last executing test programs: 5m3.758100974s ago: executing program 2 (id=328): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$tipc(0x1e, 0x5, 0x0) r2 = syz_io_uring_setup(0x88f, &(0x7f0000000200)={0x0, 0xaee2, 0x800, 0xffffffff, 0x3aa}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x7}) io_uring_enter(r2, 0x47f6, 0x4100, 0x2, 0x0, 0x300) 5m1.605494467s ago: executing program 2 (id=336): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) listen(0xffffffffffffffff, 0x100) dup(0xffffffffffffffff) syz_io_uring_submit(0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000008c0)={&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000bbb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x0}, 0x68) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') read$FUSE(r2, &(0x7f0000000a40)={0x2020}, 0xffffffb2) 4m59.796342019s ago: executing program 2 (id=343): socket$inet6(0xa, 0x80002, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) unshare(0x62040200) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x10, 0x0, 0x0, 0x4, 0x0, 0x6, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0xfffffffffffffda3, &(0x7f0000000180)={&(0x7f0000000200)=@delnexthop={0x20, 0x69, 0xb, 0x0, 0x0, {}, [{0x8, 0x1, 0x1}]}, 0x20}}, 0x4000000) 4m59.066833812s ago: executing program 2 (id=351): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f00000003c0)='./file0/file0\x00', 0x8) dup(r0) 4m58.121565822s ago: executing program 2 (id=358): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) capset(&(0x7f0000000c00)={0x19980330}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x164) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000100), 0x10) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x2, 0xfe, 0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0xff, 0x1f}, {0xb, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfd, 0x0, 0x0, 0x20, 0x0, 0x1000000}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x6, &(0x7f0000000140)=' ', 0x2e) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x280000, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4m57.915913033s ago: executing program 2 (id=361): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x3, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x7fff}}]}, 0x38}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x3}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x3, 0x6361, 0x7, 0xffffffff, 0x40000003}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x40000880) syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r4) 4m57.581172855s ago: executing program 32 (id=361): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x3, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x7fff}}]}, 0x38}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x3}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x3, 0x6361, 0x7, 0xffffffff, 0x40000003}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x40000880) syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r4) 3m42.845316264s ago: executing program 5 (id=645): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x8}]}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r3, &(0x7f0000000300)={&(0x7f0000000100)={0xa, 0x4e21, 0x1fe, @private0}, 0x1c, 0x0, 0x0, &(0x7f0000002480)=[@flowinfo={{0x14, 0x29, 0xb, 0x3}}, @flowinfo={{0x14, 0x29, 0xb, 0xffff8001}}], 0x30}, 0x200000c0) r4 = syz_io_uring_setup(0x49a, &(0x7f0000000140)={0x0, 0x79b2, 0x3180, 0x1, 0x283}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_WRITE={0x17, 0x48, 0x4007, @fd_index=0x3, 0x22, 0x0, 0x0, 0x6, 0x1}) io_uring_enter(r4, 0x627, 0x4c1, 0x63, 0x0, 0x0) 3m40.766221941s ago: executing program 5 (id=653): fsopen(0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socket$inet6(0xa, 0x5, 0x3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) syz_usb_connect(0x0, 0x2c, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x5b, 0xaa, 0x7f, 0x20, 0x458, 0x706e, 0x3564, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xe, 0x1, 0x0, 0x0, [@uac_as={[@format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x2, 0x2}]}]}}]}}]}}, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@RTM_NEWMDB={0x38, 0x54, 0x1e5, 0x0, 0xfffffffd, {0x7, r3}, [@MDBA_SET_ENTRY={0x20, 0x1, {r5, 0x1, 0x1, 0x1, {@ip4=@loopback, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000200)={0x0, r1}, 0x8) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x200000, {0x0, 0x0, 0x0, 0x0, 0x90, 0x800}, [@IFLA_MASTER={0x8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x4000880) 3m38.122766793s ago: executing program 5 (id=667): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x45, &(0x7f0000001180)={@local, @random="e130aeaaba30", @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "6410a6", 0xf, 0x4, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, @mcast2, {[], "223427d5c9a46b9fa14172170a0135"}}}}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000d80)="b8", 0x1}], 0x1}, 0xc080) socket$kcm(0xa, 0x3, 0x3a) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xb, 0x6, 0x0, &(0x7f0000000080)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f00000005c0), r2) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r3, @ANYBLOB="01000000000000000000010000000800050001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5420800050000000000900008808c00008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c640009801c000080060001000200000008000200ffffffff05000300030000001c000080060001000200000008000200ac141427050003"], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x80) 3m34.593345245s ago: executing program 5 (id=677): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[]) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r3, r3, &(0x7f0000000000)=0x2eb4, 0x2000007ff) 3m33.978106967s ago: executing program 5 (id=678): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, 0x0, 0x80) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000200)='$)\x00', &(0x7f0000000280), 0x0) r2 = socket$inet(0xa, 0x1, 0x0) r3 = syz_io_uring_setup(0xbdc, &(0x7f00000000c0)={0x0, 0x5edc, 0x1000, 0x3, 0x40000333}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000240)=@IORING_OP_SENDMSG={0x9, 0x40, 0x0, r2, 0x0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000004fc0)=ANY=[@ANYBLOB=' \x00\x00\x00\x00\x00\x00\x00'], 0x30}, 0x0, 0x4, 0x1}) io_uring_enter(r3, 0x4203, 0x0, 0x2, 0x0, 0x0) 3m32.909536571s ago: executing program 5 (id=682): r0 = syz_usb_connect$lan78xx(0x3, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f0000000700)={0x0, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000b40)={0x84, &(0x7f0000000580)={0x40, 0x18}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000880)={0x34, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000c80)={0x20, 0x13}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e40)={0x40, 0x9, 0x1, 0x6}, &(0x7f0000000e80)={0x40, 0xb, 0x2, '[f'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000002040)={0x84, &(0x7f0000001c40)={0x20, 0x30, 0x4, "ad8d3c4a"}, &(0x7f0000001c80)={0x0, 0xa, 0x1, 0x8}, 0x0, 0x0, 0x0, &(0x7f0000001d80)={0x40, 0x7, 0x2, 0x3ff}, &(0x7f0000001dc0)={0x40, 0x9, 0x1, 0x9}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001f40)={0x40, 0x1a, 0x2, 0xf37}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3m31.992411094s ago: executing program 33 (id=682): r0 = syz_usb_connect$lan78xx(0x3, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000680)={0x34, &(0x7f0000000700)={0x0, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000b40)={0x84, &(0x7f0000000580)={0x40, 0x18}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000880)={0x34, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000c80)={0x20, 0x13}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e40)={0x40, 0x9, 0x1, 0x6}, &(0x7f0000000e80)={0x40, 0xb, 0x2, '[f'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000002040)={0x84, &(0x7f0000001c40)={0x20, 0x30, 0x4, "ad8d3c4a"}, &(0x7f0000001c80)={0x0, 0xa, 0x1, 0x8}, 0x0, 0x0, 0x0, &(0x7f0000001d80)={0x40, 0x7, 0x2, 0x3ff}, &(0x7f0000001dc0)={0x40, 0x9, 0x1, 0x9}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001f40)={0x40, 0x1a, 0x2, 0xf37}, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 10.412005035s ago: executing program 1 (id=1342): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r3 = accept4(r2, 0x0, 0x0, 0x800) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000200)={@in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x22, 0x0, "43cad7b04bde5bbd8035d89034a56bad61a87c614899a37c5d0d7da4d7fc948375f3593dbd21eb7618ffb4ff4984e01eedc37998dd16526edb40eaadabe6cd2bd9f9dfeade7787ea64309c01ae05fb70"}, 0xd8) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000440)={@in={{0x2, 0x4e21, @loopback}}, 0x0, 0x0, 0x26, 0x0, "806fc2bd2ffdc9f55dadae18baa696155da2bf279c6769f9d287d63633d9ded703dbe44e9676c876c18b211df7e8c4c0b964e45841d8c1e1d171ae9273dc045c0e1db313a61f2c1cb9f6c04d5332c5ae"}, 0xd8) setsockopt$inet_tcp_int(r4, 0x6, 0x20, 0x0, 0x0) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) 9.285656468s ago: executing program 0 (id=1346): openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00') r0 = syz_io_uring_setup(0x4ed, &(0x7f0000000300)={0x0, 0xfec9, 0x0, 0xff7ffffc, 0x274}, &(0x7f00000001c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, 0x0, 0x0, 0x5b, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r0, 0xdb4, 0xd070, 0x0, 0x0, 0x0) r3 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r3, &(0x7f0000000200)={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0xc) r4 = syz_io_uring_setup(0x497, &(0x7f0000000540)={0x0, 0xcc09, 0x400, 0x3, 0x285}, &(0x7f00000004c0)=0x0, &(0x7f0000000480)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r3, 0x0, 0x0}) io_uring_enter(r4, 0x3498, 0x969, 0xffff000000000000, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) 7.26206576s ago: executing program 4 (id=1351): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000540), 0x42a00) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0x3}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) unshare(0x8040480) r3 = socket$unix(0x1, 0x1, 0x0) cachestat(r3, 0x0, 0x0, 0x0) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0xa00, 0xa00}) r4 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r4, 0xc0184800, &(0x7f0000000100)={0x20004, 0xffffffffffffffff, 0x80000}) r5 = fsopen(&(0x7f0000000340)='nilfs2\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000380)='port', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f00000003c0)={{0x0, 0x0, 0xffff, 0x0, 0x9f45}, 0x7fffffff, 0x0, 0x8}) 7.216820694s ago: executing program 0 (id=1352): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r1, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r3, 0xae80, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) mmap(&(0x7f0000097000/0x1000)=nil, 0x1000, 0x4, 0x28011, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) 6.968239363s ago: executing program 1 (id=1353): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000280)='S', 0x1}], 0x1}}], 0x1, 0x20008000) r1 = openat$nvram(0xffffffffffffff9c, 0x0, 0xb02, 0x0) ioctl$BTRFS_IOC_LOGICAL_INO(r1, 0xc0389424, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) io_submit(0x0, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x1000006) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) r2 = ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x1000000}) syz_usb_connect(0x5, 0x36, 0x0, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000580)=0x1) ioctl$HIDIOCGFIELDINFO(0xffffffffffffffff, 0xc038480a, &(0x7f00000000c0)={0x1, 0x1, 0x0, 0xc30, 0x2, 0x2, 0x2, 0x9, 0x5, 0xa8, 0x0, 0x5, 0x6, 0x7}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) shutdown(r0, 0x1) 6.843617491s ago: executing program 3 (id=1354): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140), 0x40, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004840}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 6.386008782s ago: executing program 0 (id=1356): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x80) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = memfd_create(&(0x7f00000000c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ', 0x6) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x2000003, 0x97052, r2, 0x0) ftruncate(r2, 0x7fffffffffffffff) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000000004002, 0x0) r4 = syz_io_uring_setup(0xcaf, &(0x7f0000000100)={0x0, 0xb601, 0x0, 0x0, 0x17a}, &(0x7f0000000240)=0x0, &(0x7f00000000c0)=0x0) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r4, 0x80184132, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r3, 0xc000000, &(0x7f00000001c0)=[{&(0x7f0000000280)=""/4096, 0x1000}], 0x1, 0x1e}) io_uring_enter(r4, 0x847ba, 0x20000000, 0xe, 0x0, 0x0) 6.277357558s ago: executing program 1 (id=1357): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x5, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x7fffc, {0x0, 0x0, 0x0, r7, {}, {0x2, 0xb}, {0xd, 0x5}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x9, 0x6, 0x1, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc0e8}, 0x4008000) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 6.141756338s ago: executing program 1 (id=1358): syz_usb_connect$cdc_ecm(0x5, 0x5a, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902"], 0x0) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket(0x10, 0x3, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x800000000000002, 0x0) pipe(&(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) socket$key(0xf, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f00000005c0)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x482458b699e5b9, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x2, 0x10, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x9, 0x0, 0x9}, {0x6, 0x24, 0x1a, 0x5, 0xc}}, {{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x0, 0x81}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x210, 0x6, 0xa, 0x4}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0xff, 0xa, 0x7}}}}}}}]}}, 0x0) socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0xffe, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 6.077026156s ago: executing program 6 (id=1359): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) r2 = gettid() rt_sigtimedwait(0x0, 0x0, 0x0, 0x0) tkill(r2, 0x15) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0xa9, 0x8000000000000000, 0x8, 0x7, 0x8000003}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc1002}]}) r3 = socket$nl_generic(0x10, 0x3, 0x10) madvise(&(0x7f000034d000/0x3000)=nil, 0x3000, 0xc) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ptrace$PTRACE_GETSIGMASK(0x420a, r2, 0x8, &(0x7f00000001c0)) sendmsg$NL80211_CMD_GET_SURVEY(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="a90303000000000000003200000008004001"], 0x1c}}, 0x4004050) 5.993604728s ago: executing program 4 (id=1360): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x200400c4) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x0, 0xe}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r7) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r8, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r6, 0xc}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4", 0x20}, {&(0x7f00000001c0)="43ef6e06729e", 0x6}], 0x2}, 0x4) 5.311126608s ago: executing program 3 (id=1361): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004840}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 5.213994115s ago: executing program 4 (id=1362): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000002c0), 0x400001, 0x0) ioctl$KVM_S390_VCPU_FAULT(r1, 0x4008ae52, &(0x7f0000000300)=0xfffffffffffff4f9) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'hsr0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@ipv6_newnexthop={0x34, 0x68, 0x1, 0x0, 0x25dfdbfd, {0x2}, [@NHA_ENCAP_TYPE={0x6, 0x7, 0x1}, @NHA_ENCAP={0xc, 0x8, 0x0, 0x1, @LWTUNNEL_IP6_HOPLIMIT={0x5, 0x4, 0x1}}, @NHA_OIF={0x8, 0x5, r2}]}, 0x34}, 0x1, 0x0, 0x0, 0x4402}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f000001fac0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x2, 0xa8) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8cd87, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x6, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x3}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) sendmmsg$inet6(r5, &(0x7f0000000280), 0x0, 0x844) r8 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) 4.938405461s ago: executing program 4 (id=1363): openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/wakeup_count', 0x181000, 0x21) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0x5, 0xffffffff}, 0x0) r2 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000140)=0x2000) ppoll(&(0x7f0000000040)=[{r2, 0x20}], 0x1, 0x0, 0x0, 0x0) mmap$dsp(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x100000f, 0x11, r2, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000000)=0x4000) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 4.722177512s ago: executing program 0 (id=1364): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="6c0000001000010400d201000072f60000020000", @ANYRES32=r4, @ANYBLOB="05"], 0x6c}, 0x1, 0x0, 0x0, 0x10004000}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = accept4$inet(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x80800) getsockopt$inet_mreq(r6, 0x0, 0x24, 0x0, &(0x7f0000000340)) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r2, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) ioctl$XFS_IOC_GETBMAPX(r1, 0xc0205838, &(0x7f0000000200)={0x3, 0x6, 0x7ff, 0xfffffffe, 0x1, 0x4, 0x2}) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000040)='veth1_virt_wifi\x00', 0x10) r7 = dup(0xffffffffffffffff) sendmsg$inet(r7, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10, &(0x7f0000001600)=[{}], 0x1}, 0x0) read$FUSE(r7, &(0x7f0000006a40)={0x2020}, 0x2020) 4.542136513s ago: executing program 6 (id=1365): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) timer_create(0x0, 0x0, &(0x7f0000000000)=0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xffffffffffffd270, 0xb, &(0x7f00000000c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) timer_delete(r2) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x404, 0x9}, 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x3, 0x4, 0x7f, 0x1, r3, 0x15b4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r4}, &(0x7f0000000840), &(0x7f0000000880)=r3}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r4, &(0x7f0000000900)}, 0x20) 4.37671662s ago: executing program 3 (id=1366): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x2, 0x180, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x5, 0x6, 0x9, 0x8000000000000000, 0xf4a, 0x0, 0xbdb], 0xffff1001, 0x4000}) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000200)={0x0, 0x0, 0x300f, 0x2, 0x0, 0x0, 0x0, 0x1}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 3.230395429s ago: executing program 1 (id=1367): syz_clone(0x100000, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) mlockall(0x2) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1, 0x11, r1, 0x800000000000) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r2, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000004200)={0x50, 0x0, r3, {0x7, 0x29, 0x8, 0x55610518, 0x0, 0x2008, 0x0, 0x0, 0x0, 0x0, 0x100, 0x4}}, 0x50) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x200, 0x81) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000001b80)=""/4110, 0x100e}, {0x0}], 0x2, 0x1, 0xd55) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="30000000400007012cbd700000000000017c0000040c0002800800148004001280000000000000deff00000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) 3.210721698s ago: executing program 0 (id=1368): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x14, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) chdir(0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x33455aed6cbf4c1b) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x5543, 0x4d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0x0, [{{0x9, 0x4, 0x0, 0x90, 0x7f, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0xa}}}}]}}]}}, 0x0) chdir(&(0x7f0000000540)='./cgroup\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x33455aed6cbf4c1b) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) futex(&(0x7f0000000900)=0x1, 0x1, 0x0, &(0x7f0000000940), &(0x7f0000000980)=0x1, 0x1) fcntl$notify(r2, 0x402, 0x8000003d) lsetxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, 0x0, 0x1) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0xa, {[@local=@item_4={0x3, 0x2, 0x7, "8c740a1b"}, @main=@item_4={0x3, 0x0, 0x8}]}}, 0x0}, 0x0) madvise(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x9) syz_usb_control_io(r1, &(0x7f0000000380)={0x2c, &(0x7f0000000100)={0x40, 0x21, 0xcd, {0xcd, 0xd, "188feb2a46009c6ce98b4b19d0b14b6a38df1aee7ae7694d6231f3eb366f63f0ab89437fee3293bad2f41973eacb11c998779abedced1bf3d7550be9883e156feefa1132b2e14dc1146d314680809ffdc5d8987a03846e40af14f8a747baf4800b618889eb54b2f4931a95627b702e060d8666189977bed66122018c41ef393a3b792677fc9cae049e94a4d39249ae24abb2d0b1e2dfa6ee86195a0c928530c68135a682c6cf92adbc48741b79dad03cacf9d0cb1abe24268a088ffcd29aad296aea664dca2d99b4a90fd3"}}, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x448}}, 0x0, &(0x7f0000000300)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x1, 0xc, 0x8, "6c749423", "422a34e5"}}, &(0x7f0000000340)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x5, 0x18, 0x2, 0x6, 0x0, 0x4255, 0x800}}}, &(0x7f0000000840)={0x84, &(0x7f00000003c0)={0x40, 0x15, 0x60, "8d7956347138591dc4954daf8e61e53a4f17cc89c70f0d3197972a51e39a8aed6d4d0eebbd54c52aafe88960abacc47a66913a750aa2df32e416a637212490391f8388201e035b73e82d38f3a93269d6a3207890568c30825eb90393c25bbbf8"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x80}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000004c0)={0x20, 0x0, 0x4, {0x1, 0x1}}, &(0x7f0000000500)={0x20, 0x0, 0x4, {0xa0, 0x4}}, &(0x7f0000000580)={0x40, 0x7, 0x2, 0xaa8b}, &(0x7f00000005c0)={0x40, 0x9, 0x1, 0x10}, &(0x7f0000000600)={0x40, 0xb, 0x2, "44d5"}, &(0x7f0000000640)={0x40, 0xf, 0x2, 0x2}, &(0x7f0000000680)={0x40, 0x13, 0x6, @random="5b978d7034c2"}, &(0x7f00000006c0)={0x40, 0x17, 0x6, @link_local}, &(0x7f0000000700)={0x40, 0x19, 0x2, "d914"}, 0x0, &(0x7f0000000780)={0x40, 0x1c, 0x1, 0x3}, &(0x7f00000007c0)={0x40, 0x1e, 0x1, 0xf}, &(0x7f0000000800)={0x40, 0x21, 0x1, 0xd}}) open(0x0, 0x0, 0x0) 2.778786909s ago: executing program 3 (id=1369): openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x4f6, &(0x7f0000000380)={0x0, 0xc81d, 0x10, 0x4, 0x2cf}, &(0x7f0000000300)=0x0, &(0x7f00000002c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r5 = syz_open_procfs(0x0, &(0x7f0000002440)='statm\x00') prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) read$FUSE(r5, &(0x7f0000000400)={0x2020}, 0x2020) r6 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r6, 0x4c81, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index=0x6, 0x1, {}, 0x10000, 0xf, 0x1, {0x0, 0x0, r5}}) io_uring_enter(r2, 0x47b2, 0x10f9, 0x82, 0x0, 0x48) 2.775209696s ago: executing program 4 (id=1370): syz_open_procfs$pagemap(0x0, &(0x7f00000000c0)) socket$nl_generic(0x10, 0x3, 0x10) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x28a400) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) socket$inet(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r1, @ANYRES16=r0, @ANYRESHEX], 0x0) 1.724681735s ago: executing program 6 (id=1371): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2b}}}]}, 0x38}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000023c0)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xb, 0xfff3}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x3}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x7, 0x9, 0x6, 0x1, 0x401}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4) 1.607982517s ago: executing program 3 (id=1372): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000000c0), 0x12) unshare(0x2c020400) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r2, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x0, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000100)=[{&(0x7f0000000240)=""/216, 0xd8}], 0x1}) io_uring_enter(r3, 0x847ba, 0x0, 0xf, 0x0, 0x0) shmget$private(0x0, 0xfffffffffeffffff, 0x4800, &(0x7f0000ffc000/0x3000)=nil) 1.401469345s ago: executing program 6 (id=1373): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000100)={0x18, 0x0, {0x1, @broadcast, 'bridge_slave_1\x00'}}, 0x1e) r1 = socket$pppoe(0x18, 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0xc, &(0x7f0000000480)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r4, &(0x7f0000000cc0)=[{{&(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010100}, 0x10, 0x0}}, {{&(0x7f0000000140)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000003040)=[{&(0x7f00000001c0)="05", 0x1}], 0x1}}], 0x2, 0x0) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000100)=@sack_info={r3, 0x1, 0x100269}, 0xc) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000080)={r3, 0x100000, 0x40, 0xf}, &(0x7f0000000180)=0x10) connect$pppoe(r1, &(0x7f0000000140)={0x18, 0x0, {0x2, @remote, 'tunl0\x00'}}, 0x1e) r5 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r5, &(0x7f0000000000)={0x18, 0x0, {0x1, @broadcast, 'ip_vti0\x00'}}, 0x1e) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x34, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}, @NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}, {0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x100}}, 0x0) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000001440)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0x0, 0x0, 0x1a0, 0x1a0, 0x360, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@remote, @private1, [0xff], [0x0, 0xffffffff, 0xffffff00], 'gre0\x00', 'syzkaller1\x00', {}, {0xff}, 0x0, 0x0, 0x7}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x599c, 0x6}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x270}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xd0}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@local, @ipv6=@remote, 0x3a, 0x8, 0x6}}}, {{@ipv6={@local, @empty, [0x0, 0xff000000, 0xff000000], [0xffffffff], 'ipvlan0\x00', '\x00', {}, {0xf7d589580f149d60}, 0x0, 0x5, 0x7}, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x2, 0x8}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) close(r7) 1.27449645s ago: executing program 6 (id=1374): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, 0x0, {0xc, 0xc}, {0x0, 0xfff1}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x80dd) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000006c0)={0x0, 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 978.436917ms ago: executing program 3 (id=1375): socket$inet(0x2b, 0x801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0) socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f00000001c0)) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/asound/seq/clients\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000000200)={0x2020}, 0x2020) 968.200331ms ago: executing program 1 (id=1376): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x6, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000004600), 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0x3) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) mknod$loop(0x0, 0x2000, 0x0) ioctl$TCSETSW2(r2, 0x80047456, &(0x7f0000000040)={0x3, 0xb, 0xfffffffe, 0x7fffffff, 0x0, "23f555d9adb42d4408020e90d1beaa82dc1ecf", 0xffffffff}) 522.009572ms ago: executing program 0 (id=1377): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r3, 0x10f, 0x80, &(0x7f0000000080)=0xfffffff4, 0x4) write$proc_mixer(r2, 0x0, 0x33) close(r2) r4 = syz_io_uring_setup(0x876, &(0x7f0000000140)={0x0, 0x114df, 0x0, 0x0, 0x89}, &(0x7f0000000240)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_open_dev$loop(0x0, 0xffff, 0x14f600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.stat\x00', 0x275a, 0x0) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_WRITE_FIXED={0x5, 0x50, 0x0, @fd_index=0x6, 0x4, 0xffffffffffffffff, 0x2, 0x6, 0x1}) io_uring_enter(r4, 0x3516, 0xaddf, 0x2, 0x0, 0x1517f) 439.811986ms ago: executing program 4 (id=1378): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000040)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETENCODER(0xffffffffffffffff, 0xc01464a6, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe4000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f00000000c0)="3b76210fb6150f209e440f20c0663503000000440f22c00fa2660fc7b2d42af30fa7d0440f20c066350d000000440f22c06767f2caab12bad004ec", 0x3b}], 0x1, 0xd, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r4, 0x4020aed2, &(0x7f0000000080)={0x10000, 0x14000, 0x8}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000240)={[0x10583a, 0x5, 0xa, 0x4000000000, 0x6, 0x2, 0x1041, 0x4, 0x7, 0x8000000000000000, 0xfffffffffffffffe, 0xffffffff, 0x1, 0x9, 0xbe3, 0x6a], 0xeeee8000, 0x1000d6}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 0s ago: executing program 6 (id=1379): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004840}, 0x28000) sendmsg$NFNL_MSG_ACCT_NEW(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={0x0}, 0x1, 0x0, 0x0, 0x4000850}, 0x4048010) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, 0x37, 0xa01, 0x0, 0x0, {0x80}}, 0x14}}, 0x8054) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a000007"], 0x7c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4000018) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) write$tun(r0, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0xfd5e, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0xffffff07}, @generic={0x0, 0x2, "d588382003c1"}]}}}}}}, 0xfd6c) kernel console output (not intermixed with test programs): rol_msg error -71 req 04 val 1500 [ 315.835405][ T7109] pwc: recv_control_msg error -71 req 02 val 2500 [ 315.843724][ T7109] pwc: recv_control_msg error -71 req 02 val 2400 [ 315.875996][ T7109] pwc: recv_control_msg error -71 req 02 val 2600 [ 315.904486][ T7109] pwc: recv_control_msg error -71 req 02 val 2900 [ 315.929433][ T7109] pwc: recv_control_msg error -71 req 02 val 2800 [ 315.942969][ T7109] pwc: recv_control_msg error -71 req 04 val 1100 [ 316.018815][ T7109] pwc: recv_control_msg error -71 req 04 val 1200 [ 316.038503][ T7109] videodev: could not get a free minor [ 316.055469][ T7109] pwc: Failed to register as video device (-23). [ 316.126954][ T7109] Philips webcam 2-1:0.0: probe with driver Philips webcam failed with error -23 [ 316.139855][ T7109] usb 2-1: USB disconnect, device number 15 [ 317.086002][ T9304] syzkaller0: entered promiscuous mode [ 317.188144][ T9304] syzkaller0: entered allmulticast mode [ 317.327623][ T1542] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 317.506881][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.515053][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.577193][ T1542] usb 2-1: Using ep0 maxpacket: 32 [ 317.585418][ T1542] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 317.606679][ T1542] usb 2-1: New USB device found, idVendor=2006, idProduct=0118, bcdDevice= 0.00 [ 317.635663][ T1542] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.732765][ T1542] usb 2-1: config 0 descriptor?? [ 318.518315][ T1542] hkems 0003:2006:0118.0007: item fetching failed at offset 0/2 [ 318.540571][ T63] net_ratelimit: 20 callbacks suppressed [ 318.540590][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 318.558136][ T1542] hkems 0003:2006:0118.0007: parse failed [ 318.563988][ T1542] hkems 0003:2006:0118.0007: probe with driver hkems failed with error -22 [ 318.677500][ T6550] bond5: (slave macvlan2): failed to get link speed/duplex [ 318.714246][ T7111] usb 2-1: USB disconnect, device number 16 [ 318.797167][ T6550] bond5: (slave macvlan2): failed to get link speed/duplex [ 318.867216][ T7109] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 318.906263][ T9332] tipc: Started in network mode [ 318.906323][ T9332] tipc: Node identity 1664ae9f64cd, cluster identity 4711 [ 318.922415][ T9332] tipc: Enabled bearer , priority 0 [ 318.939799][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 318.955433][ T9332] syzkaller0: entered promiscuous mode [ 318.955464][ T9332] syzkaller0: entered allmulticast mode [ 319.006624][ T9332] tipc: Resetting bearer [ 319.015844][ T9331] tipc: Resetting bearer [ 319.038051][ T9331] tipc: Disabling bearer [ 319.040564][ T7109] usb 7-1: not running at top speed; connect to a high speed hub [ 319.048633][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 319.049348][ T7109] usb 7-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 319.049372][ T7109] usb 7-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 319.049393][ T7109] usb 7-1: config 1 has no interface number 1 [ 319.049451][ T7109] usb 7-1: config 1 interface 2 has no altsetting 0 [ 319.067934][ T7109] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 319.067973][ T7109] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.067993][ T7109] usb 7-1: Product: syz [ 319.068008][ T7109] usb 7-1: Manufacturer: syz [ 319.068022][ T7109] usb 7-1: SerialNumber: syz [ 319.157273][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 319.267995][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 319.313820][ T7109] usb 7-1: selecting invalid altsetting 0 [ 319.328198][ T7109] usb 7-1: failed to enable PITCH for EP 0x82 [ 319.328234][ T7109] usb 7-1: selecting invalid altsetting 0 [ 319.384061][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 319.494902][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 319.589019][ T9343] netlink: 'syz.3.893': attribute type 1 has an invalid length. [ 319.604316][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 319.634424][ T7109] usb 7-1: USB disconnect, device number 4 [ 319.773145][ T1542] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 319.802784][ T9346] netlink: 44 bytes leftover after parsing attributes in process `syz.3.893'. [ 319.824486][ T9343] 8021q: adding VLAN 0 to HW filter on device bond3 [ 319.838777][ T9346] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 319.874073][ T9346] bond3: (slave batadv1): making interface the new active one [ 319.936394][ T9346] bond3: (slave batadv1): Enslaving as an active interface with an up link [ 319.945587][ T1542] usb 2-1: Using ep0 maxpacket: 32 [ 319.951501][ T1542] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 319.951532][ T1542] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 319.957437][ T1542] usb 2-1: config 0 descriptor?? [ 320.052631][ T9345] vlan3: entered promiscuous mode [ 320.052656][ T9345] bond3: entered promiscuous mode [ 320.052671][ T9345] batadv1: entered promiscuous mode [ 320.053049][ T9345] vlan3: entered allmulticast mode [ 320.053065][ T9345] bond3: entered allmulticast mode [ 320.053077][ T9345] batadv1: entered allmulticast mode [ 320.166441][ T1542] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 320.256414][ T1542] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 320.297609][ T1542] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 320.320782][ T1542] usb 2-1: media controller created [ 320.406978][ T1542] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 320.652829][ T1542] DVB: Unable to find symbol dib7000p_attach() [ 320.700500][ T1542] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 320.744662][ T9364] netlink: 32 bytes leftover after parsing attributes in process `syz.4.899'. [ 320.781230][ T9369] netlink: 92 bytes leftover after parsing attributes in process `syz.0.900'. [ 320.801830][ T9369] netlink: 990 bytes leftover after parsing attributes in process `syz.0.900'. [ 320.854876][ T9356] binder: 9355:9356 ioctl c0306201 200000000540 returned -14 [ 320.917182][ T1542] rc_core: IR keymap rc-dib0700-rc5 not found [ 320.923318][ T1542] Registered IR keymap rc-empty [ 320.957475][ T1542] dvb-usb: could not initialize remote control. [ 320.968650][ T1542] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 321.009817][ T1542] usb 2-1: USB disconnect, device number 17 [ 321.159340][ T1542] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 321.508039][ T29] audit: type=1800 audit(1772166188.393:248): pid=9382 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.903" name="bus" dev="ramfs" ino=35580 res=0 errno=0 [ 322.498070][ T9399] tipc: Started in network mode [ 322.502953][ T9399] tipc: Node identity e6b610cfd6a3, cluster identity 4711 [ 322.510763][ T9399] tipc: Enabled bearer , priority 0 [ 322.522577][ T9399] syzkaller0: entered promiscuous mode [ 322.537424][ T9399] syzkaller0: entered allmulticast mode [ 322.630115][ T9399] tipc: Resetting bearer [ 322.662094][ T9398] tipc: Resetting bearer [ 322.711583][ T9398] tipc: Disabling bearer [ 323.227308][ T7111] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 323.387393][ T7111] usb 7-1: Using ep0 maxpacket: 16 [ 323.398516][ T7111] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 323.414828][ T7111] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 323.426988][ T7111] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.443444][ T7111] usb 7-1: Product: syz [ 323.462553][ T7111] usb 7-1: Manufacturer: syz [ 323.474528][ T7111] usb 7-1: SerialNumber: syz [ 323.535404][ T7111] usb 7-1: config 0 descriptor?? [ 323.570162][ T7111] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 323.596414][ T7111] em28xx 7-1:0.0: DVB interface 0 found: bulk [ 323.703748][ T120] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 323.788021][ T6560] net_ratelimit: 23 callbacks suppressed [ 323.788047][ T6560] bond5: (slave macvlan2): failed to get link speed/duplex [ 323.937345][ T120] usb 5-1: Using ep0 maxpacket: 8 [ 323.947748][ T120] usb 5-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 324.011191][ T120] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.017516][ T6550] bond5: (slave macvlan2): failed to get link speed/duplex [ 324.070593][ T120] usb 5-1: Product: syz [ 324.096480][ T120] usb 5-1: Manufacturer: syz [ 324.122371][ T120] usb 5-1: SerialNumber: syz [ 324.137511][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 324.153263][ T120] usb 5-1: config 0 descriptor?? [ 324.177385][ T7111] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 324.186559][ T120] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 324.267780][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 324.379207][ T6550] bond5: (slave macvlan2): failed to get link speed/duplex [ 324.509930][ T12] bond5: (slave macvlan2): failed to get link speed/duplex [ 324.604713][ T7111] em28xx 7-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 324.631086][ T7111] em28xx 7-1:0.0: board has no eeprom [ 324.670837][ T12] bond5: (slave macvlan2): failed to get link speed/duplex [ 324.849278][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 325.007324][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 325.157312][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 325.277330][ T1542] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 325.437171][ T1542] usb 1-1: Using ep0 maxpacket: 32 [ 325.447648][ T1542] usb 1-1: config 0 has an invalid interface number: 196 but max is 0 [ 325.457403][ T1542] usb 1-1: config 0 has no interface number 0 [ 325.464793][ T1542] usb 1-1: config 0 interface 196 has no altsetting 0 [ 325.476818][ T1542] usb 1-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 325.488713][ T1542] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.500892][ T1542] usb 1-1: Product: syz [ 325.506314][ T1542] usb 1-1: Manufacturer: syz [ 325.521038][ T1542] usb 1-1: SerialNumber: syz [ 325.534776][ T1542] usb 1-1: config 0 descriptor?? [ 325.771674][ T1542] ipheth 1-1:0.196: Unable to find endpoints [ 325.811055][ T1542] usb 1-1: USB disconnect, device number 15 [ 325.878163][ T7111] em28xx 7-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 325.889212][ T7111] em28xx 7-1:0.0: dvb set to bulk mode. [ 325.899930][ T7109] em28xx 7-1:0.0: Binding DVB extension [ 325.919989][ T7111] usb 7-1: USB disconnect, device number 5 [ 325.942933][ T7111] em28xx 7-1:0.0: Disconnecting em28xx [ 326.016705][ T7109] em28xx 7-1:0.0: Registering input extension [ 326.031486][ T7111] em28xx 7-1:0.0: Closing input extension [ 326.060280][ T7111] em28xx 7-1:0.0: Freeing device [ 326.300971][ T9452] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20004 [ 326.325175][ T9452] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 326.334559][ T9452] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 326.348295][ T9452] RDS: rds_bind could not find a transport for ae0c:91e3:ccfb:11d2:0:5efe:150.125.240.108, load rds_tcp or rds_rdma? [ 326.631954][ T9] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 326.797163][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 326.831884][ T9] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 326.845879][ T9] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 326.866771][ T9] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 326.888712][ T9] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 326.929408][ T9] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 326.963156][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 327.067182][ T120] gspca_sonixj: i2c_w8 err -71 [ 327.107855][ T120] sonixj 5-1:0.0: probe with driver sonixj failed with error -71 [ 327.165008][ T120] usb 5-1: USB disconnect, device number 19 [ 327.209742][ T9] usb 1-1: GET_CAPABILITIES returned 0 [ 327.219512][ T9] usbtmc 1-1:16.0: can't read capabilities [ 327.417700][ T1542] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 327.435235][ C0] usbtmc 1-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 327.467686][ T5931] usb 1-1: USB disconnect, device number 16 [ 327.599884][ T1542] usb 2-1: config 0 has no interfaces? [ 327.608543][ T1542] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 327.618590][ T1542] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.637517][ T1542] usb 2-1: Product: syz [ 327.641732][ T1542] usb 2-1: Manufacturer: syz [ 327.646428][ T1542] usb 2-1: SerialNumber: syz [ 327.655722][ T1542] usb 2-1: config 0 descriptor?? [ 328.312944][ T9461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.463917][ T9461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.668422][ T9475] syzkaller0: entered promiscuous mode [ 328.723907][ T9475] syzkaller0: entered allmulticast mode [ 329.223185][ T1542] usb 2-1: USB disconnect, device number 18 [ 329.288964][ T13] net_ratelimit: 28 callbacks suppressed [ 329.288985][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 329.464637][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 329.647489][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 329.757619][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 329.887343][ T7109] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 329.957311][ T7111] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 330.103907][ T9491] netlink: 'syz.1.927': attribute type 10 has an invalid length. [ 330.139747][ T7111] usb 1-1: Using ep0 maxpacket: 32 [ 330.148131][ T7109] usb 7-1: config 0 has an invalid descriptor of length 95, skipping remainder of the config [ 330.159858][ T7111] usb 1-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 330.191074][ T7109] usb 7-1: New USB device found, idVendor=050d, idProduct=011b, bcdDevice=6f.a4 [ 330.204827][ T7111] usb 1-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 330.220826][ T7109] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.228970][ T7111] usb 1-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 330.263268][ T7109] usb 7-1: config 0 descriptor?? [ 330.274983][ T9491] mac80211_hwsim hwsim9 wlan1: entered promiscuous mode [ 330.294140][ T7109] usb 7-1: bad CDC descriptors [ 330.312572][ T7111] usb 1-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 330.365751][ T9491] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 330.407717][ T7111] usb 1-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 330.418308][ T7111] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.427849][ T7111] usb 1-1: Product: syz [ 330.447534][ T7111] usb 1-1: Manufacturer: syz [ 330.448701][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 330.452254][ T7111] usb 1-1: SerialNumber: syz [ 330.501438][ T9] usb 7-1: USB disconnect, device number 6 [ 330.549448][ C1] imon 1-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 330.576427][ T7111] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/input/input21 [ 330.628155][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 330.739243][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 330.747713][ T9495] fuse: Unknown parameter '' [ 330.757880][ T7111] imon 1-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 330.778124][ T9495] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 330.787233][ T7111] (id 0x00) [ 330.799277][ T9495] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 330.862912][ T9499] tipc: Enabled bearer , priority 0 [ 330.871715][ T9499] syzkaller0: entered promiscuous mode [ 330.877545][ T7111] rc_core: IR keymap rc-imon-pad not found [ 330.883655][ T7111] Registered IR keymap rc-empty [ 330.888673][ T9499] syzkaller0: entered allmulticast mode [ 330.896114][ T7111] imon 1-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 330.897267][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 330.914094][ T7111] imon 1-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 330.959151][ T9499] tipc: Resetting bearer [ 330.966885][ T9498] tipc: Resetting bearer [ 330.981109][ T7111] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0 [ 330.994019][ T9498] tipc: Disabling bearer [ 330.996666][ T7111] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0/input22 [ 331.033118][ T7111] imon 1-1:155.0: iMON device (15c2:ffdc, intf0) on usb<1:17> initialized [ 331.047857][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 331.178216][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 331.561994][ T9513] syzkaller0: entered promiscuous mode [ 331.569558][ T9513] syzkaller0: entered allmulticast mode [ 331.633643][ T9513] netlink: 76 bytes leftover after parsing attributes in process `syz.3.935'. [ 331.917161][ T5931] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 332.011985][ T9524] kvm: pic: non byte write [ 332.016795][ T9524] kvm: pic: non byte write [ 332.169351][ T5931] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 332.183312][ T5931] usb 5-1: config 1 has an invalid descriptor of length 52, skipping remainder of the config [ 332.216989][ T5931] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 332.240456][ T5931] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 7 [ 332.272525][ T5931] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9272, setting to 1024 [ 332.306405][ T5931] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 332.327203][ T5931] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 332.335532][ T5931] usb 5-1: Product: syz [ 332.347137][ T5931] usb 5-1: Manufacturer: syz [ 332.368489][ T5931] cdc_wdm 5-1:1.0: skipping garbage [ 332.373969][ T5931] cdc_wdm 5-1:1.0: skipping garbage [ 332.387378][ T5931] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 332.421455][ T9525] imon:send_packet: packet tx failed (-71) [ 332.421854][ T7109] usb 1-1: USB disconnect, device number 17 [ 332.447148][ T9525] imon:vfd_write: send packet #4 failed [ 332.586312][ T7111] usb 5-1: USB disconnect, device number 20 [ 332.809856][ T5931] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 333.001481][ T9536] syzkaller0: entered promiscuous mode [ 333.007021][ T9536] syzkaller0: entered allmulticast mode [ 333.529799][ T5931] usb 2-1: Using ep0 maxpacket: 16 [ 333.550449][ T5931] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 333.569810][ T5931] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 333.707149][ T5931] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 333.717282][ T5931] usb 2-1: Product: syz [ 333.721484][ T5931] usb 2-1: Manufacturer: syz [ 333.726286][ T5931] usb 2-1: SerialNumber: syz [ 333.773881][ T9549] netlink: 28 bytes leftover after parsing attributes in process `syz.0.946'. [ 333.948925][ T5931] usb 2-1: config 0 descriptor?? [ 334.649027][ T1112] net_ratelimit: 20 callbacks suppressed [ 334.649048][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 334.908993][ T9565] binder: 9530:9565 ioctl c00c620f 200000000140 returned -22 [ 335.102209][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 335.358360][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 335.477168][ T12] bond5: (slave macvlan2): failed to get link speed/duplex [ 335.600435][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 335.787255][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 335.917187][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 336.057619][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 336.178452][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 336.326739][ T9590] netlink: 'syz.0.953': attribute type 10 has an invalid length. [ 336.359293][ T1210] usb 2-1: USB disconnect, device number 19 [ 336.386004][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 336.464195][ T9590] mac80211_hwsim hwsim11 wlan1: entered promiscuous mode [ 336.910232][ T9590] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 336.968898][ T9589] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 337.197633][ T9587] GUP no longer grows the stack in syz.3.952 (9587): 200000005000-200000008000 (200000004000) [ 337.227571][ T9587] CPU: 1 UID: 0 PID: 9587 Comm: syz.3.952 Tainted: G L syzkaller #0 PREEMPT(full) [ 337.227621][ T9587] Tainted: [L]=SOFTLOCKUP [ 337.227630][ T9587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 337.227651][ T9587] Call Trace: [ 337.227659][ T9587] [ 337.227670][ T9587] dump_stack_lvl+0xe8/0x150 [ 337.227706][ T9587] fixup_user_fault+0x637/0x6f0 [ 337.227743][ T9587] fault_in_user_writeable+0x71/0xd0 [ 337.227770][ T9587] futex_lock_pi+0x800/0xb00 [ 337.227807][ T9587] ? __pfx_futex_lock_pi+0x10/0x10 [ 337.227832][ T9587] ? fpu__restore_sig+0x55b/0x1250 [ 337.227860][ T9587] ? fpu__restore_sig+0x55b/0x1250 [ 337.227898][ T9587] ? __pfx_futex_wake_mark+0x10/0x10 [ 337.227933][ T9587] ? restore_signal_shadow_stack+0x3b2/0x460 [ 337.227956][ T9587] ? __ia32_sys_rt_sigreturn+0x7dc/0x8e0 [ 337.227985][ T9587] do_futex+0x292/0x420 [ 337.228008][ T9587] ? __pfx___ia32_sys_rt_sigreturn+0x10/0x10 [ 337.228034][ T9587] ? __pfx_do_futex+0x10/0x10 [ 337.228064][ T9587] __se_sys_futex+0x3a8/0x450 [ 337.228093][ T9587] ? __pfx___se_sys_futex+0x10/0x10 [ 337.228117][ T9587] ? rcu_is_watching+0x15/0xb0 [ 337.228149][ T9587] ? __x64_sys_futex+0x21/0xf0 [ 337.228174][ T9587] do_syscall_64+0x14d/0xf80 [ 337.228204][ T9587] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.228224][ T9587] ? clear_bhb_loop+0x40/0x90 [ 337.228247][ T9587] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.228268][ T9587] RIP: 0033:0x7f343b39c799 [ 337.228295][ T9587] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 337.228312][ T9587] RSP: 002b:00007f34395f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 337.228335][ T9587] RAX: ffffffffffffffda RBX: 00007f343b615fa0 RCX: 00007f343b39c799 [ 337.228350][ T9587] RDX: 00000000fffffffd RSI: 000000000000008d RDI: 0000200000004000 [ 337.228364][ T9587] RBP: 00007f343b432bd9 R08: 0000000000000000 R09: 0000000000000000 [ 337.228377][ T9587] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 337.228389][ T9587] R13: 00007f343b616038 R14: 00007f343b615fa0 R15: 00007f343b73fa48 [ 337.228419][ T9587] [ 337.301155][ T5931] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 338.512122][ T5931] usb 2-1: config 0 has an invalid interface number: 99 but max is 0 [ 338.532669][ T5931] usb 2-1: config 0 has no interface number 0 [ 338.562374][ T5931] usb 2-1: New USB device found, idVendor=0c72, idProduct=0012, bcdDevice=22.96 [ 338.575597][ T7109] IPVS: starting estimator thread 0... [ 338.612128][ T5931] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 338.667465][ T9609] IPVS: using max 57 ests per chain, 136800 per kthread [ 338.699391][ T5931] usb 2-1: Product: syz [ 338.711684][ T5825] Bluetooth: hci3: unexpected subevent 0x0e length: 248 > 15 [ 338.720095][ T5825] Bluetooth: hci3: Unable to find connection for dst 00:00:00:00:00:00 sid 0x00 [ 338.891573][ T5931] usb 2-1: Manufacturer: syz [ 338.896956][ T5931] usb 2-1: SerialNumber: syz [ 339.144968][ T5931] usb 2-1: config 0 descriptor?? [ 339.175449][ T5931] peak_usb 2-1:0.99: probe with driver peak_usb failed with error 99 [ 340.267171][ T1112] net_ratelimit: 18 callbacks suppressed [ 340.267196][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 340.432145][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 340.507617][ T9632] syzkaller0: entered promiscuous mode [ 340.592610][ T9632] syzkaller0: entered allmulticast mode [ 340.685994][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 341.097342][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 341.257425][ T5931] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 341.302248][ T9639] netlink: 32 bytes leftover after parsing attributes in process `syz.4.966'. [ 341.346434][ T1210] usb 2-1: USB disconnect, device number 20 [ 341.367270][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 341.431224][ T5931] usb 1-1: Using ep0 maxpacket: 16 [ 341.442269][ T5931] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 341.480361][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 341.506496][ T5931] usb 1-1: config 0 has no interfaces? [ 341.530708][ T5931] usb 1-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 341.540887][ T5931] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 341.570537][ T5931] usb 1-1: config 0 descriptor?? [ 341.600074][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 341.719059][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 341.813587][ T9] usb 1-1: USB disconnect, device number 18 [ 341.874776][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 341.889345][ T5931] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 342.101747][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 342.187309][ T5931] usb 2-1: Using ep0 maxpacket: 32 [ 342.234239][ T5931] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 342.247196][ T1210] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 342.248505][ T5931] usb 2-1: config 0 has no interface number 0 [ 342.271936][ T5931] usb 2-1: config 0 interface 12 has no altsetting 0 [ 342.289566][ T5931] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 342.306315][ T5931] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 342.321162][ T5931] usb 2-1: Product: syz [ 342.325462][ T5931] usb 2-1: Manufacturer: syz [ 342.341462][ T5931] usb 2-1: SerialNumber: syz [ 342.353256][ T5931] usb 2-1: config 0 descriptor?? [ 342.413971][ T1210] usb 7-1: Using ep0 maxpacket: 32 [ 342.422327][ T1210] usb 7-1: config index 0 descriptor too short (expected 29220, got 36) [ 342.477330][ T1210] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 342.485983][ T1210] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 342.495108][ T1210] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 342.509183][ T1210] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 342.582242][ T1210] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 342.852228][ T1210] usb 7-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 342.975177][ T1210] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 343.036236][ T1210] usb 7-1: config 0 descriptor?? [ 343.438789][ T1210] usblp 7-1:0.0: usblp0: USB Bidirectional printer dev 7 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 343.883429][ T1210] usb 7-1: USB disconnect, device number 7 [ 343.922203][ T1210] usblp0: removed [ 345.297787][ T9671] netlink: 4 bytes leftover after parsing attributes in process `syz.0.976'. [ 345.348304][ T9671] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 345.429090][ T1093] net_ratelimit: 17 callbacks suppressed [ 345.429117][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 345.592741][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 345.627819][ T9682] syzkaller0: entered promiscuous mode [ 345.640266][ T9682] syzkaller0: entered allmulticast mode [ 345.704747][ T5931] f81534 2-1:0.12: f81534_set_register: reg: 1001 data: f1 failed: -71 [ 345.713346][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 345.721444][ T5931] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 345.730649][ T5931] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 345.768926][ T5931] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 345.837540][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 345.856588][ T5931] usb 2-1: USB disconnect, device number 21 [ 345.967179][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 346.107531][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 346.317813][ T9695] syzkaller0: entered promiscuous mode [ 346.323588][ T9695] syzkaller0: entered allmulticast mode [ 346.477290][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 346.507398][ T9697] mac80211_hwsim hwsim9 syzkaller0: entered promiscuous mode [ 346.527392][ T9697] mac80211_hwsim hwsim9 syzkaller0: entered allmulticast mode [ 346.597202][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 346.729809][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 346.751392][ T9708] syz.3.985: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 346.751809][ T9708] CPU: 1 UID: 0 PID: 9708 Comm: syz.3.985 Tainted: G L syzkaller #0 PREEMPT(full) [ 346.751837][ T9708] Tainted: [L]=SOFTLOCKUP [ 346.751845][ T9708] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 346.751857][ T9708] Call Trace: [ 346.751864][ T9708] [ 346.751873][ T9708] dump_stack_lvl+0xe8/0x150 [ 346.751907][ T9708] warn_alloc+0x249/0x340 [ 346.751931][ T9708] ? stack_trace_save+0xa9/0x100 [ 346.751954][ T9708] ? __pfx_warn_alloc+0x10/0x10 [ 346.751980][ T9708] ? kasan_save_track+0x4f/0x80 [ 346.752000][ T9708] ? kasan_save_track+0x3e/0x80 [ 346.752017][ T9708] ? __kasan_kmalloc+0x93/0xb0 [ 346.752036][ T9708] ? __kmalloc_cache_noprof+0x31c/0x660 [ 346.752056][ T9708] ? xskq_create+0x56/0x170 [ 346.752081][ T9708] ? xsk_setsockopt+0x54c/0x990 [ 346.752103][ T9708] ? do_sock_setsockopt+0x17c/0x1b0 [ 346.752129][ T9708] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 346.752154][ T9708] ? do_syscall_64+0x14d/0xf80 [ 346.752187][ T9708] __vmalloc_node_range_noprof+0x132/0x1730 [ 346.752237][ T9708] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 346.752263][ T9708] ? __kasan_kmalloc+0x93/0xb0 [ 346.752290][ T9708] vmalloc_user_noprof+0xad/0xe0 [ 346.752310][ T9708] ? xskq_create+0xbf/0x170 [ 346.752336][ T9708] xskq_create+0xbf/0x170 [ 346.752365][ T9708] xsk_init_queue+0x8a/0xe0 [ 346.752392][ T9708] xsk_setsockopt+0x54c/0x990 [ 346.752430][ T9708] ? __pfx_xsk_setsockopt+0x10/0x10 [ 346.752456][ T9708] ? __pfx_aa_sk_perm+0x10/0x10 [ 346.752483][ T9708] ? aa_sock_opt_perm+0xff/0x1a0 [ 346.752511][ T9708] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 346.752532][ T9708] ? __pfx_xsk_setsockopt+0x10/0x10 [ 346.752557][ T9708] do_sock_setsockopt+0x17c/0x1b0 [ 346.752588][ T9708] __x64_sys_setsockopt+0x13d/0x1b0 [ 346.752619][ T9708] do_syscall_64+0x14d/0xf80 [ 346.752646][ T9708] ? trace_irq_disable+0x3b/0x150 [ 346.752673][ T9708] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.752690][ T9708] ? clear_bhb_loop+0x40/0x90 [ 346.752708][ T9708] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.752725][ T9708] RIP: 0033:0x7f343b39c799 [ 346.752742][ T9708] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 346.752759][ T9708] RSP: 002b:00007f34395d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 346.752779][ T9708] RAX: ffffffffffffffda RBX: 00007f343b616090 RCX: 00007f343b39c799 [ 346.752793][ T9708] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 346.752805][ T9708] RBP: 00007f343b432bd9 R08: 0000000000000004 R09: 0000000000000000 [ 346.752816][ T9708] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 346.752828][ T9708] R13: 00007f343b616128 R14: 00007f343b616090 R15: 00007f343b73fa48 [ 346.752855][ T9708] [ 346.791873][ T9708] Mem-Info: [ 346.791905][ T9708] active_anon:7280 inactive_anon:0 isolated_anon:0 [ 346.791905][ T9708] active_file:13509 inactive_file:40077 isolated_file:0 [ 346.791905][ T9708] unevictable:768 dirty:504 writeback:0 [ 346.791905][ T9708] slab_reclaimable:11256 slab_unreclaimable:101453 [ 346.791905][ T9708] mapped:31352 shmem:1420 pagetables:1496 [ 346.791905][ T9708] sec_pagetables:0 bounce:0 [ 346.791905][ T9708] kernel_misc_reclaimable:0 [ 346.791905][ T9708] free:1312160 free_pcp:9651 free_cma:0 [ 346.791969][ T9708] Node 0 active_anon:29120kB inactive_anon:0kB active_file:53976kB inactive_file:160100kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:125348kB dirty:2016kB writeback:0kB shmem:4144kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13772kB pagetables:5864kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 346.792022][ T9708] Node 1 active_anon:0kB inactive_anon:0kB active_file:60kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:60kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 346.792151][ T9708] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 346.792211][ T9708] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 346.792255][ T9708] Node 0 DMA32 free:1295880kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:29120kB inactive_anon:0kB active_file:53976kB inactive_file:160100kB unevictable:1536kB writepending:2016kB zspages:0kB present:3129332kB managed:2552828kB mlocked:0kB bounce:0kB free_pcp:38600kB local_pcp:20312kB free_cma:0kB [ 346.792316][ T9708] lowmem_reserve[]: 0 0 0 0 0 [ 346.792355][ T9708] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:884kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 346.792408][ T9708] lowmem_reserve[]: 0 0 0 0 0 [ 346.792446][ T9708] Node 1 Normal free:3937400kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:60kB inactive_file:208kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 346.792498][ T9708] lowmem_reserve[]: 0 0 0 0 0 [ 346.792540][ T9708] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 346.792685][ T9708] Node 0 DMA32: 1318*4kB (UME) 1712*8kB (UME) 520*16kB (UME) 363*32kB (UME) 187*64kB (UME) 121*128kB (UME) 87*256kB (UM) 30*512kB (UM) 16*1024kB (UM) 4*2048kB (UM) 285*4096kB (UM) = 1295928kB [ 346.792861][ T9708] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 346.792975][ T9708] Node 1 Normal: 0*4kB 5*8kB (U) 11*16kB (UE) 7*32kB (UE) 7*64kB (UME) 4*128kB (UME) 3*256kB (ME) 4*512kB (UME) 1*1024kB (M) 2*2048kB (UE) 959*4096kB (M) = 3937400kB [ 346.793149][ T9708] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 346.793166][ T9708] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 346.793182][ T9708] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 346.793200][ T9708] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 346.793216][ T9708] 55002 total pagecache pages [ 346.793230][ T9708] 0 pages in swap cache [ 346.793255][ T9708] Free swap = 124996kB [ 346.793263][ T9708] Total swap = 124996kB [ 346.793270][ T9708] 2097051 pages RAM [ 346.793277][ T9708] 0 pages HighMem/MovableOnly [ 346.793284][ T9708] 427008 pages reserved [ 346.793292][ T9708] 0 pages cma reserved [ 346.837253][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 347.620881][ T7111] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 347.795577][ T7111] usb 2-1: Using ep0 maxpacket: 16 [ 347.800025][ T7111] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 347.800060][ T7111] usb 2-1: config 0 has no interface number 0 [ 347.800103][ T7111] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 347.800131][ T7111] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 347.800172][ T7111] usb 2-1: New USB device found, idVendor=04d9, idProduct=a081, bcdDevice= 0.00 [ 347.800196][ T7111] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 347.803031][ T7111] usb 2-1: config 0 descriptor?? [ 348.301046][ T7111] holtek_mouse 0003:04D9:A081.0008: item fetching failed at offset 5/8 [ 348.301783][ T7111] holtek_mouse 0003:04D9:A081.0008: hid parse failed: -22 [ 348.301855][ T7111] holtek_mouse 0003:04D9:A081.0008: probe with driver holtek_mouse failed with error -22 [ 349.661595][ T29] audit: type=1804 audit(1772166216.693:249): pid=9729 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.993" name="/newroot/202/file1" dev="fuse" ino=1 res=1 errno=0 [ 350.240018][ T9737] syzkaller0: entered promiscuous mode [ 350.240046][ T9737] syzkaller0: entered allmulticast mode [ 350.679152][ T1112] net_ratelimit: 23 callbacks suppressed [ 350.679172][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 350.797464][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 350.877853][ T5943] usb 2-1: USB disconnect, device number 22 [ 350.909234][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 350.956562][ T9745] trusted_key: syz.6.998 sent an empty control message without MSG_MORE. [ 351.007440][ T9746] binder: BINDER_SET_CONTEXT_MGR already set [ 351.028279][ T9746] binder: 9744:9746 ioctl 4018620d 200000000100 returned -16 [ 351.038242][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 351.147202][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 351.183429][ T9752] binder: BINDER_SET_CONTEXT_MGR already set [ 351.193348][ T9752] binder: 9744:9752 ioctl 4018620d 200000004a80 returned -16 [ 351.257422][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 351.499279][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 351.617226][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 351.727247][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 352.159848][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 352.223950][ T9765] tipc: Enabled bearer , priority 0 [ 352.239527][ T9765] syzkaller0: entered promiscuous mode [ 352.245261][ T9765] syzkaller0: entered allmulticast mode [ 352.299938][ T9765] tipc: Resetting bearer [ 352.314609][ T9764] tipc: Resetting bearer [ 352.409955][ T9764] tipc: Disabling bearer [ 352.582959][ T9770] syzkaller0: entered promiscuous mode [ 352.652108][ T9770] syzkaller0: entered allmulticast mode [ 352.907536][ T9785] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 352.920982][ T9782] input: syz1 as /devices/virtual/input/input23 [ 352.933345][ T9785] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 354.119787][ T9800] syzkaller0: entered promiscuous mode [ 354.126534][ T9800] syzkaller0: entered allmulticast mode [ 355.767452][ T1112] net_ratelimit: 20 callbacks suppressed [ 355.767474][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 355.823699][ T9820] netlink: 'syz.3.1019': attribute type 1 has an invalid length. [ 355.892681][ T9823] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1019'. [ 356.298536][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 356.830450][ T9820] bond4: entered promiscuous mode [ 356.850531][ T9820] 8021q: adding VLAN 0 to HW filter on device bond4 [ 356.939585][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 356.968645][ T9823] bond4: entered allmulticast mode [ 357.096473][ T9820] bond4: (slave bridge2): making interface the new active one [ 357.106227][ T9820] bridge2: entered promiscuous mode [ 357.115465][ T9820] bridge2: entered allmulticast mode [ 357.126992][ T9820] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 357.138751][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 357.260122][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 357.404076][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 357.540589][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 357.707730][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 357.725451][ T9842] tipc: Enabled bearer , priority 0 [ 357.766184][ T9842] syzkaller0: entered promiscuous mode [ 357.773055][ T9842] syzkaller0: entered allmulticast mode [ 357.813949][ T9842] tipc: Resetting bearer [ 357.825396][ T9841] tipc: Resetting bearer [ 357.883679][ T9841] tipc: Disabling bearer [ 358.083712][ T5943] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 358.361013][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 358.497290][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 358.497450][ T5943] usb 7-1: Using ep0 maxpacket: 8 [ 358.540818][ T5943] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 358.564097][ T5943] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.584172][ T5943] usb 7-1: Product: syz [ 358.592647][ T5943] usb 7-1: Manufacturer: syz [ 358.637199][ T5943] usb 7-1: SerialNumber: syz [ 358.648841][ T5943] usb 7-1: config 0 descriptor?? [ 358.800698][ T9853] netlink: 'syz.0.1027': attribute type 1 has an invalid length. [ 358.865597][ T5943] usb 7-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 358.911279][ T9853] 8021q: adding VLAN 0 to HW filter on device bond3 [ 358.953539][ T9855] bond3: up delay (35976) is not a multiple of miimon (100), value rounded to 35900 ms [ 358.971427][ T9855] bond3: entered allmulticast mode [ 359.048867][ T9853] bond3: (slave ip6gretap1): Enslaving as an active interface with an up link [ 359.097831][ T9857] syzkaller0: entered promiscuous mode [ 359.103736][ T9857] syzkaller0: entered allmulticast mode [ 359.477164][ T7109] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 359.727167][ T5931] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 359.747377][ T7109] usb 1-1: Using ep0 maxpacket: 32 [ 359.756268][ T7109] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 359.768222][ T7109] usb 1-1: config 0 has no interface number 0 [ 359.786743][ T7109] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 359.810265][ T7109] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 359.826180][ T7109] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.842617][ T7109] usb 1-1: Product: syz [ 359.852147][ T7109] usb 1-1: Manufacturer: syz [ 359.861858][ T7109] usb 1-1: SerialNumber: syz [ 359.881639][ T7109] usb 1-1: config 0 descriptor?? [ 359.887380][ T5931] usb 5-1: Using ep0 maxpacket: 8 [ 359.896932][ T9862] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 359.914962][ T5931] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 359.928066][ T5931] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 359.937662][ T5931] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.946096][ T5931] usb 5-1: Product: syz [ 359.951143][ T5931] usb 5-1: Manufacturer: syz [ 359.956980][ T5931] usb 5-1: SerialNumber: syz [ 359.969376][ T5931] usb 5-1: config 0 descriptor?? [ 359.991358][ T5931] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 360.143257][ T9862] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 360.295065][ T5943] dvb_usb_rtl28xxu 7-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 360.353128][ T5943] usb 7-1: USB disconnect, device number 8 [ 360.455385][ T9877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 360.460169][ T9877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 360.881298][ T6554] net_ratelimit: 18 callbacks suppressed [ 360.881342][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 361.017300][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 361.245841][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 361.403242][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 361.517263][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 361.627254][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 361.737285][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 361.847337][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 361.977730][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 362.159359][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 362.907232][ T7111] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 363.057169][ T7111] usb 2-1: Using ep0 maxpacket: 8 [ 363.087964][ T9900] kAFS: unable to lookup cell 'ÿ' [ 363.161288][ T7111] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 363.176706][ T7111] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 363.192857][ T7111] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 46624, setting to 1024 [ 363.207805][ T7111] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 363.228901][ T7111] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 363.244176][ T7111] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 363.254515][ T7111] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.275311][ T5931] gspca_zc3xx: reg_r err -71 [ 363.280725][ T5931] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 363.309653][ T5931] usb 5-1: USB disconnect, device number 21 [ 363.393769][ T7109] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 363.409502][ T7109] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0088: ffffffb9 [ 363.481115][ T7109] asix 1-1:0.188: probe with driver asix failed with error -71 [ 363.513172][ T7111] usb 2-1: GET_CAPABILITIES returned 0 [ 363.550416][ T7111] usbtmc 2-1:16.0: can't read capabilities [ 363.907507][ T7109] usb 1-1: USB disconnect, device number 19 [ 364.046108][ T9908] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1042'. [ 364.362304][ T9912] 8021q: adding VLAN 0 to HW filter on device bond5 [ 364.379698][ T9912] bond4: (slave bond5): Enslaving as an active interface with an up link [ 364.768465][ T9908] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 364.863876][ T9915] vlan2: entered promiscuous mode [ 364.980596][ T9915] bond4: entered promiscuous mode [ 364.986473][ T9915] bond5: entered promiscuous mode [ 364.994229][ T9915] gretap2: entered promiscuous mode [ 365.200591][ T9925] syzkaller0: entered promiscuous mode [ 365.216790][ T9925] syzkaller0: entered allmulticast mode [ 365.939619][ T6562] net_ratelimit: 23 callbacks suppressed [ 365.939639][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 366.119314][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 366.192997][ T120] usb 2-1: USB disconnect, device number 23 [ 366.278737][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 366.398411][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 366.527129][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 366.677240][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 366.791825][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 366.978824][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 367.255955][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 367.464633][ T13] bond5: (slave macvlan2): failed to get link speed/duplex [ 368.425366][ T7111] usb 7-1: new full-speed USB device number 9 using dummy_hcd [ 368.752502][ T7111] usb 7-1: config 1 interface 0 has no altsetting 0 [ 368.769357][ T7111] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 368.786249][ T7111] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.805329][ T7111] usb 7-1: Product: syz [ 368.825695][ T7111] usb 7-1: Manufacturer: syz [ 368.835859][ T7111] usb 7-1: SerialNumber: syz [ 369.546632][ T7111] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 9 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 369.831247][ T9985] syzkaller0: entered promiscuous mode [ 369.857270][ T9985] syzkaller0: entered allmulticast mode [ 369.945643][ T7111] usb 7-1: USB disconnect, device number 9 [ 369.954858][ T7111] usblp0: removed [ 371.027750][ T1112] net_ratelimit: 22 callbacks suppressed [ 371.027776][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 371.043358][ T1542] IPVS: starting estimator thread 0... [ 371.149351][ T9999] IPVS: sed: FWM 3 0x00000003 - no destination available [ 371.177346][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 371.187748][T10001] IPVS: using max 38 ests per chain, 91200 per kthread [ 371.289895][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 371.497681][ T1093] bond5: (slave macvlan2): failed to get link speed/duplex [ 371.611116][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 371.792813][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 371.917253][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 372.047520][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 372.187448][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 372.218290][ T5931] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 372.427654][ T5931] usb 1-1: config index 0 descriptor too short (expected 28277, got 36) [ 372.471607][ T5931] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 372.541304][ T5931] usb 1-1: config 0 has no interfaces? [ 372.597142][ T5931] usb 1-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 372.638452][ T5931] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.690077][ T5931] usb 1-1: config 0 descriptor?? [ 373.075179][T10024] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 374.097587][T10036] sg_write: data in/out 411065/130 bytes for SCSI command 0x89-- guessing data in; [ 374.097587][T10036] program syz.3.1075 not setting count and/or reply_len properly [ 374.148562][T10037] loop6: detected capacity change from 0 to 2640 [ 374.168516][T10037] Buffer I/O error on dev loop6, logical block 0, async page read [ 374.182535][T10037] Buffer I/O error on dev loop6, logical block 0, async page read [ 374.194612][T10037] Buffer I/O error on dev loop6, logical block 0, async page read [ 374.334413][T10037] Buffer I/O error on dev loop6, logical block 0, async page read [ 374.393931][T10039] kvm: kvm [10038]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x495a [ 374.431638][T10039] kvm_pr_unimpl_wrmsr: 9 callbacks suppressed [ 374.431664][T10039] kvm_intel: kvm [10038]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x100b [ 374.496372][T10037] Buffer I/O error on dev loop6, logical block 0, async page read [ 374.515017][T10039] kvm: kvm [10038]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x5956 [ 374.556201][T10037] Buffer I/O error on dev loop6, logical block 0, async page read [ 374.569739][T10039] kvm: kvm [10038]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x9c5 [ 374.614451][T10039] kvm: kvm [10038]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x61ea [ 374.646951][T10037] Buffer I/O error on dev loop6, logical block 0, async page read [ 374.656960][T10039] kvm: kvm [10038]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x4939 [ 374.682473][T10039] kvm: kvm [10038]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 374.683638][T10037] Buffer I/O error on dev loop6, logical block 0, async page read [ 374.709557][T10039] kvm: kvm [10038]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4a56 [ 374.752088][T10037] ldm_validate_partition_table(): Disk read failed. [ 374.795795][T10039] kvm: kvm [10038]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x10c8 [ 374.821328][T10037] Buffer I/O error on dev loop6, logical block 0, async page read [ 374.853236][T10039] kvm: kvm [10038]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x2262 [ 374.862930][T10039] kvm: kvm [10038]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 374.883810][T10039] kvm_intel: kvm [10038]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x19c2 [ 374.906069][T10037] Buffer I/O error on dev loop6, logical block 0, async page read [ 374.967369][T10037] Dev loop6: unable to read RDB block 0 [ 375.000166][T10037] loop6: unable to read partition table [ 375.055661][T10037] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 375.110040][ T5192] ldm_validate_partition_table(): Disk read failed. [ 375.121495][ T5192] Dev loop6: unable to read RDB block 0 [ 375.127742][ T5192] loop6: unable to read partition table [ 375.529758][ T1542] usb 1-1: USB disconnect, device number 20 [ 375.929064][ T5833] Bluetooth: hci1: command 0x0406 tx timeout [ 376.136267][ T6562] net_ratelimit: 27 callbacks suppressed [ 376.136293][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 376.325049][T10065] syzkaller0: entered promiscuous mode [ 376.331099][T10065] syzkaller0: entered allmulticast mode [ 376.550303][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 376.850208][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 377.020662][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 377.177335][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 377.306628][T10072] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1084'. [ 377.316531][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 377.359749][T10072] macvtap1: entered promiscuous mode [ 377.391055][T10072] bridge0: entered promiscuous mode [ 377.411314][T10072] macvtap1: entered allmulticast mode [ 377.433264][T10072] bridge0: entered allmulticast mode [ 377.473210][T10073] bridge0: left allmulticast mode [ 377.487958][T10073] bridge0: left promiscuous mode [ 377.527351][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 377.647236][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 377.760407][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 378.124322][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 378.946893][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.978034][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.410251][T10109] netlink: 'syz.4.1095': attribute type 27 has an invalid length. [ 380.670880][T10109] bridge0: port 2(bridge_slave_1) entered disabled state [ 380.678440][T10109] bridge0: port 1(bridge_slave_0) entered disabled state [ 380.850298][T10109] vxcan1: left promiscuous mode [ 380.993722][T10119] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 381.260505][T10109] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 381.507325][T10109] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 382.010083][T10109] bond2: left promiscuous mode [ 382.015062][T10109] bond2: left allmulticast mode [ 382.091392][T10109] veth5: left promiscuous mode [ 382.138474][ T1112] net_ratelimit: 6 callbacks suppressed [ 382.138489][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 382.237163][ T63] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 382.246360][ T63] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.305542][ T63] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 382.371764][ T29] audit: type=1326 audit(1772166249.393:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10126 comm="syz.6.1100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 382.444943][ T63] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.517190][ T29] audit: type=1326 audit(1772166249.393:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10126 comm="syz.6.1100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 382.544491][ T63] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 382.593814][ T63] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.624939][ T63] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 382.664366][T10137] netlink: 'syz.0.1102': attribute type 4 has an invalid length. [ 382.679573][ T29] audit: type=1326 audit(1772166249.393:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10126 comm="syz.6.1100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=246 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 382.710665][ T63] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.720349][ T29] audit: type=1326 audit(1772166249.393:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10126 comm="syz.6.1100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 382.746760][ T29] audit: type=1326 audit(1772166249.393:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10126 comm="syz.6.1100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 382.769815][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 382.903968][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 382.935150][ T29] audit: type=1326 audit(1772166249.393:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10126 comm="syz.6.1100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 382.976530][ T29] audit: type=1326 audit(1772166249.393:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10126 comm="syz.6.1100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 382.978364][T10140] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 383.018823][ T29] audit: type=1326 audit(1772166249.393:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10126 comm="syz.6.1100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 383.064619][T10140] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 383.072963][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 383.225815][ T29] audit: type=1326 audit(1772166249.393:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10126 comm="syz.6.1100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 383.283986][ T29] audit: type=1326 audit(1772166249.393:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10126 comm="syz.6.1100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 383.315393][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 383.427220][ T6566] bond5: (slave macvlan2): failed to get link speed/duplex [ 383.555731][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 383.682585][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 383.797205][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 383.807232][ T120] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 383.907620][ T6566] bond5: (slave macvlan2): failed to get link speed/duplex [ 384.163905][ T120] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 384.180354][ T120] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 384.388585][ T120] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 384.605652][ T120] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 384.619526][ T120] usb 7-1: SerialNumber: syz [ 384.860128][ T120] usb 7-1: 0:2 : does not exist [ 384.971071][ T120] usb 7-1: USB disconnect, device number 10 [ 385.144867][ T5843] udevd[5843]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 385.613080][T10170] syzkaller0: entered promiscuous mode [ 385.654848][T10170] syzkaller0: entered allmulticast mode [ 385.718979][T10172] syzkaller0: entered promiscuous mode [ 385.727351][T10172] syzkaller0: entered allmulticast mode [ 386.095827][T10172] tipc: Started in network mode [ 386.125102][T10172] tipc: Node identity 3a9a93a00382, cluster identity 4711 [ 386.154350][T10172] tipc: Enabled bearer , priority 0 [ 386.503072][T10171] tipc: Resetting bearer [ 386.640834][T10171] tipc: Disabling bearer [ 386.834862][T10189] syzkaller0: entered promiscuous mode [ 386.847291][T10189] syzkaller0: entered allmulticast mode [ 387.056035][T10193] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 387.068143][T10193] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 387.183962][ T6562] net_ratelimit: 20 callbacks suppressed [ 387.183986][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 387.345623][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 387.500468][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 387.509193][ T120] usb 1-1: new low-speed USB device number 21 using dummy_hcd [ 387.668406][ T6566] bond5: (slave macvlan2): failed to get link speed/duplex [ 387.740817][ T120] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 387.752649][ T120] usb 1-1: config 0 has no interface number 0 [ 387.760988][ T120] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 387.772968][ T120] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 387.827296][ T6566] bond5: (slave macvlan2): failed to get link speed/duplex [ 387.943781][ T120] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 387.961194][ T120] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 387.974466][ T120] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 387.996436][T10199] syzkaller0: entered promiscuous mode [ 388.002104][T10199] syzkaller0: entered allmulticast mode [ 388.014737][ T120] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 388.031299][ T120] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 388.046237][ T120] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 388.109747][ T120] usb 1-1: config 0 descriptor?? [ 388.129444][T10195] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 388.140303][T10195] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 388.161647][ T120] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 388.270446][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 388.455500][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 388.675435][ T5931] usb 1-1: USB disconnect, device number 21 [ 388.696467][ T5931] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 388.767176][ T5886] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 388.807384][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 388.917334][ T5886] usb 2-1: Using ep0 maxpacket: 32 [ 388.917950][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 388.924884][ T5886] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 388.940084][ T5886] usb 2-1: config 0 has no interface number 0 [ 388.967536][ T5886] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 388.990200][ T5886] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.007851][ T5886] usb 2-1: Product: syz [ 389.058690][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 389.253696][T10221] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 389.513735][ T5886] usb 2-1: Manufacturer: syz [ 389.531870][ T5886] usb 2-1: SerialNumber: syz [ 389.557128][ T5886] usb 2-1: config 0 descriptor?? [ 389.621492][T10226] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1129'. [ 389.882651][T10228] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1129'. [ 390.045508][T10227] syzkaller0: entered promiscuous mode [ 390.073698][ T5886] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 390.080746][T10227] syzkaller0: entered allmulticast mode [ 390.103923][ T5886] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 391.897292][ T5943] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 392.069754][ T5943] usb 7-1: unable to get BOS descriptor or descriptor too short [ 392.147446][ T5943] usb 7-1: New USB device found, idVendor=1235, idProduct=4661, bcdDevice=ae.13 [ 392.181586][ T5943] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 392.236698][ T5943] usb 7-1: Product: syz [ 392.248866][ T5943] usb 7-1: Manufacturer: syz [ 392.263686][ T5943] usb 7-1: SerialNumber: syz [ 392.862066][ T5886] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 392.875200][ T5886] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 392.933100][ T5886] usb 2-1: USB disconnect, device number 24 [ 393.546491][T10266] xt_hashlimit: max too large, truncated to 1048576 [ 393.682163][ T5886] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 393.849013][ T5886] usb 2-1: Using ep0 maxpacket: 32 [ 393.888046][ T5886] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 393.896650][ T5886] usb 2-1: config 0 has no interface number 0 [ 393.939966][ T5886] usb 2-1: config 0 interface 12 has no altsetting 0 [ 393.975601][ T5886] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 394.001717][ T5886] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 394.010744][ T5886] usb 2-1: Product: syz [ 394.031974][ T5886] usb 2-1: Manufacturer: syz [ 394.036665][ T5886] usb 2-1: SerialNumber: syz [ 394.058184][ T5886] usb 2-1: config 0 descriptor?? [ 396.082334][T10250] syzkaller0: entered promiscuous mode [ 396.088202][T10250] syzkaller0: entered allmulticast mode [ 396.097330][ T6554] net_ratelimit: 7 callbacks suppressed [ 396.097350][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 396.161781][T10268] gre1: entered promiscuous mode [ 396.177300][T10268] gre1: entered allmulticast mode [ 396.273293][ T5943] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 396.327225][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 396.344080][ T5943] snd-usb-audio 7-1:8.0: probe with driver snd-usb-audio failed with error -2 [ 396.368010][ T5943] usb 7-1: USB disconnect, device number 11 [ 396.459316][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 396.506781][ T6160] udevd[6160]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:8.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 396.608701][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 396.727189][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 396.907837][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 397.571663][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 397.697399][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 397.807330][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 397.902044][ T5886] f81534 2-1:0.12: f81534_set_register: reg: 1003 data: 58 failed: -71 [ 397.910926][ T5886] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 397.939906][ T5886] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 397.948476][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 397.972080][ T5886] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 397.996865][T10295] syzkaller0: entered promiscuous mode [ 398.015108][T10295] syzkaller0: entered allmulticast mode [ 398.027518][ T5886] usb 2-1: USB disconnect, device number 25 [ 398.330044][T10295] tipc: Enabled bearer , priority 0 [ 398.339323][T10295] tipc: Resetting bearer [ 398.489303][T10295] tipc: Disabling bearer [ 398.969371][T10322] tipc: Failed to remove unknown binding: 66,1,1/0:454041911/454041913 [ 399.307204][ T1210] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 399.557286][ T1210] usb 5-1: Using ep0 maxpacket: 16 [ 399.584545][ T1210] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 129, changing to 11 [ 399.621223][ T1210] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 16 [ 400.419585][T10343] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 400.484848][T10343] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 401.149764][ T6562] net_ratelimit: 21 callbacks suppressed [ 401.149787][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 401.531437][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 401.667226][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 401.787979][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 401.907217][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 402.050499][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 402.197274][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 402.326408][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 402.439678][ T6562] bond5: (slave macvlan2): failed to get link speed/duplex [ 402.577315][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 402.792883][ T1210] usb 5-1: string descriptor 0 read error: -71 [ 402.809611][ T1210] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 402.844856][ T1210] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.023514][ T1210] usb 5-1: rejected 1 configuration due to insufficient available bus power [ 403.023566][T10357] netlink: 'syz.4.1158': attribute type 2 has an invalid length. [ 403.095159][ T1210] usb 5-1: no configuration chosen from 1 choice [ 403.157205][ T1210] usb 5-1: USB disconnect, device number 22 [ 403.241502][T10357] tipc: Cannot configure node identity twice [ 403.925191][T10374] syzkaller0: entered promiscuous mode [ 403.958412][T10374] syzkaller0: entered allmulticast mode [ 404.013817][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 404.013835][ T29] audit: type=1326 audit(1772166271.043:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10376 comm="syz.4.1164" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f871b79c799 code=0x0 [ 404.325323][T10385] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1166'. [ 404.340284][T10385] vlan2: entered promiscuous mode [ 404.352183][T10385] batadv0: entered promiscuous mode [ 404.488444][T10389] geneve2: entered promiscuous mode [ 404.605483][T10393] tipc: Enabled bearer , priority 0 [ 404.705081][T10393] tipc: Resetting bearer [ 405.061715][T10403] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1172'. [ 405.366183][T10413] vlan2: entered promiscuous mode [ 405.407752][T10413] vlan2: entered allmulticast mode [ 405.440394][T10413] hsr_slave_1: entered allmulticast mode [ 406.036760][T10430] netlink: 'syz.1.1178': attribute type 25 has an invalid length. [ 406.046588][T10430] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1178'. [ 406.468468][ T6554] net_ratelimit: 21 callbacks suppressed [ 406.468487][ T6554] bond5: (slave macvlan2): failed to get link speed/duplex [ 406.603189][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 406.759852][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 406.878255][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 407.000967][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 407.117820][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 407.217950][T10441] tipc: Enabled bearer , priority 0 [ 407.282858][T10442] syzkaller0: entered promiscuous mode [ 407.290568][T10442] syzkaller0: entered allmulticast mode [ 407.367130][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 407.417462][ T5886] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 407.874579][T10451] tipc: Resetting bearer [ 407.931816][T10439] tipc: Resetting bearer [ 408.057829][ T5886] usb 1-1: Using ep0 maxpacket: 32 [ 408.085218][ T5886] usb 1-1: config 0 has an invalid interface number: 76 but max is 0 [ 408.109623][ T5886] usb 1-1: config 0 has no interface number 0 [ 408.143006][ T5886] usb 1-1: New USB device found, idVendor=2040, idProduct=d900, bcdDevice=a9.2c [ 408.165215][T10439] tipc: Disabling bearer [ 408.168749][ T5886] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.547247][ T5886] usb 1-1: Product: syz [ 408.598672][ T5886] usb 1-1: Manufacturer: syz [ 408.617670][ T5886] usb 1-1: SerialNumber: syz [ 408.752786][ T7111] tipc: Node number set to 806686927 [ 408.755664][ T5886] usb 1-1: config 0 descriptor?? [ 408.777408][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 408.787896][ T5886] dvb-usb: found a 'Hauppauge MAX S2 or WinTV NOVA HD USB2.0' in warm state. [ 408.796992][ T5886] dw2102: su3000_power_ctrl: 1, initialized 0 [ 408.809284][ T5886] dvb-usb: bulk message failed: -22 (2/0) [ 408.849473][ T5886] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 408.878007][ T5886] dvbdev: DVB: registering new adapter (Hauppauge MAX S2 or WinTV NOVA HD USB2.0) [ 408.907187][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 408.907310][ T5886] usb 1-1: media controller created [ 408.934368][ T5886] dvb-usb: bulk message failed: -22 (6/0) [ 409.021512][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 409.157301][ T5886] dw2102: i2c transfer failed. [ 409.165408][ T5886] dvb-usb: bulk message failed: -22 (6/0) [ 409.174285][ T5886] dw2102: i2c transfer failed. [ 409.237151][ T5886] dvb-usb: bulk message failed: -22 (6/0) [ 409.250145][ T5886] dw2102: i2c transfer failed. [ 409.981458][ T5886] dvb-usb: bulk message failed: -22 (6/0) [ 409.988764][ T5886] dw2102: i2c transfer failed. [ 409.997173][ T5886] dvb-usb: bulk message failed: -22 (6/0) [ 410.003033][ T5886] dw2102: i2c transfer failed. [ 410.008792][ T5886] dvb-usb: bulk message failed: -22 (6/0) [ 410.015700][ T5886] dw2102: i2c transfer failed. [ 410.030915][ T5886] dvb-usb: MAC address: 02:02:02:02:02:02 [ 410.066932][ T5886] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 410.858036][ T5886] dvb-usb: bulk message failed: -22 (3/0) [ 410.864438][ T5886] dw2102: command 0x0e transfer failed. [ 410.980340][ T5886] dvb-usb: bulk message failed: -22 (3/0) [ 411.016667][ T5886] dw2102: command 0x0e transfer failed. [ 411.252664][T10480] netlink: 'syz.4.1190': attribute type 4 has an invalid length. [ 411.271296][T10480] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1190'. [ 411.337323][ T5886] dvb-usb: bulk message failed: -22 (3/0) [ 411.565777][ T5886] dw2102: command 0x0e transfer failed. [ 411.572316][ T5886] dvb-usb: bulk message failed: -22 (3/0) [ 411.578496][ T5886] dw2102: command 0x0e transfer failed. [ 411.584108][ T5886] dvb-usb: bulk message failed: -22 (1/0) [ 411.597146][ T5886] dw2102: command 0x51 transfer failed. [ 411.603872][ T1112] net_ratelimit: 13 callbacks suppressed [ 411.603890][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 411.908252][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 412.049406][ T5886] DVB: Unable to find symbol ds3000_attach() [ 412.055950][ T5886] dvb-usb: no frontend was attached by 'Hauppauge MAX S2 or WinTV NOVA HD USB2.0' [ 412.079535][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 412.257794][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 412.378218][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 412.467206][ T5886] rc_core: IR keymap rc-su3000 not found [ 412.472959][ T5886] Registered IR keymap rc-empty [ 412.486970][ T5886] rc rc0: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 412.511112][ T6566] bond5: (slave macvlan2): failed to get link speed/duplex [ 412.529080][ T5886] input: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input24 [ 412.628866][ T5886] dvb-usb: schedule remote query interval to 150 msecs. [ 412.646565][ T5886] dw2102: su3000_power_ctrl: 0, initialized 1 [ 412.663450][ T5886] dvb-usb: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 successfully initialized and connected. [ 412.759182][ T5943] IPVS: starting estimator thread 0... [ 412.768214][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 412.783586][ T5886] usb 1-1: USB disconnect, device number 22 [ 412.869293][T10499] netlink: 'syz.3.1193': attribute type 13 has an invalid length. [ 412.877160][T10498] IPVS: using max 45 ests per chain, 108000 per kthread [ 412.877869][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 412.894235][ T5886] dvb-usb: Hauppauge MAX S2 or WinTV NOVA HD USB2. successfully deinitialized and disconnected. [ 413.227366][ T5886] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 413.295237][T10504] tipc: Enabling of bearer rejected, already enabled [ 413.337884][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 413.453163][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 413.513953][ T5886] usb 1-1: config 0 has no interfaces? [ 413.527776][ T5886] usb 1-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 413.587464][ T5886] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 413.603543][ T5886] usb 1-1: config 0 descriptor?? [ 413.752560][T10514] netlink: 324 bytes leftover after parsing attributes in process `syz.4.1198'. [ 414.635291][T10522] netlink: 'syz.1.1201': attribute type 1 has an invalid length. [ 415.377872][ T120] usb 1-1: USB disconnect, device number 23 [ 416.633574][T10543] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 416.668555][T10543] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 416.698935][T10545] netlink: 'syz.1.1209': attribute type 1 has an invalid length. [ 416.721112][ T5352] null_blk: rq ffff8880277c0000 timed out [ 416.730037][ T5352] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 1 prio class 2 [ 416.741829][ T5352] null_blk: rq ffff8880277c0180 timed out [ 416.748167][ T5352] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 1 prio class 2 [ 416.750636][ T6566] net_ratelimit: 18 callbacks suppressed [ 416.750656][ T6566] bond5: (slave macvlan2): failed to get link speed/duplex [ 416.758991][ T5352] null_blk: rq ffff8880277c0300 timed out [ 416.787213][ T5352] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 1 prio class 2 [ 416.798324][ T5352] null_blk: rq ffff8880277c0480 timed out [ 416.804355][ T5352] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 1 prio class 2 [ 416.804772][T10541] tipc: Enabled bearer , priority 0 [ 416.815360][ T5352] null_blk: rq ffff8880277c0600 timed out [ 416.815390][ T5352] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 1 prio class 2 [ 416.815418][ T5352] null_blk: rq ffff8880277c0780 timed out [ 416.815429][ T5352] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 1 prio class 2 [ 416.815456][ T5352] null_blk: rq ffff8880277c0900 timed out [ 416.815468][ T5352] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 1 prio class 2 [ 416.815494][ T5352] null_blk: rq ffff8880277c0a80 timed out [ 416.815505][ T5352] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 1 prio class 2 [ 416.815531][ T5352] null_blk: rq ffff8880277c0c00 timed out [ 416.815542][ T5352] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 1 prio class 2 [ 416.815567][ T5352] null_blk: rq ffff8880277c0d80 timed out [ 416.815578][ T5352] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 1 prio class 2 [ 416.815604][ T5352] null_blk: rq ffff8880277c0f00 timed out [ 416.815621][ T5352] null_blk: rq ffff8880277c1080 timed out [ 416.815648][ T5352] null_blk: rq ffff8880277c1200 timed out [ 416.947209][ T5352] null_blk: rq ffff8880277c1380 timed out [ 416.953098][ T5352] null_blk: rq ffff8880277c1500 timed out [ 416.962530][ T5352] null_blk: rq ffff8880277c1680 timed out [ 416.968626][ T5352] null_blk: rq ffff8880277c1800 timed out [ 416.974579][ T5352] null_blk: rq ffff8880277c1980 timed out [ 416.981226][ T5352] null_blk: rq ffff8880277c1b00 timed out [ 416.987431][ T5352] null_blk: rq ffff8880277c1c80 timed out [ 416.993209][ T5352] null_blk: rq ffff8880277c1e00 timed out [ 416.999433][ T5352] null_blk: rq ffff8880277c1f80 timed out [ 417.005506][ T5352] null_blk: rq ffff8880277c2100 timed out [ 417.012073][ T5352] null_blk: rq ffff8880277c2280 timed out [ 417.018340][ T5352] null_blk: rq ffff8880277c2400 timed out [ 417.024843][ T5352] null_blk: rq ffff8880277c2580 timed out [ 417.037303][ T5352] null_blk: rq ffff8880277c2700 timed out [ 417.047419][ T5352] null_blk: rq ffff8880277c2880 timed out [ 417.053857][ T5352] null_blk: rq ffff8880277c2a00 timed out [ 417.059812][ T5352] null_blk: rq ffff8880277c2b80 timed out [ 417.065671][ T5352] null_blk: rq ffff8880277c2d00 timed out [ 417.071891][ T5352] null_blk: rq ffff8880277c2e80 timed out [ 417.077267][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 417.077831][ T5352] null_blk: rq ffff8880277c3000 timed out [ 417.091105][ T5352] null_blk: rq ffff8880277c3180 timed out [ 417.097353][ T5352] null_blk: rq ffff8880277c3300 timed out [ 417.103384][ T5352] null_blk: rq ffff8880277c3480 timed out [ 417.109437][ T5352] null_blk: rq ffff8880277c3600 timed out [ 417.115406][ T5352] null_blk: rq ffff8880277c3780 timed out [ 417.121364][ T5352] null_blk: rq ffff8880277c3900 timed out [ 417.127197][ T5352] null_blk: rq ffff8880277c3a80 timed out [ 417.133058][ T5352] null_blk: rq ffff8880277c3c00 timed out [ 417.139080][ T5352] null_blk: rq ffff8880277c3d80 timed out [ 417.144845][ T5352] null_blk: rq ffff8880277c3f00 timed out [ 417.151356][ T5352] null_blk: rq ffff8880277c4080 timed out [ 417.157996][ T5352] null_blk: rq ffff8880277c4200 timed out [ 417.163898][ T5352] null_blk: rq ffff8880277c4380 timed out [ 417.169829][ T5352] null_blk: rq ffff8880277c4500 timed out [ 417.175694][ T5352] null_blk: rq ffff8880277c4680 timed out [ 417.181603][ T5352] null_blk: rq ffff8880277c4800 timed out [ 417.187586][ T5352] null_blk: rq ffff8880277c4980 timed out [ 417.193482][ T5352] null_blk: rq ffff8880277c4b00 timed out [ 417.199394][ T5352] null_blk: rq ffff8880277c4c80 timed out [ 417.205265][ T5352] null_blk: rq ffff8880277c4e00 timed out [ 417.211202][ T5352] null_blk: rq ffff8880277c4f80 timed out [ 417.212612][T10542] syzkaller0: entered promiscuous mode [ 417.217163][ T5352] null_blk: rq ffff8880277c5100 timed out [ 417.217191][ T5352] null_blk: rq ffff8880277c5280 timed out [ 417.217208][ T5352] null_blk: rq ffff8880277c5400 timed out [ 417.217224][ T5352] null_blk: rq ffff8880277c5580 timed out [ 417.217239][ T5352] null_blk: rq ffff8880277c5700 timed out [ 417.217255][ T5352] null_blk: rq ffff8880277c5880 timed out [ 417.217270][ T5352] null_blk: rq ffff8880277c5a00 timed out [ 417.217285][ T5352] null_blk: rq ffff8880277c5b80 timed out [ 417.217301][ T5352] null_blk: rq ffff8880277c5d00 timed out [ 417.217315][ T5352] null_blk: rq ffff8880277c5e80 timed out [ 417.377249][T10542] syzkaller0: entered allmulticast mode [ 417.397332][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 417.548896][T10541] tipc: Resetting bearer [ 417.609189][T10549] sit1: entered allmulticast mode [ 417.651801][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 417.676983][T10540] tipc: Resetting bearer [ 417.714408][T10540] tipc: Disabling bearer [ 417.778986][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 417.827555][ T1210] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 417.887212][ T6566] bond5: (slave macvlan2): failed to get link speed/duplex [ 417.977361][ T1210] usb 1-1: Using ep0 maxpacket: 32 [ 417.984140][ T1210] usb 1-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 417.984176][ T1210] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 417.987389][ T1210] usb 1-1: config 0 descriptor?? [ 418.019830][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 418.127275][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 418.176906][T10558] syzkaller0: entered promiscuous mode [ 418.176942][T10558] syzkaller0: entered allmulticast mode [ 418.195428][T10552] netlink: 'syz.0.1211': attribute type 7 has an invalid length. [ 418.348622][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 418.396837][T10552] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 418.435904][ T1210] usbhid 1-1:0.0: can't add hid device: -71 [ 418.436029][ T1210] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 418.445666][ T1210] usb 1-1: USB disconnect, device number 24 [ 418.462914][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 418.584870][T10567] syzkaller0: entered promiscuous mode [ 418.584890][T10567] syzkaller0: entered allmulticast mode [ 418.819047][T10569] tipc: Enabled bearer , priority 0 [ 418.840891][T10571] tipc: Enabled bearer , priority 0 [ 418.858940][T10569] syzkaller0: entered promiscuous mode [ 418.869214][T10569] syzkaller0: entered allmulticast mode [ 418.884000][T10571] syzkaller0: entered promiscuous mode [ 418.927443][T10571] syzkaller0: entered allmulticast mode [ 419.045518][T10569] tipc: Resetting bearer [ 419.064702][T10568] tipc: Resetting bearer [ 419.094464][T10568] tipc: Disabling bearer [ 419.123680][T10571] tipc: Resetting bearer [ 419.138032][T10570] tipc: Resetting bearer [ 419.240220][T10570] tipc: Disabling bearer [ 420.732526][T10598] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1225'. [ 421.075390][T10607] tipc: Enabled bearer , priority 0 [ 421.104509][T10607] syzkaller0: entered promiscuous mode [ 421.118104][T10607] syzkaller0: entered allmulticast mode [ 421.206550][T10610] tipc: Resetting bearer [ 421.247276][ T5886] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 421.265496][T10604] tipc: Resetting bearer [ 421.362849][T10604] tipc: Disabling bearer [ 421.413991][ T5886] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 421.437247][ T5886] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 421.460314][ T5886] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 421.466987][T10616] tipc: Enabled bearer , priority 0 [ 421.487742][T10612] syzkaller0: entered promiscuous mode [ 421.493389][T10612] syzkaller0: entered allmulticast mode [ 421.495121][ T5886] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 421.537134][ T5886] usb 5-1: Manufacturer: syz [ 421.555638][ T5886] usb 5-1: config 0 descriptor?? [ 421.607451][T10618] lo: Caught tx_queue_len zero misconfig [ 421.614660][T10612] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1230'. [ 421.649560][T10612] tipc: Resetting bearer [ 421.677760][T10611] tipc: Resetting bearer [ 421.726124][T10611] tipc: Disabling bearer [ 421.767220][ T33] net_ratelimit: 19 callbacks suppressed [ 421.767247][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 421.837244][ T7109] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 421.907213][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 421.998169][ T5886] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 422.011923][ T5886] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 422.031503][ T5886] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 422.049284][ T5886] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 422.059399][ T5886] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 422.070825][ T5886] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 422.087261][ T7109] usb 1-1: Using ep0 maxpacket: 16 [ 422.105463][ T7109] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 422.118047][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 422.126234][ T7109] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 422.144609][ T7109] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 422.150855][ T5886] pyra 0003:1E7D:2CF6.0009: unknown main item tag 0x0 [ 422.170389][ T5886] pyra 0003:1E7D:2CF6.0009: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 422.171591][ T7109] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.227966][ T7109] usb 1-1: Product: syz [ 422.237849][ T7109] usb 1-1: Manufacturer: syz [ 422.245087][ T7109] usb 1-1: SerialNumber: syz [ 422.257897][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 422.407373][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 422.467562][ T5931] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 422.490071][ T7109] usb 1-1: 0:2 : does not exist [ 422.523241][ T7109] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 422.538094][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 422.675076][ T7109] usb 1-1: USB disconnect, device number 25 [ 422.687269][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 422.701461][ T5931] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 422.711104][ T5931] usb 7-1: config 0 has no interface number 0 [ 422.728702][ T5931] usb 7-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 422.742920][T10639] tipc: Enabled bearer , priority 0 [ 422.751021][T10639] syzkaller0: entered promiscuous mode [ 422.755001][ T6160] udevd[6160]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 422.756650][T10639] syzkaller0: entered allmulticast mode [ 422.780763][ T5931] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.807286][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 422.814863][ T5931] usb 7-1: Product: syz [ 422.829899][ T5931] usb 7-1: Manufacturer: syz [ 422.836583][ T5931] usb 7-1: SerialNumber: syz [ 422.871231][ T5931] usb 7-1: config 0 descriptor?? [ 422.879883][T10639] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1239'. [ 422.893865][T10639] tipc: Resetting bearer [ 422.906882][T10638] tipc: Resetting bearer [ 422.930913][T10638] tipc: Disabling bearer [ 422.952813][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 423.042842][T10645] syzkaller0: entered promiscuous mode [ 423.048918][T10645] syzkaller0: entered allmulticast mode [ 423.106324][ T5931] usb 7-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 423.133309][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 423.145881][ T5931] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 423.307682][T10649] binder: BINDER_SET_CONTEXT_MGR already set [ 423.314004][T10649] binder: 10648:10649 ioctl 4018620d 200000000100 returned -16 [ 423.326247][ T5931] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 423.345983][T10649] binder: BINDER_SET_CONTEXT_MGR already set [ 423.400436][ T5931] usb 7-1: media controller created [ 423.408541][T10649] binder: 10648:10649 ioctl 4018620d 200000004a80 returned -16 [ 423.462774][ T5931] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 423.566964][ T5931] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 423.680318][ T5886] pyra 0003:1E7D:2CF6.0009: couldn't init struct pyra_device [ 423.691679][ T5886] pyra 0003:1E7D:2CF6.0009: couldn't install mouse [ 423.713949][ T5886] pyra 0003:1E7D:2CF6.0009: probe with driver pyra failed with error -71 [ 423.732259][ T5931] usb 7-1: USB disconnect, device number 12 [ 423.804228][ T5886] usb 5-1: USB disconnect, device number 23 [ 424.122082][T10658] fido_id[10658]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 424.582118][T10675] Cannot find add_set index 0 as target [ 425.008048][T10684] tipc: Enabling of bearer rejected, already enabled [ 426.205182][T10697] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1254'. [ 426.453681][T10702] tipc: Enabled bearer , priority 0 [ 426.497542][T10702] syzkaller0: entered promiscuous mode [ 426.503163][T10702] syzkaller0: entered allmulticast mode [ 426.509055][ T5886] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 426.572444][T10702] tipc: Resetting bearer [ 426.583296][T10701] tipc: Resetting bearer [ 426.613228][T10701] tipc: Disabling bearer [ 426.697208][ T5886] usb 7-1: Using ep0 maxpacket: 32 [ 426.705779][ T5886] usb 7-1: config 0 has an invalid interface number: 132 but max is 0 [ 426.714928][ T5886] usb 7-1: config 0 has no interface number 0 [ 426.723324][ T5886] usb 7-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 426.738845][ T5886] usb 7-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 426.748891][ T5886] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.757230][ T5931] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 426.765999][ T5886] usb 7-1: Product: syz [ 426.773470][ T5886] usb 7-1: Manufacturer: syz [ 426.781441][ T5886] usb 7-1: SerialNumber: syz [ 426.857803][ T1112] net_ratelimit: 25 callbacks suppressed [ 426.857826][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 426.873578][ T5886] usb 7-1: config 0 descriptor?? [ 426.902607][ T5886] em28xx 7-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 426.916268][ T5886] em28xx 7-1:0.132: Video interface 132 found: [ 426.923324][ T5931] usb 5-1: Using ep0 maxpacket: 16 [ 426.931865][ T5931] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 426.985375][ T5931] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 427.006741][ T5931] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 427.018159][ T5931] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.026599][ T5931] usb 5-1: Product: syz [ 427.031652][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 427.035400][ T5931] usb 5-1: Manufacturer: syz [ 427.061009][ T5931] usb 5-1: SerialNumber: syz [ 427.068674][ T5931] usb 5-1: config 0 descriptor?? [ 427.082176][ T5931] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 427.092529][ T5931] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 427.169982][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 427.287242][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 427.306137][ T5886] em28xx 7-1:0.132: chip ID is em2765 [ 427.397960][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 427.485910][T10721] tipc: Enabled bearer , priority 0 [ 427.495329][T10721] syzkaller0: entered promiscuous mode [ 427.498041][T10722] binder: 10718:10722 ioctl c0306201 200000000180 returned -14 [ 427.515204][T10721] syzkaller0: entered allmulticast mode [ 427.532867][T10721] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 427.609893][T10721] tipc: Resetting bearer [ 427.628774][T10720] tipc: Resetting bearer [ 427.689778][ T5931] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 427.698795][ T5931] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 427.709129][T10720] tipc: Disabling bearer [ 427.737380][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 427.847165][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 427.882638][ T29] audit: type=1326 audit(1772166294.903:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10724 comm="syz.1.1266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d999c799 code=0x7ffc0000 [ 427.922872][T10731] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 427.933306][T10731] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.037394][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 428.077209][ T29] audit: type=1326 audit(1772166294.903:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10724 comm="syz.1.1266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7f79d999c799 code=0x7ffc0000 [ 428.115987][ T29] audit: type=1326 audit(1772166294.903:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10724 comm="syz.1.1266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d999c799 code=0x7ffc0000 [ 428.177234][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 428.294764][ T29] audit: type=1326 audit(1772166294.903:273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10724 comm="syz.1.1266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f79d999c799 code=0x7ffc0000 [ 428.327311][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 428.412792][T10736] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.432934][T10736] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.452323][ T29] audit: type=1326 audit(1772166294.903:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10724 comm="syz.1.1266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d999c799 code=0x7ffc0000 [ 428.515064][ T5931] em28xx 5-1:0.0: Unknown AC97 audio processor detected! [ 428.639329][ T5886] em28xx 7-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 428.654250][ T5886] em28xx 7-1:0.132: board has no eeprom [ 428.668932][ T29] audit: type=1326 audit(1772166294.903:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10724 comm="syz.1.1266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f79d999c799 code=0x7ffc0000 [ 428.706539][ T5931] em28xx 5-1:0.0: couldn't setup AC97 register 2 [ 428.716039][ T5931] em28xx 5-1:0.0: couldn't setup AC97 register 4 [ 428.724362][ T5931] em28xx 5-1:0.0: couldn't setup AC97 register 6 [ 428.731972][ T5931] em28xx 5-1:0.0: couldn't setup AC97 register 54 [ 428.741376][ T5931] em28xx 5-1:0.0: couldn't setup AC97 register 56 [ 428.871493][ T5886] em28xx 7-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 428.892891][ T5886] em28xx 7-1:0.132: analog set to bulk mode. [ 428.901587][ T29] audit: type=1326 audit(1772166294.903:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10724 comm="syz.1.1266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d999c799 code=0x7ffc0000 [ 428.950576][ T9] em28xx 7-1:0.132: Registering V4L2 extension [ 428.976321][ T5886] usb 7-1: USB disconnect, device number 13 [ 428.993904][ T29] audit: type=1326 audit(1772166294.903:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10724 comm="syz.1.1266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f79d999c799 code=0x7ffc0000 [ 429.052434][ T5886] em28xx 7-1:0.132: Disconnecting em28xx [ 429.159910][ T29] audit: type=1326 audit(1772166294.903:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10724 comm="syz.1.1266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d999c799 code=0x7ffc0000 [ 429.223964][ T29] audit: type=1326 audit(1772166294.913:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10724 comm="syz.1.1266" exe="/root/syz-executor" sig=0 arch=c000003e syscall=29 compat=0 ip=0x7f79d999c799 code=0x7ffc0000 [ 429.373889][ T5931] em28xx 5-1:0.0: couldn't setup AC97 register 2 [ 429.409547][ T5931] em28xx 5-1:0.0: couldn't setup AC97 register 4 [ 429.430291][ T5931] em28xx 5-1:0.0: couldn't setup AC97 register 6 [ 429.466959][ T5931] em28xx 5-1:0.0: couldn't setup AC97 register 54 [ 429.480955][ T5931] em28xx 5-1:0.0: couldn't setup AC97 register 56 [ 429.535129][ T5931] usb 5-1: USB disconnect, device number 24 [ 429.549687][ T9] em28xx 7-1:0.132: Config register raw data: 0xffffffed [ 429.557180][ T9] em28xx 7-1:0.132: AC97 chip type couldn't be determined [ 429.568986][ T9] em28xx 7-1:0.132: No AC97 audio processor [ 429.587876][ T9] videodev: could not get a free minor [ 429.604611][ T9] em28xx 7-1:0.132: unable to register video device (error=-23). [ 429.635017][ T9] em28xx 7-1:0.132: Remote control support is not available for this card. [ 429.685787][ T5886] em28xx 7-1:0.132: Closing input extension [ 429.718272][ T5886] em28xx 7-1:0.132: Freeing device [ 431.014013][T10762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 431.056509][T10762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 431.454583][T10762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 431.469725][T10762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 431.638521][ T1210] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 431.720614][T10772] syzkaller0: entered promiscuous mode [ 431.757391][T10772] syzkaller0: entered allmulticast mode [ 431.841882][ T1210] usb 1-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 431.861720][ T1210] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.896535][ T1210] usb 1-1: config 0 descriptor?? [ 431.910917][ T1210] gspca_main: spca508-2.14.0 probing 8086:0110 [ 432.177250][ T5931] usb 5-1: new full-speed USB device number 25 using dummy_hcd [ 432.197120][ T63] net_ratelimit: 26 callbacks suppressed [ 432.197145][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 432.228587][T10783] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1278'. [ 432.397223][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 432.415782][ T5931] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 432.444975][ T5931] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 432.554083][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 432.599120][ T5931] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 432.617794][ T5931] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 432.643595][ T1210] gspca_spca508: reg_read err -110 [ 432.657563][ T5931] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 432.677232][ T5931] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 432.690862][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 432.690918][ T1210] gspca_spca508: reg_read err -32 [ 432.735998][ T1210] gspca_spca508: reg_read err -32 [ 432.743124][ T5931] usb 5-1: New USB device found, idVendor=0451, idProduct=5152, bcdDevice=c0.b9 [ 432.764908][ T1210] gspca_spca508: reg_read err -32 [ 432.770714][ T5931] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.793050][ T5931] usb 5-1: Product: syz [ 432.813212][ T5931] usb 5-1: Manufacturer: syz [ 432.818779][ T6566] bond5: (slave macvlan2): failed to get link speed/duplex [ 432.829873][ T1210] gspca_spca508: reg write: error -32 [ 432.830925][ T5931] usb 5-1: SerialNumber: syz [ 432.835945][ T1210] spca508 1-1:0.0: probe with driver spca508 failed with error -32 [ 433.078648][ T5931] usb 5-1: config 0 descriptor?? [ 433.086636][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 433.113059][ T5931] ti_usb_3410_5052 5-1:0.0: required endpoints missing [ 433.173137][ T1210] usb 1-1: USB disconnect, device number 26 [ 433.210252][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 433.387241][ T6566] bond5: (slave macvlan2): failed to get link speed/duplex [ 433.527696][ T6566] bond5: (slave macvlan2): failed to get link speed/duplex [ 433.644908][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 434.305970][T10802] netlink: 'syz.0.1283': attribute type 1 has an invalid length. [ 434.344177][T10802] netlink: 'syz.0.1283': attribute type 1 has an invalid length. [ 434.646558][T10806] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 435.784070][ T7109] usb 5-1: USB disconnect, device number 25 [ 436.757180][ T120] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 436.809569][T10825] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.874784][T10825] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.949620][ T120] usb 5-1: config 7 has an invalid interface number: 101 but max is 0 [ 436.958472][ T120] usb 5-1: config 7 has no interface number 0 [ 436.971786][ T120] usb 5-1: New USB device found, idVendor=0fd9, idProduct=002c, bcdDevice= 6.6b [ 437.001993][ T120] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.037240][ T120] usb 5-1: Product: syz [ 437.041659][ T120] usb 5-1: Manufacturer: syz [ 437.065107][ T120] usb 5-1: SerialNumber: syz [ 437.262607][ T33] net_ratelimit: 21 callbacks suppressed [ 437.262648][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 437.305090][T10830] tipc: Enabled bearer , priority 0 [ 437.331877][T10830] syzkaller0: entered promiscuous mode [ 437.358509][T10830] syzkaller0: entered allmulticast mode [ 437.407226][ T33] bond5: (slave macvlan2): failed to get link speed/duplex [ 437.474802][T10830] tipc: Resetting bearer [ 437.495074][T10829] tipc: Resetting bearer [ 437.532397][T10829] tipc: Disabling bearer [ 437.557452][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 437.668963][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 437.901348][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 438.083597][ T120] as10x_usb: device has been detected [ 438.105108][ T120] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT Deluxe) [ 438.123209][ T1112] bond5: (slave macvlan2): failed to get link speed/duplex [ 438.284442][T10841] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1289'. [ 438.318811][ T120] usb 5-1: DVB: registering adapter 1 frontend 0 (Elgato EyeTV DTT Deluxe)... [ 438.356813][T10848] syzkaller0: entered promiscuous mode [ 438.362442][T10848] syzkaller0: entered allmulticast mode [ 438.375774][ T120] as10x_usb: error during firmware upload part1 [ 438.383664][T10848] 0: reclassify loop, rule prio 0, protocol 800 [ 438.391920][ T120] Registered device Elgato EyeTV DTT Deluxe [ 438.398268][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 438.419003][ T120] usb 5-1: USB disconnect, device number 26 [ 438.492462][T10845] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1293'. [ 438.577517][ T6564] bond5: (slave macvlan2): failed to get link speed/duplex [ 438.622653][ T120] Unregistered device Elgato EyeTV DTT Deluxe [ 438.627767][ T120] as10x_usb: device has been disconnected [ 438.928196][T10855] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1297'. [ 439.023096][ T63] bond5: (slave macvlan2): failed to get link speed/duplex [ 439.052443][T10855] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 439.105118][T10855] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 439.695916][T10873] netlink: 'syz.6.1301': attribute type 5 has an invalid length. [ 440.435353][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.447351][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.749878][T10874] mac80211_hwsim hwsim9 wlan1: left promiscuous mode [ 441.267425][T10874] tipc: Resetting bearer [ 441.521079][T10873] ip6erspan0: entered promiscuous mode [ 441.593714][ T1112] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 441.630642][ T1112] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 441.670148][ T1112] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 441.845111][T10891] syzkaller0: entered promiscuous mode [ 441.860521][T10891] syzkaller0: entered allmulticast mode [ 443.782584][T10918] binder: BINDER_SET_CONTEXT_MGR already set [ 443.792852][T10918] binder: 10917:10918 ioctl 4018620d 200000000100 returned -16 [ 443.850495][T10918] binder: BINDER_SET_CONTEXT_MGR already set [ 443.856758][T10918] binder: 10917:10918 ioctl 4018620d 200000004a80 returned -16 [ 445.747304][T10911] tipc: Enabling of bearer rejected, failed to enable media [ 445.791615][T10935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 445.805943][T10935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 445.833317][T10931] tipc: Resetting bearer [ 446.767128][ T9] usb 7-1: new full-speed USB device number 14 using dummy_hcd [ 446.823027][ T29] kauditd_printk_skb: 10 callbacks suppressed [ 446.823058][ T29] audit: type=1804 audit(1772166313.783:290): pid=10949 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1318" name="bus" dev="ramfs" ino=43804 res=1 errno=0 [ 446.971177][ T9] usb 7-1: config 0 has an invalid interface number: 52 but max is 0 [ 446.990147][ T9] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 447.507157][ T9] usb 7-1: config 0 has no interface number 0 [ 447.513927][ T9] usb 7-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 447.525626][ T9] usb 7-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid wMaxPacketSize 0 [ 447.537653][ T9] usb 7-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 447.552125][ T9] usb 7-1: config 0 interface 52 has no altsetting 0 [ 447.636970][ T9] usb 7-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 447.649871][ T9] usb 7-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 447.659323][ T9] usb 7-1: Manufacturer: syz [ 447.674561][ T9] usb 7-1: config 0 descriptor?? [ 447.989671][T10940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 448.007848][T10940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 448.054842][ T9] synaptics_usb 7-1:0.52: synusb_open - usb_submit_urb failed, error: -90 [ 448.098823][ T9] synaptics_usb 7-1:0.52: probe with driver synaptics_usb failed with error -5 [ 448.147092][ T120] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 448.172616][T10960] tipc: Enabling of bearer rejected, already enabled [ 448.307154][ T120] usb 1-1: Using ep0 maxpacket: 32 [ 448.319738][ T120] usb 1-1: config 0 has no interfaces? [ 448.335208][ T120] usb 1-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 448.353623][ T120] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.444290][ T120] usb 1-1: Product: syz [ 448.461412][ T120] usb 1-1: Manufacturer: syz [ 448.466076][ T120] usb 1-1: SerialNumber: syz [ 448.475985][T10962] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 448.533436][ T120] usb 1-1: config 0 descriptor?? [ 448.545215][ T5906] usb 7-1: USB disconnect, device number 14 [ 449.131696][ T9] usb 1-1: USB disconnect, device number 27 [ 449.773861][ T5937] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 449.820877][ T5937] hid-generic 0000:0000:0000.000A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 450.018675][ T5937] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 450.243864][ T5937] usb 1-1: config 0 has no interfaces? [ 450.253783][ T5937] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 450.431340][ T5937] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 450.463945][ T5937] usb 1-1: SerialNumber: syz [ 450.514022][ T5937] usb 1-1: config 0 descriptor?? [ 450.814083][T10996] tipc: Failed to remove unknown binding: 66,1,1/0:170497902/170497904 [ 450.823248][T10996] tipc: Failed to remove unknown binding: 66,1,1/0:170497902/170497904 [ 451.025362][ T5937] usb 1-1: USB disconnect, device number 28 [ 454.957990][ T5906] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 455.267804][ T5906] usb 5-1: Using ep0 maxpacket: 32 [ 455.282751][ T5906] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 455.325670][T11052] IPVS: length: 255 != 792 [ 455.344283][ T5906] usb 5-1: config 0 has no interfaces? [ 455.374110][ T5906] usb 5-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 455.427117][ T5906] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 455.575723][ T5906] usb 5-1: Product: syz [ 455.627311][ T5906] usb 5-1: Manufacturer: syz [ 455.632148][ T5906] usb 5-1: SerialNumber: syz [ 455.678746][ T5906] usb 5-1: config 0 descriptor?? [ 456.040618][ T5937] usb 5-1: USB disconnect, device number 27 [ 456.718996][T11064] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 457.623778][T11078] kvm_pr_unimpl_wrmsr: 6 callbacks suppressed [ 457.623800][T11078] kvm: kvm [11077]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x0 [ 457.701594][T11078] kvm: kvm [11077]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 457.763864][T11078] kvm: kvm [11077]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x20 [ 457.805574][T11078] kvm: kvm [11077]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x20 [ 457.830161][T11078] kvm: kvm [11077]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x0 [ 457.840212][T11078] kvm: kvm [11077]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 457.862279][T11078] kvm: kvm [11077]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x0 [ 457.873437][T11078] kvm: kvm [11077]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 457.888029][T11078] kvm: kvm [11077]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x0 [ 457.899559][T11078] kvm: kvm [11077]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 458.030913][T11091] tipc: Enabling of bearer rejected, already enabled [ 458.217247][ C1] net_ratelimit: 4 callbacks suppressed [ 458.217269][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 458.391126][ T29] audit: type=1326 audit(1772166325.393:291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.6.1359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 458.523891][ T29] audit: type=1326 audit(1772166325.403:292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.6.1359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 458.627232][ T120] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 458.641575][T11100] syzkaller0: entered promiscuous mode [ 458.649589][T11100] syzkaller0: entered allmulticast mode [ 458.680471][ T29] audit: type=1326 audit(1772166325.403:293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.6.1359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 458.848860][ T29] audit: type=1326 audit(1772166325.403:294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.6.1359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 458.944357][ T120] usb 2-1: config 0 has no interfaces? [ 458.957395][ T120] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 458.968574][ T29] audit: type=1326 audit(1772166325.403:295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.6.1359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 458.998197][ T120] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.013880][ T120] usb 2-1: Product: syz [ 459.038381][ T120] usb 2-1: Manufacturer: syz [ 459.044901][ T29] audit: type=1326 audit(1772166325.403:296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.6.1359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 459.067793][ T120] usb 2-1: SerialNumber: syz [ 459.076423][ T120] usb 2-1: config 0 descriptor?? [ 459.115999][ T29] audit: type=1326 audit(1772166325.403:297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.6.1359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 459.360057][T11094] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 459.372202][T11094] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.387107][ T29] audit: type=1326 audit(1772166325.403:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.6.1359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa959f9c799 code=0x7ffc0000 [ 459.395922][T11094] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 459.490984][ T29] audit: type=1326 audit(1772166325.403:299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.6.1359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa959f9e007 code=0x7ffc0000 [ 459.518138][T11094] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.613903][ T29] audit: type=1326 audit(1772166325.403:300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.6.1359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7fa959f5cfce code=0x7ffc0000 [ 459.846340][T11115] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1364'. [ 459.883462][T11094] vlan3: entered promiscuous mode [ 459.921172][T11120] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1364'. [ 459.941766][T11120] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1364'. [ 459.990047][ T120] usb 2-1: USB disconnect, device number 26 [ 460.523930][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 461.447231][ T5937] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 461.517317][ T9] usb 2-1: new low-speed USB device number 27 using dummy_hcd [ 461.682603][ T5937] usb 1-1: too many endpoints for config 0 interface 0 altsetting 144: 127, using maximum allowed: 30 [ 461.694848][ T5937] usb 1-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 461.709325][ T5937] usb 1-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 461.719676][ T5937] usb 1-1: config 0 interface 0 altsetting 144 has 1 endpoint descriptor, different from the interface descriptor's value: 127 [ 461.724770][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 461.734342][ T5937] usb 1-1: config 0 interface 0 has no altsetting 0 [ 461.878769][ T9] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 461.887909][ T9] usb 2-1: config 0 has no interface number 0 [ 461.894173][ T5279] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 461.913580][ T9] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 461.925174][ T5937] usb 1-1: New USB device found, idVendor=5543, idProduct=004d, bcdDevice= 0.00 [ 461.934856][ T9] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 461.981236][ T5937] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.995836][ T9] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 462.009747][ T5937] usb 1-1: config 0 descriptor?? [ 462.019886][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.121011][ T9] usb 2-1: config 0 descriptor?? [ 462.126915][T11130] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 462.143114][ T9] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 462.234597][ T5279] usb 5-1: Using ep0 maxpacket: 16 [ 462.252048][ T5279] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 462.265956][ T5279] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 462.279245][ T5279] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 462.300824][ T5279] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.310319][ T5279] usb 5-1: Product: syz [ 462.557135][ T120] usb 2-1: USB disconnect, device number 27 [ 462.611037][ T5279] usb 5-1: Manufacturer: syz [ 462.621553][ T5279] usb 5-1: SerialNumber: syz [ 462.638898][T11143] syzkaller0: entered promiscuous mode [ 462.655003][T11143] syzkaller0: entered allmulticast mode [ 462.676093][T11143] TC_ACT_REPEAT abuse ? [ 462.863097][ T5279] usb 5-1: 0:2 : does not exist [ 462.870999][ T5937] uclogic 0003:5543:004D.000B: failed retrieving Huion firmware version: -71 [ 462.886382][ T5937] uclogic 0003:5543:004D.000B: failed probing parameters: -71 [ 462.897994][ T5937] uclogic 0003:5543:004D.000B: probe with driver uclogic failed with error -71 [ 462.922754][ T5279] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 462.964341][ T5937] usb 1-1: USB disconnect, device number 29 [ 463.112226][ T5279] usb 5-1: USB disconnect, device number 28 [ 463.176292][T11151] kvm_pr_unimpl_wrmsr: 36 callbacks suppressed [ 463.176311][T11151] kvm: kvm [11150]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x6d00 [ 463.369738][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 463.378007][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 463.413138][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 463.966633][T11170] ALSA: mixer_oss: invalid OSS volume '' [ 464.100707][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.109196][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.687502][ T6558] ------------[ cut here ]------------ [ 464.693779][ T6558] time_after(jiffies, timeout) [ 464.693815][ T6558] WARNING: io_uring/io_uring.c:2341 at io_ring_exit_work+0x4a3/0x960, CPU#0: kworker/u8:14/6558 [ 464.709598][ T6558] Modules linked in: [ 464.713937][ T6558] CPU: 0 UID: 0 PID: 6558 Comm: kworker/u8:14 Tainted: G L syzkaller #0 PREEMPT(full) [ 464.725152][ T6558] Tainted: [L]=SOFTLOCKUP [ 464.729569][ T6558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 464.739914][ T6558] Workqueue: iou_exit io_ring_exit_work [ 464.745742][ T6558] RIP: 0010:io_ring_exit_work+0x4a3/0x960 [ 464.751492][ T6558] Code: c6 05 05 5f d0 0e 01 48 c7 c7 80 51 26 8c be 25 00 00 00 48 c7 c2 a0 4c 26 8c e8 f8 c4 76 00 e9 88 fe ff ff e8 8e 8b 9a 00 90 <0f> 0b 90 b8 70 17 00 00 48 89 44 24 10 eb 9f c7 84 24 b0 00 00 00 [ 464.772275][ T6558] RSP: 0018:ffffc9000caef960 EFLAGS: 00010293 [ 464.779040][ T6558] RAX: ffffffff812b0042 RBX: 0000000100003f7f RCX: ffff888028c40000 [ 464.787148][ T6558] RDX: 0000000000000000 RSI: fffffffffffffffd RDI: 0000000000000000 [ 464.795156][ T6558] RBP: ffffc9000caefaf0 R08: ffffc9000caef8e7 R09: 1ffff9200195df1c [ 464.803483][ T6558] R10: dffffc0000000000 R11: fffff5200195df1d R12: dffffc0000000000 [ 464.811512][ T6558] R13: 0000000100003f7c R14: 0000000000002000 R15: ffff888059c36000 [ 464.819619][ T6558] FS: 0000000000000000(0000) GS:ffff888125464000(0000) knlGS:0000000000000000 [ 464.828746][ T6558] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 464.835376][ T6558] CR2: 000020000020d030 CR3: 000000007ab96000 CR4: 00000000003526f0 [ 464.843464][ T6558] Call Trace: [ 464.846775][ T6558] [ 464.849790][ T6558] ? __pfx_io_ring_exit_work+0x10/0x10 [ 464.855333][ T6558] ? process_scheduled_works+0xa25/0x1830 [ 464.861157][ T6558] ? process_scheduled_works+0xa25/0x1830 [ 464.867231][ T6558] process_scheduled_works+0xb02/0x1830 [ 464.872812][ T6558] ? __pfx_process_scheduled_works+0x10/0x10 [ 464.879054][ T6558] ? assign_work+0x3d5/0x5e0 [ 464.883676][ T6558] worker_thread+0xa50/0xfc0 [ 464.888693][ T6558] kthread+0x388/0x470 [ 464.892772][ T6558] ? __pfx_worker_thread+0x10/0x10 [ 464.897924][ T6558] ? __pfx_kthread+0x10/0x10 [ 464.902598][ T6558] ret_from_fork+0x51e/0xb90 [ 464.907255][ T6558] ? __pfx_ret_from_fork+0x10/0x10 [ 464.912473][ T6558] ? __switch_to+0xc7d/0x1450 [ 464.917284][ T6558] ? __pfx_kthread+0x10/0x10 [ 464.921865][ T6558] ret_from_fork_asm+0x1a/0x30 [ 464.926628][ T6558] [ 464.929730][ T6558] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 464.937044][ T6558] CPU: 0 UID: 0 PID: 6558 Comm: kworker/u8:14 Tainted: G L syzkaller #0 PREEMPT(full) [ 464.948436][ T6558] Tainted: [L]=SOFTLOCKUP [ 464.952992][ T6558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 464.963071][ T6558] Workqueue: iou_exit io_ring_exit_work [ 464.968729][ T6558] Call Trace: [ 464.972089][ T6558] [ 464.975011][ T6558] vpanic+0x56c/0xa60 [ 464.979040][ T6558] ? __pfx__printk+0x10/0x10 [ 464.983628][ T6558] ? __pfx_vpanic+0x10/0x10 [ 464.988130][ T6558] ? is_bpf_text_address+0x292/0x2b0 [ 464.993420][ T6558] ? is_bpf_text_address+0x26/0x2b0 [ 464.998770][ T6558] panic+0xc5/0xd0 [ 465.002485][ T6558] ? __pfx_panic+0x10/0x10 [ 465.006992][ T6558] ? ret_from_fork_asm+0x1a/0x30 [ 465.011933][ T6558] __warn+0x315/0x4f0 [ 465.016094][ T6558] ? io_ring_exit_work+0x4a3/0x960 [ 465.021227][ T6558] ? io_ring_exit_work+0x4a3/0x960 [ 465.026442][ T6558] __report_bug+0x29a/0x540 [ 465.030960][ T6558] ? __pfx___mutex_trylock_common+0x10/0x10 [ 465.036859][ T6558] ? io_ring_exit_work+0x4a3/0x960 [ 465.042052][ T6558] ? __pfx___report_bug+0x10/0x10 [ 465.047110][ T6558] ? __mutex_lock+0x319/0x1300 [ 465.051874][ T6558] ? io_ring_exit_work+0x41b/0x960 [ 465.057068][ T6558] ? io_ring_exit_work+0x4a3/0x960 [ 465.062357][ T6558] report_bug+0x16a/0x220 [ 465.066686][ T6558] ? io_ring_exit_work+0x4a3/0x960 [ 465.071967][ T6558] ? io_ring_exit_work+0x4a5/0x960 [ 465.077261][ T6558] handle_bug+0x98/0x200 [ 465.081515][ T6558] exc_invalid_op+0x1a/0x50 [ 465.086094][ T6558] asm_exc_invalid_op+0x1a/0x20 [ 465.090934][ T6558] RIP: 0010:io_ring_exit_work+0x4a3/0x960 [ 465.096647][ T6558] Code: c6 05 05 5f d0 0e 01 48 c7 c7 80 51 26 8c be 25 00 00 00 48 c7 c2 a0 4c 26 8c e8 f8 c4 76 00 e9 88 fe ff ff e8 8e 8b 9a 00 90 <0f> 0b 90 b8 70 17 00 00 48 89 44 24 10 eb 9f c7 84 24 b0 00 00 00 [ 465.116253][ T6558] RSP: 0018:ffffc9000caef960 EFLAGS: 00010293 [ 465.122417][ T6558] RAX: ffffffff812b0042 RBX: 0000000100003f7f RCX: ffff888028c40000 [ 465.130407][ T6558] RDX: 0000000000000000 RSI: fffffffffffffffd RDI: 0000000000000000 [ 465.138388][ T6558] RBP: ffffc9000caefaf0 R08: ffffc9000caef8e7 R09: 1ffff9200195df1c [ 465.146350][ T6558] R10: dffffc0000000000 R11: fffff5200195df1d R12: dffffc0000000000 [ 465.154319][ T6558] R13: 0000000100003f7c R14: 0000000000002000 R15: ffff888059c36000 [ 465.162295][ T6558] ? io_ring_exit_work+0x4a2/0x960 [ 465.167421][ T6558] ? __pfx_io_ring_exit_work+0x10/0x10 [ 465.172886][ T6558] ? process_scheduled_works+0xa25/0x1830 [ 465.178601][ T6558] ? process_scheduled_works+0xa25/0x1830 [ 465.184316][ T6558] process_scheduled_works+0xb02/0x1830 [ 465.189985][ T6558] ? __pfx_process_scheduled_works+0x10/0x10 [ 465.196015][ T6558] ? assign_work+0x3d5/0x5e0 [ 465.200610][ T6558] worker_thread+0xa50/0xfc0 [ 465.205218][ T6558] kthread+0x388/0x470 [ 465.209364][ T6558] ? __pfx_worker_thread+0x10/0x10 [ 465.214556][ T6558] ? __pfx_kthread+0x10/0x10 [ 465.219138][ T6558] ret_from_fork+0x51e/0xb90 [ 465.223726][ T6558] ? __pfx_ret_from_fork+0x10/0x10 [ 465.228825][ T6558] ? __switch_to+0xc7d/0x1450 [ 465.233492][ T6558] ? __pfx_kthread+0x10/0x10 [ 465.238068][ T6558] ret_from_fork_asm+0x1a/0x30 [ 465.242831][ T6558] [ 465.246231][ T6558] Kernel Offset: disabled [ 465.250540][ T6558] Rebooting in 86400 seconds..