last executing test programs: 8m54.106896769s ago: executing program 2 (id=583): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xf, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000e8ffffff000e6f4381fbca68b26ccf2c0018110000c0150a52c960f41c8c873c0a2073643d14df9ea5723fd7e69b30243bcdca8d2674b9e1741e851f97a77edfe0ef8902d8ab85d19c18c8b9e6417c1b5417704691d72363f000cccf503be3d99a313d1c", @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b702000000000000"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x2d) r4 = landlock_create_ruleset(&(0x7f00000003c0)={0x0, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', 0x0, 0x0, 0x1085408, 0x0) lsm_get_self_attr(0x68, &(0x7f0000000100)={0x0, 0x0, 0xfe, 0xde, ""/222}, &(0x7f0000000000)=0xfe, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000400), 0x4000000, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) umount2(&(0x7f0000000100)='./bus\x00', 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r5 = socket$inet(0xa, 0x801, 0x0) accept4(r5, 0x0, 0x0, 0x800) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, 0x0, 0x804) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0x7, 0x0, 0x0) 8m52.645713075s ago: executing program 2 (id=585): r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder-control\x00', 0x2, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000600)={'binder0\x00'}) ioctl$BINDER_CTL_ADD(r0, 0x541b, 0x0) r1 = fsopen(&(0x7f00000003c0)='tracefs\x00', 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r3, 0x0, 0xffffffffffffffff}, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f00000004c0)={'custom1\x00'}) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f0000000200)={0x15}) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r8 = syz_open_procfs(0x0, &(0x7f0000000180)='clear_refs\x00') mount$9p_fd(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x84, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r8}}) sched_getattr(r4, &(0x7f0000000140)={0x38}, 0x38, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 8m50.733706828s ago: executing program 2 (id=594): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) prctl$PR_SCHED_CORE(0x4d, 0x40003, 0x0, 0x0, 0x0) quotactl_fd$Q_GETNEXTQUOTA(r0, 0x0, 0x0, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f00000007c0)={@my=0x0, 0x2}) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x13f}}, 0x20) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd0, &(0x7f0000000080), 0x4) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x106, 0x8}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0x20000045) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) waitid(0x11, 0x0, 0x0, 0x8, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000005580)=""/102392, 0x18ff8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x2b1e}, 0x4000000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x3, 0x0, 0xffff}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) 8m49.476068824s ago: executing program 2 (id=597): r0 = syz_pidfd_open(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, 0x0, 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000140)=@o_path={&(0x7f0000000200)='./file0/../file0\x00', 0x1, 0x4000, r0}, 0x18) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae68, 0x0) mount$bind(&(0x7f0000000180)='./file0/file0\x00', &(0x7f00000001c0)='./file0/file0\x00', 0x0, 0xab3011, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0\x00', 0x0, 0x80000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0/../file0\x00', 0x89901) (fail_nth: 3) 8m48.010058384s ago: executing program 2 (id=598): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregset(0x4205, r0, 0x1, &(0x7f0000000100)={&(0x7f0000000040)="dcef58b7f29c1f7c93d183044aedba283413e674c7719c33a4b17f028f68610a6c55bb2bf8282853f3e16f8394a8676ff55a3507e2ad50248c6130863b0f7433c7fbc9b978a39eae88bffd05d139cedbee444f7c98e1f92b0f64462b4b470bedced2125e0b1f38fbaa348c6d75aa1a4011e9cdae15ecb9309b0101edbf6dd6d111d6132f1821a4e4cbec8438c571a70e7ca7b0451a6cc55c", 0x98}) ptrace$setregset(0x4205, r0, 0x1, &(0x7f00000001c0)={0x0}) syz_usb_connect(0x0, 0x5a, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ec13b2106d04f308280b0102030109024800010000000009046900000e010000084101"], 0x0) 8m44.129815113s ago: executing program 2 (id=610): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00'}, 0x2d) socket(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0x1ac81b, 0x0, 0x0, 0x201, 0x1000000}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8, 0x0, 0x0, 0x1010000}, @initr0, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222}, 0x94) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) 8m43.288279607s ago: executing program 32 (id=610): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00'}, 0x2d) socket(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0x1ac81b, 0x0, 0x0, 0x201, 0x1000000}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8, 0x0, 0x0, 0x1010000}, @initr0, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222}, 0x94) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) 7m31.71003783s ago: executing program 5 (id=773): socket$nl_generic(0x10, 0x3, 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001640)={0x11, 0x19, &(0x7f0000001740)=ANY=[@ANYBLOB="180800000600000000000000000000008510"], &(0x7f0000000000)='GPL\x00', 0xa, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x1}, 0x94) syz_io_uring_setup(0x38, &(0x7f0000000080)={0x0, 0xadde, 0x10100, 0x0, 0xfffffffd}, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x18, &(0x7f0000001840)=ANY=[@ANYBLOB="180000009a010000000000000500000018110000d5903d0fe25ee49d69c127a073c160a2e47ba3c3e5dd5f4ef66aede2387e24f6a5867909d956a80475a81b48eb04a23fd18dec90db36f40eebdcd557a2323c2f6312963b330c7b2b762675577d309b6e97d5c60c2e7909bd1126fd0d8067883f546b874a3def588f8141dd1f7b18446fcef0f36c55ee16878fe632cb3ac4fab8b89cbc7caabe65831a1bedf5ee7f49416e9c2601b720b77b977da661a230b65c1782240b463b9e4aa74f783504234fd4da8e69fc24dcbfe03362320b4b1ab91d5cfa7b694fe192785f68592068", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000bf91000000000000b7020000010000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x8, 0x0, 0x0, 0x41100, 0x71, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000280)={0x2, 0x8, 0x472, 0x5}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000040)=[0x1, 0xffffffffffffffff], &(0x7f0000001700)=[{0x4, 0x3, 0x5, 0x3}], 0x10, 0xb}, 0xe4) 7m31.279962139s ago: executing program 5 (id=775): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1100000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB="0000000000000000001400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000030000000400010005"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000000400000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000407b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000680)='sys_exit\x00', r2}, 0x10) newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x4000) pwrite64(r0, &(0x7f00000001c0)="4068b3cd177650e620694e477a6fbba5f750a3bcdf3710d7e8a23a6f009f210fc2e07ff3eea699027ee66e2b877a54a489aacb0b8a1131016dd41c1f4994f771b5543c82e6fb1b19e8ff448e686cd94aa6f9b56c27035cccf4051adfab09b7523b83bfac3c7fe573267e8b419aa71f7951e530874ce600a59da0a2886e830cba56b8a375f5b4522fb9b098670b4c9e3792b971170bf99a4148bcf87d7519e309840bab3e0ba1986e1a4dd14cf4d6dcaab97f300f4b85219b806629e5b8dd1d8727d33db28c46217e", 0xc8, 0xe14) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={0xffffffffffffffff, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 7m31.050141984s ago: executing program 5 (id=776): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x401, 0x1000004, 0x0, {0x0, 0x0, 0x0, 0x0, 0x503, 0x20000}, [@IFLA_LINK_NETNSID={0x8, 0x25, 0x1}, @IFLA_LINK={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004800}, 0x4000000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="010000000000000094000040"]) 7m27.55026095s ago: executing program 5 (id=785): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001640)={0x11, 0x19, &(0x7f0000001740)=ANY=[@ANYBLOB="180800000600000000000000000000008510"], &(0x7f0000000000)='GPL\x00', 0xa, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x1}, 0x94) syz_io_uring_setup(0x38, &(0x7f0000000080)={0x0, 0xadde, 0x10100, 0x0, 0xfffffffd}, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x18, &(0x7f0000001840)=ANY=[@ANYBLOB="180000009a010000000000000500000018110000d5903d0fe25ee49d69c127a073c160a2e47ba3c3e5dd5f4ef66aede2387e24f6a5867909d956a80475a81b48eb04a23fd18dec90db36f40eebdcd557a2323c2f6312963b330c7b2b762675577d309b6e97d5c60c2e7909bd1126fd0d8067883f546b874a3def588f8141dd1f7b18446fcef0f36c55ee16878fe632cb3ac4fab8b89cbc7caabe65831a1bedf5ee7f49416e9c2601b720b77b977da661a230b65c1782240b463b9e4aa74f783504234fd4da8e69fc24dcbfe03362320b4b1ab91d5cfa7b694fe192785f68592068", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000090000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000bf91000000000000b7020000010000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x8, 0x0, 0x0, 0x41100, 0x71, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000280)={0x2, 0x8, 0x472, 0x5}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000040)=[0x1, 0xffffffffffffffff], &(0x7f0000001700)=[{0x4, 0x3, 0x5, 0x3}], 0x10, 0xb}, 0xe4) 7m27.325323892s ago: executing program 5 (id=786): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x800) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r1}, &(0x7f0000000040), &(0x7f0000000280)='%pS \x00'}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='sys_enter\x00', r2}, 0x10) futex(0x0, 0x0, 0x1, 0x0, 0x0, 0x1) prlimit64(0x0, 0xe, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket(0x10, 0x803, 0x0) (async) socket(0x10, 0x803, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) unlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) (async) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) unshare(0x2a020600) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) 7m26.981586558s ago: executing program 5 (id=788): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2c, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000854}, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x1, 0xfffffffffffffff8}) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000080)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000200)=0x3, 0x12) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x14, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006d00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000380)={'sit0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x40, 0x6, 0x8, {{0x28, 0x4, 0x3, 0x7, 0xa0, 0x67, 0x0, 0x3, 0x29, 0x0, @remote, @remote, {[@end, @timestamp_addr={0x44, 0x14, 0xf2, 0x1, 0x9, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0xc}, {@remote, 0x5a3}]}, @timestamp_addr={0x44, 0x44, 0xfa, 0x1, 0x8, [{@broadcast, 0x1}, {@private=0xa010102, 0xb}, {@remote, 0x5}, {@rand_addr=0x64010100, 0x8}, {@loopback}, {@dev={0xac, 0x14, 0x14, 0x15}, 0x6}, {@broadcast, 0x7}, {@multicast1}]}, @rr={0x7, 0xf, 0xe5, [@loopback, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @ssrr={0x89, 0x7, 0xa9, [@initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x14, 0xf3, 0x0, 0x5, [0x2, 0x100, 0x6, 0xffff]}, @end, @end]}}}}}) r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000003c0), 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x6, 0x2, 0x8000, 0xfe00, 0x5010, 0xffffffffffffffff, 0xea6, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x2}, 0x50) pipe2$watch_queue(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r11 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r11, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r11, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r11, &(0x7f0000000040)={0x50, 0x0, r12, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) openat$cgroup_ro(r10, &(0x7f0000000640)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r13) ioctl$sock_SIOCGIFINDEX_80211(r13, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_KEY(r13, &(0x7f0000000180)={0x0, 0xfffffffffffffe6c, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, r14, 0x1, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r15}, @void}}, [@NL80211_ATTR_KEY={0xc, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5, 0x2, 0x24}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000810) syz_fuse_handle_req(r11, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r16 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) dup2(r16, r11) r17 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r17, 0xc0145608, &(0x7f00000000c0)={0x0, 0xd, 0x2, 0x0, 0x4}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x18, 0x1e, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}, [@map_idx_val={0x18, 0x2, 0x6, 0x0, 0x6, 0x0, 0x0, 0x0, 0xf88c}, @call={0x85, 0x0, 0x0, 0x6f}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}, @exit, @ldst={0x0, 0x0, 0x6, 0x7, 0x4, 0x40, 0x4}, @generic={0x1, 0x5, 0x6, 0x100, 0x4}, @generic={0x7, 0xc, 0x2, 0x8001, 0x3}, @tail_call={{0x18, 0x2, 0x1, 0x0, r4}}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}}]}, &(0x7f0000000040)='syzkaller\x00', 0x4, 0x48, &(0x7f0000000080)=""/72, 0x41100, 0x0, '\x00', r6, 0x0, r7, 0x8, &(0x7f0000000400)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[r8, r9, r10, r16, 0xffffffffffffffff, 0x1], 0x0, 0x10, 0x6}, 0x94) 7m22.040091762s ago: executing program 0 (id=801): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) r2 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x8, 0x1, 0x40000333}, &(0x7f0000000dc0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r2, 0x2ffb, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0xc, 0xa3, 0x8f, 0x40, 0x13d8, 0x11, 0xd062, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xa6, 0x1, 0x56}}]}}]}}, 0x0) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000000)={0x80000001, 0xfffffffb, 0x1000, 0x515f3157, 0x4, "910001d01f000066f98a27f7b9175b002000"}) 7m18.609183099s ago: executing program 0 (id=806): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0x21dfdbfe, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0xe, 0x4}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0xb, 0x1, {0x0, 0xb, 0x5}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x4000010) r2 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000001340), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r3, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x1, 0x353a, 0x1}}, 0x20) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r3, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x1, 0x353a, 0x1}}, 0x20) syz_emit_ethernet(0x3e, &(0x7f0000000100)={@multicast, @local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "0300", 0x8, 0x2c, 0x0, @remote, @local, {[@routing={0x2, 0x0, 0x2, 0x8}]}}}}}, 0x0) ioctl$VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000001380)={0x3c2bd845, 0x3}) 7m18.246100769s ago: executing program 0 (id=808): mknod(0x0, 0x4, 0x6) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) splice(r3, 0x0, r4, 0x0, 0xf3a, 0x0) write(r1, 0x0, 0x0) close(0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000400fff800000000000000008500000041000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x915940ab3f6031c7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) vmsplice(r4, &(0x7f0000000380)=[{&(0x7f0000013580)='\r', 0x1}], 0x1, 0x0) tee(r0, r4, 0x8f5, 0x100000000000000) write(r2, 0x0, 0x0) 7m17.285078713s ago: executing program 0 (id=809): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x401, 0x1000004, 0x0, {0x0, 0x0, 0x0, 0x0, 0x503, 0x20000}, [@IFLA_LINK_NETNSID={0x8, 0x25, 0x1}, @IFLA_LINK={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004800}, 0x4000000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="010000000000000094000040"]) 7m16.882619664s ago: executing program 0 (id=810): r0 = syz_io_uring_setup(0x5a42, &(0x7f0000000480)={0x0, 0x5202, 0x80, 0xffffffff, 0x342}, &(0x7f0000000200)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000), 0x2) r4 = memfd_create(&(0x7f0000000500)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\x00$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xa2\xcf\xc42\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00M\x05\x00\x00\x00\t\xc4\x8f!=J<\xed\x00q\xc5Q\xf7\xcc\'\xe9c\xfd\x96RKn\xe3\xa7j\x1fF\x14\x94\x87AZ\x03Z\xb9\xaeb\xd4\xebo<\x83\xa3\x1c\xf6\xf8\xaa\x8e\x1f\xf1\xf5oI\f~A#\x9d\x00\xdc\x8ejT\xceu\xcc\xa2\x89Fu\xae)+X\x9f\xf8\xd9[V)\xa0dE\f\xb0\xcf\x8eh-\x95~\n\x14\x86\x19\x11\a\x18o\xac~\xb8\xdb\t\x00\x00\x00\xdeD\x89u(&t\xc6\xdb\xfe\xd4\xab\xa5\x85n8\xb7\xc7\xc1\xf9\xf5\xc8\xfe>\x8f\x00^\xc2\xcex\x96\xfa\x88\xf5\xb1\xc6\xea\xe8\x8b#g\x15\xc0\x8e,\x12\x97\x97\x86\x9b\x17\a)\xd2\xb9)H\xe7h\x82=\xb8[M\x86\x93\'n\x8c\xa2_\x01\x01O\xd7\x8b`{|tf\x14}\x8b#I\x9a\x9d4\x80;\xc4_#?\x17\xccT\x10\xaf\xf5\x17jV\x1b}\x1aB\xa1\xfa\x1a\x1da1jL\xa8\xa0\nh_2\b\x02\x10\x92\b\x12XZ\x03h\x85V\x1c\x84Kr\xb4\xdbG\x84\x80\xeb\f\xf3\x7f\xe75=\x8e\x9d\xb4\xffu\xaa\x86B\xf0\x81\xe5\xbe\x84~,\xe3\xe6\xe6y\x00\x19\x9f\x97\xda\x96 \xf5\xa3\xa6n/S\xc8\xe5r.\xd7\td\fvM\x9e\xa3\xbf\xcf\x7fy\xb2\xec\xfb3\xfc\xe7\x8aB\xd2\xcf/\x91\xcc\xa5\r\xa4l\xf9\aQ\xae\xf4WB\xc0\xb8\xfe\xe3=\'Cs\x7f\xe1w^Wi)\xe4\xa3\x19\x8fB\xbe\xe8\xfd\xba\xa7\xed\xac\xbc\x83\xef\x9a\xbcsw\x89N\xc5\xef\x9b\xb1\x15l\xdax\x9af\x818\a\x12Wh\x17\x82\x1cm\x9dDt\x9f\x88\xef<2m\x96\xa7^7\x1b\xe4\xa2\\s\xa6E\xe2X\xa3\xaa\x8eI\xb5\xd2\x15\xf8\x9e\x01\xd7n\x16\xe3\xd4\xf0\xbe\v]\xbar,2\xc8\x8a\x98\x16e`\xb0I\x81\xc2oH\xb7n\x06\x9e0\xf7\xffx\xff\xb0?\xfe|\x1fc\x93X\xdf\x1f\xefw\xbf\xbd\xbf\xd1w\xf8\xb4\x94\x12', 0x0) ftruncate(r4, 0xffff) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="b800000000010104000000000000000002000000240001801400018008000100e000000108000200000000000c00028005000100000000002c0002800c00028005000100000000001400018008000100e000000108000200ac1e0001060003400000000008000740000000004c001080080003400000013308000240000000cd080001"], 0xb8}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r6, 0xc0105500, &(0x7f0000000000)={0x40, 0x5, 0x1000, 0x4, 0x0, 0x40010, 0x0}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x6) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f00000001c0)=ANY=[@ANYBLOB="01000000000000009a000040"]) fcntl$setstatus(r4, 0x4, 0x2400) fcntl$addseals(r4, 0x409, 0x7) r10 = ioctl$UDMABUF_CREATE(r3, 0x40187542, &(0x7f0000000100)={r4, 0x0, 0x0, 0x1000}) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r10, 0x0, 0x0, 0x0, {0x414}, 0x1}) io_uring_enter(r0, 0x3f72, 0x20092fb, 0x0, 0x0, 0x0) 7m15.68924073s ago: executing program 0 (id=813): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000200)={0x7ffc, 0x2, 0x4}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r2) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r2) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r4, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="050000000000000000d59166ba26ec64092378b7007600afaa88a5212814668cd327130600000008000300", @ANYRES32=r8, @ANYBLOB="0800050002000000"], 0x24}}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000100001070000000000080000000000000000810015001300"], 0x1c}}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r0, 0xc01c64a3, &(0x7f0000000040)={0x3, r10, 0x10000000, 0x80000001, 0xb, 0x1fd, 0x1}) r11 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r11, 0xc0d05605, &(0x7f0000000380)={0x8, @raw_data="904483805809343856040df3e75c72d09ab8960ded100575f4c061c4db9c7be195b282e40dac2461a432e0dec942d1f165ce7821a0d4a685be5ab70c3991b9269e74cac1a2af59e3bbf2039d110b863337921d9d10d12bc4ad2aed1e1eb9235991e3872f20b26777eb192fc3c010a630bb7f920843f6f13a3f4625cae58797b650cb1d72317d0f02b0284f0ccb532aa5c6c3f2d31b756e9e0d5fead4a0a04ab10f2de79e1ef71c543fbdeb43ea002ebc1847db97db5ab41dd8f689faf7440190d49a5bc10b7fe369"}) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r12, 0x0) unshare(0x6a040000) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=ANY=[@ANYBLOB="540000001000010025bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0021040000000000140003006261746164763000000000000000000008000400d700000018001680000001000000ff0b0000"], 0x54}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r12, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r12, 0x84, 0x7a, &(0x7f0000000340)={r14, @in6={{0xa, 0x0, 0x6, @ipv4={'\x00', '\xff\xff', @empty}}}}, &(0x7f0000000040)=0x84) 7m11.671007145s ago: executing program 33 (id=788): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2c, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000854}, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x1, 0xfffffffffffffff8}) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000080)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000200)=0x3, 0x12) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x14, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006d00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000380)={'sit0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x40, 0x6, 0x8, {{0x28, 0x4, 0x3, 0x7, 0xa0, 0x67, 0x0, 0x3, 0x29, 0x0, @remote, @remote, {[@end, @timestamp_addr={0x44, 0x14, 0xf2, 0x1, 0x9, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0xc}, {@remote, 0x5a3}]}, @timestamp_addr={0x44, 0x44, 0xfa, 0x1, 0x8, [{@broadcast, 0x1}, {@private=0xa010102, 0xb}, {@remote, 0x5}, {@rand_addr=0x64010100, 0x8}, {@loopback}, {@dev={0xac, 0x14, 0x14, 0x15}, 0x6}, {@broadcast, 0x7}, {@multicast1}]}, @rr={0x7, 0xf, 0xe5, [@loopback, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @ssrr={0x89, 0x7, 0xa9, [@initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x14, 0xf3, 0x0, 0x5, [0x2, 0x100, 0x6, 0xffff]}, @end, @end]}}}}}) r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000003c0), 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x6, 0x2, 0x8000, 0xfe00, 0x5010, 0xffffffffffffffff, 0xea6, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x2}, 0x50) pipe2$watch_queue(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r11 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r11, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r11, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r11, &(0x7f0000000040)={0x50, 0x0, r12, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) openat$cgroup_ro(r10, &(0x7f0000000640)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r13) ioctl$sock_SIOCGIFINDEX_80211(r13, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_KEY(r13, &(0x7f0000000180)={0x0, 0xfffffffffffffe6c, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, r14, 0x1, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r15}, @void}}, [@NL80211_ATTR_KEY={0xc, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5, 0x2, 0x24}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000810) syz_fuse_handle_req(r11, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r16 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) dup2(r16, r11) r17 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r17, 0xc0145608, &(0x7f00000000c0)={0x0, 0xd, 0x2, 0x0, 0x4}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x18, 0x1e, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}, [@map_idx_val={0x18, 0x2, 0x6, 0x0, 0x6, 0x0, 0x0, 0x0, 0xf88c}, @call={0x85, 0x0, 0x0, 0x6f}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}, @exit, @ldst={0x0, 0x0, 0x6, 0x7, 0x4, 0x40, 0x4}, @generic={0x1, 0x5, 0x6, 0x100, 0x4}, @generic={0x7, 0xc, 0x2, 0x8001, 0x3}, @tail_call={{0x18, 0x2, 0x1, 0x0, r4}}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}}]}, &(0x7f0000000040)='syzkaller\x00', 0x4, 0x48, &(0x7f0000000080)=""/72, 0x41100, 0x0, '\x00', r6, 0x0, r7, 0x8, &(0x7f0000000400)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[r8, r9, r10, r16, 0xffffffffffffffff, 0x1], 0x0, 0x10, 0x6}, 0x94) 7m0.50260764s ago: executing program 34 (id=813): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000200)={0x7ffc, 0x2, 0x4}) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r2) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r2) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r4, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="050000000000000000d59166ba26ec64092378b7007600afaa88a5212814668cd327130600000008000300", @ANYRES32=r8, @ANYBLOB="0800050002000000"], 0x24}}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000100001070000000000080000000000000000810015001300"], 0x1c}}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r0, 0xc01c64a3, &(0x7f0000000040)={0x3, r10, 0x10000000, 0x80000001, 0xb, 0x1fd, 0x1}) r11 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r11, 0xc0d05605, &(0x7f0000000380)={0x8, @raw_data="904483805809343856040df3e75c72d09ab8960ded100575f4c061c4db9c7be195b282e40dac2461a432e0dec942d1f165ce7821a0d4a685be5ab70c3991b9269e74cac1a2af59e3bbf2039d110b863337921d9d10d12bc4ad2aed1e1eb9235991e3872f20b26777eb192fc3c010a630bb7f920843f6f13a3f4625cae58797b650cb1d72317d0f02b0284f0ccb532aa5c6c3f2d31b756e9e0d5fead4a0a04ab10f2de79e1ef71c543fbdeb43ea002ebc1847db97db5ab41dd8f689faf7440190d49a5bc10b7fe369"}) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r12, 0x0) unshare(0x6a040000) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=ANY=[@ANYBLOB="540000001000010025bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0021040000000000140003006261746164763000000000000000000008000400d700000018001680000001000000ff0b0000"], 0x54}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r12, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r12, 0x84, 0x7a, &(0x7f0000000340)={r14, @in6={{0xa, 0x0, 0x6, @ipv4={'\x00', '\xff\xff', @empty}}}}, &(0x7f0000000040)=0x84) 3m27.676656409s ago: executing program 3 (id=1241): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={0x40, r1, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x1}, {0xffffffffffffffe8, 0x3, 0x1}, {0x5, 0x3, 0x6}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x40}}, 0x0) r2 = socket$kcm(0xa, 0x3, 0x106) sendmsg$kcm(r2, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @dev, 0x2}, 0xff32, 0x0}, 0xe07e872420dfefca) 3m27.473929105s ago: executing program 3 (id=1242): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008bd6000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000"], 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_io_uring_setup(0x1d1f, &(0x7f00000002c0)={0x0, 0xcd1d, 0x10100, 0x0, 0xaa}, &(0x7f0000000000), &(0x7f0000000180)) io_uring_register$IORING_REGISTER_PBUF_RING(r5, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) 3m25.289070927s ago: executing program 3 (id=1246): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x40000000000001, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) r2 = fcntl$dupfd(r0, 0x0, r0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha224)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="375f99402cc1bf47a9dfc979dcb12bd0907d82502f7ce7c99c3cbf557d4916d2bb496245ea6500da956dc5c97b2a79d03b56d194c78c445228069b92c1608f6370", 0x41) read$snapshot(r2, 0x0, 0xffffffbf) read$char_usb(r2, 0x0, 0x0) stat(&(0x7f00000009c0)='./cgroup\x00', &(0x7f0000000f40)) 3m24.045397384s ago: executing program 3 (id=1250): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='attr/current\x00') writev(r0, &(0x7f00000015c0)=[{&(0x7f00000000c0)='w', 0x1}], 0x1) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000100)={0x1, 0x7, 0x0, 0x2, 0x7, 0xffffffff}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="12010000b1bd2f087d0403508c2f010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000000c0)={0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="0000f50000000341e9"], 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000440)={0x44, &(0x7f00000001c0)={0x40, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) 3m23.041915465s ago: executing program 3 (id=1251): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x2642, 0x0) r1 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x7079, 0x0, 0x14, 0x28b}, &(0x7f0000000140)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000000c0)=@IORING_OP_SYMLINKAT={0x26, 0x8, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000240)='./file1\x00', 0x0, 0x0, 0x1}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000380)={0x48, 0x2, r5}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000280)={0x28, 0x4, r5, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000, 0x10}) ioctl$IOMMU_IOAS_UNMAP(r4, 0x3b86, &(0x7f0000000180)={0x18, r5, 0xc2, 0xffffffff}) io_uring_enter(r1, 0x704, 0x41e3, 0x2c, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x11, 0xc, 0x0, &(0x7f0000001480)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000380)='kfree\x00', r6, 0x0, 0x4804}, 0x18) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x4e23, 0x3, @mcast2, 0x5}, 0x1c) sendmmsg$inet6(r7, &(0x7f0000001980)=[{{0x0, 0x2a, 0x0}}], 0x1342d60b4ab48e7, 0xb148a8e63d73f159) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000040)={@remote, 0x7, 0x2, 0x0, 0x8, 0x9, 0x7}, 0x20) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)={0x110, 0x2d, 0x1, 0x0, 0x0, "", [@nested={0xfd, 0x0, 0x0, 0x1, [@typed={0xc, 0x2, 0x0, 0x0, @u64}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@loopback={0x100000000000000}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c"]}]}, 0x110}], 0x1, 0x0, 0x0, 0x1}, 0x0) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r8, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x20}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x14, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0x4e) syz_genetlink_get_family_id$nl80211(&(0x7f00000012c0), 0xffffffffffffffff) writev(r0, &(0x7f0000000100)=[{&(0x7f00000001c0)="93d904001003040c1e149b20f676993c91716ed850", 0x15}, {&(0x7f0000000180)="010400001bfa64", 0x7}, {&(0x7f0000000280)="204f9f5fb6d78ac3a55a93fa002e3a1b3367c41468cd2bffadec7b351c3fffc4addff3d4bdfd722ef5456d0b87087eed15ef2386850a95e16a62e39061ec8fd3d372470586ee96e33338e9cb0e15245807b68597dbda24bd", 0x58}], 0x3) 3m16.50523688s ago: executing program 3 (id=1261): clock_getres(0xfffffffffffffff1, &(0x7f0000000040)) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@ipmr_delroute={0x24, 0x19, 0x1, 0x0, 0x2, {0x80, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, 0x5}, [@RTA_SRC={0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x24}, 0x1, 0x0, 0x0, 0x8004}, 0x4) r1 = socket(0x10, 0x803, 0x0) r2 = socket$kcm(0x1e, 0x2, 0x0) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f00000008c0), 0x43) mount$tmpfs(0x0, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040), 0x1000040, &(0x7f0000000100)={[{@mpol={'mpol', 0x3d, {'prefer', '=static', @void}}}]}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) recvmsg(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000080)=""/43, 0x2b}], 0x1, 0x0, 0xfffffffffffffcd8}, 0x80) r3 = socket$kcm(0x1e, 0x4, 0x0) close(r2) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x4000000) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, 0x0, 0x0}, 0x94) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c643c, &(0x7f0000000300)={0x0, 0x0, r5}) write$cgroup_subtree(r3, &(0x7f0000000040)=ANY=[], 0xfdef) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x800448d4, &(0x7f0000000000)={0x2, 0xe, '@\x00', 0xc, 0xfe}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21}, 0x94) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r1, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, r7, 0x20, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x9, 0x7c}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x4001}, 0x48081) bind$inet(r1, &(0x7f0000000140)={0x2, 0x4e24, @empty}, 0x10) 3m1.292601278s ago: executing program 35 (id=1261): clock_getres(0xfffffffffffffff1, &(0x7f0000000040)) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@ipmr_delroute={0x24, 0x19, 0x1, 0x0, 0x2, {0x80, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, 0x5}, [@RTA_SRC={0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x24}, 0x1, 0x0, 0x0, 0x8004}, 0x4) r1 = socket(0x10, 0x803, 0x0) r2 = socket$kcm(0x1e, 0x2, 0x0) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f00000008c0), 0x43) mount$tmpfs(0x0, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040), 0x1000040, &(0x7f0000000100)={[{@mpol={'mpol', 0x3d, {'prefer', '=static', @void}}}]}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) recvmsg(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000080)=""/43, 0x2b}], 0x1, 0x0, 0xfffffffffffffcd8}, 0x80) r3 = socket$kcm(0x1e, 0x4, 0x0) close(r2) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x4000000) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, 0x0, 0x0}, 0x94) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c643c, &(0x7f0000000300)={0x0, 0x0, r5}) write$cgroup_subtree(r3, &(0x7f0000000040)=ANY=[], 0xfdef) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x800448d4, &(0x7f0000000000)={0x2, 0xe, '@\x00', 0xc, 0xfe}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21}, 0x94) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r1, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, r7, 0x20, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x9, 0x7c}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x4001}, 0x48081) bind$inet(r1, &(0x7f0000000140)={0x2, 0x4e24, @empty}, 0x10) 7.029799067s ago: executing program 6 (id=1751): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r0, 0x8b1a, &(0x7f0000000040)) 6.57311129s ago: executing program 6 (id=1757): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x50, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x8000, 0x21018}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_ZERO_CSUM6_TX={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x80) 6.313693983s ago: executing program 6 (id=1760): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r0}, 0x10) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r2, &(0x7f0000002a80)=[{&(0x7f0000000a00)="1b", 0x1}], 0x1) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r4, 0x0, 0xf3a, 0x0) write$cgroup_pid(r4, &(0x7f0000000000), 0xffffff98) splice(r1, 0x0, r4, 0x0, 0x80, 0x8) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40008d0}, 0x0) 3.177954963s ago: executing program 6 (id=1795): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000900), r0) sendmsg$NFC_CMD_START_POLL(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x2c, r1, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x4}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_TM_PROTOCOLS={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x840}, 0x10) 3.11272271s ago: executing program 6 (id=1796): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000010400b5000000000400000000", @ANYRES32=0x0, @ANYBLOB="00000000001400001c00128009000100626f6e64000000"], 0x3c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xfff3}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_NAT={0x8, 0xb, 0x1}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x1a}, 0x1, 0x0, 0x0, 0xc040810}, 0xc000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 3.050196545s ago: executing program 4 (id=1797): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x2c, 0x3f, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @typed={0x8, 0x7, 0x0, 0x0, @u32=0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) 3.00701376s ago: executing program 4 (id=1798): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f0000000000)=0x0) bind$nfc_llcp(r0, &(0x7f0000000880)={0x27, r2, 0x0, 0x6, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e879918d20000000f2170e65e3f50327080e000000000000001900", 0x3c}, 0x60) readv(r0, &(0x7f0000000600)=[{&(0x7f00000001c0)=""/109, 0x6d}], 0x1) close(r1) 2.746003022s ago: executing program 4 (id=1799): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e24, @rand_addr=0x64010101}}, 0x7, 0x88}, 0x90) 2.677771511s ago: executing program 4 (id=1800): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000480)={{{@in=@private=0xa010102, @in=@private=0xa010100, 0x4e22, 0x0, 0x4e21, 0x0, 0x2}, {0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x9c0, 0x3}, {0xffffbffffffffffc, 0x0, 0x400000000, 0x6}, 0x0, 0x0, 0x1, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x4d3, 0x3c}, 0x2, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x4000000, 0x1}}, 0xe8) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) 2.625455613s ago: executing program 4 (id=1801): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x2, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x5e21, @empty}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x5e21, @local}, 0x10) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) 2.590429611s ago: executing program 4 (id=1802): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x83, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffeb1, 0x0, 0x0, 0x0, 0x49, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x8000) 1.604585019s ago: executing program 6 (id=1805): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) getsockopt$bt_BT_FLUSHABLE(r0, 0x12, 0x8, 0x0, &(0x7f0000002540)) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f0000000280)={'sit0\x00', &(0x7f0000000200)={@dev={0xfe, 0x80, '\x00', 0x40}, @multicast1, 0x13, 0x1c}}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e20, @remote}}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) sendmsg$kcm(r3, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0xffff, 0x2, 0x10, {0x2, 0x4e21, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x20000000) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x6, 0x17, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b703000000000000850000008300", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000000000028850000008600000018110000", @ANYRES32=r4, @ANYBLOB], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0xfca804a0, 0xe, 0x0, &(0x7f0000000580)="b80022ab98d1db1b883e04000000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) sendmsg$kcm(r3, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x23}}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="1800000000000000100100000100000051d833483cc75d51900000000000000004000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319e2e66d0998a61d7da0c86d70000001010"], 0x10b8}, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000b80)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc6751dfb265a0e3ccae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce935b0f327cb3f011a7d06602e2fd52347125907000000000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df262ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71d20fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada12f7a1525320e716660000000000b02b001500a710eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d3294000000000000000000000000000000000000000000000000000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18a904c0e585a66c3b84b138efc20a546d3d5227e23b03f2a834391ad24fe7d9b20cf92cb151763d41f5c76e2ff3e93ee296c4082ee73e7e197253a2b66c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1c77a211bfa02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0843b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f04c7f0be31491eb8c9ff68236c8600000000000000000000000066e034c81c3cab4e33fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f2243471221c15fa12313ffbfa7c2730302b66a99f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca20508"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000feffffff00000000000004008500000036000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000010400000850000007300000095"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x44, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x72f4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r8, 0x0, 0xe, 0x0, &(0x7f0000000200)="ff7f0e3f2617d1f42ab5a1db8511", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9, 0x6}, 0x1d) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r9}, 0x10) ppoll(&(0x7f0000000500)=[{r6}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x8000000000, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7fffffff, 0xfffffffffffffffc}, 0x0, 0x0) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) epoll_ctl$EPOLL_CTL_ADD(r11, 0x1, r11, &(0x7f0000000080)={0x80000002}) accept$packet(0xffffffffffffffff, 0x0, 0x0) 1.590961352s ago: executing program 7 (id=1806): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @multicast1}, @time_exceeded={0x21, 0x0, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast2, @multicast1}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 1.361839081s ago: executing program 7 (id=1809): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=@newlink={0x44, 0x10, 0x403, 0x0, 0x80000000, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_FAIL_OVER_MAC={0x5, 0xd, 0xfd}, @IFLA_BOND_MODE={0x5, 0x1, 0x1}]}}}]}, 0x44}}, 0x0) 1.286231459s ago: executing program 7 (id=1811): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) sendmsg$NL80211_CMD_REGISTER_FRAME(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={0x0}, 0x18) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[], 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000000041}, 0xc) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) 1.259172165s ago: executing program 7 (id=1813): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) ioctl$SIOCGSTAMPNS(r0, 0x8907, 0x0) read(r0, &(0x7f0000000340)=""/202, 0xca) 1.11759345s ago: executing program 8 (id=1814): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c41"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000440)={'ip6tnl0\x00', &(0x7f00000002c0)={'ip6gre0\x00', 0x0, 0x29, 0xa, 0x3, 0x4, 0xa, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x700, 0x8000, 0x7, 0x3}}) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in=@loopback, @in=@empty, 0x0, 0x20, 0x1001, 0x40, 0xa}, {0xbd1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, {0x81, 0x2}, 0x2000000, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x8000, 0x33}, 0x0, @in6=@private0, 0x0, 0x2, 0x0, 0x1e, 0x0, 0x0, 0x10000}}, 0xe8) sendmmsg(r2, &(0x7f0000000480), 0x2e9, 0xffe0) 818.305454ms ago: executing program 8 (id=1816): r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r0, 0x0) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) r2 = accept4$unix(r0, 0x0, 0x0, 0x80800) recvmmsg(r2, &(0x7f0000000c00)=[{{0x0, 0x0, 0x0}, 0x807}, {{0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f00000006c0)=""/240, 0xf0}], 0x2c}, 0x1ff}], 0x2, 0x20022, 0x0) 766.59665ms ago: executing program 8 (id=1817): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 713.416402ms ago: executing program 1 (id=1818): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x2, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x5e21, @empty}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) 610.028727ms ago: executing program 8 (id=1819): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @multicast1}, @time_exceeded={0x21, 0x0, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast2, @multicast1}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 575.09102ms ago: executing program 8 (id=1820): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x60, r1, 0x1, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_MEDIA={0x14, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x800}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfffffffffffffffa}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x1200e0a0}, 0x20000000) 551.638249ms ago: executing program 1 (id=1821): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=@newlink={0x44, 0x10, 0x403, 0x0, 0x80000000, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_FAIL_OVER_MAC={0x5, 0xd, 0xfd}, @IFLA_BOND_MODE={0x5, 0x1, 0x1}]}}}]}, 0x44}}, 0x0) 450.08559ms ago: executing program 1 (id=1822): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0x4040) 449.872882ms ago: executing program 1 (id=1823): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x2, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x5e21, @empty}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) close(r1) 415.87957ms ago: executing program 1 (id=1824): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e24, @rand_addr=0x64010101}}, 0x7, 0x88}, 0x90) 351.508668ms ago: executing program 7 (id=1825): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x2, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x5e21, @empty}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x5e21, @local}, 0x10) close(r1) 291.201467ms ago: executing program 1 (id=1826): r0 = socket(0x11, 0x3, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) bind$packet(r0, &(0x7f00000001c0)={0x11, 0x0, r2, 0x1, 0x2, 0x6, @broadcast}, 0x14) socket$packet(0x11, 0x3, 0x300) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000001b40)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002840000121feb3fd58e9264c563e9361463e43dc4bb1fa05998cc7a234770b1aa4176a3f60216215d04167559621b7d3c07af0b3a66b44f45aa0be48861444c83c79beb655907c8631f0b45b64f26852ac45997ef940ea372253d27be8316ca75b10c03dcf57c00e99273610a9456c95806e04305e429e9493c1f171d2c91994cab33d43ea6467b3057d9d81c21b6a39e97d3879cbfe7a45663732ca34147dda47a487d98004e814d0b6d0d9550206626ba52ab1bc50f5564", 0xe1}], 0x1}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$BTRFS_IOC_LOGICAL_INO(r4, 0xc0389424, 0x0) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x40000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x800) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet(0x2, 0x2, 0x0) socket(0x840000000002, 0x3, 0xff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8943, &(0x7f0000000100)={'macvtap0\x00', @random="b40007eb0360"}) setsockopt$sock_int(r4, 0x1, 0x23, &(0x7f0000000a80)=0x200, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1f00000000000000000000000080"], 0x48) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYRES32=0x0], 0xfc}}, 0x10) 290.416979ms ago: executing program 7 (id=1827): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x2}, 0x94) close(r0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x18, 0x6, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffffff}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x2}, @jmp={0x5, 0x0, 0xc, 0x0, 0x0, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x8, 0x0, 0x0, 0xfffffffffffffffe, 0xd1}]}, &(0x7f00000000c0)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xf, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000840)='virtio_transport_alloc_pkt\x00', r1}, 0x18) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='virtio_transport_alloc_pkt\x00', r0}, 0x18) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) 0s ago: executing program 8 (id=1828): r0 = socket(0x11, 0x3, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f00000000c0)=0x5a8, 0x4) sendmmsg(r0, &(0x7f0000000bc0)=[{{&(0x7f0000000400)=@qipcrtr={0x2a, 0x1, 0x4001}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000040)="d479183d7d98d181a4b5f3e38100e2", 0x10012}], 0x1}}], 0x1, 0x24044015) kernel console output (not intermixed with test programs): code=0x7ffc0000 [ 637.112893][ T37] audit: type=1326 audit(1760446646.673:1360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10952 comm="syz.1.1286" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 637.113370][ T37] audit: type=1326 audit(1760446646.673:1361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10952 comm="syz.1.1286" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 637.114030][ T37] audit: type=1326 audit(1760446646.673:1362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10952 comm="syz.1.1286" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 637.114076][ T37] audit: type=1326 audit(1760446646.673:1363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10952 comm="syz.1.1286" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 637.114118][ T37] audit: type=1326 audit(1760446646.673:1364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10952 comm="syz.1.1286" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 637.114418][ T37] audit: type=1326 audit(1760446646.673:1365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10952 comm="syz.1.1286" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 637.584717][ T5806] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 637.604747][ T5806] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 637.623335][ T5806] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 637.625489][ T5806] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 637.667522][ T5806] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 637.941962][T10501] hsr_slave_0: entered promiscuous mode [ 637.942791][T10501] hsr_slave_1: entered promiscuous mode [ 637.943327][T10501] debugfs: 'hsr0' already exists in 'hsr' [ 637.943344][T10501] Cannot create hsr debugfs directory [ 637.943525][T10393] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 638.841160][ T5806] Bluetooth: hci4: command tx timeout [ 639.726022][ T5806] Bluetooth: hci6: command tx timeout [ 639.838361][T10973] FAULT_INJECTION: forcing a failure. [ 639.838361][T10973] name failslab, interval 1, probability 0, space 0, times 0 [ 639.838394][T10973] CPU: 0 UID: 0 PID: 10973 Comm: syz.1.1292 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 639.838416][T10973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 639.838427][T10973] Call Trace: [ 639.838435][T10973] [ 639.838443][T10973] dump_stack_lvl+0x189/0x250 [ 639.838471][T10973] ? __pfx____ratelimit+0x10/0x10 [ 639.838497][T10973] ? __pfx_dump_stack_lvl+0x10/0x10 [ 639.838519][T10973] ? __pfx__printk+0x10/0x10 [ 639.838548][T10973] ? __pfx___might_resched+0x10/0x10 [ 639.838571][T10973] ? fs_reclaim_acquire+0x7d/0x100 [ 639.838596][T10973] should_fail_ex+0x46c/0x600 [ 639.838626][T10973] should_failslab+0xa8/0x100 [ 639.838646][T10973] __kmalloc_noprof+0xcc/0x7d0 [ 639.838664][T10973] ? tomoyo_encode+0x28b/0x550 [ 639.838694][T10973] tomoyo_encode+0x28b/0x550 [ 639.838723][T10973] tomoyo_realpath_from_path+0x58d/0x5d0 [ 639.838758][T10973] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 639.838781][T10973] tomoyo_path_number_perm+0x1e8/0x5a0 [ 639.838806][T10973] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 639.838833][T10973] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 639.838859][T10973] ? lockdep_hardirqs_on+0x9c/0x150 [ 639.838916][T10973] ? __fget_files+0x2a/0x420 [ 639.838940][T10973] ? __fget_files+0x3a6/0x420 [ 639.838959][T10973] ? __fget_files+0x2a/0x420 [ 639.838989][T10973] security_file_ioctl+0xcb/0x2d0 [ 639.839015][T10973] __se_sys_ioctl+0x47/0x170 [ 639.839043][T10973] do_syscall_64+0xfa/0xfa0 [ 639.839068][T10973] ? lockdep_hardirqs_on+0x9c/0x150 [ 639.839092][T10973] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.839109][T10973] ? clear_bhb_loop+0x60/0xb0 [ 639.839132][T10973] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.839150][T10973] RIP: 0033:0x7fac6863eec9 [ 639.839167][T10973] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 639.839184][T10973] RSP: 002b:00007fac6689e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 639.839205][T10973] RAX: ffffffffffffffda RBX: 00007fac68895fa0 RCX: 00007fac6863eec9 [ 639.839220][T10973] RDX: 0000200000000200 RSI: 0000000080044dfd RDI: 0000000000000004 [ 639.839233][T10973] RBP: 00007fac6689e090 R08: 0000000000000000 R09: 0000000000000000 [ 639.839246][T10973] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 639.839257][T10973] R13: 00007fac68896038 R14: 00007fac68895fa0 R15: 00007ffd341471d8 [ 639.839292][T10973] [ 639.839323][T10973] ERROR: Out of memory at tomoyo_realpath_from_path. [ 641.796487][ T5806] Bluetooth: hci6: command tx timeout [ 643.027195][ T5813] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 643.053619][ T5813] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 643.057220][ T5813] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 643.067258][ T5813] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 643.069848][ T5813] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 643.092065][T10957] chnl_net:caif_netlink_parms(): no params data found [ 643.106030][ T5785] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 643.313476][ T5785] usb 2-1: Using ep0 maxpacket: 16 [ 643.333265][ T5785] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 643.333326][ T5785] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 643.349190][ T5785] usb 2-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice=b4.5b [ 643.349218][ T5785] usb 2-1: New USB device strings: Mfr=1, Product=130, SerialNumber=3 [ 643.349243][ T5785] usb 2-1: Product: syz [ 643.349256][ T5785] usb 2-1: Manufacturer: syz [ 643.349269][ T5785] usb 2-1: SerialNumber: syz [ 643.365032][ T5785] usb 2-1: config 0 descriptor?? [ 643.375669][ T5785] usb 2-1: NFC: intf ffff88805d76c000 id ffffffff8e0adb20 [ 643.596953][ T5785] usb 2-1: USB disconnect, device number 50 [ 643.839049][T10908] chnl_net:caif_netlink_parms(): no params data found [ 643.876037][ T5806] Bluetooth: hci6: command tx timeout [ 645.204402][ T5806] Bluetooth: hci2: command tx timeout [ 645.964767][ T5806] Bluetooth: hci6: command tx timeout [ 647.236700][ T5806] Bluetooth: hci2: command tx timeout [ 647.617034][ T8887] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 648.003292][ T8887] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 648.003320][ T8887] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 648.005500][ T8887] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 648.005526][ T8887] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 648.005546][ T8887] usb 2-1: SerialNumber: syz [ 648.280775][T11059] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 648.282650][T11059] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 648.321326][ T8887] usb 2-1: 0:2 : does not exist [ 648.374612][ T8887] usb 2-1: USB disconnect, device number 51 [ 648.431027][ T9378] udevd[9378]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 648.836693][T10957] bridge0: port 1(bridge_slave_0) entered blocking state [ 648.836917][T10957] bridge0: port 1(bridge_slave_0) entered disabled state [ 648.837159][T10957] bridge_slave_0: entered allmulticast mode [ 648.838810][T10957] bridge_slave_0: entered promiscuous mode [ 648.886055][ T5866] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 648.955040][T11075] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 648.955066][T11075] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 648.958828][T11075] vhci_hcd vhci_hcd.0: Device attached [ 648.959794][T11076] vhci_hcd: cannot find the pending unlink 9 [ 648.986254][T10957] bridge0: port 2(bridge_slave_1) entered blocking state [ 648.986405][T10957] bridge0: port 2(bridge_slave_1) entered disabled state [ 648.987741][T10957] bridge_slave_1: entered allmulticast mode [ 648.992469][T10957] bridge_slave_1: entered promiscuous mode [ 649.036049][ T5866] usb 5-1: Using ep0 maxpacket: 8 [ 649.063085][ T5866] usb 5-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 649.063112][ T5866] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 649.063131][ T5866] usb 5-1: Product: syz [ 649.063144][ T5866] usb 5-1: Manufacturer: syz [ 649.063158][ T5866] usb 5-1: SerialNumber: syz [ 649.074859][ T5866] usb 5-1: config 0 descriptor?? [ 649.094403][ T5866] gspca_main: se401-2.14.0 probing 047d:5003 [ 649.125722][T11076] vhci_hcd: connection closed [ 649.133975][ T1155] vhci_hcd: stop threads [ 649.133994][ T1155] vhci_hcd: release socket [ 649.142001][ T1155] vhci_hcd: disconnect device [ 649.209827][T10908] bridge0: port 1(bridge_slave_0) entered blocking state [ 649.209956][T10908] bridge0: port 1(bridge_slave_0) entered disabled state [ 649.210255][T10908] bridge_slave_0: entered allmulticast mode [ 649.217230][T10908] bridge_slave_0: entered promiscuous mode [ 649.316163][ T5806] Bluetooth: hci2: command tx timeout [ 649.328432][T10908] bridge0: port 2(bridge_slave_1) entered blocking state [ 649.328619][T10908] bridge0: port 2(bridge_slave_1) entered disabled state [ 649.328813][T10908] bridge_slave_1: entered allmulticast mode [ 649.331635][T10908] bridge_slave_1: entered promiscuous mode [ 649.363782][T10957] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 649.459236][T10957] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 649.659744][T10908] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 650.031917][T10908] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 650.707612][T10957] team0: Port device team_slave_0 added [ 650.884992][ T5866] gspca_se401: read req failed req 0x06 error -19 [ 650.909753][ T5866] usb 5-1: USB disconnect, device number 47 [ 650.953421][T10957] team0: Port device team_slave_1 added [ 651.351050][T10908] team0: Port device team_slave_0 added [ 651.396032][ T5806] Bluetooth: hci2: command tx timeout [ 651.422246][T10908] team0: Port device team_slave_1 added [ 651.443768][T10957] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 651.443784][T10957] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 651.443809][T10957] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 651.551199][T10957] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 651.551215][T10957] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 651.551235][T10957] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 651.665720][T10908] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 651.665731][T10908] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 651.665744][T10908] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 651.803164][T10908] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 651.803177][T10908] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 651.803191][T10908] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 652.096117][T11104] IPVS: set_ctl: invalid protocol: 43 127.0.0.1:20002 [ 652.303307][T10957] hsr_slave_0: entered promiscuous mode [ 652.304160][T10957] hsr_slave_1: entered promiscuous mode [ 652.304728][T10957] debugfs: 'hsr0' already exists in 'hsr' [ 652.304743][T10957] Cannot create hsr debugfs directory [ 652.489845][T11008] chnl_net:caif_netlink_parms(): no params data found [ 652.687553][T10908] hsr_slave_0: entered promiscuous mode [ 652.688704][T10908] hsr_slave_1: entered promiscuous mode [ 652.689357][T10908] debugfs: 'hsr0' already exists in 'hsr' [ 652.689375][T10908] Cannot create hsr debugfs directory [ 653.116052][ T37] kauditd_printk_skb: 34 callbacks suppressed [ 653.116070][ T37] audit: type=1326 audit(1760446662.673:1400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11110 comm="syz.1.1321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 653.116438][ T37] audit: type=1326 audit(1760446662.683:1401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11110 comm="syz.1.1321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 653.117090][ T37] audit: type=1326 audit(1760446662.683:1402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11110 comm="syz.1.1321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fac6863d710 code=0x7ffc0000 [ 653.117673][ T37] audit: type=1326 audit(1760446662.683:1403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11110 comm="syz.1.1321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 653.118639][ T37] audit: type=1326 audit(1760446662.683:1404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11110 comm="syz.1.1321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 653.118906][ T37] audit: type=1326 audit(1760446662.683:1405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11110 comm="syz.1.1321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 653.119370][ T37] audit: type=1326 audit(1760446662.683:1406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11110 comm="syz.1.1321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 653.119827][ T37] audit: type=1326 audit(1760446662.683:1407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11110 comm="syz.1.1321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 653.120109][ T37] audit: type=1326 audit(1760446662.683:1408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11110 comm="syz.1.1321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 653.120406][ T37] audit: type=1326 audit(1760446662.683:1409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11110 comm="syz.1.1321" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 655.431335][T11008] bridge0: port 1(bridge_slave_0) entered blocking state [ 655.431532][T11008] bridge0: port 1(bridge_slave_0) entered disabled state [ 655.431739][T11008] bridge_slave_0: entered allmulticast mode [ 655.433419][T11008] bridge_slave_0: entered promiscuous mode [ 655.470345][T11008] bridge0: port 2(bridge_slave_1) entered blocking state [ 655.470589][T11008] bridge0: port 2(bridge_slave_1) entered disabled state [ 655.470860][T11008] bridge_slave_1: entered allmulticast mode [ 655.472404][T11008] bridge_slave_1: entered promiscuous mode [ 655.556195][ T1231] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 655.713744][ T1231] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 655.713776][ T1231] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 655.714950][ T1231] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 655.714974][ T1231] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 655.714992][ T1231] usb 5-1: SerialNumber: syz [ 655.977759][T11134] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 655.985249][T11134] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 656.016318][ T1231] usb 5-1: 0:2 : does not exist [ 656.067085][T11008] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 656.239451][ T1231] usb 5-1: USB disconnect, device number 48 [ 656.385315][T11008] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 656.699004][ T12] bridge_slave_1: left allmulticast mode [ 656.699030][ T12] bridge_slave_1: left promiscuous mode [ 656.699248][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 657.817027][ T12] bridge_slave_0: left allmulticast mode [ 657.817054][ T12] bridge_slave_0: left promiscuous mode [ 657.818129][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 657.925039][ T5806] Bluetooth: hci0: unexpected event 0x2f length: 509 > 260 [ 658.230428][ T12] bridge_slave_1: left allmulticast mode [ 658.230493][ T12] bridge_slave_1: left promiscuous mode [ 658.230738][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 658.328040][ T12] bridge_slave_0: left allmulticast mode [ 658.328070][ T12] bridge_slave_0: left promiscuous mode [ 658.331176][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 659.448991][T11162] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1333'. [ 660.047087][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 660.126721][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 660.208427][ T12] bond0 (unregistering): Released all slaves [ 660.230549][T11008] team0: Port device team_slave_0 added [ 660.324888][T11157] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 660.347302][T11008] team0: Port device team_slave_1 added [ 661.567334][T11008] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 661.567345][T11008] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 661.567362][T11008] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 661.813469][T11008] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 661.813486][T11008] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 661.813512][T11008] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 662.138691][T11182] binder: 11181:11182 ioctl c0306201 200000000240 returned -14 [ 662.377794][T10957] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 662.591022][T10957] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 662.950913][T11008] hsr_slave_0: entered promiscuous mode [ 662.952308][T11008] hsr_slave_1: entered promiscuous mode [ 662.953285][T11008] debugfs: 'hsr0' already exists in 'hsr' [ 662.953306][T11008] Cannot create hsr debugfs directory [ 662.954151][T10957] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 662.993962][T10957] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 663.062590][T11191] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1341'. [ 664.630082][ T12] hsr_slave_0: left promiscuous mode [ 664.666292][ T12] hsr_slave_1: left promiscuous mode [ 664.666986][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 664.691338][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 664.849066][ T12] hsr_slave_0: left promiscuous mode [ 664.866092][ T12] hsr_slave_1: left promiscuous mode [ 664.866968][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 664.922549][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 667.014005][ T12] team0 (unregistering): Port device team_slave_1 removed [ 667.216726][ T12] team0 (unregistering): Port device team_slave_0 removed [ 669.996617][ T12] team0 (unregistering): Port device team_slave_1 removed [ 670.127040][ T12] team0 (unregistering): Port device team_slave_0 removed [ 671.487108][T11217] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1347'. [ 672.233486][T11228] netlink: 'syz.1.1349': attribute type 1 has an invalid length. [ 672.659362][T10908] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 672.821175][T11234] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1350'. [ 672.946271][T10908] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 673.946258][T10908] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 675.629909][T10908] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 676.017019][T10957] 8021q: adding VLAN 0 to HW filter on device bond0 [ 676.581283][T10957] 8021q: adding VLAN 0 to HW filter on device team0 [ 676.736672][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 676.737847][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 676.802653][ T7754] bridge0: port 2(bridge_slave_1) entered blocking state [ 676.802755][ T7754] bridge0: port 2(bridge_slave_1) entered forwarding state [ 676.959013][T11008] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 676.976032][ T6102] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 677.000767][ T12] bridge_slave_1: left allmulticast mode [ 677.000793][ T12] bridge_slave_1: left promiscuous mode [ 677.001042][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 677.083978][ T12] bridge_slave_0: left allmulticast mode [ 677.083998][ T12] bridge_slave_0: left promiscuous mode [ 677.084147][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 677.127774][ T6102] usb 2-1: config index 0 descriptor too short (expected 1051, got 27) [ 677.127801][ T6102] usb 2-1: config 0 has an invalid interface number: 0 but max is -1 [ 677.127819][ T6102] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 677.127871][ T6102] usb 2-1: config 0 interface 0 altsetting 12 bulk endpoint 0x87 has invalid maxpacket 149 [ 677.127885][ T6102] usb 2-1: config 0 interface 0 has no altsetting 0 [ 677.130160][ T6102] usb 2-1: New USB device found, idVendor=06cd, idProduct=010a, bcdDevice=d9.c3 [ 677.130185][ T6102] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.130203][ T6102] usb 2-1: Product: syz [ 677.130216][ T6102] usb 2-1: Manufacturer: syz [ 677.130224][ T6102] usb 2-1: SerialNumber: syz [ 677.133579][ T6102] usb 2-1: config 0 descriptor?? [ 677.136217][T11272] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 677.353480][T11272] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 677.354014][T11272] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 677.429390][ T6102] keyspan 2-1:0.0: Keyspan 4 port adapter converter detected [ 677.430038][ T6102] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 7 [ 677.432642][ T6102] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 81 [ 677.432694][ T6102] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 1 [ 677.434246][ T6102] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 677.438551][ T6102] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 82 [ 677.438636][ T6102] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 2 [ 677.449645][ T6102] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 677.452404][ T6102] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 83 [ 677.452488][ T6102] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 3 [ 677.460162][ T6102] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 677.462885][ T6102] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 84 [ 677.462969][ T6102] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 4 [ 677.469174][ T6102] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 677.474552][ T6102] usb 2-1: USB disconnect, device number 53 [ 677.484819][ T6102] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 677.497296][ T6102] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 677.505342][ T6102] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 677.511987][ T6102] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 677.513187][ T6102] keyspan 2-1:0.0: device disconnected [ 677.611610][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 677.727126][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 677.933999][ T12] bond0 (unregistering): Released all slaves [ 677.976252][T11008] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 678.025358][T11008] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 678.109099][T11008] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 678.356297][ T12] hsr_slave_0: left promiscuous mode [ 678.377509][ T12] hsr_slave_1: left promiscuous mode [ 678.378611][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 678.417190][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 678.854278][T11293] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1358'. [ 679.646767][ T12] team0 (unregistering): Port device team_slave_1 removed [ 679.786880][ T12] team0 (unregistering): Port device team_slave_0 removed [ 681.518008][T10908] 8021q: adding VLAN 0 to HW filter on device bond0 [ 682.943900][T10908] 8021q: adding VLAN 0 to HW filter on device team0 [ 683.005808][ T6278] bridge0: port 1(bridge_slave_0) entered blocking state [ 683.024226][ T6278] bridge0: port 1(bridge_slave_0) entered forwarding state [ 683.061293][ T6278] bridge0: port 2(bridge_slave_1) entered blocking state [ 683.114105][ T6278] bridge0: port 2(bridge_slave_1) entered forwarding state [ 683.365009][T10957] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 683.445538][T11008] 8021q: adding VLAN 0 to HW filter on device bond0 [ 683.646344][T11008] 8021q: adding VLAN 0 to HW filter on device team0 [ 683.702632][ T1159] bridge0: port 1(bridge_slave_0) entered blocking state [ 683.702849][ T1159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 683.773781][ T1159] bridge0: port 2(bridge_slave_1) entered blocking state [ 683.774744][ T1159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 684.344485][T10908] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 684.560697][T10957] veth0_vlan: entered promiscuous mode [ 684.632533][T10957] veth1_vlan: entered promiscuous mode [ 684.821149][T10957] veth0_macvtap: entered promiscuous mode [ 684.831464][T10957] veth1_macvtap: entered promiscuous mode [ 685.709506][T10957] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 685.765779][T10957] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 685.782202][T11008] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 686.013923][ T6075] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.040501][ T6075] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.059347][ T6075] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.130288][ T6075] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.140345][T11358] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1371'. [ 686.180234][ T37] kauditd_printk_skb: 7 callbacks suppressed [ 686.180252][ T37] audit: type=1326 audit(1760446695.733:1417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11360 comm="syz.1.1372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 686.180755][ T37] audit: type=1326 audit(1760446695.743:1418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11360 comm="syz.1.1372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fac6863d710 code=0x7ffc0000 [ 686.181364][ T37] audit: type=1326 audit(1760446695.743:1419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11360 comm="syz.1.1372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 686.181661][ T37] audit: type=1326 audit(1760446695.743:1420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11360 comm="syz.1.1372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 686.182370][ T37] audit: type=1326 audit(1760446695.743:1421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11360 comm="syz.1.1372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 686.182819][ T37] audit: type=1326 audit(1760446695.743:1422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11360 comm="syz.1.1372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 686.184251][ T37] audit: type=1326 audit(1760446695.743:1423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11360 comm="syz.1.1372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 686.314386][ T37] audit: type=1326 audit(1760446695.743:1424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11360 comm="syz.1.1372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 686.314439][ T37] audit: type=1326 audit(1760446695.873:1425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11360 comm="syz.1.1372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 686.314481][ T37] audit: type=1326 audit(1760446695.873:1426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11360 comm="syz.1.1372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 687.126232][ T5879] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 687.199469][ T6278] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 687.199489][ T6278] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 687.276546][ T5879] usb 2-1: Using ep0 maxpacket: 8 [ 687.292993][ T5879] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 687.293021][ T5879] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 687.293041][ T5879] usb 2-1: Product: syz [ 687.293055][ T5879] usb 2-1: Manufacturer: syz [ 687.293068][ T5879] usb 2-1: SerialNumber: syz [ 687.339072][ T5879] usb 2-1: config 0 descriptor?? [ 687.470325][T10908] veth0_vlan: entered promiscuous mode [ 687.501835][ T7790] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 687.501855][ T7790] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 687.547354][ T5879] usb 2-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 687.634191][T10908] veth1_vlan: entered promiscuous mode [ 687.664704][T11008] veth0_vlan: entered promiscuous mode [ 687.701493][T11008] veth1_vlan: entered promiscuous mode [ 687.763310][T10908] veth0_macvtap: entered promiscuous mode [ 687.778394][T10908] veth1_macvtap: entered promiscuous mode [ 687.843642][T11008] veth0_macvtap: entered promiscuous mode [ 687.873360][T10908] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 687.891341][T11008] veth1_macvtap: entered promiscuous mode [ 687.917988][T10908] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 687.968542][ T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 687.972430][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 687.993649][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.006167][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.024749][T11008] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 688.196171][T11376] netlink: 56 bytes leftover after parsing attributes in process `syz.8.1287'. [ 688.248251][T11008] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 688.401831][ T1159] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.412060][ T1159] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.448824][ T1159] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.482767][ T6075] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.649280][ T990] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 688.653612][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 688.653630][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 688.839834][ T990] usb 9-1: config 0 has an invalid interface number: 93 but max is 0 [ 688.839859][ T990] usb 9-1: config 0 has no interface number 0 [ 688.879701][ T990] usb 9-1: New USB device found, idVendor=1a0a, idProduct=0104, bcdDevice=7f.ac [ 688.879728][ T990] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 688.879744][ T990] usb 9-1: Product: syz [ 688.879756][ T990] usb 9-1: Manufacturer: syz [ 688.879769][ T990] usb 9-1: SerialNumber: syz [ 688.933414][ T990] usb 9-1: config 0 descriptor?? [ 689.034136][ T6075] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 689.034156][ T6075] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 689.190989][ T5879] usb write operation failed. (-71) [ 689.213388][ T6278] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 689.213408][ T6278] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 689.272152][ T5879] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 689.272817][ T5879] dvbdev: DVB: registering new adapter (Terratec H7) [ 689.272866][ T5879] usb 2-1: media controller created [ 689.298198][ T5879] usb read operation failed. (-71) [ 689.303584][ T5879] usb write operation failed. (-71) [ 689.328750][ T990] usb_ehset_test 9-1:0.93: probe with driver usb_ehset_test failed with error -32 [ 689.353277][ T990] usb 9-1: USB disconnect, device number 2 [ 689.366932][ T5879] dvb_usb_az6007 2-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 689.373512][ T5879] usb 2-1: USB disconnect, device number 54 [ 689.570489][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 689.570510][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 691.187134][ T8887] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 691.243046][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 691.243127][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 691.383750][ T8887] usb 9-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice=31.00 [ 691.383779][ T8887] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 691.383799][ T8887] usb 9-1: Product: syz [ 691.383812][ T8887] usb 9-1: Manufacturer: syz [ 691.383824][ T8887] usb 9-1: SerialNumber: syz [ 691.557154][ T8887] usb 9-1: config 0 descriptor?? [ 691.655203][ T8887] ftdi_sio 9-1:0.0: FTDI USB Serial Device converter detected [ 691.705752][ T8887] usb 9-1: Detected FT4232HP [ 692.043749][ T5813] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 692.059748][ T5813] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 692.061803][ T5813] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 692.063202][ T5813] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 692.064077][ T5813] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 692.495720][T11418] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 692.604238][T11418] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 693.468041][ T8887] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 693.472267][ T8887] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 693.494069][T11383] usb 2-1: new full-speed USB device number 55 using dummy_hcd [ 693.505171][ T8887] usb 9-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 693.526387][ T8887] usb 9-1: USB disconnect, device number 3 [ 693.534043][ T8887] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 693.534734][ T8887] ftdi_sio 9-1:0.0: device disconnected [ 693.555310][ T1155] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 693.679678][T11383] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 693.679708][T11383] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 693.679747][T11383] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 693.679767][T11383] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 693.953787][T11383] usb 2-1: GET_CAPABILITIES returned 0 [ 693.953837][T11383] usbtmc 2-1:16.0: can't read capabilities [ 694.116637][ T5813] Bluetooth: hci3: command tx timeout [ 694.193290][T11434] fuse: Unknown parameter '000000000000000000060x000000000000000c' [ 694.563104][ T1155] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 695.401059][ T1155] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 696.266240][ T5813] Bluetooth: hci3: command tx timeout [ 696.564548][ T1231] usb 2-1: USB disconnect, device number 55 [ 698.304035][ T5813] Bluetooth: hci3: command tx timeout [ 698.372238][ T1155] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.626878][ T37] kauditd_printk_skb: 52 callbacks suppressed [ 699.626895][ T37] audit: type=1326 audit(1760446709.193:1479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11475 comm="syz.1.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 699.626943][ T37] audit: type=1326 audit(1760446709.193:1480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11475 comm="syz.1.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 699.645797][ T37] audit: type=1326 audit(1760446709.203:1481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11475 comm="syz.1.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fac6863d710 code=0x7ffc0000 [ 699.645848][ T37] audit: type=1326 audit(1760446709.203:1482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11475 comm="syz.1.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 699.646139][ T37] audit: type=1326 audit(1760446709.203:1483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11475 comm="syz.1.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 699.647307][ T37] audit: type=1326 audit(1760446709.213:1484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11475 comm="syz.1.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 699.654817][ T37] audit: type=1326 audit(1760446709.213:1485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11475 comm="syz.1.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 699.655759][ T37] audit: type=1326 audit(1760446709.213:1486): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11475 comm="syz.1.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 699.655807][ T37] audit: type=1326 audit(1760446709.213:1487): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11475 comm="syz.1.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 699.655847][ T37] audit: type=1326 audit(1760446709.213:1488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11475 comm="syz.1.1391" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 700.359087][ T5813] Bluetooth: hci3: command tx timeout [ 702.292708][T11425] chnl_net:caif_netlink_parms(): no params data found [ 702.377167][ T5813] Bluetooth: hci0: unexpected event 0x2f length: 509 > 260 [ 702.576018][ T5785] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 702.725996][ T5785] usb 5-1: Using ep0 maxpacket: 32 [ 702.728460][ T5785] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 702.728484][ T5785] usb 5-1: config 0 has no interface number 0 [ 702.732619][ T5785] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 702.732645][ T5785] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 702.732665][ T5785] usb 5-1: Product: syz [ 702.732678][ T5785] usb 5-1: Manufacturer: syz [ 702.732691][ T5785] usb 5-1: SerialNumber: syz [ 702.812685][ T5785] usb 5-1: config 0 descriptor?? [ 702.828851][ T5785] smsc95xx v2.0.0 [ 702.897836][ T5879] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 702.928176][ T10] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 703.049699][ T5785] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 703.050013][ T5785] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 703.056230][ T5879] usb 2-1: Using ep0 maxpacket: 16 [ 703.058296][ T5879] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 703.058318][ T5879] usb 2-1: config 0 has no interface number 0 [ 703.058366][ T5879] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 703.058390][ T5879] usb 2-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 703.072779][ T5879] usb 2-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 703.072803][ T5879] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 703.072821][ T5879] usb 2-1: Product: syz [ 703.072834][ T5879] usb 2-1: SerialNumber: syz [ 703.141151][ T10] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 703.141175][ T10] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 703.142698][ T10] usb 9-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 703.142723][ T10] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 703.142740][ T10] usb 9-1: SerialNumber: syz [ 703.205286][ T5785] usb 5-1: USB disconnect, device number 49 [ 703.251784][ C1] vkms_vblank_simulate: vblank timer overrun [ 703.319801][ T5879] usb 2-1: config 0 descriptor?? [ 703.344192][ T5879] cm109 2-1:0.8: invalid payload size 0, expected 4 [ 703.378995][ T5879] input: CM109 USB driver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.8/input/input23 [ 703.427998][T11511] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 703.433074][T11511] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 703.483591][ T10] usb 9-1: 0:2 : does not exist [ 703.525988][ C1] cm109 2-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 703.691117][ C1] vkms_vblank_simulate: vblank timer overrun [ 703.748216][ T10] usb 9-1: USB disconnect, device number 4 [ 703.773023][T11510] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 704.248009][T11510] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 704.459528][ C1] vkms_vblank_simulate: vblank timer overrun [ 704.525125][T11387] udevd[11387]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 704.606578][T11425] bridge0: port 1(bridge_slave_0) entered blocking state [ 704.606714][T11425] bridge0: port 1(bridge_slave_0) entered disabled state [ 704.607345][T11425] bridge_slave_0: entered allmulticast mode [ 704.626834][T11425] bridge_slave_0: entered promiscuous mode [ 704.747354][T11425] bridge0: port 2(bridge_slave_1) entered blocking state [ 704.747490][T11425] bridge0: port 2(bridge_slave_1) entered disabled state [ 704.747716][T11425] bridge_slave_1: entered allmulticast mode [ 704.776682][T11425] bridge_slave_1: entered promiscuous mode [ 704.869874][ T5879] usb 2-1: USB disconnect, device number 56 [ 705.131688][ T5879] cm109 2-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 705.170325][ T1155] bridge_slave_1: left allmulticast mode [ 705.170353][ T1155] bridge_slave_1: left promiscuous mode [ 705.170581][ T1155] bridge0: port 2(bridge_slave_1) entered disabled state [ 705.259163][ T1155] bridge_slave_0: left allmulticast mode [ 705.259191][ T1155] bridge_slave_0: left promiscuous mode [ 705.262156][ T1155] bridge0: port 1(bridge_slave_0) entered disabled state [ 705.436363][ C1] vkms_vblank_simulate: vblank timer overrun [ 705.531257][ T5813] Bluetooth: hci0: unexpected event 0x2f length: 509 > 260 [ 705.891449][T11552] ntfs3(nullb0): Primary boot signature is not NTFS. [ 705.919079][T11552] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 707.602356][T11567] netlink: 'syz.8.1414': attribute type 10 has an invalid length. [ 709.226191][ T5879] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 709.380178][ T5879] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 709.380203][ T5879] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 709.381475][ T5879] usb 8-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 709.381497][ T5879] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 709.381507][ T5879] usb 8-1: SerialNumber: syz [ 709.426701][ T1155] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 709.466674][ T1155] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 709.492156][ T1155] bond0 (unregistering): Released all slaves [ 709.653874][T11574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 709.656065][T11574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 709.718985][ T5879] usb 8-1: 0:2 : does not exist [ 709.835360][ T5879] usb 8-1: USB disconnect, device number 2 [ 709.874623][T11567] lo: entered promiscuous mode [ 709.881814][T11567] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 709.901060][T11276] udevd[11276]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 709.924411][T11425] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 709.949296][T11425] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 710.136549][T11581] netlink: 40 bytes leftover after parsing attributes in process `syz.8.1418'. [ 710.162551][ T5813] Bluetooth: hci1: unexpected event 0x2f length: 509 > 260 [ 710.896158][ T5785] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 711.036219][ T5866] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 711.068378][ T5785] usb 9-1: unable to get BOS descriptor or descriptor too short [ 711.069610][ T5785] usb 9-1: config 6 has an invalid interface number: 158 but max is 0 [ 711.069633][ T5785] usb 9-1: config 6 has no interface number 0 [ 711.069665][ T5785] usb 9-1: config 6 interface 158 has no altsetting 0 [ 711.075497][ T5785] usb 9-1: New USB device found, idVendor=0bda, idProduct=0140, bcdDevice=da.29 [ 711.075524][ T5785] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.075542][ T5785] usb 9-1: Product: syz [ 711.075555][ T5785] usb 9-1: Manufacturer: syz [ 711.075569][ T5785] usb 9-1: SerialNumber: syz [ 711.206197][ T5866] usb 5-1: Using ep0 maxpacket: 32 [ 711.209422][ T5866] usb 5-1: config 0 has an invalid interface number: 241 but max is 0 [ 711.209445][ T5866] usb 5-1: config 0 has no interface number 0 [ 711.215798][ T5866] usb 5-1: New USB device found, idVendor=046d, idProduct=08f0, bcdDevice=f7.32 [ 711.217984][ T5866] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.218006][ T5866] usb 5-1: Product: syz [ 711.218019][ T5866] usb 5-1: Manufacturer: syz [ 711.218032][ T5866] usb 5-1: SerialNumber: syz [ 711.252745][ T5866] usb 5-1: config 0 descriptor?? [ 711.411508][ T5866] gspca_main: STV06xx-2.14.0 probing 046d:08f0 [ 711.411605][ T5866] gspca_stv06xx: st6422 sensor detected [ 711.442298][ T5785] rtsx_usb 9-1:6.158: probe with driver rtsx_usb failed with error -22 [ 711.478963][ T5785] usb 9-1: USB disconnect, device number 5 [ 711.582745][T11425] team0: Port device team_slave_0 added [ 711.609194][T11425] team0: Port device team_slave_1 added [ 712.411603][ T5813] Bluetooth: hci2: unexpected event 0x2f length: 509 > 260 [ 712.806503][ C1] vkms_vblank_simulate: vblank timer overrun [ 712.807471][T11383] usb 9-1: new full-speed USB device number 6 using dummy_hcd [ 713.527615][ C1] vkms_vblank_simulate: vblank timer overrun [ 713.762013][ C1] vkms_vblank_simulate: vblank timer overrun [ 713.790658][T11383] usb 9-1: descriptor type invalid, skip [ 713.790677][T11383] usb 9-1: descriptor type invalid, skip [ 713.790689][T11383] usb 9-1: descriptor type invalid, skip [ 713.790701][T11383] usb 9-1: descriptor type invalid, skip [ 713.790712][T11383] usb 9-1: descriptor type invalid, skip [ 713.790724][T11383] usb 9-1: descriptor type invalid, skip [ 713.791475][T11383] usb 9-1: not running at top speed; connect to a high speed hub [ 713.792949][T11383] usb 9-1: config 0 has no interfaces? [ 713.842491][ T5866] STV06xx 5-1:0.241: probe with driver STV06xx failed with error -71 [ 713.856247][ T5866] usb 5-1: unknown interface protocol 0xde, assuming v1 [ 713.856268][ T5866] usb 5-1: cannot find UAC_HEADER [ 713.904558][T11383] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 713.904588][T11383] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 713.904606][T11383] usb 9-1: Product: syz [ 713.904619][T11383] usb 9-1: Manufacturer: syz [ 713.904631][T11383] usb 9-1: SerialNumber: syz [ 713.987816][T11383] usb 9-1: config 0 descriptor?? [ 714.166749][T11425] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 714.166766][T11425] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 714.166790][T11425] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 714.174360][ T5866] snd-usb-audio 5-1:0.241: probe with driver snd-usb-audio failed with error -22 [ 714.261578][T11425] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 714.261595][T11425] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 714.261622][T11425] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 714.275196][ T5866] usb 5-1: USB disconnect, device number 50 [ 714.414918][T11276] udevd[11276]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.241/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 714.536190][ T1155] hsr_slave_0: left promiscuous mode [ 714.573313][ T1155] hsr_slave_1: left promiscuous mode [ 714.574284][ T1155] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 714.574308][ T1155] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 714.602637][ T1155] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 714.602672][ T1155] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 714.614504][ T5866] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 714.809012][ T5866] usb 5-1: New USB device found, idVendor=13d8, idProduct=0011, bcdDevice=d0.62 [ 714.809043][ T5866] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 714.809062][ T5866] usb 5-1: Product: syz [ 714.809075][ T5866] usb 5-1: Manufacturer: syz [ 714.809088][ T5866] usb 5-1: SerialNumber: syz [ 714.823485][ T5866] usb 5-1: config 0 descriptor?? [ 714.828115][ T5879] usb 9-1: USB disconnect, device number 6 [ 714.846687][ T1155] veth1_macvtap: left promiscuous mode [ 714.846874][ T1155] veth0_macvtap: left promiscuous mode [ 714.847144][ T1155] veth1_vlan: left promiscuous mode [ 714.847338][ T1155] veth0_vlan: left promiscuous mode [ 714.978212][T11641] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 715.005271][ T5866] usb 5-1: selecting invalid altsetting 1 [ 715.005294][ T5866] comedi comedi5: could not switch to alternate setting 1 [ 715.005308][ T5866] usbduxfast 5-1:0.0: driver 'usbduxfast' failed to auto-configure device. [ 715.048659][ T8887] usb 5-1: USB disconnect, device number 51 [ 715.162604][ T37] kauditd_printk_skb: 60 callbacks suppressed [ 715.162620][ T37] audit: type=1326 audit(1760446724.723:1549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11653 comm="syz.8.1438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 715.164760][ T37] audit: type=1326 audit(1760446724.723:1550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11653 comm="syz.8.1438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 715.167353][ T37] audit: type=1326 audit(1760446724.733:1551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11653 comm="syz.8.1438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f544b37d710 code=0x7ffc0000 [ 715.168013][ T37] audit: type=1326 audit(1760446724.733:1552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11653 comm="syz.8.1438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 715.168275][ T37] audit: type=1326 audit(1760446724.733:1553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11653 comm="syz.8.1438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 715.168960][ T37] audit: type=1326 audit(1760446724.733:1554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11653 comm="syz.8.1438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 715.169518][ T37] audit: type=1326 audit(1760446724.733:1555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11653 comm="syz.8.1438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 715.169809][ T37] audit: type=1326 audit(1760446724.733:1556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11653 comm="syz.8.1438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 715.170072][ T37] audit: type=1326 audit(1760446724.733:1557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11653 comm="syz.8.1438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 715.171490][ T37] audit: type=1326 audit(1760446724.733:1558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11653 comm="syz.8.1438" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 715.659073][ C1] vkms_vblank_simulate: vblank timer overrun [ 715.703722][ T5813] Bluetooth: hci1: unexpected event 0x2f length: 509 > 260 [ 715.926146][ C1] vkms_vblank_simulate: vblank timer overrun [ 716.215292][ C1] vkms_vblank_simulate: vblank timer overrun [ 716.500677][ C1] vkms_vblank_simulate: vblank timer overrun [ 717.131790][ C1] vkms_vblank_simulate: vblank timer overrun [ 717.291323][ C1] vkms_vblank_simulate: vblank timer overrun [ 718.441459][ C1] vkms_vblank_simulate: vblank timer overrun [ 718.597779][ C1] vkms_vblank_simulate: vblank timer overrun [ 718.803090][ C1] vkms_vblank_simulate: vblank timer overrun [ 718.981327][ C1] vkms_vblank_simulate: vblank timer overrun [ 719.332442][ C1] vkms_vblank_simulate: vblank timer overrun [ 719.440777][ T5813] Bluetooth: hci6: unexpected event 0x2f length: 509 > 260 [ 719.530725][ C1] vkms_vblank_simulate: vblank timer overrun [ 719.615451][ C1] vkms_vblank_simulate: vblank timer overrun [ 719.837622][ C1] vkms_vblank_simulate: vblank timer overrun [ 720.178051][ C1] vkms_vblank_simulate: vblank timer overrun [ 720.633950][ C1] vkms_vblank_simulate: vblank timer overrun [ 721.524117][ C1] vkms_vblank_simulate: vblank timer overrun [ 721.582452][ C1] vkms_vblank_simulate: vblank timer overrun [ 721.832508][ C1] vkms_vblank_simulate: vblank timer overrun [ 721.876790][ C1] vkms_vblank_simulate: vblank timer overrun [ 721.933853][ C1] vkms_vblank_simulate: vblank timer overrun [ 721.988919][ T1155] team0 (unregistering): Port device team_slave_1 removed [ 722.206650][ T1155] team0 (unregistering): Port device team_slave_0 removed [ 722.545259][ C1] vkms_vblank_simulate: vblank timer overrun [ 722.625051][ C1] vkms_vblank_simulate: vblank timer overrun [ 722.949251][ C1] vkms_vblank_simulate: vblank timer overrun [ 722.991915][ C1] vkms_vblank_simulate: vblank timer overrun [ 723.028215][ C1] vkms_vblank_simulate: vblank timer overrun [ 723.080057][ C1] vkms_vblank_simulate: vblank timer overrun [ 723.124647][ C1] vkms_vblank_simulate: vblank timer overrun [ 723.228368][ C1] vkms_vblank_simulate: vblank timer overrun [ 723.288462][ C1] vkms_vblank_simulate: vblank timer overrun [ 723.345948][ C1] vkms_vblank_simulate: vblank timer overrun [ 723.407412][ C1] vkms_vblank_simulate: vblank timer overrun [ 723.463356][ C1] vkms_vblank_simulate: vblank timer overrun [ 723.517744][ C1] vkms_vblank_simulate: vblank timer overrun [ 723.679741][ C1] vkms_vblank_simulate: vblank timer overrun [ 723.729051][ C1] vkms_vblank_simulate: vblank timer overrun [ 723.783883][ C1] vkms_vblank_simulate: vblank timer overrun [ 724.600443][T11645] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 724.600703][T11645] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 724.686880][T11645] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 724.686991][T11645] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 724.732304][T11425] hsr_slave_0: entered promiscuous mode [ 724.733132][T11425] hsr_slave_1: entered promiscuous mode [ 724.760064][T11645] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 724.760155][T11645] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 724.827168][T11645] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 724.944342][T11645] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 724.944426][T11645] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 725.027813][T11645] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 725.087821][T11645] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 725.087908][T11645] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 725.168415][T11645] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 725.963876][ C0] vkms_vblank_simulate: vblank timer overrun [ 725.966386][T11388] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 726.116920][T11724] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1458'. [ 726.686587][ T5813] Bluetooth: hci0: command 0x0406 tx timeout [ 726.756593][ T5813] Bluetooth: hci1: command 0x0406 tx timeout [ 726.759281][ C0] vkms_vblank_simulate: vblank timer overrun [ 726.785941][T11388] usb 9-1: Using ep0 maxpacket: 8 [ 726.800827][T11388] usb 9-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 726.800855][T11388] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 726.800874][T11388] usb 9-1: Product: syz [ 726.800887][T11388] usb 9-1: Manufacturer: syz [ 726.800901][T11388] usb 9-1: SerialNumber: syz [ 726.836244][ T5813] Bluetooth: hci6: command 0x0c1a tx timeout [ 726.849565][T11388] usb 9-1: config 0 descriptor?? [ 726.854436][T11388] gspca_main: se401-2.14.0 probing 047d:5003 [ 727.002626][ C0] vkms_vblank_simulate: vblank timer overrun [ 727.006036][ T5813] Bluetooth: hci2: command 0x0c1a tx timeout [ 727.052779][ C0] vkms_vblank_simulate: vblank timer overrun [ 727.156742][ T5813] Bluetooth: hci3: command 0x0c1a tx timeout [ 727.283086][ T37] kauditd_printk_skb: 27 callbacks suppressed [ 727.283103][ T37] audit: type=1326 audit(1760446736.843:1586): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11726 comm="syz.7.1460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff10c5beec9 code=0x7ffc0000 [ 727.287120][ T37] audit: type=1326 audit(1760446736.853:1587): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11726 comm="syz.7.1460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ff10c5bd710 code=0x7ffc0000 [ 727.287169][ T37] audit: type=1326 audit(1760446736.853:1588): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11726 comm="syz.7.1460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff10c5beec9 code=0x7ffc0000 [ 727.287215][ T37] audit: type=1326 audit(1760446736.853:1589): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11726 comm="syz.7.1460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff10c5beec9 code=0x7ffc0000 [ 727.287899][ T37] audit: type=1326 audit(1760446736.853:1590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11726 comm="syz.7.1460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ff10c5beec9 code=0x7ffc0000 [ 727.288385][ T37] audit: type=1326 audit(1760446736.853:1591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11726 comm="syz.7.1460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff10c5beec9 code=0x7ffc0000 [ 727.288651][ T37] audit: type=1326 audit(1760446736.853:1592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11726 comm="syz.7.1460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff10c5beec9 code=0x7ffc0000 [ 727.289024][ T37] audit: type=1326 audit(1760446736.853:1593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11726 comm="syz.7.1460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7ff10c5beec9 code=0x7ffc0000 [ 727.289283][ T37] audit: type=1326 audit(1760446736.853:1594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11726 comm="syz.7.1460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff10c5beec9 code=0x7ffc0000 [ 727.289623][ T37] audit: type=1326 audit(1760446736.853:1595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11726 comm="syz.7.1460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7ff10c5beec9 code=0x7ffc0000 [ 727.295283][ C0] vkms_vblank_simulate: vblank timer overrun [ 727.521456][ C0] vkms_vblank_simulate: vblank timer overrun [ 727.920163][ C0] vkms_vblank_simulate: vblank timer overrun [ 728.028655][T11388] gspca_se401: read req failed req 0x06 error -19 [ 728.030875][T11388] usb 9-1: USB disconnect, device number 7 [ 728.329623][ T10] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 729.203240][ C0] vkms_vblank_simulate: vblank timer overrun [ 729.204292][ T5813] Bluetooth: hci0: command 0x0406 tx timeout [ 729.204324][ T5813] Bluetooth: hci1: command 0x0406 tx timeout [ 729.204345][ T5813] Bluetooth: hci6: command 0x0c1a tx timeout [ 729.204366][ T5813] Bluetooth: hci2: command 0x0c1a tx timeout [ 729.236049][ T5806] Bluetooth: hci3: command 0x0c1a tx timeout [ 729.263345][ T10] usb 2-1: device descriptor read/64, error -71 [ 729.506275][ T10] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 729.636056][ T10] usb 2-1: device descriptor read/64, error -71 [ 729.751122][ T10] usb usb2-port1: attempt power cycle [ 729.986997][ C0] vkms_vblank_simulate: vblank timer overrun [ 730.064667][ C0] vkms_vblank_simulate: vblank timer overrun [ 730.146050][ T10] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 730.166958][ T10] usb 2-1: device descriptor read/8, error -71 [ 730.219721][T11764] hub 9-0:1.0: USB hub found [ 730.220275][T11764] hub 9-0:1.0: 1 port detected [ 730.406479][ T10] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 730.428522][ T10] usb 2-1: device descriptor read/8, error -71 [ 730.538067][ T10] usb usb2-port1: unable to enumerate USB device [ 731.206078][ T1231] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 731.236255][ T5806] Bluetooth: hci2: command 0x0c1a tx timeout [ 731.236287][ T5813] Bluetooth: hci6: command 0x0c1a tx timeout [ 731.288033][T11783] binder: 11782:11783 ioctl 4018620d 0 returned -22 [ 731.316885][ T5813] Bluetooth: hci3: command 0x0c1a tx timeout [ 731.394773][ T1231] usb 9-1: unable to get BOS descriptor or descriptor too short [ 731.408837][ T1231] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 731.408883][ T1231] usb 9-1: config 1 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 731.408909][ T1231] usb 9-1: config 1 interface 0 has no altsetting 0 [ 731.408924][ T1231] usb 9-1: config 1 interface 0 has no altsetting 1 [ 731.463760][ T1231] usb 9-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75 [ 731.463789][ T1231] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 731.463808][ T1231] usb 9-1: Product: syz [ 731.463821][ T1231] usb 9-1: Manufacturer: syz [ 731.463835][ T1231] usb 9-1: SerialNumber: syz [ 731.530749][T11388] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 731.701080][T11388] usb 2-1: unable to get BOS descriptor or descriptor too short [ 731.704848][T11388] usb 2-1: config 2 has an invalid interface number: 20 but max is 0 [ 731.704874][T11388] usb 2-1: config 2 has no interface number 0 [ 731.704905][T11388] usb 2-1: config 2 interface 20 has no altsetting 0 [ 731.868625][T11388] usb 2-1: New USB device found, idVendor=0f11, idProduct=1000, bcdDevice=e8.af [ 731.868655][T11388] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 731.868674][T11388] usb 2-1: Product: syz [ 731.868687][T11388] usb 2-1: Manufacturer: syz [ 731.868700][T11388] usb 2-1: SerialNumber: syz [ 731.870989][ T1231] smsusb:smsusb_probe: board id=8, interface number 0 [ 731.871023][ T1231] usb 9-1: selecting invalid altsetting 0 [ 731.871039][ T1231] smsusb:smsusb_probe: usb_set_interface failed, rc -22 [ 731.871069][ T1231] smsusb 9-1:1.0: probe with driver smsusb failed with error -22 [ 732.087444][ T9] usb 9-1: USB disconnect, device number 8 [ 732.367025][T11388] ldusb 2-1:2.20: Interrupt in endpoint not found [ 732.367951][T11425] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 732.395466][T11388] usb 2-1: USB disconnect, device number 61 [ 732.414775][T11783] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 732.420236][T11425] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 732.478782][T11425] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 732.566978][T11425] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 732.954070][T11425] 8021q: adding VLAN 0 to HW filter on device bond0 [ 733.015994][ T5886] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 733.016698][T11425] 8021q: adding VLAN 0 to HW filter on device team0 [ 733.090826][ T1231] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 733.166076][ T5886] usb 5-1: Using ep0 maxpacket: 16 [ 733.170367][ T5886] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 733.173836][ T5886] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 733.173862][ T5886] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 733.173881][ T5886] usb 5-1: Product: syz [ 733.173895][ T5886] usb 5-1: Manufacturer: syz [ 733.173908][ T5886] usb 5-1: SerialNumber: syz [ 733.177169][ T6075] bridge0: port 1(bridge_slave_0) entered blocking state [ 733.177304][ T6075] bridge0: port 1(bridge_slave_0) entered forwarding state [ 733.604041][ T6075] bridge0: port 2(bridge_slave_1) entered blocking state [ 733.604187][ T6075] bridge0: port 2(bridge_slave_1) entered forwarding state [ 733.648710][ T5813] Bluetooth: hci0: command 0x0406 tx timeout [ 733.665394][ T1231] usb 8-1: Using ep0 maxpacket: 8 [ 733.682107][ T1231] usb 8-1: config 0 has too many interfaces: 42, using maximum allowed: 32 [ 733.682132][ T1231] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 733.682151][ T1231] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 42 [ 733.682204][ T1231] usb 8-1: New USB device found, idVendor=0d46, idProduct=2012, bcdDevice=70.57 [ 733.682226][ T1231] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 733.739098][ T1231] usb 8-1: config 0 descriptor?? [ 733.740618][ T5886] r8152-cfgselector 5-1: Unknown version 0x0000 [ 733.740636][ T5886] r8152-cfgselector 5-1: config 0 descriptor?? [ 733.818201][ T1231] kobil_sct 8-1:0.0: required endpoints missing [ 734.728679][T11425] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 735.192479][T11853] tmpfs: Cannot change global quota limit on remount [ 735.385981][ T9] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 735.516161][ T9] usb 9-1: device descriptor read/64, error -71 [ 735.578469][T11425] veth0_vlan: entered promiscuous mode [ 735.592852][T11425] veth1_vlan: entered promiscuous mode [ 735.651401][T11425] veth0_macvtap: entered promiscuous mode [ 735.665645][T11425] veth1_macvtap: entered promiscuous mode [ 735.706873][T11425] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 735.724244][T11425] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 735.750753][ T1159] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.752994][ T1159] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.753057][ T1159] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.753093][ T1159] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.790916][ T9] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 735.852541][ T990] r8152-cfgselector 5-1: USB disconnect, device number 52 [ 735.927062][ T9] usb 9-1: device descriptor read/64, error -71 [ 735.945463][ T1231] usb 8-1: USB disconnect, device number 3 [ 736.041897][ T9] usb usb9-port1: attempt power cycle [ 736.278195][ T6075] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 736.278213][ T6075] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 736.406661][ T9] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 736.408551][ C1] vkms_vblank_simulate: vblank timer overrun [ 736.464462][ T9] usb 9-1: device descriptor read/8, error -71 [ 736.478233][ T37] kauditd_printk_skb: 11 callbacks suppressed [ 736.478248][ T37] audit: type=1326 audit(1760446746.043:1607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11877 comm="syz.1.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 736.503794][ T37] audit: type=1326 audit(1760446746.063:1608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11877 comm="syz.1.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fac6863d710 code=0x7ffc0000 [ 736.503843][ T37] audit: type=1326 audit(1760446746.063:1609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11877 comm="syz.1.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 736.503883][ T37] audit: type=1326 audit(1760446746.063:1610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11877 comm="syz.1.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 736.518190][ T37] audit: type=1326 audit(1760446746.083:1611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11877 comm="syz.1.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 736.518244][ T37] audit: type=1326 audit(1760446746.083:1612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11877 comm="syz.1.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 736.518284][ T37] audit: type=1326 audit(1760446746.083:1613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11877 comm="syz.1.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 736.521587][ T37] audit: type=1326 audit(1760446746.083:1614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11877 comm="syz.1.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 736.521635][ T37] audit: type=1326 audit(1760446746.083:1615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11877 comm="syz.1.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 736.521676][ T37] audit: type=1326 audit(1760446746.083:1616): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11877 comm="syz.1.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fac6863eec9 code=0x7ffc0000 [ 736.613620][ T1155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 736.613639][ T1155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 736.815969][ T9] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 736.838976][ T9] usb 9-1: device descriptor read/8, error -71 [ 736.972518][ C1] vkms_vblank_simulate: vblank timer overrun [ 736.988103][ T9] usb usb9-port1: unable to enumerate USB device [ 737.596775][ C1] vkms_vblank_simulate: vblank timer overrun [ 738.607433][ C1] vkms_vblank_simulate: vblank timer overrun [ 738.673281][ C1] vkms_vblank_simulate: vblank timer overrun [ 738.788726][ C1] vkms_vblank_simulate: vblank timer overrun [ 739.608210][ C1] vkms_vblank_simulate: vblank timer overrun [ 740.516236][ T5886] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 740.657524][ C1] vkms_vblank_simulate: vblank timer overrun [ 741.546370][ T5886] usb 7-1: Using ep0 maxpacket: 16 [ 741.591682][ T5886] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 741.613882][ T5886] usb 7-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 741.613911][ T5886] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 741.613929][ T5886] usb 7-1: Product: syz [ 741.613938][ T5886] usb 7-1: Manufacturer: syz [ 741.613945][ T5886] usb 7-1: SerialNumber: syz [ 741.743549][ T5886] r8152-cfgselector 7-1: Unknown version 0x0000 [ 741.743565][ T5886] r8152-cfgselector 7-1: config 0 descriptor?? [ 742.006100][ T10] r8152-cfgselector 7-1: USB disconnect, device number 2 [ 743.897737][ C1] vkms_vblank_simulate: vblank timer overrun [ 744.910626][ C1] vkms_vblank_simulate: vblank timer overrun [ 745.423631][T11982] sctp: [Deprecated]: syz.8.1503 (pid 11982) Use of int in max_burst socket option deprecated. [ 745.423631][T11982] Use struct sctp_assoc_value instead [ 746.436577][ T990] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 746.622690][ T990] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 746.800569][ T990] usb 9-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 746.800781][ T990] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 746.801126][ T990] usb 9-1: Product: syz [ 746.801142][ T990] usb 9-1: Manufacturer: syz [ 746.801155][ T990] usb 9-1: SerialNumber: syz [ 747.377959][ C1] vkms_vblank_simulate: vblank timer overrun [ 747.539996][ T990] usb 9-1: config 0 descriptor?? [ 747.645268][ T990] usb 9-1: can't set config #0, error -71 [ 747.928014][ T990] usb 9-1: USB disconnect, device number 13 [ 748.021982][ T37] kauditd_printk_skb: 3 callbacks suppressed [ 748.022002][ T37] audit: type=1326 audit(1760446757.573:1620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11994 comm="syz.8.1506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 748.022050][ T37] audit: type=1326 audit(1760446757.583:1621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11994 comm="syz.8.1506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 748.023560][ T37] audit: type=1326 audit(1760446757.583:1622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11994 comm="syz.8.1506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f544b37d710 code=0x7ffc0000 [ 748.023608][ T37] audit: type=1326 audit(1760446757.583:1623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11994 comm="syz.8.1506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 748.023653][ T37] audit: type=1326 audit(1760446757.583:1624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11994 comm="syz.8.1506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 748.030701][ T37] audit: type=1326 audit(1760446757.583:1625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11994 comm="syz.8.1506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 748.030756][ T37] audit: type=1326 audit(1760446757.583:1626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11994 comm="syz.8.1506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 748.030798][ T37] audit: type=1326 audit(1760446757.583:1627): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11994 comm="syz.8.1506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 748.030839][ T37] audit: type=1326 audit(1760446757.583:1628): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11994 comm="syz.8.1506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=302 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 748.032537][ T37] audit: type=1326 audit(1760446757.593:1629): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11994 comm="syz.8.1506" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544b37eec9 code=0x7ffc0000 [ 748.307122][ T9] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 748.456092][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 748.571275][ T9] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 33, using maximum allowed: 30 [ 748.571324][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 33 [ 748.571366][ T9] usb 5-1: New USB device found, idVendor=17ef, idProduct=6009, bcdDevice= 0.00 [ 748.571387][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 748.658237][ T9] usb 5-1: config 0 descriptor?? [ 749.104869][T11998] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 749.135446][T11998] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 749.656051][ T990] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 749.830481][ T9] usbhid 5-1:0.0: can't add hid device: -71 [ 749.830606][ T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 749.850282][ T990] usb 8-1: config 0 has an invalid interface number: 64 but max is 0 [ 749.850307][ T990] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 749.850326][ T990] usb 8-1: config 0 has no interface number 0 [ 749.855980][ T990] usb 8-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 749.856005][ T990] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.856025][ T990] usb 8-1: Product: syz [ 749.856039][ T990] usb 8-1: Manufacturer: syz [ 749.856054][ T990] usb 8-1: SerialNumber: syz [ 749.957938][ T9] usb 5-1: USB disconnect, device number 53 [ 749.977003][ T990] usb 8-1: config 0 descriptor?? [ 750.008030][ T990] uvcvideo 8-1:0.64: probe with driver uvcvideo failed with error -22 [ 751.669150][ T990] usb 8-1: USB disconnect, device number 4 [ 752.006588][ C1] vkms_vblank_simulate: vblank timer overrun [ 752.449185][ C1] vkms_vblank_simulate: vblank timer overrun [ 752.886191][ C1] vkms_vblank_simulate: vblank timer overrun [ 752.951378][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 752.952424][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 753.607548][ C1] vkms_vblank_simulate: vblank timer overrun [ 753.745958][ C1] vkms_vblank_simulate: vblank timer overrun [ 754.157460][ C1] vkms_vblank_simulate: vblank timer overrun [ 754.520441][ C1] vkms_vblank_simulate: vblank timer overrun [ 755.006104][T11388] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 755.172420][T11388] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 755.172450][T11388] usb 2-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 755.172468][T11388] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 755.172487][T11388] usb 2-1: config 220 has no interface number 2 [ 755.172594][T11388] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 755.172620][T11388] usb 2-1: config 220 interface 0 has no altsetting 0 [ 755.172637][T11388] usb 2-1: config 220 interface 76 has no altsetting 0 [ 755.172654][T11388] usb 2-1: config 220 interface 1 has no altsetting 0 [ 755.179629][T11388] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 755.179657][T11388] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 755.179676][T11388] usb 2-1: Product: syz [ 755.179689][T11388] usb 2-1: Manufacturer: syz [ 755.179702][T11388] usb 2-1: SerialNumber: syz [ 755.383971][T12077] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 755.383998][T12077] CIFS mount error: No usable UNC path provided in device string! [ 755.383998][T12077] [ 755.384415][T12077] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 755.603730][T12082] overlay: Unknown parameter '/' [ 755.603792][T11388] usb 2-1: selecting invalid altsetting 0 [ 755.604388][T11388] uvcvideo 2-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 755.604417][T11388] uvcvideo 2-1:220.0: No valid video chain found. [ 755.643154][ C1] vkms_vblank_simulate: vblank timer overrun [ 755.667604][T12077] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 755.700184][T11388] usb 2-1: selecting invalid altsetting 0 [ 755.700225][T11388] usbtest 2-1:220.1: probe with driver usbtest failed with error -22 [ 755.742554][T11388] usb 2-1: USB disconnect, device number 62 [ 755.785132][T12083] netlink: 'syz.6.1524': attribute type 11 has an invalid length. [ 756.557041][ C1] vkms_vblank_simulate: vblank timer overrun [ 757.165563][ C1] vkms_vblank_simulate: vblank timer overrun [ 760.033625][ T5866] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 760.181756][ T5866] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 760.181786][ T5866] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 760.181805][ T5866] usb 2-1: Product: syz [ 760.181818][ T5866] usb 2-1: Manufacturer: syz [ 760.181829][ T5866] usb 2-1: SerialNumber: syz [ 760.223972][ T5866] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 761.310263][ T10] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 762.606560][ T10] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 762.606773][ T10] ath9k_htc: Failed to initialize the device [ 762.923973][ T10] usb 2-1: ath9k_htc: USB layer deinitialized [ 763.246420][T12170] netlink: 'syz.1.1539': attribute type 10 has an invalid length. [ 764.326068][T12170] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 765.010055][T12196] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1548'. [ 765.096088][ T31] usb 2-1: USB disconnect, device number 63 [ 767.918377][T12226] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1556'. [ 769.433091][ T37] kauditd_printk_skb: 4 callbacks suppressed [ 769.433109][ T37] audit: type=1804 audit(1760446778.993:1634): pid=12245 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.7.1559" name="/newroot/38/file0" dev="tmpfs" ino=213 res=1 errno=0 [ 769.456009][ T5866] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 769.959208][ T5866] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 769.959256][ T5866] usb 7-1: New USB device found, idVendor=054c, idProduct=0268, bcdDevice= 0.00 [ 769.959279][ T5866] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 770.018138][ T5866] usb 7-1: config 0 descriptor?? [ 771.753810][T12241] macvlan0: entered promiscuous mode [ 771.913386][T12241] netlink: 'syz.6.1560': attribute type 2 has an invalid length. [ 772.186503][ T5866] sony 0003:054C:0268.000A: unbalanced delimiter at end of report description [ 772.187038][ T5866] sony 0003:054C:0268.000A: parse failed [ 772.187101][ T5866] sony 0003:054C:0268.000A: probe with driver sony failed with error -22 [ 772.196085][T11388] usb 8-1: new low-speed USB device number 5 using dummy_hcd [ 772.345953][T11388] usb 8-1: Invalid ep0 maxpacket: 32 [ 772.476020][T11388] usb 8-1: new low-speed USB device number 6 using dummy_hcd [ 772.626037][T11388] usb 8-1: Invalid ep0 maxpacket: 32 [ 772.626704][T11388] usb usb8-port1: attempt power cycle [ 773.008131][T11388] usb 8-1: new low-speed USB device number 7 using dummy_hcd [ 773.030350][T11388] usb 8-1: Invalid ep0 maxpacket: 32 [ 773.285985][T11388] usb 8-1: new low-speed USB device number 8 using dummy_hcd [ 773.330439][T11388] usb 8-1: Invalid ep0 maxpacket: 32 [ 773.331908][T11388] usb usb8-port1: unable to enumerate USB device [ 774.305968][T11388] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 774.486148][T11388] usb 9-1: Using ep0 maxpacket: 32 [ 774.488225][T11388] usb 9-1: config 0 has an invalid interface number: 67 but max is 0 [ 774.488239][T11388] usb 9-1: config 0 has no interface number 0 [ 774.496441][T11388] usb 9-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 774.496466][T11388] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 774.496485][T11388] usb 9-1: Product: syz [ 774.496497][T11388] usb 9-1: Manufacturer: syz [ 774.496511][T11388] usb 9-1: SerialNumber: syz [ 774.679130][T11388] usb 9-1: config 0 descriptor?? [ 774.708088][T11388] smsc95xx v2.0.0 [ 775.113476][T11388] smsc95xx 9-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 775.113518][T11388] smsc95xx 9-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 775.923368][T12313] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1570'. [ 777.003864][T11388] smsc95xx 9-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000104: -71 [ 777.004049][T11388] smsc95xx 9-1:0.67: probe with driver smsc95xx failed with error -71 [ 777.053455][T11388] usb 9-1: USB disconnect, device number 14 [ 777.449013][T12320] syz.8.1572: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 777.456200][T12320] CPU: 1 UID: 0 PID: 12320 Comm: syz.8.1572 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 777.456224][T12320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 777.456236][T12320] Call Trace: [ 777.456244][T12320] [ 777.456253][T12320] dump_stack_lvl+0x189/0x250 [ 777.456282][T12320] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 777.456304][T12320] ? __pfx_dump_stack_lvl+0x10/0x10 [ 777.456328][T12320] ? __pfx__printk+0x10/0x10 [ 777.456352][T12320] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 777.456380][T12320] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 777.456416][T12320] warn_alloc+0x22e/0x3b0 [ 777.456442][T12320] ? stack_depot_save_flags+0x41b/0x860 [ 777.456473][T12320] ? __pfx_warn_alloc+0x10/0x10 [ 777.456496][T12320] ? kasan_save_track+0x3e/0x80 [ 777.456513][T12320] ? __kasan_kmalloc+0x93/0xb0 [ 777.456542][T12320] ? xsk_setsockopt+0x4dc/0x8d0 [ 777.456567][T12320] ? do_sock_setsockopt+0x17c/0x1b0 [ 777.456593][T12320] ? __x64_sys_setsockopt+0x145/0x1b0 [ 777.456618][T12320] ? do_syscall_64+0xfa/0xfa0 [ 777.456644][T12320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.456675][T12320] __vmalloc_node_range_noprof+0x125/0x12d0 [ 777.456729][T12320] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 777.456755][T12320] ? __kasan_kmalloc+0x93/0xb0 [ 777.456781][T12320] vmalloc_user_noprof+0xad/0xf0 [ 777.456802][T12320] ? xskq_create+0xbf/0x170 [ 777.456828][T12320] xskq_create+0xbf/0x170 [ 777.456858][T12320] xsk_init_queue+0xb0/0x110 [ 777.456888][T12320] xsk_setsockopt+0x4dc/0x8d0 [ 777.456916][T12320] ? __pfx_xsk_setsockopt+0x10/0x10 [ 777.456951][T12320] ? __fget_files+0x2a/0x420 [ 777.456976][T12320] ? __fget_files+0x2a/0x420 [ 777.456995][T12320] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 777.457016][T12320] ? __pfx_xsk_setsockopt+0x10/0x10 [ 777.457043][T12320] do_sock_setsockopt+0x17c/0x1b0 [ 777.457076][T12320] __x64_sys_setsockopt+0x145/0x1b0 [ 777.457111][T12320] do_syscall_64+0xfa/0xfa0 [ 777.457151][T12320] ? lockdep_hardirqs_on+0x9c/0x150 [ 777.457180][T12320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.457200][T12320] ? clear_bhb_loop+0x60/0xb0 [ 777.457225][T12320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.457244][T12320] RIP: 0033:0x7f544b37eec9 [ 777.457263][T12320] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 777.457279][T12320] RSP: 002b:00007f54495e6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 777.457298][T12320] RAX: ffffffffffffffda RBX: 00007f544b5d5fa0 RCX: 00007f544b37eec9 [ 777.457314][T12320] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000007 [ 777.457326][T12320] RBP: 00007f544b401f91 R08: 0000000000000052 R09: 0000000000000000 [ 777.457340][T12320] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 777.457353][T12320] R13: 00007f544b5d6038 R14: 00007f544b5d5fa0 R15: 00007ffe542fe598 [ 777.457389][T12320] [ 777.457406][T12320] Mem-Info: [ 777.457415][T12320] active_anon:3149 inactive_anon:48104 isolated_anon:0 [ 777.457415][T12320] active_file:19674 inactive_file:38987 isolated_file:0 [ 777.457415][T12320] unevictable:768 dirty:1915 writeback:550 [ 777.457415][T12320] slab_reclaimable:12441 slab_unreclaimable:108172 [ 777.457415][T12320] mapped:44883 shmem:43947 pagetables:1729 [ 777.457415][T12320] sec_pagetables:0 bounce:0 [ 777.457415][T12320] kernel_misc_reclaimable:0 [ 777.457415][T12320] free:1262685 free_pcp:2772 free_cma:0 [ 777.457472][T12320] Node 0 active_anon:12596kB inactive_anon:192416kB active_file:78252kB inactive_file:155948kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:179316kB dirty:7660kB writeback:2200kB shmem:174252kB kernel_stack:13908kB pagetables:6760kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 777.457524][T12320] Node 1 active_anon:0kB inactive_anon:0kB active_file:444kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:216kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:48kB pagetables:156kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 777.457566][T12320] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 777.457622][T12320] lowmem_reserve[]: 0 2514 2515 2515 2515 [ 777.457653][T12320] Node 0 DMA32 free:1127632kB boost:0kB min:3940kB low:6484kB high:9028kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12596kB inactive_anon:192416kB active_file:78252kB inactive_file:155948kB unevictable:1536kB writepending:9860kB zspages:0kB present:3129332kB managed:2574612kB mlocked:0kB bounce:0kB free_pcp:11088kB local_pcp:2764kB free_cma:0kB [ 777.457713][T12320] lowmem_reserve[]: 0 0 1 1 1 [ 777.457745][T12320] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1388kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 777.457797][T12320] lowmem_reserve[]: 0 0 0 0 0 [ 777.484480][T12320] Node 1 Normal free:3907748kB boost:0kB min:6360kB low:10468kB high:14576kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:444kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 777.484561][T12320] lowmem_reserve[]: 0 0 0 0 0 [ 777.484598][T12320] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 777.484721][T12320] Node 0 DMA32: 1*4kB (E) 1*8kB (U) 2*16kB (ME) 19*32kB (UME) 306*64kB (UE) 157*128kB (UE) 35*256kB (UM) 26*512kB (U) 4*1024kB (UME) 4*2048kB (UME) 257*4096kB (UM) = 1127564kB [ 777.484871][T12320] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 777.484964][T12320] Node 1 Normal: 199*4kB (UME) 43*8kB (UE) 33*16kB (UE) 215*32kB (UE) 107*64kB (UE) 27*128kB (UE) 15*256kB (UME) 8*512kB (UME) 2*1024kB (UM) 2*2048kB (UE) 946*4096kB (M) = 3907748kB [ 777.485119][T12320] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 777.485136][T12320] Node 0 hugepages_total=6 hugepages_free=6 hugepages_surp=4 hugepages_size=2048kB [ 777.485151][T12320] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 777.485167][T12320] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 777.485182][T12320] 102679 total pagecache pages [ 777.485193][T12320] 0 pages in swap cache [ 777.485200][T12320] Free swap = 124996kB [ 777.485208][T12320] Total swap = 124996kB [ 777.485216][T12320] 2097051 pages RAM [ 777.485223][T12320] 0 pages HighMem/MovableOnly [ 777.485230][T12320] 421436 pages reserved [ 777.485237][T12320] 0 pages cma reserved [ 777.766051][T11388] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 778.085953][T11388] usb 9-1: Using ep0 maxpacket: 16 [ 778.090181][T11388] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 778.090210][T11388] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 778.090231][T11388] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 778.090271][T11388] usb 9-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 778.090293][T11388] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 778.119147][T11388] usb 9-1: config 0 descriptor?? [ 778.395314][T11388] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/input/input24 [ 778.407491][ T5151] pxrc 9-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 778.704243][T11388] usb 9-1: USB disconnect, device number 15 [ 780.557242][T11388] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 780.739844][T11388] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 780.739869][T11388] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 780.741362][T11388] usb 9-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 780.741387][T11388] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 780.741405][T11388] usb 9-1: SerialNumber: syz [ 780.991860][T12332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 780.992406][T12332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 781.002648][T11388] usb 9-1: 0:2 : does not exist [ 781.097554][ T5866] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 781.226888][T11388] usb 9-1: USB disconnect, device number 16 [ 781.251488][ T5866] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 781.251513][ T5866] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 781.252782][ T5866] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 781.252808][ T5866] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 781.252825][ T5866] usb 2-1: SerialNumber: syz [ 781.550332][T11729] udevd[11729]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 781.627775][T12356] FAULT_INJECTION: forcing a failure. [ 781.627775][T12356] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 781.627809][T12356] CPU: 1 UID: 0 PID: 12356 Comm: syz.4.1579 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 781.627830][T12356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 781.627852][T12356] Call Trace: [ 781.627860][T12356] [ 781.627868][T12356] dump_stack_lvl+0x189/0x250 [ 781.627894][T12356] ? __pfx____ratelimit+0x10/0x10 [ 781.627921][T12356] ? __pfx_dump_stack_lvl+0x10/0x10 [ 781.627943][T12356] ? __pfx__printk+0x10/0x10 [ 781.627965][T12356] ? __might_fault+0xb0/0x130 [ 781.627996][T12356] should_fail_ex+0x46c/0x600 [ 781.628025][T12356] _copy_from_user+0x2d/0xb0 [ 781.628045][T12356] memdup_user+0x5e/0xd0 [ 781.628071][T12356] strndup_user+0x68/0xd0 [ 781.628095][T12356] __se_sys_fsopen+0x3d/0x2b0 [ 781.628122][T12356] do_syscall_64+0xfa/0xfa0 [ 781.628147][T12356] ? lockdep_hardirqs_on+0x9c/0x150 [ 781.628173][T12356] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 781.628191][T12356] ? clear_bhb_loop+0x60/0xb0 [ 781.628214][T12356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 781.628232][T12356] RIP: 0033:0x7f234ee1eec9 [ 781.628248][T12356] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 781.628264][T12356] RSP: 002b:00007f234d07e038 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 781.628285][T12356] RAX: ffffffffffffffda RBX: 00007f234f075fa0 RCX: 00007f234ee1eec9 [ 781.628301][T12356] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000000 [ 781.628312][T12356] RBP: 00007f234d07e090 R08: 0000000000000000 R09: 0000000000000000 [ 781.628324][T12356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 781.628335][T12356] R13: 00007f234f076038 R14: 00007f234f075fa0 R15: 00007ffd469dafe8 [ 781.628367][T12356] [ 781.997580][T12347] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 782.031870][T12347] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 782.142004][ T5866] usb 2-1: 0:2 : does not exist [ 782.296153][ T5866] usb 2-1: USB disconnect, device number 64 [ 782.366051][ T31] usb 8-1: new full-speed USB device number 9 using dummy_hcd [ 782.449604][T11729] udevd[11729]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 782.519419][ T31] usb 8-1: config 6 has an invalid interface number: 2 but max is 0 [ 782.519446][ T31] usb 8-1: config 6 has no interface number 0 [ 782.519493][ T31] usb 8-1: config 6 interface 2 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 782.519515][ T31] usb 8-1: config 6 interface 2 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 782.577483][ T31] usb 8-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 782.577514][ T31] usb 8-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 782.577534][ T31] usb 8-1: Product: syz [ 782.577547][ T31] usb 8-1: Manufacturer: syz [ 782.577560][ T31] usb 8-1: SerialNumber: syz [ 782.668774][ T31] hso 8-1:6.2: Failed to find INT IN ep [ 782.901353][ T31] usb 8-1: USB disconnect, device number 9 [ 783.355505][ T5866] usb 7-1: USB disconnect, device number 3 [ 783.982123][ C1] vkms_vblank_simulate: vblank timer overrun [ 784.025952][ T5785] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 784.269522][ C1] vkms_vblank_simulate: vblank timer overrun [ 784.274887][ T31] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 784.499026][ T31] usb 8-1: Using ep0 maxpacket: 16 [ 784.748735][ C1] vkms_vblank_simulate: vblank timer overrun [ 784.763301][ T31] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 784.763334][ T31] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 784.763377][ T31] usb 8-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 784.763400][ T31] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 784.818523][ T31] usb 8-1: config 0 descriptor?? [ 785.016124][ T5866] usb 9-1: new full-speed USB device number 17 using dummy_hcd [ 785.041630][ T5785] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 785.041656][ T5785] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 785.043355][ T5785] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 785.043381][ T5785] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 785.043401][ T5785] usb 2-1: SerialNumber: syz [ 785.052228][T12414] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1596'. [ 785.181661][ T5866] usb 9-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0xB2, changing to 0x82 [ 785.181694][ T5866] usb 9-1: config 36 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 785.181773][ T5866] usb 9-1: config 36 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 785.183948][ T5866] usb 9-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice= 0.06 [ 785.184025][ T5866] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=16 [ 785.184047][ T5866] usb 9-1: SerialNumber: syz [ 785.280374][ T31] input: HID 045e:07da as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/0003:045E:07DA.000B/input/input25 [ 785.337848][T12402] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 785.339957][T12402] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 785.411562][ T5785] usb 2-1: 0:2 : does not exist [ 785.423938][ T31] microsoft 0003:045E:07DA.000B: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.7-1/input0 [ 785.596748][ T6102] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 785.602043][T12420] ptrace attach of "./syz-executor exec"[5797] was attempted by "./syz-executor exec"[12420] [ 785.651145][ T5785] usb 2-1: USB disconnect, device number 65 [ 785.746002][ T6102] usb 7-1: Using ep0 maxpacket: 16 [ 785.772943][ T6102] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 785.772969][ T6102] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 785.878186][ T6102] usb 7-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice=b4.5b [ 785.879113][ T6102] usb 7-1: New USB device strings: Mfr=1, Product=130, SerialNumber=3 [ 785.879137][ T6102] usb 7-1: Product: syz [ 785.879152][ T6102] usb 7-1: Manufacturer: syz [ 785.879166][ T6102] usb 7-1: SerialNumber: syz [ 786.211299][T12422] befs: (nbd4): No write support. Marking filesystem read-only [ 786.250583][T12422] befs: (nbd4): unable to read superblock [ 786.778470][ T6102] usb 7-1: config 0 descriptor?? [ 787.132302][ T990] usb 7-1: USB disconnect, device number 4 [ 787.509536][T11717] udevd[11717]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 787.632244][ T10] usb 8-1: USB disconnect, device number 10 [ 787.672922][ T5866] yealink 9-1:36.0: invalid payload size 0, expected 16 [ 787.687985][ T5866] input: Yealink usb-p1k as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:36.0/input/input26 [ 787.897081][T12434] trusted_key: syz.7.1600 sent an empty control message without MSG_MORE. [ 787.925118][ C0] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 787.925368][ C0] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 787.925598][ C0] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 787.925877][ C0] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 787.926109][ C0] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 787.926829][ C0] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 787.927061][ C0] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 787.927292][ C0] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 787.927312][ C0] yealink 9-1:36.0: urb_ctl_callback - usb_submit_urb failed -90 [ 788.144696][ T5866] usb 9-1: USB disconnect, device number 17 [ 788.480843][ C1] vkms_vblank_simulate: vblank timer overrun [ 788.745230][ C1] vkms_vblank_simulate: vblank timer overrun [ 789.073117][ C1] vkms_vblank_simulate: vblank timer overrun [ 789.486167][ T1231] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 789.635918][ T1231] usb 5-1: Using ep0 maxpacket: 16 [ 789.638368][ T1231] usb 5-1: config 0 has an invalid interface number: 35 but max is 0 [ 789.638391][ T1231] usb 5-1: config 0 has no interface number 0 [ 789.638440][ T1231] usb 5-1: config 0 interface 35 altsetting 0 has an endpoint descriptor with address 0x7A, changing to 0xA [ 789.638465][ T1231] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0xA has an invalid bInterval 70, changing to 10 [ 789.638491][ T1231] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 789.645690][ T1231] usb 5-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=3e.04 [ 789.645718][ T1231] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 789.645738][ T1231] usb 5-1: Product: syz [ 789.645752][ T1231] usb 5-1: Manufacturer: syz [ 789.645766][ T1231] usb 5-1: SerialNumber: syz [ 789.743731][ T1231] usb 5-1: config 0 descriptor?? [ 789.958843][ T1231] usb 5-1: USB disconnect, device number 54 [ 790.318862][T12480] can0: slcan on ttyprintk. [ 790.491384][ C1] vkms_vblank_simulate: vblank timer overrun [ 790.594975][ C1] vkms_vblank_simulate: vblank timer overrun [ 790.707901][T12487] FAULT_INJECTION: forcing a failure. [ 790.707901][T12487] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 790.707935][T12487] CPU: 1 UID: 0 PID: 12487 Comm: syz.1.1614 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 790.707957][T12487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 790.707970][T12487] Call Trace: [ 790.707978][T12487] [ 790.707988][T12487] dump_stack_lvl+0x189/0x250 [ 790.708016][T12487] ? __pfx____ratelimit+0x10/0x10 [ 790.708043][T12487] ? __pfx_dump_stack_lvl+0x10/0x10 [ 790.708066][T12487] ? __pfx__printk+0x10/0x10 [ 790.708108][T12487] should_fail_ex+0x46c/0x600 [ 790.708137][T12487] _copy_to_user+0x31/0xb0 [ 790.708159][T12487] simple_read_from_buffer+0xe1/0x170 [ 790.708191][T12487] proc_fail_nth_read+0x1b6/0x220 [ 790.708219][T12487] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 790.708247][T12487] ? rw_verify_area+0x2ac/0x4e0 [ 790.708273][T12487] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 790.708298][T12487] vfs_read+0x206/0xa30 [ 790.708334][T12487] ? __pfx_vfs_read+0x10/0x10 [ 790.708357][T12487] ? try_to_take_rt_mutex+0x7fd/0xac0 [ 790.708391][T12487] ? mutex_lock_nested+0x154/0x1d0 [ 790.708413][T12487] ? fdget_pos+0x253/0x320 [ 790.708443][T12487] ksys_read+0x14b/0x260 [ 790.708472][T12487] ? __pfx_ksys_read+0x10/0x10 [ 790.708503][T12487] ? do_syscall_64+0xbe/0xfa0 [ 790.708535][T12487] do_syscall_64+0xfa/0xfa0 [ 790.708560][T12487] ? lockdep_hardirqs_on+0x9c/0x150 [ 790.708585][T12487] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 790.708605][T12487] ? clear_bhb_loop+0x60/0xb0 [ 790.708629][T12487] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 790.708648][T12487] RIP: 0033:0x7fac6863d8dc [ 790.708666][T12487] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 790.708682][T12487] RSP: 002b:00007fac6689e030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 790.708703][T12487] RAX: ffffffffffffffda RBX: 00007fac68895fa0 RCX: 00007fac6863d8dc [ 790.708718][T12487] RDX: 000000000000000f RSI: 00007fac6689e0a0 RDI: 0000000000000003 [ 790.708730][T12487] RBP: 00007fac6689e090 R08: 0000000000000000 R09: 0000000000000000 [ 790.708741][T12487] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000001 [ 790.708752][T12487] R13: 00007fac68896038 R14: 00007fac68895fa0 R15: 00007ffd341471d8 [ 790.708785][T12487] [ 791.115999][ T10] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 791.267375][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 791.271003][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 791.274821][ T10] usb 5-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice=b4.5b [ 791.274847][ T10] usb 5-1: New USB device strings: Mfr=1, Product=130, SerialNumber=3 [ 791.274867][ T10] usb 5-1: Product: syz [ 791.274880][ T10] usb 5-1: Manufacturer: syz [ 791.274894][ T10] usb 5-1: SerialNumber: syz [ 791.288547][ T10] usb 5-1: config 0 descriptor?? [ 791.519804][ T10] usb 5-1: USB disconnect, device number 55 [ 791.526401][T12479] can0 (unregistered): slcan off ttyprintk. [ 794.466541][T12538] FAULT_INJECTION: forcing a failure. [ 794.466541][T12538] name failslab, interval 1, probability 0, space 0, times 0 [ 794.466574][T12538] CPU: 1 UID: 0 PID: 12538 Comm: syz.4.1628 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 794.466597][T12538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 794.466609][T12538] Call Trace: [ 794.466627][T12538] [ 794.466637][T12538] dump_stack_lvl+0x189/0x250 [ 794.466665][T12538] ? __pfx____ratelimit+0x10/0x10 [ 794.466692][T12538] ? __pfx_dump_stack_lvl+0x10/0x10 [ 794.466714][T12538] ? __pfx__printk+0x10/0x10 [ 794.466743][T12538] ? __pfx___might_resched+0x10/0x10 [ 794.466773][T12538] should_fail_ex+0x46c/0x600 [ 794.466804][T12538] should_failslab+0xa8/0x100 [ 794.466826][T12538] __kmalloc_noprof+0xcc/0x7d0 [ 794.466845][T12538] ? kfree+0x51/0x950 [ 794.466868][T12538] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 794.466899][T12538] tomoyo_realpath_from_path+0xe3/0x5d0 [ 794.466927][T12538] ? tomoyo_domain+0xda/0x130 [ 794.466958][T12538] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 794.466980][T12538] tomoyo_path_number_perm+0x1e8/0x5a0 [ 794.467007][T12538] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 794.467034][T12538] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 794.467063][T12538] ? lockdep_hardirqs_on+0x9c/0x150 [ 794.467122][T12538] ? __fget_files+0x2a/0x420 [ 794.467148][T12538] ? __fget_files+0x3a6/0x420 [ 794.467167][T12538] ? __fget_files+0x2a/0x420 [ 794.467191][T12538] security_file_ioctl+0xcb/0x2d0 [ 794.467216][T12538] __se_sys_ioctl+0x47/0x170 [ 794.467245][T12538] do_syscall_64+0xfa/0xfa0 [ 794.467271][T12538] ? lockdep_hardirqs_on+0x9c/0x150 [ 794.467297][T12538] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 794.467316][T12538] ? clear_bhb_loop+0x60/0xb0 [ 794.467339][T12538] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 794.467358][T12538] RIP: 0033:0x7f234ee1eec9 [ 794.467375][T12538] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 794.467393][T12538] RSP: 002b:00007f234d07e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 794.467414][T12538] RAX: ffffffffffffffda RBX: 00007f234f075fa0 RCX: 00007f234ee1eec9 [ 794.467429][T12538] RDX: 0000200000000140 RSI: 0000000040085112 RDI: 0000000000000003 [ 794.467442][T12538] RBP: 00007f234d07e090 R08: 0000000000000000 R09: 0000000000000000 [ 794.467455][T12538] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 794.467467][T12538] R13: 00007f234f076038 R14: 00007f234f075fa0 R15: 00007ffd469dafe8 [ 794.467507][T12538] [ 794.467515][T12538] ERROR: Out of memory at tomoyo_realpath_from_path. [ 794.515969][ T5813] Bluetooth: hci6: command 0x0c1a tx timeout [ 795.991315][T12556] qrtr: Invalid version 0 [ 796.049721][ T31] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 796.206176][ T31] usb 2-1: Using ep0 maxpacket: 16 [ 796.209221][ T31] usb 2-1: config 4 has an invalid interface number: 9 but max is 0 [ 796.209245][ T31] usb 2-1: config 4 has no interface number 0 [ 796.209296][ T31] usb 2-1: config 4 interface 9 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 796.209320][ T31] usb 2-1: config 4 interface 9 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 796.209342][ T31] usb 2-1: config 4 interface 9 has no altsetting 0 [ 796.223943][ T31] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=76.fe [ 796.224032][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 796.224052][ T31] usb 2-1: Product: syz [ 796.224066][ T31] usb 2-1: Manufacturer: syz [ 796.224081][ T31] usb 2-1: SerialNumber: syz [ 796.289133][T12551] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 796.289398][T12551] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 796.401189][ T31] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 796.616144][ T10] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 796.780256][ T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 796.780285][ T10] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 796.808242][ T10] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 796.808271][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 796.808292][ T10] usb 5-1: SerialNumber: syz [ 797.099129][ T1231] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 797.125343][T12563] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 797.139359][T12563] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 797.212771][ T10] usb 5-1: 0:2 : does not exist [ 797.247711][ T1231] usb 8-1: Using ep0 maxpacket: 16 [ 797.257285][ T1231] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 797.306550][ T1231] usb 8-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice=b4.5b [ 797.306582][ T1231] usb 8-1: New USB device strings: Mfr=1, Product=130, SerialNumber=3 [ 797.306603][ T1231] usb 8-1: Product: syz [ 797.306617][ T1231] usb 8-1: Manufacturer: syz [ 797.306631][ T1231] usb 8-1: SerialNumber: syz [ 797.374636][ T1231] usb 8-1: config 0 descriptor?? [ 797.495205][ T1155] usb 2-1: Failed to submit usb control message: -110 [ 797.495242][ T1155] usb 2-1: unable to send the bmi data to the device: -110 [ 797.495260][ T1155] usb 2-1: unable to get target info from device [ 797.495276][ T1155] usb 2-1: could not get target info (-110) [ 797.495399][ T1155] usb 2-1: could not probe fw (-110) [ 797.530598][ T10] usb 5-1: USB disconnect, device number 56 [ 797.614150][T11729] udevd[11729]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 797.709671][ C1] vkms_vblank_simulate: vblank timer overrun [ 797.804020][ T1231] usb 8-1: USB disconnect, device number 11 [ 798.471428][T12594] qrtr: Invalid version 0 [ 798.622279][ T37] audit: type=1800 audit(1760446808.183:1635): pid=12551 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.1632" name="bus" dev="ramfs" ino=41031 res=0 errno=0 [ 798.682507][T12599] netlink: 112 bytes leftover after parsing attributes in process `syz.6.1648'. [ 798.682548][T12599] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1648'. [ 798.682564][T12599] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1648'. [ 798.868068][ T5785] usb 2-1: USB disconnect, device number 66 [ 800.014890][ C1] vkms_vblank_simulate: vblank timer overrun [ 800.227664][ C1] vkms_vblank_simulate: vblank timer overrun [ 800.717178][T12629] Bluetooth: hci0: unsupported parameter 512 [ 800.717202][T12629] Bluetooth: hci0: invalid length 0, exp 2 for type 5 [ 800.862497][T12628] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1655'. [ 800.921723][T12635] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1660'. [ 800.989658][T12628] 8021q: adding VLAN 0 to HW filter on device bond2 [ 801.015396][T12636] bond2: (slave vlan2): Error -34 calling dev_set_mtu [ 801.321595][T12644] ieee802154 phy0 wpan0: encryption failed: -22 [ 801.374968][T12641] team0: Port device bond0 removed [ 801.388071][T12641] bridge_slave_0: left allmulticast mode [ 801.388097][T12641] bridge_slave_0: left promiscuous mode [ 801.388367][T12641] bridge0: port 1(bridge_slave_0) entered disabled state [ 801.481909][T12641] bridge_slave_1: left allmulticast mode [ 801.481939][T12641] bridge_slave_1: left promiscuous mode [ 801.482181][T12641] bridge0: port 2(bridge_slave_1) entered disabled state [ 801.566953][T12641] bond0: (slave bond_slave_0): Releasing backup interface [ 801.667136][T12641] bond0: (slave bond_slave_1): Releasing backup interface [ 801.778376][T12641] team0: Port device team_slave_0 removed [ 801.847568][T12641] team0: Port device team_slave_1 removed [ 801.851710][T12641] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 801.851738][T12641] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 801.911332][T12641] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 801.911360][T12641] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 801.971657][T12641] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 802.061945][T12643] mac80211_hwsim hwsim15 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 802.168923][T12644] team0: Mode changed to "loadbalance" [ 802.667072][T12684] netlink: 68 bytes leftover after parsing attributes in process `syz.6.1673'. [ 804.195978][ T50] wlan1: Trigger new scan to find an IBSS to join [ 804.545632][T12726] tipc: Started in network mode [ 804.545663][T12726] tipc: Node identity 0650cb062719, cluster identity 4711 [ 804.558505][T12726] tipc: Enabled bearer , priority 0 [ 804.561409][T12726] syzkaller0: entered promiscuous mode [ 804.561429][T12726] syzkaller0: entered allmulticast mode [ 804.876766][T12739] tipc: Resetting bearer [ 804.898312][T12745] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1692'. [ 805.277179][T12724] tipc: Resetting bearer [ 805.282842][T12747] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 805.520172][T12724] tipc: Disabling bearer [ 805.560780][T11371] tipc: Node number set to 558484230 [ 807.420720][T12793] netlink: 'syz.4.1708': attribute type 4 has an invalid length. [ 807.471118][T12796] netlink: 'syz.4.1708': attribute type 4 has an invalid length. [ 807.578159][T12793] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 807.866740][T12807] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1714'. [ 807.866780][T12807] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1714'. [ 807.866795][T12807] netlink: 58 bytes leftover after parsing attributes in process `syz.4.1714'. [ 808.269847][T12819] netlink: 48 bytes leftover after parsing attributes in process `syz.8.1719'. [ 808.269871][T12819] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1719'. [ 808.269887][T12819] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1719'. [ 809.156782][ T1155] wlan1: Trigger new scan to find an IBSS to join [ 809.388525][T12837] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1729'. [ 810.150455][T12869] netlink: 'syz.6.1741': attribute type 1 has an invalid length. [ 810.159359][T12869] netlink: 48 bytes leftover after parsing attributes in process `syz.6.1741'. [ 810.175544][ T12] wlan1: Creating new IBSS network, BSSID ba:e6:01:32:80:68 [ 810.322462][T12870] bond6: option fail_over_mac: invalid value (253) [ 810.370016][T12870] bond6 (unregistering): Released all slaves [ 810.494748][T12871] netlink: 'syz.6.1741': attribute type 3 has an invalid length. [ 811.236535][T12894] openvswitch: netlink: Message has 4 unknown bytes. [ 811.341380][T12896] veth1_to_bond: entered promiscuous mode [ 811.692043][T12907] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1753'. [ 811.953806][T12910] netlink: 'syz.8.1755': attribute type 1 has an invalid length. [ 811.953828][T12910] netlink: 224 bytes leftover after parsing attributes in process `syz.8.1755'. [ 812.298021][T12929] netlink: 'syz.1.1763': attribute type 41 has an invalid length. [ 812.909305][T12950] tipc: Enabled bearer , priority 0 [ 812.955560][T12948] syzkaller0: entered promiscuous mode [ 812.955585][T12948] syzkaller0: entered allmulticast mode [ 813.004446][T12948] tipc: Resetting bearer [ 813.114540][T12958] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1771'. [ 813.146202][T12947] tipc: Resetting bearer [ 813.192621][T12960] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1772'. [ 813.277372][T12947] tipc: Disabling bearer [ 813.554174][T12962] netlink: 'syz.8.1773': attribute type 16 has an invalid length. [ 813.554189][T12962] netlink: 'syz.8.1773': attribute type 17 has an invalid length. [ 813.659704][T12962] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 813.684417][T12969] gtp0: entered promiscuous mode [ 813.706263][T12969] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1775'. [ 813.858470][T12975] Bluetooth: hci0: invalid length 0, exp 2 for type 3 [ 814.127697][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 814.127772][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 814.196904][T12988] netlink: 'syz.7.1782': attribute type 1 has an invalid length. [ 814.222754][T12988] netlink: 48 bytes leftover after parsing attributes in process `syz.7.1782'. [ 814.264691][T12988] netlink: 'syz.7.1782': attribute type 3 has an invalid length. [ 814.316656][T12992] netlink: 220 bytes leftover after parsing attributes in process `syz.1.1784'. [ 814.537440][T13005] netlink: 'syz.8.1790': attribute type 13 has an invalid length. [ 814.790056][T13005] bridge0: port 2(bridge_slave_1) entered disabled state [ 814.799073][T13005] bridge0: port 1(bridge_slave_0) entered disabled state [ 815.204174][T13020] digital: digital_start_poll: Unknown protocol [ 815.274069][T13023] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1796'. [ 815.274103][T13023] netlink: 'syz.6.1796': attribute type 11 has an invalid length. [ 815.429197][T13005] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 815.453231][T13005] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 815.550092][T13027] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 816.655706][T13023] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1796'. [ 816.655742][T13023] netlink: 'syz.6.1796': attribute type 11 has an invalid length. [ 816.672170][ T3540] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 816.993777][T13041] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 817.109678][ T3540] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 817.134277][ T3540] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 817.134854][ T3540] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 817.134896][ T3540] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 817.134933][ T3540] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 817.134968][ T3540] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 817.135004][ T3540] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 817.410795][T13041] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 817.803330][T13041] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 818.087048][T13087] tipc: Started in network mode [ 818.087070][T13087] tipc: Node identity 2, cluster identity 2048 [ 818.087083][T13087] tipc: Node number set to 2 [ 818.093321][T13087] tipc: Cannot configure node identity twice [ 818.143962][T13102] netlink: 'syz.1.1826': attribute type 10 has an invalid length. [ 818.346534][T13101] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 818.346550][T13101] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 13101, name: syz.7.1827 [ 818.346560][T13101] preempt_count: 1, expected: 0 [ 818.346566][T13101] RCU nest depth: 2, expected: 2 [ 818.346578][T13101] 5 locks held by syz.7.1827/13101: [ 818.346584][T13101] #0: ffff8880316a98d0 (sk_lock-AF_VSOCK){+.+.}-{0:0}, at: vsock_connect+0x152/0xe20 [ 818.346622][T13101] #1: ffffffff8d7aa4c0 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run9+0x1ec/0x500 [ 818.346648][T13101] #2: ffff8880b8932c88 ((stream_local_lock)){+.+.}-{3:3}, at: __bpf_stream_push_str+0x211/0xbe0 [ 818.346676][T13101] #3: ffffffff8d7aa4c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x10d/0x2b0 [ 818.346703][T13101] #4: ffff8880b893f6e8 (&s->lock_key#5){+.+.}-{3:3}, at: ___slab_alloc+0x12f/0x13f0 [ 818.346733][T13101] Preemption disabled at: [ 818.346736][T13101] [] irq_enter_rcu+0x1e/0x140 [ 818.346759][T13101] CPU: 1 UID: 0 PID: 13101 Comm: syz.7.1827 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 818.346771][T13101] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 818.346778][T13101] Call Trace: [ 818.346783][T13101] [ 818.346788][T13101] dump_stack_lvl+0x189/0x250 [ 818.346804][T13101] ? __pfx_dump_stack_lvl+0x10/0x10 [ 818.346817][T13101] ? __pfx__printk+0x10/0x10 [ 818.346833][T13101] ? print_lock_name+0xde/0x100 [ 818.346845][T13101] ? irq_enter_rcu+0x1e/0x140 [ 818.346863][T13101] __might_resched+0x44b/0x5d0 [ 818.346881][T13101] ? irq_enter_rcu+0x1e/0x140 [ 818.346896][T13101] ? __pfx___might_resched+0x10/0x10 [ 818.346911][T13101] ? ___slab_alloc+0x12f/0x13f0 [ 818.346937][T13101] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 818.346964][T13101] ? lockdep_hardirqs_on+0x9c/0x150 [ 818.346997][T13101] rt_spin_lock+0xc7/0x3e0 [ 818.347024][T13101] ? __pfx_rt_spin_lock+0x10/0x10 [ 818.347046][T13101] ? __lock_acquire+0xab9/0xd20 [ 818.347076][T13101] ___slab_alloc+0x12f/0x13f0 [ 818.347105][T13101] ? __set_page_owner+0x25c/0x490 [ 818.347133][T13101] __slab_alloc+0xc6/0x1f0 [ 818.347150][T13101] ? __set_page_owner+0x25c/0x490 [ 818.347162][T13101] __kmalloc_cache_noprof+0xec/0x6c0 [ 818.347174][T13101] ? __set_page_owner+0x25c/0x490 [ 818.347187][T13101] __set_page_owner+0x25c/0x490 [ 818.347199][T13101] ? __pfx___set_page_owner+0x10/0x10 [ 818.347210][T13101] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 818.347228][T13101] post_alloc_hook+0x240/0x2a0 [ 818.347242][T13101] get_page_from_freelist+0x28c0/0x2960 [ 818.347263][T13101] ? lockdep_unlock+0x89/0x120 [ 818.347276][T13101] ? __lock_acquire+0xab9/0xd20 [ 818.347297][T13101] alloc_frozen_pages_nolock_noprof+0xbc/0x150 [ 818.347318][T13101] alloc_pages_nolock_noprof+0xa/0x30 [ 818.347332][T13101] bpf_stream_page_replace+0x19/0x1e0 [ 818.347348][T13101] __bpf_stream_push_str+0x35c/0xbe0 [ 818.347371][T13101] ? __pfx___bpf_stream_push_str+0x10/0x10 [ 818.347392][T13101] bpf_stream_stage_printk+0x14e/0x1c0 [ 818.347406][T13101] ? __pfx_find_from_stack_cb+0x10/0x10 [ 818.347418][T13101] ? arch_bpf_stack_walk+0x112/0x170 [ 818.347434][T13101] ? __pfx_bpf_stream_stage_printk+0x10/0x10 [ 818.347451][T13101] ? arch_stack_walk+0xfc/0x150 [ 818.347469][T13101] bpf_prog_report_may_goto_violation+0xc4/0x190 [ 818.347485][T13101] ? __pfx_bpf_prog_report_may_goto_violation+0x10/0x10 [ 818.347501][T13101] ? irqentry_exit+0x74/0x90 [ 818.347518][T13101] ? read_tsc+0x9/0x20 [ 818.347534][T13101] bpf_check_timed_may_goto+0xaa/0xb0 [ 818.347550][T13101] arch_bpf_timed_may_goto+0x21/0x40 [ 818.347567][T13101] bpf_prog_6fd842a53d323cc5+0x53/0x5f [ 818.347578][T13101] bpf_trace_run9+0x2de/0x500 [ 818.347591][T13101] ? bpf_trace_run9+0x1ec/0x500 [ 818.347601][T13101] ? __pfx_bpf_trace_run9+0x10/0x10 [ 818.347625][T13101] __bpf_trace_virtio_transport_alloc_pkt+0x2d7/0x340 [ 818.347645][T13101] ? __pfx___bpf_trace_virtio_transport_alloc_pkt+0x10/0x10 [ 818.347657][T13101] ? kmem_cache_alloc_node_noprof+0x291/0x6e0 [ 818.347673][T13101] ? __alloc_skb+0x112/0x2d0 [ 818.347695][T13101] ? irqentry_exit+0x74/0x90 [ 818.347710][T13101] ? sysvec_kvm_posted_intr_nested_ipi+0x51/0xa0 [ 818.347733][T13101] virtio_transport_alloc_skb+0x10cc/0x1130 [ 818.347757][T13101] ? __pfx_virtio_transport_alloc_skb+0x10/0x10 [ 818.347775][T13101] ? rt_spin_unlock+0x150/0x200 [ 818.347791][T13101] virtio_transport_send_pkt_info+0x6be/0x1100 [ 818.347817][T13101] virtio_transport_connect+0xa7/0x100 [ 818.347831][T13101] ? __pfx_virtio_transport_connect+0x10/0x10 [ 818.347847][T13101] ? __pfx_vsock_auto_bind+0x10/0x10 [ 818.347863][T13101] ? vsock_assign_transport+0x5ed/0x770 [ 818.347880][T13101] vsock_connect+0xb8b/0xe20 [ 818.347901][T13101] ? __might_fault+0xb0/0x130 [ 818.347912][T13101] ? __pfx_vsock_connect+0x10/0x10 [ 818.347929][T13101] ? __pfx_autoremove_wake_function+0x10/0x10 [ 818.347950][T13101] ? bpf_lsm_socket_connect+0x9/0x20 [ 818.347963][T13101] __sys_connect+0x323/0x450 [ 818.347980][T13101] ? __pfx___sys_connect+0x10/0x10 [ 818.348006][T13101] __x64_sys_connect+0x7a/0x90 [ 818.348022][T13101] do_syscall_64+0xfa/0xfa0 [ 818.348036][T13101] ? lockdep_hardirqs_on+0x9c/0x150 [ 818.348051][T13101] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.348062][T13101] ? clear_bhb_loop+0x60/0xb0 [ 818.348075][T13101] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.348085][T13101] RIP: 0033:0x7ff10c5beec9 [ 818.348095][T13101] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 818.348105][T13101] RSP: 002b:00007ff10a826038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 818.348122][T13101] RAX: ffffffffffffffda RBX: 00007ff10c815fa0 RCX: 00007ff10c5beec9 [ 818.348137][T13101] RDX: 0000000000000010 RSI: 0000200000000100 RDI: 0000000000000006 [ 818.348151][T13101] RBP: 00007ff10c641f91 R08: 0000000000000000 R09: 0000000000000000 [ 818.348164][T13101] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 818.348177][T13101] R13: 00007ff10c816038 R14: 00007ff10c815fa0 R15: 00007fff6ded5018 [ 818.348213][T13101] [ 818.892412][T13041] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 819.009585][T13102] 8021q: adding VLAN 0 to HW filter on device team0 [ 819.012060][T13102] bond0: (slave team0): Enslaving as an active interface with an up link [ 819.140877][ T12] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.159434][ T12] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.174094][ T12] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.189312][ T50] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0