last executing test programs: 46.745532707s ago: executing program 3 (id=517): r0 = syz_open_dev$video4linux(&(0x7f00000001c0), 0x0, 0x0) ioctl$VIDIOC_QUERY_EXT_CTRL(r0, 0xc0445624, &(0x7f00000000c0)={0x140980001, 0x0, "bf5dff0f251ed700f61765c214525a2572ce1ced49e8981e103268fadc1433ae"}) keyctl$set_reqkey_keyring(0xe, 0x2) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f00000041c0)={&(0x7f0000004180)=[0x0], 0x1, 0x0, 0x0, 0xffffffffffffffff}) sendmsg$IPSET_CMD_HEADER(r1, &(0x7f00000042c0)={&(0x7f0000004200)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000004280)={&(0x7f0000004240)={0x38, 0xc, 0x6, 0x301, 0x0, 0x0, {0xa, 0x0, 0x4}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000850}, 0x20000) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = dup(r2) ioctl$TCSETSF(r3, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x515f3157, 0x0, "78e114100985a79874342a70e113343972d01f"}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) read$FUSE(r3, &(0x7f0000002080)={0x2020}, 0x2) 45.823964236s ago: executing program 3 (id=522): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) syz_io_uring_setup(0x88f, &(0x7f00000001c0)={0x0, 0xaee2, 0x20, 0x200002, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r4, &(0x7f0000000100)=[{&(0x7f00000004c0)='4', 0x1}], 0x9) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xc12, 0x0, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x4) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace(0x10, r7) ptrace(0x420e, r7) fcntl$lock(r5, 0x25, &(0x7f0000000580)={0x1, 0x4, 0x1, 0x81, r7}) r8 = socket$netlink(0x10, 0x3, 0x0) writev(r8, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB, @ANYRES16=r9, @ANYBLOB="01002bbd7000fedbdf250500a4b81b887a1fe6023d125df1631d44e60000081309000200000008000c00aa0a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x2000c181}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r8, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000020}, 0xc, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES32=r6], 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x20044044) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r6) getpid() getsockname$packet(r6, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x11, &(0x7f0000000300)={&(0x7f00000003c0)=@delchain={0x3c, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r11, {}, {0xfff2, 0xffff}, {0xffff, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008844}, 0x4010) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) 45.410346681s ago: executing program 3 (id=524): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000500)={'wlan0\x00', 0x0}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x24, &(0x7f0000000280)=0x1, 0x4) shutdown(r3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bf"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) recvmmsg(r3, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x300, 0x0, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000540)={0x1c, r1, 0x4b022211eab9708f, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040000) 45.209326988s ago: executing program 3 (id=525): r0 = socket(0x2b, 0x80801, 0x1) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4, 0x3ff, @local, 0x1b6}, 0x1c) syz_usb_connect(0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206010100000000000000000000000005000100070000000900020073797a300000000014000780050015000000000008001240000000000d000300686173683a6e657400000000050005000a000000050004"], 0x5c}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)={0x1c, 0x3, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040800}, 0x8d0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x50) r3 = open_tree(r2, &(0x7f0000000640)='\x00', 0x89901) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f00000001c0)={'netdevsim0\x00', &(0x7f0000000400)=@ethtool_eeprom={0x43}}) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0xc0e85667, &(0x7f0000000680)={0x80000000, 0x100, "e00f73f4f9d4c0a956eeb2a55992bce6590cc265f658ff0563d24f6797f150b8", 0x5, 0x80, 0x4, 0x401, 0x1, 0x8, 0x8, 0x1, [0xfffffff9, 0x4b, 0x3, 0xca28]}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000600)='./file0/../file0/../file0/../file0\x00') ioctl$VIDIOC_S_AUDIO(r2, 0x40345622, &(0x7f0000000080)={0x6, "0cb42765f2c36c8bd7fe1025d755fb9a52ae7dc1912e57dea2875d966beb4612", 0x0, 0x1}) sendmsg$can_raw(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x48057}, 0x20004004) 44.629769745s ago: executing program 3 (id=534): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) syz_io_uring_setup(0x88f, &(0x7f00000001c0)={0x0, 0xaee2, 0x20, 0x200002, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r4, &(0x7f0000000100)=[{&(0x7f00000004c0)='4', 0x1}], 0x9) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xc12, 0x0, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x4) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace(0x10, r7) ptrace(0x420e, r7) fcntl$lock(r5, 0x25, &(0x7f0000000580)={0x1, 0x4, 0x1, 0x81, r7}) r8 = socket$netlink(0x10, 0x3, 0x0) writev(r8, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB, @ANYRES16=r9, @ANYBLOB="01002bbd7000fedbdf250500a4b81b887a1fe6023d125df1631d44e60000081309000200000008000c00aa0a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x2000c181}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r8, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000020}, 0xc, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES32=r6], 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x20044044) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r6) getpid() getsockname$packet(r6, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x11, &(0x7f0000000300)={&(0x7f00000003c0)=@delchain={0x3c, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r11, {}, {0xfff2, 0xffff}, {0xffff, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008844}, 0x4010) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) 44.181851152s ago: executing program 3 (id=535): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$l2tp(r0, &(0x7f00000000c0), 0x10) sendto$l2tp(r0, &(0x7f0000000040)="e5786a0d000000000000c83b", 0xc, 0x0, &(0x7f0000000100)={0x2, 0x0, @loopback}, 0x10) recvfrom$l2tp(r0, 0x0, 0x0, 0x2163, 0x0, 0x0) 43.520306581s ago: executing program 32 (id=535): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$l2tp(r0, &(0x7f00000000c0), 0x10) sendto$l2tp(r0, &(0x7f0000000040)="e5786a0d000000000000c83b", 0xc, 0x0, &(0x7f0000000100)={0x2, 0x0, @loopback}, 0x10) recvfrom$l2tp(r0, 0x0, 0x0, 0x2163, 0x0, 0x0) 8.291593636s ago: executing program 1 (id=700): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r2, @ANYBLOB], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) syz_io_uring_setup(0x88f, &(0x7f00000001c0)={0x0, 0xaee2, 0x20, 0x200002, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r4, &(0x7f0000000100)=[{&(0x7f00000004c0)='4', 0x1}], 0x9) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xc12, 0x0, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x4) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace(0x10, r7) ptrace(0x420e, r7) fcntl$lock(r5, 0x25, &(0x7f0000000580)={0x1, 0x4, 0x1, 0x81, r7}) r8 = socket$netlink(0x10, 0x3, 0x0) writev(r8, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB, @ANYRES16=r9, @ANYBLOB="01002bbd7000fedbdf250500a4b81b887a1fe6023d125df1631d44e60000081309000200000008000c00aa0a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x2000c181}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r8, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000020}, 0xc, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES32=r6], 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x20044044) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r6) getpid() getsockname$packet(r6, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x11, &(0x7f0000000300)={&(0x7f00000003c0)=@delchain={0x3c, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r11, {}, {0xfff2, 0xffff}, {0xffff, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008844}, 0x4010) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) 8.039875253s ago: executing program 1 (id=702): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r2, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r4) getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x11, &(0x7f0000000300)={&(0x7f00000003c0)=@delchain={0x3c, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r5, {}, {0xfff2, 0xffff}, {0xffff, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008844}, 0x4010) 7.756028735s ago: executing program 1 (id=705): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a8f4dd086d0492082a6d0000000109021b0001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) writev(r1, &(0x7f0000000340)=[{&(0x7f0000001780)="a2", 0x1}, {0x0}], 0x2) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000280)={0x44, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x10, &(0x7f0000000200)={0x20, 0x6}, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) 7.282740359s ago: executing program 5 (id=710): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x13000000, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_DATA={0x4}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x10c}}, 0x0) 7.02910969s ago: executing program 5 (id=713): syz_open_dev$video4linux(&(0x7f00000001c0), 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x515f3157, 0x0, "78e114100985a79874342a70e113343972d01f"}) read$FUSE(r1, &(0x7f0000002080)={0x2020}, 0x2) 6.72050394s ago: executing program 2 (id=714): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000028c0)=ANY=[@ANYBLOB="12010000000000406c256d0000000000000109022400010000000009ff7f000003000000092100000000000000000000002a000000006b2a89a28ab1419b82bae4c5538ba2e1ab9851c76a6f219e15a78331c78a959c672b7d6f7a2858e7d3a3ede58db875d26b3bb762608c9a75d9472308f1d53cd4a3774ea6c688a94956e9aab369477b9c9ade6a2c0f5b7319ca2a9fb417d072ea5842e14d2fb6b2adb409952f771db30317289b217c580342226c69d0b46eea76fb3b20450addfb99a54271318fc5f73909422704aae7dc9bc5884cb64541032b104a0219f618613b8ce5d6cf20fdb5dc6f6b78ebca969066b4976275d85f86fda69da75a63532216b17046ceb91ef1af2364e407896b6c777c89115f"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001440)={0x24, 0x0, 0x0, &(0x7f0000002800)=ANY=[@ANYBLOB="0022050000009383c5b03b378bb77d07c2654137fe9397a56e60ebbd42204bce2c60bd88a3a79f3c02d198edac03869ea6e6f5a04649e1ff3b3f21f2b7ccd7723d2ed82cece7c46e4c41c19391b0f82158b9f61c8663c239f969186e3b0d8c893c18e743458bd0b5b6960c4b9aa914414597e7bdd1a5a2064343937d36f7bff26672b6d6da56b3d0ac7c1815652f7c60880bc112da56546492d3a6"], 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x2, @lang_id={0x0, 0x3, 0x423}}, 0x0, 0x0}, 0x0) (async) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x2, @lang_id={0x0, 0x3, 0x423}}, 0x0, 0x0}, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) (async) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002040)=@delchain={0x784, 0x65, 0x2, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0x3}}, [@filter_kind_options=@f_flower={{0xb}, {0x38, 0x2, [@TCA_FLOWER_KEY_ENC_IPV4_DST={0x8, 0x1d, @initdev={0xac, 0x1e, 0x0, 0x0}}, @TCA_FLOWER_KEY_ARP_OP_MASK={0x5, 0x3e, 0x1}, @TCA_FLOWER_CLASSID={0x8, 0x1, {0xc, 0xe}}, @TCA_FLOWER_KEY_TCP_SRC_MASK={0x6}, @TCA_FLOWER_KEY_ENC_IPV6_SRC_MASK={0x14, 0x20, [0xffff00, 0xff000000, 0xff, 0xff000000]}]}}, @TCA_CHAIN={0x8, 0xb, 0x8}, @TCA_RATE={0x6, 0x5, {0x6, 0x2}}, @filter_kind_options=@f_route={{0xa}, {0x700, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0x1c4, 0x6, [@m_nat={0xec, 0x1a, 0x0, 0x0, {{0x8}, {0x54, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x4, 0xc8, 0x10000000, 0x800, 0x7}, @empty, @remote, 0xff, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x4, 0x5, 0x7, 0x9}, @loopback, @broadcast, 0xffffffff, 0x1}}]}, {0x72, 0x6, "b8baf6c037108fa08c00001d962d465acff7ffddca401bd3c90dbab7df91b6c45a3a1928235131f67b59af4ed79a93dad0d2b0455910b2ee0990a44bc7cd7c71e8619be365536d89ac23f0d84a8bb7711d83f91a80cd66c1a8e09dd0e11bd6d7b6ce23d8eb8f68b6af60e07e4b4e"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}, @m_sample={0xd4, 0x1f, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x5, 0x7fffffff, 0x5, 0x7, 0x7}}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x100, 0x2, 0x0, 0xb, 0x3}}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x8}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x9}]}, {0x68, 0x6, "379dfca2fa7ba8cdf1166333b2cd4d027da0aee26a7abf4a696ddc9747371442483f41f602857b5becb731d0cf9d27b5ce9d4ae2d97e526a743bcb21304a7fdeeb1ede6dbe61c33f8953404fbc4cfbdd6bae831cc959eee20a804046ba4f7aaf8e11968b"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_ROUTE4_ACT={0x510, 0x6, [@m_nat={0x1a4, 0x18, 0x0, 0x0, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x3, 0x0, 0x6, 0x0, 0x8000}, @empty, @broadcast, 0xffffff00, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x8001, 0x1, 0x0, 0xa3, 0x7}, @empty, @local, 0xff000000}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x41, 0x1, 0x1, 0x8, 0x800}, @local, @loopback, 0x0, 0x1}}]}, {0x102, 0x6, "c3a03fc19efbe5c6745345afbd2ac7523323ed8df3c7d74333b0418c2358ac9a8bab79ad75d6f10ac42e3ba886ba84018d97f3b79204185eee7e69c30d147e08ad1b1fde3aadc37a3d1d538e214af6ecf6044359c3b91cf94232b3be61918f6dd2e2c8616927a25d0b6051ff20061d74f110434dab266c20df25910b523bba2ba19ae0564934929f12910a22d389b253b7a4a2d9672b53ef735a3ee186348ad517ef5601b390244f18bdf6e09997d13800e7c06b20a8efb5a8025e8df8dbb9c38491dadf124fa6e2d197dbf985c30956bbd0cbc465fee9e21f6fbcd45f18154e7474efae6f44d0e190d47a2f523b947b0aa467f74017a4b15caa74a4fbe9"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_gact={0xc0, 0x13, 0x0, 0x0, {{0x9}, {0x34, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x0, 0x9d9, 0x3}}, @TCA_GACT_PARMS={0x18, 0x2, {0x8, 0xb8, 0x4, 0x9, 0x9}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0x6c6, 0x8}}]}, {0x64, 0x6, "1bccdd626d7f3baad1dd0b24fce1af71078c3579ad6f9c728de9bee93e486bf4ce3854b5d2e6cde084d2629a48df56719bbe50dde51631bbb3dac6c012ce815aa0d9d07fb1d70a23451e7cd31d21137abfb4f0571ecb5aa64b6f89e979d3082b"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x7c, 0x1f, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x7}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x8}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x81}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x6}]}, {0x2f, 0x6, "04bf1b0a006c9fb656eda12af2ca5b7af45f22aa1ced74aedddbfd711626a097d2290391c78caa9cefa916"}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_ct={0xb0, 0x18, 0x0, 0x0, {{0x7}, {0x58, 0x2, 0x0, 0x1, [@TCA_CT_NAT_IPV6_MIN={0x14, 0xb, @private1}, @TCA_CT_NAT_IPV4_MIN={0x8, 0x9, @rand_addr=0x64010102}, @TCA_CT_NAT_IPV6_MAX={0x14, 0xc, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @TCA_CT_MARK={0x8, 0x5, 0x9}, @TCA_CT_ZONE={0x6, 0x4, 0x8}, @TCA_CT_NAT_IPV6_MAX={0x14, 0xc, @rand_addr=' \x01\x00'}]}, {0x32, 0x6, "8a112809444b3cf0c52d656026e6201036445c66f8862ab48b14b35e74fdab40c2dbed859aa2965fb6e2b20e043e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_sample={0x17c, 0x12, 0x0, 0x0, {{0xb}, {0x54, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x2}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x7}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x9}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x19, 0x81, 0x10000000, 0x0, 0x3}}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0xf3, 0x0, 0x1, 0x3, 0x80000000}}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x3}]}, {0xfe, 0x6, "bebd0645dff5f733f0f0e4e2b139a771ed87262227087790250b5595b1aef04773d2979ce07745a22c6a5901308ad7e165e4c6281532e7a4624d7442843e55b2b0a12ae8adc5bcf9e74f6f38d2759f6cec5b60ce80d3b6e94fb77068fdf7088296c8b27e268fbb7257fc3dde3e0c534ecc541cea07a9d0679a520cb14f11dc7ecdb275291617ae6c90e7ad0fc9780605c6b33708e55a9a0a864396440697a789b781761e7b92d498772dd35a65d83f0785df3ea1e24dbe4e0a93b2c3b9efdbdb2d63f8b81c22125c06188dd92ba312fa6c99cfb8bd025ab96448d00b4b22311482bd3484551275d9eb6df3a7aaf4d42f07d6ce14dc721a06b6a2"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0x8, 0x9}}]}}]}, 0x784}, 0x1, 0x0, 0x0, 0x81}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002040)=@delchain={0x784, 0x65, 0x2, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0x3}}, [@filter_kind_options=@f_flower={{0xb}, {0x38, 0x2, [@TCA_FLOWER_KEY_ENC_IPV4_DST={0x8, 0x1d, @initdev={0xac, 0x1e, 0x0, 0x0}}, @TCA_FLOWER_KEY_ARP_OP_MASK={0x5, 0x3e, 0x1}, @TCA_FLOWER_CLASSID={0x8, 0x1, {0xc, 0xe}}, @TCA_FLOWER_KEY_TCP_SRC_MASK={0x6}, @TCA_FLOWER_KEY_ENC_IPV6_SRC_MASK={0x14, 0x20, [0xffff00, 0xff000000, 0xff, 0xff000000]}]}}, @TCA_CHAIN={0x8, 0xb, 0x8}, @TCA_RATE={0x6, 0x5, {0x6, 0x2}}, @filter_kind_options=@f_route={{0xa}, {0x700, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0x1c4, 0x6, [@m_nat={0xec, 0x1a, 0x0, 0x0, {{0x8}, {0x54, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x4, 0xc8, 0x10000000, 0x800, 0x7}, @empty, @remote, 0xff, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x4, 0x5, 0x7, 0x9}, @loopback, @broadcast, 0xffffffff, 0x1}}]}, {0x72, 0x6, "b8baf6c037108fa08c00001d962d465acff7ffddca401bd3c90dbab7df91b6c45a3a1928235131f67b59af4ed79a93dad0d2b0455910b2ee0990a44bc7cd7c71e8619be365536d89ac23f0d84a8bb7711d83f91a80cd66c1a8e09dd0e11bd6d7b6ce23d8eb8f68b6af60e07e4b4e"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}, @m_sample={0xd4, 0x1f, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x5, 0x7fffffff, 0x5, 0x7, 0x7}}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x100, 0x2, 0x0, 0xb, 0x3}}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x8}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x9}]}, {0x68, 0x6, "379dfca2fa7ba8cdf1166333b2cd4d027da0aee26a7abf4a696ddc9747371442483f41f602857b5becb731d0cf9d27b5ce9d4ae2d97e526a743bcb21304a7fdeeb1ede6dbe61c33f8953404fbc4cfbdd6bae831cc959eee20a804046ba4f7aaf8e11968b"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_ROUTE4_ACT={0x510, 0x6, [@m_nat={0x1a4, 0x18, 0x0, 0x0, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x3, 0x0, 0x6, 0x0, 0x8000}, @empty, @broadcast, 0xffffff00, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x8001, 0x1, 0x0, 0xa3, 0x7}, @empty, @local, 0xff000000}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x41, 0x1, 0x1, 0x8, 0x800}, @local, @loopback, 0x0, 0x1}}]}, {0x102, 0x6, "c3a03fc19efbe5c6745345afbd2ac7523323ed8df3c7d74333b0418c2358ac9a8bab79ad75d6f10ac42e3ba886ba84018d97f3b79204185eee7e69c30d147e08ad1b1fde3aadc37a3d1d538e214af6ecf6044359c3b91cf94232b3be61918f6dd2e2c8616927a25d0b6051ff20061d74f110434dab266c20df25910b523bba2ba19ae0564934929f12910a22d389b253b7a4a2d9672b53ef735a3ee186348ad517ef5601b390244f18bdf6e09997d13800e7c06b20a8efb5a8025e8df8dbb9c38491dadf124fa6e2d197dbf985c30956bbd0cbc465fee9e21f6fbcd45f18154e7474efae6f44d0e190d47a2f523b947b0aa467f74017a4b15caa74a4fbe9"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_gact={0xc0, 0x13, 0x0, 0x0, {{0x9}, {0x34, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x0, 0x9d9, 0x3}}, @TCA_GACT_PARMS={0x18, 0x2, {0x8, 0xb8, 0x4, 0x9, 0x9}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0x6c6, 0x8}}]}, {0x64, 0x6, "1bccdd626d7f3baad1dd0b24fce1af71078c3579ad6f9c728de9bee93e486bf4ce3854b5d2e6cde084d2629a48df56719bbe50dde51631bbb3dac6c012ce815aa0d9d07fb1d70a23451e7cd31d21137abfb4f0571ecb5aa64b6f89e979d3082b"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x7c, 0x1f, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x7}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x8}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x81}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x6}]}, {0x2f, 0x6, "04bf1b0a006c9fb656eda12af2ca5b7af45f22aa1ced74aedddbfd711626a097d2290391c78caa9cefa916"}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_ct={0xb0, 0x18, 0x0, 0x0, {{0x7}, {0x58, 0x2, 0x0, 0x1, [@TCA_CT_NAT_IPV6_MIN={0x14, 0xb, @private1}, @TCA_CT_NAT_IPV4_MIN={0x8, 0x9, @rand_addr=0x64010102}, @TCA_CT_NAT_IPV6_MAX={0x14, 0xc, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @TCA_CT_MARK={0x8, 0x5, 0x9}, @TCA_CT_ZONE={0x6, 0x4, 0x8}, @TCA_CT_NAT_IPV6_MAX={0x14, 0xc, @rand_addr=' \x01\x00'}]}, {0x32, 0x6, "8a112809444b3cf0c52d656026e6201036445c66f8862ab48b14b35e74fdab40c2dbed859aa2965fb6e2b20e043e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_sample={0x17c, 0x12, 0x0, 0x0, {{0xb}, {0x54, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x2}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x7}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x9}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x19, 0x81, 0x10000000, 0x0, 0x3}}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0xf3, 0x0, 0x1, 0x3, 0x80000000}}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x3}]}, {0xfe, 0x6, "bebd0645dff5f733f0f0e4e2b139a771ed87262227087790250b5595b1aef04773d2979ce07745a22c6a5901308ad7e165e4c6281532e7a4624d7442843e55b2b0a12ae8adc5bcf9e74f6f38d2759f6cec5b60ce80d3b6e94fb77068fdf7088296c8b27e268fbb7257fc3dde3e0c534ecc541cea07a9d0679a520cb14f11dc7ecdb275291617ae6c90e7ad0fc9780605c6b33708e55a9a0a864396440697a789b781761e7b92d498772dd35a65d83f0785df3ea1e24dbe4e0a93b2c3b9efdbdb2d63f8b81c22125c06188dd92ba312fa6c99cfb8bd025ab96448d00b4b22311482bd3484551275d9eb6df3a7aaf4d42f07d6ce14dc721a06b6a2"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0x8, 0x9}}]}}]}, 0x784}, 0x1, 0x0, 0x0, 0x81}, 0x0) r2 = socket(0x1f, 0x80000, 0x0) sendto(r2, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) write$uinput_user_dev(r1, &(0x7f0000000c80)={'syz1\x00', {0x0, 0x401, 0x1}, 0x10, [0x1, 0x101, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0xfffffffc, 0x0, 0xfffffffe, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x10, 0x4, 0xd, 0x4, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x2000, 0x7, 0x0, 0x0, 0x0, 0x0, 0xfffffff8, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x3, 0x0, 0x2, 0x7, 0x0, 0x2, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x5f1, 0xfffffffc], [0xfffffff8, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x81, 0x10, 0x0, 0x0, 0x0, 0xdd65056, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x6, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0xaea, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x200, 0x0, 0x400002, 0x23, 0x0, 0xeae2, 0xfffffffc, 0x0, 0xfffffffd, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x7, 0x0, 0x0, 0x9, 0xffff], [0x4, 0x100000fc, 0x8f58, 0x465b, 0x0, 0xb67f75c, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0xfffffffe, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x80, 0x2100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x3, 0x0, 0x0, 0x0, 0xfff, 0x71f, 0xa5f, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x40, 0x0, 0x0, 0xbd, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0xa, 0x0, 0xfffffffd, 0x4000, 0xdffffffc, 0xfffffffc, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x45c) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x15) (async) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x15) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) (async) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) r3 = socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r3, &(0x7f0000000c00)={&(0x7f0000000240)=@ieee802154={0x24, @long={0x3, 0x2, {0x300}}}, 0x80, &(0x7f0000000180)=[{&(0x7f00000003c0)="6463f60e1c0d07204891d7964c7ad0af546250266770826de11a6d8cbbb6b24023111f90553d7d0a5ee7bd299f314c510f903fd84deee19dc4e059b0dfe12a5bed944f57274e610a91fcbe92d41331ebc0ee0854ae1406fa7818c0566e937772e6d371ea1eb32940cab8d6dd053231f9a1e9b2ff33980a8ffda95968a42009ad9b960391e843674b62dd6ba77db19b0baa3ef53111f8eb61a63ecdccd31ac5cb0b7a37b68bed4a7d2ccf253d207badd40f8c32d8ef5e37354943e7007b7089085e11d6b6486ee9ad654d6e63a0ec996679dae0bf44845186b9280fc8193b", 0xde}, {&(0x7f00000002c0)="b2341f2f0310b2b75d45f70a562fc87a86189b05f96da2543dd7c2c00176db57187ccc0f673cbb8efc93e42db1a281ee654c74472596924c940f8cc604926657dcab3cfccb668b55", 0x48}, {&(0x7f00000004c0)="5a0c20e16a62a25b9cef4f7e2844418f8b142ff6a3c1e46242be3a36effa852c42089bba643eef54e18ea5694abc7f900379b74d11ba60978b4c897c1628656a6ab52277aeca9c7378e1623643c6f70ac388d74da525e977a59bbf4f3cbd5590c697d0ed5140", 0x66}, {&(0x7f0000000540)="d98e7da1d45cce764ae5c7af2aa2e9ef64cbca99fe51034cbd1bbf6c3d2d27af4d5c9e49b669453fe6868b33343244cd84842e350e4e00f74c403ac7ccc6959e9c46a457a9b9da4739d93e6c2298e89355d045f8c3e358f0deefc6815af6bd5478cec5933636550bb3c681543b71cf176e1b032ee4be1aed6cee5de7a5e89e97a7b5447d61d01e77c24a397e3dd945ed1f24df2aa03100bb8a15e0be33a6301489801a3a6eaee2426257d657ab714b15c98a189d2dd9537ac083d3ea66681f1c7fd5373fe2", 0xc5}, {&(0x7f0000000640)="bbe7ff1d5a4c0b62e8afeefb2152cc0ad3290cb061e1c7080eb96a9684b420201df64589cd5af2b1f5ecc01d00ef973c10d9e7dee5fd376687388430956d3572f0", 0x41}, {&(0x7f00000006c0)="a197965327e41f795f6630e2a735a6b6b87f50fdf55f43e35954bf96c3300193dd284cdbd88d275620946f7770df2774e63466dcd71481d88e76f22001fadbd1ca5eaed806e8a881c251368ce345837c6154a9e07eb77683c58fb672b6a9fa40b81081aa9ff6fb94b97356d1b887d60d8713602e4ea3644715e43a8a77754d6ebd5b", 0x82}, {&(0x7f0000000780)="541b91ebc5700a1029c4145efc1dca3fa5de0839694a3bf73d5d92f253d633253c37787f66b839722ad15d70467744826cde5574f09a54f19cdbeb67327786593a6433d2c76b88e33dd66569cf9330f87afb830bad19d09c3a80e85b9dde936e990fefc2eb0f2c41fe60a82b29f7e1007415055f907aac6b077da9c3483ff5a0", 0x80}], 0x7, &(0x7f0000000800)=ANY=[@ANYBLOB="540000003a000000b45622696117500a9c8771766b48cbbe75b93bdecc2f51a02e3d0ed1ed4e2a58f74fbe854d5e5ed9019c27503f2d1f3c89f0ef4b1c40d023876783897cde91c78171abf5ae1e4a430eab0000240000008800000008000000386ee0c0cf063d40b1fefeb33ce0e50000002800000000000000008000003453face5225acc54bc60ca9e34f95e7ac478f739a849da1eb000000b400000008010000080000004f02ead06daed4716bfff37f0cce405ee560869ac3138fde07434e8381d405ca1f3c9db8c503f03e2dd31dbb133fafbdb355d7a59cb40b69a4e57cf8b48f8cb1671488d37e9da52d728318560c1a773ec06c191142dfb20b3b303ef1e311e264bfcbd8fd0abc8d026c250dc7b1477c5761d3e88c4f2fc5fa3dd3a6a6a842df581856f208fa1f68e4dc6cffc5ac262102961bfe2cd1dce56768d1369d6b4a95c461392057e5ad63910c010000120100000d000000e8e30e736fb61861ad2d6f48396eef2caac9955f9fa49009f360bbbb985c2d9460456d76241c7fb9a23fa5a8b8f9345668e98835de81a7830777e22b00b6faa76f168152f0ef67ccf63c56270e2a11086331a2050fd226fe76c80a5a4745fe7e89e105a629f2d60007202f6eac89c5cdafa84e1a557d90bc41dc06114a74572fa48b73fb4f5698321a0f5d7afc5834e0de05ff4760e1420feb0765bfd6a34b0052e455de9f9c5575c65391bbc02c4a6e86337a07fcd70b2a59168969bdfa2f0cd0d12716e6a9fb733081daad50dccf6b97fc48959677548f01452173c6b265e1cbe62e9426dbcda8f0d51ea17e1e6f048b625791d26f4ee060b38a8b65000000e00000000901000008000000a9e2e22dfa1ddd9963f6d84cb80d65fd7979fe380ccfaae45a756e880a19db835c394401eef9a72e1ae28b9e64c5e3a2cc170018a645e049748487261226cdccc4c4d89b6a92833f778500de02c49be416eb407f65d3587b87dd2c0d169385e75e6d5688d9608485af7c889542fe6eaee13fd30114212a623863c584d5e507baaaf194d6d46470201c7a6a971ddf9fec80de619fd01581f6d6cb715f28721ea0fa979bafb4c2c173b9af2755c1de921c624306b1761c46c70e821611814b4b5a8cfe5ee0a8a55bb2f50fc11055e903650eb2e0002000000007010000800000006f081e8ef788874f85e37f7113a1183e31d9c200a000000016010000ffffffffc1116132f1421749563d1c6c5b9aa9cbc6ac9e85f05f3a8fce0569e992bcd28a8cb30ba5bb59565162c1b3de7add52647718a030835a469805f8d3fff7c8f20636fc800d17adc579e066372f22e718538fd33eb9789afce7d51980275a94744db9dcfc92435a89b8d3c2852550728badbb238fdbbf291221368e18e6f5eafeb95f7e275020e57cba0d5680ca22ecfa62568c0000000000000000"], 0x400}, 0x80) (async) sendmsg$kcm(r3, &(0x7f0000000c00)={&(0x7f0000000240)=@ieee802154={0x24, @long={0x3, 0x2, {0x300}}}, 0x80, &(0x7f0000000180)=[{&(0x7f00000003c0)="6463f60e1c0d07204891d7964c7ad0af546250266770826de11a6d8cbbb6b24023111f90553d7d0a5ee7bd299f314c510f903fd84deee19dc4e059b0dfe12a5bed944f57274e610a91fcbe92d41331ebc0ee0854ae1406fa7818c0566e937772e6d371ea1eb32940cab8d6dd053231f9a1e9b2ff33980a8ffda95968a42009ad9b960391e843674b62dd6ba77db19b0baa3ef53111f8eb61a63ecdccd31ac5cb0b7a37b68bed4a7d2ccf253d207badd40f8c32d8ef5e37354943e7007b7089085e11d6b6486ee9ad654d6e63a0ec996679dae0bf44845186b9280fc8193b", 0xde}, {&(0x7f00000002c0)="b2341f2f0310b2b75d45f70a562fc87a86189b05f96da2543dd7c2c00176db57187ccc0f673cbb8efc93e42db1a281ee654c74472596924c940f8cc604926657dcab3cfccb668b55", 0x48}, {&(0x7f00000004c0)="5a0c20e16a62a25b9cef4f7e2844418f8b142ff6a3c1e46242be3a36effa852c42089bba643eef54e18ea5694abc7f900379b74d11ba60978b4c897c1628656a6ab52277aeca9c7378e1623643c6f70ac388d74da525e977a59bbf4f3cbd5590c697d0ed5140", 0x66}, {&(0x7f0000000540)="d98e7da1d45cce764ae5c7af2aa2e9ef64cbca99fe51034cbd1bbf6c3d2d27af4d5c9e49b669453fe6868b33343244cd84842e350e4e00f74c403ac7ccc6959e9c46a457a9b9da4739d93e6c2298e89355d045f8c3e358f0deefc6815af6bd5478cec5933636550bb3c681543b71cf176e1b032ee4be1aed6cee5de7a5e89e97a7b5447d61d01e77c24a397e3dd945ed1f24df2aa03100bb8a15e0be33a6301489801a3a6eaee2426257d657ab714b15c98a189d2dd9537ac083d3ea66681f1c7fd5373fe2", 0xc5}, {&(0x7f0000000640)="bbe7ff1d5a4c0b62e8afeefb2152cc0ad3290cb061e1c7080eb96a9684b420201df64589cd5af2b1f5ecc01d00ef973c10d9e7dee5fd376687388430956d3572f0", 0x41}, {&(0x7f00000006c0)="a197965327e41f795f6630e2a735a6b6b87f50fdf55f43e35954bf96c3300193dd284cdbd88d275620946f7770df2774e63466dcd71481d88e76f22001fadbd1ca5eaed806e8a881c251368ce345837c6154a9e07eb77683c58fb672b6a9fa40b81081aa9ff6fb94b97356d1b887d60d8713602e4ea3644715e43a8a77754d6ebd5b", 0x82}, {&(0x7f0000000780)="541b91ebc5700a1029c4145efc1dca3fa5de0839694a3bf73d5d92f253d633253c37787f66b839722ad15d70467744826cde5574f09a54f19cdbeb67327786593a6433d2c76b88e33dd66569cf9330f87afb830bad19d09c3a80e85b9dde936e990fefc2eb0f2c41fe60a82b29f7e1007415055f907aac6b077da9c3483ff5a0", 0x80}], 0x7, &(0x7f0000000800)=ANY=[@ANYBLOB="540000003a000000b45622696117500a9c8771766b48cbbe75b93bdecc2f51a02e3d0ed1ed4e2a58f74fbe854d5e5ed9019c27503f2d1f3c89f0ef4b1c40d023876783897cde91c78171abf5ae1e4a430eab0000240000008800000008000000386ee0c0cf063d40b1fefeb33ce0e50000002800000000000000008000003453face5225acc54bc60ca9e34f95e7ac478f739a849da1eb000000b400000008010000080000004f02ead06daed4716bfff37f0cce405ee560869ac3138fde07434e8381d405ca1f3c9db8c503f03e2dd31dbb133fafbdb355d7a59cb40b69a4e57cf8b48f8cb1671488d37e9da52d728318560c1a773ec06c191142dfb20b3b303ef1e311e264bfcbd8fd0abc8d026c250dc7b1477c5761d3e88c4f2fc5fa3dd3a6a6a842df581856f208fa1f68e4dc6cffc5ac262102961bfe2cd1dce56768d1369d6b4a95c461392057e5ad63910c010000120100000d000000e8e30e736fb61861ad2d6f48396eef2caac9955f9fa49009f360bbbb985c2d9460456d76241c7fb9a23fa5a8b8f9345668e98835de81a7830777e22b00b6faa76f168152f0ef67ccf63c56270e2a11086331a2050fd226fe76c80a5a4745fe7e89e105a629f2d60007202f6eac89c5cdafa84e1a557d90bc41dc06114a74572fa48b73fb4f5698321a0f5d7afc5834e0de05ff4760e1420feb0765bfd6a34b0052e455de9f9c5575c65391bbc02c4a6e86337a07fcd70b2a59168969bdfa2f0cd0d12716e6a9fb733081daad50dccf6b97fc48959677548f01452173c6b265e1cbe62e9426dbcda8f0d51ea17e1e6f048b625791d26f4ee060b38a8b65000000e00000000901000008000000a9e2e22dfa1ddd9963f6d84cb80d65fd7979fe380ccfaae45a756e880a19db835c394401eef9a72e1ae28b9e64c5e3a2cc170018a645e049748487261226cdccc4c4d89b6a92833f778500de02c49be416eb407f65d3587b87dd2c0d169385e75e6d5688d9608485af7c889542fe6eaee13fd30114212a623863c584d5e507baaaf194d6d46470201c7a6a971ddf9fec80de619fd01581f6d6cb715f28721ea0fa979bafb4c2c173b9af2755c1de921c624306b1761c46c70e821611814b4b5a8cfe5ee0a8a55bb2f50fc11055e903650eb2e0002000000007010000800000006f081e8ef788874f85e37f7113a1183e31d9c200a000000016010000ffffffffc1116132f1421749563d1c6c5b9aa9cbc6ac9e85f05f3a8fce0569e992bcd28a8cb30ba5bb59565162c1b3de7add52647718a030835a469805f8d3fff7c8f20636fc800d17adc579e066372f22e718538fd33eb9789afce7d51980275a94744db9dcfc92435a89b8d3c2852550728badbb238fdbbf291221368e18e6f5eafeb95f7e275020e57cba0d5680ca22ecfa62568c0000000000000000"], 0x400}, 0x80) ioctl$UI_DEV_CREATE(r1, 0x5501) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e20, 0xfffffffd, @loopback}, 0x1c) (async) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e20, 0xfffffffd, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xfffffffc}, 0x1c) add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) (async) add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) (async) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x6f) 6.157464865s ago: executing program 4 (id=718): syz_usb_control_io$cdc_ecm(0xffffffffffffffff, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value={r2, 0xcf}, 0x8) 6.051801574s ago: executing program 5 (id=719): r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000000)=ANY=[@ANYRES8=0x0], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000900)={0x2c, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0}) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0xc, &(0x7f0000000040)={0x40, 0xdb156925a2d6164f, 0x85, {0x85, 0x22, "0057311f730a0b0ee6bdb38e51fdb4ffb5be9e574a14303593d0e3ad5416d1d3cccf69f942e3d6a818deeff3c1ccd393bac73c02ae460da51c73357644dea3cb915486e3b86165bd183331e20edf9049e5654517034b6f36b126ee31b9fd354c5183b8e7b77f8f344b01cb7717a30d23471590fc01d2b60460eab2ca84ec8650a2484f"}}, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000300)={0x10, &(0x7f0000000180)={0x40, 0x16, 0xde, "458ed0f0325a41fb58f07285021b64a51e6d01efd75c2e0e593f9fb94da2565b55e652f761e28febdf441fcd42109e7865e65d07bf384f43408fdc4dc3f7faf5df7445d809f3c38fdadeecbbcb5f8229a13d79f4558e7f9e9e23b3f0d2bb86fa449e505f928a535ead3423b3283a85d329100d00510e098d16725465984668d70cd800d5a28086d1432c1a607e6d09f9d2e86ac65a7d520126d619d2badfc268c199238bcc668c8b41047b52f63a46843507de20af63f8143ffcaeb776e1449479d5f459cf1a926eb0facf15b8eb136c26b4f7d89eae978e4b91c0e228a7"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x6}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x2}}) 5.523691437s ago: executing program 4 (id=720): socket$kcm(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) lstat(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'veth0_to_batadv\x00', 0x0}) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="2000000011000700"/20, @ANYRES32=r4], 0x20}}, 0x0) 5.105080099s ago: executing program 1 (id=721): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r2, @ANYBLOB="00000002000000002800"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) syz_io_uring_setup(0x88f, &(0x7f00000001c0)={0x0, 0xaee2, 0x20, 0x200002, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r4, &(0x7f0000000100)=[{&(0x7f00000004c0)='4', 0x1}], 0x9) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xc12, 0x0, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x4) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace(0x10, r7) ptrace(0x420e, r7) fcntl$lock(r5, 0x25, &(0x7f0000000580)={0x1, 0x4, 0x1, 0x81, r7}) r8 = socket$netlink(0x10, 0x3, 0x0) writev(r8, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB, @ANYRES16=r9, @ANYBLOB="01002bbd7000fedbdf250500a4b81b887a1fe6023d125df1631d44e60000081309000200000008000c00aa0a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x2000c181}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r8, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000020}, 0xc, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES32=r6], 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x20044044) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r6) getpid() getsockname$packet(r6, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x11, &(0x7f0000000300)={&(0x7f00000003c0)=@delchain={0x3c, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r11, {}, {0xfff2, 0xffff}, {0xffff, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008844}, 0x4010) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) 5.103321602s ago: executing program 2 (id=722): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) (async) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000180)={0x17, @time={0x65757100, 0x1000000}}) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000c41f4040110f00107f000000000109021d0009000000000904"], 0x0) 4.667585382s ago: executing program 1 (id=723): socket$nl_audit(0x10, 0x3, 0x9) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000100)={&(0x7f0000000000)=""/5, 0x204000, 0x1000}, 0x20) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, 0x0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(0x0, 0x0, 0x0, &(0x7f0000000100)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r2, 0x80049370, &(0x7f0000000180)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) syz_open_dev$amidi(&(0x7f0000000080), 0x2, 0x301002) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000500)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa802, 0x0) close(r4) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x5, "ff00"}) r6 = syz_open_pts(r5, 0x0) ioctl$TCSETA(r6, 0x5406, &(0x7f0000000200)={0xfffe, 0x80, 0xe000, 0xb3, 0x17, "041000"}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0xb, 0xd}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) recvmmsg(r9, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000002080)=""/4096, 0x1000}], 0x2, 0x0, 0x0, 0xa00100}}], 0x1b00, 0x0, 0x0) 4.523586322s ago: executing program 0 (id=724): r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$kcm(r0, &(0x7f0000000100)={&(0x7f0000000000)=@nl=@unspec={0x0, 0x0, 0xa00}, 0x80, 0x0}, 0x0) 4.260393746s ago: executing program 0 (id=725): socket$tipc(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x2, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x1) socket(0x400000000010, 0x3, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x80400, 0x0) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000280)={0x44, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) pselect6(0x40, &(0x7f0000000600)={0x11, 0xfffffffffffffffc, 0x2, 0xb000200, 0xfffffffffffffffe, 0x0, 0x4, 0x8}, 0x0, &(0x7f0000000680)={0x7fc, 0x2, 0x800000, 0x0, 0x0, 0xc3ad}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 3.729303579s ago: executing program 4 (id=726): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r2, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r4) getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x11, &(0x7f0000000300)={&(0x7f00000003c0)=@delchain={0x3c, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r5, {}, {0xfff2, 0xffff}, {0xffff, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008844}, 0x4010) 3.653728584s ago: executing program 4 (id=727): r0 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000002640)=""/4115, 0x1013}, {&(0x7f0000001240)=""/107, 0x6b}, {&(0x7f00000007c0)=""/165, 0xa5}], 0x3}, 0x60012002) 3.41648053s ago: executing program 2 (id=728): syz_usbip_server_init(0x3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f0000000000)={0x3, &(0x7f0000000480)=[{0x200000000006, 0x0, 0x2, 0x7ffc9ffb}, {0xfff, 0x7, 0x38}, {0x0, 0x6, 0x0, 0x5}]}) setrlimit(0xf, &(0x7f0000000000)={0xcf}) rseq(&(0x7f00000006c0)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) setrlimit(0x2, &(0x7f00000000c0)) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x400c, 0x2) r0 = syz_clone(0x80000400, 0x0, 0x0, 0x0, 0x0, 0x0) get_robust_list(r0, &(0x7f0000000100)=0x0, &(0x7f0000000340)) prctl$PR_SET_TIMERSLACK(0x1d, 0xffffffffffffffe1) futex(&(0x7f000000cffc)=0x100000000000004, 0xc, 0x4, &(0x7f0000edfff0)={0x0, 0x989680}, 0x0, 0x0) futex(&(0x7f000000cffc), 0x1, 0x0, 0x0, 0x0, 0x0) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000400)={0xffffffff, 0x0, 0x3, 0x0, 0x0, 0x13}) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f00000005c0), 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r1) openat$vmci(0xffffff9c, &(0x7f0000000380), 0x2, 0x0) r2 = syz_open_dev$dri(&(0x7f00000003c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_SETPLANE(r2, 0xc03064b7, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x3ff, 0xf5f926f, 0xfffff000, 0x0, 0x7, 0x8001, 0x8, 0x3, 0x7}) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x1, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x4e20, 0x0, @mcast1, 0x9}}}, 0x108) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) close(r3) r4 = socket(0x80000000000000a, 0x5, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) r5 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) tee(r5, 0xffffffffffffffff, 0x3, 0x0) 2.865601004s ago: executing program 5 (id=729): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x515f3157, 0x0, "78e114100985a79874342a70e113343972d01f"}) read$FUSE(r1, &(0x7f0000002080)={0x2020}, 0x2) 2.277339063s ago: executing program 0 (id=730): syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value={r2, 0xcf}, 0x8) 1.948899204s ago: executing program 5 (id=731): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x4001, 0x3, 0x280, 0x0, 0x0, 0x148, 0x2100, 0x148, 0x1ec, 0x240, 0x240, 0x1ec, 0x240, 0x7fffffe, 0x0, {[{{@ip={@rand_addr, @local, 0xff000000, 0x0, 'ip6gretap0\x00', 'bond_slave_1\x00', {}, {}, 0x21}, 0x0, 0xd8, 0xf8, 0x0, {}, [@common=@socket0={{0x20}}, @common=@unspec=@ipvs={{0x48}, {@ipv4=@loopback, [0xff000000, 0x0, 0xff, 0xff], 0x4e24, 0x2c, 0x4, 0x4e20, 0x8, 0x2}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x94, 0xf4, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x8}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{}, {0x1, [], 0x3}}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x2dc) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={r1}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x2, 0x0, 0xb49, 0x7, 0x1008, 0x200, 0x3}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x3, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xf174}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001300)=@newtfilter={0xffffffffffffff7c, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r7, {0xc, 0x3}, {}, {0xfff3, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0xc0d0}, 0x800) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x18}}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000001f80)={0x0, 0x0, 0x0}, 0x200808d0) io_submit(0x0, 0x0, 0x0) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f0000000600)={0xd, [0xdf30, 0xff01, 0x200, 0x800, 0x4b6, 0x7ff, 0x4, 0x2, 0x8, 0x1, 0x16, 0xffff, 0xea2, 0xd882, 0x8, 0x10, 0x101, 0x8, 0x8, 0xf, 0x4, 0x800, 0x3, 0x2, 0x7ff, 0x4, 0x401, 0x9f07, 0x1, 0x2, 0x689, 0xfff, 0x6, 0x6, 0x1ff, 0x5, 0x3, 0x5, 0x5, 0x5, 0x9, 0x40, 0x1, 0x7, 0x6, 0x2, 0x101, 0x5], 0x5}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r8, &(0x7f0000000040)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0700000000000000000005000000180001801400020073797a5f74756e000000000000000000180003800800040000000000080002002000000004000100080005"], 0x4c}}, 0x0) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$MRT_DONE(r3, 0x0, 0xc9, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000040), 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f0000000140), &(0x7f0000000240)=0x4) 1.609488346s ago: executing program 0 (id=732): r0 = syz_open_dev$midi(&(0x7f00000001c0), 0x2, 0x2) writev(r0, &(0x7f0000000740)=[{&(0x7f0000000200)="65337156371d4092cb62cb1c5bbcccde20f2bcbbcc5f14e0cc70298b0703d0cbe7345b5841456fc5164f976acda5d0460c6ae9ea44daaff34c", 0x39}, {&(0x7f0000000240)="4cc4861654ff925fe6a3a6e6b326e7803519e44fb14b1f9687399b83931ca7da2f42ec2aa66b0cab8e26f6b3a210005459c4be666a5a32b163f7ff867b5c71c903487435e78b78810d580696c2d825a99c55c6d89625f09d00a70fa70ed08edded49171b7abb53e6acc5630643924fd2956e4ea9b245988e14b49c39d6948b04687c2c149c8402", 0x87}, {&(0x7f00000015c0)="294e43aa2297e885caafefde087243f71bf5aaff6f18c2626751974677eafae9af461f43b8e5c44c82e3305bac14352a18ef69684e0bc8a4eac75f392dce69ee066efcae13ad37e8ddd3de45fdf9aef790aa3ac3776624b19a1ef6f3a9928fc1968fdb49f2299e496b6dec7ad0c3b9a467f7887cc1a07bc64b6b6ecf40d87be3bcfd59ce0b9b85811d1926b497971514e60cc3bdef1ba005242bc725a10ae8997f39e483590ac93945a6ec855db12b831f0b9bc662c4bbb1e005528d429b1b3ced5b1559e92ea6079cbc2a5d0c245a2d730e264da031f75c4a06a8a14cfbd3f24509f3f668fec85217806d689243a9965cc6225a5f2375679e4ef304e24d6e7607c12df9d0316a47302dfcac2b506fcd845a7f57344499700763f88c984a5054233a2f1205bb74932bbc01acdc999a3f84aa496852af9b75f8b88396baead890765ea2d72a98a7e495f34658fbe9988ca07fee60e01057f19cef8ee23df341800ed10e37716351ba438428235868919f6a69d46a0e98f2f3fefd42fb13655a9d1445f2b00db6e24b535bdeebf795dc55449237bf027cf2bc9e5dacf21663b470d1b2ebe4afabd76c65390c9396cb96f09d5005cbb7b5620b7fb46b03d5f51bf929ef52a8314baeff8c8ff89ff653296700747269587c8d8caa43a2dd84f4a58f46585ed898c0c87f95e58a3bbdf4d503353134996174a956780d340f799397025a1b2c8db492d5d85e9dd46f61531672be7bf6158448b277a036c3be8550fa0c234a33167c25e19917170b065c27273e9e3b56a9cd58a220598ec2443e2b6c2fadd353fbadea3daf2a95f2592b45ef410ca3733f5b2d2c73aff842f92b7989c1dbe32a11f8c99622a08bcd975581eb5d76b8d07e5033c5b90cdbcba00d535141e58aac8d4fd2e474d62e59ee0f4990728c7eae40bcd55acd13b3940bba6183e2c441404a6c3a65cf8f7da3aaebc55a451a0c76624ad35c718b5b2cb626268c2c7f7899f7f556ffcd786b2e3bc68e9983f0b26b1348ac12f96bfa5f39787237e5655a427d05ddfdaaa6d1f83a7599088b9b0a164df338c6edaa5c0a2b46a58e553c19b48ea42baeeefc659391c1a516b60ef6e28e517044b6ddb12a170a7c8f03cdd4d4df432a504f33ca93d0e3df7e6e1a4998d44874822ca0c0b8580230196c479132bea795aab9a1c6f75588e7c2c9f5d02db31f2252dbfe1d99d4a69abcf6023a9c4370c5745ca1aba56e4a9b470d1c5a3a5f5591399e86991866e1a6d50f97a5cbd53ac4c7f0750d87a73aa793d5eb2ef2ff3ceb48dd2d59c513d9e8d907d12f55d8d964baefc15a0b8ff552ee2362b3a2215bc42b01be1e60e19d2d4669162943e7c69c8ea0f6b37f851eb8c5f79554e3a790e749fdcbbb6741a1212badc9e36279c92bf865554ae657ce54c77b779c1945faf79a9c0852c30f9d2a0ad93d86eec5f8caa52b27b7f0a1f6dd962ba542e56b4407362da368686887dc9e3fa6609e13da0070d045d650216a34e490773f3e2d5cd0b7fa93d6a818c4886fc5c67822309410f317112bfc764cd7344f9e7c2b943251ec23c7d5d671e81fea1ce5215de145f5fbb079d38cfb28bd0c7a71f94f208b233d159364692abf45a76a584f71b784372b51b691a0758d09e4734bed4e992edce5207f3852c5d3a7d741a83f2aa0e97a9a727220b3f059c82ae6aa446eb00506d869e8045337097e14c9078cc49aeaf1e7cc8d8bb5b562888abc22e6a7941b8b559a7bc2548dd86ffaab8142e1337a745b202c24a9778b3294b82b77231f4f23f90b18e956a1b852368bbdb8e7867f5fc72a1aabfdafd4f86f24e5b4e93999553c3087536d17c7830915a33f39dac243d4af98d1a42ff620608ef11273e7bfecfadbcba510c893a11a49ebbabd440a597b5dcc8b101db2cd130bcfdcc515695afe9e741c56421bda2d7068520acfbfe040e9885a679716fed6f812c7b0af5189abd962a4ea9778b7c1da4f46d9934bdb7271e027354d0a3eb3c2b4f123b92c0663cc116ee9a2a6a6752c047dabf62fd89686e7778ddaad9570cc11d6f24ac33b55998f0cf55a8a15bf2d204687de767a6379148d739ed2518c302442eb1a2c24906d65a6f2975c37972161edbce158e27ccba7036a8e356c45e6da73411d1ec251897af137835f643965e78050fd840913ba6524794bf3a676993e5fda434baa6185487a8d9adc1a61854d299bb0d528f533e406d98bd08c7a9f6a86e6cac10b419f6a0013465022cd2971548b3d13b8524f26b1fcdf1c5b1d92e604ffb73ba4f683b0909aad48bca75191bea2bedf0e86255565bd4d1fb106d2b24dbe4ed6f50ee352f1c2ee74b43e7c59b1da8bafc15af1b0b2c555cb5c4839198d73356403d60647883ff9d579037a3bd621b8ca1f1e75f70de4367adaf614a82f11de471bfc5d5cbde876f998b255ee6fb73840beeccf6c1c081d17978f312670671301b490f6de7eb832e37abbe57f95fa7051577546ff061b7fa040aae20fb086eabe3e03fc03fac93d360caded2504142b97b935c4a92ee2904c8a4ae3a9553155045c72fbbfb95c83ca076f7d2603f9c5343276ee11fe30ef2367d7836cf5bdb63b2ac271f53894b2fbca37fbe24bb9613e1c2c6dc413779e78e4daf9a09573db600cc36b397c52b43153e6da4ace8b7f1603ce102fad3f6fa5b7e08d057bf73c131c3e0d79c37d85d129c7a911ec278091aba4a7b4f620b80fd4432f8ecd989a78aa9d2596c07b59f6e5a633f3d6d17e8fe060a29157a6f1c7e984d25701eb8b13c8bd93924e500010a74b5e66b2ffd0bf880584b8c454fe75d090c51d9e1f09c1ec984e7357b480d5d971df770004b3ef7425701d13cbc270973d70d6a34e2676b52486b5e8a9c126166caf60bba7b5c355c5eb7391d477d3a6d8bfc4184fd767ed52c5d19e886da50bb76b2a3034a8d067d5878932572fd4573793c0121d25e9c49fdc9503968c26bb89397129d61699b7f56a755fc7c91e40b0116f2469d82490a5a75ffb97d702b14ac17af093f8e574c72990b3c7465ba8ed253a2511d6297788178abc481c8a073d2eb7a12bcd64094f2314524f4d124bc93130f8b6e98cd24b0ea7c73d71dbdcfdb4831a0aab52cbfac3d792a098b414788c38f38d0d22866311322c05eead6e3a1691fabfcb9999ee13f84f9c70b2177afeac2401d5c6cd6b57757ab3c8b3b34ce976f82acfcb1bdd480139ac7fdc1d128b6ceb3668b6c57a6cf95d0da03c74117846f85b1945942a1b949a1f249c1c2a14de7199efd1c0b222a85b07ce0f86fcc62f7c508f9654bdbee1d9bba004353cdedc9144365c615db30542643ba9903cb729ba826f7d5e0a9ee2b08236ccd19d98eaf71395559cb3f8643e9dfdd6cc2ed6168450019159544fd5418be3614d94f317ac469754586f86e2ec37924ecb25132934ea4508a0669916baac6b84618aa923755767f7277a445ba8044a184a47ab7dea59f505b8400f221f65b556b5d69e4af7f56bb81636343f2a47d2ec9aefc25ac372a410f19693bf729baba58efb3f928836d2e7d8a767d676d56d997ac18bead4a493816b75204e9633c29df6e2dab70e92a379694173097c92a365825106613e69c54917680cc49f4ed489c046697932836ee20327bc6ae49a30cce77b90c7de425977d7446ae6fd5a7c9fa04b1a654e85117b2ea33016955a90797514b4dfe04533ab81d17ac6d005d5d2e600135a78e0f824a1e4c0878c72a94c3980fe5391add7ea1a88278a39b571a4ae8bf2ee665bb7efe31e26ed5dae31ee19b8bf244b5417fe29dff9b83a1b0ce9865fe525465ad30aa87cfb9dac47d3260d9afbd2fa8bf11fed91f0a42272238bc85cb7cfe7c27e85ab5f9f0abaf66866a076518fddefdadf7f3fc7e70771a27ad9c029e76b999c1b99092150078f25b2e2bdb2e0be559bdb36fbbbba26c3e7b863acf184a1bd3066cc7a1ce78b080e9f9aaa66f5c1bae56e732c1806a91446b7dd0f89faef4b8c4bac299b38ca8dfc42c4d7d76338fe1d07d016200c06554d4746e527b5c9b30927e32fbae59ac60d2feb8ac112901d512d5977a46ac21536ae8c01819f1549fbf825eecad8d3714149e45f470cb591268d4fbd795aa7b00ec5764e5f70ed807f979d3c30829108c5f7a075bb6e3ef6f20caca2ffffa9feb3662bf895506882b0785bdce43b1d75c59d263d88a0a7b6d73115465fac20e314a4c4a584f3e690e08ed2e6f62e421f48efb99f723b20e854d7dafb34e1969d58b5fb938efdd57444324f0522b31e9abf6ea0ece95dd1b1a23c823220dcfc7213873d8ce12738254dc2567b5763be70dc31000e29dcde96c3e9a6db9d3c4d415ec37638f55eea2c72fba5a86c434d7b01e1a6a0694d6d935b7ee240e80dd476338b3e0469609a0be5f6ae38ed97e273eec708d2d0fb595c34749c037d51185c630312c641d0a43397ba6fcd8121fc657bb9ff9362bf09da92136132b36a26a7fb02904dd87990247329b50c275df5d77cf64007153db246f856dc08232edc0ea76542bbda09f4507221afddb895593978297be0d776969b2d324ad6a3b540f347ac9e3a980080a0db7916d5ceeb1ec92f4d25c2f916a1be7afb16fa7030e4b3c3f67bab8dd997d8d737f500e89290c78c716ebab8da52ed736d1248be5ccf2b8346cd861130b7a5bc4ab97ed0cd23cf992022395fdcb32a443a54462079d5e1fca48db7de109f5c1c6f4846e65732b5a8ff3ac7c7d24dc50cf13b6c8f74b4f0f5daa2d088d5e709aff4870391f09cfa281648f1e527b635e71cf26af2135bc92c5173fa5672b98ac201eeb9eb095927fcfeae79bb028a8aa10be787d32a36431d59c9898d520a95263f3cfc6a7df823eabfd968b11078ae2c4440d6192eb3421ec2db68bcdef1bb6edb8597edbdf5e93e93ef04cd6b27457ecb9954477aab90e8052afc80ecbf9294522115ae7727823c2c0be5464e92a72d2a368f2f759b2d8fa69b8432e79720561837477c0139a9aa646c361acccf89e484d9f5ff9191442eb769030b205c0366cf4af684dbd295c8aa835526b9e78fd6d191182af0b037745dc6a62d466c94b817204b7562991ed1b54300f3fef9f333f66a7d287df48a6ba393c8c49d4792f75bf75e20ae0e745e96c78c2d5a8689463127a8e08e62b08166a32a191d4d03f83e9849ceb18437fb2c609dd735087c7369dd8bf5394bb8ea7237a3d7a52ffd8646b353cb21a63724c4fa32d6fbe66614088024093ff42baf29c443c84b1c5ea4db7c2e6dfba1a1092795ab64163b26300adf03e8061a58ed505930d4729ebf00ed981a7544e0274ae7988dbb89c752a5f685d47fd51f2384cd79e35fd67205d0e3375eed244c1823d0adb1c2e52e8f7633205a755910e10eed1f47400f1c41ab9462928b59cb0a6da9984179a1bc8935b0a5eeacc5ce1a4266e41b56a759c208eda75f0449badf859920c0bdce04e78fce11917b5a155c144c61d1da8ad6d12b29f65210b94480fcd95e4ba217", 0xf41}], 0x3) (fail_nth: 1) 1.235306604s ago: executing program 0 (id=733): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r2, @ANYBLOB="00000002000000002800"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) syz_io_uring_setup(0x88f, &(0x7f00000001c0)={0x0, 0xaee2, 0x20, 0x200002, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r4, &(0x7f0000000100)=[{&(0x7f00000004c0)='4', 0x1}], 0x9) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xc12, 0x0, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x4) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace(0x10, r7) ptrace(0x420e, r7) fcntl$lock(r5, 0x25, &(0x7f0000000580)={0x1, 0x4, 0x1, 0x81, r7}) r8 = socket$netlink(0x10, 0x3, 0x0) writev(r8, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB, @ANYRES16=r9, @ANYBLOB="01002bbd7000fedbdf250500a4b81b887a1fe6023d125df1631d44e60000081309000200000008000c00aa0a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x2000c181}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r8, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000020}, 0xc, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES32=r6], 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x20044044) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r6) getpid() getsockname$packet(r6, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x11, &(0x7f0000000300)={&(0x7f00000003c0)=@delchain={0x3c, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r11, {}, {0xfff2, 0xffff}, {0xffff, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008844}, 0x4010) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) 985.157816ms ago: executing program 4 (id=734): io_setup(0x8, &(0x7f00000002c0)) syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000080)={0xf0f041}) (fail_nth: 3) 797.309183ms ago: executing program 1 (id=735): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r1, 0xc0505405, &(0x7f0000001300)={{0x3, 0x0, 0x0, 0x0, 0x2}}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = gettid() prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x5, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) link(0x0, 0x0) ioprio_set$pid(0x3, r3, 0x4004) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x5, 0x3, 0x40, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x8, 0x8, &(0x7f0000000000)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r4}}]}, &(0x7f0000000080)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x5a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3, @void, @value}, 0x94) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000006c0)=@newtaction={0x10c, 0x32, 0x300, 0x0, 0x100, {}, [{0xf8, 0x1, [@m_ctinfo={0x30, 0x1, 0x0, 0x0, {{0xb, 0x2}, {0x4}, {0x4}, {0xfffffffffffffdb4, 0x7, {0x1}}, {0xc}}}, @m_vlan={0xc4, 0x9, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xaf9}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x88e}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0xc554}]}, {0x76, 0x6, "19019203abe924053121e1b6e0194b3e44eac650e1820b5543bcd1a75b125696e64ffb69b3be435f4df4ed5ef6bccccb0d0e424e519427dde8bb8ed09214be8a0eab271e858a7e9e17ef93f234706c3c950c84e1ed1393d2c9a715ff84808479bb42a418dcb57bab1bc7c2c0dbad82cd4ca3"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0x10c}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a70000000060a0b0400000000000000000200000044000480200001800e000100636f6e6e6c696d69740000000c000280080001400000000010000180090001006c61737400000000100001800a00010072656469720000000900010073797a30000000000900020073797a3200000000110000001100010000000000000000000000000a7a498478264f1ad6990bd4a211d455c4fe49"], 0x98}}, 0x0) 516.722697ms ago: executing program 0 (id=736): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x41, 0x3f, 0x5f, 0x20, 0x61d, 0xc150, 0xce6f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x33, 0x0, 0x1, 0x18, 0x70, 0xfd, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x4}}]}}]}}]}}, 0x0) r3 = socket$inet6(0xa, 0x1, 0x0) pipe(&(0x7f00000001c0)) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000440), 0x20000, 0x0) accept4(r1, &(0x7f0000000340)=@vsock={0x28, 0x0, 0x0, @hyper}, &(0x7f00000003c0)=0x80, 0x800) preadv(r4, &(0x7f0000000100)=[{&(0x7f0000000000)=""/202, 0xca}], 0x1, 0x9, 0x513d) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, 0x0, &(0x7f0000000180)) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_clone(0x0, &(0x7f0000000200)="809521318022880b340b747ec4db8360f8097064e96d9eb66ba3e0f493eb5479249b9e599bc729536c9f7af4e6b123b977c4f1ee9341ff086c475d0ec6c84945e99ca79513b7f75c0f65d55f6716a5", 0x4f, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f0000000300)="432463f8b28eeb4ad7abd801a232069a8d0debfadcf653c15edbe8bebb621362f2abfc7d8abc10e3bc3d8f5367a0726e4f0591") syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0xa8, &(0x7f0000000000)=ANY=[@ANYBLOB="a200004ef3b11f948ef66b0ee0b3d41b1b", @ANYRES8=r0, @ANYRESDEC=r0, @ANYRESOCT=r1]) 489.665576ms ago: executing program 2 (id=737): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b40000001300e9990000000000000000fc0000000000000000000000000000000000000000000000000000001800000100000000000000000200400000000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB='\x00'/108], 0xb4}}, 0x0) io_setup(0x48, &(0x7f0000000100)) syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000080)={0xf0f041}) 269.559245ms ago: executing program 4 (id=738): syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x46e, 0x5577, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x80, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x8, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0xff}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x1, 0xa, 0x80}}]}}}]}}]}}, 0x0) 268.350762ms ago: executing program 5 (id=739): recvmsg(0xffffffffffffffff, 0x0, 0x10002) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$qrtr(0x2a, 0x2, 0x0) mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) ioctl$BTRFS_IOC_TREE_SEARCH(r2, 0xd0009411, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) socket$kcm(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_opts(r10, 0x0, 0x4, &(0x7f0000000080)="441f080100000000ff0000005b1957034b596f21d3816491ee54bec6fe", 0x1d) getsockopt$inet_opts(r10, 0x0, 0x4, 0x0, &(0x7f0000000040)) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@newlink={0x60, 0x10, 0x401, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x103, 0x20820}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge_slave={{0x11, 0x118}, {0x14, 0x5, 0x0, 0x1, [@IFLA_BRPORT_PROXYARP={0x5, 0xa, 0x1}, @IFLA_BRPORT_FAST_LEAVE={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x44891}, 0x48000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r6, 0x47f6, 0x0, 0x2, 0x0, 0x0) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r3, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x80) r12 = openat$dlm_plock(0xffffff9c, &(0x7f00000000c0), 0x20002, 0x0) ioctl$SIOCGETNODEID(r12, 0x89e1, &(0x7f00000001c0)={0x2}) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x7000000) 164.158466ms ago: executing program 2 (id=740): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x1, 0x5, 0x0, 0x0, {0xa, 0x0, 0x8}, [@CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x40000) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000040)=ANY=[], 0xd8}, 0x1, 0x0, 0x0, 0xc050}, 0x48090) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x248ee12bd55a70bf, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000140), 0x48001, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r4, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000001380)={&(0x7f0000000200)=ANY=[@ANYBLOB="44000000000701040000000000000000070000070400078008000540000000024040000000000000030900010073797a30000000000c0006aecf00000000000000000000b2a195a97f6441a8d24e3db06be7b4067efb877d79c2cea7f84eeee27b920cd856f0ab37f54c8636c37d1f45b85e0ccf5866fc096cc0df7025ba50e42a1e0c054a6b1ed66c630e7148eb2e85e1aabbe4faf640af4bad81bbd4bd535c5ecff7"], 0x44}, 0x1, 0x0, 0x0, 0x200498c0}, 0x40080) write$binfmt_script(r3, &(0x7f0000000980)={'#! ', './file0', [], 0xa, "5176524a0451e0f1541743e2e4bf0e1f6d26e91304e7b6bdbc195b146aa57896b08b825650edd7324a5f4b12fdebc62df7d5384123d09633d094166e9a84dccb41ddf28c154d09fba536e4055c740b7503523193bc99cf23c6b74bf3cd0087cda6644855bcb5dbbb5b63c66565038a7140eac9f474837899066d9dbc58b5aa87b6fa97a25b400cff012bce9f87820833683bb57a0e9d72391607e577f8b6f10cd68aadb623ebb0599c88b70d02b3f83c02ffdd193ea1e1319e9c7473805e24f38dbb5f309f6dcd1223b4910afd9e5c9fd3ae49336c11eea0f70381297e3e7ecbeaafdea3d83391128e444a63bf8e87d5027b6e086374e7c8cfec406f34498045cb5545719cb0725e5b692db056a7e857211df6452ca1ed06377f76b5c011e521df119bf33e667fa01caa275857e9b88e28e8d7f0fd88d69c79d817ee291fb5b0bb99ed7a1e42daf9b39f1f29a663d55ac99f6e6059e67bd1ad9f31a4f7afa9298ed2a91d1e3f6ce974fb50392c074762dedd97e5d0894c3db8103b7e7c3ebe5b4671060d9a9179d9243bcbae1a257549156f292a95468f77c0104dbee9afdddbf8c50349cc9e110e044e4bf4c981b231963d99498c43023ec8eeaef100f42947ff5e9cf529d83d7729ba2c8e63fdcff280d105c5f664a8a2bc4098e6ef5b3c4cf4b3fd4a3b749dcc4bbe1eb2dc2b7b5cff8e53abd31abf1ee67f1fc2c7a2bb795e1d27478e0c6c20c29b63871282e8793d0d3905340edeacb4bbbbc1395a7fdcb8a1957924d3d3b107232d7f87a0cadd7de4e8790ddb8186d8ace8c55d5231631aab47882d4341f4d41436d3297e0252e7e17d116d283eaa67141524bdfcbc26d01bea72b239d8cfe8f081156406ce174f78e5ae05d4fc2803cf0fbbdfa59ef7ed6033e7d2a7bb979d0323386a426cb6317eb22ade30c5496d3baa6533f6f0b72708fb3e789f4135aea416aa32f425e12e2958bfe39bc1d8c54f4118f5514e5896de9355fe68ff5da28e5414f58a666a31c9521178a27144e5c67684430d8485ed177461050264aace8ae02068f78fa487aa2e0be8aeaeb4d431351669ce3851e7ac45779784745ba79e8d2175bfdebe793b3666e86f3e0bbc360ee3e6367575349d3dd9730120016146c6b86096f9538b01d4018a1273cbb4894cabbe056bb58d5c87c0ad9fee10ca220fa753e52833df88b3abfc140b10e115836a1daac4cea82c521ac2df869a1395c46bcba554de44c76116149f40104f5ea642274928ae29eb6c2415847518d32a2867a59834c6e0c4503170a9443470b4f24c581ff2284f1ff9d16db82a78e98d6450c90850ba5695695425f371efd5df490e59dc1eb4b3d74777fe4f8535d315886e203db32c362dc363de4ba6b76edd0dd152b4e6acdb37d7eda2f17b967fb07591a9b9579af4164209a7957a24bb1c49c9cf45d3876a8af3faaafabcb2021f26ff981bffce8f80f5d1bb99c23d4a55908d169e06de1d1630603e25e767c5e9c571e0b529f6473a62333e1ca4dd42fa2cb5149de2ee06884c107627dfbf8ad33c29d739626b44e1085bdb6cbdd48feae5d7490f5f865107cf42b76934ceab449c95ed052301dbe1328729a18c3a55cf57fec64b820d7fd94086eae75047347cde2de2f226a692116479ff960b4dc4bbef85bad6fb4f71284c7d74b19e1948a6871ccb5b72da09cd3166f9ab62918cfeb1214d862f21d640081b8efdc359df57f5ad1528f46d2c99864c4bfa788805e2d16814be35a08d6a15950a9ae243ba91167813bf6a182a8e61b51d673be9d12916a9879a707ea3f054baa9e9cb29c9d2c67cbef52701b1c34ad6966bd2820144381c50e67496ac22d6f33abaf765cb9e6985187c0838a77027a802b069cd2e3c6d087f653b160ebb9c6836a2c77367221a94ada3426a98359435be25dbb3f1c0eaa5f70f8b491789589fe04fc864721c0c5a9628cdd8c2886db8b2f574f105ba2883cc627b589f18baa6894aa2ed801c87b894c09e0d0e54dbcb985db305d181289c334ea7b4021ad21219eea6d670d462436be20adbd725d3489280c17f2ecc11a4c68f2a1a075ce8f34680467627516a7dc7a16473e938571cbace0e13b8869a1cf63dd61e5899bd9bd1c0134cb32d4a760048841565dd9b853e4fcf53f8adde6f9706e7ba37235fcf6e47e02576367ae0b1d855c7140c447aae1bd8a00912e02058dca9dad9f83a49261ca1a5988ab258590313abc47085b53fe0716542d96fbc39ff29e46f7f5dca9a7d46e97ea4cd17c1d600302d50c543feb0c7838fb1ece9da802aadf58c303e2f7bd7ded317bf82c1f7dd1aca0c5b1339a38d12b902aa22f99d06eaeff2e8abdd995d39daca2c0938f659c293014cf8c22d27e5e8add19c5677aea5965b6452f3781d3dd80daaffd695b9eb950a76ad7fd6c236c155abac52ca695be2a7688ab1c74e6dc4cb62feaaea9105fc3ae31194d3bb9b457f4f31c94aaee44d2abe41040a16429097b47d0e1de3692fbd12bd32dd0ed807a2b3044cfc97f63db15b1037dc6818fa80c9a9ca0ae1f087688a597bd0d96d232858c766e0fa2c071c27d3787174b8f8febff5484d4ad6735f4486439fa5a68869f2c6178ea4a015d906905022242cf65951837ba3185373d1347a32d6671812954d55b23155a420820a6f2cc9da9055552daadf0182db703f63c7aa01fdd9220b330f69368e8a3ca00095ce300858b12388c39f02d5ae5b169beb5b47678b7648d2ab6f740d677e2f6a829b8aa08f0702417e4098e147da2a902377cf2b0efdc2b3a20e62dfd174eeaa56fd473a3553cdb042d520a22ce44f5f1a8026b85327ed4e2f612542301eb7e06c5c37c03cb8cd38e4f16857bd3829f5579fb70fe8c3b834e7cbb6d2e58401cf2babd9b37eac6ae61ee756d76f1c10faed91f95c97e40c258f39f525e84c705cd1d9c14701be8ea62068cb54e3645f39e2a286852d3e921bb6331f6ba36f31fb164757eb58d4d2dff30f9ca4097eb15f45df1f751cd9d5c8e98a625d4f77d3a0a2c213fbde4e8c75fe2e08f86ab164fcb88a056ae3a23675858788dc5bd4ab888ae34ca79564d4648d127ce152fbc25640763f964a3221dfc1c3c8e6452db8e13669a230e5304360948270a43ab744736833630d2f40f3ec1bff6b45d7d30b69bf9e4fadfe26bc45759aec7ca9decf01e4f98a59f437feefa9dfdb0a921eccfb3cb4de60931e54f68725bae8d6326bb0a39a831ca9e9896a8e5ba00ded199d7ce9cfbcf5e8f66eb80a7d85a167f0fbaf4f026d1074d4571738e850b2b916849bacb4df662162470bcf79cafa21223081f1a4945d8c800dbf6f6a17afa20d23a03decb8c815c5f20f2ad316899a6082ee2df3562ff3fb87d72befa793e1bad9c2972248376f9da27e93f36b53e5b8022c1c739b801f06a654dcdf28340087d838742affbd62e2622cbed3d15e50bb1932cc2988f230fe579b7b1bb71df72c0153a6629b6c8da383a55a65db1c5a176233140cd0bb437b7d9912c5d714c4bcc1b3a0310df463856d9ecb1d8147b61737d213c19b28cf095accaeab2876b94ade65cf1502e30b17bfc18fabb58a65a8bab857841b69d6dcf00066fb322267069ced4c2e3a1324ab2a08aa263de7e818a9c0f3b8fbcbf2abaa11c76c5d5615559b51ad963ca36342849aec588b7c9609769e1cd26d338e0fb1776df5bcfb19d9039cde2865d1155ab9f2b1d7c1d5e8cb037b3ff4fca08ccef9dadbe0a5fc0e9c30ae9a07a7d4db5de1a5be81c717aff2b5c753907fe01c7bc232b8881853a05514d306ddba9c3eaeadc6bda8340c9960c0bbdafaaf2dfbf5fd185fde3e74cd81b62f792415e1c703dd4aab18bfc09ca88c4733c5d7b745626c6d2fbdc32a932db804f52708ae09d0f07cc71abe41c529b87a3da59cf19699fbf32553f9dd1b61a0c1b55f69308da46ee7df2b8d7a717ca11edc0fab4c162cf681855892fbb71e8af121fab4019a1a3c8482d69f6dd9ab790421af3b6a5318974607156c15bbf381695e4266f9f1aff01fabb3e90634e5577f4b38f031da62322e7ac8631d9b6305b252fa330051e206389c27dd922d8489a73761450eba9fc4474e51e5afee8547ec4bfceae597fa87045761810ded094c7fb008171ba933751a8e0f34812d338e617b33f6a043648792ab82833a76d0d705779b3a471d4c6d1c31d457d619bd00fda793c3c5f2ee0427ec7667d9d55070e422cf5308dc4eda093a52aba17a766b23697bfd4755e8e1ff609a11a8e29559d47791a727b5b024cd5cf04fbfc99e612da43c62fed3f9c6b9c6f7b2499834936dea3e52992ee440e903964885a673cf4781777b38f09ad151e66074ec121a519efdf2b5f87c17b44f4a5aea63299b5e19362ea39ef0c1b66363895d222cf2c5952bfa6b36034c7b9fcbd32aa351134b27944d1bfb489a24c1da2f52c9c6561b5c376e6409dd41e36c34cf4a4498c972d5d571746ab9e4a76f6e8c39cec798463ba447c8dc90410b4f71b4b79763885af916edab7b5e2ece6173198cca8aa4d2ab34e96684aff4dbf487677e9c137a6db52edc6c4fa2d63e1ff4f2aa40a11d3840f2a4344f94ecc8e0089273757605fe0bebc9a42f66bef4988a01695a942f3dbfb3e85c1ac3181b998779edb1fef7695fb1322ee5d56377e17590fde81f89593b2754695ef3d0112698056b80cb4f630d91001f199c0c2eeb01c256e52e33ba020d582fc19b5c07000fa98b0819ca1e47c505a1bfc96d947c69099cb08de2159cbed21f3a38ebb5dcb75d667884ccb37bf5942af8db72345aca594e9c1ff2322737409a32283f1ca9196c2b0ae850473d56ec6ffe2419c66642d33c23ef12ce938510dcc882512aaf85daa1f4c24902a47e0b41ba8c8160b7025bbbec7dba07a631061e86dd905c4829d737282d905725a567eab767b52d771c65faab219d21a41774ea26ee661e8d70daa299c5e909843ddc89cb4a1cf020418a9f607ec285ae1302e54e62dbd883a8bf82978e2291b9f2aa899f7e4aaac61c0ab46482d5fde0fbec794b32437fa8b6cd6617a5208601ceeb1a5c4df8f8fd9cffde41d03b3486dde408fb687615683dad64d15b9956237e0a9f84aa7c5b689b20526d9e729e96d86c2d576fed3af06cb8c8654eee0fbad921d1f233ffa57bd369a6ffad18399eb9472d59dc1b5c37f013def50fee3ab39eb3798bccfa9002098d583d2439ef452f0ce4ec16d86811c12d3765bf4e2b04c228afcc8939b48e38e2fdcde788de2d9ee941450607202c8a2dfe0d00c8e29cf44d026721015137787ca1fd7f48ec8e930970c7f94b22614766aa93759473f6168bdfa30b96d58c19a9a869320b24aecb05b91a0c566b62d5f92102e8d9bc9b9cbf7d437c303c4b9d35890d3b61cdc5a2582f3993593e322e9aa7c8deef8b2bbc673b1b227162749b610d0834de6179a5033baf4815d9008f0f755446ce461f4f81136eb95d0fa069a707f80198580a0cda24639cc516e3e289d1506507d250c8065203bae6cfb0806aa1e8efa82a370f437fc4c345253d813eea714e1125cb9ed861ca660b065df947f80c28caf1470ccd7414e7d3fba0ac949672084380b44bd1cbad59aa54d21a5dddc448d4eaead6e263e8b73e156beb9f5b819a9a03d3c1c9e21cb73a62ea85d9c91e0033ef19dc8e802aa63dab6ba3a387894ec686437a030895e0c0b16534838a9aa54327f807f25461f536455b67ba9e6ab334b0a2b90cbf459b6d0d6ebd91e69fbdf080eea1bb45"}, 0x1001) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x1900, &(0x7f0000000500)={&(0x7f0000000700)=@newsa={0x154, 0x10, 0x633, 0x0, 0x0, {{@in=@broadcast, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in6=@loopback, 0x0, 0x32}, @in=@dev={0xac, 0x14, 0x14, 0x1a}, {}, {}, {}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x72}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x70bd28, 0x70bd2c, 0x70bd28, 0x70bd27, 0x81}}]}, 0x154}}, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x28, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0xa}]}, @NHA_BLACKHOLE={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) r8 = dup(r6) ioctl$KVM_SET_VAPIC_ADDR(r8, 0x4008ae93, &(0x7f00000000c0)=0xffff) r9 = fsopen(&(0x7f00000000c0)='ntfs3\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000140)='gid', &(0x7f0000000000)='\xd0\x9bd\xd6\xe2\xa3\x88\x9e\x1e\xfc\r\x8ca\x9bh\xa37\xea\xf7\xf4\xf0\b\x00\x00\x00\x00\x00\x00\x00\x1e_\amU\"\xee\xa8\xbb\x1a\xd3\xca\x1e\xf6\xabG\x8bpoW\x8f\xf7\xb9\x005\'V\x83\xb9\xc8z\xd2\xb8^b\xaa&\xfa\x04\x15}\xcf\xa5W\x160x0, 0x7f, 0x8, 0x5, 0x6, 0x34, 0x200, 0x0, 0xde, 0x4, 0x4, 0x7ff, 0x7, 0x8, 0xaa}}) ioctl$BTRFS_IOC_INO_LOOKUP(r0, 0xd0009412, &(0x7f00000029c0)={r11, 0x8}) setsockopt$inet_tcp_TCP_REPAIR(r10, 0x6, 0x13, &(0x7f0000000000)=0x1, 0xfef2) connect$inet(r10, &(0x7f00000000c0)={0x2, 0x4e23, @remote}, 0x10) setsockopt$SO_TIMESTAMPING(r10, 0x1, 0x9, &(0x7f0000000100), 0x4) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r8, 0x404c534a, &(0x7f0000000100)={0x40, 0x6, 0x69ee}) 0s ago: executing program 2 (id=741): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) ioctl$TCSETSF(r1, 0x5404, 0x0) read$FUSE(r1, &(0x7f0000002080)={0x2020}, 0x2) kernel console output (not intermixed with test programs): [ 177.682615][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 177.712536][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 177.742294][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 177.762316][ T6945] vhci_hcd: vhci_device speed not set [ 177.772214][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 177.802179][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 177.832687][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 177.939424][ T6962] cp210x 3-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 177.990420][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 178.122150][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 178.173038][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 178.210987][ T5895] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 178.222372][ T6962] usb 3-1: cp210x converter now attached to ttyUSB0 [ 178.272116][ T5895] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 178.329062][ T5895] usb 1-1: USB disconnect, device number 15 [ 178.439901][ T7347] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 178.446489][ T7347] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 178.458964][ T7347] vhci_hcd vhci_hcd.0: Device attached [ 178.476185][ T30] audit: type=1326 audit(1745225363.099:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7345 comm="syz.1.394" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f92539 code=0x0 [ 178.503228][ T7350] netlink: 8 bytes leftover after parsing attributes in process `syz.0.395'. [ 178.697339][ T6962] usb 35-1: new high-speed USB device number 3 using vhci_hcd [ 178.819588][ T7360] FAULT_INJECTION: forcing a failure. [ 178.819588][ T7360] name failslab, interval 1, probability 0, space 0, times 0 [ 178.853346][ T7360] CPU: 0 UID: 0 PID: 7360 Comm: syz.0.397 Not tainted 6.15.0-rc2-syzkaller-00493-gac71fabf1567 #0 PREEMPT(full) [ 178.853380][ T7360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 178.853394][ T7360] Call Trace: [ 178.853402][ T7360] [ 178.853412][ T7360] dump_stack_lvl+0x241/0x360 [ 178.853451][ T7360] ? __pfx_dump_stack_lvl+0x10/0x10 [ 178.853482][ T7360] ? __pfx__printk+0x10/0x10 [ 178.853516][ T7360] ? __pfx___might_resched+0x10/0x10 [ 178.853542][ T7360] should_fail_ex+0x424/0x570 [ 178.853579][ T7360] should_failslab+0xac/0x100 [ 178.853603][ T7360] kmem_cache_alloc_node_noprof+0x7d/0x3b0 [ 178.853627][ T7360] ? __alloc_skb+0x1c2/0x480 [ 178.853668][ T7360] __alloc_skb+0x1c2/0x480 [ 178.853704][ T7360] ? __pfx___alloc_skb+0x10/0x10 [ 178.853736][ T7360] ? netlink_autobind+0xd6/0x2f0 [ 178.853762][ T7360] ? netlink_autobind+0x2b0/0x2f0 [ 178.853794][ T7360] netlink_sendmsg+0x638/0xcd0 [ 178.853834][ T7360] ? __pfx_netlink_sendmsg+0x10/0x10 [ 178.853866][ T7360] ? aa_sock_msg_perm+0x91/0x160 [ 178.853899][ T7360] ? __pfx_netlink_sendmsg+0x10/0x10 [ 178.853931][ T7360] __sock_sendmsg+0x221/0x270 [ 178.853960][ T7360] ____sys_sendmsg+0x523/0x860 [ 178.854002][ T7360] ? __pfx_____sys_sendmsg+0x10/0x10 [ 178.854052][ T7360] __sys_sendmsg+0x271/0x360 [ 178.854090][ T7360] ? __pfx___sys_sendmsg+0x10/0x10 [ 178.854176][ T7360] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 178.854199][ T7360] ? lockdep_hardirqs_on+0x9d/0x150 [ 178.854224][ T7360] __do_fast_syscall_32+0xb4/0x110 [ 178.854246][ T7360] ? exc_page_fault+0x5f8/0x920 [ 178.854272][ T7360] do_fast_syscall_32+0x34/0x80 [ 178.854295][ T7360] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 178.854321][ T7360] RIP: 0023:0xf710d539 [ 178.854340][ T7360] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 178.854359][ T7360] RSP: 002b:00000000f50fd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 178.854382][ T7360] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 178.854397][ T7360] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 178.854409][ T7360] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 178.854420][ T7360] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 178.854433][ T7360] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 178.854463][ T7360] [ 179.380710][ T7348] vhci_hcd: connection reset by peer [ 179.390165][ T36] vhci_hcd: stop threads [ 179.391975][ T5931] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 179.402604][ T36] vhci_hcd: release socket [ 179.419506][ T36] vhci_hcd: disconnect device [ 179.571590][ T5931] usb 3-1: USB disconnect, device number 20 [ 179.673554][ T5931] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 179.679015][ T7377] netlink: 24 bytes leftover after parsing attributes in process `syz.1.401'. [ 179.746272][ T5931] cp210x 3-1:0.0: device disconnected [ 179.838538][ T6939] usb 4-1: USB disconnect, device number 15 [ 180.154133][ T6942] vhci_hcd: vhci_device speed not set [ 180.282140][ T6939] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 180.472141][ T6939] usb 4-1: Using ep0 maxpacket: 32 [ 180.472449][ T6945] usb 3-1: new full-speed USB device number 21 using dummy_hcd [ 180.484087][ T6939] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 180.493350][ T6939] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 180.525419][ T6939] usb 4-1: config 0 has no interface number 0 [ 180.531596][ T6939] usb 4-1: config 0 interface 89 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 180.604819][ T6939] usb 4-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 180.614226][ T6939] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.669912][ T6945] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 180.693640][ T6945] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 180.739477][ T6945] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 180.742116][ T6939] usb 4-1: Product: syz [ 180.767876][ T6945] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 180.772140][ T6939] usb 4-1: Manufacturer: syz [ 180.806683][ T6945] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 180.812085][ T6939] usb 4-1: SerialNumber: syz [ 180.823852][ T6939] usb 4-1: config 0 descriptor?? [ 180.829128][ T6945] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 180.842261][ T6939] hub 4-1:0.89: bad descriptor, ignoring hub [ 180.848331][ T6939] hub 4-1:0.89: probe with driver hub failed with error -5 [ 180.850522][ T6945] usb 3-1: Manufacturer: syz [ 180.872564][ T6939] option 4-1:0.89: GSM modem (1-port) converter detected [ 180.900370][ T6945] usb 3-1: config 0 descriptor?? [ 180.983627][ T7400] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 180.990229][ T7400] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 181.023890][ T7400] vhci_hcd vhci_hcd.0: Device attached [ 181.065869][ T30] audit: type=1326 audit(1745225365.689:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7399 comm="syz.1.408" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f92539 code=0x0 [ 181.089937][ T7383] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.102536][ T7383] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.243293][ T6945] rc_core: IR keymap rc-hauppauge not found [ 181.258361][ T6945] Registered IR keymap rc-empty [ 181.275650][ T6945] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 181.302372][ T6942] usb 4-1: USB disconnect, device number 16 [ 181.312159][ T6945] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 181.322335][ T6942] option 4-1:0.89: device disconnected [ 181.368460][ T6945] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 181.404644][ T7401] vhci_hcd: connection closed [ 181.405034][ T992] vhci_hcd: stop threads [ 181.426503][ T992] vhci_hcd: release socket [ 181.431244][ T6945] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input18 [ 181.454428][ T992] vhci_hcd: disconnect device [ 181.475405][ T6945] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 181.607338][ T6945] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 181.612812][ T7410] syzkaller0: entered promiscuous mode [ 181.625748][ T7410] syzkaller0: entered allmulticast mode [ 181.682262][ T6945] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 181.743781][ T6945] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 181.762833][ T6945] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 181.804763][ T6945] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 181.835910][ T6945] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 181.878566][ T6945] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 181.914522][ T6945] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 181.952669][ T6945] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 181.993086][ T6945] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 182.045446][ T6945] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 182.063052][ T6945] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 182.078952][ T6945] usb 3-1: USB disconnect, device number 21 [ 182.411178][ T5895] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 182.572131][ T5895] usb 4-1: device descriptor read/64, error -71 [ 182.732144][ T6945] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 182.771558][ T7423] netlink: 24 bytes leftover after parsing attributes in process `syz.2.414'. [ 182.822171][ T5895] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 182.972243][ T5895] usb 4-1: device descriptor read/64, error -71 [ 182.992632][ T6945] usb 1-1: Using ep0 maxpacket: 16 [ 183.001936][ T6945] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 183.016535][ T6945] usb 1-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 183.032685][ T6945] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.055606][ T6945] usb 1-1: config 0 descriptor?? [ 183.095752][ T5895] usb usb4-port1: attempt power cycle [ 183.462235][ T5895] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 183.479288][ T6945] kye 0003:0458:5013.000A: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 183.492861][ T5895] usb 4-1: device descriptor read/8, error -71 [ 183.506827][ T6945] kye 0003:0458:5013.000A: hidraw0: USB HID v0.06 Device [HID 0458:5013] on usb-dummy_hcd.0-1/input0 [ 183.545123][ T6945] kye 0003:0458:5013.000A: tablet-enabling feature report not found [ 183.555271][ T6945] kye 0003:0458:5013.000A: tablet enabling failed [ 183.743871][ T5895] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 183.775078][ T5895] usb 4-1: device descriptor read/8, error -71 [ 183.834438][ T6962] vhci_hcd: vhci_device speed not set [ 183.896839][ T5895] usb usb4-port1: unable to enumerate USB device [ 184.514650][ T7433] netlink: 24 bytes leftover after parsing attributes in process `syz.2.426'. [ 184.752168][ T5895] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 184.835829][ T7443] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 184.842383][ T7443] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 184.850689][ T7443] vhci_hcd vhci_hcd.0: Device attached [ 184.865391][ T30] audit: type=1326 audit(1745225369.489:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7442 comm="syz.4.419" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb6539 code=0x0 [ 184.927078][ T5895] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 184.938283][ T5895] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 184.952848][ T5895] usb 2-1: config 0 descriptor?? [ 184.960116][ T5895] cp210x 2-1:0.0: cp210x converter detected [ 185.045830][ T6962] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 185.099657][ T7451] FAULT_INJECTION: forcing a failure. [ 185.099657][ T7451] name failslab, interval 1, probability 0, space 0, times 0 [ 185.114850][ T7451] CPU: 1 UID: 0 PID: 7451 Comm: syz.4.421 Not tainted 6.15.0-rc2-syzkaller-00493-gac71fabf1567 #0 PREEMPT(full) [ 185.114880][ T7451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 185.114894][ T7451] Call Trace: [ 185.114904][ T7451] [ 185.114914][ T7451] dump_stack_lvl+0x241/0x360 [ 185.114954][ T7451] ? __pfx_dump_stack_lvl+0x10/0x10 [ 185.115000][ T7451] ? __pfx__printk+0x10/0x10 [ 185.115025][ T7451] ? __pfx___might_resched+0x10/0x10 [ 185.115044][ T7451] should_fail_ex+0x424/0x570 [ 185.115083][ T7451] should_failslab+0xac/0x100 [ 185.115107][ T7451] kmem_cache_alloc_noprof+0x78/0x390 [ 185.115128][ T7451] ? __kernfs_new_node+0xdf/0x890 [ 185.115153][ T7451] __kernfs_new_node+0xdf/0x890 [ 185.115169][ T7451] ? __lock_acquire+0xad5/0xd80 [ 185.115194][ T7451] ? __pfx___kernfs_new_node+0x10/0x10 [ 185.115228][ T7451] ? kernfs_root+0x1c/0x230 [ 185.115250][ T7451] ? kernfs_root+0x1c/0x230 [ 185.115272][ T7451] kernfs_new_node+0x114/0x220 [ 185.115300][ T7451] __kernfs_create_file+0x49/0x2e0 [ 185.115335][ T7451] sysfs_add_file_mode_ns+0x24a/0x310 [ 185.115366][ T7451] sysfs_create_file_ns+0x197/0x2c0 [ 185.115398][ T7451] ? __pfx_sysfs_create_file_ns+0x10/0x10 [ 185.115430][ T7451] ? device_create_file+0xf2/0x1c0 [ 185.115455][ T7451] device_add+0x522/0xbf0 [ 185.115471][ T7451] ? device_initialize+0x266/0x460 [ 185.115488][ T7451] netdev_register_kobject+0x157/0x2f0 [ 185.115520][ T7451] register_netdevice+0x12b0/0x1b80 [ 185.115559][ T7451] ? __pfx_register_netdevice+0x10/0x10 [ 185.115582][ T7451] ? __pfx_l2tp_session_register+0x10/0x10 [ 185.115614][ T7451] ? l2tp_eth_create+0x38f/0xc30 [ 185.115634][ T7451] l2tp_eth_create+0x82a/0xc30 [ 185.115653][ T7451] ? l2tp_tunnel_get+0x8c/0x500 [ 185.115701][ T7451] ? l2tp_eth_create+0x38f/0xc30 [ 185.115731][ T7451] ? __pfx_l2tp_eth_create+0x10/0x10 [ 185.115767][ T7451] l2tp_nl_cmd_session_create+0x838/0xf40 [ 185.115794][ T7451] ? __pfx_l2tp_nl_cmd_session_create+0x10/0x10 [ 185.115819][ T7451] ? genl_family_rcv_msg_attrs_parse+0x1d4/0x290 [ 185.115861][ T7451] genl_rcv_msg+0xb38/0xf00 [ 185.115905][ T7451] ? __pfx_genl_rcv_msg+0x10/0x10 [ 185.115935][ T7451] ? stack_trace_save+0x11a/0x1d0 [ 185.115962][ T7451] ? __pfx_stack_trace_save+0x10/0x10 [ 185.115997][ T7451] ? stack_depot_save_flags+0x44/0x940 [ 185.116030][ T7451] ? stack_trace_snprint+0xb1/0xf0 [ 185.116068][ T7451] ? __lock_acquire+0xad5/0xd80 [ 185.116099][ T7451] ? __pfx_l2tp_nl_cmd_session_create+0x10/0x10 [ 185.116129][ T7451] netlink_rcv_skb+0x208/0x480 [ 185.116148][ T7451] ? __pfx_genl_rcv_msg+0x10/0x10 [ 185.116184][ T7451] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 185.116233][ T7451] ? netlink_deliver_tap+0x2e/0x1b0 [ 185.116262][ T7451] genl_rcv+0x28/0x40 [ 185.116283][ T7451] netlink_unicast+0x7f8/0x9a0 [ 185.116307][ T7451] ? __pfx_netlink_unicast+0x10/0x10 [ 185.116340][ T7451] ? skb_put+0x114/0x1f0 [ 185.116374][ T7451] netlink_sendmsg+0x8c3/0xcd0 [ 185.116411][ T7451] ? __pfx_netlink_sendmsg+0x10/0x10 [ 185.116434][ T7451] ? aa_sock_msg_perm+0x91/0x160 [ 185.116459][ T7451] ? __pfx_netlink_sendmsg+0x10/0x10 [ 185.116486][ T7451] __sock_sendmsg+0x221/0x270 [ 185.116515][ T7451] ____sys_sendmsg+0x523/0x860 [ 185.116556][ T7451] ? __pfx_____sys_sendmsg+0x10/0x10 [ 185.116593][ T7451] __sys_sendmsg+0x271/0x360 [ 185.116629][ T7451] ? __pfx___sys_sendmsg+0x10/0x10 [ 185.116714][ T7451] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 185.116730][ T7451] ? lockdep_hardirqs_on+0x9d/0x150 [ 185.116747][ T7451] __do_fast_syscall_32+0xb4/0x110 [ 185.116770][ T7451] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 185.116792][ T7451] ? lockdep_hardirqs_on+0x9d/0x150 [ 185.116816][ T7451] do_fast_syscall_32+0x34/0x80 [ 185.116838][ T7451] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 185.116862][ T7451] RIP: 0023:0xf7fb6539 [ 185.116875][ T7451] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 185.116888][ T7451] RSP: 002b:00000000f50d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 185.116905][ T7451] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000140 [ 185.116920][ T7451] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 185.116932][ T7451] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 185.116944][ T7451] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 185.116956][ T7451] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 185.116993][ T7451] [ 185.122435][ T6945] usb 41-1: new high-speed USB device number 2 using vhci_hcd [ 185.163845][ T7444] vhci_hcd: connection closed [ 185.187404][ T7432] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 185.359643][ T81] vhci_hcd: stop threads [ 185.593523][ T7432] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 185.601482][ T81] vhci_hcd: release socket [ 185.606380][ T81] vhci_hcd: disconnect device [ 185.616008][ T6962] usb 3-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 185.630615][ T6962] usb 3-1: config 0 interface 0 has no altsetting 0 [ 185.661976][ T6962] usb 3-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00 [ 185.671314][ T6962] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.672729][ T6942] usb 1-1: USB disconnect, device number 16 [ 185.688002][ T6962] usb 3-1: config 0 descriptor?? [ 185.747001][ T7456] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 185.748578][ T5895] usb 2-1: cp210x converter now attached to ttyUSB0 [ 185.821943][ T7460] netlink: 'syz.3.420': attribute type 10 has an invalid length. [ 185.837499][ T7456] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 185.852187][ T5881] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 185.866648][ T7456] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 185.908187][ T7456] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 185.930337][ T7456] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 185.951662][ T7456] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 185.989923][ T7456] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.036699][ T7456] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 186.062886][ T7460] team0: left allmulticast mode [ 186.074478][ T5881] usb 5-1: config 0 interface 0 altsetting 185 endpoint 0x81 has invalid wMaxPacketSize 0 [ 186.090081][ T5895] usb 2-1: USB disconnect, device number 21 [ 186.110954][ T5881] usb 5-1: config 0 interface 0 has no altsetting 0 [ 186.118232][ T5895] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 186.126189][ T5881] usb 5-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 186.142458][ T6942] usb 1-1: new full-speed USB device number 17 using dummy_hcd [ 186.144466][ T6962] nintendo 0003:057E:200E.000B: unknown main item tag 0x0 [ 186.158002][ T5895] cp210x 2-1:0.0: device disconnected [ 186.232818][ T5881] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.266924][ T6962] nintendo 0003:057E:200E.000B: item fetching failed at offset 3/5 [ 186.304251][ T6942] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 186.307724][ T5881] usb 5-1: config 0 descriptor?? [ 186.319727][ T6942] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 186.331783][ T6962] nintendo 0003:057E:200E.000B: HID parse failed [ 186.338721][ T6942] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 186.361675][ T6942] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 186.368122][ T6962] nintendo 0003:057E:200E.000B: probe - fail = -22 [ 186.390139][ T6962] nintendo 0003:057E:200E.000B: probe with driver nintendo failed with error -22 [ 186.393491][ T6942] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 186.452449][ T6942] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 186.460518][ T6942] usb 1-1: Manufacturer: syz [ 186.536554][ T6962] usb 3-1: USB disconnect, device number 22 [ 186.566698][ T6942] usb 1-1: config 0 descriptor?? [ 186.609285][ T5881] usbhid 5-1:0.0: can't add hid device: -71 [ 186.617077][ T5881] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 186.649225][ T5881] usb 5-1: USB disconnect, device number 14 [ 186.882304][ T6942] rc_core: IR keymap rc-hauppauge not found [ 186.888484][ T6942] Registered IR keymap rc-empty [ 186.902197][ T6942] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.924252][ T6942] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 186.943877][ T6942] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 186.960501][ T6942] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input19 [ 187.022325][ T6942] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 187.044355][ T6942] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 187.059434][ T7471] netlink: 24 bytes leftover after parsing attributes in process `syz.3.425'. [ 187.092538][ T6942] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 187.112304][ T6942] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 187.128507][ T7474] xt_CT: No such helper "syz0" [ 187.152313][ T6942] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 187.196651][ T6942] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 187.222277][ T6942] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 187.242802][ T6942] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 187.282414][ T6942] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 187.292537][ T7480] netlink: 4 bytes leftover after parsing attributes in process `syz.4.428'. [ 187.312690][ T6942] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 187.328014][ T7480] netlink: 4 bytes leftover after parsing attributes in process `syz.4.428'. [ 187.339897][ T7480] netlink: 4 bytes leftover after parsing attributes in process `syz.4.428'. [ 187.348925][ T6942] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 187.374361][ T6942] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 187.385001][ T6942] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 187.425421][ T6942] usb 1-1: USB disconnect, device number 17 [ 187.462079][ T7471] netlink: 'syz.3.425': attribute type 4 has an invalid length. [ 188.037476][ T7488] netlink: 24 bytes leftover after parsing attributes in process `syz.4.431'. [ 188.415748][ T7488] netlink: 'syz.4.431': attribute type 4 has an invalid length. [ 188.433579][ T7488] syz.4.431 (7488) used greatest stack depth: 19232 bytes left [ 188.922419][ T5931] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 188.942615][ T6942] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 188.983388][ T7516] netlink: 4 bytes leftover after parsing attributes in process `syz.3.440'. [ 188.995077][ T7516] netlink: 4 bytes leftover after parsing attributes in process `syz.3.440'. [ 189.005297][ T7516] netlink: 4 bytes leftover after parsing attributes in process `syz.3.440'. [ 189.093934][ T5931] usb 3-1: New USB device found, idVendor=0c45, idProduct=62a0, bcdDevice=a8.22 [ 189.103445][ T6942] usb 5-1: Using ep0 maxpacket: 16 [ 189.161032][ T5931] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.172332][ T6942] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 189.180378][ T6942] usb 5-1: config 0 has no interface number 0 [ 189.192265][ T6942] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 189.223512][ T5931] usb 3-1: config 0 descriptor?? [ 189.232114][ T6942] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 189.284589][ T6942] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 189.294969][ T6942] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 189.311255][ T5931] gspca_main: gspca_sn9c20x-2.14.0 probing 0c45:62a0 [ 189.318875][ T6942] usb 5-1: Product: syz [ 189.342067][ T6942] usb 5-1: SerialNumber: syz [ 189.386784][ T6942] usb 5-1: config 0 descriptor?? [ 189.406833][ T6942] cm109 5-1:0.8: invalid payload size 0, expected 4 [ 189.425518][ T6942] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.8/input/input20 [ 189.630513][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 189.840197][ T5931] gspca_sn9c20x: Write register 1000 failed -110 [ 189.858243][ T5931] gspca_sn9c20x: Device initialization failed [ 189.869037][ T6942] usb 5-1: USB disconnect, device number 15 [ 189.904481][ T6942] cm109 5-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 189.914062][ T5931] gspca_sn9c20x 3-1:0.0: probe with driver gspca_sn9c20x failed with error -110 [ 190.526147][ T5895] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 190.706466][ T5895] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 190.724744][ T6945] vhci_hcd: vhci_device speed not set [ 190.731907][ T5895] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 190.747261][ T5895] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 190.757177][ T5895] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 190.779712][ T5895] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 190.791345][ T5895] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 190.802425][ T5895] usb 4-1: Manufacturer: syz [ 190.821353][ T5895] usb 4-1: config 0 descriptor?? [ 191.083728][ T5846] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 191.112187][ T5895] rc_core: IR keymap rc-hauppauge not found [ 191.128370][ T5895] Registered IR keymap rc-empty [ 191.138049][ T5895] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.165974][ T5895] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.193265][ T5895] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 191.215975][ T5895] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input21 [ 191.233408][ T5895] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.243046][ T5846] usb 5-1: Using ep0 maxpacket: 8 [ 191.250716][ T5846] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 191.259545][ T5846] usb 5-1: can't read configurations, error -61 [ 191.262355][ T5895] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.292215][ T5895] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.312211][ T5895] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.340756][ T5895] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.372255][ T5895] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.392226][ T5846] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 191.392414][ T5895] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.447909][ T5895] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.492333][ T5895] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.522271][ T5895] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.549497][ T7549] netlink: 4 bytes leftover after parsing attributes in process `syz.1.449'. [ 191.582336][ T5846] usb 5-1: Using ep0 maxpacket: 8 [ 191.587579][ T5895] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 191.619126][ T5846] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 191.627115][ T5846] usb 5-1: can't read configurations, error -61 [ 191.641055][ T5846] usb usb5-port1: attempt power cycle [ 191.645784][ T5895] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 191.722084][ T5895] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 191.749195][ T7552] netlink: 208 bytes leftover after parsing attributes in process `syz.0.451'. [ 191.769031][ T5895] usb 4-1: USB disconnect, device number 21 [ 191.933149][ T6942] usb 3-1: USB disconnect, device number 23 [ 192.217440][ T5846] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 192.274975][ T5846] usb 5-1: Using ep0 maxpacket: 8 [ 192.291329][ T5846] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 192.301736][ T5846] usb 5-1: can't read configurations, error -61 [ 192.343612][ T7559] netlink: 24 bytes leftover after parsing attributes in process `syz.3.454'. [ 192.492158][ T5846] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 192.552949][ T5846] usb 5-1: Using ep0 maxpacket: 8 [ 192.560757][ T5846] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 192.588881][ T5846] usb 5-1: can't read configurations, error -61 [ 192.617988][ T5846] usb usb5-port1: unable to enumerate USB device [ 192.629039][ T7566] FAULT_INJECTION: forcing a failure. [ 192.629039][ T7566] name failslab, interval 1, probability 0, space 0, times 0 [ 192.678703][ T7566] CPU: 1 UID: 0 PID: 7566 Comm: syz.0.456 Not tainted 6.15.0-rc2-syzkaller-00493-gac71fabf1567 #0 PREEMPT(full) [ 192.678738][ T7566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 192.678751][ T7566] Call Trace: [ 192.678760][ T7566] [ 192.678769][ T7566] dump_stack_lvl+0x241/0x360 [ 192.678810][ T7566] ? __pfx_dump_stack_lvl+0x10/0x10 [ 192.678841][ T7566] ? __pfx__printk+0x10/0x10 [ 192.678876][ T7566] ? __pfx___might_resched+0x10/0x10 [ 192.678901][ T7566] should_fail_ex+0x424/0x570 [ 192.678940][ T7566] should_failslab+0xac/0x100 [ 192.678964][ T7566] kmem_cache_alloc_noprof+0x78/0x390 [ 192.678986][ T7566] ? can_rx_register+0x16b/0x730 [ 192.679013][ T7566] can_rx_register+0x16b/0x730 [ 192.679035][ T7566] ? __pfx_isotp_rcv_echo+0x10/0x10 [ 192.679070][ T7566] isotp_bind+0x4f9/0x890 [ 192.679111][ T7566] __sys_bind+0x1de/0x290 [ 192.679142][ T7566] ? __pfx___sys_bind+0x10/0x10 [ 192.679193][ T7566] __ia32_sys_bind+0x7a/0x90 [ 192.679223][ T7566] __do_fast_syscall_32+0xb4/0x110 [ 192.679247][ T7566] ? exc_page_fault+0x5f8/0x920 [ 192.679273][ T7566] do_fast_syscall_32+0x34/0x80 [ 192.679296][ T7566] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 192.679322][ T7566] RIP: 0023:0xf710d539 [ 192.679340][ T7566] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 192.679357][ T7566] RSP: 002b:00000000f50fd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000169 [ 192.679381][ T7566] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000080 [ 192.679396][ T7566] RDX: 0000000000000018 RSI: 0000000000000000 RDI: 0000000000000000 [ 192.679408][ T7566] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 192.679420][ T7566] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 192.679432][ T7566] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 192.679463][ T7566] [ 192.991769][ T7566] can: receive list entry not found for dev vxcan0, id 000, mask C00007FF [ 193.666498][ T7581] netlink: 4 bytes leftover after parsing attributes in process `syz.1.462'. [ 193.694503][ T7581] netlink: 4 bytes leftover after parsing attributes in process `syz.1.462'. [ 193.833179][ T7581] netlink: 4 bytes leftover after parsing attributes in process `syz.1.462'. [ 193.968025][ T7593] netlink: 4 bytes leftover after parsing attributes in process `syz.3.466'. [ 194.044546][ T6945] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 194.208987][ T6945] usb 3-1: Using ep0 maxpacket: 16 [ 194.249513][ T6945] usb 3-1: config 0 has an invalid interface number: 165 but max is 0 [ 194.264166][ T6945] usb 3-1: config 0 has no interface number 0 [ 194.264513][ T7600] xt_CT: No such helper "syz0" [ 194.301136][ T6945] usb 3-1: New USB device found, idVendor=0781, idProduct=0100, bcdDevice= 1.00 [ 194.328888][ T6945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.342822][ T6945] usb 3-1: Product: syz [ 194.347345][ T6945] usb 3-1: Manufacturer: syz [ 194.353380][ T6945] usb 3-1: SerialNumber: syz [ 194.408607][ T6945] usb 3-1: config 0 descriptor?? [ 194.434702][ T7614] syz_tun: entered allmulticast mode [ 194.461068][ T7614] dvmrp1: entered allmulticast mode [ 194.514112][ T7613] syz_tun: left allmulticast mode [ 194.552161][ T5895] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 194.706030][ T5895] usb 5-1: config 0 has no interfaces? [ 195.004692][ T5895] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 195.022614][ T5895] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.064495][ T5895] usb 5-1: Product: syz [ 195.073248][ T5895] usb 5-1: Manufacturer: syz [ 195.078989][ T5895] usb 5-1: SerialNumber: syz [ 195.102866][ T5895] usb 5-1: config 0 descriptor?? [ 195.203522][ T6945] usb-storage 3-1:0.165: USB Mass Storage device detected [ 195.227541][ T7621] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 195.234122][ T7621] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 195.247724][ T7621] vhci_hcd vhci_hcd.0: Device attached [ 195.256087][ T6945] usb-storage 3-1:0.165: Quirks match for vid 0781 pid 0100: 1 [ 195.276746][ T30] audit: type=1326 audit(1745225379.899:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7620 comm="syz.3.472" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705d539 code=0x0 [ 195.362796][ T6945] usb 3-1: USB disconnect, device number 24 [ 195.385821][ T7630] FAULT_INJECTION: forcing a failure. [ 195.385821][ T7630] name failslab, interval 1, probability 0, space 0, times 0 [ 195.398840][ T7630] CPU: 1 UID: 0 PID: 7630 Comm: syz.2.473 Not tainted 6.15.0-rc2-syzkaller-00493-gac71fabf1567 #0 PREEMPT(full) [ 195.398862][ T7630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 195.398872][ T7630] Call Trace: [ 195.398878][ T7630] [ 195.398885][ T7630] dump_stack_lvl+0x241/0x360 [ 195.398912][ T7630] ? __pfx_dump_stack_lvl+0x10/0x10 [ 195.398935][ T7630] ? __pfx__printk+0x10/0x10 [ 195.398954][ T7630] ? get_random_u32+0x199/0xab0 [ 195.398983][ T7630] should_fail_ex+0x424/0x570 [ 195.399011][ T7630] should_failslab+0xac/0x100 [ 195.399027][ T7630] kmem_cache_alloc_noprof+0x78/0x390 [ 195.399043][ T7630] ? sctp_get_port_local+0x796/0x1750 [ 195.399069][ T7630] sctp_get_port_local+0x796/0x1750 [ 195.399102][ T7630] ? __pfx_sctp_get_port_local+0x10/0x10 [ 195.399127][ T7630] ? sctp_bind_addr_match+0x295/0x2b0 [ 195.399148][ T7630] sctp_do_bind+0x513/0x950 [ 195.399179][ T7630] sctp_connect_new_asoc+0x2a0/0x700 [ 195.399203][ T7630] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 195.399224][ T7630] ? sctp_sendmsg+0xf30/0x3620 [ 195.399249][ T7630] ? sctp_endpoint_lookup_assoc+0xc9/0x250 [ 195.399269][ T7630] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 195.399293][ T7630] sctp_sendmsg+0x2009/0x3620 [ 195.399329][ T7630] ? __pfx_sctp_sendmsg+0x10/0x10 [ 195.399353][ T7630] ? aa_sk_perm+0x96f/0xac0 [ 195.399383][ T7630] ? inet_sendmsg+0x330/0x390 [ 195.399415][ T7630] __sock_sendmsg+0x1a6/0x270 [ 195.399437][ T7630] __sys_sendto+0x365/0x4c0 [ 195.399462][ T7630] ? __pfx___sys_sendto+0x10/0x10 [ 195.399493][ T7630] ? __fget_files+0x2a/0x420 [ 195.399514][ T7630] ? ksys_write+0x275/0x2d0 [ 195.399542][ T7630] __ia32_sys_sendto+0xdd/0x100 [ 195.399566][ T7630] __do_fast_syscall_32+0xb4/0x110 [ 195.399582][ T7630] ? exc_page_fault+0x5f8/0x920 [ 195.399601][ T7630] do_fast_syscall_32+0x34/0x80 [ 195.399617][ T7630] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 195.399636][ T7630] RIP: 0023:0xf7ff5539 [ 195.399649][ T7630] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 195.399662][ T7630] RSP: 002b:00000000f50f555c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 195.399678][ T7630] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 195.399688][ T7630] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000008005ffe4 [ 195.399697][ T7630] RBP: 000000000000001c R08: 0000000000000000 R09: 0000000000000000 [ 195.399706][ T7630] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 195.399715][ T7630] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 195.399736][ T7630] [ 195.722123][ T5895] usb 39-1: new high-speed USB device number 4 using vhci_hcd [ 195.730104][ T7623] vhci_hcd: connection closed [ 195.730806][ T7624] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 195.768586][ T7632] netlink: 14 bytes leftover after parsing attributes in process `syz.3.474'. [ 195.780247][ T992] vhci_hcd: stop threads [ 195.790446][ T992] vhci_hcd: release socket [ 195.819682][ T992] vhci_hcd: disconnect device [ 196.372959][ T6939] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 196.442197][ T5846] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 196.532267][ T6939] usb 4-1: Using ep0 maxpacket: 16 [ 196.543519][ T6939] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 196.551635][ T6939] usb 4-1: can't read configurations, error -22 [ 196.602148][ T5846] usb 3-1: Using ep0 maxpacket: 32 [ 196.609369][ T5846] usb 3-1: config 0 has an invalid interface number: 219 but max is 0 [ 196.618212][ T5846] usb 3-1: config 0 has no interface number 0 [ 196.624633][ T5846] usb 3-1: config 0 interface 219 has no altsetting 0 [ 196.631945][ T5846] usb 3-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice=30.46 [ 196.641070][ T5846] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.656046][ T5846] usb 3-1: config 0 descriptor?? [ 196.692321][ T6939] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 196.842341][ T6939] usb 4-1: Using ep0 maxpacket: 16 [ 196.851945][ T6939] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 196.871646][ T6939] usb 4-1: can't read configurations, error -22 [ 196.895249][ T6939] usb usb4-port1: attempt power cycle [ 196.982400][ T7646] netlink: 12 bytes leftover after parsing attributes in process `syz.2.480'. [ 197.044117][ T6945] usb 5-1: USB disconnect, device number 20 [ 197.091930][ T5846] usb 3-1: string descriptor 0 read error: -71 [ 197.110845][ T5846] usb 3-1: USB disconnect, device number 25 [ 197.169813][ T7652] netlink: 'syz.0.482': attribute type 4 has an invalid length. [ 197.322249][ T6939] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 197.352806][ T6939] usb 4-1: Using ep0 maxpacket: 16 [ 197.361235][ T6939] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 197.371743][ T6939] usb 4-1: can't read configurations, error -22 [ 197.512097][ T6939] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 197.532961][ T6939] usb 4-1: Using ep0 maxpacket: 16 [ 197.547627][ T6939] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 197.558084][ T6939] usb 4-1: can't read configurations, error -22 [ 197.564747][ T6939] usb usb4-port1: unable to enumerate USB device [ 198.362169][ T6939] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 198.512222][ T6939] usb 5-1: Using ep0 maxpacket: 8 [ 198.519164][ T6939] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 198.530763][ T6939] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 198.542822][ T6939] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 198.556339][ T6939] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 198.565805][ T6939] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.573948][ T6939] usb 5-1: Product: syz [ 198.578145][ T6939] usb 5-1: Manufacturer: syz [ 198.582867][ T6939] usb 5-1: SerialNumber: syz [ 198.589632][ T6939] usb 5-1: config 0 descriptor?? [ 198.597584][ T7673] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 198.664999][ T6939] rc_core: IR keymap rc-streamzap not found [ 198.671048][ T6939] Registered IR keymap rc-empty [ 198.677785][ T6939] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 198.689191][ T6942] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 198.699372][ T6939] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input22 [ 198.874175][ T6942] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 198.900030][ T6942] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 198.929629][ T6942] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.941560][ T6942] usb 1-1: Product: 䏷ꆸ䜳蒨Ѻѭ鎈깕禺⊦㧚㹋䰱懢馹 [ 198.952201][ T6942] usb 1-1: Manufacturer: 驈橾ꉑ❃壏凌峋勫덹攭宀똴묖벩쑩礎肢寜噟靾⇐篧ࠦﴇ뚎춪髚帱ሊ齐翀쎬쥜鼰擘Ⲡꞙ钡㜅㛮⊘麻䘯ਯ읬ව씨鮲댙譤캈뷢宮鰙豧ꉳ㸎艏閕鞺扖粏⎻ೱਵ䡨潭瀖ၖ᪺霘㹏讹ㆇ⭾⩄ 밉鿢멻䶂쉜䭐迼駵䜫킧蟼 [ 198.983227][ C1] vkms_vblank_simulate: vblank timer overrun [ 198.990669][ T6942] usb 1-1: SerialNumber: ᐄ [ 199.041342][ T7688] netlink: 'syz.2.493': attribute type 12 has an invalid length. [ 199.050492][ T7688] netlink: 132 bytes leftover after parsing attributes in process `syz.2.493'. [ 199.232990][ T7682] netlink: 'syz.0.491': attribute type 2 has an invalid length. [ 199.330555][ T7694] netlink: 24 bytes leftover after parsing attributes in process `syz.3.495'. [ 199.350228][ T7682] ave_0: entered promiscuous mode [ 199.376937][ T7696] netlink: 'syz.1.496': attribute type 12 has an invalid length. [ 199.391536][ T7696] netlink: 132 bytes leftover after parsing attributes in process `syz.1.496'. [ 199.400683][ T7691] netlink: 'syz.2.494': attribute type 4 has an invalid length. [ 199.533572][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.540166][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 199.721169][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 199.746647][ T7694] netlink: 'syz.3.495': attribute type 4 has an invalid length. [ 199.760341][ T7706] netlink: 'syz.1.498': attribute type 32 has an invalid length. [ 199.771701][ T7706] netlink: 24 bytes leftover after parsing attributes in process `syz.1.498'. [ 200.302330][ T5881] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 200.458157][ T5881] usb 4-1: config 0 has no interfaces? [ 200.471516][ T5881] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 200.488054][ T5881] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.497061][ T5881] usb 4-1: Product: syz [ 200.501445][ T5881] usb 4-1: Manufacturer: syz [ 200.519286][ T5881] usb 4-1: SerialNumber: syz [ 200.533784][ T5881] usb 4-1: config 0 descriptor?? [ 200.757781][ T7714] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 200.888083][ T5895] vhci_hcd: vhci_device speed not set [ 201.059390][ T5881] usb 5-1: USB disconnect, device number 21 [ 201.509409][ T6942] cdc_ncm 1-1:1.0: bind() failure [ 201.558506][ T6942] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 201.607317][ T6942] cdc_ncm 1-1:1.1: bind() failure [ 201.616268][ T7729] netlink: 'syz.1.507': attribute type 4 has an invalid length. [ 201.672601][ T6942] usb 1-1: USB disconnect, device number 18 [ 201.788836][ T7735] FAULT_INJECTION: forcing a failure. [ 201.788836][ T7735] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 201.821390][ T7735] CPU: 1 UID: 0 PID: 7735 Comm: syz.0.509 Not tainted 6.15.0-rc2-syzkaller-00493-gac71fabf1567 #0 PREEMPT(full) [ 201.821422][ T7735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 201.821435][ T7735] Call Trace: [ 201.821443][ T7735] [ 201.821452][ T7735] dump_stack_lvl+0x241/0x360 [ 201.821489][ T7735] ? __pfx_dump_stack_lvl+0x10/0x10 [ 201.821518][ T7735] ? __pfx__printk+0x10/0x10 [ 201.821557][ T7735] should_fail_ex+0x424/0x570 [ 201.821592][ T7735] _copy_to_user+0x31/0xb0 [ 201.821621][ T7735] simple_read_from_buffer+0xc4/0x170 [ 201.821655][ T7735] proc_fail_nth_read+0x1ef/0x260 [ 201.821678][ T7735] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 201.821702][ T7735] ? rw_verify_area+0x246/0x630 [ 201.821729][ T7735] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 201.821751][ T7735] vfs_read+0x21f/0xb90 [ 201.821801][ T7735] ? __pfx___mutex_lock+0x10/0x10 [ 201.821824][ T7735] ? __pfx_vfs_read+0x10/0x10 [ 201.821856][ T7735] ? __fget_files+0x2a/0x420 [ 201.821878][ T7735] ? __fget_files+0x39d/0x420 [ 201.821895][ T7735] ? __fget_files+0x2a/0x420 [ 201.821933][ T7735] ksys_read+0x19d/0x2d0 [ 201.821964][ T7735] ? __pfx_ksys_read+0x10/0x10 [ 201.821999][ T7735] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 201.822019][ T7735] ? lockdep_hardirqs_on+0x9d/0x150 [ 201.822042][ T7735] __do_fast_syscall_32+0xb4/0x110 [ 201.822064][ T7735] ? exc_page_fault+0x5f8/0x920 [ 201.822089][ T7735] do_fast_syscall_32+0x34/0x80 [ 201.822111][ T7735] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 201.822137][ T7735] RIP: 0023:0xf710d539 [ 201.822154][ T7735] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 201.822173][ T7735] RSP: 002b:00000000f50fd590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 201.822195][ T7735] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f50fd620 [ 201.822210][ T7735] RDX: 000000000000000f RSI: 00000000f7472ff4 RDI: 0000000000000000 [ 201.822222][ T7735] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 201.822234][ T7735] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 201.822247][ T7735] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 201.822277][ T7735] [ 202.044961][ C1] vkms_vblank_simulate: vblank timer overrun [ 202.450866][ T7742] netlink: 4 bytes leftover after parsing attributes in process `syz.1.511'. [ 202.467492][ T7747] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 202.474084][ T7747] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 202.489311][ T7742] netlink: 12 bytes leftover after parsing attributes in process `syz.1.511'. [ 202.509312][ T7747] vhci_hcd vhci_hcd.0: Device attached [ 202.553086][ T6939] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 202.575451][ T30] audit: type=1326 audit(1745225387.199:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7745 comm="syz.0.514" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf710d539 code=0x0 [ 202.702307][ T6962] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 202.712132][ T6939] usb 5-1: Using ep0 maxpacket: 16 [ 202.721815][ T6939] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 202.739105][ T6939] usb 5-1: New USB device found, idVendor=046d, idProduct=c513, bcdDevice= 0.00 [ 202.753479][ T6942] usb 33-1: new high-speed USB device number 3 using vhci_hcd [ 202.761427][ T6939] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.772792][ T6939] usb 5-1: config 0 descriptor?? [ 202.864210][ T6962] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 202.878141][ T6962] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 202.889176][ T6962] usb 3-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 202.901406][ T6962] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.913864][ T6962] usb 3-1: config 0 descriptor?? [ 202.982306][ T5895] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 202.998227][ T7740] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 203.009904][ T7740] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 203.132159][ T5895] usb 2-1: Using ep0 maxpacket: 8 [ 203.138428][ T6962] hid-led 0003:27B8:01ED.000C: item fetching failed at offset 3/5 [ 203.148429][ T5895] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 203.159608][ T6962] hid-led 0003:27B8:01ED.000C: probe with driver hid-led failed with error -22 [ 203.168989][ T5895] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 203.192952][ T5895] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.207069][ T5895] usb 2-1: config 0 descriptor?? [ 203.226775][ T6939] logitech-djreceiver 0003:046D:C513.000D: unknown main item tag 0x0 [ 203.247983][ T6939] logitech-djreceiver 0003:046D:C513.000D: unknown main item tag 0x0 [ 203.258195][ T6939] logitech-djreceiver 0003:046D:C513.000D: unknown main item tag 0x0 [ 203.269361][ T6939] logitech-djreceiver 0003:046D:C513.000D: unknown main item tag 0x0 [ 203.278741][ T6939] logitech-djreceiver 0003:046D:C513.000D: unknown main item tag 0x0 [ 203.302167][ T7748] vhci_hcd: connection reset by peer [ 203.313866][ T4737] vhci_hcd: stop threads [ 203.331754][ T6962] usb 3-1: USB disconnect, device number 26 [ 203.339443][ T4737] vhci_hcd: release socket [ 203.356329][ T4737] vhci_hcd: disconnect device [ 203.389723][ T6945] usb 4-1: USB disconnect, device number 26 [ 203.421441][ T5895] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 203.457320][ T5881] usb 5-1: USB disconnect, device number 22 [ 203.536372][ T7759] netlink: 20 bytes leftover after parsing attributes in process `syz.3.516'. [ 203.897998][ T5846] usb 2-1: USB disconnect, device number 22 [ 204.202267][ T6939] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 204.244778][ T5881] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 204.283723][ T5931] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 204.372122][ T6939] usb 3-1: Using ep0 maxpacket: 16 [ 204.379524][ T6939] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8 has an invalid bInterval 0, changing to 7 [ 204.390433][ T6939] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 204.402420][ T5881] usb 1-1: Using ep0 maxpacket: 8 [ 204.403686][ T6939] usb 3-1: New USB device found, idVendor=077d, idProduct=0410, bcdDevice=ec.c1 [ 204.417017][ T6939] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.425318][ T6939] usb 3-1: Product: syz [ 204.429618][ T6939] usb 3-1: Manufacturer: syz [ 204.429710][ T5881] usb 1-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 204.434587][ T6939] usb 3-1: SerialNumber: syz [ 204.465836][ T5931] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 204.466257][ T5881] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.484937][ T5931] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 204.484970][ T5931] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.493844][ T6939] usb 3-1: config 0 descriptor?? [ 204.503374][ T5881] usb 1-1: Product: syz [ 204.508544][ T5931] usb 5-1: config 0 descriptor?? [ 204.547337][ T5881] usb 1-1: Manufacturer: syz [ 204.564015][ T5881] usb 1-1: SerialNumber: syz [ 204.583758][ T5881] usb 1-1: config 0 descriptor?? [ 204.604738][ T5881] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 204.618817][ T5881] usb 1-1: setting power ON [ 204.625364][ T5881] dvb-usb: bulk message failed: -22 (2/0) [ 204.640735][ T5881] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 204.659747][ T5881] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 204.669430][ T5881] usb 1-1: media controller created [ 204.706138][ T5881] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 204.727125][ T5931] usbhid 5-1:0.0: can't add hid device: -71 [ 204.745909][ T6939] powermate 3-1:0.0: probe with driver powermate failed with error -5 [ 204.757524][ T5881] usb 1-1: selecting invalid altsetting 6 [ 204.764799][ T5931] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 204.767461][ T5881] usb 1-1: digital interface selection failed (-22) [ 204.786826][ T5881] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 204.794386][ T6939] usb 3-1: USB disconnect, device number 27 [ 204.803460][ T5881] usb 1-1: setting power OFF [ 204.809461][ T5881] dvb-usb: bulk message failed: -22 (2/0) [ 204.817219][ T7773] netlink: 'syz.3.522': attribute type 4 has an invalid length. [ 204.819163][ T5931] usb 5-1: USB disconnect, device number 23 [ 204.832152][ T5881] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 204.868372][ T5881] (NULL device *): no alternate interface [ 204.989845][ T5881] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 205.028677][ T5881] usb 1-1: USB disconnect, device number 19 [ 205.232224][ T5931] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 205.405493][ T5931] usb 5-1: Using ep0 maxpacket: 32 [ 205.416417][ T5931] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 205.439218][ T5931] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 205.467233][ T5931] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.497322][ T5931] usb 5-1: config 0 descriptor?? [ 205.515937][ T5931] ldusb 5-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 205.569694][ T5931] ldusb 5-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 205.964513][ T7771] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 205.973657][ T7771] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 205.997966][ T7808] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 206.012212][ T6944] usb 5-1: USB disconnect, device number 24 [ 206.033362][ T7808] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 206.047548][ T6944] ldusb 5-1:0.0: LD USB Device #0 now disconnected [ 206.950303][ T30] audit: type=1326 audit(1745225391.559:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7813 comm="syz.2.539" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff5539 code=0x7ffc0000 [ 206.972096][ C1] vkms_vblank_simulate: vblank timer overrun [ 207.024302][ T12] batadv0: left promiscuous mode [ 207.031136][ T12] bridge0: port 3(batadv0) entered disabled state [ 207.075822][ T30] audit: type=1326 audit(1745225391.629:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7813 comm="syz.2.539" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff5539 code=0x7ffc0000 [ 207.172413][ T12] bridge_slave_1: left promiscuous mode [ 207.179221][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.254915][ T12] bridge_slave_0: left promiscuous mode [ 207.271972][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.351352][ T7834] FAULT_INJECTION: forcing a failure. [ 207.351352][ T7834] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 207.378421][ T7834] CPU: 1 UID: 0 PID: 7834 Comm: syz.0.544 Not tainted 6.15.0-rc2-syzkaller-00493-gac71fabf1567 #0 PREEMPT(full) [ 207.378453][ T7834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 207.378466][ T7834] Call Trace: [ 207.378474][ T7834] [ 207.378483][ T7834] dump_stack_lvl+0x241/0x360 [ 207.378521][ T7834] ? __pfx_dump_stack_lvl+0x10/0x10 [ 207.378551][ T7834] ? __pfx__printk+0x10/0x10 [ 207.378590][ T7834] should_fail_ex+0x424/0x570 [ 207.378627][ T7834] _copy_to_user+0x31/0xb0 [ 207.378656][ T7834] simple_read_from_buffer+0xc4/0x170 [ 207.378690][ T7834] proc_fail_nth_read+0x1ef/0x260 [ 207.378714][ T7834] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 207.378737][ T7834] ? rw_verify_area+0x246/0x630 [ 207.378763][ T7834] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 207.378785][ T7834] vfs_read+0x21f/0xb90 [ 207.378817][ T7834] ? __pfx___mutex_lock+0x10/0x10 [ 207.378840][ T7834] ? __pfx_vfs_read+0x10/0x10 [ 207.378871][ T7834] ? __fget_files+0x2a/0x420 [ 207.378892][ T7834] ? __fget_files+0x39d/0x420 [ 207.378910][ T7834] ? __fget_files+0x2a/0x420 [ 207.378938][ T7834] ksys_read+0x19d/0x2d0 [ 207.378968][ T7834] ? __pfx_ksys_read+0x10/0x10 [ 207.378998][ T7834] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 207.379018][ T7834] ? lockdep_hardirqs_on+0x9d/0x150 [ 207.379041][ T7834] __do_fast_syscall_32+0xb4/0x110 [ 207.379063][ T7834] ? exc_page_fault+0x5f8/0x920 [ 207.379087][ T7834] do_fast_syscall_32+0x34/0x80 [ 207.379109][ T7834] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 207.379131][ T7834] RIP: 0023:0xf710d539 [ 207.379147][ T7834] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 207.379164][ T7834] RSP: 002b:00000000f50fd590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 207.379186][ T7834] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000f50fd620 [ 207.379199][ T7834] RDX: 000000000000000f RSI: 00000000f7472ff4 RDI: 0000000000000000 [ 207.379211][ T7834] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 207.379222][ T7834] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 207.379234][ T7834] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 207.379262][ T7834] [ 207.604843][ C1] vkms_vblank_simulate: vblank timer overrun [ 207.713651][ T7839] dlm: no locking on control device [ 207.742196][ T5931] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 207.766027][ T5851] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 207.792770][ T5851] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 207.801648][ T5851] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 207.819281][ T7839] xt_CT: No such helper "snmp" [ 207.832754][ T6942] vhci_hcd: vhci_device speed not set [ 207.841351][ T5851] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 207.865513][ T5851] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 207.912211][ T5931] usb 2-1: Using ep0 maxpacket: 32 [ 207.948824][ T5842] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 207.960174][ T5842] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 207.962564][ T5931] usb 2-1: config 0 has an invalid interface number: 219 but max is 0 [ 207.969101][ T5842] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 207.989947][ T5842] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 208.021675][ T5931] usb 2-1: config 0 has no interface number 0 [ 208.021946][ T5842] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 208.057705][ T5931] usb 2-1: config 0 interface 219 has no altsetting 0 [ 208.106092][ T5931] usb 2-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice=30.46 [ 208.170189][ T5931] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.203303][ T5931] usb 2-1: config 0 descriptor?? [ 208.496481][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 208.508629][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 208.518833][ T12] bond0 (unregistering): Released all slaves [ 208.674060][ T7828] netlink: 12 bytes leftover after parsing attributes in process `syz.1.541'. [ 208.793514][ T5931] usb 2-1: string descriptor 0 read error: -71 [ 208.822092][ T5931] usb 2-1: USB disconnect, device number 23 [ 208.995318][ T6939] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 209.066301][ T12] hsr_slave_0: left promiscuous mode [ 209.089229][ T12] hsr_slave_1: left promiscuous mode [ 209.098771][ T12] batman_adv: batadv0: Removing interface: dummy0 [ 209.114388][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 209.166632][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 209.192114][ T6939] usb 3-1: Using ep0 maxpacket: 16 [ 209.217383][ T6939] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 209.236458][ T6939] usb 3-1: config 0 has no interface number 0 [ 209.262153][ T6939] usb 3-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 209.282549][ T6939] usb 3-1: config 0 interface 41 altsetting 2 endpoint 0x82 has invalid maxpacket 16448, setting to 1024 [ 209.332046][ T6939] usb 3-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 1024 [ 209.372312][ T6945] usb 5-1: new full-speed USB device number 25 using dummy_hcd [ 209.382275][ T6939] usb 3-1: config 0 interface 41 has no altsetting 0 [ 209.408246][ T6939] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 209.417928][ T6939] usb 3-1: New USB device strings: Mfr=39, Product=2, SerialNumber=3 [ 209.451219][ T7871] cgroup: fork rejected by pids controller in /syz4 [ 209.464701][ T6939] usb 3-1: Product: syz [ 209.475953][ T6939] usb 3-1: Manufacturer: syz [ 209.489814][ T6939] usb 3-1: SerialNumber: syz [ 209.527027][ T6939] usb 3-1: config 0 descriptor?? [ 209.540416][ T7861] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 209.566048][ T6945] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 209.566728][ T7861] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 209.597281][ T6945] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 209.631497][ T6945] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 209.665723][ T6945] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 209.690925][ T6945] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 209.729350][ T6945] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 209.739934][ T6945] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 209.757122][ T6945] usb 5-1: Product: syz [ 209.761443][ T6945] usb 5-1: Manufacturer: syz [ 209.800155][ T6945] usb 5-1: SerialNumber: syz [ 209.810546][ T7861] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 209.830136][ T6945] usb 5-1: config 0 descriptor?? [ 209.835234][ T7861] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 210.082290][ T5851] Bluetooth: hci4: command tx timeout [ 210.100408][ T6945] radio-si470x 5-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 210.111504][ T6945] radio-si470x 5-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 210.249588][ T7861] netlink: 4 bytes leftover after parsing attributes in process `syz.2.548'. [ 210.301304][ T6945] radio-si470x 5-1:0.0: software version 0, hardware version 0 [ 210.312113][ T6945] radio-si470x 5-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 210.362483][ T6945] radio-si470x 5-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 210.486348][ T12] team0 (unregistering): Port device team_slave_1 removed [ 210.507508][ T6945] radio-si470x 5-1:0.0: submitting int urb failed (-90) [ 210.571750][ T12] team0 (unregistering): Port device team_slave_0 removed [ 210.614317][ T6939] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -22 [ 211.343019][ T6945] radio-si470x 5-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 211.362113][ T6945] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -22 [ 211.432692][ T6945] usb 5-1: USB disconnect, device number 25 [ 211.628631][ T7927] netlink: 52 bytes leftover after parsing attributes in process `syz.1.554'. [ 211.831492][ T7853] chnl_net:caif_netlink_parms(): no params data found [ 212.162316][ T5851] Bluetooth: hci4: command tx timeout [ 212.382910][ T5931] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 212.460390][ T7853] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.487028][ T12] IPVS: stop unused estimator thread 0... [ 212.493426][ T7853] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.500701][ T7853] bridge_slave_0: entered allmulticast mode [ 212.535330][ T7853] bridge_slave_0: entered promiscuous mode [ 212.583917][ T7853] bridge0: port 2(bridge_slave_1) entered blocking state [ 212.599342][ T7853] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.611508][ T5931] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 212.619818][ T7853] bridge_slave_1: entered allmulticast mode [ 212.641189][ T7853] bridge_slave_1: entered promiscuous mode [ 212.673102][ T5931] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 212.722101][ T5931] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 213.078596][ T5931] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 213.106530][ T5931] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 213.137516][ T5931] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 213.145950][ T5931] usb 5-1: Manufacturer: syz [ 213.171694][ T5931] usb 5-1: config 0 descriptor?? [ 213.200321][ T7853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 213.268311][ T7853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 213.480383][ T7853] team0: Port device team_slave_0 added [ 213.502374][ T5931] rc_core: IR keymap rc-hauppauge not found [ 213.525052][ T5931] Registered IR keymap rc-empty [ 213.531593][ T7853] team0: Port device team_slave_1 added [ 213.545696][ T5931] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 213.582239][ T5931] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 213.626244][ T5931] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 213.682386][ T5931] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input23 [ 213.729127][ T5931] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 213.866441][ T5931] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 213.885815][ T7853] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 213.915697][ T7853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 214.297324][ T6945] usb 3-1: USB disconnect, device number 28 [ 214.306628][ T5851] Bluetooth: hci4: command tx timeout [ 214.345363][ T5931] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 214.347450][ T7853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 214.426258][ T5931] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 214.451947][ T7853] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 214.510937][ T7853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 214.540785][ T7982] dlm: no locking on control device [ 214.548942][ T5931] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 214.594837][ T5931] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 214.610669][ T7853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 214.623502][ T5931] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 214.735425][ T5931] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 214.787737][ T5931] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 214.929346][ T5931] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 215.064001][ T5931] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 215.266246][ T5931] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 215.296008][ T5931] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 215.349790][ T7997] netlink: 64 bytes leftover after parsing attributes in process `syz.2.566'. [ 215.360087][ T5931] usb 5-1: USB disconnect, device number 26 [ 215.549749][ T7853] hsr_slave_0: entered promiscuous mode [ 215.610847][ T7853] hsr_slave_1: entered promiscuous mode [ 215.659878][ T7853] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 215.659931][ T7853] Cannot create hsr debugfs directory [ 216.332251][ T5851] Bluetooth: hci4: command tx timeout [ 217.384771][ T8029] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 217.666773][ T5931] usb 2-1: new full-speed USB device number 24 using dummy_hcd [ 217.746821][ T7853] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 217.853988][ T30] audit: type=1326 audit(1745225402.469:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8032 comm="syz.4.577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb6539 code=0x7ffc0000 [ 217.875821][ C1] vkms_vblank_simulate: vblank timer overrun [ 217.894708][ T5931] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 217.912159][ T30] audit: type=1326 audit(1745225402.469:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8032 comm="syz.4.577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=30 compat=1 ip=0xf7fb6539 code=0x7ffc0000 [ 217.927026][ T5931] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 217.985442][ T5931] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 218.127566][ T5931] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 218.173724][ T30] audit: type=1326 audit(1745225402.469:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8032 comm="syz.4.577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb6539 code=0x7ffc0000 [ 218.195291][ T5931] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 218.208226][ T5931] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 218.229956][ T5931] usb 2-1: Manufacturer: syz [ 218.250586][ T5931] usb 2-1: config 0 descriptor?? [ 218.321072][ T7853] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 218.332129][ T30] audit: type=1326 audit(1745225402.469:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8032 comm="syz.4.577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb6539 code=0x7ffc0000 [ 218.355815][ T7853] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 218.375127][ T30] audit: type=1326 audit(1745225402.469:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8032 comm="syz.4.577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=288 compat=1 ip=0xf7fb6539 code=0x7ffc0000 [ 218.419970][ T7853] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 218.513219][ T30] audit: type=1326 audit(1745225402.469:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8032 comm="syz.4.577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb6539 code=0x7ffc0000 [ 218.618834][ T30] audit: type=1326 audit(1745225402.469:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8032 comm="syz.4.577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf7fb6539 code=0x7ffc0000 [ 218.752407][ T5931] rc_core: IR keymap rc-hauppauge not found [ 218.758415][ T5931] Registered IR keymap rc-empty [ 218.792169][ T5931] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 218.819720][ T30] audit: type=1326 audit(1745225402.469:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8032 comm="syz.4.577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb6539 code=0x7ffc0000 [ 218.852138][ T5931] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 218.861168][ T8041] netlink: 52 bytes leftover after parsing attributes in process `syz.0.579'. [ 218.890434][ T5931] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 218.910066][ T30] audit: type=1326 audit(1745225402.479:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8032 comm="syz.4.577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fb6539 code=0x7ffc0000 [ 218.940636][ T5931] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input24 [ 219.012705][ T5931] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 219.031035][ T30] audit: type=1326 audit(1745225402.529:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8032 comm="syz.4.577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7fb6539 code=0x7ffc0000 [ 219.052278][ T5931] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 219.092305][ T5931] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 219.152847][ T5931] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 219.214232][ T5931] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 219.259091][ T7853] 8021q: adding VLAN 0 to HW filter on device bond0 [ 219.273652][ T5931] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 219.302720][ T5931] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 219.334972][ T5931] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 219.346153][ T7853] 8021q: adding VLAN 0 to HW filter on device team0 [ 219.355817][ T5931] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 219.373730][ T5931] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 219.378673][ T992] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.392268][ T5931] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 219.397056][ T992] bridge0: port 1(bridge_slave_0) entered forwarding state [ 219.444281][ T81] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.444427][ T81] bridge0: port 2(bridge_slave_1) entered forwarding state [ 219.460145][ T5931] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 219.460176][ T5931] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 219.490795][ T5931] usb 2-1: USB disconnect, device number 24 [ 219.738341][ T7853] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 219.926100][ T7853] veth0_vlan: entered promiscuous mode [ 220.015314][ T7853] veth1_vlan: entered promiscuous mode [ 220.115574][ T7853] veth0_macvtap: entered promiscuous mode [ 220.158713][ T8073] FAULT_INJECTION: forcing a failure. [ 220.158713][ T8073] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 220.198200][ T7853] veth1_macvtap: entered promiscuous mode [ 220.213445][ T8073] CPU: 0 UID: 0 PID: 8073 Comm: syz.0.585 Not tainted 6.15.0-rc2-syzkaller-00493-gac71fabf1567 #0 PREEMPT(full) [ 220.213477][ T8073] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 220.213490][ T8073] Call Trace: [ 220.213499][ T8073] [ 220.213508][ T8073] dump_stack_lvl+0x241/0x360 [ 220.213556][ T8073] ? __pfx_dump_stack_lvl+0x10/0x10 [ 220.213587][ T8073] ? __pfx__printk+0x10/0x10 [ 220.213630][ T8073] should_fail_ex+0x424/0x570 [ 220.213668][ T8073] _copy_from_user+0x2d/0xb0 [ 220.213697][ T8073] ucma_query_route+0x10c/0xa30 [ 220.213733][ T8073] ? __pfx_ucma_query_route+0x10/0x10 [ 220.213801][ T8073] ? __pfx_ucma_query_route+0x10/0x10 [ 220.213827][ T8073] ucma_write+0x2db/0x430 [ 220.213860][ T8073] ? __pfx_ucma_write+0x10/0x10 [ 220.213886][ T8073] ? bpf_lsm_file_permission+0x9/0x10 [ 220.213917][ T8073] ? rw_verify_area+0x246/0x630 [ 220.213944][ T8073] ? __pfx_ucma_write+0x10/0x10 [ 220.213973][ T8073] vfs_write+0x2bc/0xd10 [ 220.214020][ T8073] ? __pfx_vfs_write+0x10/0x10 [ 220.214050][ T8073] ? __fget_files+0x2a/0x420 [ 220.214070][ T8073] ? __fget_files+0x2a/0x420 [ 220.214091][ T8073] ? __fget_files+0x39d/0x420 [ 220.214109][ T8073] ? __fget_files+0x2a/0x420 [ 220.214138][ T8073] ksys_write+0x19d/0x2d0 [ 220.214169][ T8073] ? __pfx_ksys_write+0x10/0x10 [ 220.214201][ T8073] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 220.214224][ T8073] ? lockdep_hardirqs_on+0x9d/0x150 [ 220.214248][ T8073] __do_fast_syscall_32+0xb4/0x110 [ 220.214270][ T8073] ? exc_page_fault+0x5f8/0x920 [ 220.214295][ T8073] do_fast_syscall_32+0x34/0x80 [ 220.214318][ T8073] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 220.214343][ T8073] RIP: 0023:0xf710d539 [ 220.214361][ T8073] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 220.214379][ T8073] RSP: 002b:00000000f50fd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 220.214402][ T8073] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 220.214416][ T8073] RDX: 0000000000000018 RSI: 0000000000000000 RDI: 0000000000000000 [ 220.214445][ T8073] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 220.214457][ T8073] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 220.214469][ T8073] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 220.214499][ T8073] [ 220.501228][ T8078] netlink: 24 bytes leftover after parsing attributes in process `syz.1.588'. [ 220.737368][ T7853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 220.748483][ T7853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 220.891304][ T7853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 220.902993][ T7853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 220.913353][ T7853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 220.932400][ T7853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 220.960506][ T7853] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 220.977746][ T8093] FAULT_INJECTION: forcing a failure. [ 220.977746][ T8093] name failslab, interval 1, probability 0, space 0, times 0 [ 221.005343][ T7853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 221.020518][ T8093] CPU: 0 UID: 0 PID: 8093 Comm: syz.1.590 Not tainted 6.15.0-rc2-syzkaller-00493-gac71fabf1567 #0 PREEMPT(full) [ 221.020549][ T8093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 221.020561][ T8093] Call Trace: [ 221.020569][ T8093] [ 221.020578][ T8093] dump_stack_lvl+0x241/0x360 [ 221.020615][ T8093] ? __pfx_dump_stack_lvl+0x10/0x10 [ 221.020645][ T8093] ? __pfx__printk+0x10/0x10 [ 221.020677][ T8093] ? __pfx___might_resched+0x10/0x10 [ 221.020702][ T8093] should_fail_ex+0x424/0x570 [ 221.020737][ T8093] should_failslab+0xac/0x100 [ 221.020760][ T8093] __kmalloc_noprof+0xdf/0x4d0 [ 221.020782][ T8093] ? tomoyo_encode+0x26f/0x540 [ 221.020814][ T8093] tomoyo_encode+0x26f/0x540 [ 221.020865][ T8093] tomoyo_realpath_from_path+0x59e/0x5e0 [ 221.020908][ T8093] tomoyo_path_number_perm+0x245/0x790 [ 221.020932][ T8093] ? __lock_acquire+0xad5/0xd80 [ 221.020963][ T8093] ? tomoyo_path_number_perm+0x215/0x790 [ 221.020990][ T8093] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 221.021056][ T8093] ? __fget_files+0x2a/0x420 [ 221.021075][ T8093] ? __fget_files+0x2a/0x420 [ 221.021098][ T8093] ? __fget_files+0x2a/0x420 [ 221.021124][ T8093] security_file_ioctl_compat+0xc6/0x2a0 [ 221.021150][ T8093] __ia32_compat_sys_ioctl+0x128/0xc90 [ 221.021179][ T8093] ? __fget_files+0x2a/0x420 [ 221.021198][ T8093] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 221.021226][ T8093] ? __fget_files+0x2a/0x420 [ 221.021253][ T8093] ? fput+0x9b/0xd0 [ 221.021272][ T8093] ? ksys_write+0x275/0x2d0 [ 221.021309][ T8093] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 221.021332][ T8093] ? lockdep_hardirqs_on+0x9d/0x150 [ 221.021356][ T8093] __do_fast_syscall_32+0xb4/0x110 [ 221.021377][ T8093] ? exc_page_fault+0x5f8/0x920 [ 221.021403][ T8093] do_fast_syscall_32+0x34/0x80 [ 221.021426][ T8093] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 221.021451][ T8093] RIP: 0023:0xf7f92539 [ 221.021470][ T8093] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 221.021488][ T8093] RSP: 002b:00000000f50b655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 221.021510][ T8093] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c008561c [ 221.021525][ T8093] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 221.021537][ T8093] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 221.021549][ T8093] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 221.021561][ T8093] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 221.021591][ T8093] [ 221.021613][ T8093] ERROR: Out of memory at tomoyo_realpath_from_path. [ 221.244255][ T5931] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 221.293477][ T7853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 221.325664][ T7853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 221.376982][ T7853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 221.438873][ T7853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 221.450098][ T7853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 221.471964][ T7853] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 221.504709][ T5931] usb 5-1: config 0 has no interfaces? [ 221.545866][ T7853] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.593136][ T5931] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 221.613393][ T7853] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.637177][ T7853] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.641541][ T5931] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.650275][ T7853] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.660154][ T5931] usb 5-1: Product: syz [ 221.667329][ T5931] usb 5-1: Manufacturer: syz [ 221.707010][ T5931] usb 5-1: SerialNumber: syz [ 221.729673][ T5931] usb 5-1: config 0 descriptor?? [ 221.952436][ T6945] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 222.054356][ T7853] batman_adv: The newly added mac address (08:02:11:00:00:00) already exists on: macsec1 [ 222.086146][ T7853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 222.142785][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 222.150674][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 222.161291][ T6945] usb 1-1: config 0 has an invalid interface number: 95 but max is 0 [ 222.171042][ T6945] usb 1-1: config 0 has no interface number 0 [ 222.178303][ T6945] usb 1-1: config 0 interface 95 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 222.193536][ T6945] usb 1-1: New USB device found, idVendor=7725, idProduct=b0a8, bcdDevice= 7.46 [ 222.206406][ T6945] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.225149][ T6945] usb 1-1: Product: syz [ 222.230889][ T6945] usb 1-1: Manufacturer: syz [ 222.253220][ T6945] usb 1-1: SerialNumber: syz [ 222.291497][ T6945] usb 1-1: config 0 descriptor?? [ 222.307148][ T8101] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 222.315180][ T6962] usb 2-1: new full-speed USB device number 25 using dummy_hcd [ 222.378717][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 222.411468][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 222.499513][ T6962] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 222.510032][ T6962] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 222.555256][ T6962] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 222.583255][ T6945] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 222.596689][ T6962] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 222.612098][ T6945] usb 1-1: MIDIStreaming interface descriptor not found [ 222.650784][ T6962] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 222.690563][ T6962] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 222.735700][ T6962] usb 2-1: Manufacturer: syz [ 222.743076][ T6945] usb 1-1: USB disconnect, device number 20 [ 222.767289][ T6962] usb 2-1: config 0 descriptor?? [ 223.028823][ T6930] udevd[6930]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.95/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 223.132775][ T6962] rc_core: IR keymap rc-hauppauge not found [ 223.151506][ T6962] Registered IR keymap rc-empty [ 223.169498][ T6962] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 223.203253][ T6962] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 223.241129][ T8129] xt_CT: You must specify a L4 protocol and not use inversions on it [ 223.259861][ T6962] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 223.310039][ T6962] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input25 [ 223.339622][ T6962] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 223.376183][ T6962] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 223.404258][ T6962] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 223.421743][ T8135] netlink: 24 bytes leftover after parsing attributes in process `syz.2.599'. [ 223.452303][ T6962] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 223.482183][ T6962] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 223.526562][ T6962] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 223.592261][ T6962] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 223.622871][ T6962] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 223.712173][ T6962] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 223.743381][ T6962] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 223.759833][ T8142] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 223.776158][ T5895] usb 5-1: USB disconnect, device number 27 [ 223.800742][ T6962] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 223.832724][ T8142] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 223.862419][ T6962] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 223.893991][ T6962] usb 2-1: USB disconnect, device number 25 [ 223.946016][ T8147] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 223.965934][ T8145] netlink: 8 bytes leftover after parsing attributes in process `syz.1.602'. [ 224.032986][ T8145] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 224.042674][ T6945] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 224.061623][ T8147] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 224.081433][ T8145] macvlan2: entered promiscuous mode [ 224.252509][ T6945] usb 1-1: Using ep0 maxpacket: 16 [ 224.272853][ T6945] usb 1-1: config 1 descriptor has 1 excess byte, ignoring [ 224.305336][ T6945] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 224.340665][ T6945] usb 1-1: config 1 has no interface number 1 [ 224.351098][ T6945] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 224.374105][ T6945] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 224.398745][ T6945] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.428521][ T6945] usb 1-1: Product: syz [ 224.441276][ T6945] usb 1-1: Manufacturer: syz [ 224.454768][ T6945] usb 1-1: SerialNumber: syz [ 224.684293][ T6945] usb 1-1: 2:1 : no or invalid class specific endpoint descriptor [ 224.858839][ T6945] usb 1-1: 2:1 : format type 0 is detected, processed as PCM [ 224.899488][ T6945] usb 1-1: 2:1 : sample bitwidth 189 in over sample bytes 4 [ 224.932897][ T6945] usb 1-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 225.150813][ T6945] usb 1-1: USB disconnect, device number 21 [ 225.398034][ T6931] udevd[6931]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 225.501290][ T13] bond0: (slave bond_slave_0): interface is now down [ 225.506333][ T8185] netlink: 'syz.0.610': attribute type 10 has an invalid length. [ 225.595761][ T8185] team0: Device bond0 is up. Set it down before adding it as a team port [ 225.636308][ T6962] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 225.659697][ T13] bond0: (slave bond_slave_1): interface is now down [ 225.725170][ T13] bond0: now running without any active interface! [ 225.917049][ T8192] netlink: 24 bytes leftover after parsing attributes in process `syz.1.612'. [ 226.013967][ T6962] usb 3-1: config 0 has no interfaces? [ 226.037007][ T6962] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 226.047402][ T6962] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.057568][ T6962] usb 3-1: Product: syz [ 226.061762][ T6962] usb 3-1: Manufacturer: syz [ 226.077158][ T6962] usb 3-1: SerialNumber: syz [ 226.091895][ T6962] usb 3-1: config 0 descriptor?? [ 226.332101][ T5895] usb 1-1: new full-speed USB device number 22 using dummy_hcd [ 226.568703][ T5895] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 226.633182][ T5895] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 226.671018][ T5895] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 226.711043][ T5895] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 226.754981][ T8213] netlink: 24 bytes leftover after parsing attributes in process `syz.4.617'. [ 226.783503][ T5895] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 226.822560][ T5895] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 226.830637][ T5895] usb 1-1: Manufacturer: syz [ 226.904161][ T5895] usb 1-1: config 0 descriptor?? [ 227.056855][ T5931] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 227.266233][ T5931] usb 6-1: Using ep0 maxpacket: 16 [ 227.274106][ T5931] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 227.302223][ T5895] rc_core: IR keymap rc-hauppauge not found [ 227.308336][ T5895] Registered IR keymap rc-empty [ 227.319417][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 227.342518][ T5931] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 227.364408][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 227.380816][ T5931] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 227.403213][ T5895] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 227.461014][ T5895] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input26 [ 227.476153][ T5931] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 227.517211][ T5931] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.543931][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 227.584879][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 227.597466][ T5931] usb 6-1: config 0 descriptor?? [ 227.641742][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 227.759460][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 227.813894][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 227.876584][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 227.941364][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 227.973337][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 227.986291][ T8231] bridge0: entered promiscuous mode [ 228.001947][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 228.022186][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 228.163436][ T8231] bridge0: left promiscuous mode [ 228.201932][ T5895] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 228.251708][ T5895] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 228.291834][ T5931] microsoft 0003:045E:07DA.000E: No inputs registered, leaving [ 228.316186][ T5895] usb 1-1: USB disconnect, device number 22 [ 228.478489][ T5931] microsoft 0003:045E:07DA.000E: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 228.561105][ T5931] microsoft 0003:045E:07DA.000E: no inputs found [ 228.591554][ T5931] microsoft 0003:045E:07DA.000E: could not initialize ff, continuing anyway [ 228.634159][ T5895] usb 3-1: USB disconnect, device number 29 [ 228.670958][ T5931] usb 6-1: USB disconnect, device number 2 [ 229.225002][ T8249] netlink: 40 bytes leftover after parsing attributes in process `syz.2.624'. [ 229.402914][ T8249] netlink: 'syz.2.624': attribute type 4 has an invalid length. [ 229.873048][ T5895] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 229.937097][ T6942] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 230.066835][ T5895] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 230.083523][ T5895] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 230.122403][ T6942] usb 6-1: Using ep0 maxpacket: 32 [ 230.127789][ T5895] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 230.161492][ T5895] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 230.173201][ T6942] usb 6-1: config 1 interface 0 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 230.202389][ T6942] usb 6-1: config 1 interface 0 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024 [ 230.228685][ T6942] usb 6-1: config 1 interface 0 has no altsetting 0 [ 230.236956][ T5895] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 230.241443][ T6942] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 230.275392][ T5895] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 230.292723][ T6942] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.302130][ T5895] usb 1-1: Manufacturer: syz [ 230.311277][ T6942] usb 6-1: Product: 尺ꋒ䵁痘ᢱ朎Ꮪ퓮莼關嶳㮻汥휘䦠॥劼듼虍᷊촑桌罖퀾遀⌑猖俫鲏⼖쨠㺼ꤑ鯋䈺躰ѝ撧敗鷁竖璘괊꽓튱鞴횂丗퍛끰ﰝᅹ㙠뮐逬霺퓥ꌰ瘶枃攇韍媑覛 [ 230.325474][ T5895] usb 1-1: config 0 descriptor?? [ 230.342165][ T6962] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 230.382049][ T6942] usb 6-1: Manufacturer: Ổꂹ㳕㒛詵撵⬈蛗ٛ姮擣꜑桻컳㫁ﱒᐋ뼖ﵠᝄ갢婲≆䷵씞邈捇蒯뒠떱푱䠁 [ 230.417274][ T6942] usb 6-1: SerialNumber: І [ 230.444494][ T8270] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 230.458750][ T8270] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 230.522115][ T6962] usb 3-1: Using ep0 maxpacket: 32 [ 230.565344][ T6962] usb 3-1: config 0 interface 0 has no altsetting 0 [ 230.582267][ T6962] usb 3-1: New USB device found, idVendor=056a, idProduct=037a, bcdDevice= 0.00 [ 230.638560][ T6962] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.694940][ T6962] usb 3-1: config 0 descriptor?? [ 230.742559][ T5895] rc_core: IR keymap rc-hauppauge not found [ 230.748568][ T5895] Registered IR keymap rc-empty [ 230.769527][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 230.812303][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 230.856023][ T5895] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 230.896320][ T5895] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input27 [ 230.931526][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 230.962217][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 230.982709][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 231.002269][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 231.032263][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 231.062202][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 231.082929][ T8297] netlink: 'syz.4.635': attribute type 23 has an invalid length. [ 231.120269][ T8268] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 231.137165][ T8268] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 231.151371][ T6962] wacom 0003:056A:037A.000F: ignoring exceeding usage max [ 231.174654][ T6962] wacom 0003:056A:037A.000F: unbalanced collection at end of report description [ 231.252154][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 231.273586][ T6962] wacom 0003:056A:037A.000F: parse failed [ 231.279474][ T6962] wacom 0003:056A:037A.000F: probe with driver wacom failed with error -22 [ 231.289304][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 231.360287][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 231.452379][ T5895] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 231.534505][ T5895] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 231.570127][ T5895] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 231.582856][ T8305] netlink: 4 bytes leftover after parsing attributes in process `syz.0.636'. [ 231.603464][ T6942] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -22 [ 231.611409][ T5895] usb 1-1: USB disconnect, device number 23 [ 231.642269][ T8307] netlink: 40 bytes leftover after parsing attributes in process `syz.4.637'. [ 231.747913][ T8305] netlink: 4 bytes leftover after parsing attributes in process `syz.0.636'. [ 231.782297][ T8305] netlink: 4 bytes leftover after parsing attributes in process `syz.0.636'. [ 231.846136][ T8308] netlink: 4 bytes leftover after parsing attributes in process `syz.0.636'. [ 231.919106][ T8307] netlink: 'syz.4.637': attribute type 4 has an invalid length. [ 232.138299][ T6939] usb 3-1: USB disconnect, device number 30 [ 232.666636][ T6939] usb 6-1: USB disconnect, device number 3 [ 232.905271][ T8329] kvm: kvm [8327]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010058) = 0x1020000000800 [ 233.070689][ T8329] could not allocate digest TFM handle sha1-ni [ 233.078050][ T6962] usb 3-1: new full-speed USB device number 31 using dummy_hcd [ 233.143133][ T5895] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 233.244898][ T6962] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 233.258131][ T6962] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 233.279769][ T6962] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 233.292567][ T6942] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 233.303163][ T6962] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 233.342747][ T5895] usb 5-1: Using ep0 maxpacket: 16 [ 233.356044][ T6962] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 233.374409][ T5895] usb 5-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 233.402276][ T5895] usb 5-1: config 0 interface 0 altsetting 1 endpoint 0x89 has an invalid bInterval 170, changing to 11 [ 233.413932][ T6962] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 233.433783][ T6962] usb 3-1: Manufacturer: syz [ 233.438494][ T5895] usb 5-1: config 0 interface 0 altsetting 1 endpoint 0x89 has invalid maxpacket 34661, setting to 1024 [ 233.472167][ T6942] usb 1-1: Using ep0 maxpacket: 16 [ 233.483358][ T6962] usb 3-1: config 0 descriptor?? [ 233.488369][ T6942] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 233.504093][ T6942] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 233.522371][ T6942] usb 1-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 233.539540][ T5895] usb 5-1: config 0 interface 0 has no altsetting 0 [ 233.542484][ T6942] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.576349][ T6942] usb 1-1: config 0 descriptor?? [ 233.583877][ T5895] usb 5-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 233.607575][ T8358] netlink: 24 bytes leftover after parsing attributes in process `syz.1.653'. [ 233.633370][ T5895] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.641473][ T5895] usb 5-1: Product: syz [ 233.684325][ T5895] usb 5-1: Manufacturer: syz [ 233.715557][ T5895] usb 5-1: SerialNumber: syz [ 233.728663][ T5895] usb 5-1: config 0 descriptor?? [ 233.748074][ T8331] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 233.753108][ T8363] netlink: 12 bytes leftover after parsing attributes in process `syz.1.653'. [ 233.824191][ T8358] netlink: 8 bytes leftover after parsing attributes in process `syz.1.653'. [ 233.854529][ T6962] rc_core: IR keymap rc-hauppauge not found [ 233.854555][ T6962] Registered IR keymap rc-empty [ 233.854734][ T6962] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 233.872728][ T6962] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 233.936513][ T6962] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 233.944348][ T6962] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input28 [ 233.978473][ T8331] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 233.999462][ T8342] netlink: 340 bytes leftover after parsing attributes in process `syz.0.649'. [ 234.042574][ T6942] usbhid 1-1:0.0: can't add hid device: -71 [ 234.044229][ T6962] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 234.048883][ T6942] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 234.067936][ T5895] input: syz syz as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input29 [ 234.080374][ T6942] usb 1-1: USB disconnect, device number 24 [ 234.122676][ T6962] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 234.169402][ T6962] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 234.236583][ T6962] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 234.273165][ T6962] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 234.292299][ T6962] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 234.332714][ T6962] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 234.415402][ T6962] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 234.474108][ T6962] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 234.522487][ T6962] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 234.588349][ T6962] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 234.637256][ T6962] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 234.729762][ T6962] usb 3-1: USB disconnect, device number 31 [ 235.946245][ C0] synaptics_usb 5-1:0.0: synusb_irq - usb_submit_urb failed with result: -19 [ 235.955320][ T5895] usb 5-1: USB disconnect, device number 28 [ 235.993119][ T6962] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 236.307817][ T6962] usb 6-1: config 0 has no interfaces? [ 236.326641][ T6962] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 236.344470][ T6962] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.371554][ T6962] usb 6-1: Product: syz [ 236.385205][ T6962] usb 6-1: Manufacturer: syz [ 236.412327][ T6962] usb 6-1: SerialNumber: syz [ 236.446816][ T6962] usb 6-1: config 0 descriptor?? [ 236.629570][ T5931] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 236.744408][ T5895] usb 5-1: new full-speed USB device number 29 using dummy_hcd [ 236.825848][ T5931] usb 3-1: device descriptor read/64, error -71 [ 236.936828][ T5895] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 236.954027][ T5895] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 237.010505][ T5895] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 237.113342][ T5931] usb 3-1: new full-speed USB device number 33 using dummy_hcd [ 237.130577][ T5895] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 237.218506][ T5895] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 237.231273][ T5895] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 237.268403][ T5895] usb 5-1: Manufacturer: syz [ 237.305482][ T5895] usb 5-1: config 0 descriptor?? [ 237.326928][ T5931] usb 3-1: device descriptor read/64, error -71 [ 237.452743][ T5931] usb usb3-port1: attempt power cycle [ 237.482086][ T6942] usb 2-1: new full-speed USB device number 26 using dummy_hcd [ 237.642219][ T6942] usb 2-1: device descriptor read/64, error -71 [ 237.732257][ T5895] rc_core: IR keymap rc-hauppauge not found [ 237.743568][ T5895] Registered IR keymap rc-empty [ 237.766407][ T5895] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 237.802350][ T5931] usb 3-1: new full-speed USB device number 34 using dummy_hcd [ 237.805703][ T5895] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 237.865606][ T5931] usb 3-1: device descriptor read/8, error -71 [ 237.874936][ T5895] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 237.912159][ T6942] usb 2-1: new full-speed USB device number 27 using dummy_hcd [ 237.951318][ T5895] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input30 [ 237.997437][ T5895] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 238.025469][ T5895] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 238.072133][ T5895] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 238.084504][ T6942] usb 2-1: device descriptor read/64, error -71 [ 238.092832][ T5895] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 238.122141][ T5931] usb 3-1: new full-speed USB device number 35 using dummy_hcd [ 238.124096][ T5895] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 238.163854][ T5931] usb 3-1: device descriptor read/8, error -71 [ 238.213360][ T5895] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 238.226578][ T6942] usb usb2-port1: attempt power cycle [ 238.270265][ T5895] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 238.292600][ T5931] usb usb3-port1: unable to enumerate USB device [ 238.303082][ T5895] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 238.342206][ T5895] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 238.434950][ T6961] usb 6-1: USB disconnect, device number 4 [ 238.482277][ T5895] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 238.502334][ T8495] netlink: 4 bytes leftover after parsing attributes in process `syz.5.678'. [ 238.533682][ T5895] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 238.561611][ T5895] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 238.608282][ T5895] usb 5-1: USB disconnect, device number 29 [ 238.622742][ T6942] usb 2-1: new full-speed USB device number 28 using dummy_hcd [ 238.688340][ T6942] usb 2-1: device descriptor read/8, error -71 [ 238.992100][ T6942] usb 2-1: new full-speed USB device number 29 using dummy_hcd [ 239.017998][ T6942] usb 2-1: device descriptor read/8, error -71 [ 239.112085][ T5931] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 239.138373][ T6942] usb usb2-port1: unable to enumerate USB device [ 239.278705][ T5931] usb 1-1: Using ep0 maxpacket: 8 [ 239.337147][ T5931] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 239.396300][ T5931] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.474475][ T5931] usb 1-1: Product: syz [ 239.478700][ T5931] usb 1-1: Manufacturer: syz [ 239.541853][ T5931] usb 1-1: SerialNumber: syz [ 239.601003][ T5931] usb 1-1: config 0 descriptor?? [ 239.868810][ T5931] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 240.074487][ T6944] hid-generic 0000:0000:0000.0010: unknown main item tag 0x0 [ 240.113926][ T6944] hid-generic 0000:0000:0000.0010: hidraw0: HID v0.00 Device [syz0] on syz0 [ 240.132906][ T6945] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 240.186512][ T8525] netlink: 8 bytes leftover after parsing attributes in process `syz.1.690'. [ 240.296244][ T8520] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 240.313498][ T6945] usb 5-1: Using ep0 maxpacket: 16 [ 240.323136][ T8520] kvm: pic: level sensitive irq not supported [ 240.325348][ T8520] kvm: pic: non byte read [ 240.338094][ T8520] kvm: pic: level sensitive irq not supported [ 240.338269][ T8520] kvm: pic: non byte read [ 240.351217][ T6945] usb 5-1: config 0 has an invalid interface number: 251 but max is 0 [ 240.412071][ T6945] usb 5-1: config 0 has no interface number 0 [ 240.418277][ T6945] usb 5-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 240.502792][ T6945] usb 5-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 240.584490][ T8520] kvm: pic: level sensitive irq not supported [ 240.584617][ T8520] kvm: pic: non byte read [ 240.591860][ T6945] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 240.610732][ T6945] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.619094][ T6945] usb 5-1: Product: syz [ 240.623692][ T6945] usb 5-1: Manufacturer: syz [ 240.630977][ T6945] usb 5-1: SerialNumber: syz [ 240.638348][ T8520] kvm: pic: level sensitive irq not supported [ 240.640324][ T8520] kvm: pic: non byte read [ 240.661477][ T6945] usb 5-1: config 0 descriptor?? [ 240.672554][ T8516] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 240.680809][ T8516] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 240.854890][ T8535] netlink: 'syz.5.691': attribute type 6 has an invalid length. [ 240.937529][ T8516] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 240.960284][ T8516] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 240.970857][ T5931] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 241.500906][ T6945] asix 5-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 241.529608][ T6945] asix 5-1:0.251 (unnamed net_device) (uninitialized): Failed to read software interface selection register: -61 [ 241.569500][ T6945] asix 5-1:0.251: probe with driver asix failed with error -61 [ 242.116517][ T8559] netlink: 40 bytes leftover after parsing attributes in process `syz.1.700'. [ 242.260584][ T8559] netlink: 'syz.1.700': attribute type 4 has an invalid length. [ 242.370445][ T8565] netlink: 24 bytes leftover after parsing attributes in process `syz.1.702'. [ 242.408578][ T8567] dccp_invalid_packet: P.Data Offset(100) too large [ 242.493009][ T6945] usb 1-1: USB disconnect, device number 25 [ 242.862096][ T6942] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 242.982219][ T6945] usb 1-1: new full-speed USB device number 26 using dummy_hcd [ 242.997911][ T8591] netlink: 'syz.5.708': attribute type 4 has an invalid length. [ 243.034423][ T6942] usb 2-1: Using ep0 maxpacket: 8 [ 243.080697][ T6942] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 243.091314][ T6942] usb 2-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 243.112035][ T6942] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.141402][ T6942] usb 2-1: config 0 descriptor?? [ 243.170774][ T6945] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 243.171293][ T6942] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 243.200461][ T6945] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 243.244837][ T6945] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 243.254486][ T6945] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.273663][ T6945] usb 1-1: Product: syz [ 243.278052][ T6945] usb 1-1: Manufacturer: syz [ 243.282957][ T6945] usb 1-1: SerialNumber: syz [ 243.396402][ T8606] macsec1: entered allmulticast mode [ 243.436400][ T8606] macvlan1: entered allmulticast mode [ 243.453661][ T8606] veth1_vlan: entered allmulticast mode [ 243.472683][ T8606] macvlan1: left allmulticast mode [ 243.478836][ T8606] veth1_vlan: left allmulticast mode [ 243.655260][ T5931] usb 5-1: USB disconnect, device number 30 [ 243.789043][ T8619] netlink: 24 bytes leftover after parsing attributes in process `syz.4.715'. [ 244.022194][ T5895] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 244.114248][ T8628] Invalid logical block size (510) [ 244.190624][ T5895] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 244.210386][ T5895] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 244.226589][ T5895] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 244.242512][ T5895] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.263659][ T5895] usb 3-1: config 0 descriptor?? [ 244.622620][ T6944] usb 2-1: USB disconnect, device number 30 [ 244.662054][ T6942] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 244.823245][ T6942] usb 6-1: device descriptor read/64, error -71 [ 245.092150][ T6942] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 245.111637][ T8658] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 245.209147][ T6944] usb 3-1: USB disconnect, device number 36 [ 245.262214][ T6942] usb 6-1: device descriptor read/64, error -71 [ 245.384887][ T6942] usb usb6-port1: attempt power cycle [ 245.587847][ T8668] netlink: 'syz.1.721': attribute type 4 has an invalid length. [ 245.638823][ T6945] usb 1-1: 0:2 : does not exist [ 245.654968][ T6945] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 245.714521][ T6944] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 245.762233][ T6942] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 245.799356][ T6945] usb 1-1: USB disconnect, device number 26 [ 245.802447][ T6942] usb 6-1: device descriptor read/8, error -71 [ 245.959594][ T6944] usb 3-1: config index 0 descriptor too short (expected 29, got 18) [ 245.989108][ T6944] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 246.022141][ T6944] usb 3-1: New USB device found, idVendor=0f11, idProduct=1000, bcdDevice= 0.7f [ 246.072425][ T6942] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 246.080172][ T6944] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.112861][ T6942] usb 6-1: device descriptor read/8, error -71 [ 246.119044][ T6931] udevd[6931]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 246.139790][ T6944] usb 3-1: config 0 descriptor?? [ 246.292954][ T6942] usb usb6-port1: unable to enumerate USB device [ 246.299016][ T8676] syzkaller0: entered promiscuous mode [ 246.305987][ T8676] syzkaller0: entered allmulticast mode [ 246.385034][ T6944] usb 3-1: string descriptor 0 read error: -71 [ 246.391350][ T6944] ldusb 3-1:0.0: Interrupt in endpoint not found [ 246.440485][ T6944] usb 3-1: USB disconnect, device number 37 [ 246.602176][ T6945] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 246.638072][ T8694] netlink: 24 bytes leftover after parsing attributes in process `syz.4.726'. [ 246.775356][ T6945] usb 1-1: Using ep0 maxpacket: 8 [ 246.785771][ T6945] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 246.800284][ T6945] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 246.828474][ T6945] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 246.851452][ T6945] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 246.864097][ T6945] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 246.878027][ T6945] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 246.922379][ T6945] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.036036][ T8705] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 247.042625][ T8705] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 247.081873][ T8705] vhci_hcd vhci_hcd.0: Device attached [ 247.105353][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 247.105376][ T30] audit: type=1326 audit(1745225431.709:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8704 comm="syz.2.728" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7ff5539 code=0x0 [ 247.171706][ T6945] usb 1-1: GET_CAPABILITIES returned 0 [ 247.177586][ T6945] usbtmc 1-1:16.0: can't read capabilities [ 247.315431][ T6961] usb 37-1: new high-speed USB device number 4 using vhci_hcd [ 247.514766][ T6944] usb 1-1: USB disconnect, device number 27 [ 248.589686][ T8722] Cannot find del_set index 1 as target [ 248.796458][ T8725] FAULT_INJECTION: forcing a failure. [ 248.796458][ T8725] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 248.860459][ T8725] CPU: 1 UID: 0 PID: 8725 Comm: syz.0.732 Not tainted 6.15.0-rc2-syzkaller-00493-gac71fabf1567 #0 PREEMPT(full) [ 248.860492][ T8725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 248.860505][ T8725] Call Trace: [ 248.860515][ T8725] [ 248.860523][ T8725] dump_stack_lvl+0x241/0x360 [ 248.860560][ T8725] ? __pfx_dump_stack_lvl+0x10/0x10 [ 248.860586][ T8725] ? __pfx__printk+0x10/0x10 [ 248.860623][ T8725] should_fail_ex+0x424/0x570 [ 248.860656][ T8725] _copy_from_user+0x2d/0xb0 [ 248.860683][ T8725] snd_rawmidi_kernel_write1+0x390/0x620 [ 248.860732][ T8725] snd_rawmidi_write+0x5f2/0xc00 [ 248.860778][ T8725] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 248.860809][ T8725] ? end_current_label_crit_section+0x151/0x180 [ 248.860839][ T8725] ? common_file_perm+0x1a6/0x210 [ 248.860868][ T8725] ? bpf_lsm_file_permission+0x9/0x10 [ 248.860898][ T8725] ? rw_verify_area+0x246/0x630 [ 248.860930][ T8725] vfs_writev+0x5ba/0xbc0 [ 248.860952][ T8725] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 248.860986][ T8725] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 248.861017][ T8725] ? __pfx_vfs_writev+0x10/0x10 [ 248.861056][ T8725] ? __fget_files+0x2a/0x420 [ 248.861078][ T8725] ? __fget_files+0x39d/0x420 [ 248.861096][ T8725] ? __fget_files+0x2a/0x420 [ 248.861125][ T8725] do_writev+0x1b8/0x360 [ 248.861153][ T8725] ? __pfx_do_writev+0x10/0x10 [ 248.861177][ T8725] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 248.861199][ T8725] ? lockdep_hardirqs_on+0x9d/0x150 [ 248.861219][ T8725] __do_fast_syscall_32+0xb4/0x110 [ 248.861238][ T8725] ? exc_page_fault+0x5f8/0x920 [ 248.861270][ T8725] do_fast_syscall_32+0x34/0x80 [ 248.861290][ T8725] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 248.861312][ T8725] RIP: 0023:0xf710d539 [ 248.861328][ T8725] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 248.861343][ T8725] RSP: 002b:00000000f50fd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000092 [ 248.861364][ T8725] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000740 [ 248.861376][ T8725] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000000 [ 248.861387][ T8725] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 248.861397][ T8725] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 248.861407][ T8725] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 248.861432][ T8725] [ 249.102784][ C1] vkms_vblank_simulate: vblank timer overrun [ 249.483902][ T8734] FAULT_INJECTION: forcing a failure. [ 249.483902][ T8734] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 249.515315][ T8734] CPU: 0 UID: 0 PID: 8734 Comm: syz.4.734 Not tainted 6.15.0-rc2-syzkaller-00493-gac71fabf1567 #0 PREEMPT(full) [ 249.515339][ T8734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 249.515349][ T8734] Call Trace: [ 249.515356][ T8734] [ 249.515362][ T8734] dump_stack_lvl+0x241/0x360 [ 249.515391][ T8734] ? __pfx_dump_stack_lvl+0x10/0x10 [ 249.515414][ T8734] ? __pfx__printk+0x10/0x10 [ 249.515445][ T8734] should_fail_ex+0x424/0x570 [ 249.515473][ T8734] _copy_from_user+0x2d/0xb0 [ 249.515495][ T8734] video_usercopy+0x33d/0x1070 [ 249.515526][ T8734] ? __pfx___video_do_ioctl+0x10/0x10 [ 249.515549][ T8734] ? __pfx_video_usercopy+0x10/0x10 [ 249.515584][ T8734] ? __fget_files+0x2a/0x420 [ 249.515602][ T8734] v4l2_ioctl+0x189/0x1e0 [ 249.515626][ T8734] v4l2_compat_ioctl32+0x1d7/0x260 [ 249.515649][ T8734] __ia32_compat_sys_ioctl+0x561/0xc90 [ 249.515673][ T8734] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 249.515694][ T8734] ? __fget_files+0x2a/0x420 [ 249.515713][ T8734] ? fput+0x9b/0xd0 [ 249.515729][ T8734] ? ksys_write+0x275/0x2d0 [ 249.515755][ T8734] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 249.515772][ T8734] ? lockdep_hardirqs_on+0x9d/0x150 [ 249.515789][ T8734] __do_fast_syscall_32+0xb4/0x110 [ 249.515805][ T8734] ? exc_page_fault+0x5f8/0x920 [ 249.515823][ T8734] do_fast_syscall_32+0x34/0x80 [ 249.515839][ T8734] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 249.515858][ T8734] RIP: 0023:0xf7fb6539 [ 249.515871][ T8734] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 249.515884][ T8734] RSP: 002b:00000000f50d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 249.515901][ T8734] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000c008561c [ 249.515912][ T8734] RDX: 0000000080000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 249.515921][ T8734] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 249.515930][ T8734] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 249.515939][ T8734] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 249.515959][ T8734] [ 249.749753][ T8728] netlink: 'syz.0.733': attribute type 4 has an invalid length. [ 249.845658][ T8706] vhci_hcd: connection reset by peer [ 249.889846][ T8439] vhci_hcd: stop threads [ 249.898221][ T8439] vhci_hcd: release socket [ 249.942231][ T8439] vhci_hcd: disconnect device [ 250.213924][ T6939] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 250.278259][ T8757] netlink: 36 bytes leftover after parsing attributes in process `syz.2.740'. [ 250.317284][ T8757] netlink: 4 bytes leftover after parsing attributes in process `syz.2.740'. [ 250.352137][ T6962] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 250.462165][ T6939] usb 1-1: Using ep0 maxpacket: 32 [ 250.469619][ T6939] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 250.479437][ T6939] usb 1-1: config 0 has no interface number 0 [ 250.499400][ T6939] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 250.509670][ T6939] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 250.528917][ T6939] usb 1-1: Product: syz [ 250.538334][ T8762] netlink: 'syz.5.739': attribute type 10 has an invalid length. [ 250.677991][ T6939] usb 1-1: Manufacturer: syz [ 250.688156][ T6939] usb 1-1: SerialNumber: syz [ 250.712296][ C0] ------------[ cut here ]------------ [ 250.717875][ C0] WARNING: CPU: 0 PID: 15 at net/mac80211/rx.c:5329 ieee80211_rx_list+0x27e3/0x3490 [ 250.727855][ C0] Modules linked in: [ 250.732108][ C0] CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.15.0-rc2-syzkaller-00493-gac71fabf1567 #0 PREEMPT(full) [ 250.744090][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 250.745832][ T6939] usb 1-1: config 0 descriptor?? [ 250.754321][ C0] RIP: 0010:ieee80211_rx_list+0x27e3/0x3490 [ 250.754363][ C0] Code: 90 e9 42 dc ff ff e8 ec 27 21 f6 e9 38 dc ff ff e8 e2 27 21 f6 e9 2e dc ff ff e8 d8 27 21 f6 e9 24 dc ff ff e8 ce 27 21 f6 90 <0f> 0b 90 e9 16 dc ff ff e8 c0 27 21 f6 31 c0 48 89 44 24 58 e9 aa [ 250.754383][ C0] RSP: 0018:ffffc90000147740 EFLAGS: 00010246 [ 250.754405][ C0] RAX: ffffffff8ba19552 RBX: 0000000000000000 RCX: ffff88801c68bc00 [ 250.754422][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 250.754437][ C0] RBP: ffffc90000147970 R08: ffffffff8ba16fab R09: 0000000000000000 [ 250.754453][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805b99a780 [ 250.754468][ C0] R13: dffffc0000000000 R14: ffff88805796b0c8 R15: ffff888057968e40 [ 250.754486][ C0] FS: 0000000000000000(0000) GS:ffff888124f9a000(0000) knlGS:0000000000000000 [ 250.754504][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 250.754520][ C0] CR2: 00000000800ab018 CR3: 0000000068708000 CR4: 00000000003526f0 [ 250.754539][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 250.754553][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 250.754568][ C0] Call Trace: [ 250.754580][ C0] [ 250.800264][ T8762] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 250.820487][ T6939] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 250.823380][ C0] ? rcu_read_lock_sched_held+0x91/0x140 [ 250.823422][ C0] ? __pfx_ieee80211_rx_list+0x10/0x10 [ 250.823444][ C0] ? arch_scale_cpu_capacity+0x16/0xb0 [ 250.823478][ C0] ? __lock_acquire+0xad5/0xd80 [ 250.823536][ C0] ? ieee80211_rx_napi+0xd4/0x3c0 [ 250.823557][ C0] ieee80211_rx_napi+0x187/0x3c0 [ 250.823584][ C0] ? __pfx_ieee80211_rx_napi+0x10/0x10 [ 250.855256][ C0] ? skb_dequeue+0x113/0x150 [ 250.855302][ C0] ieee80211_handle_queued_frames+0xe7/0x1e0 [ 250.855343][ C0] tasklet_action_common+0x428/0x620 [ 250.855379][ C0] ? __pfx_tasklet_action_common+0x10/0x10 [ 250.855401][ C0] ? __schedule+0x1ba6/0x5240 [ 250.855449][ C0] handle_softirqs+0x2d6/0x9b0 [ 250.855493][ C0] ? run_ksoftirqd+0xcf/0x130 [ 250.968216][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 250.973624][ C0] run_ksoftirqd+0xcf/0x130 [ 250.978177][ C0] ? __pfx_run_ksoftirqd+0x10/0x10 [ 250.983411][ C0] ? __pfx_run_ksoftirqd+0x10/0x10 [ 250.988584][ C0] smpboot_thread_fn+0x576/0xaa0 [ 250.993626][ C0] ? smpboot_thread_fn+0x46/0xaa0 [ 250.998709][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 251.004256][ C0] kthread+0x7b7/0x940 [ 251.008393][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 251.013933][ C0] ? __pfx_kthread+0x10/0x10 [ 251.018567][ C0] ? __pfx_kthread+0x10/0x10 [ 251.023239][ C0] ? __pfx_kthread+0x10/0x10 [ 251.027872][ C0] ? __pfx_kthread+0x10/0x10 [ 251.032539][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 251.038727][ C0] ? lockdep_hardirqs_on+0x9d/0x150 [ 251.038761][ C0] ? __pfx_kthread+0x10/0x10 [ 251.038790][ C0] ret_from_fork+0x4b/0x80 [ 251.038812][ C0] ? __pfx_kthread+0x10/0x10 [ 251.038838][ C0] ret_from_fork_asm+0x1a/0x30 [ 251.038877][ C0] [ 251.038890][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 251.038908][ C0] CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.15.0-rc2-syzkaller-00493-gac71fabf1567 #0 PREEMPT(full) [ 251.038934][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 251.038949][ C0] Call Trace: [ 251.038959][ C0] [ 251.038968][ C0] dump_stack_lvl+0x241/0x360 [ 251.039004][ C0] ? __pfx_dump_stack_lvl+0x10/0x10 [ 251.039037][ C0] ? __pfx__printk+0x10/0x10 [ 251.039074][ C0] ? vscnprintf+0x5d/0x90 [ 251.039116][ C0] panic+0x349/0x880 [ 251.039147][ C0] ? __warn+0x174/0x4d0 [ 251.039175][ C0] ? __pfx_panic+0x10/0x10 [ 251.039213][ C0] ? ret_from_fork_asm+0x1a/0x30 [ 251.039234][ C0] __warn+0x344/0x4d0 [ 251.039254][ C0] ? ieee80211_rx_list+0x27e3/0x3490 [ 251.039275][ C0] report_bug+0x2b3/0x500 [ 251.039291][ C0] ? ieee80211_rx_list+0x27e3/0x3490 [ 251.039308][ C0] ? ieee80211_rx_list+0x27e3/0x3490 [ 251.039327][ C0] ? ieee80211_rx_list+0x27e5/0x3490 [ 251.039346][ C0] handle_bug+0x89/0x170 [ 251.039369][ C0] exc_invalid_op+0x1a/0x50 [ 251.039389][ C0] asm_exc_invalid_op+0x1a/0x20 [ 251.039406][ C0] RIP: 0010:ieee80211_rx_list+0x27e3/0x3490 [ 251.039425][ C0] Code: 90 e9 42 dc ff ff e8 ec 27 21 f6 e9 38 dc ff ff e8 e2 27 21 f6 e9 2e dc ff ff e8 d8 27 21 f6 e9 24 dc ff ff e8 ce 27 21 f6 90 <0f> 0b 90 e9 16 dc ff ff e8 c0 27 21 f6 31 c0 48 89 44 24 58 e9 aa [ 251.039440][ C0] RSP: 0018:ffffc90000147740 EFLAGS: 00010246 [ 251.039457][ C0] RAX: ffffffff8ba19552 RBX: 0000000000000000 RCX: ffff88801c68bc00 [ 251.039474][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 251.039486][ C0] RBP: ffffc90000147970 R08: ffffffff8ba16fab R09: 0000000000000000 [ 251.039498][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805b99a780 [ 251.039509][ C0] R13: dffffc0000000000 R14: ffff88805796b0c8 R15: ffff888057968e40 [ 251.039528][ C0] ? ieee80211_rx_list+0x23b/0x3490 [ 251.039544][ C0] ? ieee80211_rx_list+0x27e2/0x3490 [ 251.039573][ C0] ? rcu_read_lock_sched_held+0x91/0x140 [ 251.039596][ C0] ? __pfx_ieee80211_rx_list+0x10/0x10 [ 251.039616][ C0] ? arch_scale_cpu_capacity+0x16/0xb0 [ 251.039643][ C0] ? __lock_acquire+0xad5/0xd80 [ 251.039686][ C0] ? ieee80211_rx_napi+0xd4/0x3c0 [ 251.039703][ C0] ieee80211_rx_napi+0x187/0x3c0 [ 251.039722][ C0] ? __pfx_ieee80211_rx_napi+0x10/0x10 [ 251.039746][ C0] ? skb_dequeue+0x113/0x150 [ 251.039773][ C0] ieee80211_handle_queued_frames+0xe7/0x1e0 [ 251.039805][ C0] tasklet_action_common+0x428/0x620 [ 251.039831][ C0] ? __pfx_tasklet_action_common+0x10/0x10 [ 251.039848][ C0] ? __schedule+0x1ba6/0x5240 [ 251.039887][ C0] handle_softirqs+0x2d6/0x9b0 [ 251.039924][ C0] ? run_ksoftirqd+0xcf/0x130 [ 251.039944][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 251.039978][ C0] run_ksoftirqd+0xcf/0x130 [ 251.039997][ C0] ? __pfx_run_ksoftirqd+0x10/0x10 [ 251.040032][ C0] ? __pfx_run_ksoftirqd+0x10/0x10 [ 251.040049][ C0] smpboot_thread_fn+0x576/0xaa0 [ 251.040068][ C0] ? smpboot_thread_fn+0x46/0xaa0 [ 251.040087][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 251.040113][ C0] kthread+0x7b7/0x940 [ 251.040135][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 251.040152][ C0] ? __pfx_kthread+0x10/0x10 [ 251.040175][ C0] ? __pfx_kthread+0x10/0x10 [ 251.040194][ C0] ? __pfx_kthread+0x10/0x10 [ 251.040213][ C0] ? __pfx_kthread+0x10/0x10 [ 251.040231][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 251.040256][ C0] ? lockdep_hardirqs_on+0x9d/0x150 [ 251.040272][ C0] ? __pfx_kthread+0x10/0x10 [ 251.040292][ C0] ret_from_fork+0x4b/0x80 [ 251.040313][ C0] ? __pfx_kthread+0x10/0x10 [ 251.040334][ C0] ret_from_fork_asm+0x1a/0x30 [ 251.040364][ C0] [ 251.040689][ C0] Kernel Offset: disabled