last executing test programs: 16m49.507200326s ago: executing program 0 (id=1068): openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r2, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r2, &(0x7f0000000040)='l', 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f00000000c0)='5', 0x1, 0x20000000, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x6000) mbind(&(0x7f00001dd000/0x2000)=nil, 0x2000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0xa) set_mempolicy_home_node(&(0x7f0000146000/0x1000)=nil, 0x1000, 0x4000000, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'rose0\x00'}) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000bc0), &(0x7f0000000c00)=0x30) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000df000000bfa300000000000007030000f0ffffff720af0fff8ffffff71a4f0ff000000005d040200000000001d400500000000004704000001ed0000620300ff000000003f440000000000007a0a00fe00ffffffc303000040000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a1074649c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c0dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6acdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fed000000007baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca485683252b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a0032f37ff559be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee07751532d5e7d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e2fa3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef907000000f01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e015cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb581012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a0000000000000000"], &(0x7f00000001c0)='GPL\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) bind(0xffffffffffffffff, &(0x7f0000000c80)=@tipc=@nameseq={0x1e, 0x1, 0x3, {0x43, 0x4, 0x3}}, 0x80) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c40)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002c807e4edb4a1cca69d3bd7000000000000600000008000300", @ANYRES32=r6, @ANYBLOB="080005000b000000"], 0x24}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) fsopen(&(0x7f0000000980)='iso9660\x00', 0x1) 16m46.928840611s ago: executing program 0 (id=1074): socket$nl_generic(0x11, 0x3, 0x10) socket$unix(0x1, 0x2, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x101000) socket$inet(0x2, 0x3, 0x33) socket$inet6(0xa, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x1, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x8, &(0x7f0000000c00)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546000677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289d01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5467a932b77674e802a0d42bc6099ad238af770b5ed8925161729298700000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809b5b9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed3957f813567f7a95435ac15fc0288d9b2a169cdcacc413b48dafb7a2c8cb482bac0ac559eaf39027ceb379a902d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bff57002c1097f92e91002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff7a1ef3282830689da6b53b263339863297771429d120000003341bf4abacac94500fca0493cf29b33dcc9ffffffffffffffd39f6ce0c6ff01589646efd1cf870cd7bb2366fdf870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f761038b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1293b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd000c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c7df8be5877050c91301fb997316dbf17866fb84d4173731efe895ff2e1c55ef08235a0126e01254c44060926e90109b598502d3e959efc71f665c4d75cf2458e3542c9062ece84c99a861887a20639b41c8096d5742db41bd61080dcbe40e0f802fc12ee86c50804042b3eac1f879b136345cf67ca3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc74aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7ad333545794f37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f4df90400000000000000d6b2c5ea139376f24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8e3070000001e48418046c216c1f895778cb25122a2a998de0842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec84ac3571f02f647b3385b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba2f58ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df986741517abf11389b751f4e109b60000000000000000d6d5210d7560eb92d6a97a27602b81f76386f1531497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750890ae71555b3228b1bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288d139bd3da230ed05a8fe64680b0a3f9f2dd704e4214de5946912d6c98cd1a9fbe1e7d58c08acaf30235b9100000000a55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854356cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c776f4b4ce07e1c6fa66fcfc7a228805f76785efc0ceb1c8e5729c66418d169fc03aa18854693ad2a182068e1e3a0e2505bc7f41019645466ac96e0d4b3bc1"], 0x0}, 0x94) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200200000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a00010000"], 0x64}}, 0x0) 16m46.675272742s ago: executing program 0 (id=1075): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x10, 0x0, &(0x7f0000000000)=[@register_looper, @dead_binder_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000002c0), 0xffb2) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x2, &(0x7f0000000280)=@gcm_256={{0x304}, "3f60eb8f2777c39a", "5985e81ad0d9585bc175cbecd3f55eb699e3070cc206f3ba527c85bde06fbf19", "bc5ec28f", "b200"}, 0x38) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x4, &(0x7f0000000100)=@gcm_256={{}, "24747942338921a1", "d830005894bf527ae179a7173985202bbfb61b36f3678de8ea2d0d6616076243", "5615d9f5", "7c5cec21291a43fe"}, 0x38) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) r6 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r6) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r6, 0xc06864a1, &(0x7f0000002540)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r6, 0xc06864ce, &(0x7f0000000600)={r8, 0x0, 0x0, 0x0, 0x3, [0x0, 0x0, 0x0, 0x0], [0x800000], [0x0, 0x1001000], [0x0, 0x0, 0xe8a6]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r6, 0xc06864b8, &(0x7f00000001c0)={0x0, 0xae, 0x3ff, 0x34325241, 0x0, [r9, 0x0, 0x0, r10], [0x2b8]}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x116, 0x0, &(0x7f00000025c0)="b3185d7bb56f70f002360fa8bf001c08a0abcf5a90155d567980ee2aa946e6766314cba1723e81bfa5c3688c03c8b124dcb27df7938e1d41ca86e77ddfdd5200ded894211bf2def50000b12ee8871659d5e057ece73cf163f8613a17bcc6d84e74ec978613b47ddbf44354026bccb92b433282454bb6db43765bb2d9be06cb1e5abfcd58dccd0169f79a614bcd559217d2a479be17668050ae1da45782d8894d38784ffcc7e141c276b6f8e13459ca63174bce3d8e3b61bfe3a36837f21c999fb2261fb2f933466d28706af0571c93c8da1ae0aea93a1941eab32ee21cee7c612df3030aaadd71f1408c7040cc40f0a3b6ef0f2061d4e2ef2adcb3eafc0ad0ec21d7546a7ca5dde886a7a62dd39959f85e51ffe7284c"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r11 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r11, &(0x7f0000000480)={0x2020}, 0x2020) 16m46.453062584s ago: executing program 0 (id=1076): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0/../file0/../file0/../file0\x00', 0x88901) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0/../file0/../file0\x00') r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r3, 0x29, 0x20, &(0x7f0000000380)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d41400000000000000290000003e000000", 0x30) mprotect(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x123a02, 0x0) pwritev(r4, &(0x7f0000000040), 0x0, 0x3, 0xfffffffe) 16m46.452256183s ago: executing program 0 (id=1077): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0x34, r1, 0x1, 0x0, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0x0, 0x0, @l2={'eth', 0x3a, 'team0\x00'}}}}}, 0x34}, 0x1, 0xffffffffffffffa1}, 0x0) 16m46.204585891s ago: executing program 0 (id=1080): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@empty, 0x0, 0x3, 0x0, 0x0, 0xa, 0x0, 0x20, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d}, {0x0, 0x0, 0x0, 0x2dd}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x6c}, 0x2, @in=@broadcast, 0x0, 0x4, 0x1, 0x80, 0x0, 0x0, 0xff80}]}]}, 0xfc}}, 0x44000080) 16m45.99426407s ago: executing program 32 (id=1080): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@empty, 0x0, 0x3, 0x0, 0x0, 0xa, 0x0, 0x20, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d}, {0x0, 0x0, 0x0, 0x2dd}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x6c}, 0x2, @in=@broadcast, 0x0, 0x4, 0x1, 0x80, 0x0, 0x0, 0xff80}]}]}, 0xfc}}, 0x44000080) 15m40.502702526s ago: executing program 1 (id=1381): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e1d, 0x9, @local, 0x2}, 0x1c) syz_emit_ethernet(0xd2, &(0x7f0000000340)=ANY=[@ANYBLOB="1dd9878ecefdaaaaaaaaaabb86dd6a000000009c1100fe80000000000000000000009c0000aafe8000000000000000000000000000aa4e1d4e20"], 0x0) 15m40.132772428s ago: executing program 1 (id=1383): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x304000000) r1 = syz_io_uring_setup(0x49a, &(0x7f0000000380)={0x0, 0x79af, 0x2, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x48, 0x4004, @fd_index=0x3, 0x6, 0x0, 0x0, 0x2, 0x1}) io_uring_enter(r1, 0x627, 0x4c1, 0x43, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000005c0)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) 15m39.704691108s ago: executing program 1 (id=1387): socket$packet(0x11, 0x3, 0x300) bind$alg(0xffffffffffffffff, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = syz_open_dev$loop(&(0x7f0000000280), 0xa4f, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_user\x00', 0x275a, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) write$FUSE_BMAP(r1, &(0x7f00000000c0)={0x18, 0xfffffffffffffff5, 0x0, {0x8000000000000001}}, 0x18) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r1, 0x0, 0xfffffffffffffffb}, 0x75) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x6000000, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1d, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d00009520a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bc0007008019000000000000000000000000af1e4ccfb7b3cad80004010400", [0x1, 0x2000000000001]}}) 15m39.593013179s ago: executing program 1 (id=1389): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b0000000000000000000000008000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/13], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xf, &(0x7f0000000140)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x69}}}, &(0x7f0000000080)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r3 = socket(0x10, 0x2, 0x0) syz_usb_connect$uac1(0x3, 0x93, &(0x7f0000000b80)={{0x12, 0x1, 0xc2c837444fab22da, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x81, 0x3, 0x1, 0xf5, 0x80, 0x4, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x7, 0xe}, [@extension_unit={0x7, 0x24, 0x8, 0x2, 0x205, 0x9}, @input_terminal={0xc, 0x24, 0x2, 0x2, 0x200, 0x22, 0x1, 0x6, 0x7f, 0x33}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x0, 0x61, 0x2, {0x7, 0x25, 0x1, 0x2, 0x3, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x2, 0x5, 0x1001}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x0, 0x0, 0x41}]}, {{0x9, 0x5, 0x82, 0x9, 0x28, 0x1, 0x65, 0xac, {0x7, 0x25, 0x1, 0x2, 0x50, 0x7ff}}}}}}}]}}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) write(r3, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r3, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), r3) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x1c, r4, 0x10, 0x70bd26, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4040000) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) syz_emit_ethernet(0x46, &(0x7f0000000480)={@local, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, '\x00', 0x10, 0x2b, 0x0, @private1, @local, {[], {0x3b00, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}}, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffc, 0x6, 0x0, @buffer={0x2, 0x41001, &(0x7f00000000c0)=""/81}, &(0x7f0000000380)="259374c96ee3", 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) ioctl$LOOP_CONFIGURE(r8, 0x4c0a, &(0x7f0000001ac0)={r7, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1c, "ff9f020bbe82b398b1c4369d03740250ceaac594b1b3d741dd17c1ac0d38ef2a565ef1e8336300", "a9103939c787a16c1ca43f80026d1f3c4da06963dd89d130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b7e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200", [0xfffffffffffffffe]}}) ioctl$LOOP_SET_STATUS64(r8, 0x4c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x2ac, 0x0, 0x1, 0x15, 0x0, "89753015418ab0cb0900245518580ce0c8bf604cca41f31c108938fcfa393ef569e0bcf244bb4b23555b130900000000000000d0f08e8ad896ba67a07673defa", "8b609009aaa722681a1e2513d754f688a9e306ee1dba533f02e1b69da6e26ec889fee40080000027cc7d24fdc26f1a95d702020000e4b8fb1703e47463b969e4", "ca1bf5ffffffffffffff6570128218a0d22915ff6eddb10000800400", [0xc]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x1, 0x5, &(0x7f0000000000)=@framed={{}, [@map_idx={0x18, 0x9}]}, &(0x7f0000000080)='syzkaller\x00', 0x4}, 0x94) 15m36.399393377s ago: executing program 1 (id=1405): r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000340)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x6}}, {{0xa, 0xfffe, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x3}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x3, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x3, @private2}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0xa4ffffff, @rand_addr=' \x01\x00'}}}, 0x15a) close(r0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket(0x1e, 0x1, 0x0) connect$tipc(r2, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_PORTS(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x1c, r1, 0x1, 0x70bd29, 0x25dfdbfe}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) socket(0x80000000000000a, 0x2, 0x0) (async) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000340)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x6}}, {{0xa, 0xfffe, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x3}}}, 0x108) (async) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x3, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x3, @private2}}}, 0x108) (async) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0xa4ffffff, @rand_addr=' \x01\x00'}}}, 0x15a) (async) close(r0) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) (async) socket(0x1e, 0x1, 0x0) (async) connect$tipc(r2, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_SHOW_PORTS(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x1c, r1, 0x1, 0x70bd29, 0x25dfdbfe}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async) 15m36.244004402s ago: executing program 1 (id=1407): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = fsopen(&(0x7f0000000040)='fuseblk\x00', 0x0) r2 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x109801, 0x0) r3 = syz_io_uring_setup(0x2f1, &(0x7f0000000300)={0x0, 0x200000, 0x10100, 0x3}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x50, 0x0, @fd_index=0x3}) io_uring_enter(r3, 0x25e7, 0x4000, 0x0, 0x0, 0x0) write$dsp(r2, &(0x7f0000002000)='`', 0x88020) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000004c0)='j\x95\'\x80C\x16\xca\\', &(0x7f0000000c40)='\xe6usek\v\xf6u%\x9b\x00\x00\xad\xeb\x00\x00\x00\x00\x01\x80\x00\x00\xcf\x9b\x9f\b\xb6\xfe\xc8\xda~-\xf5S>\xb8\x86\xfc\x9cVR\x82\x9a\xbdp\xbd\x83w\xf9Z\xd2\xcb\xcdF\xd0#N7\x17\xfc\x1e\xf1\x97\xffxi\xe0KE}]\x8e\xca\xe3+\xc8\x98\x03\x91\x88(\bn\x7f\x0e\x85\xa5\xb4\n?_\xc9\xef\xe0Q\xdb\xb6\xa5\x81t\x06\xda\x95\x935\xf1\x18\xac\x00\xf0\xff\xff\xbd\xb5\xa1\x06\xfd\x01\x00\x00\x00\x0f\xf8\xe3\x8a\x1f\x9c\xf3\xc5\x1f\xf9\xbf[\xd13\xb3\xd3j\r6\x7f', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='{:\'@-\x00', &(0x7f0000000180)='%*.\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000740)='\xe0\"\xef\xb1\xea\xe6\x9c\xe6\xc8M\xdb\x86\xb3\x8b\xbe\xd5\xbdB\x92\xa0\x19-+a\x13qQ\xd5f39hSr\xafbB\xf6\xe8\xcd\x1bf\x18\x7f\xf27E#\"\xab\x99\xec\x88\x8d\xd8C\x0f\x95\xff\xfeG\xf9t\xb1 \xcc\xc5\xbb\x88\xb6\xd2\xf2\x17Y\xa3\xe1JV\xd0\xdeJwq\xf8oG0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x50, 0x0, @fd_index=0x3}) io_uring_enter(r3, 0x25e7, 0x4000, 0x0, 0x0, 0x0) write$dsp(r2, &(0x7f0000002000)='`', 0x88020) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000004c0)='j\x95\'\x80C\x16\xca\\', &(0x7f0000000c40)='\xe6usek\v\xf6u%\x9b\x00\x00\xad\xeb\x00\x00\x00\x00\x01\x80\x00\x00\xcf\x9b\x9f\b\xb6\xfe\xc8\xda~-\xf5S>\xb8\x86\xfc\x9cVR\x82\x9a\xbdp\xbd\x83w\xf9Z\xd2\xcb\xcdF\xd0#N7\x17\xfc\x1e\xf1\x97\xffxi\xe0KE}]\x8e\xca\xe3+\xc8\x98\x03\x91\x88(\bn\x7f\x0e\x85\xa5\xb4\n?_\xc9\xef\xe0Q\xdb\xb6\xa5\x81t\x06\xda\x95\x935\xf1\x18\xac\x00\xf0\xff\xff\xbd\xb5\xa1\x06\xfd\x01\x00\x00\x00\x0f\xf8\xe3\x8a\x1f\x9c\xf3\xc5\x1f\xf9\xbf[\xd13\xb3\xd3j\r6\x7f', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='{:\'@-\x00', &(0x7f0000000180)='%*.\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000740)='\xe0\"\xef\xb1\xea\xe6\x9c\xe6\xc8M\xdb\x86\xb3\x8b\xbe\xd5\xbdB\x92\xa0\x19-+a\x13qQ\xd5f39hSr\xafbB\xf6\xe8\xcd\x1bf\x18\x7f\xf27E#\"\xab\x99\xec\x88\x8d\xd8C\x0f\x95\xff\xfeG\xf9t\xb1 \xcc\xc5\xbb\x88\xb6\xd2\xf2\x17Y\xa3\xe1JV\xd0\xdeJwq\xf8oG0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) socket$packet(0x11, 0x3, 0x300) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="020000000400000008000000010000008000", @ANYRES32, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000500"/28], 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000001000000b7080000000000007b8af8ff00000000b508000000000000638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018240000", @ANYRES32=r2, @ANYBLOB="0000000002000000b703000008000000850000006a00"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_EXPECTED_FD={0x8}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x2}]}, @IFLA_GROUP={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000002240)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r6 = open_tree(r5, &(0x7f0000000bc0)='./file0\x00', 0x800) move_mount(r6, &(0x7f00000001c0)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x220) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_msfilter(r8, 0x0, 0x29, &(0x7f00000000c0)=ANY=[@ANYBLOB="ac1e010100000000010094cd49fe704c23ffbf000006000000e0000001e00000010a010100640101"], 0x28) setsockopt$inet_tcp_int(r7, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) r9 = syz_open_dev$vim2m(&(0x7f0000000200), 0x3, 0x2) r10 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r10, 0x29, 0x40, &(0x7f0000000d40)=@filter={'filter\x00', 0x2, 0x4, 0x4a8, 0xffffffff, 0x0, 0xf0, 0xf0, 0xfeffffff, 0xffffffff, 0x3d8, 0x3d8, 0x3d8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @mcast1, [0xff, 0xff, 0x0, 0xffffff00], [], 'pimreg0\x00', 'bond_slave_0\x00', {}, {}, 0x6, 0x0, 0x3}, 0x2f2, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@dev={0xac, 0x14, 0x14, 0x1d}, 'caif0\x00', {0x7}}}}, {{@ipv6={@mcast1, @loopback, [], [0x0, 0x0, 0xffffffff], 'netdevsim0\x00', 'geneve0\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "ddabf53d9b1435965491f6531877000001e770b689f173dfa40b58c10327e3121114449fd20ba2be6eb0cde72a972f25170163232ed996b4789b9d00"}}}, {{@uncond, 0x0, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x602, 'system_u:object_r:boot_t:s0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x508) ioctl$vim2m_VIDIOC_REQBUFS(r9, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_S_FMT(r9, 0xc0d05605, &(0x7f0000000340)={0x3, @vbi={0x6, 0x5, 0x1, 0x641e6e1f, [0xae, 0x3], [0x7, 0x10008], 0x1}}) 5m24.738448153s ago: executing program 6 (id=4329): syz_emit_ethernet(0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000088a84000ec0014"], 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r0, 0x29, 0x31, 0x0, 0x0) syz_usb_connect(0x0, 0x1a2, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000b6a57e4086805b0bc5e10102030109029001020000000009040000020e0100000a2401002200020102092100000001220000090500000000000000a7008d566539461c701919d99a91c3af134dfaf61ea66b8f08810855d90c55c91f11c4a6d847caf7b449c6c760e60f6b890d99ed23074bf2538ca7bba727dfe7c00b90d0bc7f2da56768ed5ce8df38c07183564831596fd52da49a92adafa6277df5a120c898fc51ca04089f110dfbe1b258e9b9a83bf95fb0a4a24ca6acae78e1c291f671fcdca77c7128d319f7a4b51bbc2ed4bab8aac95498fb6033f760602c1a8b1eac2150072501000000000905000000000000000725010000000007250100000000090400000eb03748000a2401000000020102052405", @ANYRESOCT], 0x0) 5m24.555378807s ago: executing program 6 (id=4330): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c00000010000107000000000000000b0a000000060001"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x240080d0) 5m23.780343296s ago: executing program 34 (id=4330): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c00000010000107000000000000000b0a000000060001"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x240080d0) 7.004680408s ago: executing program 7 (id=6166): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xe, 0x2010, r0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xa, 0x8000, 0x0, 0x9, 0x1, 0xfffffdffffffffff, 0xfa0f, 0xffffffff}, 0x0) mremap(&(0x7f00007f1000/0x4000)=nil, 0x4000, 0x800000, 0x0, &(0x7f0000130000/0x800000)=nil) syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000800)={{0x1, 0x3, 0x8, 0x1, 'syz1\x00', 0xb}, 0x3, 0x4, 0xfc9, 0xffffffffffffffff, 0x6, 0x9, 'syz1\x00', &(0x7f0000000100)=['\x00', '--*)&+\\+R\x00', '*&:&F${\x00', '@&:}&.#\x00', '/proc/timer_list\x00', '\xac].\x00'], 0x30}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r3, 0xc018937d, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r2, {0x3}}, './file0\x00'}) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073795c30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657456305f742f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/mem_sleep', 0xa0502, 0x49) io_setup(0x1, &(0x7f00000016c0)=0x0) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r8, 0x0, 0xca, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0x8, @vifc_lcl_addr=@multicast1, @loopback}, 0x10) io_submit(r7, 0x1, &(0x7f0000000140)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x8, r6, &(0x7f0000000180)="282fa8c2", 0x4, 0x5}]) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x14c, 0x1a, 0x713, 0x0, 0x25dfdbfc, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x4e21, 0x2, 0x2, 0x0, 0x0, 0x3b, 0x0, 0xee00}, {@in6=@private1, 0xfe, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x1b}, {0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x543}, {0x4, 0x7fffffffffffffff}, {}, 0x70bd28, 0x3500, 0xa, 0x4}, [@algo_aead={0x5b, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x78, 0x60, "217d66d38547aa140db8a200000000"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x880}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x7, &(0x7f0000000040)=0xefbe, 0x4) syz_open_dev$ttys(0xc, 0x2, 0x1) syz_open_dev$ptys(0xc, 0x3, 0x1) 6.424416409s ago: executing program 2 (id=6170): capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000002800)={0x1, 'vlan0\x00'}) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="78000000070a01020000000029b400000a0000080900010073797a31000000005800048054000180090001006d6574610000000044000280080001400000000c08000340000000000800034000000017080001400000000308000240000000230800014000000012080002400000001804000140"], 0x78}, 0x1, 0x0, 0x0, 0x80}, 0x44000) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f00000000c0)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x15, 0x3, 'lc\x00', 0x1, 0x400000, 0x4}, 0x2c) r2 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @remote, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x5}, {@dev={0xac, 0x14, 0x14, 0x3c}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000300)=r4, 0x4) sendmsg$nl_xfrm(r3, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000580)=@allocspi={0xf8, 0x28, 0x339, 0x0, 0x0, {{{@in=@multicast1, @in6=@ipv4={'\x00', '\xff\xff', @private}}, {@in, 0x0, 0x32}, @in6=@loopback}, 0x0, 0x4}}, 0xf8}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="480000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a31000000001c0003801800008008000340000080"], 0x48}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x52af7000) r6 = userfaultfd(0x1) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r7, 0x1, 0x6, 0x0, &(0x7f0000000040)) ioctl$UFFDIO_COPY(r6, 0xc028aa05, &(0x7f0000000180)={&(0x7f0000600000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x2000, 0x3, 0x2}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r8) sendmsg$ETHTOOL_MSG_DEBUG_SET(r8, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYRES16=r9, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000000c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r8) timerfd_create(0x0, 0x80000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r10, 0x10f, 0x80, &(0x7f0000001640)=0x4f1d, 0x4) 5.270162186s ago: executing program 2 (id=6171): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="f3a56766c7442400804400006766c74424020a0000006766c744240600000000670f0114240f21fc6766c7442400000000006766c744240208a000006766c744240600000000670f011c240fc71ac4e255cfba0000660f383341000fbec40f01c266b9ed0900000f32", 0x69}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000000)={0x100, 0x9, 0x0, 0x7, 0x2, "fe9c38121cc9057efcbd6efab9352eac9ca582", 0x7, 0x7}) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 5.104329543s ago: executing program 7 (id=6172): r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000a40)={{0x1, 0x0, 0x4, 0x5, 'syz0\x00'}, 0x0, [0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x3d8e, 0x0, 0x100007, 0xfffffffffffffffc, 0x401, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0, 0x9, 0x0, 0x4000000000000, 0x0, 0xfffffffffffffff5, 0xffffffffffffffff, 0x200000000000000, 0x1, 0xfffffffffffffffc, 0x1, 0x0, 0x2, 0x40000000c5a, 0x2, 0x1, 0x0, 0x85, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffff0, 0x1, 0x6, 0x0, 0x4000000000000000, 0x20000000000, 0x5e, 0x1, 0xfffffffffffffe, 0x0, 0x4, 0x1000000000, 0x3, 0x200000000000, 0x3, 0x200, 0xfffffffffffffffe, 0x0, 0x4000000000100001, 0x3, 0xfffffffffffffffc, 0x4, 0x800, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffffffffffff, 0x0, 0x7, 0x0, 0x0, 0x10001, 0xebf, 0x6, 0x0, 0x751, 0x3, 0x0, 0x6b, 0x7, 0xfffffffffffffffd, 0x101, 0xb, 0x0, 0x2, 0x800, 0x9, 0x10008001, 0x3, 0x7, 0x80000000000000, 0x0, 0x0, 0xf31, 0x11, 0x2, 0x0, 0x0, 0x1ea, 0x3, 0x0, 0x4, 0x0, 0x0, 0x3, 0x4000b, 0x200000000000000, 0x3, 0x2, 0xfffffffffffffffd, 0x0, 0xfffffffffffffffc, 0xfffffffffffffffc, 0x1, 0x0, 0x2c80000000000000, 0x0, 0x20000000, 0x1, 0x1553, 0x6, 0x0, 0x3]}) 5.004826541s ago: executing program 7 (id=6173): r0 = fanotify_init(0x200, 0x0) write(r0, &(0x7f00000006c0)="ff000000010000a2", 0x8) syz_open_dev$ttys(0xc, 0x2, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x0) r1 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000c00), 0x2, 0x0) ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000c40)=@multiplanar_userptr={0x9, 0x1, 0x4, 0x2000, 0x6, {0x77359400}, {0x5, 0x2, 0xe, 0x0, 0x4, 0x9, "6c087583"}, 0x7, 0x2, {0x0}, 0x800}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x406, &(0x7f0000000040)={0x0, 0xc8a0, 0xc000, 0x8, 0xc1}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x8054) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) r5 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000006c00090300000000000000000000000000000000040004000800010002000000"], 0x24}}, 0x20000000) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r7 = syz_open_dev$vim2m(&(0x7f0000000180), 0x8, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r7, 0xc0405602, &(0x7f0000000200)={0xfffffff7, 0x3, 0x0, "24cbc41ce5be2491737446a8c985e8e8f14c265827edcde01caa0f0e42ea97a5", 0x48524742}) close_range(r6, 0xffffffffffffffff, 0x0) 4.964304608s ago: executing program 7 (id=6174): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000480)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d01000000000000000000060006241a0000000905810300020000000903e60000020d00000904010102020d000009058202"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_io_uring_setup(0x6410, &(0x7f0000000200)={0x0, 0x4661, 0x4000, 0x7, 0x288}, &(0x7f0000000440)=0x0, &(0x7f0000000280)=0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000002c0), 0x4) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f00000003c0)=@hci={0x1f, 0xffffffffffffffff, 0x4}, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000100)="4c1432762d048095929ee7e68a285a4a8382892e564c8008a4f1ec92e686194b1b961c5fc95c7de90c4619998621ac8ab0b72f18e665b98e645544e0", 0x3c}, {&(0x7f0000000500)="33de7f75d04088742cf8f07d0ad454ba08b71ecf51185bae246cb66917c987eaa8cff5b7c119fe12ebd911e56d293ee4047219404cee865c60ff9d4eadfb4446097b90c377c96873aeb8cfbf15ab9eea7d853de815d15ee155dfd376c49f62c3fd7ea85cbe02199e082a05af294030ea20a7a1e14156493f60e3c743edcf5255e39a3e6e6f33770345706161d03879750c452e75ee0b8e05c8d6c9cdf4daeb7ac95bee32ad86240694e2186e6885cfe52e89fa3292b4a278cd03258f7a4808a65c8dba12ba0ae7da9a6b0e0f6832eaac39", 0xd1}, {&(0x7f0000000600)="ba0b6e2f32cdd663066804ed1803d2addd6c7512e9a7512ae4775486e914d3fd043177247d7835bac3b92611e8034158cf312c1164837ececac4a8ed85888847b3c215c8c3239f8084e0d02aa16ae9fd8c8273a29fa6fd794ba546b01fc491babcb72906817bf821c113a427c6391eecfb4c2e8dc698934e7fff45b9dc3bdc55e9e9c3be7eb612b847288f060efb52a1d54796374081231702a3fde7cf3be0fad104354332cffcee901e50d77b36b260856c8cf56b27ac50df53b66d73127259ac1d1be773bc026ed3c05a741421dc9611905bb3ad78ccb3687c561fbd6ba77d6b84245dc42bbdc160a50077a86a969b44e5ed432c09b191", 0xf8}, {&(0x7f0000000700)="5a2964fe9b65dd44a50226f6a789db32fd87ea4952c99643e348495e3ff10fd8a1429846181baf4818776bbb653ee9644ac8d39547af382dd9c9ca4ee0714c95fac5c41a05d8ca", 0x47}, {&(0x7f0000000780)="b535c1285eb6e43999bbff74b742aa5a620b860bad3b1aad24f31853d8027c4790929060d1be91ccb6e0f08418351313c79591a7e3bf2fd77e6836d36006bdf21bdc747ff1d179985bb0ad96725df0b66f341d8c9be298bd2dcba3ba31f6bba4f7ea3be0898ea6b6c5f3a214d017211c43b46918ce03", 0x76}, {&(0x7f0000000800)="77ff4e0bc8edf509755a4b2499c0e903d6e9221490ca9f427b171972aad7fa520af1687071b19380ef9152ca3f539d66c8667f84222d88c9dbe6029190211f4a4bd8f28d244e27f34d9f6071562bf568d26ecfdde08a156488c6df03513f42b660375d589b0bba1217521adc8aa2fd31cbf49f3fb6ddfa90da24ea0ecf92d3c30528fc52b1faddef59c82879f2f18780d6d50fc0a5", 0x95}], 0x6}, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000480)={@in={{0x2, 0x4e23, @loopback}}, 0x0, 0x20000000005, 0x4a}, 0xd8) bind$inet(r5, &(0x7f0000deb000)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x240087f9, &(0x7f0000000100)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) sendmmsg$inet(r5, &(0x7f0000000bc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000240)="73ab40a36755d3", 0x7}], 0x1}}], 0x1, 0x20008084) close(r5) getsockopt$sock_int(r3, 0x1, 0x10, 0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000940)=0x7, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4007, @fd_index=0x3, 0x0, 0x0}) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0, 0x58}], 0x1}, 0x0) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000980)=@deltclass={0x68, 0x29, 0x200, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {}, {0x4, 0xa}, {0x10, 0xffe0}}, [@TCA_RATE={0x6, 0x5, {0x2, 0x4}}, @tclass_kind_options=@c_mq={0x7}, @TCA_RATE={0x6, 0x5, {0x80}}, @tclass_kind_options=@c_mq={0x7}, @TCA_RATE={0x6, 0x5, {0x10, 0xfe}}, @tclass_kind_options=@c_fq_codel={0xd}, @tclass_kind_options=@c_clsact={0xb}]}, 0x68}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newqdisc={0x3c, 0x24, 0xd0f, 0x70bd2a, 0x0, {0x60, 0x0, 0x0, r9, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x0, 0x7ffffffd}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x3000c81c) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x40000000000009f, 0x0) 4.907022179s ago: executing program 3 (id=6175): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x20048810) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0x38}}, 0x2000018c) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e"], 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) (fail_nth: 7) 4.760616901s ago: executing program 3 (id=6176): r0 = socket$inet6(0x10, 0x3, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(r0, 0x7, &(0x7f0000000340)={0x1, 0x3, 0xfffffffffffffffc, 0x8}) rt_sigprocmask(0x2, &(0x7f0000000180)={[0xfffffffffffffffb]}, &(0x7f00000001c0), 0x8) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000100)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r4 = fcntl$dupfd(r3, 0x406, r3) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB], 0x3c}}, 0x4800) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="4800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000005c345f99d6250b2f800b200005804e20000004000600ffff0a007a4403e7e8e0b9926f801eda2495074b5fce56c3690ecb561cfe3e7d40fbdcfefb0d51e7f470b8310330edf490aca9a15b4ae059daf451ced6a14d048fe0747d6e06281330437086adad0b54bf9a763dfbe612837044ea92548f6ff90d3466a00e1f802fb7c61879bcedbb481e9508f10adcf83683577a39e5e9044071fc475ac977554a78d00e812bde6818fc4239f6b64e7535c74c5ee985670f751f9142f33aa939668daa47ce2c4aff3b50a2cc3c0eb86c92", @ANYRES32, @ANYBLOB], 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x80) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000240)={0x1, &(0x7f0000000280)=[{0x6, 0xfd, 0xd8, 0xe4}]}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmsg$TIPC_NL_NODE_GET(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[], 0x134}, 0x1, 0x0, 0x0, 0x24040841}, 0x40008) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x7, 0x0, 0x106, 0x4}}, 0x20) socket$inet_sctp(0x2, 0x0, 0x84) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r4) sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYBLOB="000526bd7100fedbdf250b000000400001800800030001000000080003000200000008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="1400020064766d727031000000000000000000000800030002000000"], 0x54}, 0x1, 0x0, 0x0, 0x40080c0}, 0x0) shutdown(r3, 0x1) 4.676246747s ago: executing program 2 (id=6177): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8401) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket(0x10, 0x803, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) request_key(0x0, &(0x7f0000001200)={'syz', 0x1}, &(0x7f0000001240)='\x00', 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) getdents(0xffffffffffffffff, 0xffffffffffffffff, 0x5a) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = socket(0x2, 0x3, 0x7) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="5c00000014006b03000000d86e6c1d0002847ea622fb564500004e23e3f58e76110165f450e71b0075e3002500028d459e37000f0000000000bf9367b47e51f60a64c9f4d4938037e786a6d0bdd700"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) setsockopt(r4, 0xff, 0x1, 0x0, 0x9) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000790000000000000000e50000000000000095"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 4.52601945s ago: executing program 4 (id=6178): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_IO(r1, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffffffffffd, 0xa, 0x0, @scatter={0x0, 0x3, 0x0}, &(0x7f0000000040)="3fa75c2d090000000000", 0x0, 0x3, 0x10010, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8080}, 0x20000000) 4.280811739s ago: executing program 4 (id=6179): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@getnexthop={0x18, 0x76, 0xb0d, 0x0, 0x0, {0x3}}, 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x0) 4.249674139s ago: executing program 4 (id=6180): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xe, 0x2010, r0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xa, 0x8000, 0x0, 0x9, 0x1, 0xfffffdffffffffff, 0xfa0f, 0xffffffff}, 0x0) mremap(&(0x7f00007f1000/0x4000)=nil, 0x4000, 0x800000, 0x0, &(0x7f0000130000/0x800000)=nil) syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000800)={{0x1, 0x3, 0x8, 0x1, 'syz1\x00', 0xb}, 0x3, 0x4, 0xfc9, 0xffffffffffffffff, 0x6, 0x9, 'syz1\x00', &(0x7f0000000100)=['\x00', '--*)&+\\+R\x00', '*&:&F${\x00', '@&:}&.#\x00', '/proc/timer_list\x00', '\xac].\x00'], 0x30}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r3, 0xc018937d, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r2, {0x3}}, './file0\x00'}) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073795c30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657456305f742f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r4, 0x0, 0x4000800) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/mem_sleep', 0xa0502, 0x49) io_setup(0x1, &(0x7f00000016c0)=0x0) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r8, 0x0, 0xca, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0x8, @vifc_lcl_addr=@multicast1, @loopback}, 0x10) io_submit(r7, 0x1, &(0x7f0000000140)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x8, r6, &(0x7f0000000180)="282fa8c2", 0x4, 0x5}]) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x14c, 0x1a, 0x713, 0x0, 0x25dfdbfc, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x4e21, 0x2, 0x2, 0x0, 0x0, 0x3b, 0x0, 0xee00}, {@in6=@private1, 0xfe, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x1b}, {0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x543}, {0x4, 0x7fffffffffffffff}, {}, 0x70bd28, 0x3500, 0xa, 0x4}, [@algo_aead={0x5b, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x78, 0x60, "217d66d38547aa140db8a200000000"}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x880}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x7, &(0x7f0000000040)=0xefbe, 0x4) syz_open_dev$ttys(0xc, 0x2, 0x1) syz_open_dev$ptys(0xc, 0x3, 0x1) 3.881541191s ago: executing program 3 (id=6181): syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x301) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r1 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x0, 0x400, 0x0, 0x0, 0x0, 0x1}, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0xc102, 0x0) sendfile(r5, r5, 0x0, 0x40008) io_uring_enter(0xffffffffffffffff, 0x3516, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') r7 = open(&(0x7f0000000200)='./bus\x00', 0x141a42, 0x0) sendfile(r7, r6, 0x0, 0xffffffff) lstat(&(0x7f0000000280)='./file0\x00', 0x0) prctl$PR_SET_THP_DISABLE(0x29, 0x0) r8 = getgid() ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000340)={{0x1, 0x1, 0x18, r4, {0x0, 0xee00}}, './file0\x00'}) syz_mount_image$fuse(&(0x7f0000000200), &(0x7f0000000240)='./file0\x00', 0x2000400, &(0x7f0000000600)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000120000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="d5412648dcac685e643d1445ff3f21534da14b23f205000000dd450e27fa4b", @ANYRESDEC=r8, @ANYBLOB], 0x1, 0x0, &(0x7f0000000540)="ec4d6d7c2b7f338c1606fecd19f817fa409f3bc1f47ba7d8e421af0099a3891e44adf5ffe6f8624f4eb34ef61a07d696dd41c88296c77ffc414fd38758559252551f85fb46728be60d518ae10c3cc7355c6e80006a8359ce3ff013d3f70081cf3e63830c2574eac9ccd1f791377fd3909826468b778b4a5304b85bb791136dc0fddc325430a4ba7fc71d0bbcf4d3d960aba74415aaa9e2ffec1fb150299227053dde0a71") r9 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r9, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x5, 0x10009, 0xb5315241, 0x3, 0x0, 0xff, 0x0, 0x6, 0x1, 0x4, 0x0, 0x4}}) sendfile(r0, r0, 0x0, 0x3) write$vga_arbiter(r0, &(0x7f0000000000), 0xf) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000980)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x0, {{@in=@multicast1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x4}, {@in=@loopback, 0x0, 0x3c}, @in=@loopback, {}, {0xfffffffffffffffc, 0x0, 0x2000000000}, {}, 0x0, 0x0, 0xa, 0x3, 0x0, 0x20}, [@algo_auth_trunc={0x4c, 0x14, {{'sha1\x00'}}}]}, 0x13c}}, 0x0) 2.622134091s ago: executing program 3 (id=6185): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000004340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24004800}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x1f, 0xa, 0x8003) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20008850) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000140)=@ethtool_cmd={0xb, 0x0, 0x8, 0x4, 0x5, 0xd, 0x6, 0x7, 0x3, 0x50, 0xf, 0xfffffff9, 0x222, 0x0, 0xa, 0xb701, [0xcf, 0x59c]}}) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) r4 = accept4(r2, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000200)="ad56b6cc0400aeb995298992ea5400c2", 0x10) recvmmsg$unix(r4, &(0x7f00000053c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0xa32, 0x60, 0x0) r5 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x142ba3) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82803, 0xf) unshare(0x28000600) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000000080)={r6, 0x0, {0x0, 0x0, 0x0, 0x2000000000000006, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4ad24bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x2, 0x7]}}) ioctl$LOOP_GET_STATUS(r5, 0x4c03, &(0x7f0000000280)) 2.593197185s ago: executing program 5 (id=6186): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) r2 = socket$kcm(0x2, 0x3, 0x2) socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8916, &(0x7f0000000040)={'veth1_macvtap\x00', @random="0200ac7f7f00"}) r3 = dup(0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e20, @broadcast}], 0xffffffffffffffb8) sendmsg$inet6(0xffffffffffffffff, 0x0, 0x4048043) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x10, 0x0, 0xfe, 0x4, 0x0, 0x1, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) 2.547722183s ago: executing program 4 (id=6187): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x20048810) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e0000000300000000000004050006"], 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) (fail_nth: 1) 1.972586855s ago: executing program 4 (id=6188): socket$nl_netfilter(0x10, 0x3, 0xc) socket$pppoe(0x18, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './mnt\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x35, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x8, 0x0, 0x3}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x8082, 0x0) r3 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)='0.0:\x00', 0x0) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x3b, 0x0, 0x100000001}]}) syz_emit_ethernet(0x5d, &(0x7f0000000e80)=ANY=[@ANYBLOB="aaaaaaaaaaaa1553ff41cf1186dd60", @ANYRES32=0x41424344], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000001180)={0x16, 0x4, &(0x7f0000001580)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRESOCT=r5, @ANYBLOB="156887ef20ff2d056de8c207b4e52e1518482343b8cabf3a3abbe0cbc59062d02abc85483a797fd2d6ce1802cced77b7ef85491b367651262cf68d244f2ddceef3cb330777c13b0834e753a2129cf233d01746bed23b46697463cd97d30c5b92e087e0ea695a58d6ddb8f2e0957aba82877e7517ca18"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r6 = socket$nl_generic(0x10, 0x3, 0x10) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f0000001240)=ANY=[@ANYBLOB="b6002a3761c748413aa0000000000000ffff000010000000", @ANYRES32=0x0, @ANYBLOB="980071a42686a9c7bab7af81d7ad67a91bc2b62d6c5200c817bf3735c526186fc8dfd02391db09a3741d63d870a80abcf1e8d9ff4c7cffb33143202d9e9adeb2ecdaf912f978bcaa01af38bd7750de1433826f1106a585d339b2dbb7e802c3e0ba1e17b4ebca66bb6fb3d06fac50ca88ea0bdafbe5c2314ce712737d753fd8cb89bf3e112d2b15b5a1b2e71db0809fd5522d8fe04a0070ca138a"], 0xb6) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)) sendmsg$BATADV_CMD_SET_MESH(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000f000000080003", @ANYBLOB='\b\x00'], 0x2c}}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000e40)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000f00)="576332f56236be7cfa73a36e5e436485a425bc1b921f22ca2d78ddc5aa9131162a337eadf8319fe6a960f0f3b068e86c81441ebd2df73b1face80000a70caa41f5e55b8523aabbbcdf1da83f227ae1208115de48e2a3fb3d4e4fd419b77a9b8c34a78300e6faa7a8362f89116b85ec1441bd2a13b9cce2ccfc334aba8b9cf61e3061b4b6f93b6ee030ce3a7e5f386f60059793878ca0df7398efba666be33efb40dfcf4a30d81e4522988db23b", 0xad}, {0x0}, {0x0}, {&(0x7f0000000780)="f318b45a3d8aed513e90235d54300a6373f775e36a58ca0f53e3ddcd8b8dccb6a2fc05b6d6f9ecba74e748a991ffbf264467e94b4622db20df0382c1ff1ca8dc6a9f6e05a36e6261f8b9e13e1b8753dd636e8f239d1de3b3f326ef84075a654a454e9f764f190397daee88879aafaa6b81a213802075e23b5dae233523677cbb255ff674afad254ed56fead3035b7bfc225c3d6b235d04d21e516562", 0x9c}, {&(0x7f0000000fc0)}], 0x5, &(0x7f0000001300)=ANY=[@ANYBLOB="880000a55df62b6d345f2bda8800000000000a010000090000004a6c4c313fb87ee7b5253ac5691001d14e962f43cc66d6432f54e68969165e3f5b5b917b552b721a675ee63edfd8693e949c8a23f03e22eb79c4304c77e701ef9f5b6ddb463087b577861f18bb4ccdb5a43c9bd0acd5c7eff67ed38113ce3706ac84fe777ba0ef077eacdeb6189fe51beef770fe0cdc08b878001fda32b7425f3ecb648a8f3963440000000000000e01000094000000441ca7fddda290dae91e8b290f9a642b066eb2b552ce05ee55be7847bcf07d1d8c31ae790e11969960a62268cb112e53fad6f0e76016d4d57bbf3c33ac20281251fa8c6a47e0bc92230f46f92c58c0d540bd3e8d721f33440919485bd7aa80bfeebf34fc9ee837005000000000000000110035aaa442852df57553ac7a8149198400002400000099030750f6ddb8744a9be51ac55291b7179d901b69d68583c345dcc2770692fa6ae1a83efb8145a8330b90c65fa083e333a66f67ff3adf520dea91000000000028000000000000000d01000006000000b118faf3db121fc5d85fc9e5065a1bc379a2874f98000000100000000000000012010000400000002800000000000000160100002400000018b8c31bbf03e8598596534166b293f904e00000000000005800000000000000140100000b000000319c6bae61c5cfef1b1ff11a4066b9f04611f5705cb9113068ef7583e8dd15a12d6dee5ef5f6532579cf788e88ece806fe56d31bc8d122993a3d29a26d850ff8fdb605edc5d0709d50000000000000001801000000000000244ccf14d98ff4b881fba521c65277371d28c9c31131147b1dc261bef9bdd8b44150f3309419ef2b1b8db313ab"], 0x258}, 0x40000) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="3400000010000104", @ANYRES32=0x0, @ANYBLOB="5d5b00000000000014003500776731000000000000"], 0x34}}, 0x0) 1.899302058s ago: executing program 7 (id=6189): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e20, @local}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000010c0)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000300)={r2, @in={{0x2, 0x4e24, @empty}}, [0x9e, 0x8000000000000001, 0x800, 0x8001, 0x9, 0xffffffffffffffff, 0x6, 0x5, 0x8, 0x8, 0x0, 0x3f, 0x9, 0xb, 0x406]}, &(0x7f0000000000)=0xfc) (fail_nth: 2) 1.363011614s ago: executing program 3 (id=6190): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/kexec_crash_size', 0x149a82, 0x24) syz_open_dev$sndctrl(&(0x7f0000002300), 0x9, 0x800) recvmmsg(r0, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)=""/28, 0x1c}], 0x1}, 0x4}, {{&(0x7f00000001c0)=@nfc_llcp, 0x80, &(0x7f0000000240)=[{&(0x7f0000000140)=""/55, 0x37}], 0x1}, 0xfffffffe}, {{&(0x7f0000000280)=@isdn, 0x80, &(0x7f0000000400)=[{&(0x7f0000000300)=""/240, 0xf0}], 0x1, &(0x7f0000000440)=""/226, 0xe2}, 0xfffffffa}, {{&(0x7f0000000540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000005c0)=""/238, 0xee}, {&(0x7f00000006c0)=""/186, 0xba}, {&(0x7f0000000780)=""/197, 0xc5}, {&(0x7f0000000880)=""/148, 0x94}, {&(0x7f0000000940)=""/115, 0x73}], 0x5}, 0x3f3}, {{&(0x7f0000000a40)=@nl, 0x80, &(0x7f0000001f80)=[{&(0x7f0000000ac0)=""/149, 0x95}, {0x0}, {&(0x7f0000000c40)=""/12, 0xc}, {&(0x7f0000000c80)=""/195, 0xc3}, {&(0x7f0000000d80)=""/170, 0xaa}, {&(0x7f0000000e40)=""/81, 0x51}, {&(0x7f0000000ec0)=""/4096, 0x1000}, {&(0x7f0000001ec0)=""/94, 0x5e}, {&(0x7f0000001f40)=""/16, 0x10}], 0x9, &(0x7f0000002040)=""/146, 0x92}}, {{0x0, 0x0, &(0x7f0000002680)=[{&(0x7f0000002100)=""/234, 0xea}, {&(0x7f0000006480)=""/169, 0x2d}, {&(0x7f0000004d40)=""/111, 0x6f}, {&(0x7f0000002340)=""/250, 0xfa}, {&(0x7f0000002440)=""/94, 0x5e}, {&(0x7f00000024c0)=""/209, 0xd1}, {&(0x7f00000025c0)=""/114, 0x72}, {&(0x7f0000002640)=""/38, 0x26}], 0x8, &(0x7f0000002700)=""/152, 0x98}, 0x7}, {{0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f00000027c0)=""/4096, 0x1000}], 0x1, &(0x7f0000003800)=""/242, 0xf2}, 0x3}, {{&(0x7f0000003900)=@generic, 0x80, &(0x7f0000004c00)=[{&(0x7f0000003980)=""/218, 0xda}, {&(0x7f0000003a80)=""/79, 0x4f}, {&(0x7f0000003b00)=""/4096, 0x1000}, {&(0x7f0000004b00)=""/223, 0xdf}], 0x4, &(0x7f0000004c40)=""/69, 0x45}, 0x3}, {{&(0x7f0000004cc0)=@xdp, 0x80, &(0x7f0000004e40)=[{&(0x7f0000002200)=""/231, 0xe7}], 0x1}, 0x3eef}, {{&(0x7f0000004e80)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000005080)=[{&(0x7f0000004f00)=""/253, 0xfd}, {&(0x7f0000005000)=""/109, 0x6d}], 0x2, &(0x7f00000050c0)=""/4096, 0x1000}, 0x9}], 0xa, 0x1, &(0x7f0000006340)) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000140)={0x0, 0x5, 0x2, {0xa, @pix_mp={0x9, 0x2, 0x0, 0x8, 0xa, [{0xd, 0x2}, {0x3, 0x8001}, {0xa64a80ed, 0x7fffffff}, {0x4, 0x3ff}, {0x5, 0x1}, {0x8, 0x8}, {0x7ff, 0x9}, {0x6, 0xfffffffe}], 0x7, 0xff, 0x6, 0x1, 0x5}}, 0x4}) write$cgroup_int(r0, &(0x7f0000000040)=0x800000000001c8, 0x12) read$FUSE(r0, &(0x7f0000000240)={0x2020}, 0x2020) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a0400eb2636037f00000000", @ANYRES32=r3, @ANYBLOB="020000000000800080001200080001007674693674000200600004"], 0xa0}}, 0x0) 1.316654795s ago: executing program 2 (id=6191): r0 = socket$inet6(0x10, 0x3, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(r0, 0x7, &(0x7f0000000340)={0x1, 0x3, 0xfffffffffffffffc, 0x8}) rt_sigprocmask(0x2, &(0x7f0000000180)={[0xfffffffffffffffb]}, &(0x7f00000001c0), 0x8) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000100)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r4 = fcntl$dupfd(r3, 0x406, r3) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB], 0x3c}}, 0x4800) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="4800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000005c345f99d6250b2f800b200005804e20000004000600ffff0a007a4403e7e8e0b9926f801eda2495074b5fce56c3690ecb561cfe3e7d40fbdcfefb0d51e7f470b8310330edf490aca9a15b4ae059daf451ced6a14d048fe0747d6e06281330437086adad0b54bf9a763dfbe612837044ea92548f6ff90d3466a00e1f802fb7c61879bcedbb481e9508f10adcf83683577a39e5e9044071fc475ac977554a78d00e812bde6818fc4239f6b64e7535c74c5ee985670f751f9142f33aa939668daa47ce2c4aff3b50a2cc3c0eb86c92", @ANYRES32, @ANYBLOB], 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x80) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000240)={0x1, &(0x7f0000000280)=[{0x6, 0xfd, 0xd8, 0xe4}]}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmsg$TIPC_NL_NODE_GET(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[], 0x134}, 0x1, 0x0, 0x0, 0x24040841}, 0x40008) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x7, 0x0, 0x106, 0x4}}, 0x20) socket$inet_sctp(0x2, 0x0, 0x84) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r4) sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)=ANY=[@ANYRES16=0x0, @ANYBLOB="000526bd7100fedbdf250b000000400001800800030001000000080003000200000008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="1400020064766d727031000000000000000000000800030002000000"], 0x54}, 0x1, 0x0, 0x0, 0x40080c0}, 0x0) shutdown(r3, 0x1) 1.228708998s ago: executing program 3 (id=6192): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000080), 0x10) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r2, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) lseek(0xffffffffffffffff, 0x9, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000015c0)={{0x14}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x28}}, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000180)='./control\x00', 0xa4000960) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000000)=0xffff0018) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000680)={0x0, 0x4, 0x28}, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x11, 0x13, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, [@btf_id={0x18, 0x0, 0x3, 0x0, 0x4}, @jmp={0x5, 0x0, 0x0, 0x7, 0xb, 0x1, 0xfffffffffffffff0}, @map_idx_val={0x18, 0xb, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8}, @map_val={0x18, 0xa, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1c3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f00000004c0)='GPL\x00', 0x6, 0x55, &(0x7f0000000580)=""/85, 0x41000, 0x40, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f0000000500)={0x0, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000700)=[{0x1, 0x1, 0x8}, {0x1, 0x2, 0x5, 0x8}], 0x10, 0x2}, 0x94) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNISCRNMAP(r4, 0x4b46, &(0x7f00000000c0)) 1.159948451s ago: executing program 7 (id=6193): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000480)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d01000000000000000000060006241a0000000905810300020000000903e60000020d00000904010102020d000009058202"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_io_uring_setup(0x6410, &(0x7f0000000200)={0x0, 0x4661, 0x4000, 0x7, 0x288}, &(0x7f0000000440)=0x0, &(0x7f0000000280)=0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000002c0), 0x4) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f00000003c0)=@hci={0x1f, 0xffffffffffffffff, 0x4}, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000100)="4c1432762d048095929ee7e68a285a4a8382892e564c8008a4f1ec92e686194b1b961c5fc95c7de90c4619998621ac8ab0b72f18e665b98e645544e0", 0x3c}, {&(0x7f0000000500)="33de7f75d04088742cf8f07d0ad454ba08b71ecf51185bae246cb66917c987eaa8cff5b7c119fe12ebd911e56d293ee4047219404cee865c60ff9d4eadfb4446097b90c377c96873aeb8cfbf15ab9eea7d853de815d15ee155dfd376c49f62c3fd7ea85cbe02199e082a05af294030ea20a7a1e14156493f60e3c743edcf5255e39a3e6e6f33770345706161d03879750c452e75ee0b8e05c8d6c9cdf4daeb7ac95bee32ad86240694e2186e6885cfe52e89fa3292b4a278cd03258f7a4808a65c8dba12ba0ae7da9a6b0e0f6832eaac39", 0xd1}, {&(0x7f0000000600)="ba0b6e2f32cdd663066804ed1803d2addd6c7512e9a7512ae4775486e914d3fd043177247d7835bac3b92611e8034158cf312c1164837ececac4a8ed85888847b3c215c8c3239f8084e0d02aa16ae9fd8c8273a29fa6fd794ba546b01fc491babcb72906817bf821c113a427c6391eecfb4c2e8dc698934e7fff45b9dc3bdc55e9e9c3be7eb612b847288f060efb52a1d54796374081231702a3fde7cf3be0fad104354332cffcee901e50d77b36b260856c8cf56b27ac50df53b66d73127259ac1d1be773bc026ed3c05a741421dc9611905bb3ad78ccb3687c561fbd6ba77d6b84245dc42bbdc160a50077a86a969b44e5ed432c09b191", 0xf8}, {&(0x7f0000000700)="5a2964fe9b65dd44a50226f6a789db32fd87ea4952c99643e348495e3ff10fd8a1429846181baf4818776bbb653ee9644ac8d39547af382dd9c9ca4ee0714c95fac5c41a05d8ca", 0x47}, {&(0x7f0000000780)="b535c1285eb6e43999bbff74b742aa5a620b860bad3b1aad24f31853d8027c4790929060d1be91ccb6e0f08418351313c79591a7e3bf2fd77e6836d36006bdf21bdc747ff1d179985bb0ad96725df0b66f341d8c9be298bd2dcba3ba31f6bba4f7ea3be0898ea6b6c5f3a214d017211c43b46918ce03", 0x76}, {&(0x7f0000000800)="77ff4e0bc8edf509755a4b2499c0e903d6e9221490ca9f427b171972aad7fa520af1687071b19380ef9152ca3f539d66c8667f84222d88c9dbe6029190211f4a4bd8f28d244e27f34d9f6071562bf568d26ecfdde08a156488c6df03513f42b660375d589b0bba1217521adc8aa2fd31cbf49f3fb6ddfa90da24ea0ecf92d3c30528fc52b1faddef59c82879f2f18780d6d50fc0a5", 0x95}], 0x6}, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000480)={@in={{0x2, 0x4e23, @loopback}}, 0x0, 0x20000000005, 0x4a}, 0xd8) bind$inet(r5, &(0x7f0000deb000)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x240087f9, &(0x7f0000000100)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) sendmmsg$inet(r5, &(0x7f0000000bc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000240)="73ab40a36755d3", 0x7}], 0x1}}], 0x1, 0x20008084) close(r5) getsockopt$sock_int(r3, 0x1, 0x10, 0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000940)=0x7, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4007, @fd_index=0x3, 0x0, 0x0}) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0, 0x58}], 0x1}, 0x0) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace$peek(0x3, r7, &(0x7f0000000000)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000980)=@deltclass={0x68, 0x29, 0x200, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {}, {0x4, 0xa}, {0x10, 0xffe0}}, [@TCA_RATE={0x6, 0x5, {0x2, 0x4}}, @tclass_kind_options=@c_mq={0x7}, @TCA_RATE={0x6, 0x5, {0x80}}, @tclass_kind_options=@c_mq={0x7}, @TCA_RATE={0x6, 0x5, {0x10, 0xfe}}, @tclass_kind_options=@c_fq_codel={0xd}, @tclass_kind_options=@c_clsact={0xb}]}, 0x68}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newqdisc={0x3c, 0x24, 0xd0f, 0x70bd2a, 0x0, {0x60, 0x0, 0x0, r9, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x0, 0x7ffffffd}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x3000c81c) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x40000000000009f, 0x0) 755.896711ms ago: executing program 5 (id=6194): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000140)=0x7fc, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, &(0x7f0000000080)=0x1, 0x4) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0xf, @empty, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000e80)=[{{&(0x7f0000000440)={0xa, 0x4e20, 0x2, @empty, 0x6}, 0x1c, &(0x7f0000000c40)=[{&(0x7f0000000300)="d5", 0x1}], 0x1}}, {{0x0, 0x2c, &(0x7f0000002180)=[{&(0x7f0000000340)="11a3cfd7e178ca077da8522d90a9c270be7c6b1c81ac14e84a3fc3f80efa885f32f3a74436383ecbea186c71d313adcbc16503", 0x33}], 0x1}}], 0x2, 0x20080058) 616.92454ms ago: executing program 5 (id=6195): syz_emit_ethernet(0xbe, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x9c, 0x0, @wg}}}}}, 0x0) syz_emit_ethernet(0x9e, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x90, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x7c, 0x0, @wg=@data={0x4, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00 \x00'/100}}}}}}, 0x0) 588.622372ms ago: executing program 5 (id=6196): r0 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) r1 = syz_open_procfs(0x0, &(0x7f0000002440)='statm\x00') read$FUSE(r1, &(0x7f0000000400)={0x2020}, 0x2020) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f00000005c0)={'syz', 0x1}, &(0x7f0000000980)="475a251bdb1e4c438649cdf2494dde32cd76aeabc8ca949257819f25159c532504978ed33d145658cce40a3dd867df925cbedfbd01f157cae933c958c5dfdc1e0132e03f60e3418410fe17f95bdb8090c4adb3636ea342fb8589cf4944e42579da1d2aa919fa78d9e27565fc30d2513293f3cc7d6c7d2d1fb756b0d7b352efd07bd38bedcabb8d856610db17155de5bb0409e3713b2c73464055345b98fe30949e7ee8cddc663f3d5d50881520df8da5115d6d8d81bc62e8dde2460f128365ca184efc5e1b14ff3f4ad1c1f7bad98a9435c0d757ddb9dcd577f5ae33ef675676ba7b44be538aeec0e6ec4973865dc2bb0f0847ded0a131f3b01ac48e070783564cd9031b3b9fcbeafb69dd253e8cbc2c12307f03154573a27f6f00073aae7c4c1701a3f745744c254ddd3b43988c7bbdec9c1e158fda3cdffc887206b78fb1fc943810dc473894738286878513d06aa7f074a11983261f5be648b4b76893a5f733bdafcf42427743534de2bfcf27f014923488c6476dd417344045c747c68c69e3eb5357e69d97a2cfafa44e2547aa21548dfc0739e49321684120c8bdb64448689a3412eebaca2e4b2a2ecf96690f9fec7d569087bc8561cff6012cf5cb14775230226b95a9ded9cccfedafe61c550376adf0b1b59abf9f92da6247e1061afe2eaa9d8f5a28d63db50fca875020da59426501eab6602beb74de33df143ccb60c70f950f5f53f1d5aca6371dfc8dd68cbe7ccfbe0f52e1ff238105dd93d8a3a72da45ce79824d6b091d9c91509cb290afd01f1945b118f2c1c58f17c0b59fbd872412d7d291dcecad019af039375aeee7ddcf36ede82914f64bb41281962c9b10216907c37d06aa5a5b33afe0547c6726ee169779ad6d5cfc5f373f75b234df4ac2007c6db9dc6a0fc3e7e1d2f2658e928c2a854483e6780d69908692d0166ab5334cd5ceb7a69a420803b7ca33e4609f61cfda3b631b54fb81a7473b4bbe2eabc17276f8a009668d634f332fe47fda76a1fae8fe9c3c8962f7ca7a102d5ecd1d6029abb6c422026af6ef277a4c6c21f07121cd8bcce6f1792ea6a628580b478d72b32dd50f59e893bfcf353bea1e2ddbd349c16ccc23bceb8f3b64aa16257eedabadaead30f912bd0e579c0b71e6cd86804fc39a074f94da63f0db97c5f41e38541bf441f49d2751966cc78dacd150ae0b91ffe1f5a117fe494a8b60a17ccfbc780f82f0ea96d8db842e07fb4d68edbe28119a6c2ab72ea15a5ba75ac8193dd7411d9aeece6fc23ac00370c84d7e03990ca3697a0187cc3286e4536ace023ec21389ff08cddb1e9075d1e1b3a98a95720f44e50830ad54fecd437a40f483579c7a5eb40e52e75099d9ada449ba4d0751e44de6edd5e17caa91cfb3bf88bb1e093bd76952c80669845d3cbcde8acf7415ed30ad3a0ff648968d036af2de90f2ab93b250b9386fcba42c1ba01cc951fa1f62ebbb99ad6576d803d29e81ed319350ee0a032bfab9b079ea5a29c66f665ce9ccb6b908593ae2406332c5ac7d11c9b830593576177b2af5d70c65dda56b98448862b75a54b3447534d45e0b5a52edc1a76c97f511030bd261bb1a443e1a38a78973f0781efa9910ebe207457587dbc803e68b2cb985c03c4dfbac440d58c90de66a634c07b13197b9e7d42657fb0537abe475fb56fe24cdcd771d9ac5bcea1c915a77d731d2d16a54885387e034aab6db1718521eeb07b0326d23decd5bba45b311d8617bbfd3afc10923567e8987c95260ab90ba3ff1309273a2a615174d9a33c11bfd393013c314d3df8cf4e584b752c30f54e09a38409a34cdaee74f30547b7dfdb3c48d6b4d5b7346ebcaf7fdbb91d9d45ba303e2ea2736f28301c7b8354bc6f89f58841cb844646a57153c83cd03687d8d3a6b95e93f8abd1218af123ada0de5025d18e4599c8d34cdd8ecf91af7a647c6b43d4704446a104829783ec10b68d95418ddfe8b0dc6552069bd07e4452821317131b7a76887fd792c431e6c07d770926c4e60243d198372482b911d29daac57d92f12d7f471657107a8a910d9abd67bac6eec6e0858e7cf078579621", 0x5c1, r0) 498.48946ms ago: executing program 5 (id=6197): ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x4048aec9, &(0x7f0000000080)={[{0x80000000, 0xffff, 0x0, 0x4, 0x0, 0x10, 0x5, 0x0, 0x80, 0x0, 0xa, 0x0, 0x4}, {0xa, 0x0, 0xfc, 0x0, 0x40, 0x22, 0x12, 0xfd, 0x7, 0x0, 0x5, 0x0, 0xfffffffffffffff7}, {0x200001, 0x2, 0x21, 0x5, 0x80, 0x2, 0x0, 0x0, 0x55, 0xb, 0x1, 0x0, 0x28080}], 0x6}) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x20048810) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a"], 0x38}}, 0x2000018c) r1 = fsopen(&(0x7f0000000280)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000040)='source', &(0x7f0000002280)='//\xf2b\x06\b\xba\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\\\\\\x00\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x97\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8DD\x9bp\x01\xcc:\xa6\xc5n\x9f\xfb\x81 \x10\x0fQ\x90}Zd\xeb\xab\xf70\x99\xef\x8br2}, './file0\x00'}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000240)={'vlan1\x00'}) 387.261767ms ago: executing program 5 (id=6198): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[], 0x68}}, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f0000000280)={{0x6, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, [0x0, 0x2, 0x6, 0xfffffffffffffffe, 0xffffffefffffffff, 0x0, 0x4, 0x0, 0x7, 0x4, 0x0, 0x0, 0xfffffeffbfffffff, 0x0, 0x0, 0x0, 0x3, 0x80000000, 0x3, 0x0, 0x0, 0x4000004, 0x0, 0x6, 0x0, 0x40, 0x0, 0xfffffffffffffffd, 0x1001ffdfd, 0xe, 0x6, 0x0, 0xfffffffffffffffe, 0x0, 0x9, 0x0, 0x10000, 0x1000, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x3, 0x3, 0x0, 0x7, 0x10000, 0x7785, 0x0, 0x4, 0x4, 0x8, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x3, 0x0, 0x80000002000, 0x0, 0x4, 0x0, 0xfffffffffffffffe, 0x2c1, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xb, 0x0, 0x80000000000000, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4, 0x0, 0x10, 0x0, 0x10000000000, 0xfffffffffffffffd, 0xfffffffffffffffd, 0x0, 0xfffffffffffffffd, 0x0, 0x100, 0x81, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x100000000000, 0xffffffffffffffff, 0x3, 0x7, 0x0, 0x7, 0xc0c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xffffffffffeffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x20000000, 0x0, 0x80]}) readahead(0xffffffffffffffff, 0x100, 0x96) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r2, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x550, 0x40, 0xffc, 0x0, 0xd968d5b908ac0cde, 0x2, {0x0, 0x8}, {0x350, 0x0, 0x1}, {0xf4ef}, {0x30000, 0x4, 0xffe}, 0x1, 0x100, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x8, 0x4, 0x0, 0xb}) 173.240681ms ago: executing program 4 (id=6199): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000480)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d01000000000000000000060006241a0000000905810300020000000903e60000020d00000904010102020d000009058202"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_io_uring_setup(0x6410, &(0x7f0000000200)={0x0, 0x4661, 0x4000, 0x7, 0x288}, &(0x7f0000000440)=0x0, &(0x7f0000000280)=0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000002c0), 0x4) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f00000003c0)=@hci={0x1f, 0xffffffffffffffff, 0x4}, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000100)="4c1432762d048095929ee7e68a285a4a8382892e564c8008a4f1ec92e686194b1b961c5fc95c7de90c4619998621ac8ab0b72f18e665b98e645544e0", 0x3c}, {&(0x7f0000000500)="33de7f75d04088742cf8f07d0ad454ba08b71ecf51185bae246cb66917c987eaa8cff5b7c119fe12ebd911e56d293ee4047219404cee865c60ff9d4eadfb4446097b90c377c96873aeb8cfbf15ab9eea7d853de815d15ee155dfd376c49f62c3fd7ea85cbe02199e082a05af294030ea20a7a1e14156493f60e3c743edcf5255e39a3e6e6f33770345706161d03879750c452e75ee0b8e05c8d6c9cdf4daeb7ac95bee32ad86240694e2186e6885cfe52e89fa3292b4a278cd03258f7a4808a65c8dba12ba0ae7da9a6b0e0f6832eaac39", 0xd1}, {&(0x7f0000000600)="ba0b6e2f32cdd663066804ed1803d2addd6c7512e9a7512ae4775486e914d3fd043177247d7835bac3b92611e8034158cf312c1164837ececac4a8ed85888847b3c215c8c3239f8084e0d02aa16ae9fd8c8273a29fa6fd794ba546b01fc491babcb72906817bf821c113a427c6391eecfb4c2e8dc698934e7fff45b9dc3bdc55e9e9c3be7eb612b847288f060efb52a1d54796374081231702a3fde7cf3be0fad104354332cffcee901e50d77b36b260856c8cf56b27ac50df53b66d73127259ac1d1be773bc026ed3c05a741421dc9611905bb3ad78ccb3687c561fbd6ba77d6b84245dc42bbdc160a50077a86a969b44e5ed432c09b191", 0xf8}, {&(0x7f0000000700)="5a2964fe9b65dd44a50226f6a789db32fd87ea4952c99643e348495e3ff10fd8a1429846181baf4818776bbb653ee9644ac8d39547af382dd9c9ca4ee0714c95fac5c41a05d8ca", 0x47}, {&(0x7f0000000780)="b535c1285eb6e43999bbff74b742aa5a620b860bad3b1aad24f31853d8027c4790929060d1be91ccb6e0f08418351313c79591a7e3bf2fd77e6836d36006bdf21bdc747ff1d179985bb0ad96725df0b66f341d8c9be298bd2dcba3ba31f6bba4f7ea3be0898ea6b6c5f3a214d017211c43b46918ce03", 0x76}, {&(0x7f0000000800)="77ff4e0bc8edf509755a4b2499c0e903d6e9221490ca9f427b171972aad7fa520af1687071b19380ef9152ca3f539d66c8667f84222d88c9dbe6029190211f4a4bd8f28d244e27f34d9f6071562bf568d26ecfdde08a156488c6df03513f42b660375d589b0bba1217521adc8aa2fd31cbf49f3fb6ddfa90da24ea0ecf92d3c30528fc52b1faddef59c82879f2f18780d6d50fc0a5", 0x95}], 0x6}, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000480)={@in={{0x2, 0x4e23, @loopback}}, 0x0, 0x20000000005, 0x4a}, 0xd8) bind$inet(r5, &(0x7f0000deb000)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x240087f9, &(0x7f0000000100)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) sendmmsg$inet(r5, &(0x7f0000000bc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000240)="73ab40a36755d3", 0x7}], 0x1}}], 0x1, 0x20008084) close(r5) getsockopt$sock_int(r3, 0x1, 0x10, 0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000940)=0x7, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4007, @fd_index=0x3, 0x0, 0x0}) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0, 0x58}], 0x1}, 0x0) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000980)=@deltclass={0x68, 0x29, 0x200, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {}, {0x4, 0xa}, {0x10, 0xffe0}}, [@TCA_RATE={0x6, 0x5, {0x2, 0x4}}, @tclass_kind_options=@c_mq={0x7}, @TCA_RATE={0x6, 0x5, {0x80}}, @tclass_kind_options=@c_mq={0x7}, @TCA_RATE={0x6, 0x5, {0x10, 0xfe}}, @tclass_kind_options=@c_fq_codel={0xd}, @tclass_kind_options=@c_clsact={0xb}]}, 0x68}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newqdisc={0x3c, 0x24, 0xd0f, 0x70bd2a, 0x0, {0x60, 0x0, 0x0, r9, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x0, 0x7ffffffd}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x3000c81c) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x40000000000009f, 0x0) 172.209494ms ago: executing program 2 (id=6200): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x24048890) r1 = socket$pppl2tp(0x18, 0x1, 0x1) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0x38}}, 0x2000018c) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x51d4c0, 0x0) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) r5 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_pidfd_open(r5, 0x0) setns(r6, 0x24020000) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r7, 0x0, r7, 0x0, 0x154) write$vga_arbiter(r2, &(0x7f0000000100)=@other={'decodes', ' ', 'io+mem'}, 0xf) socket$kcm(0x29, 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e"], 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) read$FUSE(r7, &(0x7f0000000e80)={0x2020}, 0x2020) r10 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r10, 0x1, 0x2f, &(0x7f0000000140), 0x4) r11 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="c8010000", @ANYRES16=r11, @ANYBLOB="0100000000000000000001000000060006000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5426c010880f4000080060005000180000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff240002001bc715ee4868b12a49f4df11bc05475489f6a27c4d6483ad2fa5e45903b0ce851400040002000000ac1414aa00000000000000008c00098028000080060001000a00000014000200ff020000000000000000000000000001050003000000000028000080060001000a000000140002000000000000000000000000000000000105000300030000001c000080060001000200da0008000200e000000105000300000000001c000080060001000200000008000200ac141400050003000000000074000080200004000a004e2200000000fc0000000000000000000000000000000400000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff080003000100000024000200cde20bc0d9b90ac13642d7b66459dd9db5e20b4b16d3d23f2cb03a8aa417dce6080007000000000014000200776730"], 0x1c8}}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f00000002c0)={'erspan0\x00', 0x0}) sendmsg$nl_route(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000140)=@newlink={0x40, 0x10, 0xc3b, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r13, 0x0, 0x6200}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_TYPE={0x6}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x180}, 0x40080c0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'tunl0\x00', &(0x7f00000002c0)={'sit0\x00', 0x0, 0x20, 0x20, 0xffff0000, 0xfffffffa, {{0xc, 0x4, 0x3, 0x14, 0x30, 0x64, 0x0, 0x7, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x3a}, @multicast1, {[@rr={0x7, 0xb, 0xcd, [@broadcast, @private=0xa010101]}, @noop, @ra={0x94, 0x4}, @rr={0x7, 0xb, 0xde, [@local, @remote]}]}}}}}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'syzkaller1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r8, &(0x7f0000000440)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="88000000", @ANYRES16=r11, @ANYBLOB="01002abd7000ffdbdf2501000000140002007767320000000000000000000000000008000100", @ANYRES32=r13, @ANYBLOB="060006004e23000008000100", @ANYRES32=r14, @ANYBLOB="0800050000000000080005000000000008000100", @ANYRES32=r15, @ANYBLOB="06000600c8e02414000200776731000000000000000000000000001400020077673100"/48], 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x42080) 0s ago: executing program 2 (id=6201): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) (async) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20002) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffe, 0x0, 0x0, @buffer={0x2, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x25, 0x0, 0x0}) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) r5 = syz_open_procfs(0x0, &(0x7f0000000600)='net/rfcomm\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) socket(0x22, 0x2, 0x3) (async) sendto$inet6(r6, &(0x7f0000000440), 0x0, 0x800, &(0x7f000005ffe4)={0xa, 0x4e23, 0x4000, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4000}, 0x1c) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x5, 0xf, 0x0, 0x2, 0x8, 0x8, 0xfffffffa, 0x3}, 0x0) (async) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) (async) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in={{0x2, 0x4e21, @loopback}}, 0x0, 0x0, 0x43, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) (async) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) ioctl$VHOST_SET_LOG_BASE(r5, 0x4008af04, &(0x7f0000000200)=&(0x7f0000000180)) (async) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) (async) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x1, &(0x7f00000001c0)=@ccm_128={{0x303}, "3d186e85f3a07d09", "a373047e6878fdb57fc2596912f8bdfd", "27edd157", "3684fa3381fd0182"}, 0x28) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r7, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) (async) r8 = syz_open_dev$sndpcmp(&(0x7f0000000180), 0x1, 0x1) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r8, 0xc2604110, &(0x7f0000000380)={0x80, [[0x3, 0x2, 0x0, 0x9000, 0x2, 0x0, 0x0, 0x9], [0x4, 0x1, 0x3, 0x0, 0x0, 0x80, 0x0, 0xfffffff9], [0x2, 0x0, 0x30f, 0xaa83, 0x2, 0x0, 0x0, 0x8000000]], '\x00', [{0x9, 0x15}, {0x0, 0xa}, {0x0, 0x1efb660a}, {}, {0x61e}, {0xfffffff9}, {}, {0xbffffffd, 0x9}, {0x8, 0x1000008}, {}, {0x0, 0x1000000}, {0x0, 0xb}], '\x00', 0x5, 0x0, 0x0, 0x500, 0x0, 0x2}) (async) ioctl$int_in(r7, 0x5421, &(0x7f0000000140)=0x1) (async) writev(r7, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) close(r7) kernel console output (not intermixed with test programs): 3][T24264] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5555'. [ 1149.002964][ C1] kye 0003:0458:5016.0025: usb_submit_urb(ctrl) failed: -1 [ 1149.181691][ T5964] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1149.190983][ T5964] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1149.199222][ T5964] usb 4-1: Product: syz [ 1149.207981][ T5964] usb 4-1: Manufacturer: syz [ 1149.212910][ T5964] usb 4-1: SerialNumber: syz [ 1149.376537][T24265] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1149.387817][T24265] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1149.536974][T24243] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1149.556658][T24243] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1150.055082][T22998] usb 6-1: USB disconnect, device number 27 [ 1150.160133][ T43] usb 3-1: new full-speed USB device number 62 using dummy_hcd [ 1150.220021][T22998] usb 6-1: new full-speed USB device number 28 using dummy_hcd [ 1150.321849][ T43] usb 3-1: config 8 has an invalid interface number: 177 but max is 0 [ 1150.330316][ T43] usb 3-1: config 8 has no interface number 0 [ 1150.336556][ T43] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 1150.347884][ T43] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1150.358514][ T43] usb 3-1: config 8 interface 177 has no altsetting 0 [ 1150.366225][ T43] usb 3-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1150.375448][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1150.385387][T22998] usb 6-1: config 8 has an invalid interface number: 177 but max is 0 [ 1150.394965][T22998] usb 6-1: config 8 has no interface number 0 [ 1150.410271][T24271] raw-gadget.6 gadget.2: fail, usb_ep_enable returned -22 [ 1150.421288][T22998] usb 6-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 1150.433876][T22998] usb 6-1: config 8 interface 177 altsetting 9 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1150.443894][T22998] usb 6-1: config 8 interface 177 has no altsetting 0 [ 1150.451488][T22998] usb 6-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1150.460667][T22998] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1150.473815][T24269] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 1150.655362][ T43] usb 3-1: string descriptor 0 read error: -71 [ 1150.663865][ T43] ir_toy 3-1:8.177: required endpoints not found [ 1150.700600][ T43] usb 3-1: USB disconnect, device number 62 [ 1150.807512][T22998] ir_toy 6-1:8.177: required endpoints not found [ 1150.826921][T22998] usb 6-1: USB disconnect, device number 28 [ 1151.309989][T22998] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1151.376948][ T9] usb 5-1: USB disconnect, device number 32 [ 1151.452271][ T5964] usb 4-1: 2:1: invalid format type 0x1001 is detected, processed as PCM [ 1151.473991][T22998] usb 6-1: Using ep0 maxpacket: 16 [ 1151.514413][T22998] usb 6-1: config 0 has an invalid interface number: 41 but max is 0 [ 1151.531457][ T5964] usb 4-1: 2:1 : sample bitwidth 65 in over sample bytes 0 [ 1151.543259][T22998] usb 6-1: config 0 has no interface number 0 [ 1151.561274][T22998] usb 6-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1151.574361][T22998] usb 6-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1151.584886][T22998] usb 6-1: config 0 interface 41 has no altsetting 0 [ 1151.595080][T22998] usb 6-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 1151.616831][T22998] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1151.632882][ T5964] usb 4-1: 2:1 : unsupported sample bitwidth 65 in 0 bytes [ 1151.652705][T22998] usb 6-1: Product: syz [ 1151.657052][T22998] usb 6-1: Manufacturer: syz [ 1151.663049][T22998] usb 6-1: SerialNumber: syz [ 1151.694103][T22998] usb 6-1: config 0 descriptor?? [ 1151.706552][T24275] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 1151.720337][T24275] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 1151.777264][ T5964] usb 4-1: USB disconnect, device number 53 [ 1151.841321][T11682] udevd[11682]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1151.946776][T24275] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 1151.972369][T24275] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 1152.206122][T24302] libceph: resolve '0.0' (ret=-3): failed [ 1152.273441][T24302] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5567'. [ 1152.360045][ T43] usb 4-1: new full-speed USB device number 54 using dummy_hcd [ 1152.414254][T22998] Error reading MAC address [ 1152.427462][T24275] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 1152.435215][T24275] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 1152.523058][ T43] usb 4-1: config 8 has an invalid interface number: 177 but max is 0 [ 1152.559313][ T43] usb 4-1: config 8 has no interface number 0 [ 1152.583249][ T43] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 1152.630015][ T43] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1152.640951][ T43] usb 4-1: config 8 interface 177 has no altsetting 0 [ 1152.648079][ T43] usb 4-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1152.658651][T22998] sr9700 6-1:0.41 (unnamed net_device) (uninitialized): Error reading MAC address [ 1152.671116][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1152.683343][T22998] usb 6-1: USB disconnect, device number 29 [ 1152.696271][T24300] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1152.850091][ T5964] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1153.020005][ T5964] usb 3-1: Using ep0 maxpacket: 32 [ 1153.028250][ T5964] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 1153.040073][ T5964] usb 3-1: config 0 has no interface number 0 [ 1153.046333][ T5964] usb 3-1: config 0 interface 184 has no altsetting 0 [ 1153.059728][ T5964] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1153.074614][ T5964] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1153.082827][ T5964] usb 3-1: Product: syz [ 1153.088170][ T5964] usb 3-1: Manufacturer: syz [ 1153.093206][ T5964] usb 3-1: SerialNumber: syz [ 1153.098227][T24307] bond0: Removing last ns target with arp_interval on [ 1153.129412][ T5964] usb 3-1: config 0 descriptor?? [ 1153.138911][ T50] bond0: (slave bond_slave_0): interface is now down [ 1153.140835][T24307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1153.159407][ T43] ir_toy 4-1:8.177: required endpoints not found [ 1153.160325][ T5964] smsc75xx v1.0.0 [ 1153.171482][ T50] bond0: (slave bond_slave_1): interface is now down [ 1153.202045][ T43] usb 4-1: USB disconnect, device number 54 [ 1153.212101][ T50] bond0: now running without any active interface! [ 1153.577638][ T5964] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 1153.604330][ T5964] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 1153.615562][ T5964] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 1153.628289][ T5964] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -61 [ 1153.790037][ T43] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 1154.060210][ T43] usb 6-1: Using ep0 maxpacket: 8 [ 1154.106956][ T43] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1154.249691][ T43] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1154.274766][ T43] usb 6-1: config 1 has no interface number 1 [ 1154.294949][ T43] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1154.403737][ T43] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1154.436885][ T43] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1154.468329][ T43] usb 6-1: Product: syz [ 1154.489607][ T43] usb 6-1: Manufacturer: syz [ 1154.498781][ T43] usb 6-1: SerialNumber: syz [ 1154.819561][T24319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1154.867865][T24319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1155.773966][ T5964] usb 3-1: USB disconnect, device number 63 [ 1156.199585][T24355] syzkaller1: entered promiscuous mode [ 1156.263580][T24355] syzkaller1: entered allmulticast mode [ 1156.293692][T24358] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5583'. [ 1156.320387][T24358] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5583'. [ 1156.378632][T24357] netlink: 'syz.7.5586': attribute type 2 has an invalid length. [ 1156.400096][ T5964] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 1156.434800][T24357] !: entered promiscuous mode [ 1156.564688][ T5964] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1156.601115][ T5964] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1156.627691][ T5964] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1156.649972][ T5964] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1156.664573][ T5964] usb 3-1: Product: syz [ 1156.674155][ T5964] usb 3-1: Manufacturer: syz [ 1156.679236][ T5964] usb 3-1: SerialNumber: syz [ 1156.691963][ T43] usb 6-1: 2:1: invalid format type 0x1001 is detected, processed as PCM [ 1156.696054][ T5964] usb 3-1: config 0 descriptor?? [ 1156.720151][ T43] usb 6-1: 2:1 : sample bitwidth 65 in over sample bytes 0 [ 1156.737745][ T43] usb 6-1: 2:1 : unsupported sample bitwidth 65 in 0 bytes [ 1156.786209][ T5964] usb 3-1: 0:0 : invalid sync pipe. bmAttributes 00, bLength 9, bSynchAddress 00 [ 1156.800899][ T43] usb 6-1: USB disconnect, device number 30 [ 1157.080230][ T5964] usb 3-1: USB disconnect, device number 64 [ 1157.780163][ T43] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 1157.861522][T22998] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 1157.932068][T24403] Cannot find set identified by id 65534 to match [ 1157.941651][ T43] usb 6-1: Using ep0 maxpacket: 32 [ 1157.962927][T24400] veth0: entered promiscuous mode [ 1158.000866][T24400] veth0: left promiscuous mode [ 1158.060091][T22998] usb 3-1: Using ep0 maxpacket: 8 [ 1158.096206][ T43] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1158.112531][T22998] usb 3-1: config 0 has an invalid interface number: 31 but max is 0 [ 1158.130557][ T43] usb 6-1: no configurations [ 1158.145561][ T43] usb 6-1: can't read configurations, error -22 [ 1158.159319][T22998] usb 3-1: config 0 has no interface number 0 [ 1158.171527][T22998] usb 3-1: New USB device found, idVendor=112a, idProduct=0005, bcdDevice=be.68 [ 1158.181177][T22998] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1158.189224][T22998] usb 3-1: Product: syz [ 1158.194895][T22998] usb 3-1: Manufacturer: syz [ 1158.199563][T22998] usb 3-1: SerialNumber: syz [ 1158.211461][T22998] usb 3-1: config 0 descriptor?? [ 1158.222240][T22998] redrat3 3-1:0.31: Couldn't find all endpoints [ 1158.469454][T24409] bond0: Removing last ns target with arp_interval on [ 1158.483686][ T2994] bond0: (slave bond_slave_1): interface is now down [ 1158.492554][T24409] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1158.520159][ T2994] bond0: (slave bond_slave_1): interface is now down [ 1158.529469][ T2994] bond0: now running without any active interface! [ 1158.895540][T24417] netlink: 72 bytes leftover after parsing attributes in process `syz.5.5607'. [ 1158.935001][T24422] fuse: Unknown parameter '00000000000000000000' [ 1159.209995][ T5907] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 1159.449958][ T5907] usb 4-1: Using ep0 maxpacket: 32 [ 1159.467972][ T5907] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 1159.487874][ T5907] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 1159.496846][ T5907] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 1159.508439][ T5907] usb 4-1: config 1 has no interface number 0 [ 1159.518608][ T5907] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1159.530195][ T5907] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 10229, setting to 1024 [ 1159.542060][ T5907] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 1159.559167][ T5907] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1159.579097][ T5907] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1159.601386][T24422] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1159.623212][ T5907] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 1159.831803][T24422] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1159.842323][ T5907] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now attached [ 1160.059607][T24422] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1160.086033][T24422] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1160.105787][ T43] usb 4-1: USB disconnect, device number 55 [ 1160.121743][ T43] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 1160.230684][T24444] team0: Device ipip0 is of different type [ 1160.821936][ T43] usb 3-1: USB disconnect, device number 65 [ 1160.941594][T24461] bond0: Removing last ns target with arp_interval on [ 1160.948883][T23043] bond0: (slave batadv0): interface is now down [ 1160.957092][T24461] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1160.969126][T24461] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x6 [ 1160.980462][ T50] bond0: (slave batadv0): interface is now down [ 1160.991147][ T50] bond0: now running without any active interface! [ 1161.135553][T24464] vim2m vim2m.0: vidioc_s_fmt queue busy [ 1161.540627][ T43] usb 5-1: new full-speed USB device number 33 using dummy_hcd [ 1161.638739][T24468] xt_hashlimit: max too large, truncated to 1048576 [ 1161.703060][ T43] usb 5-1: config 8 has an invalid interface number: 177 but max is 0 [ 1161.749045][ T43] usb 5-1: config 8 has no interface number 0 [ 1161.781694][ T43] usb 5-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 1161.823579][ T43] usb 5-1: config 8 interface 177 altsetting 9 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1161.875500][ T43] usb 5-1: config 8 interface 177 has no altsetting 0 [ 1161.929992][ T43] usb 5-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1161.939713][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1161.965484][T24466] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1162.115664][T24478] ip6tnl0: Caught tx_queue_len zero misconfig [ 1162.325071][T24484] xt_hashlimit: max too large, truncated to 1048576 [ 1162.433415][ T43] ir_toy 5-1:8.177: required endpoints not found [ 1162.458225][ T43] usb 5-1: USB disconnect, device number 33 [ 1162.968659][T24503] sctp: [Deprecated]: syz.5.5636 (pid 24503) Use of int in maxseg socket option. [ 1162.968659][T24503] Use struct sctp_assoc_value instead [ 1163.059246][T24506] bond0: Removing last ns target with arp_interval on [ 1163.079725][T24506] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1163.580016][ T43] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 1163.660174][T17958] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1163.740103][ T43] usb 6-1: Using ep0 maxpacket: 16 [ 1163.751300][ T43] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1163.764197][ T43] usb 6-1: config 129 has an invalid interface number: 125 but max is 0 [ 1163.773587][ T43] usb 6-1: config 129 has no interface number 0 [ 1163.780838][ T43] usb 6-1: config 129 interface 125 has no altsetting 0 [ 1163.798728][ T43] usb 6-1: New USB device found, idVendor=2c7c, idProduct=0306, bcdDevice=3c.51 [ 1163.813233][ T43] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1163.822653][ T43] usb 6-1: Product: syz [ 1163.827522][ T43] usb 6-1: Manufacturer: syz [ 1163.832544][ T43] usb 6-1: SerialNumber: syz [ 1163.840470][T17958] usb 3-1: Using ep0 maxpacket: 32 [ 1163.847700][T17958] usb 3-1: config 0 has an invalid descriptor of length 178, skipping remainder of the config [ 1163.861439][T17958] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1163.874942][T17958] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1163.885425][T17958] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1163.894256][T17958] usb 3-1: Product: syz [ 1163.899277][T17958] usb 3-1: Manufacturer: syz [ 1163.904734][T17958] usb 3-1: SerialNumber: syz [ 1163.916642][T17958] usb 3-1: config 0 descriptor?? [ 1164.007187][T24532] tipc: Enabled bearer , priority 10 [ 1164.137456][T24517] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1164.148208][T24517] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1164.218417][ T43] qmi_wwan 6-1:129.125: probe with driver qmi_wwan failed with error -22 [ 1164.247027][ T43] usb 6-1: USB disconnect, device number 33 [ 1164.248855][ T5964] usb 3-1: USB disconnect, device number 66 [ 1164.340417][T22998] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 1164.500176][T22998] usb 4-1: Using ep0 maxpacket: 32 [ 1164.514357][T24534] vlan2: entered promiscuous mode [ 1164.519520][T24534] veth0: entered promiscuous mode [ 1164.575624][T22998] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1164.602535][T22998] usb 4-1: no configurations [ 1164.620368][T22998] usb 4-1: can't read configurations, error -22 [ 1164.637721][T24542] use of bytesused == 0 is deprecated and will be removed in the future, [ 1164.647771][T24542] use the actual size instead. [ 1164.662714][ T5964] usb 3-1: new full-speed USB device number 67 using dummy_hcd [ 1164.861710][ T5964] usb 3-1: config 8 has an invalid interface number: 177 but max is 0 [ 1164.906748][ T5964] usb 3-1: config 8 has no interface number 0 [ 1164.927232][ T5964] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 1164.941102][T24555] xt_hashlimit: max too large, truncated to 1048576 [ 1164.965245][ T5964] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1165.015735][ T5964] usb 3-1: config 8 interface 177 has no altsetting 0 [ 1165.026686][ T5964] usb 3-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1165.038468][ T5964] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1165.052897][T24538] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1165.120110][T17958] tipc: Node number set to 3544070969 [ 1165.546505][ T5964] ir_toy 3-1:8.177: required endpoints not found [ 1165.595897][ T5964] usb 3-1: USB disconnect, device number 67 [ 1165.780179][T22998] usb 4-1: new full-speed USB device number 58 using dummy_hcd [ 1166.047981][T22998] usb 4-1: config 0 has an invalid interface number: 32 but max is 1 [ 1166.061675][T22998] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1166.127283][T22998] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1166.170130][T22998] usb 4-1: config 0 has no interface number 0 [ 1166.176295][T22998] usb 4-1: too many endpoints for config 0 interface 32 altsetting 48: 32, using maximum allowed: 30 [ 1166.187562][T22998] usb 4-1: config 0 interface 32 altsetting 48 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 1166.200878][T22998] usb 4-1: config 0 interface 32 has no altsetting 0 [ 1166.210299][T22998] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1166.272560][T22998] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1166.276697][T24571] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1166.493193][T22998] usb 4-1: config 0 descriptor?? [ 1166.780341][ T5964] usb 3-1: new full-speed USB device number 68 using dummy_hcd [ 1166.860498][ T9] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 1166.920159][ T5964] usb 3-1: device descriptor read/64, error -71 [ 1167.016956][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1167.028667][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1167.050919][ T9] usb 6-1: New USB device found, idVendor=17ef, idProduct=60ee, bcdDevice= 0.00 [ 1167.080615][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1167.105675][ T9] usb 6-1: config 0 descriptor?? [ 1167.170007][ T5964] usb 3-1: new full-speed USB device number 69 using dummy_hcd [ 1167.300212][ T5964] usb 3-1: device descriptor read/64, error -71 [ 1167.310110][ T43] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 1167.410774][ T5964] usb usb3-port1: attempt power cycle [ 1167.482795][ T43] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1167.492199][ T43] usb 5-1: config 1 has an invalid descriptor of length 42, skipping remainder of the config [ 1167.505133][ T43] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1167.516958][ T43] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 7051, setting to 64 [ 1167.533633][ T43] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1167.550161][ T43] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1167.571350][ T43] usb 5-1: Product: syz [ 1167.583096][ T43] usb 5-1: Manufacturer: syz [ 1167.614783][ T43] cdc_wdm 5-1:1.0: skipping garbage [ 1167.620585][ T43] cdc_wdm 5-1:1.0: skipping garbage [ 1167.626058][ T43] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 1167.637628][T24579] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1167.662510][T24579] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1167.762207][ T5964] usb 3-1: new full-speed USB device number 70 using dummy_hcd [ 1167.800964][ T5964] usb 3-1: device descriptor read/8, error -71 [ 1167.866449][ T5963] usb 5-1: USB disconnect, device number 34 [ 1168.070200][ T5964] usb 3-1: new full-speed USB device number 71 using dummy_hcd [ 1168.117971][ T5964] usb 3-1: device descriptor read/8, error -71 [ 1168.267718][ T5964] usb usb3-port1: unable to enumerate USB device [ 1168.384245][T22998] usb 4-1: string descriptor 0 read error: -71 [ 1168.417661][T22998] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1168.455610][T22998] dvb-usb: bulk message failed: -22 (3/0) [ 1168.473983][T22998] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1168.486550][T22998] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1168.497083][T22998] usb 4-1: media controller created [ 1168.504516][T22998] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1168.520121][T24581] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5660'. [ 1168.548107][T22998] dvb-usb: bulk message failed: -22 (6/0) [ 1168.566044][T22998] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1168.587975][T22998] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input128 [ 1168.715243][T24584] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5660'. [ 1168.800965][T24581] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1168.832527][T22998] dvb-usb: schedule remote query interval to 150 msecs. [ 1168.839622][T22998] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1168.862661][T22998] usb 4-1: USB disconnect, device number 58 [ 1168.905590][T24583] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 1168.918589][T22998] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1168.953356][T24583] bond5: (slave batadv2): Enslaving as an active interface with an up link [ 1169.249979][ T43] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 1169.532865][ T43] usb 5-1: config 0 has no interfaces? [ 1169.573173][ T43] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1169.583610][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1169.604672][ T43] usb 5-1: Product: syz [ 1169.618881][ T43] usb 5-1: Manufacturer: syz [ 1169.628863][ T43] usb 5-1: SerialNumber: syz [ 1169.649069][ T43] usb 5-1: config 0 descriptor?? [ 1169.804359][ T9] usbhid 6-1:0.0: can't add hid device: -71 [ 1169.842394][ T9] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1169.866071][T24584] bond5 (unregistering): (slave batadv2): Releasing backup interface [ 1169.878882][ T9] usb 6-1: USB disconnect, device number 34 [ 1169.886449][T24584] bond5 (unregistering): Released all slaves [ 1169.960160][ T43] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 1170.067690][T24601] program syz.5.5665 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1170.128178][T24603] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5667'. [ 1170.146026][ T43] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1170.181834][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1170.213759][ T43] usb 3-1: Product: syz [ 1170.223396][ T43] usb 3-1: Manufacturer: syz [ 1170.233945][ T43] usb 3-1: SerialNumber: syz [ 1170.247308][ T43] usb 3-1: config 0 descriptor?? [ 1170.320023][T22998] usb 4-1: new full-speed USB device number 59 using dummy_hcd [ 1170.481956][T22998] usb 4-1: config 8 has an invalid interface number: 177 but max is 0 [ 1170.497499][T22998] usb 4-1: config 8 has no interface number 0 [ 1170.514424][T22998] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 1170.570438][T22998] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1170.580970][T22998] usb 4-1: config 8 interface 177 has no altsetting 0 [ 1170.588896][T22998] usb 4-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1170.598229][T22998] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1170.617384][T24600] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 1171.095452][T22998] ir_toy 4-1:8.177: required endpoints not found [ 1171.105356][T22998] usb 4-1: USB disconnect, device number 59 [ 1171.282802][ T43] usb 3-1: non-Atmel transceiver xxxx5401 [ 1171.484076][ T43] usb 3-1: Firmware version (0.0) predates our first public release. [ 1171.494524][ T43] usb 3-1: Please update to version 0.2 or newer [ 1171.502870][ T43] usb 3-1: atusb_probe: initialization failed, error = -19 [ 1171.523872][ T43] usb 3-1: USB disconnect, device number 72 [ 1171.686837][T24616] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5670'. [ 1171.751524][T24616] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5670'. [ 1171.878407][ T9] usb 5-1: USB disconnect, device number 35 [ 1171.994845][T24622] tipc: Enabling of bearer rejected, already enabled [ 1172.186265][T24624] netlink: 'syz.4.5675': attribute type 1 has an invalid length. [ 1172.201058][ T43] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 1172.279508][T24624] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1172.333316][T24625] bond3: (slave geneve2): making interface the new active one [ 1172.378738][T24625] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 1172.387912][ T43] usb 4-1: Using ep0 maxpacket: 8 [ 1172.618688][ T43] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1172.630589][ T43] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1172.663749][ T43] usb 4-1: config 1 has no interface number 1 [ 1172.670934][ T43] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1172.728319][ T43] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1172.737950][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1172.747976][ T43] usb 4-1: Product: syz [ 1172.752682][ T43] usb 4-1: Manufacturer: syz [ 1172.757535][ T43] usb 4-1: SerialNumber: syz [ 1172.920013][ T9] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 1173.050329][ T9] usb 5-1: device descriptor read/64, error -71 [ 1173.170852][ T5964] usb 3-1: new full-speed USB device number 73 using dummy_hcd [ 1173.310043][ T9] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 1173.332955][T24620] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1173.354756][ T5964] usb 3-1: config 8 has an invalid interface number: 177 but max is 0 [ 1173.371229][T24620] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1173.385147][T24652] SET target dimension over the limit! [ 1173.399505][ T5964] usb 3-1: config 8 has no interface number 0 [ 1173.406558][ T5964] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 1173.440192][ T9] usb 5-1: device descriptor read/64, error -71 [ 1173.457935][ T5964] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1173.491860][ T5964] usb 3-1: config 8 interface 177 has no altsetting 0 [ 1173.507436][ T5964] usb 3-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1173.523465][T24654] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1173.545746][ T5964] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1173.557572][ T9] usb usb5-port1: attempt power cycle [ 1173.631239][T24638] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 1173.950437][ T9] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 1173.970834][ T9] usb 5-1: device descriptor read/8, error -71 [ 1174.070292][ T5963] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 1174.143081][ T5964] ir_toy 3-1:8.177: required endpoints not found [ 1174.165090][ T5964] usb 3-1: USB disconnect, device number 73 [ 1174.220189][ T9] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 1174.247314][ T5963] usb 6-1: Using ep0 maxpacket: 32 [ 1174.256404][ T9] usb 5-1: device descriptor read/8, error -71 [ 1174.264501][ T5963] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 1174.282347][ T5963] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1174.299452][ T5963] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1174.314414][ T5963] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1174.326604][ T5963] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1174.339095][ T5963] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1174.353234][ T5963] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1174.374371][ T5963] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1174.401278][ T9] usb usb5-port1: unable to enumerate USB device [ 1174.432001][ T5963] usb 6-1: config 0 descriptor?? [ 1174.649772][ T5963] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 35 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1174.854383][ C1] usblp0: nonzero read bulk status received: -71 [ 1174.854655][ T5963] usb 6-1: USB disconnect, device number 35 [ 1175.144732][T24661] usblp0: removed [ 1175.179125][T24689] batadv0: entered promiscuous mode [ 1175.186434][T24689] vlan2: entered promiscuous mode [ 1175.191904][T24689] bond0: entered promiscuous mode [ 1175.197104][T24689] bond_slave_0: entered promiscuous mode [ 1175.208244][T24689] bond_slave_1: entered promiscuous mode [ 1175.258372][T24684] tipc: Started in network mode [ 1175.263968][T24684] tipc: Node identity 0657bdda219d, cluster identity 4711 [ 1175.273641][T24684] tipc: Enabled bearer , priority 0 [ 1175.344980][T24694] netlink: 'syz.2.5701': attribute type 33 has an invalid length. [ 1175.374805][T24694] tipc: Resetting bearer [ 1175.724756][ T43] usb 4-1: 2:1: invalid format type 0x1001 is detected, processed as PCM [ 1175.740023][ T43] usb 4-1: 2:1 : sample bitwidth 65 in over sample bytes 0 [ 1175.750670][ T43] usb 4-1: 2:1 : unsupported sample bitwidth 65 in 0 bytes [ 1175.910947][ T43] usb 4-1: USB disconnect, device number 60 [ 1175.923858][T24678] tipc: Disabling bearer [ 1176.222806][T24714] bond0: Removing last ns target with arp_interval on [ 1176.459643][T24720] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5710'. [ 1176.752826][T24725] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5711'. [ 1177.022010][T24737] tipc: Enabling of bearer rejected, already enabled [ 1177.462104][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.468479][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.474861][ T5893] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 1177.630334][ T5893] usb 3-1: Using ep0 maxpacket: 8 [ 1177.724636][ T5893] usb 3-1: config 0 has an invalid interface number: 31 but max is 0 [ 1177.772076][ T5893] usb 3-1: config 0 has no interface number 0 [ 1177.806364][ T5893] usb 3-1: New USB device found, idVendor=112a, idProduct=0005, bcdDevice=be.68 [ 1177.830143][ T5963] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 1177.851409][ T5893] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1177.867392][ T5893] usb 3-1: Product: syz [ 1177.892717][ T5893] usb 3-1: Manufacturer: syz [ 1177.940171][ T5893] usb 3-1: SerialNumber: syz [ 1177.962546][ T5893] usb 3-1: config 0 descriptor?? [ 1178.170258][ T5963] usb 5-1: Using ep0 maxpacket: 8 [ 1178.326236][ T5963] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1178.362719][ T5963] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 1178.394428][ T5963] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 1178.472562][T24760] netlink: 7 bytes leftover after parsing attributes in process `syz.3.5725'. [ 1178.512802][T24760] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5725'. [ 1178.600802][ T5963] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1178.613467][ T5963] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1178.629331][ T5893] redrat3 3-1:0.31: Couldn't find all endpoints [ 1178.716676][ T5963] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 1178.764921][ T5963] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 1178.773244][ T5963] usb 5-1: Product: syz [ 1178.777662][ T5963] usb 5-1: Manufacturer: syz [ 1178.782540][ T5963] usb 5-1: SerialNumber: syz [ 1178.791224][ T5963] usb 5-1: config 0 descriptor?? [ 1178.970091][ T5893] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 1178.998819][ T5963] radio-si470x 5-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 1179.015829][ T5963] radio-si470x 5-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 1179.142950][ T5893] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1179.199375][ T5963] radio-si470x 5-1:0.0: software version 0, hardware version 0 [ 1179.209658][ T5893] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1179.210878][ T5963] radio-si470x 5-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 1179.232399][ T5963] radio-si470x 5-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 1179.264550][ T5893] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 1179.319107][ T5893] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1179.390092][ T5893] usb 4-1: config 0 descriptor?? [ 1179.403099][ T5963] radio-si470x 5-1:0.0: submitting int urb failed (-90) [ 1179.619027][ T5893] cp2112 0003:10C4:EA90.0026: unknown main item tag 0x0 [ 1179.644079][ T5893] cp2112 0003:10C4:EA90.0026: unknown main item tag 0x0 [ 1179.689008][ T5893] cp2112 0003:10C4:EA90.0026: unknown main item tag 0x0 [ 1179.723070][ T5893] cp2112 0003:10C4:EA90.0026: unknown main item tag 0x0 [ 1179.752116][ T5893] cp2112 0003:10C4:EA90.0026: unknown main item tag 0x0 [ 1179.779378][ T5893] cp2112 0003:10C4:EA90.0026: unknown main item tag 0x0 [ 1179.807206][ T5893] cp2112 0003:10C4:EA90.0026: unknown main item tag 0x0 [ 1179.847837][ T5893] cp2112 0003:10C4:EA90.0026: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 1180.028817][ T5893] cp2112 0003:10C4:EA90.0026: error requesting version [ 1180.043933][ T5893] cp2112 0003:10C4:EA90.0026: probe with driver cp2112 failed with error -71 [ 1180.118796][ T5893] usb 4-1: USB disconnect, device number 61 [ 1180.266678][ T9] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 1180.339523][ T9] hid-generic 0000:0000:0000.0027: hidraw0: HID v0.00 Device [syz0] on syz0 [ 1180.510389][ T5963] radio-si470x 5-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 1180.578137][ T5963] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -22 [ 1180.698290][ T5963] usb 5-1: USB disconnect, device number 40 [ 1180.888947][ T43] usb 3-1: USB disconnect, device number 74 [ 1181.587504][T24804] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1181.594820][T24804] IPv6: NLM_F_CREATE should be set when creating new route [ 1181.700471][T24812] tipc: Enabled bearer , priority 0 [ 1181.732547][T24812] syzkaller0: mtu less than device minimum [ 1181.879998][ T5963] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 1181.925198][T24805] tipc: Disabling bearer [ 1182.044074][ T5963] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 1182.083840][ T5963] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 1182.100006][ T9] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 1182.129490][ T5963] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1182.142932][ T5963] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 1182.156750][ T5963] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1182.170770][ T5963] usb 6-1: Product: syz [ 1182.175030][ T5963] usb 6-1: Manufacturer: syz [ 1182.180870][ T5963] usb 6-1: SerialNumber: syz [ 1182.191426][T24810] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1182.204757][T24810] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1182.269234][T24822] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5741'. [ 1182.279986][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 1182.354167][ T9] usb 3-1: config 0 has an invalid interface number: 31 but max is 0 [ 1182.380003][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1182.400330][ T9] usb 3-1: config 0 has no interface number 0 [ 1182.426241][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1182.453571][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1182.482596][ T9] usb 3-1: Product: syz [ 1182.494730][ T9] usb 3-1: Manufacturer: syz [ 1182.511649][ T9] usb 3-1: SerialNumber: syz [ 1182.533986][ T5963] rtl8150 6-1:1.0: couldn't reset the device [ 1182.543367][ T9] usb 3-1: config 0 descriptor?? [ 1182.553026][ T5963] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 1182.567200][ T9] uvcvideo 3-1:0.31: Found UVC 0.00 device syz (046d:08c3) [ 1182.590189][ T5963] usb 6-1: USB disconnect, device number 36 [ 1182.591391][ T9] uvcvideo 3-1:0.31: No valid video chain found. [ 1182.782900][ T9] usb 3-1: USB disconnect, device number 75 [ 1183.024102][T24845] tipc: Started in network mode [ 1183.031622][T24845] tipc: Node identity 9ebb17e6898a, cluster identity 4711 [ 1183.044775][T24845] tipc: Enabled bearer , priority 0 [ 1183.052324][T24845] syzkaller0: entered promiscuous mode [ 1183.058041][T24845] syzkaller0: entered allmulticast mode [ 1183.082180][T24845] tipc: Resetting bearer [ 1183.169194][T24846] tipc: Resetting bearer [ 1183.195523][T24846] tipc: Disabling bearer [ 1183.588022][T24858] netlink: 'syz.2.5751': attribute type 14 has an invalid length. [ 1183.604812][T24858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5751'. [ 1183.631433][T23043] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1183.642064][T24858] netlink: 'syz.2.5751': attribute type 14 has an invalid length. [ 1183.653245][T24860] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1183.661947][T23043] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1183.671469][T24858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5751'. [ 1183.686797][T23043] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1183.696413][T23043] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1183.706414][T24858] netlink: 'syz.2.5751': attribute type 14 has an invalid length. [ 1183.714537][T24858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5751'. [ 1183.725002][T24858] netlink: 'syz.2.5751': attribute type 14 has an invalid length. [ 1183.734093][T24858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5751'. [ 1183.745031][T24858] netlink: 'syz.2.5751': attribute type 14 has an invalid length. [ 1183.753807][T24858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5751'. [ 1183.787210][T24858] netlink: 'syz.2.5751': attribute type 14 has an invalid length. [ 1183.803523][T24858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5751'. [ 1183.814670][T24858] netlink: 'syz.2.5751': attribute type 14 has an invalid length. [ 1183.824360][T24858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5751'. [ 1183.846682][T24858] netlink: 'syz.2.5751': attribute type 14 has an invalid length. [ 1183.855890][T24858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5751'. [ 1183.913217][T24858] netlink: 'syz.2.5751': attribute type 14 has an invalid length. [ 1183.927563][T24858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5751'. [ 1183.945842][T24865] SET target dimension over the limit! [ 1183.951007][T24858] netlink: 'syz.2.5751': attribute type 14 has an invalid length. [ 1184.211844][T24882] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1184.277207][ T30] audit: type=1326 audit(1764483585.644:1925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24884 comm="syz.5.5760" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5b0738f749 code=0x0 [ 1184.470048][ T5893] usb 4-1: new full-speed USB device number 62 using dummy_hcd [ 1184.610088][ T5893] usb 4-1: device descriptor read/64, error -71 [ 1184.860095][ T5893] usb 4-1: new full-speed USB device number 63 using dummy_hcd [ 1185.010182][ T5893] usb 4-1: device descriptor read/64, error -71 [ 1185.133795][ T5893] usb usb4-port1: attempt power cycle [ 1185.300061][ T43] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 1185.390192][ T9] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 1185.420040][T22998] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 1185.450168][ T43] usb 3-1: Using ep0 maxpacket: 8 [ 1185.456962][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1185.466982][ T43] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1185.478639][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1185.490336][ T5893] usb 4-1: new full-speed USB device number 64 using dummy_hcd [ 1185.498400][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 1185.508792][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 1185.523253][ T5893] usb 4-1: device descriptor read/8, error -71 [ 1185.529518][ T43] usb 3-1: New USB device found, idVendor=1870, idProduct=0001, bcdDevice=e6.7f [ 1185.538678][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1185.547050][ T43] usb 3-1: Product: syz [ 1185.550061][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 1185.551359][ T43] usb 3-1: Manufacturer: syz [ 1185.561664][ T43] usb 3-1: SerialNumber: syz [ 1185.561777][ T9] usb 5-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 1185.569075][ T43] usb 3-1: config 0 descriptor?? [ 1185.579078][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1185.581311][T22998] usb 6-1: Using ep0 maxpacket: 32 [ 1185.595495][ T9] usb 5-1: Product: syz [ 1185.598902][ T43] usbtouchscreen 3-1:0.0: probe with driver usbtouchscreen failed with error -8 [ 1185.600545][ T9] usb 5-1: Manufacturer: syz [ 1185.610407][T22998] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 1185.624925][ T9] usb 5-1: SerialNumber: syz [ 1185.627620][T22998] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1185.642395][ T9] usb 5-1: config 0 descriptor?? [ 1185.647495][T22998] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1185.657065][T22998] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1185.667028][T22998] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1185.676921][T22998] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1185.691274][T22998] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1185.701192][T22998] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1185.713835][T22998] usb 6-1: config 0 descriptor?? [ 1185.770234][ T5893] usb 4-1: new full-speed USB device number 65 using dummy_hcd [ 1185.791902][ T5893] usb 4-1: device descriptor read/8, error -71 [ 1185.867667][ T9] speedtch 5-1:0.0: speedtch_bind: wrong device class 68 [ 1185.881309][ T9] speedtch 5-1:0.0: usbatm_usb_probe: bind failed: -19! [ 1185.894801][T24908] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1185.901948][ T5893] usb usb4-port1: unable to enumerate USB device [ 1185.905087][ T9] usb 5-1: USB disconnect, device number 41 [ 1185.934102][ T5963] usb 3-1: USB disconnect, device number 76 [ 1185.936255][T22998] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 37 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1186.128210][ C1] usblp0: nonzero read bulk status received: -71 [ 1186.135485][T22998] usb 6-1: USB disconnect, device number 37 [ 1186.345890][T24905] veth0_vlan: left promiscuous mode [ 1186.352062][T24905] veth0_vlan: entered promiscuous mode [ 1186.359062][T24905] team0: Device veth0_vlan failed to register rx_handler [ 1186.377138][T24904] usblp0: removed [ 1187.003771][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1187.016884][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1187.026143][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1187.034487][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1187.045001][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1187.160647][ T5963] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 1187.321934][ T5963] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1187.344221][ T5963] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1187.362504][ T5963] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1187.380122][ T5963] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1187.399348][ T5963] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 1187.417628][ T5963] usb 3-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1187.429647][T24929] chnl_net:caif_netlink_parms(): no params data found [ 1187.439977][ T5963] usb 3-1: config 1 interface 1 has no altsetting 0 [ 1187.445687][T24939] __nla_validate_parse: 58 callbacks suppressed [ 1187.445704][T24939] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5779'. [ 1187.472758][T24939] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5779'. [ 1187.478566][ T5963] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1187.516617][ T5963] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1187.544639][ T5963] usb 3-1: Product: syz [ 1187.548938][ T5963] usb 3-1: Manufacturer: syz [ 1187.554193][ T5963] usb 3-1: SerialNumber: syz [ 1187.579480][ T5963] cdc_ncm 3-1:1.0: skipping garbage [ 1187.592946][ T5963] cdc_ncm 3-1:1.0: NCM or ECM functional descriptors missing [ 1187.601176][ T5963] cdc_ncm 3-1:1.0: bind() failure [ 1187.656917][T24929] bridge0: port 1(bridge_slave_0) entered blocking state [ 1187.671464][T24929] bridge0: port 1(bridge_slave_0) entered disabled state [ 1187.678837][T24929] bridge_slave_0: entered allmulticast mode [ 1187.712574][T24929] bridge_slave_0: entered promiscuous mode [ 1187.715428][T24929] bridge0: port 2(bridge_slave_1) entered blocking state [ 1187.715607][T24929] bridge0: port 2(bridge_slave_1) entered disabled state [ 1187.716116][T24929] bridge_slave_1: entered allmulticast mode [ 1187.717965][T24929] bridge_slave_1: entered promiscuous mode [ 1187.731912][ T43] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 1187.825507][T24929] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1187.848967][T24929] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1187.905108][T24929] team0: Port device team_slave_0 added [ 1187.914886][T24929] team0: Port device team_slave_1 added [ 1187.941924][ T43] usb 6-1: Using ep0 maxpacket: 16 [ 1187.949040][ T43] usb 6-1: too many endpoints for config 0 interface 0 altsetting 229: 247, using maximum allowed: 30 [ 1187.963884][ T43] usb 6-1: config 0 interface 0 altsetting 229 has 0 endpoint descriptors, different from the interface descriptor's value: 247 [ 1187.978696][ T43] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1188.010212][ T43] usb 6-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=59.31 [ 1188.021457][T24926] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1188.023463][T24929] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1188.037380][ T43] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1188.052743][ T43] usb 6-1: Product: syz [ 1188.057226][T24926] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1188.060080][ T43] usb 6-1: Manufacturer: syz [ 1188.069708][T24929] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1188.103740][ T43] usb 6-1: SerialNumber: syz [ 1188.116122][ T43] usb 6-1: config 0 descriptor?? [ 1188.132487][ T43] usb 6-1: cannot find UAC_HEADER [ 1188.138862][T24929] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1188.178666][T24929] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1188.191074][ T43] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 1188.202960][T24929] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1188.252956][T24929] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1188.272275][T24926] lo: Caught tx_queue_len zero misconfig [ 1188.294573][T11682] udevd[11682]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1188.339606][ T43] usb 6-1: USB disconnect, device number 38 [ 1188.431057][T22998] usb 3-1: USB disconnect, device number 77 [ 1188.486613][T24929] hsr_slave_0: entered promiscuous mode [ 1188.493523][T24929] hsr_slave_1: entered promiscuous mode [ 1188.510876][T24929] debugfs: 'hsr0' already exists in 'hsr' [ 1188.516770][T24929] Cannot create hsr debugfs directory [ 1188.938465][T24929] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.079661][T24968] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5786'. [ 1189.121033][T15262] Bluetooth: hci0: command tx timeout [ 1189.129778][T24967] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(8) [ 1189.136319][T24967] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1189.145043][T24967] vhci_hcd vhci_hcd.0: Device attached [ 1189.166836][T24968] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1189.309056][T24973] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5786'. [ 1189.421876][T24969] vhci_hcd: connection closed [ 1189.422220][ T36] vhci_hcd: stop threads [ 1189.465213][ T36] vhci_hcd: release socket [ 1189.466148][T24929] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.485255][ T36] vhci_hcd: disconnect device [ 1189.582022][T24968] 8021q: adding VLAN 0 to HW filter on device batadv3 [ 1189.627365][T24968] bond5: (slave batadv3): Enslaving as an active interface with an up link [ 1190.012477][T24989] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x6 [ 1190.206114][T24973] bond5 (unregistering): (slave batadv3): Releasing backup interface [ 1190.228710][T24973] bond5 (unregistering): Released all slaves [ 1190.270784][T24987] bond0: Removing last ns target with arp_interval on [ 1190.424119][T24929] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1190.600921][T24929] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1190.649976][T22998] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 1190.820443][T22998] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1190.850162][T22998] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1190.897312][T24929] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1190.908689][T22998] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1190.923893][T24929] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1190.985296][T22998] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1190.989558][T24929] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1191.020164][T22998] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 1191.040471][T22998] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1191.072691][T22998] usb 4-1: config 1 interface 1 has no altsetting 0 [ 1191.074045][T24929] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1191.081971][T22998] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1191.101463][T22998] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1191.109498][T22998] usb 4-1: Product: syz [ 1191.115907][T22998] usb 4-1: Manufacturer: syz [ 1191.130821][T22998] usb 4-1: SerialNumber: syz [ 1191.173011][T22998] cdc_ncm 4-1:1.0: skipping garbage [ 1191.178409][T22998] cdc_ncm 4-1:1.0: NCM or ECM functional descriptors missing [ 1191.200102][T15262] Bluetooth: hci0: command tx timeout [ 1191.210437][T22998] cdc_ncm 4-1:1.0: bind() failure [ 1191.450986][ T5963] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 1191.461767][T24929] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1191.486264][T24929] 8021q: adding VLAN 0 to HW filter on device team0 [ 1191.522539][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 1191.529677][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1191.560294][ T9] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 1191.671323][ T5963] usb 6-1: Using ep0 maxpacket: 8 [ 1191.730228][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 1191.755079][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 1191.762366][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1191.803596][T25019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1191.882232][T25019] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1192.111220][T24929] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1192.123827][ T5963] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1192.145175][ T5963] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1192.166354][ T5963] usb 6-1: config 1 has no interface number 1 [ 1192.190374][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1192.229410][ T5963] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1192.302825][ T9] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1192.328406][T24929] veth0_vlan: entered promiscuous mode [ 1192.346983][T24929] veth1_vlan: entered promiscuous mode [ 1192.378873][ T9] usb 3-1: config 1 has no interface number 1 [ 1192.397826][ T9] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1192.433762][ T9] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1192.443561][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1192.459850][ T9] usb 3-1: Product: syz [ 1192.467973][ T9] usb 3-1: Manufacturer: syz [ 1192.476522][ T9] usb 3-1: SerialNumber: syz [ 1192.625987][T24929] veth0_macvtap: entered promiscuous mode [ 1192.638629][ T5963] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1192.713657][T24929] veth1_macvtap: entered promiscuous mode [ 1192.724531][ T5963] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1192.753997][ T5963] usb 6-1: Product: syz [ 1192.770879][ T5963] usb 6-1: Manufacturer: syz [ 1192.786732][T24929] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1192.797894][ T5963] usb 6-1: SerialNumber: syz [ 1192.841644][T24929] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1192.870809][ T3008] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1192.883946][ T3008] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1192.925182][ T3008] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1192.967855][ T3008] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1193.004972][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1193.025684][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1193.059019][ T2994] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1193.069560][ T2994] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1193.135379][T25024] validate_nla: 57 callbacks suppressed [ 1193.135392][T25024] netlink: 'syz.4.5770': attribute type 1 has an invalid length. [ 1193.280211][T15262] Bluetooth: hci0: command tx timeout [ 1193.499086][T25035] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1193.531356][ T5907] usb 4-1: USB disconnect, device number 66 [ 1193.692866][T25035] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1193.732719][T25018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1193.741866][T25018] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1195.347719][ T5963] usb 6-1: 2:1: invalid format type 0x1001 is detected, processed as PCM [ 1195.360080][T15262] Bluetooth: hci0: command tx timeout [ 1195.380398][ T5963] usb 6-1: 2:1 : sample bitwidth 65 in over sample bytes 0 [ 1195.387703][ T5963] usb 6-1: 2:1 : unsupported sample bitwidth 65 in 0 bytes [ 1195.431913][ T5963] usb 6-1: USB disconnect, device number 39 [ 1195.541496][ T9] usb 3-1: 2:1: invalid format type 0x1001 is detected, processed as PCM [ 1195.579983][ T9] usb 3-1: 2:1 : sample bitwidth 65 in over sample bytes 0 [ 1195.598779][ T9] usb 3-1: 2:1 : unsupported sample bitwidth 65 in 0 bytes [ 1195.628588][ T9] usb 3-1: USB disconnect, device number 78 [ 1195.695351][T11682] udevd[11682]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1196.013302][T25067] FAULT_INJECTION: forcing a failure. [ 1196.013302][T25067] name failslab, interval 1, probability 0, space 0, times 0 [ 1196.028483][T25067] CPU: 0 UID: 0 PID: 25067 Comm: syz.2.5818 Not tainted syzkaller #0 PREEMPT(full) [ 1196.028508][T25067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1196.028520][T25067] Call Trace: [ 1196.028527][T25067] [ 1196.028536][T25067] dump_stack_lvl+0x189/0x250 [ 1196.028564][T25067] ? __pfx____ratelimit+0x10/0x10 [ 1196.028607][T25067] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1196.028629][T25067] ? __pfx__printk+0x10/0x10 [ 1196.028652][T25067] ? __pfx___might_resched+0x10/0x10 [ 1196.028670][T25067] ? fs_reclaim_acquire+0x7d/0x100 [ 1196.028691][T25067] should_fail_ex+0x414/0x560 [ 1196.028721][T25067] should_failslab+0xa8/0x100 [ 1196.028742][T25067] kmem_cache_alloc_node_noprof+0x77/0x710 [ 1196.028766][T25067] ? __alloc_skb+0x112/0x2d0 [ 1196.028790][T25067] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 1196.028817][T25067] __alloc_skb+0x112/0x2d0 [ 1196.028839][T25067] pfkey_sendmsg+0x1dd/0x1090 [ 1196.028868][T25067] ? __pfx___might_resched+0x10/0x10 [ 1196.028894][T25067] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1196.028923][T25067] ? aa_sk_perm+0x81e/0x950 [ 1196.028945][T25067] ? __lock_acquire+0xab9/0xd20 [ 1196.028966][T25067] ? __pfx_aa_sk_perm+0x10/0x10 [ 1196.028987][T25067] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 1196.029018][T25067] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1196.029043][T25067] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1196.029061][T25067] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1196.029082][T25067] __sock_sendmsg+0x21c/0x270 [ 1196.029107][T25067] ____sys_sendmsg+0x52d/0x830 [ 1196.029130][T25067] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1196.029157][T25067] ? import_iovec+0x74/0xa0 [ 1196.029180][T25067] ___sys_sendmsg+0x21f/0x2a0 [ 1196.029202][T25067] ? __pfx____sys_sendmsg+0x10/0x10 [ 1196.029255][T25067] ? __fget_files+0x2a/0x420 [ 1196.029271][T25067] ? __fget_files+0x3a0/0x420 [ 1196.029297][T25067] __sys_sendmmsg+0x227/0x430 [ 1196.029321][T25067] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1196.029350][T25067] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1196.029393][T25067] ? ksys_write+0x22a/0x250 [ 1196.029417][T25067] ? __pfx_ksys_write+0x10/0x10 [ 1196.029445][T25067] __x64_sys_sendmmsg+0xa0/0xc0 [ 1196.029467][T25067] do_syscall_64+0xfa/0xfa0 [ 1196.029489][T25067] ? lockdep_hardirqs_on+0x9c/0x150 [ 1196.029512][T25067] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1196.029529][T25067] ? clear_bhb_loop+0x60/0xb0 [ 1196.029548][T25067] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1196.029564][T25067] RIP: 0033:0x7f698a38f749 [ 1196.029580][T25067] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1196.029595][T25067] RSP: 002b:00007f698b308038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1196.029615][T25067] RAX: ffffffffffffffda RBX: 00007f698a5e5fa0 RCX: 00007f698a38f749 [ 1196.029630][T25067] RDX: 00000000000003ef RSI: 0000200000000180 RDI: 0000000000000003 [ 1196.029642][T25067] RBP: 00007f698b308090 R08: 0000000000000000 R09: 0000000000000000 [ 1196.029653][T25067] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1196.029665][T25067] R13: 00007f698a5e6038 R14: 00007f698a5e5fa0 R15: 00007f698a70fa28 [ 1196.029694][T25067] [ 1196.400155][ T5893] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 1196.571505][ T5893] usb 6-1: Using ep0 maxpacket: 8 [ 1196.580020][ T5893] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1196.590265][ T5893] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 1196.602657][ T5893] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 1196.614728][ T5893] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1196.625218][ T5893] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1 [ 1196.636577][ T5893] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 1196.658307][ T5893] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x2D, changing to 0xD [ 1196.695862][ T5893] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid maxpacket 29797, setting to 1024 [ 1196.724687][ T5893] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 1024 [ 1196.743774][ T5893] usb 6-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 1196.759975][T22998] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 1196.769660][ T5893] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1196.778947][ T5893] usb 6-1: Product: syz [ 1196.787072][ T5893] usb 6-1: Manufacturer: syz [ 1196.793821][ T5893] usb 6-1: SerialNumber: syz [ 1196.804810][ T5893] usb 6-1: config 0 descriptor?? [ 1196.814898][T25059] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1196.831049][T25059] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1196.855162][ T5893] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1196.920116][T22998] usb 3-1: Using ep0 maxpacket: 16 [ 1196.927482][T22998] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1196.950636][T22998] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1196.988692][T22998] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1197.040668][T22998] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1197.070145][T22998] usb 3-1: Product: syz [ 1197.089264][T22998] usb 3-1: Manufacturer: syz [ 1197.134142][T22998] usb 3-1: SerialNumber: syz [ 1197.151385][T25093] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1197.169336][T25093] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1198.393030][ T52] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1198.425420][ T52] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1198.437001][ T52] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1198.446126][ T52] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1198.454253][ T52] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1198.484946][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1198.649332][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1198.812172][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1198.985303][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1199.011569][ T5907] usb 6-1: USB disconnect, device number 40 [ 1199.744006][T22998] usb 3-1: 0:2 : does not exist [ 1199.752408][T22998] usb 3-1: unit 6 not found! [ 1199.771123][T22998] usb 3-1: USB disconnect, device number 79 [ 1199.963709][T11682] udevd[11682]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1200.330161][ T5907] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 1200.484380][ T52] Bluetooth: hci4: command tx timeout [ 1200.532783][ T5907] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1200.606837][ T5907] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1200.680114][ T5907] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1200.732502][ T5907] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1200.785675][ T5907] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 1200.840025][ T5907] usb 6-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1200.888407][ T5907] usb 6-1: config 1 interface 1 has no altsetting 0 [ 1200.933084][ T12] bond1 (unregistering): (slave gretap1): Releasing active interface [ 1200.938088][ T5907] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1200.964167][ T5907] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1200.978781][ T5907] usb 6-1: Product: syz [ 1200.983138][ T5907] usb 6-1: Manufacturer: syz [ 1200.987891][ T5907] usb 6-1: SerialNumber: syz [ 1201.012309][ T5907] cdc_ncm 6-1:1.0: skipping garbage [ 1201.017565][ T5907] cdc_ncm 6-1:1.0: NCM or ECM functional descriptors missing [ 1201.070430][ T5907] cdc_ncm 6-1:1.0: bind() failure [ 1201.134709][ T12] dvmrp1 (unregistering): left allmulticast mode [ 1201.322617][ T12] bond3 (unregistering): (slave geneve2): Releasing active interface [ 1201.459629][T25106] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1201.473359][T25106] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1201.905603][T25155] netlink: 12 bytes leftover after parsing attributes in process `syz.7.5841'. [ 1201.917124][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1201.932527][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1201.944098][ T12] bond0 (unregistering): Released all slaves [ 1202.017652][T25161] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5841'. [ 1202.203063][ T12] bond1 (unregistering): Released all slaves [ 1202.364498][ T12] bond2 (unregistering): Released all slaves [ 1202.512524][ T12] bond3 (unregistering): Released all slaves [ 1202.526309][ T12] bond4 (unregistering): Released all slaves [ 1202.553814][T25104] chnl_net:caif_netlink_parms(): no params data found [ 1202.566573][ T52] Bluetooth: hci4: command tx timeout [ 1202.766966][T25155] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1202.796367][T25159] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1202.807952][T25159] bond1: (slave batadv1): Enslaving as an active interface with an up link [ 1203.138350][T25161] bond1 (unregistering): (slave batadv1): Releasing backup interface [ 1203.151188][T25161] bond1 (unregistering): Released all slaves [ 1203.184895][ T12] tipc: Disabling bearer [ 1203.219378][ T12] tipc: Left network mode [ 1204.075733][T25104] bridge0: port 1(bridge_slave_0) entered blocking state [ 1204.089392][T25104] bridge0: port 1(bridge_slave_0) entered disabled state [ 1204.100001][ T9] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 1204.109235][T25104] bridge_slave_0: entered allmulticast mode [ 1204.142494][T25104] bridge_slave_0: entered promiscuous mode [ 1204.209422][T25104] bridge0: port 2(bridge_slave_1) entered blocking state [ 1204.224451][T25104] bridge0: port 2(bridge_slave_1) entered disabled state [ 1204.258370][T25104] bridge_slave_1: entered allmulticast mode [ 1204.296938][ T9] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1204.311701][T25104] bridge_slave_1: entered promiscuous mode [ 1204.350276][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1204.426299][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1204.492523][ T9] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1204.527911][ T9] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 1204.574201][ T9] usb 5-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1204.602248][T25104] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1204.617762][ T9] usb 5-1: config 1 interface 1 has no altsetting 0 [ 1204.640300][ T52] Bluetooth: hci4: command tx timeout [ 1204.670546][ T9] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1204.679617][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1204.703457][T25104] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1204.757060][ T9] usb 5-1: Product: syz [ 1204.776795][ T9] usb 5-1: Manufacturer: syz [ 1204.800448][ T9] usb 5-1: SerialNumber: syz [ 1204.825319][ T9] cdc_ncm 5-1:1.0: skipping garbage [ 1204.850470][ T9] cdc_ncm 5-1:1.0: NCM or ECM functional descriptors missing [ 1204.862457][ T9] cdc_ncm 5-1:1.0: bind() failure [ 1205.000499][T25104] team0: Port device team_slave_0 added [ 1205.166929][T25104] team0: Port device team_slave_1 added [ 1205.206755][ T5893] IPVS: starting estimator thread 0... [ 1205.239221][T25204] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1205.259716][T25204] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1205.296762][T25224] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1205.300006][T25233] IPVS: using max 26 ests per chain, 62400 per kthread [ 1205.305946][T25231] tipc: Enabled bearer , priority 10 [ 1205.343317][T25104] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1205.354401][T25104] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1205.380313][ C1] vkms_vblank_simulate: vblank timer overrun [ 1205.394177][T25104] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1205.414598][T25104] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1205.422010][T25104] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1205.453640][T25104] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1205.619476][T25104] hsr_slave_0: entered promiscuous mode [ 1205.637169][T25104] hsr_slave_1: entered promiscuous mode [ 1205.666526][T25104] debugfs: 'hsr0' already exists in 'hsr' [ 1205.692015][T25104] Cannot create hsr debugfs directory [ 1205.746936][ T12] hsr_slave_0: left promiscuous mode [ 1205.773616][ T12] hsr_slave_1: left promiscuous mode [ 1205.783310][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1205.814543][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1205.917721][ T12] team0 (unregistering): Port device batadv1 removed [ 1205.974164][ T12] pim6reg (unregistering): left allmulticast mode [ 1206.027253][T25253] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 1206.551496][T25268] netlink: 228 bytes leftover after parsing attributes in process `syz.7.5864'. [ 1206.682045][T25268] netlink: 12 bytes leftover after parsing attributes in process `syz.7.5864'. [ 1206.698893][T25268] netlink: 12 bytes leftover after parsing attributes in process `syz.7.5864'. [ 1206.733076][ T52] Bluetooth: hci4: command tx timeout [ 1207.079171][ T12] team0 (unregistering): Port device team_slave_1 removed [ 1207.377719][T25272] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5865'. [ 1207.684102][T25257] bridge0: entered promiscuous mode [ 1207.690132][T25257] vlan2: entered promiscuous mode [ 1207.727020][ T5893] tipc: Node number set to 667598298 [ 1208.386444][ T12] IPVS: stop unused estimator thread 0... [ 1209.500304][T25318] netlink: 7 bytes leftover after parsing attributes in process `syz.4.5873'. [ 1209.537804][T25318] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5873'. [ 1209.694295][T25322] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5874'. [ 1209.775397][T25325] netlink: 'syz.4.5875': attribute type 11 has an invalid length. [ 1209.933379][T25335] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1209.945825][T25335] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1210.052929][T25104] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1210.113206][T25104] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1210.128482][T25345] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5879'. [ 1210.169580][T25104] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1210.254926][T25104] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1210.432560][T25362] overlayfs: missing 'lowerdir' [ 1210.516231][T25104] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1210.565253][T25104] 8021q: adding VLAN 0 to HW filter on device team0 [ 1210.593723][ T3008] bridge0: port 1(bridge_slave_0) entered blocking state [ 1210.600900][ T3008] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1210.628607][ T3008] bridge0: port 2(bridge_slave_1) entered blocking state [ 1210.635920][ T3008] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1210.655443][T25366] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1210.830454][T25104] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1210.969101][T25104] veth0_vlan: entered promiscuous mode [ 1210.991188][T25104] veth1_vlan: entered promiscuous mode [ 1211.066821][T25104] veth0_macvtap: entered promiscuous mode [ 1211.089380][T25104] veth1_macvtap: entered promiscuous mode [ 1211.136437][T25104] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1211.166035][T25104] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1211.219096][ T2994] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1211.228693][ T2994] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1211.250825][ T2994] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1211.326907][ T2994] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1211.575395][T23043] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1211.603423][T23043] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1211.698062][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1211.721276][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1212.140644][T25391] bond_slave_0: entered promiscuous mode [ 1212.146468][T25391] bond_slave_1: entered promiscuous mode [ 1212.183466][T25391] vlan2: entered promiscuous mode [ 1212.197579][T25391] bond0: entered promiscuous mode [ 1212.626900][T25400] netlink: 'syz.3.5886': attribute type 39 has an invalid length. [ 1213.464258][T25422] FAULT_INJECTION: forcing a failure. [ 1213.464258][T25422] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1213.508064][T25422] CPU: 0 UID: 0 PID: 25422 Comm: syz.2.5891 Not tainted syzkaller #0 PREEMPT(full) [ 1213.508091][T25422] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1213.508102][T25422] Call Trace: [ 1213.508110][T25422] [ 1213.508118][T25422] dump_stack_lvl+0x189/0x250 [ 1213.508145][T25422] ? __pfx____ratelimit+0x10/0x10 [ 1213.508168][T25422] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1213.508188][T25422] ? __pfx__printk+0x10/0x10 [ 1213.508205][T25422] ? __might_fault+0xb0/0x130 [ 1213.508238][T25422] should_fail_ex+0x414/0x560 [ 1213.508267][T25422] _copy_from_user+0x2d/0xb0 [ 1213.508289][T25422] ___sys_sendmsg+0x158/0x2a0 [ 1213.508311][T25422] ? __pfx____sys_sendmsg+0x10/0x10 [ 1213.508360][T25422] ? __fget_files+0x2a/0x420 [ 1213.508376][T25422] ? __fget_files+0x3a0/0x420 [ 1213.508404][T25422] __x64_sys_sendmsg+0x19b/0x260 [ 1213.508426][T25422] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1213.508461][T25422] ? __pfx_ksys_write+0x10/0x10 [ 1213.508487][T25422] ? do_syscall_64+0xbe/0xfa0 [ 1213.508514][T25422] do_syscall_64+0xfa/0xfa0 [ 1213.508535][T25422] ? lockdep_hardirqs_on+0x9c/0x150 [ 1213.508558][T25422] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1213.508576][T25422] ? clear_bhb_loop+0x60/0xb0 [ 1213.508597][T25422] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1213.508614][T25422] RIP: 0033:0x7f698a38f749 [ 1213.508630][T25422] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1213.508646][T25422] RSP: 002b:00007f698b2e7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1213.508665][T25422] RAX: ffffffffffffffda RBX: 00007f698a5e6090 RCX: 00007f698a38f749 [ 1213.508679][T25422] RDX: 0000000000004000 RSI: 0000200000000200 RDI: 0000000000000008 [ 1213.508692][T25422] RBP: 00007f698b2e7090 R08: 0000000000000000 R09: 0000000000000000 [ 1213.508704][T25422] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1213.508715][T25422] R13: 00007f698a5e6128 R14: 00007f698a5e6090 R15: 00007f698a70fa28 [ 1213.508746][T25422] [ 1213.509483][T25422] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x6 [ 1214.241865][T25444] netlink: 'syz.5.5896': attribute type 1 has an invalid length. [ 1214.343346][T25325] syz.4.5875 (25325): drop_caches: 1 [ 1214.804074][T25477] netlink: 128 bytes leftover after parsing attributes in process `syz.4.5907'. [ 1214.973341][T25484] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5909'. [ 1215.050438][T25484] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1215.083217][ T43] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 1215.134809][T25484] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5909'. [ 1215.181134][T25489] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1215.216483][T25489] bond2: (slave batadv1): Enslaving as an active interface with an up link [ 1215.287711][T25499] QAT: failed to copy from user cfg_data. [ 1215.320388][ T43] usb 4-1: Using ep0 maxpacket: 8 [ 1215.349033][ T43] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1215.378543][ T43] usb 4-1: New USB device found, idVendor=17a1, idProduct=0128, bcdDevice= 5.f6 [ 1215.410628][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1215.418666][ T43] usb 4-1: Product: syz [ 1215.440535][ T43] usb 4-1: Manufacturer: syz [ 1215.450938][ T43] usb 4-1: SerialNumber: syz [ 1215.473443][ T43] usb 4-1: config 0 descriptor?? [ 1215.488444][ T43] gspca_main: t613-2.14.0 probing 17a1:0128 [ 1215.778605][T25484] bond2 (unregistering): (slave batadv1): Releasing backup interface [ 1215.789367][T25484] bond2 (unregistering): Released all slaves [ 1215.960969][ T43] gspca_t613: unknown sensor 0000 [ 1215.966115][ T43] t613 4-1:0.0: probe with driver t613 failed with error -22 [ 1216.008833][ T43] usb 4-1: USB disconnect, device number 67 [ 1216.027004][ T30] audit: type=1326 audit(1764483617.394:1926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25521 comm="syz.4.5921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4afe98f749 code=0x7ffc0000 [ 1216.058342][T25527] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1216.070162][T25527] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1216.101899][ T30] audit: type=1326 audit(1764483617.394:1927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25521 comm="syz.4.5921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4afe98f749 code=0x7ffc0000 [ 1216.125846][ T30] audit: type=1326 audit(1764483617.424:1928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25521 comm="syz.4.5921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f4afe98f749 code=0x7ffc0000 [ 1216.159901][ T30] audit: type=1326 audit(1764483617.424:1929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25521 comm="syz.4.5921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4afe98f749 code=0x7ffc0000 [ 1216.187649][ T30] audit: type=1326 audit(1764483617.424:1930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25521 comm="syz.4.5921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4afe98f749 code=0x7ffc0000 [ 1216.212834][ T30] audit: type=1326 audit(1764483617.424:1931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25521 comm="syz.4.5921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f4afe98f749 code=0x7ffc0000 [ 1216.235811][ T30] audit: type=1326 audit(1764483617.424:1932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25521 comm="syz.4.5921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4afe98f749 code=0x7ffc0000 [ 1216.264676][ T30] audit: type=1326 audit(1764483617.424:1933): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25521 comm="syz.4.5921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4afe98f749 code=0x7ffc0000 [ 1216.287942][ T30] audit: type=1326 audit(1764483617.424:1934): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25521 comm="syz.4.5921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7f4afe98f749 code=0x7ffc0000 [ 1216.314996][ T30] audit: type=1326 audit(1764483617.424:1935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25521 comm="syz.4.5921" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4afe98f749 code=0x7ffc0000 [ 1216.670188][ T5893] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 1216.816068][T25536] netlink: 128 bytes leftover after parsing attributes in process `syz.5.5925'. [ 1216.830114][ T5893] usb 3-1: Using ep0 maxpacket: 8 [ 1216.839215][ T5893] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1216.848118][ T5893] usb 3-1: config 12 interface 0 altsetting 7 bulk endpoint 0x3 has invalid maxpacket 108 [ 1216.859164][ T5893] usb 3-1: config 12 interface 0 has no altsetting 0 [ 1216.868938][ T5893] usb 3-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 1216.878291][ T5893] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1216.887632][ T5893] usb 3-1: Product: syz [ 1216.892032][ T5893] usb 3-1: Manufacturer: syz [ 1216.896699][ T5893] usb 3-1: SerialNumber: syz [ 1216.908541][T25530] raw-gadget.6 gadget.2: fail, usb_ep_enable returned -22 [ 1217.139854][ T5893] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1217.148506][ T5893] usb 3-1: selecting invalid altsetting 0 [ 1217.183810][ T5893] usb 3-1: USB disconnect, device number 80 [ 1217.275889][T11654] udevd[11654]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:12.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1217.484675][T25547] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5929'. [ 1217.500121][T25547] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5929'. [ 1217.690000][ T43] usb 4-1: new low-speed USB device number 68 using dummy_hcd [ 1217.845987][ T43] usb 4-1: device descriptor read/64, error -71 [ 1217.853099][T25553] vlan2: entered promiscuous mode [ 1218.100159][ T43] usb 4-1: new low-speed USB device number 69 using dummy_hcd [ 1218.300175][ T43] usb 4-1: device descriptor read/64, error -71 [ 1218.410207][ T43] usb usb4-port1: attempt power cycle [ 1218.499160][T25562] vim2m vim2m.0: vidioc_s_fmt queue busy [ 1218.750084][ T43] usb 4-1: new low-speed USB device number 70 using dummy_hcd [ 1218.771898][ T43] usb 4-1: device descriptor read/8, error -71 [ 1219.010612][ T43] usb 4-1: new low-speed USB device number 71 using dummy_hcd [ 1219.039224][ T43] usb 4-1: device descriptor read/8, error -71 [ 1219.151592][ T43] usb usb4-port1: unable to enumerate USB device [ 1219.338417][T25574] netlink: 128 bytes leftover after parsing attributes in process `syz.5.5939'. [ 1219.653266][T25575] netlink: 108 bytes leftover after parsing attributes in process `syz.4.5937'. [ 1219.951777][T25590] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5943'. [ 1220.540168][ T5907] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 1220.727580][ T5907] usb 3-1: config 0 has no interfaces? [ 1220.780351][ T5907] usb 3-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1220.790664][ T5907] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1220.823473][ T5907] usb 3-1: Product: syz [ 1220.827718][ T5907] usb 3-1: Manufacturer: syz [ 1220.853541][ T5907] usb 3-1: SerialNumber: syz [ 1220.943326][ T5907] usb 3-1: config 0 descriptor?? [ 1222.690869][T25626] netlink: 128 bytes leftover after parsing attributes in process `syz.7.5954'. [ 1222.959945][ T5907] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 1223.143818][ T5907] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1223.264380][ T5907] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1223.291174][ T5893] usb 3-1: USB disconnect, device number 81 [ 1223.312201][ T5907] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1223.376216][ T5907] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1223.415706][ T5907] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 1223.444019][ T5907] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1223.505535][ T5907] usb 4-1: config 1 interface 1 has no altsetting 0 [ 1223.540417][ T5907] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1223.549605][ T5907] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1223.590056][ T5907] usb 4-1: Product: syz [ 1223.615982][ T5907] usb 4-1: Manufacturer: syz [ 1223.631646][ T5907] usb 4-1: SerialNumber: syz [ 1223.655190][ T5907] cdc_ncm 4-1:1.0: skipping garbage [ 1223.667158][ T5907] cdc_ncm 4-1:1.0: NCM or ECM functional descriptors missing [ 1223.679943][ T5907] cdc_ncm 4-1:1.0: bind() failure [ 1224.003938][T25635] binder: 25634:25635 ioctl c0306201 200000000080 returned -14 [ 1224.154504][T25650] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1224.193899][T25650] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1224.583755][T25664] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 1224.617555][T25664] netlink: 156 bytes leftover after parsing attributes in process `syz.2.5968'. [ 1225.022174][T25683] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5974'. [ 1225.044111][T25682] netlink: 128 bytes leftover after parsing attributes in process `syz.4.5973'. [ 1225.577977][T25691] fuse: Bad value for 'fd' [ 1225.740395][ T5907] usb 4-1: USB disconnect, device number 72 [ 1225.833016][T25693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1225.896674][T25693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1225.910808][T25696] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5976'. [ 1226.425985][T25703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1226.452763][T25704] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5978'. [ 1226.457153][T25703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1226.599422][T25684] syz.2.5974 (25684): drop_caches: 2 [ 1227.394212][T25710] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x6 [ 1227.864234][T25727] netlink: 128 bytes leftover after parsing attributes in process `syz.4.5987'. [ 1227.930124][T22998] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 1228.152167][T22998] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1228.165244][T22998] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1228.189232][T22998] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1228.217030][T22998] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1228.239231][T25731] xt_hashlimit: max too large, truncated to 1048576 [ 1228.248691][T22998] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 1228.274187][T22998] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1228.326873][T22998] usb 4-1: config 1 interface 1 has no altsetting 0 [ 1228.372948][T25731] fuse: Unknown parameter '000000000000000000060x000000000000000b' [ 1228.441867][T22998] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1228.455134][T22998] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1228.478466][T22998] usb 4-1: Product: syz [ 1228.487441][T22998] usb 4-1: Manufacturer: syz [ 1228.500634][T22998] usb 4-1: SerialNumber: syz [ 1228.526248][T22998] cdc_ncm 4-1:1.0: skipping garbage [ 1228.539220][T22998] cdc_ncm 4-1:1.0: NCM or ECM functional descriptors missing [ 1228.561970][T22998] cdc_ncm 4-1:1.0: bind() failure [ 1228.708947][T25738] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5991'. [ 1228.782868][T25738] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5991'. [ 1229.058652][T25745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1229.081882][T25745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1229.897754][T25762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1230.072533][T25762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1230.154435][T25762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1230.225760][T25762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1230.819537][ T5893] usb 4-1: USB disconnect, device number 73 [ 1230.905174][T25767] FAULT_INJECTION: forcing a failure. [ 1230.905174][T25767] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1230.935929][T25767] CPU: 0 UID: 0 PID: 25767 Comm: syz.7.5997 Not tainted syzkaller #0 PREEMPT(full) [ 1230.935956][T25767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1230.935967][T25767] Call Trace: [ 1230.935976][T25767] [ 1230.935984][T25767] dump_stack_lvl+0x189/0x250 [ 1230.936012][T25767] ? __pfx____ratelimit+0x10/0x10 [ 1230.936036][T25767] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1230.936058][T25767] ? __pfx__printk+0x10/0x10 [ 1230.936078][T25767] ? __might_fault+0xb0/0x130 [ 1230.936112][T25767] should_fail_ex+0x414/0x560 [ 1230.936141][T25767] _copy_from_user+0x2d/0xb0 [ 1230.936165][T25767] do_ip_getsockopt+0x25f/0x1b60 [ 1230.936193][T25767] ? __pfx_do_ip_getsockopt+0x10/0x10 [ 1230.936221][T25767] ? __might_fault+0xb0/0x130 [ 1230.936245][T25767] ? _parse_integer_limit+0x1ae/0x1f0 [ 1230.936262][T25767] ? aa_label_sk_perm+0x4cd/0x630 [ 1230.936294][T25767] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 1230.936341][T25767] ip_getsockopt+0xbb/0x220 [ 1230.936366][T25767] ? __pfx_ip_getsockopt+0x10/0x10 [ 1230.936388][T25767] ? __might_fault+0xb0/0x130 [ 1230.936413][T25767] ipv6_getsockopt+0x182/0x290 [ 1230.936436][T25767] ? __pfx_ipv6_getsockopt+0x10/0x10 [ 1230.936459][T25767] ? sctp_getsockopt+0x9b/0xb60 [ 1230.936476][T25767] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1230.936503][T25767] do_sock_getsockopt+0x372/0x450 [ 1230.936525][T25767] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1230.936544][T25767] ? do_syscall_64+0xa0/0xfa0 [ 1230.936566][T25767] ? __fget_files+0x2a/0x420 [ 1230.936582][T25767] ? __fget_files+0x3a0/0x420 [ 1230.936599][T25767] ? __fget_files+0x2a/0x420 [ 1230.936623][T25767] __x64_sys_getsockopt+0x1a5/0x250 [ 1230.936641][T25767] ? do_syscall_64+0xa0/0xfa0 [ 1230.936665][T25767] ? do_syscall_64+0xa0/0xfa0 [ 1230.936692][T25767] do_syscall_64+0xfa/0xfa0 [ 1230.936713][T25767] ? lockdep_hardirqs_on+0x9c/0x150 [ 1230.936737][T25767] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1230.936754][T25767] ? clear_bhb_loop+0x60/0xb0 [ 1230.936775][T25767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1230.936792][T25767] RIP: 0033:0x7fe9ea38f749 [ 1230.936809][T25767] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1230.936825][T25767] RSP: 002b:00007fe9eb282038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1230.936845][T25767] RAX: ffffffffffffffda RBX: 00007fe9ea5e5fa0 RCX: 00007fe9ea38f749 [ 1230.936859][T25767] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 [ 1230.936871][T25767] RBP: 00007fe9eb282090 R08: 0000200000000200 R09: 0000000000000000 [ 1230.936889][T25767] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 1230.936901][T25767] R13: 00007fe9ea5e6038 R14: 00007fe9ea5e5fa0 R15: 00007fe9ea70fa28 [ 1230.936932][T25767] [ 1233.198955][T25808] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1233.214183][T25808] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1233.230167][T25808] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1233.240510][ T43] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 1233.249799][T25808] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1233.390066][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 1233.397843][ T43] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 1233.408646][ T43] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1233.418051][ T43] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1233.428099][ T43] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1233.438663][ T43] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1233.449626][ T43] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1233.463596][ T43] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1233.473092][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1233.486246][ T43] usb 4-1: config 0 descriptor?? [ 1233.711995][ T43] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 74 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1233.867907][T25813] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1233.876751][T25813] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1233.943118][ C1] usblp0: nonzero read bulk status received: -71 [ 1233.956247][ T9] usb 4-1: USB disconnect, device number 74 [ 1234.196291][T25805] netlink: 'syz.3.6007': attribute type 10 has an invalid length. [ 1234.205258][T25805] veth0_vlan: entered allmulticast mode [ 1234.226670][T25805] veth0_vlan: left promiscuous mode [ 1234.234633][T25805] veth0_vlan: entered promiscuous mode [ 1234.245288][T25805] team0: Device veth0_vlan failed to register rx_handler [ 1234.285962][T25804] usblp0: removed [ 1234.625909][T25827] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1234.639339][T25827] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1234.669364][ T30] kauditd_printk_skb: 78 callbacks suppressed [ 1234.669383][ T30] audit: type=1326 audit(1764483636.034:2014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25829 comm="syz.5.6017" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1234.705421][ T30] audit: type=1326 audit(1764483636.034:2015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25829 comm="syz.5.6017" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1234.766541][ T30] audit: type=1326 audit(1764483636.034:2016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25829 comm="syz.5.6017" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1234.789531][ T30] audit: type=1326 audit(1764483636.034:2017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25829 comm="syz.5.6017" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1234.818243][ T30] audit: type=1326 audit(1764483636.034:2018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25829 comm="syz.5.6017" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1234.847436][ T30] audit: type=1326 audit(1764483636.034:2019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25829 comm="syz.5.6017" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1234.876169][ T30] audit: type=1326 audit(1764483636.034:2020): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25829 comm="syz.5.6017" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1234.899226][ T30] audit: type=1326 audit(1764483636.034:2021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25829 comm="syz.5.6017" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1234.928531][ T30] audit: type=1326 audit(1764483636.034:2022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25829 comm="syz.5.6017" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1234.961755][ T30] audit: type=1326 audit(1764483636.034:2023): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25829 comm="syz.5.6017" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1235.040808][T25839] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6018'. [ 1235.099602][T25827] netlink: 'syz.4.6015': attribute type 10 has an invalid length. [ 1235.129137][T25827] veth0_vlan: entered allmulticast mode [ 1235.178462][T25827] veth0_vlan: left promiscuous mode [ 1235.186379][T25827] veth0_vlan: entered promiscuous mode [ 1235.198219][T25827] team0: Device veth0_vlan failed to register rx_handler [ 1235.300021][ T5964] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 1235.451345][ T5964] usb 4-1: Using ep0 maxpacket: 8 [ 1235.460630][ T5964] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1235.480123][ T5964] usb 4-1: New USB device found, idVendor=2833, idProduct=0201, bcdDevice=2a.d5 [ 1235.510179][ T5964] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1235.526202][ T5964] usb 4-1: config 0 descriptor?? [ 1235.546345][ T5964] uvcvideo 4-1:0.0: probe with driver uvcvideo failed with error -22 [ 1235.741952][ T5964] usb 4-1: USB disconnect, device number 75 [ 1236.128223][T25875] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1236.156958][T25875] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1236.333009][T25882] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1236.345818][T25882] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1236.514524][T25886] team0: Device ipip0 is of different type [ 1236.893719][T25897] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1236.915953][T25897] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1236.941485][T25897] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1236.956659][T25897] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1236.999976][ T5964] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 1237.166025][ T5964] usb 4-1: Using ep0 maxpacket: 32 [ 1237.182451][ T5964] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 1237.238540][ T5964] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1237.286155][ T5964] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1237.334508][ T5964] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1237.367748][ T5964] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1237.389502][ T5964] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1237.404973][ T5964] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1237.427868][ T5964] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1237.480198][ T5964] usb 4-1: config 0 descriptor?? [ 1237.720657][ T5964] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 76 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1237.871721][T25899] FAULT_INJECTION: forcing a failure. [ 1237.871721][T25899] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1237.885236][T25899] CPU: 0 UID: 0 PID: 25899 Comm: syz.5.6038 Not tainted syzkaller #0 PREEMPT(full) [ 1237.885258][T25899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1237.885264][T25899] Call Trace: [ 1237.885270][T25899] [ 1237.885275][T25899] dump_stack_lvl+0x189/0x250 [ 1237.885294][T25899] ? __pfx____ratelimit+0x10/0x10 [ 1237.885308][T25899] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1237.885320][T25899] ? __pfx__printk+0x10/0x10 [ 1237.885331][T25899] ? __might_fault+0xb0/0x130 [ 1237.885353][T25899] should_fail_ex+0x414/0x560 [ 1237.885371][T25899] _copy_from_user+0x2d/0xb0 [ 1237.885385][T25899] do_ipt_get_ctl+0x2d2/0x1180 [ 1237.885403][T25899] ? __pfx_do_ipt_get_ctl+0x10/0x10 [ 1237.885418][T25899] ? __mutex_trylock_common+0x153/0x260 [ 1237.885433][T25899] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1237.885447][T25899] ? rcu_is_watching+0x15/0xb0 [ 1237.885459][T25899] ? trace_contention_end+0x39/0x120 [ 1237.885475][T25899] ? nf_getsockopt+0x224/0x290 [ 1237.885490][T25899] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 1237.885520][T25899] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1237.885548][T25899] ? __might_fault+0xb0/0x130 [ 1237.885578][T25899] nf_getsockopt+0x26e/0x290 [ 1237.885594][T25899] ip_getsockopt+0x1c4/0x220 [ 1237.885614][T25899] ? __pfx_ip_getsockopt+0x10/0x10 [ 1237.885626][T25899] ? __might_fault+0xb0/0x130 [ 1237.885641][T25899] ipv6_getsockopt+0x182/0x290 [ 1237.885654][T25899] ? __pfx_ipv6_getsockopt+0x10/0x10 [ 1237.885667][T25899] ? sctp_getsockopt+0x9b/0xb60 [ 1237.885676][T25899] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1237.885691][T25899] do_sock_getsockopt+0x372/0x450 [ 1237.885704][T25899] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1237.885714][T25899] ? do_syscall_64+0xa0/0xfa0 [ 1237.885727][T25899] ? __fget_files+0x2a/0x420 [ 1237.885737][T25899] ? __fget_files+0x3a0/0x420 [ 1237.885745][T25899] ? __fget_files+0x2a/0x420 [ 1237.885758][T25899] __x64_sys_getsockopt+0x1a5/0x250 [ 1237.885769][T25899] ? do_syscall_64+0xa0/0xfa0 [ 1237.885782][T25899] ? do_syscall_64+0xa0/0xfa0 [ 1237.885797][T25899] do_syscall_64+0xfa/0xfa0 [ 1237.885810][T25899] ? lockdep_hardirqs_on+0x9c/0x150 [ 1237.885823][T25899] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1237.885833][T25899] ? clear_bhb_loop+0x60/0xb0 [ 1237.885845][T25899] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1237.885855][T25899] RIP: 0033:0x7f5b0738f749 [ 1237.885865][T25899] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1237.885874][T25899] RSP: 002b:00007f5b08207038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1237.885886][T25899] RAX: ffffffffffffffda RBX: 00007f5b075e5fa0 RCX: 00007f5b0738f749 [ 1237.885894][T25899] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 [ 1237.885900][T25899] RBP: 00007f5b08207090 R08: 0000200000000200 R09: 0000000000000000 [ 1237.885907][T25899] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 1237.885913][T25899] R13: 00007f5b075e6038 R14: 00007f5b075e5fa0 R15: 00007f5b0770fa28 [ 1237.885929][T25899] [ 1238.205569][ C1] usblp0: nonzero read bulk status received: -71 [ 1238.212298][ T43] usb 4-1: USB disconnect, device number 76 [ 1238.467459][T25893] netlink: 'syz.3.6035': attribute type 10 has an invalid length. [ 1238.658045][T25893] veth0_vlan: left promiscuous mode [ 1238.708525][T25893] veth0_vlan: entered promiscuous mode [ 1238.752757][T25893] team0: Device veth0_vlan failed to register rx_handler [ 1238.804441][T25892] usblp0: removed [ 1238.888109][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.894944][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1239.029686][T25918] misc userio: Begin command sent, but we're already running [ 1239.303275][T25935] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6048'. [ 1239.432507][T25935] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6048'. [ 1239.460952][T25935] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6048'. [ 1239.535778][T25944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1239.565921][T25944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1239.830248][ T5907] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1240.035652][ T5907] usb 4-1: Using ep0 maxpacket: 32 [ 1240.047502][ T5907] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1240.067292][ T5907] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1240.087292][ T5907] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1240.096639][ T5907] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1240.110686][ T5907] usb 4-1: config 0 descriptor?? [ 1240.397926][T25962] vlan2: entered promiscuous mode [ 1240.525076][ T5907] usbhid 4-1:0.0: can't add hid device: -32 [ 1240.555738][ T5907] usbhid 4-1:0.0: probe with driver usbhid failed with error -32 [ 1240.602948][T25965] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1241.244786][T25993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1241.259651][T25993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1241.297093][T25994] vim2m vim2m.0: vidioc_s_fmt queue busy [ 1241.362723][T25991] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6068'. [ 1242.166252][T26005] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1242.179593][T26005] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1242.901746][ T5907] usb 4-1: USB disconnect, device number 77 [ 1242.924165][T26012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1243.022642][T26012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1243.470084][T22998] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 1243.717343][T22998] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1243.754764][T22998] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1243.782405][T22998] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1243.822742][T22998] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1243.846629][T22998] usb 3-1: SerialNumber: syz [ 1244.168072][T22998] usb 3-1: 0:2 : does not exist [ 1244.178062][T22998] usb 3-1: unit 5 not found! [ 1244.926219][T26039] vim2m vim2m.0: vidioc_s_fmt queue busy [ 1245.901233][ T9] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1246.073075][ T9] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1246.110331][ T5964] usb 3-1: USB disconnect, device number 82 [ 1246.127985][ T9] usb 4-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1246.215640][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1246.256496][ T9] usb 4-1: New USB device found, idVendor=0458, idProduct=5017, bcdDevice= 0.00 [ 1246.310053][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1246.349390][ T9] usb 4-1: config 0 descriptor?? [ 1248.906427][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 1248.929475][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1248.982662][ T9] usb 4-1: USB disconnect, device number 78 [ 1249.021472][T26088] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6102'. [ 1250.081114][T26106] vim2m vim2m.0: vidioc_s_fmt queue busy [ 1251.482608][T26110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1251.494234][T26110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1252.115290][T26113] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1252.124449][T26113] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1252.150547][T26113] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1252.159433][T26113] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1252.569384][T26127] netlink: 7 bytes leftover after parsing attributes in process `syz.2.6116'. [ 1252.584220][T26127] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6116'. [ 1252.710318][ T5893] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1252.864866][ T5893] usb 4-1: Using ep0 maxpacket: 32 [ 1252.874013][ T5893] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1252.884716][ T5893] usb 4-1: config 120 has an invalid interface number: 86 but max is 0 [ 1252.893943][ T5893] usb 4-1: config 120 has no interface number 0 [ 1252.903437][ T5893] usb 4-1: New USB device found, idVendor=12d1, idProduct=9c20, bcdDevice=e5.af [ 1252.913612][ T5893] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1252.922196][ T5893] usb 4-1: Product: syz [ 1252.927067][ T5893] usb 4-1: Manufacturer: syz [ 1252.932762][ T5893] usb 4-1: SerialNumber: syz [ 1252.940125][T22998] usb 3-1: new low-speed USB device number 83 using dummy_hcd [ 1253.123579][T22998] usb 3-1: Invalid ep0 maxpacket: 16 [ 1253.162590][ T5893] huawei_cdc_ncm 4-1:120.86: More than one union descriptor, skipping ... [ 1253.178952][ T5893] huawei_cdc_ncm 4-1:120.86: CDC Union missing and no IAD found [ 1253.187072][ T5893] huawei_cdc_ncm 4-1:120.86: bind() failure [ 1253.198721][ T5893] usb 4-1: USB disconnect, device number 79 [ 1253.270183][T22998] usb 3-1: new low-speed USB device number 84 using dummy_hcd [ 1253.351057][T26143] dvmrp1: entered allmulticast mode [ 1253.449974][T22998] usb 3-1: Invalid ep0 maxpacket: 16 [ 1253.456273][T22998] usb usb3-port1: attempt power cycle [ 1253.488400][T26146] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 1253.810066][T22998] usb 3-1: new low-speed USB device number 85 using dummy_hcd [ 1253.841774][T22998] usb 3-1: Invalid ep0 maxpacket: 16 [ 1253.981466][T22998] usb 3-1: new low-speed USB device number 86 using dummy_hcd [ 1254.010977][T22998] usb 3-1: Invalid ep0 maxpacket: 16 [ 1254.017958][T22998] usb usb3-port1: unable to enumerate USB device [ 1254.335184][T26169] vlan2: entered promiscuous mode [ 1254.341425][T26169] bond0: entered promiscuous mode [ 1254.346670][T26169] bond_slave_0: entered promiscuous mode [ 1254.355197][T26169] bond_slave_1: entered promiscuous mode [ 1254.426608][T26171] xt_hashlimit: max too large, truncated to 1048576 [ 1254.520954][T26173] netlink: 128 bytes leftover after parsing attributes in process `syz.4.6130'. [ 1255.246782][T26184] macvlan2: entered promiscuous mode [ 1255.377083][T26190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1255.387096][T26190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1255.575635][T26194] netlink: 20 bytes leftover after parsing attributes in process `syz.7.6137'. [ 1255.712107][T26198] tipc: Enabling of bearer rejected, already enabled [ 1255.871489][T26202] ptrace attach of "./syz-executor exec"[20369] was attempted by " Àÿ Ðÿ ð¥ Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ"[26202] [ 1256.305707][T26214] SET target dimension over the limit! [ 1256.912883][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 1256.912895][ T30] audit: type=1326 audit(1764483658.284:2050): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26206 comm="syz.5.6142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1256.986759][ T30] audit: type=1326 audit(1764483658.284:2051): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26206 comm="syz.5.6142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1257.034957][ T30] audit: type=1326 audit(1764483658.284:2052): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26206 comm="syz.5.6142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=220 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1257.100133][ T30] audit: type=1326 audit(1764483658.284:2053): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26206 comm="syz.5.6142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1257.173796][ T30] audit: type=1326 audit(1764483658.284:2054): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26206 comm="syz.5.6142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1257.255583][ T30] audit: type=1326 audit(1764483658.284:2055): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26206 comm="syz.5.6142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1257.304361][ T30] audit: type=1326 audit(1764483658.284:2056): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26206 comm="syz.5.6142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1257.347319][ T30] audit: type=1326 audit(1764483658.284:2057): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26206 comm="syz.5.6142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1257.412547][ T30] audit: type=1326 audit(1764483658.284:2058): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26206 comm="syz.5.6142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1257.460033][ T30] audit: type=1326 audit(1764483658.284:2059): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26206 comm="syz.5.6142" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b0738f749 code=0x7ffc0000 [ 1258.860087][T26236] vlan2: entered promiscuous mode [ 1259.448955][T26252] netlink: 'syz.5.6158': attribute type 1 has an invalid length. [ 1259.449057][T26252] bridge0: port 1(bridge_slave_0) entered disabled state [ 1259.449494][T26252] bridge0: port 1(bridge_slave_0) entered blocking state [ 1259.449579][T26252] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1260.725420][T26268] netlink: 128 bytes leftover after parsing attributes in process `syz.2.6161'. [ 1260.951129][T26276] netlink: 20 bytes leftover after parsing attributes in process `syz.7.6164'. [ 1260.967369][T26274] vim2m vim2m.0: vidioc_s_fmt queue busy [ 1261.000111][T26276] netlink: 20 bytes leftover after parsing attributes in process `syz.7.6164'. [ 1262.199784][T26299] libceph: resolve '0.0' (ret=-3): failed [ 1262.475856][T26299] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6169'. [ 1263.350023][T26311] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6173'. [ 1264.954092][T26346] fuse: Bad value for 'user_id' [ 1264.990224][T26346] fuse: Bad value for 'user_id' [ 1265.740833][T26352] SET target dimension over the limit! [ 1265.854487][T26359] FAULT_INJECTION: forcing a failure. [ 1265.854487][T26359] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1265.869980][T26359] CPU: 0 UID: 0 PID: 26359 Comm: syz.4.6187 Not tainted syzkaller #0 PREEMPT(full) [ 1265.870004][T26359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1265.870015][T26359] Call Trace: [ 1265.870023][T26359] [ 1265.870031][T26359] dump_stack_lvl+0x189/0x250 [ 1265.870059][T26359] ? __pfx____ratelimit+0x10/0x10 [ 1265.870080][T26359] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1265.870102][T26359] ? __pfx__printk+0x10/0x10 [ 1265.870120][T26359] ? __might_fault+0xb0/0x130 [ 1265.870151][T26359] should_fail_ex+0x414/0x560 [ 1265.870179][T26359] _copy_from_user+0x2d/0xb0 [ 1265.870199][T26359] ___sys_sendmsg+0x158/0x2a0 [ 1265.870222][T26359] ? __pfx____sys_sendmsg+0x10/0x10 [ 1265.870275][T26359] ? __fget_files+0x2a/0x420 [ 1265.870292][T26359] ? __fget_files+0x3a0/0x420 [ 1265.870319][T26359] __sys_sendmmsg+0x227/0x430 [ 1265.870344][T26359] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1265.870372][T26359] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1265.870421][T26359] ? ksys_write+0x22a/0x250 [ 1265.870447][T26359] ? __pfx_ksys_write+0x10/0x10 [ 1265.870475][T26359] __x64_sys_sendmmsg+0xa0/0xc0 [ 1265.870497][T26359] do_syscall_64+0xfa/0xfa0 [ 1265.870519][T26359] ? lockdep_hardirqs_on+0x9c/0x150 [ 1265.870542][T26359] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1265.870559][T26359] ? clear_bhb_loop+0x60/0xb0 [ 1265.870580][T26359] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1265.870597][T26359] RIP: 0033:0x7f4afe98f749 [ 1265.870613][T26359] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1265.870630][T26359] RSP: 002b:00007f4aff74c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1265.870651][T26359] RAX: ffffffffffffffda RBX: 00007f4afebe5fa0 RCX: 00007f4afe98f749 [ 1265.870664][T26359] RDX: 00000000000003ef RSI: 0000200000000180 RDI: 0000000000000003 [ 1265.870676][T26359] RBP: 00007f4aff74c090 R08: 0000000000000000 R09: 0000000000000000 [ 1265.870688][T26359] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1265.870699][T26359] R13: 00007f4afebe6038 R14: 00007f4afebe5fa0 R15: 00007f4afed0fa28 [ 1265.870731][T26359] [ 1266.587826][T26369] FAULT_INJECTION: forcing a failure. [ 1266.587826][T26369] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1266.602154][T26369] CPU: 0 UID: 0 PID: 26369 Comm: syz.7.6189 Not tainted syzkaller #0 PREEMPT(full) [ 1266.602179][T26369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1266.602187][T26369] Call Trace: [ 1266.602192][T26369] [ 1266.602197][T26369] dump_stack_lvl+0x189/0x250 [ 1266.602215][T26369] ? __pfx____ratelimit+0x10/0x10 [ 1266.602229][T26369] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1266.602242][T26369] ? __pfx__printk+0x10/0x10 [ 1266.602253][T26369] ? __might_fault+0xb0/0x130 [ 1266.602273][T26369] should_fail_ex+0x414/0x560 [ 1266.602291][T26369] _copy_from_user+0x2d/0xb0 [ 1266.602304][T26369] sctp_getsockopt_assoc_stats+0xec/0x780 [ 1266.602319][T26369] ? register_lock_class+0x51/0x320 [ 1266.602330][T26369] ? __pfx_sctp_getsockopt_assoc_stats+0x10/0x10 [ 1266.602358][T26369] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1266.602376][T26369] sctp_getsockopt+0x421/0xb60 [ 1266.602385][T26369] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1266.602407][T26369] do_sock_getsockopt+0x372/0x450 [ 1266.602420][T26369] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1266.602430][T26369] ? do_syscall_64+0xa0/0xfa0 [ 1266.602443][T26369] ? __fget_files+0x2a/0x420 [ 1266.602453][T26369] ? __fget_files+0x3a0/0x420 [ 1266.602461][T26369] ? __fget_files+0x2a/0x420 [ 1266.602474][T26369] __x64_sys_getsockopt+0x1a5/0x250 [ 1266.602485][T26369] ? do_syscall_64+0xa0/0xfa0 [ 1266.602498][T26369] ? do_syscall_64+0xa0/0xfa0 [ 1266.602513][T26369] do_syscall_64+0xfa/0xfa0 [ 1266.602527][T26369] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1266.602536][T26369] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1266.602546][T26369] ? clear_bhb_loop+0x60/0xb0 [ 1266.602557][T26369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1266.602567][T26369] RIP: 0033:0x7fe9ea38f749 [ 1266.602578][T26369] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1266.602587][T26369] RSP: 002b:00007fe9eb282038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1266.602599][T26369] RAX: ffffffffffffffda RBX: 00007fe9ea5e5fa0 RCX: 00007fe9ea38f749 [ 1266.602606][T26369] RDX: 0000000000000070 RSI: 0000000000000084 RDI: 0000000000000003 [ 1266.602613][T26369] RBP: 00007fe9eb282090 R08: 0000200000000000 R09: 0000000000000000 [ 1266.602620][T26369] R10: 0000200000000300 R11: 0000000000000246 R12: 0000000000000001 [ 1266.602626][T26369] R13: 00007fe9ea5e6038 R14: 00007fe9ea5e5fa0 R15: 00007fe9ea70fa28 [ 1266.602643][T26369] [ 1267.063711][T26372] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6190'. [ 1267.118865][T26375] libceph: resolve '0.0' (ret=-3): failed [ 1267.245128][T26375] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6188'. [ 1268.216404][T26403] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1268.267625][T26403] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1268.296547][T26403] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1268.300399][T26403] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1268.335586][T26405] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6200'. [ 1268.529113][T26401] ------------[ cut here ]------------ [ 1268.529209][T26401] WARNING: CPU: 0 PID: 26401 at drivers/gpu/drm/vkms/vkms_crtc.c:97 vkms_get_vblank_timestamp+0x137/0x160 [ 1268.529253][T26401] Modules linked in: [ 1268.529321][T26401] CPU: 0 UID: 0 PID: 26401 Comm: syz.5.6198 Not tainted syzkaller #0 PREEMPT(full) [ 1268.529345][T26401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1268.529358][T26401] RIP: 0010:vkms_get_vblank_timestamp+0x137/0x160 [ 1268.530526][T26401] Code: 42 80 3c 28 00 74 08 48 89 df e8 74 6c 66 fc 4c 89 33 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d e9 80 38 8a 05 cc e8 8a a7 00 fc 90 <0f> 0b 90 eb e3 44 89 e1 80 e1 07 38 c1 0f 8c ff fe ff ff 4c 89 e7 [ 1268.530549][T26401] RSP: 0018:ffffc9000d0071e8 EFLAGS: 00010283 [ 1268.530570][T26401] RAX: ffffffff85bf5c26 RBX: ffffc9000d007360 RCX: 0000000000080000 [ 1268.530586][T26401] RDX: ffffc900104d5000 RSI: 0000000000002978 RDI: 0000000000002979 [ 1268.530602][T26401] RBP: 1ffff92001a00e6c R08: ffffffff8f7cf777 R09: 1ffffffff1ef9eee [ 1268.530618][T26401] R10: dffffc0000000000 R11: ffffffff85bf5af0 R12: 0000012757bbf014 [ 1268.530633][T26401] R13: dffffc0000000000 R14: ffff88801bf0c028 R15: 0000012757bbf014 [ 1268.530645][T26401] FS: 00007f5b081e66c0(0000) GS:ffff888126138000(0000) knlGS:0000000000000000 [ 1268.530661][T26401] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1268.530673][T26401] CR2: 00002000001e3030 CR3: 0000000067bde000 CR4: 00000000003526f0 [ 1268.530692][T26401] Call Trace: [ 1268.530701][T26401] [ 1268.530710][T26401] ? __pfx_vkms_get_vblank_timestamp+0x10/0x10 [ 1268.530740][T26401] drm_crtc_next_vblank_start+0x226/0x470 [ 1268.530770][T26401] ? __pfx_drm_crtc_next_vblank_start+0x10/0x10 [ 1268.530795][T26401] ? seqcount_lockdep_reader_access+0x122/0x1c0 [ 1268.530819][T26401] ? lockdep_hardirqs_on+0x9c/0x150 [ 1268.530849][T26401] drm_atomic_helper_wait_for_fences+0x265/0x8c0 [ 1268.530882][T26401] ? __pfx_drm_atomic_helper_wait_for_fences+0x10/0x10 [ 1268.530907][T26401] ? read_tsc+0x9/0x20 [ 1268.530930][T26401] ? ktime_get+0x1d2/0x200 [ 1268.530964][T26401] commit_tail+0x79/0x3a0 [ 1268.530996][T26401] drm_atomic_helper_commit+0xa6b/0xb10 [ 1268.531027][T26401] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 1268.531049][T26401] drm_atomic_commit+0x262/0x2c0 [ 1268.531073][T26401] ? __pfx_drm_atomic_commit+0x10/0x10 [ 1268.531094][T26401] ? __pfx___drm_printfn_info+0x10/0x10 [ 1268.531126][T26401] ? drm_client_rotation+0x47c/0x5b0 [ 1268.531159][T26401] drm_client_modeset_commit_atomic+0x620/0x760 [ 1268.531198][T26401] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 1268.531248][T26401] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1268.531289][T26401] drm_client_modeset_commit_locked+0xcb/0x4d0 [ 1268.531324][T26401] drm_fb_helper_pan_display+0x3e7/0xbd0 [ 1268.531365][T26401] fb_pan_display+0x39e/0x680 [ 1268.531389][T26401] ? __pfx_drm_fb_helper_pan_display+0x10/0x10 [ 1268.531421][T26401] bit_update_start+0x4d/0x1e0 [ 1268.531450][T26401] fbcon_switch+0x14f7/0x1f90 [ 1268.531485][T26401] ? __pfx_fbcon_switch+0x10/0x10 [ 1268.531526][T26401] ? __pfx_hide_cursor+0x10/0x10 [ 1268.531555][T26401] ? is_console_locked+0x9/0x20 [ 1268.531578][T26401] ? set_origin+0x346/0x480 [ 1268.531604][T26401] redraw_screen+0x56d/0xe90 [ 1268.531625][T26401] ? fbcon_set_palette+0x690/0x800 [ 1268.531651][T26401] ? __pfx_redraw_screen+0x10/0x10 [ 1268.531683][T26401] do_fb_ioctl+0x6fd/0x750 [ 1268.531712][T26401] ? __pfx_do_fb_ioctl+0x10/0x10 [ 1268.531779][T26401] ? __fget_files+0x2a/0x420 [ 1268.531806][T26401] ? __fget_files+0x3a0/0x420 [ 1268.531826][T26401] ? __fget_files+0x2a/0x420 [ 1268.531852][T26401] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1268.531877][T26401] ? __pfx_fb_ioctl+0x10/0x10 [ 1268.531902][T26401] __se_sys_ioctl+0xfc/0x170 [ 1268.531931][T26401] do_syscall_64+0xfa/0xfa0 [ 1268.531967][T26401] ? lockdep_hardirqs_on+0x9c/0x150 [ 1268.531995][T26401] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1268.532018][T26401] ? clear_bhb_loop+0x60/0xb0 [ 1268.532045][T26401] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1268.532065][T26401] RIP: 0033:0x7f5b0738f749 [ 1268.533066][T26401] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1268.533090][T26401] RSP: 002b:00007f5b081e6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1268.533115][T26401] RAX: ffffffffffffffda RBX: 00007f5b075e6090 RCX: 00007f5b0738f749 [ 1268.533133][T26401] RDX: 0000200000000100 RSI: 0000000000004601 RDI: 0000000000000006 [ 1268.533148][T26401] RBP: 00007f5b07413f91 R08: 0000000000000000 R09: 0000000000000000 [ 1268.533186][T26401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1268.533201][T26401] R13: 00007f5b075e6128 R14: 00007f5b075e6090 R15: 00007f5b0770fa28 [ 1268.533236][T26401] [ 1268.533249][T26401] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1268.533264][T26401] CPU: 0 UID: 0 PID: 26401 Comm: syz.5.6198 Not tainted syzkaller #0 PREEMPT(full) [ 1268.533287][T26401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1268.533300][T26401] Call Trace: [ 1268.533309][T26401] [ 1268.533318][T26401] dump_stack_lvl+0x99/0x250 [ 1268.533348][T26401] ? __asan_memcpy+0x40/0x70 [ 1268.533373][T26401] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1268.533398][T26401] ? __pfx__printk+0x10/0x10 [ 1268.533435][T26401] vpanic+0x237/0x6d0 [ 1268.533460][T26401] ? __pfx_vpanic+0x10/0x10 [ 1268.533497][T26401] panic+0xb9/0xc0 [ 1268.533521][T26401] ? __pfx_panic+0x10/0x10 [ 1268.533563][T26401] __warn+0x31b/0x4b0 [ 1268.533586][T26401] ? vkms_get_vblank_timestamp+0x137/0x160 [ 1268.533610][T26401] ? vkms_get_vblank_timestamp+0x137/0x160 [ 1268.533631][T26401] report_bug+0x2be/0x4f0 [ 1268.533657][T26401] ? vkms_get_vblank_timestamp+0x137/0x160 [ 1268.533679][T26401] ? vkms_get_vblank_timestamp+0x137/0x160 [ 1268.533701][T26401] ? vkms_get_vblank_timestamp+0x139/0x160 [ 1268.533724][T26401] handle_bug+0x84/0x160 [ 1268.533745][T26401] exc_invalid_op+0x1a/0x50 [ 1268.533765][T26401] asm_exc_invalid_op+0x1a/0x20 [ 1268.533783][T26401] RIP: 0010:vkms_get_vblank_timestamp+0x137/0x160 [ 1268.533804][T26401] Code: 42 80 3c 28 00 74 08 48 89 df e8 74 6c 66 fc 4c 89 33 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d e9 80 38 8a 05 cc e8 8a a7 00 fc 90 <0f> 0b 90 eb e3 44 89 e1 80 e1 07 38 c1 0f 8c ff fe ff ff 4c 89 e7 [ 1268.533822][T26401] RSP: 0018:ffffc9000d0071e8 EFLAGS: 00010283 [ 1268.533840][T26401] RAX: ffffffff85bf5c26 RBX: ffffc9000d007360 RCX: 0000000000080000 [ 1268.533855][T26401] RDX: ffffc900104d5000 RSI: 0000000000002978 RDI: 0000000000002979 [ 1268.533869][T26401] RBP: 1ffff92001a00e6c R08: ffffffff8f7cf777 R09: 1ffffffff1ef9eee [ 1268.533885][T26401] R10: dffffc0000000000 R11: ffffffff85bf5af0 R12: 0000012757bbf014 [ 1268.533900][T26401] R13: dffffc0000000000 R14: ffff88801bf0c028 R15: 0000012757bbf014 [ 1268.533921][T26401] ? __pfx_vkms_get_vblank_timestamp+0x10/0x10 [ 1268.533954][T26401] ? vkms_get_vblank_timestamp+0x136/0x160 [ 1268.533984][T26401] ? vkms_get_vblank_timestamp+0x136/0x160 [ 1268.534004][T26401] ? __pfx_vkms_get_vblank_timestamp+0x10/0x10 [ 1268.534028][T26401] drm_crtc_next_vblank_start+0x226/0x470 [ 1268.534060][T26401] ? __pfx_drm_crtc_next_vblank_start+0x10/0x10 [ 1268.534082][T26401] ? seqcount_lockdep_reader_access+0x122/0x1c0 [ 1268.534107][T26401] ? lockdep_hardirqs_on+0x9c/0x150 [ 1268.534138][T26401] drm_atomic_helper_wait_for_fences+0x265/0x8c0 [ 1268.534171][T26401] ? __pfx_drm_atomic_helper_wait_for_fences+0x10/0x10 [ 1268.534199][T26401] ? read_tsc+0x9/0x20 [ 1268.534225][T26401] ? ktime_get+0x1d2/0x200 [ 1268.534251][T26401] commit_tail+0x79/0x3a0 [ 1268.534283][T26401] drm_atomic_helper_commit+0xa6b/0xb10 [ 1268.534314][T26401] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 1268.534337][T26401] drm_atomic_commit+0x262/0x2c0 [ 1268.534362][T26401] ? __pfx_drm_atomic_commit+0x10/0x10 [ 1268.534380][T26401] ? __pfx___drm_printfn_info+0x10/0x10 [ 1268.534413][T26401] ? drm_client_rotation+0x47c/0x5b0 [ 1268.534447][T26401] drm_client_modeset_commit_atomic+0x620/0x760 [ 1268.534490][T26401] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 1268.534541][T26401] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1268.534580][T26401] drm_client_modeset_commit_locked+0xcb/0x4d0 [ 1268.534614][T26401] drm_fb_helper_pan_display+0x3e7/0xbd0 [ 1268.534654][T26401] fb_pan_display+0x39e/0x680 [ 1268.534678][T26401] ? __pfx_drm_fb_helper_pan_display+0x10/0x10 [ 1268.534708][T26401] bit_update_start+0x4d/0x1e0 [ 1268.534734][T26401] fbcon_switch+0x14f7/0x1f90 [ 1268.534769][T26401] ? __pfx_fbcon_switch+0x10/0x10 [ 1268.534809][T26401] ? __pfx_hide_cursor+0x10/0x10 [ 1268.534837][T26401] ? is_console_locked+0x9/0x20 [ 1268.534859][T26401] ? set_origin+0x346/0x480 [ 1268.534884][T26401] redraw_screen+0x56d/0xe90 [ 1268.534906][T26401] ? fbcon_set_palette+0x690/0x800 [ 1268.534935][T26401] ? __pfx_redraw_screen+0x10/0x10 [ 1268.534986][T26401] do_fb_ioctl+0x6fd/0x750 [ 1268.535016][T26401] ? __pfx_do_fb_ioctl+0x10/0x10 [ 1268.535086][T26401] ? __fget_files+0x2a/0x420 [ 1268.535112][T26401] ? __fget_files+0x3a0/0x420 [ 1268.535130][T26401] ? __fget_files+0x2a/0x420 [ 1268.535154][T26401] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1268.535176][T26401] ? __pfx_fb_ioctl+0x10/0x10 [ 1268.535199][T26401] __se_sys_ioctl+0xfc/0x170 [ 1268.535226][T26401] do_syscall_64+0xfa/0xfa0 [ 1268.535250][T26401] ? lockdep_hardirqs_on+0x9c/0x150 [ 1268.535276][T26401] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1268.535294][T26401] ? clear_bhb_loop+0x60/0xb0 [ 1268.535317][T26401] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1268.535335][T26401] RIP: 0033:0x7f5b0738f749 [ 1268.535353][T26401] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1268.535370][T26401] RSP: 002b:00007f5b081e6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1268.535391][T26401] RAX: ffffffffffffffda RBX: 00007f5b075e6090 RCX: 00007f5b0738f749 [ 1268.535407][T26401] RDX: 0000200000000100 RSI: 0000000000004601 RDI: 0000000000000006 [ 1268.535421][T26401] RBP: 00007f5b07413f91 R08: 0000000000000000 R09: 0000000000000000 [ 1268.535434][T26401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1268.535447][T26401] R13: 00007f5b075e6128 R14: 00007f5b075e6090 R15: 00007f5b0770fa28 [ 1268.535483][T26401] [ 1268.535871][T26401] Kernel Offset: disabled