last executing test programs: 6.205245648s ago: executing program 3 (id=2788): r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) mmap$binder(&(0x7f0000000000/0x4000)=nil, 0x1fffff, 0x1, 0x11, r0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f00000006c0)={&(0x7f000034e000/0x4000)=nil, &(0x7f00002e4000/0x1000)=nil, 0x4000, 0x2}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e23, 0x2, @empty}}, 0xffb, 0x203, 0xffff18b6, 0x6, 0x330, 0x80000001, 0xdb}, 0x9c) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYRES16=0x0], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffde2}, 0x94) readahead(r0, 0x3, 0xff) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r4, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f00000003c0)=r3}, 0x20) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000600)=r0, 0x4) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000005000000850000002e00000095"], &(0x7f0000000200)='GPL\x00', 0x3, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x15, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x3, &(0x7f00000002c0)=""/66, &(0x7f0000000340)=0x42) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{r5}, &(0x7f0000000440), &(0x7f0000000480)=r6}, 0x20) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000680), 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r7, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x325000, 0x800, 0x0, 0x2}, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r8 = openat$binderfs_log(0xffffffffffffff9c, &(0x7f0000000640)='./binderfs/binder_logs/stats\x00', 0x0, 0x0) mmap$snddsp_status(&(0x7f00001b7000/0x1000)=nil, 0x1000, 0x8, 0x12, r8, 0x82000000) r9 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r9, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f000000008000", @ANYRES32=0x0, @ANYRES32=r9], 0x24}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r9, 0x8933, &(0x7f0000000080)={'vxcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000380)={0x1d, r10, 0x2, {0x1, 0xff, 0x1}}, 0x18) syz_emit_ethernet(0x15e, &(0x7f00000003c0)={@random="e33110495bfd", @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x128, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @empty, [{0x4, 0x20, "9595f429ae08a565c9a41d411170a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5e0135118be22dc6c97e730f7053d6ec34ca11b5c7c3830af6b26868600f042ff"}]}}}}}}, 0x0) 5.364844525s ago: executing program 1 (id=2792): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x34, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000740)=ANY=[@ANYBLOB="3c00000010000500"/20, @ANYRES32=0x0, @ANYBLOB="01000000010000001400030073797a6b616c6c65723000000000000008000a00", @ANYRES32], 0x3c}}, 0x0) write(r0, &(0x7f0000000700)="ffffffffffff0011223344554305000f", 0x10) 5.015349289s ago: executing program 3 (id=2794): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000006c0)={0x14, 0x0, &(0x7f0000000680)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f00000002c0), 0x6f5e, 0x402) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x0, 0x5, 0x494}) syz_open_dev$dvb_frontend(0x0, 0x0, 0x882) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000900000002000000ffff000005"], 0x48) r2 = socket(0x10, 0x3, 0x4) syz_open_dev$vim2m(0x0, 0x7fff, 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) r3 = fsopen(&(0x7f0000000340)='overlay\x00', 0x1) fsconfig$FSCONFIG_SET_PATH_EMPTY(r3, 0x4, 0x0, &(0x7f0000003740)='./file0\x00', 0xffffffffffffff9c) ioctl$vim2m_VIDIOC_G_FMT(0xffffffffffffffff, 0xc0285628, 0x0) sendmsg$AUDIT_MAKE_EQUIV(r2, 0x0, 0x20020000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000ac0)=@IORING_OP_FUTEX_WAIT={0x33, 0x28, 0x0, 0x74, 0x81, &(0x7f0000000a40)=[{&(0x7f0000000540)="d5a6334393b08fe623db1666fff398946fc39794b7cf00be63c81522a54a69ef5715c186912fd1b501380487192cb70e4eea54e6384bb8816d909dd5d992015b5c7bc08a61119d954db9672a8b8a6c53b9d04fffbe6407fbf61eeab8835367de94ce64e55bb076ee7cf806a0faf6290cb362ada5fd0c5fdcddc6a8afab3bd35f9af6085e1e167f735a0135813709fb445e4e10e40934bfae6f8140b161e7ef3b8a86d1b3e96b503275b9ab588a5b9fff7558b97e3c901400937751", 0xbb}, {&(0x7f0000000600)="50b690cf993fc25c36c6457b432eb09d0947814d84b8d94a635b22c922e3d34ba4c30172519c3d3f8c9ab544fc5eed9b881c77aa91f1af", 0x37}, {&(0x7f0000000640)="acd6291acb46425b1d2594fc2bacd9e91585d2a9cc5f2d4de4ad2739cb503c3ada51be49755ec46e59803612d582f119263e6bd1d3283737987189ef21391a50ea0968c086d1a65c225f41b5fa5a017c09c21b29a2c0505b67c7173e423fcad729409c689bd46329234676e1fbccb02ca483b52fba37ca720db6f833c3e80d12ec0683654982df208fd7db890969b26661defe11b2f2447f4d632b3383c2ff91f007e06c15563265fb3f47a8afc2bb65eef51738", 0xb4}, {&(0x7f0000000700)="5393b76b8b2cedacd764383069132a3a41c3830f396b642b946889e9278fc28df7f96dd3f529117bea82c4b2d26acc71e8580300b0a814dd99307065f08c29272ae231a0f24b4a2493e38cb4942cd368bf7d977075d9cea329ecd1d19efea4a5ae9a4b64809b315911c7993a050741012675b26f5b850adb90eab1c743c49d32b39980e5046e66c18d0d82128e51e41d027bfd3de4b54bd939cc3e7c59ab2aca97b01160cb7475432d6b81fcb7d96a7b26019a0bab", 0xb5}, {&(0x7f00000007c0)="edb340a79b5c3368d3ecbadb2eb0fb8a13f5b9a55b7923262287ce3c8963959e0e4bf18e9c", 0x25}, {&(0x7f0000000880)="2d0ae4be14d5c2ea1ff6ffb3d8a4b44da0fa0eee8d4520574c4a57326cf781a9ec354a3e060db6beb283d9ae9a8b9e4b4a22f79dc63ba3dc28d06ad82a603c36eda471290d45cb40085a10399563622127ed01cbf20ba984d5ecb746eadb6511cf3669e70ae567c34c1b7022c6d77c65b1b1b4e5895d9c7c994c8fe43fefcbd3dd183615ac06edcf37a13eba6fd54f5a", 0x90}, {&(0x7f0000000940)="8b26dcd1f89f8c0bc7eaa311898374f96b49a5e965fe5a0c949b8e68603425eb1d2344fb0077d109e00029d90195ad0deeeda3", 0x33}, {&(0x7f0000000980)="0ff65947a0ee85e8bc450d8c784e5e59b33e2bc91706b760d429d4d6fb2c0bff3f718a1cfa20a2c15423cdb0b0a214b052618b7883b05bbf9410be5ec37de58817b3b1156d385cb38c4b99b86ed63ef4e211295598f510b568114d30cc0ff8818de6c0cd405babcc33ac2b39d2bde36235390868d2561058001a2b60af48b5c82f54d021ac3f", 0x86}], 0x0, 0x0, 0x1, {0x0, 0x0, 0x0, 0x80000000}}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f0000000280), 0x1, 0x100) r4 = socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20000) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@broadcast, @in6=@empty, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffffffffffffa}, {0x0, 0x0, 0xff}, 0x0, 0x0, 0x1}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x2c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x1c) 4.888766023s ago: executing program 1 (id=2795): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xc7, 0x4, 0x0, 0x1, 0x2000000000010}, 0x0, &(0x7f0000000240)={0x1f, 0xc, 0x715, 0x8000000000000000, 0x0, 0x80000000000000, 0x100800, 0x20000}, 0x0, 0x0) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) close(r1) ioctl$KVM_CREATE_VM(r1, 0x5509, 0x23) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r1, 0xc0bc5310, &(0x7f0000000000)) 3.680147549s ago: executing program 4 (id=2800): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) ioctl$USBDEVFS_SETINTERFACE(r0, 0x80085504, &(0x7f0000000180)={0x0, 0x3f}) 3.535715673s ago: executing program 2 (id=2801): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2}) ioctl$VIDIOC_QUERYMENU(r2, 0xc008561c, &(0x7f0000000000)={0x980900, 0x3, @name="51da06bc7338e17dfebb1580e15b95473b09f0d1fb8aa1e9959ef9dc00"}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000003c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2100000000000000200012800800010068000000005f89ed4a000100", @ANYRES32=r3, @ANYBLOB="08000200", @ANYRES32=0x0, @ANYBLOB], 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) r4 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r6, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=@newqdisc={0x70, 0x24, 0xd0f, 0x70bd2c, 0x25dfdbfc, {0x60, 0x0, 0x0, r6, {}, {0x6, 0xa}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x44, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xf0cda79ea301acfa}, @TCA_TBF_RATE64={0xc, 0x4, 0xb78fea3163f663ab}, @TCA_TBF_PARMS={0x28, 0x1, {{0x8, 0x0, 0xfffa, 0x9, 0x9, 0x4}, {0x71, 0x2, 0x4, 0x8, 0x7, 0x101}, 0x0, 0x7, 0x1aa2}}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0xc5}, 0xc010) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) 3.488858089s ago: executing program 4 (id=2802): openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) recvmmsg(r0, &(0x7f0000002c80)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x80000}, {{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000400)=""/174, 0xae}, {&(0x7f0000000300)=""/83, 0x53}, {&(0x7f0000003940)=""/4091, 0xffb}, {&(0x7f0000000040)=""/175, 0xaf}, {&(0x7f0000000180)=""/256, 0x100}, {&(0x7f0000003880)=""/191, 0xbf}], 0x6}, 0x4}], 0x4, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'dummy0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c0000002400dde580cd7ff932a1c2abcffcc105", @ANYRES32=r3, @ANYBLOB="00000100ffffffff000000000c00010063616b655f6d71"], 0x3c}}, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000010c0)={[0x4, 0x20001000000000, 0x4, 0x7, 0x1ffffff, 0x8, 0xffffffff, 0x9ffffffffffffff8, 0xffff, 0xfffffffffffffff7, 0x599, 0x3, 0x3, 0x7, 0x0, 0x6], 0x1, 0x29250}) ioctl$KVM_SET_SREGS2(r5, 0x4140aecd, &(0x7f0000000140)={{0xffff0000, 0x58000, 0xf000, 0x9, 0x4, 0xe2, 0x81, 0xdf, 0x0, 0x84, 0x0, 0xb}, {0xd000, 0xd000, 0x10, 0x3, 0x3, 0x7, 0x5, 0x5, 0x1, 0x4, 0xfa, 0x5}, {0xf000, 0x8000000, 0x4, 0x4, 0x11, 0x81, 0x0, 0x5, 0x5, 0x4, 0x92, 0x9}, {0xeeee8000, 0xeeef0000, 0x1b, 0x7, 0x1, 0x40, 0x0, 0x0, 0xfa, 0x7, 0x9, 0x9}, {0xeeee8000, 0x0, 0xf, 0x9, 0x5, 0x2, 0x7, 0xed, 0x1, 0x6e, 0x0, 0x8}, {0x4000, 0x80a0000, 0xb, 0x2, 0xad, 0x2, 0x5, 0x4, 0x1, 0xe, 0x6, 0xa}, {0x10000, 0x2, 0xc, 0x0, 0xcd, 0x5, 0x9, 0x26, 0xa, 0x2, 0xff, 0x6}, {0x1ff8, 0xeeef0000, 0xb, 0xe, 0x13, 0x1e, 0x3, 0x0, 0x9, 0x5, 0x2, 0x8}, {0x100000, 0x405}, {0x80a0000, 0xff81}, 0xe0000031, 0x0, 0x6000, 0x61, 0x5, 0xa800, 0x800f900, 0x0, [0x6, 0x2, 0x8000000000000003, 0x4c]}) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000c80)={'ip6gre0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001240)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x4000000, {0x0, 0x0, 0x0, r8, {0x0, 0x1}, {0xffff, 0xffff}, {0xc}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x1, 0x0, 0x1fc, 0x0, 0xfffffc80, 0x0, 0x6, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1, 0x3f, 0x0, 0x0, 0x2, 0xffffffff, 0x2, 0xc00, 0x8, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x1000, 0xfffffffc, 0x0, 0x0, 0x0, 0x9, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x272, 0xb, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffe, 0xd, 0x80007, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb10, 0xffffffff, 0x0, 0xfffffffc, 0x7fff, 0x0, 0x0, 0x0, 0xb97, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1, 0x3, 0x5e, 0xfffffffc, 0x8, 0x0, 0x0, 0x400000, 0x3, 0x0, 0x10, 0x0, 0x4, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x80003, 0x0, 0xffffffff, 0x1, 0x0, 0x9, 0x0, 0x0, 0x105, 0x0, 0x9, 0x0, 0xfffffffc, 0x4, 0x0, 0x40000002, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0xffffffff, 0x10002, 0x0, 0xfff, 0xb3c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800004, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x4, 0x0, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0xd79, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x4, 0x7, 0x100, 0x0, 0x8, 0xfffffffd, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1008, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x31, 0x0, 0x0, 0xfffd, 0x4}, {0xff, 0x2, 0x0, 0x0, 0x0, 0x40000000}, 0x0, 0x7f}}]}}]}, 0x45c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="6664b92c78411badfd5e634d", @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) read$FUSE(r6, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f0000004200)={0x50, 0x0, r9}, 0x50) r10 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) syz_fuse_handle_req(r6, &(0x7f00000042c0), 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r11 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x0, 0x108) r12 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x121a02, 0x20) sendfile(r12, r11, &(0x7f0000002700)=0x23, 0x1c) getdents64(r10, &(0x7f00000063c0)=""/1024, 0x400) syz_fuse_handle_req(r6, &(0x7f00000067c0), 0x2000, &(0x7f00000087c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000008880)=ANY=[@ANYBLOB="30000000000000000000000000000000000000000000000000000000000000000480000000000000232c2c2d00000000"], 0x0, 0x0, 0x0, 0x0}) syz_open_dev$ttys(0xc, 0x2, 0x0) r13 = socket(0x10, 0x2, 0x0) write(r13, &(0x7f0000000040)="1c0000001a009b8a2a569e409031c72023d7d6cb8f8ae3140000003b", 0x1c) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x4aa01, 0x69) 3.475562266s ago: executing program 1 (id=2803): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x28}}, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000000)='cgroup\x00', 0x113541, 0x0, 0xf, 0x0, 0x0}) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000005c0)='cpu.stat\x00', 0x275a, 0x0) preadv(r2, &(0x7f0000001a00)=[{&(0x7f0000000280)=""/96, 0x60}], 0x1, 0x9, 0x6c8) wait4(0x0, 0x0, 0x2, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) write$binfmt_aout(r3, &(0x7f00000001c0)=ANY=[], 0xff2e) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xc004000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x50, 0x2, 0x7, 0x5, 0x0, 0x0, {0x7}, [@NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x3}, @NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x9}, @NFACCT_FILTER={0xc, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x2}]}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x1}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x57}]}, 0x50}, 0x1, 0x0, 0x0, 0x20044004}, 0x20004004) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000dc0)={0x0, 0xfffffff5, 0x5, 0xd000, 0xe, "0062ba7d8200000016001b001e00f705096604"}) r4 = syz_open_pts(r3, 0xa0200) dup3(r4, r3, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') syz_emit_ethernet(0x6e, &(0x7f0000003580)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x88, 0x0, 0x0, 0x5, '\x00', @dev={0xfe, 0x80, '\x00', 0x2a}, [{0x2, 0x3, "21c1e05659ae3f48e9296b2beda7add700385601f891"}, {0x2, 0x1, "fef4b66989e6"}]}}}}}}, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r7, 0x4010ae67, &(0x7f0000000280)={0xffe, 0x201000, 0x1}) close(r7) io_setup(0x7, &(0x7f00000000c0)=0x0) io_submit(r8, 0x1, &(0x7f0000000b00)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x2}]) unshare(0x8040480) pselect6(0x40, &(0x7f0000003800)={0x3, 0x6, 0x8, 0x1, 0x4, 0x1, 0x5, 0x7}, 0x0, &(0x7f0000003880)={0x9, 0x3, 0xfffffffffffffffe, 0x200, 0xfffffffffffffc00, 0x8000000000000000, 0x0, 0x5}, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_DELSETELEM={0x20, 0xd, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x84, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x58, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_IMMEDIATE_DATA={0xc, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, "11"}]}]}}}, {0x28, 0x1, 0x0, 0x1, @lookup={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SET={0x9, 0x1, 'syz1\x00'}, @NFTA_LOOKUP_SREG={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xcc}}, 0x0) 3.216231656s ago: executing program 2 (id=2804): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x0, &(0x7f0000000140)}) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000003400)={0x0, 0x0, &(0x7f0000003140), 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="280000000000000029000000390000003302010900000000fe8000000000000000000000000000bbbafeffffffffffff2900000039000000010e000100000000ff020000000000000000000000000001fc00000000000000000000000000000100000000000000000000ffffe000000100000000000000000000000000000000ff01000000000000000000000000000100000000000040c98861f92ca7000000000000000000ff020000000000000000000000000001a80000000000000029000000390000000812010f00000000ff02000000000000000000000000000100000000000000000000000000000001ff020000000000000000000000000001fc0100003b790000000000000000000120010000000000060000000000000001fe8000000000000000000000000000aafe800000000000000000000000000032fc00000000000000000000000000000100000000000000000000000000000000140000000000000029000000340000009203862400000000380000000000000029000000370000001603000000", @ANYRES32, @ANYBLOB], 0x230}, 0x20000010) tkill(0x0, 0x3e) 3.071051531s ago: executing program 4 (id=2805): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x34, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000740)=ANY=[@ANYBLOB="3c00000010000500"/20, @ANYRES32=0x0, @ANYBLOB="01000000010000001400030073797a6b616c6c65723000000000000008000a00", @ANYRES32], 0x3c}}, 0x0) write(r0, &(0x7f0000000700)="ffffffffffff0011223344554305000f", 0x10) 2.82993687s ago: executing program 2 (id=2807): r0 = socket$inet(0xa, 0x801, 0x6) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000082, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) listen(r0, 0xfffffffd) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c1) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) r2 = syz_mount_image$fuse(&(0x7f0000000000), 0x0, 0x880000, &(0x7f00000005c0)=ANY=[@ANYBLOB='fd=', @ANYBLOB="2c7236303030300000000022bc389998fd600cea0038a700000000f94801bad80ce6cbda32ed415e22b1d11e46c0c4c1ca7ee076bab5e1e7f4ab3c6cf1c8722189ff0f8a", @ANYRESDEC, @ANYBLOB, @ANYRESDEC, @ANYBLOB=',max_read=0x0000000000000008,default_permissions,max_read=0x0000000000000008,blksize=0x0000000000001000,blksize=0x0000000000001e00,allow_other,seclabel,audit,dont_measure,mask=^MAY_W', @ANYRESDEC=0xee00, @ANYBLOB], 0x1, 0x0, &(0x7f00000004c0)="faeaed3456d6712da26376abcb601806c353a289d2d0ec954d26eabed2a0c8b4dca0034604a28d654cabed1e19630ff1100e918f1862aad8800125cde8fa0215be598a49d435b702323d7a820eca23ff4688dc6244aa868400c89e6e8beb7f692faf80a9c8a388bded79008e085591bc524a6430f52b911f6231a7ba71ffcefb629645ac4726a0ef52a3df53606f7516abfd784c60054b32fc588a90eeebb1fc8cfcbe5336ea99cf3767808fca019ca5b261be2fd3cde59cb234c6300e216cccae95f3bfea206269106e4c04ff123d9e14e0cfc4e174e0c0404ea45c4d87619a63837f22c36d1b7508a344") r3 = open_tree(r2, 0x0, 0x0) keyctl$set_reqkey_keyring(0xe, 0xffffffffffffffff) close(r3) tkill(0x0, 0x3e) 2.755789872s ago: executing program 4 (id=2808): r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@broadcast, @in6=@empty, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffffffffffffa}, {0x0, 0x0, 0xff}, 0x0, 0x0, 0x1}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x2c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x1c) 2.545666008s ago: executing program 4 (id=2809): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4008000}, 0x40020) mkdirat(0xffffffffffffff9c, 0x0, 0x777) syz_usb_connect$uac1(0x0, 0x72, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x1739, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0x2, 0xd0, 0x9, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x1, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x9, 0x8, 0x4, {0x7, 0x25, 0x1, 0x0, 0x1, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x7, 0x0, 0x7, {0x7, 0x25, 0x1, 0x4, 0x8, 0x8}}}}}}}}]}}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x8, &(0x7f0000000080)=@string={0x8, 0x3, "53d96695174a"}}, {0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0xd8fe}}]}) write(0xffffffffffffffff, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x4f, 0x4e) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/partitions\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000004500)={0x2020}, 0x2020) lseek(r0, 0xfffffffffffffff5, 0x1) syz_open_procfs(0x0, &(0x7f0000000200)='net/ip6_tables_matches\x00') mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000003, 0x401d031, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x6e7}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) munmap(&(0x7f0000c75000/0x4000)=nil, 0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x28f41000) read(r1, 0x0, 0x0) r2 = creat(&(0x7f0000000580)='./file0\x00', 0x12c) syz_open_dev$vcsu(&(0x7f0000000180), 0x1, 0x2242) close_range(r2, r1, 0x2) msync(&(0x7f0000882000/0x1000)=nil, 0x1000, 0x1) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f00000002c0)=@framed, &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.422287211s ago: executing program 1 (id=2810): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x6, @remote, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x4}}, 0x44) syz_emit_ethernet(0x4a, &(0x7f0000000580)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd608a96460014040000000000000000000000000000000000fe8000000000000000000000000000aa00000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="f987c40446a6e7ea"], 0x0) setsockopt(r0, 0x0, 0x488, &(0x7f0000000500)="060000007f00000100150000000000006d6800000000000000000000000000000000000000000000000000007f000001001500"/60, 0x3c) r1 = socket$kcm(0xa, 0x2, 0x0) r2 = socket(0x2, 0x80805, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000240)={0x84, @loopback, 0x4e22, 0x3, 'lblcr\x00', 0x34, 0x80001, 0x70}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e61, 0x3, 'lc\x00', 0x8, 0x20000, 0x77}, {@remote, 0x4e20, 0xac91d2bf000ec5eb, 0xcd}}, 0x44) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x38, 0x0, 0x701, 0x0, 0x0, {{}, {@void, @void, @val={0x9, 0x99, {0xfffffffd, 0x75}}}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1374}, @NL80211_ATTR_VENDOR_SUBCMD={0x0, 0xc4, 0x7}]}, 0x38}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r2, &(0x7f0000000600)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x60, 0x0, 0x400, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x7, 0x47}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x98a}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x6}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x92f}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x6}, @NL80211_ATTR_DURATION={0x8, 0x57, 0xfffffff8}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x4044000) sendmsg$sock(r1, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x97, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/ip6_tables_names\x00') r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r6, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000000140)=ANY=[@ANYBLOB="30000000010401f007000000000000010100000506000640000000000a000200fffffffe08000a000500010001"], 0x30}, 0x1, 0x0, 0x0, 0x260080d4}, 0xc0) socket$nl_netfilter(0x10, 0x3, 0xc) close_range(r6, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000280)) r7 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100009e173610ef171e7206de0102030109021200010000000009040000000206"], 0x0) syz_usb_control_io$printer(r7, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket(0x40000000015, 0x5, 0x0) getsockopt(r8, 0x200000000114, 0x2715, 0x0, &(0x7f0000000040)) 2.090289878s ago: executing program 0 (id=2813): openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000001780), 0x40040, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) memfd_secret(0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000680)='/sys/power/disk', 0x2, 0x0) r0 = syz_open_dev$media(&(0x7f0000000280), 0xc, 0x20200) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0x541b, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = socket(0x11, 0x3, 0xff) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) socket$kcm(0x2, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {}, [], {{0x7, 0x1, 0xb, 0x8}, {0x5, 0x0, 0xb, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={r4, 0x71, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000001200)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9f, 0x0, 0x16, 0x0, 0x0, 0x0, 0x0, 0x13, 0x8, 0x10, 0x0}}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x1c, 0x17, 0x1, 0x70bd26, 0x25dfdbfd, {0x8}, [@typed={0x8, 0x5, 0x0, 0x0, @u32=0x7}]}, 0xff2e}}, 0x0) socket(0xa, 0x80000, 0x87) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) io_uring_enter(0xffffffffffffffff, 0x2219, 0xcf74, 0x52, 0x0, 0x0) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000140)=0x0) ioctl$BTRFS_IOC_WAIT_SYNC(0xffffffffffffffff, 0x40089416, &(0x7f0000000180)=r5) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv2(r6, &(0x7f0000001540)=[{0x0}, {&(0x7f0000001380)=""/129, 0x7ffff000}], 0x2, 0x0, 0x0, 0x0) r7 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a00)=@newqdisc={0x54, 0x12, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0xd}, {0xb, 0x1}, {0x0, 0xa}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x1, 0xc1}}}, @qdisc_kind_options=@q_choke={{0xa}, {0xc, 0x2, [@TCA_CHOKE_MAX_P={0x8, 0x3, 0x2}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x20004040}, 0x50) 1.787216896s ago: executing program 3 (id=2814): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x1, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) write(0xffffffffffffffff, &(0x7f00000000c0)="8f2a0a65bd8c002b0304000e0580a7b6070d63e286a5cefe", 0x5ac) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cb, 0x0, 0xa1d, 0x2000000068ff, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xd000, 0x0, 0x4, 0x0, 0x8, 0x0, 0x0, 0x3, 0x0, 0x8, 0x6, 0x40}, {0xffffffff, 0x10000, 0xa, 0x3, 0x2, 0x0, 0x0, 0x0, 0x7, 0xff}, {0xe6ee2000, 0x3000, 0xc, 0x0, 0x8, 0xc4, 0x0, 0x0, 0x48, 0x3, 0x0, 0xfc}, {0xeeef0000, 0xeee96000, 0xa, 0x0, 0x1, 0xa6, 0x9, 0x0, 0x8, 0x10, 0x7, 0x4}, {0xf000, 0xffff1000, 0xe, 0x0, 0x0, 0x4, 0x0, 0xfd, 0x0, 0x3c}, {0x8000000, 0x0, 0xb, 0x78, 0x5, 0x83, 0x0, 0x0, 0x3, 0xff, 0x1}, {0x1ffe, 0xeeee0000, 0xa, 0x4, 0x0, 0x5, 0xa1, 0x20, 0x0, 0x0, 0x8}, {0x81a0002, 0x6000, 0x8, 0x6, 0x0, 0x5, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0x41000, 0x8cc}, {0xdddd1000}, 0xddf8ffdb, 0x0, 0x0, 0x134, 0xd, 0x0, 0x0, [0x80000005, 0x8, 0x1]}) ioctl$KVM_RUN(r2, 0xae80, 0xf0000000000000) 1.374811131s ago: executing program 0 (id=2815): r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000040)={{{@in=@multicast2, @in6=@mcast2}}, {{@in=@multicast1}, 0x0, @in=@private}}, &(0x7f0000000180)=0xe8) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) write$FUSE_INIT(r1, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$FUSE_INTERRUPT(r1, 0x0, 0x0) syz_fuse_handle_req(r1, 0x0, 0x0, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000045c0)={0x78, 0x0, 0x10006, {0x8, 0x7, 0x0, {0x0, 0x5, 0x1, 0x4, 0x400000004, 0x401, 0xe767, 0x800, 0xe96, 0x8000, 0x2, 0x0, 0x0, 0x80000001, 0xe}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r0, 0x0, 0x48001) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x85}, {{0x0, 0x0, 0x0}, 0xfffffffd}, {{0x0, 0x0, 0x0}, 0xff}, {{0x0, 0x0, &(0x7f0000005740)=[{0x0}, {&(0x7f0000004740)=""/4084, 0xff4}], 0x2}, 0x900000}, {{0x0, 0x0, 0x0}, 0x6}], 0x8, 0x0, 0x0) 1.353167871s ago: executing program 2 (id=2816): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000d00)=ANY=[@ANYBLOB="1c000000020303000000000000000000022000000800010001"], 0x1c}}, 0x40000) sendmsg$IPSET_CMD_FLUSH(r1, 0x0, 0x44000) r2 = syz_open_dev$cec(&(0x7f0000000080), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000100)) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r2, &(0x7f0000000040)={0x20000013}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x100, 0x2001000, 0x9, 0x5, 0x3, 0x1, 0xfffffff8, 0x0, 0x6, 0x9, 0x4, 0x7, 0x4, 0x100000, 0x762, 0x3, 0xd, 0x1000000e, 0x2b12, 0x104, 0x6, 0x5, 0xb, 0x7, 0xbed4, 0x8, 0x1, 0x3, 0x0, 0x11000, 0x80000000, 0x5, 0x79b, 0x2, 0x1, 0x7d, 0x4, 0x1000a, 0x7, 0xf, 0x101, 0xd7, 0xe21, 0x7, 0xaa, 0x81, 0x8, 0x180000, 0x4007, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x5, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x0, 0x4, 0xffffff01, 0x8, 0x752, 0x0, 0x1005, 0x5, 0x10001, 0xffffffff, 0xffffffff, 0x6, 0x4, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x9, 0x84, 0x800100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x7, 0x2, 0x8, 0x8, 0x0, 0x4, 0x2, 0x40, 0x8, 0x4, 0x3, 0x401, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_VERDICT_BATCH(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x3, 0x3, 0x801, 0x0, 0x0, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x4881}, 0x4024000) r5 = openat$cgroup_type(r0, &(0x7f0000000040), 0x2, 0x0) r6 = openat$cgroup_type(r0, &(0x7f0000000540), 0x2, 0x0) clock_settime(0x0, 0x0) rmdir(&(0x7f0000000080)='./cgroup/../file0\x00') sendfile(r5, r6, &(0x7f00000000c0)=0x6, 0x7) 1.264699307s ago: executing program 3 (id=2817): syz_usb_connect(0x5, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000024917720042322023f77010203010902120001000010000904"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000000)={&(0x7f0000000540)=[{0xffff, 0x4411, 0xa9, &(0x7f00000003c0)="8974bf8b9540c246c653cb70282229bc49726167a0a306e45534195bf9284d0d94e62e190395c55daf865f0492a67be9a0c37fde39bd75d3c2416cfbea019fc7ac1d95e475370b6dd28f971264778dac3bb5627a25c17f71359907a92c41c34855fcf2a4d45c1aa5ab1a8208e4026cce5fed2efbffddbb27c5e565f5e96fbd9dd57944b707ab9479843bc14d48e52597c62278585fd9da003c2bb18f79bc51efd67bb219bfb5fa8869"}], 0x1}) (fail_nth: 5) 1.202293978s ago: executing program 0 (id=2818): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x34, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000740)=ANY=[@ANYBLOB="3c00000010000500"/20, @ANYRES32=0x0, @ANYBLOB="01000000010000001400030073797a6b616c6c65723000000000000008000a00", @ANYRES32], 0x3c}}, 0x0) write(r0, &(0x7f0000000700)="ffffffffffff0011223344554305000f", 0x10) 1.161709771s ago: executing program 2 (id=2819): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(0x3) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0xfff, @broadcast, 'macvlan1\x00'}}, 0x1e) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x0, 0x0) r2 = syz_open_dev$I2C(0x0, 0x1, 0x402) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$I2C_SMBUS(r2, 0x720, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0, 0x1, 0xea050000}, 0x0) 1.025366338s ago: executing program 0 (id=2820): r0 = socket$inet(0x2, 0x3, 0x1) r1 = dup(r0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x40, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x800, 0x64004}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_FD1={0x8}, @IFLA_GTP_FD0={0x8}]}}}]}, 0x40}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x9, &(0x7f0000000240)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000002f000000b709000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 1.025106081s ago: executing program 1 (id=2821): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000280)=@ethtool_ringparam={0x33, 0x7f, 0x20022e2e, 0x10040, 0xe, 0x3, 0x2000000, 0x0, 0x3000000}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_IO(r1, 0x2285, &(0x7f00000005c0)={0x53, 0x0, 0x6, 0x2, @scatter={0x0, 0x24000, 0x0}, &(0x7f0000000040)="41c5150d98c6", 0x0, 0x7, 0x0, 0x8000000, 0x0}) 899.147917ms ago: executing program 0 (id=2822): r0 = socket$inet(0xa, 0x801, 0x6) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000082, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r0, 0xfffffffd) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'rose0\x00', 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) sendmsg$inet6(r1, &(0x7f0000003400)={0x0, 0x0, &(0x7f0000003140)=[{&(0x7f0000000200)="283882d32b96e7390d586abac497d1b918b330f42afdf8673f6fdbdf6243aa83316fe6e57d069440462eb3156c83b4c0672d5406e3be0978ba4d80a4581943e19e8eae48f4df95cac039dfb56c5df8fe0257444300a645c54cc14f83c726ed667817", 0x62}, {&(0x7f0000000280)="0d44546f179259804a8ed072c0a71aa2c0cd874c5b880340a0649b1802384cfc7c30fc3a25ffe2604b37e77e4ac72483735701000000000000001098d9ac6add2c165a3fc7698ea2fb04000000000000001f905afe1d79cf31bb5b866d26bc4bd63611", 0x63}, {&(0x7f0000000340)="6385191c98f247585529e5ea03faa00946662b8f118bdb770aac1676d96508a558c53e22ec45effd7c636e97de88f73e3e326ded3b13cbcdfa2c4274b98de6ae5cb54222789f2fad0c0430af4e971d19b75c6ef9334acb57be05aaec1f9d2e0981f7025b182bad8bc899b6ae724f43adad5e6e3e8dcc4ef82e38d1ff679b6b1f9eea19de05b8a6592c296b994aaba82d8af1d94ec17124e07a868b45b15a278004c8feac702f453169529346e1796c", 0xaf}, {&(0x7f0000000400)="c0af955890aa640e5d2190be1b7fe944f00078c7532cf4e280b58d79abe7d5565f85efbd3660ef00191097b96a0ccef2215789f440", 0x35}, {&(0x7f00000007c0)="df50c9bca31c22fe113c57254d1eb9832b6b356c16191cee18a7df4072fa2ed79c13e3c4c337af687040dcd027df19b0b09713e0855ec8ea3f5de82e2bb7077b55f47f1420ddbbf94badd682e7d447cf4533a23d17a50d907d860d5dd004669229a281a30ef7e6b80de5c574a7d0315ca4a8d1351a1729d165568fedad73bab7ca7c066aefb5dabedf64dea878f432468261c6a2031f95af3deb30fd70d005b256ba2bb3f273c72e5e7c063d3a7a84c310a5a7a21663f222c3926774a1180a777ef285203506e3477382dedf162aaf6fe6d38c0f2d818eefea8016c3ac968e2317d6dbde3ebfd70387d19e07759b21d4774b", 0xf2}, {&(0x7f00000008c0)="6054324f5d87460279619546df5c5809edd4f5df87cfa066ef4b363634c0e14ffc9c6c8ce2ae18cd68c17951b3b791f4195abc52b4bfe179bef7ab07994e08c4a597fb9f58be27974b628c08c346fb114706205d4ff5c2da95943491b033467eae7fb7388352514998dafdeed68ea15a91753f4cd80c7b848c4f3dc93be25d53727d00d5a5d70cccfcf91746a7a2723f617d556177e16b65b720d12da4e10e0f487a18e0cba9cda6f457a0de60eabde04251039c78fefbca6afd4727104711614f280a50d71b36eb477eb5735f3cc5bccec0611bf7dd32cb601eb5649e90b42ab7fee5a28cae8c6bdec3651d5922cfbddae0fc2d774c64bcdbcf60237f7147fdddaaf1e18c894560a2c58c6dc1f61ef4e3522d8110cfab277c00ecdbf83984d90db6d2a24fb715d2cf41de7c18ad2c03ba325d1b223a3fc331771e9ae171d310de5d4abdcb7b120d6ea078609413faef99fcf6808f16f587864c7b9da07db007e0392877e74336aa028874855a6cd663a0ac90f48fa99f6f021c06682443a4ba77808ee62b197f76b363ec50ac00a59502daee40b175feebe6adaaaf598828d0074bbdb24aa50c226d3375c5adb802eccb42c5c6b64e90a2edc49dd4809d0162eed2cf89aad6ceff31fd27e9a9b45609480735ef154bc3061ca3225d449556dce5a025b7abe48ba58618e9316b087f690575de49813426809d2545c6e3fb26ef528a1de85e75bd34c18e261a4e3264bac50b086de8cac4bfe565d63115640d82e60616c0e98571c431f47edf61196f8bbd552955812fcd3f823f27b20827daae91aa1cdd31e5e6d551548ef576bfaf93e8e1e51b5cd2f1ae2e4218c3d65b6c5b44cc4c5408d5186ee81c925bfaf9869ddbd519b04788aa25f638bfa8453cbbd3000d3972a3a87608317c6db920b537be1434d243a60d933d6d5e6b859fb5c44b2cfd7947ffd90d494e73b56df5549970d728a90ca80c7fa2b7a1c425f8f336b16b837a49180898297deab2746322f893d82d1ea796255b5b4f6ec662cc0707c88749dcdbc72218c00034e9c900b6d4b75a3a019d99174a42c657468d137a18c8e31e55a9f24fda1bd83e03a6b1a0dc6941562695e65940273208b636616094b3e3cf5cdf881eb50b3d9bd8356ddb20dc4248210d9e1b51d2e2e6581d6f1543268aa3f8b5030d9aac03e75d81d5d8e5b58e8ed8942a96a2c2a5b1770e67bdbd8d3ed9c371a5a1339374bbafd9baf54f4fad724e5d23b4fd956ed5f88b947ed29454ae7769675c5a7a66d5b4d756713f76055d285bade26ba87f50164e2af4c5161c5ef19ebeb91b01dee6be009999a45e48237e085df5619496ca1055eaa65c79aaff9f904fdeb7822a2b261f92cf57d75dfc770af2b8789a458352d6b708dc6f1367134ac1159c0ebf3bbf7363729c09a2768a8e51c50efe6daae343522887dc0317ec4b42a539b7753b1cf3461566e40aa9e40cf883f1c8df76128444b303ca3b10dfd16cb559712459f25feab869ddbb19bf722b4b25d2ae5ff81dcac4b7067c6800cdf229c1d7eacb18c425ef7e499b68ec7aea2a8d38d249ae417dfcc7383fab76360ae7cb6350cbcbc641cc7883984646ab3b696019f94aecc53ec8773655c43337e295782f89edb459a4040990e97d04f899359bdcb98e88bdff3120d021223a5a4194b7bcfd0e458d0eda88adf8017a4d70b0684943f6a9955b05f4e92a957887de76634ab028250a4e7044384fc3afe619f903aebbead46c5b4ea357e4976f1ab268c1a917b23c738befc6f1a3e6aaba575453096d2bc15e2827bec9071cbd8a685e0f5c712218d998eb995f04ac239458c248f0593a6115e77cc6d26884f2fd1490ac6eb291ea76a63c46dcf85ab875f7c711a8e0ebbcbf66f180f12698f58794430b26069829f9d49f7b12417e0599e43c6c872f30592c3e3eb86267f112dfc9c5456676d5ef5fe25965098e66405d904a0efd6c06022d26d57f5b53f526cfcaf1759eb4d1805aa05ea4ba7e77d1d15334675b16e20a246ee82a9333e233070633e19fc417105d96e4e7ae5ff9b765f0e3565d6e741cad4acc67c687bb731fefa444dc05f3d0648aab54a25b79f29c3bdb0bd21fa9b4ba89210498e6c72d174273746a8370c12bde9ac5a8b40df31cfd1d1040f92e0167685105e24f95846973725531f02c2b5af8cd8606ec86241b7fc9f3a6268178027ff465435fa33d73731045721b805af3e53e5424cedf8fe4b58d2bf1f20568a27e83ac5a430ca4798b93d5d1e49f5e1f3102fb2367b026464da24179d0eadb7b225b7b7e292eca483f1ef4e1c34c239f42a423c20b4cfd0a63bb8d24dc895a3412e624a11a6d38ac13e9bc33575f66ede590b23b751267521aefc324feadee4b1e586520237e45c4fa150b51272ea63014ed32c6fc205c1d31936bb4e873598d5a5e1c2759d62fc14cbc47a729393b5d79c24f000dcd67af894fbd3d27f2b80f2c02e1aa668eb0d431b40a95bfd40259be93b2ee15eac0c64cde502ef90b2ec05cfe6be6cbee6734b0b5da0d4e3fbb0f41f0fffde3cae2f519dbbc992899c1875fedb6b09b650d0391e213a3cf4c8cc673c32cb4060e8a576d76be005df0ecb641889538bc3efa414c773642a42e78f49144745041edc6fccede9d42fca5fe8747efcb033f253a8fa55cffb39ce9c47367bbbb7f2b4dc2230a870e4d1c24620a1c09778b47fd49129b0f293fb6c7ff017059c31cfbd2e32f7425929c1e131eccdf6681d9d36a99fb952615cabc27a6c2ea9a6aa69e28182a00669c3b81805be56ecc4f99b70e0026e277fae28ad7d33ce7bf67aa8d9a33bf0c5bb9b3ad2b676133f81ea2f5349c31a0ffee710ea74c596ed0bd5f22385f0408980f2077c9f97141e927e5d148f2c6f92e7d15450969c4a544accadf82545818071248826bec05dba8b686b956e9d2995db8c18cf9fd4c32b48f122a8e0249de9db4334d830616e8785b137c3326cdcae1e142711e1bca5006314a45af5bf75f5db73070a595e0469726c4e5c6563a6f24108d6e27fff754cdf6b8896441b9589803263414eb4367ccfe1a2369c1353350fa2acd76174748702e466ad6e1ff9fc6011b441f697d851cb40628a04c6ec349f6773c7c334fcfda89e989fab0e79ed79fe6b597a3c91e661894d469705748f5486087a51f9e89918f5be5b51863e1709cd66be40be6220b608118c54747a9c88e111314184df2e63494b55c86b7216323ec1ffdf36ab1d3f1e0de67fc5a1914e9374f1efa0d5e73af23062d65245a65e265899f97c322c16b05a00e44a0145fae3b82bec866c82ba9c35420057322579bdfb34509294f135ef6a0db6333fde93274074fdcc4a99a6671fe3cfa72ab1b0fda4e9fdf78c9bcecfc38ade40cac396b06702cb4d7d145940a8fc8bb70152bbd392730af5fe40b7e921e9767d39c6c3cd272c1db5f0794810529adc02eacf250571bba2c59d0dea8ea8465172e76d609a54abd13fbc2fa6cf5f4ef9d1a4d608cf21c3a047b3f9bdec90fc48956449d8a3bcf790a0b85d9e544e1978c7bdf56426484eaaf3ba7011dd6582fc7b4730baf539d6ae67c3fe6285c54fcf5bb6c3c65ac2431e1f7b374bf07fe4f571cde362edf14c6c0dd041c799008f691fdc0b6506bb7ab0369daae0d67310653489b54476c3d5cdb7e83896cf8a0d4ce51fbce135c67ea20fc5ee7cd9ef8f051a67210c8a987009f77fa0c73802e00df6bcc0d0aaa3e00c01eaed08038b9f102f4a1293155e4b86385bc7587cc7f8c06fc13bf82ed715d31907f87cc4d60789a55ceceed4932257ce113731da82020e04570519f895579d7c3d762a8fd394f7a8b108d35c27636847d600228ee9ae05d768b2e077a4be09e5a92e9be52bb4b290c3e5deefb1a1c3158483654682d507ee1ee47c4bf50bbbc72d883f309aea3cdbfcbd98110db9c32f8acd64787ac3a2e667b7527f47207e86b99f3ec51fda06ab80562b3a1295881b0d23d5d4801af36f6f37e1de376b88fde431db04ef9794dd9f20816d810d7498cfa6909f21d4a6a34b8382ab3514943fe8ae40b85bee71b78198adf2670803712e2937b82fa7ea8720995fce8a77a6b504aebec51e82a5af880b6455ac8380e1f925df386651f155c59838fbaf47b7c8547277b28dbc42d1b5cc2fb04ac3ac3fabb284b206d66ecbcac69ada18f3b4fccf57269be838354de2fa3c5a7d8313d805e3ed3a63a33c126a72068836156af4e3a4dfe619c7eec0ab0f73477a6ffb7709f27f34d1a77bb3f37fc96152cc97b1564c7c972ff94231b4e2b1937802b1bc3065a891cb76fd279b21c319cca08f502d755c1cbedc468a53c841b71b28602aa6506e9e1419abbb7189255d0dc2dd3c14cb1066d0c8a057a937ebaed5c80c314b8296292e585f52d30356d9ac2c013f18e17406122e4fedd40688bc81d37c583e4b2415f81b4a288b57e3704585178ea86a19a79d1529a86a9387510ae6758706dc47bf54779271baed021fc05cba1e9cd9fc5258db968b1b0a1f0cc17d0f9ff0fb3201bfcaa1529e9701f62eecc3722e189c74311bf0c5fcc751334a12eb349d869f398bf63ef20ec394d03a89950eb51de768d973c276350d9764c3cc5db6bc3c1197eeea27b00c932e5a6d5d89036f86c7454c6b4cc890d2546c93aa9ab8f89826fea93e0da946cedb46eb058eff326ae58c36b32fbe207e7dfa7d34f86560400435bab4b3af4d344ff665151e095932458a42c6aa6fa15068d6fed0d861cf7a01933bd8b6cf4c1583e0aa919f29b98ab331135b245c106b2454937f4b9bfc7d59fec9b514b7953675dfdd006a35f76d1043effec6ca8ea691f605dd9024b27e4e99b2907488e04c71bebc83e459c8d1d12746e95531923c4a932d44f589c53d692e26ff7ee20e9db5442165acf83e41a39df0318222fb3c9978fe225de19b55c0bc1c2ba3216f5c85dbaaf0c7ffe34c4badbc21a5b70d63193153cb6b8e2494564dcacad9981e6df946bc7b84a22933fe9f4431cbdd8c3c53691e198d24c5f438de2bbb37179f3bbc6d5058975a101f341f36ee7bf093732958da0edd94d31fa5592f72d58a2036f6b40fd829dc0a30361dfda9855ebeb08bba66608c180bc8772731be8aadef6ab1cba396823ebe3c01318c7e1a6ba20da8fbe36c4ddf9f522c8ea80072cf7dd384f10512df7911589a08db004f688fe6ed80f84d3b1086560b345d8bba4853a3f39fb8e309a4ffc2e51f6262f81dc0dbeb4786c8c53fec5f0aff7f964c2844f915f6bf3e840e6b49338b4c76ed52e8974a4727adbddb3362579ba93a5a0d8adeaceefe15a1064ba50d6dd135d40dc4e6ad90c21077cecc2b0ba0255ea350a41f82e99e0dda086810f6af295145f4923d7acab3bc1b759d6b35ae69e5945a748e227255d18bab3d527879ea2c7123dee06ef6803b8d24d0af48b00565d07ab4284363d27f0d92a2ca887ecce1e90a97b79bba705d8ee6181bd82508255991f1dd0af907ef63fb9ed31db3827e872b7033c755663e4f8ad6d52aaa6f9a27512a8d5483f1725b703a84de5341c7be933dfbddf2260d883fc9158e44cd8ebf8caccfed42a616568442cbe04dfb07fb5b98cc8af2609154c92ef15620f81922343344bc95d915e27eca9f901e5aa3e25c93794da9660ada708bb5480d40512e72895e67274781d3b54853b6479a6004e8b41cd4b2bc8e4a63849a4ebffe55ceb45a36a55a24a67a30a0ad5252998a80459cfea2a03e83879f35d13f2dae983354825771ac2060a459c740f925d", 0x1000}, {&(0x7f00000018c0)="f971df720a4b3b317010e1e84a59d4de08064cc09f7583b60712c5cf4e1bb2cededdd69972f3e0d223709185349a67a077880fe4835f50fb81a06bb2c56c3f2e5ce45462", 0x44}, {&(0x7f0000001980)="3120c85a5dab65a882e88f2d013052032e2af0284d441dc40aff216e581d0e72e382ecd636030286a52cc3583ebd915ce130d8fc9ae6966ef6f6472925a0b438803c344b8588ca7bc9da5c6333a2669a9b122e6738f90457e3c22e9e6569fbbacd1f8d5b2d53ea2e561eeb291e2d8695c8b948beb2bfbdc9e9949ee4be7cc1edca26039f9a36e33fce53655ba0ecc0e6bffca79ab12d72e058e2a6f27079", 0x9e}, {&(0x7f0000001a40)="253950bc0fd60c6f7a4f93665432da831a49f9b1c34f35bb204417aad135fb51511eb2e7763e0c79bfa9e40419c68519b65effd6506b62331532b32590ee2daf9c769564ee307b7a8ad9061b9f9185eaaefbf31f9a665ef203b6935f1ae48243bb157e4df4b58118223173dcd256a7d758093a1161e8daffe5cd88db6e82fda927cc653af51966032125d872006bf4a700fed60a15c0e2a805044754cf1576a9ba1cd0c666e46a98575bb06e525eb91831bbe90412507aa2d3efa9f523b7c8a91da452aa6d44cd", 0xc7}, {&(0x7f0000002140)="568a0f62fd9f775eb22564e8c4c5b6cb9331da810669cecb30e647a52f3e62b2d93944b725667126522adb042f6b97380b94ea90ace6a45893df5497c882a34a49fd7a4eddf55fcd3da98bfa000f58b3c987c36724b56c9e7e42d73b69f7c22b89b41ee0c8595012a7ab5856b016c4fbda5414fbafcf728b3c07dc9c2c01a899e9bb3755be7bca4e457342c4caee6e6bac298b3016b984169c6ba7aa4be15254b114ff869748b0fa43da3148171242737412da4c693ec3f16b9f842bfa54e0bd53827c1dc91637e0771280337c4f301298c16ffd4ad009761cc3ad60bebf4d039d6f55c24e358ee7f3b599ee88a5cb7a41d53af090dae08b19956abbd3623200f0d94826e6f29a45f296c7314fcdd7e379739882467f8b4e94b627ea8df0890e0950c336633742ca65167db59c26868bd87aee7c38629abcacdaf557cd09c7fb6cadfa842bbe140c918ce4ac7b8ab141b0b2f8341cfc82bbfb9193b9501ffa81d1f70d5930ddfe2b503effa124fe96a6e905760cabee5cefaddd8f9825047c209cc715fbbaac770c3c6979bcf50fa79b096273041de3b51b0b54494e34453d02d1005c66b331027ec85fbadc656b266afe8349fad7e86762e2b9193ec1d6bb26788ed95f661f9dc2c7bb0be65f0f8793e3e470a9cd668dcd446543fbae0728372d3753f5e7f9ccfd95b62a0b52c175e062b754d806094b0c35e76a1b06abd63f57142be2c8e9e31a9d7a7d44bbb830badb5f5c45d00dbeff7fe7b02d3470f2b05579de8d29477d6258aa76099393f5d063d9653adf1d541391cbfbe84ef38236fa2ad9a795691e84c1be2b6ff9a1f970f18f65c32e496367b6fed1b162efab08ccbf15f5d4945a35e06079587f06ea8db3ac7814c2fea92e1297e42fdf87b070df2ebd9c731c15ae1a88e1be03bc3d88b48658c1e15f040aec9101423f9959f19883b150f97db1f2c4964f4a5d8cf8078a9568801c20cf81c09f9a24d42896af1e1d64115327fb0e0d3a0fc95486d2967b8d89892fd8aad9c9a45837e807a8704e1b3a2f2598b5d241862a0de91d72d560b9686aae6c0f68683d6075eda51627f5613eeb20b6048ee7662f812e481f4b51316095218bda4eba21a677999b76843c587d255c07ed3612001b2c7d65838a72c577295e33bd9a26060a34c9e1969240b89cb4706d0547c82bba838e1a6ec30b351b698175f437192b7afed22ca2ea4939b54bb6c88e55fd7e2f207f39d3247c64425b7560e2eeeb074b07490815f4dd77e2dc4b04c90e458f4d8056651288eacdaaf5fe0dd8c1890fe0afc8cbb8a936af0b8380f66b9697d03d7cccf1da09a491b8ce4c7b38ad8358509f6a580ecafe97ee985e1a4b20bfbf40bf226ace80b594290f00b017a8ec9dd234ced1a76e5d90894435a6e4e74343614e4690a3b2d3c11f5712dab3c0278ad55e52272044d5bc1f1b9bb0ead8c8221ac6e0130f14aa3e5c15d38819e74800a4f157e96f97da2b91c7b4be4ea20ac6080587202e5a68ad014b8be9d5329b55fbca34a69cb0c2c5ba5e232a31535150115df63ec2f84a9490a2bebb7a3a2f3246c02f6559c5d83717e353659091b2976f35b702e67e49a67f855974c80e3daeac649171e9299e5af26ca2f3c23b996111de9a3ed979ce43b1c1f99f185ada40789b73d89c0db2c475405e1d929980b57fd950c13ba9389b7339cde35d22946882a06c78f9a6c9ba868c62a7b1180dfcb1cfa654e5c27677acb19707485db8a3ee1f46d2daaeae72309c2b155f3230cd5cd6f10b595cf4b5526aa43ab1d1784585a1e7a0823b35851118d4c4cd785676d532eb4b2faad93d3d3b3b6b31aa776347eeee77c32e320e50b03dce97272158caf9772a80ea2564b4c19f5f97184762fdf00d30917c75a3dc27e340bc16b9c562e5e7a67bfc6a2a3069cb32939990b2c5fe020c66b75a887fb159c34962a15fb374094eb1abf639cc396f2eb34bb3580f09d02e8623d6c7cbdb8d46aada0e59db29c915fb5bee158450a0608de841a396dabf30d019326af8212ffee7e08595c406b6e19ca842ce2df7b65354acc5fab35205f2ab85e2eee729025b395ba0c48901d9409c750b0b15fcec45969c205804fad8bc49c2395853f7b660168eed06234485595bc57c59682faa04d6e941107c24a1a9b48f0cff39d2600fd048a1b6c25292c2a927cced535e940d7150d1a7163f8af9152d42c7d69c56878cf16ab7226959bdf778c35c1d5060557683c4f48d98cb1f98de7aaea8e9678446db5ba9b14481b0e2643e94faef029600e3a18e24b50d07eb50b98945cb19b50b5bbcab78a612122111f5b79e523a73aa926346500b5e78e68bd6870081f7bed0be11bc5e9629ff88efd1d81257c56279463009230fcf65c5bd20a974a77ad1b4de3953008d1982291badc20db6ddaa381712cc55f36b0fa774df5ab2805c47e5074335306b54ec70f52b6273419dcb6976094c281a72c2693ad0fd78b8efaf812ffe31369e39b2351706eb1a4c97cebbf1cf66a1971d21660e89f299c64c3d9d579ec1eacde6dd53ec2b7f3906b6be3264b024562eca8c6973e1537ab50645257e4d8276bc9470bb8ba4ee786da49fe5449558d7693c346ca6ebf4f94965c087a75120cb7ea4257b8d94cd194d241955bf20e14a98e503ec18e950adcfb3cf0f575a76c10f003cb2c48ef7c581374b6082bf0399671ed540541f4567db21d19accea2d40c835df630cef8b489fe08fd618210fad6bc7ba7cfd92adfff6978179320c93ef0ab64a6230e750123fda0e6a4591fe5203997f3984a32d74677a270dda76c6415f421cba9dadab9321ae1092995f533e0199db1046bdf73d018748a677cfe475f12f6e1d5850554d18197c98c3d2950bf6cf0acb6781fe0d4a4b7fae4186936c5779b9c9a9dcb7e94f1aa1e963525213f0bf926235da13a83c62ef19d22839252f6e6601747ff74f67fb9ce245d6517d4f79dd33f5e3f8e52eceba2dd34ab89d5dc398f9e8ff5323a44d3ca9c9b8ce456c2858b5878cce9f7a5df461f775e233dd5b8e2ab9053daf42dc251fe0fe70b64c09166af48c65931b08c33dca3ae26df324164d04b03d96c83098555ec177c60be7cebdddbb9875b023276a32c1d2542e1ca91fba928d9d018c98651ac03048fc12a19b1bba2d1c2cf5e56a26f009a56416bb902e3b417fafda24b97020c6d2a0d829a79125ad2d8ae07fcea455bee9670022cbe11fd04e0364018fd681f2f44456f52b3e02c4fdc8e9cd5bd116d3222478f925792a8fb5eaf58496c10ddc87d867202ea9038e374696ffa92d9882bd68dd30888e974e544608cb65231f515498f1d8a1d272f7b03f177ccbe1760df0b601aef539e0fe447dfd89acfc39ec50bb7e2aa682da991a70e1ea93478aa39b2b497c45e006c6d555388f59121ccb11fd69c4020b0c80f2b58802a36d62752d4bbcc5a10fe204d337bbee08d223124ba92790bc39f8a986fb89b740a77f8cf66b30635b52abd4e599c979e78b130c6b393208c2090b405d51d09befc091813f4939c5652a127fae54785568292a8971c339570fb074a31da18074f1a39e608f087f3b35971c6e4d0e19b698efb30229b1227c205e8f1ec6e585dd339b6971fdaa8fb825138f1404d8d65412edd069d7bca3b17dc9a69ff62f11025e0c874f3ccaf521bedc5597b0e65729980980d6835744ed764585d550dc8faf433507944284060f30f227c00fc9bbaf409e768104c0c0cd167637ed4990fcabca3290a644c97448d38239c4e83412cb4ee5999e945bbeacb120f4af0337445261824c42fa80646b3881035ce7ee516a477abfe0c4a629efba8507c833a1f2e8c1538bc06f0f412079bb8c1c4dd3373281f976c5f81ec4e5ebe8204a4e428d2b715c6d47e9c6c85cc1c846ba823976f07cee3148ce495fa3b9f18fa69bb718b51fa20b977d96d9875bbfed0a6c4e3ad6d3b21a656c76d63d19f030921f713684e95ac20830455b4237b2eb2c20527debf8f4ccb26e104b2bd4e041ac41f9be407b03f776cded7734e0b90b264ed054ca727fd359ef14f49cb3e3898221906626cdeec76a3e837910cf9515d4d9b5dd1e85c428fbd9997a324d32b62488f9971780567298a67cb9e6464106ecd83e14936cd80f187eaceaa3f1d711710b7f34bbf8e6675707718b463a496f49f50b03aa7580d3a1daec58063dab79b39bff6a1d4cbe87af96c5551e289b834c45312b9ee5fa40db7bee39e8a35455a68c2ebeca7a0b9c11f1429a09c6f2aff5a086d2e63d8d277f45538aca68ce48386f0b3c195ddf635e938a0e01b39bf663dd56a5208743b55741a42796c053697406f5067a7e523e10d09dda3190c4c5152be8ea1d0ffd662d42634e1d4b42f3497ef1ee6dab8a760bfca7d5b155e75fef00ba4e266aa58d683a074487e4555c28c8cf45456e11e062616f4f2934d051d7903b47ff1681f0f11b6100996e5eb4dbb95e9311baef3625a66952a046dd47bafc5f4daa0451c049554a2e37afede1fc1be94072a0f4274be373cea87f466ec15862a8cdc479bdebae4c5e028cc01fc02584ba46df7d151626e1fc88f8656b887c57aeaabcc23f8b6f57936c956088ccdc42dcf5d176a085a5f0360c6bdd183ddb9ef90cb014aa316dafee4c2abba1b22de5d8336889cf22ffaabec34c6b2a3027c17683931cbf2705bc7ac886ba632a05d03f66741204246683c5a0524d6fb6473d278773f417372f9483c519b00f1358b9145c797d4450f30ac00fe591fc7683f4e16b5bddd244555c4b8ea3e58dfba7186f6ec9753d0afe148f9f47d260c87602a618f888764cd938ad691a64627048c6c03059d889213676a3374c5a8bd42e374a8b0586a2a436f1942780878988b3baa0c8adfbc78e36cc7e0ff0ba142fcd70b4b3f1734e175fd710818c09c99051bf8876bb8be3fb6e275c2d98a294f87503a3400b0779efafa01449bbaf8af482136f2f012e5be508293dd9ae9b4c600bf0d649cde08f1f31909428e47c4f24bd0f5af2f2176bb2a2f8f629969a0496be30904eb43c2aaa0f57b0fc6ec51ec62f91dfc2411bcc56ed5bdba3640a06a95b306e2561b5ee7f129f6b69f4a7f4fce50608a29210050879ca9e4ab7c8a6af9a2aa051e9a1fd89a37ed529de2dca6c81bf0d3f4abe3b66ce635dfe2a99486b524d39f7b17ecc7fae25aa50f3b04666be7d7c246b369947e9b3693d2de07a8d5933e3d02dbf05cb848594ee793fa309c61da5f5157b929f4b0ba3e90ee077894302e10a6e3a6401957b5463654de3dcff12b523c4d2d6af87af014551dee059cb99be9ff7ab7cff5d6ec1cb8c4c7e4e5708145d30412d1f5802415a27026a8754d0bd7480c277b02f3760edc78f98684a4b63763df52c7293ff38136f523da78766dd1e6baf0219fe01fa83eab65a2a1b79766fcbca52508b0be0a961da4e9b1edd3c9b8481a63cae80c77003ecd7e3ec3826409b023a937049acd6460de5cf9adf12b8b63d4173b86817c905597bd495735e08dbb8c4fc3462412194095ef12ef742a15c09e64122492ce4b88ec44d3c92b3ad0ab5a3330274c6fc9d62678ea4e504f018836ec9dc6d7982ee3cf3d2476e8f5c4d720ff9d64495798076b526fda78800d2e8bfe7fb979a46ce9cdc1ea1b271aa80ab446315251a9b36c5165adea52baeac3a1eafe734181ca9b34f291f8cc9177781cdb37600a60d251721ad86a1931ae3d2e56311ec29c2e1b08b1e42f4986a704850ad7cae4751a7dbbf65d9fffe55ea8b0c8c49a381c51d38", 0x1000}], 0xa, &(0x7f0000001d80)=ANY=[@ANYBLOB="280000000000000029000000390000003302010900000000fe8000000000000000000000000000bbbafeffffffffffff2900000039000000010e000100000000ff020000000000000000000000000001fc00000000000000000000000000000100000000000000000000ffffe000000100000000000000000000000000000000ff01000000000000000000000000000100000000000040c98861f92ca7000000000000000000ff020000000000000000000000000001a80000000000000029000000390000000812010f00000000ff02000000000000000000000000000100000000000000000000000000000001ff020000000000000000000000000001fc0100003b790000000000000000000120010000000000060000000000000001fe8000000000000000000000000000aafe800000000000000000000000000032fc00000000000000000000000000000100000000000000000000000000000000140000000000000029000000340000009203862400000000380000000000000029000000370000001603000000000000c2040000bc1b040109c910200100000000000000000000000000010000000000280000000000000029000000370000002c01000000000000040108010700000000000000010100001400000000000000290000000b000000000000000000000024000000000000002900000032000000fe800000000000000000000000000028", @ANYRES32=r3, @ANYBLOB="0000000020000000000000002900000036000000ff00000000000000c204000000050000"], 0x230}, 0x20000010) tkill(0x0, 0x3e) 703.451453ms ago: executing program 0 (id=2823): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = syz_ublk_setup_io_uring(0x1acf, &(0x7f0000002d00)={0x0, 0xba95, 0x1000, 0x2, 0x234}, &(0x7f0000002d80), &(0x7f0000002dc0), &(0x7f0000002e00)) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r0, 0xe, &(0x7f0000003480)={0xffffffff, 0x0, 0x0, 0x0}, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000040)=ANY=[], 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000001c0)={'ip_vti0\x00', 0x0}) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r2, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000100)={{0x100, 0xfffe, 0x0, 0xd}, 'syz1\x00', 0x2c}) ioctl$UI_DEV_CREATE(r2, 0x5501) r3 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x101100) socket(0x2, 0x805, 0x0) read(r4, 0x0, 0x0) ioctl$UI_DEV_DESTROY(r2, 0x5502) fstat(0xffffffffffffffff, &(0x7f00000002c0)) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0) syz_80211_inject_frame(&(0x7f0000000140), &(0x7f0000000200)=ANY=[@ANYBLOB="5000000008021100000008020000000008"], 0x42) 486.587947ms ago: executing program 2 (id=2824): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000006c0)={0x14, 0x0, &(0x7f0000000680)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f00000002c0), 0x6f5e, 0x402) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f00000000c0)={0x0, 0x5, 0x494}) syz_open_dev$dvb_frontend(0x0, 0x0, 0x882) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000900000002000000ffff000005"], 0x48) r3 = socket(0x10, 0x3, 0x4) syz_open_dev$vim2m(0x0, 0x7fff, 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) r4 = fsopen(&(0x7f0000000340)='overlay\x00', 0x1) fsconfig$FSCONFIG_SET_PATH_EMPTY(r4, 0x4, 0x0, &(0x7f0000003740)='./file0\x00', 0xffffffffffffff9c) ioctl$vim2m_VIDIOC_G_FMT(0xffffffffffffffff, 0xc0285628, 0x0) sendmsg$AUDIT_MAKE_EQUIV(r3, 0x0, 0x20020000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000ac0)=@IORING_OP_FUTEX_WAIT={0x33, 0x28, 0x0, 0x74, 0x81, &(0x7f0000000a40)=[{&(0x7f0000000540)="d5a6334393b08fe623db1666fff398946fc39794b7cf00be63c81522a54a69ef5715c186912fd1b501380487192cb70e4eea54e6384bb8816d909dd5d992015b5c7bc08a61119d954db9672a8b8a6c53b9d04fffbe6407fbf61eeab8835367de94ce64e55bb076ee7cf806a0faf6290cb362ada5fd0c5fdcddc6a8afab3bd35f9af6085e1e167f735a0135813709fb445e4e10e40934bfae6f8140b161e7ef3b8a86d1b3e96b503275b9ab588a5b9fff7558b97e3c901400937751", 0xbb}, {&(0x7f0000000600)="50b690cf993fc25c36c6457b432eb09d0947814d84b8d94a635b22c922e3d34ba4c30172519c3d3f8c9ab544fc5eed9b881c77aa91f1af", 0x37}, {&(0x7f0000000640)="acd6291acb46425b1d2594fc2bacd9e91585d2a9cc5f2d4de4ad2739cb503c3ada51be49755ec46e59803612d582f119263e6bd1d3283737987189ef21391a50ea0968c086d1a65c225f41b5fa5a017c09c21b29a2c0505b67c7173e423fcad729409c689bd46329234676e1fbccb02ca483b52fba37ca720db6f833c3e80d12ec0683654982df208fd7db890969b26661defe11b2f2447f4d632b3383c2ff91f007e06c15563265fb3f47a8afc2bb65eef51738", 0xb4}, {&(0x7f0000000700)="5393b76b8b2cedacd764383069132a3a41c3830f396b642b946889e9278fc28df7f96dd3f529117bea82c4b2d26acc71e8580300b0a814dd99307065f08c29272ae231a0f24b4a2493e38cb4942cd368bf7d977075d9cea329ecd1d19efea4a5ae9a4b64809b315911c7993a050741012675b26f5b850adb90eab1c743c49d32b39980e5046e66c18d0d82128e51e41d027bfd3de4b54bd939cc3e7c59ab2aca97b01160cb7475432d6b81fcb7d96a7b26019a0bab", 0xb5}, {&(0x7f00000007c0)="edb340a79b5c3368d3ecbadb2eb0fb8a13f5b9a55b7923262287ce3c8963959e0e4bf18e9c", 0x25}, {&(0x7f0000000880)="2d0ae4be14d5c2ea1ff6ffb3d8a4b44da0fa0eee8d4520574c4a57326cf781a9ec354a3e060db6beb283d9ae9a8b9e4b4a22f79dc63ba3dc28d06ad82a603c36eda471290d45cb40085a10399563622127ed01cbf20ba984d5ecb746eadb6511cf3669e70ae567c34c1b7022c6d77c65b1b1b4e5895d9c7c994c8fe43fefcbd3dd183615ac06edcf37a13eba6fd54f5a", 0x90}, {&(0x7f0000000940)="8b26dcd1f89f8c0bc7eaa311898374f96b49a5e965fe5a0c949b8e68603425eb1d2344fb0077d109e00029d90195ad0deeeda3", 0x33}, {&(0x7f0000000980)="0ff65947a0ee85e8bc450d8c784e5e59b33e2bc91706b760d429d4d6fb2c0bff3f718a1cfa20a2c15423cdb0b0a214b052618b7883b05bbf9410be5ec37de58817b3b1156d385cb38c4b99b86ed63ef4e211295598f510b568114d30cc0ff8818de6c0cd405babcc33ac2b39d2bde36235390868d2561058001a2b60af48b5c82f54d021ac3f", 0x86}], 0x0, 0x0, 0x1, {0x0, 0x0, 0x0, 0x80000000}}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f0000000280), 0x1, 0x100) r5 = socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x20000) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x1c) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000100)={0x0, 0x6, 0x3, &(0x7f0000000080)={0x2, "1a9c66bf2f615e4200000000e200"}}) 192.498842ms ago: executing program 4 (id=2825): socket$inet_udp(0x2, 0x2, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) add_key(0x0, 0x0, 0x0, 0x0, r0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$loop(&(0x7f0000000180), 0x200000002, 0x400) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs/binder0\x00', 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r1 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) syz_usb_connect(0x3, 0x46, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000e95b1710720500cbc9bb00020301090234"], 0x0) socket$kcm(0x29, 0x5, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x80) openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r3, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0xe00, r5}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0xfd}], 0x1, 0x0, 0x0, 0x88000}}], 0x1, 0x0) 75.137301ms ago: executing program 1 (id=2826): r0 = socket$inet6(0xa, 0x3, 0x3) syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) r3 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000180)='./file1\x00', 0x0, 0x0, r3}, 0x18) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) unshare(0x400) r4 = socket$inet(0xa, 0x801, 0x84) connect$inet(r4, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r5 = accept4(r4, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7d, &(0x7f0000000140)={0x0, 0x4}, 0x8) ioctl$TIOCSLCKTRMIOS(0xffffffffffffffff, 0x5457, &(0x7f0000000000)) bind$alg(0xffffffffffffffff, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x4b291000) sendmsg$unix(0xffffffffffffffff, 0x0, 0x11) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="6000000002060300000000050000000007000000140007800500150002000000080012400000000414000300686173683a69702c706f72742c697000050005000200000005000400050000000900020073797a31000000000500010007"], 0x60}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) sendmsg$IPSET_CMD_ADD(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x48, 0x9, 0x6, 0x3, 0x0, 0x0, {0xa}, [@IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x5, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x2009, 0xfffffffc, 0x573a, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x5, 0x4, 0x1007, 0x7, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4000004, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x40a, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x1000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x38, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x8, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x5, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2cd, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffc, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x13, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0x10000, 0xf, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000006, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x4, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0xffe0) 5.309476ms ago: executing program 3 (id=2827): openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x3f00, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="2309fefffffffcffffff0100000005000700000000000800090000000000060002000100000008000a000400010008001700", @ANYRES32], 0x3c}}, 0x0) 0s ago: executing program 3 (id=2828): openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) (async) r0 = socket$packet(0x11, 0x3, 0x300) (async) openat$audio1(0xffffffffffffff9c, &(0x7f0000000040), 0x203a2, 0x0) (async) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x101, 0x0) (async) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) dup3(r1, r0, 0x80000) (async) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xf4a, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4043, 0x8a, 0x0, 0x0, 0x1000, 0x1, 0x0, 0x0, 0x1}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x3, 0x10d}, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x617d, 0x80, 0x2000, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed80, 0x4000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x1, 0x401f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4e48, 0x400, 0x2, 0x367}}], 0x1, &(0x7f0000000840)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xffb9, 0x4, 0x0, 0x0}}, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40500000000000071109f000000000006000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x3, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) (async) r8 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) write$vga_arbiter(r8, &(0x7f0000000300)=ANY=[@ANYBLOB='trylkck im\x00'], 0xb) wait4(0x0, &(0x7f00000000c0), 0x1000000, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r9 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000500)={0x0, 0x30b5, 0x0, 0x2, 0x377}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r9, r10, r11, r12, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x6, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, &(0x7f0000000480)=0x0) (async) r14 = socket$inet6_tcp(0xa, 0x1, 0x0) r15 = dup(r14) syz_ublk_setup_queues(r15, r13, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0xfffffffd, 0x32c}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x15a, 0x0, r9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ac7, 0x8000, 0x10000000, 0x546}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x3, 0xfffffffc}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r15, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0x3, 0x826, 0x0, 0x0}}, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r16 = syz_open_procfs(0x0, &(0x7f0000019080)='net/connector\x00') pread64(r16, &(0x7f0000000080)=""/102356, 0x18fd4, 0x1c) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r18, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000380), 0x200000, 0x0) (async) recvmmsg(r17, &(0x7f0000001900)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=""/71, 0x47}, 0x4}, {{0x0, 0x0, 0x0}, 0x7d}], 0x2, 0x40000002, 0x0) kernel console output (not intermixed with test programs): device_add_class_symlinks+0xb6/0x240 [ 526.796832][T14012] device_add+0x467/0xb80 [ 526.796856][T14012] netdev_register_kobject+0x197/0x350 [ 526.796884][T14012] register_netdevice+0x1433/0x1eb0 [ 526.796918][T14012] ? __pfx_register_netdevice+0x10/0x10 [ 526.796945][T14012] ? dst_cache_init+0x185/0x270 [ 526.797063][T14012] ? dst_cache_init+0x1ff/0x270 [ 526.797092][T14012] geneve_newlink+0xcb3/0x1090 [ 526.797161][T14012] ? __pfx_geneve_newlink+0x10/0x10 [ 526.797206][T14012] ? rtnl_create_link+0xa04/0xd70 [ 526.797229][T14012] ? __pfx_geneve_newlink+0x10/0x10 [ 526.797254][T14012] rtnl_newlink_create+0x305/0x7b0 [ 526.797278][T14012] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 526.797300][T14012] ? __pfx___mutex_lock+0x10/0x10 [ 526.797337][T14012] ? ns_capable+0x89/0xe0 [ 526.797364][T14012] rtnl_newlink+0x166d/0x1c30 [ 526.797405][T14012] ? __pfx_rtnl_newlink+0x10/0x10 [ 526.797431][T14012] ? __lock_acquire+0x747/0x2de0 [ 526.797458][T14012] ? __lock_acquire+0x747/0x2de0 [ 526.797491][T14012] ? lock_acquire+0x115/0x350 [ 526.797517][T14012] ? lock_acquire+0x115/0x350 [ 526.797545][T14012] ? is_bpf_text_address+0x26/0x2b0 [ 526.797574][T14012] ? __lock_acquire+0x747/0x2de0 [ 526.797599][T14012] ? __kernel_text_address+0xd/0x30 [ 526.797619][T14012] ? unwind_get_return_address+0x4d/0x90 [ 526.797641][T14012] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 526.797660][T14012] ? arch_stack_walk+0xfb/0x150 [ 526.797691][T14012] ? lock_acquire+0x115/0x350 [ 526.797731][T14012] ? __pfx_rtnl_newlink+0x10/0x10 [ 526.797755][T14012] rtnetlink_rcv_msg+0x802/0xc00 [ 526.797779][T14012] ? netlink_sendmsg+0x5d4/0xb40 [ 526.797803][T14012] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 526.797828][T14012] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 526.797855][T14012] ? __lock_acquire+0x747/0x2de0 [ 526.797886][T14012] netlink_rcv_skb+0x226/0x4a0 [ 526.797907][T14012] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 526.797934][T14012] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 526.797966][T14012] ? netlink_deliver_tap+0x2e/0x1b0 [ 526.797986][T14012] ? netlink_deliver_tap+0x2e/0x1b0 [ 526.798010][T14012] netlink_unicast+0x7bd/0x940 [ 526.798039][T14012] netlink_sendmsg+0x813/0xb40 [ 526.798067][T14012] ? __pfx_netlink_sendmsg+0x10/0x10 [ 526.798096][T14012] ? apparmor_socket_sendmsg+0x98/0x360 [ 526.798121][T14012] ? __pfx_netlink_sendmsg+0x10/0x10 [ 526.798141][T14012] sock_sendmsg_nosec+0x13a/0x180 [ 526.798165][T14012] ____sys_sendmsg+0x54e/0x850 [ 526.798198][T14012] ? __pfx_____sys_sendmsg+0x10/0x10 [ 526.798232][T14012] ? import_iovec+0x73/0xa0 [ 526.798261][T14012] ___sys_sendmsg+0x2a5/0x360 [ 526.798287][T14012] ? __lock_acquire+0x747/0x2de0 [ 526.798310][T14012] ? __pfx____sys_sendmsg+0x10/0x10 [ 526.798370][T14012] ? __fget_files+0x2a/0x420 [ 526.798395][T14012] ? __fget_files+0x3a2/0x420 [ 526.798431][T14012] __x64_sys_sendmsg+0x1b1/0x290 [ 526.798460][T14012] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 526.798508][T14012] do_syscall_64+0x166/0x520 [ 526.798533][T14012] ? trace_irq_disable+0x3b/0x140 [ 526.798551][T14012] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.798571][T14012] ? clear_bhb_loop+0x70/0xc0 [ 526.798593][T14012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.798612][T14012] RIP: 0033:0x7f48afd9e1d9 [ 526.798630][T14012] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 526.798645][T14012] RSP: 002b:00007f48b0ca4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 526.798665][T14012] RAX: ffffffffffffffda RBX: 00007f48b0025fa0 RCX: 00007f48afd9e1d9 [ 526.798679][T14012] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 526.798690][T14012] RBP: 00007f48b0ca4090 R08: 0000000000000000 R09: 0000000000000000 [ 526.798701][T14012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 526.798713][T14012] R13: 00007f48b0026038 R14: 00007f48b0025fa0 R15: 00007f48b014fa48 [ 526.798749][T14012] [ 527.145312][T14016] netlink: 'syz.4.2537': attribute type 1 has an invalid length. [ 527.147318][T14016] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2537'. [ 527.172389][ T71] net_ratelimit: 1 callbacks suppressed [ 527.172406][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 527.368063][T14020] netlink: 'syz.0.2539': attribute type 1 has an invalid length. [ 527.383262][T14020] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2539'. [ 527.401523][T14025] FAULT_INJECTION: forcing a failure. [ 527.401523][T14025] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 527.401554][T14025] CPU: 1 UID: 0 PID: 14025 Comm: syz.4.2540 Tainted: G L syzkaller #0 PREEMPT(full) [ 527.401578][T14025] Tainted: [L]=SOFTLOCKUP [ 527.401586][T14025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 527.401596][T14025] Call Trace: [ 527.401603][T14025] [ 527.401612][T14025] dump_stack_lvl+0xe8/0x150 [ 527.401642][T14025] should_fail_ex+0x410/0x560 [ 527.401671][T14025] _copy_from_user+0x2d/0xb0 [ 527.401698][T14025] snd_seq_ioctl+0x213/0x490 [ 527.401818][T14025] ? __pfx_snd_seq_ioctl+0x10/0x10 [ 527.401852][T14025] ? __fget_files+0x3a2/0x420 [ 527.401879][T14025] ? __fget_files+0x2a/0x420 [ 527.401908][T14025] ? bpf_lsm_file_ioctl+0x9/0x20 [ 527.401937][T14025] ? __pfx_snd_seq_ioctl+0x10/0x10 [ 527.401956][T14025] __se_sys_ioctl+0xfc/0x170 [ 527.401983][T14025] do_syscall_64+0x166/0x520 [ 527.402009][T14025] ? trace_irq_disable+0x3b/0x140 [ 527.402028][T14025] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.402046][T14025] ? clear_bhb_loop+0x70/0xc0 [ 527.402067][T14025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.402085][T14025] RIP: 0033:0x7f48afd9e1d9 [ 527.402101][T14025] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 527.402113][T14025] RSP: 002b:00007f48b0ca4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 527.402138][T14025] RAX: ffffffffffffffda RBX: 00007f48b0025fa0 RCX: 00007f48afd9e1d9 [ 527.402149][T14025] RDX: 0000200000000180 RSI: 00000000c0a85352 RDI: 0000000000000003 [ 527.402159][T14025] RBP: 00007f48b0ca4090 R08: 0000000000000000 R09: 0000000000000000 [ 527.402168][T14025] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 527.402177][T14025] R13: 00007f48b0026038 R14: 00007f48b0025fa0 R15: 00007f48b014fa48 [ 527.402200][T14025] [ 527.452950][T14024] x_tables: duplicate entry at hook 3 [ 527.682631][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 527.694158][ T6222] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 527.824043][T14035] ip6t_hbh: unknown flags 38 [ 527.841526][ T6222] usb 4-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.00 [ 527.842615][ T6222] usb 4-1: config 1 has an invalid descriptor of length 102, skipping remainder of the config [ 527.842638][ T6222] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 527.842684][ T6222] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 527.863349][T14035] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 527.863909][T14035] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 527.910764][ T9] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 528.055197][T14024] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2541'. [ 528.058655][ T6222] usb 4-1: string descriptor 0 read error: -71 [ 528.061766][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 528.064143][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 528.064188][ T9] usb 5-1: New USB device found, idVendor=0b05, idProduct=1739, bcdDevice= 0.40 [ 528.068364][ T6222] usb 4-1: interface 1 not found [ 528.072473][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.072494][ T9] usb 5-1: Product: syz [ 528.072507][ T9] usb 5-1: SerialNumber: syz [ 528.078815][ T6222] usb 4-1: USB disconnect, device number 90 [ 528.192053][ T6833] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 528.301969][T14041] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4294967295 (8589934590 ns) > initial count (474742790 ns). Using initial count to start timer. [ 528.700953][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 528.750266][T14049] netlink: 'syz.1.2550': attribute type 1 has an invalid length. [ 528.764436][T14049] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2550'. [ 528.799620][ T9] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 528.804607][ T9] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 528.898764][ T9] usb 5-1: USB disconnect, device number 114 [ 528.955486][ T5623] udevd[5623]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 528.980699][ T9845] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 529.110735][ T5701] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 529.143196][T14050] binder: 14048:14050 ioctl c018620c 200000000900 returned -1 [ 529.172544][ T9845] usb 4-1: unable to get BOS descriptor or descriptor too short [ 529.172597][ T9845] usb 4-1: New USB device found, idVendor=1235, idProduct=8012, bcdDevice= 0.40 [ 529.173457][ T9845] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 529.173491][ T9845] usb 4-1: can't read configurations, error -71 [ 529.212744][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 529.293497][T14057] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 529.324825][ T5701] usb 2-1: Using ep0 maxpacket: 32 [ 529.332185][ T5701] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 529.336738][ T5701] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 529.351046][ T5701] usb 2-1: config 0 descriptor?? [ 529.369294][ T5701] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 529.721721][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 530.194346][ T5762] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 530.230881][ T6502] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 530.347552][T14077] x_tables: duplicate entry at hook 3 [ 530.351257][ T5762] usb 3-1: Using ep0 maxpacket: 16 [ 530.353871][ T5762] usb 3-1: unable to get BOS descriptor or descriptor too short [ 530.353917][ T5762] usb 3-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 530.361062][ T5762] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 530.361087][ T5762] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 530.372193][ T5762] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 530.372637][ T5762] usb 3-1: Product: syz [ 530.372651][ T5762] usb 3-1: Manufacturer: syz [ 530.372665][ T5762] usb 3-1: SerialNumber: syz [ 530.400178][T14081] ip6t_hbh: unknown flags 38 [ 530.439899][T14081] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 530.440888][T14081] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 530.601302][ T25] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 530.632892][T14071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.634873][T14071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.641714][T14071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.642270][T14071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.741844][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 530.751591][ T25] usb 4-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.00 [ 530.767287][ T25] usb 4-1: config 1 has an invalid descriptor of length 102, skipping remainder of the config [ 530.767312][ T25] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 530.767385][ T25] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 530.825702][ T5762] usb 3-1: USB disconnect, device number 2 [ 530.906602][T14085] netlink: 'syz.4.2561': attribute type 1 has an invalid length. [ 530.907549][T14085] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2561'. [ 530.992204][T14077] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2559'. [ 530.993364][ T25] usb 4-1: string descriptor 0 read error: -71 [ 530.996177][T14052] IPVS: rr: TCP 127.0.0.1:21 - no destination available [ 531.000400][ T25] usb 4-1: interface 1 not found [ 531.009709][ T25] usb 4-1: USB disconnect, device number 93 [ 531.251006][ T6502] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 531.301867][ T5701] gspca_vc032x: reg_w err -110 [ 531.301886][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301892][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301897][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301901][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301906][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301911][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301915][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301920][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301925][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301929][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301934][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301938][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301942][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301947][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301951][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301956][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301961][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301965][ T5701] gspca_vc032x: I2c Bus Busy Wait ed [ 531.301970][ T5701] gspca_vc032x: Unknown sensor... [ 531.302012][ T5701] vc032x 2-1:0.0: probe with driver vc032x failed with error -22 [ 531.530725][ T25] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 531.681389][ T25] usb 1-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 531.682487][ T25] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 531.682538][ T25] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 531.701930][ T25] as10x_usb: device has been detected [ 531.705753][ T25] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 531.718520][ T25] usb 1-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 531.780163][ T25] as10x_usb: error during firmware upload part1 [ 531.780520][ T25] Registered device Abilis Systems DVB-Titan [ 531.860711][ T5701] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 532.031654][T14097] binder: 14096:14097 ioctl c018620c 200000000900 returned -1 [ 532.064212][ T5701] usb 4-1: unable to get BOS descriptor or descriptor too short [ 532.064243][ T5701] usb 4-1: New USB device found, idVendor=1235, idProduct=8012, bcdDevice= 0.40 [ 532.066832][ T5701] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 532.066854][ T5701] usb 4-1: can't read configurations, error -71 [ 532.121283][ T25] usb 2-1: USB disconnect, device number 7 [ 532.272059][ T6502] net_ratelimit: 2 callbacks suppressed [ 532.272074][ T6502] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 532.477124][ T25] usb 1-1: USB disconnect, device number 2 [ 532.485893][T14091] usb usb8: usbfs: process 14091 (syz.0.2563) did not claim interface 4 before use [ 532.527568][ T25] Unregistered device Abilis Systems DVB-Titan [ 532.533290][ T25] as10x_usb: device has been disconnected [ 532.781389][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 533.160819][ T5701] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 533.178704][T14118] netlink: 'syz.0.2572': attribute type 1 has an invalid length. [ 533.182725][T14118] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2572'. [ 533.291247][ T6502] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 533.311450][ T5701] usb 4-1: Using ep0 maxpacket: 32 [ 533.312143][ T5701] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 533.313149][ T5701] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 210, changing to 11 [ 533.313176][ T5701] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8771, setting to 1024 [ 533.313216][ T5701] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 533.317627][ T5701] usb 4-1: config 0 descriptor?? [ 533.334361][ T5701] hub 4-1:0.0: USB hub found [ 533.341106][T14121] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2573'. [ 533.341139][T14121] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2573'. [ 533.415681][T14122] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2573'. [ 533.415718][T14122] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2573'. [ 533.542139][ T31] kauditd_printk_skb: 436 callbacks suppressed [ 533.542159][ T31] audit: type=1326 audit(1791510140.871:33466): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.3.2571" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbebdb9e1d9 code=0x7ffc0000 [ 533.543584][ T31] audit: type=1326 audit(1791510140.871:33467): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.3.2571" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fbebdb5ea0e code=0x7ffc0000 [ 533.544166][ T31] audit: type=1326 audit(1791510140.871:33468): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.3.2571" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbebdb9de6b code=0x7ffc0000 [ 533.546980][ T31] audit: type=1326 audit(1791510140.871:33469): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.3.2571" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbebdb9de6b code=0x7ffc0000 [ 533.550046][T14116] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 533.550535][T14116] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 533.555512][ T31] audit: type=1326 audit(1791510140.881:33470): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.3.2571" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbebdb9e1d9 code=0x7ffc0000 [ 533.558042][ T31] audit: type=1326 audit(1791510140.881:33471): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.3.2571" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fbebdb9e1d9 code=0x7ffc0000 [ 533.558087][ T31] audit: type=1326 audit(1791510140.881:33472): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.3.2571" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbebdb9e1d9 code=0x7ffc0000 [ 533.558124][ T31] audit: type=1326 audit(1791510140.881:33473): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.3.2571" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbebdb9e1d9 code=0x7ffc0000 [ 533.562693][ T31] audit: type=1326 audit(1791510140.891:33474): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.3.2571" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7fbebdb9e1d9 code=0x7ffc0000 [ 533.562738][ T31] audit: type=1326 audit(1791510140.891:33475): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.3.2571" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbebdb9e1d9 code=0x7ffc0000 [ 533.681169][ T25] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 533.700751][ T5759] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 533.800960][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 533.832327][ T25] usb 3-1: Using ep0 maxpacket: 32 [ 533.833093][ T25] usb 3-1: New USB device found, idVendor=0582, idProduct=015b, bcdDevice= 0.40 [ 533.836362][ T25] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 255, changing to 7 [ 533.838845][ T25] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 533.838867][ T25] usb 3-1: Product: Ð¥ [ 533.838881][ T25] usb 3-1: Manufacturer: 쳼璉î˜â¸¹í˜…枑뙖∆ḅâƒá›žë«¿ê¹‚宗킥⑮娠䣾࿛í’ë’› [ 533.838919][ T25] usb 3-1: SerialNumber: ㉠[ 533.856908][ T5759] usb 5-1: Using ep0 maxpacket: 16 [ 533.859582][ T5759] usb 5-1: unable to get BOS descriptor or descriptor too short [ 533.859628][ T5759] usb 5-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 533.865016][ T5759] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 533.865038][ T5759] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 533.872110][ T5759] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 533.872134][ T5759] usb 5-1: Product: syz [ 533.872148][ T5759] usb 5-1: Manufacturer: syz [ 533.872187][ T5759] usb 5-1: SerialNumber: syz [ 533.981046][ T5762] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 534.059243][T14114] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2570'. [ 534.069144][ T25] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 534.104101][T14124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 534.105852][T14124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 534.109939][T14124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 534.110330][T14124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 534.132770][ T5762] usb 1-1: Using ep0 maxpacket: 32 [ 534.146613][ T5762] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 534.162885][ T5762] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 534.162912][ T5762] usb 1-1: config 0 has no interface number 0 [ 534.162952][ T5762] usb 1-1: config 0 interface 12 has no altsetting 0 [ 534.166533][ T5762] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.166558][ T5762] usb 1-1: Product: syz [ 534.166572][ T5762] usb 1-1: Manufacturer: syz [ 534.166615][ T5762] usb 1-1: SerialNumber: syz [ 534.173214][ T5762] usb 1-1: config 0 descriptor?? [ 534.222768][ T25] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 534.249625][ T5701] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 534.255621][ T25] usb 3-1: USB disconnect, device number 3 [ 534.281889][ T5701] usbhid 4-1:0.0: can't add hid device: -71 [ 534.282018][ T5701] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 534.311245][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 534.329964][ T5701] usb 4-1: USB disconnect, device number 96 [ 534.335587][ T9] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 534.348165][ T5623] udevd[5623]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 534.404859][ T5759] usb 5-1: USB disconnect, device number 115 [ 534.517260][T14138] binder: 14137:14138 ioctl c018620c 200000000900 returned -1 [ 534.536831][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 534.536880][ T9] usb 2-1: New USB device found, idVendor=1235, idProduct=8012, bcdDevice= 0.40 [ 534.538716][ T9] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 534.538747][ T9] usb 2-1: can't read configurations, error -71 [ 534.736963][T14147] netlink: 'syz.2.2583': attribute type 1 has an invalid length. [ 534.737651][T14147] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2583'. [ 534.802480][ T5701] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 534.821681][ T6505] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 534.950830][ T5701] usb 4-1: Using ep0 maxpacket: 32 [ 534.952983][ T5701] usb 4-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 534.954311][ T5701] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 534.984138][ T5701] usb 4-1: config 0 descriptor?? [ 534.996987][ T5701] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 535.119832][ T5762] f81534 1-1:0.12: f81534_set_register: reg: 1002 data: 0 failed: -71 [ 535.119874][ T5762] f81534 1-1:0.12: f81534_find_config_idx: read failed: -71 [ 535.119884][ T5762] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 535.119947][ T5762] f81534 1-1:0.12: probe with driver f81534 failed with error -71 [ 535.165199][ T5762] usb 1-1: USB disconnect, device number 3 [ 535.184159][T14166] binder: 14163:14166 unknown command 1078485782 [ 535.184181][T14166] binder: 14163:14166 ioctl c0306201 2000000002c0 returned -22 [ 535.194713][T14166] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(7) [ 535.194739][T14166] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 535.194871][T14166] vhci_hcd vhci_hcd.0: Device attached [ 535.225782][ T5701] gspca_vc032x: reg_r err -32 [ 535.225800][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225811][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225819][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225828][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225837][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225845][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225854][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225870][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225879][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225887][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225896][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225904][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225913][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225921][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225930][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225939][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225948][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225972][ T5701] gspca_vc032x: I2c Bus Busy Wait 00 [ 535.225981][ T5701] gspca_vc032x: Unknown sensor... [ 535.226055][ T5701] vc032x 4-1:0.0: probe with driver vc032x failed with error -22 [ 535.322837][T14166] fuse: Unknown parameter 'group_S‚' [ 535.334141][T14168] vhci_hcd: connection closed [ 535.339980][ T6502] vhci_hcd vhci_hcd.1: stop threads [ 535.340006][ T6502] vhci_hcd vhci_hcd.1: release socket [ 535.340026][ T6502] vhci_hcd vhci_hcd.1: disconnect device [ 535.341703][ T6502] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 535.349313][T14171] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2590'. [ 535.438415][T14175] lo: entered allmulticast mode [ 535.752792][ T9] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 535.842259][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 535.900762][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 535.904353][ T9] usb 3-1: New USB device found, idVendor=15ca, idProduct=1806, bcdDevice= 0.40 [ 535.925806][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 535.925853][ T9] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 535.942031][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.942058][ T9] usb 3-1: Product: syz [ 535.942069][ T9] usb 3-1: Manufacturer: syz [ 535.942083][ T9] usb 3-1: SerialNumber: syz [ 535.956180][ T6220] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 536.003090][ T5762] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 536.150698][ T6220] usb 1-1: Using ep0 maxpacket: 16 [ 536.153837][ T6220] usb 1-1: unable to get BOS descriptor or descriptor too short [ 536.153873][ T6220] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 536.155921][ T6220] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 536.155943][ T6220] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 536.158579][ T6220] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.158672][ T6220] usb 1-1: Product: syz [ 536.158697][ T6220] usb 1-1: Manufacturer: syz [ 536.158709][ T6220] usb 1-1: SerialNumber: syz [ 536.247254][T14191] binder: 14190:14191 ioctl c018620c 200000000900 returned -1 [ 536.298720][ T5762] usb 5-1: unable to get BOS descriptor or descriptor too short [ 536.298771][ T5762] usb 5-1: New USB device found, idVendor=1235, idProduct=8012, bcdDevice= 0.40 [ 536.299572][ T5762] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 536.299603][ T5762] usb 5-1: can't read configurations, error -71 [ 536.350939][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 536.388189][ T9] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 536.388346][ T9] usb 3-1: MIDIStreaming interface descriptor not found [ 536.449146][T14187] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 536.461342][T14187] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 536.466562][T14187] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 536.469188][T14187] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 536.493206][ T9] usb 3-1: USB disconnect, device number 4 [ 536.585841][ T5622] udevd[5622]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 536.668278][ T6220] usb 1-1: USB disconnect, device number 4 [ 536.751643][T14207] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(7) [ 536.751669][T14207] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 536.751795][T14207] vhci_hcd vhci_hcd.0: Device attached [ 536.756975][T14207] fuse: Invalid rootmode [ 536.758548][T14208] vhci_hcd: connection closed [ 536.772689][ T5820] vhci_hcd vhci_hcd.1: stop threads [ 536.772715][ T5820] vhci_hcd vhci_hcd.1: release socket [ 536.772735][ T5820] vhci_hcd vhci_hcd.1: disconnect device [ 536.862350][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 536.904483][T14211] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4294967295 (8589934590 ns) > initial count (474742790 ns). Using initial count to start timer. [ 537.371301][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 537.535078][ T9] usb 4-1: USB disconnect, device number 97 [ 537.882308][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 537.899566][T14237] FAULT_INJECTION: forcing a failure. [ 537.899566][T14237] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 537.899600][T14237] CPU: 0 UID: 0 PID: 14237 Comm: syz.0.2611 Tainted: G L syzkaller #0 PREEMPT(full) [ 537.899624][T14237] Tainted: [L]=SOFTLOCKUP [ 537.899632][T14237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 537.899643][T14237] Call Trace: [ 537.899651][T14237] [ 537.899659][T14237] dump_stack_lvl+0xe8/0x150 [ 537.899692][T14237] should_fail_ex+0x410/0x560 [ 537.899722][T14237] _copy_from_user+0x2d/0xb0 [ 537.899749][T14237] ___sys_sendmsg+0x1c6/0x360 [ 537.899779][T14237] ? __lock_acquire+0x747/0x2de0 [ 537.899807][T14237] ? __pfx____sys_sendmsg+0x10/0x10 [ 537.899839][T14237] ? kstrtouint+0x6e/0xe0 [ 537.899881][T14237] ? __fget_files+0x2a/0x420 [ 537.899909][T14237] ? __fget_files+0x3a2/0x420 [ 537.899943][T14237] __sys_sendmmsg+0x273/0x4d0 [ 537.899974][T14237] ? __pfx___sys_sendmmsg+0x10/0x10 [ 537.900036][T14237] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 537.900077][T14237] ? ksys_write+0x242/0x270 [ 537.900098][T14237] ? __pfx_ksys_write+0x10/0x10 [ 537.900122][T14237] __x64_sys_sendmmsg+0xa0/0xc0 [ 537.900141][T14237] do_syscall_64+0x166/0x520 [ 537.900166][T14237] ? trace_irq_disable+0x3b/0x140 [ 537.900186][T14237] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.900206][T14237] ? clear_bhb_loop+0x70/0xc0 [ 537.900228][T14237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.900245][T14237] RIP: 0033:0x7f6a6579e1d9 [ 537.900262][T14237] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 537.900277][T14237] RSP: 002b:00007f6a6671a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 537.900296][T14237] RAX: ffffffffffffffda RBX: 00007f6a65a25fa0 RCX: 00007f6a6579e1d9 [ 537.900310][T14237] RDX: 0000000000000002 RSI: 0000200000002b00 RDI: 0000000000000003 [ 537.900322][T14237] RBP: 00007f6a6671a090 R08: 0000000000000000 R09: 0000000000000000 [ 537.900334][T14237] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 537.900344][T14237] R13: 00007f6a65a26038 R14: 00007f6a65a25fa0 R15: 00007f6a65b4fa48 [ 537.900373][T14237] [ 538.390946][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 538.500825][ T5701] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 538.650644][ T5701] usb 2-1: Using ep0 maxpacket: 16 [ 538.651515][ T5701] usb 2-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 538.652976][ T5701] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 255, changing to 7 [ 538.684124][ T5701] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 538.684141][ T5701] usb 2-1: Product: syz [ 538.684148][ T5701] usb 2-1: Manufacturer: ì—«ä„žî«ã´†á¹†ê ´é¯§à£žãŒ¦á€£à¿Šéµƒâ¹‚年찻낟ïªã—…ä¨ç¨§ë²¥â»¸à£ï›¯é§ë¨‰ë‹ºè¼¸ìºˆë•†Ý£íˆœî“ꮱ腤éªæ–í¬Ë‡ã½’럹â»ä¼„咤ꣾ㱄尊瞠퉺æ [ 538.684159][ T5701] usb 2-1: SerialNumber: syz [ 538.740711][ T6220] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 538.777695][T14250] ALSA: mixer_oss: invalid OSS volume 'LINEine' [ 538.777709][T14250] ALSA: mixer_oss: invalid OSS volume '' [ 538.890750][ T6220] usb 1-1: Using ep0 maxpacket: 16 [ 538.894780][ T6220] usb 1-1: unable to get BOS descriptor or descriptor too short [ 538.894830][ T6220] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 538.896394][ T6220] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 538.896416][ T6220] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 538.898883][ T6220] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 538.898905][ T6220] usb 1-1: Product: syz [ 538.898918][ T6220] usb 1-1: Manufacturer: syz [ 538.898930][ T6220] usb 1-1: SerialNumber: syz [ 538.902974][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 539.143815][T14247] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 539.144359][T14247] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 539.162946][T14247] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 539.165825][T14247] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 539.412003][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 539.468594][ T6220] usb 1-1: USB disconnect, device number 5 [ 539.498629][T14262] ALSA: mixer_oss: invalid OSS volume 'LINEine' [ 539.498648][T14262] ALSA: mixer_oss: invalid OSS volume '' [ 539.921614][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 539.968712][T14266] fuse: Unknown parameter 'rootmoë¥*¹1hˆV' [ 540.036463][ T5701] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 540.060925][ T5701] snd-usb-audio 2-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 540.226381][ T5701] snd-usb-audio 2-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 540.230463][ T5701] usb 2-1: USB disconnect, device number 10 [ 540.291712][ T5756] udevd[5756]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 540.430814][ T6502] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 540.469779][T14276] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4294967295 (8589934590 ns) > initial count (474742790 ns). Using initial count to start timer. [ 540.563262][ T31] kauditd_printk_skb: 73 callbacks suppressed [ 540.563319][ T31] audit: type=1326 audit(1791510147.891:33549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14271 comm="syz.0.2622" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x0 [ 540.612654][ T31] audit: type=1326 audit(1791510147.941:33550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14271 comm="syz.0.2622" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x0 [ 540.941384][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 541.030670][ T9] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 541.180673][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 541.181437][ T9] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 541.184378][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.184401][ T9] usb 2-1: Product: syz [ 541.184414][ T9] usb 2-1: Manufacturer: syz [ 541.184428][ T9] usb 2-1: SerialNumber: syz [ 541.403233][ T9] usb 2-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 541.433887][ T9] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 541.434258][ T9] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 541.434303][ T9] usb 2-1: media controller created [ 541.461191][ T6833] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 541.486776][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 541.564498][T14287] FAULT_INJECTION: forcing a failure. [ 541.564498][T14287] name failslab, interval 1, probability 0, space 0, times 0 [ 541.564532][T14287] CPU: 1 UID: 0 PID: 14287 Comm: syz.3.2627 Tainted: G L syzkaller #0 PREEMPT(full) [ 541.564558][T14287] Tainted: [L]=SOFTLOCKUP [ 541.564565][T14287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 541.564578][T14287] Call Trace: [ 541.564586][T14287] [ 541.564595][T14287] dump_stack_lvl+0xe8/0x150 [ 541.564629][T14287] should_fail_ex+0x410/0x560 [ 541.564658][T14287] should_failslab+0xa8/0x100 [ 541.564684][T14287] ? __kernfs_new_node+0xe6/0x980 [ 541.564707][T14287] kmem_cache_alloc_noprof+0xa1/0x600 [ 541.564731][T14287] ? __kernfs_new_node+0xe6/0x980 [ 541.564758][T14287] __kernfs_new_node+0xe6/0x980 [ 541.564788][T14287] ? __pfx___kernfs_new_node+0x10/0x10 [ 541.564811][T14287] ? kernfs_root+0x1c/0x230 [ 541.564837][T14287] ? kernfs_root+0x1c/0x230 [ 541.564856][T14287] ? kernfs_root+0x1c/0x230 [ 541.564873][T14287] ? kernfs_root+0x1c/0x230 [ 541.564897][T14287] kernfs_new_node+0xea/0x140 [ 541.564923][T14287] __kernfs_create_file+0x4b/0x2e0 [ 541.564952][T14287] sysfs_add_file_mode_ns+0x237/0x300 [ 541.564985][T14287] internal_create_group+0x679/0x1180 [ 541.565017][T14287] ? __pfx_internal_create_group+0x10/0x10 [ 541.565041][T14287] ? up_write+0x19d/0x4a0 [ 541.565071][T14287] sysfs_create_groups+0x59/0x120 [ 541.565092][T14287] device_add_attrs+0x12c/0x600 [ 541.565121][T14287] ? __pfx_device_add_attrs+0x10/0x10 [ 541.565149][T14287] ? kobject_put+0x50f/0x550 [ 541.565172][T14287] ? device_add_class_symlinks+0x21f/0x240 [ 541.565198][T14287] device_add+0x488/0xb80 [ 541.565221][T14287] input_register_device+0x9d7/0x1150 [ 541.565250][T14287] uinput_create_device+0x53e/0x690 [ 541.565378][T14287] uinput_ioctl_handler+0x433/0x15a0 [ 541.565410][T14287] ? __pfx_uinput_ioctl_handler+0x10/0x10 [ 541.565446][T14287] ? __fget_files+0x2a/0x420 [ 541.565472][T14287] ? __fget_files+0x3a2/0x420 [ 541.565502][T14287] ? bpf_lsm_file_ioctl+0x9/0x20 [ 541.565531][T14287] ? __pfx_uinput_ioctl+0x10/0x10 [ 541.565555][T14287] __se_sys_ioctl+0xfc/0x170 [ 541.565580][T14287] do_syscall_64+0x166/0x520 [ 541.565606][T14287] ? trace_irq_disable+0x3b/0x140 [ 541.565626][T14287] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.565645][T14287] ? clear_bhb_loop+0x70/0xc0 [ 541.565666][T14287] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.565685][T14287] RIP: 0033:0x7fbebdb9e1d9 [ 541.565705][T14287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 541.565721][T14287] RSP: 002b:00007fbebe97e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 541.565743][T14287] RAX: ffffffffffffffda RBX: 00007fbebde25fa0 RCX: 00007fbebdb9e1d9 [ 541.565757][T14287] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003 [ 541.565769][T14287] RBP: 00007fbebe97e090 R08: 0000000000000000 R09: 0000000000000000 [ 541.565780][T14287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 541.565791][T14287] R13: 00007fbebde26038 R14: 00007fbebde25fa0 R15: 00007fbebdf4fa48 [ 541.565822][T14287] [ 541.724445][ T9] zl10353_read_register: readreg error (reg=127, ret==-32) [ 541.977402][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 542.038236][T14294] program syz.1.2624 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 542.143735][T14299] fuse: Bad value for 'fd' [ 542.490946][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 542.740781][ T5762] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 542.910831][ T5762] usb 4-1: Using ep0 maxpacket: 16 [ 542.918065][ T5762] usb 4-1: unable to get BOS descriptor or descriptor too short [ 542.918111][ T5762] usb 4-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 542.919302][ T5762] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 542.919324][ T5762] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 542.961301][ T5762] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 542.961327][ T5762] usb 4-1: Product: syz [ 542.961341][ T5762] usb 4-1: Manufacturer: syz [ 542.961354][ T5762] usb 4-1: SerialNumber: syz [ 543.004225][ T6502] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 543.212429][T14306] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.214654][T14306] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 543.239048][T14306] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.239485][T14306] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 543.515310][ T5762] usb 4-1: USB disconnect, device number 98 [ 543.520773][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 543.639029][T14326] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2637'. [ 543.699716][ T31] audit: type=1326 audit(1791510151.021:33551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14327 comm="syz.0.2638" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 543.699768][ T31] audit: type=1326 audit(1791510151.021:33552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14327 comm="syz.0.2638" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 543.699808][ T31] audit: type=1326 audit(1791510151.021:33553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14327 comm="syz.0.2638" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 543.699845][ T31] audit: type=1326 audit(1791510151.021:33554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14327 comm="syz.0.2638" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 543.699882][ T31] audit: type=1326 audit(1791510151.021:33555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14327 comm="syz.0.2638" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 543.699920][ T31] audit: type=1326 audit(1791510151.021:33556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14327 comm="syz.0.2638" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 543.852383][ T31] audit: type=1326 audit(1791510151.191:33557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14327 comm="syz.0.2638" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 543.852514][ T31] audit: type=1326 audit(1791510151.191:33558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14327 comm="syz.0.2638" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 544.032469][ T6833] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 544.093720][T14335] FAULT_INJECTION: forcing a failure. [ 544.093720][T14335] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 544.093753][T14335] CPU: 0 UID: 0 PID: 14335 Comm: syz.1.2639 Tainted: G L syzkaller #0 PREEMPT(full) [ 544.093778][T14335] Tainted: [L]=SOFTLOCKUP [ 544.093785][T14335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 544.093796][T14335] Call Trace: [ 544.093805][T14335] [ 544.093813][T14335] dump_stack_lvl+0xe8/0x150 [ 544.093846][T14335] should_fail_ex+0x410/0x560 [ 544.093875][T14335] _copy_from_user+0x2d/0xb0 [ 544.093902][T14335] copy_folio_from_user+0x1e3/0x320 [ 544.093937][T14335] hugetlb_mfill_atomic_pte+0xe4c/0x1770 [ 544.093981][T14335] mfill_atomic_copy+0xc87/0x14b0 [ 544.094068][T14335] ? __pfx_mfill_atomic_copy+0x10/0x10 [ 544.094100][T14335] userfaultfd_copy+0x413/0x7e0 [ 544.094135][T14335] ? __pfx_userfaultfd_copy+0x10/0x10 [ 544.094161][T14335] ? hook_file_ioctl+0x1f2/0x600 [ 544.094207][T14335] userfaultfd_ioctl+0x49a/0x560 [ 544.094231][T14335] ? __fget_files+0x2a/0x420 [ 544.094259][T14335] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 544.094282][T14335] ? __fget_files+0x2a/0x420 [ 544.094307][T14335] ? __fget_files+0x3a2/0x420 [ 544.094333][T14335] ? __fget_files+0x2a/0x420 [ 544.094361][T14335] ? bpf_lsm_file_ioctl+0x9/0x20 [ 544.094387][T14335] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 544.094414][T14335] __se_sys_ioctl+0xfc/0x170 [ 544.094439][T14335] do_syscall_64+0x166/0x520 [ 544.094474][T14335] ? trace_irq_disable+0x3b/0x140 [ 544.094495][T14335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.094518][T14335] ? clear_bhb_loop+0x70/0xc0 [ 544.094542][T14335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.094561][T14335] RIP: 0033:0x7fd5f319e1d9 [ 544.094579][T14335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 544.094594][T14335] RSP: 002b:00007fd5f405f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 544.094615][T14335] RAX: ffffffffffffffda RBX: 00007fd5f3425fa0 RCX: 00007fd5f319e1d9 [ 544.094629][T14335] RDX: 0000200000000000 RSI: 00000000c028aa03 RDI: 0000000000000008 [ 544.094641][T14335] RBP: 00007fd5f405f090 R08: 0000000000000000 R09: 0000000000000000 [ 544.094653][T14335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 544.094664][T14335] R13: 00007fd5f3426038 R14: 00007fd5f3425fa0 R15: 00007fd5f354fa48 [ 544.094695][T14335] [ 544.486033][T14343] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 544.533191][ C1] blk_print_req_error: 157 callbacks suppressed [ 544.533213][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 544.533295][ C1] buffer_io_error: 155 callbacks suppressed [ 544.533308][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 544.533335][ C1] I/O error, dev loop9, sector 1 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 544.533394][ C1] Buffer I/O error on dev loop9, logical block 1, async page read [ 544.533414][ C1] I/O error, dev loop9, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 544.533502][ C1] Buffer I/O error on dev loop9, logical block 2, async page read [ 544.533523][ C1] I/O error, dev loop9, sector 3 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 544.533589][ C1] Buffer I/O error on dev loop9, logical block 3, async page read [ 544.533609][ C1] I/O error, dev loop9, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 544.533666][ C1] Buffer I/O error on dev loop9, logical block 4, async page read [ 544.533685][ C1] I/O error, dev loop9, sector 5 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 544.533741][ C1] Buffer I/O error on dev loop9, logical block 5, async page read [ 544.533757][ C1] I/O error, dev loop9, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 544.533814][ C1] Buffer I/O error on dev loop9, logical block 6, async page read [ 544.535381][ C1] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 544.535451][ C1] Buffer I/O error on dev loop9, logical block 0, async page read [ 544.535473][ C1] I/O error, dev loop9, sector 1 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 544.535529][ C1] Buffer I/O error on dev loop9, logical block 1, async page read [ 544.535548][ C1] I/O error, dev loop9, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 544.535604][ C1] Buffer I/O error on dev loop9, logical block 2, async page read [ 544.542811][ T6833] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 544.564000][ T4982] ldm_validate_partition_table(): Disk read failed. [ 544.569705][ T4982] Dev loop9: unable to read RDB block 0 [ 544.581032][ T5762] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 544.652295][ T4982] loop9: unable to read partition table [ 544.652500][ T4982] loop9: partition table beyond EOD, truncated [ 544.742779][ T5762] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 544.743374][ T5762] usb 5-1: config 0 has no interfaces? [ 544.774538][ T6222] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 544.817439][ T5762] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 544.817462][ T5762] usb 5-1: Product: syz [ 544.817470][ T5762] usb 5-1: Manufacturer: syz [ 544.817477][ T5762] usb 5-1: SerialNumber: syz [ 544.819213][ T5762] usb 5-1: config 0 descriptor?? [ 544.942640][ T6222] usb 4-1: New USB device found, idVendor=0782, idProduct=0047, bcdDevice= 0.40 [ 544.943870][ T6222] usb 4-1: config 1 interface 1 altsetting 26 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 544.943906][ T6222] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 544.943927][ T6222] usb 4-1: config 1 interface 1 has no altsetting 1 [ 544.946569][ T6222] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 544.946593][ T6222] usb 4-1: Product: syz [ 544.946607][ T6222] usb 4-1: Manufacturer: syz [ 544.946619][ T6222] usb 4-1: SerialNumber: syz [ 545.051578][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 545.198405][T14355] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 545.198898][T14355] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 545.315431][T14341] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 545.331879][T14341] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 545.388162][ T6222] usb 4-1: 1:26 : incorrect wMaxPacketSize for BADD profile [ 545.390374][ T6222] usb 4-1: incorrect wMaxPacketSize 0x20 for BADD profile [ 545.501808][ T6222] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 545.525788][ T6222] usb 4-1: USB disconnect, device number 99 [ 545.560832][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 545.596009][ T6125] udevd[6125]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 545.671268][T14331] syzkaller0: entered promiscuous mode [ 545.671293][T14331] syzkaller0: entered allmulticast mode [ 546.000686][ T6222] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 546.071117][ T6833] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 546.156781][ T6222] usb 4-1: Using ep0 maxpacket: 16 [ 546.170136][ T6222] usb 4-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=56.88 [ 546.181850][ T6222] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 546.181874][ T6222] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 546.181908][ T6222] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 546.185663][ T6222] usb 4-1: config 0 descriptor?? [ 546.464710][T14378] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2649'. [ 546.592947][ T6833] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 546.597833][ T9] dvb_usb_gl861 2-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 546.625876][ T9] usb 2-1: USB disconnect, device number 11 [ 546.822896][ T25] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 547.000680][ T25] usb 1-1: unable to get BOS descriptor or descriptor too short [ 547.000718][ T25] usb 1-1: New USB device found, idVendor=1235, idProduct=8002, bcdDevice= 0.40 [ 547.001700][ T25] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 138, changing to 7 [ 547.003547][ T25] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.003568][ T25] usb 1-1: Product: syz [ 547.003582][ T25] usb 1-1: Manufacturer: syz [ 547.003596][ T25] usb 1-1: SerialNumber: syz [ 547.112559][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 547.308630][T14377] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 547.308961][T14377] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 547.620793][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 548.133803][ T6505] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 548.500753][ T9] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 548.640881][ T6505] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 548.650969][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 548.653556][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 548.653605][ T9] usb 2-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 548.654736][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 548.654759][ T9] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 548.657295][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.657383][ T9] usb 2-1: Product: syz [ 548.657400][ T9] usb 2-1: Manufacturer: syz [ 548.657415][ T9] usb 2-1: SerialNumber: syz [ 548.875667][T14384] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 548.876210][T14384] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 548.896479][T14384] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 548.900541][T14384] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 548.999705][ T9] usb 2-1: USB disconnect, device number 12 [ 549.152973][ T6505] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 549.669855][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 549.832146][ T5701] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 549.981693][ T5701] usb 2-1: device descriptor read/64, error -71 [ 550.200798][ T71] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 550.238855][ T5701] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 550.393705][ T5701] usb 2-1: device descriptor read/64, error -71 [ 550.495854][T14366] syzkaller0: entered promiscuous mode [ 550.495870][T14366] syzkaller0: entered allmulticast mode [ 550.499032][T14370] tipc: Enabled bearer , priority 0 [ 550.500269][T14372] tipc: Resetting bearer [ 550.512171][T14360] tipc: Resetting bearer [ 550.531614][ T5701] usb usb2-port1: attempt power cycle [ 550.548036][ T5762] usb 5-1: USB disconnect, device number 118 [ 550.549754][T14360] tipc: Disabling bearer [ 550.629368][ T25] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 550.630101][ T25] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 550.711205][ T6505] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 550.730167][ T6222] usb 4-1: USB disconnect, device number 100 [ 550.804074][ T25] usb 1-1: USB disconnect, device number 6 [ 550.892418][ T5701] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 550.911297][ T5701] usb 2-1: device descriptor read/8, error -71 [ 550.915586][ T5623] udevd[5623]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 551.100759][ T9] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 551.160791][ T5701] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 551.181282][ T5701] usb 2-1: device descriptor read/8, error -71 [ 551.220873][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 551.252206][ T9] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 551.253223][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 551.255988][ T9] usb 5-1: config 0 descriptor?? [ 551.291170][ T5701] usb usb2-port1: unable to enumerate USB device [ 551.291675][ T25] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 551.441284][ T25] usb 4-1: New USB device found, idVendor=0782, idProduct=0047, bcdDevice= 0.40 [ 551.442473][ T25] usb 4-1: config 1 interface 1 altsetting 26 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 551.442513][ T25] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 551.442537][ T25] usb 4-1: config 1 interface 1 has no altsetting 1 [ 551.444710][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.444733][ T25] usb 4-1: Product: syz [ 551.444747][ T25] usb 4-1: Manufacturer: syz [ 551.444761][ T25] usb 4-1: SerialNumber: syz [ 551.461172][T14392] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 551.461624][T14392] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 551.494924][T14392] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 551.496900][T14392] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 551.662069][T14397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 551.662602][T14397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 551.690492][ T25] usb 4-1: 1:26 : incorrect wMaxPacketSize for BADD profile [ 551.698495][ T25] usb 4-1: incorrect wMaxPacketSize 0x20 for BADD profile [ 551.730780][ T6505] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 551.763751][ T25] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 551.784540][ T25] usb 4-1: USB disconnect, device number 101 [ 551.825834][ T5623] udevd[5623]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 551.949817][T14406] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2661'. [ 552.094400][ T9] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 552.097004][ T9] [drm:udl_init] *ERROR* Selecting channel failed [ 552.123463][ T9] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 1 [ 552.123484][ T9] [drm] Initialized udl on minor 1 [ 552.128139][ T9] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 552.128620][ T9] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 552.136561][ T6222] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 552.138837][ T9] usb 5-1: USB disconnect, device number 119 [ 552.140101][ T6222] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 552.140286][ T6222] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 552.241073][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 552.320872][ T25] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 552.321006][ T5701] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 552.471184][ T25] usb 3-1: Using ep0 maxpacket: 16 [ 552.473909][ T5701] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 552.476749][ T5701] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 552.478615][ T25] usb 3-1: unable to get BOS descriptor or descriptor too short [ 552.478649][ T25] usb 3-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 552.479702][ T5701] usb 4-1: config 0 descriptor?? [ 552.480408][ T25] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 552.480423][ T25] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 552.558957][ T25] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.558973][ T25] usb 3-1: Product: syz [ 552.558981][ T25] usb 3-1: Manufacturer: syz [ 552.558988][ T25] usb 3-1: SerialNumber: syz [ 552.716669][ T5701] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 552.751390][ T5820] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 552.800620][T14411] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 552.802588][T14411] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 552.821919][T14411] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 552.827951][T14411] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 552.867803][ T25] usb 3-1: USB disconnect, device number 5 [ 552.952376][ T5701] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 1 [ 552.952413][ T5701] [drm] Initialized udl on minor 1 [ 553.081503][ T5759] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 553.154099][T14427] syzkaller0: entered promiscuous mode [ 553.154122][T14427] syzkaller0: entered allmulticast mode [ 553.165996][T14427] tipc: Enabled bearer , priority 0 [ 553.172245][T14427] tipc: Resetting bearer [ 553.185741][T14426] tipc: Resetting bearer [ 553.209664][T14426] tipc: Disabling bearer [ 553.241482][ T5759] usb 2-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 553.242681][ T5759] usb 2-1: config 32 has too many interfaces: 87, using maximum allowed: 32 [ 553.242729][ T5759] usb 2-1: config 32 has an invalid interface number: 214 but max is 86 [ 553.242748][ T5759] usb 2-1: config 32 has an invalid descriptor of length 0, skipping remainder of the config [ 553.242765][ T5759] usb 2-1: config 32 has 1 interface, different from the descriptor's value: 87 [ 553.242783][ T5759] usb 2-1: config 32 has no interface number 0 [ 553.244258][ T5759] usb 2-1: New USB device strings: Mfr=1, Product=0, SerialNumber=3 [ 553.244276][ T5759] usb 2-1: Manufacturer: syz [ 553.244284][ T5759] usb 2-1: SerialNumber: syz [ 553.263359][ T6506] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 553.455071][T14438] netlink: 'syz.2.2668': attribute type 10 has an invalid length. [ 553.474328][ T5759] usb 2-1: USB disconnect, device number 17 [ 553.505246][T14438] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 553.518237][T14438] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 553.770756][ T6506] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 553.848985][T14443] fuse: Bad value for 'fd' [ 553.934304][T14445] pim6reg: entered allmulticast mode [ 554.204731][T14458] ptrace attach of "ci-upstream-kasan-gce/syz-executor exec"[5628] was attempted by "ci-upstream-kasan-gce/syz-executor exec"[14458] [ 554.250651][ T6222] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 554.280930][T13265] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 554.401827][ T6222] usb 1-1: New USB device found, idVendor=0782, idProduct=0047, bcdDevice= 0.40 [ 554.403927][ T6222] usb 1-1: config 1 interface 1 altsetting 26 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 554.403969][ T6222] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 554.403993][ T6222] usb 1-1: config 1 interface 1 has no altsetting 1 [ 554.409442][ T6222] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.409468][ T6222] usb 1-1: Product: syz [ 554.409481][ T6222] usb 1-1: Manufacturer: syz [ 554.409494][ T6222] usb 1-1: SerialNumber: syz [ 554.610717][ T5759] usb 5-1: new full-speed USB device number 120 using dummy_hcd [ 554.701846][T14445] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 554.704890][T14445] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 554.706795][T14445] pim6reg: left allmulticast mode [ 554.761639][ T5759] usb 5-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 554.762901][ T5759] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 554.762924][ T5759] usb 5-1: config 0 has no interface number 0 [ 554.765597][ T5759] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.765620][ T5759] usb 5-1: Product: syz [ 554.765634][ T5759] usb 5-1: Manufacturer: syz [ 554.765646][ T5759] usb 5-1: SerialNumber: syz [ 554.771022][ T5759] usb 5-1: config 0 descriptor?? [ 554.805358][T13265] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 554.851436][ T5759] usb 5-1: selecting invalid altsetting 1 [ 554.851583][ T5759] dvb_ttusb_budget: ttusb_init_controller: error [ 554.851594][ T5759] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 554.912898][ T6222] usb 1-1: 1:26 : incorrect wMaxPacketSize for BADD profile [ 554.913706][ T6222] usb 1-1: incorrect wMaxPacketSize 0x20 for BADD profile [ 555.011302][ T6222] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 555.034253][ T6222] usb 1-1: USB disconnect, device number 7 [ 555.063520][ T5759] DVB: Unable to find symbol stv0299_attach() [ 555.079998][T14467] FAULT_INJECTION: forcing a failure. [ 555.079998][T14467] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 555.080020][T14467] CPU: 1 UID: 0 PID: 14467 Comm: syz.4.2676 Tainted: G L syzkaller #0 PREEMPT(full) [ 555.080037][T14467] Tainted: [L]=SOFTLOCKUP [ 555.080041][T14467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 555.080048][T14467] Call Trace: [ 555.080052][T14467] [ 555.080057][T14467] dump_stack_lvl+0xe8/0x150 [ 555.080077][T14467] should_fail_ex+0x410/0x560 [ 555.080093][T14467] _copy_from_user+0x2d/0xb0 [ 555.080108][T14467] memdup_user+0x5e/0xd0 [ 555.080121][T14467] i2cdev_ioctl+0x656/0x880 [ 555.080220][T14467] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 555.080233][T14467] ? __fget_files+0x3a2/0x420 [ 555.080248][T14467] ? __fget_files+0x2a/0x420 [ 555.080263][T14467] ? bpf_lsm_file_ioctl+0x9/0x20 [ 555.080279][T14467] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 555.080291][T14467] __se_sys_ioctl+0xfc/0x170 [ 555.080304][T14467] do_syscall_64+0x166/0x520 [ 555.080319][T14467] ? trace_irq_disable+0x3b/0x140 [ 555.080330][T14467] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.080340][T14467] ? clear_bhb_loop+0x70/0xc0 [ 555.080352][T14467] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.080363][T14467] RIP: 0033:0x7f48afd9e1d9 [ 555.080373][T14467] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 555.080382][T14467] RSP: 002b:00007f48b0ca4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 555.080394][T14467] RAX: ffffffffffffffda RBX: 00007f48b0025fa0 RCX: 00007f48afd9e1d9 [ 555.080402][T14467] RDX: 0000200000000000 RSI: 0000000000000707 RDI: 0000000000000004 [ 555.080409][T14467] RBP: 00007f48b0ca4090 R08: 0000000000000000 R09: 0000000000000000 [ 555.080416][T14467] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 555.080422][T14467] R13: 00007f48b0026038 R14: 00007f48b0025fa0 R15: 00007f48b014fa48 [ 555.080437][T14467] [ 555.104968][ T5623] udevd[5623]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 555.183213][T14472] syzkaller0: entered promiscuous mode [ 555.183244][T14472] syzkaller0: entered allmulticast mode [ 555.208257][T14472] tipc: Enabled bearer , priority 0 [ 555.221736][T14472] tipc: Resetting bearer [ 555.272781][ T5759] DVB: Unable to find symbol tda8083_attach() [ 555.272797][ T5759] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 555.287525][T14470] tipc: Resetting bearer [ 555.299145][ T5759] usb 5-1: USB disconnect, device number 120 [ 555.320666][ T6621] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 555.425094][T14470] tipc: Disabling bearer [ 555.768112][T14483] fuse: Bad value for 'fd' [ 555.803633][T14487] netlink: 'syz.1.2683': attribute type 40 has an invalid length. [ 555.806375][T14487] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 555.806805][T14487] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 555.807320][T14487] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 555.832538][T13265] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 555.933477][ T31] kauditd_printk_skb: 62 callbacks suppressed [ 555.933494][ T31] audit: type=1326 audit(1791510163.261:33621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14490 comm="syz.4.2684" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 555.933962][T14493] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 555.934965][ T31] audit: type=1326 audit(1791510163.261:33622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14490 comm="syz.4.2684" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 555.935531][ T31] audit: type=1326 audit(1791510163.261:33623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14490 comm="syz.4.2684" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 555.971933][ T31] audit: type=1326 audit(1791510163.261:33624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14490 comm="syz.4.2684" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 555.971985][ T31] audit: type=1326 audit(1791510163.271:33625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14490 comm="syz.4.2684" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 556.060833][ T31] audit: type=1326 audit(1791510163.391:33626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14490 comm="syz.4.2684" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 556.060888][ T31] audit: type=1326 audit(1791510163.391:33627): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14490 comm="syz.4.2684" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 556.060948][ T31] audit: type=1326 audit(1791510163.391:33628): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14490 comm="syz.4.2684" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 556.135275][ T31] audit: type=1326 audit(1791510163.461:33629): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14490 comm="syz.4.2684" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 556.135737][ T31] audit: type=1326 audit(1791510163.461:33630): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14490 comm="syz.4.2684" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 556.263111][T14489] netlink: 'syz.0.2685': attribute type 1 has an invalid length. [ 556.312289][T14494] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2685'. [ 556.330959][ T6623] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 556.356225][T14489] bond3: entered promiscuous mode [ 556.356243][T14489] bond3: entered allmulticast mode [ 556.368256][T14489] 8021q: adding VLAN 0 to HW filter on device bond3 [ 556.682207][T14505] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4294967295 (8589934590 ns) > initial count (474742790 ns). Using initial count to start timer. [ 556.840808][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 557.793040][T14536] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4294967295 (8589934590 ns) > initial count (474742790 ns). Using initial count to start timer. [ 557.862491][ T6831] net_ratelimit: 1 callbacks suppressed [ 557.862534][ T6831] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 558.033984][ T5701] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffff92 [ 558.034408][ T5701] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 558.042320][ T5701] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 558.056127][ T5701] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 558.056480][ T5701] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 558.057299][ T5759] usb 4-1: USB disconnect, device number 102 [ 558.121357][T14540] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4294967295 (8589934590 ns) > initial count (474742790 ns). Using initial count to start timer. [ 558.371008][ T6831] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 558.883166][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 559.035977][T14557] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2705'. [ 559.036001][T14557] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 559.038943][T14557] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 559.131076][ T5701] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 559.179833][T14564] x_tables: duplicate underflow at hook 2 [ 559.280694][ T5701] usb 2-1: Using ep0 maxpacket: 16 [ 559.283143][ T5701] usb 2-1: unable to get BOS descriptor or descriptor too short [ 559.283194][ T5701] usb 2-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 559.284472][ T5701] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 559.284493][ T5701] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 559.287687][ T5701] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.287711][ T5701] usb 2-1: Product: syz [ 559.287726][ T5701] usb 2-1: Manufacturer: syz [ 559.287739][ T5701] usb 2-1: SerialNumber: syz [ 559.394479][ T5812] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 559.491104][ T9] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 559.513482][T14549] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.517826][T14549] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.640646][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 559.641353][ T9] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 559.644597][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.644621][ T9] usb 3-1: Product: syz [ 559.644634][ T9] usb 3-1: Manufacturer: syz [ 559.644646][ T9] usb 3-1: SerialNumber: syz [ 559.657754][ T5701] usb 2-1: USB disconnect, device number 18 [ 559.680664][ T5618] usb 4-1: new low-speed USB device number 103 using dummy_hcd [ 559.742611][T14577] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4294967295 (8589934590 ns) > initial count (474742790 ns). Using initial count to start timer. [ 559.810693][ T5618] usb 4-1: device descriptor read/64, error -71 [ 559.901178][ T6831] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 559.937981][ T9] usb 3-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 559.956669][ T9] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 559.957015][ T9] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 559.957062][ T9] usb 3-1: media controller created [ 559.996203][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 560.050725][ T5618] usb 4-1: new low-speed USB device number 104 using dummy_hcd [ 560.134670][ T9] zl10353_read_register: readreg error (reg=127, ret==-32) [ 560.180941][ T5618] usb 4-1: device descriptor read/64, error -71 [ 560.291022][ T5618] usb usb4-port1: attempt power cycle [ 560.410950][ T6831] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 560.489640][T14583] program syz.2.2708 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 560.630982][ T5618] usb 4-1: new low-speed USB device number 105 using dummy_hcd [ 560.635680][T14591] IPVS: length: 138 != 24 [ 560.651585][ T5618] usb 4-1: device descriptor read/8, error -71 [ 560.706933][T14593] program syz.1.2716 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 560.851934][ T25] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 560.890796][ T5618] usb 4-1: new low-speed USB device number 106 using dummy_hcd [ 560.915788][ T5618] usb 4-1: device descriptor read/8, error -71 [ 560.922273][ T5812] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 561.000723][ T25] usb 1-1: Using ep0 maxpacket: 16 [ 561.001826][ T25] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 561.002831][ T25] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 561.002857][ T25] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 561.020970][ T5618] usb usb4-port1: unable to enumerate USB device [ 561.028008][ T25] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 561.028041][ T25] usb 1-1: Product: syz [ 561.028055][ T25] usb 1-1: Manufacturer: syz [ 561.028067][ T25] usb 1-1: SerialNumber: syz [ 561.061630][ T25] usb 1-1: config 0 descriptor?? [ 561.081764][ T25] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 561.081784][ T25] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 561.430848][ T6831] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 561.621616][ T25] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 561.622069][ T25] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 561.622452][ T25] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 561.622469][ T25] em28xx 1-1:0.0: No AC97 audio processor [ 561.667619][ T25] usb 1-1: USB disconnect, device number 8 [ 561.685780][ T25] em28xx 1-1:0.0: Disconnecting em28xx [ 561.787718][ T25] em28xx: Freeing device [ 561.874588][T14608] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.876741][T14608] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.899362][T14608] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.910077][T14608] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.941149][ T5812] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 562.116178][ T9] dvb_usb_gl861 3-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 562.131126][ T9] usb 3-1: USB disconnect, device number 6 [ 562.323063][T14620] fuse: Bad value for 'fd' [ 562.389380][ T31] kauditd_printk_skb: 104 callbacks suppressed [ 562.389395][ T31] audit: type=1326 audit(1791510169.711:33735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14622 comm="syz.0.2727" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 562.389438][ T31] audit: type=1326 audit(1791510169.711:33736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14622 comm="syz.0.2727" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 562.426012][ T31] audit: type=1326 audit(1791510169.751:33737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14622 comm="syz.0.2727" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 562.426063][ T31] audit: type=1326 audit(1791510169.751:33738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14622 comm="syz.0.2727" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 562.452007][ T6506] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 562.503148][ T31] audit: type=1326 audit(1791510169.821:33739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14622 comm="syz.0.2727" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 562.505783][ T31] audit: type=1326 audit(1791510169.831:33740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14622 comm="syz.0.2727" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 562.505831][ T31] audit: type=1326 audit(1791510169.831:33741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14622 comm="syz.0.2727" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 562.506038][ T31] audit: type=1326 audit(1791510169.831:33742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14622 comm="syz.0.2727" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 562.509839][ T31] audit: type=1326 audit(1791510169.831:33743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14622 comm="syz.0.2727" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 562.509888][ T31] audit: type=1326 audit(1791510169.831:33744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14622 comm="syz.0.2727" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a6579e1d9 code=0x7ffc0000 [ 562.832598][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.832655][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.935193][ T25] hid-generic 0008:046D:C082.001B: hidraw0: HID v0.04 Device [syz0] on syz0 [ 562.961543][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 562.965233][T14631] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2728'. [ 563.050984][T14634] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2729'. [ 563.250343][T14632] fido_id[14632]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 563.471633][ T6506] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 563.796060][T14639] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2732'. [ 563.831100][T14639] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2732'. [ 563.981434][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 564.480715][T14654] loop6: detected capacity change from 0 to 1 [ 564.491241][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 564.626402][T14654] Dev loop6: unable to read RDB block 1 [ 564.626452][T14654] loop6: unable to read partition table [ 564.626647][T14654] loop6: partition table beyond EOD, truncated [ 564.626680][T14654] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 564.941127][ T6222] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 564.971204][ T9] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 565.001009][ T6506] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 565.100711][ T6222] usb 3-1: Using ep0 maxpacket: 32 [ 565.102790][ T6222] usb 3-1: unable to get BOS descriptor or descriptor too short [ 565.102839][ T6222] usb 3-1: New USB device found, idVendor=0b05, idProduct=1739, bcdDevice= 0.40 [ 565.105833][ T6222] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.105857][ T6222] usb 3-1: Product: syz [ 565.105871][ T6222] usb 3-1: SerialNumber: syz [ 565.141568][ T5666] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 565.151147][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 565.159572][ T9] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 565.176668][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.176692][ T9] usb 2-1: Product: syz [ 565.176705][ T9] usb 2-1: Manufacturer: syz [ 565.176719][ T9] usb 2-1: SerialNumber: syz [ 565.312460][ T5666] usb 5-1: Using ep0 maxpacket: 16 [ 565.314837][ T5666] usb 5-1: unable to get BOS descriptor or descriptor too short [ 565.314948][ T5666] usb 5-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 565.316245][ T5666] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 565.316268][ T5666] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 565.319060][ T5666] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.319084][ T5666] usb 5-1: Product: syz [ 565.319098][ T5666] usb 5-1: Manufacturer: syz [ 565.319112][ T5666] usb 5-1: SerialNumber: syz [ 565.364399][ T25] usb 4-1: new full-speed USB device number 107 using dummy_hcd [ 565.405826][ T9] usb 2-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 565.409775][ T9] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 565.411562][ T9] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 565.411610][ T9] usb 2-1: media controller created [ 565.432281][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 565.510984][ T5812] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 565.553324][T14661] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 565.554013][T14661] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 565.605625][ T9] zl10353_read_register: readreg error (reg=127, ret==-32) [ 565.677893][ T6222] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 565.681479][ T6222] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 565.692424][ T5666] usb 5-1: USB disconnect, device number 121 [ 565.754607][ T6222] usb 3-1: USB disconnect, device number 7 [ 565.823438][ T5623] udevd[5623]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 565.882412][T14675] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2744'. [ 565.884712][T14675] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2744'. [ 565.975097][T14678] program syz.1.2739 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 566.032127][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 566.497648][T14686] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2748'. [ 566.497722][T14686] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2748'. [ 566.543118][ T6506] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 566.617878][T14686] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2748'. [ 566.669841][T14689] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2748'. [ 566.669876][T14689] netlink: 304 bytes leftover after parsing attributes in process `syz.2.2748'. [ 566.718450][T14686] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 566.962127][T14696] xt_cgroup: path and classid specified [ 567.024609][T14700] ip6t_hbh: unknown flags 38 [ 567.051310][ T6506] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 567.053728][T14696] input: syz1 as /devices/virtual/input/input61 [ 567.135585][T14700] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 567.135988][T14700] bond0: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 567.340076][ T6831] nvmet: connect request for invalid subsystem t! [ 567.350010][T14699] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "t" [ 567.936954][ T9] dvb_usb_gl861 2-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 567.960958][ T5759] usb 2-1: USB disconnect, device number 19 [ 568.070801][ T5816] net_ratelimit: 1 callbacks suppressed [ 568.070821][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 568.146966][T14714] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2755'. [ 568.172040][ T25] usb 4-1: New USB device found, idVendor=0031, idProduct=656c, bcdDevice= 0.30 [ 568.172080][ T25] usb 4-1: no configurations [ 568.172092][ T25] usb 4-1: can't read configurations, error -22 [ 568.183188][T14710] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2755'. [ 568.299194][T14718] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4294967295 (8589934590 ns) > initial count (474742790 ns). Using initial count to start timer. [ 568.490767][ T5759] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 568.581043][ T5812] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 568.585088][T14719] could not allocate digest TFM handle sha384-ssse3 [ 568.650677][ T5759] usb 1-1: Using ep0 maxpacket: 16 [ 568.652740][ T5759] usb 1-1: unable to get BOS descriptor or descriptor too short [ 568.652785][ T5759] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 568.653668][ T5759] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 568.653689][ T5759] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 568.657774][ T5759] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 568.657798][ T5759] usb 1-1: Product: syz [ 568.657812][ T5759] usb 1-1: Manufacturer: syz [ 568.657824][ T5759] usb 1-1: SerialNumber: syz [ 568.800724][ T25] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 568.934100][T14721] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.934392][T14721] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.938889][T14721] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.939153][T14721] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.978777][ T25] usb 4-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice= 1.00 [ 568.980421][ T25] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 569.013704][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 569.013762][ T25] usb 4-1: Product: syz [ 569.013776][ T25] usb 4-1: Manufacturer: syz [ 569.093683][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 569.118404][ T5759] usb 1-1: USB disconnect, device number 9 [ 569.206502][T14740] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2761'. [ 569.329983][T14740] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 569.411399][ T5618] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 569.541905][T14747] ip6t_hbh: unknown flags 38 [ 569.580655][ T5618] usb 3-1: Using ep0 maxpacket: 32 [ 569.601996][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 569.650479][T14747] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 569.659543][T14747] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 569.777713][ T5618] usb 3-1: unable to get BOS descriptor or descriptor too short [ 569.777817][ T5618] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 569.778725][ T5618] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 569.778759][ T5618] usb 3-1: can't read configurations, error -71 [ 569.830730][ T5762] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 569.929777][T14728] netlink: 'syz.3.2758': attribute type 30 has an invalid length. [ 569.969304][ T25] input: Samsung SUR40 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input62 [ 569.982503][ T5762] usb 5-1: Using ep0 maxpacket: 16 [ 569.983244][ T5762] usb 5-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 569.991112][ T5762] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 569.991138][ T5762] usb 5-1: Product: syz [ 569.991151][ T5762] usb 5-1: Manufacturer: syz [ 569.991164][ T5762] usb 5-1: SerialNumber: syz [ 570.039174][ T25] usb 4-1: USB disconnect, device number 108 [ 570.050713][ T9] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 570.111497][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 570.182367][ T9] usb 1-1: device descriptor read/64, error -71 [ 570.238964][ T5762] usb 5-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 570.250277][ T5762] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 570.250512][ T5762] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 570.250539][ T5762] usb 5-1: media controller created [ 570.262458][ T5762] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 570.421253][ T9] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 570.442188][ T5762] zl10353_read_register: readreg error (reg=127, ret==-32) [ 570.550722][ T9] usb 1-1: device descriptor read/64, error -71 [ 570.621905][ T5812] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 570.660993][ T9] usb usb1-port1: attempt power cycle [ 570.790708][T14788] program syz.4.2765 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 570.840740][ T25] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 570.990886][ T25] usb 4-1: Using ep0 maxpacket: 16 [ 570.992186][ T25] usb 4-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 570.995526][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.995549][ T25] usb 4-1: Product: syz [ 570.995563][ T25] usb 4-1: Manufacturer: syz [ 570.995576][ T25] usb 4-1: SerialNumber: syz [ 571.016534][ T9] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 571.025041][ T6222] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 571.040142][ T9] usb 1-1: device descriptor read/8, error -71 [ 571.141095][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 571.180732][ T6222] usb 3-1: Using ep0 maxpacket: 16 [ 571.182955][ T6222] usb 3-1: unable to get BOS descriptor or descriptor too short [ 571.183004][ T6222] usb 3-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 571.184053][ T6222] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 571.184075][ T6222] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 571.187357][ T6222] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 571.187382][ T6222] usb 3-1: Product: syz [ 571.187395][ T6222] usb 3-1: Manufacturer: syz [ 571.187409][ T6222] usb 3-1: SerialNumber: syz [ 571.245559][ T25] usb 4-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 571.271382][ T9] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 571.291313][ T9] usb 1-1: device descriptor read/8, error -71 [ 571.294140][ T25] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 571.294427][ T25] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 571.294455][ T25] usb 4-1: media controller created [ 571.345554][ T25] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 571.401340][ T9] usb usb1-port1: unable to enumerate USB device [ 571.430788][T14787] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 571.432920][T14787] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 571.436069][ T25] zl10353_read_register: readreg error (reg=127, ret==-32) [ 571.468983][T14787] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 571.469280][T14787] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 571.518427][ T6222] usb 3-1: USB disconnect, device number 10 [ 571.577252][ T25] dvb_usb_gl861 4-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 571.651629][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 571.931852][T14799] program syz.3.2773 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 572.160735][ T6831] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 572.261661][T14804] program syz.2.2780 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 572.262028][T14804] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 572.530689][ T5759] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 572.694287][ T5759] usb 3-1: New USB device found, idVendor=04d8, idProduct=0082, bcdDevice= 1.00 [ 572.697923][ T5759] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 572.697964][ T5759] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 1024 [ 572.697987][ T5759] usb 3-1: config 1 interface 1 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 572.698009][ T5759] usb 3-1: config 1 interface 1 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 255 [ 572.698042][ T5759] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 572.704339][T14804] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 572.832492][ T5762] dvb_usb_gl861 5-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 572.887069][ T5762] usb 5-1: USB disconnect, device number 122 [ 573.157647][ T5759] ims_pcu 3-1:1.0: Failed to set line state, error: -71 [ 573.158312][ T5759] ims_pcu 3-1:1.0: probe with driver ims_pcu failed with error -71 [ 573.180764][ T5812] net_ratelimit: 1 callbacks suppressed [ 573.180783][ T5812] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 573.184948][T14817] FAULT_INJECTION: forcing a failure. [ 573.184948][T14817] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 573.184980][T14817] CPU: 1 UID: 0 PID: 14817 Comm: syz.0.2786 Tainted: G L syzkaller #0 PREEMPT(full) [ 573.184995][T14817] Tainted: [L]=SOFTLOCKUP [ 573.184999][T14817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 573.185006][T14817] Call Trace: [ 573.185011][T14817] [ 573.185016][T14817] dump_stack_lvl+0xe8/0x150 [ 573.185036][T14817] should_fail_ex+0x410/0x560 [ 573.185053][T14817] _copy_from_user+0x2d/0xb0 [ 573.185071][T14817] snd_pcm_oss_write2+0x227/0x440 [ 573.185188][T14817] ? __pfx_snd_pcm_oss_write2+0x10/0x10 [ 573.185200][T14817] ? __pfx_snd_pcm_post_prepare+0x10/0x10 [ 573.185238][T14817] ? snd_pcm_action_nonatomic+0x25c/0x2b0 [ 573.185253][T14817] snd_pcm_oss_write+0x65e/0xb40 [ 573.185271][T14817] ? __pfx_snd_pcm_oss_write+0x10/0x10 [ 573.185281][T14817] vfs_write+0x296/0xba0 [ 573.185296][T14817] ? __pfx_vfs_write+0x10/0x10 [ 573.185307][T14817] ? __fget_files+0x2a/0x420 [ 573.185333][T14817] ? __fget_files+0x2a/0x420 [ 573.185346][T14817] ? __fget_files+0x3a2/0x420 [ 573.185359][T14817] ? __fget_files+0x2a/0x420 [ 573.185383][T14817] ksys_write+0x150/0x270 [ 573.185395][T14817] ? __pfx_ksys_write+0x10/0x10 [ 573.185411][T14817] do_syscall_64+0x166/0x520 [ 573.185425][T14817] ? trace_irq_disable+0x3b/0x140 [ 573.185436][T14817] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.185447][T14817] ? clear_bhb_loop+0x70/0xc0 [ 573.185459][T14817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.185470][T14817] RIP: 0033:0x7f6a6579e1d9 [ 573.185481][T14817] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 573.185489][T14817] RSP: 002b:00007f6a6671a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 573.185501][T14817] RAX: ffffffffffffffda RBX: 00007f6a65a25fa0 RCX: 00007f6a6579e1d9 [ 573.185509][T14817] RDX: 000000000000fc36 RSI: 0000200000000500 RDI: 0000000000000006 [ 573.185515][T14817] RBP: 00007f6a6671a090 R08: 0000000000000000 R09: 0000000000000000 [ 573.185522][T14817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 573.185528][T14817] R13: 00007f6a65a26038 R14: 00007f6a65a25fa0 R15: 00007f6a65b4fa48 [ 573.185544][T14817] [ 573.382722][ T5759] usb 3-1: USB disconnect, device number 11 [ 573.691839][ T6621] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 573.791302][ T6222] usb 4-1: USB disconnect, device number 109 [ 574.219894][ T5812] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 574.522856][ T5759] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 574.683586][ T5759] usb 1-1: Using ep0 maxpacket: 16 [ 574.688178][ T5759] usb 1-1: unable to get BOS descriptor or descriptor too short [ 574.688220][ T5759] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 574.689314][ T5759] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 574.689335][ T5759] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 574.707966][ T5759] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.707991][ T5759] usb 1-1: Product: syz [ 574.708004][ T5759] usb 1-1: Manufacturer: syz [ 574.708016][ T5759] usb 1-1: SerialNumber: syz [ 574.730869][ T6506] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 575.028390][T14837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 575.044927][T14837] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 575.075744][T14837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 575.082812][T14837] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 575.144391][ T5759] usb 1-1: USB disconnect, device number 14 [ 575.230778][ T6222] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 575.241686][ T6621] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 575.381816][ T6222] usb 4-1: Using ep0 maxpacket: 16 [ 575.382416][ T6222] usb 4-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 575.390455][ T6222] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 575.390482][ T6222] usb 4-1: Product: syz [ 575.390496][ T6222] usb 4-1: Manufacturer: syz [ 575.390509][ T6222] usb 4-1: SerialNumber: syz [ 575.482228][ T31] kauditd_printk_skb: 1762 callbacks suppressed [ 575.482247][ T31] audit: type=1326 audit(1791510182.801:35507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14853 comm="syz.4.2798" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 575.482287][ T31] audit: type=1326 audit(1791510182.801:35508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14853 comm="syz.4.2798" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 575.482325][ T31] audit: type=1326 audit(1791510182.801:35509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14853 comm="syz.4.2798" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 575.484205][ T31] audit: type=1326 audit(1791510182.811:35510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14853 comm="syz.4.2798" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 575.484251][ T31] audit: type=1326 audit(1791510182.811:35511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14853 comm="syz.4.2798" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 575.485241][ T31] audit: type=1326 audit(1791510182.811:35512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14853 comm="syz.4.2798" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 575.485515][ T31] audit: type=1326 audit(1791510182.811:35513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14853 comm="syz.4.2798" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 575.485662][ T31] audit: type=1326 audit(1791510182.811:35514): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14853 comm="syz.4.2798" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 575.485985][ T31] audit: type=1326 audit(1791510182.811:35515): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14853 comm="syz.4.2798" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 575.487589][ T31] audit: type=1326 audit(1791510182.811:35516): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14853 comm="syz.4.2798" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f48afd9e1d9 code=0x7ffc0000 [ 575.647225][T14852] __nla_validate_parse: 11 callbacks suppressed [ 575.647248][T14852] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2797'. [ 575.765456][ T6506] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 575.765828][ T6222] usb 4-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 575.769629][ T6222] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 575.770012][ T6222] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 575.770058][ T6222] usb 4-1: media controller created [ 575.830292][ T6222] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 575.927998][ T6222] zl10353_read_register: readreg error (reg=127, ret==-32) [ 575.936767][T14860] xt_cgroup: path and classid specified [ 576.049255][T14860] input: syz1 as /devices/virtual/input/input63 [ 576.052535][T14861] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 576.271620][ T6831] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 576.299286][T14864] program syz.3.2794 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 576.343147][T14866] usb usb7: usbfs: process 14866 (syz.4.2800) did not claim interface 0 before use [ 576.415490][ T6831] nvmet: connect request for invalid subsystem t! [ 576.419562][T14861] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "t" [ 576.497634][T14870] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2802'. [ 576.502374][T14871] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2801'. [ 576.579625][T14870] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 576.665756][T14871] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2801'. [ 576.782683][ T6831] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 577.290811][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 577.731083][ T25] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 577.882871][ T25] usb 5-1: Using ep0 maxpacket: 32 [ 577.885001][ T25] usb 5-1: unable to get BOS descriptor or descriptor too short [ 577.885059][ T25] usb 5-1: New USB device found, idVendor=0b05, idProduct=1739, bcdDevice= 0.40 [ 577.890992][ T5762] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 577.930514][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.930540][ T25] usb 5-1: Product: syz [ 577.939549][ T25] usb 5-1: SerialNumber: syz [ 578.040790][ T5762] usb 2-1: Using ep0 maxpacket: 16 [ 578.041540][ T5762] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 578.045981][ T5762] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 578.046005][ T5762] usb 2-1: Product: syz [ 578.046044][ T5762] usb 2-1: Manufacturer: syz [ 578.046057][ T5762] usb 2-1: SerialNumber: syz [ 578.093695][ T5762] r8152-cfgselector 2-1: Unknown version 0x0000 [ 578.093720][ T5762] r8152-cfgselector 2-1: config 0 descriptor?? [ 578.209045][ T6222] dvb_usb_gl861 4-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 578.234578][ T6222] usb 4-1: USB disconnect, device number 110 [ 578.299200][ T5762] r8152-cfgselector 2-1: Unknown version 0x0000 [ 578.300260][ T5762] r8152-cfgselector 2-1: No union descriptors [ 578.322421][ T5812] net_ratelimit: 1 callbacks suppressed [ 578.322463][ T5812] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 578.359416][ T5762] r8152-cfgselector 2-1: USB disconnect, device number 20 [ 578.831441][ T6831] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 578.941595][ T25] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 578.941986][ T25] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 578.966820][ T6222] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 579.026970][T14923] netdevsim netdevsim1: Direct firmware load for .. @ failed with error -2 [ 579.026998][T14923] netdevsim netdevsim1: Falling back to sysfs fallback for: .. @ [ 579.038996][ T25] usb 5-1: USB disconnect, device number 123 [ 579.091461][ T5623] udevd[5623]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 579.130771][ T6222] usb 4-1: Using ep0 maxpacket: 32 [ 579.131578][ T6222] usb 4-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 579.134453][ T6222] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.134479][ T6222] usb 4-1: Product: syz [ 579.134494][ T6222] usb 4-1: Manufacturer: syz [ 579.134510][ T6222] usb 4-1: SerialNumber: syz [ 579.139231][ T6222] usb 4-1: config 0 descriptor?? [ 579.193062][ T6222] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 579.193159][ T6222] dvb-usb: bulk message failed: -22 (4/0) [ 579.193221][ T6222] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 579.193382][ T6222] dvb-usb: bulk message failed: -22 (5/0) [ 579.193396][ T6222] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 579.196872][ T6222] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 579.197537][ T6222] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 579.197584][ T6222] usb 4-1: media controller created [ 579.269159][T14929] input: syz1 as /devices/virtual/input/input64 [ 579.282387][ T6222] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 579.308526][ T6222] usb 4-1: selecting invalid altsetting 3 [ 579.308547][ T6222] ttusb2: set interface to alts=3 failed [ 579.340864][ T5816] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 579.343489][T14915] FAULT_INJECTION: forcing a failure. [ 579.343489][T14915] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 579.343521][T14915] CPU: 1 UID: 0 PID: 14915 Comm: syz.3.2817 Tainted: G L syzkaller #0 PREEMPT(full) [ 579.343556][T14915] Tainted: [L]=SOFTLOCKUP [ 579.343562][T14915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 579.343572][T14915] Call Trace: [ 579.343579][T14915] [ 579.343587][T14915] dump_stack_lvl+0xe8/0x150 [ 579.343616][T14915] should_fail_ex+0x410/0x560 [ 579.343645][T14915] _copy_from_user+0x2d/0xb0 [ 579.343673][T14915] memdup_user+0x5e/0xd0 [ 579.343693][T14915] i2cdev_ioctl+0x656/0x880 [ 579.343714][T14915] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 579.343733][T14915] ? __fget_files+0x3a2/0x420 [ 579.343762][T14915] ? __fget_files+0x2a/0x420 [ 579.343790][T14915] ? bpf_lsm_file_ioctl+0x9/0x20 [ 579.343817][T14915] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 579.343836][T14915] __se_sys_ioctl+0xfc/0x170 [ 579.343859][T14915] do_syscall_64+0x166/0x520 [ 579.343885][T14915] ? trace_irq_disable+0x3b/0x140 [ 579.343904][T14915] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 579.343923][T14915] ? clear_bhb_loop+0x70/0xc0 [ 579.343944][T14915] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 579.343963][T14915] RIP: 0033:0x7fbebdb9e1d9 [ 579.343980][T14915] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 579.343995][T14915] RSP: 002b:00007fbebe97e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 579.344014][T14915] RAX: ffffffffffffffda RBX: 00007fbebde25fa0 RCX: 00007fbebdb9e1d9 [ 579.344028][T14915] RDX: 0000200000000000 RSI: 0000000000000707 RDI: 0000000000000004 [ 579.344040][T14915] RBP: 00007fbebe97e090 R08: 0000000000000000 R09: 0000000000000000 [ 579.344052][T14915] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 579.344063][T14915] R13: 00007fbebde26038 R14: 00007fbebde25fa0 R15: 00007fbebdf4fa48 [ 579.344091][T14915] [ 579.474001][ T6222] DVB: Unable to find symbol tda10086_attach() [ 579.474018][ T6222] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 579.521177][ T6222] dvb-usb: bulk message failed: -22 (4/0) [ 579.521198][ T6222] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 579.521300][ T6222] dvb-usb: bulk message failed: -22 (5/0) [ 579.521312][ T6222] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 579.521369][ T6222] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 579.550794][ T25] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 579.639711][ T6222] usb 4-1: USB disconnect, device number 111 [ 579.651804][ T5762] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 579.682516][ T6222] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 579.701446][ T25] usb 1-1: Using ep0 maxpacket: 16 [ 579.702229][ T25] usb 1-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 579.709555][ T25] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.709580][ T25] usb 1-1: Product: syz [ 579.709589][ T25] usb 1-1: Manufacturer: syz [ 579.709596][ T25] usb 1-1: SerialNumber: syz [ 579.732762][ T25] usb 1-1: config 0 descriptor?? [ 579.800946][ T5762] usb 3-1: Using ep0 maxpacket: 16 [ 579.802044][ T5762] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 579.805577][ T5762] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.805601][ T5762] usb 3-1: Product: syz [ 579.805614][ T5762] usb 3-1: Manufacturer: syz [ 579.805650][ T5762] usb 3-1: SerialNumber: syz [ 579.851027][ T6506] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 580.010681][ T5666] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 580.039931][ T5762] usb 3-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 580.054121][ T5762] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 580.071626][ T5762] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 580.071679][ T5762] usb 3-1: media controller created [ 580.102586][ T5762] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 580.156060][ T25] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 580.168369][ T5666] usb 5-1: Using ep0 maxpacket: 16 [ 580.174371][ T5666] usb 5-1: New USB device found, idVendor=0572, idProduct=cb00, bcdDevice=bb.c9 [ 580.184980][ T5666] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 580.185002][ T5666] usb 5-1: config 0 has no interfaces? [ 580.187823][ T5666] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 580.187848][ T5666] usb 5-1: Product: syz [ 580.187860][ T5666] usb 5-1: SerialNumber: syz [ 580.188825][ T25] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 580.201277][ T5666] usb 5-1: config 0 descriptor?? [ 580.249080][ T25] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 580.249136][ T25] usb 1-1: media controller created [ 580.259575][ T5762] zl10353_read_register: readreg error (reg=127, ret==-32) [ 580.299276][ T25] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 580.360786][ T6621] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 580.366961][T14929] ------------[ cut here ]------------ [ 580.367010][T14929] usb 3-1: BOGUS control dir, pipe 80000c80 doesn't match bRequestType c0 [ 580.367024][T14929] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1057/0x18b0, CPU#1: syz.0.2823/14929 [ 580.407212][T14929] Modules linked in: [ 580.411349][T14929] CPU: 1 UID: 0 PID: 14929 Comm: syz.0.2823 Tainted: G L syzkaller #0 PREEMPT(full) [ 580.422616][T14929] Tainted: [L]=SOFTLOCKUP [ 580.426938][T14929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 580.437390][T14929] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 580.443343][T14929] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 580.463954][T14929] RSP: 0018:ffffc9000d787718 EFLAGS: 00010246 [ 580.470129][T14929] RAX: 0000000000000000 RBX: ffff88807449d700 RCX: 0000000080000c80 [ 580.478508][T14929] RDX: ffff88802617a340 RSI: ffffffff8cc53540 RDI: ffffffff90881d10 [ 580.486819][T14929] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 580.495161][T14929] R10: ffffc9000d787800 R11: fffff52001af0f0c R12: 1ffff1100f482bc0 [ 580.503605][T14929] R13: ffff88807a415e00 R14: ffff88802617a340 R15: 0000000080000c80 [ 580.511935][T14929] FS: 00007f6a6671a6c0(0000) GS:ffff888124dc6000(0000) knlGS:0000000000000000 [ 580.521109][T14929] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 580.527688][T14929] CR2: 0000001b33711ff8 CR3: 0000000054b50000 CR4: 00000000003526f0 [ 580.535933][T14929] Call Trace: [ 580.539223][T14929] [ 580.542463][T14929] usb_start_wait_urb+0x13f/0x5b0 [ 580.547546][T14929] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 580.553413][T14929] usb_control_msg+0x234/0x3e0 [ 580.558209][T14929] gl861_ctrl_msg+0x207/0x420 [ 580.563316][T14929] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 580.568508][T14929] ? aa_file_perm+0x4ed/0x15f0 [ 580.573468][T14929] gl861_i2c_master_xfer+0x439/0x6a0 [ 580.578752][T14929] __i2c_transfer+0x7bf/0x1fe0 [ 580.583573][T14929] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 580.589383][T14929] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 580.595236][T14929] ? rt_mutex_lock_nested+0x156/0x1c0 [ 580.602351][T14929] ? i2c_transfer+0xc7/0x2d0 [ 580.606959][T14929] i2c_transfer+0x1cb/0x2d0 [ 580.611538][T14929] i2c_transfer_buffer_flags+0x10d/0x1a0 [ 580.617171][T14929] ? __lock_acquire+0x747/0x2de0 [ 580.622176][T14929] ? __pfx_i2c_transfer_buffer_flags+0x10/0x10 [ 580.628386][T14929] ? i2cdev_read+0xe8/0x250 [ 580.632957][T14929] i2cdev_read+0x10d/0x250 [ 580.637461][T14929] ? __pfx_i2cdev_read+0x10/0x10 [ 580.642565][T14929] vfs_read+0x213/0xa80 [ 580.646805][T14929] ? __pfx_vfs_read+0x10/0x10 [ 580.651505][T14929] ? __fget_files+0x2a/0x420 [ 580.656136][T14929] ? __fget_files+0x2a/0x420 [ 580.660851][T14929] ? __fget_files+0x3a2/0x420 [ 580.665527][T14929] ? __fget_files+0x2a/0x420 [ 580.670126][T14929] ksys_read+0x150/0x270 [ 580.674700][T14929] ? __pfx_ksys_read+0x10/0x10 [ 580.679477][T14929] do_syscall_64+0x166/0x520 [ 580.684105][T14929] ? trace_irq_disable+0x3b/0x140 [ 580.689126][T14929] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.695253][T14929] ? clear_bhb_loop+0x70/0xc0 [ 580.699925][T14929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.705847][T14929] RIP: 0033:0x7f6a6579e1d9 [ 580.710266][T14929] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 580.729909][T14929] RSP: 002b:00007f6a6671a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 580.738352][T14929] RAX: ffffffffffffffda RBX: 00007f6a65a25fa0 RCX: 00007f6a6579e1d9 [ 580.746360][T14929] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b [ 580.754510][T14929] RBP: 00007f6a65835888 R08: 0000000000000000 R09: 0000000000000000 [ 580.762548][T14929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 580.770513][T14929] R13: 00007f6a65a26038 R14: 00007f6a65a25fa0 R15: 00007f6a65b4fa48 [ 580.778537][T14929] [ 580.781591][T14929] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 580.788865][T14929] CPU: 1 UID: 0 PID: 14929 Comm: syz.0.2823 Tainted: G L syzkaller #0 PREEMPT(full) [ 580.799787][T14929] Tainted: [L]=SOFTLOCKUP [ 580.804098][T14929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 580.814141][T14929] Call Trace: [ 580.817412][T14929] [ 580.820347][T14929] vpanic+0x56d/0xa60 [ 580.824321][T14929] ? __pfx__printk+0x10/0x10 [ 580.828894][T14929] ? __pfx_vpanic+0x10/0x10 [ 580.833398][T14929] ? is_bpf_text_address+0x292/0x2b0 [ 580.838678][T14929] ? is_bpf_text_address+0x26/0x2b0 [ 580.843870][T14929] panic+0xc5/0xd0 [ 580.847585][T14929] ? __pfx_panic+0x10/0x10 [ 580.852031][T14929] __warn+0x315/0x4c0 [ 580.855999][T14929] ? usb_submit_urb+0x1057/0x18b0 [ 580.861012][T14929] ? usb_submit_urb+0x1057/0x18b0 [ 580.866028][T14929] __report_bug+0x276/0x570 [ 580.870605][T14929] ? usb_submit_urb+0x1057/0x18b0 [ 580.875628][T14929] ? __pfx___report_bug+0x10/0x10 [ 580.880645][T14929] ? stack_depot_save_flags+0x404/0x7f0 [ 580.886182][T14929] report_bug_entry+0x19b/0x290 [ 580.891039][T14929] ? usb_submit_urb+0x1100/0x18b0 [ 580.896068][T14929] ? usb_submit_urb+0x1105/0x18b0 [ 580.901078][T14929] handle_bug+0xce/0x200 [ 580.905307][T14929] exc_invalid_op+0x1a/0x50 [ 580.909793][T14929] asm_exc_invalid_op+0x1a/0x20 [ 580.914625][T14929] RIP: 0010:usb_submit_urb+0x1100/0x18b0 [ 580.920242][T14929] Code: b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 84 c0 0f 85 b2 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 18 4c 89 f2 44 89 f9 <67> 48 0f b9 3a 48 bd 00 00 00 00 00 fc ff df e9 ba f2 ff ff 44 89 [ 580.939829][T14929] RSP: 0018:ffffc9000d787718 EFLAGS: 00010246 [ 580.945884][T14929] RAX: 0000000000000000 RBX: ffff88807449d700 RCX: 0000000080000c80 [ 580.953844][T14929] RDX: ffff88802617a340 RSI: ffffffff8cc53540 RDI: ffffffff90881d10 [ 580.961888][T14929] RBP: dffffc0000000000 R08: 00000000000000c0 R09: 0000000000000000 [ 580.969842][T14929] R10: ffffc9000d787800 R11: fffff52001af0f0c R12: 1ffff1100f482bc0 [ 580.977803][T14929] R13: ffff88807a415e00 R14: ffff88802617a340 R15: 0000000080000c80 [ 580.985778][T14929] ? usb_submit_urb+0x1091/0x18b0 [ 580.990812][T14929] usb_start_wait_urb+0x13f/0x5b0 [ 580.995839][T14929] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 581.001469][T14929] usb_control_msg+0x234/0x3e0 [ 581.006225][T14929] gl861_ctrl_msg+0x207/0x420 [ 581.010892][T14929] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 581.016069][T14929] ? aa_file_perm+0x4ed/0x15f0 [ 581.020819][T14929] gl861_i2c_master_xfer+0x439/0x6a0 [ 581.026106][T14929] __i2c_transfer+0x7bf/0x1fe0 [ 581.030965][T14929] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 581.036864][T14929] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 581.042678][T14929] ? rt_mutex_lock_nested+0x156/0x1c0 [ 581.048044][T14929] ? i2c_transfer+0xc7/0x2d0 [ 581.052617][T14929] i2c_transfer+0x1cb/0x2d0 [ 581.057196][T14929] i2c_transfer_buffer_flags+0x10d/0x1a0 [ 581.062808][T14929] ? __lock_acquire+0x747/0x2de0 [ 581.067738][T14929] ? __pfx_i2c_transfer_buffer_flags+0x10/0x10 [ 581.073889][T14929] ? i2cdev_read+0xe8/0x250 [ 581.078395][T14929] i2cdev_read+0x10d/0x250 [ 581.082820][T14929] ? __pfx_i2cdev_read+0x10/0x10 [ 581.087738][T14929] vfs_read+0x213/0xa80 [ 581.091974][T14929] ? __pfx_vfs_read+0x10/0x10 [ 581.096652][T14929] ? __fget_files+0x2a/0x420 [ 581.101257][T14929] ? __fget_files+0x2a/0x420 [ 581.105928][T14929] ? __fget_files+0x3a2/0x420 [ 581.110633][T14929] ? __fget_files+0x2a/0x420 [ 581.115224][T14929] ksys_read+0x150/0x270 [ 581.119460][T14929] ? __pfx_ksys_read+0x10/0x10 [ 581.124211][T14929] do_syscall_64+0x166/0x520 [ 581.129248][T14929] ? trace_irq_disable+0x3b/0x140 [ 581.134272][T14929] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.140418][T14929] ? clear_bhb_loop+0x70/0xc0 [ 581.145091][T14929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.150974][T14929] RIP: 0033:0x7f6a6579e1d9 [ 581.155409][T14929] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 581.175018][T14929] RSP: 002b:00007f6a6671a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 581.183423][T14929] RAX: ffffffffffffffda RBX: 00007f6a65a25fa0 RCX: 00007f6a6579e1d9 [ 581.191384][T14929] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b [ 581.199344][T14929] RBP: 00007f6a65835888 R08: 0000000000000000 R09: 0000000000000000 [ 581.207330][T14929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 581.215302][T14929] R13: 00007f6a65a26038 R14: 00007f6a65a25fa0 R15: 00007f6a65b4fa48 [ 581.223284][T14929] [ 581.226808][T14929] Kernel Offset: disabled [ 581.231145][T14929] Rebooting in 86400 seconds..