last executing test programs: 27m23.747887579s ago: executing program 4 (id=2069): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000080)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000400002100000008000000180001801400020073797a5f74756e0000000000000000001c000280"], 0x48}, 0x1, 0x0, 0x0, 0x20004094}, 0x0) 27m23.625628006s ago: executing program 4 (id=2070): r0 = socket(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1f, 0x0, 0x0, 0x1000, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x28011, r1, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x8}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000a80)=ANY=[@ANYBLOB="2c0000001600156f00000000000000000a000000", @ANYRES32=0x0, @ANYBLOB="1400060003"], 0x2c}}, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x3, 0x4, 0x5, 0x3, 0x7}, &(0x7f0000000000)=0x98) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000200)={r2, @in={{0x2, 0x4e20, @multicast2}}, 0x97, 0x3}, 0x90) 27m23.624928946s ago: executing program 4 (id=2071): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000001c0)=[@text64={0x40, &(0x7f0000000140)="440f0138440f01c5c744240006000000c7442402b6000000c7442406000000000f011424660f383b2d62539c2db9150b0000b8f6ffffffbaffffff7f0f30c7442400ec440000c744240200000000c7442406000000000f011c24407942f021180f35640f38cd6800", 0x68}], 0x1, 0x60, 0x0, 0x0) llistxattr(&(0x7f0000000180)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB='4\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="0c000d0020880200140003006d6163"], 0x34}, 0x1, 0x0, 0x0, 0x44801}, 0x48000) r0 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280)="d2", 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xffffffffffffff02, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0xa00000000000000) 27m23.253321363s ago: executing program 4 (id=2077): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) syz_clone(0xd000, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="7c0000001000010400"/20, @ANYRES32=r3, @ANYBLOB="00000000000000005c001280110001006272696467655f736c61766500000000440005800500050000000000050020000100000005000800000000000600", @ANYRES8=r1], 0x7c}}, 0x0) (fail_nth: 5) 27m22.50310163s ago: executing program 4 (id=2079): unshare(0x22020600) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) (async) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x8008000000010, 0x0, 0x0) (async) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, 0x0) (async) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000040)={0x2}) 27m22.291033394s ago: executing program 4 (id=2082): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="050000000c0000000080000004"], 0x50) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6(0xa, 0x1, 0x8010800000000084) sendmsg$SMC_PNETID_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0xffffff14, &(0x7f0000000000)={0x0, 0x14}}, 0x0) sendmmsg$inet6(r3, &(0x7f0000000040)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, 0x1c, &(0x7f0000000600)=[{&(0x7f00000000c0)='/', 0x1}], 0x1}}, {{&(0x7f0000000400)={0xa, 0x0, 0x0, @private0}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000d00)='[', 0x4d0}], 0x21}}], 0x2, 0x4008040) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r4, 0x847ba, 0x0, 0xe, 0x0, 0x0) r7 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) read$FUSE(r7, &(0x7f0000002380)={0x2020}, 0x2020) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000540)={0x0, @in={{0x2, 0x4e22, @rand_addr=0x64010100}}, 0x8000, 0x7, 0x800, 0xaffd, 0x44, 0xe3d, 0x3}, 0x9c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x7, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000656141b186f796a14740780040000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200000000000085000000860000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0xae, 0x75, &(0x7f0000000100)=""/117, 0x40f00, 0x7, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000180)={0x1, 0x5, 0x3, 0x101}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000000200)=[r0], &(0x7f0000000240)=[{0x2, 0x1, 0xc, 0x5}, {0x0, 0x4, 0x7, 0xb}, {0x0, 0x4, 0xd, 0x2}], 0x10, 0xffffffff, @void, @value}, 0x94) r8 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000400)=@generic={&(0x7f0000000380)='./file0\x00'}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r0}, &(0x7f0000000440), &(0x7f0000000280)=r8}, 0x3) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000003c0)={r0, &(0x7f0000000600), &(0x7f0000000080)=""/61}, 0x20) 27m6.764300018s ago: executing program 32 (id=2082): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="050000000c0000000080000004"], 0x50) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6(0xa, 0x1, 0x8010800000000084) sendmsg$SMC_PNETID_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0xffffff14, &(0x7f0000000000)={0x0, 0x14}}, 0x0) sendmmsg$inet6(r3, &(0x7f0000000040)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, 0x1c, &(0x7f0000000600)=[{&(0x7f00000000c0)='/', 0x1}], 0x1}}, {{&(0x7f0000000400)={0xa, 0x0, 0x0, @private0}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000d00)='[', 0x4d0}], 0x21}}], 0x2, 0x4008040) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r4, 0x847ba, 0x0, 0xe, 0x0, 0x0) r7 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) read$FUSE(r7, &(0x7f0000002380)={0x2020}, 0x2020) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000540)={0x0, @in={{0x2, 0x4e22, @rand_addr=0x64010100}}, 0x8000, 0x7, 0x800, 0xaffd, 0x44, 0xe3d, 0x3}, 0x9c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x7, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000656141b186f796a14740780040000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200000000000085000000860000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0xae, 0x75, &(0x7f0000000100)=""/117, 0x40f00, 0x7, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000180)={0x1, 0x5, 0x3, 0x101}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000000200)=[r0], &(0x7f0000000240)=[{0x2, 0x1, 0xc, 0x5}, {0x0, 0x4, 0x7, 0xb}, {0x0, 0x4, 0xd, 0x2}], 0x10, 0xffffffff, @void, @value}, 0x94) r8 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000400)=@generic={&(0x7f0000000380)='./file0\x00'}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r0}, &(0x7f0000000440), &(0x7f0000000280)=r8}, 0x3) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000003c0)={r0, &(0x7f0000000600), &(0x7f0000000080)=""/61}, 0x20) 8.580102775s ago: executing program 2 (id=8908): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) ioctl$TUNSETPERSIST(0xffffffffffffffff, 0x400454c9, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xc, 0x0, 0x3}, 0x0) fsopen(0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) r6 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0x0, 0xff, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0x0, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=@newqdisc={0x34, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r8, {}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x55}, 0x4000) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x1}, @NFT_OBJECT_SYNPROXY=@NFTA_OBJ_TYPE={0x8}}], {0x14}}, 0x44}, 0x1, 0x0, 0x0, 0x4c050}, 0x40) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f0000000180)={'macvlan1\x00', &(0x7f0000000100)=@ethtool_pauseparam={0x13, 0x6, 0xfffffffd, 0x3ff}}) bind$rds(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4e, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x180000f, 0x13, r2, 0x2000) r10 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r11 = dup(r10) write$6lowpan_enable(r11, &(0x7f0000000000)='0', 0xfffffd2c) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x34, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}, @NFT_MSG_NEWSETELEM={0x30, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe8}}, 0x0) 6.673830796s ago: executing program 3 (id=8912): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000800)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x60000000, 0x0, 0xfffffffffffffecd, 0x0, 0x0}, 0x50) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000001c0), 0x4) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x200000000000011, 0x2, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000011620140480b05101e8c000000010902120001000000000904"], 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@RTM_NEWMDB={0x38, 0x54, 0x1e5, 0x0, 0x25dfdbfd, {0x7, r4}, [@MDBA_SET_ENTRY={0x20, 0x1, {r6, 0x1, 0x0, 0x4, {@ip4=@broadcast}}}]}, 0x38}}, 0x20044050) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000003000000", @ANYRES32=0x0, @ANYBLOB="08001b0000000000"], 0x30}}, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r0, &(0x7f00000002c0)=[{{&(0x7f0000000400)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffd}, 0x1c, 0x0}}], 0x1, 0x0) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x442182, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x5, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) recvmmsg(r0, &(0x7f0000000800), 0x62, 0x12141, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/rt_cache\x00') syz_open_procfs(0x0, &(0x7f0000001380)='net/rt_cache\x00') 6.433569324s ago: executing program 5 (id=8915): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private0, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0x0, 0x0, 0x9]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0x0, @remote}, {0xa, 0x4e22, 0x0, @mcast1}}, 0x5c) setsockopt$MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2}, {0xa, 0x0, 0x0, @empty}}, 0x5c) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r2, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000540)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000380)={0x24, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000380)=[@free_buffer], 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_DYNSET_SET_NAME={0x9, 0x1, 'syz2\x00'}, @NFTA_DYNSET_FLAGS={0x8}, @NFTA_DYNSET_OP={0x8}, @NFTA_DYNSET_SREG_KEY={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xd8}}, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000440)={0x34, &(0x7f0000000200)={0x20, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="0000d2"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f00000001c0)={0x2c, &(0x7f0000000000)={0x40, 0x4, 0x2b, {0x2b, 0x10, "c560ad1fa6de64b2f9baf247d75da10467cde7214aa9bf9168b41f196fb0fb6175aae95cb91659f3f0"}}, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, &(0x7f0000000080)={0x0, 0xf, 0x59, {0x5, 0xf, 0x59, 0x3, [@generic={0x46, 0x10, 0xb, "a24b261a2579179b8517d5c23c478a5009f8ab10ddb64fb1b4385faae48d20573188bb6b6ae1dd6bf769d075ae69b8f23da73c2cc8be8cb30f395da1193bbe6a6cd228"}, @ext_cap={0x7, 0x10, 0x2, 0x1c, 0x2, 0x3, 0x7}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0xb, 0x1, 0x1ff}]}}, &(0x7f0000000100)={0x20, 0x29, 0xf, {0xf, 0x29, 0x1, 0x60, 0xa, 0x4, "c702b336", "948cfa57"}}, &(0x7f0000000140)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x3, 0xcc, 0x0, 0x3, 0x400, 0x4}}}, &(0x7f0000000800)={0x84, &(0x7f0000000200)={0x20, 0x0, 0x34, "d4cadab5bb3a757dcddab23db9554e93898188194e09e5d3f9bc3175ac907b42e36ee13d676911648cf1ec218943d312ec6d1b18"}, 0x0, &(0x7f0000000280)={0x0, 0x8, 0x1, 0x40}, &(0x7f00000002c0)={0x20, 0x0, 0x4, {0x3, 0x1}}, &(0x7f0000000300)={0x20, 0x0, 0x4, {0x200, 0x40}}, &(0x7f0000000340)={0x40, 0x7, 0x2, 0x3}, &(0x7f0000000380)={0x40, 0x9, 0x1, 0x3}, &(0x7f00000003c0)={0x40, 0xb, 0x2, "c620"}, &(0x7f0000000400)={0x40, 0xf, 0x2, 0x9}, &(0x7f0000000440)={0x40, 0x13, 0x6, @random="428eed7c920e"}, &(0x7f0000000480)={0x40, 0x17, 0x6, @multicast}, &(0x7f00000004c0)={0x40, 0x19, 0x2, "ecea"}, &(0x7f0000000540)={0x40, 0x1a, 0x2, 0x5}, &(0x7f0000000580)={0x40, 0x1c, 0x1, 0xf7}, &(0x7f00000005c0)={0x40, 0x1e, 0x1, 0x6}, &(0x7f0000000600)={0x40, 0x21, 0x1, 0x5}}) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000680)=ANY=[@ANYBLOB="7001000010003306000000000000000020010000000000000000000000000001fe8000000000000000000000000000bbffff400000007fff0000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141400000000000000000000000000000004da32000000ff02000000000000000000000000000123030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000029bd7000000000400a0002000000e1ff000000004800020070636263286663727970742900000000000000000000000000000000000000000000000000004f00000000000000000000000000000000000000000000000000000000001c00200000004e1e00000000fc0200000000000000000000000000001c00040002004e214e200000ffffffff00"/296], 0x170}}, 0x0) 6.044986273s ago: executing program 2 (id=8917): r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r0, 0x9003000000000000, 0x40, &(0x7f0000000b40)=@raw={'raw\x00', 0x2, 0x3, 0x2c8, 0x178, 0x178, 0x178, 0x0, 0x178, 0x230, 0x230, 0x230, 0x230, 0x230, 0x3, 0x0, {[{{@ip={@private=0xa010100, @multicast2, 0xffffffff, 0xffffff00, 'geneve1\x00', 'gre0\x00', {0xff}, {0xff}, 0x2f, 0x0, 0x11}, 0x0, 0x158, 0x178, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x300, 0x0, 'kmp\x00', "d9d9e63590ab5471c46924e95540949f0cd7e2b0a94d71d9d944acb7f0a1297674a95b30cee19db4c1725572ba928385b1635c89b58ae9a0e1ea500b26f006da3fa8a134552f7980e92de5a784cd4f46e799e191835d7d5ea776f04bef524e22f0bb6ed4b00f44ceb936943e13fa1caa6b4b159c673db1efa9a08b1ddc74ce6c", 0x43, 0x3}}, @common=@inet=@socket3={{0x28}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x98, 0xb8, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x328) 5.857847243s ago: executing program 2 (id=8918): openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={0xffffffffffffffff, &(0x7f0000000300), &(0x7f0000000200)=""/35}, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000180)=@gcm_256={{0x303}, "c4915c7f49541ce8", "9b84f987950ff3df25fa8f46983d34157e047d27ae4a66a6d15608a32cbaa5bc", '\x00', "be0ea450d5a5fd03"}, 0x38) recvmmsg(r2, 0x0, 0x0, 0x10020, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) ptrace(0x10, 0x1) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x4000000000000, 0x40, &(0x7f0000002300)=@raw={'raw\x00', 0xc01, 0x3, 0x1268, 0x1100, 0x5002004a, 0x0, 0x0, 0x0, 0x2200, 0x3c8, 0x3c8, 0x2200, 0x3c8, 0x3, 0x0, {[{{@ip={@broadcast, @remote, 0x0, 0xff, 'xfrm0\x00', 'tunl0\x00', {}, {}, 0x2e, 0x0, 0x20}, 0x60, 0x10a0, 0x1100, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x1, 0x0, 0x0, 0x0, './cgroup.cpu/syz1\x00'}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x2, 0x1, 0x7], 0x6, 0x2}, {0x2, [0x0, 0x6, 0x4, 0x9, 0x0, 0x89ce99baffcf6900], 0x1, 0x1}}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@loopback, [0xffffff00, 0xff000000, 0xff, 0xff0000ff], 0x4e22, 0x4c20, 0x4e24, 0x4e23, 0xc7, 0x0, 0x3b, 0x83, 0x25}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x12c8) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x18c40, 0x0) r4 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xe4010000, &(0x7f0000000080)=[{&(0x7f00000000c0)="1400000017000b63d25a80648c2594f941a3c92b", 0x14}], 0x1}, 0x0) 5.072986767s ago: executing program 1 (id=8924): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x109903, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)=0x19) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000002c0)=0x1) 4.905781697s ago: executing program 1 (id=8925): pipe2$9p(&(0x7f0000000000), 0x880) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r2, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) accept4(r3, 0x0, 0x0, 0x0) mmap(&(0x7f00001a0000/0x3000)=nil, 0x3000, 0x0, 0x28011, r2, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00'], 0x0, 0x0, 0x0, 0x0}, 0x0) preadv(r2, &(0x7f00000015c0), 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) lsm_set_self_attr(0x68, &(0x7f0000000800)=ANY=[], 0x20, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x880) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r6 = add_key$keyring(&(0x7f0000000200), &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, &(0x7f0000000940)='asymmetric\x00', &(0x7f0000000900)=@chain={'key_or_keyring:', r6}) syz_open_dev$dri(0x0, 0x1, 0x0) 4.613814591s ago: executing program 0 (id=8927): socket$nl_netfilter(0x10, 0x3, 0xc) mbind(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x6002, &(0x7f0000000040)=0xa, 0x7, 0x0) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x240, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1}) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x0, 0x0, 0x4, 0x0, [], [0x8200, 0x80000000], 0x13a}}}) ioctl$VIDIOC_QBUF(r1, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "8000"}, 0x0, 0x2, {}, 0x20800}) close_range(r0, 0xffffffffffffffff, 0x0) r2 = gettid() r3 = syz_open_procfs(r2, &(0x7f0000000040)='timers\x00') read$FUSE(r3, &(0x7f0000000680)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) statx(r3, &(0x7f00000000c0)='./file0\x00', 0x2000, 0x80, &(0x7f0000000280)) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x3d8}, &(0x7f00000006c0)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r10 = socket(0xf, 0x6, 0x84) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) io_uring_enter(r7, 0x847ba, 0x0, 0xe, 0x0, 0x0) ptrace$ARCH_GET_UNTAG_MASK(0x1e, r4, &(0x7f0000000000), 0x4001) fcntl$dupfd(r3, 0x406, r10) 4.374233689s ago: executing program 0 (id=8928): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000040)={0x3}, 0x4) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x4) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r1, &(0x7f0000000000)='X', 0x1, 0x4000000, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0xffffffffffffc0fe}}, 0x1c) 4.37050225s ago: executing program 3 (id=8929): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000340)={0x1, 0x6d}, 0x8) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f00000001c0)=0x439b, 0x4) sendmmsg$inet6(r0, &(0x7f0000000980)=[{{&(0x7f0000000200)={0xa, 0x4e22, 0x0, @mcast2}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0xf401}}], 0x1, 0x4004000) 3.96754235s ago: executing program 3 (id=8930): openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x169a82, 0x189) r0 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) mount$fuse(0x0, 0x0, 0x0, 0xa02002, &(0x7f00000004c0)=ANY=[]) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000400)=ANY=[], 0x1df) (async) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) (async) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 3.961337704s ago: executing program 0 (id=8931): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0xb, 0xa) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = dup(r3) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) r5 = syz_io_uring_setup(0x235, &(0x7f0000000380)={0x0, 0x1ffffe, 0x10100, 0x1, 0x0, 0x0, r4}, 0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(0x0, r6, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f00000007c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x740, 0x120, 0x2f8, 0x440, 0x510, 0x2f8, 0x670, 0x670, 0x670, 0x670, 0x670, 0x6, 0x0, {[{{@ipv6={@private2, @loopback, [0xff000000, 0xffffffff, 0xffffff00, 0xff000000], [0xff000000, 0xffffff00, 0x0, 0xffffff00], 'vlan1\x00', 'veth1_virt_wifi\x00', {0xff}, {0xff}, 0x0, 0x3, 0x3, 0x14}, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x2}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x6, 0x7}}}, {{@ipv6={@remote, @local, [0x0, 0xffffffff], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11, 0x0, 0x0, 0x4}, 0x0, 0x198, 0x1d8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@unspec=@conntrack3={{0xc8}, {{@ipv6=@remote, [], @ipv6=@private1, [0xffffffff, 0xff000000, 0xffffffff], @ipv4=@multicast2, [0x0, 0xffffffff, 0xffffffff, 0xffffffff], @ipv4=@empty, [0x0, 0x0, 0xff000000, 0xff], 0x0, 0x0, 0x42, 0x4e22, 0x4e24, 0x4e20, 0x4e24, 0x0, 0x23ccf3e9fd2b5143}, 0x0, 0x80, 0x0, 0x4e20, 0x4e24, 0x4e23}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0x100, 0x148, 0x0, {}, [@common=@unspec=@connmark={{0x30}}, @common=@inet=@socket1={{0x28}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@empty, @ipv6=@private2, 0x0, 0xfe}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0xc}}}, {{@uncond, 0x0, 0x118, 0x160, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@dst={{0x48}, {0x0, 0x0, 0x0, [0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x2]}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@dev, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7a0) prctl$PR_SET_NAME(0xf, &(0x7f0000000240)='\xf4\xaa\\k[sC\xae\xd6\x98\x9bY\nI}\xd8\xcc9K\xd7Z+\\\xf8\xdb\x84\xee\xa9\f>\xe4\x81\x88\x90_\xd4\r\xb83\x9e\x13B3\xfe\xcf\xccm\xfdO2\xd7\xa0DD4\x1b*\xdd\xb6\xcf\xacr\xabF\f\xb5\x11Vkp\"\xb1\xa8\xf0\x8d\x00\x18}3utO\x1bQ0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, 0x0, 0x0) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) dup(0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x60240) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000006300)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) lseek(r8, 0x8000000000000000, 0x3) r9 = socket$inet(0xa, 0x801, 0x84) connect$inet(r9, &(0x7f0000004cc0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x3d}}, 0x10) 2.746610594s ago: executing program 1 (id=8935): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="44000000090601020000000000000003000000000900020073797a310000000005000100070000001c0007800c00018008000140fffffffe0c000280080001"], 0x44}, 0x1, 0x0, 0x0, 0x34008005}, 0x4000050) 2.621931967s ago: executing program 1 (id=8936): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x19}, 0x7}, 0x1c) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000008c0)="5c00000012006bab9e3de3d86e6c1dffff137e0300000000000000b68675f8001d000a00a0e69ee517d34460bc24eab556a7e6241e6182949a36c33d3b48dfd8cdbf9367b4fa51f60a64c9f408000300060100000000000400000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 2.457456678s ago: executing program 0 (id=8937): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'team0\x00'}) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 2.39873206s ago: executing program 0 (id=8938): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000006c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x8, 0xf, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000500000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000040420f00b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095000000000000002bee25269a60615d7ec31a913dc637fa6826856b605e51dadc5635d8c03fe5676a0c41"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) read$FUSE(0xffffffffffffffff, 0x0, 0x0) umount2(0x0, 0xa) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a0200010203010902120001000000400904000000ff"], 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='coredump_filter\x00') pwritev(r2, &(0x7f0000000500)=[{&(0x7f0000000000)='0', 0x1}], 0x1, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000540)={{{@in=@empty, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private2}, 0x0, @in6=@private0}}, &(0x7f0000000100)=0xe8) ioctl$TUNSETOWNER(0xffffffffffffffff, 0x400454cc, r3) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0xe, 0x0, &(0x7f0000001780)="000000000000000002b2138373ef", 0x0, 0x10003, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.085486954s ago: executing program 5 (id=8939): socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x1e, 0x4, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) getsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x3f, 0x0, 0x0) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f0000000280)={[{0x49, 0x20fe, 0x6, 0x47, 0x4f, 0x9, 0x6, 0xc1, 0x5, 0x81, 0x5, 0x5, 0x40007}, {0x0, 0x4, 0x8, 0x1, 0x33, 0xc, 0x7f, 0x6, 0xfc, 0xa0, 0x84, 0xbb, 0x8000}, {0xfffffffa, 0xe0, 0xc, 0x6, 0x3, 0x3, 0x2, 0x2, 0xff, 0xf, 0x7, 0x3, 0x7}], 0x6}) sendmmsg$unix(r2, 0x0, 0x0, 0x101d0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x4c, 0x10, 0x403, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0xe0646}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x4}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x4c}, 0x1, 0x0, 0x40000, 0x600}, 0x0) 1.973943475s ago: executing program 2 (id=8940): socket$alg(0x26, 0x5, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 64) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000007c0)={0x26, 'hash\x00', 0x0, 0x0, 'vmac(blowfish)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r3 = accept$alg(r2, 0x0, 0x0) sendmmsg$alg(r3, &(0x7f0000001040)=[{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000340)="9f1ac09f155c1291fc8baa01adb9b575263c1a877ef8644bccc1143c6da61222f05eacf50665f3905cc2fd3e4e8100a13e7fcca4310085ea82993babea06255779d0dfa66f589f9501a2f87ee914c9e0894139310b5457cfe7ca3ae9dade5d7a11f0f2bbdec62e2df3daf962810b875c7965066575817d99d20bbeaff93d8d4d80ac0f358dc57835301a172498e99fac2ae601866fe71782539fae5b6033877f30e9afe9db04c13665632fc6334135a3a4e85c6cafe7f11978254e4bddda73d54382fd1bc60d6ab73c08cbd2d0ddae17cc30ed50717dd7131dda", 0xda}, {&(0x7f00000012c0)="f12468c6c394472c8eb4d933949b4e7ce34f7e40ba3f0e7faf4c451550fa3e23ce5eff4f94c1d6a8d70a2bac4a61a80878383b7e9b4949e5e1806334e9b2b38c36b1ae9cacf90d28c44777d394f9c35db1f99c67e2e8be7b18eb08f008d897c6f47e09251280c7f663bd27785705ece8f16d41629358dd8090186bbd46a69fb5727ba3e1d26a5489ee962100f4600a24873520bd6266c7d27e2c0645cdc1c5b6e0787b5a9e9a98358e557344f0d8190df4e39a0ae6a3c77022d5bfe6326c9f151c760d16864288295be04e9f6454cafc19431c2f99322dd409b56268d8e40d80ca98b6f6331f06ef5a28ed1b092e16558d33177d4ab70db6768e06f59cf9c9d0382a2d59fcad38fbeded381b74acb93bd915ae6898f8ba1587e780205ad4cbf31186fe3913dcdb2527af89b3f431029416fcf0aa6a5e81d935d7e37e932a4e8cec21daf2eff568ca97132e6c3e659d0332cbdac7111ac4edbad69c5b67e11ebecc863a58ad7264385e8520d3d3f27fa565bfd90907e66b0a6c692f6fa9b666cb3a1e4c341c7fe0235bbd1bcb657637c2c784c874a7d083f80644b6a6e68983f769e5b90a06b30f0418addd80ed03722a9360bd640acc28f89bef7d20a4b9384ade774b1e461be1a926c9753e561cfd4de1e15177008c1b1e88b267457f697f4ada22ee0198a644a76ab3eecc263e61bc09f1455888f768a15a3213b9981b2863c3505317e4e363a0cbebaad423cae3df0ee901ae7dc4c80ea672932d92cb206e57f931f31482b30caec2926b277f2b45c3f12d6e243ae7a75191480771f6da4798045e9f024cde0045013c6c5dac160a908c1a8f19bfb2a2c49dfd138fcae28f289a929e5c584652a1930930f7b55d010d4ac7f497bcf21484a39b71ce12164d03650f6dcbde8e4315981579d151bedf03769de77d6664c2a3bff1047d19026d747520756eb4f9473f7e174aa0a9e635f0054c9cf2c52f28ef209ee55985c966a89c86cfe4d1c38bb5c367d42590a12ab71fd9df77239b71c29286bce4f5d270c885c223e2541609b5a9b25ca5898e077ffbe051686079c3d371f8bb8decf44234844ce4f3202cf6f7ce760492b2291d465d5a3abbab5486758bd2dd41c3dfff561bff88f105ed23eef411f8815dc739b17329ca264156bdc1112b6a4f3500f5dd79e8608e2b2941d03fac5136874c687bb082a9571002548f4cf6d966267c4e35bde6163d52bba090fdb972bf4905bca4d6032a96166ecd3922b46404c2a96f880c83dad173e119c30e568fa2d1a62c4af40f79cc4db7c41af817a9a41fddab00de688ddde530fbd5d22c30691b1c34394e3d329032a2b31ddbda7f2cbe68b2bb2a5efa0f57fd8dae10f472d8d82a2f2681a68eb54fdc2ff4e532118a8c5bdc490353f65f5747f72edd5dec321bb799f490fa69f4654c1c4d6c4f99e52880f7ec3905e60578649171b0f1e6bf001688a3f1e856b01b19c8e674ee1abecbfc0795927ca1559c557a4febc928f93f10c1e0a793ff140d2475d5563a916101a7a15ca075c1716be9c170b0dd52a8b0f109e722d27057f6cc8474e3f9456d5eeb10b8cfc8668cbab0ce4039211aa349058a38376c63da06616112242b4b3ddfb75cb5d5ca18ad4a231d90cb8ddbe430076c60b57ba814b81a32aa0c16c8867d193f31a89311c6aa4dfdc557657456ba2a6e381a6e824c8f88f599d2e5bbfa4caa45cfcbed998ad6844446270cd1348ac075fd831ff6b6016b82314a82c284ee252e9435ef726c4492f2c80a5f0462496b5f53e6ebd15dc419eab620e2da0534892b0f1506681eedad8c9b65b6f042cb5d71fc39d6f8ac35a054b20f964b6b8867bf242ac1cd2873a6cf8b4d4814ab60f6b3266f72f3c5f10d180cd5a7ae1dccafd847a2cb76542a16da1e88b2df1bef08279d3cf2de21ea2ebc32696c6b3e9df3268d3306c59184edc352eae88bf7967b316d13098312e040265a121762dd83495ba637bf5e68c72a5056231caca9041969d0dfa0f05a0307e42ebc36dc10e526e4e6481509d33ef9eb71565d4c50d3e594f0b451ea22c9ffdc4abb31cb9ad3095f2c1e30abd5072f18f35345a50500084f1bd3f584b0f9a4be66fb8c1193def94882815df069971a2f9088da24932b1b6f22a3afbbbf2408adeadfb4042340f56c3dbb74c8b78dc0efbde2504cf52169c27a4d47969ac0a0cb6875e4e3afaa7e199c5a33e550a9c34f64a6826e2396b88d40cbb8761c04a39bb5be5fd3a1073c3fb77a66d14b0ce83cf66ac2dac9d566a469410cbfdca14764466e2198089ce6f560a323f856867ca06d244f2b6c55259618768ab7e0aa4cd3374105a657f39d11c4eab45f1f685b8f11233b11a2ee4429033937d36b8d3d00a690b57dae50a6760946a1115b43c478950c0edf8d02ee0d07b8b96d00a0c26dcf6a9ccaaa3be39e63b81bdda5d3", 0x6c6}], 0x2, 0x0, 0x0, 0x80}], 0x1, 0xc8d1) (async) recvmmsg(r3, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0xf}], 0x1, 0x2101, 0x0) (async) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x2000000000000001, 0x0, 0x2, 0x0) syz_emit_ethernet(0x29, &(0x7f0000000200)={@local, @remote, @val={@val={0x88a8, 0x2, 0x1, 0x4}, {0x8100, 0x3, 0x1, 0x2}}, {@generic={0x8035, "ccebd444a61bcdaf84f11cc5b9b04423f1798c"}}}, 0x0) (async) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x40844) (async) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(0xffffffffffffffff, 0xc0984124, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r4, 0x8983, &(0x7f0000000040)={0x6, 'bond_slave_1\x00', {0x1}, 0xff7f}) (async) add_key$user(0x0, 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) (async) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x15) writev(r5, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) (async) recvmmsg(r5, &(0x7f0000000740)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x120c2, 0x0) (async) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r6, 0x0, 0xca, &(0x7f00000002c0)={0x1, 0x4, 0x0, 0x0, @vifc_lcl_ifindex, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) (async) setsockopt$MRT_ADD_MFC_PROXY(r6, 0x0, 0xd2, &(0x7f0000000280)={@broadcast, @empty, 0x0, "ffff01e03d64a831683fdc3fd440829c82cfc400"}, 0x3c) (async, rerun: 32) setsockopt$MRT_FLUSH(r6, 0x0, 0xd4, &(0x7f0000000000)=0xe, 0x4) (rerun: 32) r7 = accept$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) getsockopt$packet_buf(r7, 0x107, 0x2, &(0x7f0000000240)=""/254, &(0x7f0000000040)=0xfe) (async) socket$packet(0x11, 0x2, 0x300) 1.818636947s ago: executing program 5 (id=8941): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x70, r1, 0x1, 0x0, 0x10000000, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME={0x51, 0x33, @beacon={{{0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {}, @broadcast, @device_a, @initial, {0x0, 0x1}, @value=@ver_80211n={0x0, 0x64, 0x2, 0x0, 0x0, 0x2}}, 0x0, @default, 0x0, @void, @val, @void, @void, @val={0x6, 0x2, 0x6}, @val={0x5, 0x3, {0x8, 0x6c, 0x9c}}, @void, @val={0x2a, 0x1, {0x1}}, @val={0x3c, 0x4, {0x0, 0x0, 0x2}}, @void, @val={0x72, 0x6}, @val={0x71, 0x7, {0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x5e}}, @void}}]}, 0x70}, 0x1, 0x60000000}, 0x20000000) 1.748429526s ago: executing program 2 (id=8942): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf2, 0x30, 0x39, 0x20, 0x2c42, 0x1202, 0x8540, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc, 0x2, 0x2, 0xc1, 0x7f, 0xc, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000c80)={0x34, &(0x7f0000000480)={0x40, 0xb, 0x1, "e4"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x8, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000500000000000000740000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f837974fd76b540a8d000000b7030010a4160000850000000600000095"], &(0x7f0000000200)='syzkaller\x00', 0xa, 0x100b, &(0x7f0000001e40)=""/4107, 0x0, 0x42, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000180)={0x40, 0x12, 0x1, "b4"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x80042, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_submit(r1, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}]) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000200)={0x20, 0x16, 0x4, "f11f783b"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf2, 0x30, 0x39, 0x20, 0x2c42, 0x1202, 0x8540, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc, 0x2, 0x2, 0xc1, 0x7f, 0xc, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) (async) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000c80)={0x34, &(0x7f0000000480)={0x40, 0xb, 0x1, "e4"}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x8, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000500000000000000740000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f837974fd76b540a8d000000b7030010a4160000850000000600000095"], &(0x7f0000000200)='syzkaller\x00', 0xa, 0x100b, &(0x7f0000001e40)=""/4107, 0x0, 0x42, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000180)={0x40, 0x12, 0x1, "b4"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x80042, 0x0) (async) io_setup(0x8, &(0x7f0000004200)) (async) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') (async) io_submit(r1, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}]) (async) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000200)={0x20, 0x16, 0x4, "f11f783b"}, 0x0, 0x0, 0x0, 0x0}) (async) 1.585455999s ago: executing program 1 (id=8943): sched_setscheduler(0x0, 0x2, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ptrace(0x10, r0) rt_sigqueueinfo(r0, 0x3d, &(0x7f0000000ac0)={0x0, 0xc4, 0xff7ffffe}) ptrace$peeksig(0x4209, r0, &(0x7f0000000100)={0xfffffffffffffffd, 0x0, 0x2}, &(0x7f0000002e40)=[{}, {}, {}]) syz_open_dev$loop(&(0x7f0000000100), 0x4, 0xca042) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ip6_mr_cache\x00') read$FUSE(r2, &(0x7f0000000e00)={0x2020}, 0x2020) r3 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) read$dsp(r3, &(0x7f00000002c0)=""/4096, 0x1000) write$dsp(0xffffffffffffffff, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) syz_usb_connect(0x1, 0x0, 0x0, 0x0) mmap(&(0x7f00008cd000/0x4000)=nil, 0x4000, 0x2, 0x10, 0xffffffffffffffff, 0x53bb0000) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x8, 0x3, &(0x7f0000002fc0)=ANY=[@ANYBLOB="1830000000000000000000000300000095000000000000000ff629d42ec9cd093d9c9e052b4a389421df4cbe4d81bb9c6655955029f613eaef7da80000000000000002d2ed32518e24a40740ea07988481a22aa6e9619b345a388cb63f88bffd08da389b46e01e8e560d821d2174d9d10171f3d2391436c28f6c817541b2e0bbff39e84efffb184724266c5c04eb5c69e98ede2459657039c6c242617eb7212d5b79a7dfff5bdf2e10b8a7280f"], &(0x7f0000000080)='syzkaller\x00', 0x8, 0x94, &(0x7f00000000c0)=""/148, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000, @void, @value}, 0x94) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x9) pread64(r2, &(0x7f000001a240)=""/102395, 0x18ffb, 0x41e) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000500)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0xb, 0x1c, 0x0, 0x0, @in={0x2, 0x461d, @rand_addr=0x64010100}, @in6={0xa, 0x4e20, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x118) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.current\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000800)={'#! ', './file1/../file0', [{0x20, 'cgroQ\xedB\x9f\xc6\vQ\xf8~up.stat\x00\x88\xd8K\x91\x17\xb3\xe4w\x956\xf1\xce\xdcX\xf5\x03\x1a\x84\xdaj\xf8a\xc4#g\xad\x8d;xu\x16W_!m\xd0I\xe1\x98?3lA\x82\xa1. K\xa6\x9c\xcc\x02:k\x9d\xd4\x14\xb1\xdbK\xf3\x9e$\xe4\x04\x91\xc2\xf6\xc5%+r*E\xee\x9c9\xfe\xa5\xeb\xda\xa3\xfa\xdf\xbfQS\xcbxz9p\x01o\x1bm'}, {0x20, '\x00\xd2D\xb2K\x94\xad\x14\xdf\\\t\x9d#\xefEY\x86\x97\x01\xa3\xa6\b\x008/\xea\xf9W\x11\xbd\x0e\xe6\xb8\x8d\x03\xca\xf0\x881\xe8 Pj4\xe9\x021\xe8\x88\x1a\x13C\xf6\xb1\xc2\x7f\x04\xc5*`b3\xe8%5\xeexZ\bii\v\xea\t\xfd\xbc\xc2\xbf?g\x8d\xe05\xcd\x0e_\xf3\x03\x84`W\x85\x00\x10\xab\xd1W\xf0\x92\x86\x86\x05\x00\x00\x00\xaa\xb1.n\xbf\xc8\xd1\xa5\r\xc7\x04O\xde\xd3w\xe1\xdd\x11g3\x15}\xe0\xc5V\xc3\x97J\x10\x17\xd9\x1c\xf9\xfc:>\x0ea\x81*\x15\x14\xfe\xec\x1d@~\x0f9\xce\xb0\xa5\xe3\x12\x04\xef\x12\xd2J$)7/R8\x0eS\xa7\x14\xfdz\x80g\xd5\x9d\x8e{\xeb\xc9\x19\xf4\xf3k\v\xd0\xeaP\xd8p\xf4\n\xe0\x81\x9c\x9a\xd4o\xc2\xb3\xbc\xd2\x8d3\x87\f\xe1C\xb6\x8ct\x97\xeb\xe9\\\x9c\xb8bs#\xf7*\x1c\xb4g\x9d\xaa,\x97\a\x00\x00\x00\x00\x00\x00\x00\a\xdbt\xb3\x84\x98\x87$\xbc\xf8?J\xec@\xa3\xfd\x193\xe7\x01d\xd4\xdfP~\xa1}\x83\x12~>\x89\xcd\xf7\x9d\xbfgV\x02\xb0\x88\x9a\x17\xf2\xb2\xa5z4\xe3&Zc\n\xf4\x19U\xeb\a\xe2W\xeeU\xc6\x06\xeb\n\x045\xe7\x94Ho\xb1\x8e\x91+9\xb8=\xe2b\xc0+\xfc\xd1oz\xdd\xbdDHh\xf8\x04m\a\r$\x8f\x92\xfdw\xb4\xc5&CF$\xeb\x91\xad\x1b-\r\xbe2f\xed8R\\?O;\x01\xac\xb3\xa8\xdc\xf5\x9f]\xc2O\xda]=\r\xff8\x99\xa1\xbd\x85#\x88\xb7C\x7f\xf0\xb8f\x90>P>=\xedBQO\xeb\xbd\xa8%a\xddX\xaa\xfb1\xfc\xb9\xbb\xa2\t\x90xao\x9d\x1d.\x82g\x9b\x13\b\x84\x1d\xba?\xb7\x0elp1\x9b\xac\x8c\xaex\x7f\x12\xd6\xf1C%\xec<\xec\xeblp\xd9\x9dt\x97\xe2|8\x9aVE\xa7\xdc\xdf\xe3L\xd4N\xce\x7fbb$$,48\x12'}]}, 0x26d) write$cgroup_subtree(r4, &(0x7f0000003080)=ANY=[@ANYBLOB="43726c69060074200a6ead5d1aeab4b90759fff53e998d67c78cab471872b90bc662c86a52207a8c5815e51f6b904eed6b54c9bc"], 0x8) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x30, r6, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffffffffffff}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x30}}, 0x0) bpf$OBJ_GET_PROG(0x9, &(0x7f0000000600)=@generic={0x0, 0x11, 0x10}, 0xc) 1.584843383s ago: executing program 5 (id=8944): socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) close(0x3) syz_usb_connect(0x4, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000fdc01a40f30c74933bbc0000000109", @ANYRESDEC=0x0], 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x3, &(0x7f0000000100)=0x3c, 0x4) fsetxattr(0xffffffffffffffff, &(0x7f0000000080)=@known='trusted.overlay.upper\x00', 0x0, 0x0, 0x1) socket$inet_mptcp(0x2, 0x1, 0x106) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x3, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, 0x0, 0x0) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r5 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000027c0), 0x1, 0x0) writev(r5, &(0x7f0000000300)=[{0x0}], 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000004000000040000000900000000000000", @ANYBLOB="040000000000000000000000000000180000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) 980.896755ms ago: executing program 0 (id=8945): bpf$BPF_PROG_DETACH(0x9, &(0x7f00000003c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='&\x00\x00\x00\x00\x00\x00\x00'], 0x20) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f0000002700)=@raw={'raw\x00', 0x8, 0x3, 0x218, 0x0, 0x8, 0xfa04, 0x0, 0x6c02, 0x180, 0x194, 0x194, 0x180, 0x194, 0x3, 0x0, {[{{@ip={@empty=0x1e00, @broadcast, 0x0, 0x0, 'veth0_to_hsr\x00', 'veth0_virt_wifi\x00', {}, {}, 0x6}, 0x0, 0xa0, 0xc8, 0x0, {0x0, 0x74020000}, [@common=@inet=@tcp={{0x30}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@ip={@multicast2, @dev, 0x0, 0x0, '\x00', 'tunl0\x00'}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x278) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="5c00000002060511001f0000000000000000000005000400000000000900020073797a30000000001400078008001340000000000800064000000000050005000000000005000120060000000d000300686173683a6d6163"], 0x5c}}, 0x0) r2 = syz_usb_connect(0x2, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa00090582024000000000da8b748aadb96e2da4a432d0d076ccec14378b1fe88f3e0e0f4b959fca81f542349b88d139d72bb166e310d960bd2c165bf09a4f515637c9262f0b7bab9a7d8f83229fe4763117a5314be8e20cb0037140ae8fc8033d4525fefcdb92077a2c617b4cb32b2d20f0f16b7d0f85e015e78f5e9222bbe2b334142dd8e8"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$cdc_ecm(0x0, 0x6e, &(0x7f00000000c0)={{0x12, 0x1, 0x350, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x1, 0x1, 0x0, 0xde5eaad0ef3b2a2e, 0x3, [{{0x9, 0x4, 0x0, 0x7, 0x3, 0x2, 0x6, 0x0, 0x36, {{0x5}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x4, 0x8, 0x3}, [@network_terminal={0x7, 0x24, 0xa, 0x3, 0x2, 0x54, 0x4}, @mbim={0xc, 0x24, 0x1b, 0x7ff, 0x5, 0x6, 0x2, 0x5, 0xfc}, @obex={0x5, 0x24, 0x15, 0x81}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x20, 0x9, 0x5, 0x3}}], {{0x9, 0x5, 0x82, 0x2, 0x8, 0x1}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x8, 0x3, 0xdc}}}}}]}}]}}, &(0x7f0000000400)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x201, 0x98, 0x4, 0x9, 0x40, 0x81}, 0x32, &(0x7f00000001c0)={0x5, 0xf, 0x32, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x0, 0x1, 0x8, 0x80}, @generic={0x11, 0x10, 0x2, "f876ed8b529f752a4ceb62fd56b7"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x4, 0x60, 0x0, 0x3}, @wireless={0xb, 0x10, 0x1, 0xc, 0x8, 0x6, 0x6, 0x7, 0x9}]}, 0x1, [{0x0, 0x0}]}) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="680000000000000016010000050000002436a1b5c5b24765552b49ccc57d3457ef918a0664aa1247bd76d11497230db97adb78a91e872289f2b983f957346cb7d8a8160f6165966cda822ae84a1f54f16bdce5b3013767a0a584cd5df9849e32590000000000000098000000000000000901000002000000f413582941e06f6e34e65913e2ef6eb92c289fe9f801a3e63029eab3f281010000000000008065057469ece6004e1b1e756345e955cb8dad236f2bd0d216bc6531b9f07fee6bd15f28ac664f317278d6bbf3a638a8f467d2079719ef86a96f72c4d9d99b0a92a4fbf288492e268e4e051778b0df3f0a5de02cd8b82114f30ffa8593000000000000a000000000000000310100000900000072dc60dc774e1d0a5685c0c6582193eadb5ebec5c263eb93fb4e2e054b016d04698fe22a30946da07a8988e1f3fe2ff891393b9311c276f475e96007335cb83e377ddde70d69e25436d9fc70c0cfa0388a4aa4e9690962996645a8194b8aca79ad9932bab0c7c04ecd952f0da2e806879b7e160c2a96fd0406b1c25e964106ee18c023ae1daee17a3a00000000000000"], 0x1a0}, 0x10) r4 = openat$apparmor_thread_current(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) write$apparmor_current(r4, &(0x7f00000003c0)=ANY=[@ANYBLOB='permprofile && \r:'], 0xff) socket$tipc(0x1e, 0x5, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="340000003c0007010000000000000000010000000400fc800c00018008000600ffff0000080002"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0x0) 359.441207ms ago: executing program 1 (id=8946): socket$inet6(0xa, 0x3, 0xff) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x1, 0x0, 0x1, 0xb}, 0x20) r0 = syz_open_dev$vcsu(&(0x7f00000000c0), 0x3ac7ffa, 0x8040) open_tree(r0, &(0x7f0000000100)='./file0\x00', 0x88000) r1 = socket$inet6(0xa, 0x5, 0x2) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000005dc0)=[{{&(0x7f0000000100)=@in6={0xa, 0x4e22, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x5}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@timestamping={{0x14, 0x1, 0x25, 0x2}}], 0x18}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f00000000c0)=[@in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x31}}, @in6={0xa, 0x4e23, 0xffff, @ipv4={'\x00', '\xff\xff', @loopback}, 0x2}], 0x3c) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="0300"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000240), 0x5b9f80, 0x0) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000280), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f0000000000)={{0x1, 0x1, 0xfffffe00, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r4, 0x80585414, &(0x7f0000000140)) ioctl$SW_SYNC_IOC_INC(r3, 0xc0105702, &(0x7f00000000c0)) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r5, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r5, 0x7a0, &(0x7f0000000240)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_SETPF(r5, 0x7a9, &(0x7f00000003c0)={{@my=0x1}, 0xfff, 0x3, 0x0, 0x0, 0x80000, 0x0, 0x1000000000ff8, 0x4}) ptrace(0x10, r2) getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f0000000340)={'HL\x00'}, &(0x7f00000003c0)=0x1e) fcntl$getownex(r1, 0x10, &(0x7f0000000040)) syz_usb_connect(0x5, 0x24, &(0x7f0000000e80)=ANY=[@ANYBLOB="010203010902120001080500040904ce01006fda0d8d"], 0x0) r6 = io_uring_setup(0x1532, &(0x7f0000000000)={0x0, 0x761, 0x811, 0x1, 0x1a0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) r7 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000380)="5802001749173b473ac7d3d79fa554181edf6a0aee70496db7dbd4516988d8b732", 0x21}], 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(r7, 0x1, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r6, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) io_uring_register$IORING_REGISTER_BUFFERS(r6, 0x0, &(0x7f0000000300)=[{0x0}], 0x1) 94.143311ms ago: executing program 5 (id=8947): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x18, 0x0, 0x71, 0x10, 0xaf}, [@ldst={0x6}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x3, &(0x7f0000000080)=""/201, 0x500, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) 22.519235ms ago: executing program 3 (id=8948): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0xbc, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x12, 0x0, {0x0, 0xffe0}, {0x0, 0xfff1}, {0x0, 0x8}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x8c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x2, 0x0, 0x11, 0xff, 0x0, 0x0, 0xb, 0x23, 0x0, 0x0, 0x0, 0xa, 0x7d, 0xf4, 0xa], 0x1, [0x1, 0x0, 0x6, 0x0, 0x0, 0x0, 0x2000, 0xfffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc, 0x0, 0x4000]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x30, 0xc, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8}, @TCA_TAPRIO_SCHED_ENTRY_CMD={0x5}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0xd}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x1}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0xd2}]}]}]}}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r1, @ANYBLOB="00000000000000001c001a800800078004000500080000003e"], 0x44}}, 0x0) 0s ago: executing program 5 (id=8949): socket(0x40000000015, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) socket$inet6(0xa, 0x2, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$F2FS_IOC_FLUSH_DEVICE(r0, 0x4008f50a, &(0x7f0000000040)={0x1}) socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a603f00000000000500000014000500200100000000000000000100000000001c00090008000000", @ANYRES32=r2, @ANYRES32=r2], 0x4c}}, 0x40) kernel console output (not intermixed with test programs): : Dropping previously announced user features [ 2134.378462][T21089] usb 6-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 2134.404620][T21089] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2134.431119][T21089] usb 6-1: Product: syz [ 2134.435995][T21089] usb 6-1: Manufacturer: syz [ 2134.440653][T21089] usb 6-1: SerialNumber: syz [ 2134.451593][T21075] CoreChips 2-1:0.41 (unnamed net_device) (uninitialized): set LINK LED failed : -71 [ 2134.466854][T21089] usb 6-1: config 0 descriptor?? [ 2134.471931][T21075] CoreChips 2-1:0.41: probe with driver CoreChips failed with error -71 [ 2134.506399][T11222] usb 3-1: USB disconnect, device number 102 [ 2134.552975][T21075] usb 2-1: USB disconnect, device number 26 [ 2134.683407][ T3462] xt_hashlimit: max too large, truncated to 1048576 [ 2134.694783][ T3460] fido_id[3460]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 2134.832098][T21089] usb-storage 6-1:0.0: USB Mass Storage device detected [ 2135.141746][ T3483] netlink: 'syz.2.8433': attribute type 32 has an invalid length. [ 2135.225597][T21089] usb 1-1: new low-speed USB device number 120 using dummy_hcd [ 2135.840667][T21089] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 2135.874374][ T3492] netlink: 'syz.2.8434': attribute type 2 has an invalid length. [ 2135.957290][T21089] usb 1-1: config 0 has no interface number 0 [ 2135.969173][T21089] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 2136.005065][ T3494] netlink: 'syz.2.8434': attribute type 13 has an invalid length. [ 2136.035516][T21089] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 2136.064762][T21089] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2136.087149][T21089] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2136.119423][T21089] usb 1-1: config 0 descriptor?? [ 2136.143818][ T3472] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 2136.173101][T21089] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 2137.159375][ T30] audit: type=1326 audit(1750692355.126:4223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.1.8439" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa17e98e929 code=0x7ffc0000 [ 2137.405478][ T30] audit: type=1326 audit(1750692355.126:4224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.1.8439" exe="/root/syz-executor" sig=0 arch=c000003e syscall=433 compat=0 ip=0x7fa17e98e929 code=0x7ffc0000 [ 2137.605537][ T30] audit: type=1326 audit(1750692355.126:4225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.1.8439" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa17e98e929 code=0x7ffc0000 [ 2137.626108][T21075] usb 6-1: USB disconnect, device number 91 [ 2137.628966][ T30] audit: type=1326 audit(1750692355.176:4226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.1.8439" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fa17e98e929 code=0x7ffc0000 [ 2137.657160][ T30] audit: type=1326 audit(1750692355.176:4227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.1.8439" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa17e98e929 code=0x7ffc0000 [ 2137.681019][ T30] audit: type=1326 audit(1750692355.176:4228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.1.8439" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fa17e98e929 code=0x7ffc0000 [ 2137.757139][T21089] usb 1-1: USB disconnect, device number 120 [ 2138.861658][ T3531] netlink: 'syz.5.8447': attribute type 21 has an invalid length. [ 2139.371385][ T3555] loop5: detected capacity change from 0 to 7 [ 2139.386415][ T3555] Dev loop5: unable to read RDB block 7 [ 2139.395944][ T3555] loop5: AHDI p3 p4 [ 2139.481274][ T3555] loop5: partition table partially beyond EOD, truncated [ 2139.556140][ T3565] dummy0: left allmulticast mode [ 2139.561157][ T3565] dummy0: left promiscuous mode [ 2139.566349][ T3565] bridge0: port 1(dummy0) entered disabled state [ 2139.598407][ T3555] loop5: p3 start 1886353253 is beyond EOD, truncated [ 2139.763526][ T3565] bond11: (slave veth0_to_bond): Releasing active interface [ 2139.823579][ T3565] bond1: (slave gretap1): Releasing active interface [ 2140.002279][ T3570] bridge_slave_0: left allmulticast mode [ 2140.011291][ T3570] bridge_slave_0: left promiscuous mode [ 2140.022575][ T3570] bridge0: port 1(bridge_slave_0) entered disabled state [ 2140.102516][ T3570] bridge_slave_1: left allmulticast mode [ 2140.108687][ T3570] bridge_slave_1: left promiscuous mode [ 2140.130381][ T3573] can: request_module (can-proto-4) failed. [ 2140.140659][ T3577] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 2140.297202][ T3570] bridge0: port 2(bridge_slave_1) entered disabled state [ 2140.626202][ T3570] bond4: (slave veth0_to_bond): Releasing active interface [ 2140.626231][ T3570] veth0_to_bond: left allmulticast mode [ 2140.647607][ T3570] bond0: (slave bond_slave_0): Releasing backup interface [ 2140.652868][ T3570] bond0: (slave bond_slave_1): Releasing backup interface [ 2140.665619][ T3570] team0: Port device team_slave_0 removed [ 2140.669858][ T3570] team0: Port device team_slave_1 removed [ 2140.670467][ T3570] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2140.674953][ T3570] team0: Port device geneve0 removed [ 2140.927271][ T3583] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 2141.935295][T32332] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 2142.333358][T32332] usb 3-1: config 0 has no interfaces? [ 2142.347278][T32332] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 2142.375359][T32332] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2142.415000][T32332] usb 3-1: Product: syz [ 2142.428786][T32332] usb 3-1: Manufacturer: syz [ 2142.501376][T32332] usb 3-1: SerialNumber: syz [ 2142.534123][T32332] usb 3-1: config 0 descriptor?? [ 2142.632742][ T3603] netlink: 'syz.1.8469': attribute type 1 has an invalid length. [ 2142.711369][ T3608] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8470'. [ 2142.722324][ T3608] FAULT_INJECTION: forcing a failure. [ 2142.722324][ T3608] name failslab, interval 1, probability 0, space 0, times 0 [ 2142.750880][ T3603] 8021q: adding VLAN 0 to HW filter on device bond2 [ 2142.792306][ T3608] CPU: 0 UID: 0 PID: 3608 Comm: syz.3.8470 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 2142.792331][ T3608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 2142.792340][ T3608] Call Trace: [ 2142.792347][ T3608] [ 2142.792354][ T3608] dump_stack_lvl+0x189/0x250 [ 2142.792379][ T3608] ? __pfx____ratelimit+0x10/0x10 [ 2142.792399][ T3608] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2142.792420][ T3608] ? __pfx__printk+0x10/0x10 [ 2142.792439][ T3608] ? __pfx___might_resched+0x10/0x10 [ 2142.792459][ T3608] ? fs_reclaim_acquire+0x7d/0x100 [ 2142.792479][ T3608] should_fail_ex+0x414/0x560 [ 2142.792499][ T3608] should_failslab+0xa8/0x100 [ 2142.792515][ T3608] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 2142.792529][ T3608] ? __alloc_skb+0x112/0x2d0 [ 2142.792547][ T3608] __alloc_skb+0x112/0x2d0 [ 2142.792564][ T3608] netlink_ack+0x146/0xa50 [ 2142.792577][ T3608] ? __pfx_genl_rcv_msg+0x10/0x10 [ 2142.792595][ T3608] ? ref_tracker_free+0x63a/0x7d0 [ 2142.792621][ T3608] ? __pfx_ref_tracker_free+0x10/0x10 [ 2142.792646][ T3608] netlink_rcv_skb+0x28c/0x470 [ 2142.792661][ T3608] ? __pfx_genl_rcv_msg+0x10/0x10 [ 2142.792682][ T3608] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2142.792713][ T3608] ? down_read+0x1ad/0x2e0 [ 2142.792733][ T3608] genl_rcv+0x28/0x40 [ 2142.792757][ T3608] netlink_unicast+0x75b/0x8d0 [ 2142.792787][ T3608] netlink_sendmsg+0x805/0xb30 [ 2142.792818][ T3608] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2142.792866][ T3608] ? aa_sock_msg_perm+0x94/0x160 [ 2142.792886][ T3608] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2142.792904][ T3608] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2142.792922][ T3608] __sock_sendmsg+0x21c/0x270 [ 2142.792946][ T3608] ____sys_sendmsg+0x505/0x830 [ 2142.792969][ T3608] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2142.792993][ T3608] ? import_iovec+0x74/0xa0 [ 2142.793010][ T3608] ___sys_sendmsg+0x21f/0x2a0 [ 2142.793029][ T3608] ? __pfx____sys_sendmsg+0x10/0x10 [ 2142.793073][ T3608] ? __fget_files+0x2a/0x420 [ 2142.793088][ T3608] ? __fget_files+0x3a0/0x420 [ 2142.793111][ T3608] __x64_sys_sendmsg+0x19b/0x260 [ 2142.793131][ T3608] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2142.793156][ T3608] ? __pfx_ksys_write+0x10/0x10 [ 2142.793167][ T3608] ? rcu_is_watching+0x15/0xb0 [ 2142.793192][ T3608] ? do_syscall_64+0xbe/0x3b0 [ 2142.793208][ T3608] do_syscall_64+0xfa/0x3b0 [ 2142.793220][ T3608] ? lockdep_hardirqs_on+0x9c/0x150 [ 2142.793240][ T3608] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2142.793254][ T3608] ? clear_bhb_loop+0x60/0xb0 [ 2142.793271][ T3608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2142.793285][ T3608] RIP: 0033:0x7f9cd538e929 [ 2142.793298][ T3608] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2142.793310][ T3608] RSP: 002b:00007f9cd61cb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2142.793326][ T3608] RAX: ffffffffffffffda RBX: 00007f9cd55b5fa0 RCX: 00007f9cd538e929 [ 2142.793336][ T3608] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 2142.793346][ T3608] RBP: 00007f9cd61cb090 R08: 0000000000000000 R09: 0000000000000000 [ 2142.793355][ T3608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2142.793363][ T3608] R13: 0000000000000000 R14: 00007f9cd55b5fa0 R15: 00007f9cd56dfa28 [ 2142.793385][ T3608] [ 2143.453215][ T3606] vlan2: entered allmulticast mode [ 2143.464491][ T3606] bond2: entered allmulticast mode [ 2143.863614][ T3615] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8472'. [ 2144.281633][T21075] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 2144.417434][ T3631] tipc: Started in network mode [ 2144.422520][ T3631] tipc: Node identity ac14140f, cluster identity 4711 [ 2144.432662][ T3631] tipc: Enabled bearer , priority 10 [ 2144.468686][T21075] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2144.494345][T21075] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 2144.510729][T21075] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 2144.605341][T21075] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 2144.765402][T21075] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2144.778301][T21075] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2144.800628][T21075] usb 6-1: config 0 descriptor?? [ 2144.812404][ T3619] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 2145.067288][ T3639] ptrace attach of "./syz-executor exec"[27273] was attempted by "./syz-executor exec"[3639] [ 2145.084779][ T3639] xt_cgroup: invalid path, errno=-2 [ 2145.171775][T21089] usb 3-1: USB disconnect, device number 103 [ 2145.293089][T21075] usbhid 6-1:0.0: can't add hid device: -71 [ 2145.299398][T21075] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 2145.317705][T21075] usb 6-1: USB disconnect, device number 92 [ 2145.448546][T11206] tipc: Node number set to 2886997007 [ 2146.166312][ T3649] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 2146.210358][ T3649] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 2146.449186][ T3649] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 2146.455928][ T3649] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 2146.545117][ T3649] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 2146.552399][ T3649] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 2146.562603][ T3649] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 2146.581886][ T3649] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 2146.598753][ T3649] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 2146.686809][ T3660] FAULT_INJECTION: forcing a failure. [ 2146.686809][ T3660] name failslab, interval 1, probability 0, space 0, times 0 [ 2146.755796][ T3660] CPU: 1 UID: 0 PID: 3660 Comm: syz.5.8485 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 2146.755815][ T3660] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 2146.755823][ T3660] Call Trace: [ 2146.755829][ T3660] [ 2146.755835][ T3660] dump_stack_lvl+0x189/0x250 [ 2146.755859][ T3660] ? __pfx____ratelimit+0x10/0x10 [ 2146.755878][ T3660] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2146.755897][ T3660] ? __pfx__printk+0x10/0x10 [ 2146.755915][ T3660] ? __pfx___might_resched+0x10/0x10 [ 2146.755933][ T3660] ? fs_reclaim_acquire+0x7d/0x100 [ 2146.755951][ T3660] should_fail_ex+0x414/0x560 [ 2146.755970][ T3660] should_failslab+0xa8/0x100 [ 2146.755984][ T3660] kmem_cache_alloc_noprof+0x73/0x3c0 [ 2146.756004][ T3660] ? security_inode_alloc+0x39/0x330 [ 2146.756024][ T3660] security_inode_alloc+0x39/0x330 [ 2146.756043][ T3660] inode_init_always_gfp+0x9ed/0xdc0 [ 2146.756061][ T3660] ? __pfx_sock_alloc_inode+0x10/0x10 [ 2146.756079][ T3660] alloc_inode+0x82/0x1b0 [ 2146.756093][ T3660] __sock_create+0x12d/0x9f0 [ 2146.756118][ T3660] udp_sock_create6+0xcb/0x690 [ 2146.756138][ T3660] ? __pfx_udp_sock_create6+0x10/0x10 [ 2146.756154][ T3660] ? __kasan_kmalloc_large+0x85/0xa0 [ 2146.756173][ T3660] geneve_sock_add+0x35b/0x910 [ 2146.756191][ T3660] ? __pfx_geneve_sock_add+0x10/0x10 [ 2146.756201][ T3660] ? ib_device_get_by_netdev+0x46b/0x4d0 [ 2146.756226][ T3660] ? __pfx_ib_device_get_by_netdev+0x10/0x10 [ 2146.756250][ T3660] ? ip6_route_dev_notify+0x9a/0x5b0 [ 2146.756266][ T3660] ? notifier_call_chain+0x3bf/0x3e0 [ 2146.756287][ T3660] geneve_open+0x8c/0x140 [ 2146.756300][ T3660] __dev_open+0x470/0x880 [ 2146.756317][ T3660] ? __pfx___dev_open+0x10/0x10 [ 2146.756335][ T3660] __dev_change_flags+0x1ea/0x6d0 [ 2146.756355][ T3660] ? __pfx___dev_change_flags+0x10/0x10 [ 2146.756378][ T3660] netif_change_flags+0x88/0x1a0 [ 2146.756396][ T3660] do_setlink+0xc55/0x41c0 [ 2146.756413][ T3660] ? __kernel_text_address+0xd/0x40 [ 2146.756436][ T3660] ? arch_stack_walk+0xfc/0x150 [ 2146.756452][ T3660] ? __pfx_do_setlink+0x10/0x10 [ 2146.756477][ T3660] ? __lock_acquire+0xab9/0xd20 [ 2146.756500][ T3660] ? __mutex_trylock_common+0x153/0x260 [ 2146.756514][ T3660] ? __pfx___mutex_trylock_common+0x10/0x10 [ 2146.756530][ T3660] ? rcu_is_watching+0x15/0xb0 [ 2146.756550][ T3660] ? trace_contention_end+0x39/0x120 [ 2146.756563][ T3660] ? __mutex_lock+0x330/0xe80 [ 2146.756584][ T3660] ? __pfx_aa_get_newest_label+0x10/0x10 [ 2146.756603][ T3660] ? rtnl_newlink+0x8db/0x1c70 [ 2146.756615][ T3660] ? rcu_is_watching+0x15/0xb0 [ 2146.756634][ T3660] ? __pfx___mutex_lock+0x10/0x10 [ 2146.756657][ T3660] ? full_name_hash+0x92/0xe0 [ 2146.756675][ T3660] ? netdev_name_node_lookup+0xdf/0x120 [ 2146.756695][ T3660] rtnl_newlink+0x160b/0x1c70 [ 2146.756707][ T3660] ? netlink_sendmsg+0x805/0xb30 [ 2146.756729][ T3660] ? __pfx_rtnl_newlink+0x10/0x10 [ 2146.756757][ T3660] ? kasan_quarantine_put+0xdd/0x220 [ 2146.756775][ T3660] ? lockdep_hardirqs_on+0x9c/0x150 [ 2146.756797][ T3660] ? nlmon_xmit+0xb0/0x100 [ 2146.756814][ T3660] ? kmem_cache_free+0x18f/0x400 [ 2146.756830][ T3660] ? __local_bh_enable_ip+0x12d/0x1c0 [ 2146.756849][ T3660] ? lockdep_hardirqs_on+0x9c/0x150 [ 2146.756868][ T3660] ? __local_bh_enable_ip+0x12d/0x1c0 [ 2146.756886][ T3660] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 2146.756907][ T3660] ? __dev_queue_xmit+0x27e/0x3a70 [ 2146.756932][ T3660] ? __lock_acquire+0xab9/0xd20 [ 2146.756964][ T3660] ? __pfx_rtnl_newlink+0x10/0x10 [ 2146.756977][ T3660] rtnetlink_rcv_msg+0x7cc/0xb70 [ 2146.756992][ T3660] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 2146.757004][ T3660] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2146.757015][ T3660] ? ref_tracker_free+0x63a/0x7d0 [ 2146.757030][ T3660] ? __copy_skb_header+0xa7/0x550 [ 2146.757047][ T3660] ? __pfx_ref_tracker_free+0x10/0x10 [ 2146.757064][ T3660] ? __skb_clone+0x63/0x7a0 [ 2146.757084][ T3660] netlink_rcv_skb+0x208/0x470 [ 2146.757099][ T3660] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2146.757112][ T3660] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2146.757134][ T3660] ? netlink_deliver_tap+0x2e/0x1b0 [ 2146.757148][ T3660] ? netlink_deliver_tap+0x2e/0x1b0 [ 2146.757165][ T3660] netlink_unicast+0x75b/0x8d0 [ 2146.757185][ T3660] netlink_sendmsg+0x805/0xb30 [ 2146.757205][ T3660] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2146.757221][ T3660] ? aa_sock_msg_perm+0x94/0x160 [ 2146.757238][ T3660] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2146.757254][ T3660] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2146.757268][ T3660] __sock_sendmsg+0x21c/0x270 [ 2146.757289][ T3660] ____sys_sendmsg+0x505/0x830 [ 2146.757308][ T3660] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2146.757329][ T3660] ? import_iovec+0x74/0xa0 [ 2146.757343][ T3660] ___sys_sendmsg+0x21f/0x2a0 [ 2146.757360][ T3660] ? __pfx____sys_sendmsg+0x10/0x10 [ 2146.757398][ T3660] ? __fget_files+0x2a/0x420 [ 2146.757411][ T3660] ? __fget_files+0x3a0/0x420 [ 2146.757436][ T3660] __x64_sys_sendmsg+0x19b/0x260 [ 2146.757453][ T3660] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2146.757475][ T3660] ? __pfx_ksys_write+0x10/0x10 [ 2146.757485][ T3660] ? rcu_is_watching+0x15/0xb0 [ 2146.757508][ T3660] ? do_syscall_64+0xbe/0x3b0 [ 2146.757521][ T3660] do_syscall_64+0xfa/0x3b0 [ 2146.757531][ T3660] ? lockdep_hardirqs_on+0x9c/0x150 [ 2146.757549][ T3660] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2146.757561][ T3660] ? clear_bhb_loop+0x60/0xb0 [ 2146.757577][ T3660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2146.757589][ T3660] RIP: 0033:0x7fb02b38e929 [ 2146.757601][ T3660] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2146.757611][ T3660] RSP: 002b:00007fb02c183038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2146.757625][ T3660] RAX: ffffffffffffffda RBX: 00007fb02b5b5fa0 RCX: 00007fb02b38e929 [ 2146.757634][ T3660] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 2146.757642][ T3660] RBP: 00007fb02c183090 R08: 0000000000000000 R09: 0000000000000000 [ 2146.757650][ T3660] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2146.757658][ T3660] R13: 0000000000000000 R14: 00007fb02b5b5fa0 R15: 00007fb02b6dfa28 [ 2146.757676][ T3660] [ 2146.763256][ T3660] socket: no more sockets [ 2147.410830][ T3649] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 2147.432023][ T3660] geneve1: entered promiscuous mode [ 2147.460658][ T3660] geneve1: entered allmulticast mode [ 2147.730350][ T3666] netlink: 68 bytes leftover after parsing attributes in process `syz.1.8487'. [ 2148.016549][ T2241] Bluetooth: hci5: command 0x0406 tx timeout [ 2148.125498][T21075] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 2148.306780][T21075] usb 2-1: New USB device found, idVendor=0471, idProduct=0329, bcdDevice=db.da [ 2148.316396][T21075] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2148.335122][T21075] usb 2-1: config 0 descriptor?? [ 2148.352037][T21075] pwc: Philips SPC 900NC USB webcam detected. [ 2148.385437][T21089] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 2148.492325][ T2241] Bluetooth: hci3: command 0x0406 tx timeout [ 2148.565711][ T2241] Bluetooth: hci0: command 0x0c1a tx timeout [ 2148.576306][T11222] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 2148.613315][T21089] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x92, changing to 0x82 [ 2148.633179][T21089] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2148.647195][ T2241] Bluetooth: hci2: command 0x0405 tx timeout [ 2148.675059][T21089] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 2148.706715][T21089] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2148.742700][ T3682] netlink: 56 bytes leftover after parsing attributes in process `syz.3.8495'. [ 2148.752005][ T3682] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8495'. [ 2148.752355][T21089] usb 1-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=9e.7f [ 2148.774742][T11222] usb 3-1: Using ep0 maxpacket: 32 [ 2148.786548][T21089] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2148.794880][T21089] usb 1-1: Product: syz [ 2148.804637][T11222] usb 3-1: too many endpoints for config 0 interface 0 altsetting 64: 255, using maximum allowed: 30 [ 2148.822716][T11222] usb 3-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 108, changing to 10 [ 2148.834151][T21089] usb 1-1: Manufacturer: syz [ 2148.842905][T21089] usb 1-1: SerialNumber: syz [ 2148.854800][T11222] usb 3-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2148.870493][T21075] pwc: send_video_command error -71 [ 2148.879788][T21089] usb 1-1: config 0 descriptor?? [ 2148.884950][T21075] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 2148.900252][T21089] redrat3 1-1:0.0: Couldn't find all endpoints [ 2148.909391][T11222] usb 3-1: config 0 interface 0 altsetting 64 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 2148.922963][T21075] Philips webcam 2-1:0.0: probe with driver Philips webcam failed with error -71 [ 2148.939309][T11222] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2148.952161][T21075] usb 2-1: USB disconnect, device number 27 [ 2148.960912][T11222] usb 3-1: New USB device found, idVendor=172f, idProduct=0038, bcdDevice= 0.00 [ 2148.985025][T11222] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2149.011050][T11222] usb 3-1: config 0 descriptor?? [ 2149.112286][ T3671] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2149.121435][ T3671] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2149.136198][ T3671] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2149.153610][ T3671] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2149.178815][ T3671] netlink: 32 bytes leftover after parsing attributes in process `syz.0.8490'. [ 2149.238991][ T3675] loop3: detected capacity change from 0 to 1 [ 2149.283429][ T3675] Dev loop3: unable to read RDB block 1 [ 2149.312220][ T3675] loop3: unable to read partition table [ 2149.320727][ T3675] loop3: partition table beyond EOD, truncated [ 2149.331550][ T3702] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2149.356024][ T3675] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 2149.365895][ T3702] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2149.397962][ T3703] sch_tbf: burst 19872 is lower than device lo mtu (39799) ! [ 2149.543727][T11222] waltop 0003:172F:0038.0085: unknown main item tag 0x2 [ 2149.548395][ T3708] xt_recent: hitcount (4294967295) is larger than allowed maximum (65535) [ 2149.573443][T21075] usb 1-1: USB disconnect, device number 121 [ 2149.671154][T11222] waltop 0003:172F:0038.0085: hidraw0: USB HID v0.07 Device [HID 172f:0038] on usb-dummy_hcd.2-1/input0 [ 2149.922177][T11222] usb 3-1: USB disconnect, device number 104 [ 2150.085731][ T2241] Bluetooth: hci5: command 0x0406 tx timeout [ 2150.290008][T21075] hid-generic 0000:0000:0000.0086: unknown main item tag 0x7 [ 2150.313446][ T3726] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8510'. [ 2150.325693][T21075] hid-generic 0000:0000:0000.0086: ignoring exceeding usage max [ 2150.347027][T21075] hid-generic 0000:0000:0000.0086: unknown main item tag 0x0 [ 2150.369533][T21075] hid-generic 0000:0000:0000.0086: unknown main item tag 0x6 [ 2150.390273][T21075] hid-generic 0000:0000:0000.0086: reserved main item tag 0xd [ 2150.487777][T21075] hid-generic 0000:0000:0000.0086: hidraw0: HID v0.00 Device [syz0] on syz0 [ 2150.570136][ T2241] Bluetooth: hci3: command 0x0406 tx timeout [ 2150.645369][ T2241] Bluetooth: hci0: command 0x0c1a tx timeout [ 2150.725345][ T2241] Bluetooth: hci2: command 0x0405 tx timeout [ 2150.795599][T21075] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 2150.997647][T21075] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2151.008507][T21075] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2151.023974][ T3733] fido_id[3733]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 2151.165404][T21075] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 2151.178830][T21075] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 2151.195938][T21075] usb 3-1: Product: syz [ 2151.215008][T21075] usb 3-1: Manufacturer: syz [ 2151.220221][T21089] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 2151.240433][T21075] usb 3-1: SerialNumber: syz [ 2151.266163][T21075] usb 3-1: config 0 descriptor?? [ 2151.290758][T21075] usb 3-1: selecting invalid altsetting 0 [ 2151.375296][T21089] usb 4-1: Using ep0 maxpacket: 32 [ 2151.382139][T21089] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 2151.395576][T21089] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2151.420417][T21089] usb 4-1: config 0 has no interface number 0 [ 2151.435353][T21089] usb 4-1: config 0 interface 35 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2151.468705][T21089] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 2151.511114][T21089] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2151.544165][ T3743] fido_id[3743]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 2151.551039][T21089] usb 4-1: Product: syz [ 2151.578445][T21089] usb 4-1: Manufacturer: syz [ 2151.592133][T21089] usb 4-1: SerialNumber: syz [ 2151.621595][T21089] usb 4-1: config 0 descriptor?? [ 2151.664266][T21089] radio-si470x 4-1:0.35: could not find interrupt in endpoint [ 2151.701288][T21089] radio-si470x 4-1:0.35: probe with driver radio-si470x failed with error -5 [ 2151.842040][T21089] radio-raremono 4-1:0.35: Thanko's Raremono connected: (10C4:818A) [ 2152.034639][T21075] usb 3-1: USB disconnect, device number 105 [ 2152.046400][T21089] radio-raremono 4-1:0.35: raremono_cmd_main failed (-71) [ 2152.098576][T21089] radio-raremono 4-1:0.35: V4L2 device registered as radio48 [ 2152.157363][T21089] usb 4-1: USB disconnect, device number 85 [ 2152.173976][T21089] radio-raremono 4-1:0.35: Thanko's Raremono disconnected [ 2152.190384][ C0] vcan0: j1939_tp_rxtimer: 0xffff888024498400: rx timeout, send abort [ 2152.198967][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802449ac00: rx timeout, send abort [ 2152.248211][ T3749] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8515'. [ 2152.332501][ T3749] FAULT_INJECTION: forcing a failure. [ 2152.332501][ T3749] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2152.379943][ T3749] CPU: 1 UID: 0 PID: 3749 Comm: syz.2.8515 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 2152.379972][ T3749] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 2152.379983][ T3749] Call Trace: [ 2152.379989][ T3749] [ 2152.379996][ T3749] dump_stack_lvl+0x189/0x250 [ 2152.380024][ T3749] ? __pfx____ratelimit+0x10/0x10 [ 2152.380047][ T3749] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2152.380070][ T3749] ? __pfx__printk+0x10/0x10 [ 2152.380087][ T3749] ? __might_fault+0xb0/0x130 [ 2152.380110][ T3749] should_fail_ex+0x414/0x560 [ 2152.380132][ T3749] _copy_from_user+0x2d/0xb0 [ 2152.380154][ T3749] kstrtouint_from_user+0xc4/0x170 [ 2152.380177][ T3749] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 2152.380210][ T3749] proc_fail_nth_write+0x88/0x240 [ 2152.380228][ T3749] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2152.380250][ T3749] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2152.380269][ T3749] vfs_write+0x27b/0xa90 [ 2152.380299][ T3749] ? __pfx_vfs_write+0x10/0x10 [ 2152.380322][ T3749] ? __fget_files+0x2a/0x420 [ 2152.380342][ T3749] ? __fget_files+0x3a0/0x420 [ 2152.380357][ T3749] ? __fget_files+0x2a/0x420 [ 2152.380380][ T3749] ksys_write+0x145/0x250 [ 2152.380396][ T3749] ? __pfx_ksys_write+0x10/0x10 [ 2152.380407][ T3749] ? rcu_is_watching+0x15/0xb0 [ 2152.380434][ T3749] ? do_syscall_64+0xbe/0x3b0 [ 2152.380451][ T3749] do_syscall_64+0xfa/0x3b0 [ 2152.380463][ T3749] ? lockdep_hardirqs_on+0x9c/0x150 [ 2152.380484][ T3749] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2152.380499][ T3749] ? clear_bhb_loop+0x60/0xb0 [ 2152.380518][ T3749] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2152.380532][ T3749] RIP: 0033:0x7f0a4bf8d3df [ 2152.380545][ T3749] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 2152.380558][ T3749] RSP: 002b:00007f0a4ce2d030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2152.380573][ T3749] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0a4bf8d3df [ 2152.380584][ T3749] RDX: 0000000000000001 RSI: 00007f0a4ce2d0a0 RDI: 0000000000000004 [ 2152.380594][ T3749] RBP: 00007f0a4ce2d090 R08: 0000000000000000 R09: 0000000000000000 [ 2152.380603][ T3749] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 [ 2152.380611][ T3749] R13: 0000000000000000 R14: 00007f0a4c1b5fa0 R15: 00007f0a4c2dfa28 [ 2152.380634][ T3749] [ 2152.615672][ C1] vkms_vblank_simulate: vblank timer overrun [ 2152.698654][ C0] vcan0: j1939_tp_rxtimer: 0xffff888024498400: abort rx timeout. Force session deactivation [ 2152.710372][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802449ac00: abort rx timeout. Force session deactivation [ 2152.735448][ T2241] Bluetooth: hci0: command 0x0c1a tx timeout [ 2152.805691][ T2241] Bluetooth: hci2: command 0x0405 tx timeout [ 2152.828722][ T3757] (unnamed net_device) (uninitialized): up delay (16) is not a multiple of miimon (6516), value rounded to 0 ms [ 2152.971735][ T3765] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8520'. [ 2152.989808][ T3765] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8520'. [ 2153.015072][ T3767] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8522'. [ 2153.055398][ T3765] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8520'. [ 2153.066817][ T3767] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8522'. [ 2153.078040][ T3767] netlink: 'syz.3.8522': attribute type 20 has an invalid length. [ 2153.264775][ T3777] bridge_slave_0: left allmulticast mode [ 2153.270839][ T3777] bridge_slave_0: left promiscuous mode [ 2153.281496][ T3777] bridge0: port 1(bridge_slave_0) entered disabled state [ 2153.327483][ T3777] bridge_slave_1: left allmulticast mode [ 2153.334189][ T3777] bridge_slave_1: left promiscuous mode [ 2153.340876][ T3777] bridge0: port 2(bridge_slave_1) entered disabled state [ 2153.380179][T21089] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 2153.411196][ T3777] bond0: (slave bond_slave_0): Releasing backup interface [ 2153.436929][ T3777] bond0: (slave bond_slave_1): Releasing backup interface [ 2153.551611][ T3777] team0: Port device team_slave_0 removed [ 2153.585131][ T3777] team0: Port device team_slave_1 removed [ 2153.597427][ T3777] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2153.607040][ T3777] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2153.619163][T21089] usb 6-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 2153.630502][T21089] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2153.648245][T21089] usb 6-1: config 0 descriptor?? [ 2153.742844][T21089] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 2153.832199][ T3788] sch_tbf: burst 19872 is lower than device lo mtu (39799) ! [ 2153.990970][ T3773] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8526'. [ 2154.002103][ T3773] tipc: Started in network mode [ 2154.011117][ T3773] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 2154.018644][ T3773] tipc: Enabled bearer , priority 10 [ 2154.070521][ T3773] netlink: 14 bytes leftover after parsing attributes in process `syz.5.8526'. [ 2154.080711][ T3773] tipc: Resetting bearer [ 2154.510001][ T3773] tipc: Disabling bearer [ 2154.883041][T21089] gspca_cpia1: usb_control_msg 05, error -110 [ 2154.890336][T21089] gspca_cpia1: usb_control_msg 01, error -32 [ 2154.900796][T21089] gspca_cpia1: usb_control_msg 01, error -32 [ 2154.915643][T21089] gspca_cpia1: usb_control_msg 01, error -32 [ 2154.932347][T21089] gspca_cpia1: usb_control_msg 01, error -32 [ 2154.949783][T21089] cpia1 6-1:0.0: only firmware version 1 is supported (got: 0) [ 2155.165950][T21089] usb 6-1: USB disconnect, device number 93 [ 2156.133210][ T3809] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8535'. [ 2156.180586][T21075] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 2156.450444][ T3820] netlink: 'syz.0.8536': attribute type 2 has an invalid length. [ 2156.468800][ T3820] netlink: 'syz.0.8536': attribute type 13 has an invalid length. [ 2156.540955][T21075] usb 2-1: Using ep0 maxpacket: 16 [ 2156.551591][T21075] usb 2-1: config 0 has an invalid interface number: 68 but max is 0 [ 2156.560450][T21075] usb 2-1: config 0 has no interface number 0 [ 2156.594486][T21075] usb 2-1: config 0 interface 68 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2156.635345][T32332] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 2156.708574][T21075] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 2156.733043][T21075] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2156.755523][T21075] usb 2-1: Product: syz [ 2156.760560][T21075] usb 2-1: Manufacturer: syz [ 2156.776994][T21075] usb 2-1: SerialNumber: syz [ 2156.813544][T21075] usb 2-1: config 0 descriptor?? [ 2156.859595][T32332] usb 3-1: config 0 has no interfaces? [ 2156.935632][T32332] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 2156.936148][T21075] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 2156.959362][T32332] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2156.985837][T32332] usb 3-1: Product: syz [ 2156.995461][T11206] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 2157.014561][T32332] usb 3-1: Manufacturer: syz [ 2157.048848][ T49] usb 2-1: Failed to submit usb control message: -71 [ 2157.050640][ T2328] usb 2-1: USB disconnect, device number 28 [ 2157.066841][ T49] usb 2-1: unable to send the bmi data to the device: -71 [ 2157.074122][T32332] usb 3-1: SerialNumber: syz [ 2157.074681][ T49] usb 2-1: unable to get target info from device [ 2157.086942][ T49] usb 2-1: could not get target info (-71) [ 2157.092784][ T49] usb 2-1: could not probe fw (-71) [ 2157.136101][T32332] usb 3-1: config 0 descriptor?? [ 2157.172556][T11206] usb 6-1: Using ep0 maxpacket: 8 [ 2157.223942][T11206] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 2157.290452][T11206] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2157.298915][T11206] usb 6-1: Product: syz [ 2157.308829][T11206] usb 6-1: Manufacturer: syz [ 2157.313468][T11206] usb 6-1: SerialNumber: syz [ 2157.350766][ T3814] binder: 3805:3814 ioctl c0306201 0 returned -14 [ 2157.401055][T11206] usb 6-1: config 0 descriptor?? [ 2157.619881][T11206] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 2157.814618][ T3834] FAULT_INJECTION: forcing a failure. [ 2157.814618][ T3834] name failslab, interval 1, probability 0, space 0, times 0 [ 2157.888157][ T3834] CPU: 0 UID: 0 PID: 3834 Comm: syz.0.8539 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 2157.888184][ T3834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 2157.888196][ T3834] Call Trace: [ 2157.888204][ T3834] [ 2157.888213][ T3834] dump_stack_lvl+0x189/0x250 [ 2157.888247][ T3834] ? __pfx____ratelimit+0x10/0x10 [ 2157.888274][ T3834] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2157.888300][ T3834] ? __pfx__printk+0x10/0x10 [ 2157.888325][ T3834] ? __pfx___might_resched+0x10/0x10 [ 2157.888357][ T3834] should_fail_ex+0x414/0x560 [ 2157.888384][ T3834] should_failslab+0xa8/0x100 [ 2157.888405][ T3834] __kmalloc_noprof+0xcb/0x4f0 [ 2157.888423][ T3834] ? security_sk_alloc+0x52/0x390 [ 2157.888444][ T3834] security_sk_alloc+0x52/0x390 [ 2157.888464][ T3834] sk_prot_alloc+0x101/0x220 [ 2157.888489][ T3834] sk_alloc+0x3a/0x370 [ 2157.888521][ T3834] inet6_create+0x7fd/0x12a0 [ 2157.888539][ T3834] ? inet6_create+0x71/0x12a0 [ 2157.888564][ T3834] __sock_create+0x4b0/0x9f0 [ 2157.888600][ T3834] udp_sock_create6+0xcb/0x690 [ 2157.888628][ T3834] ? __pfx_udp_sock_create6+0x10/0x10 [ 2157.888652][ T3834] ? __kasan_kmalloc_large+0x85/0xa0 [ 2157.888681][ T3834] geneve_sock_add+0x35b/0x910 [ 2157.888706][ T3834] ? __pfx_geneve_sock_add+0x10/0x10 [ 2157.888721][ T3834] ? ib_device_get_by_netdev+0x46b/0x4d0 [ 2157.888752][ T3834] ? __pfx_ib_device_get_by_netdev+0x10/0x10 [ 2157.888786][ T3834] ? ip6_route_dev_notify+0x9a/0x5b0 [ 2157.888808][ T3834] ? notifier_call_chain+0x3bf/0x3e0 [ 2157.888839][ T3834] geneve_open+0x8c/0x140 [ 2157.888858][ T3834] __dev_open+0x470/0x880 [ 2157.888881][ T3834] ? __pfx___dev_open+0x10/0x10 [ 2157.888908][ T3834] __dev_change_flags+0x1ea/0x6d0 [ 2157.888935][ T3834] ? __pfx___dev_change_flags+0x10/0x10 [ 2157.888968][ T3834] netif_change_flags+0x88/0x1a0 [ 2157.888994][ T3834] do_setlink+0xc55/0x41c0 [ 2157.889018][ T3834] ? __kernel_text_address+0xd/0x40 [ 2157.889043][ T3834] ? arch_stack_walk+0xfc/0x150 [ 2157.889069][ T3834] ? __pfx_do_setlink+0x10/0x10 [ 2157.889124][ T3834] ? __lock_acquire+0xab9/0xd20 [ 2157.889178][ T3834] ? __mutex_trylock_common+0x153/0x260 [ 2157.889203][ T3834] ? __pfx___mutex_trylock_common+0x10/0x10 [ 2157.889231][ T3834] ? rcu_is_watching+0x15/0xb0 [ 2157.889263][ T3834] ? trace_contention_end+0x39/0x120 [ 2157.889284][ T3834] ? __mutex_lock+0x330/0xe80 [ 2157.889319][ T3834] ? __pfx_aa_get_newest_label+0x10/0x10 [ 2157.889350][ T3834] ? rtnl_newlink+0x8db/0x1c70 [ 2157.889370][ T3834] ? rcu_is_watching+0x15/0xb0 [ 2157.889402][ T3834] ? __pfx___mutex_lock+0x10/0x10 [ 2157.889440][ T3834] ? full_name_hash+0x92/0xe0 [ 2157.889470][ T3834] ? netdev_name_node_lookup+0xdf/0x120 [ 2157.889504][ T3834] rtnl_newlink+0x160b/0x1c70 [ 2157.889546][ T3834] ? __pfx_rtnl_newlink+0x10/0x10 [ 2157.889594][ T3834] ? __lock_acquire+0xab9/0xd20 [ 2157.889643][ T3834] ? is_bpf_text_address+0x26/0x2b0 [ 2157.889680][ T3834] ? is_bpf_text_address+0x292/0x2b0 [ 2157.889709][ T3834] ? is_bpf_text_address+0x26/0x2b0 [ 2157.889744][ T3834] ? kernel_text_address+0xa5/0xe0 [ 2157.889783][ T3834] ? __lock_acquire+0xab9/0xd20 [ 2157.889839][ T3834] ? __pfx_rtnl_newlink+0x10/0x10 [ 2157.889860][ T3834] rtnetlink_rcv_msg+0x7cc/0xb70 [ 2157.889886][ T3834] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 2157.889907][ T3834] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2157.889947][ T3834] netlink_rcv_skb+0x208/0x470 [ 2157.889973][ T3834] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2157.889997][ T3834] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2157.890034][ T3834] ? netlink_deliver_tap+0x2e/0x1b0 [ 2157.890057][ T3834] ? netlink_deliver_tap+0x2e/0x1b0 [ 2157.890087][ T3834] netlink_unicast+0x75b/0x8d0 [ 2157.890121][ T3834] netlink_sendmsg+0x805/0xb30 [ 2157.890156][ T3834] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2157.890184][ T3834] ? aa_sock_msg_perm+0x94/0x160 [ 2157.890212][ T3834] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2157.890250][ T3834] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2157.890289][ T3834] __sock_sendmsg+0x21c/0x270 [ 2157.890320][ T3834] ____sys_sendmsg+0x505/0x830 [ 2157.890359][ T3834] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2157.890393][ T3834] ? import_iovec+0x74/0xa0 [ 2157.890414][ T3834] ___sys_sendmsg+0x21f/0x2a0 [ 2157.890438][ T3834] ? __pfx____sys_sendmsg+0x10/0x10 [ 2157.890491][ T3834] ? __fget_files+0x2a/0x420 [ 2157.890509][ T3834] ? __fget_files+0x3a0/0x420 [ 2157.890545][ T3834] __x64_sys_sendmsg+0x19b/0x260 [ 2157.890570][ T3834] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2157.890631][ T3834] ? __pfx_ksys_write+0x10/0x10 [ 2157.890655][ T3834] ? do_syscall_64+0xbe/0x3b0 [ 2157.890676][ T3834] do_syscall_64+0xfa/0x3b0 [ 2157.890694][ T3834] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2157.890712][ T3834] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2157.890739][ T3834] ? clear_bhb_loop+0x60/0xb0 [ 2157.890762][ T3834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2157.890780][ T3834] RIP: 0033:0x7f923878e929 [ 2157.890798][ T3834] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2157.890814][ T3834] RSP: 002b:00007f92365f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2157.890834][ T3834] RAX: ffffffffffffffda RBX: 00007f92389b5fa0 RCX: 00007f923878e929 [ 2157.890848][ T3834] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 2157.890860][ T3834] RBP: 00007f92365f6090 R08: 0000000000000000 R09: 0000000000000000 [ 2157.890872][ T3834] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2157.890884][ T3834] R13: 0000000000000000 R14: 00007f92389b5fa0 R15: 00007f9238adfa28 [ 2157.890914][ T3834] [ 2158.840055][T11206] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 2158.855879][ T3834] geneve1: entered promiscuous mode [ 2158.861192][ T3834] geneve1: entered allmulticast mode [ 2159.343682][ T3843] ptrace attach of "./syz-executor exec"[2245] was attempted by "./syz-executor exec"[3843] [ 2159.410072][ T3843] xt_cgroup: invalid path, errno=-2 [ 2159.587642][ T3844] sch_tbf: burst 19872 is lower than device lo mtu (39799) ! [ 2159.925672][T11206] usb 6-1: USB disconnect, device number 94 [ 2160.179003][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 2160.198656][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 2160.576336][T21075] usb 3-1: USB disconnect, device number 106 [ 2161.123753][ T3866] sch_tbf: burst 19872 is lower than device lo mtu (39799) ! [ 2161.333445][ T3875] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:16x16 (0x47425247, 9, 0, 0, 0) [ 2161.413482][ T3881] netlink: 24032 bytes leftover after parsing attributes in process `syz.5.8553'. [ 2161.467556][ T3881] netlink: 104088 bytes leftover after parsing attributes in process `syz.5.8553'. [ 2161.535477][ T3881] netlink: 24032 bytes leftover after parsing attributes in process `syz.5.8553'. [ 2161.675355][T21089] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 2161.683182][T21075] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 2161.849615][T21075] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2161.860970][T21075] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2161.870865][T21075] usb 4-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 2161.880623][T21089] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 2161.889808][T21089] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 2161.927341][T21075] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2161.935530][T21089] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2161.948858][T21089] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 2161.963258][T21089] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2161.971794][T21075] usb 4-1: config 0 descriptor?? [ 2161.979591][T21089] usb 1-1: Product: syz [ 2162.066454][T21089] usb 1-1: Manufacturer: syz [ 2162.071159][T21089] usb 1-1: SerialNumber: syz [ 2162.327277][T21089] usb 1-1: 0:2 : does not exist [ 2162.385520][T11206] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 2162.511352][T21089] usb 1-1: USB disconnect, device number 122 [ 2162.558461][T11206] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 2162.600797][T11206] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 2162.672816][T11206] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 2162.706970][ T3202] udevd[3202]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2162.719414][T11206] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2162.815870][ T3890] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 2162.835115][T11206] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 2163.054938][T11206] usb 6-1: USB disconnect, device number 95 [ 2163.543959][ T3917] netlink: 'syz.2.8561': attribute type 27 has an invalid length. [ 2163.757059][ T2328] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 2164.088955][ T2328] usb 1-1: Using ep0 maxpacket: 32 [ 2164.097429][ T2328] usb 1-1: unable to get BOS descriptor or descriptor too short [ 2164.107742][ T2328] usb 1-1: config 253 has an invalid interface number: 202 but max is 0 [ 2164.118672][ T2328] usb 1-1: config 253 has no interface number 0 [ 2164.128865][ T3923] ptrace attach of "./syz-executor exec"[2406] was attempted by "./syz-executor exec"[3923] [ 2164.153159][ T2328] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 2164.165181][ T2328] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2164.181961][ T3923] xt_cgroup: invalid path, errno=-2 [ 2164.187606][ T2328] usb 1-1: Product: syz [ 2164.195241][ T2328] usb 1-1: Manufacturer: syz [ 2164.208406][ T2328] usb 1-1: SerialNumber: syz [ 2164.262538][T21089] usb 4-1: USB disconnect, device number 86 [ 2164.539561][ T2328] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 2164.551799][ T36] usb 1-1: Failed to submit usb control message: -71 [ 2164.598984][ T36] usb 1-1: unable to send the bmi data to the device: -71 [ 2164.635784][ T2328] usb 1-1: USB disconnect, device number 123 [ 2164.645907][ T36] usb 1-1: unable to get target info from device [ 2164.675330][ T36] usb 1-1: could not get target info (-71) [ 2164.718559][ T36] usb 1-1: could not probe fw (-71) [ 2165.265756][T21089] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 2165.639322][T21089] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 2165.663593][T21089] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2165.693016][T21089] usb 3-1: Product: syz [ 2165.724557][T21089] usb 3-1: Manufacturer: syz [ 2165.755642][T21089] usb 3-1: SerialNumber: syz [ 2165.778715][T21089] usb 3-1: config 0 descriptor?? [ 2166.145859][T11222] usb 2-1: new full-speed USB device number 29 using dummy_hcd [ 2166.332955][T11222] usb 2-1: New USB device found, idVendor=04f2, idProduct=1236, bcdDevice= 0.00 [ 2166.351120][T11222] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2166.387978][T11222] usb 2-1: config 0 descriptor?? [ 2166.454853][ T3955] ptrace attach of "./syz-executor exec"[27768] was attempted by "./syz-executor exec"[3955] [ 2166.476465][ T3955] xt_cgroup: invalid path, errno=-2 [ 2166.930040][T21089] usb 3-1: non-Atmel transceiver xxxx0008 [ 2167.004661][T11222] chicony 0003:04F2:1236.0087: hidraw0: USB HID v1.01 Device [HID 04f2:1236] on usb-dummy_hcd.1-1/input0 [ 2167.104958][ T3968] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8577'. [ 2167.125723][T11222] usb 2-1: USB disconnect, device number 29 [ 2167.176407][ T3968] openvswitch: : Dropping previously announced user features [ 2167.189209][T21089] usb 3-1: Firmware version (0.0) predates our first public release. [ 2167.197756][T21089] usb 3-1: Please update to version 0.2 or newer [ 2167.219497][T21089] usb 3-1: atusb_probe: initialization failed, error = -19 [ 2167.249573][T21089] usb 3-1: USB disconnect, device number 107 [ 2167.301765][ T3967] fido_id[3967]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 2167.437547][ T3970] netlink: 68 bytes leftover after parsing attributes in process `syz.0.8578'. [ 2167.867713][T21089] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 2168.073341][T21089] usb 1-1: New USB device found, idVendor=0471, idProduct=0329, bcdDevice=db.da [ 2168.131123][ T3986] program syz.1.8585 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2168.145591][T21089] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2168.211581][T21089] usb 1-1: config 0 descriptor?? [ 2168.234323][ T3989] xt_TPROXY: Can be used only with -p tcp or -p udp [ 2168.268259][T21089] pwc: Philips SPC 900NC USB webcam detected. [ 2168.401080][ T3993] netlink: 'syz.2.8587': attribute type 1 has an invalid length. [ 2168.486956][ T3993] bond4: entered promiscuous mode [ 2168.507708][ T3993] 8021q: adding VLAN 0 to HW filter on device bond4 [ 2168.670137][T21089] pwc: send_video_command error -71 [ 2168.679179][T21089] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 2168.695106][T21089] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71 [ 2168.717125][T21089] usb 1-1: USB disconnect, device number 124 [ 2168.833437][ T4004] ptrace attach of "./syz-executor exec"[27768] was attempted by "./syz-executor exec"[4004] [ 2168.862427][ T4004] xt_cgroup: invalid path, errno=-2 [ 2168.955291][ T2328] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 2169.129246][ T2328] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 2169.139382][ T2328] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2169.147511][ T2328] usb 6-1: Product: syz [ 2169.161933][ T2328] usb 6-1: Manufacturer: syz [ 2169.172086][ T2328] usb 6-1: SerialNumber: syz [ 2169.199348][ T2328] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 2169.241085][T11206] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 2169.447375][T11222] usb 6-1: USB disconnect, device number 96 [ 2169.825304][ T2328] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 2170.325611][T11206] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 2170.357163][ T2328] usb 1-1: config 0 has no interfaces? [ 2170.367969][T11206] ath9k_htc: Failed to initialize the device [ 2170.403769][ T2328] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 2170.528645][ T2328] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2170.542204][ T2328] usb 1-1: Product: syz [ 2170.546737][ T2328] usb 1-1: Manufacturer: syz [ 2170.546739][T11222] usb 6-1: ath9k_htc: USB layer deinitialized [ 2170.579916][ T2328] usb 1-1: SerialNumber: syz [ 2170.602001][ T2328] usb 1-1: config 0 descriptor?? [ 2170.872123][ T4018] binder: 4011:4018 ioctl c0306201 0 returned -14 [ 2170.924133][ T4018] binder: BINDER_SET_CONTEXT_MGR already set [ 2170.930604][ T4018] binder: 4011:4018 ioctl 4018620d 2000000001c0 returned -16 [ 2171.243407][ T4032] geneve2: entered promiscuous mode [ 2171.255408][ T4032] geneve2: entered allmulticast mode [ 2172.512725][ T4050] ptrace attach of "./syz-executor exec"[2406] was attempted by "./syz-executor exec"[4050] [ 2172.526606][ T4050] xt_cgroup: invalid path, errno=-2 [ 2172.551134][ T4049] netlink: 68 bytes leftover after parsing attributes in process `syz.2.8603'. [ 2172.594469][ T2328] usb 1-1: USB disconnect, device number 125 [ 2172.808574][T11206] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 2172.821940][ T4055] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8599'. [ 2173.153334][T11206] usb 3-1: New USB device found, idVendor=0471, idProduct=0329, bcdDevice=db.da [ 2173.153356][T11206] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2173.159751][T11206] usb 3-1: config 0 descriptor?? [ 2173.275926][T11206] pwc: Philips SPC 900NC USB webcam detected. [ 2173.634027][T11206] pwc: send_video_command error -71 [ 2173.634048][T11206] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 2173.634162][T11206] Philips webcam 3-1:0.0: probe with driver Philips webcam failed with error -71 [ 2173.643098][T11206] usb 3-1: USB disconnect, device number 108 [ 2174.430367][ T4074] FAULT_INJECTION: forcing a failure. [ 2174.430367][ T4074] name failslab, interval 1, probability 0, space 0, times 0 [ 2174.450057][ T4074] CPU: 1 UID: 0 PID: 4074 Comm: syz.3.8610 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 2174.450086][ T4074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 2174.450099][ T4074] Call Trace: [ 2174.450108][ T4074] [ 2174.450118][ T4074] dump_stack_lvl+0x189/0x250 [ 2174.450155][ T4074] ? __pfx____ratelimit+0x10/0x10 [ 2174.450187][ T4074] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2174.450224][ T4074] ? __pfx__printk+0x10/0x10 [ 2174.450254][ T4074] ? __pfx___might_resched+0x10/0x10 [ 2174.450283][ T4074] ? fs_reclaim_acquire+0x7d/0x100 [ 2174.450328][ T4074] should_fail_ex+0x414/0x560 [ 2174.450355][ T4074] should_failslab+0xa8/0x100 [ 2174.450376][ T4074] kmem_cache_alloc_noprof+0x73/0x3c0 [ 2174.450403][ T4074] ? vm_area_dup+0x2b/0x680 [ 2174.450426][ T4074] vm_area_dup+0x2b/0x680 [ 2174.450449][ T4074] __split_vma+0x1a9/0xa00 [ 2174.450479][ T4074] ? look_up_lock_class+0x74/0x170 [ 2174.450507][ T4074] ? __pfx___split_vma+0x10/0x10 [ 2174.450538][ T4074] ? __lock_acquire+0xab9/0xd20 [ 2174.450564][ T4074] ? can_vma_merge_left+0x195/0x6b0 [ 2174.450595][ T4074] vma_modify+0x13b3/0x1970 [ 2174.450618][ T4074] ? vma_modify+0xd0/0x1970 [ 2174.450639][ T4074] ? vma_modify+0xd1/0x1970 [ 2174.450676][ T4074] vma_modify_flags_name+0x1ec/0x240 [ 2174.450703][ T4074] ? __pfx_vma_modify_flags_name+0x10/0x10 [ 2174.450738][ T4074] ? mas_prev_slot+0xb31/0xbe0 [ 2174.450770][ T4074] madvise_update_vma+0x287/0x9d0 [ 2174.450796][ T4074] ? __pfx_madvise_update_vma+0x10/0x10 [ 2174.450832][ T4074] madvise_do_behavior+0x1262/0x2e70 [ 2174.450865][ T4074] ? __pfx_madvise_do_behavior+0x10/0x10 [ 2174.450891][ T4074] ? is_bpf_text_address+0x26/0x2b0 [ 2174.450928][ T4074] ? __lock_acquire+0xab9/0xd20 [ 2174.450962][ T4074] ? __lock_acquire+0xab9/0xd20 [ 2174.450994][ T4074] ? madvise_lock+0x106/0x200 [ 2174.451022][ T4074] ? madvise_lock+0x106/0x200 [ 2174.451038][ T4074] ? down_write_killable+0x178/0x230 [ 2174.451057][ T4074] ? __pfx___up_read+0x10/0x10 [ 2174.451080][ T4074] ? iov_iter_iovec_advance+0x1e0/0x290 [ 2174.451109][ T4074] ? madvise_should_skip+0x2c6/0x2f0 [ 2174.451129][ T4074] __se_sys_process_madvise+0x48b/0x880 [ 2174.451147][ T4074] ? vfs_write+0x8d8/0xa90 [ 2174.451183][ T4074] ? __pfx___se_sys_process_madvise+0x10/0x10 [ 2174.451214][ T4074] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2174.451253][ T4074] ? fput+0xa0/0xd0 [ 2174.451275][ T4074] ? ksys_write+0x22a/0x250 [ 2174.451298][ T4074] ? __pfx_ksys_write+0x10/0x10 [ 2174.451313][ T4074] ? rcu_is_watching+0x15/0xb0 [ 2174.451345][ T4074] ? do_syscall_64+0xbe/0x3b0 [ 2174.451359][ T4074] ? __x64_sys_process_madvise+0x20/0xc0 [ 2174.451381][ T4074] do_syscall_64+0xfa/0x3b0 [ 2174.451395][ T4074] ? lockdep_hardirqs_on+0x9c/0x150 [ 2174.451418][ T4074] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2174.451435][ T4074] ? clear_bhb_loop+0x60/0xb0 [ 2174.451457][ T4074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2174.451474][ T4074] RIP: 0033:0x7f9cd538e929 [ 2174.451489][ T4074] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2174.451505][ T4074] RSP: 002b:00007f9cd61cb038 EFLAGS: 00000246 ORIG_RAX: 00000000000001b8 [ 2174.451523][ T4074] RAX: ffffffffffffffda RBX: 00007f9cd55b5fa0 RCX: 00007f9cd538e929 [ 2174.451537][ T4074] RDX: 0000000000000002 RSI: 0000200000000240 RDI: 0000000000000003 [ 2174.451548][ T4074] RBP: 00007f9cd61cb090 R08: 0000000000000000 R09: 0000000000000000 [ 2174.451559][ T4074] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 2174.451570][ T4074] R13: 0000000000000000 R14: 00007f9cd55b5fa0 R15: 00007f9cd56dfa28 [ 2174.451598][ T4074] [ 2174.806886][ C1] vkms_vblank_simulate: vblank timer overrun [ 2175.064200][ T4085] netlink: 'syz.3.8616': attribute type 1 has an invalid length. [ 2175.094739][ T4085] 8021q: adding VLAN 0 to HW filter on device bond7 [ 2175.222012][ T4085] bond7: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 2175.253849][ T4087] sch_tbf: burst 19872 is lower than device lo mtu (39799) ! [ 2175.337253][ T4088] vlan3: entered allmulticast mode [ 2175.345360][ T4088] bond7: entered allmulticast mode [ 2175.406492][ T4088] bond7: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 2175.443824][ T4095] ptrace attach of "./syz-executor exec"[27273] was attempted by "./syz-executor exec"[4095] [ 2176.415167][ T4106] netlink: 68 bytes leftover after parsing attributes in process `syz.3.8618'. [ 2176.528297][ T4109] netlink: 56 bytes leftover after parsing attributes in process `syz.2.8619'. [ 2176.746848][T11222] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 2176.925686][ T4118] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8622'. [ 2176.946909][ T4118] openvswitch: : Dropping previously announced user features [ 2177.011521][T11222] usb 4-1: New USB device found, idVendor=0471, idProduct=0329, bcdDevice=db.da [ 2177.028841][T11222] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2177.053369][T11222] usb 4-1: config 0 descriptor?? [ 2177.114231][T11222] pwc: Philips SPC 900NC USB webcam detected. [ 2177.285706][T11206] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 2177.452632][ T4130] loop6: detected capacity change from 0 to 7 [ 2177.471355][T11206] usb 1-1: Using ep0 maxpacket: 8 [ 2177.485257][T11206] usb 1-1: config 0 has no interfaces? [ 2177.515687][ T4130] Dev loop6: unable to read RDB block 7 [ 2177.521295][ T4130] loop6: AHDI p1 p2 [ 2177.523521][T11206] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 2177.526814][T11222] pwc: send_video_command error -71 [ 2177.544806][T11206] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2177.551026][T11222] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 2177.561411][ T4130] loop6: partition table partially beyond EOD, truncated [ 2177.590962][T11222] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71 [ 2177.600589][T11206] usb 1-1: Product: syz [ 2177.609068][T11206] usb 1-1: Manufacturer: syz [ 2177.616091][ T4130] loop6: p1 start 926365495 is beyond EOD, truncated [ 2177.690345][T11206] usb 1-1: SerialNumber: syz [ 2177.701543][T11222] usb 4-1: USB disconnect, device number 87 [ 2177.736799][T11206] usb 1-1: config 0 descriptor?? [ 2178.158574][T11222] usb 1-1: USB disconnect, device number 126 [ 2178.203470][ T4146] netlink: 'syz.1.8629': attribute type 32 has an invalid length. [ 2178.415750][ T4152] sch_tbf: burst 19872 is lower than device lo mtu (39799) ! [ 2179.078636][ T4161] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8636'. [ 2179.765044][ T4176] netlink: 'syz.1.8643': attribute type 1 has an invalid length. [ 2180.157353][ T4176] 8021q: adding VLAN 0 to HW filter on device bond4 [ 2180.291313][ T4182] bond4: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 2180.325419][T11206] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 2180.525687][T11206] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 2180.537505][T11206] usb 3-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 2180.803795][T11206] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 2180.902125][T11206] usb 3-1: config 220 has no interface number 2 [ 2180.914843][T11206] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 2180.965511][T11206] usb 3-1: config 220 interface 0 has no altsetting 0 [ 2180.972442][T11206] usb 3-1: config 220 interface 76 has no altsetting 0 [ 2181.075352][T11206] usb 3-1: config 220 interface 1 has no altsetting 0 [ 2181.094446][T11206] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 2181.124564][T11206] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2181.141260][T11206] usb 3-1: Product: syz [ 2181.151389][T11206] usb 3-1: Manufacturer: syz [ 2181.165111][T11206] usb 3-1: SerialNumber: syz [ 2181.403513][ T4188] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2181.416711][ T4188] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2181.476826][ T4205] netlink: 'syz.0.8652': attribute type 4 has an invalid length. [ 2181.666154][T11206] uvcvideo 3-1:220.1: Unknown video format 00000000-0000-0000-0000-000000000000 [ 2181.687293][T11206] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 2181.693815][T11206] usb 3-1: No valid video chain found. [ 2181.704903][T11206] usb 3-1: selecting invalid altsetting 0 [ 2181.749860][T11206] usb 3-1: selecting invalid altsetting 0 [ 2181.762243][T11206] usbtest 3-1:220.1: probe with driver usbtest failed with error -22 [ 2181.774999][ T4211] netlink: 'syz.5.8653': attribute type 2 has an invalid length. [ 2181.813258][ T4211] netlink: 'syz.5.8653': attribute type 13 has an invalid length. [ 2181.826642][T11206] usb 3-1: USB disconnect, device number 109 [ 2182.030361][ T4220] xt_TCPMSS: Only works on TCP SYN packets [ 2182.285406][ T2328] usb 1-1: new full-speed USB device number 127 using dummy_hcd [ 2182.407309][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805702dc00: rx timeout, send abort [ 2182.415858][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805702fc00: rx timeout, send abort [ 2182.458277][ T2328] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 2182.466565][ T2328] usb 1-1: config 0 has no interface number 0 [ 2182.472656][ T2328] usb 1-1: config 0 interface 41 has no altsetting 0 [ 2182.495555][T11222] usb 4-1: new low-speed USB device number 88 using dummy_hcd [ 2182.498239][ T2328] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 2182.515474][ T2328] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2182.529449][ T2328] usb 1-1: Product: syz [ 2182.533690][ T2328] usb 1-1: Manufacturer: syz [ 2182.542322][ T2328] usb 1-1: SerialNumber: syz [ 2182.570019][ T2328] usb 1-1: config 0 descriptor?? [ 2182.697290][T11222] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 2182.706252][T11222] usb 4-1: config 0 has no interface number 0 [ 2182.726450][T11222] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 2182.755531][T11222] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 2182.818432][T11222] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2182.854809][T11222] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2182.880335][ T4229] netlink: 20 bytes leftover after parsing attributes in process `syz.5.8661'. [ 2182.891076][T11222] usb 4-1: config 0 descriptor?? [ 2182.906229][ T4222] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 2182.915586][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805702dc00: abort rx timeout. Force session deactivation [ 2182.923967][T11222] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 2182.928090][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805702fc00: abort rx timeout. Force session deactivation [ 2182.989335][ T4220] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2183.020608][ T4220] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2183.047976][ T30] audit: type=1400 audit(1750692401.026:4229): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=2626200D3AC023AE1DAEE17A3A pid=4219 comm="syz.0.8657" [ 2183.057394][ T4220] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8657'. [ 2183.068933][ C0] vkms_vblank_simulate: vblank timer overrun [ 2183.136654][ T4220] openvswitch: : Dropping previously announced user features [ 2183.231083][ T2328] CoreChips 1-1:0.41 (unnamed net_device) (uninitialized): set LINK LED failed : -71 [ 2183.281489][ T2328] CoreChips 1-1:0.41: probe with driver CoreChips failed with error -71 [ 2183.605374][ T2328] usb 1-1: USB disconnect, device number 127 [ 2183.694302][ T4238] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8660'. [ 2184.336817][ C1] iowarrior 4-1:0.1: iowarrior_callback - usb_submit_urb failed with result -1 [ 2184.347428][T11222] usb 4-1: USB disconnect, device number 88 [ 2184.862531][ T4249] netlink: 44 bytes leftover after parsing attributes in process `syz.1.8667'. [ 2185.664460][ T4269] netlink: 'syz.3.8671': attribute type 2 has an invalid length. [ 2185.697093][ T4269] netlink: 'syz.3.8671': attribute type 13 has an invalid length. [ 2186.125574][ T2328] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 2186.263859][ T2328] usb 2-1: device descriptor read/64, error -71 [ 2186.575367][ T2328] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 2186.735328][ T2328] usb 2-1: device descriptor read/64, error -71 [ 2186.920697][ T2328] usb usb2-port1: attempt power cycle [ 2187.195349][T11206] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 2187.295363][ T2328] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 2187.315786][ T2328] usb 2-1: device descriptor read/8, error -71 [ 2187.361357][T11206] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 2187.392222][T11206] usb 4-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 2187.432158][T11206] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 2187.618481][T11206] usb 4-1: config 220 has no interface number 2 [ 2187.633906][T11206] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 2187.647455][ T2328] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 2187.655220][T11206] usb 4-1: config 220 interface 0 has no altsetting 0 [ 2187.665193][T11206] usb 4-1: config 220 interface 76 has no altsetting 0 [ 2187.672910][T11206] usb 4-1: config 220 interface 1 has no altsetting 0 [ 2187.683100][T11206] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 2187.696994][ T2328] usb 2-1: device descriptor read/8, error -71 [ 2187.748425][T11206] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2187.787913][T11206] usb 4-1: Product: syz [ 2187.813074][ T2328] usb usb2-port1: unable to enumerate USB device [ 2187.824761][T11206] usb 4-1: Manufacturer: syz [ 2187.837422][T11206] usb 4-1: SerialNumber: syz [ 2188.092313][ T4296] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8682'. [ 2188.264831][T11206] usb 4-1: selecting invalid altsetting 0 [ 2188.315043][T11206] usb 4-1: Found UVC 7.01 device syz (8086:0b07) [ 2188.367179][T11206] usb 4-1: No valid video chain found. [ 2188.398484][T11206] usb 4-1: selecting invalid altsetting 0 [ 2188.405432][T11206] usbtest 4-1:220.1: probe with driver usbtest failed with error -22 [ 2188.446992][T11206] usb 4-1: USB disconnect, device number 89 [ 2188.505462][T11222] usb 6-1: new high-speed USB device number 97 using dummy_hcd [ 2188.668400][T11222] usb 6-1: config 0 has an invalid interface number: 246 but max is 0 [ 2188.681486][ T4298] ptrace attach of "./syz-executor exec"[28031] was attempted by "./syz-executor exec"[4298] [ 2188.719163][T11222] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2188.734003][ T4298] xt_cgroup: invalid path, errno=-2 [ 2188.763311][T11222] usb 6-1: config 0 has no interface number 0 [ 2188.776065][T11222] usb 6-1: New USB device found, idVendor=28a7, idProduct=71ab, bcdDevice=df.39 [ 2188.785699][T11222] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2188.793794][T11222] usb 6-1: Product: syz [ 2188.798890][T11222] usb 6-1: Manufacturer: syz [ 2188.803619][T11222] usb 6-1: SerialNumber: syz [ 2188.831663][T11222] usb 6-1: config 0 descriptor?? [ 2188.843115][T11222] cdc_wdm 6-1:0.246: More than one union descriptor, skipping ... [ 2188.851542][T11222] cdc_wdm 6-1:0.246: probe with driver cdc_wdm failed with error -22 [ 2189.056973][T11222] usb 6-1: USB disconnect, device number 97 [ 2189.158112][ T4310] loop6: detected capacity change from 0 to 7 [ 2189.207121][ T4310] Dev loop6: unable to read RDB block 7 [ 2189.212819][ T4310] loop6: AHDI p1 p2 [ 2189.217297][ T4310] loop6: partition table partially beyond EOD, truncated [ 2189.226054][ T4310] loop6: p1 start 926365495 is beyond EOD, truncated [ 2189.438277][T11206] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 2189.549547][ T4318] netlink: 'syz.3.8687': attribute type 2 has an invalid length. [ 2189.567686][ T4318] netlink: 'syz.3.8687': attribute type 13 has an invalid length. [ 2189.782598][T11206] usb 1-1: config 0 has no interfaces? [ 2189.804678][T11206] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 2189.815713][T11206] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2189.857616][T11206] usb 1-1: Product: syz [ 2189.903780][T11206] usb 1-1: Manufacturer: syz [ 2189.933620][T11206] usb 1-1: SerialNumber: syz [ 2190.002322][T11206] usb 1-1: config 0 descriptor?? [ 2190.255325][T11222] usb 6-1: new high-speed USB device number 98 using dummy_hcd [ 2190.405416][T11222] usb 6-1: Using ep0 maxpacket: 16 [ 2190.420923][T11222] usb 6-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 2190.431105][T11222] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2190.460490][T11222] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2190.489651][T11222] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 2190.504713][ T4323] input: syz0 as /devices/virtual/input/input125 [ 2190.515649][T11222] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2190.540097][T11222] usb 6-1: Product: syz [ 2190.560825][T11222] usb 6-1: Manufacturer: syz [ 2190.584151][T11222] usb 6-1: SerialNumber: syz [ 2191.029611][T11222] usb 6-1: 0:2 : does not exist [ 2191.073515][ T4332] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8693'. [ 2191.155607][T21089] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 2191.317414][T21089] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x92, changing to 0x82 [ 2191.329471][T21089] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2191.340167][T21089] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 2191.350850][T21089] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2191.371784][T21089] usb 4-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=9e.7f [ 2191.381506][T21089] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2191.397227][T21089] usb 4-1: Product: syz [ 2191.401601][T21089] usb 4-1: Manufacturer: syz [ 2191.407806][T21089] usb 4-1: SerialNumber: syz [ 2191.427462][T21089] usb 4-1: config 0 descriptor?? [ 2191.444716][T21089] redrat3 4-1:0.0: Couldn't find all endpoints [ 2191.551466][ T4338] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8695'. [ 2191.639934][ T4320] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2191.650399][ T4320] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2191.669364][ T4326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2191.688789][ T4326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2191.715038][ T4326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2191.739778][ T4326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2191.768045][ T4326] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8690'. [ 2191.896002][ T4344] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2191.903299][T11222] usb 6-1: 1:0: failed to get current value for ch 0 (-22) [ 2191.912896][ T4344] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2191.963216][T11222] usb 6-1: USB disconnect, device number 98 [ 2192.070926][T11206] usb 4-1: USB disconnect, device number 90 [ 2192.076332][T21089] usb 1-1: USB disconnect, device number 2 [ 2192.143810][ T4348] Set syz0 is full, maxelem 0 reached [ 2193.394077][ T4377] (unnamed net_device) (uninitialized): up delay (16) is not a multiple of miimon (6516), value rounded to 0 ms [ 2193.410135][ T4378] ptrace attach of "./syz-executor exec"[28031] was attempted by "./syz-executor exec"[4378] [ 2193.985335][T11222] usb 6-1: new high-speed USB device number 99 using dummy_hcd [ 2194.195595][T11222] usb 6-1: Using ep0 maxpacket: 8 [ 2194.236081][T11222] usb 6-1: unable to get BOS descriptor or descriptor too short [ 2194.243774][T11222] usb 6-1: too many configurations: 17, using maximum allowed: 8 [ 2194.335706][T11222] usb 6-1: config 1 has an invalid descriptor of length 78, skipping remainder of the config [ 2194.348248][T11222] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 2194.384704][T11222] usb 6-1: config 1 has an invalid descriptor of length 78, skipping remainder of the config [ 2194.414177][T11222] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 2194.477670][T11222] usb 6-1: config 1 has an invalid descriptor of length 78, skipping remainder of the config [ 2194.555593][T11222] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 2194.580021][T11222] usb 6-1: config 1 has an invalid descriptor of length 78, skipping remainder of the config [ 2194.616986][T11222] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 2194.657001][T11222] usb 6-1: config 1 has an invalid descriptor of length 78, skipping remainder of the config [ 2194.667634][T11222] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 2194.678151][T11222] usb 6-1: config 1 has an invalid descriptor of length 78, skipping remainder of the config [ 2194.690691][T11222] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 2194.709954][T11222] usb 6-1: config 1 has an invalid descriptor of length 78, skipping remainder of the config [ 2194.720433][T11222] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 2194.731123][T11222] usb 6-1: config 1 has an invalid descriptor of length 78, skipping remainder of the config [ 2194.742147][T11222] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 2194.753620][T11222] usb 6-1: New USB device found, idVendor=05ac, idProduct=0237, bcdDevice= 0.40 [ 2194.763080][T11222] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2194.772016][T11222] usb 6-1: Product: syz [ 2194.796420][T11222] usb 6-1: Manufacturer: syz [ 2194.802437][T11222] usb 6-1: SerialNumber: syz [ 2194.806009][T11206] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 2195.090081][T11222] usb 6-1: USB disconnect, device number 99 [ 2195.135741][T11206] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x92, changing to 0x82 [ 2195.215222][T11206] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2195.232129][T11206] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 2195.251683][T11206] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2195.443909][T11206] usb 4-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=9e.7f [ 2195.468802][T11206] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2195.497476][T11206] usb 4-1: Product: syz [ 2195.522751][T11206] usb 4-1: Manufacturer: syz [ 2195.533159][T11206] usb 4-1: SerialNumber: syz [ 2195.543765][T11206] usb 4-1: config 0 descriptor?? [ 2195.591845][T11206] redrat3 4-1:0.0: Couldn't find all endpoints [ 2195.865356][ T4393] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2195.870584][ T4412] netlink: 68 bytes leftover after parsing attributes in process `syz.0.8716'. [ 2195.886399][ T4393] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2195.899593][ T4393] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2195.909757][ T4393] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2195.985874][ T4393] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8712'. [ 2196.086222][ T4418] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2196.096016][ T4418] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2196.195282][T11206] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 2196.202222][T11222] usb 4-1: USB disconnect, device number 91 [ 2196.388290][T11206] usb 1-1: New USB device found, idVendor=0471, idProduct=0329, bcdDevice=db.da [ 2196.408087][T11206] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2196.446370][T11206] usb 1-1: config 0 descriptor?? [ 2196.457413][T11206] pwc: Philips SPC 900NC USB webcam detected. [ 2196.663959][T11206] pwc: Failed to set LED on/off time (-71) [ 2196.686272][T11206] pwc: send_video_command error -71 [ 2196.692423][ T4430] netlink: 'syz.5.8723': attribute type 1 has an invalid length. [ 2196.711927][T11206] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 2196.754724][T11206] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71 [ 2196.792652][T11206] usb 1-1: USB disconnect, device number 3 [ 2196.806245][ T4430] 8021q: adding VLAN 0 to HW filter on device bond1 [ 2196.851496][ T4432] bond1: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 2196.989494][ T4436] xt_TCPMSS: Only works on TCP SYN packets [ 2197.271582][T11222] usb 4-1: new full-speed USB device number 92 using dummy_hcd [ 2197.457449][T11222] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 2197.465928][T11222] usb 4-1: config 0 has no interface number 0 [ 2197.472068][T11222] usb 4-1: config 0 interface 41 has no altsetting 0 [ 2197.481448][T11222] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 2197.491544][T11222] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2197.501685][T11222] usb 4-1: Product: syz [ 2197.505909][T11222] usb 4-1: Manufacturer: syz [ 2197.510524][T11222] usb 4-1: SerialNumber: syz [ 2197.518487][T11222] usb 4-1: config 0 descriptor?? [ 2197.932031][ T4436] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2197.946281][ T4436] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2197.976166][ T4436] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8725'. [ 2197.980577][ T30] audit: type=1400 audit(1750692415.946:4230): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=2626200D3AC023AE1DAEE17A3A pid=4435 comm="syz.3.8725" [ 2197.996229][ T4436] openvswitch: : Dropping previously announced user features [ 2198.073294][T11222] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): set LINK LED failed : -71 [ 2198.094324][T11222] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -71 [ 2198.147736][T11222] usb 4-1: USB disconnect, device number 92 [ 2198.912020][T11206] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 2199.107207][T11206] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x92, changing to 0x82 [ 2199.107230][T11206] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2199.107244][T11206] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 2199.107259][T11206] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2199.109941][T11206] usb 2-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=9e.7f [ 2199.109962][T11206] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2199.109978][T11206] usb 2-1: Product: syz [ 2199.109990][T11206] usb 2-1: Manufacturer: syz [ 2199.110001][T11206] usb 2-1: SerialNumber: syz [ 2199.133752][T11206] usb 2-1: config 0 descriptor?? [ 2199.154143][T11206] redrat3 2-1:0.0: Couldn't find all endpoints [ 2199.276106][ T4467] ptrace attach of "./syz-executor exec"[28031] was attempted by "./syz-executor exec"[4467] [ 2199.277208][ T4467] xt_cgroup: invalid path, errno=-2 [ 2199.288751][T11222] usb 6-1: new full-speed USB device number 100 using dummy_hcd [ 2199.338698][ T4460] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2199.338966][ T4460] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2199.341885][ T4460] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2199.342120][ T4460] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2199.342485][ T4460] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8734'. [ 2199.459199][T11222] usb 6-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 2199.459235][T11222] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2199.459258][T11222] usb 6-1: Product: syz [ 2199.459275][T11222] usb 6-1: Manufacturer: syz [ 2199.459292][T11222] usb 6-1: SerialNumber: syz [ 2199.461832][T11222] usb 6-1: config 0 descriptor?? [ 2199.576542][ T4468] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2199.576866][ T4468] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2199.672609][T21089] usb 2-1: USB disconnect, device number 34 [ 2199.876802][T11222] airspy 6-1:0.0: Board ID: 00 [ 2199.881633][T11222] airspy 6-1:0.0: Firmware version: [ 2200.318462][T21089] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 2200.505545][T21089] usb 4-1: Using ep0 maxpacket: 32 [ 2200.518540][ T4482] FAULT_INJECTION: forcing a failure. [ 2200.518540][ T4482] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2200.522970][T21089] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2200.547134][ T4482] CPU: 0 UID: 0 PID: 4482 Comm: syz.2.8742 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 2200.547171][ T4482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 2200.547184][ T4482] Call Trace: [ 2200.547192][ T4482] [ 2200.547201][ T4482] dump_stack_lvl+0x189/0x250 [ 2200.547234][ T4482] ? __pfx____ratelimit+0x10/0x10 [ 2200.547260][ T4482] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2200.547288][ T4482] ? __pfx__printk+0x10/0x10 [ 2200.547318][ T4482] should_fail_ex+0x414/0x560 [ 2200.547354][ T4482] _copy_to_user+0x31/0xb0 [ 2200.547373][ T4482] simple_read_from_buffer+0xe1/0x170 [ 2200.547396][ T4482] proc_fail_nth_read+0x1df/0x250 [ 2200.547423][ T4482] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2200.547449][ T4482] ? rw_verify_area+0x258/0x650 [ 2200.547475][ T4482] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2200.547497][ T4482] vfs_read+0x1fd/0x980 [ 2200.547527][ T4482] ? __pfx___mutex_lock+0x10/0x10 [ 2200.547554][ T4482] ? __pfx_vfs_read+0x10/0x10 [ 2200.547583][ T4482] ? __fget_files+0x2a/0x420 [ 2200.547607][ T4482] ? __fget_files+0x3a0/0x420 [ 2200.547625][ T4482] ? __fget_files+0x2a/0x420 [ 2200.547650][ T4482] ksys_read+0x145/0x250 [ 2200.547679][ T4482] ? __pfx_ksys_read+0x10/0x10 [ 2200.547704][ T4482] ? rcu_is_watching+0x15/0xb0 [ 2200.547747][ T4482] ? do_syscall_64+0xbe/0x3b0 [ 2200.547765][ T4482] do_syscall_64+0xfa/0x3b0 [ 2200.547780][ T4482] ? lockdep_hardirqs_on+0x9c/0x150 [ 2200.547802][ T4482] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2200.547819][ T4482] ? clear_bhb_loop+0x60/0xb0 [ 2200.547839][ T4482] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2200.547857][ T4482] RIP: 0033:0x7f0a4bf8d33c [ 2200.547873][ T4482] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 2200.547887][ T4482] RSP: 002b:00007f0a4ce2d030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2200.547905][ T4482] RAX: ffffffffffffffda RBX: 00007f0a4c1b5fa0 RCX: 00007f0a4bf8d33c [ 2200.547918][ T4482] RDX: 000000000000000f RSI: 00007f0a4ce2d0a0 RDI: 0000000000000004 [ 2200.547929][ T4482] RBP: 00007f0a4ce2d090 R08: 0000000000000000 R09: 0000000000000000 [ 2200.547940][ T4482] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 2200.547950][ T4482] R13: 0000000000000000 R14: 00007f0a4c1b5fa0 R15: 00007f0a4c2dfa28 [ 2200.547976][ T4482] [ 2200.785062][ C0] vkms_vblank_simulate: vblank timer overrun [ 2200.794774][T21089] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2200.802468][T11206] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 2200.818377][T21089] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 2200.839520][T21089] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2200.859317][T21089] usb 4-1: config 0 descriptor?? [ 2200.946255][T11206] usb 1-1: device descriptor read/64, error -71 [ 2201.025511][T11222] airspy 6-1:0.0: Registered as swradio24 [ 2201.040554][T11222] airspy 6-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 2201.073047][T11222] usb 6-1: USB disconnect, device number 100 [ 2201.189437][T11206] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 2201.313721][T21089] usbhid 4-1:0.0: can't add hid device: -71 [ 2201.319857][T21089] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 2201.325450][T11206] usb 1-1: device descriptor read/64, error -71 [ 2201.357835][T21089] usb 4-1: USB disconnect, device number 93 [ 2201.470416][T11206] usb usb1-port1: attempt power cycle [ 2201.477854][ T4504] netlink: 'syz.5.8747': attribute type 2 has an invalid length. [ 2201.500191][ T4504] netlink: 'syz.5.8747': attribute type 13 has an invalid length. [ 2201.524352][ T4502] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2201.825462][T11206] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 2201.882140][T11206] usb 1-1: device descriptor read/8, error -71 [ 2202.195455][T11206] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 2202.228347][T11206] usb 1-1: device descriptor read/8, error -71 [ 2202.335790][T11206] usb usb1-port1: unable to enumerate USB device [ 2202.858143][ T4535] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8756'. [ 2203.015012][T21089] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 2203.175652][T11222] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 2203.195262][T21089] usb 3-1: Using ep0 maxpacket: 8 [ 2203.282338][T21089] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 2203.310283][T21089] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2203.341722][T21089] usb 3-1: Product: syz [ 2203.371541][T11222] usb 6-1: config 0 has no interfaces? [ 2203.381862][T21089] usb 3-1: Manufacturer: syz [ 2203.392005][T11222] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 2203.404595][T11222] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2203.430034][T21089] usb 3-1: SerialNumber: syz [ 2203.438708][T11222] usb 6-1: Product: syz [ 2203.447517][T11222] usb 6-1: Manufacturer: syz [ 2203.453223][T21089] usb 3-1: config 0 descriptor?? [ 2203.468692][T11222] usb 6-1: SerialNumber: syz [ 2203.493278][T11222] usb 6-1: config 0 descriptor?? [ 2203.593118][ T4547] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8758'. [ 2203.743212][T21089] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 2203.941849][ T4552] netlink: 'syz.0.8760': attribute type 2 has an invalid length. [ 2204.295787][ T4552] netlink: 'syz.0.8760': attribute type 13 has an invalid length. [ 2204.335651][T11222] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 2204.478938][T11222] usb 4-1: device descriptor read/64, error -71 [ 2204.643575][T21089] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 2204.825309][T11222] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 2204.965490][T11222] usb 4-1: device descriptor read/64, error -71 [ 2205.075908][T11222] usb usb4-port1: attempt power cycle [ 2205.175487][ T4568] pim6reg: entered allmulticast mode [ 2205.405450][T11206] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 2205.425833][T11222] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 2205.446029][T11222] usb 4-1: device descriptor read/8, error -71 [ 2205.557223][T11206] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2205.571365][T11206] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2205.580992][T11206] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2205.598713][T11206] usb 2-1: config 0 descriptor?? [ 2205.610427][T11206] pwc: Askey VC010 type 2 USB webcam detected. [ 2205.686084][T11222] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 2205.710371][T11222] usb 4-1: device descriptor read/8, error -71 [ 2205.828034][T11222] usb usb4-port1: unable to enumerate USB device [ 2205.838494][T11206] pwc: recv_control_msg error -71 req 02 val 2b00 [ 2205.863150][T11206] pwc: recv_control_msg error -71 req 02 val 2700 [ 2205.871257][T11206] pwc: recv_control_msg error -71 req 02 val 2c00 [ 2205.878582][T11206] pwc: recv_control_msg error -71 req 04 val 1000 [ 2205.885741][T11206] pwc: recv_control_msg error -71 req 04 val 1300 [ 2205.892609][T11206] pwc: recv_control_msg error -71 req 04 val 1400 [ 2205.908140][T11206] pwc: recv_control_msg error -71 req 02 val 2000 [ 2205.914787][ T4575] netlink: 'syz.1.8767': attribute type 32 has an invalid length. [ 2205.955905][T11206] pwc: recv_control_msg error -71 req 02 val 2100 [ 2205.962800][T11206] pwc: recv_control_msg error -71 req 04 val 1500 [ 2205.970313][T11206] pwc: recv_control_msg error -71 req 02 val 2500 [ 2205.980428][T11206] pwc: recv_control_msg error -71 req 02 val 2400 [ 2206.000035][T11206] pwc: recv_control_msg error -71 req 02 val 2600 [ 2206.010495][T11206] pwc: recv_control_msg error -71 req 02 val 2900 [ 2206.022293][T11222] usb 6-1: USB disconnect, device number 101 [ 2206.029038][T11206] pwc: recv_control_msg error -71 req 02 val 2800 [ 2206.058471][T11206] pwc: recv_control_msg error -71 req 04 val 1100 [ 2206.088436][T11206] pwc: recv_control_msg error -71 req 04 val 1200 [ 2206.111981][T11206] pwc: Registered as video103. [ 2206.176232][T11206] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input127 [ 2206.234469][T11206] usb 2-1: USB disconnect, device number 35 [ 2206.436604][ T4592] netlink: 'syz.2.8752': attribute type 32 has an invalid length. [ 2206.870118][ T4607] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 2207.011447][ T4610] xt_TCPMSS: Only works on TCP SYN packets [ 2207.020698][ T4610] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8778'. [ 2207.122468][ T4595] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8774'. [ 2207.295382][T11222] usb 6-1: new full-speed USB device number 102 using dummy_hcd [ 2207.337176][ T4613] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8779'. [ 2207.466565][T11222] usb 6-1: config 0 has an invalid interface number: 41 but max is 0 [ 2207.474853][T11222] usb 6-1: config 0 has no interface number 0 [ 2207.574329][T11222] usb 6-1: config 0 interface 41 has no altsetting 0 [ 2207.666178][T21075] usb 3-1: USB disconnect, device number 110 [ 2207.696159][T11222] usb 6-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 2207.709634][T11222] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2207.735286][T11222] usb 6-1: Product: syz [ 2207.749338][T11222] usb 6-1: Manufacturer: syz [ 2207.753956][T11222] usb 6-1: SerialNumber: syz [ 2207.799421][T11222] usb 6-1: config 0 descriptor?? [ 2207.810831][ T4621] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8781'. [ 2207.810856][ T4621] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8781'. [ 2207.810889][ T4621] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8781'. [ 2207.985343][ T4626] netlink: 68 bytes leftover after parsing attributes in process `syz.0.8785'. [ 2208.213017][ T4610] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2208.222267][ T4610] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2208.234641][ T4610] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8778'. [ 2208.253927][T11206] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 2208.254645][ T4610] openvswitch: : Dropping previously announced user features [ 2208.261579][ T30] audit: type=1400 audit(1750692426.206:4231): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=2626200D3AC023AE1DAEE17A3A pid=4608 comm="syz.5.8778" [ 2208.431096][T11206] usb 1-1: New USB device found, idVendor=0471, idProduct=0329, bcdDevice=db.da [ 2208.441925][T11206] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2208.479041][T11206] usb 1-1: config 0 descriptor?? [ 2208.504192][T11206] pwc: Philips SPC 900NC USB webcam detected. [ 2208.535070][T11222] CoreChips 6-1:0.41 (unnamed net_device) (uninitialized): set LINK LED failed : -71 [ 2208.601324][T11222] CoreChips 6-1:0.41: probe with driver CoreChips failed with error -71 [ 2208.637027][T11222] usb 6-1: USB disconnect, device number 102 [ 2208.699808][T11206] pwc: Failed to set LED on/off time (-71) [ 2208.721172][T11206] pwc: send_video_command error -71 [ 2208.739350][T11206] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 2208.762278][T11206] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71 [ 2208.795304][ T2328] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 2208.821408][T11206] usb 1-1: USB disconnect, device number 8 [ 2208.869556][ T4638] xt_hashlimit: max too large, truncated to 1048576 [ 2208.958120][ T2328] usb 4-1: config 0 interface 0 altsetting 12 endpoint 0x87 has an invalid bInterval 102, changing to 10 [ 2208.979076][ T2328] usb 4-1: config 0 interface 0 altsetting 12 endpoint 0x87 has invalid maxpacket 24624, setting to 1024 [ 2209.004523][ T2328] usb 4-1: config 0 interface 0 has no altsetting 0 [ 2209.021883][ T2328] usb 4-1: New USB device found, idVendor=06cd, idProduct=0115, bcdDevice=d9.c3 [ 2209.041718][ T2328] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2209.053900][ T2328] usb 4-1: Product: syz [ 2209.062454][ T2328] usb 4-1: Manufacturer: syz [ 2209.069878][ T2328] usb 4-1: SerialNumber: syz [ 2209.083139][ T2328] usb 4-1: config 0 descriptor?? [ 2209.113510][ T2328] keyspan 4-1:0.0: Keyspan 2 port adapter converter detected [ 2209.133861][ T2328] keyspan 4-1:0.0: found no endpoint descriptor for endpoint 7 [ 2209.162225][ T2328] keyspan 4-1:0.0: found no endpoint descriptor for endpoint 81 [ 2209.189822][ T2328] keyspan 4-1:0.0: found no endpoint descriptor for endpoint 1 [ 2209.217681][ T2328] keyspan 4-1:0.0: found no endpoint descriptor for endpoint 2 [ 2209.262819][ T2328] keyspan 4-1:0.0: found no endpoint descriptor for endpoint 85 [ 2209.299822][ T2328] keyspan 4-1:0.0: found no endpoint descriptor for endpoint 5 [ 2209.357868][ T2328] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 2209.367827][ T2328] keyspan 4-1:0.0: found no endpoint descriptor for endpoint 83 [ 2209.391611][ T2328] keyspan 4-1:0.0: found no endpoint descriptor for endpoint 3 [ 2209.408319][ T2328] keyspan 4-1:0.0: found no endpoint descriptor for endpoint 4 [ 2209.424924][ T2328] keyspan 4-1:0.0: found no endpoint descriptor for endpoint 86 [ 2209.448795][ T2328] keyspan 4-1:0.0: found no endpoint descriptor for endpoint 6 [ 2209.464573][ T2328] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 2209.488432][ T2328] usb 4-1: USB disconnect, device number 98 [ 2209.523388][ T2328] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 2209.546635][ T2328] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 2209.557656][ T2328] keyspan 4-1:0.0: device disconnected [ 2209.568032][T11222] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 2209.769192][T11222] usb 3-1: Using ep0 maxpacket: 8 [ 2209.806170][T21075] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 2209.967264][T11222] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 2209.983002][T11222] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2210.291062][T21075] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2210.475782][T21075] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2210.509388][T11222] usb 3-1: Product: syz [ 2210.525718][T11222] usb 3-1: Manufacturer: syz [ 2210.530358][T11222] usb 3-1: SerialNumber: syz [ 2210.545955][T21075] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 2210.555008][T21075] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 2210.684859][T21075] usb 2-1: SerialNumber: syz [ 2210.690618][T11222] usb 3-1: config 0 descriptor?? [ 2210.933833][T21075] usb 2-1: 0:2 : does not exist [ 2210.939678][T11222] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 2210.988908][T21075] usb 2-1: USB disconnect, device number 36 [ 2211.183203][ T3436] udevd[3436]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2211.225268][T21089] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 2211.406465][T21089] usb 6-1: config 32 has an invalid interface number: 152 but max is 2 [ 2211.414975][T21089] usb 6-1: config 32 has an invalid interface number: 244 but max is 2 [ 2211.432389][T21089] usb 6-1: config 32 contains an unexpected descriptor of type 0x1, skipping [ 2211.450927][T21089] usb 6-1: config 32 has an invalid interface number: 3 but max is 2 [ 2211.459497][T11224] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 2211.503985][T21089] usb 6-1: config 32 contains an unexpected descriptor of type 0x1, skipping [ 2211.513551][T21089] usb 6-1: config 32 contains an unexpected descriptor of type 0x2, skipping [ 2211.522522][T21089] usb 6-1: config 32 has no interface number 0 [ 2211.529315][T21089] usb 6-1: config 32 has no interface number 1 [ 2211.572740][T21089] usb 6-1: config 32 has no interface number 2 [ 2211.587000][T21089] usb 6-1: config 32 interface 152 altsetting 3 endpoint 0xD has invalid maxpacket 58774, setting to 1024 [ 2211.602338][T11222] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 2211.652722][T11224] usb 4-1: config index 0 descriptor too short (expected 43690, got 77) [ 2211.663974][T11224] usb 4-1: config 170 has too many interfaces: 170, using maximum allowed: 32 [ 2211.673142][T21089] usb 6-1: config 32 interface 152 altsetting 3 has a duplicate endpoint with address 0xA, skipping [ 2211.695004][T11224] usb 4-1: config 170 has an invalid descriptor of length 0, skipping remainder of the config [ 2211.705449][T21089] usb 6-1: config 32 interface 152 altsetting 3 has a duplicate endpoint with address 0xA, skipping [ 2211.721080][T11224] usb 4-1: config 170 has 0 interfaces, different from the descriptor's value: 170 [ 2211.735218][T21089] usb 6-1: config 32 interface 152 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 2211.769759][T21089] usb 6-1: config 32 interface 152 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 2211.865909][T21089] usb 6-1: config 32 interface 244 altsetting 8 has a duplicate endpoint with address 0xD, skipping [ 2211.895589][T21089] usb 6-1: config 32 interface 244 altsetting 8 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 2211.918949][T11224] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 2211.950463][T21089] usb 6-1: config 32 interface 244 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 2211.962924][T11224] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2212.114139][T11224] usb 4-1: Product: syz [ 2212.118485][T21089] usb 6-1: config 32 interface 244 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 2212.129587][T11224] usb 4-1: Manufacturer: syz [ 2212.134220][T11224] usb 4-1: SerialNumber: syz [ 2212.141224][T21089] usb 6-1: config 32 interface 244 altsetting 8 has a duplicate endpoint with address 0xD, skipping [ 2212.162732][T21089] usb 6-1: config 32 interface 244 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 2212.174810][T21089] usb 6-1: config 32 interface 3 altsetting 1 has a duplicate endpoint with address 0x6, skipping [ 2212.193867][T21089] usb 6-1: config 32 interface 3 altsetting 1 endpoint 0x4 has invalid maxpacket 1024, setting to 64 [ 2212.226839][T21089] usb 6-1: config 32 interface 3 altsetting 1 bulk endpoint 0xC has invalid maxpacket 487 [ 2212.237423][T21089] usb 6-1: config 32 interface 3 altsetting 1 has a duplicate endpoint with address 0x8, skipping [ 2212.258303][T21089] usb 6-1: config 32 interface 3 altsetting 1 has a duplicate endpoint with address 0xA, skipping [ 2212.270402][T21089] usb 6-1: config 32 interface 3 altsetting 1 has an endpoint descriptor with address 0xE5, changing to 0x85 [ 2212.287419][T21089] usb 6-1: config 32 interface 3 altsetting 1 has a duplicate endpoint with address 0x85, skipping [ 2212.301571][T21089] usb 6-1: config 32 interface 3 altsetting 1 has a duplicate endpoint with address 0x2, skipping [ 2212.365052][T21089] usb 6-1: config 32 interface 3 altsetting 1 endpoint 0xE has invalid maxpacket 512, setting to 64 [ 2212.438316][T21089] usb 6-1: config 32 interface 3 altsetting 1 has a duplicate endpoint with address 0xD, skipping [ 2212.464076][T21089] usb 6-1: config 32 interface 3 altsetting 1 has a duplicate endpoint with address 0x8, skipping [ 2212.655813][T21089] usb 6-1: config 32 interface 3 altsetting 1 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 2212.658390][T11206] usb 3-1: USB disconnect, device number 111 [ 2212.672847][T21089] usb 6-1: config 32 interface 3 altsetting 1 has a duplicate endpoint with address 0xE, skipping [ 2212.703025][T21089] usb 6-1: config 32 interface 152 has no altsetting 0 [ 2212.772887][ T4690] mac80211_hwsim hwsim67 wlan0: entered allmulticast mode [ 2212.774550][T21089] usb 6-1: config 32 interface 244 has no altsetting 0 [ 2212.780554][ T4690] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 2212.788244][ T4686] xt_TCPMSS: Only works on TCP SYN packets [ 2212.824343][T21089] usb 6-1: config 32 interface 3 has no altsetting 0 [ 2212.854455][T21089] usb 6-1: New USB device found, idVendor=0c45, idProduct=6130, bcdDevice=fb.76 [ 2212.892110][T21089] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2212.903780][T21089] usb 6-1: Product: syz [ 2212.908425][T21089] usb 6-1: Manufacturer: syz [ 2212.962873][T21089] usb 6-1: SerialNumber: syz [ 2212.992001][ T4671] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 2213.066137][ T4699] netlink: 56 bytes leftover after parsing attributes in process `syz.0.8809'. [ 2213.205350][ T4699] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8809'. [ 2213.405952][T21089] usb 6-1: USB disconnect, device number 103 [ 2213.948955][ T4713] netlink: 'syz.1.8812': attribute type 2 has an invalid length. [ 2213.966830][ T4713] netlink: 'syz.1.8812': attribute type 13 has an invalid length. [ 2214.691571][T11206] usb 4-1: USB disconnect, device number 99 [ 2215.315724][T11206] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 2215.485657][T11206] usb 4-1: Using ep0 maxpacket: 8 [ 2215.504240][T11206] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 2215.533472][T11206] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2215.565368][T11206] usb 4-1: Product: syz [ 2215.579854][T11206] usb 4-1: Manufacturer: syz [ 2215.636303][T11206] usb 4-1: SerialNumber: syz [ 2215.650422][T11206] usb 4-1: config 0 descriptor?? [ 2215.866778][T11206] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 2216.484727][T11206] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 2216.893775][ T4761] netlink: 'syz.0.8827': attribute type 2 has an invalid length. [ 2216.912731][ T4761] netlink: 'syz.0.8827': attribute type 13 has an invalid length. [ 2217.175019][ T4767] netlink: 20 bytes leftover after parsing attributes in process `syz.5.8830'. [ 2218.136647][ T4789] FAULT_INJECTION: forcing a failure. [ 2218.136647][ T4789] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2218.205572][ T4789] CPU: 0 UID: 0 PID: 4789 Comm: syz.1.8836 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 2218.205599][ T4789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 2218.205611][ T4789] Call Trace: [ 2218.205620][ T4789] [ 2218.205629][ T4789] dump_stack_lvl+0x189/0x250 [ 2218.205660][ T4789] ? __pfx____ratelimit+0x10/0x10 [ 2218.205687][ T4789] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2218.205714][ T4789] ? __pfx__printk+0x10/0x10 [ 2218.205737][ T4789] ? __might_fault+0xb0/0x130 [ 2218.205765][ T4789] should_fail_ex+0x414/0x560 [ 2218.205791][ T4789] _copy_from_user+0x2d/0xb0 [ 2218.205810][ T4789] ___sys_sendmsg+0x158/0x2a0 [ 2218.205835][ T4789] ? __pfx____sys_sendmsg+0x10/0x10 [ 2218.205884][ T4789] ? __fget_files+0x2a/0x420 [ 2218.205903][ T4789] ? __fget_files+0x3a0/0x420 [ 2218.205931][ T4789] __sys_sendmmsg+0x227/0x430 [ 2218.205959][ T4789] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2218.205978][ T4789] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 2218.206036][ T4789] ? ksys_write+0x22a/0x250 [ 2218.206054][ T4789] ? __pfx_ksys_write+0x10/0x10 [ 2218.206068][ T4789] ? rcu_is_watching+0x15/0xb0 [ 2218.206102][ T4789] __x64_sys_sendmmsg+0xa0/0xc0 [ 2218.206126][ T4789] do_syscall_64+0xfa/0x3b0 [ 2218.206141][ T4789] ? lockdep_hardirqs_on+0x9c/0x150 [ 2218.206166][ T4789] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2218.206184][ T4789] ? clear_bhb_loop+0x60/0xb0 [ 2218.206205][ T4789] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2218.206223][ T4789] RIP: 0033:0x7fa17e98e929 [ 2218.206239][ T4789] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2218.206255][ T4789] RSP: 002b:00007fa17f717038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2218.206274][ T4789] RAX: ffffffffffffffda RBX: 00007fa17ebb5fa0 RCX: 00007fa17e98e929 [ 2218.206287][ T4789] RDX: 00000000000003ef RSI: 0000200000000180 RDI: 0000000000000003 [ 2218.206298][ T4789] RBP: 00007fa17f717090 R08: 0000000000000000 R09: 0000000000000000 [ 2218.206316][ T4789] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2218.206327][ T4789] R13: 0000000000000000 R14: 00007fa17ebb5fa0 R15: 00007fa17ecdfa28 [ 2218.206354][ T4789] [ 2218.457860][ T4791] netlink: 'syz.3.8815': attribute type 32 has an invalid length. [ 2218.473929][ T4790] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 2218.695947][ T4798] netlink: 36 bytes leftover after parsing attributes in process `syz.5.8841'. [ 2218.925527][T21089] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 2219.075448][T21089] usb 2-1: device descriptor read/64, error -71 [ 2219.156790][T11224] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 2219.317768][ T4821] netlink: 'syz.5.8849': attribute type 2 has an invalid length. [ 2219.337831][ T4821] netlink: 'syz.5.8849': attribute type 13 has an invalid length. [ 2219.367040][T21089] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 2219.448852][T11224] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 2219.502568][T11224] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2219.539382][T11224] usb 1-1: config 0 descriptor?? [ 2219.558710][T21089] usb 2-1: device descriptor read/64, error -71 [ 2219.686032][T21089] usb usb2-port1: attempt power cycle [ 2219.729172][T11206] usb 4-1: USB disconnect, device number 100 [ 2219.769275][ T4809] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2219.806378][ T4809] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2219.847875][ T4824] (unnamed net_device) (uninitialized): up delay (16) is not a multiple of miimon (6516), value rounded to 0 ms [ 2219.935794][ T4826] ptrace attach of "./syz-executor exec"[28031] was attempted by "./syz-executor exec"[4826] [ 2220.034515][T11224] usb 1-1: Cannot read MAC address [ 2220.054872][T11224] MOSCHIP usb-ethernet driver 1-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -32 [ 2220.075290][T21089] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 2220.166839][T11224] usb 1-1: USB disconnect, device number 9 [ 2220.186029][T21089] usb 2-1: device descriptor read/8, error -71 [ 2220.425543][T21089] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 2220.446971][ T4831] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.8851'. [ 2220.481374][T21089] usb 2-1: device descriptor read/8, error -71 [ 2220.617992][T21089] usb usb2-port1: unable to enumerate USB device [ 2221.225536][T21089] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 2221.609480][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 2221.616034][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 2221.763663][T21089] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2221.803332][T21089] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2221.834124][T21089] usb 3-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 2221.868907][T21089] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2221.895480][T21089] usb 3-1: config 0 descriptor?? [ 2222.165314][T11206] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 2222.315553][T11206] usb 2-1: Using ep0 maxpacket: 16 [ 2222.316201][T21089] elan 0003:04F3:0755.0088: bogus close delimiter [ 2222.332577][T21089] elan 0003:04F3:0755.0088: item 0 1 2 10 parsing failed [ 2222.343067][T11206] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 2222.356691][T21089] elan 0003:04F3:0755.0088: Hid Parse failed [ 2222.362883][T21089] elan 0003:04F3:0755.0088: probe with driver elan failed with error -22 [ 2222.381191][T11206] usb 2-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 2222.392430][T11206] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2222.411614][T11206] usb 2-1: config 0 descriptor?? [ 2222.431420][T11206] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input128 [ 2222.538771][T11224] usb 3-1: USB disconnect, device number 112 [ 2222.870193][ T4884] sch_tbf: burst 19872 is lower than device lo mtu (39799) ! [ 2223.057522][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805789fc00: rx timeout, send abort [ 2223.066125][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805789cc00: rx timeout, send abort [ 2223.575257][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805789fc00: abort rx timeout. Force session deactivation [ 2223.587405][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805789cc00: abort rx timeout. Force session deactivation [ 2224.259302][ T4892] netlink: 'syz.5.8871': attribute type 10 has an invalid length. [ 2224.358834][ T4892] netlink: 32 bytes leftover after parsing attributes in process `syz.5.8871'. [ 2224.667420][ T4906] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2224.733729][ T4906] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2225.039725][ T4908] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2225.227812][ T5185] bcm5974 2-1:0.0: could not read from device [ 2225.228725][T21089] usb 2-1: USB disconnect, device number 41 [ 2225.273419][ T3436] bcm5974 2-1:0.0: could not read from device [ 2225.483279][ T5185] bcm5974 2-1:0.0: could not read from device [ 2225.554271][ T4913] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 2226.083493][ T4932] ptrace attach of "./syz-executor exec"[28031] was attempted by "./syz-executor exec"[4932] [ 2226.445250][T11206] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 2226.672957][T11206] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x92, changing to 0x82 [ 2226.706741][ T4943] loop6: detected capacity change from 0 to 7 [ 2226.723373][ T4943] Dev loop6: unable to read RDB block 7 [ 2226.730764][ T4943] loop6: AHDI p1 p2 [ 2226.755042][ T4943] loop6: partition table partially beyond EOD, truncated [ 2226.780430][T11206] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2226.803849][ T4943] loop6: p1 start 926365495 is beyond EOD, truncated [ 2226.820066][T11206] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 2226.865844][T11206] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2226.870147][ T4945] netlink: 'syz.0.8887': attribute type 32 has an invalid length. [ 2227.009521][T11206] usb 2-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=9e.7f [ 2227.055704][T11206] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2227.176793][T11206] usb 2-1: Product: syz [ 2227.196931][T11206] usb 2-1: Manufacturer: syz [ 2227.235345][T11206] usb 2-1: SerialNumber: syz [ 2227.274822][T11206] usb 2-1: config 0 descriptor?? [ 2227.311924][T11206] redrat3 2-1:0.0: Couldn't find all endpoints [ 2227.534938][ T4937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2227.559899][ T4937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2227.689724][ T4937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2227.762224][ T4937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2227.885980][ T4937] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8884'. [ 2228.199098][ T4957] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2228.383695][ T4957] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2228.570785][T21089] usb 2-1: USB disconnect, device number 42 [ 2228.625770][T32332] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 2228.818735][T32332] usb 4-1: config 27 has an invalid descriptor of length 105, skipping remainder of the config [ 2228.835744][T32332] usb 4-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2228.848873][T32332] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=dc.9d [ 2228.864915][T32332] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2229.222907][ T4963] delete_channel: no stack [ 2229.233044][ T4963] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 2229.249969][T32332] usb 4-1: string descriptor 0 read error: -71 [ 2229.285995][T32332] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 2229.414769][ T4970] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2229.486508][ T4970] 8021q: adding VLAN 0 to HW filter on device team0 [ 2230.012223][T32332] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 2230.073536][ T4983] netlink: 'syz.1.8896': attribute type 4 has an invalid length. [ 2230.108392][T32332] usb 4-1: USB disconnect, device number 102 [ 2230.125299][ T4970] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 2230.326034][ T4977] sch_tbf: burst 19872 is lower than device lo mtu (39799) ! [ 2230.448704][ T4989] xt_hashlimit: max too large, truncated to 1048576 [ 2230.464146][ T4990] netlink: 68 bytes leftover after parsing attributes in process `syz.0.8897'. [ 2230.775717][T11224] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 2231.045410][T11224] usb 1-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 2231.274586][T11224] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2231.295154][T11224] usb 1-1: Product: syz [ 2231.323910][T11224] usb 1-1: Manufacturer: syz [ 2231.334435][T11224] usb 1-1: SerialNumber: syz [ 2231.367517][T11224] usb 1-1: config 0 descriptor?? [ 2231.451141][T11224] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 2231.989419][ T4999] (unnamed net_device) (uninitialized): up delay (16) is not a multiple of miimon (6516), value rounded to 0 ms [ 2232.310638][ T5004] ptrace attach of "./syz-executor exec"[28031] was attempted by "./syz-executor exec"[5004] [ 2232.632733][ T5010] geneve2: entered promiscuous mode [ 2232.642439][ T5010] geneve2: entered allmulticast mode [ 2233.355440][T11224] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 2233.518708][T11224] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x92, changing to 0x82 [ 2233.530613][T21089] usb 6-1: new full-speed USB device number 104 using dummy_hcd [ 2233.624177][T11224] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2233.684483][T11224] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 2233.699361][T21089] usb 6-1: config 0 has no interfaces? [ 2233.710798][T21089] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 2233.720167][T21089] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2233.792518][T21089] usb 6-1: Product: syz [ 2233.810966][T11224] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2233.835311][T21089] usb 6-1: Manufacturer: syz [ 2233.839960][T21089] usb 6-1: SerialNumber: syz [ 2233.962171][T21089] usb 6-1: config 0 descriptor?? [ 2233.980163][T11224] usb 2-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=9e.7f [ 2233.998627][T11224] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2234.035647][T11224] usb 2-1: Product: syz [ 2234.050342][T11224] usb 2-1: Manufacturer: syz [ 2234.061104][T11224] usb 2-1: SerialNumber: syz [ 2234.081520][T11224] usb 2-1: config 0 descriptor?? [ 2234.114030][T11224] redrat3 2-1:0.0: Couldn't find all endpoints [ 2234.310434][T11224] usb 1-1: USB disconnect, device number 10 [ 2234.375652][ T5018] program syz.5.8907 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2234.396624][ T5018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2234.413812][ T5016] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2234.526116][ T5016] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2234.576097][ T5018] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2234.625689][ T5025] sch_tbf: burst 19872 is lower than device lo mtu (39799) ! [ 2235.216655][ T5016] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2235.291247][ T5016] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2235.325501][ T5016] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8906'. [ 2235.423826][ T5031] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2235.437140][ T5031] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2235.537138][ T2328] usb 2-1: USB disconnect, device number 43 [ 2236.250006][T32332] usb 6-1: USB disconnect, device number 104 [ 2236.625553][ T2328] usb 4-1: new full-speed USB device number 103 using dummy_hcd [ 2236.705281][T11224] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 2236.804528][ T5049] xt_TPROXY: Can be used only with -p tcp or -p udp [ 2236.813209][ T2328] usb 4-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 2236.839368][ T2328] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2236.877965][T11224] usb 6-1: Using ep0 maxpacket: 8 [ 2236.886577][ T2328] usb 4-1: config 0 descriptor?? [ 2236.897774][T11224] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 2236.909639][T11224] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2236.933650][T11224] usb 6-1: Product: syz [ 2236.952954][T11224] usb 6-1: Manufacturer: syz [ 2236.980546][T11224] usb 6-1: SerialNumber: syz [ 2237.003540][T11224] usb 6-1: config 0 descriptor?? [ 2237.111084][ T5055] dlm: plock device version mismatch: kernel (1.2.0), user (1.131072.0) [ 2237.156528][ T5040] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8912'. [ 2237.223892][T11224] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 2237.401137][ T5061] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8922'. [ 2237.442849][ T5061] tipc: Enabling of bearer rejected, failed to enable media [ 2237.828784][T11224] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 2237.860499][ T2328] usb 4-1: USB disconnect, device number 103 [ 2237.928505][ T5073] ptrace attach of "./syz-executor exec"[28031] was attempted by "./syz-executor exec"[5073] [ 2238.950918][ T5098] loop6: detected capacity change from 0 to 7 [ 2239.008502][ T5098] Dev loop6: unable to read RDB block 7 [ 2239.042396][ T5098] loop6: AHDI p3 p4 [ 2239.046909][ T5098] loop6: partition table partially beyond EOD, truncated [ 2239.095700][ T5098] loop6: p3 start 1886353253 is beyond EOD, truncated [ 2239.615385][T11224] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 2239.623575][ T5107] netlink: 'syz.5.8915': attribute type 32 has an invalid length. [ 2239.865284][T11224] usb 3-1: Using ep0 maxpacket: 16 [ 2239.872636][T11224] usb 3-1: config 0 has no interfaces? [ 2239.951176][T11224] usb 3-1: New USB device found, idVendor=0c45, idProduct=628e, bcdDevice=5a.36 [ 2239.965503][T11224] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2239.974094][T11224] usb 3-1: Product: syz [ 2239.982845][T11224] usb 3-1: Manufacturer: syz [ 2239.994265][T11224] usb 3-1: SerialNumber: syz [ 2240.032768][T11224] usb 3-1: config 0 descriptor?? [ 2240.045427][T21089] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 2240.198198][T21089] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2240.213926][T21089] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 2240.225048][T21089] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2240.237470][T21089] usb 4-1: Product: syz [ 2240.243874][T21089] usb 4-1: Manufacturer: syz [ 2240.257238][T21089] usb 4-1: SerialNumber: syz [ 2240.274318][T11224] usb 3-1: USB disconnect, device number 113 [ 2240.302119][T21089] usb 4-1: config 0 descriptor?? [ 2240.699618][ T2328] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 2240.722529][T21089] usb 6-1: USB disconnect, device number 105 [ 2240.782823][ T5122] netlink: 'syz.5.8939': attribute type 1 has an invalid length. [ 2240.838325][ T5122] 8021q: adding VLAN 0 to HW filter on device bond2 [ 2240.859605][ T2328] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.02 [ 2240.869435][ T2328] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2240.882746][ T2328] usb 1-1: Product: syz [ 2240.887236][ T2328] usb 1-1: Manufacturer: syz [ 2240.892062][ T2328] usb 1-1: SerialNumber: syz [ 2240.900776][ T2328] usb 1-1: config 0 descriptor?? [ 2241.213758][ T2328] usb 1-1: USB disconnect, device number 11 [ 2241.395495][T32332] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 2241.575273][T32332] usb 3-1: Using ep0 maxpacket: 32 [ 2241.583212][T32332] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 2241.667530][T32332] usb 3-1: config 0 has no interface number 0 [ 2241.682006][T32332] usb 3-1: config 0 interface 12 has no altsetting 0 [ 2241.700092][T32332] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 2241.715731][T32332] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2241.723830][T32332] usb 3-1: Product: syz [ 2241.729530][T32332] usb 3-1: Manufacturer: syz [ 2241.744368][T32332] usb 3-1: SerialNumber: syz [ 2241.754762][T32332] usb 3-1: config 0 descriptor?? [ 2241.911389][ T5152] xt_TCPMSS: Only works on TCP SYN packets [ 2242.185385][ T2328] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 2242.347593][ T2328] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 2242.357588][ T2328] usb 1-1: config 0 has no interface number 0 [ 2242.363861][ T2328] usb 1-1: config 0 interface 41 has no altsetting 0 [ 2242.373981][ T2328] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 2242.383368][ T2328] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2242.391494][ T2328] usb 1-1: Product: syz [ 2242.396033][ T2328] usb 1-1: Manufacturer: syz [ 2242.400687][ T2328] usb 1-1: SerialNumber: syz [ 2242.408198][ T2328] usb 1-1: config 0 descriptor?? [ 2242.694542][ T5156] Context (ID=0x0) not attached to queue pair (handle=0x4d5:0x0) [ 2242.759853][T21089] usb 4-1: USB disconnect, device number 104 [ 2242.828765][ T5152] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2242.859613][ T5152] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2242.886886][ T30] audit: type=1400 audit(1750692460.866:4232): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=2626200D3AC023AE1DAEE17A3A pid=5151 comm="syz.0.8945" [ 2242.888040][ T5152] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8945'. [ 2242.944155][ T5152] openvswitch: : Dropping previously announced user features [ 2242.964782][ T5166] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2242.972116][ T5166] IPv6: NLM_F_CREATE should be set when creating new route [ 2242.979404][ T5166] IPv6: NLM_F_CREATE should be set when creating new route [ 2242.988277][ T5166] ------------[ cut here ]------------ [ 2242.993847][ T5166] WARNING: CPU: 0 PID: 5166 at drivers/net/netdevsim/fib.c:831 nsim_fib_event_nb+0xed8/0x1080 [ 2243.004501][ T5166] Modules linked in: [ 2243.005594][T11224] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 2243.008810][ T5166] CPU: 0 UID: 0 PID: 5166 Comm: syz.5.8949 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 2243.026987][ T5166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 2243.038326][ T5166] RIP: 0010:nsim_fib_event_nb+0xed8/0x1080 [ 2243.044624][ T5166] Code: fa be 02 00 00 00 eb 0a e8 a5 b8 b3 fa be 01 00 00 00 4c 89 f7 e8 e8 ce b4 fd 4c 8b 64 24 08 e9 91 f4 ff ff e8 89 b8 b3 fa 90 <0f> 0b 90 e9 70 fb ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 35 [ 2243.064883][ T5166] RSP: 0018:ffffc9000d797068 EFLAGS: 00010283 [ 2243.071634][ T5166] RAX: ffffffff870c9497 RBX: 0000000000000001 RCX: 0000000000080000 [ 2243.080111][ T5166] RDX: ffffc90013340000 RSI: 0000000000006596 RDI: 0000000000006597 [ 2243.088729][ T5166] RBP: dffffc0000000000 R08: ffff88805da9142f R09: 1ffff1100bb52285 [ 2243.096799][ T5166] R10: dffffc0000000000 R11: ffffed100bb52286 R12: ffff88806bd96000 [ 2243.104928][ T5166] R13: ffffc9000d7971e0 R14: 0000000000000000 R15: ffffc9000d7971f8 [ 2243.112992][ T5166] FS: 00007fb02c1836c0(0000) GS:ffff888125c51000(0000) knlGS:0000000000000000 [ 2243.122246][ T5166] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2243.129148][ T5166] CR2: 00007fb02c182f98 CR3: 000000005c62c000 CR4: 00000000003526f0 [ 2243.137213][ T5166] Call Trace: [ 2243.140518][ T5166] [ 2243.143502][ T5166] notifier_call_chain+0x1b3/0x3e0 [ 2243.147247][T11224] usb 2-1: device descriptor read/64, error -71 [ 2243.148688][ T5166] ? atomic_notifier_call_chain+0x26/0x180 [ 2243.160746][ T5166] atomic_notifier_call_chain+0xda/0x180 [ 2243.166491][ T5166] call_fib_notifiers+0x31/0x60 [ 2243.171793][ T5166] call_fib6_multipath_entry_notifiers+0xe6/0x150 [ 2243.178745][ T5166] ? __pfx_call_fib6_multipath_entry_notifiers+0x10/0x10 [ 2243.185879][ T5166] ? inet6_rtm_newroute+0xe8b/0x18c0 [ 2243.191208][ T5166] inet6_rtm_newroute+0x12f5/0x18c0 [ 2243.196490][ T5166] ? nlmon_xmit+0xb0/0x100 [ 2243.200946][ T5166] ? kmem_cache_free+0x18f/0x400 [ 2243.206006][ T5166] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 2243.211591][ T5166] ? __local_bh_enable_ip+0x12d/0x1c0 [ 2243.217092][ T5166] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 2243.222660][ T5166] rtnetlink_rcv_msg+0x7cc/0xb70 [ 2243.227664][ T5166] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 2243.232796][ T5166] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2243.238340][ T5166] ? ref_tracker_free+0x63a/0x7d0 [ 2243.243393][ T5166] ? __copy_skb_header+0xa7/0x550 [ 2243.248554][ T5166] ? __pfx_ref_tracker_free+0x10/0x10 [ 2243.253967][ T5166] ? __skb_clone+0x63/0x7a0 [ 2243.258594][ T5166] netlink_rcv_skb+0x208/0x470 [ 2243.263404][ T5166] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2243.268934][ T5166] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2243.274586][ T5166] ? netlink_deliver_tap+0x2e/0x1b0 [ 2243.280322][ T5166] ? netlink_deliver_tap+0x2e/0x1b0 [ 2243.285662][ T5166] netlink_unicast+0x75b/0x8d0 [ 2243.290483][ T5166] netlink_sendmsg+0x805/0xb30 [ 2243.295384][ T5166] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2243.300713][ T5166] ? aa_sock_msg_perm+0x94/0x160 [ 2243.305747][ T5166] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2243.311071][ T5166] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2243.316452][ T5166] __sock_sendmsg+0x21c/0x270 [ 2243.321180][ T5166] ____sys_sendmsg+0x505/0x830 [ 2243.326060][ T5166] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2243.331374][ T5166] ? import_iovec+0x74/0xa0 [ 2243.335948][ T5166] ___sys_sendmsg+0x21f/0x2a0 [ 2243.340669][ T5166] ? __pfx____sys_sendmsg+0x10/0x10 [ 2243.345982][ T5166] ? __fget_files+0x2a/0x420 [ 2243.350618][ T5166] ? __fget_files+0x3a0/0x420 [ 2243.355413][ T5166] __x64_sys_sendmsg+0x19b/0x260 [ 2243.360413][ T5166] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2243.365967][ T5166] ? do_syscall_64+0xbe/0x3b0 [ 2243.370666][ T5166] do_syscall_64+0xfa/0x3b0 [ 2243.375642][ T5166] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2243.381749][ T5166] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2243.388409][ T5166] ? clear_bhb_loop+0x60/0xb0 [ 2243.393157][ T5166] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2243.395795][T11224] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 2243.399114][ T5166] RIP: 0033:0x7fb02b38e929 [ 2243.411112][ T5166] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2243.430848][ T5166] RSP: 002b:00007fb02c183038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2243.439347][ T5166] RAX: ffffffffffffffda RBX: 00007fb02b5b5fa0 RCX: 00007fb02b38e929 [ 2243.447449][ T5166] RDX: 0000000000000040 RSI: 0000200000000100 RDI: 0000000000000008 [ 2243.455489][ T5166] RBP: 00007fb02b410b39 R08: 0000000000000000 R09: 0000000000000000 [ 2243.463484][ T5166] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2243.471544][ T5166] R13: 0000000000000000 R14: 00007fb02b5b5fa0 R15: 00007fb02b6dfa28 [ 2243.479991][ T5166] [ 2243.483045][ T5166] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 2243.490326][ T5166] CPU: 0 UID: 0 PID: 5166 Comm: syz.5.8949 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 2243.500602][ T5166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 2243.510660][ T5166] Call Trace: [ 2243.513949][ T5166] [ 2243.516889][ T5166] dump_stack_lvl+0x99/0x250 [ 2243.521493][ T5166] ? __asan_memcpy+0x40/0x70 [ 2243.526094][ T5166] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2243.531308][ T5166] ? __pfx__printk+0x10/0x10 [ 2243.535917][ T5166] panic+0x2db/0x790 [ 2243.539831][ T5166] ? __pfx_panic+0x10/0x10 [ 2243.544266][ T5166] ? show_trace_log_lvl+0x4fb/0x550 [ 2243.549497][ T5166] __warn+0x31b/0x4b0 [ 2243.553503][ T5166] ? nsim_fib_event_nb+0xed8/0x1080 [ 2243.558716][ T5166] ? nsim_fib_event_nb+0xed8/0x1080 [ 2243.563918][ T5166] report_bug+0x2be/0x4f0 [ 2243.568258][ T5166] ? nsim_fib_event_nb+0xed8/0x1080 [ 2243.573468][ T5166] ? nsim_fib_event_nb+0xed8/0x1080 [ 2243.578767][ T5166] ? nsim_fib_event_nb+0xeda/0x1080 [ 2243.583973][ T5166] handle_bug+0x84/0x160 [ 2243.588218][ T5166] exc_invalid_op+0x1a/0x50 [ 2243.592724][ T5166] asm_exc_invalid_op+0x1a/0x20 [ 2243.597578][ T5166] RIP: 0010:nsim_fib_event_nb+0xed8/0x1080 [ 2243.603394][ T5166] Code: fa be 02 00 00 00 eb 0a e8 a5 b8 b3 fa be 01 00 00 00 4c 89 f7 e8 e8 ce b4 fd 4c 8b 64 24 08 e9 91 f4 ff ff e8 89 b8 b3 fa 90 <0f> 0b 90 e9 70 fb ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 35 [ 2243.623006][ T5166] RSP: 0018:ffffc9000d797068 EFLAGS: 00010283 [ 2243.629083][ T5166] RAX: ffffffff870c9497 RBX: 0000000000000001 RCX: 0000000000080000 [ 2243.637144][ T5166] RDX: ffffc90013340000 RSI: 0000000000006596 RDI: 0000000000006597 [ 2243.645145][ T5166] RBP: dffffc0000000000 R08: ffff88805da9142f R09: 1ffff1100bb52285 [ 2243.653230][ T5166] R10: dffffc0000000000 R11: ffffed100bb52286 R12: ffff88806bd96000 [ 2243.661221][ T5166] R13: ffffc9000d7971e0 R14: 0000000000000000 R15: ffffc9000d7971f8 [ 2243.669304][ T5166] ? nsim_fib_event_nb+0xed7/0x1080 [ 2243.674527][ T5166] ? nsim_fib_event_nb+0xed7/0x1080 [ 2243.679755][ T5166] notifier_call_chain+0x1b3/0x3e0 [ 2243.684890][ T5166] ? atomic_notifier_call_chain+0x26/0x180 [ 2243.690795][ T5166] atomic_notifier_call_chain+0xda/0x180 [ 2243.696444][ T5166] call_fib_notifiers+0x31/0x60 [ 2243.701298][ T5166] call_fib6_multipath_entry_notifiers+0xe6/0x150 [ 2243.707719][ T5166] ? __pfx_call_fib6_multipath_entry_notifiers+0x10/0x10 [ 2243.714776][ T5166] ? inet6_rtm_newroute+0xe8b/0x18c0 [ 2243.720108][ T5166] inet6_rtm_newroute+0x12f5/0x18c0 [ 2243.725322][ T5166] ? nlmon_xmit+0xb0/0x100 [ 2243.729752][ T5166] ? kmem_cache_free+0x18f/0x400 [ 2243.734698][ T5166] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 2243.740252][ T5166] ? __local_bh_enable_ip+0x12d/0x1c0 [ 2243.745695][ T5166] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 2243.751243][ T5166] rtnetlink_rcv_msg+0x7cc/0xb70 [ 2243.756186][ T5166] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 2243.761308][ T5166] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2243.766858][ T5166] ? ref_tracker_free+0x63a/0x7d0 [ 2243.771892][ T5166] ? __copy_skb_header+0xa7/0x550 [ 2243.776930][ T5166] ? __pfx_ref_tracker_free+0x10/0x10 [ 2243.782322][ T5166] ? __skb_clone+0x63/0x7a0 [ 2243.786837][ T5166] netlink_rcv_skb+0x208/0x470 [ 2243.791605][ T5166] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2243.797064][ T5166] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2243.802358][ T5166] ? netlink_deliver_tap+0x2e/0x1b0 [ 2243.807559][ T5166] ? netlink_deliver_tap+0x2e/0x1b0 [ 2243.812760][ T5166] netlink_unicast+0x75b/0x8d0 [ 2243.817545][ T5166] netlink_sendmsg+0x805/0xb30 [ 2243.822320][ T5166] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2243.827632][ T5166] ? aa_sock_msg_perm+0x94/0x160 [ 2243.832578][ T5166] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2243.837873][ T5166] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2243.843162][ T5166] __sock_sendmsg+0x21c/0x270 [ 2243.847850][ T5166] ____sys_sendmsg+0x505/0x830 [ 2243.852625][ T5166] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2243.857926][ T5166] ? import_iovec+0x74/0xa0 [ 2243.862440][ T5166] ___sys_sendmsg+0x21f/0x2a0 [ 2243.867127][ T5166] ? __pfx____sys_sendmsg+0x10/0x10 [ 2243.872355][ T5166] ? __fget_files+0x2a/0x420 [ 2243.876954][ T5166] ? __fget_files+0x3a0/0x420 [ 2243.881643][ T5166] __x64_sys_sendmsg+0x19b/0x260 [ 2243.886585][ T5166] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2243.892060][ T5166] ? do_syscall_64+0xbe/0x3b0 [ 2243.896747][ T5166] do_syscall_64+0xfa/0x3b0 [ 2243.901338][ T5166] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2243.907405][ T5166] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2243.913565][ T5166] ? clear_bhb_loop+0x60/0xb0 [ 2243.918258][ T5166] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2243.924164][ T5166] RIP: 0033:0x7fb02b38e929 [ 2243.928608][ T5166] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2243.948240][ T5166] RSP: 002b:00007fb02c183038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2243.956658][ T5166] RAX: ffffffffffffffda RBX: 00007fb02b5b5fa0 RCX: 00007fb02b38e929 [ 2243.964632][ T5166] RDX: 0000000000000040 RSI: 0000200000000100 RDI: 0000000000000008 [ 2243.972619][ T5166] RBP: 00007fb02b410b39 R08: 0000000000000000 R09: 0000000000000000 [ 2243.980598][ T5166] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2243.988576][ T5166] R13: 0000000000000000 R14: 00007fb02b5b5fa0 R15: 00007fb02b6dfa28 [ 2243.996561][ T5166] [ 2243.999835][ T5166] Kernel Offset: disabled [ 2244.004167][ T5166] Rebooting in 86400 seconds..