731.719941][T14639] netlink: 'syz.2.2410': attribute type 58 has an invalid length. [ 731.753374][T14639] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2410'. [ 731.900607][T14639] IPVS: Scheduler module ip_vs_ not found [ 731.940833][ C1] net_ratelimit: 2 callbacks suppressed [ 731.940854][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 732.331816][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 732.371393][ T43] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 732.381830][ T5938] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 732.555858][ T5938] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 732.575204][ T5938] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 732.575849][ T43] usb 5-1: Using ep0 maxpacket: 16 [ 732.623335][ T43] usb 5-1: config 1 has an invalid interface number: 105 but max is 0 [ 732.637787][ T5938] usb 3-1: Product: syz [ 732.647090][ T43] usb 5-1: config 1 has no interface number 0 [ 732.671467][ T5938] usb 3-1: Manufacturer: syz [ 732.680868][ T43] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 732.691843][ T5938] usb 3-1: SerialNumber: syz [ 732.717517][ T43] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 732.728058][ T5964] vhci_hcd: vhci_device speed not set [ 732.757293][ T5938] usb 3-1: config 0 descriptor?? [ 732.780616][ T43] usb 5-1: config 1 interface 105 has no altsetting 0 [ 732.810086][ T5938] ch341 3-1:0.0: ch341-uart converter detected [ 732.836696][ T43] usb 5-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 732.865163][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 732.897402][ T43] usb 5-1: Product: syz [ 732.930011][ T43] usb 5-1: Manufacturer: syz [ 732.969539][ T43] usb 5-1: SerialNumber: syz [ 732.975421][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.058153][T14651] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 733.121164][T14651] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 733.303993][ T5937] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.394027][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.545151][ T43] aqc111 5-1:1.105: probe with driver aqc111 failed with error -71 [ 733.594522][ T43] usb 5-1: USB disconnect, device number 81 [ 733.726993][T14674] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 733.733747][T14674] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 733.753796][T14674] vhci_hcd vhci_hcd.0: Device attached [ 734.010846][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.150109][T14674] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2420'. [ 734.164573][ T5938] usb 3-1: failed to send control message: -71 [ 734.171071][ T5938] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 734.185095][ T5938] usb 3-1: USB disconnect, device number 96 [ 734.201495][ T3097] usb 41-1: new low-speed USB device number 7 using vhci_hcd [ 734.252544][ T5938] ch341 3-1:0.0: device disconnected [ 734.260762][ T5964] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 734.421270][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.442966][ T5964] usb 2-1: config 0 has an invalid interface number: 229 but max is 0 [ 734.463857][ T5964] usb 2-1: config 0 has no interface number 0 [ 734.504007][ T5964] usb 2-1: New USB device found, idVendor=0dfc, idProduct=0001, bcdDevice= c.19 [ 734.544862][ T5964] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.575505][ T5964] usb 2-1: config 0 descriptor?? [ 734.802379][ T5938] usb 2-1: USB disconnect, device number 91 [ 734.953818][T14676] vhci_hcd: connection reset by peer [ 734.975038][ T2940] vhci_hcd: stop threads [ 734.993330][ T2940] vhci_hcd: release socket [ 735.001415][ T2940] vhci_hcd: disconnect device [ 735.051563][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 735.068141][T14688] netlink: 'syz.4.2425': attribute type 58 has an invalid length. [ 735.076254][T14688] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2425'. [ 735.166516][T14692] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2426'. [ 735.176064][T14692] (unnamed net_device) (uninitialized): option ad_select: invalid value (102) [ 735.229928][T14688] IPVS: Scheduler module ip_vs_ not found [ 735.300589][T14692] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2426'. [ 735.458590][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 735.473111][T14692] veth23: entered promiscuous mode [ 735.563508][T14705] AppArmor: change_hat: Invalid input '0x000000000000002^/dev/ttyS3' [ 735.851325][ T5938] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 736.101037][ T5952] vhci_hcd: vhci_device speed not set [ 737.131668][ C1] net_ratelimit: 3 callbacks suppressed [ 737.131690][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 737.571672][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 737.612288][T14730] netlink: 108 bytes leftover after parsing attributes in process `syz.3.2437'. [ 737.949249][T14738] fuse: Unknown parameter 'rootiode' [ 738.170874][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.660479][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.872297][T14746] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2443'. [ 738.917352][T14746] (unnamed net_device) (uninitialized): option ad_select: invalid value (102) [ 739.211547][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.390906][ T3097] vhci_hcd: vhci_device speed not set [ 739.393714][ T5938] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.432298][T14746] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2443'. [ 739.483692][T14746] veth17: entered promiscuous mode [ 739.718593][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.803830][T14762] netlink: 'syz.4.2448': attribute type 58 has an invalid length. [ 739.828161][T14762] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2448'. [ 740.004983][T14763] IPVS: Scheduler module ip_vs_ not found [ 740.109572][T14768] vivid-004: disconnect [ 740.133059][T14768] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 740.142158][T14768] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 740.151553][T14768] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 740.211757][T14767] vivid-004: reconnect [ 740.900795][ T5952] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 741.216399][ T5952] usb 3-1: config 0 has an invalid interface number: 229 but max is 0 [ 741.246432][ T5952] usb 3-1: config 0 has no interface number 0 [ 741.265432][ T5952] usb 3-1: New USB device found, idVendor=0dfc, idProduct=0001, bcdDevice= c.19 [ 741.287239][ T5952] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 741.325358][ T5952] usb 3-1: config 0 descriptor?? [ 741.604035][ T5952] usb 3-1: USB disconnect, device number 97 [ 741.773739][T14799] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2461'. [ 741.953182][T14799] (unnamed net_device) (uninitialized): option ad_select: invalid value (102) [ 742.009637][T14795] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2461'. [ 742.111178][ T24] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 742.235368][T14795] veth19: entered promiscuous mode [ 742.280831][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 742.298653][ T24] usb 5-1: too many configurations: 60, using maximum allowed: 8 [ 742.330917][ C1] net_ratelimit: 31 callbacks suppressed [ 742.330938][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.356744][ T24] usb 5-1: New USB device found, idVendor=0471, idProduct=032c, bcdDevice=ba.e9 [ 742.366042][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=204 [ 742.376241][ T24] usb 5-1: Product: syz [ 742.380491][ T24] usb 5-1: Manufacturer: syz [ 742.385268][ T24] usb 5-1: SerialNumber: syz [ 742.393871][ T24] usb 5-1: config 0 descriptor?? [ 742.410988][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.411550][ T24] pwc: Philips SPC 880NC USB webcam detected. [ 742.484408][T14814] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2465'. [ 742.498375][T14814] block nbd0: Attempted send on invalid socket [ 742.504905][T14814] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 2 [ 742.625867][T14797] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2460'. [ 742.895692][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.232201][ T24] pwc: Warning: more than 1 configuration available. [ 743.239555][ T24] pwc: Failed to set LED on/off time (-71) [ 743.258464][ T24] pwc: send_video_command error -71 [ 743.269338][ T24] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 743.315668][ T24] Philips webcam 5-1:0.0: probe with driver Philips webcam failed with error -71 [ 743.371720][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.383873][ T24] usb 5-1: USB disconnect, device number 82 [ 743.941027][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.410841][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.449216][T14843] tipc: Enabled bearer , priority 10 [ 745.058274][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.451450][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.554696][T14850] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2479'. [ 745.571078][T14850] (unnamed net_device) (uninitialized): option ad_select: invalid value (102) [ 745.613434][ T5938] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.621817][ T5938] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.834188][T14850] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2479'. [ 746.105368][T14850] veth33: entered promiscuous mode [ 746.311988][T14866] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2483'. [ 746.608386][T14871] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 746.615081][T14871] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 746.627173][T14871] vhci_hcd vhci_hcd.0: Device attached [ 746.643337][T14871] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2485'. [ 746.870825][ T5952] usb 41-1: new low-speed USB device number 8 using vhci_hcd [ 747.001980][T14880] netlink: 1 bytes leftover after parsing attributes in process `syz.1.2488'. [ 747.171186][T14891] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2490'. [ 747.330758][ T5938] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 747.373857][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.380253][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.424840][T14872] vhci_hcd: connection reset by peer [ 747.455078][ T2940] vhci_hcd: stop threads [ 747.459798][ T2940] vhci_hcd: release socket [ 747.464823][ T2940] vhci_hcd: disconnect device [ 747.506620][ T5938] usb 2-1: config 0 has no interfaces? [ 747.519332][ T5938] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 747.529375][ T5938] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 747.531409][ C1] net_ratelimit: 3 callbacks suppressed [ 747.531426][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 747.557312][ T5938] usb 2-1: Manufacturer: syz [ 747.575198][ T5938] usb 2-1: config 0 descriptor?? [ 747.989064][T14901] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2494'. [ 748.171583][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.202617][T14911] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2496'. [ 748.562189][T14917] syzkaller1: entered promiscuous mode [ 748.571028][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.608350][T14917] syzkaller1: entered allmulticast mode [ 748.651811][ T5937] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.211441][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.422858][T14931] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2501'. [ 749.611806][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.862407][T14935] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2502'. [ 749.966335][ T5937] usb 2-1: USB disconnect, device number 92 [ 750.251451][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.650842][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.051922][ T43] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 751.292022][ T43] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 751.305930][ T43] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 751.374401][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.399204][ T43] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 751.434878][ T43] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 751.481017][ T43] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 751.570363][ T43] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 751.656612][T14963] tipc: Bearer : already 2 bearers with priority 10 [ 751.666859][T14963] tipc: Bearer : trying with adjusted priority [ 751.678382][T14963] tipc: Enabling of bearer rejected, failed to enable media [ 751.691260][ T5937] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.699705][ T43] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 751.707980][ T43] usb 2-1: Product: syz [ 751.712454][ T43] usb 2-1: Manufacturer: syz [ 751.747116][ T43] cdc_wdm 2-1:1.0: skipping garbage [ 751.777535][ T43] cdc_wdm 2-1:1.0: skipping garbage [ 751.814678][ T43] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 751.820763][ T43] cdc_wdm 2-1:1.0: Unknown control protocol [ 752.020907][ T5952] vhci_hcd: vhci_device speed not set [ 752.226570][ T43] usb 2-1: USB disconnect, device number 93 [ 752.740869][ C1] net_ratelimit: 2 callbacks suppressed [ 752.740892][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 752.756512][ T43] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 752.946069][ T43] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 752.990832][ T43] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 753.066313][ T43] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 753.075793][ T43] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 753.087827][ T43] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 753.128500][ T43] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 753.158420][ T43] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 753.451631][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.480359][ T43] usb 2-1: Product: syz [ 753.531063][ T43] usb 2-1: Manufacturer: syz [ 753.572475][ T43] cdc_wdm 2-1:1.0: skipping garbage [ 753.611878][ T43] cdc_wdm 2-1:1.0: skipping garbage [ 753.646980][ T43] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 753.660809][ T43] cdc_wdm 2-1:1.0: Unknown control protocol [ 753.771820][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.867593][ T43] usb 2-1: USB disconnect, device number 94 [ 754.017767][T14993] netlink: 'syz.1.2517': attribute type 58 has an invalid length. [ 754.128371][T14993] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2517'. [ 754.491215][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.628780][T14996] IPVS: Scheduler module ip_vs_ not found [ 754.731355][ T5937] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.810854][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.052355][ T5937] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.114530][T15004] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.141112][T15004] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.166496][T15004] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.840857][ T3097] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 755.873886][T15022] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 755.908709][T15022] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 756.001153][ T3097] usb 2-1: Using ep0 maxpacket: 16 [ 756.008969][ T3097] usb 2-1: unable to get BOS descriptor or descriptor too short [ 756.022293][ T3097] usb 2-1: config 129 has an invalid interface number: 156 but max is 1 [ 756.031046][ T3097] usb 2-1: config 129 contains an unexpected descriptor of type 0x2, skipping [ 756.047738][ T3097] usb 2-1: config 129 has 1 interface, different from the descriptor's value: 2 [ 756.080780][ T3097] usb 2-1: config 129 has no interface number 0 [ 756.140250][ T3097] usb 2-1: config 129 interface 156 has no altsetting 0 [ 756.190010][T15027] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2528'. [ 756.202904][ T3097] usb 2-1: New USB device found, idVendor=0408, idProduct=4030, bcdDevice=31.80 [ 756.206607][T15027] (unnamed net_device) (uninitialized): option ad_select: invalid value (102) [ 756.238138][ T3097] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 756.262487][ T3097] usb 2-1: Product: syz [ 756.266715][ T3097] usb 2-1: Manufacturer: syz [ 756.301063][ T3097] usb 2-1: SerialNumber: syz [ 756.343520][T15027] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2528'. [ 756.415446][T15027] veth25: entered promiscuous mode [ 756.614691][T15020] kvm: user requested TSC rate below hardware speed [ 756.643881][T15020] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=2205475325 (8821901300 ns) > initial count (6564024732 ns). Using initial count to start timer. [ 756.798241][T15036] netlink: 'syz.3.2530': attribute type 58 has an invalid length. [ 756.809795][T15036] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2530'. [ 756.966105][T15036] IPVS: Scheduler module ip_vs_ not found [ 757.771607][ T5952] net_ratelimit: 7 callbacks suppressed [ 757.771627][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 757.931475][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 758.090946][ T5937] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 758.289861][ T5937] usb 5-1: Using ep0 maxpacket: 16 [ 758.332871][ T5937] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 758.358447][ T5937] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 758.400327][ T5937] usb 5-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 758.443096][ T5937] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 758.467646][ T5937] usb 5-1: Product: syz [ 758.485361][ T5937] usb 5-1: Manufacturer: syz [ 758.500258][ T5937] usb 5-1: SerialNumber: syz [ 758.601775][T15056] fuse: Bad value for 'group_id' [ 758.623148][ T5937] usb 5-1: config 0 descriptor?? [ 758.640760][T15056] fuse: Bad value for 'group_id' [ 758.816438][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 758.866124][ T3097] usb 2-1: Found UVC 8.00 device syz (0408:4030) [ 758.903594][ T3097] usb 2-1: No valid video chain found. [ 758.939187][ T3097] usb 2-1: USB disconnect, device number 95 [ 758.970878][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.851614][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 760.011237][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 760.471798][T15092] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2542'. [ 760.525787][ T5937] usb 5-1: USB disconnect, device number 83 [ 760.556649][T15092] (unnamed net_device) (uninitialized): option ad_select: invalid value (102) [ 760.633517][T15097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 760.642048][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 760.805035][T15092] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2542'. [ 760.825749][ T5937] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 760.932317][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 760.951298][T15092] veth21: entered promiscuous mode [ 761.106767][T15084] syz.3.2540 (15084): drop_caches: 2 [ 761.174936][T15102] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 761.181516][T15102] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 761.194190][T15102] vhci_hcd vhci_hcd.0: Device attached [ 761.216372][T15102] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2546'. [ 761.316421][T15107] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2545'. [ 761.470776][ T5937] usb 41-1: new low-speed USB device number 9 using vhci_hcd [ 761.804668][T15117] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 761.813244][T15117] tipc: Enabled bearer , priority 10 [ 761.940532][T15119] syzkaller0: entered promiscuous mode [ 762.009366][T15119] syzkaller0: entered allmulticast mode [ 762.047776][T15128] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 762.102717][T15128] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 762.117450][T15130] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 762.120923][T15103] vhci_hcd: connection reset by peer [ 762.169211][ T2940] vhci_hcd: stop threads [ 762.199832][T15130] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 762.207678][ T2940] vhci_hcd: release socket [ 762.221080][ T2940] vhci_hcd: disconnect device [ 762.223001][T15128] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 762.270701][T15128] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 762.600818][ T24] usb 2-1: new low-speed USB device number 96 using dummy_hcd [ 762.765120][ T24] usb 2-1: LPM exit latency is zeroed, disabling LPM. [ 762.782785][ T24] usb 2-1: config 1 interface 0 altsetting 60 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 762.802157][ T24] usb 2-1: config 1 interface 0 has no altsetting 0 [ 762.822108][ T24] usb 2-1: string descriptor 0 read error: -22 [ 762.832136][ T24] usb 2-1: New USB device found, idVendor=17ef, idProduct=60b5, bcdDevice= 0.40 [ 762.846505][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 763.052557][ T5868] net_ratelimit: 3 callbacks suppressed [ 763.052580][ T5868] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 763.082163][ T24] usbhid 2-1:1.0: can't add hid device: -71 [ 763.088708][ T24] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 763.105696][ T24] usb 2-1: USB disconnect, device number 96 [ 763.130858][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 763.223711][T15154] vivid-008: disconnect [ 763.229990][T15152] vivid-008: reconnect [ 763.266580][T15148] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 763.286322][T15148] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 763.439054][T15159] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2560'. [ 763.448809][T15159] (unnamed net_device) (uninitialized): option ad_select: invalid value (102) [ 763.485344][T15159] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2560'. [ 763.511975][T15159] veth33: entered promiscuous mode [ 763.852619][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 763.887765][ T9606] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 763.899379][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 763.915863][ T92] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.092111][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.171532][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.315441][T15181] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2565'. [ 764.651670][ T5938] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.210875][ T5938] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 765.220828][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.350774][ T5938] usb 2-1: device descriptor read/64, error -71 [ 765.434344][T15194] netlink: 'syz.3.2570': attribute type 58 has an invalid length. [ 765.504955][ T92] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 765.534494][T15194] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2570'. [ 765.598933][T15195] IPVS: Scheduler module ip_vs_ not found [ 765.639965][T15198] input: syz0 as /devices/virtual/input/input65 [ 765.640831][ T5938] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 765.743824][T15190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 765.754316][T15190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 765.787752][ T5185] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 765.861410][ T5938] usb 2-1: device descriptor read/64, error -71 [ 765.972010][ T5938] usb usb2-port1: attempt power cycle [ 766.340843][ T5938] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 766.375135][ T5938] usb 2-1: device descriptor read/8, error -71 [ 766.560807][ T5937] vhci_hcd: vhci_device speed not set [ 766.630956][ T5938] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 766.661793][ T5938] usb 2-1: device descriptor read/8, error -71 [ 766.782241][ T5938] usb usb2-port1: unable to enumerate USB device [ 766.846653][T15215] [U] [ 766.849689][T15215] [U] [ 766.852403][T15215] [U] [ 766.855118][T15215] [U] [ 766.859002][T15215] [U] [ 766.861720][T15215] [U] [ 766.864426][T15215] [U] [ 766.867179][T15215] [U] [ 766.875232][T15215] [U] [ 766.877992][T15215] [U] [ 766.880899][T15215] [U] [ 767.196469][T15214] [U] [ 768.010894][T15226] usb usb8: usbfs: process 15226 (syz.3.2578) did not claim interface 0 before use [ 768.331684][ C1] net_ratelimit: 10 callbacks suppressed [ 768.331708][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.347174][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.688747][ T92] usb 5-1: unable to get BOS descriptor or descriptor too short [ 768.727620][ T92] usb 5-1: too many configurations: 111, using maximum allowed: 8 [ 768.776058][ T92] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 768.814314][ T92] usb 5-1: can't read configurations, error -71 [ 768.971569][ T9608] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.983736][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 769.005420][T14039] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 769.370991][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 769.437122][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 769.798724][T15253] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 769.862352][T15253] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 769.882933][ T43] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 769.932635][T15253] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.083385][ T43] usb 2-1: Using ep0 maxpacket: 16 [ 770.109860][ T43] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 770.178575][ T43] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 770.686962][ T43] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 770.820709][ T43] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 770.838701][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.863908][ T43] usb 2-1: Product: syz [ 770.870716][ T43] usb 2-1: Manufacturer: syz [ 770.887593][ T43] usb 2-1: SerialNumber: syz [ 771.672744][ T43] usb 2-1: 0:2 : does not exist [ 772.391455][T15281] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 772.425563][T15282] nfs: Unknown parameter 'O$J<8 _QWyX7s%p|9*HCV)·"' [ 772.492644][T15281] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 772.512225][T15284] input: syz0 as /devices/virtual/input/input66 [ 773.530818][ C1] net_ratelimit: 17 callbacks suppressed [ 773.530841][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.721099][ T24] usb 3-1: new full-speed USB device number 98 using dummy_hcd [ 774.292728][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.300954][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.309069][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.317631][ T3504] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.328588][ T5937] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.336791][ T5868] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.358323][T14039] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.371802][ T92] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.571259][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.050917][ T43] usb 2-1: 1:0: failed to get current value for ch 0 (-22) [ 775.529549][ T43] usb 2-1: USB disconnect, device number 101 [ 775.960814][ T43] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 776.172432][ T43] usb 2-1: Using ep0 maxpacket: 32 [ 776.184126][ T43] usb 2-1: config 0 has an invalid interface number: 186 but max is 0 [ 776.200896][ T43] usb 2-1: config 0 has no interface number 0 [ 776.218217][ T43] usb 2-1: New USB device found, idVendor=0856, idProduct=ac29, bcdDevice=a8.3c [ 776.228894][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 776.237673][ T43] usb 2-1: Product: syz [ 776.244377][ T43] usb 2-1: Manufacturer: syz [ 776.259014][ T43] usb 2-1: SerialNumber: syz [ 776.303802][ T43] usb 2-1: config 0 descriptor?? [ 776.790812][T15324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 776.862809][T15324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 776.966376][ T24] usb 3-1: unable to get BOS descriptor or descriptor too short [ 777.025354][ T24] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 777.069984][ T24] usb 3-1: can't read configurations, error -71 [ 778.364192][T15338] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2606'. [ 778.426090][T15338] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 778.433849][T15338] IPv6: NLM_F_CREATE should be set when creating new route [ 778.484374][T15310] delete_channel: no stack [ 778.494299][ T43] mos7840 2-1:0.186: missing endpoints [ 778.505755][ T43] usb 2-1: USB disconnect, device number 102 [ 778.731017][T15342] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2608'. [ 778.731496][ C1] net_ratelimit: 8 callbacks suppressed [ 778.731512][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.533437][ T5868] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.551356][ T92] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 779.611374][ T9602] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.644180][T14039] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.656324][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.747260][ T92] usb 3-1: config 0 has an invalid interface number: 229 but max is 0 [ 779.754585][T15361] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2614'. [ 779.757290][ T92] usb 3-1: config 0 has no interface number 0 [ 779.770831][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.779239][ T92] usb 3-1: New USB device found, idVendor=0dfc, idProduct=0001, bcdDevice= c.19 [ 779.788392][ T92] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 779.796827][ T5937] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 779.888751][ T92] usb 3-1: config 0 descriptor?? [ 779.906084][T15361] fuse: Unknown parameter '00000000000000000003' [ 779.955146][ T5937] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 779.966712][ T5937] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 779.975895][ T5937] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 780.004102][ T5937] usb 5-1: config 0 interface 0 has no altsetting 0 [ 780.037289][ T5937] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 780.047716][ T5937] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 780.069016][ T5937] usb 5-1: config 0 interface 0 has no altsetting 0 [ 780.143518][ T43] usb 3-1: USB disconnect, device number 100 [ 780.145351][ T5937] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 780.184046][ T5937] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 780.203778][ T5937] usb 5-1: config 0 interface 0 has no altsetting 0 [ 780.214775][T15361] netlink: 196 bytes leftover after parsing attributes in process `syz.3.2614'. [ 780.235355][ T5937] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 780.246612][ T5937] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 780.250830][ T5868] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 780.287091][T15361] openvswitch: netlink: Flow key attr not present in new flow. [ 780.295448][T15367] usb usb8: usbfs: process 15367 (syz.0.2616) did not claim interface 0 before use [ 780.317429][ T5937] usb 5-1: config 0 interface 0 has no altsetting 0 [ 780.676895][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 780.700734][ T5868] usb 2-1: Using ep0 maxpacket: 16 [ 780.716515][ T92] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 780.732332][ T5868] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 780.742757][ T5937] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 780.752259][ T5868] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 780.755472][ T5937] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 780.776830][ T5868] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 780.779610][ T5937] usb 5-1: config 0 interface 0 has no altsetting 0 [ 780.815264][ T5868] usb 2-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 780.825418][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 780.841403][ T5937] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 780.849419][ T5868] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.850586][ T5937] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 780.859690][ T5868] usb 2-1: Product: syz [ 780.874732][ T5868] usb 2-1: Manufacturer: syz [ 780.879384][ T5868] usb 2-1: SerialNumber: syz [ 780.911008][ T5868] usb 2-1: config 0 descriptor?? [ 780.919925][T15365] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 780.941688][ T5937] usb 5-1: config 0 interface 0 has no altsetting 0 [ 780.965307][ T5937] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 780.978198][ T5937] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 781.007812][ T5937] usb 5-1: config 0 interface 0 has no altsetting 0 [ 781.035063][ T5937] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 781.045864][ T5868] mcba_usb 2-1:0.0 can0: failed tx_urb -90 [ 781.049689][ T5937] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 781.056147][ T5868] mcba_usb 2-1:0.0 can0: Failed to send cmd (169) [ 781.071279][ T5868] mcba_usb 2-1:0.0 can0: failed tx_urb -90 [ 781.077269][ T5868] mcba_usb 2-1:0.0 can0: Failed to send cmd (169) [ 781.090215][ T5937] usb 5-1: config 0 interface 0 has no altsetting 0 [ 781.095951][ T5868] mcba_usb 2-1:0.0: Microchip CAN BUS Analyzer connected [ 781.112320][ T5937] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 781.127037][ T5937] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 781.153578][T15375] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2619'. [ 781.167630][ T5937] usb 5-1: Product: syz [ 781.188627][ T5937] usb 5-1: Manufacturer: syz [ 781.272595][T15375] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 781.277051][ T5937] usb 5-1: SerialNumber: syz [ 781.279847][T15375] IPv6: NLM_F_CREATE should be set when creating new route [ 781.342727][ T5937] usb 5-1: config 0 descriptor?? [ 781.388151][ T5937] yurex 5-1:0.0: USB YUREX device now attached to Yurex #0 [ 782.825764][ C0] usb 5-1: yurex_control_callback - control failed: -2 [ 782.850851][ T5937] usb 5-1: USB disconnect, device number 86 [ 782.898216][ T5937] yurex 5-1:0.0: USB YUREX #0 now disconnected [ 783.063795][T15400] netlink: 'syz.4.2623': attribute type 58 has an invalid length. [ 783.074742][T15400] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2623'. [ 783.254444][ T5868] usb 2-1: USB disconnect, device number 103 [ 783.263064][ T5868] mcba_usb 2-1:0.0 can0: device disconnected [ 783.358667][T15400] IPVS: Scheduler module ip_vs_ not found [ 783.552029][T15408] usb usb8: usbfs: process 15408 (syz.2.2622) did not claim interface 0 before use [ 783.770926][ T24] net_ratelimit: 121 callbacks suppressed [ 783.770950][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.784990][ T5937] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.930815][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.731814][ T9599] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.741096][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.760330][ T5937] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.791173][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 784.791193][ T30] audit: type=1326 audit(1756091807.176:1579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15431 comm="syz.1.2629" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 784.820201][ T5868] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.971511][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.054563][ T30] audit: type=1326 audit(1756091807.176:1580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15431 comm="syz.1.2629" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 785.211062][ T30] audit: type=1326 audit(1756091807.186:1581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15431 comm="syz.1.2629" exe="/root/syz-executor" sig=0 arch=40000003 syscall=172 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 785.380413][ T30] audit: type=1326 audit(1756091807.186:1582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15431 comm="syz.1.2629" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 785.468489][ T30] audit: type=1326 audit(1756091807.186:1583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15431 comm="syz.1.2629" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 785.506298][ T30] audit: type=1326 audit(1756091807.186:1584): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15431 comm="syz.1.2629" exe="/root/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 785.555193][ T30] audit: type=1326 audit(1756091807.186:1585): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15431 comm="syz.1.2629" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 785.627309][ T30] audit: type=1326 audit(1756091807.186:1586): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15431 comm="syz.1.2629" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 785.860389][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.902186][ T30] audit: type=1326 audit(1756091807.186:1587): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15431 comm="syz.1.2629" exe="/root/syz-executor" sig=0 arch=40000003 syscall=260 compat=1 ip=0xf7f11539 code=0x7ffc0000 [ 786.010836][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 786.440935][ T30] audit: type=1326 audit(1756091807.236:1588): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15431 comm="syz.1.2629" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f11558 code=0x7ffc0000 [ 787.136103][T15484] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 787.145851][T15484] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 787.160879][T15484] syz_tun: tun_net_xmit 42 [ 787.222083][T15432] netlink: 'syz.1.2629': attribute type 2 has an invalid length. [ 787.345115][T15487] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 787.377026][T15487] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 787.590845][ T5937] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 787.786213][ T5937] usb 5-1: Using ep0 maxpacket: 32 [ 787.832675][ T5937] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 787.917534][ T5937] usb 5-1: config 0 has no interface number 0 [ 787.956360][ T5937] usb 5-1: config 0 interface 184 has no altsetting 0 [ 788.073627][ T5937] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 788.118288][ T5937] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 788.160536][ T5937] usb 5-1: Product: syz [ 788.169845][ T5937] usb 5-1: Manufacturer: syz [ 788.177707][ T5937] usb 5-1: SerialNumber: syz [ 788.180762][ C1] syz_tun: tun_net_xmit 42 [ 788.288045][ T5937] usb 5-1: config 0 descriptor?? [ 788.347768][T15492] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 788.354317][T15492] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 788.362219][ T5937] smsc75xx v1.0.0 [ 788.389129][ T5937] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 788.399596][T15492] vhci_hcd vhci_hcd.0: Device attached [ 788.440707][ T5937] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -22 [ 788.543030][T15483] fuse: Bad value for 'fd' [ 788.670860][T14039] usb 37-1: new low-speed USB device number 4 using vhci_hcd [ 788.856620][T15492] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2641'. [ 789.131791][ C1] net_ratelimit: 5 callbacks suppressed [ 789.131820][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.210808][ C1] syz_tun: tun_net_xmit 42 [ 789.458116][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.606759][T15502] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2642'. [ 789.854776][ T92] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 790.170807][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 790.217905][T15432] syz.1.2629 (15432): drop_caches: 2 [ 790.263329][ T3504] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 790.291491][ T92] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 790.303105][ T5937] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 790.373945][T15493] vhci_hcd: connection reset by peer [ 790.385922][ T9599] vhci_hcd: stop threads [ 790.390192][ T9599] vhci_hcd: release socket [ 790.396727][ T9599] vhci_hcd: disconnect device [ 790.635874][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 790.680782][T15498] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 790.688634][T15498] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 790.725731][T15498] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 790.739006][T15498] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 790.751528][T15498] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 790.768289][T15482] delete_channel: no stack [ 790.796582][T15498] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 790.903007][T15498] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 790.911115][T15512] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2646'. [ 790.945808][T15498] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 791.109038][T15498] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 791.144425][T15498] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 791.211556][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 791.306764][ T24] usb 5-1: USB disconnect, device number 87 [ 791.342478][T15523] tipc: Bearer : already 2 bearers with priority 10 [ 791.374810][T15523] tipc: Bearer : trying with adjusted priority [ 791.410393][T15523] tipc: Enabling of bearer rejected, failed to enable media [ 791.425017][T15526] veth0_to_bond: entered allmulticast mode [ 791.691148][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.767572][T15548] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2657'. [ 792.822166][T15548] (unnamed net_device) (uninitialized): option ad_select: invalid value (48) [ 793.152333][T15548] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2657'. [ 793.373466][T15548] veth39: entered promiscuous mode [ 793.580546][T15563] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2659'. [ 793.930896][T14039] vhci_hcd: vhci_device speed not set [ 794.277630][T15558] net_ratelimit: 12 callbacks suppressed [ 794.277653][T15558] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 794.283243][T15576] random: crng reseeded on system resumption [ 794.330856][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 794.908123][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.170452][T15582] tipc: Bearer : already 2 bearers with priority 10 [ 795.209855][T15582] tipc: Bearer : trying with adjusted priority [ 795.241031][T15582] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 795.352765][T15582] tipc: Enabled bearer , priority 9 [ 795.371456][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.741946][T15591] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.814621][T15591] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.829678][T15591] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.838612][T15591] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.921505][T15591] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.941444][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 796.848508][T15605] syzkaller0: entered promiscuous mode [ 796.858804][T15605] syzkaller0: entered allmulticast mode [ 798.707893][T15621] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 798.714465][T15621] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 798.760857][T15621] vhci_hcd vhci_hcd.0: Device attached [ 798.848325][T15625] CUSE: unknown device info "" [ 798.854346][T15625] CUSE: zero length info key specified [ 799.010809][ T43] usb 37-1: new low-speed USB device number 5 using vhci_hcd [ 799.390942][ T5868] net_ratelimit: 10 callbacks suppressed [ 799.390966][ T5868] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 799.531780][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 799.977626][T15622] vhci_hcd: connection reset by peer [ 799.997111][ T2940] vhci_hcd: stop threads [ 800.001475][ T2940] vhci_hcd: release socket [ 800.067814][ T2940] vhci_hcd: disconnect device [ 800.492804][ T5868] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 800.570890][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 801.534405][ T5868] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 801.622718][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 801.777311][ T9604] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 801.786214][ T5937] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 801.799524][ T5937] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.012917][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 804.169201][ T43] vhci_hcd: vhci_device speed not set [ 804.655049][ T5868] net_ratelimit: 4 callbacks suppressed [ 804.655073][ T5868] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 804.730818][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 805.054316][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 805.328083][T15633] dummy0: left promiscuous mode [ 805.335283][T15633] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 805.636220][T15686] netlink: 763 bytes leftover after parsing attributes in process `syz.0.2687'. [ 805.691314][ T5868] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 805.771649][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 805.852656][T15691] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2690'. [ 805.903687][T15691] (unnamed net_device) (uninitialized): option ad_select: invalid value (102) [ 805.956070][T15693] tipc: Bearer : already 2 bearers with priority 10 [ 805.965293][T15693] tipc: Bearer : trying with adjusted priority [ 806.004758][T15693] tipc: Enabling of bearer rejected, failed to enable media [ 806.088002][T15698] netlink: 'syz.4.2692': attribute type 58 has an invalid length. [ 806.167316][T15691] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2690'. [ 806.176597][T15698] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2692'. [ 806.341734][T15691] veth29: entered promiscuous mode [ 806.363339][T15708] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2694'. [ 806.391395][T15708] (unnamed net_device) (uninitialized): option ad_select: invalid value (48) [ 806.442172][T15701] IPVS: Scheduler module ip_vs_ not found [ 806.633721][T15708] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2694'. [ 806.731405][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 806.753191][T15708] veth41: entered promiscuous mode [ 806.810801][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 807.532595][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 807.541845][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 807.578424][T15707] syz.1.2693 (15707): drop_caches: 2 [ 807.593024][T15727] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 807.613705][T15727] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 808.325540][ T5952] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 808.470945][ T5952] usb 2-1: device descriptor read/64, error -71 [ 808.720725][ T5952] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 808.821662][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.828045][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.860750][ T5952] usb 2-1: device descriptor read/64, error -71 [ 808.971235][ T5952] usb usb2-port1: attempt power cycle [ 808.992331][T15745] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 809.033566][T15745] syzkaller0: entered promiscuous mode [ 809.075568][T15745] syzkaller0: entered allmulticast mode [ 809.279705][T15745] netlink: 7856 bytes leftover after parsing attributes in process `syz.2.2705'. [ 809.381098][ T5952] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 809.411563][ T5952] usb 2-1: device descriptor read/8, error -71 [ 809.576593][T15754] fuse: Bad value for 'group_id' [ 809.581988][T15754] fuse: Bad value for 'group_id' [ 809.606570][T15754] kernel profiling enabled (shift: 6) [ 809.671245][ T5952] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 809.701361][ T5952] usb 2-1: device descriptor read/8, error -71 [ 809.931582][ C1] net_ratelimit: 6 callbacks suppressed [ 809.931603][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 810.160368][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 810.258914][ T5952] usb usb2-port1: unable to enumerate USB device [ 810.604995][T15759] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2707'. [ 810.970968][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.221317][ T5868] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.267962][T15765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.277889][T15765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.351025][T15765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.372891][T15765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.381783][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.418904][T15765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.485130][T15781] tipc: Enabling of bearer rejected, already enabled [ 812.545327][ T43] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 812.702945][ T43] usb 2-1: config 0 has an invalid interface number: 229 but max is 0 [ 812.711657][ T43] usb 2-1: config 0 has no interface number 0 [ 812.719351][ T43] usb 2-1: New USB device found, idVendor=0dfc, idProduct=0001, bcdDevice= c.19 [ 812.740311][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 812.777927][ T43] usb 2-1: config 0 descriptor?? [ 812.992019][ T5952] usb 2-1: USB disconnect, device number 108 [ 814.190799][ T5952] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 814.229263][T15817] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2724'. [ 814.244269][T15817] (unnamed net_device) (uninitialized): option ad_select: invalid value (102) [ 814.380813][ T5952] usb 3-1: Using ep0 maxpacket: 32 [ 814.387677][ T5952] usb 3-1: config 0 has an invalid interface number: 247 but max is 0 [ 814.396529][ T5952] usb 3-1: config 0 has no interface number 0 [ 814.402676][ T92] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 814.422423][T15817] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2724'. [ 814.440991][ T5952] usb 3-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice= 1.9b [ 814.480003][ T5952] usb 3-1: New USB device strings: Mfr=128, Product=0, SerialNumber=0 [ 814.528565][ T5952] usb 3-1: Manufacturer: syz [ 814.559494][ T5952] usb 3-1: config 0 descriptor?? [ 814.593731][ T92] usb 2-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 814.603307][ T92] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 814.613928][T15817] veth43: entered promiscuous mode [ 814.624155][ T92] usb 2-1: config 0 descriptor?? [ 814.947681][ T43] usb 3-1: USB disconnect, device number 101 [ 815.043674][T15826] vxcan1: tx drop: invalid sa for name 0x0000000000000006 [ 815.121454][T15828] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 815.130968][ C1] net_ratelimit: 7 callbacks suppressed [ 815.130989][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 815.138667][T15828] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 815.195601][ T30] kauditd_printk_skb: 339 callbacks suppressed [ 815.195622][ T30] audit: type=1326 audit(1756091837.596:1928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15830 comm="syz.0.2728" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f71539 code=0x7ffc0000 [ 815.299154][ T30] audit: type=1326 audit(1756091837.596:1929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15830 comm="syz.0.2728" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f71539 code=0x7ffc0000 [ 815.324607][ T30] audit: type=1326 audit(1756091837.596:1930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15830 comm="syz.0.2728" exe="/root/syz-executor" sig=0 arch=40000003 syscall=234 compat=1 ip=0xf7f71539 code=0x7ffc0000 [ 815.350768][ T24] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 815.400765][ T30] audit: type=1326 audit(1756091837.596:1931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15830 comm="syz.0.2728" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f71539 code=0x7ffc0000 [ 815.423451][ T30] audit: type=1326 audit(1756091837.596:1932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15830 comm="syz.0.2728" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f71539 code=0x7ffc0000 [ 815.451124][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 815.462967][ T30] audit: type=1326 audit(1756091837.596:1933): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15830 comm="syz.0.2728" exe="/root/syz-executor" sig=0 arch=40000003 syscall=264 compat=1 ip=0xf7f71539 code=0x7ffc0000 [ 815.532725][ T30] audit: type=1326 audit(1756091837.596:1934): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15830 comm="syz.0.2728" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f71539 code=0x7ffc0000 [ 815.566745][ T24] usb 5-1: config index 0 descriptor too short (expected 3133, got 61) [ 815.615311][ T24] usb 5-1: config 0 has an invalid interface number: 156 but max is 1 [ 815.658344][ T30] audit: type=1326 audit(1756091837.596:1935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15830 comm="syz.0.2728" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f71539 code=0x7ffc0000 [ 815.680803][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 815.680834][ T24] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 815.680856][ T24] usb 5-1: config 0 has no interface number 0 [ 815.680904][ T24] usb 5-1: config 0 interface 156 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 815.700100][ T30] audit: type=1326 audit(1756091837.596:1936): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15830 comm="syz.0.2728" exe="/root/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf7f71539 code=0x7ffc0000 [ 815.753000][ T30] audit: type=1326 audit(1756091837.596:1937): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15830 comm="syz.0.2728" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f71539 code=0x7ffc0000 [ 815.874385][ T24] usb 5-1: config 0 interface 156 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 816.086351][T15839] random: crng reseeded on system resumption [ 816.165660][ T24] usb 5-1: config 0 interface 156 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 816.179724][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 816.230515][T15844] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 816.250791][ T24] usb 5-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 816.272187][T15844] syzkaller0: entered promiscuous mode [ 816.278229][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 816.286999][T15844] syzkaller0: entered allmulticast mode [ 816.343884][ T24] usb 5-1: config 0 descriptor?? [ 816.507499][ T5868] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 816.567348][ T24] gspca_main: spca561-2.14.0 probing abcd:cdee [ 816.685438][ T92] pegasus 2-1:0.0: probe with driver pegasus failed with error -110 [ 816.785459][ T24] spca561 5-1:0.156: probe with driver spca561 failed with error -22 [ 816.827805][ T24] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 816.876094][ T24] usb 5-1: MIDIStreaming interface descriptor not found [ 817.077726][ T24] usb 5-1: USB disconnect, device number 88 [ 817.210952][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 817.243843][ T92] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 817.452338][ T92] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 817.531048][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 817.870370][T15860] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 817.887124][T15860] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 818.251569][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 818.327288][ T92] usb 2-1: USB disconnect, device number 109 [ 818.571192][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 818.769189][T15868] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2736'. [ 818.982879][T15870] vxcan1: tx drop: invalid sa for name 0x0000000000000006 [ 819.390733][ T24] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 819.570725][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 819.578821][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 819.632255][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 819.754110][ T24] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 819.788665][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 819.836299][ T24] usb 3-1: config 0 descriptor?? [ 820.331645][ C1] net_ratelimit: 2 callbacks suppressed [ 820.331668][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 820.493688][T15875] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 820.511390][ T92] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 820.666484][ T92] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 820.795355][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 820.860310][ T24] usbhid 3-1:0.0: can't add hid device: -71 [ 820.875035][ T24] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 820.951128][ T24] usb 3-1: USB disconnect, device number 102 [ 820.991277][ T92] usb 2-1: Using ep0 maxpacket: 16 [ 821.370826][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 821.654380][T15915] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2750'. [ 821.700885][ T24] usb 5-1: new full-speed USB device number 89 using dummy_hcd [ 821.859016][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 821.893686][ T24] usb 5-1: config 0 has an invalid interface number: 11 but max is 0 [ 821.913836][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 821.956315][ T24] usb 5-1: config 0 has no interface number 0 [ 821.980073][ T24] usb 5-1: config 0 interface 11 altsetting 253 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 822.011548][ T24] usb 5-1: config 0 interface 11 altsetting 253 endpoint 0x87 has invalid maxpacket 8456, setting to 64 [ 822.038332][ T24] usb 5-1: config 0 interface 11 altsetting 253 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 822.177013][ T24] usb 5-1: config 0 interface 11 has no altsetting 0 [ 822.218953][ T24] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 822.243228][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 822.345563][ T24] usb 5-1: config 0 descriptor?? [ 822.411421][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 822.427263][T15926] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2752'. [ 822.471473][ T24] keyspan 5-1:0.11: Keyspan 2 port adapter converter detected [ 822.499556][ T24] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 7 [ 822.575314][T15911] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 822.586272][T15911] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 822.647955][ T24] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 81 [ 822.690916][T14039] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 822.713018][ T24] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 82 [ 822.741155][ T24] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 1 [ 822.795856][ T24] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 2 [ 822.812144][ T24] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 85 [ 822.830753][ T24] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 5 [ 822.894615][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 822.926643][T14039] usb 3-1: no configurations [ 822.930898][ T24] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 822.935219][T14039] usb 3-1: can't read configurations, error -22 [ 822.984955][ T24] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 83 [ 823.036251][ T24] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 84 [ 823.070975][T14039] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 823.079257][ T24] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 3 [ 823.130789][ T24] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 4 [ 823.138773][ T24] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 86 [ 823.160079][ T24] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 6 [ 823.180390][ T24] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 823.232978][T14039] usb 3-1: no configurations [ 823.237689][T14039] usb 3-1: can't read configurations, error -22 [ 823.299140][T14039] usb usb3-port1: attempt power cycle [ 823.450818][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 823.531979][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 823.720814][T14039] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 823.754681][T14039] usb 3-1: no configurations [ 823.780214][T14039] usb 3-1: can't read configurations, error -22 [ 823.931161][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 823.950253][T14039] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 824.024740][T14039] usb 3-1: no configurations [ 824.029439][T14039] usb 3-1: can't read configurations, error -22 [ 824.153102][T14039] usb usb3-port1: unable to enumerate USB device [ 824.290312][T15940] team0: Device gtp1 is of different type [ 824.435997][ T3097] usb 5-1: USB disconnect, device number 89 [ 824.444838][ T3097] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 824.452240][ T3097] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 824.452862][ T3097] keyspan 5-1:0.11: device disconnected [ 824.520459][T15942] netlink: 'syz.0.2755': attribute type 11 has an invalid length. [ 824.608158][ T92] usb 2-1: unable to get BOS descriptor or descriptor too short [ 824.609181][ T92] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 824.609220][ T92] usb 2-1: can't read configurations, error -71 [ 825.530863][ C1] net_ratelimit: 2 callbacks suppressed [ 825.530883][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 825.796193][T15965] team0: Device gtp0 is of different type [ 825.870446][T15951] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2757'. [ 826.011477][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 826.229416][ T30] audit: type=1326 audit(1756091848.626:1938): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15968 comm="syz.2.2763" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f63539 code=0x7ffc0000 [ 826.235803][ T30] audit: type=1326 audit(1756091848.636:1939): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15968 comm="syz.2.2763" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f63539 code=0x7ffc0000 [ 826.235866][ T30] audit: type=1326 audit(1756091848.636:1940): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15968 comm="syz.2.2763" exe="/root/syz-executor" sig=0 arch=40000003 syscall=224 compat=1 ip=0xf7f63539 code=0x7ffc0000 [ 826.235912][ T30] audit: type=1326 audit(1756091848.636:1941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15968 comm="syz.2.2763" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f63539 code=0x7ffc0000 [ 826.235958][ T30] audit: type=1326 audit(1756091848.636:1942): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15968 comm="syz.2.2763" exe="/root/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf7f63539 code=0x7ffc0000 [ 826.236004][ T30] audit: type=1326 audit(1756091848.636:1943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15968 comm="syz.2.2763" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f63539 code=0x7ffc0000 [ 826.236051][ T30] audit: type=1326 audit(1756091848.636:1944): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15968 comm="syz.2.2763" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f63539 code=0x7ffc0000 [ 826.236095][ T30] audit: type=1326 audit(1756091848.636:1945): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15968 comm="syz.2.2763" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f63539 code=0x7ffc0000 [ 826.236139][ T30] audit: type=1326 audit(1756091848.636:1946): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15968 comm="syz.2.2763" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f63539 code=0x7ffc0000 [ 826.236185][ T30] audit: type=1326 audit(1756091848.636:1947): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15968 comm="syz.2.2763" exe="/root/syz-executor" sig=0 arch=40000003 syscall=55 compat=1 ip=0xf7f63539 code=0x7ffc0000 [ 826.357539][T15970] netlink: 'syz.2.2763': attribute type 13 has an invalid length. [ 826.571328][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 826.611240][T14039] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 826.662006][T15972] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2763'. [ 826.690445][T15972] netlink: 'syz.2.2763': attribute type 18 has an invalid length. [ 826.749949][T15972] vxlan1: entered promiscuous mode [ 826.755840][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 827.054433][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 827.542232][ T24] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 827.612126][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 827.790754][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 827.809370][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 827.840541][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 827.875783][ T24] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 827.923026][ T24] usb 2-1: New USB device found, idVendor=046d, idProduct=c293, bcdDevice= 0.00 [ 828.031624][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 828.066299][ T24] usb 2-1: config 0 descriptor?? [ 828.092497][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 828.651221][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 828.739753][T16011] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2773'. [ 828.792746][T16011] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 828.811219][T16011] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 828.883726][T16013] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 829.027633][T16013] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 829.081692][T16011] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2773'. [ 829.136482][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 830.731553][ C1] net_ratelimit: 3 callbacks suppressed [ 830.731575][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 830.764120][T16028] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 830.772488][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 830.997015][T16028] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2778'. [ 831.212215][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 831.271193][T16021] netlink: 'syz.0.2776': attribute type 1 has an invalid length. [ 831.440141][T16030] bond2: entered promiscuous mode [ 831.474532][T16030] bond2: entered allmulticast mode [ 831.480365][T16030] 8021q: adding VLAN 0 to HW filter on device bond2 [ 831.565134][ T24] usbhid 2-1:0.0: can't add hid device: -71 [ 831.594475][ T24] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 831.665842][ T24] usb 2-1: USB disconnect, device number 112 [ 831.729975][T16021] 8021q: adding VLAN 0 to HW filter on device bond3 [ 831.738980][T16021] bond3: entered promiscuous mode [ 831.750851][T16021] bond3: entered allmulticast mode [ 831.756932][T16021] bond2: (slave bond3): Enslaving as a backup interface with a down link [ 831.770934][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 832.281122][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 832.811402][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 833.131353][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 833.271580][T16065] FAULT_INJECTION: forcing a failure. [ 833.271580][T16065] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 833.291529][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 833.404130][T16065] CPU: 0 UID: 0 PID: 16065 Comm: syz.2.2786 Not tainted syzkaller #0 PREEMPT(full) [ 833.404151][T16065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 833.404158][T16065] Call Trace: [ 833.404163][T16065] [ 833.404169][T16065] dump_stack_lvl+0x189/0x250 [ 833.404189][T16065] ? __pfx____ratelimit+0x10/0x10 [ 833.404212][T16065] ? __pfx_dump_stack_lvl+0x10/0x10 [ 833.404235][T16065] ? __pfx__printk+0x10/0x10 [ 833.404263][T16065] ? __might_fault+0xb0/0x130 [ 833.404295][T16065] should_fail_ex+0x414/0x560 [ 833.404317][T16065] _copy_from_user+0x2d/0xb0 [ 833.404332][T16065] move_addr_to_kernel+0x7e/0x160 [ 833.404348][T16065] get_compat_msghdr+0x3bd/0x4a0 [ 833.404364][T16065] ? __pfx_get_compat_msghdr+0x10/0x10 [ 833.404383][T16065] ___sys_sendmsg+0x193/0x2a0 [ 833.404396][T16065] ? __pfx____sys_sendmsg+0x10/0x10 [ 833.404429][T16065] ? __fget_files+0x2a/0x420 [ 833.404445][T16065] ? __fget_files+0x3a0/0x420 [ 833.404467][T16065] __sys_sendmsg+0x164/0x220 [ 833.404481][T16065] ? __pfx___sys_sendmsg+0x10/0x10 [ 833.404502][T16065] ? lockdep_hardirqs_on+0x9c/0x150 [ 833.404519][T16065] __do_fast_syscall_32+0xb6/0x2b0 [ 833.404536][T16065] ? lockdep_hardirqs_on+0x9c/0x150 [ 833.404554][T16065] do_fast_syscall_32+0x34/0x80 [ 833.404570][T16065] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 833.404584][T16065] RIP: 0023:0xf7f63539 [ 833.404595][T16065] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 833.404606][T16065] RSP: 002b:00000000f548655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 833.404620][T16065] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001380 [ 833.404631][T16065] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 833.404638][T16065] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 833.404645][T16065] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 833.404652][T16065] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 833.404668][T16065] [ 833.850820][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 834.099640][T16052] pim6reg1: entered promiscuous mode [ 834.106905][T16052] pim6reg1: entered allmulticast mode [ 834.699130][T16055] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 834.733064][T16055] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 835.022571][T16082] netlink: 'syz.0.2792': attribute type 58 has an invalid length. [ 835.040310][T16082] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2792'. [ 835.087199][T16082] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 835.315150][T16091] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2793'. [ 835.416317][T16096] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2795'. [ 835.930807][ C1] net_ratelimit: 7 callbacks suppressed [ 835.930829][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 836.170968][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 836.339018][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 836.347925][T16104] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2798'. [ 836.411276][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 836.443141][T16110] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2799'. [ 836.525169][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 836.820717][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 836.842383][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 836.971556][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 837.481351][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 837.490466][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 839.260689][ T5952] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 839.410705][ T5952] usb 3-1: Using ep0 maxpacket: 8 [ 839.460563][ T5952] usb 3-1: config 0 has an invalid interface number: 56 but max is 0 [ 839.538088][ T5952] usb 3-1: config 0 has no interface number 0 [ 839.556513][ T5952] usb 3-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=c7.76 [ 839.571677][ T5952] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 839.638692][ T5952] usb 3-1: Product: syz [ 839.653349][ T5952] usb 3-1: Manufacturer: syz [ 839.668140][ T5952] usb 3-1: SerialNumber: syz [ 839.683710][ T5952] usb 3-1: config 0 descriptor?? [ 839.822081][T16148] pim6reg: entered allmulticast mode [ 839.962038][ T5952] peak_usb 3-1:0.56: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 840.211875][ T5952] peak_usb 3-1:0.56 can0: sending command failure: -22 [ 840.290997][ T5952] peak_usb 3-1:0.56 can0: sending command failure: -22 [ 840.315129][ T5952] peak_usb 3-1:0.56 can0: sending command failure: -22 [ 840.567162][T16156] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 840.579101][T16156] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 840.609370][T16159] FAULT_INJECTION: forcing a failure. [ 840.609370][T16159] name failslab, interval 1, probability 0, space 0, times 0 [ 840.637305][T16159] CPU: 1 UID: 0 PID: 16159 Comm: syz.0.2812 Not tainted syzkaller #0 PREEMPT(full) [ 840.637324][T16159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 840.637332][T16159] Call Trace: [ 840.637337][T16159] [ 840.637344][T16159] dump_stack_lvl+0x189/0x250 [ 840.637364][T16159] ? __pfx____ratelimit+0x10/0x10 [ 840.637380][T16159] ? __pfx_dump_stack_lvl+0x10/0x10 [ 840.637393][T16159] ? __pfx__printk+0x10/0x10 [ 840.637412][T16159] ? __pfx___might_resched+0x10/0x10 [ 840.637426][T16159] should_fail_ex+0x414/0x560 [ 840.637445][T16159] should_failslab+0xa8/0x100 [ 840.637462][T16159] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 840.637479][T16159] ? __alloc_skb+0x112/0x2d0 [ 840.637492][T16159] __alloc_skb+0x112/0x2d0 [ 840.637505][T16159] netlink_sendmsg+0x5c6/0xb30 [ 840.637527][T16159] ? __pfx_netlink_sendmsg+0x10/0x10 [ 840.637545][T16159] ? __import_iovec+0x5d4/0x7f0 [ 840.637557][T16159] ? aa_sock_msg_perm+0xf1/0x1d0 [ 840.637569][T16159] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 840.637581][T16159] ? __pfx_netlink_sendmsg+0x10/0x10 [ 840.637598][T16159] __sock_sendmsg+0x21c/0x270 [ 840.637616][T16159] ____sys_sendmsg+0x505/0x830 [ 840.637632][T16159] ? __pfx_____sys_sendmsg+0x10/0x10 [ 840.637653][T16159] ___sys_sendmsg+0x21f/0x2a0 [ 840.637667][T16159] ? __pfx____sys_sendmsg+0x10/0x10 [ 840.637698][T16159] ? __fget_files+0x2a/0x420 [ 840.637714][T16159] ? __fget_files+0x3a0/0x420 [ 840.637736][T16159] __sys_sendmsg+0x164/0x220 [ 840.637749][T16159] ? __pfx___sys_sendmsg+0x10/0x10 [ 840.637770][T16159] ? lockdep_hardirqs_on+0x9c/0x150 [ 840.637788][T16159] __do_fast_syscall_32+0xb6/0x2b0 [ 840.637811][T16159] ? lockdep_hardirqs_on+0x9c/0x150 [ 840.637829][T16159] do_fast_syscall_32+0x34/0x80 [ 840.637846][T16159] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 840.637859][T16159] RIP: 0023:0xf7f71539 [ 840.637871][T16159] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 840.637881][T16159] RSP: 002b:00000000f549655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 840.637895][T16159] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 840.637903][T16159] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 840.637910][T16159] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 840.637917][T16159] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 840.637924][T16159] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 840.637941][T16159] [ 841.131335][ C1] net_ratelimit: 9 callbacks suppressed [ 841.131352][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 841.267154][ T5952] peak_usb 3-1:0.56: probe with driver peak_usb failed with error -22 [ 841.491316][T16174] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 841.522087][T16174] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 841.558734][T16176] netlink: 'syz.1.2819': attribute type 11 has an invalid length. [ 841.609493][T16178] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 841.669870][T16178] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 841.709371][T16178] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 841.747996][T16178] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 842.127746][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 842.170739][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 842.260567][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 842.465567][ T5952] usb 3-1: USB disconnect, device number 107 [ 842.534200][T16200] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2824'. [ 842.894855][T16200] 8021q: VLANs not supported on ip_vti0 [ 843.011100][T16200] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2824'. [ 843.131907][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 843.211456][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 843.607102][T16207] netlink: 'syz.4.2827': attribute type 8 has an invalid length. [ 843.776338][T16209] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 843.784877][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 844.199812][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 844.250824][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 844.513544][T16224] netlink: 'syz.1.2832': attribute type 5 has an invalid length. [ 845.036069][T16233] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 845.046553][T16233] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 846.260957][ T3097] net_ratelimit: 4 callbacks suppressed [ 846.260981][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 846.330821][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 846.383714][T16243] binder: BINDER_SET_CONTEXT_MGR already set [ 846.390351][T16243] binder: 16240:16243 ioctl 4018620d 800002c0 returned -16 [ 847.294547][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 847.371517][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 848.376474][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 848.394945][T14039] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 848.411051][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 848.807509][T16261] syz_tun: tun_net_xmit 42 [ 849.415099][T16267] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2844'. [ 849.451565][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 849.462173][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 849.555104][T16271] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2846'. [ 849.564969][T16270] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2845'. [ 849.574349][T16271] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2846'. [ 849.602925][T16270] vivid-007: ================= START STATUS ================= [ 849.621300][T16270] vivid-007: Enable Output Cropping: true [ 849.627554][T16270] vivid-007: Enable Output Composing: true [ 849.660053][T16270] vivid-007: Enable Output Scaler: true [ 849.681682][T16270] vivid-007: Tx RGB Quantization Range: Automatic [ 849.708946][T16270] vivid-007: Transmit Mode: HDMI [ 849.753988][T16270] vivid-007: Hotplug Present: 0x00000000 [ 849.759787][T16270] vivid-007: RxSense Present: 0x00000000 [ 849.766947][T16270] vivid-007: EDID Present: 0x00000000 [ 849.775708][T16270] vivid-007: ================== END STATUS ================== [ 849.793608][T16277] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 849.812890][T16277] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 849.861040][ C0] syz_tun: tun_net_xmit 42 [ 850.491058][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 850.890890][ C0] syz_tun: tun_net_xmit 42 [ 851.359418][T16309] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2857'. [ 851.531245][ C1] net_ratelimit: 3 callbacks suppressed [ 851.531264][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 851.620731][ T3097] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 851.632289][ T9608] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 851.733349][ T5952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 851.742294][ T5937] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 851.760754][T14039] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 851.847406][T13412] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 851.859804][T13412] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 851.868748][T13412] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 851.878305][T13412] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 851.886243][T13412] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 851.931824][T14039] usb 5-1: Using ep0 maxpacket: 8 [ 851.938713][T14039] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 851.953466][T14039] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 851.981876][T14039] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 851.995896][T14039] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 852.006409][T14039] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 852.020570][ T5185] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 852.025802][T14039] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 852.042964][T16313] fuse: Unknown parameter 'ud0x0000000000000004' [ 852.049793][T14039] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 852.049858][ T5185] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 852.067602][ T5185] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 852.076573][ T5185] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 852.085073][ T5185] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 852.309350][T14039] usb 5-1: GET_CAPABILITIES returned 0 [ 852.329386][T14039] usbtmc 5-1:16.0: can't read capabilities [ 852.384925][ T9599] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 852.425243][ T9599] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 852.517852][T16308] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2861'. [ 852.539022][T16308] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2861'. [ 852.600220][ T9599] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 852.631578][ T9599] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 852.782652][ T24] usb 5-1: USB disconnect, device number 90 [ 852.840579][ T9599] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 852.869963][ T9599] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 853.901298][ T9599] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 853.918868][ T9599] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 854.161112][T16335] kvm: user requested TSC rate below hardware speed [ 854.184502][ T5185] Bluetooth: hci5: command tx timeout [ 855.307417][T16353] sch_tbf: burst 6 is lower than device ip6gre0 mtu (1448) ! [ 856.250445][T16361] netlink: 'syz.1.2873': attribute type 9 has an invalid length. [ 856.262032][ T5185] Bluetooth: hci5: command tx timeout [ 856.866581][ T9599] dvmrp0 (unregistering): left allmulticast mode [ 857.274827][ T9599] bond0 (unregistering): Released all slaves [ 857.289509][ T9599] bond1 (unregistering): Released all slaves [ 857.517035][ T9599] bond2 (unregistering): Released all slaves [ 857.538507][T16316] chnl_net:caif_netlink_parms(): no params data found [ 857.567414][T16356] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2872'. [ 857.592262][T16363] veth1_vlan: left allmulticast mode [ 857.613721][T16363] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2874'. [ 857.650577][T16363] A link change request failed with some changes committed already. Interface veth1_vlan may have been left with an inconsistent configuration, please check. [ 858.105967][ T9599] tipc: Disabling bearer [ 858.118091][ T9599] tipc: Disabling bearer [ 858.137559][ T9599] tipc: Disabling bearer [ 858.170557][ T9599] tipc: Left network mode [ 858.330807][ T5185] Bluetooth: hci5: command tx timeout [ 858.370900][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 858.421106][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 858.481992][T16376] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2876'. [ 859.046988][T16395] syz_tun: entered promiscuous mode [ 859.090513][T16395] batadv_slave_0: entered promiscuous mode [ 859.126120][T16404] netlink: 'syz.0.2884': attribute type 58 has an invalid length. [ 859.141948][T16316] bridge0: port 1(bridge_slave_0) entered blocking state [ 859.155599][T16316] bridge0: port 1(bridge_slave_0) entered disabled state [ 859.178856][T16404] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2884'. [ 859.188842][T16316] bridge_slave_0: entered allmulticast mode [ 859.214792][T16316] bridge_slave_0: entered promiscuous mode [ 859.353093][T16316] bridge0: port 2(bridge_slave_1) entered blocking state [ 859.378075][T16316] bridge0: port 2(bridge_slave_1) entered disabled state [ 859.397811][T16407] IPVS: Scheduler module ip_vs_ not found [ 859.407283][T16316] bridge_slave_1: entered allmulticast mode [ 859.617971][T16316] bridge_slave_1: entered promiscuous mode [ 860.414998][ T5185] Bluetooth: hci5: command tx timeout [ 860.427081][T16316] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 860.594882][T16428] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 860.601546][T16428] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 860.644419][T16432] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2889'. [ 860.697562][T16428] vhci_hcd vhci_hcd.0: Device attached [ 860.754625][T16316] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 860.942096][ T24] usb 33-1: new low-speed USB device number 5 using vhci_hcd [ 861.090407][T16316] team0: Port device team_slave_0 added [ 861.163171][T16316] team0: Port device team_slave_1 added [ 861.268869][T16442] netlink: 188 bytes leftover after parsing attributes in process `syz.3.2891'. [ 861.307267][T16316] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 861.340406][T16316] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 861.376854][T16316] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 861.612921][T16429] vhci_hcd: connection reset by peer [ 861.627258][ T3504] vhci_hcd: stop threads [ 861.640831][ T3504] vhci_hcd: release socket [ 861.655695][ T3504] vhci_hcd: disconnect device [ 861.677662][T16316] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 861.690107][T16316] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 861.717128][T16316] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 861.918218][ T5937] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 862.043792][T16316] hsr_slave_0: entered promiscuous mode [ 862.056434][T16316] hsr_slave_1: entered promiscuous mode [ 862.067336][T16316] debugfs: 'hsr0' already exists in 'hsr' [ 862.076627][T16316] Cannot create hsr debugfs directory [ 862.080710][T14039] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 862.118684][ T9599] veth1_macvtap: left promiscuous mode [ 862.121224][ T5937] usb 5-1: Using ep0 maxpacket: 8 [ 862.138507][ T5937] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 862.147729][ T5937] usb 5-1: config 0 has no interface number 0 [ 862.147811][ T9599] veth0_macvtap: left promiscuous mode [ 862.154609][ T5937] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 862.171087][ T5937] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 862.185799][ T5937] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 862.197442][ T5937] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 862.211189][ T5937] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 862.226902][ T5937] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 862.262070][T14039] usb 2-1: Using ep0 maxpacket: 32 [ 862.269624][T14039] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 862.278764][ T5937] usb 5-1: config 0 descriptor?? [ 862.286198][T14039] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 862.329409][ T5937] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 862.352291][T14039] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 862.387824][T14039] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 862.415171][T14039] usb 2-1: config 0 interface 0 has no altsetting 0 [ 862.435411][T14039] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 862.450444][T14039] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 862.465382][T14039] usb 2-1: Product: syz [ 862.484935][T14039] usb 2-1: Manufacturer: syz [ 862.490341][T14039] usb 2-1: SerialNumber: syz [ 862.523367][T14039] usb 2-1: config 0 descriptor?? [ 862.552235][T14039] ldusb 2-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 862.657201][ T92] usb 5-1: USB disconnect, device number 91 [ 862.668572][T14039] ldusb 2-1:0.0: LD USB Device #1 now attached to major 180 minor 1 [ 862.681419][ T92] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 863.079000][ T9599] pim6reg (unregistering): left allmulticast mode [ 863.588907][T16484] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2901'. [ 865.728098][ T5868] usb 2-1: USB disconnect, device number 113 [ 865.743213][ T5868] ldusb 2-1:0.0: LD USB Device #1 now disconnected [ 866.080778][ T24] vhci_hcd: vhci_device speed not set [ 866.126943][T16502] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 866.133525][T16502] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 866.170157][T16502] vhci_hcd vhci_hcd.0: Device attached [ 866.255005][T16502] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2906'. [ 866.430770][ T92] usb 35-1: new low-speed USB device number 4 using vhci_hcd [ 867.083529][T16505] vhci_hcd: connection reset by peer [ 867.097344][ T3504] vhci_hcd: stop threads [ 867.118265][ T3504] vhci_hcd: release socket [ 867.128786][ T3504] vhci_hcd: disconnect device [ 867.337372][T16316] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 867.360264][T16316] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 867.387535][T16316] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 867.433371][T16316] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 867.955009][T16316] 8021q: adding VLAN 0 to HW filter on device bond0 [ 868.055680][T16316] 8021q: adding VLAN 0 to HW filter on device team0 [ 868.324754][T16564] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 868.334234][T16564] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 868.345561][ T9599] bridge0: port 1(bridge_slave_0) entered blocking state [ 868.352789][ T9599] bridge0: port 1(bridge_slave_0) entered forwarding state [ 868.539129][T16560] netlink: 6 bytes leftover after parsing attributes in process `syz.1.2913'. [ 868.759066][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 868.759085][ T30] audit: type=1326 audit(1756091891.156:1973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16536 comm="syz.1.2913" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x0 [ 868.837903][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 868.845216][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 869.525578][T16316] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 869.900079][T16316] veth0_vlan: entered promiscuous mode [ 870.235811][T16587] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 870.290971][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.297445][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.351764][T16587] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 870.445214][T16587] tipc: Resetting bearer [ 870.585722][T16316] veth1_vlan: entered promiscuous mode [ 870.890396][T16596] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 870.897164][T16596] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 870.948994][T16596] vhci_hcd vhci_hcd.0: Device attached [ 871.869677][T16316] veth0_macvtap: entered promiscuous mode [ 871.916148][T16597] vhci_hcd: connection reset by peer [ 871.950797][ T36] vhci_hcd: stop threads [ 871.955216][ T36] vhci_hcd: release socket [ 871.961188][ T36] vhci_hcd: disconnect device [ 872.081972][T16316] veth1_macvtap: entered promiscuous mode [ 872.144213][ T30] audit: type=1326 audit(1756091894.506:1974): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16623 comm="syz.1.2926" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f11539 code=0x0 [ 872.405647][ T30] audit: type=1326 audit(1756091894.806:1975): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16628 comm="syz.4.2927" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fe4539 code=0x0 [ 872.472380][T16316] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 872.564194][T16316] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 872.601408][ T36] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 872.624754][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 872.654815][ T36] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 872.736351][ T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 873.256799][ T3504] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 873.282884][ T3504] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 873.549726][ T9602] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 873.649062][ T9602] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 875.013420][T16662] input: syz0 as /devices/virtual/input/input67 [ 875.129928][T16662] input: syz1 as /devices/virtual/input/input68 [ 875.683922][T13412] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 875.701061][T13412] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 875.714014][T13412] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 875.725690][T13412] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 875.736308][T13412] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 875.852111][ T5952] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 876.160653][ T5952] usb 5-1: Using ep0 maxpacket: 16 [ 876.169811][ T5952] usb 5-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 876.191006][ T5952] usb 5-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 876.220144][ T5952] usb 5-1: config 0 interface 0 has no altsetting 0 [ 876.229949][ T5952] usb 5-1: New USB device found, idVendor=04d8, idProduct=00df, bcdDevice= 0.00 [ 876.255534][ T5952] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 876.275933][ T5952] usb 5-1: config 0 descriptor?? [ 876.396489][T16674] fuse: Bad value for 'group_id' [ 876.401786][T16674] fuse: Bad value for 'group_id' [ 876.536499][ T43] usb 4-1: USB disconnect, device number 60 [ 876.744138][ T5952] hid_parser_main: 1 callbacks suppressed [ 876.744154][ T5952] mcp2200 0003:04D8:00DF.0010: unknown main item tag 0x0 [ 877.066231][T16673] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 877.067331][ T5952] mcp2200 0003:04D8:00DF.0010: unknown main item tag 0x0 [ 877.116252][ T5952] mcp2200 0003:04D8:00DF.0010: unknown main item tag 0x0 [ 877.129395][ T5952] mcp2200 0003:04D8:00DF.0010: unknown main item tag 0x0 [ 877.146985][ T5952] mcp2200 0003:04D8:00DF.0010: unknown main item tag 0x0 [ 877.197516][ T5952] mcp2200 0003:04D8:00DF.0010: unknown main item tag 0x0 [ 877.232863][ T5952] mcp2200 0003:04D8:00DF.0010: unknown main item tag 0x0 [ 877.271732][ T5952] mcp2200 0003:04D8:00DF.0010: USB HID v0.00 Device [HID 04d8:00df] on usb-dummy_hcd.4-1/input0 [ 877.306450][ T3504] tipc: Resetting bearer [ 877.426601][ T5952] usb 5-1: USB disconnect, device number 92 [ 877.612047][ T2940] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 877.626649][ T92] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 877.770862][ T5185] Bluetooth: hci3: command tx timeout [ 877.870787][ T92] usb 3-1: Using ep0 maxpacket: 8 [ 877.879404][ T92] usb 3-1: config 0 has an invalid interface number: 38 but max is 0 [ 877.899503][ T92] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 877.946728][ T92] usb 3-1: config 0 has no interface number 0 [ 877.968945][ T92] usb 3-1: config 0 interface 38 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 878.009978][ T92] usb 3-1: config 0 interface 38 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 878.042031][ T2940] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 878.087867][ T92] usb 3-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=f8.63 [ 878.094483][ T5868] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 878.138296][ T92] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 878.185287][ T92] usb 3-1: Product: syz [ 878.189604][ T92] usb 3-1: Manufacturer: syz [ 878.228953][ T92] usb 3-1: SerialNumber: syz [ 878.310759][ T5868] usb 2-1: Using ep0 maxpacket: 32 [ 878.322080][ T5868] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 878.331005][ T5868] usb 2-1: config 0 has no interface number 0 [ 878.337160][ T5868] usb 2-1: config 0 interface 184 has no altsetting 0 [ 878.398772][ T92] usb 3-1: config 0 descriptor?? [ 878.464196][ T92] xbox_remote_probe: Unexpected endpoint_in [ 878.564825][ T5868] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 878.599215][ T5868] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 878.620979][ T5868] usb 2-1: Product: syz [ 878.632042][ T5868] usb 2-1: Manufacturer: syz [ 878.645739][ T5868] usb 2-1: SerialNumber: syz [ 878.666558][ T5868] usb 2-1: config 0 descriptor?? [ 878.716053][T16691] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 878.755803][ T2940] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 878.764826][T16691] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 878.866164][ T43] usb 3-1: USB disconnect, device number 108 [ 878.880422][ T5868] smsc75xx v1.0.0 [ 878.892638][ T5868] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 878.924227][ T5868] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -22 [ 879.376071][ T2940] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 879.670886][T16702] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 879.677157][T16702] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 879.810818][T16702] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 879.817084][T16702] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 879.850652][ C1] ------------[ cut here ]------------ [ 879.856446][ C1] workqueue: cannot queue hci_cmd_timeout on wq hci3 [ 879.863276][ C1] WARNING: CPU: 1 PID: 16706 at kernel/workqueue.c:2256 __queue_work+0xd38/0xfb0 [ 879.872391][ C1] Modules linked in: [ 879.876547][ C1] CPU: 1 UID: 0 PID: 16706 Comm: syz.4.2942 Not tainted syzkaller #0 PREEMPT(full) [ 879.885905][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 879.896010][ C1] RIP: 0010:__queue_work+0xd38/0xfb0 [ 879.901304][ C1] Code: 42 80 3c 20 00 74 08 4c 89 ef e8 33 09 99 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 60 de 89 8b 4c 89 fa e8 99 39 f9 ff 90 <0f> 0b 90 90 e9 1a f5 ff ff e8 ea 9a 35 00 90 0f 0b 90 e9 dd fc ff [ 879.920943][ C1] RSP: 0000:ffffc90003f5fa50 EFLAGS: 00010046 [ 879.927030][ C1] RAX: b7256157cdd9a600 RBX: 0000000000000100 RCX: ffff88802f8e9e00 [ 879.935024][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002 [ 879.943110][ C1] RBP: 1ffff1100d241138 R08: ffffc90003f5f767 R09: 1ffff920007ebeec [ 879.951098][ C1] R10: dffffc0000000000 R11: fffff520007ebeed R12: dffffc0000000000 [ 879.959086][ C1] R13: ffff88807bb8c988 R14: 0000000000000008 R15: ffff888069208978 [ 879.967237][ C1] FS: 0000000000000000(0000) GS:ffff888125d1b000(0063) knlGS:00000000569a5440 [ 879.976170][ C1] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 879.982752][ C1] CR2: 00000000f7446288 CR3: 0000000024898000 CR4: 00000000003526f0 [ 879.990832][ C1] Call Trace: [ 879.994159][ C1] [ 879.997105][ C1] call_timer_fn+0x17e/0x5f0 [ 880.001709][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 880.007781][ C1] ? call_timer_fn+0xbe/0x5f0 [ 880.012552][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 880.017677][ C1] ? do_raw_spin_unlock+0x122/0x240 [ 880.022875][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 880.028704][ C1] __run_timer_base+0x646/0x860 [ 880.033566][ C1] ? ktime_get+0x3e/0x1f0 [ 880.037914][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 880.043328][ C1] run_timer_softirq+0xb7/0x180 [ 880.048270][ C1] handle_softirqs+0x283/0x870 [ 880.053039][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 880.057809][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 880.063104][ C1] __irq_exit_rcu+0xca/0x1f0 [ 880.067702][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 880.073032][ C1] irq_exit_rcu+0x9/0x30 [ 880.077293][ C1] sysvec_apic_timer_interrupt+0x57/0xc0 [ 880.082958][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 880.088952][ C1] RIP: 0023:0xf7147d85 [ 880.093026][ C1] Code: 08 89 f9 39 f2 19 d9 73 15 8d 74 26 00 8b 70 f8 8b 58 fc 83 e8 08 89 f9 39 f2 19 d9 72 ef 39 c5 73 3b 8b 54 24 0c 8b 7c 24 18 <89> 5d 04 83 c5 08 8b 5c 24 10 89 75 f8 89 10 8b 70 f8 89 58 04 8b [ 880.112732][ C1] RSP: 002b:00000000f75cf800 EFLAGS: 00000283 [ 880.118910][ C1] RAX: 00000000f66954d0 RBX: 00000000ffffffff RCX: 0000000000000000 [ 880.126889][ C1] RDX: 0000000089581d8b RSI: 0000000089581d8b RDI: 00000000f66953e0 [ 880.134868][ C1] RBP: 00000000f66953f0 R08: 0000000000000000 R09: 0000000000000000 [ 880.142848][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 880.150831][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 880.158836][ C1] [ 880.161899][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 880.169191][ C1] CPU: 1 UID: 0 PID: 16706 Comm: syz.4.2942 Not tainted syzkaller #0 PREEMPT(full) [ 880.178658][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 880.188716][ C1] Call Trace: [ 880.192001][ C1] [ 880.194932][ C1] dump_stack_lvl+0x99/0x250 [ 880.199616][ C1] ? __asan_memcpy+0x40/0x70 [ 880.204212][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 880.209434][ C1] ? __pfx__printk+0x10/0x10 [ 880.214063][ C1] vpanic+0x281/0x750 [ 880.218141][ C1] ? __pfx__printk+0x10/0x10 [ 880.222740][ C1] ? __pfx_vpanic+0x10/0x10 [ 880.227254][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 880.232572][ C1] panic+0xb9/0xc0 [ 880.236337][ C1] ? __pfx_panic+0x10/0x10 [ 880.240809][ C1] __warn+0x31b/0x4b0 [ 880.244800][ C1] ? __queue_work+0xd38/0xfb0 [ 880.249485][ C1] ? __queue_work+0xd38/0xfb0 [ 880.254181][ C1] report_bug+0x2be/0x4f0 [ 880.258526][ C1] ? __queue_work+0xd38/0xfb0 [ 880.263216][ C1] ? __queue_work+0xd38/0xfb0 [ 880.267901][ C1] ? __queue_work+0xd3a/0xfb0 [ 880.272617][ C1] handle_bug+0x84/0x160 [ 880.276868][ C1] exc_invalid_op+0x1a/0x50 [ 880.281378][ C1] asm_exc_invalid_op+0x1a/0x20 [ 880.286252][ C1] RIP: 0010:__queue_work+0xd38/0xfb0 [ 880.291542][ C1] Code: 42 80 3c 20 00 74 08 4c 89 ef e8 33 09 99 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 60 de 89 8b 4c 89 fa e8 99 39 f9 ff 90 <0f> 0b 90 90 e9 1a f5 ff ff e8 ea 9a 35 00 90 0f 0b 90 e9 dd fc ff [ 880.311150][ C1] RSP: 0000:ffffc90003f5fa50 EFLAGS: 00010046 [ 880.317226][ C1] RAX: b7256157cdd9a600 RBX: 0000000000000100 RCX: ffff88802f8e9e00 [ 880.325299][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002 [ 880.333270][ C1] RBP: 1ffff1100d241138 R08: ffffc90003f5f767 R09: 1ffff920007ebeec [ 880.341246][ C1] R10: dffffc0000000000 R11: fffff520007ebeed R12: dffffc0000000000 [ 880.349216][ C1] R13: ffff88807bb8c988 R14: 0000000000000008 R15: ffff888069208978 [ 880.357214][ C1] call_timer_fn+0x17e/0x5f0 [ 880.361825][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 880.367636][ C1] ? call_timer_fn+0xbe/0x5f0 [ 880.372450][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 880.377572][ C1] ? do_raw_spin_unlock+0x122/0x240 [ 880.382776][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 880.388587][ C1] __run_timer_base+0x646/0x860 [ 880.393442][ C1] ? ktime_get+0x3e/0x1f0 [ 880.397787][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 880.403182][ C1] run_timer_softirq+0xb7/0x180 [ 880.408046][ C1] handle_softirqs+0x283/0x870 [ 880.412816][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 880.417585][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 880.422967][ C1] __irq_exit_rcu+0xca/0x1f0 [ 880.427558][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 880.432769][ C1] irq_exit_rcu+0x9/0x30 [ 880.437011][ C1] sysvec_apic_timer_interrupt+0x57/0xc0 [ 880.442652][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 880.448634][ C1] RIP: 0023:0xf7147d85 [ 880.452795][ C1] Code: 08 89 f9 39 f2 19 d9 73 15 8d 74 26 00 8b 70 f8 8b 58 fc 83 e8 08 89 f9 39 f2 19 d9 72 ef 39 c5 73 3b 8b 54 24 0c 8b 7c 24 18 <89> 5d 04 83 c5 08 8b 5c 24 10 89 75 f8 89 10 8b 70 f8 89 58 04 8b [ 880.472416][ C1] RSP: 002b:00000000f75cf800 EFLAGS: 00000283 [ 880.478510][ C1] RAX: 00000000f66954d0 RBX: 00000000ffffffff RCX: 0000000000000000 [ 880.486498][ C1] RDX: 0000000089581d8b RSI: 0000000089581d8b RDI: 00000000f66953e0 [ 880.494475][ C1] RBP: 00000000f66953f0 R08: 0000000000000000 R09: 0000000000000000 [ 880.502463][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 880.510449][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 880.518435][ C1] [ 880.521773][ C1] Kernel Offset: disabled [ 880.526176][ C1] Rebooting in 86400 seconds..