last executing test programs: 15m1.785890754s ago: executing program 0 (id=202): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'vlan1\x00', 0x0}) sendto$packet(r0, &(0x7f00000002c0)="3303120081fd120000007ef52f555f2a0c09000000fd88a800f788a83baa9900", 0x20, 0x40008c1, &(0x7f00000000c0)={0x11, 0x0, r1, 0x1, 0xcf, 0x6, @random="0fe6557a37c0"}, 0x14) 15m1.473892002s ago: executing program 0 (id=203): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x5) close(r2) socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r3 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @local}, 0x10, 0x0}}], 0x1, 0x8000004) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') preadv(r4, &(0x7f0000000080)=[{&(0x7f0000000b40)=""/119, 0x77}], 0x1, 0x4000ffe, 0x0) 15m0.92189686s ago: executing program 0 (id=204): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, 0x7}, 0x1c) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x2) fcntl$setown(r0, 0x8, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0xfff}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003740)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="02", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000180)="bb", 0x1}], 0x1}}], 0x2, 0x404c851) 15m0.439956702s ago: executing program 0 (id=206): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$NFT_MSG_GETOBJ_RESET(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00', 0x32a}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60140, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) setxattr$trusted_overlay_origin(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r4, 0x4004ae99, &(0x7f00000001c0)=0x3) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000569000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f0000000900)="65f30fa7e066b94209000066b81286694866ba000000000f30baa100ec65a00000660f3881433f640f07b801088ed8baf80c66b834ff178166efbafe0cb000eeb8000002c0640f01cf", 0x49}], 0x1, 0x30, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f0000000380)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ffd3bf79a1f5c5dc34cf2645cbc11c4562d22db8780edc5daee171cc04d96d9ec2db07478f347edbd6424923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b000000fb354673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff0100f5620000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce78754182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f26df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132155fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe656c9c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) write$sndseq(r1, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick=0x2, {}, {}, @raw32}], 0x1c) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x2, 0x20000006, 0x0, 0x0, 0x3}) close_range(r0, 0xffffffffffffffff, 0x400000000000000) 14m58.703207447s ago: executing program 0 (id=209): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000010c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), 0xffffffffffffffff, r1}}, 0x18) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000080), 0xfffffebe}], 0x1) 14m58.344088838s ago: executing program 0 (id=210): move_pages(0x0, 0x20000000000000fe, &(0x7f0000000080)=[&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil], 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000780), 0x2380, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) 14m43.23000826s ago: executing program 32 (id=210): move_pages(0x0, 0x20000000000000fe, &(0x7f0000000080)=[&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil], 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000780), 0x2380, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) 13m35.247302346s ago: executing program 2 (id=549): r0 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe64, 0x1ff, @empty, 0x2}, 0x1c) r1 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0xe64, 0x3, @ipv4={'\x00', '\xff\xff', @empty}, 0x202}, 0x1c) r2 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r2, &(0x7f0000000000)={0xa, 0xe64, 0x3, @empty, 0x2}, 0x1c) connect$unix(r2, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e23}, 0x6e) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12014101f2c59620d016b8108edee501030109022400010000100009040002020083ec0009050602000202000a09058202"], 0x0) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000000)={"c467b883b4b2c597c3c27fd16f348e5fa553805a7d48036535e0ec821a76bd1ba148daaaff10b33c03b09688af41dc349665db532bd99683fb1ab31efc9250fa7882b91c9afca084a6904a475d430b2041f26e051eb3edf02d5282c79bef1655c35782b131461cdc62cbaffd9ed45aa64bd33cd3b4ccb4f30a1554986d5d0b71128a5b0a21d776d73bb6f9ef6a3def008f73a272400ea71eca582e5f8952a63f0d9fa2ad6e6a13448ae3a63d7dfe8fd8d3e69277ddff563a53afe380cbd8410d276f1bcfc0b2d56d4ec7dae0c14d0b5c268aae7845ba633e2006a360f72465a859c1d314d9372f2cd5734990ae3510fb855bfd5156d5f21d72156ba5a9de914d8639e305a05c127122103b59b5f82d2a82ba8ab6f1b678c0c3329b61b5d0a77fe1ac79a6daffbf4fafb536ef7d90cde846f51f64b58a28e3f34d1c370e70cb95e0ea6a9de0ca4aff44557cd4b9d8f7c6c76d90b5b57b9661bfbb383632a2bf89f70a87d669f51903c04cc9576cca9556b703379a45d52a65e427889d7556ed0b057154be6a6f95c78e03cb0afb5336c3da54c3ef06001488a3d8ce21e5b6c440b5c6ef5a4f5f7fdeecc52ba9695b06b38e20abed372afbd6f371b52146cf7fb8cb188f4e3b7c73ae2fe785f9953690a681c30be5f8d45ca6e6e2638a0ec2b353e6b37f7ab0c93f34b4c334f68f15b9476b40f7ecade2aa57ccf5ddec999b990b9b6e0aeacd8a6477e502a8a202ec7bad030000003a7249fdab39a9368a8cafdf87cd6ae485c4bbd0100ad4e2d6a1186bcbd2854f95a241cc4eeec67d397fdd6f94786eded36e4e811c5f5235e892c4588721438aabe14611b5e9ac053e268bbc2e7ff044687b1259243f8da86bc00165dd7764041e6d5b4fe4accfe3cd2ae6379f92ae37aaf9122d167bb037de518a8370e0c5809700f390e24122c79c4b4eaf4694715eec8dfcba19ee202b64f0d7063224cb0e0e3d50ad306f8cc69980b1c90b10d1dd3453065da2a36f53f5a075ca8b07ec431bef6f7ec3837ff256a0a8a230ddcd2dbc6fab975ddfd2cec7fdc343c68926c08958e80a8de323bd483654c7e60dee6656c126343b73325aeb29746df12de5e8ea24c5b827c983737a43faa31d6b3b8fa50fe098c5861a6a8496e9d66a3545b09fe802dbd6b36bcb073c49722d9ee65f87c5cf173f987e74b2497b62ca92c9c4b4c68cc1978804fc147ae04b916b26e4e6be536921f14361fd6b510d76b936e2fbe03cd68cc0a043781240e311561d3e04ddbc0b041a9c4c749b122c2cbff764c1d3dc057b33b2bea8aae76b6ddb7ea64ae2ff38e65e15db9f9412151cd64927d982eebc76512452ce2479ce10b9fa3504274011fafac6f9912ed769cd42ab17b25eb9eb852a40e4a9e2ac7b3ce0c656b3b0b7fd818e8d7b458d6482f6f4ccbba5d0f74f702b00b7848c3d78"}) syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000068e04d206f0e2c586831010203010902240001000000000904000002ff47d000090509e7de1429c6040905", @ANYBLOB="b7"], 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$sierra_net(r3, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000540)=ANY=[@ANYBLOB="20100c"], 0x0, 0x0}) syz_usb_control_io$sierra_net(r3, 0x0, &(0x7f0000000140)={0x1c, &(0x7f0000000480)={0x0, 0x17, 0x28, "086e5b9b2bb03927c0b1323aebd8e686ff77441b7a1c6b2b84dee397631b87abd78384d72edf33e0"}, &(0x7f0000000a00)={0xa1, 0x1, 0x400, "1353b78c21b87bbf9c3ea8b107ea9695191ba3374bfd2ed735d20e881ff6a45ed09166d77412a334c0c733959442df271fb0ba537fd892f4e55b6ad45b59f0facfa8ac06df6540b7c867ec629fb3a5d9a234b8e8afc6284ddb7994e79b6287ef349a8f97767e38097ebf1a2e0aaf66a06540e55dba41606577f8d8d3eae00d62d590b9a0fca258cd6d2c30e232e2303c57875ae18760c16d02ce62524128abcdcf5be788b3dba0a9b66c0afaa1473601d88a4a71513a85e7e11a3f48a1253a22f89bb0ffe7dd1044b7e204fd80000000fbc9945e5125cfb0d959981146df51ce86fa6576acafcd66f36cc54cfe7ecc9cccec9a399c4ea7db9e620591c874e25485b9d49b0da49ae96d3e2c434e2353493a43558f79911c99594bf04883a59361621a4f3a0aeda2e948a4d21d115f99017c0bd7d37bee83eb72bda1c2e5899f54224552ac5d0217e3b23d546396bd5f7c898c3a6e6b93b59ae4ac98ce5ea0584cb235cba199f5f728ce227776556d708cd83ae5abf949b4ef5c8ee43d58bdead708af544ddde873ffa0ae9b931fda035031cb3f94564ece0cadace5a56066f49319b2cca677751349750e31c3fb24d5a0f2b102506ee6ff877ce3987515a3c571fc5cb8baf1cab1681e2e2fb7d1994785b2ed7f3e5c11759d121b048800a5d039d669242f89025ff771ae8cd2fd1fc5d7ce7773507071677b8287ecbd6d2fae62a3d83d86f93d947a05c6ec0c0555a35161d3c5c5239155c06554dc7bf1092e4afda6542a2bd46da6aa2ac268a55759888eb90a6b7f34396f11463e822a1155401b32b564ebb1ee4ed7b930b4cbcabcd14872d041195c27e653d2d88d5ea0b9f4357268566c169ec7cd2dfaddaa966df9cb401d3e1159be1d7e75b79024787f37e40a88c203d42570dc585a0b82f6ec10d5d3f9ded11ff9970696739a0f8559063f96c7d19b836d9fc2efc30af6cd268314093b024979cfa7f07e469716a325ba11210ae1b9720f52202961f7021a97defc1c166c8e7ce1b4decaca63fe376a31e227c0304bac904b7061c6d3ddcdfaa9ec9533b585f25c9173d065f5ccf0a4e61ade02bdc1c2abed6263a12c050f54e9859b74ee86e01aa5d2bda8f1093aeb7d1e5c9c000074b725703fad748d38e87f1983a0b9a0d8833b0d9e9687b4a3d526245ba5a4a41c83e14aafa94313f3863894a1ec8900f956893844f85df81aee0f1a82b525d193ee437fad1dc9d5e2464c56988cb890770440b115d1cdfbbcf506fa484cf5128d474108f032585309021f8b0750db6f60d63c5c8f96ae6e19b44b8c5f5f344d3cb22f31eb430c686d25b2123a814b3b960fec4320aec3c284964d0c2ad56960109119d15e2f975a6f51d0d7fc8a22f59a2f2ee85601e4caafc18b90b0095f9e5ec4fc00"}, 0x0}) socket(0xa, 0x1, 0x0) (async) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000040)=0x9, 0x4) (async) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe64, 0x1ff, @empty, 0x2}, 0x1c) (async) socket(0xa, 0x1, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0x9, 0x4) (async) bind$inet6(r1, &(0x7f0000000080)={0xa, 0xe64, 0x3, @ipv4={'\x00', '\xff\xff', @empty}, 0x202}, 0x1c) (async) socket(0xa, 0x1, 0x0) (async) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000040)=0x9, 0x4) (async) bind$inet6(r2, &(0x7f0000000000)={0xa, 0xe64, 0x3, @empty, 0x2}, 0x1c) (async) connect$unix(r2, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e23}, 0x6e) (async) syz_usb_connect(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12014101f2c59620d016b8108edee501030109022400010000100009040002020083ec0009050602000202000a09058202"], 0x0) (async) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000000)={"c467b883b4b2c597c3c27fd16f348e5fa553805a7d48036535e0ec821a76bd1ba148daaaff10b33c03b09688af41dc349665db532bd99683fb1ab31efc9250fa7882b91c9afca084a6904a475d430b2041f26e051eb3edf02d5282c79bef1655c35782b131461cdc62cbaffd9ed45aa64bd33cd3b4ccb4f30a1554986d5d0b71128a5b0a21d776d73bb6f9ef6a3def008f73a272400ea71eca582e5f8952a63f0d9fa2ad6e6a13448ae3a63d7dfe8fd8d3e69277ddff563a53afe380cbd8410d276f1bcfc0b2d56d4ec7dae0c14d0b5c268aae7845ba633e2006a360f72465a859c1d314d9372f2cd5734990ae3510fb855bfd5156d5f21d72156ba5a9de914d8639e305a05c127122103b59b5f82d2a82ba8ab6f1b678c0c3329b61b5d0a77fe1ac79a6daffbf4fafb536ef7d90cde846f51f64b58a28e3f34d1c370e70cb95e0ea6a9de0ca4aff44557cd4b9d8f7c6c76d90b5b57b9661bfbb383632a2bf89f70a87d669f51903c04cc9576cca9556b703379a45d52a65e427889d7556ed0b057154be6a6f95c78e03cb0afb5336c3da54c3ef06001488a3d8ce21e5b6c440b5c6ef5a4f5f7fdeecc52ba9695b06b38e20abed372afbd6f371b52146cf7fb8cb188f4e3b7c73ae2fe785f9953690a681c30be5f8d45ca6e6e2638a0ec2b353e6b37f7ab0c93f34b4c334f68f15b9476b40f7ecade2aa57ccf5ddec999b990b9b6e0aeacd8a6477e502a8a202ec7bad030000003a7249fdab39a9368a8cafdf87cd6ae485c4bbd0100ad4e2d6a1186bcbd2854f95a241cc4eeec67d397fdd6f94786eded36e4e811c5f5235e892c4588721438aabe14611b5e9ac053e268bbc2e7ff044687b1259243f8da86bc00165dd7764041e6d5b4fe4accfe3cd2ae6379f92ae37aaf9122d167bb037de518a8370e0c5809700f390e24122c79c4b4eaf4694715eec8dfcba19ee202b64f0d7063224cb0e0e3d50ad306f8cc69980b1c90b10d1dd3453065da2a36f53f5a075ca8b07ec431bef6f7ec3837ff256a0a8a230ddcd2dbc6fab975ddfd2cec7fdc343c68926c08958e80a8de323bd483654c7e60dee6656c126343b73325aeb29746df12de5e8ea24c5b827c983737a43faa31d6b3b8fa50fe098c5861a6a8496e9d66a3545b09fe802dbd6b36bcb073c49722d9ee65f87c5cf173f987e74b2497b62ca92c9c4b4c68cc1978804fc147ae04b916b26e4e6be536921f14361fd6b510d76b936e2fbe03cd68cc0a043781240e311561d3e04ddbc0b041a9c4c749b122c2cbff764c1d3dc057b33b2bea8aae76b6ddb7ea64ae2ff38e65e15db9f9412151cd64927d982eebc76512452ce2479ce10b9fa3504274011fafac6f9912ed769cd42ab17b25eb9eb852a40e4a9e2ac7b3ce0c656b3b0b7fd818e8d7b458d6482f6f4ccbba5d0f74f702b00b7848c3d78"}) (async) syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000068e04d206f0e2c586831010203010902240001000000000904000002ff47d000090509e7de1429c6040905", @ANYBLOB="b7"], 0x0) (async) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) (async) syz_usb_control_io$uac1(r3, 0x0, 0x0) (async) syz_usb_control_io$sierra_net(r3, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000540)=ANY=[@ANYBLOB="20100c"], 0x0, 0x0}) (async) syz_usb_control_io$sierra_net(r3, 0x0, &(0x7f0000000140)={0x1c, &(0x7f0000000480)={0x0, 0x17, 0x28, "086e5b9b2bb03927c0b1323aebd8e686ff77441b7a1c6b2b84dee397631b87abd78384d72edf33e0"}, &(0x7f0000000a00)={0xa1, 0x1, 0x400, "1353b78c21b87bbf9c3ea8b107ea9695191ba3374bfd2ed735d20e881ff6a45ed09166d77412a334c0c733959442df271fb0ba537fd892f4e55b6ad45b59f0facfa8ac06df6540b7c867ec629fb3a5d9a234b8e8afc6284ddb7994e79b6287ef349a8f97767e38097ebf1a2e0aaf66a06540e55dba41606577f8d8d3eae00d62d590b9a0fca258cd6d2c30e232e2303c57875ae18760c16d02ce62524128abcdcf5be788b3dba0a9b66c0afaa1473601d88a4a71513a85e7e11a3f48a1253a22f89bb0ffe7dd1044b7e204fd80000000fbc9945e5125cfb0d959981146df51ce86fa6576acafcd66f36cc54cfe7ecc9cccec9a399c4ea7db9e620591c874e25485b9d49b0da49ae96d3e2c434e2353493a43558f79911c99594bf04883a59361621a4f3a0aeda2e948a4d21d115f99017c0bd7d37bee83eb72bda1c2e5899f54224552ac5d0217e3b23d546396bd5f7c898c3a6e6b93b59ae4ac98ce5ea0584cb235cba199f5f728ce227776556d708cd83ae5abf949b4ef5c8ee43d58bdead708af544ddde873ffa0ae9b931fda035031cb3f94564ece0cadace5a56066f49319b2cca677751349750e31c3fb24d5a0f2b102506ee6ff877ce3987515a3c571fc5cb8baf1cab1681e2e2fb7d1994785b2ed7f3e5c11759d121b048800a5d039d669242f89025ff771ae8cd2fd1fc5d7ce7773507071677b8287ecbd6d2fae62a3d83d86f93d947a05c6ec0c0555a35161d3c5c5239155c06554dc7bf1092e4afda6542a2bd46da6aa2ac268a55759888eb90a6b7f34396f11463e822a1155401b32b564ebb1ee4ed7b930b4cbcabcd14872d041195c27e653d2d88d5ea0b9f4357268566c169ec7cd2dfaddaa966df9cb401d3e1159be1d7e75b79024787f37e40a88c203d42570dc585a0b82f6ec10d5d3f9ded11ff9970696739a0f8559063f96c7d19b836d9fc2efc30af6cd268314093b024979cfa7f07e469716a325ba11210ae1b9720f52202961f7021a97defc1c166c8e7ce1b4decaca63fe376a31e227c0304bac904b7061c6d3ddcdfaa9ec9533b585f25c9173d065f5ccf0a4e61ade02bdc1c2abed6263a12c050f54e9859b74ee86e01aa5d2bda8f1093aeb7d1e5c9c000074b725703fad748d38e87f1983a0b9a0d8833b0d9e9687b4a3d526245ba5a4a41c83e14aafa94313f3863894a1ec8900f956893844f85df81aee0f1a82b525d193ee437fad1dc9d5e2464c56988cb890770440b115d1cdfbbcf506fa484cf5128d474108f032585309021f8b0750db6f60d63c5c8f96ae6e19b44b8c5f5f344d3cb22f31eb430c686d25b2123a814b3b960fec4320aec3c284964d0c2ad56960109119d15e2f975a6f51d0d7fc8a22f59a2f2ee85601e4caafc18b90b0095f9e5ec4fc00"}, 0x0}) (async) 13m32.756130303s ago: executing program 2 (id=558): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) io_uring_setup(0x1b7b, &(0x7f00000003c0)={0x0, 0xc8a2, 0x8000, 0x2, 0x1b5}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) syz_clone(0xfdba2180, 0x0, 0x106, 0x0, 0x0, 0x0) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x80800, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = syz_genetlink_get_family_id$nl80211(0x0, r5) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r5, &(0x7f0000000480)={&(0x7f0000000040), 0xc, &(0x7f0000000440)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000129bd7000fedbdf25620000000600b300030000000600b4007f0400000600b4f4950e0000"], 0x2c}, 0x1, 0x0, 0x0, 0x24000041}, 0x4000004) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20002, 0x620a9}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8, 0x3, 0x101}, @IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x9}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x24008040) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0097edef6dc2a13c017000000000be0791fb2d", @ANYBLOB="9b47dba44463735869ddc7fc899e2fa73a6f18aba682edc6f98a11347fed3d8560a9c5fd430289fd4f080f7c40e76d4ff1f68380755a8c629aacdf53d6ab4cd44ab82a5e267b75f94b4e347e51690fd397c183f9172a1dab973e946738e651febd1cca7fada736b7c21a350a811730b778c7c851572a83320b7c5c07efe1ab4436a10a88b9671f1c1c269df1b1d7efc6", @ANYBLOB="0005000000000000140012800900010076657468000000000400028008000a00", @ANYRES32=r10, @ANYRESOCT=r6, @ANYBLOB="e083cf51442102a1f379853b1acdbf6c2fba3ff79554e7ceccd42adea536fc02a7861bd895838b14eafa172b23c9d553930cdf675926dfa7c5f460720643b2a7fae69a99f884dfd7bd834b9ed7959d60d359725bfb8793bcd495e8d3a1362cadd3459f7916db0bf5218c5d88cea360a2b32b8340f1792e790736b97cc21f914511879bdfa4f5e0af67896eb556b319ef63a08315e58e42dd9b5ad3309844f972527ff23f901aa0fd5ed4b1fe06f59a5790e7f2a7"], 0x3c}, 0x1, 0x0, 0x0, 0x24000804}, 0x8800) socket$nl_route(0x10, 0x3, 0x0) 13m28.476798192s ago: executing program 2 (id=575): syz_emit_ethernet(0x2a, &(0x7f0000000380)={@local, @random="06ac0100", @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x8}, @remote, @local, @remote}}}}, 0x0) (fail_nth: 1) 13m28.36356605s ago: executing program 2 (id=576): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) ioctl$KVM_GET_MSR_INDEX_LIST(r1, 0xc004ae02, &(0x7f0000000080)={0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0x4) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) (async) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) (async) ioctl$KVM_GET_MSR_INDEX_LIST(r1, 0xc004ae02, &(0x7f0000000080)={0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) (async) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) (async) umount2(&(0x7f00000002c0)='./file0\x00', 0x4) (async) 13m28.231807437s ago: executing program 2 (id=577): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a000004090001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, 0x0, 0x0) connect$inet6(r0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) syz_open_procfs$pagemap(0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=ANY=[@ANYBLOB="58010000", @ANYRES16=r3, @ANYBLOB="010026bd7000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="0600cd00000000003101330000000000080211000001080211000000505050"], 0x158}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 13m24.982938264s ago: executing program 2 (id=587): creat(0x0, 0xd931d3864d39ddd8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket(0xa, 0x5, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x5f8, 0x2c8, 0x1d0, 0x468, 0x468, 0x1d0, 0x550, 0x550, 0x550, 0x550, 0x550, 0x6, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0, [], [0xffffff00, 0x0, 0x0, 0x1f9814788dbf7ab2], 'veth1\x00', 'syz_tun\x00'}, 0x11e, 0xa8, 0x1d0, 0x1f000000, {0x0, 0x7}}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@ipv6={@loopback, @dev, [], [], 'batadv_slave_0\x00', 'macvlan1\x00', {}, {}, 0x2b}, 0x0, 0xa8, 0xd0, 0x7400}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x68}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x1, @ipv6=@mcast2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x658) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0xa9, 0x8000000000000000, 0x8, 0x7, 0x8000003}, 0x0) syz_open_procfs(0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x0, 0x0}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r3 = fsopen(&(0x7f0000000240)='hugetlbfs\x00', 0x1) r4 = socket$rds(0x15, 0x5, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r5, &(0x7f0000002140)={0x2020}, 0x2020) bind$rds(r4, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r4, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @private=0xa010100}, 0x10, 0x0}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) creat(0x0, 0xe9) pread64(0xffffffffffffffff, &(0x7f0000000100)=""/253, 0xfd, 0xadc) r6 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r6, 0x0, 0x48c, &(0x7f0000000400)={0x0, 'ipvlan0\x00'}, 0x18) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), r7) sendmsg$ETHTOOL_MSG_RINGS_GET(r7, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000fc0)={0x2c, r8, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x10) socket$inet6_sctp(0xa, 0x7, 0x84) 13m24.160314545s ago: executing program 33 (id=587): creat(0x0, 0xd931d3864d39ddd8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket(0xa, 0x5, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x5f8, 0x2c8, 0x1d0, 0x468, 0x468, 0x1d0, 0x550, 0x550, 0x550, 0x550, 0x550, 0x6, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0, [], [0xffffff00, 0x0, 0x0, 0x1f9814788dbf7ab2], 'veth1\x00', 'syz_tun\x00'}, 0x11e, 0xa8, 0x1d0, 0x1f000000, {0x0, 0x7}}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@ipv6={@loopback, @dev, [], [], 'batadv_slave_0\x00', 'macvlan1\x00', {}, {}, 0x2b}, 0x0, 0xa8, 0xd0, 0x7400}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x68}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x1, @ipv6=@mcast2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x658) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0xa9, 0x8000000000000000, 0x8, 0x7, 0x8000003}, 0x0) syz_open_procfs(0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x0, 0x0}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r3 = fsopen(&(0x7f0000000240)='hugetlbfs\x00', 0x1) r4 = socket$rds(0x15, 0x5, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r5, &(0x7f0000002140)={0x2020}, 0x2020) bind$rds(r4, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r4, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @private=0xa010100}, 0x10, 0x0}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) creat(0x0, 0xe9) pread64(0xffffffffffffffff, &(0x7f0000000100)=""/253, 0xfd, 0xadc) r6 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r6, 0x0, 0x48c, &(0x7f0000000400)={0x0, 'ipvlan0\x00'}, 0x18) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), r7) sendmsg$ETHTOOL_MSG_RINGS_GET(r7, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000fc0)={0x2c, r8, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x10) socket$inet6_sctp(0xa, 0x7, 0x84) 9m3.773602665s ago: executing program 4 (id=1640): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa101, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x10001, 0x2) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x3, 0x0, 0x0, "0062ba7d82000000000000000000f7fffeff00"}) syz_open_pts(r0, 0x8182) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000030c0)={'ip6tnl0\x00', &(0x7f0000003040)={'syztnl2\x00', 0x0, 0x4, 0xf0, 0xf9, 0x812, 0x54, @mcast1, @ipv4={'\x00', '\xff\xff', @remote}, 0x8, 0x7, 0x3, 0x4}}) 9m3.464336863s ago: executing program 4 (id=1642): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = fsopen(&(0x7f0000000400)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='source', &(0x7f0000001bc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6h\xd1\x1d\xac\xaa\xfb\xc7Y\xcd\xc5n\xeb\xab\xf70\x99\xef\x8b0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x28, r3, 0x213, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000081}, 0x4008000) syz_clone3(&(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, {0x1b}, 0x0, 0x0, 0x0, &(0x7f0000000380)=[r1], 0x1}, 0x58) syz_open_procfs$pagemap(r1, &(0x7f0000000100)) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r6, 0x0, 0x0, 0x80800) r8 = epoll_create1(0x80000) sendmmsg$unix(r7, &(0x7f0000000840)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000004}}], 0x1, 0x400c880) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f00000002c0)={0x10000018}) fsync(r0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) r10 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="12013f00000000407f04ffff00000000000109022400010000a55d9b7d4206e6db000000092140000001220f00090581"], 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f00000000c0)={0x53, 0xfffffffffffffffb, 0x0, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000040), 0x0, 0x10, 0x1001a, 0x0, 0x0}) syz_usb_control_io$hid(r10, 0x0, 0x0) syz_usb_control_io(r10, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c369197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0) r11 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r11, 0xd01c4813, &(0x7f00000000c0)={0x2, 0x100, 0x0, 0x2, 0xfffffffd, 0x2}) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="580000002e00090027bd7000000000000400000044001800"], 0x58}, 0x1, 0x0, 0x0, 0x42804}, 0x0) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f0000000080)={'batadv0\x00', &(0x7f0000000640)=@ethtool_stats}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x4}) 9m0.976318775s ago: executing program 4 (id=1654): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r5 = memfd_create(&(0x7f00000004c0)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdbU\xb1\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\x90i\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14O\xf8\xb5C\x1f\xb6b8b\x06A2@D\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g&\x99\x0e\x8d\x8d\x16\x05\x00\x00\x00\x00\x00\x00\x00\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\x88\xd1\x1eQB\x18\xc1-\xc4\x8fK\xf8\xfa\xb6\xf8\v;\xaa\x8fW\xcc\n\x17\x7f\x98\xb7\xcdqV\xd4\xf0)\xfa\x0fG\xc8\xbf\xfd\xe8>K\f\xcd+\xb0\x99Q\xba/\xa8\xb9`k\b\xd1\xcc\xfc\xeaA\"\v=\x83fC\x90%\xa1d\x91\xf8:\x16<\xad\xc2\x18\xdf\x01\xe2\x96\xfcj\xe9\xa4\x065m\x03\x05N\xb9\x1dOr\xb6\xbcP\x8fP\x8d\x89%\xf2\x12T\xd0\xc3\x15W\x9c\x87\x1b\x8c\xc9\xd9\xc6\xad\x96-d\xa2wFB\xcaB\xa5\x15\xf8,\x04\x1c*\xd98\x8bG\x90\x81`\x03\xe0\xde\x9c\x9a\x0f\x1b\x8f\xd2%*&$Wc\xb3\xa6\xc4TK1}2\xb3\xab\xf4\xb7\xb7\x85\apa\xaf\x1c\x10i\xb9\x9f\x06\xff4%\"7f \x0e\xf5Bk\r\xac\"\x13tNx\xc0$\x85\x9f', 0x3) ftruncate(r5, 0xffff) close(0x3) fcntl$addseals(r2, 0x409, 0x3) ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f00000001c0)={r5, 0x1, 0x0, 0x8000}) io_setup(0x5, &(0x7f0000000140)) r6 = syz_io_uring_setup(0x188f, &(0x7f0000000140)={0x0, 0xccc9, 0x0, 0x0, 0x96}, &(0x7f00000000c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x85c3}}) io_uring_enter(r6, 0x32d7, 0x0, 0x46, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e27, @initdev={0xac, 0x1e, 0x10, 0x0}}]}, &(0x7f00000002c0)=0x10) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x20d036, 0x0, 0x0, 0x0, 0x0) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r9, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x5) r10 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'pim6reg1\x00'}) move_mount(r10, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r11 = open_tree(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x89901) mount_setattr(r11, &(0x7f0000001d80)='.\x00', 0x8000, &(0x7f0000001dc0)={0xb, 0x0, 0x80000}, 0x20) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f00000010c0)=0x8) 8m59.58311458s ago: executing program 4 (id=1664): r0 = socket$inet6(0xa, 0x1, 0x100) listen(r0, 0x0) pipe(&(0x7f0000000000)) 8m59.281305111s ago: executing program 4 (id=1666): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, 0x7}, 0x1c) prctl$PR_MCE_KILL(0x35, 0x1, 0x8) prctl$PR_MCE_KILL(0x35, 0x1, 0x2) r1 = gettid() ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x2) fcntl$setown(r0, 0x8, r1) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xfff}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003740)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="02", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000180)="bb", 0x1}], 0x1}}], 0x2, 0x404c851) 8m58.928882416s ago: executing program 34 (id=1666): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, 0x7}, 0x1c) prctl$PR_MCE_KILL(0x35, 0x1, 0x8) prctl$PR_MCE_KILL(0x35, 0x1, 0x2) r1 = gettid() ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x2) fcntl$setown(r0, 0x8, r1) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xfff}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003740)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="02", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000180)="bb", 0x1}], 0x1}}], 0x2, 0x404c851) 11.347662502s ago: executing program 6 (id=3870): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="4c000000100039042abd70000000000000000000", @ANYRES32=r1, @ANYBLOB], 0x4c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newlink={0x74, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, r1, 0x42024}, [@IFLA_LINKINFO={0x54, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x40, 0x2, 0x0, 0x1, [@IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_HWID={0x6}, @IFLA_GRE_LOCAL={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @IFLA_GRE_REMOTE={0x14, 0x7, @private2}]}}}]}, 0x74}, 0x1, 0x0, 0x0, 0x4040014}, 0x0) 11.08533685s ago: executing program 6 (id=3872): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000240)="d800000019007b29e00208ba0d8105040a601100fe02040b067c55a1bc001400030006990600000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b316277c7f6bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a14c11ce1b14d6d930dfe1d1d322fe04fb95cae8c9fad95667e04adcdf634c1fdf48000000000000e1cace81ed0b7fece0b42a9ecbeeef7d93458c69e0cdf106a159031e9f05e9f16e9cb500020000000000000000000000009ae42a97718952ab98b6768e7a5f", 0xd8}], 0x1, 0x0, 0x0, 0x2663}, 0x8000) (fail_nth: 6) 10.028137195s ago: executing program 6 (id=3874): socket(0x16, 0x3, 0x3a) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, 0x0, 0x0, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x0, 0x0) r2 = syz_io_uring_setup(0x1110, &(0x7f0000000240)={0x0, 0xdb9c, 0x800, 0x10000000, 0x4}, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_FADVISE={0x18, 0x0, 0x0, @fd=r1, 0xa289c37, 0x0, 0x40000}) io_uring_enter(r2, 0x47f6, 0x0, 0x20, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r5, 0x0, 0x800) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x2, 0x8, 0x0, 0x3}, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r6, r6, 0x0, 0x200000) ioprio_set$pid(0x3, 0x0, 0x0) 9.948855082s ago: executing program 3 (id=3877): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010101}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f00000000c0), 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f00000008c0)={r2, 0x10, "83cd73d913625563f3877450d9e218b0"}, &(0x7f0000000340)=0x18) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000580)={r3, 0x10, "f3663f226195d6a79015bb7b7734e7b5"}, &(0x7f0000000000)=0x18) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000240)="d800000019007b29e00208ba0d8105040a601100fe02040b067c55a1bc001400030006990600000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b316277c7f6bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a14c11ce1b14d6d930dfe1d1d322fe04fb95cae8c9fad95667e04adcdf634c1fdf48000000000000e1cace81ed0b7fece0b42a9ecbeeef7d93458c69e0cdf106a159031e9f05e9f16e9cb500020000000000000000000000009ae42a97718952ab98b6768e7a5f", 0xd8}], 0x1, 0x0, 0x0, 0x2663}, 0x8000) 8.819785252s ago: executing program 3 (id=3879): setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x208000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket(0x10, 0x803, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8002, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa0e, 0xffffffff}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002f00)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000380)=';', 0x1}], 0x1}}], 0x1, 0x4004851) r5 = syz_open_dev$usbfs(&(0x7f0000000300), 0x77, 0x1c1b41) ioctl$USBDEVFS_CONTROL(r5, 0xc0105500, &(0x7f0000000000)={0x80, 0x8, 0x2fe, 0x0, 0x0, 0x800000, 0x0}) setsockopt(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000040)="010000", 0x3) ioctl$KVM_CREATE_VM(r0, 0xae01, 0xc) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, 0x0) ioctl$IOMMU_VFIO_IOAS$SET(r6, 0x3b88, &(0x7f0000000140)={0xc}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x40241, 0x0) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, 0x0) write$tun(r7, &(0x7f0000000240)=ANY=[@ANYBLOB="000008004600002c00660000000190780a010102ac1e00014404a2400d009078011b000100ba0e00000000000000026f"], 0x30) recvfrom$inet6(r2, &(0x7f0000000180)=""/93, 0x5d, 0x10000, &(0x7f0000000100)={0xa, 0x4e24, 0xecc8, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x81}, 0x1c) ioctl$IOMMU_VFIO_SET_IOMMU(r6, 0x3b66, 0x1) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r6, 0x3b72, &(0x7f0000000440)=ANY=[@ANYBLOB="1800007f000000000020"]) socket$qrtr(0x2a, 0x2, 0x0) 8.608743468s ago: executing program 6 (id=3882): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x2, 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x101800, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000000)={0x19}) r6 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x1, 0x0) fchdir(r7) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x8001, 0x0, 0x0, 0x0, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r9, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001dc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) close(r7) rename(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000200)='./file0\x00') sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a6c000000060a010400000000000000000200000a400004803c0001800b00010065787468647200002c00028005000200890000000800034000ff00000800044000000001080006400000000408000140000500010900010073797a30000000000900020073797a32"], 0x94}}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000fdc01a40f30c74933bbc0000000109021b0001000000000904000001a7a00f000905", @ANYBLOB="a18ad9"], 0x0) 8.580214475s ago: executing program 1 (id=3883): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8d40, 0x0) syz_open_pts(r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000001300090468fe0700000000000000ff3f08000000480100100000000019002b000a0001000500000000000072080003000500000000", 0x39}], 0x1) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000001800d98d000000000000000002000000006ee1bc6efcee7684000005000000001800168014000100010000a200000000000049ecbedd32a9f4df3b26bae3220a57e5a2a617816d23b1c1006b3598db814d261d1c20da5317d675c3d8de637c8cf010e8b5a59d50f32b1093012cfc1698edd9dd9d730965561dceb01a438780929764a0a64332842d5e620d2a2ebbfea3cd6f0fc2d2bad9d1253c8d76a11f0f1e2e06a2b9787f778e1b10764dcbe25c6335faf8d34167df348535066d64e9e76d70cb0ee92913285112509fc51e30f69f6ee0fae4fafaafb941caec69a5846e3a1dd27f6f7917c592576891a7c8f68f7f81542b1424247723cb45d623de8a96"], 0x34}}, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = dup(r3) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) io_setup(0x9, &(0x7f0000000b80)=0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0xff, 0x0, 0x7fc00100}]}) io_submit(r5, 0x1, &(0x7f00000002c0)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r6, 0x0}]) mknodat(r4, &(0x7f0000000100)='./file0\x00', 0x4, 0xcc5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11}, &(0x7f0000000000)) ioctl$VIDIOC_S_OUTPUT(r4, 0xc004562f, &(0x7f0000000280)=0x7) write$6lowpan_enable(r4, &(0x7f0000000000)='1', 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000180)={'dummy0\x00', &(0x7f0000000040)=@ethtool_perm_addr={0x4b, 0x46, "2d720787b641423f000000a6aa0825471829a0bc32e5cde91eaf6df1497941f89ca551d1e7dea188ffc5bb39ec84b91f5751669d70ba271e33ba8ec0195cf2d59bdf8a77eba5"}}) 8.048095064s ago: executing program 5 (id=3884): r0 = socket$inet(0x2, 0x3, 0x1) sendmsg$inet(r0, &(0x7f0000000600)={&(0x7f0000000140)={0x2, 0x4e23, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101027f00000100000000001c000000000000000000000008"], 0x40}, 0x4000000) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x6, &(0x7f0000000040)={0x22, {{0x29, 0x0, 0x2000000, @private1, 0x800000b0}}}, 0x88) 7.973892469s ago: executing program 5 (id=3885): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f4070009040081000000fe000000000000000800040001", 0x21) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="2800000007000000000000000000000001"], 0x28) socket$nl_generic(0x10, 0x3, 0x10) 7.470209173s ago: executing program 1 (id=3886): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000540)={0x1, 0x0, [{0x80000007, 0x1, 0x2, 0x5, 0xf04, 0x6}]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x1, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f00000000c0)={&(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1}, 0x1}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc084}, 0x20000090) (fail_nth: 8) 7.347983675s ago: executing program 5 (id=3887): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x7, 0x4010, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps_rollup\x00') socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$BTRFS_IOC_GET_FEATURES(r0, 0x80189439, &(0x7f00000002c0)) mremap(&(0x7f00007ff000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000580000/0x4000)=nil) mremap(&(0x7f0000580000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00007ff000/0x2000)=nil) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x2007, &(0x7f0000000980)=0x0) eventfd2(0x9, 0x0) io_pgetevents(r5, 0x2, 0x0, 0x0, 0x0, 0x0) io_submit(r5, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000000, 0x5d032, 0xffffffffffffffff, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f00001cd000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x9, &(0x7f00000002c0), 0x0, 0xc303, 0x0, 0x0, 0x0, 0x64}) r6 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r6, 0xc100565c, &(0x7f0000000040)={0x0, 0x1, 0x4, {0x9, @pix_mp={0x12, 0x5be7, 0xb5315258, 0x6, 0xb, [{0x80000004, 0x7}, {0x7ff, 0x5}, {0x10000001, 0x9}, {0x63d, 0x7fd}, {0x1, 0xb}, {0x7, 0x489aa92e}, {0x1}, {0xff, 0x7}], 0x1, 0xc, 0x2, 0x0, 0x3}}, 0xfffffffd}) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000140)=""/122, 0x7a}], 0x1) 7.305966382s ago: executing program 1 (id=3888): r0 = socket(0x10, 0x3, 0x4) capset(&(0x7f0000000500)={0x19980330}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7, 0x7}) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0x25dfdbfe, {0x2, 0x0, 0x0, 0x0, {0x4, 0xb}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0xfc, 0x200, 0x1080000a, 0x0, 0x1, 0x7ff}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x18, 0xd, 0x1, 0x4, 0xfffffffe}}, {0x4}}]}]}, 0x68}}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000500)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="0d00000000000000000087f2", @ANYRES32=0x0, @ANYBLOB, @ANYRES64=0x0], 0x20) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0xab, @loopback, 0x10001}, 0x1c) r2 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$sierra_net(r2, 0x0, 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r3, 0x707, &(0x7f00000002c0)={&(0x7f00000001c0)=[{0x2, 0x8411, 0x22, &(0x7f00000006c0)="0203204bdcc36cda8907f47563863d1428f47b34551c000bce0f6bc6584f11a7489c"}, {0x7fff, 0x10, 0x0, 0x0}], 0x2}) syz_usb_control_io$uac1(r2, &(0x7f0000000180)={0x14, &(0x7f00000003c0)={0x40, 0x10, 0x83, {0x83, 0x2, "2bcff982b0586db06caeeddc90f6f4662e997cd7ed78d8b5337c95fb15c8c87eebc823cbf01f093b350ad8890f35165202709a2195b139ea5459b1c49595935037f10cd36d22de643d13b16e625f0ae3a1411e311bdd0cf4001c76eadadf23465659cf2fd7313f145993cff0512e9b10a3a79d0ba599fcaf1ad4141a8ca51058ca"}}, &(0x7f0000000080)={0x0, 0x3, 0xb, @string={0xb, 0x3, "44d3596b4914d7153b"}}}, &(0x7f0000000600)={0x44, &(0x7f0000000240)={0x20, 0x9, 0x45, "a269dd536dc656059958d8fd973590d22bed686ee4893cdabb1cd78407d0bc674461d09a9a47ed0fff0c8baf7ce29a5c260e1c336eaa40bf9f41d6ca7cc4c0356d79e5df82"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x31}, &(0x7f0000000480)={0x20, 0x81, 0x3, "b43cb6"}, &(0x7f00000004c0)={0x20, 0x82, 0x2, "fbe8"}, &(0x7f0000000540)={0x20, 0x83, 0x2, "125b"}, &(0x7f0000000580)={0x20, 0x84, 0x2, "03a4"}, &(0x7f00000005c0)={0x20, 0x85, 0x3, "81efbb"}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22, 0x7, @loopback, 0x23}, 0x1c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r6, 0xffffffffffffffff, 0x0) sendmmsg(r1, &(0x7f0000001e00)=[{{0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f00000006c0)="87e8ae1a40dca7f0ff2478efce8e1c831a44e5b275dc913413ade883c7809f2e7d309efc", 0x24}], 0x1}}], 0x2, 0x0) r7 = dup(r1) r8 = socket(0xa, 0x3, 0xff) connect$inet6(r8, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty, 0x4000002}, 0x1c) syz_emit_ethernet(0x6e, &(0x7f00000001c0)={@random="cfb14e407d33", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, 'z&-', 0x38, 0x3a, 0x1, @local, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x8001, {0x2, 0x6, "081331", 0x9, 0xff, 0x0, @loopback, @loopback, [@fragment={0x3b, 0x0, 0xe, 0x0, 0x0, 0x3, 0x65}]}}}}}}}, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r7, &(0x7f00000000c0)={0x7, 0xffffffffffffffa0, 0xfa00, {0xffffffffffffffff, 0x10c}}, 0xfffffd88) 6.860103204s ago: executing program 3 (id=3889): r0 = ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000000)={0x0, 0x3}) close(r0) connect$unix(0xffffffffffffffff, &(0x7f0000000040)=@abs={0x0, 0x0, 0x4e22}, 0x6e) syz_emit_ethernet(0xc2, &(0x7f00000000c0)={@random="d63d5ca06ce1", @multicast, @val={@val={0x88a8, 0x4, 0x0, 0x2}, {0x8100, 0x0, 0x1, 0x1}}, {@mpls_uc={0x8847, {[{0x9}, {0x6, 0x0, 0x1}], @llc={@snap={0xaa, 0x154, "18", "9f0cd8", 0x8884, "6ee5cc657149df1f70e0b8a6c3cbe1feb3afb5924ca53c8524f19e68b9427c9e00f245a96eebe7b8d7f974680ad9573da22b8d2424fef40f84b092e60079b36d220abcc6b9ef5e8791e16f05c03c8cf1cda735da94bae42bd14a6fd69b8b4697453b42c8880b9221df2072c702b256e72f6ec18978d2b15499a22386c9e236241556301c81cbe0fcce4a48b01546b3aeeb4b89b59a7a860d109cebbd"}}}}}}, &(0x7f00000001c0)={0x0, 0x1, [0x49a, 0x612, 0x905, 0x5f1]}) syz_emit_ethernet(0x26, &(0x7f0000000200)={@random="c3417d4c4b7a", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}, @val={@val={0x88a8, 0x5, 0x1, 0x2}, {0x8100, 0x0, 0x0, 0x3}}, {@can={0xc, {{0x0, 0x0, 0x1, 0x1}, 0x0, 0x2, 0x0, 0x0, "e5c497129181d070"}}}}, &(0x7f0000000240)={0x1, 0x4, [0x685, 0xadb, 0x3f, 0x5]}) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffd000/0x1000)=nil) munlock(&(0x7f0000ffd000/0x3000)=nil, 0x3000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r2, 0x0, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x4004) r3 = socket(0x2c, 0x3, 0x5b) r4 = io_uring_setup(0x825, &(0x7f00000003c0)={0x0, 0x7807, 0x2, 0x0, 0x18a}) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000000, 0x8010, r4, 0x10000000) setsockopt$MRT6_DEL_MFC_PROXY(r3, 0x29, 0xd3, &(0x7f0000000440)={{0xa, 0x4e23, 0x5, @private2={0xfc, 0x2, '\x00', 0x1}, 0x4}, {0xa, 0x4e24, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x5}, 0xffffffffffffffff, {[0x9, 0x7b, 0x3, 0x6, 0x5, 0x0, 0x6, 0x8]}}, 0x5c) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_RUN(r5, 0xae80, 0x0) setsockopt$RXRPC_SECURITY_KEY(r3, 0x110, 0x1, &(0x7f00000004c0)='IPVS\x00', 0x5) sendmsg(r1, &(0x7f0000001c00)={&(0x7f0000000500)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e22, @broadcast}, 0x4, 0x4, 0x0, 0x4}}, 0x80, &(0x7f0000000740)=[{&(0x7f0000000580)="741a78fe96d6d63c44be17063b347f95903a0ee1b040bdb7ff8e92f175dffb2a3bc19241096949ee2c8befec8b7bdffabb5c01e35c706020544e308e371e994f4f4d29", 0x43}, {&(0x7f0000000600)="0c5705405cbf615f81e93e3dc403c73b0a8e34a1108e336314a5f6666c4fe6d8bd7378b2125503027ce996", 0x2b}, {&(0x7f0000000640)="0c3068155ede62af76c9d5f83ea9a151bb6c1029b565b6e03d42acde2cc10ec110377aa1627a911a93ce4c1432574cf1", 0x30}, {&(0x7f0000000680)="c630e8633007935f096c8dc0db190ac0efe2a0ae1e3f518839c658f4cdd1e42da639144bcc93748ca321a55159d8e25fb0ade90d1fd00df7adbdb56269b5d66a4ff2e36bd63e8197ce75a0473d115ccd2287c7f0ba5b13c59caf13235010b2f071c477c0b0256a6b51debb80407c8d39c9a78f5670d2a0c05183b28472e99b9ad3bc1a1ccedd0b863a23271d5e2e5a966e41a59367aa90959d495cf35fa560391a552587df23664c0019", 0xaa}], 0x4, &(0x7f0000000780)=[{0x48, 0x108, 0xa7, "7cdab18e8e0fabeb3f4d8b2fb48a570a3ad9606c432e45b676da5b009f04fe6204063af3c6e15659f23c897df10622485e"}, {0xe8, 0x110, 0x7fffffff, "66f8101f413cd3f8a69fc9023cb8d90ee13e58ee6fd466b7ea21c1735475afb0ff2046fe404e82ab61f5c98aae0f947b5c8ba53dbf7ac21ad0ff0b0b1447848a59a6f59c994eb8dc2e05654655da3346edf1693418549d93ab9619b5293926fceb5e59408f8a24272c130bc45312bb5f8b7c6aa7fd4b5de9323041648aecc69eb1121aeb6bd08c3dd41856a23eab383974a1d86a091b0917ba0fff7ce214cb7e91a4dfd00442e7eba5249545e9b83d02ee5e9290bd12e1ee83e6cdb686c309d767a9c01b92612f4c1028390379011ad900db006c8b"}, {0x1010, 0x102, 0x5, "0fafb493cccd1a6ad58c1d724165c6e67b7ffebabe05ea96642601aaa723cbc19c8b5572968730c1ab1ff08be3047d2a38574f364de444030e0234d36a13caeb3d228734bf5bbfba3e755e9a7385aa78b12de9b65b87705ab2147753a8ec5d855e5055c94ede10362f2af9b570c1f485c73737d3b7aa5b5eef56d067e0d76f6e01920224c1810a056b3d72c602195a41ba5bf5cae6006ba42ee71cf6ac7272520de8c442c29bcb1c4116d86955af56803b2b5433bf3dc5a96f9d85c640af5d7c4531215f8dcd73d0e0810a02e3e8b9534d165f1a8017425444b9c8ab5d36a31351c78a0da5b40e2393def5aa447637e97342b9887b9bd2ddbc86dad0c859ead3bb9a515fb3f1fda5fd691f82c597a01c0c96ead8bbe92b49c46bfb5f18d5cc7176111c4816b2658ff79e4157d02f03ee27e88c6fd52efd6aada0645286c2a9fe71a888cb11ff73d212baee7420f5437f76952dc20d1fc703e9842bd475cf864a7db08fedbc967b373c086d6990326a4f8b8099b3e0c55e23cfb5cda0733a9acaebbf475714f37e53048f1fd2a498b17e4f40ebf09495e7c2f08dfee51b77c80a41daa2f40a3582170524b1a6a4bb07eeae988e02023d5ee5ec4121e37e9d34e1d9e121f1cd0df5a1d77402cb1b1ae2a369379a5678e16b067c769bc02c1d0fb53eab6f9faa0b3b698158c48cff6ff1039fcd32320bf112f855c41f5a35313cd69a865da5f44c2810b2d5dc7c0f749223485d72bc68cefb14600d699c65d9631faeb075baddfed117efe9014048d013ce5fd5a4ad0628945313dd6bf7de9339db56d1a8a801365e4a7bd6da68cb88dd83ff4da8f556cd61431dd86568465ff6522f2b28f98f27899c8f07f76d3a3bb601ca7b6a4ef2a72de05e3eb3158d5cf407dae1f22f3b11870a43bf40b0a4f164d3213bf6943b59f68c5539628ae56f84efa1d774aa4c535026374e28726bc6f079382a91fe7b7b90352b7c7859930241653f0462dce113748d10e6f792a47322fb1810b5d89c286be4f8a8dce3a38a88e4366b5b5bd783e7d643ef3d9dd9865ec9113375569f15af69509e4e70ff71c1feeb6310f5ced60e540e2d2e750a8cb27701efb91ce2b9f698ad379b1c2b6cf0d8546abd0089db9fdb966a0f4c841e2cb0350dcbf6d11f5215d0b7945e76ece46496eae24a62144b27320988b06e157cad1e10592444d4141bd055a7a3c1b65c981d51ad5be654735fad3d5b2bffe77c02e81903e3e3ba714e088b66104207ad2d13e6c481015737247f9f968444904b1cef6750c75e387b35aba811c7724ef0d67baa070794af2b084643ad837f28eefa84ce9981ca13563aab62239d42f1106d29c8174d94f7b2cd3e98e6098bfe51cde5d8b743a240364342dd866bcc3f3d0eba5f68cacb1a7b6f73187a817b5409d824225ceff1bf45d86341d55915a1919fa4b327808b222cb58e0245f22c06607097796612322cbbfa963011ac133e6d8b5922e08729d75bce0cb003b6370e10590fefc035e2f5e11c52322b3c6993d36b5ba4ac75010d88d46e954494cd68ef8332c81ded3b740da1ec5263bee2aaeb17337bb54e716ce4c6f0add2b61754daa4f5900e152ae168d36c16d9c10462062ab35ed3e1e2b4d2603809cbaee155d50c02b794caaa95ab4b02eb9774177d6ca2ed980f52febc83f60b8610dd504fd1ef24239f5dd5f5f249e1acabf3e3767b1d26acc828a954b0e641a2d05dd9f8f3dbe9941609f5c2d8110bf2ae74657f062caed807f354294a7a02838d2b5c31125e4ab0f4a423c1a7d1a8d6a260f00044aaaf99cda84341e57c268cb4401f061bc9c935b2a3fc1b575832065bd8f46d6b9f74f9564825a6bacbe18dc3b61f363a859c0efb7daf95bc5376e993a641c0f347c56a4b98b8cacb250b8fd004c2c75de59fd1fa4c8bb177d972bc0644068f66dbe742beebc349c81bcf1ac76e4a9422ec06ec979707670491fe8bc9fe22082c2e0eb29197f1c9bdff3e7b635edf31133b377e54a50034caa218cc68429ac5ba6cf7e501f6dff6bddd548b9c0689942a8ab247bd532612d7534cb229d293ace8ef41d17f86b14854a0863dd7abdb607864372a90abe31ba2b971a7b21264862506c2ad1518612ce757b0a276f205b19bf593ffa0652bd05ef623134b007a4d088d0851b888534fcaee14565a2289dffbc878491a97bc997b91df4929f63230734492e083469bafe896f1190fe7d7463a51772c3cf9885ce9fda867f88ff55d45f5e504d8c6972b05306cf06a0ffb4a981869215a3c58fea22f66e0e9e6a653670199c651856eb76705dcb7af324a66fffe544e55f0187f445e4ce0c7dbadb7207c0fe773c16f623611420142010d33623b1ecfe8738dd3e50f3269b7ccf1b39d6ee0e4f456b2890938375d6136aa8a49ec3514d33d6aec97a92fb8497eb174ac5d0567952ec00ad9c8001f6841266d50dd804fe7a9681a1cc1b660fedc0ee18b2cc20b0b725fb57bdac33d5694683a9328bd5677bfad0d78ea4248168e707153898ea3519e22aec76a7c33f09b504c3d2cb1a8af8d7e4698ab9ac04a3d9804fd21754071c4eb6d80bd33afa703ee250b5cd9a8ea780974c0f4889f8d7567dd73e92a7e1f9123d3d7ec81359355c108bb8fa5daa9fc883ffcae060e515b0f3ff448b136c99d7e3e7bc8bb1b2008ecc11d30374b6a4ea1c510990c3790a4a0b60573f7ab967b97d24a25eb0f96e711e73dbd8a0b6423572bb6acfbd5a884c1007a27a66a68a13d58f8f19e026e7a944f983c40da307f072a637bf43ea167c51165312ff3009786320866c3f7269413d361b24a9dff9d96c49cd854ca1d8b4a529c5f9011e7d973261a5b3d19bedd0e221dc3aa17b00ba72a5894a72b7ff15a22a78b0dbf4d56b56aebcc75de4f9f239afb05d04bf678b1f902141ca5068447383c7efd312f61d6d3e61fe9726c259e1168344b05ec55df8e26f264e6c20b89142ccd0aeec04ca5f0cb7196fe91922703d307e8cae44b6181c9fa00cd360ea2c996c4e05e63fc4b532d11046030da3b0b076d92cbce8537facf5a12e51153395f06af11ba9206fd8a5b01b21c1f68eada087da034a41fd781d0f28de49f8c4456dc23c263d1fc4f5c5b229d66e5a3ce5a18e44801a6c09fdf885fd187e814cefb51320392609e376e2f3f33a470eccdc40fba7f84e41816cb9154468bd2d44c33507199be5f6e00ccd6dfda96cb2abeac8eba2f788574ac59354dc5f5e6b091ab90fda79e6d6395b06290f20961297ba30fdc9fe0fcb8434d131a85bf5d0014cff8016d667ab6838bc1033385e72cf19816bccde5da987cf2949d7fe74e7b07293d2b3f57784b0a5b69ea2fba7a2a461d3ce92481ae6e5a1eda0ebaad8d01037a8c61aa3a6806f929ec452df068865ae0f5486d8fece143e3fec8d24f9ec8de382c7cae048fbaf3b7b7030ab9e9ff7845bcdf58fc339b7abd7fe4a0409287455ec432fbbfc5c7f3ae6e51282139609400e582fe6b5f5a3b4c0a6131eec1f4e3c3a3ca1a119e25fe1aa8447af290d5d6ec2c887d6de0016447073b77c34811a3d338066516ff7cea60f17c64dd72e4bb89f1da7cfee2b699b679d1b4821a8c2a39d335259719c2cca54ad450336f7bff29e7d1d8d71d748df82c57ce9470273ae0d53ed0a07783eb4bb3d712ac5370d47682429e6c03107b206315cd5011317f8ef8a6ceb4be4ebe974dd1b73ec55d9d24ece742f0621f7562ef1115aeabd54deda849a971d864d845ea50ed094cb09cff805daca1b31a00fc3d09eb3374b0be965ef3799cf0c2b42a03e73b3e743cda476d78829a596f4819aa1ceaccc57214a413c6ce1949d98c462e16e332d2b98a1965adfce00a2749bca86e1e5e2fdc292bc4c6e06168abad695d0fc261c9fc00ea303596e997d620cd75ba298b45ca35dc9c3d421074dd8cc048ba58962b33ecab50d83b0936d7fdba537f600369b63a97adb33e4efa3113f4d916389926e9e6431d1c36cc58b8a254041b5c38473e76505cea63387655e3bd375ffb3f813eec499a55c3b4b88e4f7c9ffa62e5809fa424e71c01fddb03dd52ff3dac987ad0de0e49271e53286aa7f3e412c79eee56082e229486af54f8d0d8f2e21a77d827785cca482aa62a1bb1ec5f70104a09617f9400eec3265836a5c1ff708ed3606649d4532cd854346db449c883cf89ba7b651772adcffae663cab203d9d765f60b90508e38487c87a3f76754e9c37033d634177a10e865e704513502d65f87e48abc1f733155cd42ab8fac31305e612aa8352c67df3926a38a8ed7d17f73138bbd10f1bcf43a75abee9b0ba4e9faea1e7191b0dd4c9801d129856b0c7ba09a64feb6201aab1e9ea8367d1d560a05f98e09ad8a0d382dd5f156d34a997f0ded0e1d2aa2d9d958433adb9cebf9ae22445024112450ff6cc230a2ee40f804d8d5c93c2996ff641ae3b474b95624b4c0c725a509b1436ebf3716f50ff2c734463619ee80effffa6ca424e1f0fc30c1768b9f13074d9a9ae8a229156765c3721d63bbddd702d79f5ac637d45608d7cdc0a004e0f4427b22e096a2f304021b7fc194e757a052ffb59d321a5cc6bac31988833a43f8389a38aa21e060e8e2b841f21021d0d6b47427b19b7fe7008e3eee0ad438a3211a12ecce468ff7d692946c6ed39e04efa2a5e9799295eca438f4bb4b3885a06224b88a0e834e3834ca21881bcda3a88af75dda2ca2281ae52eda2bdad0768d297be6fb0c8649569fda2d196ccef68ef4debfa321c5ab12244805c30b53b743fac6e01be9cc21c69be5a551454e783ccf62fd8b09a2992e5d42bf5908428b03d4d7493db21514c769936d5c4ee6b10ce927cd7a3a17f0b84a140d236d8d75903fdcda6233e2f9079f285b2b00f7c98b5ca2a35d4ea0307991065f26579d036001bf1ed99d36c91526564684653b70e3ee3d699975090149e6e815e21db0ebef85c2e68564f22aea34b99cde9161aab2a0c281c4ded43d924c4852c88cfb71a165d7a3384e0ad125a900fecdc16a3a81787547ea4003b444409e1563f6294e041b624f75e45ff65f9ea812cb20414416f0f15c01079626459f89b3e4f84fa4d8c00507454014a77950e80539b2bf5b32ac9dac3bc84f32d802d10b8b7b96762bbb5bbdf8cac55039eaf5c779d69711c834b6bb1a9195babdd240cea03c63bf0aecadae958cdacb1f9a6abd60f36c404223ee8268dc5b4b92e5c09e7355ddf05e96f75ffb4f2b6ec303e3931b117bab9f3318b632a66ebd95f298d67e70501cdbafada20f207f431fb98a0b38fb21d92cf6002338bd51aa836c4a0a064b8be17a9432ab29d08bff113cae1d5b19379e6bdf84bd522a89d41be7647a13693074b2003b5d696608e9a4f70fba6f2b47d849a33d76feff86de282d80cdbf6dc64a2fc3f3972881e2f6b8465c1dd7f8de80ef561a17eda8febbbd1962c29b4e5a853c4f8a290722e8f60e2758caa5f5191f7a8c352cb9e0c0fba7088ed60f0deb627d4dbf897a825746086b973e7a5f199b66ce6145368b5fb1f572deb012b15b3773eced41c99de0cdef87f3c8e96edf0c49014a88db38b5f5b14e7495983169fa6abd0ae98fef25b2eb6c12da0a424c6be43c559b81c1fb3e920b08a69e6ec9bea66613349ffec834587b98e91ccce88cec3dad38abb1baaea06179e3137a8725ad03403ed64dd1181416d9a658edfc97caa162ace540c14449254ad28ae98ec7de48bae7f1352391734343907a0a32bbd154a399ac0a97817aab5736120d2ea8da08c11613"}, {0xf0, 0x109, 0x6, "a9396c2d8d0d31822cdda05b3e3b88e3cd06b23da07cdfd3e8f076b64053fcf80c26ffd04f07db5f7a42567a2057a166bb8552306d7bc3b2e5a4a8065c977a476cdbf294a9ca7d369b87a681fa35a3ae1db7c81ed7299682be509d84a9d054f672276549ee485fc4266d783bd8c13912b7cd4f098fc8efdf2f459953ad48578c9ca7076a46b2df21feb5bd789e55a0b9772740fa4e654612352888d3817c357f91f35c212ec535b9850799493925808cf27899eb43c5867dd9480b1fdad77fbbc9499c86a81a319963fdd4b44dfc35de5b2dc1015efc11af84472db965e3"}, {0x20, 0x108, 0xe82, "1ac101ca270d6b7ef6b3b9"}, {0xb0, 0x10d, 0x10000, "db2cf9d364de4c074e887b50bedc583d6b18575e993194698cbeb65773264fad8a708fca05b3efcf54f1c9aa8471aa0d615c39b60fc403725210ea4c9f79b05ec2c82e6c01a1da132575c6ca5dc57630cf8abc2bad74efe2e3c459f313239d73d1e00b7f27513fd8b2601ff82ada33c1b28f50103055d24ec543e0cddb598d44027cc37088ea8737d47062ba33ba09e96691e5c809252a6a4cfbf2fd6e3c"}, {0xb8, 0x1, 0x0, "0639e633d86df37ee19deacca603a90dfb6133a8058dd6f4c222c67b7a7b2e28bda0b70b417a26875386169740e385d00fafbf8f49a1c297835d8320f84f42904fd457d4acc43b930e2b9eeb56944b341cf5378ee956134a18b7a26473daee17b5e8c909b858955fde190247a57df363e1f5e1684d55a6f9a018fe981fdd7bb9b35e489fe53a0597677261c4ee96273212e56bd4dd4042ffb1fa09444d913faec98823f87b4754"}, {0xc0, 0x29, 0xb, "c1a806fee35e5c97eeaeda51903d2200e1d6e1294fb0725deb531041b68ef3b41cf13700339102962c70ab9829c9e69a813496dee07570f787236d8f2f3e3007dd02a095fc7e105c63ffa5add0eb473195ab8bf3e86460aec65b8348a52baf093a294a9559c7cfe64a90cd712148d4226cbbbd5a25fe52eab65aaac1c87b6ae90e98dd212ef19938f5b93f984248ae046048c0c90292d2c2ca322d77ca63d1518d543eb898b53cf1d3"}], 0x1478}, 0x4000000) fsetxattr$trusted_overlay_redirect(r4, &(0x7f0000001c40), &(0x7f0000001c80)='./file0\x00', 0x8, 0x3) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, &(0x7f0000001cc0)=""/149, &(0x7f0000001d80)=0x95) openat$dir(0xffffffffffffff9c, &(0x7f0000001dc0)='./file0\x00', 0x2, 0x104) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000001e00), &(0x7f0000001e40)=0x8) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001ec0), r1) sendmsg$MPTCP_PM_CMD_GET_ADDR(r3, &(0x7f0000002080)={&(0x7f0000001e80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002040)={&(0x7f0000001f00)={0x11c, r6, 0x20, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x48, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010102}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x10}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x24, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010101}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010100}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7f}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x18}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010102}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x11c}}, 0x80) sendmsg$NFNL_MSG_CTHELPER_DEL(r3, &(0x7f0000002180)={&(0x7f00000020c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002140)={&(0x7f0000002100)={0x40, 0x2, 0x9, 0x301, 0x0, 0x0, {0x2}, [@NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x10}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x9}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x4004050}, 0x1) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002200), r3) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(0xffffffffffffffff, &(0x7f00000022c0)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002280)={&(0x7f0000002240)={0x1c, r7, 0x100, 0x70bd26, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_BANDS={0x8, 0xef, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000010}, 0x4000000) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r1, &(0x7f00000023c0)={&(0x7f0000002300), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x28, 0x2, 0x8, 0x5, 0x0, 0x0, {0x5, 0x0, 0x5}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x11}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) getsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000002400), 0x10) 6.536475862s ago: executing program 3 (id=3890): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = dup(0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x200000, 0x0, 0xb4c, 0x9, 0x6, 0x0, 0xa}, 0x0) inotify_init() io_uring_setup(0x218a, &(0x7f0000000000)={0x0, 0x3ffffffc, 0x800, 0x0, 0x221}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r6, 0x0, &(0x7f0000000480)=[{&(0x7f0000000380)=""/199, 0xc7}, {&(0x7f0000000140)=""/48, 0x30}, {&(0x7f0000000240)=""/5, 0x5}, {&(0x7f0000000280)=""/103, 0x67}], 0x4) r7 = io_uring_setup(0xa4, &(0x7f00000000c0)={0x0, 0xc63b, 0x10, 0x1, 0x1, 0x0, r1}) io_uring_register$IORING_REGISTER_CLOCK(r7, 0x1d, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r8 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$6lowpan_enable(r8, &(0x7f0000000200)='0', 0x1) socket$netlink(0x10, 0x3, 0x12) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) 5.552556065s ago: executing program 5 (id=3892): socket(0x16, 0x3, 0x3a) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, 0x0, 0x0, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x0, 0x0) r2 = syz_io_uring_setup(0x1110, &(0x7f0000000240)={0x0, 0xdb9c, 0x800, 0x10000000, 0x4}, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_FADVISE={0x18, 0x0, 0x0, @fd=r1, 0xa289c37, 0x0, 0x40000}) io_uring_enter(r2, 0x47f6, 0x0, 0x20, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r5, 0x0, 0x800) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x2, 0x8, 0x0, 0x3}, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r6, r6, 0x0, 0x200000) ioprio_set$pid(0x3, 0x0, 0x0) 5.178553647s ago: executing program 6 (id=3893): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000001c0)=0x800, 0x4) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000040)=0x20000, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'dummy0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r1, &(0x7f0000000100)={0x2c, 0x0, r3}, 0x10) r4 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r4, &(0x7f0000019440)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80ffe0090f000060000000a2bc5603ca00000f7f89000000200000004a2471083ec6991778581acb6c0101ff0000000309", 0x48}], 0x1) syz_usb_control_io(r0, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000340)={0x40, 0xf, 0x1, 'V'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000180)={0x20, 0xd}, &(0x7f00000001c0)={0x0, 0xa, 0x1, 0x81}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, &(0x7f00000004c0)={0x0, 0xa}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000002c0)={0x2c, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) 4.71643563s ago: executing program 1 (id=3896): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000200)={0x0, 0x0, 0x6, 0x0, 0x0, "00769a7d8200010000001495595915303d6000"}) syz_open_pts(0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000001300090468fe0700000000000000ff3f08000000480100100000000019002b000a0001000500000000000072080003000500000000", 0x39}], 0x1) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000001800d98d000000000000000002000000006ee1bc6efcee7684000005000000001800168014000100010000a200000000000049ecbedd32a9f4df3b26bae3220a57e5a2a617816d23b1c1006b3598db814d261d1c20da5317d675c3d8de637c8cf010e8b5a59d50f32b1093012cfc1698edd9dd9d730965561dceb01a438780929764a0a64332842d5e620d2a2ebbfea3cd6f0fc2d2bad9d1253c8d76a11f0f1e2e06a2b9787f778e1b10764dcbe25c6335faf8d34167df348535066d64e9e76d70cb0ee92913285112509fc51e30f69f6ee0fae4fafaafb941caec69a5846e3a1dd27f6f7917c592576891a7c8f68f7f81542b1424247723cb45d623de8a96"], 0x34}}, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = dup(r2) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) io_setup(0x9, &(0x7f0000000b80)=0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0xff, 0x0, 0x7fc00100}]}) io_submit(r4, 0x1, &(0x7f00000002c0)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r5, 0x0}]) mknodat(r3, &(0x7f0000000100)='./file0\x00', 0x4, 0xcc5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11}, &(0x7f0000000000)) ioctl$VIDIOC_S_OUTPUT(r3, 0xc004562f, &(0x7f0000000280)=0x7) write$6lowpan_enable(r3, &(0x7f0000000000)='1', 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000180)={'dummy0\x00', &(0x7f0000000040)=@ethtool_perm_addr={0x4b, 0x46, "2d720787b641423f000000a6aa0825471829a0bc32e5cde91eaf6df1497941f89ca551d1e7dea188ffc5bb39ec84b91f5751669d70ba271e33ba8ec0195cf2d59bdf8a77eba5"}}) 4.350816424s ago: executing program 3 (id=3897): setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x208000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket(0x10, 0x803, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8002, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa0e, 0xffffffff}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002f00)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000380)=';', 0x1}], 0x1}}], 0x1, 0x4004851) r5 = syz_open_dev$usbfs(&(0x7f0000000300), 0x77, 0x1c1b41) ioctl$USBDEVFS_CONTROL(r5, 0xc0105500, &(0x7f0000000000)={0x80, 0x8, 0x2fe, 0x0, 0x0, 0x800000, 0x0}) setsockopt(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000040)="01000000", 0x4) ioctl$KVM_CREATE_VM(r0, 0xae01, 0xc) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, 0x0) ioctl$IOMMU_VFIO_IOAS$SET(r6, 0x3b88, &(0x7f0000000140)={0xc}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x40241, 0x0) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, 0x0) write$tun(r7, &(0x7f0000000240)=ANY=[@ANYBLOB="000008004600002c00660000000190780a010102ac1e00014404a2400d009078011b000100ba0e00000000000000026f"], 0x30) recvfrom$inet6(r2, &(0x7f0000000180)=""/93, 0x5d, 0x10000, &(0x7f0000000100)={0xa, 0x4e24, 0xecc8, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x81}, 0x1c) ioctl$IOMMU_VFIO_SET_IOMMU(r6, 0x3b66, 0x1) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r6, 0x3b72, &(0x7f0000000440)=ANY=[@ANYBLOB="1800007f000000000020"]) socket$qrtr(0x2a, 0x2, 0x0) 3.741878256s ago: executing program 5 (id=3898): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) rt_tgsigqueueinfo(0x0, 0x0, 0x6, &(0x7f0000000080)={0x11, 0x0, 0x8}) r1 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, r2, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x10000}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r3}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x200}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000001840)=0x5d4) syz_emit_ethernet(0x20f, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd60f4adf701d92c0020010000000000000000000000000001ff0200000000000000000000000000013a000000000000000400907880000001670495210005880000000000000000000000000000000000200100000000000000000000000000003c0a020000000000fc020000000000000000000000000001fe8000000000000000000000000000bb20010000000000000000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000aa67006c08680000003a0a0000000000000730000000000abfff0f0700000000000000feffffffffffffff0900000000000000c30000000000000026ec000000000000040124000100c20400002617c910200100000000000000000000000000002b0100000000000000010004011bc204000007e8000000000c030000000000000401010103000000c910fc01000000000000000000000000000104010400000032040000000000000313fe80f5a887875b7812c50202ce450e261a61c9000100000100050200000401050000000000008800fc41640000007b76e29b0ddcff3b69d24a7df1e41be90997ccbb22e1620287e3fdd787df50e62fff9a87feac6a29852d41ccc4bb466f983dcd256640dfa61e76be4b99f7d3e7cab5edd3935b4225d0efffce4915a5ab016dbf48bc10ac090efb4fa7f339001e8c681dd6eceeced9abbf8a7d4c12960c3e"], 0x0) r4 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) r5 = socket$inet6(0xa, 0x2, 0x10001) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000000)=0x6a0, 0x4) write$binfmt_script(r4, &(0x7f00000000c0), 0x28) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCFLSH(r6, 0x5608, 0x0) r7 = syz_usb_connect(0x2, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="31010000dccd5e08cb06030000e8160000010902240001000064000904340102d469e70009058acf"], 0x0) r8 = syz_open_dev$loop(&(0x7f0000000240), 0x6, 0x85862) r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) syz_usb_connect(0x4, 0x4f, &(0x7f0000000680)=ANY=[@ANYRES16=r5, @ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRESOCT=r6, @ANYRES8], 0x0) r10 = socket$inet_udp(0x2, 0x2, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0xaa000, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$sock_inet_SIOCSIFADDR(r10, 0x8916, &(0x7f0000000080)={'pim6reg1\x00', {0x2, 0x4e20, @local}}) ioctl$sock_SIOCGIFCONF(r10, 0x8912, &(0x7f0000000000)=@req={0x28, &(0x7f00000000c0)={'hsr0\x00', @ifru_data=0x0}}) sendfile(r9, r8, 0x0, 0x10000200000200) syz_usb_control_io$uac1(r7, 0x0, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newlink={0x40, 0x10, 0x401, 0xfffffffd, 0xfffffffe, {0x0, 0x0, 0x0, 0x0, 0x72d7a, 0x1a001}, [@IFLA_IFNAME={0x14, 0x3, 'vxcan1\x00'}, @IFLA_ADDRESS={0xa, 0x1, @broadcast}]}, 0x40}, 0x1, 0x0, 0x0, 0x20004010}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 3.642138808s ago: executing program 1 (id=3899): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)={0x24, r1, 0x1, 0x70bd28, 0x1, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x24}}, 0x80) 3.285952226s ago: executing program 1 (id=3900): r0 = syz_open_dev$radio(&(0x7f0000000940), 0xffffffffffffffff, 0x2) r1 = socket(0x10, 0x3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, 0xffffffffffffffff, 0x80, &(0x7f00000000c0)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e24, @private=0xa010102}}, 0x0, 0x0, 0x1}) io_uring_enter(0xffffffffffffffff, 0x3516, 0x0, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_NOP={0x0, 0x6}) sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@bridge_getvlan={0x18, 0x72, 0x7e3bfe4fa73db39f}, 0x18}, 0x1, 0x0, 0xa6ffffffffffffff}, 0x0) ioctl$VIDIOC_QUERYMENU(r0, 0xc02c5625, 0x0) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[], 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_usb_connect(0x5, 0x24, 0x0, 0x0) preadv(r2, &(0x7f0000000140)=[{0x0}, {&(0x7f0000001300)=""/4100, 0x1004}], 0x2, 0x8c0, 0x2bd6) socket(0x10, 0x803, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r4 = memfd_create(0x0, 0xc) ioctl$FS_IOC_RESVSP(r4, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xa}) 2.531013235s ago: executing program 3 (id=3901): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000580)='/proc/tty/drivers\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000003bc0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) fcntl$lock(r0, 0x25, &(0x7f0000000000)={0x0, 0x1, 0x7fffffffffffffff, 0x9, r1}) r2 = syz_usb_connect(0x3, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x22, 0x2, 0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r5) sendmsg$BATADV_CMD_GET_NEIGHBORS(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)={0x1c, r6, 0x331, 0x0, 0x0, {0x8}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x400, 0x4, 0x379}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000240)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r7, 0x47ba, 0x3e82, 0x60, 0x0, 0x0) 1.47360582s ago: executing program 5 (id=3906): r0 = socket(0x10, 0x3, 0x4) capset(&(0x7f0000000500)={0x19980330}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7, 0x7}) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0x25dfdbfe, {0x2, 0x0, 0x0, 0x0, {0x4, 0xb}, {0xb, 0x1}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0xfc, 0x200, 0x1080000a, 0x0, 0x1, 0x7ff}}, {0x4}}, {{0x1c, 0x1, {0x6, 0xc, 0x18, 0xd, 0x1, 0x4, 0xfffffffe}}, {0x4}}]}]}, 0x68}}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000500)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="0d00000000000000000087f2", @ANYRES32=0x0, @ANYBLOB, @ANYRES64=0x0], 0x20) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0xab, @loopback, 0x10001}, 0x1c) r2 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$sierra_net(r2, 0x0, 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r3, 0x707, &(0x7f00000002c0)={&(0x7f00000001c0)=[{0x2, 0x8411, 0x22, &(0x7f00000006c0)="0203204bdcc36cda8907f47563863d1428f47b34551c000bce0f6bc6584f11a7489c"}, {0x7fff, 0x10, 0x0, 0x0}], 0x2}) syz_usb_control_io$uac1(r2, &(0x7f0000000180)={0x14, &(0x7f00000003c0)={0x40, 0x10, 0x83, {0x83, 0x2, "2bcff982b0586db06caeeddc90f6f4662e997cd7ed78d8b5337c95fb15c8c87eebc823cbf01f093b350ad8890f35165202709a2195b139ea5459b1c49595935037f10cd36d22de643d13b16e625f0ae3a1411e311bdd0cf4001c76eadadf23465659cf2fd7313f145993cff0512e9b10a3a79d0ba599fcaf1ad4141a8ca51058ca"}}, &(0x7f0000000080)={0x0, 0x3, 0xb, @string={0xb, 0x3, "44d3596b4914d7153b"}}}, &(0x7f0000000600)={0x44, &(0x7f0000000240)={0x20, 0x9, 0x45, "a269dd536dc656059958d8fd973590d22bed686ee4893cdabb1cd78407d0bc674461d09a9a47ed0fff0c8baf7ce29a5c260e1c336eaa40bf9f41d6ca7cc4c0356d79e5df82"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x31}, &(0x7f0000000480)={0x20, 0x81, 0x3, "b43cb6"}, &(0x7f00000004c0)={0x20, 0x82, 0x2, "fbe8"}, &(0x7f0000000540)={0x20, 0x83, 0x2, "125b"}, &(0x7f0000000580)={0x20, 0x84, 0x2, "03a4"}, &(0x7f00000005c0)={0x20, 0x85, 0x3, "81efbb"}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22, 0x7, @loopback, 0x23}, 0x1c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r6, 0xffffffffffffffff, 0x0) sendmmsg(r1, &(0x7f0000001e00)=[{{0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f00000006c0)="87e8ae1a40dca7f0ff2478efce8e1c831a44e5b275dc913413ade883c7809f2e7d309efc", 0x24}], 0x1}}], 0x2, 0x0) r7 = dup(r1) r8 = socket(0xa, 0x3, 0xff) connect$inet6(r8, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty, 0x4000002}, 0x1c) syz_emit_ethernet(0x6e, &(0x7f00000001c0)={@random="cfb14e407d33", @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, 'z&-', 0x38, 0x3a, 0x1, @local, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x8001, {0x2, 0x6, "081331", 0x9, 0xff, 0x0, @loopback, @loopback, [@fragment={0x3b, 0x0, 0xe, 0x0, 0x0, 0x3, 0x65}]}}}}}}}, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r7, &(0x7f00000000c0)={0x7, 0xffffffffffffffa0, 0xfa00, {0xffffffffffffffff, 0x10c}}, 0xfffffd88) 1.250337022s ago: executing program 7 (id=3907): socketpair$unix(0x2d, 0x2, 0x0, &(0x7f0000000200)) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x38011, r2, 0x0) ioctl$HIDIOCGRDESCSIZE(r1, 0x80044801, &(0x7f0000000100)) 1.23486431s ago: executing program 6 (id=3908): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000540), 0x401) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000580)={{0x3, 0x0, 0x1, 0x2, 0x1}, 0x5, 0x5, 0x400001}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) writev(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025", 0x1d}], 0x1) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000140)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d24070000030769dc000049c40c240000e9fffff5ffffffff0924031300010005024524", @ANYRES8=r1, @ANYBLOB="05"], 0x0) 796.458873ms ago: executing program 7 (id=3909): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5ed000) r0 = userfaultfd(0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x14, r2, 0x1, 0xffffffff, 0x0, {0x2f}}, 0x14}, 0x1, 0x0, 0x0, 0x20000041}, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=@dellink={0x28, 0x11, 0x1, 0x70bd2b, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x408}, [@IFLA_NET_NS_PID={0x8}]}, 0x28}, 0x1, 0x200000000000000, 0x0, 0x4}, 0x40cc040) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x20}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) 278.904507ms ago: executing program 7 (id=3910): r0 = socket(0x1e, 0x1, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r0, 0x0, 0x0) sendmsg$AUDIT_TRIM(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3f6, 0x800, 0x70bd25, 0x25dfdbfb}, 0x10}, 0x1, 0x0, 0x0, 0xc810}, 0x4814) recvmmsg$unix(r0, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000700)=""/4096, 0x1000}], 0x1}}], 0x1, 0x40000040, 0x0) 202.647781ms ago: executing program 7 (id=3911): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xfc}}, 0x0) write$tun(r0, &(0x7f0000001240)=ANY=[@ANYBLOB="0800080000000200b6e71407020045b00fc00068000002"], 0xfce) 87.608179ms ago: executing program 7 (id=3912): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x81000) fcntl$getflags(r0, 0x40a) socket$inet_mptcp(0x2, 0x1, 0x106) 0s ago: executing program 7 (id=3913): r0 = syz_usb_connect(0x5, 0x24, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r1, 0x707, &(0x7f00000000c0)={&(0x7f0000000200)=[{0x6, 0x11, 0x1, &(0x7f0000000080)="d7"}], 0x1}) kernel console output (not intermixed with test programs): number 91 [ 894.104712][ T5897] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 894.144684][ T5897] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 894.171558][ T5897] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 894.177482][T17336] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 894.184252][ T5897] usb 2-1: media controller created [ 894.576067][ T5897] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 894.716441][T17336] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 894.804344][ T5897] DVB: Unable to find symbol dib7000p_attach() [ 894.824762][ T5897] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 894.916315][T17336] usb 4-1: Using ep0 maxpacket: 16 [ 894.928253][T17336] usb 4-1: config index 0 descriptor too short (expected 23158, got 36) [ 894.960197][ T5897] rc_core: IR keymap rc-dib0700-rc5 not found [ 894.970306][T17336] usb 4-1: config 119 has too many interfaces: 186, using maximum allowed: 32 [ 894.976423][ T5897] Registered IR keymap rc-empty [ 894.999387][T17336] usb 4-1: config 119 has an invalid descriptor of length 112, skipping remainder of the config [ 895.003075][ T5897] dvb-usb: could not initialize remote control. [ 895.042102][T17336] usb 4-1: config 119 has 0 interfaces, different from the descriptor's value: 186 [ 895.066092][ T5897] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 895.077279][T17336] usb 4-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 895.114235][T17336] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 895.378778][T18593] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 895.392784][T18593] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 895.983515][T17336] usb 4-1: string descriptor 0 read error: -71 [ 896.221338][T17336] usb 4-1: USB disconnect, device number 92 [ 896.364235][ T24] usb 2-1: USB disconnect, device number 89 [ 896.500366][ T24] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 896.815143][T18609] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3292'. [ 896.966507][ T24] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 897.115528][T18626] syzkaller0: entered promiscuous mode [ 897.202125][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 897.298769][ T24] usb 2-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 897.395604][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 897.480217][ T24] usb 2-1: Product: syz [ 897.536436][ T24] usb 2-1: Manufacturer: syz [ 897.544233][ T24] usb 2-1: SerialNumber: syz [ 897.581062][T18634] bond1: option mode: unable to set because the bond device is up [ 897.710252][ T24] usb 2-1: config 0 descriptor?? [ 897.756562][T14362] Bluetooth: hci4: command 0x0406 tx timeout [ 897.817231][ T5897] usb 7-1: new high-speed USB device number 107 using dummy_hcd [ 897.954658][T18635] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 898.029679][T18635] 8021q: adding VLAN 0 to HW filter on device bond1 [ 898.048966][ T5897] usb 7-1: Using ep0 maxpacket: 16 [ 898.093111][ T5897] usb 7-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 898.128113][ T5897] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 898.147690][T18635] bond1: (slave lo): Enslaving as an active interface with an up link [ 898.169078][ T5897] usb 7-1: Product: syz [ 898.216775][ T5897] usb 7-1: Manufacturer: syz [ 898.241275][ T5897] usb 7-1: SerialNumber: syz [ 898.263007][ T5897] usb 7-1: config 0 descriptor?? [ 898.291774][ T24] dvb_usb_dtv5100 2-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 898.346623][T18635] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 898.431963][ T24] usb 2-1: USB disconnect, device number 90 [ 898.695857][ T5897] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 898.730432][ T5897] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 898.787006][ T5897] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 898.805497][ T5897] usb 7-1: media controller created [ 898.951851][T18632] dtv5100: wlen = 0, aborting. [ 898.962910][T18639] netlink: 'syz.3.3298': attribute type 1 has an invalid length. [ 899.018062][ T5897] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 899.419506][ T5897] zl10353_read_register: readreg error (reg=127, ret==0) [ 899.423881][T18645] binder: 18641:18645 ioctl 4b4e 30 returned -22 [ 899.465770][ T5897] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 899.492977][ T5897] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 900.117633][T18662] xt_CT: You must specify a L4 protocol and not use inversions on it [ 900.569421][ T24] usb 7-1: USB disconnect, device number 107 [ 900.660948][ T24] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 901.533924][T18673] netlink: 'syz.6.3308': attribute type 1 has an invalid length. [ 902.384757][T18685] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 902.663730][T18686] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 902.746363][ T5897] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 902.972034][ T5897] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 903.015124][ T5897] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 903.108304][ T5897] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 903.138913][ T5897] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 903.165467][T18692] binder: 18691:18692 ioctl 4b4e 30 returned -22 [ 903.197154][T13766] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 903.222690][T18687] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 903.261884][ T5897] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 903.360888][T13766] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 903.374539][T13766] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 903.389686][T13766] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 903.538305][T13766] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 903.770304][T18685] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 903.792852][T13766] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 905.418485][T15791] usb 2-1: USB disconnect, device number 91 [ 905.688977][T18703] xt_CONNSECMARK: invalid mode: 0 [ 905.946490][T15791] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 905.989008][ T5955] usb 6-1: USB disconnect, device number 81 [ 906.171643][T15791] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 906.206612][T15791] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 906.235848][T15791] usb 2-1: Product: syz [ 906.244066][T15791] usb 2-1: Manufacturer: syz [ 906.284163][T15791] usb 2-1: SerialNumber: syz [ 906.307966][T18747] input: syz1 as /devices/virtual/input/input73 [ 906.311101][T15791] usb 2-1: config 0 descriptor?? [ 906.567719][T15791] usb 2-1: Firmware version (0.0) predates our first public release. [ 906.580360][T15791] usb 2-1: Please update to version 0.2 or newer [ 906.687080][T15791] usb 2-1: USB disconnect, device number 92 [ 907.230027][T18760] netlink: 'syz.3.3324': attribute type 1 has an invalid length. [ 907.947597][ T5829] usb 7-1: new full-speed USB device number 108 using dummy_hcd [ 907.998869][T18766] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3329'. [ 908.261927][ T5829] usb 7-1: config 0 has an invalid interface number: 113 but max is 0 [ 908.273479][ T5829] usb 7-1: config 0 has no interface number 0 [ 908.344098][ T5829] usb 7-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 908.376793][ T5829] usb 7-1: config 0 interface 113 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 908.426748][ T5829] usb 7-1: config 0 interface 113 has no altsetting 0 [ 908.474986][ T4340] bridge_slave_1: left allmulticast mode [ 908.489697][ T4340] bridge_slave_1: left promiscuous mode [ 908.496989][T15791] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 908.542965][ T5829] usb 7-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 908.553988][ T5829] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 908.570767][ T4340] bridge0: port 2(bridge_slave_1) entered disabled state [ 909.256327][T15791] usb 2-1: Using ep0 maxpacket: 16 [ 909.283701][ T5829] usb 7-1: Product: syz [ 909.296617][ T5829] usb 7-1: Manufacturer: syz [ 909.303848][ T5829] usb 7-1: SerialNumber: syz [ 909.311129][T15791] usb 2-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 909.322682][ T4340] bridge_slave_0: left allmulticast mode [ 909.325123][ T5829] usb 7-1: config 0 descriptor?? [ 909.339141][T15791] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 909.350486][ T4340] bridge_slave_0: left promiscuous mode [ 909.350741][ T4340] bridge0: port 1(bridge_slave_0) entered disabled state [ 909.357902][T15791] usb 2-1: Product: syz [ 909.379854][T15791] usb 2-1: Manufacturer: syz [ 909.385432][T15791] usb 2-1: SerialNumber: syz [ 909.396337][T13766] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 909.431351][T15791] usb 2-1: config 0 descriptor?? [ 909.622299][T13766] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 909.675338][T13766] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 909.716487][T13766] usb 6-1: Product: syz [ 909.722889][T13766] usb 6-1: Manufacturer: syz [ 909.737998][T13766] usb 6-1: SerialNumber: syz [ 909.864647][T15791] dvb_usb_dtv5100 2-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 909.894131][T13766] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 909.934806][ T5927] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 909.966061][T15791] usb 2-1: USB disconnect, device number 93 [ 910.392150][ T5829] usb 7-1: can't set config #0, error -71 [ 910.417000][ T5829] usb 7-1: USB disconnect, device number 108 [ 910.892521][T18777] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 911.057411][T18777] usb 2-1: Using ep0 maxpacket: 32 [ 911.068484][T18777] usb 2-1: too many endpoints for config 0 interface 0 altsetting 64: 255, using maximum allowed: 30 [ 911.083665][T18777] usb 2-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 108, changing to 10 [ 911.098984][T18777] usb 2-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 911.113519][T18777] usb 2-1: config 0 interface 0 altsetting 64 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 911.133578][ T5927] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 911.142039][ T5927] ath9k_htc: Failed to initialize the device [ 911.149897][T18777] usb 2-1: config 0 interface 0 has no altsetting 0 [ 911.150261][ T4340] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 911.163148][T18777] usb 2-1: New USB device found, idVendor=172f, idProduct=0038, bcdDevice= 0.00 [ 911.185674][T18777] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 911.211305][T18777] usb 2-1: config 0 descriptor?? [ 911.227962][ T5897] usb 7-1: new full-speed USB device number 109 using dummy_hcd [ 911.237632][ T5927] usb 6-1: ath9k_htc: USB layer deinitialized [ 911.398865][ T5897] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 911.424137][ T5897] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 911.483440][ T5897] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 911.496607][ T5897] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 911.507708][ T5897] usb 7-1: Product: syz [ 911.512660][ T5897] usb 7-1: Manufacturer: syz [ 911.520291][ T5897] usb 7-1: SerialNumber: syz [ 911.568480][T18777] usbhid 2-1:0.0: can't add hid device: -71 [ 911.575009][T18777] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 911.625676][T18777] usb 2-1: USB disconnect, device number 94 [ 911.720121][T17337] usb 6-1: USB disconnect, device number 82 [ 911.733711][T18798] netlink: 'syz.6.3335': attribute type 20 has an invalid length. [ 911.772996][ T5897] usb 7-1: 0:2 : does not exist [ 911.808747][ T5897] usb 7-1: 5:0: failed to get current value for ch 0 (-22) [ 911.841136][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 911.841157][ T30] audit: type=1326 audit(1768293760.826:2146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18804 comm="syz.5.3337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x7ffc0000 [ 911.901189][ T30] audit: type=1326 audit(1768293760.826:2147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18804 comm="syz.5.3337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x7ffc0000 [ 911.943119][ T30] audit: type=1326 audit(1768293760.826:2148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18804 comm="syz.5.3337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=213 compat=0 ip=0x7f246b38f749 code=0x7ffc0000 [ 911.991963][ T5897] usb 7-1: USB disconnect, device number 109 [ 912.017109][ T30] audit: type=1326 audit(1768293760.826:2149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18804 comm="syz.5.3337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x7ffc0000 [ 912.083898][ T8386] udevd[8386]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 912.116880][ T30] audit: type=1326 audit(1768293760.826:2150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18804 comm="syz.5.3337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x7ffc0000 [ 912.156497][ T30] audit: type=1326 audit(1768293760.826:2151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18804 comm="syz.5.3337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f246b38f749 code=0x7ffc0000 [ 912.221032][ T30] audit: type=1326 audit(1768293760.826:2152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18804 comm="syz.5.3337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x7ffc0000 [ 912.261881][ T30] audit: type=1326 audit(1768293760.826:2153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18804 comm="syz.5.3337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x7ffc0000 [ 912.299922][ T30] audit: type=1326 audit(1768293760.916:2154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18804 comm="syz.5.3337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=233 compat=0 ip=0x7f246b38f749 code=0x7ffc0000 [ 912.383088][ T30] audit: type=1326 audit(1768293760.916:2155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18804 comm="syz.5.3337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x7ffc0000 [ 912.457101][ T4340] bond1 (unregistering): (slave bond0): Releasing backup interface [ 912.481668][ T4340] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 912.499114][ T4340] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 912.514059][ T4340] bond0 (unregistering): Released all slaves [ 912.546478][ T5927] usb 6-1: new full-speed USB device number 83 using dummy_hcd [ 912.705570][ T5927] usb 6-1: device descriptor read/64, error -71 [ 912.755279][T15791] usb 7-1: new high-speed USB device number 110 using dummy_hcd [ 912.835079][ T4340] bond1 (unregistering): Released all slaves [ 912.851122][ T4340] bond2 (unregistering): Released all slaves [ 912.940193][T15791] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 912.960242][ T5927] usb 6-1: new full-speed USB device number 84 using dummy_hcd [ 912.984890][T15791] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 912.998882][T15791] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 913.030360][T15791] usb 7-1: config 0 descriptor?? [ 913.044460][T15791] pwc: Askey VC010 type 2 USB webcam detected. [ 913.146890][ T5927] usb 6-1: device descriptor read/64, error -71 [ 913.267124][ T5927] usb usb6-port1: attempt power cycle [ 913.295470][ T4340] bond3 (unregistering): (slave veth5): Releasing active interface [ 913.312102][ T4340] bond3 (unregistering): Released all slaves [ 913.346076][ T4340] bond4 (unregistering): Released all slaves [ 913.616716][ T5927] usb 6-1: new full-speed USB device number 85 using dummy_hcd [ 913.744016][ T4340] tipc: Left network mode [ 913.747798][ T5927] usb 6-1: device descriptor read/8, error -71 [ 914.159176][ T5927] usb 6-1: new full-speed USB device number 86 using dummy_hcd [ 914.236150][ T5927] usb 6-1: device descriptor read/8, error -71 [ 914.356954][ T5926] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 914.371560][ T5927] usb usb6-port1: unable to enumerate USB device [ 914.544095][ T5926] usb 4-1: Using ep0 maxpacket: 32 [ 914.565485][ T5926] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 914.608184][ T5926] usb 4-1: config 0 has no interface number 0 [ 914.678656][ T5926] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 914.733499][ T5926] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 914.755565][ T5926] usb 4-1: Product: syz [ 914.781546][ T5926] usb 4-1: Manufacturer: syz [ 914.813990][ T5926] usb 4-1: SerialNumber: syz [ 914.851975][ T5926] usb 4-1: config 0 descriptor?? [ 914.909521][ T5926] smsc95xx v2.0.0 [ 915.343942][ T5926] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 915.535237][ T5926] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 915.612932][ T5926] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 915.696869][ T5926] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 915.846908][ T5926] usb 4-1: USB disconnect, device number 93 [ 915.880373][T15791] pwc: recv_control_msg error -71 req 02 val 2b00 [ 915.945608][T15791] pwc: recv_control_msg error -71 req 02 val 2700 [ 915.986703][T15791] pwc: recv_control_msg error -71 req 02 val 2c00 [ 915.987031][T18830] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3343'. [ 916.174338][T15791] pwc: recv_control_msg error -71 req 04 val 1000 [ 916.246760][T15791] pwc: recv_control_msg error -71 req 04 val 1300 [ 916.282051][T15791] pwc: recv_control_msg error -71 req 04 val 1400 [ 916.311535][T15791] pwc: recv_control_msg error -71 req 02 val 2000 [ 916.357987][T15791] pwc: recv_control_msg error -71 req 02 val 2100 [ 916.398241][T15791] pwc: recv_control_msg error -71 req 04 val 1500 [ 916.437423][T15791] pwc: recv_control_msg error -71 req 02 val 2500 [ 916.459460][T15791] pwc: recv_control_msg error -71 req 02 val 2400 [ 916.478857][T15791] pwc: recv_control_msg error -71 req 02 val 2600 [ 916.587301][T15791] pwc: recv_control_msg error -71 req 02 val 2900 [ 916.633309][T15791] pwc: recv_control_msg error -71 req 02 val 2800 [ 916.667239][T15791] pwc: recv_control_msg error -71 req 04 val 1100 [ 916.693352][ T4340] hsr_slave_0: left promiscuous mode [ 916.734082][T15791] pwc: recv_control_msg error -71 req 04 val 1200 [ 916.777532][ T4340] hsr_slave_1: left promiscuous mode [ 916.830884][ T4340] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 916.890787][ T4340] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 916.949208][T15791] pwc: Registered as video103. [ 916.969491][T15791] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input74 [ 917.036044][T15791] usb 7-1: USB disconnect, device number 110 [ 917.085375][ T4340] batman_adv: batadv0: Removing interface: dummy0 [ 917.550398][ T4340] pim6reg (unregistering): left allmulticast mode [ 917.621838][T18867] FAULT_INJECTION: forcing a failure. [ 917.621838][T18867] name failslab, interval 1, probability 0, space 0, times 0 [ 917.662036][T18862] kvm: user requested TSC rate below hardware speed [ 917.674790][T18862] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3351'. [ 917.695659][T18867] CPU: 0 UID: 0 PID: 18867 Comm: syz.1.3352 Tainted: G L syzkaller #0 PREEMPT(full) [ 917.695690][T18867] Tainted: [L]=SOFTLOCKUP [ 917.695697][T18867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 917.695709][T18867] Call Trace: [ 917.695716][T18867] [ 917.695725][T18867] dump_stack_lvl+0xe8/0x150 [ 917.695755][T18867] should_fail_ex+0x414/0x560 [ 917.695788][T18867] should_failslab+0xa8/0x100 [ 917.695811][T18867] __kmalloc_noprof+0xdf/0x800 [ 917.695827][T18867] ? percpu_ref_get_many+0x18c/0x1e0 [ 917.695845][T18867] ? io_cache_alloc_new+0x40/0x100 [ 917.695875][T18867] io_cache_alloc_new+0x40/0x100 [ 917.695892][T18867] io_msg_alloc_async+0x1b2/0x2d0 [ 917.695911][T18867] io_sendmsg_prep+0x344/0x5f0 [ 917.695933][T18867] io_submit_sqes+0xad3/0x2140 [ 917.695977][T18867] __se_sys_io_uring_enter+0x2e0/0x2b60 [ 917.696016][T18867] ? ksys_write+0x1cb/0x250 [ 917.696036][T18867] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 917.696058][T18867] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 917.697191][T18867] ? __pfx_vfs_write+0x10/0x10 [ 917.697214][T18867] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 917.697239][T18867] ? __fget_files+0x3a0/0x420 [ 917.697319][T18867] ? fput+0xa0/0xd0 [ 917.697348][T18867] ? ksys_write+0x22a/0x250 [ 917.697366][T18867] ? __pfx_ksys_write+0x10/0x10 [ 917.697389][T18867] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 917.697416][T18867] do_syscall_64+0xec/0xf80 [ 917.697439][T18867] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 917.697462][T18867] ? trace_irq_disable+0x37/0x100 [ 917.697487][T18867] ? clear_bhb_loop+0x60/0xb0 [ 917.697509][T18867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 917.697527][T18867] RIP: 0033:0x7f982ff8f749 [ 917.697544][T18867] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 917.697557][T18867] RSP: 002b:00007f9830d68038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 917.697575][T18867] RAX: ffffffffffffffda RBX: 00007f98301e5fa0 RCX: 00007f982ff8f749 [ 917.697587][T18867] RDX: 000000000000ddd0 RSI: 0000000000003516 RDI: 0000000000000005 [ 917.697597][T18867] RBP: 00007f9830d68090 R08: 0000000000000000 R09: 0000000000000000 [ 917.697607][T18867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 917.697616][T18867] R13: 00007f98301e6038 R14: 00007f98301e5fa0 R15: 00007f983030fa28 [ 917.697642][T18867] [ 918.030495][T18868] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3351'. [ 918.040656][T18868] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3351'. [ 918.103001][T18870] netlink: 'syz.5.3351': attribute type 10 has an invalid length. [ 918.370057][ T5927] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 918.562689][ T5927] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 918.589348][ T5927] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 918.616924][ T5927] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 918.634494][ T5927] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 918.680009][T18871] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 918.720634][ T5927] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 918.948296][ T4340] team0 (unregistering): Port device team_slave_1 removed [ 919.088801][ T4340] team0 (unregistering): Port device team_slave_0 removed [ 919.910758][T18862] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 920.264314][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 920.264361][ T30] audit: type=1326 audit(1768293769.266:2161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18880 comm="syz.5.3356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x50000 [ 920.327948][T18884] input: syz0 as /devices/virtual/input/input75 [ 920.440634][ T30] audit: type=1326 audit(1768293769.266:2162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18880 comm="syz.5.3356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x50000 [ 920.559212][ T30] audit: type=1326 audit(1768293769.326:2163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18880 comm="syz.5.3356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x50000 [ 920.637615][ T30] audit: type=1326 audit(1768293769.326:2164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18880 comm="syz.5.3356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x50000 [ 920.923479][ T30] audit: type=1326 audit(1768293769.326:2165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18880 comm="syz.5.3356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x50000 [ 920.983284][ T30] audit: type=1326 audit(1768293769.326:2166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18880 comm="syz.5.3356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x50000 [ 921.081633][ T30] audit: type=1326 audit(1768293769.326:2167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18880 comm="syz.5.3356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x50000 [ 921.164461][ T30] audit: type=1326 audit(1768293769.326:2168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18880 comm="syz.5.3356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x50000 [ 921.205155][ T890] usb 2-1: USB disconnect, device number 95 [ 921.395854][ T30] audit: type=1326 audit(1768293769.326:2169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18880 comm="syz.5.3356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x50000 [ 921.503961][ T30] audit: type=1326 audit(1768293769.326:2170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18880 comm="syz.5.3356" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x50000 [ 922.115193][T15497] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 922.283225][T18919] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3366'. [ 922.562356][ T890] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 922.947097][T18946] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3371'. [ 923.135733][ T890] usb 4-1: Using ep0 maxpacket: 32 [ 923.151895][ T890] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 923.170916][ T890] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 923.234855][ T890] usb 4-1: config 0 descriptor?? [ 923.462791][ T890] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 923.500143][ T890] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 923.539111][ T890] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 923.555972][ T890] usb 4-1: media controller created [ 923.602141][ T890] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 923.721022][T18944] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 923.729850][T18944] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 923.753773][T18944] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 923.774197][T18944] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 923.801827][T18944] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 923.810725][ T890] DVB: Unable to find symbol dib7000p_attach() [ 923.847966][T18944] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 923.855933][ T890] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 923.892114][T18944] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 923.918175][T18944] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 923.966967][T18944] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 924.013666][T18944] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 924.047741][ T890] rc_core: IR keymap rc-dib0700-rc5 not found [ 924.079396][ T890] Registered IR keymap rc-empty [ 924.109611][ T890] dvb-usb: could not initialize remote control. [ 924.126394][ T890] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 924.193513][T18960] netlink: 'syz.5.3375': attribute type 8 has an invalid length. [ 924.205343][T18960] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 924.423713][T18969] openvswitch: : Dropping previously announced user features [ 924.649175][T18969] kvm: kvm [18958]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 924.677169][T18969] kvm: kvm [18958]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 925.098897][T15497] Bluetooth: hci3: command 0x0c1a tx timeout [ 925.105155][T18978] fuse: Bad value for 'fd' [ 925.226819][ T890] usb 4-1: USB disconnect, device number 94 [ 925.378102][ T890] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 925.389918][T18983] netlink: 'syz.3.3378': attribute type 10 has an invalid length. [ 925.417127][T18980] bond0: (slave bridge0): Releasing backup interface [ 925.472398][T18980] bridge0: port 2(bridge_slave_1) entered disabled state [ 925.484037][T18980] bridge0: port 1(bridge_slave_0) entered disabled state [ 925.730139][ T5829] hid-generic 009C:0008:0003.001C: unknown main item tag 0x0 [ 925.744327][ T5829] hid-generic 009C:0008:0003.001C: unknown main item tag 0x0 [ 925.823745][T15497] Bluetooth: hci4: command 0x0406 tx timeout [ 925.823747][T14362] Bluetooth: hci1: command 0x0406 tx timeout [ 925.837719][T14362] Bluetooth: hci2: command 0x0c1a tx timeout [ 925.858305][T18980] bridge_slave_0: left allmulticast mode [ 925.864707][T18980] bridge_slave_0: left promiscuous mode [ 925.899222][ T5829] hid-generic 009C:0008:0003.001C: unknown main item tag 0x0 [ 925.953780][ T5829] hid-generic 009C:0008:0003.001C: unknown main item tag 0x0 [ 926.006361][T14362] Bluetooth: hci0: command 0x0c1a tx timeout [ 926.006630][T18980] bridge0: port 1(bridge_slave_0) entered disabled state [ 926.016403][ T5829] hid-generic 009C:0008:0003.001C: unknown main item tag 0x0 [ 926.036689][ T5829] hid-generic 009C:0008:0003.001C: unknown main item tag 0x0 [ 926.049771][ T5829] hid-generic 009C:0008:0003.001C: unknown main item tag 0x0 [ 926.058357][ T5829] hid-generic 009C:0008:0003.001C: unknown main item tag 0x0 [ 926.116821][ T5829] hid-generic 009C:0008:0003.001C: hidraw0: HID v0.05 Device [syz1] on syz0 [ 926.169517][T18980] bridge_slave_1: left allmulticast mode [ 926.198240][T18980] bridge_slave_1: left promiscuous mode [ 926.306300][T18980] bridge0: port 2(bridge_slave_1) entered disabled state [ 926.484188][T18980] bond0: (slave bond_slave_0): Releasing backup interface [ 926.525924][T18980] bond0: (slave bond_slave_1): Releasing backup interface [ 926.574653][T18980] team0: Port device team_slave_0 removed [ 926.674208][T18980] team0: Port device team_slave_1 removed [ 926.745090][T18980] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 926.801670][T18980] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 926.849283][T18980] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 926.860599][T18980] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 926.881262][T18980] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 926.953732][T19011] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3382'. [ 927.111333][T18983] 8021q: adding VLAN 0 to HW filter on device bond0 [ 927.123345][T18983] team0: Port device bond0 added [ 927.187058][T19012] Option ' ÜÛPu©ª¡´ià ' to dns_resolver key: bad/missing value [ 927.208669][T17335] usb 7-1: new high-speed USB device number 111 using dummy_hcd [ 927.269751][T18994] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3381'. [ 927.399911][T17335] usb 7-1: Using ep0 maxpacket: 8 [ 927.416185][T17335] usb 7-1: config 4 has an invalid interface number: 194 but max is 0 [ 927.425799][T17335] usb 7-1: config 4 has no interface number 0 [ 927.449547][T17335] usb 7-1: config 4 interface 194 altsetting 8 endpoint 0xA has an invalid bInterval 238, changing to 7 [ 927.485635][T17335] usb 7-1: config 4 interface 194 has no altsetting 0 [ 927.498010][T17335] usb 7-1: New USB device found, idVendor=19d2, idProduct=f4df, bcdDevice=4a.2d [ 927.509353][T17335] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 927.562377][T17335] usb 7-1: Product: Ѓ [ 927.578485][T19014] FAULT_INJECTION: forcing a failure. [ 927.578485][T19014] name failslab, interval 1, probability 0, space 0, times 0 [ 927.590592][T17335] usb 7-1: Manufacturer: â [ 927.613368][T19014] CPU: 1 UID: 0 PID: 19014 Comm: syz.7.3384 Tainted: G L syzkaller #0 PREEMPT(full) [ 927.613389][T19014] Tainted: [L]=SOFTLOCKUP [ 927.613394][T19014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 927.613401][T19014] Call Trace: [ 927.613407][T19014] [ 927.613412][T19014] dump_stack_lvl+0xe8/0x150 [ 927.613431][T19014] should_fail_ex+0x414/0x560 [ 927.613451][T19014] should_failslab+0xa8/0x100 [ 927.613466][T19014] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 927.613483][T19014] ? __alloc_skb+0x198/0x3a0 [ 927.613495][T19014] ? __alloc_skb+0x1dc/0x3a0 [ 927.613505][T19014] ? __local_bh_enable_ip+0xd0/0x130 [ 927.613517][T19014] ? __alloc_skb+0x198/0x3a0 [ 927.613529][T19014] __alloc_skb+0x1dc/0x3a0 [ 927.613542][T19014] alloc_skb_with_frags+0xca/0x890 [ 927.613556][T19014] ? __lock_acquire+0x6b6/0x2cf0 [ 927.613571][T19014] sock_alloc_send_pskb+0x84d/0x980 [ 927.613594][T19014] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 927.613610][T19014] ? dev_get_by_index+0x22/0x2e0 [ 927.613625][T19014] ? dev_get_by_index+0x22/0x2e0 [ 927.613643][T19014] packet_sendmsg+0x33a0/0x5080 [ 927.613663][T19014] ? aa_label_match+0x1b70/0x1be0 [ 927.613676][T19014] ? __lock_acquire+0x6b6/0x2cf0 [ 927.613699][T19014] ? aa_sk_perm+0x15f/0x920 [ 927.613713][T19014] ? __pfx_packet_sendmsg+0x10/0x10 [ 927.613726][T19014] ? aa_sk_perm+0x7ee/0x920 [ 927.613741][T19014] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 927.613759][T19014] ? aa_sock_msg_perm+0xf1/0x1b0 [ 927.613773][T19014] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 927.613783][T19014] ? __pfx_packet_sendmsg+0x10/0x10 [ 927.613797][T19014] __sock_sendmsg+0x21c/0x270 [ 927.613816][T19014] __sys_sendto+0x3bd/0x520 [ 927.613829][T19014] ? __pfx___sys_sendto+0x10/0x10 [ 927.613840][T19014] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 927.613858][T19014] ? __fget_files+0x3a0/0x420 [ 927.613877][T19014] ? ksys_write+0x22a/0x250 [ 927.613888][T19014] ? __pfx_ksys_write+0x10/0x10 [ 927.613901][T19014] __x64_sys_sendto+0xde/0x100 [ 927.613914][T19014] do_syscall_64+0xec/0xf80 [ 927.613926][T19014] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 927.613936][T19014] ? trace_irq_disable+0x37/0x100 [ 927.613951][T19014] ? clear_bhb_loop+0x60/0xb0 [ 927.613963][T19014] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 927.613973][T19014] RIP: 0033:0x7f0a1058f749 [ 927.613984][T19014] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 927.613994][T19014] RSP: 002b:00007f0a1136c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 927.614008][T19014] RAX: ffffffffffffffda RBX: 00007f0a107e5fa0 RCX: 00007f0a1058f749 [ 927.614016][T19014] RDX: 000000000000000e RSI: 0000200000000240 RDI: 0000000000000003 [ 927.614023][T19014] RBP: 00007f0a1136c090 R08: 0000200000000200 R09: 0000000000000014 [ 927.614032][T19014] R10: 0000000000040080 R11: 0000000000000246 R12: 0000000000000001 [ 927.614039][T19014] R13: 00007f0a107e6038 R14: 00007f0a107e5fa0 R15: 00007f0a1090fa28 [ 927.614057][T19014] [ 927.616165][T17335] usb 7-1: SerialNumber: 倊 [ 927.916595][T14362] Bluetooth: hci2: command 0x0c1a tx timeout [ 927.936362][T15497] Bluetooth: hci4: command 0x0406 tx timeout [ 928.076365][T15497] Bluetooth: hci0: command 0x0c1a tx timeout [ 928.237994][T19016] netlink: 'syz.7.3385': attribute type 12 has an invalid length. [ 928.267424][T19016] netlink: 'syz.7.3385': attribute type 29 has an invalid length. [ 928.307314][T19016] netlink: 148 bytes leftover after parsing attributes in process `syz.7.3385'. [ 928.390348][T19016] netlink: 'syz.7.3385': attribute type 1 has an invalid length. [ 928.431098][T19016] netlink: 43 bytes leftover after parsing attributes in process `syz.7.3385'. [ 928.519775][T17335] option 7-1:4.194: GSM modem (1-port) converter detected [ 928.580460][T17335] usb 7-1: USB disconnect, device number 111 [ 928.600492][T17335] option 7-1:4.194: device disconnected [ 928.703711][T19027] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3389'. [ 929.116465][T13766] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 929.358327][T13766] usb 2-1: Using ep0 maxpacket: 32 [ 929.826057][ T5829] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 929.876790][T13766] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 929.899814][T13766] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 929.926039][T13766] usb 2-1: config 0 descriptor?? [ 929.997646][ T5829] usb 6-1: Using ep0 maxpacket: 16 [ 930.017417][T15497] Bluetooth: hci2: command 0x0c1a tx timeout [ 930.033434][T19048] netlink: 'syz.3.3392': attribute type 1 has an invalid length. [ 930.100465][ T5829] usb 6-1: config 0 has no interfaces? [ 930.109207][ T5829] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 930.139194][ T5829] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 930.149159][ T5829] usb 6-1: Manufacturer: syz [ 930.156373][T15497] Bluetooth: hci0: command 0x0c1a tx timeout [ 930.175814][ T5829] usb 6-1: config 0 descriptor?? [ 930.274067][T13766] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 930.286119][T13766] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 930.321957][T13766] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 930.332389][T13766] usb 2-1: media controller created [ 930.359226][T13766] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 930.928719][T13766] DVB: Unable to find symbol dib7000p_attach() [ 930.939443][T13766] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 931.180168][T13766] rc_core: IR keymap rc-dib0700-rc5 not found [ 931.190753][T13766] Registered IR keymap rc-empty [ 931.241861][T13766] dvb-usb: could not initialize remote control. [ 931.261118][T13766] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 931.524152][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.570858][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.922454][ T890] usb 6-1: USB disconnect, device number 87 [ 932.122388][T13766] usb 2-1: USB disconnect, device number 96 [ 932.631427][T13766] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 935.548987][T19112] 8021q: adding VLAN 0 to HW filter on device bond0 [ 935.574303][T19112] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 936.319968][T19143] syz_tun: entered allmulticast mode [ 936.366062][T19140] syz_tun: left allmulticast mode [ 936.465351][T19151] bond1: (slave lo): Releasing backup interface [ 936.500891][T19151] bond1: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 936.524079][T19156] netlink: 'syz.1.3430': attribute type 10 has an invalid length. [ 936.536764][ T5897] usb 7-1: new high-speed USB device number 112 using dummy_hcd [ 936.562141][T19151] bond2: (slave dummy0): Releasing active interface [ 936.592480][T19151] bridge_slave_0: left allmulticast mode [ 936.610167][T19151] bridge_slave_0: left promiscuous mode [ 936.623237][T19151] bridge0: port 1(bridge_slave_0) entered disabled state [ 936.640012][T19151] bridge_slave_1: left allmulticast mode [ 936.647514][T19151] bridge_slave_1: left promiscuous mode [ 936.654115][T19151] bridge0: port 2(bridge_slave_1) entered disabled state [ 936.670081][T19151] bond0: (slave bond_slave_0): Releasing backup interface [ 936.705717][T19151] bond0: (slave bond_slave_1): Releasing backup interface [ 936.706295][ T5897] usb 7-1: Using ep0 maxpacket: 8 [ 936.733312][ T5897] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 936.744812][ T5897] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 936.750364][T19151] team0: Port device team_slave_0 removed [ 936.758796][ T5897] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 936.775683][ T5897] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 936.781353][T19151] team0: Port device team_slave_1 removed [ 936.802761][T19151] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 936.803787][ T5897] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 936.815719][T19151] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 936.834121][ T5897] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 936.845317][ T5897] usb 7-1: Product: syz [ 936.849946][T19151] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 936.856375][ T5897] usb 7-1: Manufacturer: syz [ 936.860578][T19151] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 936.864560][ T5897] usb 7-1: SerialNumber: syz [ 936.868635][T19144] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 936.912262][T19151] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 936.987959][T19156] bond0: (slave wlan1): Opening slave failed [ 937.015176][T19163] syz_tun: entered allmulticast mode [ 937.037070][T19167] lo: entered allmulticast mode [ 937.057194][T19157] syz_tun: left allmulticast mode [ 937.115875][ T5897] cdc_ether 7-1:1.0: probe with driver cdc_ether failed with error -22 [ 937.174585][ T5897] usb 7-1: USB disconnect, device number 112 [ 937.771286][T19201] syzkaller0: entered promiscuous mode [ 937.777981][T19201] syzkaller0: entered allmulticast mode [ 939.125052][T19241] xt_hashlimit: max too large, truncated to 1048576 [ 939.886488][ T5897] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 940.046534][ T5897] usb 2-1: Using ep0 maxpacket: 32 [ 940.060574][ T5897] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 940.081925][ T5897] usb 2-1: config 0 has no interface number 0 [ 940.112723][ T5897] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 940.138052][ T5897] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 940.164265][ T5897] usb 2-1: Product: syz [ 940.176666][ T5897] usb 2-1: Manufacturer: syz [ 940.189500][ T5897] usb 2-1: SerialNumber: syz [ 940.210080][ T5897] usb 2-1: config 0 descriptor?? [ 940.226975][ T5897] smsc95xx v2.0.0 [ 940.870770][T19294] netlink: 'syz.5.3485': attribute type 3 has an invalid length. [ 940.941267][T19296] syzkaller0: entered promiscuous mode [ 940.962761][T19296] syzkaller0: entered allmulticast mode [ 941.030665][T15497] Bluetooth: hci1: Malformed LE Event: 0x0b [ 941.040821][ T5897] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 941.226464][ T890] usb 7-1: new high-speed USB device number 113 using dummy_hcd [ 941.245762][ T5897] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 941.277493][ T5897] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 941.306742][ T5897] usb 2-1: USB disconnect, device number 97 [ 941.408823][ T890] usb 7-1: Using ep0 maxpacket: 32 [ 941.431571][ T890] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 941.461980][ T890] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 941.491425][ T890] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 941.570681][ T890] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 941.606307][ T890] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 941.620598][ T890] usb 7-1: Product: syz [ 941.625181][ T890] usb 7-1: Manufacturer: syz [ 941.655490][ T890] usb 7-1: SerialNumber: syz [ 941.688741][ T890] cdc_ncm 7-1:1.0: skipping garbage [ 941.695239][ T890] cdc_ncm 7-1:1.0: skipping garbage [ 941.706604][ T890] cdc_ncm 7-1:1.0: CDC Union missing and no IAD found [ 941.727194][ T890] cdc_ncm 7-1:1.0: bind() failure [ 941.875950][T15791] usb 7-1: USB disconnect, device number 113 [ 941.896605][ T5897] usb 4-1: new full-speed USB device number 95 using dummy_hcd [ 941.906883][T19331] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3503'. [ 942.080855][ T5897] usb 4-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 942.101906][ T5897] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 942.141276][ T5897] usb 4-1: config 0 descriptor?? [ 942.641525][T19345] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3508'. [ 943.650031][T19381] mac80211_hwsim hwsim22 syzkaller0: entered promiscuous mode [ 943.662756][T15497] Bluetooth: hci3: unexpected event for opcode 0x1003 [ 943.666446][T19381] mac80211_hwsim hwsim22 syzkaller0: entered allmulticast mode [ 943.997720][ T5897] pegasus 4-1:0.0: setup Pegasus II specific registers [ 944.023511][T19392] input: syz1 as /devices/virtual/input/input78 [ 944.126879][ T5897] pegasus 4-1:0.0: can't locate MII phy, using default [ 944.175530][T19394] binder: 19393:19394 ioctl c0306201 200000000680 returned -14 [ 944.197184][ T5897] pegasus 4-1:0.0: eth13, ELECOM USB Ethernet LD-USB20, c2:2e:29:6c:0c:3b [ 944.235141][ T5897] usb 4-1: USB disconnect, device number 95 [ 944.882848][T19419] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3539'. [ 944.914519][T19423] syz_tun: entered allmulticast mode [ 944.965962][T19421] syz_tun: left allmulticast mode [ 945.169298][T19434] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3544'. [ 945.620931][ T30] kauditd_printk_skb: 59 callbacks suppressed [ 945.620950][ T30] audit: type=1326 audit(1768293794.626:2230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19456 comm="syz.7.3553" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0a1058f749 code=0x0 [ 945.659997][T19455] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3554'. [ 946.038179][ T30] audit: type=1326 audit(1768293795.046:2231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19469 comm="syz.1.3557" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f982ff8f749 code=0x0 [ 946.739853][T15791] usb 7-1: new high-speed USB device number 114 using dummy_hcd [ 946.919584][T15791] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 946.963169][T15791] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 947.002974][T15791] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 947.053365][T15791] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 947.075116][T15791] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 947.120150][T15791] usb 7-1: config 0 descriptor?? [ 947.568237][T17335] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 947.624934][T15791] plantronics 0003:047F:FFFF.001D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 947.679475][T15497] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 947.692115][T15497] Bluetooth: hci3: Injecting HCI hardware error event [ 947.706452][T15497] Bluetooth: hci3: hardware error 0x00 [ 947.746406][T17335] usb 4-1: Using ep0 maxpacket: 32 [ 947.762058][T17335] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 41, changing to 9 [ 947.783528][T19522] xt_CT: You must specify a L4 protocol and not use inversions on it [ 947.796744][T17335] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid maxpacket 1246, setting to 1024 [ 947.814788][T17335] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 947.831441][T17335] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 79, changing to 10 [ 947.844688][T17335] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid maxpacket 34258, setting to 1024 [ 947.869204][T15791] usb 7-1: USB disconnect, device number 114 [ 947.925258][T17335] usb 4-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 947.939249][T17335] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 947.951368][T17335] usb 4-1: Product: syz [ 947.960311][T17335] usb 4-1: Manufacturer: syz [ 947.969785][T17335] usb 4-1: SerialNumber: syz [ 947.987815][T17335] usb 4-1: config 0 descriptor?? [ 948.019052][T19517] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 948.033058][T19527] fido_id[19527]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 948.036005][T19517] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 948.193259][T17335] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input80 [ 948.729644][T17335] usb 4-1: USB disconnect, device number 96 [ 948.729705][ C0] xpad 4-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 948.783250][T19506] netlink: 'syz.7.3568': attribute type 27 has an invalid length. [ 948.810165][T19536] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3577'. [ 949.030370][T19506] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 949.756394][T15497] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 950.376557][T15791] usb 7-1: new high-speed USB device number 115 using dummy_hcd [ 950.629079][T15791] usb 7-1: Using ep0 maxpacket: 16 [ 950.664630][T15791] usb 7-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 950.677248][T15791] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 950.691928][T15791] usb 7-1: Product: syz [ 950.703429][T15791] usb 7-1: Manufacturer: syz [ 950.712687][T15791] usb 7-1: SerialNumber: syz [ 950.731212][T15791] usb 7-1: config 0 descriptor?? [ 951.169733][T15791] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 951.205889][T15791] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 951.432953][T15791] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 951.433225][T19549] dtv5100: wlen = 0, aborting. [ 951.483159][T15791] usb 7-1: media controller created [ 951.550284][T15791] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 951.717638][T15791] zl10353_read_register: readreg error (reg=127, ret==0) [ 951.735129][T15791] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 951.818510][T15791] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 951.879744][T15791] usb 7-1: USB disconnect, device number 115 [ 952.010710][T15791] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 952.111836][T19571] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3589'. [ 952.426416][T15791] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 952.449957][T19580] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3592'. [ 952.586328][T15791] usb 2-1: Using ep0 maxpacket: 8 [ 952.598761][T15791] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 952.609705][T15791] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 952.625608][T15791] pvrusb2: Hardware description: Terratec Grabster AV400 [ 952.642337][T15791] pvrusb2: ********** [ 952.647716][T15791] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 952.670062][T15791] pvrusb2: Important functionality might not be entirely working. [ 952.682368][T15791] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 952.696115][T15791] pvrusb2: ********** [ 952.824930][ T2346] pvrusb2: Invalid write control endpoint [ 952.873823][T19589] xt_CT: You must specify a L4 protocol and not use inversions on it [ 953.012601][T19594] syz_tun: entered allmulticast mode [ 953.036028][T15791] usb 2-1: USB disconnect, device number 98 [ 953.112375][ T2346] pvrusb2: Invalid write control endpoint [ 953.125735][T19593] syz_tun: left allmulticast mode [ 953.138956][ T2346] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 953.160219][ T2346] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 953.180053][ T2346] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 953.206892][ T2346] pvrusb2: Device being rendered inoperable [ 953.221048][ T2346] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 953.252780][ T2346] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_c) [ 953.285444][ T2346] pvrusb2: Attached sub-driver cx25840 [ 953.307586][T19597] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3596'. [ 953.314543][ T2346] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 953.361058][ T2346] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 953.966387][T19613] netlink: 48 bytes leftover after parsing attributes in process `syz.7.3601'. [ 954.403823][T19616] xt_CT: You must specify a L4 protocol and not use inversions on it [ 954.853123][T15791] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 954.962830][T19631] syz_tun: entered allmulticast mode [ 954.972204][T19630] syz_tun: left allmulticast mode [ 955.017321][T15791] usb 4-1: Using ep0 maxpacket: 16 [ 955.027542][T15791] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 955.040181][T15791] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 955.049131][T15791] usb 4-1: Product: syz [ 955.055304][T15791] usb 4-1: Manufacturer: syz [ 955.060860][T15791] usb 4-1: SerialNumber: syz [ 955.123180][T15791] usb 4-1: config 0 descriptor?? [ 955.295218][T19637] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3608'. [ 955.552565][T15791] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 955.598862][T15791] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 955.623588][T15791] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 955.676008][T15791] usb 4-1: media controller created [ 955.744169][T15791] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 955.807118][T19625] dtv5100: wlen = 0, aborting. [ 955.901390][T19650] syz_tun: entered allmulticast mode [ 955.940811][T19649] syz_tun: left allmulticast mode [ 956.016715][T15791] zl10353_read_register: readreg error (reg=127, ret==0) [ 956.026685][T15791] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 956.069907][T15791] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 956.176988][ T890] usb 4-1: USB disconnect, device number 97 [ 956.341012][T19662] xt_CT: You must specify a L4 protocol and not use inversions on it [ 956.587491][ T890] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 956.629392][T19667] syz_tun: entered allmulticast mode [ 956.836478][T19664] syz_tun: left allmulticast mode [ 957.210166][T19675] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3616'. [ 957.365231][T19671] netlink: 'syz.5.3615': attribute type 1 has an invalid length. [ 957.822777][T14362] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 957.844005][T19685] binder: 19684:19685 ioctl 4b4e 30 returned -22 [ 957.864506][T14362] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 957.906486][T14362] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 957.932649][T14362] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 957.946907][T14362] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 958.444066][T17335] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 958.613008][T19697] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3624'. [ 958.647068][T17335] usb 2-1: Using ep0 maxpacket: 16 [ 958.702411][T17335] usb 2-1: config 0 has no interfaces? [ 958.714581][T17335] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 958.725287][T17335] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 958.736468][T17335] usb 2-1: Manufacturer: syz [ 958.759543][T17335] usb 2-1: config 0 descriptor?? [ 959.252140][ T6030] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 959.256529][ T890] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 959.365641][T19708] syz_tun: entered allmulticast mode [ 959.426064][ T6030] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 959.456348][ T890] usb 4-1: Using ep0 maxpacket: 16 [ 959.469534][ T890] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 959.483287][ T890] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 959.512037][T19704] syz_tun: left allmulticast mode [ 959.544378][ T890] usb 4-1: Product: syz [ 959.567501][ T890] usb 4-1: Manufacturer: syz [ 959.592663][ T890] usb 4-1: SerialNumber: syz [ 959.612607][ T890] usb 4-1: config 0 descriptor?? [ 959.657269][ T6030] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 959.738767][T19690] chnl_net:caif_netlink_parms(): no params data found [ 959.814206][ T6030] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 959.996605][T15497] Bluetooth: hci5: command tx timeout [ 960.043710][ T890] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 960.060202][ T890] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 960.073867][ T890] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 960.085805][ T890] usb 4-1: media controller created [ 960.125137][ T890] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 960.212621][T19690] bridge0: port 1(bridge_slave_0) entered blocking state [ 960.222239][T19690] bridge0: port 1(bridge_slave_0) entered disabled state [ 960.236950][T19690] bridge_slave_0: entered allmulticast mode [ 960.253597][T19690] bridge_slave_0: entered promiscuous mode [ 960.274475][T19690] bridge0: port 2(bridge_slave_1) entered blocking state [ 960.283818][T19690] bridge0: port 2(bridge_slave_1) entered disabled state [ 960.292628][T19690] bridge_slave_1: entered allmulticast mode [ 960.305696][ T890] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 960.316617][ T890] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 960.336974][T19690] bridge_slave_1: entered promiscuous mode [ 960.517610][T19703] dtv5100: wlen = 0, aborting. [ 960.535751][T19690] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 960.565410][ T6030] bridge_slave_1: left allmulticast mode [ 960.574803][ T6030] bridge_slave_1: left promiscuous mode [ 960.605167][ T6030] bridge0: port 2(bridge_slave_1) entered disabled state [ 960.684406][ T6030] bridge_slave_0: left allmulticast mode [ 960.696613][ T6030] bridge_slave_0: left promiscuous mode [ 960.717140][ T6030] bridge0: port 1(bridge_slave_0) entered disabled state [ 960.810424][T17337] usb 4-1: USB disconnect, device number 98 [ 960.896148][ T890] usb 2-1: USB disconnect, device number 99 [ 960.896995][T17337] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 961.519456][ T6030] .` (unregistering): (slave bridge0): Releasing backup interface [ 961.779572][ T6030] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 961.793254][ T6030] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 961.805652][ T6030] .` (unregistering): Released all slaves [ 962.092898][T15497] Bluetooth: hci5: command tx timeout [ 962.122132][ T6030] bond1 (unregistering): Released all slaves [ 962.147043][ T6030] bond2 (unregistering): Released all slaves [ 962.215273][ T6030] bond3 (unregistering): Released all slaves [ 962.283663][T19741] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3636'. [ 962.599433][T19744] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3635'. [ 962.670503][ T6030] bond5 (unregistering): (slave bond0): Releasing backup interface [ 962.706683][ T6030] bond0 (unregistering): (slave veth3): Releasing active interface [ 962.720857][ T6030] bond0 (unregistering): Released all slaves [ 962.762586][ T6030] bond4 (unregistering): Released all slaves [ 963.171472][ T6030] bond5 (unregistering): Released all slaves [ 963.185977][T19690] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 963.392434][ T6030] : left promiscuous mode [ 963.548065][T19690] team0: Port device team_slave_0 added [ 963.579533][T19690] team0: Port device team_slave_1 added [ 963.758687][T19690] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 963.775593][T19690] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 963.843765][T19690] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 963.897437][T19690] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 963.918285][T19690] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 963.967230][T19690] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 963.996898][T19767] syz_tun: entered allmulticast mode [ 964.024050][T19766] syz_tun: left allmulticast mode [ 964.048845][T15791] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 964.157206][T15497] Bluetooth: hci5: command tx timeout [ 964.236414][T15791] usb 4-1: Using ep0 maxpacket: 16 [ 964.251604][T15791] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 964.263901][T15791] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 964.272763][T19690] hsr_slave_0: entered promiscuous mode [ 964.290003][T15791] usb 4-1: Product: syz [ 964.291895][T19690] hsr_slave_1: entered promiscuous mode [ 964.301255][T15791] usb 4-1: Manufacturer: syz [ 964.315829][T15791] usb 4-1: SerialNumber: syz [ 964.323226][T19690] debugfs: 'hsr0' already exists in 'hsr' [ 964.339448][T19690] Cannot create hsr debugfs directory [ 964.352934][T15791] usb 4-1: config 0 descriptor?? [ 964.635051][T19790] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3649'. [ 964.797768][T15791] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 964.878531][T15791] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 964.920679][T15791] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 964.931161][T15791] usb 4-1: media controller created [ 964.975762][T15791] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 965.090694][T19765] dtv5100: wlen = 0, aborting. [ 965.154945][T19792] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3648'. [ 965.288850][ T6030] hsr_slave_0: left promiscuous mode [ 965.300479][T15791] zl10353_read_register: readreg error (reg=127, ret==0) [ 965.315997][ T6030] hsr_slave_1: left promiscuous mode [ 965.316007][T15791] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 965.316024][T15791] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 965.443108][ T6030] veth1_macvtap: left promiscuous mode [ 965.452748][ T6030] veth0_macvtap: left promiscuous mode [ 965.466527][ T6030] veth1_vlan: left promiscuous mode [ 965.472531][ T6030] veth0_vlan: left promiscuous mode [ 965.491097][T15791] usb 4-1: USB disconnect, device number 99 [ 965.625775][T15791] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 965.958032][ T5897] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 966.131876][ T5897] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 966.146545][ T5897] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 966.173185][ T5897] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 966.203510][ T5897] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 966.243413][T19808] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 966.251569][T15497] Bluetooth: hci5: command tx timeout [ 966.269923][ T5897] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 967.155833][ T6030] team0 (unregistering): Port device team_slave_1 removed [ 967.258688][ T6030] team0 (unregistering): Port device team_slave_0 removed [ 968.234130][T19806] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 968.451715][T19819] netlink: 'syz.3.3655': attribute type 12 has an invalid length. [ 969.125018][T19837] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3659'. [ 969.196523][T17337] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 969.369530][T17337] usb 6-1: Using ep0 maxpacket: 8 [ 969.411267][ T5897] usb 2-1: USB disconnect, device number 100 [ 969.432799][T17337] usb 6-1: config 179 has an invalid interface number: 97 but max is 0 [ 969.459527][T19844] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3661'. [ 969.466359][T17337] usb 6-1: config 179 has no interface number 0 [ 969.519940][T17337] usb 6-1: config 179 interface 97 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 969.597481][T17337] usb 6-1: config 179 interface 97 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 969.640405][T17337] usb 6-1: config 179 interface 97 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 969.706446][T17337] usb 6-1: config 179 interface 97 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 969.742023][T17337] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.ce [ 969.781183][T17337] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 969.804546][T19690] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 969.817979][T19830] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 969.900715][T19690] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 969.947120][T19690] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 969.988744][T19690] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 970.196654][T15791] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 970.366648][T19690] 8021q: adding VLAN 0 to HW filter on device bond0 [ 970.375311][T15791] usb 2-1: Using ep0 maxpacket: 8 [ 970.399707][T15791] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 970.455398][ T6030] IPVS: stop unused estimator thread 0... [ 970.468026][T19690] 8021q: adding VLAN 0 to HW filter on device team0 [ 970.478554][T15791] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 970.510426][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state [ 970.519407][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 970.545840][T15791] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 970.563909][ T7855] bridge0: port 2(bridge_slave_1) entered blocking state [ 970.571780][ T7855] bridge0: port 2(bridge_slave_1) entered forwarding state [ 970.582159][T15791] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 970.612570][T15791] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 970.639846][T15791] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 970.952001][T15791] usb 2-1: GET_CAPABILITIES returned 0 [ 970.989923][T15791] usbtmc 2-1:16.0: can't read capabilities [ 971.052111][T19690] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 971.173315][T19690] veth0_vlan: entered promiscuous mode [ 971.195173][T19690] veth1_vlan: entered promiscuous mode [ 971.245526][T19690] veth0_macvtap: entered promiscuous mode [ 971.273602][T19690] veth1_macvtap: entered promiscuous mode [ 971.341510][T19690] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 971.384586][T19690] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 971.436066][ T13] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 971.460965][ T13] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 971.483752][ T13] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 971.496859][T19878] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3663'. [ 971.535143][ T13] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 971.803937][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 971.838421][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 971.860429][T15791] usb 6-1: USB disconnect, device number 88 [ 971.954518][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 971.981168][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 973.055230][T13766] usb 2-1: USB disconnect, device number 101 [ 973.586382][T13766] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 973.757708][T13766] usb 2-1: Using ep0 maxpacket: 8 [ 973.769369][T13766] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 973.791423][T13766] usb 2-1: config 179 has no interface number 0 [ 973.799388][T13766] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 973.818839][T13766] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 973.835710][T13766] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 973.858776][T13766] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 973.875661][T13766] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 973.905939][T13766] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 973.944470][T13766] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 974.127503][T19933] Cannot find del_set index 0 as target [ 974.157239][T19916] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 974.443552][ T890] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input81 [ 974.801401][ T5897] usb 2-1: USB disconnect, device number 102 [ 974.801498][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 974.819638][ C1] dummy_hcd dummy_hcd.1: timer fired with no URBs pending? [ 975.542273][T19964] xt_CT: You must specify a L4 protocol and not use inversions on it [ 975.863526][T19969] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3681'. [ 976.686376][T17335] usb 7-1: new high-speed USB device number 116 using dummy_hcd [ 976.826395][T17335] usb 7-1: device descriptor read/64, error -71 [ 977.076455][T17335] usb 7-1: new high-speed USB device number 117 using dummy_hcd [ 977.356194][T19991] xt_CT: You must specify a L4 protocol and not use inversions on it [ 977.366830][T17335] usb 7-1: device descriptor read/64, error -71 [ 977.519364][T17335] usb usb7-port1: attempt power cycle [ 977.563697][T19990] xt_CT: You must specify a L4 protocol and not use inversions on it [ 977.717916][ T890] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 977.948395][ T890] usb 4-1: Using ep0 maxpacket: 32 [ 978.016837][T17335] usb 7-1: new high-speed USB device number 118 using dummy_hcd [ 978.036740][ T890] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 978.037027][T17335] usb 7-1: device descriptor read/8, error -71 [ 978.054691][ T890] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 978.115211][ T890] usb 4-1: config 0 descriptor?? [ 978.296458][T17335] usb 7-1: new high-speed USB device number 119 using dummy_hcd [ 978.348363][T17335] usb 7-1: device descriptor read/8, error -71 [ 978.430500][ T890] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 978.449255][ T890] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 978.476721][T17335] usb usb7-port1: unable to enumerate USB device [ 978.484818][ T890] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 978.510213][ T890] usb 4-1: media controller created [ 978.581847][ T890] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 978.716776][ T890] DVB: Unable to find symbol dib7000p_attach() [ 978.734412][ T890] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 978.838781][ T890] rc_core: IR keymap rc-dib0700-rc5 not found [ 978.860640][ T890] Registered IR keymap rc-empty [ 978.860933][T20018] syz_tun: entered allmulticast mode [ 978.874308][ T890] dvb-usb: could not initialize remote control. [ 978.885314][ T890] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 979.006553][T20017] syz_tun: left allmulticast mode [ 979.199311][T20021] process '/newroot/414/file0' started with executable stack [ 979.956486][T13766] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 980.658556][T13766] usb 2-1: Using ep0 maxpacket: 16 [ 980.673267][T13766] usb 2-1: config 0 has no interfaces? [ 980.711142][T13766] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 980.726341][T17335] usb 7-1: new high-speed USB device number 120 using dummy_hcd [ 980.745276][T13766] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 980.780329][T13766] usb 2-1: Manufacturer: syz [ 980.866943][T13766] usb 2-1: config 0 descriptor?? [ 980.906040][ T890] usb 4-1: USB disconnect, device number 100 [ 980.939638][T17335] usb 7-1: Using ep0 maxpacket: 8 [ 980.962192][T17335] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 980.997915][T17335] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 981.007596][ T890] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 981.078534][T20056] xt_CT: You must specify a L4 protocol and not use inversions on it [ 981.093114][T17335] pvrusb2: Hardware description: Terratec Grabster AV400 [ 981.119678][T14882] hid-generic 0000:0000:0000.001E: unknown main item tag 0x0 [ 981.167919][T13766] usb 6-1: new high-speed USB device number 89 using dummy_hcd [ 981.171039][T17335] pvrusb2: ********** [ 981.190843][T14882] hid-generic 0000:0000:0000.001E: hidraw0: HID v0.00 Device [syz1] on syz0 [ 981.205411][T17335] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 981.224838][T17335] pvrusb2: Important functionality might not be entirely working. [ 981.252223][T17335] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 981.309756][T17335] pvrusb2: ********** [ 981.322759][T20059] fido_id[20059]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 981.350400][ T2346] pvrusb2: Invalid write control endpoint [ 981.408513][T13766] usb 6-1: Using ep0 maxpacket: 8 [ 981.434235][T13766] usb 6-1: config 179 has an invalid interface number: 97 but max is 0 [ 981.484121][T13766] usb 6-1: config 179 has no interface number 0 [ 981.567411][T20045] pvrusb2: Invalid write control endpoint [ 981.584065][T17335] usb 7-1: USB disconnect, device number 120 [ 981.594934][T13766] usb 6-1: config 179 interface 97 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 981.634010][ T2346] pvrusb2: Invalid write control endpoint [ 981.645779][T13766] usb 6-1: config 179 interface 97 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 981.649119][ T2346] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 981.691300][T13766] usb 6-1: config 179 interface 97 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 981.701918][ T2346] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 981.728520][ T2346] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 981.748586][ T2346] pvrusb2: Device being rendered inoperable [ 981.755838][T13766] usb 6-1: config 179 interface 97 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 981.760657][ T2346] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 981.778614][ T2346] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_c) [ 981.818796][T13766] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.ce [ 981.845801][ T2346] pvrusb2: Attached sub-driver cx25840 [ 981.866477][ T2346] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 981.876295][T13766] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 981.891195][ T2346] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 981.962630][T20051] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 982.356937][T13766] usb 2-1: USB disconnect, device number 103 [ 982.517821][T20078] netlink: 'syz.3.3710': attribute type 1 has an invalid length. [ 982.704998][T20077] netlink: 'syz.6.3714': attribute type 23 has an invalid length. [ 982.772800][T13766] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 982.784055][T20081] input: syz0 as /devices/virtual/input/input84 [ 982.949519][T13766] usb 2-1: config 48 interface 0 altsetting 98 bulk endpoint 0x4 has invalid maxpacket 1024 [ 982.961176][T13766] usb 2-1: config 48 interface 0 altsetting 98 has an endpoint descriptor with address 0x5A, changing to 0xA [ 983.007530][T13766] usb 2-1: config 48 interface 0 altsetting 98 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 983.046315][T13766] usb 2-1: config 48 interface 0 altsetting 98 endpoint 0xA has invalid wMaxPacketSize 0 [ 983.066308][T13766] usb 2-1: config 48 interface 0 has no altsetting 0 [ 983.094960][T13766] usb 2-1: New USB device found, idVendor=1784, idProduct=0006, bcdDevice=bb.2f [ 983.109078][T13766] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 983.120396][T13766] usb 2-1: Product: syz [ 983.126580][T13766] usb 2-1: Manufacturer: syz [ 983.132745][T13766] usb 2-1: SerialNumber: syz [ 983.158844][T20074] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 983.286261][T17335] usb 6-1: USB disconnect, device number 89 [ 983.382976][T20074] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 983.409817][T20074] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 983.464800][T20074] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 983.498882][T20074] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 983.544884][T13766] usb 2-1: USB disconnect, device number 104 [ 983.817871][T20103] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 984.236500][T17335] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 984.335211][T20110] netlink: 'syz.1.3723': attribute type 1 has an invalid length. [ 984.400429][T17335] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 984.413824][T17335] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 984.462114][T17335] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 984.505073][T17335] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 984.521804][T20112] syzkaller0: entered promiscuous mode [ 984.544967][T20112] syzkaller0: entered allmulticast mode [ 984.585640][T20103] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 984.698278][T17335] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 985.102741][T20114] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3343437945 (53495007120 ns) > initial count (52285443328 ns). Using initial count to start timer. [ 985.798919][T20126] netlink: 'syz.5.3728': attribute type 23 has an invalid length. [ 985.874923][T20126] input: syz0 as /devices/virtual/input/input86 [ 986.092203][T20134] sit0: entered promiscuous mode [ 986.134569][T20134] netlink: 'syz.6.3729': attribute type 1 has an invalid length. [ 986.144206][T20134] netlink: 1 bytes leftover after parsing attributes in process `syz.6.3729'. [ 986.165290][T20134] netlink: 24 bytes leftover after parsing attributes in process `syz.6.3729'. [ 986.477830][ T30] audit: type=1326 audit(1768293835.486:2232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20133 comm="syz.6.3729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7638f749 code=0x7fc00000 [ 986.642071][T14882] usb 4-1: USB disconnect, device number 101 [ 986.801957][T20151] FAULT_INJECTION: forcing a failure. [ 986.801957][T20151] name failslab, interval 1, probability 0, space 0, times 0 [ 986.828625][T20151] CPU: 0 UID: 0 PID: 20151 Comm: syz.7.3735 Tainted: G L syzkaller #0 PREEMPT(full) [ 986.828661][T20151] Tainted: [L]=SOFTLOCKUP [ 986.828669][T20151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 986.828681][T20151] Call Trace: [ 986.828690][T20151] [ 986.828700][T20151] dump_stack_lvl+0xe8/0x150 [ 986.828735][T20151] should_fail_ex+0x414/0x560 [ 986.828771][T20151] should_failslab+0xa8/0x100 [ 986.828799][T20151] kmem_cache_alloc_noprof+0x88/0x710 [ 986.828832][T20151] ? security_file_alloc+0x34/0x330 [ 986.828859][T20151] security_file_alloc+0x34/0x330 [ 986.828880][T20151] init_file+0x93/0x2f0 [ 986.828922][T20151] alloc_empty_file+0x6e/0x1d0 [ 986.828949][T20151] path_openat+0x108/0x3dd0 [ 986.828970][T20151] ? is_bpf_text_address+0x292/0x2b0 [ 986.829018][T20151] ? is_bpf_text_address+0x26/0x2b0 [ 986.829051][T20151] ? kernel_text_address+0xa5/0xe0 [ 986.829081][T20151] ? __kernel_text_address+0xd/0x40 [ 986.829107][T20151] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 986.829135][T20151] ? arch_stack_walk+0xfc/0x150 [ 986.829365][T20151] ? stack_trace_save+0x9c/0xe0 [ 986.829396][T20151] ? __pfx_path_openat+0x10/0x10 [ 986.829415][T20151] ? __lock_acquire+0x6b6/0x2cf0 [ 986.829456][T20151] do_filp_open+0x1fa/0x410 [ 986.829477][T20151] ? __pfx_do_filp_open+0x10/0x10 [ 986.829518][T20151] ? _raw_spin_unlock+0x28/0x50 [ 986.829539][T20151] ? alloc_fd+0x64c/0x6c0 [ 986.829577][T20151] io_openat2+0x3e0/0x5c0 [ 986.829604][T20151] ? __pfx_io_openat2+0x10/0x10 [ 986.829628][T20151] ? getname_flags+0x1e5/0x540 [ 986.829656][T20151] __io_issue_sqe+0x181/0x4b0 [ 986.829683][T20151] io_issue_sqe+0x165/0x1060 [ 986.829717][T20151] io_submit_sqes+0xbf4/0x2140 [ 986.829772][T20151] __se_sys_io_uring_enter+0x2e0/0x2b60 [ 986.829817][T20151] ? ksys_write+0x1cb/0x250 [ 986.829840][T20151] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 986.829864][T20151] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 986.829887][T20151] ? __pfx_vfs_write+0x10/0x10 [ 986.829911][T20151] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 986.829939][T20151] ? __fget_files+0x3a0/0x420 [ 986.829971][T20151] ? fput+0xa0/0xd0 [ 986.829998][T20151] ? ksys_write+0x22a/0x250 [ 986.830026][T20151] ? __pfx_ksys_write+0x10/0x10 [ 986.830051][T20151] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 986.830091][T20151] do_syscall_64+0xec/0xf80 [ 986.830117][T20151] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 986.830138][T20151] ? trace_irq_disable+0x37/0x100 [ 986.830166][T20151] ? clear_bhb_loop+0x60/0xb0 [ 986.830191][T20151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 986.830216][T20151] RIP: 0033:0x7f0a1058f749 [ 986.830236][T20151] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 986.830258][T20151] RSP: 002b:00007f0a1136c038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 986.830280][T20151] RAX: ffffffffffffffda RBX: 00007f0a107e5fa0 RCX: 00007f0a1058f749 [ 986.830297][T20151] RDX: 0000000000007721 RSI: 0000000000002219 RDI: 0000000000000000 [ 986.830310][T20151] RBP: 00007f0a1136c090 R08: 0000000000000000 R09: 0000000000000000 [ 986.830325][T20151] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000001 [ 986.830338][T20151] R13: 00007f0a107e6038 R14: 00007f0a107e5fa0 R15: 00007f0a1090fa28 [ 986.830369][T20151] [ 986.836164][T20150] syzkaller0: entered promiscuous mode [ 986.913994][ T30] audit: type=1326 audit(1768293835.846:2233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20133 comm="syz.6.3729" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f4b7632b829 code=0x7fc00000 [ 987.268705][T20150] syzkaller0: entered allmulticast mode [ 987.289918][T20157] tipc: Failed to remove unknown binding: 66,1,1/0:375894471/375894473 [ 987.566326][T13766] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 987.856487][T17337] usb 7-1: new high-speed USB device number 121 using dummy_hcd [ 987.886409][T13766] usb 6-1: Using ep0 maxpacket: 16 [ 987.895364][T13766] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 129, changing to 11 [ 988.045703][T13766] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 16 [ 988.080361][T17337] usb 7-1: Using ep0 maxpacket: 32 [ 988.119458][T17337] usb 7-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 988.141167][T17337] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 988.184552][T17337] usb 7-1: config 0 descriptor?? [ 988.405526][T17337] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 988.518483][T17337] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 988.539091][T17337] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 988.556735][T17337] usb 7-1: media controller created [ 988.614669][T17337] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 989.051488][T17337] DVB: Unable to find symbol dib7000p_attach() [ 989.074534][T17337] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 989.286807][T17337] rc_core: IR keymap rc-dib0700-rc5 not found [ 989.315178][T17337] Registered IR keymap rc-empty [ 989.337910][T20180] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3745'. [ 989.364131][T20181] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3745'. [ 989.376041][T20181] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3745'. [ 989.379061][T17337] dvb-usb: could not initialize remote control. [ 989.397679][T17337] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 989.443638][T20181] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3745'. [ 989.679067][ T30] audit: type=1326 audit(1768293838.686:2234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20183 comm="syz.3.3747" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f2c4058f749 code=0x0 [ 989.872457][T13766] usb 6-1: string descriptor 0 read error: -71 [ 989.893278][T13766] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 990.164278][T13766] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 990.195246][T13766] usb 6-1: rejected 1 configuration due to insufficient available bus power [ 990.221422][T13766] usb 6-1: no configuration chosen from 1 choice [ 990.317513][T13766] usb 6-1: USB disconnect, device number 90 [ 990.336367][ T5829] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 990.467186][T17337] usb 7-1: USB disconnect, device number 121 [ 990.518533][ T5829] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 990.538730][ T5829] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 990.563358][ T5829] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 990.593463][T17337] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 990.602224][ T5829] usb 2-1: config 0 descriptor?? [ 990.632297][ T5829] pwc: Askey VC010 type 2 USB webcam detected. [ 990.707781][T20203] syzkaller0: entered promiscuous mode [ 990.713461][T20203] syzkaller0: entered allmulticast mode [ 991.550987][T20214] xt_CT: You must specify a L4 protocol and not use inversions on it [ 992.959864][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.977616][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.068527][ T5829] pwc: recv_control_msg error -71 req 02 val 2b00 [ 993.087106][ T5829] pwc: recv_control_msg error -71 req 02 val 2700 [ 993.104924][ T5829] pwc: recv_control_msg error -71 req 02 val 2c00 [ 993.129667][ T5829] pwc: recv_control_msg error -71 req 04 val 1000 [ 993.146787][ T5829] pwc: recv_control_msg error -71 req 04 val 1300 [ 993.154716][ T5829] pwc: recv_control_msg error -71 req 04 val 1400 [ 993.184732][ T5829] pwc: recv_control_msg error -71 req 02 val 2000 [ 993.195134][ T5829] pwc: recv_control_msg error -71 req 02 val 2100 [ 993.246712][ T5829] pwc: recv_control_msg error -71 req 04 val 1500 [ 993.265957][ T5829] pwc: recv_control_msg error -71 req 02 val 2500 [ 993.282385][ T5829] pwc: recv_control_msg error -71 req 02 val 2400 [ 993.297851][ T5829] pwc: recv_control_msg error -71 req 02 val 2600 [ 993.314844][ T5829] pwc: recv_control_msg error -71 req 02 val 2900 [ 993.333785][ T5829] pwc: recv_control_msg error -71 req 02 val 2800 [ 993.352416][ T5829] pwc: recv_control_msg error -71 req 04 val 1100 [ 993.366719][ T5829] pwc: recv_control_msg error -71 req 04 val 1200 [ 993.388905][ T5829] pwc: Registered as video103. [ 993.424931][ T5829] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input88 [ 993.467184][ T5829] usb 2-1: USB disconnect, device number 105 [ 993.595922][T20238] syzkaller0: entered promiscuous mode [ 993.618392][T20238] syzkaller0: entered allmulticast mode [ 993.816376][T14882] usb 7-1: new high-speed USB device number 122 using dummy_hcd [ 994.017303][T14882] usb 7-1: Using ep0 maxpacket: 8 [ 994.026742][T14882] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 994.036265][T14882] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 994.056329][ T5829] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 994.079468][T14882] pvrusb2: Hardware description: Terratec Grabster AV400 [ 994.097095][T14882] pvrusb2: ********** [ 994.107356][T14882] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 994.132258][T14882] pvrusb2: Important functionality might not be entirely working. [ 994.154443][T14882] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 994.193312][T14882] pvrusb2: ********** [ 994.216649][ T5829] usb 2-1: Using ep0 maxpacket: 16 [ 994.268912][ T5829] usb 2-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 994.282299][ T5829] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 994.305986][ T2346] pvrusb2: Invalid write control endpoint [ 994.331903][ T5829] usb 2-1: Product: syz [ 994.348793][ T5829] usb 2-1: Manufacturer: syz [ 994.364968][ T5829] usb 2-1: SerialNumber: syz [ 994.384836][ T2346] pvrusb2: Invalid write control endpoint [ 994.391644][ T2346] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 994.394358][ T5829] usb 2-1: config 0 descriptor?? [ 994.479782][ T2346] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 994.510609][T14882] usb 7-1: USB disconnect, device number 122 [ 994.579693][T20251] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 994.723306][ T2346] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 994.753631][ T2346] pvrusb2: Device being rendered inoperable [ 994.760074][ T2346] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 994.771512][ T2346] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_c) [ 994.780635][ T2346] pvrusb2: Attached sub-driver cx25840 [ 994.792781][ T2346] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 994.807863][ T2346] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 994.930007][ T5829] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 994.941382][ T5829] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 995.040472][ T5829] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 995.057723][ T5829] usb 2-1: media controller created [ 995.063720][T20257] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 995.102972][ T5829] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 995.300660][ T5829] zl10353_read_register: readreg error (reg=127, ret==0) [ 995.335314][T17337] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 995.372123][ T5829] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 995.426359][ T5829] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 995.448357][ T5829] usb 2-1: USB disconnect, device number 106 [ 995.564491][ T5829] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 995.631516][T17337] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 995.652000][T17337] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 995.689562][T17337] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 995.727316][T20263] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3769'. [ 995.795369][T20265] syzkaller1: entered promiscuous mode [ 995.802102][T20265] syzkaller1: entered allmulticast mode [ 995.808052][T17337] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 995.854138][T20258] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 995.869071][T17337] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 996.269454][T20274] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3773'. [ 996.306848][T20273] syzkaller0: entered promiscuous mode [ 996.312825][T20273] syzkaller0: entered allmulticast mode [ 996.957659][ T30] audit: type=1326 audit(1768293845.966:2235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20281 comm="syz.6.3776" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4b7638f749 code=0x0 [ 998.169841][ T5829] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 998.313543][T14882] usb 4-1: USB disconnect, device number 102 [ 998.326698][ T5829] usb 6-1: Using ep0 maxpacket: 16 [ 998.365389][ T5829] usb 6-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 998.385497][ T5829] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 998.418104][ T5829] usb 6-1: Product: syz [ 998.427241][ T5829] usb 6-1: Manufacturer: syz [ 998.443281][ T5829] usb 6-1: SerialNumber: syz [ 998.454431][ T5829] usb 6-1: config 0 descriptor?? [ 998.500416][T20302] syzkaller1: entered promiscuous mode [ 998.525275][T20302] syzkaller1: entered allmulticast mode [ 998.883246][ T5829] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 998.897127][ T5829] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 998.927175][ T5829] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 998.938402][ T5829] usb 6-1: media controller created [ 998.981582][ T5829] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 999.555233][ T5829] zl10353_read_register: readreg error (reg=127, ret==0) [ 999.577288][ T5829] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 999.596009][ T5829] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 999.635824][ T5829] usb 6-1: USB disconnect, device number 91 [ 999.711456][ T5829] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1000.075955][T20323] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3792'. [ 1000.177092][T20326] netlink: 112 bytes leftover after parsing attributes in process `syz.6.3793'. [ 1000.499646][ T30] audit: type=1326 audit(1768293849.506:2236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20336 comm="syz.5.3798" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f246b38f749 code=0x0 [ 1000.869443][T20346] syzkaller0: entered promiscuous mode [ 1000.875213][T20346] syzkaller0: entered allmulticast mode [ 1001.373293][T20357] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3805'. [ 1001.382488][T20357] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3805'. [ 1001.556421][T14882] usb 7-1: new high-speed USB device number 123 using dummy_hcd [ 1001.719303][T14882] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1001.729980][T14882] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1001.739604][T14882] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1001.760071][T14882] usb 7-1: config 0 descriptor?? [ 1001.771237][T14882] pwc: Askey VC010 type 2 USB webcam detected. [ 1001.964831][T20362] syzkaller0: entered promiscuous mode [ 1001.978179][T20362] syzkaller0: entered allmulticast mode [ 1002.185365][T14882] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1002.206363][T14882] pwc: recv_control_msg error -32 req 02 val 2700 [ 1003.257160][T14882] pwc: recv_control_msg error -71 req 04 val 1000 [ 1003.303571][T14882] pwc: recv_control_msg error -71 req 04 val 1300 [ 1003.332603][T14882] pwc: recv_control_msg error -71 req 04 val 1400 [ 1003.354264][T14882] pwc: recv_control_msg error -71 req 02 val 2000 [ 1003.373187][T14882] pwc: recv_control_msg error -71 req 02 val 2100 [ 1003.384636][T14882] pwc: recv_control_msg error -71 req 04 val 1500 [ 1003.413139][T14882] pwc: recv_control_msg error -71 req 02 val 2500 [ 1003.423679][T14882] pwc: recv_control_msg error -71 req 02 val 2400 [ 1003.459076][T14882] pwc: recv_control_msg error -71 req 02 val 2600 [ 1003.477424][T14882] pwc: recv_control_msg error -71 req 02 val 2900 [ 1003.494623][T14882] pwc: recv_control_msg error -71 req 02 val 2800 [ 1003.506804][T14882] pwc: recv_control_msg error -71 req 04 val 1100 [ 1003.532552][T14882] pwc: recv_control_msg error -71 req 04 val 1200 [ 1003.584106][T20388] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1003.616098][T14882] pwc: Registered as video103. [ 1003.648726][T14882] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input89 [ 1003.710664][T14882] usb 7-1: USB disconnect, device number 123 [ 1004.013997][T20382] bridge0: port 2(bridge_slave_1) entered disabled state [ 1004.022821][T20382] bridge0: port 1(bridge_slave_0) entered disabled state [ 1004.097310][T20389] bond0: entered promiscuous mode [ 1004.114878][T20389] batadv0: entered promiscuous mode [ 1004.133789][T20389] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 1004.156995][T20389] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 1004.189148][T20402] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3817'. [ 1004.198877][T20402] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1004.206893][T20402] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1004.215139][T20402] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1004.224292][T20402] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1004.321960][T20404] syzkaller0: entered promiscuous mode [ 1004.327827][T20404] syzkaller0: entered allmulticast mode [ 1004.397473][T17335] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 1004.568138][T17335] usb 4-1: Using ep0 maxpacket: 32 [ 1004.592040][T17335] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1004.603079][T17335] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1004.632160][T17335] usb 4-1: config 0 descriptor?? [ 1004.873681][T17335] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1004.903994][T17335] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1004.919349][T17335] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1004.926895][T17335] usb 4-1: media controller created [ 1004.946155][T17335] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1005.042133][T17335] DVB: Unable to find symbol dib7000p_attach() [ 1005.048810][T17335] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1005.146712][T17335] rc_core: IR keymap rc-dib0700-rc5 not found [ 1005.165040][T17335] Registered IR keymap rc-empty [ 1005.171838][T17335] dvb-usb: could not initialize remote control. [ 1005.178780][T17335] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 1007.079662][T17335] usb 4-1: USB disconnect, device number 103 [ 1007.133224][T17335] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1009.856312][ T5897] usb 6-1: new full-speed USB device number 92 using dummy_hcd [ 1010.048199][ T5897] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 129, using maximum allowed: 30 [ 1010.075470][ T5897] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 1010.106517][ T5897] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 1010.121721][ T5897] usb 6-1: New USB device found, idVendor=056a, idProduct=00de, bcdDevice= 0.00 [ 1010.131471][ T5897] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1010.143325][ T5897] usb 6-1: config 0 descriptor?? [ 1010.155861][T20455] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1010.227559][T20471] syzkaller0: entered promiscuous mode [ 1010.233407][T20471] syzkaller0: entered allmulticast mode [ 1010.375838][T20455] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1010.386925][T20455] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1010.506675][T17335] usb 7-1: new high-speed USB device number 124 using dummy_hcd [ 1010.601826][T20477] syzkaller0: entered promiscuous mode [ 1010.610221][T20477] syzkaller0: entered allmulticast mode [ 1010.686308][T17335] usb 7-1: Using ep0 maxpacket: 8 [ 1010.695354][T17335] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 1010.704511][T17335] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1010.714847][T17335] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1010.725592][T17335] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1010.736059][T17335] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1010.749592][T17335] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1010.759019][T17335] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1011.000206][T17335] usb 7-1: usb_control_msg returned -32 [ 1011.005953][T17335] usbtmc 7-1:16.0: can't read capabilities [ 1011.319317][T17335] usb 6-1: USB disconnect, device number 92 [ 1014.287184][ T5829] usb 7-1: USB disconnect, device number 124 [ 1014.500146][T20511] netlink: 64 bytes leftover after parsing attributes in process `syz.5.3844'. [ 1014.717371][T20518] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1014.924630][T20520] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1015.734636][T20532] syz_tun: entered allmulticast mode [ 1015.749465][T20531] syz_tun: left allmulticast mode [ 1015.826493][ T5897] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 1015.986407][ T5897] usb 2-1: Using ep0 maxpacket: 8 [ 1016.058126][ T5897] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 1016.066150][ T5897] usb 2-1: can't read configurations, error -61 [ 1016.246610][ T5897] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 1016.257205][T20554] syzkaller0: entered promiscuous mode [ 1016.263049][T20554] syzkaller0: entered allmulticast mode [ 1016.428753][ T5897] usb 2-1: Using ep0 maxpacket: 8 [ 1016.437621][ T5897] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 1016.470959][ T5897] usb 2-1: can't read configurations, error -61 [ 1016.498290][ T5897] usb usb2-port1: attempt power cycle [ 1016.810188][T20571] netlink: 'syz.5.3857': attribute type 1 has an invalid length. [ 1016.956540][ T5897] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 1017.002795][ T5897] usb 2-1: Using ep0 maxpacket: 8 [ 1017.173650][ T5897] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 1017.182883][ T5897] usb 2-1: can't read configurations, error -61 [ 1017.336387][ T5897] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 1017.384650][ T5897] usb 2-1: Using ep0 maxpacket: 8 [ 1017.393652][ T5897] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 1017.405303][ T5897] usb 2-1: can't read configurations, error -61 [ 1017.418597][ T5897] usb usb2-port1: unable to enumerate USB device [ 1020.774268][T20585] syz_tun: entered allmulticast mode [ 1020.816426][T20585] syz_tun: left allmulticast mode [ 1020.974336][T20596] sit0: entered promiscuous mode [ 1021.027245][T20600] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3866'. [ 1021.104156][T20596] netlink: 'syz.7.3866': attribute type 1 has an invalid length. [ 1021.170627][T20596] netlink: 1 bytes leftover after parsing attributes in process `syz.7.3866'. [ 1021.221763][T20606] netlink: 44 bytes leftover after parsing attributes in process `syz.6.3870'. [ 1021.602533][T20614] netlink: 'syz.6.3872': attribute type 20 has an invalid length. [ 1021.809785][ T30] audit: type=1326 audit(1768293870.786:2237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20595 comm="syz.7.3866" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0a1058f749 code=0x7fc00000 [ 1021.996371][T20614] FAULT_INJECTION: forcing a failure. [ 1021.996371][T20614] name failslab, interval 1, probability 0, space 0, times 0 [ 1022.080853][T20614] CPU: 1 UID: 0 PID: 20614 Comm: syz.6.3872 Tainted: G L syzkaller #0 PREEMPT(full) [ 1022.080880][T20614] Tainted: [L]=SOFTLOCKUP [ 1022.080886][T20614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1022.080896][T20614] Call Trace: [ 1022.080902][T20614] [ 1022.080907][T20614] dump_stack_lvl+0xe8/0x150 [ 1022.080926][T20614] should_fail_ex+0x414/0x560 [ 1022.080946][T20614] should_failslab+0xa8/0x100 [ 1022.080960][T20614] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 1022.080977][T20614] ? __alloc_skb+0x198/0x3a0 [ 1022.080990][T20614] ? __alloc_skb+0x1dc/0x3a0 [ 1022.080999][T20614] ? __local_bh_enable_ip+0xd0/0x130 [ 1022.081011][T20614] ? __alloc_skb+0x198/0x3a0 [ 1022.081023][T20614] __alloc_skb+0x1dc/0x3a0 [ 1022.081035][T20614] netlink_ack+0x146/0xa50 [ 1022.081048][T20614] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1022.081059][T20614] ? ref_tracker_free+0x63a/0x7d0 [ 1022.081070][T20614] ? __asan_memcpy+0x40/0x70 [ 1022.081085][T20614] ? __pfx_ref_tracker_free+0x10/0x10 [ 1022.081095][T20614] ? __skb_clone+0x63/0x7a0 [ 1022.081111][T20614] netlink_rcv_skb+0x28c/0x470 [ 1022.081125][T20614] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1022.081137][T20614] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1022.081154][T20614] ? netlink_deliver_tap+0x2e/0x1b0 [ 1022.081171][T20614] netlink_unicast+0x82f/0x9e0 [ 1022.081187][T20614] ? __pfx_netlink_unicast+0x10/0x10 [ 1022.081198][T20614] ? __alloc_skb+0x198/0x3a0 [ 1022.081209][T20614] ? netlink_sendmsg+0x642/0xb30 [ 1022.081222][T20614] ? skb_put+0x11b/0x210 [ 1022.081235][T20614] netlink_sendmsg+0x805/0xb30 [ 1022.081252][T20614] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1022.081267][T20614] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1022.081282][T20614] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1022.081291][T20614] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1022.081305][T20614] __sock_sendmsg+0x21c/0x270 [ 1022.081322][T20614] ____sys_sendmsg+0x505/0x820 [ 1022.081338][T20614] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1022.081354][T20614] ? import_iovec+0x74/0xa0 [ 1022.081369][T20614] ___sys_sendmsg+0x21f/0x2a0 [ 1022.081382][T20614] ? __pfx____sys_sendmsg+0x10/0x10 [ 1022.081410][T20614] ? __fget_files+0x2a/0x420 [ 1022.081423][T20614] ? __fget_files+0x3a0/0x420 [ 1022.081440][T20614] __x64_sys_sendmsg+0x19b/0x260 [ 1022.081454][T20614] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1022.081470][T20614] ? __pfx_ksys_write+0x10/0x10 [ 1022.081485][T20614] do_syscall_64+0xec/0xf80 [ 1022.081498][T20614] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1022.081508][T20614] ? trace_irq_disable+0x37/0x100 [ 1022.081521][T20614] ? clear_bhb_loop+0x60/0xb0 [ 1022.081533][T20614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1022.081543][T20614] RIP: 0033:0x7f4b7638f749 [ 1022.081555][T20614] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1022.081564][T20614] RSP: 002b:00007f4b771b2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1022.081578][T20614] RAX: ffffffffffffffda RBX: 00007f4b765e5fa0 RCX: 00007f4b7638f749 [ 1022.081585][T20614] RDX: 0000000000008000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1022.081592][T20614] RBP: 00007f4b771b2090 R08: 0000000000000000 R09: 0000000000000000 [ 1022.081599][T20614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1022.081606][T20614] R13: 00007f4b765e6038 R14: 00007f4b765e5fa0 R15: 00007f4b7670fa28 [ 1022.081621][T20614] [ 1022.776841][T20635] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3876'. [ 1022.787405][T20636] netlink: 'syz.3.3877': attribute type 20 has an invalid length. [ 1023.023351][T20635] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3876'. [ 1023.995661][T20654] sit0: entered promiscuous mode [ 1024.058296][T20657] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3883'. [ 1024.083716][T20654] netlink: 'syz.1.3883': attribute type 1 has an invalid length. [ 1024.348997][T20654] netlink: 1 bytes leftover after parsing attributes in process `syz.1.3883'. [ 1024.676402][T17335] usb 7-1: new high-speed USB device number 125 using dummy_hcd [ 1024.826919][ T30] audit: type=1326 audit(1768293873.816:2238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20653 comm="syz.1.3883" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f982ff8f749 code=0x7fc00000 [ 1024.900472][T17335] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 1024.973645][T17335] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 217 [ 1025.006353][ T30] audit: type=1326 audit(1768293873.836:2239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20653 comm="syz.1.3883" exe="/root/syz-executor" sig=0 arch=c000003e syscall=209 compat=0 ip=0x7f982ff8f749 code=0x7fc00000 [ 1025.032843][T17335] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1025.106308][T17335] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1025.158688][T17335] usb 7-1: config 0 descriptor?? [ 1025.190503][T20659] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 1025.536345][ T5829] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 1025.706299][ T5829] usb 2-1: Using ep0 maxpacket: 16 [ 1025.723451][ T5829] usb 2-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1025.811992][ T5829] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1025.820661][ T5829] usb 2-1: Product: syz [ 1025.825067][ T5829] usb 2-1: Manufacturer: syz [ 1025.830048][ T5829] usb 2-1: SerialNumber: syz [ 1025.852476][ T5829] usb 2-1: config 0 descriptor?? [ 1026.238630][T17335] ath6kl: Failed to submit usb control message: -110 [ 1026.246317][T17335] ath6kl: unable to send the bmi data to the device: -110 [ 1026.260893][T17335] ath6kl: Unable to send get target info: -110 [ 1026.279958][T17335] ath6kl: Failed to init ath6kl core: -110 [ 1026.280085][ T5829] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1026.360980][T17335] ath6kl_usb 7-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1026.423895][ T5829] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1026.450661][ T5829] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1026.488269][ T5829] usb 2-1: media controller created [ 1026.527731][ T5829] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1026.637687][T20673] dtv5100: wlen = 0, aborting. [ 1026.883168][ T5829] zl10353_read_register: readreg error (reg=127, ret==0) [ 1026.910521][ T5829] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1026.930203][T20688] FAULT_INJECTION: forcing a failure. [ 1026.930203][T20688] name failslab, interval 1, probability 0, space 0, times 0 [ 1026.951378][ T5829] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1026.969221][T20688] CPU: 1 UID: 0 PID: 20688 Comm: syz.7.3891 Tainted: G L syzkaller #0 PREEMPT(full) [ 1026.969250][T20688] Tainted: [L]=SOFTLOCKUP [ 1026.969258][T20688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1026.969269][T20688] Call Trace: [ 1026.969276][T20688] [ 1026.969285][T20688] dump_stack_lvl+0xe8/0x150 [ 1026.969314][T20688] should_fail_ex+0x414/0x560 [ 1026.969403][T20688] should_failslab+0xa8/0x100 [ 1026.969428][T20688] kmem_cache_alloc_lru_noprof+0x8d/0x6e0 [ 1026.969455][T20688] ? shmem_alloc_inode+0x28/0x40 [ 1026.969470][T20688] ? kmem_cache_prefill_sheaf+0x2ba/0x480 [ 1026.969500][T20688] ? __pfx_shmem_alloc_inode+0x10/0x10 [ 1026.969515][T20688] shmem_alloc_inode+0x28/0x40 [ 1026.969534][T20688] alloc_inode+0x6a/0x1b0 [ 1026.969557][T20688] new_inode+0x22/0x170 [ 1026.969578][T20688] ? mas_preallocate+0x429/0x670 [ 1026.969598][T20688] shmem_get_inode+0x347/0xe60 [ 1026.969614][T20688] ? __pfx_mas_preallocate+0x10/0x10 [ 1026.969637][T20688] __shmem_file_setup+0x163/0x300 [ 1026.969665][T20688] shmem_zero_setup+0x90/0x130 [ 1026.969691][T20688] mmap_region+0x1448/0x1d10 [ 1026.969727][T20688] ? __pfx_mmap_region+0x10/0x10 [ 1026.969796][T20688] ? arch_get_unmapped_area_topdown+0x251/0xbc0 [ 1026.969837][T20688] ? mm_get_unmapped_area+0xd4/0x100 [ 1026.969876][T20688] ? bpf_lsm_mmap_addr+0x9/0x20 [ 1026.969895][T20688] ? security_mmap_addr+0x71/0x270 [ 1026.969933][T20688] do_mmap+0xc45/0x10d0 [ 1026.969969][T20688] ? __pfx_do_mmap+0x10/0x10 [ 1026.969993][T20688] ? down_write_killable+0x178/0x230 [ 1026.970018][T20688] ? __pfx_vfs_write+0x10/0x10 [ 1026.970037][T20688] ? __pfx_down_write_killable+0x10/0x10 [ 1026.970063][T20688] ? apparmor_mmap_file+0xc3/0xe0 [ 1026.970085][T20688] vm_mmap_pgoff+0x2a6/0x4d0 [ 1026.970111][T20688] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 1026.970127][T20688] ? ksys_write+0x22a/0x250 [ 1026.970145][T20688] ? __pfx_ksys_write+0x10/0x10 [ 1026.970166][T20688] ? ksys_mmap_pgoff+0xf4/0x760 [ 1026.970194][T20688] ? __x64_sys_mmap+0x7f/0x140 [ 1026.970217][T20688] do_syscall_64+0xec/0xf80 [ 1026.970238][T20688] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1026.970258][T20688] ? trace_irq_disable+0x37/0x100 [ 1026.970284][T20688] ? clear_bhb_loop+0x60/0xb0 [ 1026.970308][T20688] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1026.970338][T20688] RIP: 0033:0x7f0a1058f749 [ 1026.970357][T20688] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1026.970375][T20688] RSP: 002b:00007f0a1136c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1026.970402][T20688] RAX: ffffffffffffffda RBX: 00007f0a107e5fa0 RCX: 00007f0a1058f749 [ 1026.970417][T20688] RDX: 000000000300000b RSI: 0000000000200000 RDI: 0000200000000000 [ 1026.970431][T20688] RBP: 00007f0a1136c090 R08: ffffffffffffffff R09: 00000000ec776000 [ 1026.970446][T20688] R10: 0000000000204031 R11: 0000000000000246 R12: 0000000000000001 [ 1026.970459][T20688] R13: 00007f0a107e6038 R14: 00007f0a107e5fa0 R15: 00007f0a1090fa28 [ 1026.970517][T20688] [ 1027.283149][ T5829] usb 2-1: USB disconnect, device number 111 [ 1027.331356][T15791] usb 7-1: USB disconnect, device number 125 [ 1027.356457][ T5829] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1027.836402][T15791] usb 7-1: new high-speed USB device number 126 using dummy_hcd [ 1027.861275][T20702] netlink: 'syz.1.3896': attribute type 1 has an invalid length. [ 1027.890104][T20702] netlink: 1 bytes leftover after parsing attributes in process `syz.1.3896'. [ 1027.922759][T20702] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3896'. [ 1028.016585][T15791] usb 7-1: Using ep0 maxpacket: 16 [ 1028.054050][T15791] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1028.076467][T15791] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1028.106839][T15791] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1028.126452][T15791] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1028.134514][T15791] usb 7-1: Product: syz [ 1028.154996][T15791] usb 7-1: Manufacturer: syz [ 1028.169358][T15791] usb 7-1: SerialNumber: syz [ 1028.178971][T15791] usb 7-1: config 0 descriptor?? [ 1028.195431][T15791] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1028.206621][T15791] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 1028.239072][ T30] audit: type=1326 audit(1768293877.246:2240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20700 comm="syz.1.3896" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f982ff8f749 code=0x7fc00000 [ 1028.690605][ T30] audit: type=1326 audit(1768293877.696:2241): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20700 comm="syz.1.3896" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f982ff2b829 code=0x7fc00000 [ 1028.728168][T20710] netlink: 'syz.7.3895': attribute type 1 has an invalid length. [ 1029.062620][T15791] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 1029.090389][T15791] em28xx 7-1:0.0: Config register raw data: 0xfffffffb [ 1029.223315][T14882] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 1029.536317][T14882] usb 6-1: Using ep0 maxpacket: 16 [ 1029.553190][T14882] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1029.587945][T14882] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1029.664767][T14882] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1029.725785][T14882] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1029.763726][T14882] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1029.790562][T15791] em28xx 7-1:0.0: Unknown AC97 audio processor detected! [ 1029.804410][T14882] usb 6-1: config 0 descriptor?? [ 1029.830287][T15791] em28xx 7-1:0.0: couldn't setup AC97 register 2 [ 1030.028707][ T5897] usb 2-1: new full-speed USB device number 112 using dummy_hcd [ 1030.123559][T20723] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1030.123995][T20723] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1030.176484][ T5897] usb 2-1: device descriptor read/64, error -71 [ 1030.336416][ T5829] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 1030.416378][ T5897] usb 2-1: new full-speed USB device number 113 using dummy_hcd [ 1030.443932][T14882] usbhid 6-1:0.0: can't add hid device: -71 [ 1030.453772][T14882] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1030.478833][T14882] usb 6-1: USB disconnect, device number 93 [ 1030.507167][ T5829] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1030.520923][ T5829] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1030.530913][ T5829] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1030.540202][T15791] em28xx 7-1:0.0: AC97 command still being executed: not handled properly! [ 1030.546421][ T5897] usb 2-1: device descriptor read/64, error -71 [ 1030.550337][T15791] em28xx 7-1:0.0: couldn't setup AC97 register 6 [ 1030.567162][ T5829] usb 4-1: config 0 descriptor?? [ 1030.578974][ T5829] pwc: Askey VC010 type 2 USB webcam detected. [ 1030.670164][ T5897] usb usb2-port1: attempt power cycle [ 1030.734561][T15791] em28xx 7-1:0.0: couldn't setup AC97 register 54 [ 1030.745813][T15791] em28xx 7-1:0.0: couldn't setup AC97 register 56 [ 1030.771200][T15791] usb 7-1: USB disconnect, device number 126 [ 1030.988217][T20740] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3905'. [ 1030.998863][T20740] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1031.016556][T20740] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1031.029524][ T5897] usb 2-1: new full-speed USB device number 114 using dummy_hcd [ 1031.045168][T20740] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1031.055128][T20740] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1031.066846][ T5897] usb 2-1: device descriptor read/8, error -71 [ 1031.074993][T20740] batman_adv: batadv0: Removing interface: macvtap1 [ 1031.308277][T14882] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 1031.315979][ T5897] usb 2-1: new full-speed USB device number 115 using dummy_hcd [ 1031.317387][ T890] hid-generic 0000:0000:0000.0020: unknown main item tag 0x0 [ 1031.371306][ T890] hid-generic 0000:0000:0000.0020: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1031.376953][ T5897] usb 2-1: device descriptor read/8, error -71 [ 1031.497706][ T5897] usb usb2-port1: unable to enumerate USB device [ 1031.510460][T14882] usb 6-1: Using ep0 maxpacket: 16 [ 1031.524364][T14882] usb 6-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1031.535155][T14882] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1031.543670][T14882] usb 6-1: Product: syz [ 1031.548666][T14882] usb 6-1: Manufacturer: syz [ 1031.553480][T14882] usb 6-1: SerialNumber: syz [ 1031.561659][T14882] usb 6-1: config 0 descriptor?? [ 1031.627837][T17335] usb 7-1: new high-speed USB device number 127 using dummy_hcd [ 1031.788508][T17335] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1031.798761][T17335] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1031.811916][T17335] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1031.823671][T17335] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1031.835456][T17335] usb 7-1: SerialNumber: syz [ 1031.976276][T14882] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1031.990393][T14882] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1032.004102][T14882] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1032.013062][T14882] usb 6-1: media controller created [ 1032.035294][T14882] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1032.068309][T17335] usb 7-1: 0:2 : does not exist [ 1032.084513][T17335] usb 7-1: 5:0: failed to get current value for ch 0 (-22) [ 1032.131418][T17335] usb 7-1: USB disconnect, device number 127 [ 1032.237791][T14882] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1032.249925][T14882] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1032.451177][T20743] dtv5100: wlen = 0, aborting. [ 1032.527976][T20763] ------------[ cut here ]------------ [ 1032.533554][T20763] usb 6-1: BOGUS control dir, pipe 80005e80 doesn't match bRequestType c0 [ 1032.542156][T20763] WARNING: drivers/usb/core/urb.c:414 at usb_submit_urb+0x105c/0x18d0, CPU#1: syz.7.3913/20763 [ 1032.552584][T20763] Modules linked in: [ 1032.556968][T20763] CPU: 1 UID: 0 PID: 20763 Comm: syz.7.3913 Tainted: G L syzkaller #0 PREEMPT(full) [ 1032.568002][T20763] Tainted: [L]=SOFTLOCKUP [ 1032.572345][T20763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1032.582443][T20763] RIP: 0010:usb_submit_urb+0x111c/0x18d0 [ 1032.588161][T20763] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 b7 f2 ff ff 89 e9 [ 1032.608527][T20763] RSP: 0018:ffffc9000501f920 EFLAGS: 00010246 [ 1032.614754][T20763] RAX: 0000000000000000 RBX: ffff888079fb4200 RCX: 0000000080005e80 [ 1032.622998][T20763] RDX: ffff88802920e7a0 RSI: ffffffff8c140d20 RDI: ffffffff8f8ee730 [ 1032.631082][T20763] RBP: 1ffff110050affb4 R08: 00000000000000c0 R09: 0000000000000000 [ 1032.639469][T20763] R10: ffffc9000501fa20 R11: fffff52000a03f50 R12: ffff8880775e0100 [ 1032.647740][T20763] R13: ffff88802857fda0 R14: 0000000080005e80 R15: ffff88802920e7a0 [ 1032.655864][T20763] FS: 00007f0a1136c6c0(0000) GS:ffff888125f1f000(0000) knlGS:0000000000000000 [ 1032.662363][T14882] usb 6-1: USB disconnect, device number 94 [ 1032.664901][T20763] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1032.677517][T20763] CR2: 000000110c3b9b44 CR3: 000000005fcd8000 CR4: 00000000003526f0 [ 1032.685535][T20763] Call Trace: [ 1032.688895][T20763] [ 1032.691888][T20763] ? __init_swait_queue_head+0xa9/0x150 [ 1032.697536][T20763] usb_start_wait_urb+0x115/0x4f0 [ 1032.702640][T20763] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1032.708334][T20763] usb_control_msg+0x232/0x3e0 [ 1032.713168][T20763] dtv5100_i2c_msg+0x231/0x2f0 [ 1032.718120][T20763] dtv5100_i2c_xfer+0x1a4/0x3c0 [ 1032.723056][T20763] __i2c_transfer+0x79a/0x1f00 [ 1032.727909][T20763] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1032.733878][T20763] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1032.739835][T20763] ? i2c_transfer+0xc8/0x2d0 [ 1032.744477][T20763] i2c_transfer+0x1cc/0x2d0 [ 1032.749093][T20763] i2cdev_ioctl_rdwr+0x460/0x740 [ 1032.754099][T20763] i2cdev_ioctl+0x64b/0x820 [ 1032.758680][T20763] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1032.763720][T20763] ? __fget_files+0x3a0/0x420 [ 1032.768469][T20763] ? __fget_files+0x2a/0x420 [ 1032.773085][T20763] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1032.778158][T20763] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1032.783205][T20763] __se_sys_ioctl+0xfc/0x170 [ 1032.787884][T20763] do_syscall_64+0xec/0xf80 [ 1032.792429][T20763] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1032.798680][T20763] ? trace_irq_disable+0x37/0x100 [ 1032.803771][T20763] ? clear_bhb_loop+0x60/0xb0 [ 1032.808543][T20763] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1032.814506][T20763] RIP: 0033:0x7f0a1058f749 [ 1032.819030][T20763] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1032.838758][T20763] RSP: 002b:00007f0a1136c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1032.847381][T20763] RAX: ffffffffffffffda RBX: 00007f0a107e5fa0 RCX: 00007f0a1058f749 [ 1032.855401][T20763] RDX: 00002000000000c0 RSI: 0000000000000707 RDI: 0000000000000003 [ 1032.863483][T20763] RBP: 00007f0a10613f91 R08: 0000000000000000 R09: 0000000000000000 [ 1032.871499][T20763] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1032.879563][T20763] R13: 00007f0a107e6038 R14: 00007f0a107e5fa0 R15: 00007f0a1090fa28 [ 1032.887609][T20763] [ 1032.890634][T20763] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1032.897903][T20763] CPU: 1 UID: 0 PID: 20763 Comm: syz.7.3913 Tainted: G L syzkaller #0 PREEMPT(full) [ 1032.908850][T20763] Tainted: [L]=SOFTLOCKUP [ 1032.913162][T20763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1032.923203][T20763] Call Trace: [ 1032.926476][T20763] [ 1032.929406][T20763] vpanic+0x1e0/0x670 [ 1032.933396][T20763] panic+0xb9/0xc0 [ 1032.937120][T20763] ? __pfx_panic+0x10/0x10 [ 1032.941554][T20763] __warn+0x317/0x4b0 [ 1032.945534][T20763] ? usb_submit_urb+0x105c/0x18d0 [ 1032.950617][T20763] ? usb_submit_urb+0x105c/0x18d0 [ 1032.955639][T20763] __report_bug+0x288/0x500 [ 1032.960139][T20763] ? unwind_get_return_address+0x4d/0x90 [ 1032.965784][T20763] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1032.971974][T20763] ? usb_submit_urb+0x105c/0x18d0 [ 1032.977020][T20763] ? __pfx___report_bug+0x10/0x10 [ 1032.982052][T20763] ? __pfx_stack_trace_save+0x10/0x10 [ 1032.987456][T20763] ? stack_depot_save_flags+0x33/0x810 [ 1032.992916][T20763] report_bug_entry+0x19a/0x290 [ 1032.997787][T20763] ? usb_submit_urb+0x111c/0x18d0 [ 1033.002907][T20763] ? usb_submit_urb+0x1121/0x18d0 [ 1033.007963][T20763] handle_bug+0xca/0x200 [ 1033.012219][T20763] exc_invalid_op+0x1a/0x50 [ 1033.016732][T20763] asm_exc_invalid_op+0x1a/0x20 [ 1033.021581][T20763] RIP: 0010:usb_submit_urb+0x111c/0x18d0 [ 1033.027215][T20763] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 b7 f2 ff ff 89 e9 [ 1033.046914][T20763] RSP: 0018:ffffc9000501f920 EFLAGS: 00010246 [ 1033.052989][T20763] RAX: 0000000000000000 RBX: ffff888079fb4200 RCX: 0000000080005e80 [ 1033.060974][T20763] RDX: ffff88802920e7a0 RSI: ffffffff8c140d20 RDI: ffffffff8f8ee730 [ 1033.069062][T20763] RBP: 1ffff110050affb4 R08: 00000000000000c0 R09: 0000000000000000 [ 1033.077141][T20763] R10: ffffc9000501fa20 R11: fffff52000a03f50 R12: ffff8880775e0100 [ 1033.085127][T20763] R13: ffff88802857fda0 R14: 0000000080005e80 R15: ffff88802920e7a0 [ 1033.093141][T20763] ? __init_swait_queue_head+0xa9/0x150 [ 1033.098752][T20763] usb_start_wait_urb+0x115/0x4f0 [ 1033.103795][T20763] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1033.109370][T20763] usb_control_msg+0x232/0x3e0 [ 1033.114161][T20763] dtv5100_i2c_msg+0x231/0x2f0 [ 1033.119022][T20763] dtv5100_i2c_xfer+0x1a4/0x3c0 [ 1033.123886][T20763] __i2c_transfer+0x79a/0x1f00 [ 1033.128671][T20763] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1033.134480][T20763] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1033.140314][T20763] ? i2c_transfer+0xc8/0x2d0 [ 1033.144934][T20763] i2c_transfer+0x1cc/0x2d0 [ 1033.149447][T20763] i2cdev_ioctl_rdwr+0x460/0x740 [ 1033.154396][T20763] i2cdev_ioctl+0x64b/0x820 [ 1033.158899][T20763] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1033.163928][T20763] ? __fget_files+0x3a0/0x420 [ 1033.168620][T20763] ? __fget_files+0x2a/0x420 [ 1033.173237][T20763] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1033.178201][T20763] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1033.183244][T20763] __se_sys_ioctl+0xfc/0x170 [ 1033.187876][T20763] do_syscall_64+0xec/0xf80 [ 1033.192390][T20763] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1033.198577][T20763] ? trace_irq_disable+0x37/0x100 [ 1033.203624][T20763] ? clear_bhb_loop+0x60/0xb0 [ 1033.208321][T20763] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1033.214223][T20763] RIP: 0033:0x7f0a1058f749 [ 1033.218667][T20763] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1033.238273][T20763] RSP: 002b:00007f0a1136c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1033.246697][T20763] RAX: ffffffffffffffda RBX: 00007f0a107e5fa0 RCX: 00007f0a1058f749 [ 1033.254669][T20763] RDX: 00002000000000c0 RSI: 0000000000000707 RDI: 0000000000000003 [ 1033.262796][T20763] RBP: 00007f0a10613f91 R08: 0000000000000000 R09: 0000000000000000 [ 1033.270784][T20763] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1033.278771][T20763] R13: 00007f0a107e6038 R14: 00007f0a107e5fa0 R15: 00007f0a1090fa28 [ 1033.286804][T20763] [ 1033.290164][T20763] Kernel Offset: disabled [ 1033.294508][T20763] Rebooting in 86400 seconds..