last executing test programs: 2m46.458981929s ago: executing program 1 (id=1118): fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000800030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0xc4}, 0x890) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000780)="86ca2a16fe5180f6bafb367fbfaeb7bd377d1170d68d553f9c9410e659dcd55247def2c714abd25da699246aa2572436da2b8b4ab57133f6105c9ff092575369318865cb4c5fbc85e0e966b9f56d3cc6ef68d0eca7e7207cfe0b35e51fa72113d44a2432cbb2971a18f68635dc5962d1312cf9b464ca81ff8dab3a49b840309ad90f6abd7ff2d8e5ef4aff817c886c1aaef6bcb547a7cb00629b700c871f90e70e7526127f228a0b917622911b8690227a9591dae66623ade7b85e721fc1fbcca8a7221e335c3221e08d3455bf24ccc3501a901837db9ace9d7ea19827e12a6f505f16bd932f2ae5e3c2c3fcf2760dfbe3e2ccca118b6085c3b4bc", 0xfb) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000002c0)) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 2m46.313053711s ago: executing program 1 (id=1128): fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000800030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0xc4}, 0x890) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000780)="86ca2a16fe5180f6bafb367fbfaeb7bd377d1170d68d553f9c9410e659dcd55247def2c714abd25da699246aa2572436da2b8b4ab57133f6105c9ff092575369318865cb4c5fbc85e0e966b9f56d3cc6ef68d0eca7e7207cfe0b35e51fa72113d44a2432cbb2971a18f68635dc5962d1312cf9b464ca81ff8dab3a49b840309ad90f6abd7ff2d8e5ef4aff817c886c1aaef6bcb547a7cb00629b700c871f90e70e7526127f228a0b917622911b8690227a9591dae66623ade7b85e721fc1fbcca8a7221e335c3221e08d3455bf24ccc3501a901837db9ace9d7ea19827e12a6f505f16bd932f2ae5e3c2c3fcf2760dfbe3e2ccca118b6085c3b4bc", 0xfb) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000002c0)) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 2m46.197334726s ago: executing program 1 (id=1122): setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x800000000f, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x7f, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xffffffff}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='team0\x00', 0x10) listen(r0, 0x2) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000200), 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)={0x94, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x94}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) sendmsg$IPCTNL_MSG_CT_GET_DYING(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)={0x14, 0x6, 0x1, 0x301, 0x0, 0x0, {0xa, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) recvmsg(r3, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x20) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r5, 0x84, 0x7, &(0x7f0000000040), &(0x7f0000000080)=0x4) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x7f, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xffffffff}, 0x20) listen(r4, 0x2) 2m46.00056456s ago: executing program 1 (id=1124): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x108}}, 0x0) 2m45.869974208s ago: executing program 1 (id=1126): write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000001040)={0x1a, {"a2e3ad21ed6b52f99cfbf4c087f71e9b230963ff7fc6e5539b9b3b09719b711b5d52101b080d29428f0e1ac6e7049b3468959b189a242a9b45f3988f7ef319520100ffe8d178708c523c921b1b23380a169b63d336cd3b78130daa61d8e81aea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f309f4cff7738596ecae8707ce065cd5b91cd0ae11a973735b36d5b1b63e91c00305d9be7bd1d020000000000000075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecd03aded6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801000000005b6bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c580263093ca9a34af674f3f39fe23491e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6fa94fc488ec130fb3850a27afc953854a642c57519544ae15a7e454dea05918b412435111c8f11baa500a3621c56cea8d20ff911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269caf12c31357c8219793e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a687974e7b4ab01b7f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a60560a22f1fca567e65d5e880572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5120000008213b704c7fb082ff27590678ef9f190bae979babc7041d860420c5664ba7921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da3710ac000000001a527777a5371f87d0d4aa202fd28f28381aab144a5d429a04a689b83c7068ae949ef06e288e810bac9c766000a5e19c907f8ea2e2f05dd3318271a1f5f8528f227e79c1386abdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eefc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f103000000416d59fdee5325928974d12dad99dac44c3f0008047096a44060fb30e900caab415db6578b4779415d97b9a6d601005c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3c901cd34e5c92f76cc4c24eeb8bc4e9ac292d9e53803ed000000009737d214060005ea6f1783e287b3bee96e3a7288afe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f48fe4eae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf02b98a269b891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efedfd71af9444e197f47e866101496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ffffff7f000000007f889b09114edb8e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615f7084a607a7eceb6243378e0610060f02cca405d8c5f64fdb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c4e15a7b6eb65ca8104e1b4da1fbb67ab2fc043aead87c32ab875ee7c2e7b7019c902cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe529003d1802d5676d95f160ec97b1ad948741b2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd73643de50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c1023bf70cc77737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73c497579773767075428067e7f16f4dde374f8211fef42cb468e623daf60b3569d462f4f19eacdb3ed70eeebb40800000077d443e8b40426db6fe29068c0ca3d3414442e863a154704b0e5e2c664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae44369ddb4581c55925d0f6f1ba471eba281f259152f85e654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b405177548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd84e935e00785ec27e923911fab964c271556527697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9ddbfb96d6144345f48843dd014e5c5ad8fe995754bd9cf32fce1e7027132f2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5336651b1b9bd522d60399473296b831dbd933d93994ba30b4279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee29165895ac4b008e595f437491d87abed02cefcd9db53dc10772d2b13f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76d57227edff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f84fa6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b30f0b932a4d02da711b757fe43c06d21e759595e4e98b27faea8aa12bc8040000000000000033eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d0000010000000000fcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cb0b3e35cb80dd349e891aef595dc4d080e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c60edddab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec014508e5247d33ae6c962d35603ff8454c16f8342856935125102bb784ed704887071f3d998efdd9923c954ab6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6ff7ffb1d62458d0741a12830052fcc460db043afe525629b40d7cee65802cb5e930ed624806c43a006dc9336d07c2b8081c188d26558f48261f7897084c2a1a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da3932ba5c04c24a560ad80a3ce654578376e599aff3565b1d531f30912b99e6619ebe93cc0b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c0ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf475bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e6491953264c7b34252600c9654e502dcea39cb0800eb69992e234b4ca7db2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc640df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c02b5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadbb25c72e9758f03a755d0be53f8d2a1dfb1c6000064b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ff1aa7082ead01a9b03c37b0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058093fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d060000008926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000340)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000380)=[0x0, 0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280), 0x3, 0x2, 0x7}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffd}}, @dstopts_2292={{0xc8, 0x29, 0x4, {0x4, 0x15, '\x00', [@calipso={0x7, 0x10, {0x1, 0x2, 0x9, 0x9f, [0x8]}}, @generic={0xfe, 0x38, "f4a4a3142ee1e12b9826287997a6b33d89f3d60da1641d9fe3896c3c1b6c130ef4f01be8f5836d417874540898619050b14420ab124b11de"}, @generic={0x80, 0x14, "09e12e5f0b6bdcf72f2ec7008a15fa88b025e0ad"}, @calipso={0x7, 0x30, {0x1, 0xa, 0x7a, 0x8001, [0x5, 0x9, 0x4, 0x400, 0xb]}}, @pad1, @ra={0x5, 0x2, 0xbf4}, @hao={0xc9, 0x10, @private2}]}}}, @hoplimit={{0x14}}, @hopopts={{0x98, 0x29, 0x36, {0x5e, 0xf, '\x00', [@generic={0xff, 0x40, "50d650847249ad288702ebd0d654b985e8908defb7ec6c5ff115c58e128b9e3a21c34b45ef9de99984e143ca7c3509a971b2ec429ee1edc0bb903fe94b32c28f"}, @pad1, @pad1, @calipso={0x7, 0x28, {0x3, 0x8, 0x0, 0xfff, [0x2, 0x4, 0x966, 0xfffffffffffffff7]}}, @calipso={0x7, 0x8, {0x3, 0x0, 0x3}}]}}}, @rthdr={{0x18}}], 0x1c0}}], 0x1, 0x810) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r5, 0x4030ae7b, &(0x7f0000000040)={0x6, 0x6, 0x9, 0x3, 0x4}) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2m44.190453345s ago: executing program 1 (id=1132): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)=ANY=[@ANYBLOB="1c00000014000100000080000000000002000080080002"], 0x1c}], 0x1}, 0x4040000) sendmmsg$unix(r0, &(0x7f00000089c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@rights={{0x1c, 0x1, 0x1, [r1, r1, r1]}}], 0x20}}], 0x1, 0x0) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000040)={'bridge_slave_1\x00', {0x2, 0x0, @initdev}}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r4}, &(0x7f0000000340)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)={0x14, 0x26, 0x9, 0x80004, 0x7d, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x48010}, 0x4000000) r5 = socket$vsock_stream(0x28, 0x1, 0x0) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r6, &(0x7f0000006380)={0x2020}, 0x2020) setsockopt$RDS_CANCEL_SENT_TO(r6, 0x114, 0x1, &(0x7f0000000080)={0x2, 0x4e24, @empty}, 0x10) connect$vsock_stream(r5, &(0x7f0000000000)={0x28, 0x0, 0xffffffff}, 0x10) 2m42.600175761s ago: executing program 0 (id=1147): socket$inet6_sctp(0xa, 0x1, 0x84) mmap(&(0x7f000000c000/0x4000)=nil, 0x4000, 0xa, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x1f6, 0x4) sendmmsg$inet(r0, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, &(0x7f00000016c0)=[{&(0x7f0000001540)="94", 0xffe3}], 0x1}}], 0x1, 0x4000800) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) bind$packet(r1, &(0x7f0000000300)={0x11, 0x1, r2, 0x1, 0x10, 0x6, @remote}, 0x14) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') r4 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) openat$cgroup_int(r5, &(0x7f0000000180)='cgroup.max.depth\x00', 0x2, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$SG_SET_FORCE_PACK_ID(r5, 0x227b, &(0x7f0000000040)) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) bind$packet(r6, &(0x7f0000000000)={0x11, 0x0, r8, 0x1, 0x2, 0x6, @local}, 0x14) preadv(r3, &(0x7f00000001c0)=[{&(0x7f0000000500)=""/212, 0xd4}], 0x1, 0x33, 0xf5) 2m42.598707883s ago: executing program 0 (id=1148): r0 = signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0x2]}, 0x8) ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000040)={[0x5, 0xfffffffffffffffc, 0x8000000000000000, 0x6, 0x88d3, 0xff, 0x0, 0xc000000000000000, 0x6, 0x3, 0x2, 0x8, 0x10000, 0x4, 0x2, 0x8], 0xffffffff, 0x40}) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/vlan/vlan1\x00') r2 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x10500, 0x5, 0x6}, 0x18) getdents(r2, &(0x7f00000001c0)=""/252, 0xfc) r3 = open(&(0x7f00000002c0)='./file0\x00', 0x4800, 0xc5) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r3, 0x110, 0x4, &(0x7f0000000300), 0x4) sendmsg$nl_generic(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, 0x25, 0x8, 0x70bd27, 0x25dfdbfe, {0xf}, [@typed={0x8, 0xa9, 0x0, 0x0, @ipv4=@remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80c1}, 0x4000044) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0xc0, 0x0) r5 = geteuid() ioctl$TUNSETOWNER(r4, 0x400454cc, r5) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f0000000480)={{0x5000, 0x100000, 0xa, 0x80, 0x5, 0x9, 0x6, 0x5, 0x79, 0xbb, 0x5, 0x1}, {0x60000, 0x3000, 0x1c, 0x9, 0x8, 0xf9, 0xfd, 0x20, 0x2, 0xfa, 0x1, 0xc3}, {0xffff1000, 0x5a58d3a162d9f6db, 0xa, 0x5, 0x40, 0x9, 0x49, 0x8, 0x0, 0x3, 0x4}, {0xeeea8001, 0x0, 0xd, 0xcc, 0x3, 0x0, 0xfa, 0xf9, 0x8, 0x80, 0x1, 0x2e}, {0xb000, 0x54000, 0xb, 0x80, 0x6, 0x6, 0x5, 0x6, 0x0, 0xb0, 0x0, 0x5}, {0x50000, 0x9000, 0x10, 0x7, 0x1, 0xd, 0xc, 0x1, 0x5, 0x7, 0x1, 0x10}, {0xe000, 0x1, 0x9, 0x8, 0x9, 0x40, 0xfb, 0x68, 0xe, 0x7, 0x81, 0x9}, {0xffffffff, 0x0, 0x9, 0x9c, 0x8, 0x7, 0xfb, 0xb, 0x40, 0x7, 0x1, 0x8}, {0x5000, 0x6}, {0x80b2000, 0x9}, 0x80000015, 0x0, 0x54000, 0x40000, 0x1, 0x4001, 0x10000, [0x5578, 0x0, 0x926, 0x5]}) sendmsg$OSF_MSG_ADD(r0, &(0x7f0000000fc0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000600)={0x964, 0x0, 0x5, 0x301, 0x0, 0x0, {0x5, 0x0, 0x6}, [{{0x254, 0x1, {{0x2, 0x80000001}, 0x6, 0x9, 0x80, 0x1, 0x11, 'syz1\x00', "0a28ca0358f14e861eebddd04030e57e1136cd64e4d76ae86cf1cb5be878d236", "2bd85d1beadf2a877c9ca24931692302adae0c6986bee9ec350e257537ed3144", [{0x1c, 0x2, {0x0, 0x5}}, {0x0, 0x17e6, {0x1, 0x9}}, {0x7b4a, 0x4, {0x2, 0xf}}, {0x3, 0x4, {0x3, 0x10001}}, {0x8f7, 0x0, {0x3, 0x6}}, {0x101, 0x6, {0x0, 0x486bd7bb}}, {0x8, 0x8001, {0x0, 0xffffff7f}}, {0xfffa, 0x0, {0x3, 0xac7}}, {0x4, 0x8, {0x0, 0xffffff84}}, {0xfffb, 0x6, {0x3, 0xb762}}, {0x1, 0x5950, {0x0, 0x2}}, {0x3, 0x10, {0x0, 0x80000000}}, {0x1, 0x2, {0x3, 0x7}}, {0x4, 0x1, {0x3, 0x2}}, {0x3, 0x0, {0x1, 0x9}}, {0xc, 0x6, {0x3, 0x10001}}, {0x4, 0x7, {0x3, 0x7}}, {0x600, 0x0, {0x0, 0x7}}, {0x1000, 0x4, {0x2, 0x9}}, {0x7, 0x7, {0x2, 0x800}}, {0x8, 0x0, {0x1, 0x2}}, {0x5, 0x0, {0x1}}, {0x5, 0xf4, {0x3, 0x5}}, {0x62, 0x6, {0x1, 0x9}}, {0xfc00, 0x4, {0x2, 0x7fffffff}}, {0x401, 0x4, {0x2, 0x3}}, {0x5, 0x3, {0x2, 0x7f}}, {0x10, 0xf, {0x1, 0x5}}, {0x6, 0x9, {0x2, 0x6}}, {0xfffa, 0x805, {0x2, 0x8}}, {0x1e3f, 0x2, {0x3, 0x3}}, {0x998a, 0x4, {0x2, 0x7}}, {0xff, 0xffff, {0x3, 0xfffffffd}}, {0x0, 0x9, {0x0, 0x3}}, {0x2, 0x2, {0x3, 0x4}}, {0x1000, 0x8, {0x2, 0x7ff}}, {0x4, 0x9, {0x2, 0x80}}, {0x8, 0xfa, {0x2, 0x7f}}, {0x10, 0x2c1, {0x2, 0x8}}, {0x1, 0x100, {0x1, 0x5c}}]}}}, {{0x254, 0x1, {{0x0, 0xfffffffa}, 0x0, 0xc0, 0x401, 0x3638, 0x3, 'syz1\x00', "378c2f9f495914aea64258599ee8e5e008fc3cefb004a82d924dcea7a61f06ce", "5f7dde1acb838cfd5ea1a5a2025fc27908b156ed3ca8e7868b3281f6b8bb4e45", [{0x3123, 0xd13, {0x2, 0x3}}, {0x7, 0x0, {0x3, 0x7fffffff}}, {0x5, 0x7, {0x0, 0x2}}, {0x4, 0xd7c3, {0x0, 0x8}}, {0x9, 0x1, {0x1, 0x6}}, {0x100, 0x80, {0x2, 0xff}}, {0x1, 0x5}, {0x9, 0x9, {0x2, 0xfb}}, {0x2218, 0x1, {0x0, 0x2}}, {0x1ff, 0x3, {0x2, 0x101}}, {0x1, 0x4551, {0x2}}, {0x1000, 0x6, {0x1, 0x7}}, {0x1, 0x2, {0x3, 0x48000000}}, {0x4, 0x2, {0x0, 0x8}}, {0x70d, 0x800, {0x3, 0xb0}}, {0xce, 0x8000, {0x0, 0x10}}, {0x44, 0x0, {0x0, 0xffff}}, {0x101, 0x0, {0x3, 0xff}}, {0x0, 0x139, {0x2, 0xfffff842}}, {0x7, 0xc, {0x0, 0x9}}, {0xa06f, 0x8937, {0x0, 0x4}}, {0x101, 0x2, {0x1, 0x6}}, {0x9, 0x81, {0x3, 0x8000}}, {0x81, 0x7ff, {0x2}}, {0x3, 0xc, {0x2, 0x2}}, {0x6, 0x9, {0x2, 0x8}}, {0x400, 0x9, {0x0, 0x1}}, {0xfbff, 0x66b, {0x0, 0xd7d6}}, {0x2, 0x6, {0x1}}, {0x6, 0x9, {0x0, 0x6af9}}, {0x7, 0xae2c, {0x0, 0x8}}, {0x0, 0x7, {0x2, 0x4}}, {0x9, 0x6, {0x3, 0x322}}, {0xd784, 0x3, {0x0, 0xfffffff8}}, {0x1, 0x4, {0x3, 0x6}}, {0x1, 0x46, {0x0, 0x49c8e123}}, {0x4, 0x3fc4, {0x2, 0x17b}}, {0x5, 0x0, {0x3, 0x7e9}}, {0xfffd, 0xdb, {0x0, 0x8}}, {0x9, 0x1ff, {0x3}}]}}}, {{0x254, 0x1, {{0x3, 0x8}, 0x0, 0x1, 0xfff7, 0x200, 0x19, 'syz0\x00', "a4cb304a9e3b69ec68e62525745a6e6be9316ff3079b03efb99c48b482f9455d", "923da24e22fbf77ba98bb32a335ff570bafbc003f1588d78e8538ea4cbc81d8d", [{0x9, 0x2ac5, {0x3, 0x400}}, {0xc0, 0x1, {0x0, 0x3}}, {0x2, 0x8000, {0x1, 0x693}}, {0x1ff, 0x9, {0x3, 0x5}}, {0x0, 0x4, {0x2, 0x7}}, {0xb, 0xf84e, {0x1, 0x5}}, {0x81, 0x3, {0x3, 0xff}}, {0x1, 0x3, {0x0, 0xba}}, {0xe926, 0x6, {0x2, 0x1}}, {0x1, 0x9, {0x0, 0x10}}, {0xffff, 0x5, {0x0, 0x1a}}, {0x9, 0xdeb5, {0x3, 0x7f}}, {0x2, 0x5d89, {0x3, 0x72}}, {0x4, 0x3, {0x2, 0x7}}, {0xc88, 0x9, {0x2, 0x7}}, {0xf, 0x8, {0x1, 0x3}}, {0x69d, 0x3, {0x2, 0xfffffffb}}, {0xd, 0x8, {0x2, 0x8}}, {0x3, 0x0, {0x1, 0x1}}, {0x6, 0x4, {0x0, 0x2}}, {0x1, 0x8000, {0x0, 0x40}}, {0x101, 0x7, {0x0, 0x4}}, {0x8, 0xfff, {0x2, 0x6}}, {0x6, 0xdd, {0x2, 0xd7}}, {0xe9f, 0x8b, {0x3, 0x6}}, {0x75, 0x9, {0x3, 0x6}}, {0x400, 0x80, {0x1, 0x2}}, {0x3ff, 0xd2, {0x1, 0xac16}}, {0x7, 0x2, {0x0, 0xeae}}, {0x4, 0x7, {0x1, 0x6}}, {0x4, 0xc, {0x1}}, {0x15b, 0x41, {0x2, 0x7}}, {0xf, 0x7f, {0x0, 0x3}}, {0x5, 0x8, {0x0, 0x5}}, {0x7, 0x3, {0x0, 0x8}}, {0x2, 0x8, {0x3, 0x7}}, {0xa6, 0x1, {0x0, 0x80}}, {0x8, 0x0, {0x3, 0xffff}}, {0x3ad9, 0x7, {0x2, 0x8}}, {0x0, 0x8, {0x2, 0x9}}]}}}, {{0x254, 0x1, {{0x0, 0x5}, 0xe, 0x1, 0x3, 0x0, 0x19, 'syz1\x00', "9987378aa2d5988ad6a7f56f67cc9919c0a838bd47e1ce4a4f9eaeb148c3b74b", "f508bc1dea5531b72d69a0f243d971312f5584b8806396bb8355b374a792f4af", [{0x8, 0x101, {0x0, 0x79c}}, {0x9, 0x3, {0x2, 0x6}}, {0x5, 0x1, {0x3, 0x3}}, {0x6, 0x54, {0x3}}, {0x6f77, 0x81, {0x2, 0x7}}, {0x1, 0x2, {0x73a37ee1bc22f048, 0xffffffff}}, {0x7, 0x2, {0x0, 0x1000}}, {0x2, 0x23d8, {0x1, 0xb}}, {0xe000, 0x3, {0x3, 0x9}}, {0x8000, 0xee, {0x3}}, {0x9, 0xfff, {0x1, 0xe}}, {0x3, 0x7, {0x1, 0x2}}, {0x2f52, 0x9, {0x3, 0x1000}}, {0x100, 0x4, {0x3, 0x80}}, {0x0, 0x8, {0x0, 0x2}}, {0x8, 0x5f7, {0x0, 0xbe}}, {0x7, 0x53b5, {0x2, 0x2}}, {0x5, 0x14, {0x1, 0x2}}, {0x84, 0x8, {0x0, 0xffff}}, {0x4, 0x3, {0x2, 0x1ff}}, {0x81, 0x3, {0x3, 0x1ff}}, {0x200, 0x5, {0x2, 0xb1ac}}, {0x5, 0x9, {0x3, 0x30000}}, {0x3, 0xfff9, {0x2, 0x81}}, {0xda41, 0x8d77, {0x3, 0x5}}, {0xb, 0x400, {0x2, 0x5}}, {0xdbc9, 0x4, {0x0, 0xd2a4}}, {0x3, 0x3, {0x2, 0x8}}, {0x7, 0x8, {0x0, 0x8}}, {0xd6, 0xfff3, {0x2, 0x2}}, {0x48, 0x6, {0x3, 0x8}}, {0x1, 0x8, {0x1}}, {0x3, 0x2a2, {0x3, 0xfffffff7}}, {0x1, 0x9, {0x1, 0x5}}, {0x1, 0x6, {0x0, 0x5}}, {0x25, 0xb129, {0x3, 0x2}}, {0x6, 0x6, {0x2, 0x7}}, {0x9, 0x8, {0x0, 0xffff}}, {0x9, 0x2, {0x1, 0x6e9}}, {0xd, 0x2, {0x3, 0x6}}]}}}]}, 0x964}, 0x1, 0x0, 0x0, 0x8000}, 0x11) r6 = fsopen(&(0x7f0000001000)='devtmpfs\x00', 0x1) connect$qrtr(r0, &(0x7f0000001040)={0x2a, 0x2, 0x8000}, 0xc) r7 = fcntl$dupfd(r0, 0x0, r6) getpid() r8 = fsmount(r0, 0x0, 0x6) r9 = accept4$netrom(r3, &(0x7f0000001080)={{0x3, @bcast}, [@default, @default, @default, @bcast, @netrom, @remote, @netrom, @default]}, &(0x7f0000001100)=0x48, 0x800) ioctl$sock_netrom_SIOCDELRT(r9, 0x890c, &(0x7f0000001140)={0x0, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0xfffffffb, 'syz1\x00', @bcast, 0xffffffff, 0x8, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @null, @default]}) connect$l2tp6(r3, &(0x7f00000011c0)={0xa, 0x0, 0x10, @local, 0x3160, 0x4}, 0x20) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000001200)={0x0, 0x1, 0x2, 0x4, 0x4, 0x820}, &(0x7f0000001240)=0x14) setsockopt$inet_sctp6_SCTP_CONTEXT(r7, 0x84, 0x11, &(0x7f0000001280)={r10, 0x5b}, 0x8) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r9, 0x80286722, &(0x7f0000001340)={&(0x7f00000012c0)=""/69, 0x45, 0x4, 0x1c}) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000001380)={0x1fe, 0x1786ad7695e43850, 0x58000, 0x1000, &(0x7f0000ffd000/0x1000)=nil}) r11 = accept4$vsock_stream(r8, &(0x7f00000013c0)={0x28, 0x0, 0x0, @my=0x1}, 0x10, 0x800) pidfd_getfd(r8, r11, 0x0) r12 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001440), r8) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f0000001500)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000014c0)={&(0x7f0000001480)={0x3c, r12, 0x0, 0x70bd2b, 0x25dfdbfc, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'vcan0\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x4048010) syz_usb_disconnect(0xffffffffffffffff) 2m41.807498072s ago: executing program 0 (id=1155): prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0xda9917f2, &(0x7f0000000480)='\x00\xff\xff\x00\x02@qGP\xc5\x94\xa6\x8fB\xc3\x93\xe5\xc1a\x05!\x9a\x8b\xeb\xceJP\x1e\xf2\x8a\xd4\xaa\x15@>\xdb\xab\x06\x1b\xe2w\xd8\x1e\xda\xc1\x9f\xe9\xc4c\xdd\xf6^\xcb\xec\xab\x82\xcf\x14\xde\xa5\xef\x162bP\x95/\xefMs\xe0%}\xe4\xf1=\x05\xf6l7\xc1\xe9c\xc3\x7f\tg\xf56\xeasl\xbd\x02\xc1\x8a\xa9\x83\xaf\xfa\x95W+N$\x06R\x92\xe5Z\x97\xfb\xb6e}fW\x8bm\x04\'{\xaf\xe2zd\x91+-\xb1\xd8\ftK|\xb8\xd2\xb6\x7f\xf4\x84\v\x1e\xe6R\xfc\xbcg\x81\xbb\xc4\xcd\xe9\xe5.\x9b\x7f\xeb\x04\xe6,N\x00\x9a\x9d\xf8\xd1\x8aR4;\x7f\x8a\x86\xb7\xd7o\x90\xfd\xa9dJ\xd5.\x18F2\x00\x00\x00\xf2y\x99\xfd\xca\xff*\xd3;\x84F\x8f !N\x1c\xfaI\xa5\x85:\xc1\x9ed\x13\xaf\xd0/\x00\x9b\x0e\xb6\xca\xa5X\xb9]<\n\x90Tk\xa4\xb3\xc4\xa4*\xc2\xf6\x1bw\n6^\xfa\xea\r\xf1\xc1\xd0\xd8\xc7B\x1cP\x02\xcfH\x89\x82G\xcf\x1921\x9e\v4Q\xc6\x9c\xc3\xfd\xf3Z1\xef7cK\xd5\xdc\xbf\x00\xe0{\xa0\xf7\xcd\x82\xf6\x99\xcb\x1a\x17\x02\xd1\x9d(\xa2 \x85\x8e 6zL\xeeqG\t~\xafQ(\xc3\xd8\x05\xcb\xbfB\xb0\xe1b\x0f\xa8f\xe6\xb1\xe8\x9aB\x90\x00\x00\x00') prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x1a9) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x400, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x420, &(0x7f0000000100)=ANY=[@ANYBLOB="67727071bcce74615f626c6f636b5f68617264064caf8fbdb1a45500"]) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000380)="660f388103656726f2adba6100edce66b9800000c00f326635010000000f302edde22ea7ad660f3880b3f700656465660f3881990d00", 0x36}], 0x1, 0x64, 0x0, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000340)={0x28, 0x0, 0x0, @local}, 0x10) ioctl$KVM_RUN(r4, 0xae80, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioprio_set$pid(0x1, 0x0, 0x0) add_key(&(0x7f00000018c0)='big_key\x00', &(0x7f0000001900)={'syz', 0x1}, &(0x7f0000001940)='\f', 0xfffff, 0xfffffffffffffffe) syz_genetlink_get_family_id$nl80211(&(0x7f0000003640), r0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x4, 0x2011, r5, 0x1fc6a000) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0xd4602, 0x0) ioctl$SNDCTL_DSP_SETFMT(r6, 0xc0045005, &(0x7f0000001180)=0x2000000) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x2, 0x0) epoll_create1(0x0) 2m41.699392804s ago: executing program 0 (id=1159): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000300)="d8000000180081064e81f782db4cb904021d0800fe067c05e8fe55a10a0005000140020003600e41b0000900ac0006fc1100000004000500014002000000035c3b61c1d67f6f94007174cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001b14d6d930dfe1d9d322fe7c4650b5b9bd6ee6f63f5aeb4edbb57a", 0x88}], 0x1}, 0x20004804) r0 = openat$uinput(0xffffff9c, &(0x7f0000000180), 0x802, 0x0) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000001fc0)=""/4096, 0x1000}, {&(0x7f0000000580)=""/106, 0x6a}, {&(0x7f0000000980)=""/67, 0x43}, {&(0x7f0000000000)=""/72, 0x48}, {&(0x7f00000007c0)=""/141, 0x8d}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/191, 0xbf}, 0x5}], 0x1, 0x2001, &(0x7f0000003700)={0x77359400}) 2m41.64245788s ago: executing program 0 (id=1160): connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000240)=[{0x0, 0x300}, {&(0x7f0000000300)="359cb6", 0x3}], 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c000400"/44, @ANYRES32=0x0], 0x30}], 0x1, 0x0) r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg$inet(r0, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x3284b164842c97f7, 0x8014) bind$llc(r0, 0x0, 0x0) 2m41.484225848s ago: executing program 0 (id=1165): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x11}, @multicast1}}}, @ip_retopts={{0x24, 0x0, 0x7, {[@timestamp_addr={0x44, 0x14, 0x7, 0x1, 0x7, [{@rand_addr=0x64010101}, {@dev={0xac, 0x14, 0x14, 0x1d}, 0x5}]}]}}}], 0x48}, 0x200040c4) mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000002280)='nfsd\x00', 0x0, 0x0) 2m28.789211107s ago: executing program 32 (id=1132): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)=ANY=[@ANYBLOB="1c00000014000100000080000000000002000080080002"], 0x1c}], 0x1}, 0x4040000) sendmmsg$unix(r0, &(0x7f00000089c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@rights={{0x1c, 0x1, 0x1, [r1, r1, r1]}}], 0x20}}], 0x1, 0x0) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000040)={'bridge_slave_1\x00', {0x2, 0x0, @initdev}}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r4}, &(0x7f0000000340)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)={0x14, 0x26, 0x9, 0x80004, 0x7d, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x48010}, 0x4000000) r5 = socket$vsock_stream(0x28, 0x1, 0x0) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r6, &(0x7f0000006380)={0x2020}, 0x2020) setsockopt$RDS_CANCEL_SENT_TO(r6, 0x114, 0x1, &(0x7f0000000080)={0x2, 0x4e24, @empty}, 0x10) connect$vsock_stream(r5, &(0x7f0000000000)={0x28, 0x0, 0xffffffff}, 0x10) 2m26.810999265s ago: executing program 4 (id=1173): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000180)) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) umount2(&(0x7f0000000040)='.\x00', 0x2) ioctl$TIOCGPTPEER(r1, 0x5441, 0x6) write$dsp(r0, &(0x7f0000000280)="dce480febb0ccd0bcb66ade3495e87b440e5afdc984cc06eb1c91c85a7fec04b2f82e267c1edd1543b79d80c0f949073bdbaa464c040e61ea6e6586995281707ce6d20a6dbdbb06cfeff4876e3a0632ea5d8133f88bc5f197f4c3ba346140d3c52b51c418b84f83a7cf032ac4767ab5c935c8c55ed00807bbae65878e5c814eec867bdae7850203aa931fc1f3426808574e13fe29dd70e47751b12e025de8ceca8190d21e3fffb752ec872d45596f3d68c75964f78ef9b139c81eeda892dcb434dd1ee7a4c8819160ba1265341c340f5bbc04676f555d14d5abd9bf8c94736cd65287584e01055354e4943f8cb19e3a8", 0xf0) write$dsp(r0, &(0x7f0000000080)="cd", 0x1) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) add_key(&(0x7f0000000000)='encrypted\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000140)="bb477684461db197546607b589ff132b324255ff4aa7", 0x16, 0xfffffffffffffffc) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x202, 0x0) close(r5) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r6) sendmsg$NLBL_CIPSOV4_C_ADD(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)={0xd4, r7, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x4c, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x51ba0f0e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x23}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x74a642f7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3133b74c}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x12}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xec1238b}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x10}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x1}, {0x5, 0x3, 0x1}, {0x5}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_TAGLST={0x14, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x1}, {0x5, 0x3, 0x6}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_TAGLST={0x2c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}]}, 0xd4}}, 0x0) fgetxattr(r5, &(0x7f0000000380)=@known='trusted.overlay.metacopy\x00', 0x0, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x54, r13, 0x1, 0x0, 0x25dfdbfc, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2f}}}, {0x14, 0x2, @in={0x2, 0x0, @empty}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_BEARER_ADD(r11, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)={0x14, r13, 0x4c1dad3e3d6a7499, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x240088d4}, 0x24048000) ioctl$KVM_GET_ONE_REG(r10, 0x4010aeab, &(0x7f00000001c0)=@other={0x2000000400000000, 0x0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r4, 0xc0bc5351, &(0x7f00000000c0)={0x55, 0x0, 'client1\x00', 0x0, "2cd367818b4014ff", "859e92f118c4484604734b1d432094270002711b936fc2c4d28f902e94f8e647", 0x80}) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) 2m26.129124877s ago: executing program 33 (id=1165): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x11}, @multicast1}}}, @ip_retopts={{0x24, 0x0, 0x7, {[@timestamp_addr={0x44, 0x14, 0x7, 0x1, 0x7, [{@rand_addr=0x64010101}, {@dev={0xac, 0x14, 0x14, 0x1d}, 0x5}]}]}}}], 0x48}, 0x200040c4) mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000002280)='nfsd\x00', 0x0, 0x0) 2m25.867245276s ago: executing program 4 (id=1178): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f0000000040)=[0x0], 0x0, 0x0, 0x0, 0x1}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(r3, 0xc02064b6, &(0x7f0000000080)={0x0, r4, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETCRTC(r5, 0xc06864a1, &(0x7f0000000340)={0x0, 0x0, r6, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r3, 0xc06864a2, &(0x7f0000000140)={0x0, 0x0, r4, r7, 0x20, 0x5, 0x4000000, 0x7, {0x20000, 0x2, 0x6, 0x5, 0xa, 0x0, 0x200, 0x0, 0x8, 0x0, 0x6, 0x0, 0x8, 0x4, "d20bddda7de75aec79ff0300d28000000b0000000000001000000900"}}) sendmsg$NL80211_CMD_DEAUTHENTICATE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x28, r2, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x200000d0}, 0x10) 2m25.740667882s ago: executing program 4 (id=1179): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r0, 0x8947, &(0x7f0000000040)={'bond0\x00', @ifru_names='ip6tnl0\x00'}) syz_usb_connect(0x0, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100004366b408c70b0800c84f0102030109022d0001000000000904"], 0x0) 2m25.157355885s ago: executing program 4 (id=1180): fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000800030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0xc4}, 0x890) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000780)="86ca2a16fe5180f6bafb367fbfaeb7bd377d1170d68d553f9c9410e659dcd55247def2c714abd25da699246aa2572436da2b8b4ab57133f6105c9ff092575369318865cb4c5fbc85e0e966b9f56d3cc6ef68d0eca7e7207cfe0b35e51fa72113d44a2432cbb2971a18f68635dc5962d1312cf9b464ca81ff8dab3a49b840309ad90f6abd7ff2d8e5ef4aff817c886c1aaef6bcb547a7cb00629b700c871f90e70e7526127f228a0b917622911b8690227a9591dae66623ade7b85e721fc1fbcca8a7221e335c3221e08d3455bf24ccc3501a901837db9ace9d7ea19827e12a6f505f16bd932f2ae5e3c2c3fcf2760dfbe3e2ccca118b6085c3b4bc", 0xfb) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x4b564d07}]}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280), 0x0) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 2m25.071066797s ago: executing program 4 (id=1183): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0x20) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000100), r1) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0xe000000, 0x80}, 0xc, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="b00000000314010026bd7000fcdbdf250900020073797a3200000000080041007278650014003300766c616e3000000000000000000000000900020073797a3200000000080041007369770014003300636169663000000000000000000000000900020073797a300000000008004100727865001400330074756e4c3000000000000000000000000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000008078d3bb065c0b9f7d11da3689fb75e89699eef64c3dca34a904cc4802188f45d182228246a3082847b86c1527ff319db2402d338f8fc5a1d7b2c7927237a9c9cd0c4d278923e82e790924eba06c82d56a4eee969011240e6dfde0eb3b37b28d9d"], 0xb0}, 0x1, 0x0, 0x0, 0x8011}, 0x0) 2m24.931459511s ago: executing program 4 (id=1184): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8d40, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xb, 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000080)=0xfffffffa) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0xffffffff, 0x0, 0x4, 0x0, "00dec37d82000100c96cbd9f1278e1923d6000"}) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='tmpfs\x00', 0x0, &(0x7f00000001c0)='grpquota') r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x1b, 0x53, 0x2f, 0x40, 0x10b8, 0x1e14, 0xdbf2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x9f, 0x0, 0x0, 0x1b, 0x25, 0xa6}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f00000008c0)={0x84, &(0x7f00000000c0)={0x0, 0x8, 0x3, "0300fe"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2d8041, 0x0) syz_emit_vhci(&(0x7f0000000280)=@HCI_EVENT_PKT={0x4, @hci_ev_simple_pair_complete={{0x36, 0x7}, {0x80}}}, 0xa) 2m9.911235866s ago: executing program 34 (id=1184): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8d40, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xb, 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000080)=0xfffffffa) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0xffffffff, 0x0, 0x4, 0x0, "00dec37d82000100c96cbd9f1278e1923d6000"}) r2 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='tmpfs\x00', 0x0, &(0x7f00000001c0)='grpquota') r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x1b, 0x53, 0x2f, 0x40, 0x10b8, 0x1e14, 0xdbf2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x9f, 0x0, 0x0, 0x1b, 0x25, 0xa6}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f00000008c0)={0x84, &(0x7f00000000c0)={0x0, 0x8, 0x3, "0300fe"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2d8041, 0x0) syz_emit_vhci(&(0x7f0000000280)=@HCI_EVENT_PKT={0x4, @hci_ev_simple_pair_complete={{0x36, 0x7}, {0x80}}}, 0xa) 55.896235026s ago: executing program 5 (id=2025): r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) recvmmsg(r0, &(0x7f0000004680)=[{{0x0, 0x0, &(0x7f0000001900)=[{&(0x7f0000000200)=""/96, 0x60}], 0x1}, 0x7}], 0x1, 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000dc0)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbb0180c200000386dd6d002000006488ff00000000000000000000000000000000ff0200000000000000000000000000014f194e20004d90"], 0x9e) 55.000872155s ago: executing program 5 (id=2037): r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) 54.955992029s ago: executing program 5 (id=2038): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) r3 = syz_usb_connect(0x5, 0x207, &(0x7f0000009a00)=ANY=[@ANYBLOB="12011003a9372540f30c1010db26010203010902f50101030250070904"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) syz_usb_disconnect(r3) syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x3, 0xf0, 0x4, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x4, 0xf9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x9, 0xff, 0x6, {0x7, 0x25, 0x1, 0x1, 0x5, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x3, 0x0, 0x29, {0x7, 0x25, 0x1, 0x80, 0x5, 0x3}}}}}}}]}}, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000580)={'comedi_bond\x00', [0x4f27, 0x8, 0x3, 0x1002d, 0x66, 0xcc7, 0xb, 0xa, 0x2, 0x100, 0x30009, 0x2, 0xeffeffff, 0x5, 0x0, 0x9, 0x7, 0x1a449, 0x3, 0x40020003, 0x100208d, 0xd, 0xd27, 0x5, 0x7fff, 0x3, 0x3c, 0x1, 0x2, 0x6, 0x9]}) connect$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0xb9, @local, 0x6, 0x2}, 0x20) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @private2, 0x7fffffff}, 0x1c) connect$inet6(r1, &(0x7f0000000280)={0xa, 0x4e21, 0x10001, @local, 0x7f}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x5, 0x0, 0x0) 52.808029518s ago: executing program 5 (id=2054): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) (async, rerun: 32) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) (async) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) (async, rerun: 32) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) (rerun: 32) mount$bind(&(0x7f0000000400)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) (async) mount$bind(&(0x7f0000000140)='./file0/file0\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x10a78c0, 0x0) (async) mount$bind(&(0x7f0000000180)='./file0/file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0xb101e, 0x0) (async) r1 = socket$unix(0x1, 0x2, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={0x4c, r2, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x7ff, 0x78}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}, @NL80211_ATTR_4ADDR={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) 52.804836101s ago: executing program 5 (id=2055): r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) 52.705162856s ago: executing program 5 (id=2057): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000600)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x54) syz_emit_vhci(&(0x7f00000015c0)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x3, 0x0, 0x4}}, 0x9) r1 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000500)={'dummy0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x65, r3}) syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x1, 0x2, 0x1c}, @l2cap_cid_signaling={{0x18}, [@l2cap_info_req={{0xa, 0x2, 0x2}, {0x2}}, @l2cap_create_chan_rsp={{0xd, 0x3, 0x8}, {0x53, 0x401, 0x7, 0x4}}, @l2cap_move_chan_cfm_rsp={{0x11, 0x0, 0x2}, {0x5}}]}}, 0x21) sync() 37.468705373s ago: executing program 35 (id=2057): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000600)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x54) syz_emit_vhci(&(0x7f00000015c0)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x3, 0x0, 0x4}}, 0x9) r1 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000500)={'dummy0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x65, r3}) syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x1, 0x2, 0x1c}, @l2cap_cid_signaling={{0x18}, [@l2cap_info_req={{0xa, 0x2, 0x2}, {0x2}}, @l2cap_create_chan_rsp={{0xd, 0x3, 0x8}, {0x53, 0x401, 0x7, 0x4}}, @l2cap_move_chan_cfm_rsp={{0x11, 0x0, 0x2}, {0x5}}]}}, 0x21) sync() 5.976211181s ago: executing program 7 (id=2407): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000940)={0x34, &(0x7f0000000680)=ANY=[@ANYBLOB="aa30000000b6"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000880)={0x34, &(0x7f00000006c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000004c0)={0x2c, &(0x7f0000000380)={0x0, 0x16, 0x4, "123979e0"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000080)=ANY=[@ANYRESDEC=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect$rtl8150(0x5, 0xffffffffffffff5b, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xffffffffffffff85}}]}}, 0x0) syz_usb_control_io$rtl8150(r1, &(0x7f0000000280)={0x14, &(0x7f0000000180)={0x20, 0x4, 0xa9, {0xa9, 0x0, "ef616be9fbb8efaf676c622fd7b8d10ee871a44cb971bc15c4b885e446ec1324a5cfc618ba1f5dcaf943b68d5279d78699fdd168e40b663ebf7cf5d4c37a697e93e805bc21d208b307591ac1da4f9c401c4612cc2be621258e2338091607d396a31d5a26fd21f92fe8b30638013a5c6fc6a51d8bca4e2916b1dc689a94475c77f36290fa0d70c48d651465c98cebc79ef97a895204344436e41429f29a36908f00ba152ead4305"}}, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x280a}}}, &(0x7f0000000440)={0x2c, &(0x7f00000002c0)={0x40, 0x12, 0x27, "3458530a09ba45"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x4b}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000003c0), &(0x7f0000000400)={0x40, 0x5, 0x1, "87"}}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000007c0)={0x84, &(0x7f0000000c40)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000040), 0xf7f, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000000)={0xf0f071, 0x1}) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022d000100000000090400001503000000092140000001220f000905", @ANYRES32], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00"], 0x0, 0x0, 0x0, 0x0}, 0x0) r4 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x40200) ioctl$HIDIOCGUCODE(r4, 0xc018480d, &(0x7f0000000000)={0x2, 0x100, 0x963, 0x0, 0x6, 0x5}) syz_usb_control_io(r0, 0x0, &(0x7f0000000ac0)={0x84, &(0x7f0000000100)=ANY=[@ANYRES32=r0, @ANYBLOB="48737d036981ce83221e292adadff893cc17673bb2e88c73d3f37f7cf6efdce36c81e11b58a0d5696c5ddaa4e338b4394c479ecc84c86c7d1240bdbd716a4cf6"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 5.421113354s ago: executing program 2 (id=2410): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x29, 0x19, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000600)={0x84, &(0x7f0000000940)=ANY=[@ANYBLOB="400f01"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000240)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f00000003c0)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_usb_control_io$printer(r1, &(0x7f00000005c0)={0x14, &(0x7f00000006c0)={0x40, 0x0, 0x46, {0x46, 0x30, "fd260f21784baa8e9a06ac5da4d0cde8a09f10cf515db12461a156b414ac0c415484576503445e40772b0ee06444b729505404d554fb3026b5ae4abd10231bc997606703"}}, &(0x7f0000000740)={0x0, 0x3, 0xbe, @string={0xbe, 0x3, "f4ac89420d77058a4684fb92d7fdf0c0bdafa899f62d8b7df07570c269241eede722347cb854118828e6dbb83457eb0059b895f99c39dc698f20ec65ccdb71f64666959e9ff90e3c4dfbb7a08ba7e747191a015a87640b5688f49e30e4dd362397c257d74421546f589d8dda10a098afd8aa395d8b51b6f6420a13ce389020950e218c10e1061864b49192db058340b5a9fa72aac45a9854f06a580d47e0070b187a26eae36bbacdc796632865fed1b7b501b59c5b612f3d5cfc975d"}}}, &(0x7f0000000b00)={0x34, &(0x7f0000000840)={0x0, 0x14, 0xd5, "4ccd51c9bdd388f9fadca2714303eb0612be05178f051b27a55af8803a3b2c0d9525628c5dedfc9247b6a2b006a37dddc729ba26d40872c9dfc67c2cbe3b7c061a44052e702c3140da4168db2f07dc12c26821773bd3e205dfea35bf11cd4601701c3b3bb36a79e6e3ed80b7d63a7bb1999b71d0afa62643016633f3fee30357dc318dc59b04e549af8547e213c635383010eceefdb3118517bb2861d400ed642111d503f22c8503e4cfa4f01a3ea7902f9cbe3032f0dd577c66b33cfe06f0a249b62598919c257a40d5b76ecb576c9105b23c8504"}, &(0x7f0000000980)={0x0, 0xa, 0x1, 0x6}, &(0x7f00000009c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000a00)={0x20, 0x0, 0x69, {0x67, "95b2faa489b51163a756519f1346fb655fcf1961fa1d8524cd396fd8e784183b92b7faaaee92489e71f04907dc96c22ba43fba89ab1c8f0a942ab7454a7afaba386819d122dae8b980a9002dd560f9072e306a2116fc17b336977d5fc8f1d8da708437225de60d"}}, &(0x7f0000000a80)={0x20, 0x1, 0x1, 0x8}, &(0x7f0000000ac0)={0x20, 0x0, 0x1, 0x7}}) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000000180)={0x14, &(0x7f0000000100)={0x0, 0x21, 0x4f, {0x4f, 0x21, "88198fbc1a1ba8c24cc1ec548d7225e5d2d9d84c13307cbf1b9a1fb26ebadd01e32890f4b6e594df98218fd7877ce325e463d5f145213a8d251aa0ba837fa6cb794a455bf9fcca4b3b1de66a28"}}, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000540)={0x44, &(0x7f0000000280)={0x0, 0x8, 0x44, "27ed4c10a160cf287452681eb14474cd27fbe215354e720b293efea027064d9ce10d991c36d20e4e4fe04c0d4d19d61c5221d7ff3055215044a7a4bc7adf73b43aab06ac"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0xe8}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000000400)={0x20, 0x80, 0x1c, {0xd349, 0x7ff, 0x6, 0x1, 0x3a45, 0x6, 0xbe, 0x8, 0x9, 0x1, 0x3506, 0x6}}, &(0x7f0000000440)={0x20, 0x85, 0x4, 0x3}, &(0x7f0000000480)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000004c0)={0x20, 0x87, 0x2, 0x40}, &(0x7f0000000500)={0x20, 0x89, 0x2, 0x1}}) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r4 = accept(r2, 0x0, 0x0) recvmmsg(r4, &(0x7f0000011c40)=[{{0x0, 0x0, &(0x7f00000070c0)=[{&(0x7f0000005f40)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0xc040) 3.596837485s ago: executing program 6 (id=2422): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e110b"], 0xec) 3.499691221s ago: executing program 6 (id=2423): socket$inet6(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$kcm(0x2, 0x3, 0x2) openat$cuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) mkdir(&(0x7f0000000580)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) mount$overlay(0x0, &(0x7f0000000180)='./bus\x00', &(0x7f0000000500), 0x0, &(0x7f0000000440)={[{@lowerdir={'lowerdir', 0x3d, './bus'}, 0x3a}], [], 0x2f}) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008000200", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) 3.463144566s ago: executing program 6 (id=2424): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r0, 0x29, 0xc8, 0x0, 0xc000000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000140)=0x2000) ppoll(&(0x7f0000000040)=[{r2, 0x20}], 0x1, 0x0, 0x0, 0x0) mmap$dsp(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x100000f, 0x11, r2, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000000)=0x4000) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000240)={@val={0x0, 0x86dd}, @void, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "fc0300", 0x30, 0x2c, 0x0, @local, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0xd93f, {0x4, 0x6, "001000", 0xf08, 0x11, 0xb9e02c7ea3376920, @mcast2, @dev={0xfe, 0x80, '\x00', 0x12}}}}}}}, 0x5c) 2.742040551s ago: executing program 2 (id=2428): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r0, 0x29, 0xc8, 0x0, 0xc000000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x12}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "fc0300", 0x30, 0x2c, 0x0, @local, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0xd93f, {0x4, 0x6, "001000", 0xf08, 0x11, 0xb9e02c7ea3376920, @mcast2, @dev={0xfe, 0x80, '\x00', 0x12}}}}}}}, 0x66) 2.549981035s ago: executing program 2 (id=2429): r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) recvmmsg(r0, 0x0, 0x0, 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000dc0)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbb0180c200000386dd6d002000006488ff00000000000000000000000000000000ff0200000000000000000000000000014f194e2000"], 0x9e) 2.327768974s ago: executing program 6 (id=2430): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {0x0}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) 2.302066724s ago: executing program 2 (id=2431): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e110b"], 0xec) 2.282287565s ago: executing program 6 (id=2432): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r0, 0x29, 0xc8, 0x0, 0xc000000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x12}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "fc0300", 0x30, 0x2c, 0x0, @local, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0xd93f, {0x4, 0x6, "001000", 0xf08, 0x11, 0xb9e02c7ea3376920, @mcast2, @dev={0xfe, 0x80, '\x00', 0x12}}}}}}}, 0x66) (fail_nth: 1) 2.281904808s ago: executing program 7 (id=2433): r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) recvmmsg(r0, &(0x7f0000004680)=[{{0x0, 0x0, &(0x7f0000001900)=[{&(0x7f0000000200)=""/96, 0x60}], 0x1}, 0x7}], 0x1, 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, 0x0, 0x9e) 1.93868205s ago: executing program 2 (id=2434): r0 = socket(0xa, 0x5, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80001, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000100)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x0) r6 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x4, 0x3, 0x3}, 0x10) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f00000001c0)=0x69, 0x4) ioctl$FBIOPUT_VSCREENINFO(r7, 0x4601, &(0x7f0000000040)={0x60, 0xa0, 0x0, 0x320, 0x0, 0x0, 0x0, 0x0, {0x10, 0x8}}) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r5, 0xc0145401, &(0x7f0000000280)={0x3, 0x0, 0x0, 0x0, 0x7fffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000140)={"47828e6e252ca43f81eb53a61af401f64a37752dff48f13896f915609ec0cfe7", r3}) ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f0000000180)={"2486910284ed923431d4c5d5fbf514fd00", r4}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 1.811586233s ago: executing program 2 (id=2435): r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(0x0, 0x20000007d, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) accept4(0xffffffffffffffff, 0x0, &(0x7f00000004c0), 0x80000) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0x8, {"516a636913c205f8712f20d3d82796ca7b6c5427b012478fbe84b5b710dc22d71edf28d4a0907e08ac9f7de051413c707c881cd6a11169c04b387f7befe4952becf1afdd554a5f56a183f87bb948c6c6af99a9a82c0ebc2162a9a0e4b4dd66fb76c39a210942a0c177eae66fbcd71f5e6b833911f648ad4c1cf6e6e4f40f5f62ff5b8f0c2838613f6e3e0b446b758ccf02c1bd32d777507f14a923267b42d206f18faa331fb3cffad779dc838d8cb6df6120617961217eaf5a9a35adf67a752837750216d3cd5c778c0c7da7e3d521d4167d80879090954f84e48fcfbb3473189ef802b0c64cf13ad5e6ef19781e5cd265791a1892289f74c0c6c7cefab6c62e0216b410d46fa1292f8e349840a9856fdb12a87cad131fed709e1f3f702d0074fb7be4d6c0be3278ef69379a378bab7fcb7c0bc44b14aff6ad7b414f79ece1df291d1ba0fc00d568de6d964cfc8a261226c5bb91c4639bfee19a4f41d8dd1bd52b2bd20cfa6424cf543e22dda8e405ec3f9ae4650bcf86d6e2759484756768ae962cac7be2c4e158ce701a66aa8088ce4da3d0ed497fa55bb94404decc34ad8f4c44f8f85ebf4fcb3e65e77af2331d37c45e050e57ad87619438e1189941fdfa09977e7645eb29b482f558efc44fe78320d306a82925e4a5d2c01148a6c37385cd5c9837dea0eae650f503d810ecf0bdca6390b1639a1d993c790e07204e6f0d2d067dd863ade190c1be168c776b8b7095188c0cecbbf0301199787206a7d1b1dba4fb4445182feb6e4dde3bec055fc0cedbad6523762b7fc1a1f5cb30752709a8f682dd9aa16509f43ba933eb8009b716ebaf1a729a946ff699a240ff7004777d892fcf53c95b0c2e026e28696ea896428053821e41f3e3530af633b9cabc23cb676f85f689d732765f56e5c6b2d8e537b3034d8c4b852c904deb0a4a3fab74c0fd812537a9d547deb1bfbe2692fb5d29f5ec25071be1b175de499c58582e94fa5f7f0e51f86efe4b7ba89eefb9a0697e43a974bef33745ab69d94cfe23b2e7dfb0e02ee18b6552e3dd047cbd329376468b8e70af2f20fe90731c7e1ae2f2e24c7496af653394f41218fd9b94d72ed02d8e80def9e15c3b2af66c0d07ed93c2e6982f60d949337c3c8f405b48277ce82e5b2c8bd4da67b3cffd1c99705f1dfeb9d08b74b114b00066b1ba6de98c478c82c30f1406391525cfbc0aa3e9b2ae0bcdcafb838914c4c3fd2b31e3ea85dfdf8a2506dde272b7ccab4e41de556ae2a3122657144051bae34d8aa42dbe654a87a0d72bbb99a58085aeb8aed0d2a79202025254ff4d62b36499279ae8947152d23a7c8e4589d2a8b7e22ef3979b41682788fb01e6892bea35f098bcf2805e456d2fdfc58bddd7ce5074e0001d06586737952abe8b39a04b06b5c6cf84cc87f2ff8aaf9d2aae86e61e97e7bbd1b16bc2dfba3f83ed2ffffb5f6378ee0eb1381ab7405282ee5dec94292cf43196dd92d13868ac05c6ca2295df3183e6305def71b496ec405885beee053d4ed7e71ebcad4945c7930a2cbec1b7a9d3d52d85601de8614982ee0eceaded7a74b9dbbb589a7492ff9b72c1e7cad6e4e649810f742244245ad7e83f7a44d65c769e388abb37bb84856a4bf5115e261a898a2de4b52ab07fbf8c7a8a6bd17c854256d5a2e56ef27e23b5c65cffae74c157eb9a50db5ea8edb26cc69ae1d1aafd3c689a5898e9d05b694be20fe5dfd7b950565d0643d8aaa7db7e20287d0f3d3fe6cb75bc3c8211d59e65bb14b50944b0cac5c6d0de3e9eea98774bd7bfccdc54a0d01ac478fbb2fc0cd5d5d384cec4d056a6e163adc8ecd4a6648b0811b0703ead144767e0cc1517c060d3e6ccebe0a5d592214f7efb507b1121c3b9016740480bcfe5530fd65064761a22e3eb11d2e242cb951ab132f3d4d437433a4cbd512bc551f00f7842695cf8f9e822a3c3c00678104eb2ea29c80313de94531e23f4cd50f4506fa33609dd53bab13272f781659dd1e75f06a46617b0103e265cc52e233623fa8d02b3e4810b343e8e3b6c372d3fb03f62ea71f0b58d38bb0071257e31cbfad44cffe72b73e936f6db5ea5cfd62e1f521f387873f662462e55c6b28a25fb2facc7e9e7ead1feefbf72e2615cc8e41389da06c423e90159ff60953bb8fd5f9b976d62e040f13f98c5ad8b236604ee88658b174a352e8b515ea87c3bb0f2c3ee4123ccd451e8d68deeb7f246a109fa9f94a5ad4efbf5dc4b3eabb51d60c0a5f2997ab7b5917a3a9d5a6405081c07178f9c6c460e610002a1c9a8c909a8ba9e137c00dc91ec3258c1674235ac21ca19d40328293082bbdfe657d5b6cdf0b5370eeee08422917408d9a8b6e8fd5478b380513fe057cdf51eab406f217834cf3c85efa30c50e92daabb3cfde8146e01f964a95aaaea152e04fa420d3c29e7ace71b6c98fc5e04f050fffaa3ca4809657a4d0a496f440c864ad175711f3402457567a90e56f4fcf860ae3c40b4edcc14af291462f29a67aa5d797a2b435ee69f1eb9b66f49f942469ec7b6ff0f0afc0fe8f9eb73cc0acdf35e0632a77f3620a26c88e1fe74e7a69f7a6e61448753f5004920f585fb767c2c66f7b66bc6308588d4705cd127be239a5a985ff4b5facd2b856cc377b856a02af285741a30e15cbdd731541467f80b6dd5d7754d778edaff6080772ac9c9669297e3c978f3a5eacede603ce4f43e47421cb3cd23c09672c548595e6cdcd49ea395cc93aa1e29465f4799d4611631bc4310408f2b81f35a769ad29fa1d50024bd64edf589ba39403453e973229c14470e28ed1ce6d0fd2f5fbc35cd56c2c46218cfe45218c7bf16595acabcad8078215f40fb03e868a09a9f165cc6b0b2bd0bad099ed49905e3110238aab61616d61c72de9b07b6977b8c254f5e1ca0e139aecf7e5ac728248e3bc80abd45eb5bf87db72955e1914c4e0d4fc2bfa71a77e7de09e6a8c328f61279f130f6e8de6ce6477b1c256998cc23f86a9c5e4a62954aa725f45af8f4306df72cc61cd92558f848e0c2b832003e97e64a463dbd6b5f9d2797bf3380f18827819deea2a443ff1ab13c20859bbcbf94aee46d7306ea32f034248d5b5e8240215618b8e1d316226e4fd840f03198b23b315eefe3051a6f7731bee5d9e8583529adf98917d27c32c1327d7ecc302a35db045a0957129d521fd026f57fc2d2b3c1b2666eab16527853396bf1789b3b161c37c9d9ac0a9c054d6e3f0b816b25609c6fd62406ffd3009ceab568469bbcad74e40a66e10461012c04206d21a844df7f277341bcf719ffe62afece78fe92702df3b5151407b42f677ec7889fc601c64e9482b66ccdfe0e73df3eb722e87815c227281a4458da78d390a5f49751adf7b3c3172452ce935bd79146edaa5907ff2d7cdf25b290a53026eca6e6f560b1375f3a53d2283b3153063da105207708447e28cbbee327a0ba7b471734d6f161ec451d8354c9452ea9568a8ebced4f137c0d4cdc847b598b6cc398425eb50a617a0ef9088f43f86d137be406965a2760e70f290e7901419c459854c961484423d020aae2bb453b06dc9a61ecdac2a282682686fbc0cc18f32716f7ce388523b9655d7c7f63ae0d20cec1917e7f9aacec18bb120aa9c4a8d5d325594fa35ecf56f6eea838f4da04a175483a2c0d890879410edee4a90e12b9de62fefae32091c55186864e80d1c2872c51c6bec38c882ea160eeabde7d1c80bb1a21e9dd8bbbed5b26c55fd3d15b6fb194466f41fc4ee82884d8137640f3afcd0aa60fa1b4d37d963af5869c6b9deb9daddd15fbc786ac0044aefc127a43b318310f2349c9486d1abd6f58c1a6c1938601f7633d9d6fbd85e5afb9e29f2cda79507b7fe9b4e28080733a12f85ea1b184b4a35bfa91b548f961593f464cae580a3a12a33a164baf8768ad17b01d4440b6f6d5744ffc0403b87f051756c12f6ef710beef483845e2a4bf3f3fdc93e23a6176ef37be691dd6f596bb6b6268c87d98ff80765868f3e216c6b49c217b40db9706a2d81bd3890532fa48b18f067856c0466f30acd05cbb3bf4754c8fc0618b0d17cef0727f5ba7e1895060fb8b6ec7d59b91d2402eb1e8cb113713b2de511d1ca6cf8a2f7948696140312c41d7325c9bb6b5b391e9412d6850f81acf6d59f395f80974889f4744aa8aef0b9ba41fcd521c7566b5c2c84cfb95c66568e0785126f86fc64632415d3042e68a9d1a813a6717a6ecfb8e4b667049fcd30cb03388b20a97682a43bce1adfd5360c48904d1d8705b89505a43eda733b42b68827e025e47dc17c3b21f902eb0336cfad7bdfebcfd0e094b405ef048d5025ae19befd8c4819f7adc974cc1f0f09bc4ba361f4ffef9b84decc9cb98e5ee9f4baf5bd5dcf97c0517d07fc8daf23fd42e9e62188573ebd0042060f75926dcdd03f7cb0d54f0223249f34e53c5e2c2f03619a7b388a204e506759539c0045e08b30e08ac3d88661a106cec1acaa4dd1ce0d75ab4254276f573e8fecf3f580a7825064579a8a5d6e3c33d9963833c4634a128e227375594f2ed95196599ca31d870dd5d2b4c1f19db39f23df06aade940a5e38561346b48e14c52021f9c84f5a1ba5bf88933cfae87e7e8497773eb495c7313ff5f0193591a381dfdc1521ba284f0cb6274a27fb5855750d60743315630c7a5ab3597336e6b25e00c20394e9e08f412bc6b4400b4614ca7bafee4d6f88ee4fa0e7669294001892fbf17cc352b0394225be7a304a154b3dea211c4f93e2ee5985eb3e0160b203f2d1c2f5042a056844ce2a3ce7c496020002564afd82bf434c526390465af117a823831f7842201ccc9fce215fe913ca46f936b2e56bfca6b1cd786443c09dd727960cf3090597a3d5c18354b2ce54e11477104013aa0bb082c7e9c39ee15068f9399559e77b293c462896d354f2384646cf0c047221b91d3fb4c2401e7b0ec1b67a426bb7ce4fdf28435a27dda3bd211c59b6b81dcb521e3918d5525e9846118d12977dfc3e3632ce16df2f5f99ccda2d765416cdc0bae1f94eb2fc7bef41b3a19192302d8f7bc98a81efd5c90a235b157226a507c3528a50f94f7d25ba7a05cdbf2216f2dd2cb9a942d972873c1a92bcceca0c5c9898bc81d272dbf13602ba40e228fb9f8ae69966716601228f323e4f24cac5e00750c515c0ae160cc8a53ab605f16ac84db86d6cfb5fffe86042aee12cefa21e720e6bc02e84ce00eb7df296d3b2b501cf50b79c6f2b37fc14220aef2423ac270658818a0749da937fde96f713ecb2bdd18a4b2d33ad38c5b215ff9dde65e376068e8ad6c16120f3a342af9faa5b1c5a52acfa0dca889ad6801c15908826eca9998c4d54c385be5f3d0afbb0f95dac48c55db27280b35fafbcd489fb135acb326f7858c0e09a4488aec8a63bb3cfe0c9db57c8b7dc0384fe1992e0e780983d1ec199da01e095269a472ef87b477beee451eef839e99c7c681e28f89a652660cb98946df9af42f2a818df9c7288d3fbc674e79572a92c9ac7599b77c7b1565c10f28750f429cad9380931804f01286fafc096a1f0ec74ee2142dd6fa665f43eca512bf80e4451e293e888e5aad2a9b304cebb40818ea8c5082636bbecc7fff258f4bdba3d87ad2ca8ae1814eca22927c62c6ead5fb434219f2971dea94d6eda456d24c6ad90d3f383c6d9ce1310edee3596234b2a94e2b10a177d99a8c66d408856f96ec7862ecc5b645743ab9d7b2ff2414d521ed818387cb42e2f72c14961464475e07a6c4442410015cdb3806d42466babce7167c3ef36c0f51", 0x1000}}, 0x1006) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000240)={0x24, &(0x7f0000000480)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x20, 0x0, 0x4, {0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000640)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x4, {0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bind$alg(0xffffffffffffffff, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000140), 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r4 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r4, 0xc0184800, &(0x7f0000000100)={0x4}) setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x4}, 0x8) syz_usb_connect$cdc_ecm(0x0, 0x5a, 0x0, 0x0) semtimedop(0x0, &(0x7f0000000140), 0x0, &(0x7f0000000240)={0x0, 0x3938700}) dup3(r0, r1, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) 1.753510049s ago: executing program 6 (id=2436): ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x9, 0x10010, r0, 0xc622e000) ioctl$KDGKBMODE(r0, 0x4b44, &(0x7f0000000040)) syz_usb_connect$uac1(0x2, 0x99, &(0x7f00000000c0)=ANY=[@ANYBLOB="12014d2c6fabcb2374e526f21deb0000000000106b1d01004000010203010902870003010000040904000000010100cbf979000a000904010000010200000904010101010200000c2402015c040503161ee5e1090501092000ff080a07250180130800090402000001020000090402f203bd023cc15440a8290724010000021009050725010000000000000000000000006d4660aae58e4a"], 0x0) 1.175586547s ago: executing program 7 (id=2439): r0 = landlock_create_ruleset(&(0x7f0000000240)={0x8010, 0x3}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) (async) r1 = fsopen(&(0x7f0000000080)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETVESABLANK(r2, 0x541c, &(0x7f0000000000)) (async) fsmount(r1, 0x0, 0xf) fsconfig$FSCONFIG_CMD_RECONFIGURE(r1, 0x7, 0x0, 0x0, 0x0) (async) syz_usb_ep_write$ath9k_ep2(0xffffffffffffffff, 0x83, 0x6a, &(0x7f0000000140)=@generic={0x1, 0x0, 0x62, "faff02ff", "10e56bb4b9d6d5d14ba074108f7f6d5692adbd8c1e71c732c135b72d0fb045ab33fb59d63fc0452c8dcf73f2e6040048a204c690fc1d1323dde5a6e31e1cdfc287df23f82de7cc96747bf6aec33e56ac0dfe9d070679dadb375f34cfb5483ddcf1b9"}) 956.420562ms ago: executing program 3 (id=2441): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0) sendmsg$NFC_CMD_DEV_UP(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010426bd7000f8dbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x800000000000000}, 0x4008054) 898.920873ms ago: executing program 3 (id=2442): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) 845.182085ms ago: executing program 3 (id=2443): fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000800030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0xc4}, 0x890) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000780)="86ca2a16fe5180f6bafb367fbfaeb7bd377d1170d68d553f9c9410e659dcd55247def2c714abd25da699246aa2572436da2b8b4ab57133f6105c9ff092575369318865cb4c5fbc85e0e966b9f56d3cc6ef68d0eca7e7207cfe0b35e51fa72113d44a2432cbb2971a18f68635dc5962d1312cf9b464ca81ff8dab3a49b840309ad90f6abd7ff2d8e5ef4aff817c886c1aaef6bcb547a7cb00629b700c871f90e70e7526127f228a0b917622911b8690227a9591dae66623ade7b85e721fc1fbcca8a7221e335c3221e08d3455bf24ccc3501a901837db9ace9d7ea19827e12a6f505f16bd932f2ae5e3c2c3fcf2760dfbe3e2ccca118b6085c3b4bc", 0xfb) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x4b564d07}]}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {0x0}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 768.86102ms ago: executing program 3 (id=2444): openat$dir(0xffffffffffffff9c, 0x0, 0x4200, 0x1c0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043e110b"], 0xec) 671.569931ms ago: executing program 3 (id=2445): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010000000004000000003f00000008000300", @ANYRES32=r1, @ANYBLOB="134662f37105b2debea76feaccc909f0f2c348badcdb9ac4cdb5d0cebbad06a02fa88d693c221f3151d4cceefdfc7a5c92b32cdf1550c0c04f1690"], 0x1c}}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c000000020605000a0005b38290f90e9ab40000100003006269746d61703a706f72740005000400000000000900020073797a30000000000500050003000000050001000600000014000780060004400004000006000540"], 0x5c}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0xb, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x9}]}]}, 0x34}}, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f00000003c0)={0x1, 0x0, [{0x26b, 0x0, 0xff}]}) mount$bpf(0x0, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080), 0x80, &(0x7f0000000240)={[{@gid}]}) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x260081, 0x0) fcntl$getflags(r9, 0x3) close(r8) socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x3}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet(0x2, 0x3, 0x33) r12 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mreqsrc(r12, 0x0, 0x53, &(0x7f00000001c0)={@dev, @local, @broadcast}, &(0x7f0000000200)=0xffffffffffffff34) ioctl$SIOCSIFHWADDR(r8, 0x8b32, &(0x7f0000000000)={'virt_wifi0\x00', @broadcast}) r13 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400), r10) sendmsg$IPVS_CMD_NEW_DEST(r11, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x70, r13, 0x10, 0x70bd26, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6abc}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@dev={0xfe, 0x80, '\x00', 0x2f}}]}, @IPVS_CMD_ATTR_SERVICE={0x4}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8001}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}]}, 0x70}, 0x1, 0x0, 0x0, 0x1}, 0x10) sendmsg$IPSET_CMD_ADD(r8, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000280)={0xc4, 0x9, 0x6, 0x101, 0x0, 0x0, {0x5}, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x9}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x4}]}, @IPSET_ATTR_DATA={0x4c, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x2}, @IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @mcast1}}, @IPSET_ATTR_PACKETS={0xc, 0x19, 0x1, 0x0, 0x9}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x8}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x8000}, @IPSET_ATTR_BYTES={0xc, 0x18, 0x1, 0x0, 0x4}]}, @IPSET_ATTR_ADT={0x48, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x80}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBPRIO={0x8, 0x1c, 0x1, 0x0, 0x1000}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e23}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_BYTES={0xc, 0x18, 0x1, 0x0, 0xe9b}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_NAME={0x9, 0x12, 'syz0\x00'}}]}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x4}]}, 0xc4}, 0x1, 0x0, 0x0, 0x4040884}, 0x40) 597.806781ms ago: executing program 7 (id=2446): r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x400080) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) r2 = dup3(r0, r1, 0x0) ioctl$MON_IOCG_STATS(r2, 0xc0109207, &(0x7f00000001c0)) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r2) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x70, r3, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x7ac}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast2}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x100}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x7}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x70}}, 0x0) 496.659429ms ago: executing program 3 (id=2447): r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) recvmmsg(r0, &(0x7f0000004680)=[{{0x0, 0x0, &(0x7f0000001900)=[{&(0x7f0000000200)=""/96, 0x60}], 0x1}, 0x7}], 0x1, 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, 0x0, 0x9e) 263.689µs ago: executing program 7 (id=2448): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000200)=0x1, 0x4) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000400)={{{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x0, 0x0, 0x2, 0x120, 0x20}, {0xffffffff80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {0x0, 0x0, 0xfffffffffffffff1}, 0x0, 0x0, 0x1}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0x6c}, 0x0, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}, 0xe8) connect$inet(r0, &(0x7f0000000000)={0x2, 0x2000, @local}, 0x10) 0s ago: executing program 7 (id=2449): r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) recvmmsg(r0, 0x0, 0x0, 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000dc0)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbb0180c200000386dd6d002000006488ff00000000000000000000000000000000ff0200000000000000000000000000014f194e20004d"], 0x9e) kernel console output (not intermixed with test programs): : unexpected cc 0x0c38 length: 249 > 2 [ 232.800724][ T9216] chnl_net:caif_netlink_parms(): no params data found [ 232.902095][ T9216] bridge0: port 1(bridge_slave_0) entered blocking state [ 232.909735][ T9216] bridge0: port 1(bridge_slave_0) entered disabled state [ 232.916993][ T9216] bridge_slave_0: entered allmulticast mode [ 232.924795][ T9216] bridge_slave_0: entered promiscuous mode [ 232.933407][ T9216] bridge0: port 2(bridge_slave_1) entered blocking state [ 232.942090][ T9216] bridge0: port 2(bridge_slave_1) entered disabled state [ 232.951577][ T9216] bridge_slave_1: entered allmulticast mode [ 232.959339][ T9216] bridge_slave_1: entered promiscuous mode [ 232.999809][ T9216] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 233.012501][ T9216] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 233.051346][ T9216] team0: Port device team_slave_0 added [ 233.063190][ T9216] team0: Port device team_slave_1 added [ 233.093775][ T9216] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 233.102599][ T9216] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 233.128774][ T9216] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 233.141720][ T9216] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 233.149198][ T9216] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 233.175950][ T9216] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 233.232196][ T9216] hsr_slave_0: entered promiscuous mode [ 233.239042][ T9216] hsr_slave_1: entered promiscuous mode [ 233.245632][ T9216] debugfs: 'hsr0' already exists in 'hsr' [ 233.251559][ T9216] Cannot create hsr debugfs directory [ 233.695052][ T9216] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 233.735030][ T9216] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 233.775093][ T9216] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 233.786986][ T9216] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 233.951791][ T9216] 8021q: adding VLAN 0 to HW filter on device bond0 [ 233.983344][ T9216] 8021q: adding VLAN 0 to HW filter on device team0 [ 234.006005][ T1928] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.013283][ T1928] bridge0: port 1(bridge_slave_0) entered forwarding state [ 234.037059][ T65] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.044623][ T65] bridge0: port 2(bridge_slave_1) entered forwarding state [ 234.215143][ T9261] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 234.231531][ T9261] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 234.254295][ T9261] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 234.263926][ T9261] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 234.352093][ T9262] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1314'. [ 234.363434][ T9264] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1314'. [ 234.537904][ T51] Bluetooth: hci6: command tx timeout [ 234.847405][ T9216] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 235.076166][ T9287] overlayfs: failed to clone upperpath [ 235.525897][ T24] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 235.613212][ T9216] veth0_vlan: entered promiscuous mode [ 235.641168][ T9216] veth1_vlan: entered promiscuous mode [ 235.697861][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 235.709041][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 223, changing to 11 [ 235.736572][ T9216] veth0_macvtap: entered promiscuous mode [ 235.756961][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 42636, setting to 1024 [ 235.783126][ T9216] veth1_macvtap: entered promiscuous mode [ 235.789454][ T24] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 235.822445][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 235.843843][ T9216] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 235.860641][ T24] usb 6-1: config 0 descriptor?? [ 235.879741][ T9290] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 235.890632][ T24] hub 6-1:0.0: USB hub found [ 235.943401][ T9216] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 235.987889][ T13] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 236.005371][ T13] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 236.043626][ T13] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 236.061088][ T13] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 236.081357][ T9304] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1327'. [ 236.093787][ T24] hub 6-1:0.0: 1 port detected [ 236.094913][ T9304] xt_policy: neither incoming nor outgoing policy selected [ 236.240586][ T135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 236.262449][ T135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 236.317264][ T65] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 236.328333][ T65] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 236.618190][ T51] Bluetooth: hci6: command tx timeout [ 236.699819][ T9290] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 236.748860][ T9290] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 236.803108][ T24] hub 6-1:0.0: hub_ext_port_status failed (err = -71) [ 236.821562][ T13] usb 6-1: Failed to suspend device, error -71 [ 236.829386][ T5881] usb 6-1: USB disconnect, device number 10 [ 237.076024][ T51] Bluetooth: hci6: ACL packet too small [ 238.020167][ T9357] trusted_key: syz.2.1344 sent an empty control message without MSG_MORE. [ 238.408945][ T9376] tipc: Enabling of bearer rejected, failed to enable media [ 238.697827][ T51] Bluetooth: hci6: command tx timeout [ 238.793135][ T5812] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 238.963293][ T5812] usb 7-1: config 0 has an invalid interface number: 117 but max is 0 [ 238.972315][ T5812] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 238.983614][ T5812] usb 7-1: config 0 has no interface number 0 [ 238.991355][ T5812] usb 7-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 239.001927][ T5812] usb 7-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 239.032151][ T5812] usb 7-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 239.045047][ T5812] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.067980][ T5812] usb 7-1: Product: syz [ 239.072247][ T5812] usb 7-1: Manufacturer: syz [ 239.077051][ T5812] usb 7-1: SerialNumber: syz [ 239.143417][ T5812] usb 7-1: config 0 descriptor?? [ 239.257231][ T9409] tipc: Started in network mode [ 239.274643][ T9409] tipc: Node identity 32278d80ce9e, cluster identity 4711 [ 239.284058][ T9409] tipc: Enabled bearer , priority 0 [ 239.475153][ T9409] syzkaller0: entered promiscuous mode [ 239.481527][ T9409] syzkaller0: entered allmulticast mode [ 239.490319][ T9409] tipc: Resetting bearer [ 239.568683][ T1304] tipc: Resetting bearer [ 239.576528][ T9408] tipc: Resetting bearer [ 239.735572][ T5812] usbtouchscreen 7-1:0.117: probe with driver usbtouchscreen failed with error -71 [ 239.759376][ T5812] usb 7-1: USB disconnect, device number 2 [ 240.789065][ T51] Bluetooth: hci6: command tx timeout [ 241.001961][ T9450] befs: (nbd6): No write support. Marking filesystem read-only [ 241.892011][ T9463] tmpfs: Unknown parameter 'smackfstransmute' [ 242.385425][ T9408] tipc: Disabling bearer [ 242.397024][ T24] tipc: Node number set to 4240018816 [ 242.405000][ T9451] mac80211_hwsim hwsim6 syzkaller1: left promiscuous mode [ 242.412539][ T9451] mac80211_hwsim hwsim6 syzkaller1: left allmulticast mode [ 242.762354][ T9477] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 243.940609][ T9501] tipc: Started in network mode [ 243.946190][ T9501] tipc: Node identity c60c4358b3a6, cluster identity 4711 [ 243.956271][ T9501] tipc: Enabled bearer , priority 0 [ 244.052442][ T9507] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1398'. [ 244.072476][ T9507] netlink: 5204 bytes leftover after parsing attributes in process `syz.2.1398'. [ 244.113681][ T9508] 9p: Bad value for 'wfdno' [ 244.300887][ T9501] syzkaller0: entered promiscuous mode [ 244.306619][ T9501] syzkaller0: entered allmulticast mode [ 244.315003][ T9501] tipc: Resetting bearer [ 244.429098][ T9342] tipc: Resetting bearer [ 244.436085][ T9500] tipc: Resetting bearer [ 244.805389][ T9517] program syz.5.1402 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 247.004586][ T9575] fuse: Bad value for 'fd' [ 247.124234][ T9500] tipc: Disabling bearer [ 247.154821][ T24] tipc: Node number set to 1974092632 [ 247.728516][ T9603] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1437'. [ 247.751963][ T9603] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1437'. [ 248.101503][ T5812] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 248.277760][ T5812] usb 6-1: Using ep0 maxpacket: 16 [ 248.288274][ T5812] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 129, using maximum allowed: 30 [ 248.308495][ T5812] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 248.319786][ T5812] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 248.333185][ T5812] usb 6-1: New USB device found, idVendor=0757, idProduct=0a00, bcdDevice= 0.00 [ 248.342802][ T5812] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 248.354448][ T5812] usb 6-1: config 0 descriptor?? [ 248.877094][ T9607] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 248.890225][ T9607] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 248.915843][ T5812] usbhid 6-1:0.0: can't add hid device: -71 [ 248.923840][ T5812] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 248.936099][ T5812] usb 6-1: USB disconnect, device number 11 [ 249.133532][ T9630] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1446'. [ 249.146093][ T9630] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1446'. [ 249.374936][ T9633] fuse: Bad value for 'fd' [ 249.400696][ T9634] pim6reg1: entered promiscuous mode [ 249.406246][ T9634] pim6reg1: entered allmulticast mode [ 250.526369][ T9659] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1456'. [ 250.539633][ T9659] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1456'. [ 250.877814][ T5812] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 251.027945][ T5812] usb 7-1: Using ep0 maxpacket: 16 [ 251.035622][ T5812] usb 7-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 251.048235][ T5812] usb 7-1: config 0 interface 0 has no altsetting 0 [ 251.055070][ T5812] usb 7-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 251.065146][ T5812] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.076993][ T5812] usb 7-1: config 0 descriptor?? [ 251.157345][ T9674] pim6reg1: entered promiscuous mode [ 251.163002][ T9674] pim6reg1: entered allmulticast mode [ 251.538993][ T5812] nzxt-smart2 0003:1E71:2009.0004: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.6-1/input0 [ 251.667091][ T9692] netlink: 17780 bytes leftover after parsing attributes in process `syz.5.1470'. [ 252.096966][ T9714] xt_cluster: you have exceeded the maximum number of cluster nodes (37482740 > 32) [ 252.220365][ T29] usb 7-1: USB disconnect, device number 3 [ 253.581999][ T5812] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 253.768520][ T5812] usb 6-1: Using ep0 maxpacket: 16 [ 253.775559][ T5812] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 253.789125][ T5812] usb 6-1: config 0 interface 0 has no altsetting 0 [ 253.796908][ T5812] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 253.807118][ T5812] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 253.823379][ T5812] usb 6-1: config 0 descriptor?? [ 254.267754][ T5812] nzxt-smart2 0003:1E71:2009.0005: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.5-1/input0 [ 254.905265][ T5812] usb 6-1: USB disconnect, device number 12 [ 255.459265][ T9854] netlink: 'syz.3.1531': attribute type 10 has an invalid length. [ 255.514929][ T9854] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 255.586655][ T9854] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1531'. [ 256.234886][ T9865] syzkaller0: entered promiscuous mode [ 256.240663][ T9865] syzkaller0: entered allmulticast mode [ 256.618046][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 256.837874][ T24] usb 6-1: new full-speed USB device number 13 using dummy_hcd [ 256.987874][ T24] usb 6-1: device descriptor read/64, error -71 [ 257.239213][ T24] usb 6-1: new full-speed USB device number 14 using dummy_hcd [ 257.378921][ T24] usb 6-1: device descriptor read/64, error -71 [ 257.490001][ T24] usb usb6-port1: attempt power cycle [ 257.828012][ T24] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 257.858926][ T24] usb 6-1: device descriptor read/8, error -71 [ 258.099638][ T24] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 258.140822][ T24] usb 6-1: device descriptor read/8, error -71 [ 258.250926][ T24] usb usb6-port1: unable to enumerate USB device [ 258.617847][ T5848] Bluetooth: hci5: command tx timeout [ 259.546451][ T5812] kernel read not supported for file /vcs (pid: 5812 comm: kworker/0:3) [ 260.120259][ T9935] syzkaller0: entered promiscuous mode [ 260.126062][ T9935] syzkaller0: entered allmulticast mode [ 260.206299][ T9946] netlink: 'syz.2.1561': attribute type 20 has an invalid length. [ 260.221100][ T9947] netlink: 'syz.2.1561': attribute type 20 has an invalid length. [ 261.085491][ T9961] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 261.094322][ T9961] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 261.113413][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 261.557793][ T24] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 261.700814][ T24] usb 6-1: device descriptor read/64, error -71 [ 261.957842][ T24] usb 6-1: new full-speed USB device number 18 using dummy_hcd [ 262.097843][ T24] usb 6-1: device descriptor read/64, error -71 [ 262.211296][ T24] usb usb6-port1: attempt power cycle [ 262.558262][ T24] usb 6-1: new full-speed USB device number 19 using dummy_hcd [ 262.591824][ T24] usb 6-1: device descriptor read/8, error -71 [ 262.847788][ T24] usb 6-1: new full-speed USB device number 20 using dummy_hcd [ 262.868522][ T24] usb 6-1: device descriptor read/8, error -71 [ 262.979326][ T24] usb usb6-port1: unable to enumerate USB device [ 263.338398][ T5848] Bluetooth: hci5: command tx timeout [ 264.757812][ T24] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 264.908004][ T24] usb 7-1: Using ep0 maxpacket: 32 [ 264.924709][ T24] usb 7-1: unable to get BOS descriptor or descriptor too short [ 264.937180][ T24] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 264.948732][ T24] usb 7-1: can't read configurations, error -71 [ 265.664975][ T30] audit: type=1326 audit(1769177640.846:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9990 comm="syz.2.1575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9539d9acb9 code=0x7fc00000 [ 266.655290][T10080] netlink: 'syz.6.1610': attribute type 1 has an invalid length. [ 266.667975][T10080] netlink: 'syz.6.1610': attribute type 2 has an invalid length. [ 266.858799][ T5848] Bluetooth: hci1: command 0x0406 tx timeout [ 267.337872][ T5812] usb 7-1: new full-speed USB device number 6 using dummy_hcd [ 267.357971][ T9] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 267.467944][ T5812] usb 7-1: device descriptor read/64, error -71 [ 267.509631][ T9] usb 6-1: config index 0 descriptor too short (expected 39, got 27) [ 267.517985][ T9] usb 6-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 267.528346][ T9] usb 6-1: config 0 interface 0 has no altsetting 0 [ 267.537478][ T9] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 267.547918][ T9] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 267.556169][ T9] usb 6-1: Product: syz [ 267.560803][ T9] usb 6-1: Manufacturer: syz [ 267.565519][ T9] usb 6-1: SerialNumber: syz [ 267.573470][ T9] usb 6-1: config 0 descriptor?? [ 267.588790][ T9] hub 6-1:0.0: bad descriptor, ignoring hub [ 267.595266][ T9] hub 6-1:0.0: probe with driver hub failed with error -5 [ 267.610133][ T9] usb 6-1: selecting invalid altsetting 0 [ 267.708261][ T5812] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 267.863916][T10113] No source specified [ 267.878196][ T5812] usb 7-1: device descriptor read/64, error -71 [ 267.895230][T10110] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1620'. [ 267.998171][ T5812] usb usb7-port1: attempt power cycle [ 268.057828][ T5848] Bluetooth: hci2: command 0x0406 tx timeout [ 268.347918][ T5812] usb 7-1: new full-speed USB device number 8 using dummy_hcd [ 268.378505][ T5812] usb 7-1: device descriptor read/8, error -71 [ 268.509417][T10102] usb 6-1: reset high-speed USB device number 21 using dummy_hcd [ 268.618482][ T5812] usb 7-1: new full-speed USB device number 9 using dummy_hcd [ 268.658586][ T5812] usb 7-1: device descriptor read/8, error -71 [ 268.778599][ T5812] usb usb7-port1: unable to enumerate USB device [ 269.097883][ T5848] Bluetooth: hci6: command tx timeout [ 269.430621][T10112] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 269.442196][T10112] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.459679][T10112] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 269.473965][T10112] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 270.132793][T10141] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1630'. [ 270.458212][ T24] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 270.492586][T10151] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 270.544917][ T9] usb 6-1: USB disconnect, device number 21 [ 270.624184][ T24] usb 7-1: config 0 has an invalid interface number: 117 but max is 0 [ 270.646344][ T24] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 270.668092][ T24] usb 7-1: config 0 has no interface number 0 [ 270.678010][ T24] usb 7-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 270.704465][ T24] usb 7-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 270.758457][ T24] usb 7-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 270.779891][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 270.803951][ T24] usb 7-1: Product: syz [ 270.812906][ T24] usb 7-1: Manufacturer: syz [ 270.820166][ T24] usb 7-1: SerialNumber: syz [ 270.840990][ T24] usb 7-1: config 0 descriptor?? [ 271.025002][T10169] netlink: set zone limit has 4 unknown bytes [ 271.068057][ T9] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 271.217797][ T9] usb 6-1: device descriptor read/64, error -71 [ 271.270570][ T24] usbtouchscreen 7-1:0.117: probe with driver usbtouchscreen failed with error -71 [ 271.298764][ T24] usb 7-1: USB disconnect, device number 10 [ 271.392808][T10179] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1644'. [ 271.407461][T10179] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1644'. [ 271.457757][ T9] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 271.587933][ T9] usb 6-1: device descriptor read/64, error -71 [ 271.698416][ T9] usb usb6-port1: attempt power cycle [ 271.846061][T10192] netlink: set zone limit has 4 unknown bytes [ 272.067975][ T9] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 272.099165][ T9] usb 6-1: device descriptor read/8, error -71 [ 272.347826][ T9] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 272.368444][ T9] usb 6-1: device descriptor read/8, error -71 [ 272.478621][ T9] usb usb6-port1: unable to enumerate USB device [ 272.893277][T10210] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1280 [ 273.073326][T10216] netlink: set zone limit has 4 unknown bytes [ 273.717801][ T24] usb 7-1: new full-speed USB device number 11 using dummy_hcd [ 273.847796][ T24] usb 7-1: device descriptor read/64, error -71 [ 274.087820][ T24] usb 7-1: new full-speed USB device number 12 using dummy_hcd [ 274.137855][ T5848] Bluetooth: hci1: command 0x0406 tx timeout [ 274.227805][ T24] usb 7-1: device descriptor read/64, error -71 [ 274.301884][T10241] netlink: set zone limit has 4 unknown bytes [ 274.341491][ T24] usb usb7-port1: attempt power cycle [ 274.697798][ T24] usb 7-1: new full-speed USB device number 13 using dummy_hcd [ 274.729630][ T24] usb 7-1: device descriptor read/8, error -71 [ 274.977943][ T24] usb 7-1: new full-speed USB device number 14 using dummy_hcd [ 275.022075][ T24] usb 7-1: device descriptor read/8, error -71 [ 275.138643][ T24] usb usb7-port1: unable to enumerate USB device [ 275.499052][ T5848] Bluetooth: hci6: command tx timeout [ 275.611075][T10263] netlink: set zone limit has 4 unknown bytes [ 276.680358][T10286] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1688'. [ 276.697141][T10286] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1688'. [ 276.746833][T10289] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1687'. [ 277.848962][ T29] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 277.948639][T10322] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 277.956392][T10322] IPv6: NLM_F_CREATE should be set when creating new route [ 277.963841][T10322] IPv6: NLM_F_CREATE should be set when creating new route [ 277.971123][T10322] IPv6: NLM_F_CREATE should be set when creating new route [ 277.991634][T10322] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1700'. [ 278.002056][T10322] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1700'. [ 278.015432][ T29] usb 7-1: Using ep0 maxpacket: 32 [ 278.028828][ T29] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 223, changing to 11 [ 278.044317][ T29] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 42636, setting to 1024 [ 278.060275][ T29] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 278.069885][ T29] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.084540][ T29] usb 7-1: config 0 descriptor?? [ 278.099413][T10316] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 278.109857][ T29] hub 7-1:0.0: USB hub found [ 278.317839][ T29] hub 7-1:0.0: 1 port detected [ 278.518940][T10340] tipc: Enabling of bearer rejected, failed to enable media [ 279.140163][T10316] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 279.163707][T10316] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 279.211957][ T29] hub 7-1:0.0: hub_ext_port_status failed (err = -71) [ 279.239752][ T5881] usb 7-1: USB disconnect, device number 15 [ 279.433400][ T5848] Bluetooth: hci2: command 0x0406 tx timeout [ 279.537824][ T5918] usb 6-1: new full-speed USB device number 26 using dummy_hcd [ 279.585023][T10366] tipc: Enabling of bearer rejected, failed to enable media [ 279.710669][ T5918] usb 6-1: unable to get BOS descriptor or descriptor too short [ 279.719730][ T5918] usb 6-1: not running at top speed; connect to a high speed hub [ 279.741370][ T5918] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 279.756969][ T5918] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 279.781187][ T5918] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 279.823785][ T5918] usb 6-1: string descriptor 0 read error: -22 [ 279.830453][ T5918] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 279.845422][ T5918] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 279.865655][ T5918] cdc_ncm 6-1:1.0: CDC Union missing and no IAD found [ 279.881515][ T5918] cdc_ncm 6-1:1.0: bind() failure [ 279.983412][ T5881] IPVS: starting estimator thread 0... [ 279.989367][T10381] IPVS: set_ctl: invalid protocol: 255 172.20.20.170:19996 [ 280.069549][T10354] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 280.081764][T10354] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 280.088135][T10382] IPVS: using max 29 ests per chain, 69600 per kthread [ 280.095830][ T29] usb 6-1: USB disconnect, device number 26 [ 280.197759][ T5881] usb 7-1: new full-speed USB device number 16 using dummy_hcd [ 280.303747][T10392] tipc: Enabling of bearer rejected, failed to enable media [ 280.338219][ T5881] usb 7-1: device descriptor read/64, error -71 [ 280.577784][ T5881] usb 7-1: new full-speed USB device number 17 using dummy_hcd [ 280.698888][ T5848] Bluetooth: hci1: command 0x0406 tx timeout [ 280.707807][ T5881] usb 7-1: device descriptor read/64, error -71 [ 280.821865][ T5881] usb usb7-port1: attempt power cycle [ 280.847897][T10414] tipc: Enabling of bearer rejected, failed to enable media [ 281.167911][ T5881] usb 7-1: new full-speed USB device number 18 using dummy_hcd [ 281.188549][ T5881] usb 7-1: device descriptor read/8, error -71 [ 281.394276][T10433] overlayfs: failed to resolve './file1': -2 [ 281.402951][T10433] overlayfs: failed to resolve './file1/file0': -2 [ 281.427734][ T5881] usb 7-1: new full-speed USB device number 19 using dummy_hcd [ 281.468530][ T5881] usb 7-1: device descriptor read/8, error -71 [ 281.576601][T10440] tipc: Enabling of bearer rejected, failed to enable media [ 281.583086][ T5881] usb usb7-port1: unable to enumerate USB device [ 281.643403][T10442] overlayfs: upper fs does not support file handles, falling back to index=off. [ 281.978024][ T5848] Bluetooth: hci6: command tx timeout [ 282.050613][T10465] tipc: Enabling of bearer rejected, failed to enable media [ 282.171824][T10469] 9pnet_fd: Insufficient options for proto=fd [ 282.523609][T10483] tipc: Enabling of bearer rejected, failed to enable media [ 282.582350][T10485] overlayfs: failed to clone lowerpath [ 283.170354][T10504] tipc: Enabled bearer , priority 0 [ 283.329490][T10504] syzkaller0: entered promiscuous mode [ 283.335157][T10504] syzkaller0: entered allmulticast mode [ 283.345724][T10504] tipc: Resetting bearer [ 283.368633][T10501] tipc: Resetting bearer [ 285.133616][T10501] tipc: Disabling bearer [ 285.309719][T10536] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1782'. [ 285.319150][T10538] FAULT_INJECTION: forcing a failure. [ 285.319150][T10538] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 285.348337][T10538] CPU: 0 UID: 0 PID: 10538 Comm: syz.5.1783 Tainted: G L syzkaller #0 PREEMPT(full) [ 285.348370][T10538] Tainted: [L]=SOFTLOCKUP [ 285.348378][T10538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 285.348391][T10538] Call Trace: [ 285.348399][T10538] [ 285.348408][T10538] dump_stack_lvl+0xe8/0x150 [ 285.348442][T10538] should_fail_ex+0x412/0x560 [ 285.348479][T10538] _copy_from_user+0x2d/0xb0 [ 285.348505][T10538] __copy_msghdr+0x3c5/0x5b0 [ 285.348544][T10538] ___sys_sendmsg+0x213/0x360 [ 285.348570][T10538] ? __lock_acquire+0x6b5/0x2cf0 [ 285.348603][T10538] ? __pfx____sys_sendmsg+0x10/0x10 [ 285.348635][T10538] ? kstrtouint+0x6e/0xe0 [ 285.348691][T10538] ? __fget_files+0x2a/0x420 [ 285.348718][T10538] ? __fget_files+0x3a0/0x420 [ 285.348756][T10538] __sys_sendmmsg+0x27c/0x4e0 [ 285.348789][T10538] ? __pfx___sys_sendmmsg+0x10/0x10 [ 285.348815][T10538] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 285.348879][T10538] ? ksys_write+0x242/0x270 [ 285.348913][T10538] ? __pfx_ksys_write+0x10/0x10 [ 285.348951][T10538] __x64_sys_sendmmsg+0xa0/0xc0 [ 285.348981][T10538] do_syscall_64+0xe2/0xf80 [ 285.349008][T10538] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 285.349029][T10538] ? trace_irq_disable+0x37/0x100 [ 285.349050][T10538] ? clear_bhb_loop+0x40/0x90 [ 285.349076][T10538] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 285.349097][T10538] RIP: 0033:0x7fcf09f9acb9 [ 285.349123][T10538] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 285.349139][T10538] RSP: 002b:00007fcf0ae94028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 285.349168][T10538] RAX: ffffffffffffffda RBX: 00007fcf0a215fa0 RCX: 00007fcf09f9acb9 [ 285.349183][T10538] RDX: 0000000000000001 RSI: 0000200000003240 RDI: 0000000000000003 [ 285.349197][T10538] RBP: 00007fcf0ae94090 R08: 0000000000000000 R09: 0000000000000000 [ 285.349209][T10538] R10: 0000000004000800 R11: 0000000000000246 R12: 0000000000000001 [ 285.349221][T10538] R13: 00007fcf0a216038 R14: 00007fcf0a215fa0 R15: 00007fff03cfc298 [ 285.349253][T10538] [ 285.783344][T10553] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1789'. [ 285.837589][T10556] tipc: Enabling of bearer rejected, failed to enable media [ 286.311217][T10581] tipc: Enabling of bearer rejected, failed to enable media [ 286.805120][T10608] tipc: Enabling of bearer rejected, failed to enable media [ 287.482468][T10649] tipc: Enabling of bearer rejected, failed to enable media [ 287.969091][T10677] tipc: Enabling of bearer rejected, failed to enable media [ 288.445873][T10702] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 288.453437][T10702] overlayfs: failed to set xattr on upper [ 288.468856][T10702] overlayfs: ...falling back to redirect_dir=nofollow. [ 288.486410][T10702] overlayfs: ...falling back to uuid=null. [ 288.674427][T10710] tipc: Enabling of bearer rejected, failed to enable media [ 288.941119][T10719] Bluetooth: MGMT ver 1.23 [ 288.974852][T10724] netlink: 'syz.3.1851': attribute type 21 has an invalid length. [ 288.998843][T10724] netlink: 14532 bytes leftover after parsing attributes in process `syz.3.1851'. [ 289.103519][T10727] netlink: set zone limit has 4 unknown bytes [ 289.236924][T10737] netlink: 'syz.6.1856': attribute type 11 has an invalid length. [ 289.246228][T10737] netlink: 168 bytes leftover after parsing attributes in process `syz.6.1856'. [ 289.328727][ T5812] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 289.489860][ T5812] usb 6-1: Using ep0 maxpacket: 16 [ 289.497555][ T5812] usb 6-1: unable to get BOS descriptor or descriptor too short [ 289.509386][ T5812] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 289.517234][ T5812] usb 6-1: can't read configurations, error -61 [ 289.658646][ T5812] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 289.733232][T10757] netlink: set zone limit has 4 unknown bytes [ 289.827913][ T5812] usb 6-1: Using ep0 maxpacket: 16 [ 289.836885][ T5812] usb 6-1: unable to get BOS descriptor or descriptor too short [ 289.846946][ T5812] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 289.854755][ T5812] usb 6-1: can't read configurations, error -61 [ 289.862553][ T5812] usb usb6-port1: attempt power cycle [ 289.887814][ T5935] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 290.037750][ T5935] usb 7-1: Using ep0 maxpacket: 16 [ 290.044947][ T5935] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 290.056369][ T5935] usb 7-1: config 0 interface 0 has no altsetting 0 [ 290.065815][ T5935] usb 7-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 290.075414][ T5935] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.083984][ T5935] usb 7-1: Product: syz [ 290.088306][ T5935] usb 7-1: Manufacturer: syz [ 290.092937][ T5935] usb 7-1: SerialNumber: syz [ 290.101011][ T5935] usb 7-1: config 0 descriptor?? [ 290.227967][ T5812] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 290.249411][ T5812] usb 6-1: Using ep0 maxpacket: 16 [ 290.256881][ T5812] usb 6-1: unable to get BOS descriptor or descriptor too short [ 290.266737][ T5812] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 290.274771][ T5812] usb 6-1: can't read configurations, error -61 [ 290.313686][ C1] imon 7-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 290.325721][ T5935] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input12 [ 290.355304][ T5935] imon:send_packet: packet tx failed (-71) [ 290.378024][ T5935] imon 7-1:0.0: panel buttons/knobs setup failed [ 290.407822][ T5812] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 290.447831][ T5935] rc_core: IR keymap rc-imon-pad not found [ 290.454009][ T5935] Registered IR keymap rc-empty [ 290.460311][ T5935] imon 7-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 290.465992][ T5812] usb 6-1: Using ep0 maxpacket: 16 [ 290.471797][ T5935] imon 7-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 290.488253][ T5935] imon:send_packet: packet tx failed (-71) [ 290.499089][ T5812] usb 6-1: unable to get BOS descriptor or descriptor too short [ 290.508016][ T5935] imon 7-1:0.0: remote input dev register failed [ 290.509179][ T5812] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 290.516529][ T5935] imon 7-1:0.0: imon_init_intf0: rc device setup failed [ 290.523266][ T5812] usb 6-1: can't read configurations, error -61 [ 290.536834][ T5812] usb usb6-port1: unable to enumerate USB device [ 290.559556][ T5935] imon 7-1:0.0: unable to initialize intf0, err 0 [ 290.566029][ T5935] imon:imon_probe: failed to initialize context! [ 290.572957][ T5935] imon 7-1:0.0: unable to register, err -19 [ 290.583000][ T5935] usb 7-1: USB disconnect, device number 20 [ 291.195732][T10790] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1876'. [ 291.443780][T10806] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 291.443780][T10806] The task syz.6.1881 (10806) triggered the difference, watch for misbehavior. [ 292.478570][ T9] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 292.637706][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 292.644904][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 292.654781][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 292.666949][ T9] usb 6-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=4d.a7 [ 292.676334][ T9] usb 6-1: New USB device strings: Mfr=152, Product=158, SerialNumber=3 [ 292.684744][ T9] usb 6-1: Product: syz [ 292.689054][ T9] usb 6-1: Manufacturer: syz [ 292.693688][ T9] usb 6-1: SerialNumber: syz [ 292.703000][ T9] usb 6-1: config 0 descriptor?? [ 292.713726][ T9] usb 6-1: no audio or video endpoints found [ 292.925920][ T9] usb 6-1: USB disconnect, device number 31 [ 293.150458][T10867] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1909'. [ 293.492554][ T30] audit: type=1326 audit(1769177668.676:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10870 comm="syz.6.1910" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f836a19acb9 code=0x0 [ 293.743609][T10880] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1913'. [ 293.816608][T10883] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1914'. [ 294.582906][T10899] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1922'. [ 294.732086][T10904] netlink: 'syz.5.1924': attribute type 10 has an invalid length. [ 294.733913][T10906] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1923'. [ 294.766687][T10904] bridge0: port 2(bridge_slave_1) entered disabled state [ 294.768504][T10904] bridge0: port 1(bridge_slave_0) entered disabled state [ 294.835212][T10904] 9p: Bad value for 'rfdno' [ 294.900189][T10913] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1927'. [ 294.985985][T10919] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1925'. [ 295.156844][T10930] rdma_op ffff888020f631f0 conn xmit_rdma 0000000000000000 [ 295.207909][ T9] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 295.367801][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 295.374846][ T9] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 295.387878][ T9] usb 6-1: config 0 has no interface number 0 [ 295.407884][ T10] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 295.418324][ T9] usb 6-1: New USB device found, idVendor=093a, idProduct=010e, bcdDevice=30.d8 [ 295.427605][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 295.436002][ T9] usb 6-1: Product: syz [ 295.440319][ T9] usb 6-1: Manufacturer: syz [ 295.445033][ T9] usb 6-1: SerialNumber: syz [ 295.455423][ T9] usb 6-1: config 0 descriptor?? [ 295.470627][ T9] gspca_main: mr97310a-2.14.0 probing 093a:010e [ 295.477263][ T9] gspca_mr97310a: reg write [21] error -22 [ 295.484092][ T9] mr97310a 6-1:0.51: probe with driver mr97310a failed with error -22 [ 295.557718][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 295.566504][ T10] usb 7-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 295.581006][ T10] usb 7-1: config 0 interface 0 has no altsetting 0 [ 295.588103][ T10] usb 7-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 295.597541][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.611256][ T10] usb 7-1: config 0 descriptor?? [ 295.694812][ T5935] usb 6-1: USB disconnect, device number 32 [ 295.766961][T10937] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1933'. [ 296.008337][ T5848] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 296.151197][ T10] nzxt-smart2 0003:1E71:2009.0006: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.6-1/input0 [ 296.409368][T10954] usb usb8: usbfs: process 10954 (syz.5.1938) did not claim interface 0 before use [ 296.602439][ T10] usb 7-1: USB disconnect, device number 21 [ 296.809367][ T5848] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 297.190728][ T24] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 297.349489][ T24] usb 6-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 297.378991][ T24] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 297.403618][ T24] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 297.428401][ T24] usb 6-1: config 1 has no interface number 1 [ 297.434793][ T24] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 297.471948][ T24] usb 6-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 297.514296][ T24] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 297.530773][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.557714][ T24] usb 6-1: Product: syz [ 297.562145][ T24] usb 6-1: Manufacturer: syz [ 297.566871][ T24] usb 6-1: SerialNumber: syz [ 297.804022][ T24] usb 6-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 297.827251][ T24] usb 6-1: MIDIStreaming interface descriptor not found [ 297.869607][T11003] sctp: [Deprecated]: syz.6.1949 (pid 11003) Use of struct sctp_assoc_value in delayed_ack socket option. [ 297.869607][T11003] Use struct sctp_sack_info instead [ 298.021592][ T24] usb 6-1: USB disconnect, device number 33 [ 298.147067][T11011] udevd[11011]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 298.421934][T11026] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1953'. [ 299.460335][T11057] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1965'. [ 299.550269][T11061] netlink: 192 bytes leftover after parsing attributes in process `syz.2.1967'. [ 299.570303][T11064] netlink: 192 bytes leftover after parsing attributes in process `syz.2.1967'. [ 299.709055][T11071] tmpfs: Bad value for 'nr_inodes' [ 300.043413][T11083] mmap: syz.3.1977 (11083) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 301.046399][T11099] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 301.057526][T11099] VFS: Can't find a romfs filesystem on dev nullb0. [ 301.057526][T11099] [ 301.182336][ T5848] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 301.898072][T11120] pim6reg1: entered promiscuous mode [ 301.903538][T11120] pim6reg1: entered allmulticast mode [ 302.046785][T11123] pim6reg1: entered promiscuous mode [ 302.052506][T11123] pim6reg1: entered allmulticast mode [ 302.687843][ T5935] usb 7-1: new full-speed USB device number 22 using dummy_hcd [ 302.817763][ T5935] usb 7-1: device descriptor read/64, error -71 [ 303.057834][ T5935] usb 7-1: new full-speed USB device number 23 using dummy_hcd [ 303.156555][T11154] netlink: 'syz.5.2005': attribute type 1 has an invalid length. [ 303.157900][ T5848] Bluetooth: hci5: link tx timeout [ 303.172074][ T5848] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 303.189428][ T5935] usb 7-1: device descriptor read/64, error -71 [ 303.308088][ T5935] usb usb7-port1: attempt power cycle [ 303.658098][ T5935] usb 7-1: new full-speed USB device number 24 using dummy_hcd [ 303.688687][ T5935] usb 7-1: device descriptor read/8, error -71 [ 303.927816][ T5935] usb 7-1: new full-speed USB device number 25 using dummy_hcd [ 303.948843][ T5935] usb 7-1: device descriptor read/8, error -71 [ 304.058290][ T5935] usb usb7-port1: unable to enumerate USB device [ 304.458752][ T5848] Bluetooth: hci6: command tx timeout [ 305.257927][ T5848] Bluetooth: hci5: command 0x0406 tx timeout [ 306.581820][T11222] netlink: 'syz.6.2030': attribute type 10 has an invalid length. [ 307.457796][ T10] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 307.635473][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 307.665036][ T10] usb 6-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 307.687222][ T10] usb 6-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 307.707876][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.716251][ T10] usb 6-1: Product: syz [ 307.738734][ T10] usb 6-1: Manufacturer: syz [ 307.748046][ T10] usb 6-1: SerialNumber: syz [ 308.589354][ T10] usb 6-1: reset high-speed USB device number 34 using dummy_hcd [ 308.777357][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 308.791285][ T10] usb 6-1: device firmware changed [ 308.812047][ T10] usb 6-1: USB disconnect, device number 34 [ 308.996399][T11282] IPVS: set_ctl: invalid protocol: 44 224.0.0.1:20001 [ 309.437095][ T51] Bluetooth: hci5: ACL packet for unknown connection handle 201 [ 309.447415][ T10] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 309.561961][ T51] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 309.617698][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 309.629877][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 223, changing to 11 [ 309.651539][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 42636, setting to 1024 [ 309.663535][ T10] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 309.673011][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 309.684831][ T10] usb 7-1: config 0 descriptor?? [ 309.696208][T11288] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 309.727940][ T10] hub 7-1:0.0: USB hub found [ 309.737008][T11304] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2059'. [ 309.750817][T11304] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2059'. [ 309.928582][ T10] hub 7-1:0.0: 1 port detected [ 310.753430][ T10] hub 7-1:0.0: hub_ext_port_status failed (err = -71) [ 310.760818][ T9] usb 7-1: USB disconnect, device number 26 [ 311.766506][ T5848] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 311.776877][ T5848] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 311.787243][ T5848] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 311.795989][ T5848] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 311.805933][ T5848] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 312.229112][T11331] chnl_net:caif_netlink_parms(): no params data found [ 312.402318][T11331] bridge0: port 1(bridge_slave_0) entered blocking state [ 312.411315][T11331] bridge0: port 1(bridge_slave_0) entered disabled state [ 312.420564][T11331] bridge_slave_0: entered allmulticast mode [ 312.429743][T11331] bridge_slave_0: entered promiscuous mode [ 312.440439][T11331] bridge0: port 2(bridge_slave_1) entered blocking state [ 312.449189][T11331] bridge0: port 2(bridge_slave_1) entered disabled state [ 312.457027][T11331] bridge_slave_1: entered allmulticast mode [ 312.469437][T11331] bridge_slave_1: entered promiscuous mode [ 312.528488][T11331] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 312.544428][T11331] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 312.607063][T11331] team0: Port device team_slave_0 added [ 312.645465][T11331] team0: Port device team_slave_1 added [ 312.679076][T11331] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 312.686104][T11331] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 312.713744][T11331] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 312.730526][T11331] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 312.739298][T11331] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 312.773143][T11331] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 312.847149][T11331] hsr_slave_0: entered promiscuous mode [ 312.854366][T11331] hsr_slave_1: entered promiscuous mode [ 312.862202][T11331] debugfs: 'hsr0' already exists in 'hsr' [ 312.869828][T11331] Cannot create hsr debugfs directory [ 313.120881][T11331] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 313.191696][T11331] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 313.267517][T11331] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 313.335394][T11331] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 313.473785][T11331] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 313.486886][T11331] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 313.499909][T11331] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 313.519972][T11331] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 313.627014][T11331] 8021q: adding VLAN 0 to HW filter on device bond0 [ 313.650198][T11331] 8021q: adding VLAN 0 to HW filter on device team0 [ 313.666895][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 313.674170][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 313.692360][ T4337] bridge0: port 2(bridge_slave_1) entered blocking state [ 313.699710][ T4337] bridge0: port 2(bridge_slave_1) entered forwarding state [ 313.897941][ T5848] Bluetooth: hci7: command tx timeout [ 313.950526][T11331] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 314.031131][T11331] veth0_vlan: entered promiscuous mode [ 314.051679][T11331] veth1_vlan: entered promiscuous mode [ 314.112298][T11331] veth0_macvtap: entered promiscuous mode [ 314.126757][T11331] veth1_macvtap: entered promiscuous mode [ 314.159151][T11331] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 314.185341][T11331] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 314.209789][ T36] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.221198][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.249679][ T36] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.263391][ T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.374628][ T3454] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 314.397517][ T3454] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 314.452789][ T9380] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 314.464338][ T9380] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 315.468895][ T24] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 315.627897][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 315.640214][ T24] usb 3-1: New USB device found, idVendor=04b4, idProduct=8613, bcdDevice=95.8f [ 315.650021][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.659048][ T24] usb 3-1: Product: syz [ 315.663606][ T24] usb 3-1: Manufacturer: syz [ 315.668646][ T24] usb 3-1: SerialNumber: syz [ 315.676306][ T24] usb 3-1: config 0 descriptor?? [ 315.685486][ T24] usbtest 3-1:0.0: FX2 device [ 315.690619][ T24] usbtest 3-1:0.0: high-speed {control bulk-in bulk-out} tests (+alt) [ 315.888733][ T24] usb 3-1: USB disconnect, device number 4 [ 315.977903][ T5848] Bluetooth: hci7: command tx timeout [ 316.160211][ T5848] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 317.400504][T11484] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2116'. [ 317.421873][T11484] netlink: 'syz.3.2116': attribute type 2 has an invalid length. [ 317.500337][ T5927] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 317.671505][ T5927] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.9e [ 317.688545][ T5927] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.708361][ T5927] usb 7-1: config 0 descriptor?? [ 318.063147][ T5848] Bluetooth: hci7: command tx timeout [ 318.305858][T11512] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2128'. [ 318.531962][ T5848] Bluetooth: hci1: Malformed LE Event: 0x0b [ 320.137903][ T5848] Bluetooth: hci7: command tx timeout [ 320.142424][ T5927] ath6kl: Failed to read usb control message: -110 [ 320.151614][ T5927] ath6kl: Unable to read the bmi data from the device: -110 [ 320.161404][ T5927] ath6kl: unable to read target info byte count: -110 [ 320.178121][ T5927] ath6kl: Failed to init ath6kl core: -110 [ 320.184594][ T5927] ath6kl_usb 7-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 320.234393][T11473] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 320.270323][ T5914] usb 7-1: USB disconnect, device number 27 [ 320.587783][ T5927] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 320.716934][T11554] FAULT_INJECTION: forcing a failure. [ 320.716934][T11554] name failslab, interval 1, probability 0, space 0, times 0 [ 320.731167][T11554] CPU: 1 UID: 0 PID: 11554 Comm: syz.6.2144 Tainted: G L syzkaller #0 PREEMPT(full) [ 320.731193][T11554] Tainted: [L]=SOFTLOCKUP [ 320.731199][T11554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 320.731221][T11554] Call Trace: [ 320.731230][T11554] [ 320.731236][T11554] dump_stack_lvl+0xe8/0x150 [ 320.731261][T11554] should_fail_ex+0x412/0x560 [ 320.731288][T11554] should_failslab+0xa8/0x100 [ 320.731304][T11554] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 320.731325][T11554] ? __alloc_skb+0x186/0x7d0 [ 320.731342][T11554] ? __alloc_skb+0x1d0/0x7d0 [ 320.731357][T11554] ? __local_bh_enable_ip+0xd0/0x130 [ 320.731380][T11554] __alloc_skb+0x1d0/0x7d0 [ 320.731401][T11554] netlink_sendmsg+0x5d4/0xb40 [ 320.731430][T11554] ? __pfx_netlink_sendmsg+0x10/0x10 [ 320.731454][T11554] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 320.731478][T11554] ? __pfx_netlink_sendmsg+0x10/0x10 [ 320.731500][T11554] sock_sendmsg_nosec+0x18f/0x1d0 [ 320.731516][T11554] ____sys_sendmsg+0x589/0x8c0 [ 320.731536][T11554] ? __might_fault+0xaf/0x130 [ 320.731558][T11554] ? __pfx_____sys_sendmsg+0x10/0x10 [ 320.731584][T11554] ? import_iovec+0x73/0xa0 [ 320.731603][T11554] ___sys_sendmsg+0x2a5/0x360 [ 320.731622][T11554] ? __lock_acquire+0x6b5/0x2cf0 [ 320.731645][T11554] ? __pfx____sys_sendmsg+0x10/0x10 [ 320.731689][T11554] ? __fget_files+0x2a/0x420 [ 320.731708][T11554] ? __fget_files+0x3a0/0x420 [ 320.731734][T11554] __x64_sys_sendmsg+0x1bd/0x2a0 [ 320.731756][T11554] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 320.731782][T11554] ? __pfx_ksys_write+0x10/0x10 [ 320.731813][T11554] do_syscall_64+0xe2/0xf80 [ 320.731833][T11554] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 320.731847][T11554] ? trace_irq_disable+0x37/0x100 [ 320.731862][T11554] ? clear_bhb_loop+0x40/0x90 [ 320.731887][T11554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 320.731902][T11554] RIP: 0033:0x7f836a19acb9 [ 320.731916][T11554] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 320.731928][T11554] RSP: 002b:00007f836b108028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 320.731945][T11554] RAX: ffffffffffffffda RBX: 00007f836a415fa0 RCX: 00007f836a19acb9 [ 320.731956][T11554] RDX: 6f3ece73483f27dc RSI: 00002000000000c0 RDI: 0000000000000003 [ 320.731966][T11554] RBP: 00007f836b108090 R08: 0000000000000000 R09: 0000000000000000 [ 320.731975][T11554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 320.732016][T11554] R13: 00007f836a416038 R14: 00007f836a415fa0 R15: 00007ffdf904bbe8 [ 320.732048][T11554] [ 321.005701][ T5927] usb 3-1: Using ep0 maxpacket: 16 [ 321.012678][ T5927] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 321.022500][ T5927] usb 3-1: config 0 has no interface number 0 [ 321.028885][ T5927] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 321.041829][ T5927] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 321.053025][ T5927] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 321.064105][ T5927] usb 3-1: Product: syz [ 321.068507][ T5927] usb 3-1: SerialNumber: syz [ 321.076319][ T5927] usb 3-1: config 0 descriptor?? [ 321.093524][ T5927] cm109 3-1:0.8: invalid payload size 208, expected 4 [ 321.104822][ T5927] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input14 [ 321.130974][ T5848] Bluetooth: hci6: Malformed LE Event: 0x0b [ 321.377787][ T5914] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 321.523608][ C1] cm109 3-1:0.8: cm109_urb_irq_callback: urb status -71 [ 321.531098][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 321.538281][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 321.545484][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 321.548615][ T5914] usb 7-1: Using ep0 maxpacket: 32 [ 321.554115][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 321.564917][ T5927] usb 3-1: USB disconnect, device number 5 [ 321.571128][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 321.571159][ C1] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 321.599212][ T5914] usb 7-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 321.609899][ T5927] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 321.619882][ T5914] usb 7-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 321.631877][ T5914] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 321.645786][ T5914] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 321.655192][ T5914] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.670785][ T5914] usb 7-1: Product: syz [ 321.677758][ T5914] usb 7-1: Manufacturer: syz [ 321.682715][ T5914] usb 7-1: SerialNumber: syz [ 321.904925][ T5914] usb 7-1: 0:2 : does not exist [ 321.941402][ T5914] usb 7-1: USB disconnect, device number 28 [ 321.972413][T11011] udevd[11011]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 322.387817][ T5927] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 322.547800][ T5927] usb 3-1: Using ep0 maxpacket: 8 [ 322.559582][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 322.568526][ T5927] usb 3-1: New USB device found, idVendor=0fe9, idProduct=db01, bcdDevice=e9.9b [ 322.578364][ T5927] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.586585][ T5927] usb 3-1: Product: syz [ 322.593778][ T5927] usb 3-1: Manufacturer: syz [ 322.604746][ T5927] usb 3-1: SerialNumber: syz [ 322.612817][ T5927] usb 3-1: config 0 descriptor?? [ 322.625592][ T5927] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in warm state. [ 322.634585][ T5927] dvb-usb: bulk message failed: -22 (2/0) [ 322.644173][ T5927] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 322.654702][ T5927] dvbdev: DVB: registering new adapter (DViCO FusionHDTV DVB-T USB (LGZ201)) [ 322.663773][ T5927] usb 3-1: media controller created [ 322.680251][ T5927] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 322.826996][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 322.867197][ T5927] DVB: Unable to find symbol mt352_attach() [ 322.874653][ T5927] dvb-usb: no frontend was attached by 'DViCO FusionHDTV DVB-T USB (LGZ201)' [ 322.957814][ T5927] rc_core: IR keymap rc-dvico-portable not found [ 322.964369][ T5927] Registered IR keymap rc-empty [ 322.972104][ T5927] rc rc0: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 322.986048][ T5927] input: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input15 [ 323.000884][ T5927] dvb-usb: schedule remote query interval to 100 msecs. [ 323.009678][ T5927] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized and connected. [ 323.121658][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 323.237947][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 323.350007][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 323.457737][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 323.567792][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 323.687877][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 323.797921][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 323.907928][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 324.018020][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 324.128049][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 324.224583][ T30] audit: type=1326 audit(1769177699.406:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11591 comm="syz.6.2156" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f836a19acb9 code=0x0 [ 324.239160][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 324.357874][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 324.467875][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 324.578608][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 324.687816][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 324.807740][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 324.880564][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 324.895769][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 324.906130][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 324.916984][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 324.924564][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 324.934533][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 325.037748][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 325.147798][ T5927] dvb-usb: bulk message failed: -22 (1/0) [ 325.188093][ T5927] usb 3-1: USB disconnect, device number 6 [ 325.255915][T11598] chnl_net:caif_netlink_parms(): no params data found [ 325.321934][ T5927] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully deinitialized and disconnected. [ 325.542797][T11598] bridge0: port 1(bridge_slave_0) entered blocking state [ 325.550617][T11598] bridge0: port 1(bridge_slave_0) entered disabled state [ 325.558133][T11598] bridge_slave_0: entered allmulticast mode [ 325.567152][T11598] bridge_slave_0: entered promiscuous mode [ 325.578488][T11598] bridge0: port 2(bridge_slave_1) entered blocking state [ 325.585928][T11598] bridge0: port 2(bridge_slave_1) entered disabled state [ 325.593712][T11598] bridge_slave_1: entered allmulticast mode [ 325.602112][T11598] bridge_slave_1: entered promiscuous mode [ 325.648369][T11598] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 325.678624][T11598] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 325.729282][T11598] team0: Port device team_slave_0 added [ 325.739510][T11598] team0: Port device team_slave_1 added [ 325.778336][T11598] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 325.785464][T11598] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 325.812879][T11598] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 325.829726][T11598] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 325.837210][T11598] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 325.887956][T11598] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 325.894873][ T5914] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 325.969969][T11598] hsr_slave_0: entered promiscuous mode [ 325.982167][T11598] hsr_slave_1: entered promiscuous mode [ 325.989059][T11598] debugfs: 'hsr0' already exists in 'hsr' [ 325.994941][T11598] Cannot create hsr debugfs directory [ 326.057673][ T5914] usb 7-1: Using ep0 maxpacket: 16 [ 326.066453][ T5914] usb 7-1: config 11 has an invalid interface number: 32 but max is 0 [ 326.075353][ T5914] usb 7-1: config 11 has no interface number 0 [ 326.084916][ T5914] usb 7-1: config 11 interface 32 has no altsetting 0 [ 326.100698][ T5914] usb 7-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 5.91 [ 326.113899][ T5914] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 326.122499][ T5914] usb 7-1: Product: syz [ 326.127482][ T5914] usb 7-1: Manufacturer: syz [ 326.133339][ T5914] usb 7-1: SerialNumber: syz [ 326.572687][T11598] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 326.604909][T11598] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 326.638905][T11598] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 326.651204][T11598] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 326.756617][T11650] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 326.836476][T11598] 8021q: adding VLAN 0 to HW filter on device bond0 [ 326.896552][T11598] 8021q: adding VLAN 0 to HW filter on device team0 [ 326.916917][ T3454] bridge0: port 1(bridge_slave_0) entered blocking state [ 326.924211][ T3454] bridge0: port 1(bridge_slave_0) entered forwarding state [ 326.955694][ T3554] bridge0: port 2(bridge_slave_1) entered blocking state [ 326.962999][ T3554] bridge0: port 2(bridge_slave_1) entered forwarding state [ 327.019373][ T5848] Bluetooth: hci2: command tx timeout [ 327.461172][T11598] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 327.801952][T11598] veth0_vlan: entered promiscuous mode [ 327.817568][T11598] veth1_vlan: entered promiscuous mode [ 327.861381][T11598] veth0_macvtap: entered promiscuous mode [ 327.876143][T11598] veth1_macvtap: entered promiscuous mode [ 327.904824][T11598] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 327.931159][T11598] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 327.949632][ T3554] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 327.959024][ T3554] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 327.971887][ T3554] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 327.981972][ T3554] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.093210][ T3554] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 328.117704][ T3554] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 328.181228][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 328.193823][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 328.385018][T11684] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2180'. [ 328.471297][ T5848] Bluetooth: hci2: Malformed LE Event: 0x0b [ 328.575517][ T5914] ttusb_dec_send_command: command bulk message failed: error -22 [ 328.596859][ T5914] ttusb-dec 7-1:11.32: probe with driver ttusb-dec failed with error -22 [ 328.633886][ T5914] usb 7-1: USB disconnect, device number 29 [ 329.032840][ T51] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 329.042719][ T51] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 329.053330][ T51] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 329.061509][ T51] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 329.070009][ T51] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 329.098060][ T51] Bluetooth: hci2: command tx timeout [ 329.209610][ T5918] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 329.357874][ T5918] usb 3-1: device descriptor read/64, error -71 [ 329.486856][T11700] chnl_net:caif_netlink_parms(): no params data found [ 329.607769][ T5918] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 329.728185][T11700] bridge0: port 1(bridge_slave_0) entered blocking state [ 329.735961][T11700] bridge0: port 1(bridge_slave_0) entered disabled state [ 329.747312][T11700] bridge_slave_0: entered allmulticast mode [ 329.753740][ T5918] usb 3-1: device descriptor read/64, error -71 [ 329.763801][T11700] bridge_slave_0: entered promiscuous mode [ 329.783183][T11700] bridge0: port 2(bridge_slave_1) entered blocking state [ 329.791330][T11700] bridge0: port 2(bridge_slave_1) entered disabled state [ 329.799081][T11700] bridge_slave_1: entered allmulticast mode [ 329.807788][T11700] bridge_slave_1: entered promiscuous mode [ 329.871180][ T5918] usb usb3-port1: attempt power cycle [ 329.877074][T11700] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 329.893064][T11700] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 329.945497][T11700] team0: Port device team_slave_0 added [ 329.954802][T11700] team0: Port device team_slave_1 added [ 330.006241][T11700] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 330.014094][T11700] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 330.042912][T11700] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 330.081516][T11700] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 330.088771][T11700] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 330.116414][T11700] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 330.224891][T11700] hsr_slave_0: entered promiscuous mode [ 330.231195][ T5918] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 330.249187][T11700] hsr_slave_1: entered promiscuous mode [ 330.255870][T11700] debugfs: 'hsr0' already exists in 'hsr' [ 330.281522][ T5918] usb 3-1: device descriptor read/8, error -71 [ 330.287907][ T5914] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 330.295901][T11700] Cannot create hsr debugfs directory [ 330.469951][ T5914] usb 8-1: Using ep0 maxpacket: 8 [ 330.479411][ T5914] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 330.507987][ T5914] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 330.530238][ T5914] usb 8-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 330.540534][ T5918] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 330.548902][ T5914] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.558601][ T5914] usb 8-1: Product: syz [ 330.562859][ T5914] usb 8-1: Manufacturer: syz [ 330.567497][ T5914] usb 8-1: SerialNumber: syz [ 330.578432][ T5918] usb 3-1: device descriptor read/8, error -71 [ 330.592540][ T5914] usb 8-1: config 0 descriptor?? [ 330.654019][T11700] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.698141][ T8860] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 330.708345][ T5918] usb usb3-port1: unable to enumerate USB device [ 330.750626][T11700] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.796516][T11700] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.857394][T11700] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.878166][ T8860] usb 7-1: Using ep0 maxpacket: 32 [ 330.890600][ T8860] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 223, changing to 11 [ 330.904900][ T8860] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 42636, setting to 1024 [ 330.916371][ T8860] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 330.925553][ T8860] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.936973][ T8860] usb 7-1: config 0 descriptor?? [ 330.940120][ T51] Bluetooth: hci7: command tx timeout [ 330.956378][T11724] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 330.974478][ T8860] hub 7-1:0.0: USB hub found [ 331.099626][ T51] Bluetooth: hci8: command tx timeout [ 331.107295][T11700] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 331.122895][T11700] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 331.135733][T11700] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 331.150836][T11700] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 331.167466][ T8860] hub 7-1:0.0: 1 port detected [ 331.178156][ T51] Bluetooth: hci2: command tx timeout [ 331.281347][T11700] 8021q: adding VLAN 0 to HW filter on device bond0 [ 331.313518][T11700] 8021q: adding VLAN 0 to HW filter on device team0 [ 331.333053][ T3454] bridge0: port 1(bridge_slave_0) entered blocking state [ 331.340463][ T3454] bridge0: port 1(bridge_slave_0) entered forwarding state [ 331.361657][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 331.369265][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 331.659114][T11700] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 331.727728][T11700] veth0_vlan: entered promiscuous mode [ 331.747262][T11700] veth1_vlan: entered promiscuous mode [ 331.795737][T11700] veth0_macvtap: entered promiscuous mode [ 331.811885][T11700] veth1_macvtap: entered promiscuous mode [ 331.853106][T11700] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 331.876820][T11700] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 331.897212][ T1304] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.910369][ T1304] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.932001][ T1304] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.942285][ T1304] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 332.028716][ T5914] hub 7-1:0.0: hub_ext_port_status failed (err = -71) [ 332.098617][ T9380] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 332.118684][ T9380] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 332.176071][ T9380] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 332.185195][ T9380] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 332.802916][ T5927] usb 7-1: USB disconnect, device number 30 [ 333.037253][ T5935] usb 8-1: USB disconnect, device number 2 [ 333.117758][ T5914] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 333.178043][ T51] Bluetooth: hci8: command tx timeout [ 333.258094][ T51] Bluetooth: hci2: command tx timeout [ 333.271162][ T5914] usb 4-1: device descriptor read/64, error -71 [ 333.397767][ T5935] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 333.508533][ T5914] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 333.548141][ T5927] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 333.557778][ T5935] usb 8-1: Using ep0 maxpacket: 32 [ 333.570454][ T5935] usb 8-1: New USB device found, idVendor=2040, idProduct=d900, bcdDevice=a9.2c [ 333.581503][ T5935] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 333.591614][ T5935] usb 8-1: Product: syz [ 333.595834][ T5935] usb 8-1: Manufacturer: syz [ 333.600950][ T5935] usb 8-1: SerialNumber: syz [ 333.610893][ T5935] usb 8-1: config 0 descriptor?? [ 333.623133][ T5935] dvb-usb: found a 'Hauppauge MAX S2 or WinTV NOVA HD USB2.0' in warm state. [ 333.632874][ T5935] dw2102: su3000_power_ctrl: 1, initialized 0 [ 333.639650][ T5935] dvb-usb: bulk message failed: -22 (2/0) [ 333.648917][ T5914] usb 4-1: device descriptor read/64, error -71 [ 333.655100][ T5935] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 333.669643][ T5935] dvbdev: DVB: registering new adapter (Hauppauge MAX S2 or WinTV NOVA HD USB2.0) [ 333.680732][ T5935] usb 8-1: media controller created [ 333.686177][ T5935] dvb-usb: bulk message failed: -22 (6/0) [ 333.693401][ T5935] dw2102: i2c transfer failed. [ 333.699538][ T5935] dvb-usb: bulk message failed: -22 (6/0) [ 333.705408][ T5935] dw2102: i2c transfer failed. [ 333.710630][ T5935] dvb-usb: bulk message failed: -22 (6/0) [ 333.716397][ T5935] dw2102: i2c transfer failed. [ 333.721556][ T5927] usb 3-1: Using ep0 maxpacket: 32 [ 333.727028][ T5935] dvb-usb: bulk message failed: -22 (6/0) [ 333.733427][ T5935] dw2102: i2c transfer failed. [ 333.739733][ T5927] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 223, changing to 11 [ 333.753744][ T5935] dvb-usb: bulk message failed: -22 (6/0) [ 333.763026][ T5927] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 42636, setting to 1024 [ 333.774405][ T5935] dw2102: i2c transfer failed. [ 333.779705][ T5935] dvb-usb: bulk message failed: -22 (6/0) [ 333.785644][ T5935] dw2102: i2c transfer failed. [ 333.790704][ T5914] usb usb4-port1: attempt power cycle [ 333.790715][ T5927] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 333.805761][ T5935] dvb-usb: MAC address: 02:02:02:02:02:02 [ 333.818438][ T5927] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 333.829979][ T5927] usb 3-1: config 0 descriptor?? [ 333.832206][T11767] dvb-usb: bulk message failed: -22 (4/0) [ 333.843368][T11771] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 333.852946][T11767] dw2102: i2c transfer failed. [ 333.864956][ T5935] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 333.880039][ T5927] hub 3-1:0.0: USB hub found [ 333.915804][ T5935] dvb-usb: bulk message failed: -22 (3/0) [ 333.921937][ T5935] dw2102: command 0x0e transfer failed. [ 333.927965][ T5935] dvb-usb: bulk message failed: -22 (3/0) [ 333.933908][ T5935] dw2102: command 0x0e transfer failed. [ 334.075141][ T5927] hub 3-1:0.0: 1 port detected [ 334.127775][ T5914] usb 4-1: new full-speed USB device number 23 using dummy_hcd [ 334.158513][ T5914] usb 4-1: device descriptor read/8, error -71 [ 334.247877][ T5935] dvb-usb: bulk message failed: -22 (3/0) [ 334.253888][ T5935] dw2102: command 0x0e transfer failed. [ 334.259697][ T5935] dvb-usb: bulk message failed: -22 (3/0) [ 334.265511][ T5935] dw2102: command 0x0e transfer failed. [ 334.273268][ T5935] dvb-usb: bulk message failed: -22 (1/0) [ 334.279554][ T5935] dw2102: command 0x51 transfer failed. [ 334.323504][ T5935] DVB: Unable to find symbol ds3000_attach() [ 334.331366][ T5935] dvb-usb: no frontend was attached by 'Hauppauge MAX S2 or WinTV NOVA HD USB2.0' [ 334.401599][ T5935] rc_core: IR keymap rc-su3000 not found [ 334.407332][ T5935] Registered IR keymap rc-empty [ 334.414518][ T5935] rc rc0: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 as /devices/platform/dummy_hcd.7/usb8/8-1/rc/rc0 [ 334.418545][ T5914] usb 4-1: new full-speed USB device number 24 using dummy_hcd [ 334.438979][ T5935] input: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 as /devices/platform/dummy_hcd.7/usb8/8-1/rc/rc0/input16 [ 334.454563][ T5935] dvb-usb: schedule remote query interval to 150 msecs. [ 334.463469][ T5935] dw2102: su3000_power_ctrl: 0, initialized 1 [ 334.480041][ T5914] usb 4-1: device descriptor read/8, error -71 [ 334.487004][ T5935] dvb-usb: Hauppauge MAX S2 or WinTV NOVA HD USB2.0 successfully initialized and connected. [ 334.529797][ T5935] usb 8-1: USB disconnect, device number 3 [ 334.590192][ T5914] usb usb4-port1: unable to enumerate USB device [ 334.626774][ T5935] dvb-usb: Hauppauge MAX S2 or WinTV NOVA HD USB2. successfully deinitialized and disconnected. [ 334.691573][T11781] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2211'. [ 334.718523][T11781] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2211'. [ 334.898871][ T5927] hub 3-1:0.0: hub_ext_port_status failed (err = -71) [ 334.907445][ T5953] usb 3-1: USB disconnect, device number 11 [ 335.043949][T11787] syzkaller1: entered promiscuous mode [ 335.049654][T11787] syzkaller1: entered allmulticast mode [ 335.188507][ T5914] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 335.258434][ T51] Bluetooth: hci8: command tx timeout [ 335.559821][ T5918] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 335.747858][ T5918] usb 8-1: Using ep0 maxpacket: 16 [ 335.760445][ T5918] usb 8-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 335.772349][ T5918] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.783500][ T5918] usb 8-1: Product: syz [ 335.789235][ T5918] usb 8-1: Manufacturer: syz [ 335.793917][ T5918] usb 8-1: SerialNumber: syz [ 335.802257][ T5918] usb 8-1: config 0 descriptor?? [ 335.823666][ T5918] ssu100 8-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 335.976315][T11817] FAULT_INJECTION: forcing a failure. [ 335.976315][T11817] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 335.997191][T11817] CPU: 0 UID: 0 PID: 11817 Comm: syz.3.2225 Tainted: G L syzkaller #0 PREEMPT(full) [ 335.997232][T11817] Tainted: [L]=SOFTLOCKUP [ 335.997240][T11817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 335.997253][T11817] Call Trace: [ 335.997261][T11817] [ 335.997271][T11817] dump_stack_lvl+0xe8/0x150 [ 335.997303][T11817] should_fail_ex+0x412/0x560 [ 335.997339][T11817] _copy_from_user+0x2d/0xb0 [ 335.997363][T11817] ___sys_sendmsg+0x1c6/0x360 [ 335.997389][T11817] ? __lock_acquire+0x6b5/0x2cf0 [ 335.997420][T11817] ? __pfx____sys_sendmsg+0x10/0x10 [ 335.997481][T11817] ? __fget_files+0x2a/0x420 [ 335.997508][T11817] ? __fget_files+0x3a0/0x420 [ 335.997545][T11817] __x64_sys_sendmsg+0x1bd/0x2a0 [ 335.997574][T11817] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 335.997609][T11817] ? __pfx_ksys_write+0x10/0x10 [ 335.997650][T11817] do_syscall_64+0xe2/0xf80 [ 335.997678][T11817] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.997699][T11817] ? trace_irq_disable+0x37/0x100 [ 335.997718][T11817] ? clear_bhb_loop+0x40/0x90 [ 335.997743][T11817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.997765][T11817] RIP: 0033:0x7fef6e39acb9 [ 335.997785][T11817] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 335.997812][T11817] RSP: 002b:00007fef6f26f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 335.997834][T11817] RAX: ffffffffffffffda RBX: 00007fef6e615fa0 RCX: 00007fef6e39acb9 [ 335.997849][T11817] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 335.997860][T11817] RBP: 00007fef6f26f090 R08: 0000000000000000 R09: 0000000000000000 [ 335.997870][T11817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 335.997881][T11817] R13: 00007fef6e616038 R14: 00007fef6e615fa0 R15: 00007ffe1642c148 [ 335.997912][T11817] [ 336.206163][ T5918] ssu100 8-1:0.0: probe with driver ssu100 failed with error -110 [ 336.225699][T11800] 8021q: adding VLAN 0 to HW filter on device bond0 [ 336.386878][T11800] bond0: (slave rose0): Enslaving as an active interface with an up link [ 336.627158][ T51] Bluetooth: hci6: command 0x0406 tx timeout [ 336.897927][ T5914] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 337.057741][ T5914] usb 4-1: Using ep0 maxpacket: 32 [ 337.068355][ T5914] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 223, changing to 11 [ 337.097168][ T5914] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 42636, setting to 1024 [ 337.110375][ T5914] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 337.123794][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 337.141448][ T5914] usb 4-1: config 0 descriptor?? [ 337.154333][T11836] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 337.168848][ T5914] hub 4-1:0.0: USB hub found [ 337.338410][ T5848] Bluetooth: hci8: command tx timeout [ 337.365491][ T5914] hub 4-1:0.0: 1 port detected [ 337.788104][ T24] usb 7-1: new full-speed USB device number 32 using dummy_hcd [ 337.868177][ T5935] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 337.948930][ T24] usb 7-1: device descriptor read/64, error -71 [ 338.038147][ T5935] usb 3-1: Using ep0 maxpacket: 16 [ 338.050306][ T5935] usb 3-1: config 1 has an invalid interface number: 155 but max is 0 [ 338.070874][ T5935] usb 3-1: config 1 has no interface number 0 [ 338.083807][ T5935] usb 3-1: config 1 interface 155 has no altsetting 0 [ 338.102618][ T5935] usb 3-1: New USB device found, idVendor=046d, idProduct=0897, bcdDevice=16.a1 [ 338.118937][ T5935] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 338.134795][ T10] usb 4-1: reset high-speed USB device number 25 using dummy_hcd [ 338.135223][ T5935] usb 3-1: Product: syz [ 338.157373][ T5935] usb 3-1: Manufacturer: syz [ 338.171401][ T5935] usb 3-1: SerialNumber: syz [ 338.208257][ T24] usb 7-1: new full-speed USB device number 33 using dummy_hcd [ 338.348026][ T24] usb 7-1: device descriptor read/64, error -71 [ 338.452053][ T5918] usb 8-1: USB disconnect, device number 4 [ 338.480008][ T24] usb usb7-port1: attempt power cycle [ 338.611570][T11872] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 338.621245][T11872] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 338.641295][ T5935] gspca_main: vc032x-2.14.0 probing 046d:0897 [ 338.649024][ T5935] gspca_vc032x: reg_r err -71 [ 338.653819][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.660287][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.665601][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.671096][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.680507][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.685865][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.695572][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.702028][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.707386][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.727792][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.733286][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.739872][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.746165][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.754937][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.760715][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.766046][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.771602][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.781245][ T5935] gspca_vc032x: I2c Bus Busy Wait 00 [ 338.786608][ T5935] gspca_vc032x: Unknown sensor... [ 338.792593][ T5935] vc032x 3-1:1.155: probe with driver vc032x failed with error -22 [ 338.810640][ T5935] usb 3-1: USB disconnect, device number 12 [ 338.847985][ T24] usb 7-1: new full-speed USB device number 34 using dummy_hcd [ 338.880487][ T24] usb 7-1: device descriptor read/8, error -71 [ 338.972133][ T5914] usb 4-1: USB disconnect, device number 25 [ 339.117857][ T24] usb 7-1: new full-speed USB device number 35 using dummy_hcd [ 339.139576][ T24] usb 7-1: device descriptor read/8, error -71 [ 339.268796][ T24] usb usb7-port1: unable to enumerate USB device [ 339.425846][ T5150] Bluetooth: hci8: command tx timeout [ 339.473778][T11916] FAULT_INJECTION: forcing a failure. [ 339.473778][T11916] name failslab, interval 1, probability 0, space 0, times 0 [ 339.486883][T11916] CPU: 0 UID: 0 PID: 11916 Comm: syz.7.2246 Tainted: G L syzkaller #0 PREEMPT(full) [ 339.486918][T11916] Tainted: [L]=SOFTLOCKUP [ 339.486926][T11916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 339.486938][T11916] Call Trace: [ 339.486947][T11916] [ 339.486956][T11916] dump_stack_lvl+0xe8/0x150 [ 339.486990][T11916] should_fail_ex+0x412/0x560 [ 339.487028][T11916] should_failslab+0xa8/0x100 [ 339.487052][T11916] __kmalloc_noprof+0xe8/0x760 [ 339.487083][T11916] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 339.487115][T11916] tomoyo_realpath_from_path+0xe3/0x5d0 [ 339.487141][T11916] ? tomoyo_domain+0xd7/0x130 [ 339.487172][T11916] ? tomoyo_path_number_perm+0x219/0x630 [ 339.487204][T11916] tomoyo_path_number_perm+0x246/0x630 [ 339.487239][T11916] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 339.487270][T11916] ? __lock_acquire+0x6b5/0x2cf0 [ 339.487315][T11916] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 339.487367][T11916] ? __fget_files+0x2a/0x420 [ 339.487396][T11916] ? __fget_files+0x2a/0x420 [ 339.487421][T11916] ? __fget_files+0x3a0/0x420 [ 339.487446][T11916] ? __fget_files+0x2a/0x420 [ 339.487486][T11916] security_file_ioctl+0xc3/0x2a0 [ 339.487519][T11916] __se_sys_ioctl+0x47/0x170 [ 339.487543][T11916] do_syscall_64+0xe2/0xf80 [ 339.487571][T11916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.487595][T11916] ? trace_irq_disable+0x37/0x100 [ 339.487615][T11916] ? clear_bhb_loop+0x40/0x90 [ 339.487641][T11916] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.487661][T11916] RIP: 0033:0x7f85c899acb9 [ 339.487681][T11916] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 339.487698][T11916] RSP: 002b:00007f85c9820028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 339.487719][T11916] RAX: ffffffffffffffda RBX: 00007f85c8c15fa0 RCX: 00007f85c899acb9 [ 339.487735][T11916] RDX: 0000200000000140 RSI: 0000000000008b06 RDI: 0000000000000003 [ 339.487748][T11916] RBP: 00007f85c9820090 R08: 0000000000000000 R09: 0000000000000000 [ 339.487761][T11916] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 339.487774][T11916] R13: 00007f85c8c16038 R14: 00007f85c8c15fa0 R15: 00007ffc3dd7e588 [ 339.487808][T11916] [ 339.717127][ T5150] Bluetooth: hci6: command 0x0406 tx timeout [ 339.728221][T11916] ERROR: Out of memory at tomoyo_realpath_from_path. [ 339.921775][T11924] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.2250'. [ 339.980383][ T5838] Bluetooth: hci5: command 0x0406 tx timeout [ 339.986489][ T5150] Bluetooth: hci4: command 0x0406 tx timeout [ 340.079019][ T5935] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 340.229146][ T5935] usb 4-1: Using ep0 maxpacket: 32 [ 340.238605][ T5935] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 223, changing to 11 [ 340.251849][ T5935] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 42636, setting to 1024 [ 340.264902][ T5935] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 340.277134][ T5935] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 340.304582][ T5935] usb 4-1: config 0 descriptor?? [ 340.324552][T11920] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 340.334654][ T5935] hub 4-1:0.0: USB hub found [ 340.357920][ T5918] usb 8-1: new full-speed USB device number 5 using dummy_hcd [ 340.510459][ T5918] usb 8-1: config 0 has an invalid interface number: 113 but max is 0 [ 340.537281][ T5918] usb 8-1: config 0 has no interface number 0 [ 340.552073][ T5935] hub 4-1:0.0: 1 port detected [ 340.553188][ T5918] usb 8-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 340.571173][ T5918] usb 8-1: config 0 interface 113 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 340.582501][ T5918] usb 8-1: config 0 interface 113 has no altsetting 0 [ 340.611141][ T5918] usb 8-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 340.637950][ T5918] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.651362][ T5918] usb 8-1: Product: syz [ 340.655604][ T5918] usb 8-1: Manufacturer: syz [ 340.662426][ T5918] usb 8-1: SerialNumber: syz [ 340.682067][ T5918] usb 8-1: config 0 descriptor?? [ 340.695719][ C0] usb 8-1: NFC: Urb failure (status -71) [ 340.704005][ T5918] usb 8-1: NFC: Unable to get FW version [ 340.720506][ T5918] pn533_usb 8-1:0.113: probe with driver pn533_usb failed with error -90 [ 340.921481][T11929] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2253'. [ 340.947811][ T87] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 341.050177][ T5935] usb 8-1: USB disconnect, device number 5 [ 341.120106][ T87] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 341.135006][ T87] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 341.145093][ T87] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 341.157532][ T87] usb 7-1: config 0 descriptor?? [ 341.371735][ T29] hub 4-1:0.0: hub_ext_port_status failed (err = -71) [ 341.373388][ T5918] usb 4-1: USB disconnect, device number 26 [ 341.574523][ T87] keytouch 0003:0926:3333.0007: fixing up Keytouch IEC report descriptor [ 341.596045][ T87] input: HID 0926:3333 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:0926:3333.0007/input/input17 [ 341.787358][ T87] keytouch 0003:0926:3333.0007: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.6-1/input0 [ 341.982555][ T5935] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 342.152641][ T5935] usb 3-1: Using ep0 maxpacket: 8 [ 342.178462][ T5935] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 342.192107][ T5935] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 342.217054][ T5935] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 342.230740][ T5935] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 342.242127][ T5935] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 342.256741][ T5935] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 342.273168][ T5935] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 342.482521][T11937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 342.500797][T11937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 342.533126][ T5935] usb 3-1: GET_CAPABILITIES returned 0 [ 342.544792][ T5935] usbtmc 3-1:16.0: can't read capabilities [ 342.619205][ T5918] usb 7-1: USB disconnect, device number 36 [ 342.673024][T11962] program syz.3.2266 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 342.701072][T11962] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 342.737869][T11944] usb 3-1: usbtmc_ioctl_clear_out_halt returned -32 [ 342.762065][ T5935] usb 3-1: USB disconnect, device number 13 [ 342.775972][T11964] netlink: 'syz.6.2267': attribute type 9 has an invalid length. [ 342.803820][T11964] netlink: 'syz.6.2267': attribute type 11 has an invalid length. [ 342.834764][T11964] netlink: 'syz.6.2267': attribute type 12 has an invalid length. [ 342.863926][T11964] netlink: 210020 bytes leftover after parsing attributes in process `syz.6.2267'. [ 342.880737][T11964] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2267'. [ 343.428122][T11990] netlink: 40 bytes leftover after parsing attributes in process `syz.7.2278'. [ 343.909326][T12013] vivid-000: disconnect [ 343.914883][T12012] vivid-000: reconnect [ 344.034126][T12021] nbd: couldn't find device at index -37165402 [ 344.568677][ T116] usb 8-1: new low-speed USB device number 6 using dummy_hcd [ 344.707794][ T5935] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 344.728962][ T5914] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 344.732898][ T116] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 344.745993][ T116] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 344.758037][ T116] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 344.770504][ T116] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 344.782796][ T116] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 344.795691][ T116] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 344.803689][ T116] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 344.815604][ T116] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 344.829776][ T116] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 344.841332][ T116] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 344.854048][ T116] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 344.861704][ T116] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 344.873450][ T116] usb 8-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 344.887010][ T5935] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 344.898573][ T116] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 344.909980][ T5935] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 344.915100][ T5914] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 344.921210][ T116] usb 8-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 344.922889][ T5935] usb 7-1: New USB device found, idVendor=046d, idProduct=c287, bcdDevice= 0.00 [ 344.942642][ T5914] usb 4-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 344.942698][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 344.981309][ T5914] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 344.988996][ T29] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 345.000897][ T116] usb 8-1: string descriptor 0 read error: -22 [ 345.007302][ T116] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 345.025483][ T116] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 345.034186][ T5935] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 345.051485][ T116] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 345.061541][ T5935] usb 7-1: config 0 descriptor?? [ 345.338136][ T5848] Bluetooth: hci6: command 0x0406 tx timeout [ 345.362726][ T29] usb 3-1: unable to get BOS descriptor or descriptor too short [ 345.377289][ T29] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 345.386452][ T29] usb 3-1: can't read configurations, error -71 [ 345.478715][ T5935] logitech 0003:046D:C287.0008: unknown main item tag 0x0 [ 345.486709][ T5935] logitech 0003:046D:C287.0008: unknown main item tag 0x0 [ 345.495236][ T5935] logitech 0003:046D:C287.0008: unknown main item tag 0x0 [ 345.503078][ T5935] logitech 0003:046D:C287.0008: unknown main item tag 0x0 [ 345.513565][ T5935] logitech 0003:046D:C287.0008: unknown main item tag 0x0 [ 345.521527][ T5935] logitech 0003:046D:C287.0008: unknown main item tag 0x0 [ 345.532475][ T5935] logitech 0003:046D:C287.0008: unknown main item tag 0x0 [ 345.551023][ T5935] logitech 0003:046D:C287.0008: hidraw0: USB HID v0.00 Device [HID 046d:c287] on usb-dummy_hcd.6-1/input0 [ 345.563532][ T5935] logitech 0003:046D:C287.0008: no inputs found [ 345.683875][T12047] netlink: 'syz.6.2299': attribute type 4 has an invalid length. [ 345.695277][T12047] netlink: 'syz.6.2299': attribute type 1 has an invalid length. [ 345.703947][T12047] netlink: 228 bytes leftover after parsing attributes in process `syz.6.2299'. [ 345.717299][ T87] usb 7-1: USB disconnect, device number 37 [ 346.061445][ T5914] stv0680 4-1:4.0: STV(e): camera ping failed!! [ 346.230395][T12077] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 346.579056][ T5914] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -110 [ 346.587382][ T5914] stv0680 4-1:4.0: last error: 0, command = 0x0 [ 346.972596][T12098] syzkaller1: entered promiscuous mode [ 346.981070][T12098] syzkaller1: entered allmulticast mode [ 347.095245][T12103] genirq: Flags mismatch irq 10. 00200000 (aio_iiro_16) vs. 00200080 (virtio2) [ 347.473081][ T5935] usb 4-1: USB disconnect, device number 27 [ 347.601758][ T5848] Bluetooth: hci7: Malformed LE Event: 0x0b [ 347.855410][T12138] input: syz0 as /devices/virtual/input/input18 [ 347.918025][ T5935] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 347.926921][ T116] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 347.986442][T12140] infiniband: Added to hash: ib_dev=ffff888043208000 (0)() ndev=ffff88805fbd0000 (26)(veth0_to_team) [ 348.067804][ T5935] usb 4-1: Using ep0 maxpacket: 32 [ 348.075919][ T5935] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 9 [ 348.100526][ T116] usb 7-1: config index 0 descriptor too short (expected 39, got 27) [ 348.111882][ T116] usb 7-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 348.129253][ T116] usb 7-1: config 0 interface 0 has no altsetting 0 [ 348.129563][ T5935] usb 4-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 348.177812][ T116] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 348.199718][ T116] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 348.208501][ T5935] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 348.216660][ T116] usb 7-1: Product: syz [ 348.224801][ T5935] usb 4-1: Product: syz [ 348.231329][ T116] usb 7-1: Manufacturer: syz [ 348.240656][ T5935] usb 4-1: Manufacturer: syz [ 348.247719][ T116] usb 7-1: SerialNumber: syz [ 348.257729][ T5935] usb 4-1: SerialNumber: syz [ 348.269187][ T116] usb 7-1: config 0 descriptor?? [ 348.287561][ T116] hub 7-1:0.0: bad descriptor, ignoring hub [ 348.296882][ T116] hub 7-1:0.0: probe with driver hub failed with error -5 [ 348.308166][ T5935] usb 4-1: config 0 descriptor?? [ 348.315516][T12121] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 348.328021][ T116] usb 7-1: selecting invalid altsetting 0 [ 348.357284][ T5935] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input19 [ 348.549015][ T87] usb 4-1: USB disconnect, device number 28 [ 348.549373][ C1] usbtouchscreen 4-1:0.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 348.588780][ T116] usb 7-1: USB disconnect, device number 38 [ 348.659876][T11009] udevd[11009]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 348.833203][T12140] infiniband syz1: set active [ 348.840180][T12140] infiniband syz1: added veth0_to_team [ 348.852249][T12140] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 348.856832][T12140] infiniband syz1: Couldn't open port 1 [ 348.931783][T12140] RDS/IB: syz1: added [ 348.936471][T12140] smc: adding ib device syz1 with port count 1 [ 348.945183][T12140] smc: ib device syz1 port 1 has pnetid SYZ0 (user defined) [ 349.007773][ T116] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 349.184379][ T116] usb 7-1: config index 0 descriptor too short (expected 39, got 27) [ 349.197752][ T116] usb 7-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 349.209289][ T116] usb 7-1: config 0 interface 0 has no altsetting 0 [ 349.228125][ T116] usb 7-1: string descriptor 0 read error: -22 [ 349.235171][ T116] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 349.252847][ T116] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 349.266227][ T116] usb 7-1: config 0 descriptor?? [ 349.283810][ T116] hub 7-1:0.0: bad descriptor, ignoring hub [ 349.293895][ T116] hub 7-1:0.0: probe with driver hub failed with error -5 [ 349.305213][ T116] usb 7-1: selecting invalid altsetting 0 [ 349.338755][ T5935] usb 8-1: USB disconnect, device number 6 [ 349.534634][ T5848] Bluetooth: hci8: Malformed LE Event: 0x0b [ 349.600072][ T116] usb 7-1: USB disconnect, device number 39 [ 350.291873][ T5848] Bluetooth: hci8: Malformed LE Event: 0x0b [ 350.587774][T12060] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 350.717799][ T5914] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 350.758480][T12060] usb 7-1: Using ep0 maxpacket: 32 [ 350.766655][T12060] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 223, changing to 11 [ 350.789953][T12060] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 42636, setting to 1024 [ 350.817785][T12060] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 350.826949][T12060] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 350.862672][T12060] usb 7-1: config 0 descriptor?? [ 350.887941][T12190] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 350.897677][ T5914] usb 8-1: Using ep0 maxpacket: 32 [ 350.908525][T12060] hub 7-1:0.0: USB hub found [ 350.911590][ T5914] usb 8-1: unable to get BOS descriptor or descriptor too short [ 350.932980][ T5914] usb 8-1: config 3 interface 0 altsetting 8 bulk endpoint 0x7 has invalid maxpacket 32 [ 350.953965][ T5914] usb 8-1: config 3 interface 0 has no altsetting 0 [ 350.974510][ T5914] usb 8-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=94.13 [ 350.984348][ T5914] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 351.004948][ T5914] usb 8-1: Product: syz [ 351.009607][ T5914] usb 8-1: Manufacturer: syz [ 351.014311][ T5914] usb 8-1: SerialNumber: syz [ 351.020512][ T1928] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (12)(syz1) rdma_ndev=ffff88805fbd0000 (29)(veth0_to_team) cookie=ffff888036a7c000 (15)(syzkaller1) start [ 351.052521][ T1928] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (12)(syz1) rdma_ndev=ffff88805fbd0000 (29)(veth0_to_team) cookie=ffff888036a7c000 (5)(syzkaller1) end [ 351.073975][T12194] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 351.097994][T12060] hub 7-1:0.0: 1 port detected [ 351.296821][ T5914] usb 8-1: ucan: probing device on interface #0 [ 351.307204][ T5914] usb 8-1: ucan: invalid endpoint configuration [ 351.321546][ T5914] usb 8-1: ucan: probe failed; try to update the device firmware [ 351.349024][ T5914] usb 8-1: USB disconnect, device number 7 [ 351.677717][ T5918] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 351.838245][ T5918] usb 4-1: Using ep0 maxpacket: 16 [ 351.859499][ T5918] usb 4-1: config 9 has an invalid interface number: 202 but max is 0 [ 351.870729][ T5918] usb 4-1: config 9 has no interface number 0 [ 351.876894][ T5918] usb 4-1: config 9 interface 202 has no altsetting 0 [ 351.911412][T12060] hub 7-1:0.0: hub_ext_port_status failed (err = -71) [ 351.921807][ T5914] usb 7-1: USB disconnect, device number 40 [ 351.947047][ T5918] usb 4-1: New USB device found, idVendor=16d8, idProduct=6803, bcdDevice=c5.96 [ 351.960224][ T5918] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 351.972634][ T5918] usb 4-1: Product: syz [ 351.976875][ T5918] usb 4-1: Manufacturer: syz [ 351.983463][ T5918] usb 4-1: SerialNumber: syz [ 351.992105][ T5848] Bluetooth: hci2: Malformed LE Event: 0x0b [ 352.213978][T12214] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 352.232435][T12214] block device autoloading is deprecated and will be removed. [ 352.248217][T12208] tmpfs: Bad value for 'mpol' [ 352.313404][ T5918] usb 4-1: USB disconnect, device number 29 [ 352.764566][ T5848] Bluetooth: hci6: Malformed LE Event: 0x0b [ 353.297752][ T116] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 353.357731][ T5935] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 353.449787][ T116] usb 4-1: Using ep0 maxpacket: 32 [ 353.457567][ T116] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 223, changing to 11 [ 353.472902][ T116] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 42636, setting to 1024 [ 353.485340][ T116] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 353.496333][ T116] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 353.518473][ T116] usb 4-1: config 0 descriptor?? [ 353.526296][T12244] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 353.533884][ T5935] usb 7-1: Using ep0 maxpacket: 32 [ 353.549162][ T5935] usb 7-1: config 0 has an invalid descriptor of length 33, skipping remainder of the config [ 353.561242][ T116] hub 4-1:0.0: USB hub found [ 353.585532][ T5935] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 353.599502][ T5935] usb 7-1: New USB device found, idVendor=258a, idProduct=0033, bcdDevice= 0.00 [ 353.615349][ T5935] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 353.644087][ T5935] usb 7-1: config 0 descriptor?? [ 353.746996][ T116] hub 4-1:0.0: 1 port detected [ 353.941955][ T1304] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888067d28000 (16)(syzkaller1) start [ 353.963268][ T1304] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888067d28000 (12)(syzkaller1) end [ 354.090652][ T5935] usb 7-1: string descriptor 0 read error: -71 [ 354.108614][ T5935] usb 7-1: USB disconnect, device number 41 [ 354.573543][ T116] hub 4-1:0.0: hub_ext_port_status failed (err = -71) [ 354.580792][ T5935] usb 4-1: USB disconnect, device number 30 [ 354.864629][ T1928] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888065a7c000 (13)(syzkaller1) start [ 354.892651][ T1928] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888065a7c000 (9)(syzkaller1) end [ 355.338044][ T5848] Bluetooth: hci6: command 0x0406 tx timeout [ 355.344973][ T5918] usb 7-1: new full-speed USB device number 42 using dummy_hcd [ 355.487776][ T5918] usb 7-1: device descriptor read/64, error -71 [ 355.508801][T11626] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888079010000 (16)(syzkaller1) start [ 355.526997][T11626] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888079010000 (12)(syzkaller1) end [ 355.554292][T12315] sit0: entered promiscuous mode [ 355.563405][T12315] netlink: 'syz.2.2400': attribute type 1 has an invalid length. [ 355.574949][T12315] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2400'. [ 355.727736][ T5918] usb 7-1: new full-speed USB device number 43 using dummy_hcd [ 355.759916][ T51] Bluetooth: hci8: Malformed LE Event: 0x0b [ 355.832648][ T51] Bluetooth: unknown link type 128 [ 355.857753][ T5918] usb 7-1: device descriptor read/64, error -71 [ 355.930983][T12328] FAULT_INJECTION: forcing a failure. [ 355.930983][T12328] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 355.946850][T12328] CPU: 1 UID: 0 PID: 12328 Comm: syz.7.2406 Tainted: G L syzkaller #0 PREEMPT(full) [ 355.946875][T12328] Tainted: [L]=SOFTLOCKUP [ 355.946880][T12328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 355.946889][T12328] Call Trace: [ 355.946895][T12328] [ 355.946901][T12328] dump_stack_lvl+0xe8/0x150 [ 355.946925][T12328] should_fail_ex+0x412/0x560 [ 355.946951][T12328] _copy_from_user+0x2d/0xb0 [ 355.946969][T12328] ___sys_sendmsg+0x1c6/0x360 [ 355.946989][T12328] ? __lock_acquire+0x6b5/0x2cf0 [ 355.947013][T12328] ? __pfx____sys_sendmsg+0x10/0x10 [ 355.947036][T12328] ? kstrtouint+0x6e/0xe0 [ 355.947075][T12328] ? __fget_files+0x2a/0x420 [ 355.947096][T12328] ? __fget_files+0x3a0/0x420 [ 355.947122][T12328] __sys_sendmmsg+0x27c/0x4e0 [ 355.947146][T12328] ? __pfx___sys_sendmmsg+0x10/0x10 [ 355.947165][T12328] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 355.947204][T12328] ? ksys_write+0x242/0x270 [ 355.947227][T12328] ? __pfx_ksys_write+0x10/0x10 [ 355.947254][T12328] __x64_sys_sendmmsg+0xa0/0xc0 [ 355.947275][T12328] do_syscall_64+0xe2/0xf80 [ 355.947295][T12328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.947309][T12328] ? trace_irq_disable+0x37/0x100 [ 355.947324][T12328] ? clear_bhb_loop+0x40/0x90 [ 355.947342][T12328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.947356][T12328] RIP: 0033:0x7f85c899acb9 [ 355.947370][T12328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 355.947383][T12328] RSP: 002b:00007f85c9820028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 355.947399][T12328] RAX: ffffffffffffffda RBX: 00007f85c8c15fa0 RCX: 00007f85c899acb9 [ 355.947410][T12328] RDX: 0000000000000001 RSI: 0000200000004580 RDI: 0000000000000003 [ 355.947419][T12328] RBP: 00007f85c9820090 R08: 0000000000000000 R09: 0000000000000000 [ 355.947428][T12328] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000001 [ 355.947437][T12328] R13: 00007f85c8c16038 R14: 00007f85c8c15fa0 R15: 00007ffc3dd7e588 [ 355.947459][T12328] [ 356.013079][ T5918] usb usb7-port1: attempt power cycle [ 356.427786][ T116] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 356.518167][ T5918] usb 7-1: new full-speed USB device number 44 using dummy_hcd [ 356.568312][ T5918] usb 7-1: device descriptor read/8, error -71 [ 356.583302][ T116] usb 8-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 356.601448][ T116] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.613990][ T9588] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888079010000 (9)(syzkaller1) start [ 356.632301][ T116] usb 8-1: Product: syz [ 356.636849][ T116] usb 8-1: Manufacturer: syz [ 356.643711][ T116] usb 8-1: SerialNumber: syz [ 356.650137][ T9588] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888079010000 (4)(syzkaller1) end [ 356.726174][ T9342] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff88801188c000 (16)(syzkaller1) start [ 356.745882][ T9342] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff88801188c000 (12)(syzkaller1) end [ 356.817886][ T5918] usb 7-1: new full-speed USB device number 45 using dummy_hcd [ 356.849194][ T5918] usb 7-1: device descriptor read/8, error -71 [ 356.959273][ T5918] usb usb7-port1: unable to enumerate USB device [ 357.037779][T12060] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 357.092792][ T116] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 357.111512][ T116] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 357.197856][T12060] usb 3-1: Using ep0 maxpacket: 16 [ 357.204775][T12060] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 357.218677][T12060] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 357.232010][T12060] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 357.241339][T12060] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.249582][T12060] usb 3-1: Product: syz [ 357.253950][T12060] usb 3-1: Manufacturer: syz [ 357.260622][T12060] usb 3-1: SerialNumber: syz [ 357.269987][T12060] usb 3-1: config 0 descriptor?? [ 357.282520][T12060] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 357.292028][T12060] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 357.883430][T12060] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 357.897811][ T51] Bluetooth: hci8: command tx timeout [ 357.906199][T12060] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 358.274075][T11761] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff88801188c000 (16)(syzkaller1) start [ 358.293189][T11761] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff88801188c000 (7)(syzkaller1) end [ 358.339679][T12330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 358.350020][T12330] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 358.364009][ T116] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 358.400350][ T116] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPIPE [ 358.519500][T12060] em28xx 3-1:0.0: Unknown AC97 audio processor detected! [ 358.636142][T12363] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 358.653543][T12363] overlayfs: overlapping lowerdir path [ 358.786595][ T9588] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888065a74000 (12)(syzkaller1) start [ 358.804836][ T9588] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888065a74000 (7)(syzkaller1) end [ 358.832130][T12330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 358.842840][T12330] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 358.852502][T12060] em28xx 3-1:0.0: couldn't setup AC97 register 4 [ 358.869752][T12060] em28xx 3-1:0.0: couldn't setup AC97 register 6 [ 358.880971][T12060] em28xx 3-1:0.0: couldn't setup AC97 register 54 [ 358.891424][T12060] em28xx 3-1:0.0: couldn't setup AC97 register 56 [ 358.911140][T12060] usb 3-1: USB disconnect, device number 16 [ 359.151959][T12375] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 359.165038][T12375] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 359.292730][ T116] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000080. ret = -EPIPE [ 359.306858][ T116] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 359.319226][ T116] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 359.332108][ T116] lan78xx 8-1:1.0: probe with driver lan78xx failed with error -32 [ 359.347241][ T116] usb 8-1: USB disconnect, device number 8 [ 359.378167][ T5953] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 359.537701][ T5953] usb 4-1: Using ep0 maxpacket: 16 [ 359.544681][ T5953] usb 4-1: config 0 has an invalid interface number: 111 but max is 0 [ 359.565660][ T5953] usb 4-1: config 0 has an invalid descriptor of length 152, skipping remainder of the config [ 359.581728][ T5953] usb 4-1: config 0 has no interface number 0 [ 359.610213][ T5953] usb 4-1: config 0 interface 111 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 359.632506][ T5953] usb 4-1: New USB device found, idVendor=0a12, idProduct=5d10, bcdDevice=fc.66 [ 359.642565][ T5953] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.658948][ T5953] usb 4-1: Product: syz [ 359.668512][ T5953] usb 4-1: Manufacturer: syz [ 359.673264][ T5953] usb 4-1: SerialNumber: syz [ 359.701104][ T5953] usb 4-1: config 0 descriptor?? [ 359.723019][ T9380] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888067d28000 (16)(syzkaller1) start [ 359.751974][ T9380] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888067d28000 (10)(syzkaller1) end [ 359.934293][ T5953] usb 4-1: USB disconnect, device number 31 [ 359.969729][T12386] FAULT_INJECTION: forcing a failure. [ 359.969729][T12386] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 359.997996][T12386] CPU: 0 UID: 0 PID: 12386 Comm: syz.6.2432 Tainted: G L syzkaller #0 PREEMPT(full) [ 359.998030][T12386] Tainted: [L]=SOFTLOCKUP [ 359.998038][T12386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 359.998051][T12386] Call Trace: [ 359.998060][T12386] [ 359.998068][T12386] dump_stack_lvl+0xe8/0x150 [ 359.998102][T12386] should_fail_ex+0x412/0x560 [ 359.998146][T12386] _copy_from_iter+0x1d3/0x1670 [ 359.998181][T12386] ? __pfx__copy_from_iter+0x10/0x10 [ 359.998202][T12386] ? __lock_acquire+0x6b5/0x2cf0 [ 359.998244][T12386] tun_get_user+0x275/0x3dd0 [ 359.998293][T12386] ? __pfx_tun_get_user+0x10/0x10 [ 359.998320][T12386] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 359.998347][T12386] ? lockdep_hardirqs_on+0x7a/0x110 [ 359.998374][T12386] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 359.998406][T12386] ? save_netdev_trace_buffer+0x4e2/0x610 [ 359.998428][T12386] ? kstrtoull+0x12f/0x1d0 [ 359.998465][T12386] ? ref_tracker_alloc+0x363/0x4d0 [ 359.998500][T12386] ? tun_chr_write_iter+0x60/0x210 [ 359.998523][T12386] ? vfs_write+0x61d/0xb90 [ 359.998552][T12386] ? ksys_write+0x150/0x270 [ 359.998583][T12386] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 359.998609][T12386] ? tun_get+0x1c/0x2f0 [ 359.998641][T12386] ? tun_get+0x1c/0x2f0 [ 359.998665][T12386] ? tun_get+0x1c/0x2f0 [ 359.998696][T12386] tun_chr_write_iter+0x113/0x210 [ 359.998725][T12386] vfs_write+0x61d/0xb90 [ 359.998764][T12386] ? __pfx_vfs_write+0x10/0x10 [ 359.998819][T12386] ? __fget_files+0x2a/0x420 [ 359.998855][T12386] ksys_write+0x150/0x270 [ 359.998889][T12386] ? __pfx_ksys_write+0x10/0x10 [ 359.998932][T12386] do_syscall_64+0xe2/0xf80 [ 359.998959][T12386] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.998980][T12386] ? trace_irq_disable+0x37/0x100 [ 359.999001][T12386] ? clear_bhb_loop+0x40/0x90 [ 359.999027][T12386] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.999047][T12386] RIP: 0033:0x7f836a19acb9 [ 359.999066][T12386] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 359.999084][T12386] RSP: 002b:00007f836b108028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 359.999106][T12386] RAX: ffffffffffffffda RBX: 00007f836a415fa0 RCX: 00007f836a19acb9 [ 359.999122][T12386] RDX: 0000000000000066 RSI: 0000200000000240 RDI: 0000000000000004 [ 359.999135][T12386] RBP: 00007f836b108090 R08: 0000000000000000 R09: 0000000000000000 [ 359.999148][T12386] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 359.999160][T12386] R13: 00007f836a416038 R14: 00007f836a415fa0 R15: 00007ffdf904bbe8 [ 359.999193][T12386] [ 360.608316][ T116] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 360.657738][ T5953] usb 7-1: new full-speed USB device number 46 using dummy_hcd [ 360.757726][ T116] usb 3-1: Using ep0 maxpacket: 32 [ 360.775348][ T116] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 223, changing to 11 [ 360.786841][ T116] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 42636, setting to 1024 [ 360.800591][ T116] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 360.810240][ T116] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 360.816241][ T5953] usb 7-1: device descriptor read/64, error -71 [ 360.827342][ T116] usb 3-1: config 0 descriptor?? [ 360.857498][T12394] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 360.866062][ T9380] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff88805f8f8000 (12)(syzkaller1) start [ 360.886747][ T116] hub 3-1:0.0: USB hub found [ 360.891903][ T9380] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff88805f8f8000 (5)(syzkaller1) end [ 361.067767][ T5953] usb 7-1: new full-speed USB device number 47 using dummy_hcd [ 361.081769][ T116] hub 3-1:0.0: 1 port detected [ 361.103559][ T65] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff88805f8f8000 (16)(syzkaller1) start [ 361.121446][ T65] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff88805f8f8000 (12)(syzkaller1) end [ 361.207804][ T5953] usb 7-1: device descriptor read/64, error -71 [ 361.318481][ T5953] usb usb7-port1: attempt power cycle [ 361.657991][ T5953] usb 7-1: new full-speed USB device number 48 using dummy_hcd [ 361.688638][ T5953] usb 7-1: device descriptor read/8, error -71 [ 361.903085][ T29] hub 3-1:0.0: hub_ext_port_status failed (err = -71) [ 361.917437][ T116] usb 3-1: USB disconnect, device number 17 [ 361.947917][ T5953] usb 7-1: new full-speed USB device number 49 using dummy_hcd [ 361.968488][ T5953] usb 7-1: device descriptor read/8, error -71 [ 362.077960][ T5953] usb usb7-port1: unable to enumerate USB device [ 362.213958][ T9380] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888029194000 (16)(syzkaller1) start [ 362.236715][ T31] INFO: task syz.0.1165:8812 blocked for more than 143 seconds. [ 362.245112][ T31] Tainted: G L syzkaller #0 [ 362.247921][ T9380] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888043208000 (11)(syz1) rdma_ndev=ffff88805fbd0000 (28)(veth0_to_team) cookie=ffff888029194000 (12)(syzkaller1) end [ 362.253494][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 362.280281][ T31] task:syz.0.1165 state:D stack:25544 pid:8812 tgid:8811 ppid:5845 task_flags:0x400140 flags:0x00080002 [ 362.292708][ T31] Call Trace: [ 362.296061][ T31] [ 362.299270][ T31] __schedule+0x153e/0x4fe0 [ 362.303970][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 362.309118][ T31] ? __pfx___schedule+0x10/0x10 [ 362.314163][ T31] ? schedule+0x90/0x360 [ 362.318896][ T31] schedule+0x164/0x360 [ 362.323096][ T31] schedule_preempt_disabled+0x13/0x30 [ 362.331556][ T31] __mutex_lock+0x7fe/0x1300 [ 362.336267][ T31] ? __mutex_lock+0x5ac/0x1300 [ 362.341370][ T31] ? nfsd_shutdown_threads+0x4e/0xd0 [ 362.346747][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 362.352079][ T31] ? net_generic+0x1e/0x240 [ 362.356621][ T31] ? net_generic+0x1e/0x240 [ 362.361289][ T31] nfsd_shutdown_threads+0x4e/0xd0 [ 362.366541][ T31] nfsd_umount+0x41/0x60 [ 362.370933][ T31] deactivate_locked_super+0xbc/0x130 [ 362.376359][ T31] cleanup_mnt+0x437/0x4d0 [ 362.381536][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 362.386814][ T31] task_work_run+0x1d9/0x270 [ 362.392933][ T31] ? __pfx_task_work_run+0x10/0x10 [ 362.403238][ T31] exit_to_user_mode_loop+0xed/0x480 [ 362.408840][ T31] ? rcu_is_watching+0x15/0xb0 [ 362.413694][ T31] do_syscall_64+0x2b7/0xf80 [ 362.418537][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.424698][ T31] ? trace_irq_disable+0x37/0x100 [ 362.432994][ T31] ? clear_bhb_loop+0x40/0x90 [ 362.437872][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.443818][ T31] RIP: 0033:0x7fcc8d39acb9 [ 362.461585][ T31] RSP: 002b:00007fcc8e1b3028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 362.470294][ T31] RAX: fffffffffffffffe RBX: 00007fcc8d615fa0 RCX: 00007fcc8d39acb9 [ 362.478533][ T31] RDX: 0000200000002280 RSI: 0000200000000100 RDI: 0000000000000000 [ 362.486654][ T31] RBP: 00007fcc8d408bf7 R08: 0000000000000000 R09: 0000000000000000 [ 362.494819][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 362.503218][ T31] R13: 00007fcc8d616038 R14: 00007fcc8d615fa0 R15: 00007ffd9b824288 [ 362.512990][ T31] [ 362.516281][ T31] INFO: task syz.4.1184:8896 blocked for more than 143 seconds. [ 362.525987][ T31] Tainted: G L syzkaller #0 [ 362.535950][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 362.545131][ T31] task:syz.4.1184 state:D stack:26912 pid:8896 tgid:8895 ppid:8834 task_flags:0x400140 flags:0x00080002 [ 362.557358][ T31] Call Trace: [ 362.560735][ T31] [ 362.563688][ T31] __schedule+0x153e/0x4fe0 [ 362.568301][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 362.573305][ T31] ? __pfx___schedule+0x10/0x10 [ 362.578282][ T31] ? schedule+0x90/0x360 [ 362.582570][ T31] schedule+0x164/0x360 [ 362.586849][ T31] schedule_preempt_disabled+0x13/0x30 [ 362.592501][ T31] rwsem_down_read_slowpath+0x61e/0x920 [ 362.598166][ T31] ? rwsem_down_read_slowpath+0x4d9/0x920 [ 362.603946][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 362.610301][ T31] ? super_lock+0x2d6/0x3d0 [ 362.614901][ T31] down_read+0x99/0x2e0 [ 362.620540][ T31] ? super_lock+0x263/0x3d0 [ 362.625122][ T31] super_lock+0x2d6/0x3d0 [ 362.629808][ T31] ? __pfx_super_lock+0x10/0x10 [ 362.640253][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 362.645359][ T31] ? do_raw_spin_unlock+0xf5/0x210 [ 362.650703][ T31] __iterate_supers+0x126/0x290 [ 362.655607][ T31] ? __pfx_quota_sync_one+0x10/0x10 [ 362.660924][ T31] __se_sys_quotactl+0x3a7/0x9e0 [ 362.665914][ T31] ? __pfx___se_sys_quotactl+0x10/0x10 [ 362.671581][ T31] do_syscall_64+0xe2/0xf80 [ 362.676141][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.682316][ T31] ? trace_irq_disable+0x37/0x100 [ 362.687381][ T31] ? clear_bhb_loop+0x40/0x90 [ 362.692167][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.698142][ T31] RIP: 0033:0x7f2745f9acb9 [ 362.702574][ T31] RSP: 002b:00007f2746e9a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000b3 [ 362.712120][ T31] RAX: ffffffffffffffda RBX: 00007f2746215fa0 RCX: 00007f2745f9acb9 [ 362.720385][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff80000102 [ 362.729267][ T31] RBP: 00007f2746008bf7 R08: 0000000000000000 R09: 0000000000000000 [ 362.741009][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 362.749329][ T31] R13: 00007f2746216038 R14: 00007f2746215fa0 R15: 00007fff6db082e8 [ 362.757379][ T31] [ 362.762138][ T31] [ 362.762138][ T31] Showing all locks held in the system: [ 362.770234][ T31] 3 locks held by kworker/u8:0/12: [ 362.775701][ T31] #0: ffff8880b853abe0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 [ 362.786204][ T31] #1: ffff8880b8524588 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 [ 362.795348][ T31] #2: ffff88801e6e2890 (&p->pi_lock){-.-.}-{2:2}, at: try_to_wake_up+0x66/0x12a0 [ 362.804713][ T31] 1 lock held by khungtaskd/31: [ 362.809661][ T31] #0: ffffffff8e75dde0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 362.819650][ T31] 2 locks held by getty/5583: [ 362.824351][ T31] #0: ffff8880375000a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 362.834479][ T31] #1: ffffc9000332e2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 362.846858][ T31] 2 locks held by syz.1.1132/8733: [ 362.852190][ T31] #0: ffffffff8fc445f0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 362.861750][ T31] #1: ffffffff8ea7f868 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x141/0x16c0 [ 362.872295][ T31] 2 locks held by syz.0.1165/8812: [ 362.877456][ T31] #0: ffff8880581440e0 (&type->s_umount_key#86){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 [ 362.890703][ T31] #1: ffffffff8ea7f868 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x4e/0xd0 [ 362.900556][ T31] 1 lock held by syz.4.1184/8896: [ 362.905622][ T31] #0: ffff8880581440e0 (&type->s_umount_key#86){++++}-{4:4}, at: super_lock+0x2d6/0x3d0 [ 362.915751][ T31] 1 lock held by syz.5.2057/11299: [ 362.920931][ T31] #0: ffff8880581440e0 (&type->s_umount_key#86){++++}-{4:4}, at: super_lock+0x2d6/0x3d0 [ 362.930991][ T31] 1 lock held by syz-executor/11700: [ 362.936304][ T31] #0: ffff8880b843abe0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 [ 362.949819][ T31] 1 lock held by poweroff/12161: [ 362.954813][ T31] #0: ffff8880581440e0 (&type->s_umount_key#86){++++}-{4:4}, at: super_lock+0x2d6/0x3d0 [ 362.964882][ T31] 2 locks held by syz.3.2447/12422: [ 362.970197][ T31] #0: ffffffff8fbd6408 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 362.979319][ T31] #1: ffffffff8e764078 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 362.990403][ T31] 1 lock held by syz.7.2449/12427: [ 362.995528][ T31] #0: ffffffff8e763f40 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 363.005703][ T31] [ 363.011611][ T31] ============================================= [ 363.011611][ T31] [ 363.024854][ T31] NMI backtrace for cpu 1 [ 363.024876][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 363.024904][ T31] Tainted: [L]=SOFTLOCKUP [ 363.024912][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 363.024925][ T31] Call Trace: [ 363.024933][ T31] [ 363.024941][ T31] dump_stack_lvl+0xe8/0x150 [ 363.024972][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 363.024995][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 363.025024][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 363.025050][ T31] sys_info+0x135/0x170 [ 363.025081][ T31] watchdog+0xf90/0xfe0 [ 363.025108][ T31] ? watchdog+0x209/0xfe0 [ 363.025138][ T31] kthread+0x388/0x470 [ 363.025159][ T31] ? __pfx_watchdog+0x10/0x10 [ 363.025179][ T31] ? __pfx_kthread+0x10/0x10 [ 363.025201][ T31] ret_from_fork+0x51b/0xa40 [ 363.025230][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 363.025256][ T31] ? __switch_to+0xc7d/0x1400 [ 363.025282][ T31] ? __pfx_kthread+0x10/0x10 [ 363.025304][ T31] ret_from_fork_asm+0x1a/0x30 [ 363.025349][ T31] [ 363.025357][ T31] Sending NMI from CPU 1 to CPUs 0: [ 363.144834][ C0] NMI backtrace for cpu 0 [ 363.144853][ C0] CPU: 0 UID: 0 PID: 11598 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 363.144878][ C0] Tainted: [L]=SOFTLOCKUP [ 363.144885][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 363.144896][ C0] RIP: 0010:lock_acquire+0xbe/0x330 [ 363.144926][ C0] Code: 98 5b 78 11 85 c0 0f 85 bf 00 00 00 65 48 8b 05 e0 15 78 11 83 b8 14 0b 00 00 00 0f 85 aa 00 00 00 4c 89 74 24 10 4d 89 fe 9c <41> 5f fa 48 c7 c7 3a 96 e0 8d e8 d3 30 ea 09 65 ff 05 5c 5b 78 11 [ 363.144941][ C0] RSP: 0018:ffffc90004ab73b0 EFLAGS: 00000246 [ 363.144958][ C0] RAX: ffff888027428000 RBX: 0000000000000000 RCX: 0000000080000001 [ 363.144971][ C0] RDX: 0000000000000000 RSI: ffffffff81759272 RDI: 1ffffffff1cebbbc [ 363.144983][ C0] RBP: ffffffff81759255 R08: 0000000000000000 R09: 0000000000000000 [ 363.144994][ C0] R10: ffffc90004ab7578 R11: ffffffff81aeeb30 R12: 0000000000000002 [ 363.145006][ C0] R13: ffffffff8e75dde0 R14: 0000000000000000 R15: 0000000000000000 [ 363.145017][ C0] FS: 0000555565c17500(0000) GS:ffff88812529e000(0000) knlGS:0000000000000000 [ 363.145032][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 363.145043][ C0] CR2: 00007f85c8bdfd58 CR3: 0000000029920000 CR4: 00000000003526f0 [ 363.145059][ C0] Call Trace: [ 363.145066][ C0] [ 363.145077][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 363.145104][ C0] ? __kvmalloc_node_noprof+0x528/0x8a0 [ 363.145130][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 363.145155][ C0] unwind_next_frame+0xc2/0x23c0 [ 363.145179][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 363.145207][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 363.145232][ C0] ? __kasan_kmalloc+0x93/0xb0 [ 363.145258][ C0] ? __kvmalloc_node_noprof+0x528/0x8a0 [ 363.145285][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 363.145306][ C0] arch_stack_walk+0x11b/0x150 [ 363.145334][ C0] ? __kvmalloc_node_noprof+0x528/0x8a0 [ 363.145362][ C0] stack_trace_save+0xa9/0x100 [ 363.145381][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 363.145402][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 363.145425][ C0] kasan_save_track+0x3e/0x80 [ 363.145449][ C0] ? kasan_save_track+0x3e/0x80 [ 363.145472][ C0] ? __kasan_kmalloc+0x93/0xb0 [ 363.145503][ C0] ? __kvmalloc_node_noprof+0x528/0x8a0 [ 363.145555][ C0] __kasan_kmalloc+0x93/0xb0 [ 363.145581][ C0] __kvmalloc_node_noprof+0x528/0x8a0 [ 363.145606][ C0] ? translate_table+0x191/0x20b0 [ 363.145633][ C0] ? __kvmalloc_node_noprof+0x393/0x8a0 [ 363.145661][ C0] translate_table+0x191/0x20b0 [ 363.145701][ C0] ? __pfx_translate_table+0x10/0x10 [ 363.145727][ C0] ? __might_fault+0xaf/0x130 [ 363.145748][ C0] ? __might_fault+0xaf/0x130 [ 363.145778][ C0] ? _copy_from_user+0x94/0xb0 [ 363.145800][ C0] do_ip6t_set_ctl+0x9fe/0xe10 [ 363.145818][ C0] ? rcu_is_watching+0x15/0xb0 [ 363.145843][ C0] ? trace_contention_end+0x39/0x100 [ 363.145860][ C0] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 363.145885][ C0] ? __pfx___mutex_lock+0x10/0x10 [ 363.145909][ C0] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 363.145938][ C0] ? __pfx_aa_sk_perm+0x10/0x10 [ 363.145958][ C0] nf_setsockopt+0x26f/0x290 [ 363.145979][ C0] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 363.146000][ C0] do_sock_setsockopt+0x17c/0x1b0 [ 363.146024][ C0] __x64_sys_setsockopt+0x13d/0x1b0 [ 363.146048][ C0] do_syscall_64+0xe2/0xf80 [ 363.146071][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 363.146088][ C0] ? trace_irq_disable+0x37/0x100 [ 363.146106][ C0] ? clear_bhb_loop+0x40/0x90 [ 363.146126][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 363.146142][ C0] RIP: 0033:0x7f85c899c51a [ 363.146156][ C0] Code: 48 83 ec 10 48 63 c9 48 63 ff 45 89 c9 6a 2c e8 ec 99 fb ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 [ 363.146171][ C0] RSP: 002b:00007ffc3dd7e1f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000036 [ 363.146188][ C0] RAX: ffffffffffffffda RBX: 00007ffc3dd7e280 RCX: 00007f85c899c51a [ 363.146200][ C0] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 363.146211][ C0] RBP: 0000000000000003 R08: 00000000000003b8 R09: 0000000000000000 [ 363.146221][ C0] R10: 00007f85c8bdfd00 R11: 0000000000000202 R12: 00007f85c8bdfca0 [ 363.146233][ C0] R13: 00007ffc3dd7e21c R14: 0000000000000000 R15: 00007f85c8be1e60 [ 363.146256][ C0] [ 363.598895][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 363.605801][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 363.616531][ T31] Tainted: [L]=SOFTLOCKUP [ 363.620983][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 363.631071][ T31] Call Trace: [ 363.634405][ T31] [ 363.637344][ T31] vpanic+0x1e0/0x670 [ 363.641375][ T31] panic+0xc5/0xd0 [ 363.645132][ T31] ? __pfx_panic+0x10/0x10 [ 363.649581][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 363.655010][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 363.661189][ T31] watchdog+0xfda/0xfe0 [ 363.665392][ T31] ? watchdog+0x209/0xfe0 [ 363.669774][ T31] kthread+0x388/0x470 [ 363.673886][ T31] ? __pfx_watchdog+0x10/0x10 [ 363.678601][ T31] ? __pfx_kthread+0x10/0x10 [ 363.683238][ T31] ret_from_fork+0x51b/0xa40 [ 363.687883][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 363.693215][ T31] ? __switch_to+0xc7d/0x1400 [ 363.697948][ T31] ? __pfx_kthread+0x10/0x10 [ 363.702637][ T31] ret_from_fork_asm+0x1a/0x30 [ 363.707480][ T31] [ 363.711153][ T31] Kernel Offset: disabled [ 363.715494][ T31] Rebooting in 86400 seconds..