last executing test programs: 9.787575854s ago: executing program 1 (id=999): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8400) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000040)="ee", 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x101, @loopback, 0x8000005}, 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) ioprio_set$uid(0x3, 0x0, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x22201) getsockopt$IP_SET_OP_GET_BYNAME(r0, 0x1, 0x53, &(0x7f0000000380)={0x6, 0x7, 'syz2\x00'}, &(0x7f00000003c0)=0x28) r6 = syz_io_uring_setup(0x239, &(0x7f0000000200)={0x0, 0x7d4b, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r6, 0x2def, 0x1, 0x46, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) r9 = openat$vicodec0(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r9, 0xc0cc5640, &(0x7f0000000440)={0xa, @pix_mp={0x9, 0x8, 0x33565348, 0x1, 0xa, [{0x32badaa3, 0x1f}, {0x81, 0x3}, {0x100000, 0x9}, {0x6, 0x3dc}, {0x8000, 0x5}, {0x9, 0x9}, {0x6, 0x3}, {0x1, 0x6}], 0x3, 0x9, 0x6, 0x0, 0x3}}) ioctl$SG_IO(r1, 0x2285, &(0x7f00000005c0)={0x53, 0x20, 0x5, 0x2, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000300)="4b8d7bcda0", 0x0, 0x0, 0x0, 0x0, 0x0}) r10 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r10, 0x0, 0x40, &(0x7f0000000080)=@raw={'raw\x00', 0x8, 0x3, 0x26c, 0x114, 0x11, 0x148, 0x0, 0x10, 0x1d8, 0x2a8, 0x2a8, 0x1d8, 0x2a8, 0xac, 0x0, {[{{@uncond, 0x10, 0xcc, 0x114, 0x1c, {}, [@common=@ttl={{0x24}, {0x1, 0x3}}, @common=@unspec=@quota={{0x38}, {0x1, 0x0, 0x100, {0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@dev={0xac, 0x14, 0x14, 0x10}, 'bond0\x00', {0xc0000000}}}}, {{@uncond, 0x0, 0x9c, 0xc4, 0x0, {}, [@common=@addrtype={{0x2c}, {0x854, 0x180, 0x1, 0x3}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x3}, {0xffffffffffffffff, 0x1}}}}], {{'\x00', 0xc8, 0x70, 0x94}, {0x24}}}}, 0x2c8) 9.114160726s ago: executing program 4 (id=1003): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x8, 0x0, 0x3}, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) poll(&(0x7f0000000200), 0x51, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000000)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x2, 0x9}, 0x20) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b7020000b96871dfbfa30000030100000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a9a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c048d46362ea0d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337dbcf3456ff6cd0d6b98a258e3509a7d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f009db49c6b8b19613e4d792cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19, 0x0, 0xffffffffffffffff, 0x54, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x42) 8.125382152s ago: executing program 1 (id=1006): syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x162682, 0x0) fanotify_init(0x200, 0x8000) dup(r0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) r4 = syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000075210000000900010073797a300000000060000000030a010100000000000000000100000008000b400000004014000480080002400000000008000140000000000900010073797a300000000008000a40000000021c0008800c00024000000000000000000c000110000100216cc2df8cbb00000000000000000000000a00000000000000"], 0xa8}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x140}}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000100)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYRESOCT=r2, @ANYRESHEX=r4], 0x3c}}, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x4) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}}) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x3fa1dc947ffe4b82}) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) 7.974674935s ago: executing program 0 (id=1008): r0 = socket(0x10, 0x5, 0xffffffb4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@delqdisc={0x2c, 0x25, 0x100, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, r1, {0x10, 0xa}, {0x60ede9961e993d9, 0x9}, {0xd, 0xd}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x9}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) r2 = syz_io_uring_setup(0x6d34, &(0x7f0000000140)={0x0, 0x62fd, 0x2, 0x2, 0x1a0}, &(0x7f00000001c0), &(0x7f0000000200)=0x0) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000240)=""/103, 0x67}, {&(0x7f00000002c0)=""/125, 0x7d}, {&(0x7f0000000340)=""/157, 0x9d}, {&(0x7f0000000400)=""/76, 0x4c}, {&(0x7f0000000480)}], 0x5) r4 = syz_io_uring_setup(0xf29, &(0x7f0000000500)={0x0, 0x4fce, 0x10, 0x2, 0x134, 0x0, r2}, &(0x7f0000000580)=0x0, &(0x7f00000005c0)) syz_io_uring_submit(r5, r3, &(0x7f0000000600)=@IORING_OP_FADVISE={0x18, 0x0, 0x0, @fd_index=0x2, 0x7, 0x0, 0x3, 0x2, 0x1}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xb, 0x9, &(0x7f0000000640)) pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSW2(r7, 0x402c542c, &(0x7f00000006c0)={0x1, 0x4, 0x2, 0x5, 0x6, "3df799f30b0c60886dcd0aea4c5d265ec93ab5", 0x6, 0x9}) ioctl$TIOCL_PASTESEL(r7, 0x541c, &(0x7f0000000700)) r8 = socket$nl_route(0x10, 0x3, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000740)={0xa, 0x4e24, 0x9, @loopback, 0x8}, 0x1c) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000b40)={r7, 0x20, &(0x7f0000000b00)={&(0x7f0000000a40)=""/116, 0x74, 0x0, &(0x7f0000000ac0)=""/9, 0x9}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x6, 0x28, &(0x7f0000000780)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r7}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @cb_func={0x18, 0x6, 0x4, 0x0, 0x4}, @map_val={0x18, 0x0, 0x2, 0x0, r7, 0x0, 0x0, 0x0, 0x8}, @map_fd={0x18, 0x2, 0x1, 0x0, r6}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000008c0)='syzkaller\x00', 0x6b06, 0xfd, &(0x7f0000000900)=""/253, 0x41000, 0x20, '\x00', 0x0, @fallback=0x2f, r6, 0x8, &(0x7f0000000a00)={0x8, 0x2}, 0x8, 0x10, 0x0, 0x0, r9, r6, 0x2, &(0x7f0000000b80)=[r6], &(0x7f0000000bc0)=[{0x1, 0x4, 0xe, 0xb}, {0x3, 0x1, 0x5}], 0x10, 0x31, @void, @value}, 0x94) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r7, 0xc08c5336, &(0x7f0000000cc0)={0x280b, 0x8, 0x0, 'queue0\x00', 0x9}) r11 = openat$hwrng(0xffffff9c, &(0x7f0000000d80), 0x101000, 0x0) unshare(0x2020300) fcntl$setpipe(r0, 0x407, 0x8) syz_open_dev$sndctrl(&(0x7f0000000dc0), 0x9, 0x109082) socket$inet(0x2, 0x80000, 0x0) r12 = io_uring_setup(0x2ace, &(0x7f0000000e00)={0x0, 0x94ba, 0x8000, 0x0, 0x28f}) io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r12, 0x12, 0x0, 0x0) r13 = socket$vsock_stream(0x28, 0x1, 0x0) poll(&(0x7f0000000e80)=[{r4}, {r8, 0x9000}, {r13, 0x4}, {r10, 0x2}, {r8, 0x20}], 0x5, 0xe) r14 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000f00), r6) sendmsg$IPVS_CMD_NEW_DAEMON(r6, &(0x7f0000001000)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f40)={0x78, r14, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x5}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip6erspan0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0x78}, 0x1, 0x0, 0x0, 0x840}, 0x0) r15 = syz_open_dev$rtc(&(0x7f0000001040), 0x8, 0x109000) close_range(r11, r15, 0x2) 7.293426917s ago: executing program 3 (id=1011): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) ppoll(&(0x7f0000000240)=[{r0, 0x2280}], 0x1, 0x0, 0x0, 0x0) r1 = socket$caif_stream(0x25, 0x1, 0x5) shutdown(r1, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = io_uring_setup(0x5e0c, &(0x7f0000000140)={0x0, 0x2002, 0x100, 0x2, 0x1d0}) io_uring_register$IORING_UNREGISTER_RING_FDS(r3, 0x15, &(0x7f0000000000), 0x0) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[@ANYBLOB="1800000024000103000000000000000001"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r5, &(0x7f0000004ec0), 0x0, 0x2000, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r6) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r7, @ANYBLOB="050000000000000000000200000008000300", @ANYRES32, @ANYBLOB="2d000e0080000000ffffffffffff08021100000008021100000000000000000000000000640000002503000000000000080026"], 0x80}}, 0x0) r8 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r8, 0x1, 0xf, 0x0, 0x0) bind$inet(r8, &(0x7f0000000280)={0x2, 0x5e21, @local}, 0x10) r9 = socket$inet(0x2, 0x2, 0x0) bind$inet(r9, &(0x7f0000000280)={0x2, 0x5e21, @empty}, 0x10) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000040)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000240)={@hyper, 0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x20005e}) sendmsg$inet(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) write$P9_RSTATu(r0, &(0x7f0000000580)={0x21e, 0x2, 0x0, {{0x500, 0xdd, 0x0, 0x4, {}, 0x3810000, 0xa000000, 0x0, 0x0, 0x1b, '\x04nod\xff\x01{evoo~\x059\xc6\x00\x05\x00\x007\xd9:\x8b\x92\x00\x00\x00', 0x38, '\xc6GtZ\xc8YR\xbf\xe0\xb0pg>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4', 0x2, '\b\x00', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xe2\x89\xdad\x9a7\x00'}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300, 0x0, 0x0, 0xee01}}, 0x21e) 7.168896477s ago: executing program 0 (id=1012): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) close(0xffffffffffffffff) name_to_handle_at(0xffffffffffffff9c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0, 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x8e79f0352167ea94) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0xfffffffd) r3 = accept4(r2, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f0000001000), 0x581, 0x4000001f, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f00000002c0)={0x3, 0x1, 0x2, 0xff, 0xa4, 0x0, 0x1, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2, 0x20}, 0xe) socket(0x27, 0x1, 0x4) setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r4, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="ed42aaaaaaaaaaaaffffffffffff08004500001c000000000002907800000000e000030000009078006800d2"], 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x2000000, 0x12, r5, 0x0) 7.056047086s ago: executing program 4 (id=1013): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)={0x70, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_SYNPROXY={0xc, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8}]}]}, 0x70}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000500)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101540, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETSNDBUF(r2, 0x400454d4, &(0x7f0000000180)=0xe) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = syz_usb_connect(0x5, 0x3f, &(0x7f0000000240)=ANY=[@ANYBLOB="12010003ac9bcc20d118af1ebb5a0102030109022d00010700800b0904bb06033ae5040009050402b3030fd3040905070020000500ce0905030210"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r4, 0x0, &(0x7f0000000e80)={0x44, &(0x7f0000000a00)=ANY=[@ANYBLOB="40060300000000de"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r7, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_S_DV_TIMINGS(r7, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x190, 0x1, 0x0, 0xdd9f83, 0x1, 0x9, 0x1, 0x2, 0x5, 0x722, 0x13, 0x7, 0x7f, 0x36, 0xb763599953cb091d, {0x0, 0x6fd8e84b}, 0x3, 0xed}}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0x7}, {0xffff, 0xffff}, {0xc}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r8, {0x0, 0x1}, {}, {0x8, 0x6}}, [@filter_kind_options=@f_flow={{0x9}, {0x58, 0x2, [@TCA_FLOW_ACT={0x54, 0x9, 0x0, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x3ff, 0xe, 0x5, 0x1, 0x20d}, 0x1}}]}, {0x4}, {0xc}, {0x11, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x88}}, 0x0) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGKBDIACR(r9, 0x4b4a, &(0x7f0000000440)=""/252) 6.182622479s ago: executing program 3 (id=1017): r0 = socket$l2tp6(0xa, 0x2, 0x73) getsockname(r0, &(0x7f0000000180)=@xdp, &(0x7f0000000100)=0x80) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x4000000046842, 0x0) io_setup(0x222, &(0x7f0000000280)=0x0) io_submit(r2, 0x4, &(0x7f00000000c0)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000)='%', 0x1a000}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) (async) fcntl$getownex(r1, 0x10, &(0x7f0000000000)) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWRULE={0x1174, 0x6, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFTA_RULE_EXPRESSIONS={0x10f0, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @notrack={{0xc}, @val={0x4, 0x2, 0x0, 0x1, ["", "", "", "", "", ""]}}}, {0x10, 0x1, 0x0, 0x1, @queue={{0xa}, @void}}, {0x10b8, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x10a8, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0x8, 0x1, 'ecn\x00'}, @NFTA_MATCH_INFO={0x95, 0x3, "20ac37f2699e06f99845ba89539a0fd717ba9a574e3ff7eb0589fdc583f4c6b8c794a0e2115139d009206cdc2420378cbc52206b2f84897bac558c8a8af9010f8ac259e0204c39b774ec31b6556d879fa1d7d6166f4cf7fa4679e4566e977c8503fc77a67ffae7dea220ecc14405ef72a22c900915209496ac1764c0a20c711bb46670753db717aadab72ce122a97a8bd6"}, @NFTA_MATCH_INFO={0x1004, 0x3, "e88632e948c8d2d5e1b957449b64130014adbe438848963784a456002b97be311e5978cfb334cb2c888fe7e4602894ca437f3c13148f50349bc37c74cee6d007101de50ee3885ee01fedbf7d9960d7176a9bc700191b1e4e8b06bfb0b213a8ec5a60adf23462bd53d57cbf307f733db9d43ba8f3f71429f3f3c8aea62c1cf6ac1c62389d8b3cefe0c2aa4a55f7bf51d41530d9c6b7f5068b159104625a0ea98b1fbb8edcf96c688203063b2aa4c0fa3ca2bb225e2be0102cbce726983dc7434305809fd65b9dc1d5900b509e5023a5f257f386c55238693744b57568dddee7f3169a36fd136804bfc5e1c67363c05bbb90dbf0a322c57f4b822f2db30991c0bfa56882b90dda6cb6d1b38b077a3ea0cd54bcad9fc2ea8bb816cbd4d92cc4b0c3afe77786f37412cbbe0abcdacc06afc9ad9a7bad36cf95d93a8014a902d9acff60687aa03a8da1e056af6f8f700b1dcc3cd837279fc219e6615cd148c45aa860eda7d92f044b22e23d03e3855d1ad0cdb955d16af3b1f724fa1323cf27438a07c551f52482dbf48a3e53adf0510027cb9c606ef2397551995d0c827b3b93ec5c996edffe7cd940d69f5a0e9e7f7d0dbd7dc9bb5641de49828f3f404454865333267461acba703ca14d681e1801dccd3ddb4a3b2929f5ad98ec4aa5a7ec8f1a91f7e0f14b4946ff21fed956577a2f18b7fc3707122234a0907b170132a2e84ad768e6687b2e1cc78fd545890dd356cb77339199390e7a610b58a98aa176c6359a14cea1040e596611bc13437b5927ac8e66d0d339cbf864846dea9ac6efec9a4575c4ff3b504241b08ea0f089e6baf056d918955bc2e3082db6393df434176a06526ec27ff07297fb9fb9a06dacd85bbc0daceb61789a82a78694040f1d1c4cee263225859ebede7fb4e2f783f8bb0dcd8601640ab3d30f904dbac87bd7220738e9826f527b985671871d891cdc13aa57f8616ff8199b27cbdd5e0ac1b12769681e2abbefb9ff321efe4e70bfb79140286ece6759c1e4643069fc0f4b35f888e9a013e8c66519d56f4237a09d663d6430c2d0a7a84050d214b2033cb06624ba37728b13007f8ab6a397b742a6f39d24ec928a44945b3e488376fbddc7d51799d0f8d367f5d7cf50f116a847dac41cb88d8d9a93f33d7790abc6327c205a401ac2299ccde7a1cfb72a65335dfe874aa82b2166682201cf8dc4e0bb54fa1ba77996bf5cd1a3362e99dae14140b833d4e4bfc2000e84697b2baec67492cd315c9c0ba48533ded68a6541b2436ed015cce5f989a1df5b55349819ffc88bfa5da4bb6e3601a29e9855b36640bd493886f4ee431020aa0e14957eb7ce59654e76847398fed19073443c7d65cfc1e468dc81f423beef95afa1b1242c31221d97034298067964f2ea34b56ea28416ec604b5cc3254a0e06223cb7b3337bc5b3dc30539afd9ea1cf24818126726ec1a1bb2e74e237012de255dec80c45e3d7fb962d46d04b61f437ff0498df96eb9414dfa4a255741b33fc91ea84683d3cbc503469dfadb06e7ee5dc3a3c998f851d89f65072f717fa30afef1b425f3342676500e6d12110118ae2963ec85f62096ac92850e61fac275995e01e9839f2836be3b67e696ff88e64051cddd08ce7c109f0ecf4ddeb02db77bffed73b0fd22b4d095dbcb0125bbe88dd2f9d96e527baf05272b54efa9486cc5d6482a1826a9f7db17e4ff1fb41b1d29f9a80ac901e716fc61127d2418145e933080dc7e404f9d4d0028428701b55e475346e8030d80e29a6155311101f08de6fa6bd4446bc5d4c92c3835294ada7ba6081ba92293a5005e18fefdbaa925e0d9ae8bfa94d04d1788353e398dd0062bc1d9c5411e60a935397b3286d6e3f19c94ef8e368c84992fadf49d72c8cf58803fa62aabff4ab74dd59b672cd0f6f801627262c0d504c93c1cdf01b0aaa6aa30d302f79d1e5f7ea840e589d0bbeb49a551e3dd4874bd55ee7319e3feab618808f4e6cb06e89509acb45a8d337f7fd92215842946e7b53193d2a4b2c0fa0149fa85e60cd8e657506894b91a765db34c126aadeff2b5bc5e20eeb6d1a2ee4baf1586f93921c7c63acdf35e45334b1bd41bf570916ac5a5693033cf76ec3dde50778c80a937308964767a4e6cf6a22fabc3540ca68079930a19a2403ba0e804620aa7c08fb71ab867aa78519b87195a5ce51c875163949f794b55458136274a864ef81de253d0e1dc5b6e15fd5d8bb9cf0f86cbe4d793e182db1eb9bf6c173e8a40bb382ad520b4c5f7f5b2aa69b52d7038e25361a5df2707028b98a0a0dcbae114f3aa8a7537fbe0d357cfc65fe42ab9885630ff78516c8cee61b3b9f6e561fa9d15423d5b31d366a73c6d540945ed24c7c2038f118acc60deb00ae8880e8657b78fe937e2dfe0170a3347abe24279a444e987aa22dc2a7dd6c893263c975edbea3bce9a75e8d642fab363b543adb0b1387388d2bcc0e00ce9096b44dc22d402246dc34d9a2931b6083ef31d559c5b95dc6779f46a24634e351c46196e2c5e0829a65dd614d2e5321f40dd951b4a207137e0effa97edb4a042b25d40bb3b347786deb4921a657ba675ac77b2b54e3b99298f88fa50a4107f196b8668746f31180652cda3f7d514c42d3c73eac06e17cc613b171c7f40e6898f142de7d3a48f9916410e0c94498437652b7a865b49f2abcab38fa52f55851379189609442fea468b622b820de90aa1c669a44a80ead6fe8f7c9388b9efcb03149bc9d02cd89e7d547dfcbf8e6c321a366a1727c97f0697ca39e2ba0cf7991c23e935084688fcaa8757d124b8824ac2cebc5273e217d1043dde19070f234ec4b614a76250a525b9b61f4e8fcb51da9cb13386aec44bfbf627a8970a355f6ac598ace1c41766d6462bc27452dab174dbd2fe26cc6721687072d796408bc1311620c622708356e945f8211a11b25e1872a3a107909bc71f406cf7701f57cfdeabea352353e083aea325aa38b02ada0896f967c88d0a940af46c02f94e1d8aef2e766d6814c2c4d0126431bade2727b880f1d0afb5012e0164a5ada2619133c2cf9caabcb0bd95d04193d895e3761121d0719f05e3850deee9cd4756f315ef6bd5b080190051cf6527b9c7a778b97eb5c2f8c74633854a58d75fb7efa29eb5634495df1ac80474601b8b74b467f208d87c73f3af94ec71428500c8575986250f39347266496954127e29800b7448d299e5f11368b0a84dc9fd8bb99e501a87b2a94ccc2c0ead4aa3b37600d079ea15667508d048d416811b2b3fa36c972ef53f4b9476245353c5fd52ac31620c3962043bd9847b662e341821b98103c6d2925b017c1ef5e3b36fd933be30450a489985e6eaed5288e04c297b1a9f9e92e49e184da33f7126a958ac34aac9e90e2102ccfe6f4402736ef34607f3442c52bbdbc7fb435f216af035a588436a4fbcd70cea387c046d620ef93ef9c12cc2f68786903b3c07f78a42b615f53c9afb4ed82ab39912347ae96e698bd652d0d416c9900844e726bf19d814d37f285db473fc22ecc87000556601f7102adf1b19e3bd771c518509fcf3b4c6b7cde72c4a653280c6d5a2d8bcf7343042a1eacd08c55413d5be81caf3858946bb2e6b88692cbc5c91f91363f3e58db3d27ded68caed6173318a5e4dd89f5d033ba27300c8252979c7fdf7e6ea067b34ca2b30c548612f7826ca4070e6dc1b53fdce30f810df28bd3f1c4502bdba3fbf65f0ec553a7a59b36f1e83dcb179efc682453d8ee279545969fb3bd9fbe84811c91f0c311a74df6218edb481c485da58494e391d65deb0d45e7bac5aefcd320f86128fb389a78cb5b8c47d9f685df5ad9c5493f9dcfdc0902d89a30484f22e4dba820835d908d9b74939f67a494dbe4e8bf0081dbefb3e72210a2596dbc047e989891ccacf55a7bee279732cb1030bd238b403750e8004ef579de08afd71f1a3b085154e2f5054ae668755cbd91ec6a9680c699245b23409d6ce85c7fe88dfd22e1ae64b3b07d22f9137c82e2bf859fddf6de2a1c0bce649ffb58e0dd2c5009f983c6ada5a4e4a38b2fc706e30435a8da2f3bb3c398143c95e27edb9219f29e5418977df583b66eb567bd861116b04e372ec01cccf249fb02867fedca0c7fb0ae1b1f89a26117e83a4fe61602d5fbe457475507e3d43d6e39df2623fe7f2c9e279f2cf4ce438710bd5ca8a924ea32d0b434442c4bdd241029ca3b1c018489a1f28b6f4229cc18be8ddc0c9142b2e5ada72555be1440a1b96b5b88df8edb840f4468f4424706ad7067d745956f1cbf5ed71ccf36c87a66281e76e8de08ecffc3acc09d0c66b9616952a9395e81530381798fd10008d077b183778cbd0a54778427fbaed4da90f523c4ebdf534e1d69db3414678aabf272acef811382d843dff7a28ae88fc958e3402ab74bf8af1878bc86d7f68a53f9cdf110e55d52d557483ad2f9db0c3f19da52977dfe2d14ebad5e503ad01e0fc048808d479efdc56af1ee7515044ccaa30a7d14a76b5d77c0ddb36ad64c2c0cf4f9b3681ace55b76a8847870a54a98ef5ccc0dadee63590bf346b7a0aafae01c0cf5a0282add384c7e6282fc2f998d4f1785a0112070633a081f2c645635e69be12af5d419aac50c734023e98e866656136c24746a4a527eb8008a428f9caa03214f257219cf491423db8bfff1808d14046c2b4664fde63e846d989f5003bdc42c26341ecd982aea438de2a99122f91956bec4423df3051e6386044277d89c38e78183467444c0f529b0273c6e0147f056d61d486b3df9208000382e2c13878c9a6d8b908c0facfcf33b3c5d72cd87f5844b45a86421ae3c1c1debb9892ff68635a77bf7fda7d16a1e9cf3fff9f83cf8de342930ac981bc4a09cee5544021589808a9786d884889c7c9d6363183f2d1f09784e32f20b25aec126377c2bd1842a23261a258ba794e825e88831287a432b72e84c2c008bee935161d57efdec68a1eec7be18000d113b3502f0ee5cf05bf80a64cff44589d814bac8b4a939fcb3aa3cf70a16e69a224548aa7a8d01cc80d2742d24fffcac0dfc412f1ec032c64e5f550708cf0835063ec893864f8382907f40150404d7e1c349351e0037f58276f324fd748cc026e0cd5f67cc83869c49071fedfef7afcb369cfb1721f43fda88fe62d8cd7bd65bccb92ccadc31fef28f2d932f982f266424ed351ac4396d735a8f709c72ce6434d6e5b46e8da6a6d6d905d871f629ed3289a807c1ee3a7894a75413ad2c3a68ca2c49b42ac59cde309793bd83261c4653861028450ad2cbcd7ec9fe2a86a4081f509a327e55d52cefd311cf5c9dfa186ce64fce1aec3543197657a37bccc60bdcd28da238b335b3ba96a949c01224cde7792f066bb065a12dbf9b9340e66cd990f070a9333959e3d2dc10664aa4e88a3fa6258bf04b1577f1e89dd824554fcd34f88c5ed41b4e59c00555e4f518293f6b7f0e4de4f7ec856a2e719a45e92dafacee368968f78ece5be88a6f5961dec722a5a8cdd9aa5c2020af6a56455018c6e8df5a6877071374bcee8d5a8e2f2269bc8a4126c55a3c35bcb6ab53d74e55b7415e687b17b4655c668ca14e44eeb0c179433a7bb8a0f58f430fb0876bb86a7eae27a3582f0e5c4bc0950e3a20e5977861fabc49ec48e1b065bd32014913b21bf350794b64927da053b2f30543d2eac5b65b6ca82e37eef5236618b94b449b91e9c704dcc20ad62d8002548bdcbc695e1791832a908e0737c9441723e146eab95673e5bc69dec8a4de3cc913d183d8780f3fc1a6d0af653"}]}}}, {0x10, 0x1, 0x0, 0x1, @redir={{0xa}, @void}}]}, @NFTA_RULE_COMPAT={0x4c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x6c}, @NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x88fb}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x8914}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x8035}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x1d}]}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}, @NFTA_RULE_USERDATA={0xe, 0x7, 0x1, 0x0, "c06c017ec26378a9a837"}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x11f4}}, 0x20000000) 5.971343801s ago: executing program 3 (id=1019): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8400) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000040)="ee", 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x101, @loopback, 0x8000005}, 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) ioprio_set$uid(0x3, 0x0, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x22201) getsockopt$IP_SET_OP_GET_BYNAME(r0, 0x1, 0x53, &(0x7f0000000380)={0x6, 0x7, 'syz2\x00'}, &(0x7f00000003c0)=0x28) r6 = syz_io_uring_setup(0x239, &(0x7f0000000200)={0x0, 0x7d4b, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r6, 0x2def, 0x1, 0x46, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) r9 = openat$vicodec0(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r9, 0xc0cc5640, &(0x7f0000000440)={0xa, @pix_mp={0x9, 0x8, 0x33565348, 0x1, 0xa, [{0x32badaa3, 0x1f}, {0x81, 0x3}, {0x100000, 0x9}, {0x6, 0x3dc}, {0x8000, 0x5}, {0x9, 0x9}, {0x6, 0x3}, {0x1, 0x6}], 0x3, 0x9, 0x6, 0x0, 0x3}}) ioctl$SG_IO(r1, 0x2285, &(0x7f00000005c0)={0x53, 0x20, 0x5, 0x2, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000300)="4b8d7bcda0", 0x0, 0x0, 0x0, 0x0, 0x0}) r10 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r10, 0x0, 0x40, &(0x7f0000000080)=@raw={'raw\x00', 0x8, 0x3, 0x26c, 0x114, 0x11, 0x148, 0x0, 0x10, 0x1d8, 0x2a8, 0x2a8, 0x1d8, 0x2a8, 0xac, 0x0, {[{{@uncond, 0x10, 0xcc, 0x114, 0x1c, {}, [@common=@ttl={{0x24}, {0x1, 0x3}}, @common=@unspec=@quota={{0x38}, {0x1, 0x0, 0x100, {0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@dev={0xac, 0x14, 0x14, 0x10}, 'bond0\x00', {0xc0000000}}}}, {{@uncond, 0x0, 0x9c, 0xc4, 0x0, {}, [@common=@addrtype={{0x2c}, {0x854, 0x180, 0x1, 0x3}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x3}, {0xffffffffffffffff, 0x1}}}}], {{'\x00', 0xc8, 0x70, 0x94}, {0x24}}}}, 0x2c8) 5.565428191s ago: executing program 0 (id=1021): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a80)=ANY=[@ANYBLOB="14000000100001000000f4ff000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a31000000005c000000060a010400000000000000000100000008000b4000000000340004803000018008000100636d7000240002801000038009000100efbb17b799000000080001400000200b08000240000000000900010073797a30"], 0xd0}}, 0x0) 5.075563265s ago: executing program 0 (id=1022): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000000240)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x0, @remote, 0x9}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000140)="7957d404736da65f9d", 0x9}, {&(0x7f00000000c0)}, {&(0x7f0000000180)="ade31e7ea268a7", 0x7}], 0x3, &(0x7f00000020c0)=ANY=[@ANYRES32=r0], 0x590}}], 0x1, 0x8008801) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='gid_map\x00') r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) r5 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r4, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x2c, 0x11, 0x1, 0x2000000, 0xffffffff, {0x0, 0x0, 0x0, r4, {}, {}, {0xfff3}}, [{0x8, 0xb, 0x200}]}, 0x2c}}, 0x0) bind$packet(r1, &(0x7f0000000040)={0x11, 0x1b, r4, 0x1, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x224b5bee36ba75e4}}, 0x14) ioctl$IOCTL_STATUS_ACCEL_DEV(r1, 0x40046103, &(0x7f0000000040)={0x7, 0x0, 0x0, 0x2, 0x10, 0x4, 0x3, 0x80, 0x7, 0xa, 0xd2, "5f42f0fced6abfba6b611177ab09d03ee0e6963fe6d488006e3f3ebf02f41cdc"}) sendmmsg$inet6(r0, &(0x7f00000006c0), 0x0, 0x2604082c) 4.24188934s ago: executing program 3 (id=1023): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x38}}, 0x40840) r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x20, 0x70bd29, 0x25dfdc00, {0x60, 0x0, 0x0, 0x0, {0xfff1, 0xfff2}, {0x1, 0xc}, {0xfff3, 0x8}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_NAT={0x8, 0xb, 0x104}, @TCA_CAKE_TARGET={0x8, 0x8, 0x2}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x44045}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x4000000) r2 = socket(0x10, 0x803, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=@getchain={0x24, 0x66, 0x0, 0x0, 0x2000}, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000700)=0x14) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xcabd8245) fcntl$getownex(r0, 0x10, &(0x7f00000000c0)={0x0, 0x0}) write$cgroup_pid(r6, &(0x7f00000001c0)=r7, 0x12) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012800b0001006914000300ff020000000000000000000080000001"], 0x48}}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 3.874124567s ago: executing program 1 (id=1024): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x0, 0x800, 0xbbba, 0x0, 0x18, 0x0, {}, {0x7ffffcff, 0xfffffffd, 0xfffffffe}, {0x0, 0xffff0000}, {0xffffff}, 0x0, 0x3f0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}) 3.574599396s ago: executing program 2 (id=1025): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x17c, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@remote, 0x0, 0x3, 0x4e1d, 0x0, 0xa, 0x0, 0x80, 0x5e}, {0x0, 0x800, 0x0, 0x7, 0x500000000000000, 0x0, 0x3, 0x7}, {0x0, 0x0, 0x1}}, [@tmpl={0xc4, 0x5, [{{@in=@remote, 0x0, 0x6c}, 0x0, @in6=@mcast2, 0x0, 0x0, 0x0, 0x56, 0x0, 0xfffffffd, 0x2}, {{@in=@broadcast, 0x0, 0x32}, 0x0, @in6=@remote, 0x3502, 0x3, 0x2}, {{@in6=@local, 0x4d3, 0x3c}, 0x2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}]}, 0x17c}}, 0x0) 3.444002836s ago: executing program 1 (id=1026): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000140), 0x1e) keyctl$reject(0x13, 0x0, 0x7, 0x204, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x10000, 0x0, 0xb49, 0x9, 0x6, 0x0, 0x3}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) socket(0x400000000010, 0x3, 0x0) munmap(&(0x7f0000001000/0x2000)=nil, 0x2000) r3 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r3, 0xc01064bd, &(0x7f00000000c0)={&(0x7f0000000040)="c0e2c3", 0x259584305129a66}) r4 = syz_open_dev$vim2m(&(0x7f0000002c80), 0x7ff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000080)={0x7, 0x1, 0x4}) ioctl$vim2m_VIDIOC_QUERYBUF(r4, 0xc04c5609, &(0x7f0000000400)=@userptr={0x6, 0x1, 0x4, 0x40, 0xf1, {}, {0x3, 0xc, 0x80, 0x4, 0x6, 0x2, "ab438f99"}, 0x3, 0x2, {0x0}, 0x800}) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = syz_open_dev$sndctrl(&(0x7f0000002b80), 0x1, 0x8000) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r5, 0xc2c45513, &(0x7f0000002e00)={{0x8, 0x7, 0x3, 0x1ff, 'syz0\x00', 0x7f}, 0x0, [0x8, 0x8, 0x1000, 0x0, 0xb3c, 0xffffffff, 0x1000005, 0x901, 0xbbf, 0x7, 0x15b, 0x7, 0x5944, 0x9, 0x7, 0x4a7, 0x9, 0x5, 0xd, 0x3, 0x2c, 0x400, 0x40, 0x10000000, 0x6, 0x0, 0xffffffff, 0x800, 0x3, 0x3, 0x4, 0x6, 0x6, 0xfff, 0x3ff, 0x1, 0x5, 0x40000003, 0x5, 0x9, 0x7, 0x7fff, 0xffff8000, 0x80000001, 0x53f2806a, 0x20, 0x3, 0x0, 0xe, 0x4, 0x9, 0x5, 0x400, 0x3, 0x9, 0xfffff647, 0x8, 0x4, 0x5, 0x0, 0x9, 0x9, 0x5, 0x8, 0x98, 0xbe, 0x6, 0xa, 0x7, 0x80000000, 0x81, 0x10001, 0x2, 0x80000001, 0x69d, 0xb, 0x3, 0x1, 0x8, 0x9, 0x7, 0x9, 0x1, 0x3, 0x1, 0xffff, 0x6, 0x8, 0x7ff, 0x4, 0xef, 0xff, 0x6, 0x3, 0xf86, 0x589f, 0x3, 0x9, 0x895, 0xfff, 0x9, 0x89, 0x0, 0x1, 0xe0b2, 0x9, 0xfffff561, 0xe, 0x3, 0x3, 0xfffffffa, 0x3, 0x2, 0x1, 0x2ba, 0x1, 0xe, 0x0, 0xf, 0x2, 0xf2, 0x4, 0x0, 0x7, 0x2, 0x7, 0x6, 0x100]}) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'hsr0\x00', 0x0}) bind$packet(r6, &(0x7f0000000000)={0x11, 0x3, r7, 0x1, 0x0, 0x6, @local}, 0x14) r8 = syz_open_procfs(0x0, &(0x7f0000000080)='net/softnet_stat\x00') sendfile(r8, r8, &(0x7f0000000040)=0x87, 0x3) openat$vhost_vsock(0xffffff9c, &(0x7f00000000c0), 0x2, 0x0) 3.399365952s ago: executing program 2 (id=1027): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x17c, 0x19, 0x1, 0x0, 0x1, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x500000000000000}, {0x0, 0x0, 0x0, 0x2000000000}}, [@tmpl={0xc4, 0x5, [{{@in6=@remote, 0x0, 0x33}, 0x0, @in=@broadcast, 0x0, 0x2, 0x0, 0x0, 0xffffffff, 0x0, 0x40}, {{@in6=@local, 0x4d2, 0x33}, 0x0, @in=@empty}, {{@in=@remote, 0x0, 0x32}, 0x0, @in6=@private1, 0x0, 0x5}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 3.194785458s ago: executing program 2 (id=1028): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000002840)={0x400, 0x300, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, {0x4}, {}, {0x0, 0x20}, {0x0, 0x0, 0x1}, 0x0, 0x3f0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x3, 0x1}) 2.97179155s ago: executing program 2 (id=1029): socket$nl_route(0x10, 0x3, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) openat$cuse(0xffffff9c, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x222e, &(0x7f0000000280)={0x0, 0x1b6c, 0x10100}, &(0x7f0000000080)=0x0, &(0x7f00000003c0)=0x0) syz_io_uring_submit(r1, r2, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x8000, 0x800000, 0x0, 0x0, 0x2}) io_uring_enter(r0, 0x53d1, 0x0, 0x4, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141121) r5 = dup(r4) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000005080000024d564b"]) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x82000, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000200)=@newtfilter={0x38, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x3}, {0x3, 0xc}, {0x1c}}, [@filter_kind_options=@f_flower={{0xb}, {0x8, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x4}]}}]}, 0x38}}, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000080)={0xbe, 0x0, 0x1}) ioctl$KVM_GET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000040)) r7 = socket$inet_sctp(0x2, 0x5, 0x84) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000280), &(0x7f0000000240)=0xc) getsockopt$inet_sctp6_SCTP_MAX_BURST(r8, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r7, 0x84, 0x1, &(0x7f0000000040)={r9, 0x401, 0x4, 0x8, 0x3, 0x21b41bac}, &(0x7f0000000080)=0x14) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r5, 0x84, 0x13, &(0x7f0000000280)={r9}, &(0x7f0000000380)=0x8) r10 = syz_io_uring_setup(0x5ee7, &(0x7f0000000400)={0x0, 0x37b5, 0x10100, 0x0, 0x8b}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r11, r12, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r4}) io_uring_enter(r10, 0x2def, 0x4000, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x8}, 0x0, &(0x7f00000002c0)={0x402, 0x0, 0xfffffffffffffffc, 0x9, 0x0, 0x0, 0x7fffffff, 0x2}, 0x0, 0x0) 2.431283344s ago: executing program 0 (id=1030): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x8, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="180000300a0000180000000001000000b7080000000010007baa00fe00000000b5080200000000007b8af0ff00000000bf8100000000000007010000a8d5b100bfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000004850000000800000095"], &(0x7f0000000300)='GPL\x00', 0x3, 0xff7, &(0x7f0000001e00)=""/4087, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 2.379461894s ago: executing program 3 (id=1031): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) close(0xffffffffffffffff) name_to_handle_at(0xffffffffffffff9c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0, 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x8e79f0352167ea94) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0xfffffffd) r3 = accept4(r2, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f0000001000), 0x581, 0x4000001f, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f00000002c0)={0x3, 0x1, 0x2, 0xff, 0xa4, 0x0, 0x1, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2, 0x20}, 0xe) socket(0x27, 0x1, 0x4) setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r4, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="ed42aaaaaaaaaaaaffffffffffff08004500001c000000000002907800000000e000030000009078006800d2"], 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x2000000, 0x12, r5, 0x0) 2.063438924s ago: executing program 4 (id=1032): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x8, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000a0000000000200000000001bf080000000001007baaf8ff00000000b5080200000000007b8af0ff00000000bf8100000000000007010000a8d5b100bfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000001000000b705000008000000850000000800200095"], &(0x7f0000000300)='GPL\x00', 0xa, 0xff7, &(0x7f0000001e00)=""/4087, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 1.88423361s ago: executing program 2 (id=1033): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000100001000000000000000000000c000a20000000000a01040000000000000000010000000900010073797a310000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000050900010073797a310000000038000000050a01020000000000000000010020000c00024000000000000000010900010073797a31000000000c000494080002401ace24d114000000110001"], 0xc0}}, 0x0) 1.874485686s ago: executing program 4 (id=1034): r0 = socket$key(0xf, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet(0x2, 0x3, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000840)=@ipv4_newroute={0x88, 0x18, 0x400, 0x70bd2a, 0x25dfdbfd, {0x2, 0x20, 0x0, 0x8, 0xff, 0x3, 0x0, 0x8, 0x200}, [@RTA_FLOW={0x8, 0xb, 0x6}, @RTA_SPORT={0x6, 0x1c, 0x4e22}, @RTA_UID={0x8}, @RTA_MARK={0x8, 0x10, 0x5}, @RTA_SPORT={0x6, 0x1c, 0x4e24}, @RTA_DPORT={0x6, 0x1d, 0x4e23}, @RTA_IP_PROTO={0x5, 0x1b, 0x11}, @RTA_OIF={0x8}, @RTA_PREFSRC={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0xe}}, @RTA_PREFSRC={0x8, 0x7, @private=0xa010102}, @RTA_MULTIPATH={0xc, 0x9, {0x1, 0x4, 0x5, r4}}, @RTA_TABLE={0x8, 0xf, 0x3}, @RTA_PRIORITY={0x8, 0x6, 0x9}]}, 0x88}, 0x1, 0x0, 0x0, 0x4001}, 0x40) ioprio_set$pid(0x1, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=@newlink={0x5c, 0x10, 0x401, 0xfffffffc, 0x800086, {0x0, 0x0, 0x0, r4, 0x1d53}, [@IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x136e0}, @IFLA_EXT_MASK={0x8, 0x1d, 0x80}, @IFLA_CARRIER_CHANGES={0x8, 0x23, 0x9}, @IFLA_EVENT={0x8, 0x2c, 0xffffffff}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond_slave_1\x00'}, @IFLA_PROTO_DOWN={0x5, 0x27, 0x6}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4006045}, 0x0) sendmsg$inet(r2, &(0x7f0000000600)={&(0x7f0000000000)={0x2, 0x3}, 0x10, &(0x7f0000000800)=[{0x0}, {&(0x7f0000000440)="6a98", 0x2}], 0x2}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'erspan0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="6800000010000104000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000677265002c00028005000900020000000800055cd0df7234ad717f000300000008001500469d070005001700000000000800150066bf09e80400110001000200be56fd8d0362b3519435a0fca72d81e278f167d90e7c91360c4976ecc3ea41d5a4e03466c30dd008f5f6859100d093f0519afee79aa0a6"], 0x68}, 0x1, 0x0, 0x0, 0x40088d0}, 0x4000000) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000300)=@newlink={0x50, 0x10, 0xc3b, 0x0, 0x0, {0x0, 0x0, 0x0, r6, 0x0, 0x40}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_IGNORE_DF={0x5, 0x13, 0xfd}, @IFLA_GRE_IKEY={0x8, 0x4, 0x2e84}, @IFLA_GRE_ERSPAN_HWID={0x6, 0x18, 0x3ff}]}}}]}, 0x50}}, 0x0) sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="0203f30216000000000000000000000002001b0008000000e9000000000000000300060000000000020000000000000000000000000000000200010000000000000003fcff000020030005000000000002000000ac1414aa00000000000000000a00080008"], 0xb0}, 0x1, 0x7}, 0x0) r8 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x8, &(0x7f0000000640)=[@in6={0xa, 0x4e21, 0x10, @private0, 0x8}]}, &(0x7f0000000180)=0xc) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r8, 0x84, 0x6d, &(0x7f0000000040)={r9}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000500)={0x6, 0x8208, 0xbe5c, 0x4, r9}, 0x10) creat(&(0x7f00000001c0)='./file0\x00', 0x0) r10 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r10, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) faccessat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x3) openat$vim2m(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) r11 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r11, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) bind$inet6(r11, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0xfffffffd, @empty}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r11, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) 1.737708349s ago: executing program 0 (id=1035): syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x162682, 0x0) fanotify_init(0x200, 0x8000) dup(r0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) r4 = syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000075210000000900010073797a300000000060000000030a010100000000000000000100000008000b400000004014000480080002400000000008000140000000000900010073797a300000000008000a40000000021c0008800c00024000000000000000000c000110000100216cc2df8cbb00000000000000000000000a00000000000000"], 0xa8}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x140}}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000100)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYRESOCT=r2, @ANYRESHEX=r4], 0x3c}}, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(0xffffffffffffffff, 0x4) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}}) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x3fa1dc947ffe4b82}) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) 1.584109526s ago: executing program 2 (id=1036): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8400) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000040)="ee", 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x101, @loopback, 0x8000005}, 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) ioprio_set$uid(0x3, 0x0, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x22201) getsockopt$IP_SET_OP_GET_BYNAME(r0, 0x1, 0x53, &(0x7f0000000380)={0x6, 0x7, 'syz2\x00'}, &(0x7f00000003c0)=0x28) syz_io_uring_setup(0x239, &(0x7f0000000200)={0x0, 0x7d4b, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0xc102, 0x0) r8 = openat$vicodec0(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r8, 0xc0cc5640, &(0x7f0000000440)={0xa, @pix_mp={0x9, 0x8, 0x33565348, 0x1, 0xa, [{0x32badaa3, 0x1f}, {0x81, 0x3}, {0x100000, 0x9}, {0x6, 0x3dc}, {0x8000, 0x5}, {0x9, 0x9}, {0x6, 0x3}, {0x1, 0x6}], 0x3, 0x9, 0x6, 0x0, 0x3}}) ioctl$SG_IO(r1, 0x2285, &(0x7f00000005c0)={0x53, 0x20, 0x5, 0x2, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000300)="4b8d7bcda0", 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000080)=@raw={'raw\x00', 0x8, 0x3, 0x26c, 0x114, 0x11, 0x148, 0x0, 0x10, 0x1d8, 0x2a8, 0x2a8, 0x1d8, 0x2a8, 0xac, 0x0, {[{{@uncond, 0x10, 0xcc, 0x114, 0x1c, {}, [@common=@ttl={{0x24}, {0x1, 0x3}}, @common=@unspec=@quota={{0x38}, {0x1, 0x0, 0x100, {0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@dev={0xac, 0x14, 0x14, 0x10}, 'bond0\x00', {0xc0000000}}}}, {{@uncond, 0x0, 0x9c, 0xc4, 0x0, {}, [@common=@addrtype={{0x2c}, {0x854, 0x180, 0x1, 0x3}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x3}, {0xffffffffffffffff, 0x1}}}}], {{'\x00', 0xc8, 0x70, 0x94}, {0x24}}}}, 0x2c8) 1.524554159s ago: executing program 1 (id=1037): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000080)={'syz0\x00', {}, 0x0, [0x0, 0x3, 0x403, 0x81, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3, 0x10000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xfffffffd], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedc0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffff8, 0x0, 0x0, 0x79, 0xfffffffd, 0x0, 0x0, 0x0, 0x2, 0x47, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff0, 0x4, 0xfffffffc, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x20], [0x0, 0xfffffffc, 0x0, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x5, 0x89, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0xfffffffe, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x351e, 0x0, 0xfffffffd, 0xfffffffc, 0x0, 0x6492, 0x8], [0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x200000, 0x0, 0x0, 0x10, 0x0, 0x0, 0x804, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x2, 0x0, 0x4, 0x0, 0xfd32, 0x6, 0x0, 0x0, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x4, 0x0, 0x0, 0x0, 0x100000]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000500)={'syz0\x00', {0x1, 0x1, 0x400, 0x64}, 0x4d, [0x5bd, 0x4, 0x0, 0x3, 0x6, 0xcfca, 0x400000, 0x2, 0x8, 0x8295, 0x7cc3, 0x5, 0x171, 0x0, 0x4, 0x4, 0xa09, 0x7, 0x80000000, 0x10001, 0x6, 0xff, 0x4, 0x1, 0x3, 0x8000, 0xe1, 0x0, 0x1, 0xac8, 0x4, 0x8, 0xffffffff, 0x101, 0x1, 0x8, 0x4, 0x5, 0x6, 0x80000001, 0x8, 0xffff, 0x1, 0x81, 0x400, 0x8, 0x1ff, 0x80000005, 0x6, 0x9, 0x1, 0x1000, 0x7, 0xfffe, 0x3ff, 0xffffff2a, 0x100, 0x40, 0x10, 0x8, 0x63, 0xb, 0x3, 0x81], [0x4, 0x9, 0x2, 0x4, 0x0, 0x1, 0x5, 0x6, 0x1, 0x7f, 0xffffffff, 0x100, 0x1, 0x2, 0xfa39, 0x200, 0x6, 0x5, 0x6, 0x1, 0x9, 0x8, 0x38000, 0x8, 0x5, 0x200, 0x6770, 0x4, 0x9, 0xe, 0x1f, 0x1, 0x3, 0x0, 0x3, 0xa4b5, 0x8, 0xa75, 0x5, 0x0, 0xaa, 0x2, 0xff, 0x7fff, 0x2e, 0x3, 0x4, 0x800, 0x3e29eb4d, 0x5ece2dfb, 0x5, 0x2, 0x20000008, 0x5, 0x10000, 0x1, 0x3ff, 0xa009, 0x200, 0x6, 0x3, 0xfff, 0x3, 0x8], [0xffffffff, 0x362, 0x3, 0x5, 0x3, 0x5, 0xd, 0x4, 0x7, 0xbc83, 0x9, 0x80000000, 0x9e3, 0x3ae81e81, 0x1ff, 0xfffffbff, 0x7, 0x9, 0x1000, 0x2, 0x1, 0x5, 0x7, 0x2, 0x3, 0x1fc00, 0x2, 0x8, 0x8, 0x1000, 0x5, 0x1, 0x200, 0x1, 0x4, 0x6, 0x200, 0x10, 0x5, 0x7, 0xfff, 0x2, 0x1, 0x50, 0x4, 0x101, 0x7, 0xfffffbff, 0x7, 0x10001, 0xfff, 0x8, 0xb, 0x8, 0x1, 0x3, 0x7, 0x8, 0x5, 0x32, 0x505, 0x4, 0x0, 0x3], [0x6, 0x0, 0x7fff, 0x4, 0x109, 0x3ff, 0x0, 0x1f, 0x4, 0xf9, 0xfffffff3, 0x5, 0x9, 0x8, 0x79, 0x8, 0x7, 0x1, 0x5, 0x6, 0x7ff, 0xb, 0x3, 0x2, 0xd, 0x6, 0x6, 0x6, 0x40000000, 0x80000001, 0xfffffff8, 0x8, 0x523, 0x6, 0x5, 0x1, 0x0, 0x4, 0x3, 0x5, 0xa6e, 0x8, 0x80000001, 0x10, 0xed, 0x5, 0x8, 0xf, 0x5, 0x9, 0x9, 0x40, 0x8000, 0x1, 0x7, 0x10, 0x4, 0x4ef8, 0x2, 0x5, 0xffff0fe5, 0x2500, 0x6, 0x262de53c]}, 0x45c) 1.361076017s ago: executing program 1 (id=1038): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r2, &(0x7f0000000440)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000400)={&(0x7f00000001c0)={0x214, 0xa, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x3c}, @NFTA_SET_EXPRESSIONS={0xf0, 0x12, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @tproxy={{0xb}, @void}}, {0x5c, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x5d}, @NFTA_PAYLOAD_CSUM_OFFSET={0x8, 0x7, 0x1, 0x0, 0xff}, @NFTA_PAYLOAD_CSUM_TYPE={0x8}, @NFTA_PAYLOAD_SREG={0x8, 0x5, 0x1, 0x0, 0x16}, @NFTA_PAYLOAD_CSUM_OFFSET={0x8, 0x7, 0x1, 0x0, 0x9}, @NFTA_PAYLOAD_CSUM_OFFSET={0x8, 0x7, 0x1, 0x0, 0x4}, @NFTA_PAYLOAD_CSUM_TYPE={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_PAYLOAD_DREG={0x8}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x85}]}}}, {0x14, 0x1, 0x0, 0x1, @synproxy={{0xd}, @void}}, {0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}, {0x2c, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x8}]}}}, {0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}, {0x10, 0x1, 0x0, 0x1, @exthdr={{0xb}, @void}}, {0x18, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0x4}}}]}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x1}, @NFTA_SET_DESC={0xe4, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x3c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}, {0x2c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0xa3}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x800}, @NFTA_SET_DESC_CONCAT={0x7c, 0x2, 0x0, 0x1, [{0x4c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xdb}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x984}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5837}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xe075}]}, {0x2c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x63ed}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x40}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7f}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffa}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}]}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}, @NFTA_SET_EXPR={0x10, 0x11, 0x0, 0x1, @payload={{0xc}, @void}}]}, 0x214}, 0x1, 0x0, 0x0, 0x24000010}, 0x2400c044) unshare(0x2040400) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x1b, &(0x7f0000000040)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}, 0x4, 0x0, 0xff, 0x4}, 0x20) r6 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCXONC(r6, 0x540a, 0x2) close(r6) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') read$watch_queue(r7, &(0x7f0000001540)=""/4111, 0x100f) sendfile(r4, r4, 0x0, 0x200000) 1.359106479s ago: executing program 4 (id=1039): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x1, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000085b03e007d00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000820000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r5, 0x0, 0x6, 0x8, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) openat$audio1(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) symlinkat(&(0x7f0000000000)='.\x02\x00', 0xffffffffffffffff, 0x0) ioctl$EVIOCGLED(0xffffffffffffffff, 0x40284504, &(0x7f0000000000)=""/56) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="34000000100001002bbd70000000feffffff2000", @ANYRES32=0x0, @ANYBLOB="00000100000000000a000200aaaaaaaaaabb000008001b"], 0x34}, 0x1, 0x0, 0xffffffff, 0x10}, 0x0) 680.137665ms ago: executing program 4 (id=1040): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x108) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') unshare(0x2c020400) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = gettid() sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect$printer(0x4, 0x0, 0x0, 0x0) dup(0xffffffffffffffff) syz_usb_connect$hid(0x3, 0x3f, &(0x7f00000001c0)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x20, 0x4d8, 0xdd, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x8, 0xa4, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x1, 0x2, 0x8, {0x9, 0x21, 0x9, 0xe, 0x1, {0x22, 0x788}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0xa, 0xc, 0xf3}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x0, 0x77, 0x9a}}]}}}]}}]}}, &(0x7f0000000340)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x300, 0x67, 0x2, 0x1, 0x20, 0x6}, 0x1a, &(0x7f0000000280)={0x5, 0xf, 0x1a, 0x1, [@generic={0x15, 0x10, 0x3, "c411a3641c4f8651a5417fde94c9861393a6"}]}, 0x1, [{0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x430}}]}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffff7f}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='./file0/../file0/../file0/../file0\x00') 0s ago: executing program 3 (id=1041): socket$nl_generic(0x10, 0x3, 0x10) get_mempolicy(0x0, &(0x7f0000000440), 0x4000, &(0x7f0000023000/0x2000)=nil, 0x5) socket$igmp(0x2, 0x3, 0x2) socket(0xd8a982b17b1ba894, 0xb3d641165cf4b2ba, 0x1ef) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f0000004dc0), 0x0, 0x102, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x5, 0x20, 0x0, 0x0, 0x81, 0x200d, 0xfffffffffffffffe, 0x3}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYRES16=r3, @ANYBLOB="010000000000ffffffff390000000c009900010000005600000018000d80140000800500070000000000050006000237c03c"], 0x38}, 0x1, 0x0, 0x0, 0x45}, 0x0) r4 = request_key(&(0x7f0000001240)='id_legacy\x00', &(0x7f0000000380)={'syz', 0x0}, &(0x7f0000001280)='/dev/vsock\x00/(zu\xaa\xa9\x9c\x11\xcb!i\x80\xeds/\xaa#\xd8^\xf2B\xf6\x81\x02\xae\xed\xcc\xd0\x80\x8eCA\xdd`\xcco$G\xf6f\xa7\xe2\xc2e\xf0&\x81\x9f)\'\x87Ro|\x0e,\x85\xe9\xa5\x93\xd7\xbb\x0fe?G\xeb\xd6\x0e/,\xec\xb1\xaf\xaeIZAk\xb3\xfcm\x12\xcb\x97,\xd2\xda\x19~\xbaAEV\xde\x15\x02\x0fA\xe3p\xe9\x96\xc3\x1f\x8e\xa7\xadi\x00\xf7\x05\xb4.f\b\x9f\xe1\f\x7f\x16!\xda\xfd\xb4\xbf\x88\x9dl\xda\xe8\xb1=\xceS\x85\xedVq2\"\x89\xd3\x8f\xbb\x1dP\xf2\x8f\xfb\xdfz2\x16\"\xfa\x1aX\x13\xb9\x94\x99\xa1T#`\xff61b\xbew\x17\xb3\x95z\xaey\xe9?n\xc3\xf7\xde\xbf\xb8\\D\xf4\xc8\xc6e\xc9\xbb\x1a>P\xf2\x10\xbf\x01\xc4\xca\xe2\xe3\x8a\xca!\x1e2\x03N\xe0\xb9OD\xd6\xbf\x02_|i/\x8a\x90\x155\x8e\xd9\xf4\x1e\aS-\x14\v\x05\xee\x83l.D\x03h\xbc@\xe0\xae\xa1zK\xc8\xd0\xbb\x89\xf1my*\x12\xb5\xbbE\x14\xd3', 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000b75c7f40471501026411010203010902120001000000000904000000a2cdd2"], 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000003800010310bd7000ffdbdf250d"], 0x14}, 0x1, 0x0, 0x0, 0x8004000}, 0x40) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r5) keyctl$search(0xa, r4, &(0x7f00000000c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, r4) getxattr(0x0, &(0x7f00000001c0)=@known='system.posix_acl_access\x00', 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[], 0x0}, 0x0) r6 = getpid() r7 = syz_pidfd_open(r6, 0x0) r8 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r8, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [], [0x8200], 0x13a}}, 0x3}) ioctl$VIDIOC_QBUF(r7, 0xc058565d, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x8040}, 0x8884) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socket$inet_smc(0x2b, 0x1, 0x0) kernel console output (not intermixed with test programs): ex 0 descriptor/start: -71 [ 173.433660][ T5914] usb 3-1: can't read configurations, error -71 [ 173.515895][ T5885] usb 4-1: Using ep0 maxpacket: 8 [ 173.536957][ T5885] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 173.537444][ T5885] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 173.537471][ T5885] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 173.537703][ T5885] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 173.537729][ T5885] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 173.537774][ T5885] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 173.537798][ T5885] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.753353][ T7295] [U]  [ 174.060709][ T5885] usb 4-1: usb_control_msg returned -71 [ 174.060752][ T5885] usbtmc 4-1:16.0: can't read capabilities [ 174.085147][ T5885] usb 4-1: USB disconnect, device number 26 [ 174.515509][ T5914] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 174.545735][ T7308] netlink: 8 bytes leftover after parsing attributes in process `syz.0.458'. [ 174.679519][ T5914] usb 3-1: New USB device found, idVendor=15f4, idProduct=0015, bcdDevice=fd.bf [ 174.698379][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.713115][ T5914] usb 3-1: Product: syz [ 174.734219][ T5914] usb 3-1: Manufacturer: syz [ 174.744472][ T5914] usb 3-1: SerialNumber: syz [ 174.763974][ T7312] veth0_to_team: entered promiscuous mode [ 174.771248][ T7312] veth0_to_team: entered allmulticast mode [ 174.824119][ T5914] dvb-usb: found a 'Hanftek UMT-010 DVB-T USB2.0' in warm state. [ 174.830765][ T7314] loop6: detected capacity change from 0 to 524287999 [ 174.852382][ T5914] dvb-usb: bulk message failed: -22 (3/0) [ 174.887390][ T5914] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 174.935228][ T5914] dvbdev: DVB: registering new adapter (Hanftek UMT-010 DVB-T USB2.0) [ 175.115059][ T5914] usb 3-1: media controller created [ 175.243205][ T5914] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 175.331470][ T55] usb 2-1: USB disconnect, device number 17 [ 175.501409][ T5914] DVB: Unable to find symbol mt352_attach() [ 175.515045][ T30] audit: type=1326 audit(1750624982.132:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7316 comm="syz.1.461" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 175.544162][ T5914] dvb-usb: no frontend was attached by 'Hanftek UMT-010 DVB-T USB2.0' [ 175.565872][ T5914] dvb-usb: bulk message failed: -22 (3/0) [ 175.604216][ T5914] dvb-usb: Hanftek UMT-010 DVB-T USB2.0 successfully initialized and connected. [ 175.617070][ T24] usb 5-1: USB disconnect, device number 25 [ 175.633258][ T30] audit: type=1326 audit(1750624982.132:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7316 comm="syz.1.461" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 175.645876][ T5914] usb 3-1: USB disconnect, device number 23 [ 175.668585][ T30] audit: type=1326 audit(1750624982.162:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7316 comm="syz.1.461" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 175.744876][ T30] audit: type=1326 audit(1750624982.162:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7316 comm="syz.1.461" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 175.808369][ T5914] dvb-usb: Hanftek UMT-010 DVB-T USB2.0 successfully deinitialized and disconnected. [ 175.814353][ T30] audit: type=1326 audit(1750624982.162:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7316 comm="syz.1.461" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 175.904988][ T30] audit: type=1326 audit(1750624982.162:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7316 comm="syz.1.461" exe="/root/syz-executor" sig=0 arch=40000003 syscall=9 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 175.939912][ T30] audit: type=1326 audit(1750624982.182:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7316 comm="syz.1.461" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 175.961732][ C0] vkms_vblank_simulate: vblank timer overrun [ 175.978969][ T30] audit: type=1326 audit(1750624982.182:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7316 comm="syz.1.461" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 176.034831][ T30] audit: type=1326 audit(1750624982.182:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7316 comm="syz.1.461" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 176.058631][ T30] audit: type=1326 audit(1750624982.182:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7316 comm="syz.1.461" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 176.080373][ C0] vkms_vblank_simulate: vblank timer overrun [ 176.205700][ T55] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 176.365494][ T55] usb 2-1: Using ep0 maxpacket: 16 [ 176.386137][ T55] usb 2-1: config index 0 descriptor too short (expected 16456, got 72) [ 176.412939][ T55] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 176.421312][ T978] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 176.443196][ T55] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 176.469516][ T55] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 176.493185][ T55] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 176.515929][ T55] usb 2-1: config 0 has no interface number 0 [ 176.531991][ T55] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 176.556883][ T55] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 176.566848][ T24] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 176.591564][ T55] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 176.601577][ T978] usb 3-1: Using ep0 maxpacket: 32 [ 176.616918][ T978] usb 3-1: config 0 has an invalid interface number: 136 but max is 0 [ 176.629097][ T978] usb 3-1: config 0 has no interface number 0 [ 176.636296][ T978] usb 3-1: config 0 interface 136 altsetting 0 has an endpoint descriptor with address 0xAD, changing to 0x8D [ 176.650464][ T55] usb 2-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 176.663674][ T978] usb 3-1: config 0 interface 136 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 176.674838][ T55] usb 2-1: config 0 interface 125 has no altsetting 0 [ 176.682151][ T55] usb 2-1: config 0 interface 125 has no altsetting 2 [ 176.690168][ T978] usb 3-1: config 0 interface 136 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 0 [ 176.701176][ T978] usb 3-1: config 0 interface 136 altsetting 0 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 176.712280][ T978] usb 3-1: config 0 interface 136 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 176.738929][ T55] usb 2-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 176.748044][ T55] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.762849][ T24] usb 5-1: config 0 has no interfaces? [ 176.775540][ T978] usb 3-1: New USB device found, idVendor=0763, idProduct=1021, bcdDevice=8e.c0 [ 176.785650][ T24] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 176.794701][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.805482][ T55] usb 2-1: Product: syz [ 176.809698][ T24] usb 5-1: Product: syz [ 176.815014][ T24] usb 5-1: Manufacturer: syz [ 176.825435][ T55] usb 2-1: Manufacturer: syz [ 176.830603][ T24] usb 5-1: SerialNumber: syz [ 176.841083][ T55] usb 2-1: SerialNumber: syz [ 176.845864][ T978] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.857868][ T24] usb 5-1: config 0 descriptor?? [ 176.881015][ T55] usb 2-1: config 0 descriptor?? [ 176.901509][ T978] usb 3-1: config 0 descriptor?? [ 176.918268][ T55] usb 2-1: selecting invalid altsetting 2 [ 176.942526][ T978] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 177.361062][ T978] usb 3-1: USB disconnect, device number 24 [ 177.523243][ T24] hid-generic 00A0:0008:0003.0008: unknown main item tag 0x0 [ 177.543529][ T24] hid-generic 00A0:0008:0003.0008: unknown main item tag 0x3 [ 177.554141][ T24] hid-generic 00A0:0008:0003.0008: unknown main item tag 0x0 [ 177.564715][ T24] hid-generic 00A0:0008:0003.0008: unknown main item tag 0x0 [ 177.576900][ T24] hid-generic 00A0:0008:0003.0008: unknown main item tag 0x0 [ 177.584451][ T24] hid-generic 00A0:0008:0003.0008: collection stack underflow [ 177.592651][ T24] hid-generic 00A0:0008:0003.0008: item 0 0 0 12 parsing failed [ 177.601592][ T24] hid-generic 00A0:0008:0003.0008: probe with driver hid-generic failed with error -22 [ 177.615817][ C1] usb 2-1: async_complete: urb error -71 [ 177.621794][ C1] usb 2-1: async_complete: urb error -71 [ 177.627551][ C1] usb 2-1: async_complete: urb error -71 [ 177.667037][ T55] get_1284_register: usb error -71 [ 177.672412][ T55] uss720 2-1:0.125: probe with driver uss720 failed with error -71 [ 177.729882][ T55] usb 2-1: USB disconnect, device number 18 [ 179.574793][ T55] usb 5-1: USB disconnect, device number 26 [ 180.021316][ T7353] netlink: 8 bytes leftover after parsing attributes in process `syz.1.472'. [ 180.257126][ T7357] input: syz0 as /devices/virtual/input/input9 [ 180.511815][ T7359] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 180.542299][ T7359] netlink: 'syz.4.475': attribute type 10 has an invalid length. [ 180.667138][ T7337] syz.0.468: vmalloc error: size 85106688, failed to allocated page array size 166224, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 180.692784][ T7366] loop6: detected capacity change from 0 to 524287999 [ 180.785616][ T7337] CPU: 1 UID: 0 PID: 7337 Comm: syz.0.468 Not tainted 6.16.0-rc2-syzkaller-00318-g739a6c93cc75 #0 PREEMPT(full) [ 180.785644][ T7337] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 180.785653][ T7337] Call Trace: [ 180.785658][ T7337] [ 180.785663][ T7337] dump_stack_lvl+0x189/0x250 [ 180.785694][ T7337] ? __pfx_dump_stack_lvl+0x10/0x10 [ 180.785710][ T7337] ? __pfx__printk+0x10/0x10 [ 180.785722][ T7337] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 180.785734][ T7337] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 180.785746][ T7337] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 180.785759][ T7337] warn_alloc+0x214/0x310 [ 180.785774][ T7337] ? __pfx_warn_alloc+0x10/0x10 [ 180.785790][ T7337] ? __get_vm_area_node+0x28f/0x300 [ 180.785801][ T7337] ? drm_property_create_blob+0x65/0x300 [ 180.785815][ T7337] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 180.785840][ T7337] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 180.785854][ T7337] ? rcu_is_watching+0x15/0xb0 [ 180.785870][ T7337] ? drm_property_create_blob+0x65/0x300 [ 180.785881][ T7337] ? drm_property_create_blob+0x65/0x300 [ 180.785891][ T7337] __kvmalloc_node_noprof+0x3b8/0x5f0 [ 180.785902][ T7337] ? drm_property_create_blob+0x65/0x300 [ 180.785913][ T7337] ? drm_dev_enter+0x49/0x150 [ 180.785928][ T7337] ? vga16fb_copyarea+0x41e/0x7a0 [ 180.785943][ T7337] drm_property_create_blob+0x65/0x300 [ 180.785957][ T7337] drm_mode_createblob_ioctl+0xbf/0x400 [ 180.785971][ T7337] drm_ioctl_kernel+0x2cf/0x390 [ 180.785985][ T7337] ? __pfx_drm_mode_createblob_ioctl+0x10/0x10 [ 180.785997][ T7337] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 180.786015][ T7337] drm_ioctl+0x67f/0xb10 [ 180.786026][ T7337] ? rcu_is_watching+0x15/0xb0 [ 180.786044][ T7337] ? __pfx_drm_mode_createblob_ioctl+0x10/0x10 [ 180.786058][ T7337] ? __pfx_drm_ioctl+0x10/0x10 [ 180.786078][ T7337] ? drm_compat_ioctl+0xa7/0x330 [ 180.786097][ T7337] __ia32_compat_sys_ioctl+0x543/0x840 [ 180.786115][ T7337] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 180.786133][ T7337] ? irqentry_exit+0x74/0x90 [ 180.786149][ T7337] ? lockdep_hardirqs_on+0x9c/0x150 [ 180.786173][ T7337] __do_fast_syscall_32+0xb6/0x2b0 [ 180.786187][ T7337] do_fast_syscall_32+0x34/0x80 [ 180.786196][ T7337] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 180.786209][ T7337] RIP: 0023:0xf7f04539 [ 180.786222][ T7337] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 180.786232][ T7337] RSP: 002b:00000000f4bc155c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 180.786247][ T7337] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00000000c01064bd [ 180.786255][ T7337] RDX: 00000000800000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 180.786261][ T7337] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 180.786267][ T7337] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 180.786273][ T7337] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 180.786287][ T7337] [ 180.786370][ T7337] Mem-Info: [ 181.153105][ T7337] active_anon:6306 inactive_anon:0 isolated_anon:0 [ 181.153105][ T7337] active_file:13148 inactive_file:39866 isolated_file:0 [ 181.153105][ T7337] unevictable:768 dirty:87 writeback:0 [ 181.153105][ T7337] slab_reclaimable:9275 slab_unreclaimable:98113 [ 181.153105][ T7337] mapped:33356 shmem:1362 pagetables:1266 [ 181.153105][ T7337] sec_pagetables:0 bounce:0 [ 181.153105][ T7337] kernel_misc_reclaimable:0 [ 181.153105][ T7337] free:1313413 free_pcp:18567 free_cma:0 [ 181.214602][ T7337] Node 0 active_anon:25224kB inactive_anon:0kB active_file:52592kB inactive_file:159260kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:137224kB dirty:348kB writeback:0kB shmem:3912kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12324kB pagetables:4912kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 181.279247][ T7371] netlink: 8 bytes leftover after parsing attributes in process `syz.2.477'. [ 181.291869][ T7337] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:80kB pagetables:152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 181.425199][ T7337] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 181.805924][ T7337] lowmem_reserve[]: 0 2501 2502 2502 2502 [ 181.819636][ T7337] Node 0 DMA32 free:1332656kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:26752kB inactive_anon:0kB active_file:52592kB inactive_file:159208kB unevictable:1536kB writepending:352kB present:3129332kB managed:2561024kB mlocked:0kB bounce:0kB free_pcp:53040kB local_pcp:21788kB free_cma:0kB [ 181.946011][ T30] kauditd_printk_skb: 72 callbacks suppressed [ 181.961596][ T30] audit: type=1800 audit(1750624988.512:151): pid=7380 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.479" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 182.752902][ T7337] lowmem_reserve[]: 0 0 1 1 1 [ 182.795919][ T7337] Node 0 Normal free:16kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1828kB unevictable:0kB writepending:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 182.915841][ T7337] lowmem_reserve[]: 0 0 0 0 0 [ 182.920620][ T7337] Node 1 Normal free:3903044kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:19712kB local_pcp:12832kB free_cma:0kB [ 182.956308][ T7337] lowmem_reserve[]: 0 0 0 0 0 [ 182.961051][ T7337] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 183.038689][ T7337] Node 0 DMA32: 953*4kB (UM) 621*8kB (UME) 426*16kB (UME) 753*32kB (UME) 200*64kB (UME) 94*128kB (UME) 88*256kB (UME) 38*512kB (UM) 37*1024kB (UME) 22*2048kB (UME) 278*4096kB (UM) = 1328140kB [ 183.112241][ T7337] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 183.139116][ T7337] Node 1 Normal: 167*4kB (UE) 51*8kB (UME) 35*16kB (UME) 91*32kB (UME) 22*64kB (UME) 8*128kB (UME) 5*256kB (UME) 3*512kB (UM) 2*1024kB (ME) 2*2048kB (UE) 949*4096kB (M) = 3903044kB [ 183.184763][ T7387] ip6gretap0: entered promiscuous mode [ 183.198239][ T7337] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 183.210710][ T7387] ip6gretap0: entered allmulticast mode [ 183.224593][ T7337] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 183.249847][ T7387] netem: incorrect ge model size [ 183.255187][ T7337] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 183.268357][ T7387] netem: change failed [ 183.276238][ T7337] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 183.286550][ T7337] 54762 total pagecache pages [ 183.291670][ T7337] 0 pages in swap cache [ 183.303429][ T7337] Free swap = 124996kB [ 183.308333][ T7337] Total swap = 124996kB [ 183.312617][ T7337] 2097051 pages RAM [ 183.316924][ T7337] 0 pages HighMem/MovableOnly [ 183.321840][ T7337] 424689 pages reserved [ 183.326578][ T7337] 0 pages cma reserved [ 183.887158][ T10] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 184.069733][ T7408] xt_bpf: check failed: parse error [ 184.075486][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 184.082685][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 184.100378][ T10] usb 5-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=37.a3 [ 184.109945][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.173130][ T10] usb 5-1: Product: syz [ 184.179971][ T10] usb 5-1: Manufacturer: syz [ 184.283961][ T10] usb 5-1: SerialNumber: syz [ 184.307162][ T10] usb 5-1: config 0 descriptor?? [ 184.605723][ T10] usb 5-1: USB disconnect, device number 27 [ 184.679571][ T7410] netlink: 20 bytes leftover after parsing attributes in process `syz.3.490'. [ 184.772574][ T6781] udevd[6781]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 184.901972][ T7420] xt_CT: You must specify a L4 protocol and not use inversions on it [ 184.999101][ T24] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 185.176076][ T30] audit: type=1326 audit(1750624991.732:152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7415 comm="syz.1.493" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 185.208057][ C0] vkms_vblank_simulate: vblank timer overrun [ 185.265470][ T24] usb 1-1: Using ep0 maxpacket: 16 [ 185.272380][ T30] audit: type=1326 audit(1750624991.732:153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7415 comm="syz.1.493" exe="/root/syz-executor" sig=0 arch=40000003 syscall=164 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 185.277042][ T24] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 185.300767][ T30] audit: type=1326 audit(1750624991.732:154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7415 comm="syz.1.493" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 185.326539][ C0] vkms_vblank_simulate: vblank timer overrun [ 185.430136][ T7428] loop8: detected capacity change from 0 to 7 [ 185.438975][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 185.478875][ T7428] Dev loop8: unable to read RDB block 7 [ 185.485213][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 185.485231][ T30] audit: type=1326 audit(1750624991.732:155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7415 comm="syz.1.493" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 185.485273][ T30] audit: type=1326 audit(1750624991.732:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7415 comm="syz.1.493" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 185.538745][ C0] vkms_vblank_simulate: vblank timer overrun [ 185.578212][ T7428] loop8: unable to read partition table [ 185.591026][ T24] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 185.594149][ T7428] loop8: partition table beyond EOD, [ 185.600881][ T24] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 185.622565][ T24] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 185.634870][ T24] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 185.645255][ T24] usb 1-1: Manufacturer: syz [ 185.657706][ T24] usb 1-1: config 0 descriptor?? [ 185.715129][ T7428] truncated [ 185.722029][ T7428] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 185.765335][ T30] audit: type=1326 audit(1750624991.732:157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7415 comm="syz.1.493" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 185.819952][ T30] audit: type=1326 audit(1750624991.732:158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7415 comm="syz.1.493" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 185.841789][ C0] vkms_vblank_simulate: vblank timer overrun [ 185.902855][ T30] audit: type=1326 audit(1750624991.742:159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7415 comm="syz.1.493" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 185.924689][ C0] vkms_vblank_simulate: vblank timer overrun [ 186.025485][ T5899] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 186.094390][ T30] audit: type=1326 audit(1750624991.742:160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7415 comm="syz.1.493" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 186.125514][ T24] rc_core: IR keymap rc-hauppauge not found [ 186.132128][ T24] Registered IR keymap rc-empty [ 186.147886][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.188008][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.215863][ T5899] usb 4-1: Using ep0 maxpacket: 16 [ 186.242526][ T7440] xt_CT: No such helper "syz0" [ 186.249930][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 186.275869][ T5899] usb 4-1: unable to get BOS descriptor or descriptor too short [ 186.296129][ T5899] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 186.303870][ T5899] usb 4-1: can't read configurations, error -71 [ 186.327824][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input10 [ 186.371626][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.399451][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.424537][ T7444] tipc: Started in network mode [ 186.431144][ T7444] tipc: Node identity , cluster identity 4711 [ 186.435851][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.440832][ T7444] tipc: Failed to set node id, please configure manually [ 186.458737][ T7444] tipc: Enabling of bearer rejected, failed to enable media [ 186.475763][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.497740][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.520993][ T7448] netlink: 16 bytes leftover after parsing attributes in process `syz.0.491'. [ 186.530370][ T7449] --map-set only usable from mangle table [ 186.535555][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.577373][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.606049][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.625583][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.645759][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.688383][ T24] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 186.697513][ T24] mceusb 1-1:0.0: 2 tx ports (0x1 cabled) and 2 rx sensors (0x0 active) [ 186.715708][ T10] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 186.715980][ T24] usb 1-1: USB disconnect, device number 18 [ 186.993575][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 187.004785][ T7458] netlink: 20 bytes leftover after parsing attributes in process `syz.2.505'. [ 187.014339][ T10] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 187.025114][ T10] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 187.039637][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 187.065157][ T10] usb 2-1: SerialNumber: syz [ 187.175502][ T5899] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 187.286524][ T10] usb 2-1: 0:2 : does not exist [ 187.322403][ T10] usb 2-1: USB disconnect, device number 19 [ 187.337451][ T5899] usb 4-1: config 0 has an invalid interface number: 114 but max is 0 [ 187.346056][ T5899] usb 4-1: config 0 has no interface number 0 [ 187.373730][ T5899] usb 4-1: config 0 interface 114 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 187.408288][ T5899] usb 4-1: config 0 interface 114 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 0 [ 187.443095][ T5899] usb 4-1: config 0 interface 114 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 187.627539][ T5899] usb 4-1: config 0 interface 114 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 187.649132][ T5899] usb 4-1: New USB device found, idVendor=bcc7, idProduct=f7e6, bcdDevice= d.10 [ 187.658895][ T5899] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.667668][ T5899] usb 4-1: Product: syz [ 187.673252][ T5899] usb 4-1: Manufacturer: syz [ 187.686827][ T5899] usb 4-1: SerialNumber: syz [ 187.725179][ T5899] usb 4-1: config 0 descriptor?? [ 187.730364][ T978] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 187.745150][ T5899] usb-storage 4-1:0.114: USB Mass Storage device detected [ 187.960585][ T5899] usb 4-1: USB disconnect, device number 28 [ 187.967047][ T978] usb 3-1: config 0 has no interfaces? [ 187.995256][ T978] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 188.011051][ T978] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.036112][ T978] usb 3-1: Product: syz [ 188.045073][ T978] usb 3-1: Manufacturer: syz [ 188.102478][ T978] usb 3-1: SerialNumber: syz [ 188.127513][ T978] usb 3-1: config 0 descriptor?? [ 188.855991][ T5899] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 188.924616][ T7486] xt_bpf: check failed: parse error [ 189.451286][ T7496] tipc: Started in network mode [ 189.457442][ T7496] tipc: Node identity -:, cluster identity 4711 [ 189.463726][ T7496] tipc: Enabling of bearer rejected, failed to enable media [ 189.508954][ T5899] usb 1-1: config 0 has no interfaces? [ 189.514971][ T5899] usb 1-1: New USB device found, idVendor=28bd, idProduct=0935, bcdDevice= 0.00 [ 189.538777][ T5899] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.564167][ T5899] usb 1-1: config 0 descriptor?? [ 189.890984][ T10] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 189.916937][ T7479] vlan2: entered promiscuous mode [ 190.032177][ T55] usb 1-1: USB disconnect, device number 19 [ 190.049679][ T10] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 190.068094][ T10] usb 4-1: config 1 interface 0 has no altsetting 1 [ 190.082564][ T10] usb 4-1: New USB device found, idVendor=0536, idProduct=a4a8, bcdDevice= 0.40 [ 190.092892][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.101136][ T10] usb 4-1: Product: syz [ 190.122850][ T10] usb 4-1: Manufacturer: syz [ 190.135068][ T10] usb 4-1: SerialNumber: syz [ 190.768495][ T5885] usb 4-1: USB disconnect, device number 29 [ 190.798679][ T55] usb 3-1: USB disconnect, device number 25 [ 191.175825][ T7512] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 191.244210][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 191.244227][ T30] audit: type=1326 audit(1750624997.862:165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7513 comm="syz.0.523" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f04539 code=0x7ffc0000 [ 191.376015][ T30] audit: type=1326 audit(1750624997.862:166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7513 comm="syz.0.523" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f04539 code=0x7ffc0000 [ 191.633119][ T30] audit: type=1326 audit(1750624997.862:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7513 comm="syz.0.523" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f04558 code=0x7ffc0000 [ 191.724835][ T30] audit: type=1326 audit(1750624997.862:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7513 comm="syz.0.523" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f04558 code=0x7ffc0000 [ 192.326476][ T30] audit: type=1326 audit(1750624997.862:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7513 comm="syz.0.523" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f04558 code=0x7ffc0000 [ 192.823379][ T30] audit: type=1326 audit(1750624997.862:170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7513 comm="syz.0.523" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f04539 code=0x7ffc0000 [ 193.055686][ T30] audit: type=1326 audit(1750624997.862:171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7513 comm="syz.0.523" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f04558 code=0x7ffc0000 [ 193.204846][ T30] audit: type=1326 audit(1750624997.882:172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7513 comm="syz.0.523" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f04558 code=0x7ffc0000 [ 193.352396][ T30] audit: type=1326 audit(1750624997.882:173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7513 comm="syz.0.523" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f04558 code=0x7ffc0000 [ 193.473745][ T30] audit: type=1326 audit(1750624997.882:174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7513 comm="syz.0.523" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f04558 code=0x7ffc0000 [ 193.756827][ T7514] delete_channel: no stack [ 194.345981][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.352369][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.555505][ T55] usb 4-1: new full-speed USB device number 30 using dummy_hcd [ 194.736857][ T55] usb 4-1: unable to get BOS descriptor or descriptor too short [ 194.755899][ T55] usb 4-1: not running at top speed; connect to a high speed hub [ 194.772174][ T55] usb 4-1: config 129 has an invalid interface number: 145 but max is 0 [ 194.800112][ T55] usb 4-1: config 129 has no interface number 0 [ 194.811145][ T7567] netlink: 8 bytes leftover after parsing attributes in process `syz.0.545'. [ 194.815473][ T55] usb 4-1: config 129 interface 145 has no altsetting 0 [ 194.872089][ T55] usb 4-1: New USB device found, idVendor=0644, idProduct=800f, bcdDevice= d.2f [ 194.915788][ T55] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.923833][ T55] usb 4-1: Product: syz [ 194.979598][ T55] usb 4-1: Manufacturer: syz [ 194.987710][ T55] usb 4-1: SerialNumber: syz [ 195.142906][ T7572] input: syz0 as /devices/virtual/input/input12 [ 195.229750][ T55] usb 4-1: USB disconnect, device number 30 [ 195.346035][ T5914] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 195.519635][ T5914] usb 2-1: config 1 interface 0 has no altsetting 0 [ 195.528569][ T5914] usb 2-1: New USB device found, idVendor=05ac, idProduct=0274, bcdDevice= 0.40 [ 195.543973][ T5914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.555574][ T5914] usb 2-1: Product: syz [ 195.564156][ T5914] usb 2-1: Manufacturer: syz [ 195.568939][ T5914] usb 2-1: SerialNumber: syz [ 195.605579][ T5885] usb 5-1: new full-speed USB device number 28 using dummy_hcd [ 195.769222][ T5885] usb 5-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 195.823245][ T5885] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 195.835748][ T5914] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input13 [ 195.869429][ T5185] bcm5974 2-1:1.0: could not read from device [ 195.878818][ T5885] usb 5-1: config 0 descriptor?? [ 195.891066][ T5885] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 195.910086][ T5185] bcm5974 2-1:1.0: could not read from device [ 195.925075][ T5185] bcm5974 2-1:1.0: could not read from device [ 195.952084][ T5914] usb 2-1: USB disconnect, device number 20 [ 195.970182][ T5185] bcm5974 2-1:1.0: could not read from device [ 196.090602][ T7577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 196.103592][ T5885] gp8psk: usb in 128 operation failed. [ 196.116801][ T7577] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 196.148014][ T7588] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 196.162278][ T7577] netlink: 4 bytes leftover after parsing attributes in process `syz.4.550'. [ 196.163650][ T7588] netlink: 'syz.3.553': attribute type 10 has an invalid length. [ 196.173143][ T7589] netlink: 4 bytes leftover after parsing attributes in process `syz.4.550'. [ 196.430185][ T5885] gp8psk: usb in 137 operation failed. [ 196.438065][ T5885] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 196.475199][ T5885] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 196.511311][ T5885] usb 5-1: USB disconnect, device number 28 [ 196.685252][ T7611] Cannot find map_set index 0 as target [ 196.968189][ T5885] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 197.001433][ T7617] netlink: 28 bytes leftover after parsing attributes in process `syz.3.562'. [ 197.011733][ T7617] netlink: 204 bytes leftover after parsing attributes in process `syz.3.562'. [ 197.021164][ T7617] netlink: 8 bytes leftover after parsing attributes in process `syz.3.562'. [ 197.164219][ T7615] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 197.355670][ T5885] usb 5-1: config 0 has no interfaces? [ 197.635675][ T5885] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 197.708792][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.718544][ T5885] usb 5-1: Product: syz [ 197.723581][ T5885] usb 5-1: Manufacturer: syz [ 197.734029][ T7627] netlink: 'syz.0.564': attribute type 4 has an invalid length. [ 197.781105][ T5885] usb 5-1: SerialNumber: syz [ 197.969093][ T5885] usb 5-1: config 0 descriptor?? [ 198.186776][ T7629] netlink: 4 bytes leftover after parsing attributes in process `syz.0.565'. [ 199.193810][ T7638] xt_bpf: check failed: parse error [ 199.329439][ T7640] netlink: 8 bytes leftover after parsing attributes in process `syz.3.570'. [ 199.440254][ T5899] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 199.608175][ T5899] usb 1-1: config 0 has an invalid interface number: 120 but max is 0 [ 199.617354][ T5899] usb 1-1: config 0 has no interface number 0 [ 199.640523][ T5899] usb 1-1: config 0 interface 120 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 199.694972][ T5899] usb 1-1: config 0 interface 120 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 199.760287][ T5899] usb 1-1: config 0 interface 120 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 199.834710][ T5899] usb 1-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 199.881549][ T5934] usb 5-1: USB disconnect, device number 29 [ 199.898745][ T5899] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.929239][ T7646] xt_CT: You must specify a L4 protocol and not use inversions on it [ 199.967977][ T5899] usb 1-1: config 0 descriptor?? [ 199.984032][ T7636] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 200.008791][ T5899] input: USB Touchscreen 16e3:f9e9 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.120/input/input14 [ 200.069792][ C0] usbtouchscreen 1-1:0.120: usbtouch_irq - usb_submit_urb failed with result: -1 [ 200.083141][ T7650] loop8: detected capacity change from 0 to 7 [ 200.096772][ T5885] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 200.109421][ T7650] Dev loop8: unable to read RDB block 7 [ 200.126530][ T7650] loop8: unable to read partition table [ 200.142815][ T7650] loop8: partition table beyond EOD, truncated [ 200.157705][ T7650] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 200.280180][ T5885] usb 2-1: Using ep0 maxpacket: 32 [ 200.326587][ T7655] ip6gretap1: entered promiscuous mode [ 200.332096][ T7655] ip6gretap1: entered allmulticast mode [ 200.368323][ T5885] usb 2-1: config 127 has an invalid interface number: 62 but max is 0 [ 200.379220][ T5885] usb 2-1: config 127 has no interface number 0 [ 200.451454][ T5885] usb 2-1: config 127 interface 62 altsetting 15 bulk endpoint 0x1 has invalid maxpacket 1023 [ 200.469701][ T5885] usb 2-1: config 127 interface 62 has no altsetting 0 [ 200.490004][ T5885] usb 2-1: New USB device found, idVendor=0525, idProduct=1080, bcdDevice=50.0f [ 200.509886][ T5885] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.530593][ T5885] usb 2-1: Product: syz [ 200.544947][ T5885] usb 2-1: Manufacturer: syz [ 200.553308][ T5885] usb 2-1: SerialNumber: syz [ 200.582747][ T7644] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 200.828932][ T7670] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.889048][ T7670] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 200.972324][ T7670] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.129702][ T7670] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.141302][ T7670] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.153185][ T5885] net1080 2-1:127.62: probe with driver net1080 failed with error -22 [ 201.171256][ T7670] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.516211][ T7670] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.530901][ T5830] Bluetooth: hci1: command 0x0406 tx timeout [ 201.530929][ T7670] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.537365][ T5830] Bluetooth: hci3: command 0x0406 tx timeout [ 201.551807][ T5150] Bluetooth: hci0: command 0x0406 tx timeout [ 201.558691][ T5830] Bluetooth: hci2: command 0x0406 tx timeout [ 201.564988][ T5150] Bluetooth: hci4: command 0x0406 tx timeout [ 201.601223][ T7670] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.632208][ T7670] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.742683][ T5914] usb 2-1: USB disconnect, device number 21 [ 202.127700][ T9] usb 1-1: USB disconnect, device number 20 [ 203.356588][ T7688] netlink: 4 bytes leftover after parsing attributes in process `syz.0.582'. [ 203.914761][ T5885] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 204.265501][ T5885] usb 1-1: Using ep0 maxpacket: 32 [ 204.274039][ T5885] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 204.300597][ T5885] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 204.414138][ T5885] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 204.471571][ T5885] usb 1-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 204.551964][ T5885] usb 1-1: Product: syz [ 204.595242][ T5885] usb 1-1: Manufacturer: syz [ 204.646521][ T5885] hub 1-1:4.0: USB hub found [ 204.725201][ T7703] netlink: 4 bytes leftover after parsing attributes in process `syz.4.586'. [ 205.136187][ T7709] netlink: 44 bytes leftover after parsing attributes in process `syz.1.587'. [ 205.184539][ T7709] netlink: 43 bytes leftover after parsing attributes in process `syz.1.587'. [ 205.218932][ T7709] netlink: 'syz.1.587': attribute type 6 has an invalid length. [ 205.242806][ T7709] netlink: 'syz.1.587': attribute type 5 has an invalid length. [ 205.261831][ T7709] netlink: 43 bytes leftover after parsing attributes in process `syz.1.587'. [ 205.403370][ T7688] team_slave_0: left promiscuous mode [ 205.415322][ T7714] xt_SECMARK: invalid mode: 0 [ 205.474093][ T7688] team0 (unregistering): Port device team_slave_0 removed [ 205.489300][ T7688] team_slave_1: left promiscuous mode [ 205.549617][ T7688] team0 (unregistering): Port device team_slave_1 removed [ 205.562158][ T7688] batadv1: left promiscuous mode [ 205.629887][ T7688] team0 (unregistering): Port device batadv1 removed [ 205.751131][ T7712] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 205.773004][ T5885] hub 1-1:4.0: config failed, can't read hub descriptor (err -22) [ 205.886337][ T5885] usb 1-1: USB disconnect, device number 21 [ 205.990337][ T5934] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 206.185282][ T7723] Cannot find add_set index 3 as target [ 206.239367][ T5934] usb 3-1: config 0 has no interfaces? [ 206.295090][ T5934] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 206.486463][ T5934] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.494540][ T5934] usb 3-1: Product: syz [ 206.499639][ T5934] usb 3-1: Manufacturer: syz [ 206.504268][ T5934] usb 3-1: SerialNumber: syz [ 206.533712][ T5934] usb 3-1: config 0 descriptor?? [ 207.529106][ T7737] netlink: 4 bytes leftover after parsing attributes in process `syz.4.599'. [ 208.772304][ T5885] usb 4-1: new full-speed USB device number 31 using dummy_hcd [ 208.891947][ T5899] usb 3-1: USB disconnect, device number 26 [ 208.958737][ T5885] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 209.002479][ T5885] usb 4-1: New USB device found, idVendor=18d1, idProduct=5028, bcdDevice= 0.40 [ 209.036418][ T5885] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.082672][ T5885] usb 4-1: Product: ꢟ한ᮟ邔왂짰껴é£å©€ê¿³îŒµã‚朕鈔꿰듘೭멧왕戯やî’꫙쉭溊ヨ艴郋á›ëº§æ ºá³äµ­ì¥¦ê¢­ï±¿æ•¯ê—ꈣ㯷핶༆㑥ᣒ䱧렴࠻뢨ᔨꯀ㗩êµâµéˆ€è³¨ášå–Žå½‰í„°î¸€îŠ¬á¸å²ì†²ì¦˜Ñ±í’»èˆ‚Ἷ䔫廉蘈玶겸勅ච૒᥾黖솙ïá¦ë›‡ï½™à ˜á³¥ë½ªèŽ¾â–‚悈䳳譟êꚪ쾎è‰á ‚툀ụ胕⊺ሀíšá€¨ã—½ç‚”鬣 [ 209.115065][ C0] vkms_vblank_simulate: vblank timer overrun [ 209.234045][ T5885] usb 4-1: Manufacturer: ÐŽ [ 209.271451][ T5885] usb 4-1: SerialNumber: Ñ• [ 209.312489][ T7747] xt_SECMARK: invalid mode: 0 [ 209.313252][ T7733] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 209.375806][ T978] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 209.517624][ T7753] netlink: 4 bytes leftover after parsing attributes in process `syz.1.605'. [ 209.549698][ T978] usb 3-1: config 0 has no interfaces? [ 209.555252][ T978] usb 3-1: New USB device found, idVendor=28bd, idProduct=0935, bcdDevice= 0.00 [ 209.585159][ T978] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.620028][ T978] usb 3-1: config 0 descriptor?? [ 209.695505][ T5914] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 209.843813][ T7743] vlan2: entered promiscuous mode [ 209.863531][ T5885] usbhid 4-1:1.0: can't add hid device: -71 [ 209.870048][ T5914] usb 5-1: Using ep0 maxpacket: 8 [ 209.884319][ T5885] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 209.901189][ T5914] usb 5-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 209.947612][ T5914] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.962614][ T5885] usb 4-1: USB disconnect, device number 31 [ 209.993926][ T5914] usb 5-1: config 0 descriptor?? [ 210.017237][ T978] usb 3-1: USB disconnect, device number 27 [ 210.119272][ T7768] netlink: 'syz.0.607': attribute type 10 has an invalid length. [ 210.137325][ T7768] netlink: 40 bytes leftover after parsing attributes in process `syz.0.607'. [ 210.422404][ T7773] fuse: Bad value for 'fd' [ 210.695927][ T5934] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 210.846152][ T5934] usb 1-1: Using ep0 maxpacket: 32 [ 210.881871][ T5934] usb 1-1: config 0 has an invalid interface number: 170 but max is 0 [ 211.035864][ T5934] usb 1-1: config 0 has no interface number 0 [ 211.046085][ T5934] usb 1-1: config 0 interface 170 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 211.107283][ T5934] usb 1-1: config 0 interface 170 has no altsetting 0 [ 211.120886][ T5934] usb 1-1: New USB device found, idVendor=3277, idProduct=0072, bcdDevice=d4.e5 [ 211.132347][ T5934] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.141984][ T5934] usb 1-1: Product: syz [ 211.147928][ T5934] usb 1-1: Manufacturer: syz [ 211.152620][ T5934] usb 1-1: SerialNumber: syz [ 211.166376][ T5934] usb 1-1: config 0 descriptor?? [ 211.274806][ T5934] usb 1-1: Found UVC 0.00 device syz (3277:0072) [ 211.286268][ T10] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 211.310254][ T5934] usb 1-1: No valid video chain found. [ 211.465550][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 211.482773][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 211.502286][ T10] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 211.523000][ T10] usb 3-1: New USB device found, idVendor=1044, idProduct=7a4d, bcdDevice= 0.00 [ 211.608888][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.812822][ T10] usb 3-1: config 0 descriptor?? [ 211.963492][ T5934] usb 1-1: USB disconnect, device number 22 [ 212.913431][ T7810] bridge1: entered promiscuous mode [ 212.926725][ T7810] bridge1: entered allmulticast mode [ 213.339483][ T5914] asix 5-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 213.349896][ T5914] asix 5-1:0.0 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0088: ffffffb9 [ 213.371645][ T5914] asix 5-1:0.0: probe with driver asix failed with error -71 [ 213.456049][ T5914] usb 5-1: USB disconnect, device number 30 [ 213.883673][ T5899] usb 3-1: USB disconnect, device number 28 [ 214.654936][ T5914] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 214.846557][ T5914] usb 3-1: Using ep0 maxpacket: 32 [ 214.859250][ T5914] usb 3-1: config index 0 descriptor too short (expected 156, got 27) [ 214.867881][ T5914] usb 3-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 214.885255][ T5914] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 214.913248][ T7851] netlink: 28 bytes leftover after parsing attributes in process `syz.3.631'. [ 214.945973][ T5914] usb 3-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 214.965779][ T7851] netlink: 204 bytes leftover after parsing attributes in process `syz.3.631'. [ 215.006981][ T7851] netlink: 8 bytes leftover after parsing attributes in process `syz.3.631'. [ 215.009660][ T5914] usb 3-1: config 0 interface 0 has no altsetting 0 [ 215.046616][ T5914] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 215.056488][ T5914] usb 3-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 215.116280][ T5914] usb 3-1: Product: syz [ 215.148487][ T5914] usb 3-1: Manufacturer: syz [ 215.157292][ T5914] usb 3-1: SerialNumber: syz [ 215.198053][ T5914] usb 3-1: config 0 descriptor?? [ 215.224881][ T5914] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 215.324930][ T5914] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 215.376025][ T5899] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 215.455168][ T7834] tap0: tun_chr_ioctl cmd 1074025680 [ 215.466906][ T7834] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 215.485274][ T7834] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 215.539172][ T7834] block device autoloading is deprecated and will be removed. [ 215.564602][ T5885] usb 3-1: USB disconnect, device number 29 [ 215.570786][ C0] ldusb 3-1:0.0: usb_submit_urb failed (-19) [ 215.583022][ T5885] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 215.600354][ T5899] usb 2-1: config 0 has no interfaces? [ 215.786800][ T5899] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 215.879135][ T5899] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.015507][ T5899] usb 2-1: Product: syz [ 216.022512][ T5899] usb 2-1: Manufacturer: syz [ 216.027409][ T5899] usb 2-1: SerialNumber: syz [ 216.038349][ T5899] usb 2-1: config 0 descriptor?? [ 217.697004][ T7866] vlan2: entered promiscuous mode [ 217.714245][ T7866] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 217.737026][ T7868] netlink: 'syz.2.634': attribute type 4 has an invalid length. [ 218.124075][ T7880] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 218.257366][ T5885] usb 2-1: USB disconnect, device number 22 [ 218.398274][ T7884] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 218.517347][ T7884] bond0: Error: Cannot enslave bond to itself. [ 218.824930][ T7896] netlink: 28 bytes leftover after parsing attributes in process `syz.4.644'. [ 219.021432][ T5885] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 220.216120][ T5885] usb 2-1: config 0 has no interfaces? [ 220.556355][ T5885] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 220.721749][ T5885] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.786366][ T5885] usb 2-1: Product: syz [ 220.819651][ T5885] usb 2-1: Manufacturer: syz [ 220.860282][ T5885] usb 2-1: SerialNumber: syz [ 220.927819][ T5885] usb 2-1: config 0 descriptor?? [ 221.226201][ T7892] [U]  [ 221.775716][ T5885] usb 5-1: new full-speed USB device number 31 using dummy_hcd [ 221.812179][ T7922] netlink: 4 bytes leftover after parsing attributes in process `syz.0.651'. [ 221.937810][ T5885] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 221.957304][ T5885] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 222.001544][ T5885] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 222.011960][ T5885] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 222.028811][ T5885] usb 5-1: Manufacturer: syz [ 222.084516][ T5885] usb 5-1: config 0 descriptor?? [ 222.415614][ T7933] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 222.426074][ T7933] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 222.822105][ T55] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 222.851197][ T10] usb 2-1: USB disconnect, device number 23 [ 223.193001][ T55] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 223.378757][ T55] usb 1-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 223.429679][ T55] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.658014][ T55] usb 1-1: config 0 descriptor?? [ 223.808960][ T7949] Cannot find del_set index 0 as target [ 224.117311][ T978] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 224.144316][ T5885] usb 5-1: USB disconnect, device number 31 [ 224.213717][ T55] zydacron 0003:13EC:0006.0009: unknown main item tag 0x0 [ 224.240030][ T55] zydacron 0003:13EC:0006.0009: unknown main item tag 0x0 [ 224.256407][ T7953] netlink: 28 bytes leftover after parsing attributes in process `syz.2.658'. [ 224.267142][ T55] zydacron 0003:13EC:0006.0009: unknown main item tag 0x0 [ 224.274380][ T55] zydacron 0003:13EC:0006.0009: unknown main item tag 0x0 [ 224.295940][ T7953] netlink: 204 bytes leftover after parsing attributes in process `syz.2.658'. [ 224.307051][ T55] zydacron 0003:13EC:0006.0009: item fetching failed at offset 4/5 [ 224.315307][ T7953] netlink: 8 bytes leftover after parsing attributes in process `syz.2.658'. [ 224.327277][ T55] zydacron 0003:13EC:0006.0009: parse failed [ 224.334125][ T55] zydacron 0003:13EC:0006.0009: probe with driver zydacron failed with error -22 [ 224.346534][ T978] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 224.355777][ T978] usb 4-1: config 0 has no interface number 0 [ 224.361993][ T978] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 224.373039][ T978] usb 4-1: config 0 interface 8 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 224.393603][ T978] usb 4-1: New USB device found, idVendor=0582, idProduct=b9d5, bcdDevice=73.f7 [ 224.457421][ T7957] netlink: 'syz.1.660': attribute type 2 has an invalid length. [ 224.996214][ T7957] : entered promiscuous mode [ 225.035744][ T978] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.077453][ T978] usb 4-1: config 0 descriptor?? [ 225.268469][ T5843] udevd[5843]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.8/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 226.209426][ T5899] usb 1-1: USB disconnect, device number 23 [ 226.299189][ T7951] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 226.381166][ T7971] netlink: 'syz.3.657': attribute type 10 has an invalid length. [ 226.402469][ T7971] bridge0: port 2(bridge_slave_1) entered disabled state [ 226.410562][ T7971] bridge0: port 1(bridge_slave_0) entered disabled state [ 226.601354][ T7971] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.608911][ T7971] bridge0: port 2(bridge_slave_1) entered forwarding state [ 226.617785][ T7971] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.625024][ T7971] bridge0: port 1(bridge_slave_0) entered forwarding state [ 226.711860][ T7971] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 227.020480][ T7986] netlink: 20 bytes leftover after parsing attributes in process `syz.2.665'. [ 227.555780][ T5914] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 227.582433][ T7996] netlink: 80 bytes leftover after parsing attributes in process `syz.2.668'. [ 227.748270][ T5914] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 227.771898][ T5914] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 227.815690][ T5899] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 227.830772][ T5914] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 0 [ 227.875904][ T5914] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 227.929943][ T7998] netlink: 4 bytes leftover after parsing attributes in process `syz.2.670'. [ 227.972073][ T5914] usb 2-1: New USB device found, idVendor=0bfd, idProduct=010c, bcdDevice=2d.16 [ 227.985698][ T5899] usb 5-1: Using ep0 maxpacket: 16 [ 227.997916][ T5914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.000676][ T5899] usb 5-1: config 0 has no interfaces? [ 228.029792][ T5914] usb 2-1: Product: syz [ 228.035023][ T5899] usb 5-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 228.051572][ T5914] usb 2-1: Manufacturer: syz [ 228.063327][ T5914] usb 2-1: SerialNumber: syz [ 228.069809][ T5899] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.090481][ T5899] usb 5-1: Product: syz [ 228.103416][ T5914] usb 2-1: config 0 descriptor?? [ 228.104035][ T5899] usb 5-1: Manufacturer: syz [ 228.132019][ T5899] usb 5-1: SerialNumber: syz [ 228.139924][ T5914] kvaser_usb 2-1:0.0: error -ENODEV: Cannot get usb endpoint(s) [ 228.153383][ T5899] usb 5-1: config 0 descriptor?? [ 228.329247][ T10] usb 4-1: USB disconnect, device number 32 [ 228.487612][ T5899] usb 5-1: USB disconnect, device number 32 [ 229.127580][ T5899] usb 2-1: USB disconnect, device number 24 [ 229.473022][ T8022] xt_CT: No such helper "syz0" [ 230.061114][ T8033] netlink: 8 bytes leftover after parsing attributes in process `syz.1.681'. [ 231.915560][ T5914] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 232.103494][ T5914] usb 5-1: Using ep0 maxpacket: 16 [ 233.289344][ T8065] syz.3.689: attempt to access beyond end of device [ 233.289344][ T8065] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 233.847732][ T5914] usb 5-1: unable to get BOS descriptor or descriptor too short [ 233.890512][ T5914] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 233.898153][ T5914] usb 5-1: can't read configurations, error -71 [ 234.515904][ T8082] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 234.601868][ T8082] netlink: 'syz.3.696': attribute type 10 has an invalid length. [ 235.205473][ T5914] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 235.361366][ T5914] usb 5-1: config 0 has no interfaces? [ 235.406355][ T5914] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 235.422961][ T5914] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.450487][ T5914] usb 5-1: Product: syz [ 235.473440][ T5914] usb 5-1: Manufacturer: syz [ 235.492932][ T5914] usb 5-1: SerialNumber: syz [ 235.523706][ T8095] netlink: 28 bytes leftover after parsing attributes in process `syz.0.698'. [ 235.547400][ T5914] usb 5-1: config 0 descriptor?? [ 235.786599][ T8091] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 236.131692][ T8105] syz.0.700: attempt to access beyond end of device [ 236.131692][ T8105] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 237.211375][ T8109] xt_bpf: check failed: parse error [ 237.667437][ T5934] usb 5-1: USB disconnect, device number 35 [ 237.705887][ T978] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 237.877509][ T978] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 237.877528][ T978] usb 1-1: config 0 has no interface number 0 [ 237.877552][ T978] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 237.877564][ T978] usb 1-1: config 0 interface 8 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 237.877586][ T978] usb 1-1: New USB device found, idVendor=0582, idProduct=b9d5, bcdDevice=73.f7 [ 237.877599][ T978] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.879353][ T978] usb 1-1: config 0 descriptor?? [ 238.367181][ T8117] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 238.367780][ T8117] netlink: 'syz.0.704': attribute type 10 has an invalid length. [ 238.368354][ T8117] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.368997][ T8117] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.370101][ T8117] bridge0: left promiscuous mode [ 238.374149][ T8117] bridge0: port 2(bridge_slave_1) entered blocking state [ 238.374266][ T8117] bridge0: port 2(bridge_slave_1) entered forwarding state [ 238.374530][ T8117] bridge0: port 1(bridge_slave_0) entered blocking state [ 238.374649][ T8117] bridge0: port 1(bridge_slave_0) entered forwarding state [ 238.378083][ T8117] bridge0: entered promiscuous mode [ 238.378886][ T8117] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 238.512092][ T10] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 238.806385][ T10] usb 5-1: config 0 has no interfaces? [ 239.048107][ T10] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 239.084026][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.196693][ T8152] netlink: 4 bytes leftover after parsing attributes in process `syz.2.710'. [ 239.392058][ T10] usb 5-1: Product: syz [ 239.491635][ T10] usb 5-1: Manufacturer: syz [ 239.496485][ T5885] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 239.532103][ T10] usb 5-1: SerialNumber: syz [ 239.732164][ T10] usb 5-1: config 0 descriptor?? [ 239.863108][ T5885] usb 4-1: config 0 has no interfaces? [ 239.900644][ T5885] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 239.910005][ T5885] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.918641][ T5885] usb 4-1: Product: syz [ 239.923121][ T5885] usb 4-1: Manufacturer: syz [ 240.008355][ T5885] usb 4-1: SerialNumber: syz [ 240.032329][ T5885] usb 4-1: config 0 descriptor?? [ 240.144603][ T8134] [U]  [ 241.795937][ T5899] usb 5-1: USB disconnect, device number 36 [ 242.595199][ T8186] bridge0: Device is already in use. [ 242.916541][ T978] usb 4-1: USB disconnect, device number 33 [ 243.332853][ T8202] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 243.376694][ T8202] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 243.531152][ T8205] netlink: 91 bytes leftover after parsing attributes in process `syz.2.724'. [ 244.273828][ T8224] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 244.285490][ T8224] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 244.318141][ T8224] [U]  [ 244.586699][ T5934] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 244.798991][ T5934] usb 3-1: config 0 has no interfaces? [ 244.818182][ T5934] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 244.844466][ T5934] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.894585][ T5934] usb 3-1: Product: syz [ 245.198829][ T5934] usb 3-1: Manufacturer: syz [ 245.203457][ T5934] usb 3-1: SerialNumber: syz [ 245.334684][ T5934] usb 3-1: config 0 descriptor?? [ 245.615060][ T8216] [U]  [ 246.255456][ T5885] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 246.506373][ T5885] usb 2-1: device descriptor read/64, error -71 [ 247.036208][ T8235] Cannot find add_set index 3 as target [ 247.051943][ T5885] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 247.248683][ T5885] usb 2-1: device descriptor read/64, error -71 [ 247.378763][ T5885] usb usb2-port1: attempt power cycle [ 247.716917][ T5866] usb 3-1: USB disconnect, device number 30 [ 247.735607][ T5885] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 247.755234][ T8244] netlink: 156 bytes leftover after parsing attributes in process `syz.0.742'. [ 247.791329][ T5885] usb 2-1: device descriptor read/8, error -71 [ 247.899242][ T8249] syz.4.732: attempt to access beyond end of device [ 247.899242][ T8249] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 248.014654][ T8251] netlink: 4 bytes leftover after parsing attributes in process `syz.2.735'. [ 248.135933][ T5885] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 248.156598][ T5885] usb 2-1: device descriptor read/8, error -71 [ 248.390791][ T5885] usb usb2-port1: unable to enumerate USB device [ 248.475971][ T5866] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 248.744300][ T5866] usb 3-1: Using ep0 maxpacket: 16 [ 248.788969][ T5866] usb 3-1: New USB device found, idVendor=0c45, idProduct=800a, bcdDevice=db.47 [ 248.857338][ T5866] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.952417][ T5866] usb 3-1: Product: syz [ 248.975609][ T5866] usb 3-1: Manufacturer: syz [ 248.981459][ T5866] usb 3-1: SerialNumber: syz [ 249.049271][ T8262] syz.1.738: attempt to access beyond end of device [ 249.049271][ T8262] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 249.289094][ T5866] usb 3-1: config 0 descriptor?? [ 249.300552][ T5866] gspca_main: sn9c2028-2.14.0 probing 0c45:800a [ 249.562743][ T5866] gspca_sn9c2028: read1 error -32 [ 249.605814][ T5866] gspca_sn9c2028: read1 error -32 [ 249.932621][ T8254] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.959747][ T8254] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.969552][ T5866] usb 3-1: USB disconnect, device number 31 [ 250.524883][ T8278] Cannot find add_set index 3 as target [ 251.375532][ T5934] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 251.735542][ T978] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 251.787304][ T5934] usb 2-1: config 0 has no interfaces? [ 252.020112][ T5934] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 252.038799][ T5934] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 252.165047][ T5934] usb 2-1: Product: syz [ 252.209390][ T5934] usb 2-1: Manufacturer: syz [ 252.214117][ T5934] usb 2-1: SerialNumber: syz [ 252.252221][ T5934] usb 2-1: config 0 descriptor?? [ 252.267412][ T978] usb 3-1: config 0 has no interfaces? [ 252.273029][ T978] usb 3-1: New USB device found, idVendor=28bd, idProduct=0935, bcdDevice= 0.00 [ 252.333170][ T978] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.364090][ T978] usb 3-1: config 0 descriptor?? [ 252.597136][ T8299] vlan2: entered promiscuous mode [ 252.665930][ T8303] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 252.683591][ T8303] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 252.703450][ T8289] [U]  [ 252.719818][ T8303] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 252.743330][ T5934] usb 3-1: USB disconnect, device number 32 [ 252.772727][ T8303] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 253.286858][ T8318] syz.4.755: attempt to access beyond end of device [ 253.286858][ T8318] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 253.767634][ T978] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 253.969549][ T978] usb 3-1: Using ep0 maxpacket: 32 [ 254.013285][ T5934] usb 2-1: USB disconnect, device number 29 [ 254.024230][ T978] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 254.048137][ T978] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 254.058223][ T978] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 254.067316][ T978] usb 3-1: Product: syz [ 254.072002][ T978] usb 3-1: Manufacturer: syz [ 254.082450][ T978] usb 3-1: SerialNumber: syz [ 254.092642][ T978] usb 3-1: config 0 descriptor?? [ 254.106166][ T8322] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 254.118374][ T978] hub 3-1:0.0: bad descriptor, ignoring hub [ 254.125988][ T978] hub 3-1:0.0: probe with driver hub failed with error -5 [ 254.426430][ T978] usb 3-1: USB disconnect, device number 33 [ 255.017177][ T8340] Cannot find add_set index 3 as target [ 255.772283][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.780450][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.735884][ T8365] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 256.871911][ T8367] syz.2.771: attempt to access beyond end of device [ 256.871911][ T8367] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 257.260273][ T8373] netlink: 'syz.1.773': attribute type 4 has an invalid length. [ 257.293217][ T8375] netlink: 12 bytes leftover after parsing attributes in process `syz.0.775'. [ 257.618180][ T8383] xt_bpf: check failed: parse error [ 257.819610][ T8386] netlink: 4 bytes leftover after parsing attributes in process `syz.4.778'. [ 258.083321][ T8390] xt_CT: You must specify a L4 protocol and not use inversions on it [ 258.706790][ T978] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 258.793095][ T8401] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.802808][ T8401] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.820694][ T8401] [U]  [ 258.882992][ T978] usb 3-1: device descriptor read/64, error -71 [ 259.525653][ T978] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 259.805726][ T978] usb 3-1: device descriptor read/64, error -71 [ 259.925629][ T5866] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 259.926495][ T978] usb usb3-port1: attempt power cycle [ 260.125059][ T8408] netlink: 'syz.4.780': attribute type 30 has an invalid length. [ 260.141891][ T5866] usb 4-1: config 0 has no interfaces? [ 260.182666][ T5866] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 260.217795][ T5866] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.264085][ T5866] usb 4-1: Product: syz [ 260.289164][ T5866] usb 4-1: Manufacturer: syz [ 260.319359][ T5866] usb 4-1: SerialNumber: syz [ 260.345528][ T978] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 260.356685][ T5866] usb 4-1: config 0 descriptor?? [ 260.388375][ T978] usb 3-1: device descriptor read/8, error -71 [ 260.440789][ T8415] Cannot find add_set index 3 as target [ 260.627447][ T8406] [U]  [ 260.656117][ T978] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 260.842280][ T978] usb 3-1: device descriptor read/8, error -71 [ 261.122778][ T978] usb usb3-port1: unable to enumerate USB device [ 261.212311][ T8417] kAFS: unable to lookup cell '/,' [ 261.969916][ T8432] syz.1.792: attempt to access beyond end of device [ 261.969916][ T8432] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 262.029704][ T8435] netlink: 8 bytes leftover after parsing attributes in process `syz.2.793'. [ 262.615780][ T55] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 262.750510][ T8444] xt_bpf: check failed: parse error [ 262.759189][ T8444] netlink: 16 bytes leftover after parsing attributes in process `syz.0.796'. [ 262.860561][ T55] usb 3-1: config 0 has no interfaces? [ 262.904418][ T55] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 262.923409][ T55] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.946622][ T55] usb 3-1: Product: syz [ 262.953932][ T55] usb 3-1: Manufacturer: syz [ 262.970624][ T55] usb 3-1: SerialNumber: syz [ 262.988224][ T55] usb 3-1: config 0 descriptor?? [ 263.150158][ T5934] usb 4-1: USB disconnect, device number 34 [ 263.948219][ T8455] tipc: Started in network mode [ 263.953672][ T8455] tipc: Node identity -:, cluster identity 4711 [ 263.965730][ T8455] tipc: Enabling of bearer rejected, failed to enable media [ 264.250064][ T8459] netlink: 8 bytes leftover after parsing attributes in process `syz.0.803'. [ 264.339108][ T8459] netlink: 4 bytes leftover after parsing attributes in process `syz.0.803'. [ 265.857587][ T5866] usb 3-1: USB disconnect, device number 38 [ 266.445546][ T5934] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 266.817670][ T5934] usb 3-1: Using ep0 maxpacket: 32 [ 266.909185][ T5934] usb 3-1: too many configurations: 205, using maximum allowed: 8 [ 266.932868][ T5934] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 266.953198][ T5934] usb 3-1: can't read configurations, error -22 [ 267.116345][ T8491] Cannot find add_set index 3 as target [ 267.157714][ T5934] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 267.475520][ T5934] usb 3-1: Using ep0 maxpacket: 32 [ 267.481646][ T5934] usb 3-1: too many configurations: 205, using maximum allowed: 8 [ 267.523202][ T5934] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 267.562800][ T5934] usb 3-1: can't read configurations, error -22 [ 267.576904][ T8496] syz.3.813: attempt to access beyond end of device [ 267.576904][ T8496] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 267.602449][ T5934] usb usb3-port1: attempt power cycle [ 267.955752][ T5934] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 267.992051][ T5934] usb 3-1: Using ep0 maxpacket: 32 [ 268.000472][ T5934] usb 3-1: too many configurations: 205, using maximum allowed: 8 [ 268.033237][ T5934] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 268.061335][ T5934] usb 3-1: can't read configurations, error -22 [ 268.228486][ T5934] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 268.270117][ T5934] usb 3-1: Using ep0 maxpacket: 32 [ 268.287261][ T5934] usb 3-1: too many configurations: 205, using maximum allowed: 8 [ 268.333632][ T5934] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 268.363314][ T5934] usb 3-1: can't read configurations, error -22 [ 268.415869][ T5934] usb usb3-port1: unable to enumerate USB device [ 269.495726][ T5866] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 269.625455][ T5934] usb 5-1: new full-speed USB device number 37 using dummy_hcd [ 269.655590][ T5866] usb 3-1: Using ep0 maxpacket: 32 [ 269.671371][ T5866] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 269.687132][ T5866] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 269.697485][ T5866] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 269.717596][ T5866] usb 3-1: Product: syz [ 269.730849][ T5866] usb 3-1: Manufacturer: syz [ 269.746631][ T5866] usb 3-1: SerialNumber: syz [ 269.774896][ T5866] usb 3-1: config 0 descriptor?? [ 269.781461][ T5934] usb 5-1: config 0 has no interfaces? [ 269.787338][ T5934] usb 5-1: New USB device found, idVendor=28bd, idProduct=0935, bcdDevice= 0.00 [ 269.790155][ T8511] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 269.875895][ T5866] hub 3-1:0.0: bad descriptor, ignoring hub [ 269.881874][ T5866] hub 3-1:0.0: probe with driver hub failed with error -5 [ 269.952582][ T5934] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.061904][ T5934] usb 5-1: config 0 descriptor?? [ 270.161007][ T8523] vlan2: entered promiscuous mode [ 270.175466][ T55] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 270.306008][ T8513] netlink: 12 bytes leftover after parsing attributes in process `syz.4.818'. [ 270.329108][ T8513] vlan3: entered promiscuous mode [ 270.334254][ T8513] bridge0: entered promiscuous mode [ 270.355186][ T8531] netlink: 156 bytes leftover after parsing attributes in process `syz.3.824'. [ 270.374890][ T5866] usb 3-1: USB disconnect, device number 43 [ 270.896501][ T55] usb 2-1: config 0 has no interfaces? [ 271.308591][ T55] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 271.328292][ T55] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.336949][ T55] usb 2-1: Product: syz [ 271.351151][ T55] usb 2-1: Manufacturer: syz [ 271.371436][ T55] usb 2-1: SerialNumber: syz [ 271.585810][ T55] usb 2-1: config 0 descriptor?? [ 271.895009][ T5866] usb 5-1: USB disconnect, device number 37 [ 271.958723][ T8519] [U]  [ 272.256408][ T8540] netlink: 4 bytes leftover after parsing attributes in process `syz.3.826'. [ 273.815997][ T5866] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 273.824504][ T55] usb 2-1: USB disconnect, device number 31 [ 273.977764][ T5866] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 273.985741][ T978] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 273.994600][ T5866] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 274.009330][ T5866] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 274.025687][ T5866] usb 4-1: Product: syz [ 274.085411][ T5866] usb 4-1: Manufacturer: syz [ 274.090076][ T5866] usb 4-1: SerialNumber: syz [ 274.165761][ T978] usb 5-1: Using ep0 maxpacket: 16 [ 274.188436][ T978] usb 5-1: New USB device found, idVendor=1004, idProduct=61aa, bcdDevice=4f.75 [ 274.244333][ T8559] syz.2.831: attempt to access beyond end of device [ 274.244333][ T8559] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 274.267353][ T978] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 274.292949][ T978] usb 5-1: Product: syz [ 274.302538][ T978] usb 5-1: Manufacturer: syz [ 274.314435][ T978] usb 5-1: SerialNumber: syz [ 274.319647][ T55] usb 2-1: new low-speed USB device number 32 using dummy_hcd [ 274.341613][ T978] usb 5-1: config 0 descriptor?? [ 274.416927][ T978] usb 5-1: bad CDC descriptors [ 274.466481][ T55] usb 2-1: device descriptor read/64, error -71 [ 274.785654][ T55] usb 2-1: new low-speed USB device number 33 using dummy_hcd [ 275.013522][ T55] usb 2-1: device descriptor read/64, error -71 [ 275.060418][ T8545] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 275.072754][ T8545] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 275.087962][ T8545] netlink: 4 bytes leftover after parsing attributes in process `syz.3.827'. [ 275.126662][ T55] usb usb2-port1: attempt power cycle [ 275.161075][ T5866] usb 5-1: USB disconnect, device number 38 [ 275.605703][ T55] usb 2-1: new low-speed USB device number 34 using dummy_hcd [ 275.626700][ T55] usb 2-1: device descriptor read/8, error -71 [ 275.935914][ T55] usb 2-1: new low-speed USB device number 35 using dummy_hcd [ 276.029843][ T55] usb 2-1: device descriptor read/8, error -71 [ 276.155809][ T55] usb usb2-port1: unable to enumerate USB device [ 276.300911][ T55] usb 4-1: USB disconnect, device number 35 [ 277.111144][ T8579] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 277.506546][ T978] usb 2-1: new full-speed USB device number 36 using dummy_hcd [ 277.687293][ T978] usb 2-1: config 0 has no interfaces? [ 277.698425][ T978] usb 2-1: New USB device found, idVendor=28bd, idProduct=0935, bcdDevice= 0.00 [ 277.731744][ T978] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 277.771349][ T978] usb 2-1: config 0 descriptor?? [ 278.056047][ T978] usb 2-1: USB disconnect, device number 36 [ 279.305869][ T978] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 279.860656][ T8610] syz.1.844: attempt to access beyond end of device [ 279.860656][ T8610] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 279.924435][ T978] usb 5-1: config 0 has no interfaces? [ 279.933759][ T8608] ======================================================= [ 279.933759][ T8608] WARNING: The mand mount option has been deprecated and [ 279.933759][ T8608] and is ignored by this kernel. Remove the mand [ 279.933759][ T8608] option from the mount to silence this warning. [ 279.933759][ T8608] ======================================================= [ 279.940762][ T978] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 279.969481][ C1] vkms_vblank_simulate: vblank timer overrun [ 280.128430][ T978] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 280.136853][ T978] usb 5-1: Product: syz [ 280.160203][ T978] usb 5-1: Manufacturer: syz [ 280.166277][ T978] usb 5-1: SerialNumber: syz [ 280.454152][ T978] usb 5-1: config 0 descriptor?? [ 281.133264][ T8602] [U]  [ 281.556344][ T5934] usb 2-1: new low-speed USB device number 37 using dummy_hcd [ 281.615832][ T978] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 281.722171][ T5934] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 281.752225][ T5934] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 281.767889][ T978] usb 3-1: config 0 has an invalid interface number: 169 but max is 0 [ 281.779990][ T978] usb 3-1: config 0 has no interface number 0 [ 281.830960][ T5934] usb 2-1: New USB device found, idVendor=046d, idProduct=c52f, bcdDevice= 0.00 [ 281.841742][ T978] usb 3-1: New USB device found, idVendor=05ac, idProduct=9222, bcdDevice= f.a9 [ 281.870845][ T5934] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 281.884477][ T978] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 281.932135][ T978] usb 3-1: Product: syz [ 281.955580][ T978] usb 3-1: Manufacturer: syz [ 281.960393][ T5934] usb 2-1: config 0 descriptor?? [ 281.981879][ T978] usb 3-1: SerialNumber: syz [ 282.012182][ T978] usb 3-1: config 0 descriptor?? [ 282.034379][ T978] appledisplay 3-1:0.169: Could not find int-in endpoint [ 282.063357][ T8626] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 282.167412][ T978] usbhid 3-1:0.169: couldn't find an input interrupt endpoint [ 282.385098][ T5885] usb 5-1: USB disconnect, device number 39 [ 282.911648][ T5914] usb 3-1: USB disconnect, device number 44 [ 282.985763][ T5885] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 283.173281][ T5885] usb 5-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 283.183211][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 283.191333][ T5885] usb 5-1: Product: syz [ 283.196439][ T5885] usb 5-1: Manufacturer: syz [ 283.201082][ T5885] usb 5-1: SerialNumber: syz [ 283.249546][ T5885] usb 5-1: config 0 descriptor?? [ 283.408359][ T5914] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 283.468523][ T5885] hso 5-1:0.0: Failed to find INT IN ep [ 283.496793][ T5885] usb-storage 5-1:0.0: USB Mass Storage device detected [ 283.599130][ T5914] usb 3-1: Using ep0 maxpacket: 32 [ 283.620711][ T5914] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 283.649234][ T5914] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 283.681826][ T5885] usb 5-1: USB disconnect, device number 40 [ 283.703892][ T5914] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 283.742788][ T5914] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 283.772889][ T5914] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 283.803288][ T5914] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 283.813084][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 283.829171][ T5914] usb 3-1: Product: syz [ 283.839696][ T5914] usb 3-1: Manufacturer: syz [ 283.854570][ T5914] usb 3-1: SerialNumber: syz [ 283.884336][ T5914] usb 3-1: config 0 descriptor?? [ 284.169412][ T5934] usbhid 2-1:0.0: can't add hid device: -71 [ 284.175775][ T5934] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 284.214125][ T5934] usb 2-1: USB disconnect, device number 37 [ 284.708137][ T8652] syz.4.858: attempt to access beyond end of device [ 284.708137][ T8652] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 284.789049][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 284.811170][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 284.823443][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 284.853729][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 284.873778][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 284.895017][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 284.951754][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 284.966016][ T978] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 284.974438][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 285.013532][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 285.024257][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 285.042417][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 285.050440][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 285.066679][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 285.091483][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 285.106335][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 285.125707][ T978] usb 4-1: Using ep0 maxpacket: 8 [ 285.130536][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 285.141709][ T978] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 285.162868][ T978] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.171314][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 285.172144][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 285.211326][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 285.222973][ T8661] loop8: detected capacity change from 0 to 7 [ 285.223093][ T978] usb 4-1: config 0 descriptor?? [ 285.298259][ T8661] Dev loop8: unable to read RDB block 7 [ 285.304345][ T5914] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 285.314477][ T8661] loop8: unable to read partition table [ 285.322787][ T5914] input input16: Timeout waiting for response from device. [ 285.331785][ T8661] loop8: partition table beyond EOD, truncated [ 285.338225][ T8661] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 285.363599][ T5914] usb 3-1: USB disconnect, device number 45 [ 285.644621][ T8665] netlink: 8 bytes leftover after parsing attributes in process `syz.1.863'. [ 285.889496][ T8653] netlink: 4 bytes leftover after parsing attributes in process `syz.3.857'. [ 285.973922][ T5833] Bluetooth: hci0: unexpected event for opcode 0x0405 [ 285.982787][ T978] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 286.000707][ T978] asix 4-1:0.0: probe with driver asix failed with error -61 [ 286.041267][ T8673] netlink: 4 bytes leftover after parsing attributes in process `syz.1.864'. [ 286.091273][ T8673] netlink: 44 bytes leftover after parsing attributes in process `syz.1.864'. [ 286.891530][ T8696] netlink: 8 bytes leftover after parsing attributes in process `syz.0.869'. [ 287.294764][ T8706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 287.467504][ T8706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 287.495923][ T978] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 287.695514][ T978] usb 2-1: Using ep0 maxpacket: 16 [ 287.804632][ T978] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 287.815452][ T978] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 287.858151][ T978] usb 2-1: config 0 has no interface number 0 [ 287.878581][ T8713] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 287.906232][ T8713] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 287.909767][ T978] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 287.965490][ T978] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.989404][ T978] usb 2-1: Product: syz [ 287.993632][ T978] usb 2-1: Manufacturer: syz [ 288.020650][ T978] usb 2-1: SerialNumber: syz [ 288.049913][ T978] usb 2-1: config 0 descriptor?? [ 288.082633][ T978] usb 2-1: Found UVC 0.00 device syz (046d:08f3) [ 288.104370][ T978] usb 2-1: No valid video chain found. [ 288.338825][ T8699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 288.359457][ T8699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 288.462834][ T8723] syz.4.876: attempt to access beyond end of device [ 288.462834][ T8723] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 288.546357][ T5914] usb 4-1: USB disconnect, device number 36 [ 288.554930][ T8711] netlink: 4 bytes leftover after parsing attributes in process `syz.0.871'. [ 288.957405][ T5934] usb 2-1: USB disconnect, device number 38 [ 289.755569][ T5914] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 290.255674][ T5833] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 290.265491][ T5833] Bluetooth: hci0: Injecting HCI hardware error event [ 290.273564][ T5833] Bluetooth: hci0: hardware error 0x00 [ 290.657294][ T5914] usb 4-1: config 0 has an invalid interface number: 156 but max is 0 [ 290.704761][ T5914] usb 4-1: config 0 has no interface number 0 [ 290.751783][ T5914] usb 4-1: config 0 interface 156 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 290.806322][ T5914] usb 4-1: config 0 interface 156 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 290.852694][ T5914] usb 4-1: config 0 interface 156 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 290.885815][ T8737] tipc: Started in network mode [ 290.920128][ T8737] tipc: Node identity -:, cluster identity 4711 [ 290.965768][ T5914] usb 4-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 290.980152][ T8737] tipc: Enabling of bearer rejected, failed to enable media [ 290.989295][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.021827][ T5914] usb 4-1: config 0 descriptor?? [ 291.035193][ T5914] gspca_main: spca561-2.14.0 probing abcd:cdee [ 291.626921][ T5914] spca561 4-1:0.156: probe with driver spca561 failed with error -22 [ 291.635986][ T5914] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 291.642983][ T5914] usb 4-1: MIDIStreaming interface descriptor not found [ 291.680764][ T5914] usb 4-1: USB disconnect, device number 37 [ 291.810185][ T6778] udevd[6778]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.156/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 292.691980][ T8754] input: syz0 as /devices/virtual/input/input18 [ 292.715745][ T5833] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 292.918587][ T8776] netlink: 4 bytes leftover after parsing attributes in process `syz.3.892'. [ 292.930481][ T8778] ptrace attach of "./syz-executor exec"[5845] was attempted by "./syz-executor exec"[8778] [ 293.003575][ T8778] dns_resolver: Unsupported server list version (0) [ 293.882860][ T8792] Cannot find add_set index 3 as target [ 294.415793][ T10] usb 5-1: new low-speed USB device number 41 using dummy_hcd [ 294.627577][ T10] usb 5-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 65535, setting to 8 [ 294.672151][ T10] usb 5-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 294.695442][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 294.755870][ T8794] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 295.074028][ T10] usb 5-1: string descriptor 0 read error: -71 [ 295.102149][ T10] hub 5-1:32.0: USB hub found [ 295.116621][ T10] hub 5-1:32.0: config failed, can't read hub descriptor (err -22) [ 295.347454][ T10] usb 5-1: USB disconnect, device number 41 [ 295.386059][ T5914] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 295.570042][ T5914] usb 3-1: config 0 has no interfaces? [ 295.592998][ T5914] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 295.639178][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 295.677848][ T5914] usb 3-1: Product: syz [ 295.717276][ T5914] usb 3-1: Manufacturer: syz [ 295.722024][ T5914] usb 3-1: SerialNumber: syz [ 295.810590][ T5914] usb 3-1: config 0 descriptor?? [ 296.009108][ T8822] input: syz0 as /devices/virtual/input/input19 [ 296.035779][ T8820] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 296.042657][ T8820] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 296.082735][ T8805] [U]  [ 296.106692][ T8828] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 296.152941][ T8828] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 296.174878][ T8820] vhci_hcd vhci_hcd.0: Device attached [ 296.416524][ T5934] usb 4-1: new full-speed USB device number 38 using dummy_hcd [ 296.505423][ T5914] usb 39-1: new high-speed USB device number 2 using vhci_hcd [ 296.592553][ T5934] usb 4-1: config 0 has an invalid interface number: 200 but max is 0 [ 296.610239][ T5934] usb 4-1: config 0 has no interface number 0 [ 296.619247][ T5934] usb 4-1: config 0 interface 200 altsetting 2 endpoint 0x4 has invalid wMaxPacketSize 0 [ 296.631486][ T5934] usb 4-1: config 0 interface 200 has no altsetting 0 [ 296.655109][ T5934] usb 4-1: New USB device found, idVendor=0b57, idProduct=852a, bcdDevice=6d.39 [ 296.674942][ T5934] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 296.686225][ T5934] usb 4-1: Product: syz [ 296.693313][ T5934] usb 4-1: Manufacturer: syz [ 296.714500][ T5934] usb 4-1: SerialNumber: syz [ 296.759116][ T5934] usb 4-1: config 0 descriptor?? [ 296.983288][ T8823] vhci_hcd: connection reset by peer [ 296.995259][ T5934] input: Hanwang Art Master III 1308 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.200/input/input20 [ 297.015571][ T13] vhci_hcd: stop threads [ 297.020269][ T5885] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 297.034132][ T13] vhci_hcd: release socket [ 297.034988][ T5934] usb 4-1: USB disconnect, device number 38 [ 297.052378][ T13] vhci_hcd: disconnect device [ 297.197210][ T5885] usb 5-1: Using ep0 maxpacket: 16 [ 297.229905][ T5885] usb 5-1: config 0 has no interfaces? [ 297.250513][ T5885] usb 5-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 297.269905][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.299183][ T5885] usb 5-1: Product: syz [ 297.318920][ T5885] usb 5-1: Manufacturer: syz [ 297.329778][ T5885] usb 5-1: SerialNumber: syz [ 297.459324][ T5885] usb 5-1: config 0 descriptor?? [ 297.585813][ T5934] usb 3-1: USB disconnect, device number 46 [ 297.796992][ T8851] Cannot find add_set index 3 as target [ 297.869644][ T8853] netlink: 8 bytes leftover after parsing attributes in process `syz.3.914'. [ 297.957777][ T5934] usb 5-1: USB disconnect, device number 42 [ 298.155629][ T55] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 298.310852][ T8863] netlink: 20 bytes leftover after parsing attributes in process `syz.1.919'. [ 298.319930][ T55] usb 3-1: Using ep0 maxpacket: 32 [ 298.327376][ T55] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 298.339316][ T55] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 298.418142][ T978] usb 4-1: new full-speed USB device number 39 using dummy_hcd [ 298.427103][ T55] usb 3-1: New USB device found, idVendor=0c70, idProduct=f0b6, bcdDevice= 0.00 [ 298.448944][ T55] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.478698][ T55] usb 3-1: config 0 descriptor?? [ 298.587431][ T978] usb 4-1: config 0 has no interfaces? [ 298.592960][ T978] usb 4-1: New USB device found, idVendor=28bd, idProduct=0935, bcdDevice= 0.00 [ 298.635620][ T978] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.669411][ T8866] xt_SECMARK: invalid mode: 0 [ 298.695468][ T978] usb 4-1: config 0 descriptor?? [ 298.934235][ T8873] netlink: 20 bytes leftover after parsing attributes in process `syz.1.921'. [ 298.947606][ T8859] netlink: 12 bytes leftover after parsing attributes in process `syz.3.917'. [ 298.965558][ T8859] vlan3: entered promiscuous mode [ 299.181254][ T55] aquacomputer_d5next 0003:0C70:F0B6.000A: unknown main item tag 0x2 [ 299.787708][ T55] aquacomputer_d5next 0003:0C70:F0B6.000A: hidraw0: USB HID vff.fc Device [HID 0c70:f0b6] on usb-dummy_hcd.2-1/input0 [ 300.024876][ T8881] use of bytesused == 0 is deprecated and will be removed in the future, [ 301.049521][ T8881] use the actual size instead. [ 301.282364][ T55] usb 3-1: reset high-speed USB device number 47 using dummy_hcd [ 301.494005][ T978] usb 4-1: USB disconnect, device number 39 [ 301.715442][ T5885] usb 5-1: new full-speed USB device number 43 using dummy_hcd [ 301.727229][ T5914] vhci_hcd: vhci_device speed not set [ 302.027456][ T5885] usb 5-1: config 0 has no interfaces? [ 302.033320][ T5885] usb 5-1: New USB device found, idVendor=28bd, idProduct=0935, bcdDevice= 0.00 [ 302.067258][ T5885] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 302.120225][ T8886] syz.0.923: vmalloc error: size 85106688, failed to allocated page array size 166224, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 302.142232][ T8886] CPU: 1 UID: 0 PID: 8886 Comm: syz.0.923 Not tainted 6.16.0-rc2-syzkaller-00318-g739a6c93cc75 #0 PREEMPT(full) [ 302.142261][ T8886] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 302.142288][ T8886] Call Trace: [ 302.142300][ T8886] [ 302.142310][ T8886] dump_stack_lvl+0x189/0x250 [ 302.142351][ T8886] ? __pfx_dump_stack_lvl+0x10/0x10 [ 302.142382][ T8886] ? __pfx__printk+0x10/0x10 [ 302.142405][ T8886] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 302.142429][ T8886] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 302.142453][ T8886] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 302.142478][ T8886] warn_alloc+0x214/0x310 [ 302.142508][ T8886] ? __pfx_warn_alloc+0x10/0x10 [ 302.142540][ T8886] ? __get_vm_area_node+0x28f/0x300 [ 302.142562][ T8886] ? drm_property_create_blob+0x65/0x300 [ 302.142588][ T8886] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 302.142609][ T8886] ? __kasan_slab_free+0x62/0x70 [ 302.142656][ T8886] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 302.142684][ T8886] ? rcu_is_watching+0x15/0xb0 [ 302.142714][ T8886] ? drm_property_create_blob+0x65/0x300 [ 302.142735][ T8886] ? drm_property_create_blob+0x65/0x300 [ 302.142753][ T8886] __kvmalloc_node_noprof+0x3b8/0x5f0 [ 302.142772][ T8886] ? drm_property_create_blob+0x65/0x300 [ 302.142789][ T8886] ? drm_dev_enter+0x49/0x150 [ 302.142813][ T8886] ? vga16fb_copyarea+0x41e/0x7a0 [ 302.142847][ T8886] drm_property_create_blob+0x65/0x300 [ 302.142870][ T8886] drm_mode_createblob_ioctl+0xbf/0x400 [ 302.142892][ T8886] drm_ioctl_kernel+0x2cf/0x390 [ 302.142915][ T8886] ? __pfx_drm_mode_createblob_ioctl+0x10/0x10 [ 302.142934][ T8886] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 302.142967][ T8886] drm_ioctl+0x67f/0xb10 [ 302.142986][ T8886] ? __lock_acquire+0xab9/0xd20 [ 302.143012][ T8886] ? __pfx_drm_mode_createblob_ioctl+0x10/0x10 [ 302.143038][ T8886] ? __pfx_drm_ioctl+0x10/0x10 [ 302.143068][ T8886] ? __fget_files+0x3a0/0x420 [ 302.143086][ T8886] ? __fget_files+0x2a/0x420 [ 302.143103][ T8886] ? drm_compat_ioctl+0xa7/0x330 [ 302.143128][ T8886] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 302.143156][ T8886] __ia32_compat_sys_ioctl+0x543/0x840 [ 302.143183][ T8886] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 302.143213][ T8886] ? __se_sys_futex_time32+0x360/0x3e0 [ 302.143241][ T8886] ? rcu_is_watching+0x15/0xb0 [ 302.143268][ T8886] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 302.143295][ T8886] ? lockdep_hardirqs_on+0x9c/0x150 [ 302.143320][ T8886] __do_fast_syscall_32+0xb6/0x2b0 [ 302.143341][ T8886] do_fast_syscall_32+0x34/0x80 [ 302.143356][ T8886] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 302.143376][ T8886] RIP: 0023:0xf7f04539 [ 302.143391][ T8886] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 302.143406][ T8886] RSP: 002b:00000000f4bc155c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 302.143424][ T8886] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00000000c01064bd [ 302.143436][ T8886] RDX: 00000000800000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 302.143446][ T8886] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 302.143455][ T8886] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 302.143465][ T8886] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 302.143487][ T8886] [ 302.143599][ T8886] Mem-Info: [ 302.690783][ T5885] usb 5-1: config 0 descriptor?? [ 302.721252][ T8886] active_anon:10319 inactive_anon:0 isolated_anon:0 [ 302.721252][ T8886] active_file:13182 inactive_file:40125 isolated_file:0 [ 302.721252][ T8886] unevictable:768 dirty:74 writeback:0 [ 302.721252][ T8886] slab_reclaimable:9366 slab_unreclaimable:102483 [ 302.721252][ T8886] mapped:35515 shmem:5463 pagetables:1310 [ 302.721252][ T8886] sec_pagetables:0 bounce:0 [ 302.721252][ T8886] kernel_misc_reclaimable:0 [ 302.721252][ T8886] free:1303000 free_pcp:19868 free_cma:0 [ 302.771994][ T5899] usb 3-1: USB disconnect, device number 47 [ 302.847960][ T8886] Node 0 active_anon:41376kB inactive_anon:0kB active_file:52728kB inactive_file:160396kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:142060kB dirty:296kB writeback:0kB shmem:20316kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12432kB pagetables:5188kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 302.899230][ T8899] netlink: 156 bytes leftover after parsing attributes in process `syz.1.927'. [ 303.014076][ T8886] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:80kB pagetables:152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 303.050789][ T8886] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 303.086794][ T8886] lowmem_reserve[]: 0 2501 2502 2502 2502 [ 303.092962][ T8886] Node 0 DMA32 free:1302444kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:41332kB inactive_anon:0kB active_file:52728kB inactive_file:159132kB unevictable:1536kB writepending:308kB present:3129332kB managed:2561024kB mlocked:0kB bounce:0kB free_pcp:52580kB local_pcp:23016kB free_cma:0kB [ 303.166221][ T8886] lowmem_reserve[]: 0 0 1 1 1 [ 303.172078][ T8886] Node 0 Normal free:16kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1828kB unevictable:0kB writepending:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 303.220695][ T8891] vlan3: entered promiscuous mode [ 303.232349][ T8886] lowmem_reserve[]: 0 0 0 0 0 [ 303.251908][ T8886] Node 1 Normal free:3902856kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:19984kB local_pcp:6912kB free_cma:0kB [ 303.307315][ T8886] lowmem_reserve[]: 0 0 0 0 0 [ 303.315957][ T8886] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 303.338236][ T8886] Node 0 DMA32: 1258*4kB (UME) 1062*8kB (UME) 1281*16kB (UME) 984*32kB (UME) 675*64kB (UME) 374*128kB (UME) 228*256kB (UME) 203*512kB (UM) 169*1024kB (UME) 24*2048kB (UME) 186*4096kB (UM) = 1302952kB [ 303.359425][ T8886] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 303.373509][ T8886] Node 1 Normal: 92*4kB (UE) 19*8kB (UE) 34*16kB (UE) 111*32kB (UME) 24*64kB (UME) 7*128kB (UE) 4*256kB (UME) 3*512kB (UM) 2*1024kB (ME) 2*2048kB (UE) 949*4096kB (M) = 3902856kB [ 303.392689][ T8886] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 303.434053][ T8886] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 303.449745][ T8886] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 303.484987][ T8886] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 303.521441][ T8886] 58931 total pagecache pages [ 303.529425][ T8886] 0 pages in swap cache [ 303.534949][ T8886] Free swap = 124996kB [ 303.549519][ T55] usb 5-1: USB disconnect, device number 43 [ 303.581707][ T8886] Total swap = 124996kB [ 303.592007][ T8886] 2097051 pages RAM [ 303.599393][ T8886] 0 pages HighMem/MovableOnly [ 303.658010][ T8886] 424689 pages reserved [ 303.662535][ T8886] 0 pages cma reserved [ 304.047957][ T8924] Cannot find add_set index 3 as target [ 304.277237][ T8933] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 304.286799][ T8933] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 304.302679][ T8933] [U]  [ 305.427219][ T5899] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 305.518013][ T8942] loop8: detected capacity change from 0 to 7 [ 305.546406][ T5843] Dev loop8: unable to read RDB block 7 [ 305.552463][ T5843] loop8: unable to read partition table [ 305.583687][ T5843] loop8: partition table beyond EOD, truncated [ 305.615787][ T5899] usb 2-1: Using ep0 maxpacket: 16 [ 305.646013][ T5899] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 305.657030][ T5899] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 305.696755][ T8942] Dev loop8: unable to read RDB block 7 [ 305.708681][ T8942] loop8: unable to read partition table [ 305.765659][ T8942] loop8: partition table beyond EOD, truncated [ 305.782341][ T5899] usb 2-1: New USB device found, idVendor=1044, idProduct=7a4d, bcdDevice= 0.00 [ 305.786125][ T8942] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 305.798408][ T5899] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.826321][ T5899] usb 2-1: config 0 descriptor?? [ 306.092707][ T5885] usb 2-1: USB disconnect, device number 39 [ 306.289387][ T5899] usb 5-1: new full-speed USB device number 44 using dummy_hcd [ 306.334607][ T8953] netlink: 4 bytes leftover after parsing attributes in process `syz.2.945'. [ 306.462432][ T8956] netlink: 4 bytes leftover after parsing attributes in process `syz.3.946'. [ 306.491513][ T8956] netlink: 44 bytes leftover after parsing attributes in process `syz.3.946'. [ 306.528641][ T5899] usb 5-1: device descriptor read/all, error -61 [ 306.686016][ T5899] usb 5-1: new full-speed USB device number 45 using dummy_hcd [ 306.738435][ T8961] netlink: 8 bytes leftover after parsing attributes in process `syz.1.948'. [ 306.769415][ T5885] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 306.836061][ T5899] usb 5-1: device descriptor read/64, error -71 [ 306.958343][ T5885] usb 3-1: Using ep0 maxpacket: 16 [ 306.958814][ T5899] usb usb5-port1: attempt power cycle [ 306.967828][ T5885] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 306.979437][ T5885] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.027153][ T5885] usb 3-1: Product: syz [ 307.048363][ T5885] usb 3-1: Manufacturer: syz [ 307.070401][ T5885] usb 3-1: SerialNumber: syz [ 307.110953][ T5885] r8152-cfgselector 3-1: Unknown version 0x0000 [ 307.268568][ T5885] r8152-cfgselector 3-1: config 0 descriptor?? [ 307.345557][ T5899] usb 5-1: new full-speed USB device number 46 using dummy_hcd [ 307.533248][ T8959] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 307.563014][ T8959] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 307.595868][ T5899] usb 5-1: device not accepting address 46, error -71 [ 307.620848][ T5885] r8152-cfgselector 3-1: Unknown version 0x0000 [ 307.637062][ T5885] r8152-cfgselector 3-1: bad CDC descriptors [ 307.674548][ T5885] r8152-cfgselector 3-1: USB disconnect, device number 48 [ 307.709131][ T8975] xt_bpf: check failed: parse error [ 307.785128][ T8975] netlink: 16 bytes leftover after parsing attributes in process `syz.0.953'. [ 308.004563][ T8984] tipc: Enabling of bearer rejected, failed to enable media [ 308.845448][ T5899] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 308.899143][ T5899] usb 5-1: Using ep0 maxpacket: 16 [ 308.948171][ T5899] usb 5-1: New USB device found, idVendor=09c0, idProduct=0201, bcdDevice= a.a4 [ 308.959576][ T30] kauditd_printk_skb: 527 callbacks suppressed [ 308.959595][ T30] audit: type=1326 audit(1750625115.582:702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8988 comm="syz.0.956" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f04539 code=0x7ffc0000 [ 308.963298][ T5899] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 308.979847][ T30] audit: type=1326 audit(1750625115.592:703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8988 comm="syz.0.956" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f04539 code=0x7ffc0000 [ 309.072329][ T5899] usb 5-1: Product: syz [ 309.096110][ T5899] usb 5-1: Manufacturer: syz [ 309.111316][ T5899] usb 5-1: SerialNumber: syz [ 309.143423][ T5899] usb 5-1: config 0 descriptor?? [ 309.145411][ T30] audit: type=1326 audit(1750625115.592:704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8988 comm="syz.0.956" exe="/root/syz-executor" sig=0 arch=40000003 syscall=331 compat=1 ip=0xf7f04539 code=0x7ffc0000 [ 309.245946][ T5899] dvb-usb: found a 'Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver' in warm state. [ 309.305777][ T30] audit: type=1326 audit(1750625115.592:705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8988 comm="syz.0.956" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f04539 code=0x7ffc0000 [ 309.329401][ T5914] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 309.372588][ T30] audit: type=1326 audit(1750625115.592:706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8988 comm="syz.0.956" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f04539 code=0x7ffc0000 [ 309.455231][ T5899] gp8psk: usb in 128 operation failed. [ 309.485582][ T5914] usb 3-1: Using ep0 maxpacket: 8 [ 309.500726][ T30] audit: type=1326 audit(1750625115.592:707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8988 comm="syz.0.956" exe="/root/syz-executor" sig=0 arch=40000003 syscall=356 compat=1 ip=0xf7f04539 code=0x7ffc0000 [ 309.531865][ T5914] usb 3-1: config 0 has an invalid interface number: 122 but max is 0 [ 309.562357][ T5914] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 309.575849][ T30] audit: type=1326 audit(1750625115.592:708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8988 comm="syz.0.956" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f04539 code=0x7ffc0000 [ 309.605672][ T5914] usb 3-1: config 0 has no interface number 0 [ 309.611842][ T5914] usb 3-1: config 0 interface 122 altsetting 0 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 309.622814][ T5914] usb 3-1: config 0 interface 122 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 8 [ 309.633406][ T5914] usb 3-1: config 0 interface 122 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 309.643662][ T5914] usb 3-1: config 0 interface 122 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 0 [ 309.665697][ T5914] usb 3-1: config 0 interface 122 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 8 [ 309.684706][ T30] audit: type=1326 audit(1750625115.592:709): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8988 comm="syz.0.956" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f04539 code=0x7ffc0000 [ 309.716234][ T5899] gp8psk: usb in 146 operation failed. [ 309.726205][ T5899] gp8psk: failed to get FW version [ 309.742591][ T30] audit: type=1326 audit(1750625115.592:710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8988 comm="syz.0.956" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f04539 code=0x7ffc0000 [ 309.764518][ T5914] usb 3-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 5.b7 [ 309.764547][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 309.764566][ T5914] usb 3-1: Product: syz [ 309.764579][ T5914] usb 3-1: Manufacturer: syz [ 309.764593][ T5914] usb 3-1: SerialNumber: syz [ 309.816807][ T5914] usb 3-1: config 0 descriptor?? [ 309.819788][ T5899] gp8psk: FPGA Version = 0 [ 309.832264][ T8989] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 309.887790][ T5899] usb 5-1: Direct firmware load for dvb-usb-gp8psk-02.fw failed with error -2 [ 309.917565][ T5899] usb 5-1: Falling back to sysfs fallback for: dvb-usb-gp8psk-02.fw [ 309.933841][ T30] audit: type=1326 audit(1750625115.592:711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8988 comm="syz.0.956" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f04539 code=0x7ffc0000 [ 310.089138][ T9000] netlink: 156 bytes leftover after parsing attributes in process `syz.0.961'. [ 310.097904][ T9001] --map-set only usable from mangle table [ 310.265555][ T9005] netlink: 4 bytes leftover after parsing attributes in process `syz.0.963'. [ 310.573296][ T5914] usb 3-1: NFC: intf ffff888055328000 id ffffffff8eb52b40 [ 310.675173][ T5914] nfcmrvl 3-1:0.122: NFC: registered with nci successfully [ 310.753295][ T5914] usb 3-1: USB disconnect, device number 49 [ 310.785181][ T5914] usb 3-1: NFC: intf ffff888055328000 [ 311.105663][ T55] usb 2-1: new low-speed USB device number 40 using dummy_hcd [ 311.272108][ T55] usb 2-1: New USB device found, idVendor=046d, idProduct=08b1, bcdDevice=6d.2a [ 311.281920][ T55] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.306658][ T55] usb 2-1: config 0 descriptor?? [ 311.344898][ T55] pwc: Logitech QuickCam Notebook Pro USB webcam detected. [ 311.471316][ T9031] syz.3.970: attempt to access beyond end of device [ 311.471316][ T9031] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 311.894031][ T55] pwc: Failed to set LED on/off time (-71) [ 311.900598][ T55] pwc: send_video_command error -71 [ 311.906564][ T55] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 311.926275][ T55] Philips webcam 2-1:0.0: probe with driver Philips webcam failed with error -71 [ 311.974030][ T55] usb 2-1: USB disconnect, device number 40 [ 313.311205][ T55] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 314.230051][ T55] usb 4-1: config 0 has no interfaces? [ 314.281693][ T55] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 314.300596][ T55] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.350064][ T55] usb 4-1: Product: syz [ 314.362765][ T55] usb 4-1: Manufacturer: syz [ 314.372312][ T55] usb 4-1: SerialNumber: syz [ 314.386862][ T55] usb 4-1: config 0 descriptor?? [ 314.416326][ T5866] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 314.625541][ T5866] usb 3-1: Using ep0 maxpacket: 16 [ 314.719010][ T5866] usb 3-1: unable to get BOS descriptor or descriptor too short [ 314.743779][ T5866] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 314.752221][ T5866] usb 3-1: can't read configurations, error -71 [ 315.417466][ T9068] Cannot find add_set index 3 as target [ 316.046258][ T978] usb 4-1: USB disconnect, device number 40 [ 316.177436][ T9087] Cannot find add_set index 3 as target [ 316.349495][ T9090] syz.4.985: attempt to access beyond end of device [ 316.349495][ T9090] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 316.720191][ T9092] Cannot find add_set index 3 as target [ 316.925471][ T5914] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 317.226067][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.232843][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.474320][ T9094] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 317.546060][ T9094] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 317.580189][ T5914] usb 4-1: config 0 has no interfaces? [ 317.732184][ T5914] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 317.762358][ T5914] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.959656][ T5914] usb 4-1: Product: syz [ 317.963916][ T5914] usb 4-1: Manufacturer: syz [ 317.974980][ T5914] usb 4-1: SerialNumber: syz [ 318.002267][ T5914] usb 4-1: config 0 descriptor?? [ 318.381828][ T9091] [U]  [ 320.810097][ T5914] usb 4-1: USB disconnect, device number 41 [ 321.561291][ T9121] Cannot find add_set index 3 as target [ 321.942102][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 321.942121][ T30] audit: type=1326 audit(1750625128.542:726): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9135 comm="syz.1.997" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 322.081776][ T30] audit: type=1326 audit(1750625128.542:727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9135 comm="syz.1.997" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 322.161180][ T30] audit: type=1326 audit(1750625128.542:728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9135 comm="syz.1.997" exe="/root/syz-executor" sig=0 arch=40000003 syscall=331 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 322.183097][ C1] vkms_vblank_simulate: vblank timer overrun [ 322.227031][ T30] audit: type=1326 audit(1750625128.552:729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9135 comm="syz.1.997" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 322.290529][ T30] audit: type=1326 audit(1750625128.552:730): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9135 comm="syz.1.997" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 322.415763][ T30] audit: type=1326 audit(1750625128.552:731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9135 comm="syz.1.997" exe="/root/syz-executor" sig=0 arch=40000003 syscall=356 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 322.564039][ T30] audit: type=1326 audit(1750625128.552:732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9135 comm="syz.1.997" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 322.596165][ T9152] Cannot find add_set index 3 as target [ 322.666821][ T30] audit: type=1326 audit(1750625128.552:733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9135 comm="syz.1.997" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 322.688773][ T55] usb 4-1: new full-speed USB device number 42 using dummy_hcd [ 322.698903][ T30] audit: type=1326 audit(1750625128.552:734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9135 comm="syz.1.997" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 322.735718][ T30] audit: type=1326 audit(1750625128.552:735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9135 comm="syz.1.997" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ae539 code=0x7ffc0000 [ 322.848299][ T55] usb 4-1: config 0 has no interfaces? [ 322.890679][ T55] usb 4-1: New USB device found, idVendor=28bd, idProduct=0935, bcdDevice= 0.00 [ 322.943951][ T55] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 322.974160][ T55] usb 4-1: config 0 descriptor?? [ 323.193289][ T9146] vlan3: entered promiscuous mode [ 323.311553][ T5914] usb 4-1: USB disconnect, device number 42 [ 323.431546][ T9161] xt_bpf: check failed: parse error [ 323.876342][ T5866] usb 3-1: new full-speed USB device number 52 using dummy_hcd [ 324.078343][ T5866] usb 3-1: config 1 interface 0 altsetting 26 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 324.097716][ T5866] usb 3-1: config 1 interface 0 has no altsetting 0 [ 324.113692][ T5866] usb 3-1: New USB device found, idVendor=046a, idProduct=0023, bcdDevice= 0.40 [ 324.126501][ T5866] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.138223][ T5866] usb 3-1: Product: syz [ 324.142655][ T5866] usb 3-1: Manufacturer: syz [ 324.149277][ T5866] usb 3-1: SerialNumber: syz [ 324.378484][ T9163] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 324.403440][ T9163] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 324.454487][ T5866] usbhid 3-1:1.0: can't add hid device: -71 [ 324.484106][ T5866] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 324.563984][ T5866] usb 3-1: USB disconnect, device number 52 [ 324.809854][ T9186] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1011'. [ 324.838184][ T9186] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1011'. [ 325.022146][ T9192] (unnamed net_device) (uninitialized): option arp_interval: invalid value (18446744073072017407) [ 325.048496][ T9192] (unnamed net_device) (uninitialized): option arp_interval: allowed values 0 - 2147483647 [ 325.552949][ T9195] xt_CT: No such helper "syz0" [ 326.382885][ T9212] Cannot find add_set index 3 as target [ 326.815209][ T9219] Cannot find add_set index 3 as target [ 327.298568][ T9221] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1022'. [ 327.373417][ T9221] bridge_slave_1: left allmulticast mode [ 327.384365][ T9221] bridge_slave_1: left promiscuous mode [ 327.391938][ T9221] bridge0: port 2(bridge_slave_1) entered disabled state [ 327.422112][ T9221] bridge_slave_0: left allmulticast mode [ 327.429463][ T9221] bridge_slave_0: left promiscuous mode [ 327.464844][ T9221] bridge0: port 1(bridge_slave_0) entered disabled state [ 327.918473][ T9224] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1023'. [ 327.935255][ T9224] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1023'. [ 328.044768][ T9225] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1023'. [ 328.144362][ T9224] netlink: 'syz.3.1023': attribute type 11 has an invalid length. [ 328.306451][ T9221] bond0: (slave bridge0): Releasing backup interface [ 328.351366][ T9231] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1025'. [ 328.356778][ T9221] bridge0 (unregistering): left promiscuous mode [ 328.531077][ T9236] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1027'. [ 330.054618][ T9258] bond0: entered promiscuous mode [ 330.118772][ T9258] bond_slave_0: entered promiscuous mode [ 330.124635][ T9258] bond_slave_1: entered promiscuous mode [ 330.137920][ T9258] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 330.227766][ T9258] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1034'. [ 330.323485][ T9267] input: syz0 as /devices/virtual/input/input21 [ 330.662272][ T9274] Cannot find add_set index 3 as target [ 331.253511][ T5885] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 331.406334][ T9281] lo: entered promiscuous mode [ 331.411151][ T9281] lo: entered allmulticast mode [ 331.427309][ T9281] tunl0: entered promiscuous mode [ 331.445461][ T9281] tunl0: entered allmulticast mode [ 331.451297][ T9281] gre0: entered promiscuous mode [ 331.500863][ T9281] gre0: entered allmulticast mode [ 331.515694][ T9281] gretap0: entered promiscuous mode [ 331.521164][ T9281] gretap0: entered allmulticast mode [ 331.533759][ T5885] usb 2-1: config 0 has no interfaces? [ 331.546927][ T5885] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 331.556100][ T5885] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 331.566411][ T5885] usb 2-1: Product: syz [ 331.575814][ T9281] erspan0: entered promiscuous mode [ 331.581132][ T9281] erspan0: entered allmulticast mode [ 331.602056][ T5885] usb 2-1: Manufacturer: syz [ 331.628070][ T5885] usb 2-1: SerialNumber: syz [ 331.698950][ T5885] usb 2-1: config 0 descriptor?? [ 331.727892][ T9281] ip_vti0: entered promiscuous mode [ 331.742336][ T9281] ip_vti0: entered allmulticast mode [ 331.773304][ T9281] ip6_vti0: entered promiscuous mode [ 331.781343][ T9281] ip6_vti0: entered allmulticast mode [ 331.815469][ T9281] sit0: entered promiscuous mode [ 331.820666][ T9281] sit0: entered allmulticast mode [ 331.851253][ T9281] ip6tnl0: entered promiscuous mode [ 331.857907][ T9281] ip6tnl0: entered allmulticast mode [ 331.863905][ T9281] ip6gre0: entered promiscuous mode [ 331.869758][ T9281] ip6gre0: entered allmulticast mode [ 331.876754][ T9281] syz_tun: entered promiscuous mode [ 331.882054][ T9281] syz_tun: entered allmulticast mode [ 331.889590][ T9281] bridge0: entered allmulticast mode [ 331.933309][ T9281] vcan0: entered promiscuous mode [ 331.950690][ T9281] vcan0: entered allmulticast mode [ 332.041397][ T9281] bond0: entered allmulticast mode [ 332.059616][ T9281] bond_slave_0: entered allmulticast mode [ 332.069019][ T9281] bond_slave_1: entered allmulticast mode [ 332.082543][ T9286] [U]  [ 332.106640][ T9281] team0: entered promiscuous mode [ 332.136002][ T5866] usb 4-1: new full-speed USB device number 43 using dummy_hcd [ 332.212059][ T9281] team_slave_0: entered promiscuous mode [ 332.229496][ T9281] team_slave_1: entered promiscuous mode [ 332.242891][ T9281] vlan2: entered promiscuous mode [ 332.248964][ T9281] [ 332.251298][ T9281] ====================================================== [ 332.258297][ T9281] WARNING: possible circular locking dependency detected [ 332.265317][ T9281] 6.16.0-rc2-syzkaller-00318-g739a6c93cc75 #0 Not tainted [ 332.272419][ T9281] ------------------------------------------------------ [ 332.279429][ T9281] syz.4.1040/9281 is trying to acquire lock: [ 332.285504][ T9281] ffff88807ec08d30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: dev_set_promiscuity+0x10e/0x260 [ 332.295944][ T9281] [ 332.295944][ T9281] but task is already holding lock: [ 332.303286][ T9281] ffff88802ce60e00 (team->team_lock_key){+.+.}-{4:4}, at: team_change_rx_flags+0x38/0x220 [ 332.313199][ T9281] [ 332.313199][ T9281] which lock already depends on the new lock. [ 332.313199][ T9281] [ 332.323588][ T9281] [ 332.323588][ T9281] the existing dependency chain (in reverse order) is: [ 332.332578][ T9281] [ 332.332578][ T9281] -> #1 (team->team_lock_key){+.+.}-{4:4}: [ 332.340639][ T9281] lock_acquire+0x120/0x360 [ 332.345653][ T9281] __mutex_lock+0x182/0xe80 [ 332.350656][ T9281] team_device_event+0x182/0xa20 [ 332.356102][ T9281] notifier_call_chain+0x1b3/0x3e0 [ 332.361722][ T9281] dev_close_many+0x29c/0x410 [ 332.366900][ T9281] vlan_device_event+0x1748/0x1d00 [ 332.372514][ T9281] notifier_call_chain+0x1b3/0x3e0 [ 332.378221][ T9281] __dev_notify_flags+0x18d/0x2e0 [ 332.383752][ T9281] netif_change_flags+0xe8/0x1a0 [ 332.389193][ T9281] do_setlink+0xc55/0x41c0 [ 332.394119][ T9281] rtnl_newlink+0x160b/0x1c70 [ 332.399308][ T9281] rtnetlink_rcv_msg+0x7cc/0xb70 [ 332.404751][ T9281] netlink_rcv_skb+0x208/0x470 [ 332.410022][ T9281] netlink_unicast+0x75b/0x8d0 [ 332.415289][ T9281] netlink_sendmsg+0x805/0xb30 [ 332.420583][ T9281] __sock_sendmsg+0x21c/0x270 [ 332.425787][ T9281] ____sys_sendmsg+0x505/0x830 [ 332.431077][ T9281] ___sys_sendmsg+0x21f/0x2a0 [ 332.436258][ T9281] __sys_sendmsg+0x164/0x220 [ 332.441352][ T9281] __do_fast_syscall_32+0xb6/0x2b0 [ 332.446965][ T9281] do_fast_syscall_32+0x34/0x80 [ 332.452323][ T9281] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 332.459244][ T9281] [ 332.459244][ T9281] -> #0 (&dev_instance_lock_key#20){+.+.}-{4:4}: [ 332.467749][ T9281] validate_chain+0xb9b/0x2140 [ 332.473027][ T9281] __lock_acquire+0xab9/0xd20 [ 332.478213][ T9281] lock_acquire+0x120/0x360 [ 332.483223][ T9281] __mutex_lock+0x182/0xe80 [ 332.488242][ T9281] dev_set_promiscuity+0x10e/0x260 [ 332.493853][ T9281] __dev_set_promiscuity+0x534/0x740 [ 332.499739][ T9281] netif_set_promiscuity+0x50/0xe0 [ 332.505373][ T9281] dev_set_promiscuity+0x126/0x260 [ 332.511039][ T9281] team_change_rx_flags+0x123/0x220 [ 332.516745][ T9281] __dev_set_promiscuity+0x534/0x740 [ 332.522532][ T9281] __dev_change_flags+0x41b/0x6d0 [ 332.528068][ T9281] netif_change_flags+0x88/0x1a0 [ 332.533504][ T9281] do_setlink+0xc55/0x41c0 [ 332.538423][ T9281] rtnl_newlink+0x149f/0x1c70 [ 332.543598][ T9281] rtnetlink_rcv_msg+0x7cc/0xb70 [ 332.549040][ T9281] netlink_rcv_skb+0x208/0x470 [ 332.554303][ T9281] netlink_unicast+0x75b/0x8d0 [ 332.559565][ T9281] netlink_sendmsg+0x805/0xb30 [ 332.564830][ T9281] __sock_sendmsg+0x21c/0x270 [ 332.570022][ T9281] ____sys_sendmsg+0x505/0x830 [ 332.575297][ T9281] ___sys_sendmsg+0x21f/0x2a0 [ 332.580501][ T9281] __sys_sendmsg+0x164/0x220 [ 332.585597][ T9281] __do_fast_syscall_32+0xb6/0x2b0 [ 332.591220][ T9281] do_fast_syscall_32+0x34/0x80 [ 332.597089][ T9281] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 332.603914][ T9281] [ 332.603914][ T9281] other info that might help us debug this: [ 332.603914][ T9281] [ 332.614154][ T9281] Possible unsafe locking scenario: [ 332.614154][ T9281] [ 332.621594][ T9281] CPU0 CPU1 [ 332.626943][ T9281] ---- ---- [ 332.632299][ T9281] lock(team->team_lock_key); [ 332.637061][ T9281] lock(&dev_instance_lock_key#20); [ 332.644853][ T9281] lock(team->team_lock_key); [ 332.652135][ T9281] lock(&dev_instance_lock_key#20); [ 332.657406][ T9281] [ 332.657406][ T9281] *** DEADLOCK *** [ 332.657406][ T9281] [ 332.665535][ T9281] 2 locks held by syz.4.1040/9281: [ 332.670631][ T9281] #0: ffffffff8f50fc48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 332.679716][ T9281] #1: ffff88802ce60e00 (team->team_lock_key){+.+.}-{4:4}, at: team_change_rx_flags+0x38/0x220 [ 332.690079][ T9281] [ 332.690079][ T9281] stack backtrace: [ 332.696399][ T9281] CPU: 0 UID: 0 PID: 9281 Comm: syz.4.1040 Not tainted 6.16.0-rc2-syzkaller-00318-g739a6c93cc75 #0 PREEMPT(full) [ 332.696415][ T9281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 332.696422][ T9281] Call Trace: [ 332.696429][ T9281] [ 332.696434][ T9281] dump_stack_lvl+0x189/0x250 [ 332.696455][ T9281] ? __pfx_dump_stack_lvl+0x10/0x10 [ 332.696470][ T9281] ? __pfx__printk+0x10/0x10 [ 332.696481][ T9281] ? print_lock_name+0xde/0x100 [ 332.696492][ T9281] print_circular_bug+0x2ee/0x310 [ 332.696503][ T9281] check_noncircular+0x134/0x160 [ 332.696514][ T9281] validate_chain+0xb9b/0x2140 [ 332.696523][ T9281] ? console_unlock+0x21b/0x270 [ 332.696533][ T9281] ? __pfx_console_unlock+0x10/0x10 [ 332.696543][ T9281] ? irq_work_queue+0xbc/0x140 [ 332.696559][ T9281] __lock_acquire+0xab9/0xd20 [ 332.696574][ T9281] ? dev_set_promiscuity+0x10e/0x260 [ 332.696586][ T9281] lock_acquire+0x120/0x360 [ 332.696599][ T9281] ? dev_set_promiscuity+0x10e/0x260 [ 332.696613][ T9281] __mutex_lock+0x182/0xe80 [ 332.696622][ T9281] ? dev_set_promiscuity+0x10e/0x260 [ 332.696634][ T9281] ? kasan_check_range+0x9f/0x2c0 [ 332.696646][ T9281] ? dev_set_promiscuity+0x10e/0x260 [ 332.696657][ T9281] ? __pfx___mutex_lock+0x10/0x10 [ 332.696665][ T9281] ? netdev_info+0x10a/0x160 [ 332.696678][ T9281] ? __pfx_netdev_info+0x10/0x10 [ 332.696692][ T9281] dev_set_promiscuity+0x10e/0x260 [ 332.696704][ T9281] ? __pfx_vlan_dev_change_rx_flags+0x10/0x10 [ 332.696717][ T9281] __dev_set_promiscuity+0x534/0x740 [ 332.696729][ T9281] ? do_raw_spin_unlock+0x122/0x240 [ 332.696741][ T9281] netif_set_promiscuity+0x50/0xe0 [ 332.696753][ T9281] dev_set_promiscuity+0x126/0x260 [ 332.696765][ T9281] team_change_rx_flags+0x123/0x220 [ 332.696782][ T9281] ? __pfx_team_change_rx_flags+0x10/0x10 [ 332.696797][ T9281] __dev_set_promiscuity+0x534/0x740 [ 332.696809][ T9281] __dev_change_flags+0x41b/0x6d0 [ 332.696822][ T9281] ? __pfx___dev_change_flags+0x10/0x10 [ 332.696833][ T9281] ? netif_state_change+0x29e/0x3a0 [ 332.696842][ T9281] ? lockdep_hardirqs_on+0x9c/0x150 [ 332.696857][ T9281] ? __pfx_netif_state_change+0x10/0x10 [ 332.696868][ T9281] netif_change_flags+0x88/0x1a0 [ 332.696880][ T9281] do_setlink+0xc55/0x41c0 [ 332.696892][ T9281] ? __kernel_text_address+0xd/0x40 [ 332.696906][ T9281] ? arch_stack_walk+0xfc/0x150 [ 332.696916][ T9281] ? __pfx_do_setlink+0x10/0x10 [ 332.696937][ T9281] ? __lock_acquire+0xab9/0xd20 [ 332.696952][ T9281] ? __mutex_trylock_common+0x153/0x260 [ 332.696962][ T9281] ? __pfx___mutex_trylock_common+0x10/0x10 [ 332.696974][ T9281] ? rcu_is_watching+0x15/0xb0 [ 332.696989][ T9281] ? trace_contention_end+0x39/0x120 [ 332.696999][ T9281] ? __mutex_lock+0x330/0xe80 [ 332.697008][ T9281] ? __pfx_aa_get_newest_label+0x10/0x10 [ 332.697022][ T9281] ? rtnl_newlink+0x8db/0x1c70 [ 332.697031][ T9281] ? rcu_is_watching+0x15/0xb0 [ 332.697046][ T9281] ? __pfx___mutex_lock+0x10/0x10 [ 332.697056][ T9281] ? ns_capable+0x8a/0xf0 [ 332.697071][ T9281] ? rtnl_link_get_net_capable+0x16a/0x350 [ 332.697083][ T9281] rtnl_newlink+0x149f/0x1c70 [ 332.697093][ T9281] ? netlink_sendmsg+0x805/0xb30 [ 332.697107][ T9281] ? __pfx_rtnl_newlink+0x10/0x10 [ 332.697121][ T9281] ? kasan_quarantine_put+0xdd/0x220 [ 332.697135][ T9281] ? lockdep_hardirqs_on+0x9c/0x150 [ 332.697150][ T9281] ? nlmon_xmit+0xb0/0x100 [ 332.697163][ T9281] ? kmem_cache_free+0x18f/0x400 [ 332.697174][ T9281] ? __local_bh_enable_ip+0x12d/0x1c0 [ 332.697189][ T9281] ? lockdep_hardirqs_on+0x9c/0x150 [ 332.697203][ T9281] ? __local_bh_enable_ip+0x12d/0x1c0 [ 332.697217][ T9281] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 332.697233][ T9281] ? __dev_queue_xmit+0x27e/0x3a70 [ 332.697248][ T9281] ? __lock_acquire+0xab9/0xd20 [ 332.697266][ T9281] ? __pfx_rtnl_newlink+0x10/0x10 [ 332.697275][ T9281] rtnetlink_rcv_msg+0x7cc/0xb70 [ 332.697286][ T9281] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 332.697295][ T9281] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 332.697304][ T9281] ? ref_tracker_free+0x63a/0x7d0 [ 332.697318][ T9281] ? __copy_skb_header+0xa7/0x550 [ 332.697330][ T9281] ? __pfx_ref_tracker_free+0x10/0x10 [ 332.697343][ T9281] ? __skb_clone+0x63/0x7a0 [ 332.697356][ T9281] netlink_rcv_skb+0x208/0x470 [ 332.697367][ T9281] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 332.697377][ T9281] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 332.697390][ T9281] ? netlink_deliver_tap+0x2e/0x1b0 [ 332.697400][ T9281] ? netlink_deliver_tap+0x2e/0x1b0 [ 332.697412][ T9281] netlink_unicast+0x75b/0x8d0 [ 332.697424][ T9281] netlink_sendmsg+0x805/0xb30 [ 332.697437][ T9281] ? __pfx_netlink_sendmsg+0x10/0x10 [ 332.697449][ T9281] ? __import_iovec+0x5d4/0x7f0 [ 332.697458][ T9281] ? aa_sock_msg_perm+0x94/0x160 [ 332.697470][ T9281] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 332.697483][ T9281] ? __pfx_netlink_sendmsg+0x10/0x10 [ 332.697494][ T9281] __sock_sendmsg+0x21c/0x270 [ 332.697509][ T9281] ____sys_sendmsg+0x505/0x830 [ 332.697523][ T9281] ? __pfx_____sys_sendmsg+0x10/0x10 [ 332.697538][ T9281] ___sys_sendmsg+0x21f/0x2a0 [ 332.697550][ T9281] ? __pfx____sys_sendmsg+0x10/0x10 [ 332.697568][ T9281] ? __fget_files+0x2a/0x420 [ 332.697579][ T9281] ? __fget_files+0x3a0/0x420 [ 332.697591][ T9281] __sys_sendmsg+0x164/0x220 [ 332.697604][ T9281] ? __pfx___sys_sendmsg+0x10/0x10 [ 332.697617][ T9281] ? rcu_is_watching+0x15/0xb0 [ 332.697632][ T9281] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 332.697647][ T9281] ? lockdep_hardirqs_on+0x9c/0x150 [ 332.697661][ T9281] __do_fast_syscall_32+0xb6/0x2b0 [ 332.697671][ T9281] ? lockdep_hardirqs_on+0x9c/0x150 [ 332.697685][ T9281] do_fast_syscall_32+0x34/0x80 [ 332.697694][ T9281] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 332.697707][ T9281] RIP: 0023:0xf709e539 [ 332.697718][ T9281] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 332.697727][ T9281] RSP: 002b:00000000f506d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 332.697739][ T9281] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000040 [ 332.697747][ T9281] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 332.697753][ T9281] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 332.697758][ T9281] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 332.697764][ T9281] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 332.697773][ T9281] [ 333.385705][ T9281] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 333.393684][ T9281] team0: entered allmulticast mode [ 333.400370][ T9281] team_slave_0: entered allmulticast mode [ 333.407921][ T9281] team_slave_1: entered allmulticast mode [ 333.413746][ T9281] vlan2: entered allmulticast mode [ 333.426474][ T9281] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 333.456072][ T9281] dummy0: entered promiscuous mode [ 333.461644][ T9281] dummy0: entered allmulticast mode [ 333.468828][ T9281] nlmon0: entered promiscuous mode [ 333.487733][ T9281] nlmon0: entered allmulticast mode [ 333.495723][ T9281] chnl_net:chnl_net_open(): err: Unable to register and open device, Err:-19 [ 333.509842][ T9281] caif:caif_disconnect_client(): nothing to disconnect [ 333.539018][ T9281] chnl_net:chnl_flowctrl_cb(): NET flowctrl func called flow: CLOSE/DEINIT [ 333.590737][ T5866] usb 4-1: New USB device found, idVendor=1547, idProduct=0201, bcdDevice=11.64 [ 333.600496][ T5866] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 333.608720][ T5866] usb 4-1: Product: syz [ 333.613396][ T5866] usb 4-1: Manufacturer: syz [ 333.618067][ T5866] usb 4-1: SerialNumber: syz [ 333.619820][ T9281] chnl_net:chnl_net_open(): state disconnected [ 333.630740][ T5866] usb 4-1: config 0 descriptor?? [ 333.644731][ T9281] caif0: entered promiscuous mode [ 333.667464][ T9281] caif0: entered allmulticast mode [ 333.683919][ T9281] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 333.724527][ T5866] usb 2-1: USB disconnect, device number 41 [ 334.897896][ T5866] usb 4-1: USB disconnect, device number 43 [ 335.225704][ T3516] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.281828][ T3516] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.343017][ T3516] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.431363][ T3516] vlan2 (unregistering): left promiscuous mode [ 335.444239][ T3516] netdevsim netdevsim4 netdevsim0 (unregistering): left promiscuous mode [ 335.454446][ T3516] vlan2 (unregistering): left allmulticast mode [ 335.463251][ T3516] netdevsim netdevsim4 netdevsim0 (unregistering): left allmulticast mode [ 335.473689][ T3516] team0: Port device vlan2 removed [ 335.484622][ T3516] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.618135][ T3516] bridge_slave_1: left allmulticast mode [ 335.623842][ T3516] bridge_slave_1: left promiscuous mode [ 335.634694][ T3516] bridge0: port 2(bridge_slave_1) entered disabled state [ 335.647772][ T3516] bridge_slave_0: left allmulticast mode [ 335.653459][ T3516] bridge_slave_0: left promiscuous mode [ 335.661214][ T3516] bridge0: port 1(bridge_slave_0) entered disabled state [ 335.862838][ T3516] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 335.886922][ T3516] bond_slave_0: left promiscuous mode [ 335.892481][ T3516] bond_slave_0: left allmulticast mode [ 335.918618][ T3516] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 335.938981][ T3516] bond_slave_1: left promiscuous mode [ 335.944522][ T3516] bond_slave_1: left allmulticast mode [ 335.966273][ T3516] bond0 (unregistering): Released all slaves [ 335.987507][ T3516] bond1 (unregistering): Released all slaves [ 336.011720][ T3516] bond2 (unregistering): Released all slaves [ 336.379960][ T3516] hsr_slave_0: left promiscuous mode [ 336.400839][ T3516] hsr_slave_1: left promiscuous mode [ 336.419268][ T3516] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 336.435459][ T3516] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 336.452432][ T3516] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 336.460536][ T3516] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 336.474086][ T3516] veth1_macvtap: left promiscuous mode [ 336.479888][ T3516] veth0_macvtap: left promiscuous mode [ 336.485796][ T3516] veth1_vlan: left promiscuous mode [ 336.491088][ T3516] veth0_vlan: left promiscuous mode [ 336.702268][ T3516] team_slave_1 (unregistering): left promiscuous mode [ 336.710734][ T3516] team_slave_1 (unregistering): left allmulticast mode [ 336.718894][ T3516] team0 (unregistering): Port device team_slave_1 removed [ 336.750897][ T3516] team_slave_0 (unregistering): left promiscuous mode [ 336.758180][ T3516] team_slave_0 (unregistering): left allmulticast mode [ 336.769206][ T3516] team0 (unregistering): Port device team_slave_0 removed