last executing test programs: 13.617729248s ago: executing program 0 (id=3704): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x200000, 0x0, 0xb49, 0x9, 0xc, 0x0, 0x1}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000580)=@ipv4_newroute={0x38, 0x18, 0x35f32a6dfa748ddd, 0x0, 0xfffbfffd, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x400}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x4}, @RTA_ENCAP={0x14, 0x16, 0x0, 0x1, @SEG6_LOCAL_BPF={0x10, 0x8, 0x0, 0x1, @SEG6_LOCAL_BPF_PROG_NAME={0xa, 0x2, '*/^\\^\x00'}}}]}, 0x38}}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r3, &(0x7f0000000000)={&(0x7f00000001c0)={0xa, 0x4e21, 0x80000, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xfffffffd}, 0x1c, 0x0, 0x0, &(0x7f00000002c0)=[@dstopts_2292={{0x18, 0x29, 0x36, {0x32, 0x1d2}}}], 0x18}, 0xc4) syz_open_dev$dri(0x0, 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$dsp(r4, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000200)={0x0, 0x1, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) r8 = dup(r7) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4400ae8f, &(0x7f0000000040)=@arm64={0x6, 0x4, 0x9, '\x00', 0x1}) ioctl$KVM_SET_VAPIC_ADDR(r8, 0x4008ae93, &(0x7f00000000c0)=0xffff) syz_usb_connect(0x1, 0x3d, &(0x7f0000000080)=ANY=[], 0x0) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r9, &(0x7f0000000000)=[{0x0}, {&(0x7f0000019080)='\x00\x00', 0x2}], 0x50) 13.614601525s ago: executing program 1 (id=3705): socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000940)=0xffffffffffffffff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) setregid(0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r2, 0x7c81, 0x0) unshare(0x2a020400) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0xa000, 0x1da) r4 = socket$inet6(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000002080)) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, 0x0, 0x310) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, &(0x7f00000000c0)={0xc, 0x0, 0x0}, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2b, &(0x7f00000005c0)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x4e22, 0x0, @empty}}}, 0x108) read$FUSE(r3, &(0x7f0000000040)={0x2020}, 0x2020) close(r3) r5 = syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) fsopen(&(0x7f00000000c0)='hfs\x00', 0x1) close_range(r5, 0xffffffffffffffff, 0x0) 11.85495901s ago: executing program 4 (id=3709): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_buf(r0, 0x0, 0x2a, &(0x7f0000000240)=""/145, &(0x7f00000000c0)=0x91) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x1) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/address_bits', 0x0, 0x1ce) r4 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f00000000c0)=@ethtool_gfeatures={0x33}}) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$getregset(0x4204, r6, 0x200, &(0x7f0000000480)={&(0x7f0000001240)=""/4096, 0x1000}) io_uring_setup(0x597f, &(0x7f0000000180)={0x0, 0xd492, 0x1, 0x0, 0x2f}) syz_mount_image$fuse(0x0, &(0x7f0000002d40)='./file0\x00', 0x1080000, 0x0, 0x0, 0x0, 0x0) r7 = open$dir(&(0x7f0000000140)='./file0\x00', 0x20800, 0x0) utimensat(r7, 0x0, &(0x7f0000000040)={{0x0, 0x3ffffffe}, {0x77359400}}, 0x0) 11.821536809s ago: executing program 3 (id=3721): timer_create(0x0, 0x0, &(0x7f0000000300)=0x0) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x2) openat$cgroup_root(0xffffff9c, &(0x7f0000000040)='./cgroup.net/syz1\x00', 0x200002, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mlock(&(0x7f0000c00000/0x400000)=nil, 0x400000) mbind(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4005, &(0x7f0000000c00)=0xc, 0x6, 0x2) madvise(&(0x7f0000f7c000/0x3000)=nil, 0x3000, 0x14) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x6, 0x141981) r5 = dup(r4) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_SURVEY(r5, &(0x7f0000000640)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000140)={0x20, r6, 0x304, 0x70bd27, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x4, 0x7f}}}}, ["", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x2004089d) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) r7 = fcntl$dupfd(r1, 0x0, r1) write$uinput_user_dev(r7, &(0x7f0000000180)={'syz1\x00', {0x10, 0x0, 0xffff}, 0x9, [0xb86, 0x7, 0x4, 0x7, 0x7ff, 0x3, 0x5, 0x100000, 0x5, 0x4, 0xd, 0x3, 0x9, 0x1f, 0xc795, 0x8, 0x7fff, 0x10001, 0x4, 0x4, 0x1, 0x6, 0xa, 0x6, 0x1, 0x5, 0x0, 0xfb82, 0x3, 0x0, 0x0, 0x1, 0xd, 0x2, 0x0, 0x1, 0x0, 0xfffffffc, 0x400, 0x5, 0x9, 0x5, 0x2, 0x6, 0x0, 0x8, 0x7, 0x4, 0x1, 0xe8, 0x5, 0x7, 0x4, 0x2, 0x2f03132e, 0x0, 0x3, 0x9, 0x3, 0x0, 0x0, 0x0, 0xdf, 0x287f], [0x101, 0x31, 0x6, 0x7, 0x23e, 0x80000001, 0x40a1, 0xe, 0x3, 0x8, 0x9, 0x7f, 0x75, 0x8, 0x7fff, 0x2, 0x7f, 0x5, 0x73, 0x8, 0xfffffffb, 0x1, 0x7ff, 0x4, 0x4d, 0x1, 0x0, 0x9, 0x0, 0x2, 0x8, 0xf, 0xd, 0x2, 0x2a, 0x8, 0x5, 0x3, 0x1, 0x8, 0x2, 0xfffffff0, 0x6, 0x8, 0x7cd, 0x8, 0x7, 0x3, 0xc6, 0x7, 0x9, 0x7, 0x10000, 0x6, 0x5, 0x0, 0x3, 0x4, 0x8, 0x0, 0x2, 0x0, 0x6], [0x0, 0xfffffff8, 0x1, 0x3, 0x9, 0x8001, 0x3, 0x3ea7, 0x6, 0xfffffff8, 0x9, 0x1, 0x700, 0x0, 0xfffffffa, 0xd, 0x7ff, 0x6, 0x80000, 0x7fffffff, 0x9, 0x48, 0x9, 0x6, 0x1, 0x9, 0x3, 0x709, 0x9, 0x9, 0x2, 0x7, 0xff, 0x7fffffff, 0x5, 0x6, 0x43cd, 0x5, 0xd, 0x8000, 0x4, 0x40, 0x7, 0x7, 0x8, 0x10001, 0x4, 0xffff89a1, 0x1000, 0x19, 0x9, 0xa59, 0x3ff, 0x1, 0x3, 0xfffffff5, 0x9, 0x2, 0x10000, 0x1d, 0x3, 0x4, 0x40000, 0x1], [0x7, 0x8, 0x213, 0x789c, 0x40, 0x6, 0x1000, 0x8000, 0x2, 0x3, 0x2, 0x5, 0x7fffffff, 0xd, 0x6, 0x7, 0x8, 0x9, 0x7fffffff, 0x0, 0xffff, 0x0, 0x6, 0x7, 0x0, 0xda43, 0x2, 0x5, 0x14ac3b3b, 0x2, 0xb, 0x0, 0x2, 0x1, 0x1, 0x1000, 0x81, 0xff, 0xb6, 0x3, 0xffff, 0x10, 0xa114, 0x3, 0x6, 0x800, 0x4, 0x40, 0xfffffffb, 0x4, 0x0, 0xfffffff7, 0x7, 0x800, 0x0, 0x4, 0x5, 0x3, 0x2, 0x6, 0xe, 0x9a6, 0x5, 0xffffffff]}, 0x45c) ioctl$SG_GET_REQUEST_TABLE(r7, 0x2275, &(0x7f00000018c0)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) timer_gettime(r0, &(0x7f0000000000)) 11.664993595s ago: executing program 2 (id=3710): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) setsockopt$sock_attach_bpf(r0, 0x1, 0x7, &(0x7f0000000040), 0x95) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x6, 0x8, 0x8001, 0x0, 0xb3, 0x4, 0xfffffe0000000001, 0x7, 0xffffffff}, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) recvmmsg(r4, 0x0, 0x0, 0x122, 0x0) shutdown(r4, 0x2) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000007c0)=ANY=[], 0x119) add_key$user(&(0x7f0000000000), &(0x7f0000000340)={'syz', 0x2}, &(0x7f0000000480)="d25a9850a9a91163f76c5357f3bbadf2656e10d77f85d1028e60ab4e45b931e71645d3d636e82cfdeaadb674e1693d4a7de63820fefc4f787e272b122ebbff6884b3de82f8a3df9a2d0b67e46c349917110300b94240185146e52ac1540130161b6534e99e466173af4c775f238fae344b198915446b576be455f251e79f7ec703f937cd8530410f37000000000000", 0x8f, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv4_delroute={0x44, 0x19, 0x901, 0x0, 0x20, {0x2, 0x18, 0x0, 0x0, 0x0, 0x2, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @rand_addr=0x64010100}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @RPL_IPTUNNEL_SRH={0xc, 0x1, {0x3, 0x8, 0x1, 0x8, 0x2}}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x4}]}, 0x44}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b00000008000000000000000080000000000000", @ANYRES32, @ANYRES16=r0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x50) syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x8000) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="11000000040000000400000008"], 0x48) socketpair(0x21, 0x7, 0x3ff, &(0x7f0000000200)) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x4001, @loopback}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xa7}, 0x30004084) 11.517852168s ago: executing program 1 (id=3711): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x35}}, 0x10) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x4f, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f00000001c0)={[{0x4, 0x5, 0x80, 0x4, 0x4, 0x4, 0x9, 0x5, 0xb6, 0x0, 0x40, 0x9}, {0x3bea, 0xfff9, 0x6, 0x4, 0x5, 0x4, 0xf, 0xfe, 0x3, 0x8, 0x5, 0x2, 0x4}, {0x8, 0x8, 0x9, 0x6a, 0xfc, 0x7, 0x6f, 0x6, 0x4, 0x2, 0x6, 0x7, 0x8}], 0xf}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0xb, 0x9}, {}, {0x9, 0x2}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x6}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x8, 0x3, 0x240, 0xb8, 0x11, 0x148, 0xb8, 0x0, 0x1ac, 0x2a8, 0x2a8, 0x1ac, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x4, 0x300, 'netbios-ns\x00', {0x5}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0xffffffff, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xcc, 0xf4, 0x0, {}, [@common=@ttl={{0x24}, {0x3, 0xb}}, @common=@unspec=@quota={{0x38}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x3, 0x6, 0x2}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x29c) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r8, 0x8937, &(0x7f0000000100)={'veth0_vlan\x00', @random="010000201000"}) r9 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f09"], 0x0) syz_usb_control_io$cdc_ecm(r9, 0x0, 0x0) 10.287202397s ago: executing program 0 (id=3713): r0 = socket$inet6(0xa, 0x3, 0x3c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'pim6reg0\x00', 0x2}) ioctl$TUNSETOFFLOAD(r1, 0x400454c9, 0x3) socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$EBT_SO_SET_COUNTERS(0xffffffffffffffff, 0x0, 0x81, 0x0, 0x11e) r4 = socket$inet(0xa, 0x801, 0x84) connect$inet(r4, &(0x7f0000000340)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r4, 0x8) r5 = accept4(r4, 0x0, 0x0, 0x0) sendto$inet(r5, 0x0, 0x0, 0x0, 0x0, 0x0) close(r5) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, 0x0, 0x18) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket(0x10, 0x3, 0x0) recvmmsg(r7, &(0x7f0000008400)=[{{0x0, 0x0, 0x0}, 0x8000}], 0x1, 0x2102, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x17}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc8}}, 0x0) 9.301018149s ago: executing program 4 (id=3715): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f00000011c0)=@multiplanar_overlay={0xbc8c, 0xa, 0x4, 0x2000, 0x6, {}, {0x3, 0x2, 0xf7, 0xa, 0x3, 0x81, "26da813f"}, 0x4, 0x3, {0x0}}) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2f) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r1 = openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r1, 0x4004510d, &(0x7f0000000000)) r2 = syz_open_dev$radio(&(0x7f00000000c0), 0xffffffffffffffff, 0x2) r3 = syz_open_procfs$pagemap(0x0, 0x0) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f0000000100)={0x60, 0x200000000000000, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x2000000, 0x0, 0x0, 0x235, 0x0, 0x2, 0x11, 0x2}) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000100)={0x4, 0xffffff71, 0x3, 0xffffffffffffffff, 0x0, 0x0}) r4 = openat$vmci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r4, 0x7a4, &(0x7f0000000140)={{@any, 0x7}, 0x5, 0x0, 0x5, 0xff}) mremap(&(0x7f0000324000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) statfs(0x0, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) epoll_create(0xb) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x77359400}}, 0x0) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r6, r5, &(0x7f0000002080)=0x64, 0x21c) 8.847988737s ago: executing program 2 (id=3716): ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000340)={'syztnl0\x00', &(0x7f00000002c0)={'ip6tnl0\x00', 0x0, 0x29, 0x2, 0x2, 0x7, 0x5a, @remote, @dev={0xfe, 0x80, '\x00', 0x17}, 0x80, 0x7800, 0x3, 0x4}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000003c0)=@getchain={0x2c, 0x66, 0x102, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r0, {0x10, 0xe}, {0x8, 0xffff}, {0x2, 0x2}}, [{0x8, 0xb, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x804}, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = dup(r1) r3 = openat$procfs(0xffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) lseek(r3, 0xfffffffffffffff6, 0x3) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r4, 0x29, 0xca, &(0x7f00000000c0)={0x0, 0x1, 0x3, 0x0, 0x1}, 0xffffffffffffff29) openat$ttyS3(0xffffff9c, &(0x7f0000000b00), 0x1, 0x0) setsockopt$MRT6_DEL_MIF(r4, 0x29, 0xcb, &(0x7f0000000540), 0xc) write$UHID_INPUT(r2, &(0x7f0000001040)={0xfc, {"a2e3ad0e090d07f91b5e1a1887f70706d038e7ff7fc6e5539b0d3c0a8b089b3f32356c030890e0879b0a4cc6e70a9b334a959b669a240d0a0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d07732f0acd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0xffffffffffffff34}}, 0x1006) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6e65772064656661757d7420ab91f884fdf1667e757365723a73797a2030301030306095360411000000"], 0x2a, 0x0) r5 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) keyctl$read(0xb, r5, &(0x7f0000000240)=""/112, 0x349b7f55) r6 = epoll_create1(0x80000) r7 = socket$unix(0x1, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r7, &(0x7f0000000080)) r8 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r8, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) ioctl$BTRFS_IOC_SPACE_INFO(r2, 0xc0109414, &(0x7f0000002080)={0xe15, 0x2, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) syz_emit_ethernet(0x4e, &(0x7f0000000200)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00\x00 ', 0x18, 0x6, 0x0, @private1, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@generic={0xfe, 0x2}, @generic={0xfe, 0x2}]}}}}}}}}, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000280)={0xffffffff}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) write$cgroup_int(r3, &(0x7f0000000380)=0xfffffffffffffffe, 0x12) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r9, 0x89f1, &(0x7f0000000340)={'ip_vti0\x00', &(0x7f0000000140)=@ethtool_cmd={0x0, 0x80000000, 0xffffffff, 0x9, 0xf, 0x3, 0x3, 0xfc, 0x0, 0xff, 0x0, 0x0, 0x6, 0xff, 0x0, 0x5}}) 8.167365323s ago: executing program 4 (id=3717): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setsockopt$packet_int(r2, 0x107, 0x11, &(0x7f0000000080)=0x2, 0x4) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x396, @empty}, 0x1c) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000) r3 = fanotify_init(0x200, 0x0) fanotify_mark(r3, 0x80, 0x48001059, 0xffffffffffffff9c, 0x0) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0xc0001, 0x0) writev(r4, &(0x7f0000001880)=[{&(0x7f0000000400)='{', 0x1}], 0x1) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r4, 0xc2c45512, &(0x7f0000000540)={{0x1, 0x1, 0x38000000, 0x2, 'syz0\x00', 0x4}, 0x0, [0x4, 0xf, 0x2, 0x5cbc, 0xf23d, 0xe6ec, 0x5, 0x7, 0x5, 0x9, 0xfffffff8, 0x9d6, 0x3, 0x3, 0xb5, 0x800, 0xe746, 0x1, 0x8000, 0x1, 0xe4d2, 0x81, 0xffffffff, 0x1000, 0x2, 0xa, 0x7fff, 0x3, 0x2, 0x1, 0x8, 0x80000001, 0xe, 0xff, 0x3, 0x7, 0x1, 0x8, 0xaa8, 0x656b, 0x4, 0x2, 0x401, 0x9, 0x3, 0x10000, 0x9, 0x0, 0x7fffffff, 0x0, 0x1, 0x9, 0x7, 0x9, 0x2, 0x26, 0x49, 0xfffffffd, 0x7, 0x7ff, 0x2b, 0x5d474c98, 0x0, 0x400, 0x3, 0x7f, 0x9, 0x7fff, 0x3, 0x8, 0x9, 0x9, 0x0, 0x5, 0x5, 0x1, 0x1, 0x9, 0x1ff, 0x200, 0x9, 0x81, 0x6, 0xf, 0x2, 0xffffffff, 0x3, 0x6, 0x9, 0x7, 0xfb25, 0x8, 0x5, 0x54, 0x2, 0x1, 0x40, 0x6, 0x3, 0x5, 0x6, 0x80, 0x5, 0x0, 0x5577c841, 0x8, 0x7ff, 0xa28a, 0x4, 0xa8, 0xd4, 0xb3, 0x10001, 0x4565, 0xe494, 0x1, 0x8000, 0x7, 0x2, 0xe4f, 0x3, 0x5, 0x3ff, 0x1, 0x10, 0x8000, 0x7, 0x48]}) add_key(0x0, &(0x7f0000000300)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0x1, 0x0) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)=0x0) timer_settime(r6, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0xd, 0x402, 0x0, 0x0, 0xfffffffc) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)={0x0}}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r8, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 8.004504717s ago: executing program 2 (id=3718): socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) socket(0x80000000000000a, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_async', 0x42, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000001a00010000000000000000000a008000", @ANYRES32=0x0, @ANYBLOB="0000000008000300000000001400", @ANYRES64=r2], 0x38}}, 0x0) syz_open_dev$vivid(&(0x7f0000000100), 0x1, 0x2) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) sendmmsg$inet6(r3, &(0x7f0000000c80)=[{{&(0x7f0000000580)={0xa, 0x4e21, 0x0, @empty}, 0x1c, 0x0}}], 0x40000cc, 0xc000) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private=0xa010101, @in=@empty, 0x0, 0xbf, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4}, {0xfffffffffffffffb, 0xfffffffffffffffd, 0x1}, {0x0, 0x0, 0x4, 0x2}, 0x0, 0x0, 0x1}, {{@in6=@empty, 0x0, 0x2b}, 0x0, @in=@broadcast, 0x0, 0x3, 0x1, 0x0, 0xf000000, 0x6}}, 0xe8) listen(r4, 0x0) r5 = fsopen(&(0x7f0000000540)='vxfs\x00', 0x0) readv(r5, &(0x7f0000000680)=[{&(0x7f0000000200)=""/117, 0x75}, {0x0}], 0x2) syz_emit_ethernet(0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 7.924361179s ago: executing program 3 (id=3719): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$vimc1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r3, 0xc0cc5640, 0x0) socket(0x10, 0x3, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x101, 0x4}) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0), 0x0, 0x0}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, &(0x7f00000006c0)={0x0, 0x9, &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000500)=[0x0], &(0x7f0000000600), &(0x7f0000000640)=[0x6, 0xc, 0x1], 0x0, 0xfffffffffffffff8}) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r6, 0x0, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd30", 0x10) syz_emit_ethernet(0xfdef, 0x0, 0x0) r8 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r8, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000680)="fe55fc2733656cd94cd632f708d5edc9bbe8b3ec7b6726cb94dd7ef916602cfa318a03da4cd0bcbe6074bdf1dc41427cb05cdcc0a6bf308e382bd3b0a7", 0x3d}], 0x1, 0x0, 0x0, 0x40000}], 0x1, 0xc0) recvmmsg(r8, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000740)=""/96, 0x7}, {&(0x7f0000000940)=""/53, 0x35}], 0x2}, 0x7fff}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000840)=""/116, 0x74}], 0x1}, 0x9}], 0x2, 0x10000, 0x0) 7.738789106s ago: executing program 1 (id=3720): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f00000001c0)=0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7ffffeff}]}) r5 = syz_open_procfs(0x0, 0x0) lseek(r5, 0x2000, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r6, 0xc000000, &(0x7f0000000000)=[{0x0}], 0x1, 0x12}) io_uring_enter(0xffffffffffffffff, 0x847ba, 0x0, 0xe, 0x0, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = epoll_create1(0x80000) r9 = fcntl$dupfd(r7, 0x406, r8) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r9, &(0x7f0000000000)) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f00000001c0)={0x10000014}) r10 = getpid() r11 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r10, r11, 0x7, r9, &(0x7f0000000100)={r8, r9}) 6.189126093s ago: executing program 0 (id=3722): socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet6(0xa, 0x3, 0xff) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000000), 0x2, 0xe8e80) r4 = fsopen(&(0x7f0000000100)='proc\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r4, 0x2, &(0x7f0000000040)='&:}\x00', &(0x7f00000002c0)="1b98", 0x2) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@random="9b4307000001", @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @private, @broadcast}, @echo_reply={0xe0, 0x0, 0x0, 0xfffd}}}}}, 0x0) r5 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_DV_TIMINGS(r5, 0xc0845657, &(0x7f0000000900)={0x0, @reserved}) io_uring_enter(0xffffffffffffffff, 0x48e9, 0x0, 0x2, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000480)={0xa, 0xfffe, 0x3, @mcast1, 0x5}, 0x1c) syz_open_dev$vivid(&(0x7f0000000080), 0x0, 0x2) r6 = socket(0x2b, 0x1, 0x1) r7 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x8000000, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, &(0x7f0000000180)={@mcast1, 0x8000000, 0x0, 0xff, 0x0, 0x4}, 0x20) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)}, {&(0x7f0000000380)="d973b2fed6357292a3647d2464ec8dd4badcdd95766520cb584869ea1047f72e29b26c3e29b0170dcafdc5c0dce754205e54ceb6d37cac3f1eeb8bf69fd7de36252516b3485790b5a1abc0c549adc91d5c43d52e01df06f524cc9fc3cc48b87deaec1e719043809f90f1f9f139cd607a07c9b9fe13f3caa5ed8fbc22625b6a6dfb764d98701761b48604279eff092b61899e50afe70e89ef389603e5ee77d0c84cd113e83f46219cb44cafbdd10694dab3181a581c8c5f3806fa1a73be101262776933fb", 0xc4}, {&(0x7f00000004c0)="dd345a01e682bd48d2a703b3ad078d81f920811f51a07d3acf4b8439dbea9a098db6073e49c20b2e8267166a695d3044f02fb6c4de6669a5673866805a04aeafbe11317b64b47dd954deb47bc3a9673e0b5f21edc3166411a28a44b306da605223891d1f1b319b60bcffec1b0d31a1fcc6151aaf261fb7969a9bf359a4fee18a5050509c32fbc436d6", 0x89}], 0x3, &(0x7f00000005c0)=[@cred={{0x18}}, @rights={{0x18, 0x1, 0x1, [r4, 0xffffffffffffffff, r6]}}, @cred={{0x18}}], 0x48, 0x801}}], 0x1, 0x4000890) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r9 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r9, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) close_range(r8, 0xffffffffffffffff, 0x0) 6.086948249s ago: executing program 1 (id=3723): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f00000000c0)={0x0, 0x115000}) ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f0000000400)={0x10000, 0x7000}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r4, 0x4010ae68, &(0x7f0000000000)={0xdddd7000, 0x6000}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r5 = socket$inet6(0xa, 0x800, 0xfffffff8) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_netprio_ifpriomap(r6, &(0x7f0000000080), 0x2, 0x0) sendfile(r7, r7, &(0x7f0000000040)=0x8, 0xc) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) bpf$PROG_LOAD(0x5, 0x0, 0x0) rmdir(0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000fd7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000040)="660f38817d64652e450f01ca67670f35362ef20f2ca803900000400f6f4c7200420fc79a007800000f01d142790066bad104ed2e0f7898c2000000", 0x3b}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r10, 0x4080aebf, &(0x7f0000003680)=@vmx={0x0, 0x0, 0x2080, {0x0, 0x8080000, {}, 0x0, 0xc}, {"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000"}}) 6.054262662s ago: executing program 3 (id=3724): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfa11, 0xffffffff}, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[], 0x5c}}, 0x0) set_mempolicy(0x3, &(0x7f00000000c0)=0x3, 0x5) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r4, &(0x7f0000000f80)=[{{&(0x7f0000000240)={0xa, 0x4e24, 0x86, @private0={0xfc, 0x0, '\x00', 0x1}, 0x7fffffff}, 0x1c, &(0x7f00000005c0)=[{&(0x7f0000000280)="8a", 0x1}], 0x1}}, {{&(0x7f0000000540)={0xa, 0x4e21, 0x8075, @dev={0xfe, 0x80, '\x00', 0x6}, 0x2}, 0x1c, &(0x7f0000000e00)=[{&(0x7f0000000ac0)='^', 0x1}], 0x1}}], 0x2, 0x40000c0) shutdown(r4, 0x1) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f0000000300)={0x0, 0x5}, &(0x7f0000000340)=0x8) r5 = syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r5, 0xc0844123, &(0x7f0000002fc0)) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000000140), &(0x7f00000001c0)=0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000180)=[@in={0x2, 0x4e22, @loopback}], 0x10) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r8 = dup(r7) write$6lowpan_enable(r8, &(0x7f0000000000)='0', 0xfffffd2c) 5.916819226s ago: executing program 4 (id=3725): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) setsockopt$sock_attach_bpf(r0, 0x1, 0x7, &(0x7f0000000040), 0x95) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x6, 0x8, 0x8001, 0x0, 0xb3, 0x4, 0xfffffe0000000001, 0x7, 0xffffffff}, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) recvmmsg(r4, 0x0, 0x0, 0x122, 0x0) shutdown(r4, 0x2) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000007c0)=ANY=[], 0x119) add_key$user(&(0x7f0000000000), &(0x7f0000000340)={'syz', 0x2}, &(0x7f0000000480)="d25a9850a9a91163f76c5357f3bbadf2656e10d77f85d1028e60ab4e45b931e71645d3d636e82cfdeaadb674e1693d4a7de63820fefc4f787e272b122ebbff6884b3de82f8a3df9a2d0b67e46c349917110300b94240185146e52ac1540130161b6534e99e466173af4c775f238fae344b198915446b576be455f251e79f7ec703f937cd8530410f37000000000000", 0x8f, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv4_delroute={0x44, 0x19, 0x901, 0x0, 0x20, {0x2, 0x18, 0x0, 0x0, 0x0, 0x2, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @rand_addr=0x64010100}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @RPL_IPTUNNEL_SRH={0xc, 0x1, {0x3, 0x8, 0x1, 0x8, 0x2}}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x4}]}, 0x44}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b00000008000000000000000080000000000000", @ANYRES32, @ANYRES16=r0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x50) syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x8000) socketpair(0x21, 0x7, 0x3ff, &(0x7f0000000200)) socketpair(0x2b, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x4001, @loopback}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xa7}, 0x30004084) 5.860273275s ago: executing program 2 (id=3726): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x89b0, &(0x7f0000000000)={'vlan0\x00', &(0x7f00000000c0)=@ethtool_cmd={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x401, 0xc, 0x9, 0x2, 0x7}, 0x0) remap_file_pages(&(0x7f0000115000/0x400000)=nil, 0x400000, 0x8, 0x2, 0x1c0000) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x8, 0x20040, 0x2000) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, 0x0, 0x0) setsockopt$sock_int(r4, 0x1, 0x2c, &(0x7f00000000c0)=0xbfe, 0x4) setsockopt$packet_fanout_data(r4, 0x107, 0x16, 0x0, 0x0) listen(r3, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) r5 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_G_FMT(r5, 0xc0d05604, &(0x7f0000000240)={0x8, @vbi}) syz_usb_connect(0x2, 0x36, &(0x7f0000000a40)={{0x12, 0x1, 0x201, 0xaf, 0x4f, 0xc6, 0x20, 0x110a, 0x1130, 0x4efa, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0xc, 0x7, 0x40, 0x6, [{{0x9, 0x4, 0xbb, 0x40, 0x2, 0x55, 0xe7, 0xdb, 0x8, [], [{{0x9, 0x5, 0xa, 0x2, 0x400, 0xf, 0x5, 0x1c}}, {{0x9, 0x5, 0x9, 0x0, 0x40, 0x3, 0xd, 0x1}}]}}]}}]}}, &(0x7f00000010c0)={0x0, 0x0, 0x0, 0x0}) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r6, 0x84, 0x20, &(0x7f0000000040), 0x4) 4.451005236s ago: executing program 1 (id=3727): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_buf(r0, 0x0, 0x2a, &(0x7f0000000240)=""/145, &(0x7f00000000c0)=0x91) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x1) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/address_bits', 0x0, 0x1ce) r4 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f00000000c0)=@ethtool_gfeatures={0x33}}) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$getregset(0x4204, r6, 0x200, &(0x7f0000000480)={&(0x7f0000001240)=""/4096, 0x1000}) io_uring_setup(0x597f, &(0x7f0000000180)={0x0, 0xd492, 0x1, 0x0, 0x2f}) syz_mount_image$fuse(0x0, &(0x7f0000002d40)='./file0\x00', 0x1080000, 0x0, 0x0, 0x0, 0x0) r7 = open$dir(&(0x7f0000000140)='./file0\x00', 0x20800, 0x0) utimensat(r7, 0x0, &(0x7f0000000040)={{0x0, 0x3ffffffe}, {0x77359400}}, 0x0) 4.450293442s ago: executing program 3 (id=3728): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f00000011c0)=@multiplanar_overlay={0xbc8c, 0xa, 0x4, 0x2000, 0x6, {}, {0x3, 0x2, 0xf7, 0xa, 0x3, 0x81, "26da813f"}, 0x4, 0x3, {0x0}}) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2f) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r1 = openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r1, 0x4004510d, &(0x7f0000000000)) r2 = syz_open_dev$radio(&(0x7f00000000c0), 0xffffffffffffffff, 0x2) r3 = syz_open_procfs$pagemap(0x0, 0x0) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f0000000100)={0x60, 0x200000000000000, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x2000000, 0x0, 0x0, 0x235, 0x0, 0x2, 0x11, 0x2}) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000100)={0x4, 0xffffff71, 0x3, 0xffffffffffffffff, 0x0, 0x0}) r4 = openat$vmci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r4, 0x7a4, &(0x7f0000000140)={{@any, 0x7}, 0x5, 0x0, 0x5, 0xff}) mremap(&(0x7f0000324000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) statfs(0x0, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) epoll_create(0xb) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x77359400}}, 0x0) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r6, r5, &(0x7f0000002080)=0x64, 0x21c) 4.449793173s ago: executing program 4 (id=3729): syz_usb_connect(0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x4000)=nil, 0x0, 0x12) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r2, &(0x7f00000002c0)={'#! ', './file0', [], 0xa, "1f410e2852ad52cb07410969e814977e4f2c4a80522094786c8673fb61cf8b86bd030000005a3c7c04055f1f70e4064d46b2bb9e5100d446bb6afb2c0fc07b58f4a9c1006a0b6c05639e23ec12979ff9b48ca61e6dec58682449c75d86eb4337b8d343ed9c18927289d3d788fa281a5742690ff5a505cfff34fc1503afbfd2d44b50e4ca119f67b2890064d83a34eae5f4e64ae0c7c124730f21dcbc2d36ade1464e"}, 0xad) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff000000003e040000000000005d000000000000000704000012da0aff2500000017ffffffae040000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6b8306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119"], &(0x7f00000001c0)='GPL\x00'}, 0x94) close(r2) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x5, 0x9fd, 0x84, 0x105}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), 0x0, 0x800, r3}, 0x38) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000200)=0x1, 0x12) write$cgroup_pid(r5, &(0x7f0000000140), 0x12) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007e3dc410cd0621013ddd0102030109021b000100094000090485000189fe1f000905820220"], 0x0) 4.449024057s ago: executing program 0 (id=3737): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev, 0x7}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000780)=@raw={'raw\x00', 0x3c1, 0x3, 0x4ac, 0x2d8, 0x111, 0x4b4, 0x0, 0xd4feffff, 0x3e4, 0x20a, 0x278, 0x3e4, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [0x0, 0xffffff00], [0x0, 0x0, 0x0, 0xffffffff], 'ipvlan0\x00', 'team_slave_0\x00', {0xff}, {0xff}, 0x6, 0xe}, 0x0, 0x2b4, 0x2d8, 0x0, {}, [@common=@inet=@hashlimit2={{0x150}, {'pimreg\x00', {0xfffffffffffffffe, 0x81, 0x6, 0x1, 0x7, 0x1, 0x9, 0x20, 0x18}, {0x7c012f2}}}, @common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "6d93eb04697dfa39de04767f46614613a407abbf4ed2e83a63b484dbb3bf6b2a850e79009e2905d2f98ba19f91f3c9faee6d3686e9bee067f4e77d9ad66238750c4100d7ee97ec7646259d90edece6e9787a97bc956c01754c34c5c9518c46178ed5f9194454980e579c80eca35a58dc47d1d5e4ff6e216c724e88c702448587", 0xa}}]}, @common=@inet=@TCPMSS={0x24, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@ipv6={@loopback, @mcast2, [], [], 'hsr0\x00', 'pim6reg1\x00', {0xff}}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x20, 0x1, 0xfffffffe, 0x0, 'snmp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x508) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}}) unshare(0x26020480) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000000)={@local}) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r4, 0x7af, &(0x7f0000000080)={@hyper}) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r5, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r5, 0x7a0, &(0x7f0000000240)={@hyper}) close_range(r3, 0xffffffffffffffff, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) open_tree(r6, &(0x7f0000000040)='./file0\x00', 0x80001) umount2(&(0x7f0000000000)='./file0\x00', 0x3) listen(r0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r7, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x78, r8, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xb0}, @MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x30, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xf8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x33}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}]}, 0x78}, 0x1, 0x0, 0x0, 0x50}, 0x800) 3.912959749s ago: executing program 3 (id=3730): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') lseek(r2, 0x6, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) unshare(0x2040400) r4 = fsopen(&(0x7f0000000440)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) unshare(0x2000400) fsmount(r4, 0x0, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, &(0x7f0000001b00)={0x0, 0x34325842, 0x1, @discrete={0x1, 0x100}}) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000e40)=@raw={'raw\x00', 0x3c1, 0x3, 0x4b0, 0x2fc, 0x18c, 0x203, 0x0, 0x19030000, 0x3e8, 0x2e0, 0x2e0, 0x3e8, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d4, 0x2fc, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x1d}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {0xfffc, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3}, {0x2}, {0xffff}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x16}, {}, {}, {0x7}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {}, {}, {0xfffe}, {}, {}, {}, {0x0, 0xfd}, {}, {0x7a04}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb84, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {}, {}, {0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x0, 0x0, 0x2000000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4, 0x0, 0x10}]}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa4, 0xec}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x50c) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) r5 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = syz_open_procfs(0x0, 0x0) pread64(r6, &(0x7f0000000080)=""/102356, 0x18fd4, 0xc2a) socket$nl_generic(0x10, 0x3, 0x10) fsopen(&(0x7f0000000040)='hpfs\x00', 0x1) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0cc5605, &(0x7f0000000740)={0x2, @vbi={0x6, 0x50, 0x3, 0x50565559, [0x9, 0x3], [0xf, 0x6], 0x1}}) socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000055bed40020000000000000003010902380002000000060904c700010e0101000300d009050a000000000000090400000101be2600090500000000000000080b"], 0x0) 3.66986027s ago: executing program 0 (id=3731): r0 = syz_open_dev$dri(&(0x7f0000000080), 0xb, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) unshare(0x8000000) semget$private(0x0, 0x4000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000d80)=ANY=[@ANYBLOB="140000e0390000000000000003ffffff060000006bf28d368cf0759e68cc6cf94bb7222c95120e6a7a8b3acabc8361a2ac966c1a786b5e10376fab91277cf848fec33b4f2c5d1f80a3ee45fe9d0b81dac5a532e5f1cb903096cde6452a97e23cd6f718a32899f5de3a619660286c7af00b6bb81a854f24d59a6d63e7272c2c77f5e804e02cdb6cc7d7182c158af02a2fea4e9da8d7e8a6f57cd534cfde7d57525391da1941f65e6287443bbe44"], 0x5a}, 0x1, 0x0, 0x0, 0x448d3}, 0x0) madvise(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xc) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000740)) r4 = syz_open_dev$media(&(0x7f0000000000), 0x8001, 0x180502) ioctl$MEDIA_IOC_ENUM_LINKS(r4, 0xc01c7c02, 0x0) ioctl$MEDIA_IOC_ENUM_ENTITIES(r4, 0xc1007c01, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, &(0x7f0000000040)={0x80000000, &(0x7f0000000000), &(0x7f00000001c0)}) ioctl$MEDIA_IOC_G_TOPOLOGY(r4, 0xc0487c04, &(0x7f0000000d00)={0x0, 0x0, 0x0, &(0x7f0000001400), 0x0, 0x0, &(0x7f0000000240), 0x8, 0x0, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f00000004c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x300000f, 0x810, r0, 0x100000) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x1b) sendmsg$nl_route(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=@bridge_getneigh={0x28, 0x1e, 0x3c964e403b131b43, 0x0, 0x0, {}, [@IFLA_MASTER={0x8}]}, 0x28}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x2, 0x3b4, &(0x7f0000000040)=ANY=[@ANYRESOCT=r5, @ANYBLOB="331f0f7391a8733dee", @ANYBLOB="19c909abdea6c6442176cef596e310a8cb5ac5e5d046f04abf2ca5ddff7b2097c1deb66fca08b30523dd9a53a06fdcd1d0c5a92bd8c61ebb4e5b33b92501527b6082c40fcf947c61a405ecc381010695d3c74ea9b614323262ec5aea200d50f04fb5d8ce3585a34eaca7ed09290c8ff3143d04a16916c7584d81e0895dbcad06ee", @ANYRESOCT, @ANYRESDEC, @ANYBLOB="4ba673b23d0b3b9032408b6934ad189f76d50015631a42c58318c0dbc01448c91a8bd0dd96328b5170c1f5fb112a92b17b2a63e524d355a9a1a671e2fe6d8a115c9526d2a6373045bc47c1ceba26f125cd310284b48787c49f81671753ee29a3c20c20362a0ed78757dbdcc7588f36704e8c9e5753268af4f9e3d82ad37336a0213f6d630a7ef4c319f1db8183e7b36fe9bb7047e1e723d4d8e0a1382c8b33df713197cf8e1706"], 0x0) 1.79681492s ago: executing program 2 (id=3732): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, 0x500) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) syz_open_dev$usbfs(0x0, 0x76, 0x101301) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) r6 = accept4(r5, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000200)="ad56b6cc0400aeb995298992ea5400c2", 0x10) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000002a40)=[{{0x0, 0x0, &(0x7f0000000e00)=[{0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000000680)=""/144, 0x90}], 0x5}}], 0x1, 0x20, 0x0) sendmmsg$unix(r6, &(0x7f0000000680), 0x4924924924925c6, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r4, &(0x7f00000001c0)=[{&(0x7f0000001400)=""/227, 0x10}], 0x4) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000080)={0x0, 'syzkaller1\x00', {0x4}, 0x1}) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000180)=@multiplanar_fd={0x593, 0x0, 0x4, 0x4, 0x1, {}, {0x5, 0x0, 0x6, 0xb7, 0xe, 0xf8, "48b3dafa"}, 0xe0ed, 0x4, {&(0x7f0000000240)=[{0x81, 0x5e4a, {}, 0x6}, {0x81, 0x9, {}, 0x1ff}]}, 0x30d}) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000080)=0x2) close_range(r2, 0xffffffffffffffff, 0x0) 1.335906371s ago: executing program 1 (id=3733): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f0000000480), &(0x7f00000004c0)=0x4) r2 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r2, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_S_DV_TIMINGS(r2, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x191, 0x1, 0x0, 0xdd9f83, 0x1, 0x2f, 0xf3, 0x2, 0x8, 0x722, 0x6, 0x7, 0x7f, 0x27, 0x20, {0x0, 0x6fd8e84b}, 0x3, 0xed}}) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r3 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3, 0x1}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) landlock_restrict_self(r3, 0x0) symlinkat(&(0x7f00000001c0)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file6\x00') socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="120100000cb768405e0483020b990102030109021b0001000000000904000001012900000905"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_open_dev$audion(&(0x7f00000011c0), 0x3, 0x8c4201) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x80800, 0x0) r5 = syz_open_procfs(0x0, 0x0) sendmsg$DEVLINK_CMD_RELOAD(r5, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB="640100", @ANYRES16=0x0, @ANYBLOB="000227bd7000fedbdf2525000000080001007063690011000200303030303a30303a31302e300000000008008c0001000000080001007063690011000200303030303a30303a31302e300000000008008c0000000000080001007063690011000200303030303a30303a31302e30000000000800", @ANYRES32=0x0, @ANYBLOB, @ANYRES32=r5, @ANYBLOB="0e0001006e657464657673696d0000009333f00f0002006e657464657673", @ANYRES32=0x0, @ANYBLOB="080001007063690011000200303030303a30303a31302e30000000000800", @ANYRES32=r5, @ANYBLOB="0e0001006e65746465", @ANYBLOB="080001007063690011000200303030303a30303a31302e300000000008008a00", @ANYRES32, @ANYBLOB], 0x164}, 0x1, 0x0, 0x0, 0x40000c0}, 0x4000824) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r5, 0x8040942d, &(0x7f0000000040)) syz_open_dev$audion(&(0x7f00000011c0), 0x3, 0x8c4201) 337.796981ms ago: executing program 0 (id=3734): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f00000001c0)=0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7ffffeff}]}) r5 = syz_open_procfs(0x0, 0x0) lseek(r5, 0x2000, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r6, 0xc000000, &(0x7f0000000000)=[{0x0}], 0x1, 0x12}) io_uring_enter(0xffffffffffffffff, 0x847ba, 0x0, 0xe, 0x0, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = epoll_create1(0x80000) r9 = fcntl$dupfd(r7, 0x406, r8) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r9, &(0x7f0000000000)) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f00000001c0)={0x10000014}) r10 = getpid() r11 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r10, r11, 0x7, r9, &(0x7f0000000100)={r8, r9}) 337.329329ms ago: executing program 3 (id=3735): r0 = socket$inet_udplite(0x2, 0x2, 0x88) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0xfff, 0x3}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000004000000040000000a000000000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB='\x00'/27], 0x48) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000040)=@generic={0x0, r3}, 0x14) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x2, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f00000000c0)=0x3) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r5 = syz_io_uring_setup(0x231, &(0x7f0000000080)={0x0, 0xfffffffd, 0x10100}, 0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(0x0, r6, 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_DISCONNECT_CLAIM(r7, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_ALLOW_SUSPEND(r7, 0x5522) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_uring_enter(r5, 0x7a98, 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r0, &(0x7f0000000200)={0x4}) syz_open_dev$media(0x0, 0x4007, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="4000000010000104000000004000000000000000", @ANYRES32=0x0, @ANYBLOB="038000000000000004001980080004003a010000140003006272696467655f736c6176655f31000091cbb30776fb7008efeb131afd52246b3b61d686d4f5e9261b70cc024e72c0c8528113316be323028d6c5052be6d7c6410c395d51165f27560eccc954c6f0a847d72134b54395002b5288753adc662bbc35a4b484bc2917747b381e985149caf33f665d56c05f1622560e241f40f118b3f8ce83b6599488571c01f9ee9696a2c9bd5d2d684c5c7c4b3939d2e8dcfd2a54276468c26fdd80fb507f17de6a3ac0658e4bec3956c14d4729bd77705825667cd73cc290384b034946cfc1aa1e024e03dd518da332d559fa119b6bd89fcb81663"], 0x40}}, 0x0) 336.577954ms ago: executing program 4 (id=3736): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000080)={0x0, 0x1, 0x2, "d0f84e565c6f0f308072785ebd9ca8ac00", 0x3032344d}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0186405, &(0x7f0000000340)={0x2, 0x3ed2, {0x0}, {}, 0x7, 0xd}) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001b00)=ANY=[@ANYRES32=r3], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x98, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x6c, 0x3, 0x0, 0x1, [{0x68, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x5c, 0xb, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x10000}]}}}, {0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x80000000}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x8}]}}}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xfc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) r6 = socket(0x1e, 0x4, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="7000000010000d042abd70000000000000000000", @ANYBLOB="80580100400000002c0012800c0001006d6163766c616e001c00028008000900ffffffff08000100010000000800030001000000140035006d"], 0x70}, 0x1, 0x0, 0x0, 0x804}, 0x8000) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x2, 0x0, 0x81, 0x1ff, 0x7, 0x1}, 0x1c) r8 = syz_io_uring_setup(0x1dd5, &(0x7f0000001b40)={0x0, 0xd3f7, 0x4, 0x2, 0x1}, &(0x7f0000001ac0), 0x0) getsockname$qrtr(r6, &(0x7f0000000100), &(0x7f0000001a80)=0xc) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)={0x34, r9, 0x3141e0b2751b0f9b, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x60c5}, 0x80) io_uring_enter(r8, 0x1f85, 0x40110a, 0x4d, 0x0, 0x85) recvmmsg$unix(r6, &(0x7f0000001e80)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000005c0)=""/227, 0xe3}], 0x1}}, {{&(0x7f0000000380), 0x6e, &(0x7f0000001840)=[{&(0x7f0000000580)=""/17, 0x11}, {&(0x7f00000006c0)=""/4096, 0x1000}, {&(0x7f00000016c0)=""/195, 0xc3}, {&(0x7f00000017c0)=""/114, 0x72}], 0x4}}, {{0x0, 0x0, &(0x7f0000001e40)}}], 0x3, 0x40000000, 0x0) 0s ago: executing program 2 (id=3738): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfa11, 0xffffffff}, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[], 0x5c}}, 0x0) set_mempolicy(0x3, &(0x7f00000000c0)=0x3, 0x5) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r4, &(0x7f0000000f80)=[{{&(0x7f0000000240)={0xa, 0x4e24, 0x86, @private0={0xfc, 0x0, '\x00', 0x1}, 0x7fffffff}, 0x1c, &(0x7f00000005c0)=[{&(0x7f0000000280)="8a", 0x1}], 0x1}}, {{&(0x7f0000000540)={0xa, 0x4e21, 0x8075, @dev={0xfe, 0x80, '\x00', 0x6}, 0x2}, 0x1c, &(0x7f0000000e00)=[{&(0x7f0000000ac0)='^', 0x1}], 0x1}}], 0x2, 0x40000c0) shutdown(r4, 0x1) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f0000000300)={0x0, 0x5}, &(0x7f0000000340)=0x8) r5 = syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r5, 0xc0844123, &(0x7f0000002fc0)) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000000140), &(0x7f00000001c0)=0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r6, 0x84, 0x6b, &(0x7f0000000180)=[@in={0x2, 0x4e22, @loopback}], 0x10) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r8 = dup(r7) write$6lowpan_enable(r8, &(0x7f0000000000)='0', 0xfffffd2c) kernel console output (not intermixed with test programs): 8103][T23641] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3064'. [ 1442.434391][T23668] netlink: 'syz.4.3070': attribute type 4 has an invalid length. [ 1442.538242][T20310] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 1443.001379][T20310] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD4, changing to 0x84 [ 1443.086324][T20310] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 51544, setting to 1024 [ 1443.416801][T20310] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 1443.627939][T20310] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1443.658399][T20310] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1443.666459][T20310] usb 2-1: Product: syz [ 1443.677909][T20310] usb 2-1: Manufacturer: syz [ 1443.682529][T20310] usb 2-1: SerialNumber: syz [ 1443.718651][T20310] usb 2-1: config 0 descriptor?? [ 1443.734724][T23664] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1444.014705][T23680] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1444.088657][T23664] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1446.286328][T20310] usb 2-1: USB disconnect, device number 86 [ 1446.543950][T23713] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1446.737893][ T9] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 1446.937060][ T9] usb 1-1: device descriptor read/64, error -71 [ 1447.398312][ T9] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 1447.547964][ T9] usb 1-1: device descriptor read/64, error -71 [ 1447.658652][ T9] usb usb1-port1: attempt power cycle [ 1448.167899][ T9] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 1448.196808][ T9] usb 1-1: device descriptor read/8, error -71 [ 1448.597930][ T9] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 1448.682202][T23728] syz.3.3090 (23728): drop_caches: 2 [ 1448.842660][ T9] usb 1-1: device descriptor read/8, error -71 [ 1448.973866][ T9] usb usb1-port1: unable to enumerate USB device [ 1449.306784][T23739] sctp: [Deprecated]: syz.1.3083 (pid 23739) Use of int in maxseg socket option. [ 1449.306784][T23739] Use struct sctp_assoc_value instead [ 1449.635955][T23739] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3083'. [ 1449.871920][T23745] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3084'. [ 1449.881103][T23745] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3084'. [ 1449.967051][T23739] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3083'. [ 1450.914332][T23760] usb usb8: usbfs: process 23760 (syz.0.3096) did not claim interface 0 before use [ 1451.284604][T23768] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3086'. [ 1453.062087][T23784] netlink: 'syz.2.3091': attribute type 10 has an invalid length. [ 1453.128541][T23785] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3091'. [ 1453.544831][T23785] team0 (unregistering): Port device team_slave_0 removed [ 1453.565049][T23785] team0 (unregistering): Port device team_slave_1 removed [ 1454.957896][T18581] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 1455.125250][T18581] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1455.156383][T18581] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1455.175883][T18581] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1455.191194][T18581] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1455.212705][T18581] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1455.228069][T18581] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1455.236188][T18581] usb 4-1: Manufacturer: syz [ 1455.246965][T18581] usb 4-1: config 0 descriptor?? [ 1455.666308][T18581] appleir 0003:05AC:8243.000E: unknown main item tag 0x0 [ 1455.678020][T18581] appleir 0003:05AC:8243.000E: hiddev1,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 1456.604479][T23801] bond6: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 1456.616067][T23801] bond6 (unregistering): Released all slaves [ 1456.646870][T23803] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3094'. [ 1456.853000][T23808] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 1456.861310][T23808] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 1456.999281][T23816] syz.1.3098 (23816): drop_caches: 2 [ 1457.369763][T23822] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3099'. [ 1458.081388][ T9] usb 4-1: USB disconnect, device number 98 [ 1458.948104][ T9] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 1459.255960][T23844] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3102'. [ 1459.281054][T23846] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1459.298420][ T9] usb 4-1: device descriptor read/64, error -71 [ 1459.374381][T23846] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1459.616772][ T9] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 1459.798687][T23850] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1459.864157][T23846] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1459.919120][T23846] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1459.988443][T23850] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1460.057951][ T9] usb 4-1: device descriptor read/64, error -71 [ 1460.063378][T23849] netlink: 'syz.0.3112': attribute type 4 has an invalid length. [ 1460.112281][T23851] usb usb8: usbfs: process 23851 (syz.1.3103) did not claim interface 0 before use [ 1460.190403][T23850] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1460.200469][T23850] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1460.232110][ T9] usb usb4-port1: attempt power cycle [ 1460.266800][T23846] vhci_hcd vhci_hcd.0: pdev(2) rhport(6) sockfd(18) [ 1460.273415][T23846] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 1460.285105][T23846] vhci_hcd vhci_hcd.0: Device attached [ 1460.496458][T13886] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 1460.635765][ T9] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 1460.668009][T13886] usb 37-7: new full-speed USB device number 3 using vhci_hcd [ 1460.695946][ T9] usb 4-1: device descriptor read/8, error -71 [ 1460.996539][ T9] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 1461.078718][ T9] usb 4-1: device descriptor read/8, error -71 [ 1461.248154][ T9] usb usb4-port1: unable to enumerate USB device [ 1461.562796][T23863] block device autoloading is deprecated and will be removed. [ 1461.701715][T23864] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3105'. [ 1461.713126][T23863] netlink: 'syz.3.3105': attribute type 4 has an invalid length. [ 1461.883646][T23864] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1462.135580][T23872] sctp: [Deprecated]: syz.4.3109 (pid 23872) Use of int in maxseg socket option. [ 1462.135580][T23872] Use struct sctp_assoc_value instead [ 1462.156924][T23872] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3109'. [ 1462.213658][T23874] binder: BINDER_SET_CONTEXT_MGR already set [ 1462.220005][T23874] binder: 23866:23874 ioctl 4018620d 80000040 returned -16 [ 1462.316469][T23852] vhci_hcd: connection reset by peer [ 1462.327986][T18581] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 1462.351557][T16165] vhci_hcd vhci_hcd.2: stop threads [ 1462.356964][T16165] vhci_hcd vhci_hcd.2: release socket [ 1462.362947][T16165] vhci_hcd vhci_hcd.2: disconnect device [ 1462.436873][T23872] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3109'. [ 1462.567895][T18581] usb 1-1: Using ep0 maxpacket: 32 [ 1462.579637][T18581] usb 1-1: config 0 has an invalid interface number: 169 but max is 0 [ 1462.644822][T18581] usb 1-1: config 0 has an invalid descriptor of length 53, skipping remainder of the config [ 1462.714161][T18581] usb 1-1: config 0 has no interface number 0 [ 1462.720865][T18581] usb 1-1: config 0 interface 169 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1462.736193][T18581] usb 1-1: config 0 interface 169 has no altsetting 0 [ 1462.757568][T18581] usb 1-1: New USB device found, idVendor=0499, idProduct=500c, bcdDevice=33.49 [ 1462.771876][T18581] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1462.818725][T18581] usb 1-1: Product: syz [ 1462.826349][T18581] usb 1-1: Manufacturer: syz [ 1463.044768][T18581] usb 1-1: SerialNumber: syz [ 1463.055759][T18581] usb 1-1: config 0 descriptor?? [ 1463.064968][T18581] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1463.096828][T18581] snd-usb-audio 1-1:0.169: probe with driver snd-usb-audio failed with error -2 [ 1463.142546][ T5836] udevd[5836]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.169/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1463.328430][T23867] netlink: 'syz.0.3107': attribute type 21 has an invalid length. [ 1463.336453][T23867] netlink: 156 bytes leftover after parsing attributes in process `syz.0.3107'. [ 1463.398291][T23867] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3107'. [ 1463.725040][ T9] usb 1-1: USB disconnect, device number 103 [ 1463.986858][T23893] binder: BINDER_SET_CONTEXT_MGR already set [ 1463.993057][T23893] binder: 23884:23893 ioctl 4018620d 80000040 returned -16 [ 1464.066782][T23894] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3114'. [ 1464.184018][T23896] syz.3.3113 (23896): drop_caches: 2 [ 1464.478362][ T30] audit: type=1326 audit(1769752464.804:967): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23886 comm="syz.2.3114" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1464.502559][ T30] audit: type=1326 audit(1769752464.814:968): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23886 comm="syz.2.3114" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1464.569303][T23898] input: syz1 as /devices/virtual/input/input65 [ 1464.968947][ T30] audit: type=1326 audit(1769752464.814:969): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23886 comm="syz.2.3114" exe="/root/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1465.263713][ T30] audit: type=1326 audit(1769752464.814:970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23886 comm="syz.2.3114" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1465.417048][ T30] audit: type=1326 audit(1769752464.814:971): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23886 comm="syz.2.3114" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1465.808116][T13886] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 1465.963722][T23907] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3116'. [ 1468.103454][T23943] xt_policy: output policy not valid in PREROUTING and INPUT [ 1469.792820][T23956] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1470.167898][T13886] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 1470.391711][T13886] usb 4-1: device descriptor read/64, error -71 [ 1470.702068][T13886] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 1470.979735][T13886] usb 4-1: device descriptor read/64, error -71 [ 1471.128436][T23974] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3130'. [ 1471.367983][ T30] audit: type=1326 audit(1769752471.564:972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23971 comm="syz.0.3130" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1471.397978][T13886] usb usb4-port1: attempt power cycle [ 1471.419263][ T30] audit: type=1326 audit(1769752471.574:973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23971 comm="syz.0.3130" exe="/root/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1471.644757][ T30] audit: type=1326 audit(1769752471.574:974): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23971 comm="syz.0.3130" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1471.728101][ T30] audit: type=1326 audit(1769752471.574:975): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23971 comm="syz.0.3130" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1471.834480][T13886] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 1471.868446][T23975] ptrace attach of "./syz-executor exec"[5845] was attempted by "./syz-executor exec"[23975] [ 1472.039829][T13886] usb 4-1: device descriptor read/8, error -71 [ 1472.290992][T13886] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 1472.324106][T13886] usb 4-1: device descriptor read/8, error -71 [ 1472.477931][T13886] usb usb4-port1: unable to enumerate USB device [ 1472.815905][T23990] openvswitch: netlink: Flow key attr not present in new flow. [ 1473.107884][T18581] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 1473.299872][T18581] usb 1-1: device descriptor read/64, error -71 [ 1473.607900][ T797] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 1473.776568][T18581] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 1473.848291][ T797] usb 4-1: Using ep0 maxpacket: 8 [ 1473.862052][ T797] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1473.887942][ T797] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1473.942145][ T797] usb 4-1: config 0 has no interface number 0 [ 1473.986414][ T797] usb 4-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1474.002943][T18581] usb 1-1: device descriptor read/64, error -71 [ 1474.065438][ T797] usb 4-1: New USB device found, idVendor=0421, idProduct=008f, bcdDevice=ba.de [ 1474.108405][T24002] input: syz1 as /devices/virtual/input/input67 [ 1474.163783][T18581] usb usb1-port1: attempt power cycle [ 1474.198300][ T797] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1474.241890][ T797] usb 4-1: config 0 descriptor?? [ 1474.276683][ T797] usb 4-1: bad CDC descriptors [ 1474.287544][ T797] cdc_acm 4-1:0.1: Zero length descriptor references [ 1474.302081][ T797] cdc_acm 4-1:0.1: probe with driver cdc_acm failed with error -22 [ 1474.537916][T18581] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 1474.663574][T18581] usb 1-1: device descriptor read/8, error -71 [ 1474.908491][T18581] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 1475.014782][T18581] usb 1-1: device descriptor read/8, error -71 [ 1475.230933][T18581] usb usb1-port1: unable to enumerate USB device [ 1475.261724][T23978] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1475.271974][T23978] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1475.694908][T24012] netlink: 'syz.1.3138': attribute type 4 has an invalid length. [ 1475.702841][T24012] netlink: 17 bytes leftover after parsing attributes in process `syz.1.3138'. [ 1475.821853][T24013] delete_channel: no stack [ 1475.906920][T18581] usb 4-1: USB disconnect, device number 107 [ 1476.208532][T24020] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1476.299103][ T797] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 1476.487988][ T797] usb 1-1: device descriptor read/64, error -71 [ 1476.569896][T24027] usb usb8: usbfs: process 24027 (syz.3.3142) did not claim interface 0 before use [ 1477.417998][ T797] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 1477.558558][ T797] usb 1-1: device descriptor read/64, error -71 [ 1477.682590][ T797] usb usb1-port1: attempt power cycle [ 1478.048064][ T797] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 1478.108594][T24037] usb usb8: usbfs: process 24037 (syz.2.3143) did not claim interface 0 before use [ 1478.178964][ T797] usb 1-1: device descriptor read/8, error -71 [ 1478.360663][T24042] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3145'. [ 1478.457122][ T797] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 1478.525056][ T30] audit: type=1326 audit(1769752478.884:976): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24038 comm="syz.1.3145" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1478.603145][ T797] usb 1-1: device descriptor read/8, error -71 [ 1478.624860][ T30] audit: type=1326 audit(1769752478.884:977): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24038 comm="syz.1.3145" exe="/root/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1478.718154][ T797] usb usb1-port1: unable to enumerate USB device [ 1478.727455][ T30] audit: type=1326 audit(1769752478.884:978): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24038 comm="syz.1.3145" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1478.823733][ T30] audit: type=1326 audit(1769752478.884:979): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24038 comm="syz.1.3145" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1480.164817][T24060] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1480.721551][T24068] hub 9-0:1.0: USB hub found [ 1480.727964][T24068] hub 9-0:1.0: 1 port detected [ 1483.764212][T24096] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1484.374542][T24103] openvswitch: netlink: Message has 1 unknown bytes. [ 1484.381416][T24103] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1484.546904][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.553489][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1485.434079][T24097] ipip0: entered promiscuous mode [ 1485.439834][T24097] ipip0: entered allmulticast mode [ 1485.469701][T24097] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3153'. [ 1486.803815][T24127] xt_bpf: check failed: parse error [ 1487.228336][T13886] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 1487.267894][ T797] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 1487.388574][T13886] usb 1-1: Using ep0 maxpacket: 16 [ 1487.401276][T13886] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1487.448462][ T797] usb 4-1: Using ep0 maxpacket: 16 [ 1487.457592][ T797] usb 4-1: New USB device found, idVendor=25c6, idProduct=9002, bcdDevice=41.ba [ 1487.467445][ T797] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1487.476685][ T797] usb 4-1: Product: syz [ 1487.481213][ T797] usb 4-1: Manufacturer: syz [ 1487.489490][ T797] usb 4-1: SerialNumber: syz [ 1487.718305][T13886] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1487.848452][T13886] usb 1-1: Product: syz [ 1487.921668][T13886] usb 1-1: Manufacturer: syz [ 1487.934551][T13886] usb 1-1: SerialNumber: syz [ 1488.020903][T13886] r8152-cfgselector 1-1: Unknown version 0x0000 [ 1488.024519][ T797] usb 4-1: config 0 descriptor?? [ 1488.035757][T13886] r8152-cfgselector 1-1: config 0 descriptor?? [ 1488.250942][ T797] usb 4-1: can't set first interface for hiFace device. [ 1488.258341][ T797] snd-usb-hiface 4-1:0.0: probe with driver snd-usb-hiface failed with error -5 [ 1488.279957][T13886] r8152-cfgselector 1-1: Needed 1 retries to read version [ 1488.383452][T24139] vimc link validate: Scaler:src:16x16 (0x33424752, 12, 0, 4, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1488.444212][ T797] usb 4-1: USB disconnect, device number 108 [ 1488.647498][T24129] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3161'. [ 1488.656942][T13886] r8152-cfgselector 1-1: Unknown version 0x2460 [ 1488.714181][T13886] r8152-cfgselector 1-1: bad CDC descriptors [ 1489.222941][T13886] r8152-cfgselector 1-1: USB disconnect, device number 112 [ 1489.623476][T24150] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3166'. [ 1489.633188][T24150] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3166'. [ 1489.642672][T24150] netlink: 'syz.1.3166': attribute type 3 has an invalid length. [ 1489.650866][T24150] netlink: 11 bytes leftover after parsing attributes in process `syz.1.3166'. [ 1490.342005][T24166] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1494.575245][ T13] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1494.589154][ T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1494.633456][ T13] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1494.644921][ T13] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1494.817923][T18581] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 1495.247894][T18581] usb 4-1: Using ep0 maxpacket: 16 [ 1495.350062][T18581] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8 has an invalid bInterval 0, changing to 7 [ 1495.370387][T18581] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 1495.905910][T18581] usb 4-1: New USB device found, idVendor=077d, idProduct=0410, bcdDevice=ec.c1 [ 1495.917083][T18581] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1495.936835][T18581] usb 4-1: Product: syz [ 1495.951498][T18581] usb 4-1: Manufacturer: syz [ 1495.968920][T18581] usb 4-1: SerialNumber: syz [ 1495.990221][T18581] usb 4-1: config 0 descriptor?? [ 1497.397697][T18581] powermate 4-1:0.0: probe with driver powermate failed with error -5 [ 1497.468119][T18581] usb 4-1: USB disconnect, device number 109 [ 1497.537919][ T797] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 1497.728036][ T797] usb 1-1: device descriptor read/64, error -71 [ 1497.968369][T24242] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 1497.974929][T24242] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1497.997503][T24242] vhci_hcd vhci_hcd.0: Device attached [ 1498.080961][ T797] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 1498.168440][ T9] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 1498.246975][ T9] usb 35-1: new full-speed USB device number 5 using vhci_hcd [ 1498.256530][ T797] usb 1-1: device descriptor read/64, error -71 [ 1498.441803][ T797] usb usb1-port1: attempt power cycle [ 1498.860155][T24243] vhci_hcd: connection reset by peer [ 1498.998450][T16165] vhci_hcd vhci_hcd.1: stop threads [ 1499.003705][T16165] vhci_hcd vhci_hcd.1: release socket [ 1499.021756][T16165] vhci_hcd vhci_hcd.1: disconnect device [ 1499.180811][ T797] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 1499.238694][ T797] usb 1-1: device descriptor read/8, error -71 [ 1499.550410][ T797] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 1499.815367][ T797] usb 1-1: device descriptor read/8, error -71 [ 1499.948348][ T797] usb usb1-port1: unable to enumerate USB device [ 1500.116591][T24264] netlink: 'syz.3.3185': attribute type 4 has an invalid length. [ 1500.411723][T24266] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3186'. [ 1500.426767][T24266] netlink: 'syz.2.3186': attribute type 4 has an invalid length. [ 1500.444998][T24266] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1501.278790][T13886] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 1501.479253][T13886] usb 2-1: Using ep0 maxpacket: 32 [ 1501.494465][T13886] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 1501.976565][T13886] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 1501.990297][T13886] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 1502.004687][T13886] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 1502.020843][T13886] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 1502.043579][T13886] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 1502.053213][T13886] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1502.068511][T13886] usb 2-1: Product: syz [ 1502.081689][T13886] usb 2-1: Manufacturer: syz [ 1502.091835][T13886] usb 2-1: SerialNumber: syz [ 1502.132924][T13886] usb 2-1: config 0 descriptor?? [ 1502.263082][T24281] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1502.620723][T24284] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3191'. [ 1502.753980][T24285] netlink: 232 bytes leftover after parsing attributes in process `syz.2.3191'. [ 1503.178444][T13886] iforce 2-1:0.0: usb_submit_urb failed: -110 [ 1503.204352][T13886] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 1503.233071][T13886] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 1503.255562][T13886] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 1503.288358][T13886] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 1503.315487][T13886] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 1503.358929][T24298] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3204'. [ 1503.373281][T24298] netlink: 'syz.4.3204': attribute type 4 has an invalid length. [ 1503.394256][T24298] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1503.498443][ T9] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 1503.515886][T13886] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 1503.547324][T13886] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 1503.571826][T13886] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 1503.591307][T13886] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 1503.609319][T13886] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 1503.631143][T13886] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 1503.680020][T13886] iforce 2-1:0.0: usb_submit_urb failed: -32 [ 1503.869416][T13886] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1504.111680][T13886] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1504.144342][T13886] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1504.154032][T13886] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1504.168954][T13886] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1504.175461][T13886] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1504.182117][T13886] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1504.188565][T13886] input input69: Timeout waiting for response from device. [ 1504.236881][T13886] usb 2-1: USB disconnect, device number 87 [ 1504.768248][ T797] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 1504.898575][T13886] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 1505.058771][T13886] usb 2-1: Using ep0 maxpacket: 16 [ 1505.173959][T13886] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8 has an invalid bInterval 0, changing to 7 [ 1505.201171][T13886] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 1505.201212][ T797] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1505.218529][ T797] usb 4-1: can't read configurations, error -61 [ 1505.347617][T13886] usb 2-1: New USB device found, idVendor=077d, idProduct=0410, bcdDevice=ec.c1 [ 1505.357576][T13886] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1505.380410][T13886] usb 2-1: Product: syz [ 1505.387878][ T797] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 1505.388767][T13886] usb 2-1: Manufacturer: syz [ 1505.403168][T13886] usb 2-1: SerialNumber: syz [ 1505.451475][T13886] usb 2-1: config 0 descriptor?? [ 1505.580906][ T797] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1505.599114][ T797] usb 4-1: can't read configurations, error -61 [ 1505.620351][ T797] usb usb4-port1: attempt power cycle [ 1506.187932][ T797] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 1506.248454][ T797] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1506.256077][ T797] usb 4-1: can't read configurations, error -61 [ 1506.408606][ T797] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 1506.458474][ T797] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1506.491926][ T797] usb 4-1: can't read configurations, error -61 [ 1506.504524][ T797] usb usb4-port1: unable to enumerate USB device [ 1506.963640][T24329] usb usb8: usbfs: process 24329 (syz.2.3201) did not claim interface 0 before use [ 1507.503552][T24334] netlink: 196 bytes leftover after parsing attributes in process `syz.3.3202'. [ 1507.821698][T13886] powermate 2-1:0.0: probe with driver powermate failed with error -5 [ 1507.851065][T13886] usb 2-1: USB disconnect, device number 88 [ 1508.410722][T24341] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 1508.419576][T24341] openvswitch: netlink: Message has 16 unknown bytes. [ 1509.980973][T24362] ptrace attach of "./syz-executor exec"[5847] was attempted by "./syz-executor exec"[24362] [ 1510.957503][T24368] hub 9-0:1.0: USB hub found [ 1511.081123][T24368] hub 9-0:1.0: 1 port detected [ 1512.293960][T24399] netlink: 'syz.3.3213': attribute type 3 has an invalid length. [ 1513.457218][T24412] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1513.483123][T24411] usb usb1: check_ctrlrecip: process 24411 (syz.4.3216) requesting ep 01 but needs 81 [ 1513.506927][T24412] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1513.740287][T24411] input: syz1 as /devices/virtual/input/input71 [ 1514.102767][T13886] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 1514.275648][T24419] binder: 24414:24419 ioctl 4018620d 0 returned -22 [ 1514.615727][T13886] usb 2-1: Using ep0 maxpacket: 16 [ 1514.719169][T13886] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1514.769127][T13886] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1514.823204][T13886] usb 2-1: Product: syz [ 1514.827409][T13886] usb 2-1: Manufacturer: syz [ 1514.850498][T13886] usb 2-1: SerialNumber: syz [ 1515.393768][T13886] r8152-cfgselector 2-1: Unknown version 0x0000 [ 1515.524562][T13886] r8152-cfgselector 2-1: config 0 descriptor?? [ 1515.740722][T13886] r8152-cfgselector 2-1: Needed 1 retries to read version [ 1515.748271][T13886] r8152-cfgselector 2-1: Unknown version 0x2460 [ 1515.762779][T13886] r8152-cfgselector 2-1: bad CDC descriptors [ 1515.973833][T24410] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3215'. [ 1516.142772][T24436] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1516.304242][T13886] r8152-cfgselector 2-1: USB disconnect, device number 89 [ 1516.508435][ T9] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 1516.733373][ T9] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1516.741511][ T9] usb 4-1: can't read configurations, error -61 [ 1516.911365][ T9] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 1517.390028][ T9] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1517.428331][ T9] usb 4-1: can't read configurations, error -61 [ 1517.441178][ T9] usb usb4-port1: attempt power cycle [ 1517.498779][T24452] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1517.523592][T24452] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1517.905514][ T9] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 1517.964147][ T9] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1518.031286][ T9] usb 4-1: can't read configurations, error -61 [ 1518.188241][ T9] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 1518.221151][ T9] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1518.241074][ T9] usb 4-1: can't read configurations, error -61 [ 1518.345782][ T9] usb usb4-port1: unable to enumerate USB device [ 1519.610279][T24476] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3229'. [ 1520.566586][T24476] libceph: resolve '0..' (ret=-3): failed [ 1520.983517][T24490] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1521.109995][T24499] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1522.464817][T24509] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3234'. [ 1523.506047][T24512] netlink: 236 bytes leftover after parsing attributes in process `syz.0.3235'. [ 1523.573414][T24514] tipc: Enabled bearer , priority 0 [ 1523.683938][T24514] syzkaller0: entered promiscuous mode [ 1523.690262][T24514] syzkaller0: entered allmulticast mode [ 1523.978089][T20310] usb 4-1: new full-speed USB device number 118 using dummy_hcd [ 1524.004748][T24527] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1524.015040][T24527] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1524.057920][T13886] usb 2-1: new full-speed USB device number 90 using dummy_hcd [ 1524.147172][T20310] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1524.157601][T20310] usb 4-1: not running at top speed; connect to a high speed hub [ 1524.171026][T20310] usb 4-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 1524.181096][T20310] usb 4-1: config 5 interface 0 has no altsetting 1 [ 1524.198282][T20310] usb 4-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice=2a.70 [ 1524.215955][T20310] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1524.238639][T13886] usb 2-1: config 0 has an invalid interface number: 189 but max is 0 [ 1524.254988][T13886] usb 2-1: config 0 has no interface number 0 [ 1524.261483][T20310] usb 4-1: Product: syz [ 1524.265818][T13886] usb 2-1: config 0 interface 189 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1524.284253][T20310] usb 4-1: Manufacturer: syz [ 1524.302425][T20310] usb 4-1: SerialNumber: syz [ 1524.373005][T13886] usb 2-1: config 0 interface 189 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1524.406780][T13886] usb 2-1: config 0 interface 189 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 64 [ 1524.450992][T13886] usb 2-1: config 0 interface 189 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 1524.479793][T13886] usb 2-1: config 0 interface 189 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1524.517278][T13886] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 1524.534553][T13886] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1524.552699][T13886] usb 2-1: Product: syz [ 1524.563786][T13886] usb 2-1: Manufacturer: syz [ 1524.576126][T13886] usb 2-1: SerialNumber: syz [ 1524.595753][T13886] usb 2-1: config 0 descriptor?? [ 1524.614163][T24514] tipc: Resetting bearer [ 1524.636663][T24516] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 1524.661628][T24514] xt_TCPMSS: Only works on TCP SYN packets [ 1524.672438][T13886] ums-alauda 2-1:0.189: USB Mass Storage device detected [ 1524.836223][T24513] tipc: Resetting bearer [ 1524.956675][T20310] usb 4-1: USB disconnect, device number 118 [ 1524.996378][T13886] scsi host1: usb-storage 2-1:0.189 [ 1525.011821][T24513] tipc: Disabling bearer [ 1525.054609][T13886] usb 2-1: USB disconnect, device number 90 [ 1525.076051][T24118] udevd[24118]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:5.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1527.338612][T24562] loop0: detected capacity change from 0 to 2560 [ 1527.358431][T24562] Buffer I/O error on dev loop0, logical block 0, lost async page write [ 1527.366998][T24562] Buffer I/O error on dev loop0, logical block 1, lost async page write [ 1527.382801][T24118] Buffer I/O error on dev loop0, logical block 256, lost async page write [ 1527.439155][T24118] Buffer I/O error on dev loop0, logical block 257, lost async page write [ 1527.447688][T24118] Buffer I/O error on dev loop0, logical block 258, lost async page write [ 1527.463665][T24562] Buffer I/O error on dev loop0, logical block 2, lost async page write [ 1527.478132][T24118] Buffer I/O error on dev loop0, logical block 259, lost async page write [ 1527.486685][T24118] Buffer I/O error on dev loop0, logical block 260, lost async page write [ 1527.496889][T24118] Buffer I/O error on dev loop0, logical block 261, lost async page write [ 1527.519422][T24118] Buffer I/O error on dev loop0, logical block 262, lost async page write [ 1527.552501][T24567] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3247'. [ 1528.022038][T24561] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1528.076932][T24561] block device autoloading is deprecated and will be removed. [ 1528.640883][T24576] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3249'. [ 1528.652776][T24576] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3249'. [ 1528.663063][T24576] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3249'. [ 1528.673416][T24576] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3249'. [ 1528.683000][T24576] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3249'. [ 1529.197740][T24587] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1529.555322][T24594] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1530.588482][T24600] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 1530.595145][T24600] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1530.623501][T24600] vhci_hcd vhci_hcd.0: Device attached [ 1530.912010][T20310] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 1530.944491][T24607] xt_bpf: check failed: parse error [ 1531.011039][T20310] usb 39-1: new full-speed USB device number 4 using vhci_hcd [ 1531.536858][T24601] vhci_hcd: connection reset by peer [ 1531.543693][ T3520] vhci_hcd vhci_hcd.3: stop threads [ 1531.561714][ T3520] vhci_hcd vhci_hcd.3: release socket [ 1531.727857][ T3520] vhci_hcd vhci_hcd.3: disconnect device [ 1532.188431][T24621] fuse: Bad value for 'group_id' [ 1532.193473][T24621] fuse: Bad value for 'group_id' [ 1532.904676][T24626] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 1532.913221][T24626] openvswitch: netlink: Message has 16 unknown bytes. [ 1534.057816][T24641] netlink: 'syz.0.3260': attribute type 3 has an invalid length. [ 1534.268147][T24646] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1534.305942][T24646] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1534.644688][T24654] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3264'. [ 1534.838605][T13886] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 1535.031711][T13886] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1535.054169][T13886] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1535.072381][T13886] usb 2-1: Product: syz [ 1535.092798][T13886] usb 2-1: Manufacturer: syz [ 1535.108041][T13886] usb 2-1: SerialNumber: syz [ 1535.144710][T13886] usb 2-1: config 0 descriptor?? [ 1535.359276][T13886] hso 2-1:0.0: Failed to find INT IN ep [ 1535.365644][T13886] usb-storage 2-1:0.0: USB Mass Storage device detected [ 1535.401147][T24662] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1535.595734][T24653] syzkaller0: left promiscuous mode [ 1535.655265][T24653] bond4: left promiscuous mode [ 1535.665516][T24653] ipip0: left promiscuous mode [ 1536.129281][T20310] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 1536.737878][T13886] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 1536.942366][T24672] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3268'. [ 1537.407659][T13886] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD4, changing to 0x84 [ 1537.436216][T13886] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 51544, setting to 1024 [ 1537.507228][T18581] usb 2-1: USB disconnect, device number 91 [ 1537.574617][T13886] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 1537.741957][T24679] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3270'. [ 1537.903989][T13886] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1537.913872][T13886] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1537.960645][T13886] usb 4-1: Product: syz [ 1537.977865][T13886] usb 4-1: Manufacturer: syz [ 1538.005523][T13886] usb 4-1: SerialNumber: syz [ 1538.039669][T13886] usb 4-1: config 0 descriptor?? [ 1538.060862][T24666] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 1538.346038][T24666] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 1538.709641][T24695] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3272'. [ 1540.277926][T24709] input: syz0 as /devices/virtual/input/input73 [ 1540.674577][T24717] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3276'. [ 1540.837704][T24715] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1541.531876][T13886] usb 4-1: USB disconnect, device number 119 [ 1542.213662][T24739] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1545.193553][T24767] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3285'. [ 1545.482732][T13886] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 1545.825006][T13886] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD4, changing to 0x84 [ 1545.888068][T20310] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 1546.098294][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.104679][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1546.120763][T13886] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 51544, setting to 1024 [ 1546.132484][T13886] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 1546.160034][T13886] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1546.169207][T13886] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1546.177281][T13886] usb 2-1: Product: syz [ 1546.181557][T13886] usb 2-1: Manufacturer: syz [ 1546.186149][T13886] usb 2-1: SerialNumber: syz [ 1546.198020][T13886] usb 2-1: config 0 descriptor?? [ 1546.203707][T24764] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1546.313801][T20310] usb 4-1: config 0 has no interfaces? [ 1546.328015][T20310] usb 4-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 1546.357647][T20310] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1546.368880][T20310] usb 4-1: config 0 descriptor?? [ 1546.514530][T24764] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1548.191387][ T797] usb 4-1: USB disconnect, device number 120 [ 1548.325736][T18581] usb 2-1: USB disconnect, device number 92 [ 1548.509516][T24787] loop0: detected capacity change from 0 to 2560 [ 1548.532132][T24787] buffer_io_error: 315 callbacks suppressed [ 1548.532154][T24787] Buffer I/O error on dev loop0, logical block 0, lost async page write [ 1548.546874][T24787] Buffer I/O error on dev loop0, logical block 1, lost async page write [ 1548.555354][T24787] Buffer I/O error on dev loop0, logical block 2, lost async page write [ 1548.563810][T24787] Buffer I/O error on dev loop0, logical block 3, lost async page write [ 1548.792053][T24118] Buffer I/O error on dev loop0, logical block 256, lost async page write [ 1548.803708][T24118] Buffer I/O error on dev loop0, logical block 257, lost async page write [ 1548.858097][T24787] Buffer I/O error on dev loop0, logical block 4, lost async page write [ 1548.887892][T24118] Buffer I/O error on dev loop0, logical block 258, lost async page write [ 1548.910845][T24787] Buffer I/O error on dev loop0, logical block 5, lost async page write [ 1548.921013][T24787] Buffer I/O error on dev loop0, logical block 6, lost async page write [ 1550.170018][ T30] audit: type=1804 audit(1769752550.534:980): pid=24802 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.3290" name="/newroot/663/file1" dev="fuse" ino=1 res=1 errno=0 [ 1550.457598][T24808] binder: 24804:24808 ioctl 4018620d 0 returned -22 [ 1551.071678][T24818] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3296'. [ 1551.109008][ T30] audit: type=1326 audit(1769752551.404:981): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24813 comm="syz.4.3296" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1551.258550][ T30] audit: type=1326 audit(1769752551.404:982): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24813 comm="syz.4.3296" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1551.511744][ T30] audit: type=1326 audit(1769752551.414:983): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24813 comm="syz.4.3296" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1551.674460][ T30] audit: type=1326 audit(1769752551.414:984): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24813 comm="syz.4.3296" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1551.762456][ T30] audit: type=1326 audit(1769752551.414:985): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24813 comm="syz.4.3296" exe="/root/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1552.080307][ T30] audit: type=1326 audit(1769752551.414:986): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24813 comm="syz.4.3296" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1552.118009][ T30] audit: type=1326 audit(1769752551.414:987): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24813 comm="syz.4.3296" exe="/root/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1552.158165][ T30] audit: type=1326 audit(1769752551.414:988): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24813 comm="syz.4.3296" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1552.223298][T24825] ip6t_REJECT: ECHOREPLY is not supported [ 1552.307071][ T30] audit: type=1326 audit(1769752551.414:989): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24813 comm="syz.4.3296" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1553.228400][T24834] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1553.237592][T24834] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1554.376112][T24848] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3303'. [ 1557.523722][T24873] netlink: 'syz.1.3306': attribute type 3 has an invalid length. [ 1559.216159][T24897] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1559.248947][T24897] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1559.708778][T24887] bond_slave_0: left promiscuous mode [ 1559.729627][T24887] bond_slave_1: left promiscuous mode [ 1559.796900][T24887] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 1560.338466][T24893] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1560.404376][ T5076] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1560.429542][ T5076] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1560.471997][ T5076] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1560.481921][ T5076] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1560.938419][T24906] input: syz1 as /devices/virtual/input/input74 [ 1560.990357][T24909] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3313'. [ 1563.869663][T24944] hub 1-0:1.0: USB hub found [ 1563.878039][T24944] hub 1-0:1.0: 1 port detected [ 1566.029389][T24977] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1566.108792][T24962] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3324'. [ 1567.238518][T24987] openvswitch: netlink: Message has 1 unknown bytes. [ 1567.248096][T24987] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1567.776949][T24989] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3328'. [ 1567.847850][T13886] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 1568.055831][T13886] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1568.108371][T13886] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1568.160386][T13886] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1568.207949][T13886] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1568.308370][T13886] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1568.349723][T13886] usb 2-1: config 0 descriptor?? [ 1568.587178][T24999] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3331'. [ 1568.702962][T24999] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3331'. [ 1568.798610][T24999] netlink: 'syz.0.3331': attribute type 3 has an invalid length. [ 1568.913093][T24999] netlink: 11 bytes leftover after parsing attributes in process `syz.0.3331'. [ 1569.924456][T25016] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1571.482007][T25030] netlink: 'syz.0.3335': attribute type 2 has an invalid length. [ 1571.540501][T25032] netlink: 'syz.0.3335': attribute type 2 has an invalid length. [ 1571.543579][T25030] !: entered promiscuous mode [ 1572.352799][T25034] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3336'. [ 1572.808989][T13886] usbhid 2-1:0.0: can't add hid device: -71 [ 1572.815169][T13886] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1572.839932][T13886] usb 2-1: USB disconnect, device number 93 [ 1573.614612][T25048] xt_CT: No such helper "snmp" [ 1573.962319][T25054] ip6t_REJECT: ECHOREPLY is not supported [ 1575.397939][T25067] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1575.713343][T25065] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3344'. [ 1575.733882][T25065] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3344'. [ 1575.773274][T25078] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3346'. [ 1575.801608][T25065] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3344'. [ 1575.874623][T25065] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3344'. [ 1576.204837][T25065] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3344'. [ 1576.224645][T25065] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3344'. [ 1576.871537][T20310] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 1577.457901][T20310] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD4, changing to 0x84 [ 1577.498612][T20310] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 51544, setting to 1024 [ 1577.529717][T20310] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 1577.564644][T20310] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1577.574186][T20310] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1577.588239][T20310] usb 2-1: Product: syz [ 1577.600106][T20310] usb 2-1: Manufacturer: syz [ 1577.604904][T20310] usb 2-1: SerialNumber: syz [ 1577.619631][T20310] usb 2-1: config 0 descriptor?? [ 1577.658823][T25087] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1577.858259][T25096] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1578.218601][T25086] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1579.627178][T25110] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1580.416257][ T797] usb 2-1: USB disconnect, device number 94 [ 1580.431136][T25120] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3353'. [ 1580.687025][T25118] tipc: Failed to remove unknown binding: 66,1,1/2130706433:61441320/61441322 [ 1580.720540][T25118] tipc: Failed to remove unknown binding: 66,1,1/2130706433:61441320/61441322 [ 1580.734942][T25118] tipc: Failed to remove unknown binding: 66,1,1/2130706433:61441320/61441322 [ 1580.937978][T25127] ip6t_REJECT: ECHOREPLY is not supported [ 1580.996809][T25128] sctp: [Deprecated]: syz.4.3355 (pid 25128) Use of int in maxseg socket option. [ 1580.996809][T25128] Use struct sctp_assoc_value instead [ 1582.476122][T25145] input: syz0 as /devices/virtual/input/input75 [ 1582.576010][T25147] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1583.208835][T25152] netlink: 'syz.4.3360': attribute type 2 has an invalid length. [ 1583.800116][T25160] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3361'. [ 1583.815351][T25160] netlink: 'syz.1.3361': attribute type 4 has an invalid length. [ 1584.030911][T25163] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1585.244965][T25182] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1585.254377][T25182] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1587.818348][ T797] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 1587.995862][ T797] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1588.040710][T25219] xt_bpf: check failed: parse error [ 1588.304950][ T797] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1588.387556][ T797] usb 2-1: Product: syz [ 1588.396926][ T797] usb 2-1: Manufacturer: syz [ 1588.404214][T25221] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3370'. [ 1588.413466][ T797] usb 2-1: SerialNumber: syz [ 1588.593944][ T797] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1588.715429][T18581] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1589.089571][T25230] openvswitch: netlink: Message has 1 unknown bytes. [ 1589.096440][T25230] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1589.219365][T25231] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1589.239535][T25231] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1589.945771][T18581] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1590.208774][T18581] ath9k_htc: Failed to initialize the device [ 1590.423616][T25242] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1590.848851][T18581] usb 2-1: ath9k_htc: USB layer deinitialized [ 1591.059346][ T9] usb 2-1: USB disconnect, device number 95 [ 1591.519460][T25247] input: syz0 as /devices/virtual/input/input76 [ 1592.571664][T25263] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3380'. [ 1592.765700][T25266] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3377'. [ 1592.779788][T25266] netlink: 'syz.0.3377': attribute type 4 has an invalid length. [ 1592.791830][T25266] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1593.085290][T25269] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3388'. [ 1594.858441][ T9] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 1595.090403][T25285] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3384'. [ 1595.116777][ T9] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD4, changing to 0x84 [ 1595.285358][T25285] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3384'. [ 1595.294429][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 51544, setting to 1024 [ 1595.315814][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 1595.341893][T25289] netlink: 'syz.2.3383': attribute type 2 has an invalid length. [ 1595.366707][T25289] !: entered promiscuous mode [ 1595.388340][T25289] netlink: 'syz.2.3383': attribute type 2 has an invalid length. [ 1595.425193][ T9] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1595.434593][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1595.442977][ T9] usb 1-1: Product: syz [ 1595.447293][ T9] usb 1-1: Manufacturer: syz [ 1595.452595][ T9] usb 1-1: SerialNumber: syz [ 1595.459940][T25285] netlink: 'syz.3.3384': attribute type 11 has an invalid length. [ 1595.593539][ T9] usb 1-1: config 0 descriptor?? [ 1595.599441][T25279] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1596.162036][T25302] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 1596.178706][T25279] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1596.266853][T25303] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3387'. [ 1596.276166][T25303] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3387'. [ 1597.607429][T25314] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1597.621759][T25314] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1597.762515][T25314] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1597.804769][T25314] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1597.989187][T25321] fuse: Invalid rootmode [ 1598.006166][ T30] kauditd_printk_skb: 41 callbacks suppressed [ 1598.006184][ T30] audit: type=1326 audit(1769752598.344:1031): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25315 comm="syz.1.3391" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1598.040493][ T30] audit: type=1326 audit(1769752598.344:1032): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25315 comm="syz.1.3391" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1598.066574][ T30] audit: type=1326 audit(1769752598.344:1033): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25315 comm="syz.1.3391" exe="/root/syz-executor" sig=0 arch=40000003 syscall=14 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1598.094636][ T30] audit: type=1326 audit(1769752598.344:1034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25315 comm="syz.1.3391" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1598.151602][ T30] audit: type=1326 audit(1769752598.344:1035): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25315 comm="syz.1.3391" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1598.192814][T25322] input: syz0 as /devices/virtual/input/input77 [ 1598.219601][ T30] audit: type=1326 audit(1769752598.344:1036): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25315 comm="syz.1.3391" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1598.288879][ T30] audit: type=1326 audit(1769752598.354:1037): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25315 comm="syz.1.3391" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1598.343837][ T30] audit: type=1326 audit(1769752598.354:1038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25315 comm="syz.1.3391" exe="/root/syz-executor" sig=0 arch=40000003 syscall=21 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1598.479314][ T30] audit: type=1326 audit(1769752598.354:1039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25315 comm="syz.1.3391" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1598.534882][ T30] audit: type=1326 audit(1769752598.354:1040): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25315 comm="syz.1.3391" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1598.560985][ T9] usb 1-1: USB disconnect, device number 117 [ 1599.774549][T25344] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3397'. [ 1601.469968][T25360] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3409'. [ 1601.631334][T25363] input: syz0 as /devices/virtual/input/input78 [ 1601.992250][T25367] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3400'. [ 1602.816947][T25376] netlink: 'syz.1.3401': attribute type 4 has an invalid length. [ 1602.839128][T25376] netlink: 17 bytes leftover after parsing attributes in process `syz.1.3401'. [ 1602.884406][T25377] IPv6: Can't replace route, no match found [ 1602.894187][T25377] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3402'. [ 1602.903301][T25377] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3402'. [ 1603.032605][T25376] delete_channel: no stack [ 1603.587002][T25389] vhci_hcd vhci_hcd.0: pdev(0) rhport(2) sockfd(17) [ 1603.593638][T25389] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1603.794207][T25386] vhci_hcd vhci_hcd.0: pdev(0) rhport(1) sockfd(14) [ 1603.800849][T25386] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1603.810404][T25380] vhci_hcd vhci_hcd.0: port 0 already used [ 1603.845727][T25386] vhci_hcd vhci_hcd.0: Device attached [ 1603.879818][T25389] vhci_hcd vhci_hcd.0: Device attached [ 1603.925963][T25393] vhci_hcd vhci_hcd.0: pdev(0) rhport(3) sockfd(20) [ 1603.932591][T25393] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1604.001464][T25393] vhci_hcd vhci_hcd.0: Device attached [ 1604.036543][T25386] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(23) [ 1604.043186][T25386] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 1604.091862][T25380] vhci_hcd vhci_hcd.0: pdev(0) rhport(4) sockfd(13) [ 1604.098501][T25380] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1604.107309][T25386] vhci_hcd vhci_hcd.0: Device attached [ 1604.138480][T25389] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1604.151239][T25380] vhci_hcd vhci_hcd.0: Device attached [ 1604.181361][T25380] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1604.193160][T25380] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1604.219026][T25380] vhci_hcd vhci_hcd.0: pdev(0) rhport(1) sockfd(31) [ 1604.225685][T25380] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 1604.389247][T25380] vhci_hcd vhci_hcd.0: Device attached [ 1604.450436][T25397] vhci_hcd: connection closed [ 1604.450962][ T1334] vhci_hcd vhci_hcd.0: stop threads [ 1604.452130][T25394] vhci_hcd: connection closed [ 1604.455799][ T1334] vhci_hcd vhci_hcd.0: release socket [ 1604.462035][T25387] vhci_hcd: connection closed [ 1604.478837][T25390] vhci_hcd: connection closed [ 1604.489237][T25396] vhci_hcd: connection closed [ 1604.501417][ T1334] vhci_hcd vhci_hcd.0: disconnect device [ 1604.577505][ T1334] vhci_hcd vhci_hcd.0: stop threads [ 1604.583229][ T1334] vhci_hcd vhci_hcd.0: release socket [ 1604.592433][ T1334] vhci_hcd vhci_hcd.0: disconnect device [ 1604.599410][ T1334] vhci_hcd vhci_hcd.0: stop threads [ 1604.605829][ T1334] vhci_hcd vhci_hcd.0: release socket [ 1604.612562][ T1334] vhci_hcd vhci_hcd.0: disconnect device [ 1604.628229][ T1334] vhci_hcd vhci_hcd.0: stop threads [ 1604.633766][ T1334] vhci_hcd vhci_hcd.0: release socket [ 1604.663524][ T1334] vhci_hcd vhci_hcd.0: disconnect device [ 1604.740108][ T1334] vhci_hcd vhci_hcd.0: stop threads [ 1604.784811][ T1334] vhci_hcd vhci_hcd.0: release socket [ 1604.791963][ T1334] vhci_hcd vhci_hcd.0: disconnect device [ 1605.239047][T25402] vhci_hcd: connection closed [ 1605.250414][ T5076] vhci_hcd vhci_hcd.0: stop threads [ 1605.291577][ T5076] vhci_hcd vhci_hcd.0: release socket [ 1605.302416][ T5076] vhci_hcd vhci_hcd.0: disconnect device [ 1605.590011][T25409] syz.2.3406 (25409): drop_caches: 2 [ 1605.643378][T25409] syz.2.3406 (25409): drop_caches: 2 [ 1607.256486][T25437] binder: 25434:25437 ioctl 4018620d 0 returned -22 [ 1607.412277][T25441] syz_tun: entered promiscuous mode [ 1607.421728][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.429494][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.563776][T25441] macsec1: entered allmulticast mode [ 1607.736685][T25441] syz_tun: entered allmulticast mode [ 1607.888919][T25441] syz_tun: left allmulticast mode [ 1607.960232][T25441] syz_tun: left promiscuous mode [ 1608.315374][T25453] program syz.3.3416 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1608.339967][T25453] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3416'. [ 1608.349561][T25447] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1608.406368][T25453] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3416'. [ 1609.934784][T25463] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1610.798883][T25466] program syz.2.3419 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1610.866452][T25466] syz.2.3419 (25466): drop_caches: 2 [ 1611.247679][T25475] input: syz1 as /devices/virtual/input/input79 [ 1611.674014][T25480] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 1613.342101][T25498] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3425'. [ 1614.743978][T18581] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 1614.964176][T18581] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1615.037232][T18581] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1615.070109][T18581] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1615.128849][T18581] usb 4-1: Product: syz [ 1615.143134][T18581] usb 4-1: Manufacturer: syz [ 1615.153308][T18581] usb 4-1: SerialNumber: syz [ 1615.173831][T18581] usb 4-1: config 0 descriptor?? [ 1615.291138][T18581] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 1615.314743][T24118] udevd[24118]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1615.745172][T25523] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1616.889285][T25541] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1617.077694][T25537] binder: 25531:25537 ioctl 4018620d 0 returned -22 [ 1617.549140][T13886] usb 4-1: USB disconnect, device number 121 [ 1619.243286][T25563] sctp: [Deprecated]: syz.1.3435 (pid 25563) Use of int in maxseg socket option. [ 1619.243286][T25563] Use struct sctp_assoc_value instead [ 1619.568037][T25568] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1619.684350][T25575] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3438'. [ 1619.709958][T25575] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3438'. [ 1621.066534][T25585] netlink: 'syz.3.3441': attribute type 2 has an invalid length. [ 1621.087363][T25585] !: entered promiscuous mode [ 1621.155588][T25582] netlink: 'syz.3.3441': attribute type 2 has an invalid length. [ 1622.258395][T18581] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 1622.468752][T18581] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1622.532332][T25598] syz.4.3443 (25598): drop_caches: 2 [ 1622.574941][T18581] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1622.721062][T18581] usb 2-1: New USB device found, idVendor=0079, idProduct=1846, bcdDevice= 0.00 [ 1622.732595][T18581] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1622.940670][T18581] usb 2-1: config 0 descriptor?? [ 1623.378485][T25604] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1623.621333][T25610] xt_bpf: check failed: parse error [ 1623.730669][T18581] usbhid 2-1:0.0: can't add hid device: -71 [ 1623.736701][T18581] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1623.762166][T18581] usb 2-1: USB disconnect, device number 96 [ 1624.278472][T25616] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3446'. [ 1626.155740][T25641] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1626.862161][T25646] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3451'. [ 1628.555512][T25663] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3455'. [ 1628.574831][T25663] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3455'. [ 1628.590655][T25663] netlink: 'syz.2.3455': attribute type 3 has an invalid length. [ 1628.600162][T25663] netlink: 11 bytes leftover after parsing attributes in process `syz.2.3455'. [ 1628.821718][T25671] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1631.014446][T25697] input: syz0 as /devices/virtual/input/input80 [ 1633.081974][T25721] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3469'. [ 1633.105308][T25722] hsr0: entered promiscuous mode [ 1633.112813][T25722] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3467'. [ 1633.186918][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 1633.186937][ T30] audit: type=1326 audit(1769752633.434:1058): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25715 comm="syz.3.3469" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743d539 code=0x7ffc0000 [ 1633.228837][T25722] hsr_slave_0: left promiscuous mode [ 1633.238305][T25722] hsr_slave_1: left promiscuous mode [ 1633.367291][T25722] hsr0 (unregistering): left promiscuous mode [ 1633.377901][ T30] audit: type=1326 audit(1769752633.434:1059): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25715 comm="syz.3.3469" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743d539 code=0x7ffc0000 [ 1633.567995][ T30] audit: type=1326 audit(1769752633.434:1060): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25715 comm="syz.3.3469" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf743d539 code=0x7ffc0000 [ 1633.598326][ T30] audit: type=1326 audit(1769752633.434:1061): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25715 comm="syz.3.3469" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743d539 code=0x7ffc0000 [ 1633.873543][T25712] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3465'. [ 1633.937450][ T30] audit: type=1326 audit(1769752633.434:1062): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25715 comm="syz.3.3469" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743d539 code=0x7ffc0000 [ 1634.050022][ T30] audit: type=1326 audit(1769752633.434:1063): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25715 comm="syz.3.3469" exe="/root/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf743d539 code=0x7ffc0000 [ 1634.113377][ T30] audit: type=1326 audit(1769752633.434:1064): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25715 comm="syz.3.3469" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743d539 code=0x7ffc0000 [ 1634.227440][ T30] audit: type=1326 audit(1769752633.434:1065): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25715 comm="syz.3.3469" exe="/root/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf743d539 code=0x7ffc0000 [ 1634.558548][ T30] audit: type=1326 audit(1769752633.434:1066): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25715 comm="syz.3.3469" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf743d539 code=0x7ffc0000 [ 1634.806532][ T30] audit: type=1326 audit(1769752633.434:1067): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25715 comm="syz.3.3469" exe="/root/syz-executor" sig=0 arch=40000003 syscall=427 compat=1 ip=0xf743d539 code=0x7ffc0000 [ 1636.446798][T25747] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1637.267030][T25755] xt_bpf: check failed: parse error [ 1637.535831][T25759] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1637.558256][T13886] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 1637.612304][T25765] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3477'. [ 1637.788817][T25759] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1637.817944][T13886] usb 4-1: device descriptor read/64, error -71 [ 1638.187880][T13886] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 1638.632751][T25772] input: syz0 as /devices/virtual/input/input81 [ 1638.849251][T13886] usb 4-1: device descriptor read/64, error -71 [ 1638.969407][T13886] usb usb4-port1: attempt power cycle [ 1639.484940][T13886] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 1639.747969][T18581] usb 1-1: new full-speed USB device number 118 using dummy_hcd [ 1639.795482][T13886] usb 4-1: device not accepting address 124, error -71 [ 1639.951842][T18581] usb 1-1: config 0 has an invalid interface number: 133 but max is 0 [ 1639.961102][T18581] usb 1-1: config 0 has no interface number 0 [ 1639.967197][T18581] usb 1-1: config 0 interface 133 altsetting 0 endpoint 0x82 has invalid maxpacket 288, setting to 64 [ 1640.035060][T18581] usb 1-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 1640.051655][T18581] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1640.071259][T18581] usb 1-1: Product: syz [ 1640.078178][T18581] usb 1-1: Manufacturer: syz [ 1640.084054][T18581] usb 1-1: SerialNumber: syz [ 1640.096742][T18581] usb 1-1: config 0 descriptor?? [ 1640.114201][T25777] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 1640.432712][T25785] program syz.1.3481 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1640.490914][T25785] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3481'. [ 1640.532244][T25785] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3481'. [ 1641.243358][T25792] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1641.253846][T25792] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1642.454483][T25806] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1643.783608][T18581] keyspan 1-1:0.133: Keyspan 1 port adapter converter detected [ 1643.801698][T18581] keyspan 1-1:0.133: found no endpoint descriptor for endpoint 81 [ 1643.809963][T18581] keyspan 1-1:0.133: found no endpoint descriptor for endpoint 1 [ 1643.835945][T18581] keyspan 1-1:0.133: found no endpoint descriptor for endpoint 2 [ 1643.907422][T18581] usb 1-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 1643.935282][T18581] usb 1-1: USB disconnect, device number 118 [ 1643.951532][T18581] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 1643.979716][T18581] keyspan 1-1:0.133: device disconnected [ 1644.358358][T18581] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 1645.054955][T18581] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1645.600117][T18581] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1645.824185][T18581] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1645.901444][T18581] usb 1-1: Product: syz [ 1645.905659][T18581] usb 1-1: Manufacturer: syz [ 1645.938433][T18581] usb 1-1: SerialNumber: syz [ 1646.049122][T18581] usb 1-1: config 0 descriptor?? [ 1646.134618][T18581] snd-usb-audio 1-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 1646.387194][T25845] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 1646.426621][T24118] udevd[24118]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1647.429635][T25849] openvswitch: netlink: Message has 1 unknown bytes. [ 1647.436353][T25849] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1647.527563][T25828] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1647.879684][T25855] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3494'. [ 1648.020352][T25858] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3494'. [ 1648.150330][T25828] tipc: Disabling bearer [ 1648.165547][T16165] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1648.177103][T16165] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1648.286572][T16165] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1648.445997][T25861] syz.4.3496 (25861): drop_caches: 2 [ 1648.553046][T25861] syz.4.3496 (25861): drop_caches: 2 [ 1648.570106][T25837] usb 1-1: USB disconnect, device number 119 [ 1648.922974][T25872] snd_dummy snd_dummy.0: control 1:-1:-8:syz0:32 is already present [ 1649.296847][T25882] fuse: Unknown parameter 'mGN‡8o«ad' [ 1649.638376][T25836] usb 2-1: new full-speed USB device number 97 using dummy_hcd [ 1649.802949][T25836] usb 2-1: config 0 has an invalid interface number: 133 but max is 0 [ 1649.830117][T25836] usb 2-1: config 0 has no interface number 0 [ 1649.876285][T25836] usb 2-1: config 0 interface 133 altsetting 0 endpoint 0x82 has invalid maxpacket 288, setting to 64 [ 1650.123987][T25836] usb 2-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 1650.158829][T25836] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1650.208988][T25836] usb 2-1: Product: syz [ 1650.217333][T25836] usb 2-1: Manufacturer: syz [ 1650.238696][T25836] usb 2-1: SerialNumber: syz [ 1650.277541][T25836] usb 2-1: config 0 descriptor?? [ 1650.304165][T25883] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1650.628721][T18581] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 1650.825976][T18581] usb 1-1: Using ep0 maxpacket: 16 [ 1650.898951][T25897] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1650.911492][T25897] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1650.924160][T18581] usb 1-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 1650.938470][T18581] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1650.946614][T18581] usb 1-1: Product: syz [ 1651.099019][T18581] usb 1-1: Manufacturer: syz [ 1651.105926][T18581] usb 1-1: SerialNumber: syz [ 1651.122695][T18581] usb 1-1: config 0 descriptor?? [ 1651.142706][T18581] safe_serial 1-1:0.0: safe_serial converter detected [ 1651.156577][T18581] usb 1-1: safe_serial converter now attached to ttyUSB0 [ 1651.454977][T25904] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1652.484663][T25836] keyspan 2-1:0.133: Keyspan 1 port adapter converter detected [ 1652.529619][T25836] keyspan 2-1:0.133: found no endpoint descriptor for endpoint 81 [ 1652.564808][T25836] keyspan 2-1:0.133: found no endpoint descriptor for endpoint 1 [ 1652.583848][T25836] keyspan 2-1:0.133: found no endpoint descriptor for endpoint 2 [ 1652.633527][T25836] usb 2-1: Keyspan 1 port adapter converter now attached to ttyUSB1 [ 1652.715840][T25836] usb 2-1: USB disconnect, device number 97 [ 1652.763024][T25836] keyspan_1 ttyUSB1: Keyspan 1 port adapter converter now disconnected from ttyUSB1 [ 1652.836853][T25836] keyspan 2-1:0.133: device disconnected [ 1654.227072][T18581] usb 1-1: USB disconnect, device number 120 [ 1654.239310][T18581] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 1654.394466][T18581] safe_serial 1-1:0.0: device disconnected [ 1654.787054][T25933] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3510'. [ 1654.796994][T25933] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3510'. [ 1654.886970][T25938] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1657.782333][T25960] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1658.039228][T25962] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3515'. [ 1658.078707][ T30] kauditd_printk_skb: 78 callbacks suppressed [ 1658.078723][ T30] audit: type=1326 audit(1769752658.384:1146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25957 comm="syz.1.3515" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1658.140537][T25955] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3514'. [ 1658.168984][T25955] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3514'. [ 1658.258693][ T30] audit: type=1326 audit(1769752658.384:1147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25957 comm="syz.1.3515" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1658.298874][T25955] netlink: 'syz.4.3514': attribute type 3 has an invalid length. [ 1658.318889][T25955] netlink: 11 bytes leftover after parsing attributes in process `syz.4.3514'. [ 1658.423469][ T30] audit: type=1326 audit(1769752658.384:1148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25957 comm="syz.1.3515" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1658.489665][ T30] audit: type=1326 audit(1769752658.384:1149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25957 comm="syz.1.3515" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1658.682904][ T30] audit: type=1326 audit(1769752658.384:1150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25957 comm="syz.1.3515" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1658.838785][ T30] audit: type=1326 audit(1769752658.384:1151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25957 comm="syz.1.3515" exe="/root/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1658.894151][ T30] audit: type=1326 audit(1769752658.384:1152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25957 comm="syz.1.3515" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1658.990273][T25970] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1659.182332][ T30] audit: type=1326 audit(1769752658.384:1153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25957 comm="syz.1.3515" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1659.603903][ T30] audit: type=1326 audit(1769752658.384:1154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25957 comm="syz.1.3515" exe="/root/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1659.658735][ T30] audit: type=1326 audit(1769752658.384:1155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25957 comm="syz.1.3515" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 1660.346522][T25983] netlink: 'syz.4.3518': attribute type 2 has an invalid length. [ 1660.365556][T25983] !: entered promiscuous mode [ 1660.409926][T25983] netlink: 'syz.4.3518': attribute type 2 has an invalid length. [ 1660.435125][T18581] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 1661.070052][T18581] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD4, changing to 0x84 [ 1661.083968][T18581] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 51544, setting to 1024 [ 1661.116276][T18581] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 1661.160444][T18581] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1661.178941][T18581] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1661.197280][T18581] usb 1-1: Product: syz [ 1661.202542][T18581] usb 1-1: Manufacturer: syz [ 1661.207155][T18581] usb 1-1: SerialNumber: syz [ 1661.241107][T18581] usb 1-1: config 0 descriptor?? [ 1661.265594][T25977] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1661.350412][T25995] netlink: 'syz.2.3521': attribute type 10 has an invalid length. [ 1661.392864][T25995] netlink: 'syz.2.3521': attribute type 10 has an invalid length. [ 1661.411566][T25995] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3521'. [ 1661.499979][T25977] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1661.511139][T25997] program syz.4.3524 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1661.638441][T25837] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 1661.660071][T25997] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3524'. [ 1661.688392][T25997] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3524'. [ 1661.728430][T25836] usb 1-1: USB disconnect, device number 121 [ 1661.792489][T25837] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1661.807486][T25837] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1661.825381][T25837] usb 4-1: New USB device found, idVendor=0079, idProduct=1846, bcdDevice= 0.00 [ 1661.856728][T25837] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1661.886701][T25837] usb 4-1: config 0 descriptor?? [ 1662.399546][T25837] usbhid 4-1:0.0: can't add hid device: -71 [ 1662.406267][T25837] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1662.429594][T25837] usb 4-1: USB disconnect, device number 126 [ 1662.538755][T25836] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 1662.643453][T26009] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3528'. [ 1662.859008][T25836] usb 2-1: Using ep0 maxpacket: 32 [ 1662.873381][T25836] usb 2-1: config 1 interface 0 altsetting 95 bulk endpoint 0x82 has invalid maxpacket 64 [ 1662.884321][T25836] usb 2-1: config 1 interface 0 altsetting 95 bulk endpoint 0x3 has invalid maxpacket 16 [ 1662.912949][T25836] usb 2-1: config 1 interface 0 altsetting 95 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1662.932285][T25836] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1662.950352][T25836] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1662.964727][T25836] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1662.976207][T25836] usb 2-1: Product: syz [ 1662.994228][T25836] usb 2-1: Manufacturer: syz [ 1663.007528][T25836] usb 2-1: SerialNumber: syz [ 1663.034989][T26004] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1663.043566][T26004] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1663.464954][T26019] syz_tun: entered promiscuous mode [ 1663.472068][T26019] macsec1: entered allmulticast mode [ 1663.477435][T26019] syz_tun: entered allmulticast mode [ 1663.669206][T26004] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1663.751086][T26004] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1663.894078][T26019] syz_tun: left allmulticast mode [ 1663.932896][T26019] syz_tun: left promiscuous mode [ 1664.670431][T25836] usb 2-1: bad CDC descriptors [ 1665.128927][T25836] usb 2-1: USB disconnect, device number 98 [ 1668.070264][T26060] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3536'. [ 1668.906439][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.918990][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1668.990318][T26071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1669.261924][T26071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1669.498874][T26076] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3538'. [ 1669.511702][T26076] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3538'. [ 1670.240606][T26086] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3543'. [ 1673.176260][T26110] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3545'. [ 1673.703464][T26125] xt_bpf: check failed: parse error [ 1674.590268][T26134] netlink: 'syz.1.3551': attribute type 2 has an invalid length. [ 1674.610179][T26134] !: entered promiscuous mode [ 1674.705939][T26133] netlink: 'syz.1.3551': attribute type 2 has an invalid length. [ 1676.931192][T26146] syz.3.3556 (26146): drop_caches: 2 [ 1677.264644][T26158] bridge0: port 2(bridge_slave_1) entered disabled state [ 1677.272044][T26158] bridge0: port 1() entered disabled state [ 1677.626715][T26163] ptrace attach of "./syz-executor exec"[5846] was attempted by "./syz-executor exec"[26163] [ 1677.959794][T26163] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3565'. [ 1678.075639][T26170] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3558'. [ 1678.385906][ T5076] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1678.477120][ T5076] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1678.499833][ T5076] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1678.529140][ T5076] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1678.553301][ T5076] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1678.577465][ T5076] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1678.611711][ T5076] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1678.645477][ T5076] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1678.927823][T26181] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1678.994183][T26184] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3559'. [ 1679.039138][ T30] kauditd_printk_skb: 58 callbacks suppressed [ 1679.039151][ T30] audit: type=1326 audit(1769752679.334:1214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26171 comm="syz.2.3559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1679.199700][ T30] audit: type=1326 audit(1769752679.334:1215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26171 comm="syz.2.3559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1679.423116][ T30] audit: type=1326 audit(1769752679.334:1216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26171 comm="syz.2.3559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1679.446040][T13534] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 1679.560505][ T30] audit: type=1326 audit(1769752679.334:1217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26171 comm="syz.2.3559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1679.608882][T13534] usb 1-1: Using ep0 maxpacket: 16 [ 1679.616721][T13534] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1679.669748][T13534] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1679.688786][ T30] audit: type=1326 audit(1769752679.334:1218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26171 comm="syz.2.3559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1679.718808][T13534] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1679.786190][T13534] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1679.804333][ T30] audit: type=1326 audit(1769752679.334:1219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26171 comm="syz.2.3559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1679.828950][T13534] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1679.836972][T13534] usb 1-1: Manufacturer: syz [ 1679.863508][ T30] audit: type=1326 audit(1769752679.334:1220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26171 comm="syz.2.3559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1679.894129][T13534] usb 1-1: config 0 descriptor?? [ 1680.094922][T26190] hub 9-0:1.0: USB hub found [ 1680.100762][T26190] hub 9-0:1.0: 1 port detected [ 1680.102694][ T30] audit: type=1326 audit(1769752679.344:1221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26171 comm="syz.2.3559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1680.240347][T26192] macsec1: entered allmulticast mode [ 1680.245708][T26192] syz_tun: entered allmulticast mode [ 1680.279967][T26192] syz_tun: left allmulticast mode [ 1680.376397][ T30] audit: type=1326 audit(1769752679.344:1222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26171 comm="syz.2.3559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1680.596907][ T30] audit: type=1326 audit(1769752679.344:1223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26171 comm="syz.2.3559" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 1682.616119][T25837] usb 1-1: USB disconnect, device number 122 [ 1683.278388][T25837] usb 4-1: new full-speed USB device number 127 using dummy_hcd [ 1683.525023][T25837] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1683.537131][T25837] usb 4-1: not running at top speed; connect to a high speed hub [ 1683.563345][T25837] usb 4-1: config 12 has an invalid interface number: 187 but max is 0 [ 1683.573014][T25837] usb 4-1: config 12 has no interface number 0 [ 1683.580924][T25837] usb 4-1: config 12 interface 187 altsetting 64 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 1683.644235][T25837] usb 4-1: config 12 interface 187 has no altsetting 0 [ 1683.781371][T26230] No memory to map [ 1683.984820][T25837] usb 4-1: New USB device found, idVendor=110a, idProduct=1130, bcdDevice=4e.fa [ 1684.005330][T25837] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1684.093023][T26227] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1684.492192][T25837] usb 4-1: Product: syz [ 1684.497635][T25837] usb 4-1: Manufacturer: syz [ 1684.508696][T25837] usb 4-1: SerialNumber: syz [ 1684.528555][T26217] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1686.904937][T26253] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3574'. [ 1687.855737][T25837] ti_usb_3410_5052 4-1:12.187: TI USB 3410 1 port adapter converter detected [ 1687.870337][T25837] ti_usb_3410_5052 4-1:12.187: missing endpoints [ 1687.909093][T25837] usb 4-1: USB disconnect, device number 127 [ 1688.690752][T26275] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3577'. [ 1688.763014][ T30] kauditd_printk_skb: 37 callbacks suppressed [ 1688.763033][ T30] audit: type=1326 audit(1769752689.014:1261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26268 comm="syz.0.3577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1688.946748][ T30] audit: type=1326 audit(1769752689.014:1262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26268 comm="syz.0.3577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1689.171373][ T30] audit: type=1326 audit(1769752689.014:1263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26268 comm="syz.0.3577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1689.214134][ T30] audit: type=1326 audit(1769752689.014:1264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26268 comm="syz.0.3577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1689.374234][ T30] audit: type=1326 audit(1769752689.014:1265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26268 comm="syz.0.3577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1689.448495][ T30] audit: type=1326 audit(1769752689.014:1266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26268 comm="syz.0.3577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1689.568445][T26278] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1689.694612][T26284] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3580'. [ 1689.725117][T26284] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3580'. [ 1689.840375][ T30] audit: type=1326 audit(1769752689.014:1267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26268 comm="syz.0.3577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1689.935534][ T30] audit: type=1326 audit(1769752689.014:1268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26268 comm="syz.0.3577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1690.074551][ T30] audit: type=1326 audit(1769752689.014:1269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26268 comm="syz.0.3577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1690.149677][ T30] audit: type=1326 audit(1769752689.014:1270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26268 comm="syz.0.3577" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 1691.880965][T26307] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3584'. [ 1691.895620][T26307] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3584'. [ 1691.941670][T26307] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3584'. [ 1691.957182][T26307] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3584'. [ 1692.950247][T26312] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1693.251687][T26317] Cannot find add_set index 3 as target [ 1693.377204][T26319] trusted_key: encrypted_key: insufficient parameters specified [ 1693.394546][T26319] trusted_key: encrypted_key: insufficient parameters specified [ 1693.719179][T26321] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1693.783128][T26321] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1693.871284][T26321] netlink: 63 bytes leftover after parsing attributes in process `syz.2.3588'. [ 1696.229565][T26352] wg1: entered promiscuous mode [ 1696.249530][T26352] wg1: entered allmulticast mode [ 1697.052866][T26368] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3597'. [ 1697.075433][ T30] kauditd_printk_skb: 85 callbacks suppressed [ 1697.075450][ T30] audit: type=1326 audit(1769752697.404:1356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26363 comm="syz.4.3597" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1697.729303][T26373] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1697.737861][ T30] audit: type=1326 audit(1769752697.404:1357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26363 comm="syz.4.3597" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1697.761868][T26373] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1697.770900][ T30] audit: type=1326 audit(1769752697.404:1358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26363 comm="syz.4.3597" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1697.793765][ T30] audit: type=1326 audit(1769752697.404:1359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26363 comm="syz.4.3597" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1698.026982][ T30] audit: type=1326 audit(1769752697.404:1360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26363 comm="syz.4.3597" exe="/root/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1698.071684][ T30] audit: type=1326 audit(1769752697.404:1361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26363 comm="syz.4.3597" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1698.138925][ T30] audit: type=1326 audit(1769752697.404:1362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26363 comm="syz.4.3597" exe="/root/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1698.220194][ T30] audit: type=1326 audit(1769752697.404:1363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26363 comm="syz.4.3597" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1698.309745][ T30] audit: type=1326 audit(1769752697.404:1364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26363 comm="syz.4.3597" exe="/root/syz-executor" sig=0 arch=40000003 syscall=427 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1698.339355][ T30] audit: type=1326 audit(1769752697.404:1365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26363 comm="syz.4.3597" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f42539 code=0x7ffc0000 [ 1699.551172][T26390] pimreg: entered allmulticast mode [ 1699.985098][T26383] pimreg: left allmulticast mode [ 1700.328800][T18581] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 1700.557196][T26396] trusted_key: encrypted_key: insufficient parameters specified [ 1700.568680][T26396] trusted_key: encrypted_key: insufficient parameters specified [ 1700.644946][T18581] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 1700.676825][T18581] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1700.759487][T18581] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1700.786228][T18581] usb 2-1: config 0 descriptor?? [ 1700.833122][T18581] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 1701.431260][T26400] batadv_slave_0: entered promiscuous mode [ 1702.973690][T25836] usb 2-1: USB disconnect, device number 99 [ 1704.622159][T26446] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1705.962702][T26458] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3615'. [ 1705.978507][T26458] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3615'. [ 1706.030704][T26460] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1706.039504][T26460] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1706.053846][T26460] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1706.064751][T26460] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1706.105249][T26460] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3616'. [ 1707.196827][T26474] trusted_key: encrypted_key: insufficient parameters specified [ 1707.207621][T26474] trusted_key: encrypted_key: insufficient parameters specified [ 1708.033288][T26485] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3619'. [ 1709.259441][T26500] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1711.321206][T26524] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 1711.409075][T26526] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1712.456017][T26534] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1712.465906][T26534] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1713.101752][T26543] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1713.368877][T18581] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 1713.640104][T18581] usb 2-1: Using ep0 maxpacket: 16 [ 1713.738996][T18581] usb 2-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1713.751971][T18581] usb 2-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 0 [ 1713.780905][T18581] usb 2-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1713.812135][T18581] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1713.886331][T18581] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1713.903193][T18581] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1713.933754][T18581] usb 2-1: Product: syz [ 1713.953592][T18581] usb 2-1: Manufacturer: syz [ 1713.980280][T18581] usb 2-1: SerialNumber: syz [ 1714.340438][T18581] usblp 2-1:1.0: usblp1: USB Unidirectional printer dev 100 if 0 alt 255 proto 1 vid 0x0525 pid 0xA4A8 [ 1715.060153][T25837] usb 1-1: new full-speed USB device number 123 using dummy_hcd [ 1715.344364][T25837] usb 1-1: config 0 has an invalid interface number: 133 but max is 0 [ 1715.505131][T25837] usb 1-1: config 0 has no interface number 0 [ 1715.682362][T25837] usb 1-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 1715.712573][T25837] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1715.736054][T25837] usb 1-1: Product: syz [ 1715.777073][T25837] usb 1-1: Manufacturer: syz [ 1715.806972][T25837] usb 1-1: SerialNumber: syz [ 1715.847313][T25837] usb 1-1: config 0 descriptor?? [ 1716.053859][T18581] usb 2-1: USB disconnect, device number 100 [ 1716.065400][T18581] usblp1: removed [ 1716.430109][T26572] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1718.212748][T26581] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1718.307602][T26579] netlink: 'syz.1.3639': attribute type 4 has an invalid length. [ 1718.319799][ T30] kauditd_printk_skb: 75 callbacks suppressed [ 1718.319817][ T30] audit: type=1400 audit(1769752718.684:1441): apparmor="DENIED" operation="change_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=265B5EB82B25250232D14211823621494CB2CE51344170755D29F27061B3CB021457E0E8E4EAEDB60F88EF927E2B9F969D7B83E8C3EA39324D7E018663FB29E428E26ABC3ED1900A6A02 pid=26574 comm="syz.1.3639" [ 1718.617270][T26587] could not allocate digest TFM handle md5 [ 1718.910054][T25837] keyspan 1-1:0.133: Keyspan 1 port adapter converter detected [ 1718.941658][T25837] keyspan 1-1:0.133: found no endpoint descriptor for endpoint 81 [ 1718.960171][T25837] keyspan 1-1:0.133: found no endpoint descriptor for endpoint 1 [ 1719.006953][T25837] keyspan 1-1:0.133: found no endpoint descriptor for endpoint 2 [ 1719.030160][T25837] usb 1-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 1719.063469][T25837] usb 1-1: USB disconnect, device number 123 [ 1719.069706][T25837] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 1719.070398][T25837] keyspan 1-1:0.133: device disconnected [ 1720.547300][T26608] hub 9-0:1.0: USB hub found [ 1720.556816][T26608] hub 9-0:1.0: 1 port detected [ 1720.609861][T26610] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1720.748466][T18581] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 1721.144760][T18581] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1721.383102][T18581] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1721.445695][T18581] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1721.565092][T18581] usb 4-1: config 0 descriptor?? [ 1721.587256][T18581] pwc: Askey VC010 type 2 USB webcam detected. [ 1723.766963][T18581] pwc: recv_control_msg error -71 req 02 val 2700 [ 1723.803948][T18581] pwc: recv_control_msg error -71 req 02 val 2c00 [ 1723.840643][T18581] pwc: recv_control_msg error -71 req 04 val 1000 [ 1723.863640][T18581] pwc: recv_control_msg error -71 req 04 val 1300 [ 1723.894684][T18581] pwc: recv_control_msg error -71 req 04 val 1400 [ 1723.989142][T18581] pwc: recv_control_msg error -71 req 02 val 2000 [ 1724.028747][T18581] pwc: recv_control_msg error -71 req 02 val 2100 [ 1724.142098][T18581] pwc: recv_control_msg error -71 req 04 val 1500 [ 1724.214225][T26636] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1724.230661][T18581] pwc: recv_control_msg error -71 req 02 val 2500 [ 1724.231252][T18581] pwc: recv_control_msg error -71 req 02 val 2400 [ 1724.429029][T18581] pwc: recv_control_msg error -71 req 02 val 2600 [ 1724.436669][T18581] pwc: recv_control_msg error -71 req 02 val 2900 [ 1724.445355][T18581] pwc: recv_control_msg error -71 req 02 val 2800 [ 1724.453831][T18581] pwc: recv_control_msg error -71 req 04 val 1100 [ 1724.462075][T26626] syz.0.3651 (26626): drop_caches: 2 [ 1724.539267][T18581] pwc: recv_control_msg error -71 req 04 val 1200 [ 1724.600549][T18581] pwc: Registered as video103. [ 1724.607553][T18581] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input82 [ 1724.722181][T18581] usb 4-1: USB disconnect, device number 2 [ 1724.973659][T26647] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1725.963431][T26658] netdevsim netdevsim3: Direct firmware load for nel/address_bits failed with error -2 [ 1725.994490][T26658] netdevsim netdevsim3: Falling back to sysfs fallback for: nel/address_bits [ 1726.019060][T26656] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 1726.025623][T26656] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1726.230504][T26656] vhci_hcd vhci_hcd.0: Device attached [ 1726.304239][T26664] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3655'. [ 1726.316352][T26664] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3655'. [ 1726.568849][T23200] usb 39-1: new low-speed USB device number 5 using vhci_hcd [ 1727.007014][T26668] netlink: 'syz.2.3656': attribute type 2 has an invalid length. [ 1727.367174][T26678] syz.0.3657 (26678): drop_caches: 2 [ 1727.394817][T26678] syz.0.3657 (26678): drop_caches: 2 [ 1728.123233][T26657] vhci_hcd: connection reset by peer [ 1728.129621][ T12] vhci_hcd vhci_hcd.3: stop threads [ 1728.134852][ T12] vhci_hcd vhci_hcd.3: release socket [ 1728.219495][ T12] vhci_hcd vhci_hcd.3: disconnect device [ 1728.720797][T26688] Cannot find add_set index 3 as target [ 1728.899060][T26692] hub 9-0:1.0: USB hub found [ 1728.904316][T26692] hub 9-0:1.0: 1 port detected [ 1730.419021][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1730.425569][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1730.522569][T26703] syz.2.3663 (26703): drop_caches: 2 [ 1730.529486][T26703] syz.2.3663 (26703): drop_caches: 2 [ 1731.562068][T26716] xt_bpf: check failed: parse error [ 1731.877115][T23200] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 1732.411027][T26722] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1732.892591][T26729] syz.2.3669 (26729): drop_caches: 2 [ 1732.920643][T26729] syz.2.3669 (26729): drop_caches: 2 [ 1734.122920][T26738] could not allocate digest TFM handle md5 [ 1735.599988][T26753] Cannot find add_set index 3 as target [ 1735.959895][T26764] syz.2.3677 (26764): drop_caches: 2 [ 1735.989558][T26764] syz.2.3677 (26764): drop_caches: 2 [ 1736.963273][T26771] xt_bpf: check failed: parse error [ 1736.974550][T26771] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1737.198804][T26771] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1738.141879][T26785] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3683'. [ 1738.491262][T18581] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 1738.500104][T23200] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 1738.774335][T23200] usb 4-1: New USB device found, idVendor=1b80, idProduct=e396, bcdDevice=a7.b1 [ 1738.784269][T23200] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1738.799114][T18581] usb 2-1: config 0 has no interfaces? [ 1738.811064][T18581] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1738.824589][T18581] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1738.841528][T18581] usb 2-1: Product: syz [ 1738.849515][T23200] usb 4-1: Manufacturer: syz [ 1738.857433][T18581] usb 2-1: Manufacturer: syz [ 1738.870166][T18581] usb 2-1: SerialNumber: syz [ 1738.878776][ T5885] usb 1-1: new full-speed USB device number 124 using dummy_hcd [ 1738.886572][T23200] usb 4-1: config 0 descriptor?? [ 1738.910917][T18581] usb 2-1: config 0 descriptor?? [ 1739.019865][ T5885] usb 1-1: device descriptor read/64, error -71 [ 1739.228544][T26779] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1739.283373][T23200] usb 4-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 1739.293223][T26779] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1739.305090][T23200] dvb_usb_af9015 4-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 1739.314876][ T5885] usb 1-1: new full-speed USB device number 125 using dummy_hcd [ 1739.455751][ T5885] usb 1-1: device descriptor read/64, error -71 [ 1739.569885][ T5885] usb usb1-port1: attempt power cycle [ 1739.909229][ T5885] usb 1-1: new full-speed USB device number 126 using dummy_hcd [ 1739.941952][ T5885] usb 1-1: device descriptor read/8, error -71 [ 1740.228808][ T5885] usb 1-1: new full-speed USB device number 127 using dummy_hcd [ 1740.276654][ T5885] usb 1-1: device descriptor read/8, error -71 [ 1740.392616][ T5885] usb usb1-port1: unable to enumerate USB device [ 1740.643750][T23200] usb 2-1: USB disconnect, device number 101 [ 1741.284008][ T5885] usb 4-1: USB disconnect, device number 3 [ 1741.319124][T23200] usb 2-1: new low-speed USB device number 102 using dummy_hcd [ 1741.508566][T23200] usb 2-1: device descriptor read/64, error -71 [ 1741.753957][T23200] usb 2-1: new low-speed USB device number 103 using dummy_hcd [ 1741.952343][T23200] usb 2-1: device descriptor read/64, error -71 [ 1742.447624][T23200] usb usb2-port1: attempt power cycle [ 1742.889021][T23200] usb 2-1: new low-speed USB device number 104 using dummy_hcd [ 1743.011516][T23200] usb 2-1: device descriptor read/8, error -71 [ 1743.454097][T23200] usb 2-1: new low-speed USB device number 105 using dummy_hcd [ 1744.259087][T23200] usb 2-1: device descriptor read/8, error -71 [ 1744.409123][T23200] usb usb2-port1: unable to enumerate USB device [ 1744.656176][T26839] libceph: resolve 'c' (ret=-3): failed [ 1744.813313][T26841] Cannot find add_set index 3 as target [ 1745.361541][T26846] vhci_hcd vhci_hcd.0: port 0 already used [ 1745.409936][T26846] netdevsim netdevsim0: Direct firmware load for nel/address_bits failed with error -2 [ 1745.420963][T26846] netdevsim netdevsim0: Falling back to sysfs fallback for: nel/address_bits [ 1748.436761][T26874] fuse: Bad value for 'group_id' [ 1748.442420][T26874] fuse: Bad value for 'group_id' [ 1748.600808][T26878] delete_channel: no stack [ 1748.629751][T26878] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1748.659267][T26878] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1748.823098][T26881] syz.4.3701 (26881): drop_caches: 2 [ 1748.833092][T26881] syz.4.3701 (26881): drop_caches: 2 [ 1749.598655][T26885] syz.3.3712 (26885): drop_caches: 2 [ 1749.628546][T26885] syz.3.3712 (26885): drop_caches: 2 [ 1751.992261][T26914] netlink: 'syz.2.3706': attribute type 4 has an invalid length. [ 1752.055462][ T30] audit: type=1400 audit(1769752752.364:1442): apparmor="DENIED" operation="change_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=265B5EB82B25250232D14211823621494CB2CE51344170755D29F27061B3CB021457E0E8E4EAEDB60F88EF927E2B9F969D7B83E8C3EA39324D7E018663FB29E428E26ABC3ED1900A6A02 pid=26906 comm="syz.2.3706" [ 1752.117552][T26917] KVM: debugfs: duplicate directory 26917-5 [ 1752.680235][ T30] audit: type=1804 audit(1769752753.044:1443): pid=26917 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.3707" name="/newroot/741/file1" dev="tmpfs" ino=3903 res=1 errno=0 [ 1752.774353][T26926] syz.3.3708 (26926): drop_caches: 2 [ 1752.888012][T26926] syz.3.3708 (26926): drop_caches: 2 [ 1752.898473][T25837] usb 1-1: new low-speed USB device number 2 using dummy_hcd [ 1753.028722][T25837] usb 1-1: device descriptor read/64, error -71 [ 1753.374516][T25837] usb 1-1: new low-speed USB device number 3 using dummy_hcd [ 1753.509867][T25837] usb 1-1: device descriptor read/64, error -71 [ 1753.639060][T25837] usb usb1-port1: attempt power cycle [ 1753.988429][T25837] usb 1-1: new low-speed USB device number 4 using dummy_hcd [ 1754.051359][T25837] usb 1-1: device descriptor read/8, error -71 [ 1754.296855][T26938] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1754.378558][T25837] usb 1-1: new low-speed USB device number 5 using dummy_hcd [ 1754.459914][T25837] usb 1-1: device descriptor read/8, error -71 [ 1754.498876][T26944] netdevsim netdevsim4: Direct firmware load for nel/address_bits failed with error -2 [ 1754.509835][T26944] netdevsim netdevsim4: Falling back to sysfs fallback for: nel/address_bits [ 1754.570348][T26941] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 1754.576908][T26941] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1754.599267][T23200] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 1754.668975][T25837] usb usb1-port1: unable to enumerate USB device [ 1754.765785][T26941] vhci_hcd vhci_hcd.0: Device attached [ 1755.088444][T25837] usb 41-1: new low-speed USB device number 6 using vhci_hcd [ 1755.160064][T23200] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1755.477328][T23200] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1755.518572][T23200] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1755.540426][T23200] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1755.640233][T26952] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 1755.668273][T23200] usb 2-1: config 0 descriptor?? [ 1756.821440][T26961] trusted_key: encrypted_key: master key parameter 'defau}t' is invalid [ 1756.916842][T26960] syz.4.3715 (26960): drop_caches: 2 [ 1756.917163][T26960] syz.4.3715 (26960): drop_caches: 2 [ 1757.569328][T23200] usb 2-1: USB disconnect, device number 106 [ 1760.513716][T27007] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1760.545751][T27007] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1761.176198][T27015] syz.3.3728 (27015): drop_caches: 2 [ 1761.278438][T27015] syz.3.3728 (27015): drop_caches: 2 [ 1761.309925][T27013] xt_hashlimit: overflow, try lower: 18446744073709551614/129 [ 1761.434895][T27013] fuse: Bad value for 'fd' [ 1761.739541][T27022] xt_bpf: check failed: parse error [ 1762.028953][T23200] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 1762.344226][T23200] usb 4-1: config 0 has an invalid interface number: 199 but max is 1 [ 1762.354086][T23200] usb 4-1: config 0 has no interface number 1 [ 1762.384029][T23200] usb 4-1: config 0 interface 199 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1762.419832][T23200] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1762.519521][T25836] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 1762.533817][T23200] usb 4-1: New USB device found, idVendor=0002, idProduct=0000, bcdDevice= 0.00 [ 1762.543600][T23200] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1762.552262][T23200] usb 4-1: SerialNumber: syz [ 1762.577671][T23200] usb 4-1: config 0 descriptor?? [ 1762.593083][T27032] netdevsim netdevsim1: Direct firmware load for nel/address_bits failed with error -2 [ 1762.636035][T23200] uvcvideo 4-1:0.199: Found UVC 0.00 device (0002:0000) [ 1762.665629][T27032] netdevsim netdevsim1: Falling back to sysfs fallback for: nel/address_bits [ 1762.665694][T27030] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 1762.682122][T27030] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1762.691575][T23200] uvcvideo 4-1:0.199: No valid video chain found. [ 1762.708369][T25836] usb 1-1: device descriptor read/64, error -71 [ 1762.861921][T27030] vhci_hcd vhci_hcd.0: Device attached [ 1763.059007][T25836] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 1763.288387][T25836] usb 1-1: device descriptor read/64, error -71 [ 1763.289013][T23200] usb 35-1: new low-speed USB device number 6 using vhci_hcd [ 1763.418985][T25836] usb usb1-port1: attempt power cycle [ 1763.936004][T25836] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 1763.980268][T25836] usb 1-1: device descriptor read/8, error -71 [ 1764.288470][T25836] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 1764.379976][T25836] usb 1-1: device descriptor read/8, error -71 [ 1764.511851][T25836] usb usb1-port1: unable to enumerate USB device [ 1764.570218][T25836] usb 4-1: USB disconnect, device number 4 [ 1764.798392][T25834] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 1765.051375][T25834] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD4, changing to 0x84 [ 1765.063333][T25834] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 51544, setting to 1024 [ 1765.103311][T25834] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 1765.152704][T25834] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1765.168463][T25834] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1765.176501][T25834] usb 2-1: Product: syz [ 1765.187252][T25834] usb 2-1: Manufacturer: syz [ 1765.195857][T25834] usb 2-1: SerialNumber: syz [ 1765.413970][T27058] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3736'. [ 1765.462974][T25834] usb 2-1: config 0 descriptor?? [ 1765.479318][T27045] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1765.541336][T27059] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1765.701765][T27045] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1766.139005][ T31] INFO: task kworker/0:0:9 blocked for more than 143 seconds. [ 1766.179129][ T31] Tainted: G L syzkaller #0 [ 1766.516739][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1766.641070][ T31] task:kworker/0:0 state:D stack:20856 pid:9 tgid:9 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1766.685193][ T31] Workqueue: usb_hub_wq hub_event [ 1766.726042][ T31] Call Trace: [ 1766.731578][ T31] [ 1766.744034][ T31] __schedule+0x14ea/0x5050 [ 1766.797333][ T31] ? wq_worker_sleeping+0xfe/0x250 [ 1766.813114][ T31] ? __pfx___schedule+0x10/0x10 [ 1766.828360][ T31] ? schedule+0x90/0x360 [ 1767.199072][ T31] schedule+0x164/0x360 [ 1767.206851][ T31] schedule_preempt_disabled+0x13/0x30 [ 1767.222991][ T31] __mutex_lock+0x7fe/0x1300 [ 1767.229213][ T31] ? __mutex_lock+0x5ac/0x1300 [ 1767.237415][ T31] ? hub_event+0x21a2/0x4f30 [ 1767.249078][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1767.259174][ T31] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1767.267512][ T31] hub_event+0x21a2/0x4f30 [ 1767.301204][ T31] ? __pfx_hub_event+0x10/0x10 [ 1767.317024][ T31] ? process_scheduled_works+0xa0f/0x17a0 [ 1767.343203][ T31] ? process_scheduled_works+0xa0f/0x17a0 [ 1767.363271][ T31] ? process_scheduled_works+0xa0f/0x17a0 [ 1767.376946][ T31] process_scheduled_works+0xaec/0x17a0 [ 1767.393260][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 1767.409753][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 1767.423382][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1767.475527][ T31] ? schedule+0x90/0x360 [ 1767.491720][ T31] worker_thread+0xda6/0x1360 [ 1767.525829][T25834] usb 2-1: USB disconnect, device number 107 [ 1767.548693][ T31] kthread+0x726/0x8b0 [ 1767.572617][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1767.603110][ T31] ? __pfx_kthread+0x10/0x10 [ 1767.626622][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1767.638935][ T31] ? __pfx_kthread+0x10/0x10 [ 1767.648640][ T31] ret_from_fork+0x51b/0xa40 [ 1767.659507][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1767.668981][ T31] ? __switch_to+0xc82/0x1410 [ 1767.677143][ T31] ? __pfx_kthread+0x10/0x10 [ 1767.687693][ T31] ret_from_fork_asm+0x1a/0x30 [ 1767.701073][ T31] [ 1767.706824][ T31] [ 1767.706824][ T31] Showing all locks held in the system: [ 1767.726151][ T31] 5 locks held by kworker/0:0/9: [ 1767.747629][ T31] #0: ffff8881422add48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 1767.770814][ T31] #1: ffffc900000e7bc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 1767.791960][ T31] #2: ffff8880294bd198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 1767.802430][ T31] #3: ffff8880294c0518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x217a/0x4f30 [ 1767.817091][ T31] #4: ffff88802930ee68 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21a2/0x4f30 [ 1767.835548][ T31] 1 lock held by khungtaskd/31: [ 1767.844239][ T31] #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1767.868358][ T31] 2 locks held by kworker/u8:6/1334: [ 1767.878321][ T31] #0: ffff88801d3cc148 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 1767.890506][ T31] #1: ffffc900040dfbc0 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 1767.903239][ T31] 2 locks held by getty/5587: [ 1767.908494][ T31] #0: ffff888034c850a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1767.918829][ T31] #1: ffffc900036bb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 1767.929437][ T31] 5 locks held by kworker/0:5/5914: [ 1767.934629][ T31] #0: ffff8881422add48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 1767.946562][ T31] #1: ffffc90005327bc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 1767.959088][ T31] #2: ffff888144766198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 1767.968642][ T31] #3: ffff88814478a518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x217a/0x4f30 [ 1767.979258][ T31] #4: ffff88802930ee68 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21a2/0x4f30 [ 1767.989515][ T31] 5 locks held by kworker/1:4/23200: [ 1767.994804][ T31] #0: ffff8881422add48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 1768.006621][ T31] #1: ffffc9001a357bc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 1768.019022][ T31] #2: ffff8881447ac198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 1768.028481][ T31] #3: ffff8881447af518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x217a/0x4f30 [ 1768.039149][ T31] #4: ffff888029260e68 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21a2/0x4f30 [ 1768.049427][ T31] 5 locks held by kworker/0:9/25837: [ 1768.054709][ T31] #0: ffff8881422add48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 1768.066500][ T31] #1: ffffc9000b6cfbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 1768.078905][ T31] #2: ffff88802965e198 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 1768.088340][ T31] #3: ffff888029721518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x217a/0x4f30 [ 1768.098784][ T31] #4: ffff88802959e468 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21a2/0x4f30 [ 1768.108975][ T31] 1 lock held by syz.0.3734/27046: [ 1768.114093][ T31] #0: ffffffff8e560b40 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 1768.124351][ T31] 1 lock held by syz.2.3738/27060: [ 1768.129812][ T31] #0: ffffffff8e560b40 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 1768.139888][ T31] [ 1768.142215][ T31] ============================================= [ 1768.142215][ T31] [ 1768.163824][ T31] NMI backtrace for cpu 0 [ 1768.163846][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1768.163869][ T31] Tainted: [L]=SOFTLOCKUP [ 1768.163875][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1768.163884][ T31] Call Trace: [ 1768.163891][ T31] [ 1768.163899][ T31] dump_stack_lvl+0xe8/0x150 [ 1768.163923][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 1768.163945][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1768.163971][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1768.163995][ T31] sys_info+0x135/0x170 [ 1768.164014][ T31] watchdog+0xf90/0xfe0 [ 1768.164036][ T31] ? watchdog+0x209/0xfe0 [ 1768.164061][ T31] kthread+0x726/0x8b0 [ 1768.164082][ T31] ? __pfx_watchdog+0x10/0x10 [ 1768.164096][ T31] ? __pfx_kthread+0x10/0x10 [ 1768.164117][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1768.164138][ T31] ? __pfx_kthread+0x10/0x10 [ 1768.164155][ T31] ret_from_fork+0x51b/0xa40 [ 1768.164180][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1768.164200][ T31] ? __switch_to+0xc82/0x1410 [ 1768.164223][ T31] ? __pfx_kthread+0x10/0x10 [ 1768.164241][ T31] ret_from_fork_asm+0x1a/0x30 [ 1768.164274][ T31] [ 1768.164282][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1768.294469][ C1] NMI backtrace for cpu 1 [ 1768.294490][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 1768.294511][ C1] Tainted: [L]=SOFTLOCKUP [ 1768.294517][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1768.294527][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1768.294550][ C1] Code: a8 60 02 e9 53 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 67 12 00 fb f4 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 1768.294563][ C1] RSP: 0000:ffffc90000197e20 EFLAGS: 00000242 [ 1768.294577][ C1] RAX: 00000000023adcb5 RBX: ffffffff8199570d RCX: 0000000080000001 [ 1768.294589][ C1] RDX: 0000000000000001 RSI: ffffffff8dcc9061 RDI: ffffffff8c073a80 [ 1768.294599][ C1] RBP: ffffc90000197f10 R08: ffff8880b87336db R09: 1ffff110170e66db [ 1768.294611][ C1] R10: dffffc0000000000 R11: ffffed10170e66dc R12: ffffffff8fef1b70 [ 1768.294622][ C1] R13: 1ffff110039dcb70 R14: 0000000000000001 R15: 0000000000000001 [ 1768.294633][ C1] FS: 0000000000000000(0000) GS:ffff8881257f5000(0000) knlGS:0000000000000000 [ 1768.294645][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1768.294656][ C1] CR2: 0000000080202018 CR3: 0000000064dc4000 CR4: 00000000003526f0 [ 1768.294670][ C1] Call Trace: [ 1768.294679][ C1] [ 1768.294685][ C1] default_idle+0x9/0x20 [ 1768.294702][ C1] default_idle_call+0x72/0xb0 [ 1768.294719][ C1] do_idle+0x1bd/0x500 [ 1768.294733][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 1768.294751][ C1] ? __pfx_do_idle+0x10/0x10 [ 1768.294768][ C1] cpu_startup_entry+0x43/0x60 [ 1768.294782][ C1] start_secondary+0x101/0x110 [ 1768.294801][ C1] common_startup_64+0x13e/0x147 [ 1768.294825][ C1] [ 1768.473356][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1768.480224][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1768.490916][ T31] Tainted: [L]=SOFTLOCKUP [ 1768.495250][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1768.506189][ T31] Call Trace: [ 1768.509488][ T31] [ 1768.512430][ T31] vpanic+0x1e0/0x670 [ 1768.516586][ T31] panic+0xc5/0xd0 [ 1768.520300][ T31] ? __pfx_panic+0x10/0x10 [ 1768.525229][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1768.530702][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 1768.536880][ T31] watchdog+0xfda/0xfe0 [ 1768.541134][ T31] ? watchdog+0x209/0xfe0 [ 1768.545472][ T31] kthread+0x726/0x8b0 [ 1768.549542][ T31] ? __pfx_watchdog+0x10/0x10 [ 1768.554225][ T31] ? __pfx_kthread+0x10/0x10 [ 1768.558909][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1768.564166][ T31] ? __pfx_kthread+0x10/0x10 [ 1768.568839][ T31] ret_from_fork+0x51b/0xa40 [ 1768.573451][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1768.578558][ T31] ? __switch_to+0xc82/0x1410 [ 1768.583245][ T31] ? __pfx_kthread+0x10/0x10 [ 1768.587836][ T31] ret_from_fork_asm+0x1a/0x30 [ 1768.592619][ T31] [ 1768.596158][ T31] Kernel Offset: disabled [ 1768.600469][ T31] Rebooting in 86400 seconds..