last executing test programs: 9m11.910613071s ago: executing program 0 (id=1107): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) bind$alg(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) syz_clone(0x100011, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) getsockopt(r1, 0x7, 0x8, 0x0, &(0x7f0000000100)) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x24048055}, 0x0) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) sendto(r1, &(0x7f0000000180)='%', 0x300000, 0x840, 0x0, 0x60) close(0x3) fanotify_init(0x200, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') r6 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x8010, &(0x7f0000000140)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x3, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x40020, &(0x7f0000000280)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x2f947e0a0f4328e7}, 0x2c, {}, 0x2c, {}, 0x2c, {[], [{@flag='ro'}]}}) pread64(r5, &(0x7f0000000080)=""/237, 0xed, 0x5) bind$alg(r0, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) 9m9.625360442s ago: executing program 0 (id=1115): r0 = socket(0x2, 0x80805, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x4, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x113c}, 0x1, 0x0, 0x0, 0x48000}, 0x400c004) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) openat$sequencer2(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x111, 0x5}}, 0xffffffffffffff5a) write$RDMA_USER_CM_CMD_RESOLVE_IP(r5, &(0x7f0000000480)={0x3, 0x40, 0xfa00, {{0xa, 0xfffc, 0x0, @dev={0xfe, 0x80, '\x00', 0x11}, 0x5}, {0xa, 0x0, 0x0, @loopback}}}, 0x48) pread64(0xffffffffffffffff, &(0x7f0000000100)=""/50, 0x32, 0x20000000000040) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r6, r6, 0x0, 0x200000) mbind(&(0x7f00005b4000/0x4000)=nil, 0x4000, 0x1, 0x0, 0x100000000000041, 0x2) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r7 = fcntl$getown(r0, 0x9) sched_getattr(r7, &(0x7f0000000680)={0x38}, 0x38, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0xff, 0x5, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) r8 = socket(0x15, 0x80005, 0x0) getsockopt(r8, 0x200000000114, 0x2721, 0x0, &(0x7f0000000000)) 9m8.430784567s ago: executing program 0 (id=1126): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001b00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x94, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0xff00}, @NFTA_RULE_EXPRESSIONS={0x6c, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x34, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x3}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x108}}, 0x0) 9m8.027291042s ago: executing program 0 (id=1127): socket$netlink(0x10, 0x3, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000040), 0x2, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = memfd_create(&(0x7f0000000d00)='Y\xff\xff\x00\x00\x00\x00\x00K\xb2\x02\x80B\xe9\xe8\xcc\xde\x06\x00l\xa8\x1aJ\xaf\xb2M\xba\xb8_\x05U\xcd<|>\x9e\xec^\x0e\xbe\x18+-\x9b\x893\x02\x00\xa6\x1f+\xb3\xc5\x90z5\xe0\xdfi\xb7\x9f\xb4QW\xc9\xc9\x92\x03\t\x00\x00\x00\x00\x00\xb2\x0f\xee\xbe\f8\xcc\x7f\x00\x00\x00Z\x81\x00\x00\x00\x00\x18I\x13\xf1\xa2x\x04\x81R\xd45R\xae\x05\x00\x00\x00\x00\x00\x00\x00_M^dQ:\xbc\xafq\x88\x19nSF|;]\xe1A\x8c\x8a\x98\xd7|\xdcLF\r\xb1\xfd\xbf!\xc7u\xccP\xdd\x13~\x89\xcf\x85\xca\xa0%\xc6\xc7\x11\x00\x00\x00\x00\x00\x00\x00?M9\\\av~\'\xd9\xb0\xacdya]8\x9d\xb7\v\xf39\xc5{\x9c!\x0f/\xb8o8\xb9\x8d\x19\xe2\xca\x01y\x83\xe7\ng\x87\xd93\xf0y\xd6\xb0\xf2\x9f\xa7\xcf\xad\x86\\\xec\xec\xd6\x9d\bT\xcd\xa2\xea', 0xe) ftruncate(r2, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x34, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x5}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r5) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCADDRT(r7, 0x890b, &(0x7f0000000280)={0x0, @l2tp={0x2, 0x0, @multicast2, 0x80000000}, @l2tp={0x2, 0x0, @multicast2}, @in={0x2, 0x4e1d, @broadcast}, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}) connect$inet(r3, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000008380)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x20, 0x0, 0x20000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) 9m6.577164893s ago: executing program 0 (id=1134): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000080e372208c106801b284010203110902240001000010000904020002f8fd00000905060200020d0006090582020002"], 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x80000000, 0x20000006, 0x4d, 0x6, 0x5d, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0xd, 0x7, 0x0, 0xffffffff, 0xe661, 0x629, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8c, 0x6, 0x10002, 0x0, 0x5, 0x4, 0x8008, 0x400, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2c0, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f2e, 0xd, 0x4e2, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x7c9d, 0x9, 0x8, 0x3, 0x3, 0x81, 0x48c93690, 0x42, 0x3], [0x7, 0xb, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xca, 0x2, 0x3, 0x7ff, 0x8000012b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x3c484551], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x93a, 0x5, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x2000004, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0xfffffff9, 0xfffff000, 0x10000, 0x0, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x5, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0x1000]}, 0x45c) (async) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x80000000, 0x20000006, 0x4d, 0x6, 0x5d, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0xd, 0x7, 0x0, 0xffffffff, 0xe661, 0x629, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8c, 0x6, 0x10002, 0x0, 0x5, 0x4, 0x8008, 0x400, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2c0, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f2e, 0xd, 0x4e2, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x7c9d, 0x9, 0x8, 0x3, 0x3, 0x81, 0x48c93690, 0x42, 0x3], [0x7, 0xb, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xca, 0x2, 0x3, 0x7ff, 0x8000012b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x3c484551], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x93a, 0x5, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x2000004, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0xfffffff9, 0xfffff000, 0x10000, 0x0, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x5, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0x1000]}, 0x45c) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x164, &(0x7f0000000640)=ANY=[@ANYBLOB="5d01004e689544c1da98352f1b429a6bc19632b77a2d3cbde3674b55f60dacce1dc20b15344706373e7092260f2a140adacb43471f78a2953c860198f25ca42a497f7d88877e639ba486e1c0b3d38c1afa7f6bd915dd21ca98dc1bba06d794c01d86a7e17c98d7419432727193b57947d0c1413b30cf58b8bbc6ad110ac116c7bbb909abbee5cc16e913b9ea09e5c10332a37dbb894c0f1f0e491156dd1a0ad2de9efd5254017dc6791d6fbbbf6cfdcb8db76970c734bd07c63aaaba8fdfc19cca6e9ca6374a892c825206840b973a3e918fcd93c7c4a29d80092cfdf67831ec4609b535d5e275180bc211851e2dbb33bdcda15263236ae9fe900532867ffb8859bf81ca3cd41a49344fee18afd64879f8db0bddabca5ceebfbff53fc0df5ee30169138c3428c3d95c39ae74273e6e6e9d8346982df996eca6b0e8ec08002bed7d347bfb56f30fb20d12ebc137ba85ac52706dec22eb6e551af174cafe"]) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x0) ioctl$I2C_SMBUS(r2, 0x720, &(0x7f00000000c0)={0x0, 0xfb, 0x1, 0x0}) syz_usb_control_io(r1, &(0x7f00000002c0)={0x2c, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x805}}, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(r1, &(0x7f00000002c0)={0x2c, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x805}}, 0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000001000030400000000fdffff0000000300", @ANYRES32=0x0, @ANYBLOB="0000000040000000140012800900010076657468000000000400028008004040", @ANYRES32=0x0, @ANYBLOB="e73b4fc8b8"], 0x40}}, 0x0) syz_clone3(&(0x7f0000000300)={0x10100, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140), {0x2b}, &(0x7f0000000180)=""/55, 0x37, &(0x7f00000001c0)=""/65, &(0x7f0000000240)=[0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff], 0x6}, 0x58) (async) syz_clone3(&(0x7f0000000300)={0x10100, &(0x7f0000000080), &(0x7f0000000100)=0x0, &(0x7f0000000140), {0x2b}, &(0x7f0000000180)=""/55, 0x37, &(0x7f00000001c0)=""/65, &(0x7f0000000240)=[0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff], 0x6}, 0x58) prctl$PR_SCHED_CORE(0x3e, 0x4, r3, 0x3, 0x0) 9m3.473444041s ago: executing program 0 (id=1153): syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x1, 0x803, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='gid_map\x00') preadv(r2, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/133, 0x85}], 0x1, 0x2, 0x0) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000200)={0xaa, 0x224}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) r4 = syz_open_dev$usbfs(&(0x7f0000000000), 0x1ff, 0x402) r5 = dup(r4) ioctl$USBDEVFS_CONTROL(r5, 0xc0185500, &(0x7f0000000040)={0x23, 0x3, 0x2, 0x41, 0x0, 0x5, 0x0}) syz_clone(0x100000, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000a00)={'bond0\x00', 0x0}) sendto$packet(r6, &(0x7f0000000240)="02030c65420002000fd4ab5d71acedd7c9560385dcb1080094d7dc039806112405ce811cc352", 0x26, 0x0, &(0x7f0000000140)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @broadcast}, 0x14) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, 0x0, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000240), 0x0) r8 = syz_open_dev$vim2m(&(0x7f0000000580), 0x8, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f00000002c0)={0x2, @vbi={0x1, 0x9f, 0x3, 0x35315241, [0x3, 0x100], [0x9, 0x5], 0x108}}) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='cubic', 0x5) socket$nl_route(0x10, 0x3, 0x0) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x700, 0x0, 0xfffffffffffffd25) syz_usb_connect(0x0, 0x10a, &(0x7f00000022c0)=ANY=[@ANYBLOB="12010000f58a3c103d1000010d68010203010902f800015102b01e0904"], 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) 8m48.0842925s ago: executing program 32 (id=1153): syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x1, 0x803, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='gid_map\x00') preadv(r2, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/133, 0x85}], 0x1, 0x2, 0x0) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000200)={0xaa, 0x224}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) r4 = syz_open_dev$usbfs(&(0x7f0000000000), 0x1ff, 0x402) r5 = dup(r4) ioctl$USBDEVFS_CONTROL(r5, 0xc0185500, &(0x7f0000000040)={0x23, 0x3, 0x2, 0x41, 0x0, 0x5, 0x0}) syz_clone(0x100000, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000a00)={'bond0\x00', 0x0}) sendto$packet(r6, &(0x7f0000000240)="02030c65420002000fd4ab5d71acedd7c9560385dcb1080094d7dc039806112405ce811cc352", 0x26, 0x0, &(0x7f0000000140)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @broadcast}, 0x14) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, 0x0, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000240), 0x0) r8 = syz_open_dev$vim2m(&(0x7f0000000580), 0x8, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f00000002c0)={0x2, @vbi={0x1, 0x9f, 0x3, 0x35315241, [0x3, 0x100], [0x9, 0x5], 0x108}}) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='cubic', 0x5) socket$nl_route(0x10, 0x3, 0x0) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x700, 0x0, 0xfffffffffffffd25) syz_usb_connect(0x0, 0x10a, &(0x7f00000022c0)=ANY=[@ANYBLOB="12010000f58a3c103d1000010d68010203010902f800015102b01e0904"], 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) 6m3.239356165s ago: executing program 1 (id=2020): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r1, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x140, @dev={0xac, 0x14, 0x14, 0x14}}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2=0xe0000001}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) 6m2.82657195s ago: executing program 1 (id=2021): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) (rerun: 64) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x7c, r2, 0x300, 0x70bd27, 0x25cfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x3}, @NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}, @NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}, @NL80211_ATTR_HIDDEN_SSID={0x8}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x4}, @NL80211_ATTR_HE_OBSS_PD={0x10, 0x117, 0x0, 0x1, [@NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP={0xc, 0x4, "95a06a2be119e4b0"}]}, @acl_policy=[@NL80211_ATTR_MAC_ADDRS={0x28, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}]}]]}, 0x7c}}, 0x40011) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) socket$inet_sctp(0x2, 0x1, 0x84) (async) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) unshare(0x26020480) (async, rerun: 32) r5 = socket(0x10, 0x80002, 0x2) (rerun: 32) bind$netlink(r5, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) (async) r6 = syz_usb_connect(0x1, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r6, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r6, 0x0, 0x0) (async) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0x3) ioctl$TCSETSW2(r4, 0x80047456, &(0x7f0000000040)={0x3, 0xb, 0xfffffffe, 0x7fffffff, 0x0, "23f555d9adb42d4408020e90d1beaa82dc1ecf", 0xffffffff}) (async, rerun: 64) r7 = socket$inet6(0xa, 0x3, 0x7) (async, rerun: 64) r8 = socket$netlink(0x10, 0x3, 0x0) (async) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) (async, rerun: 32) r10 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) (rerun: 32) execveat(r10, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) (async) fcntl$setstatus(r9, 0x4, 0x7c00) (async, rerun: 64) writev(r8, &(0x7f00000000c0)=[{&(0x7f0000000040)}], 0x1) (async, rerun: 64) connect$inet6(r7, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) sendmmsg(r7, &(0x7f0000000480), 0x2e9, 0x0) (async) socket$nl_xfrm(0x10, 0x3, 0x6) fsopen(&(0x7f0000000200)='ecryptfs\x00', 0x0) 6m2.113090618s ago: executing program 1 (id=2023): socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x4, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x113c}, 0x1, 0x0, 0x0, 0x48000}, 0x400c004) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) openat$sequencer2(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x111, 0x5}}, 0xffffffffffffff5a) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f0000000480)={0x3, 0x40, 0xfa00, {{0xa, 0xfffc, 0x0, @dev={0xfe, 0x80, '\x00', 0x11}, 0x5}, {0xa, 0x0, 0x0, @loopback}}}, 0x48) pread64(0xffffffffffffffff, &(0x7f0000000100)=""/50, 0x32, 0x20000000000040) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r5, r5, 0x0, 0x200000) mbind(&(0x7f00005b4000/0x4000)=nil, 0x4000, 0x1, 0x0, 0x100000000000041, 0x2) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r6 = fcntl$getown(0xffffffffffffffff, 0x9) sched_getattr(r6, &(0x7f0000000680)={0x38}, 0x38, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0xff, 0x5, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) r7 = socket(0x15, 0x80005, 0x0) getsockopt(r7, 0x200000000114, 0x2721, 0x0, &(0x7f0000000000)) 6m0.468273571s ago: executing program 1 (id=2030): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x4d, 0x0, &(0x7f0000001840)=0x1c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) bind$alg(r3, 0x0, 0x0) sendto$packet(r3, &(0x7f0000000340)="bef2aeaebac38f92967dba56ba0ad8af096ec9b83068e36820695874b1d5365175ee2ff606e008b3c39dd57db3035b083973a8e7e5c9e0500240ed12fe0e9c2b2f6707b004e0410858f82c29540a060973783c2fa1a99f4740b9b0e3d93ac87c9099fe5856349e84840efb5af531d55c66ae45d6600cffa153160e4aedb61a80a4e5f531502672d0d42a02cf5ebf829fbb20afae32f3e5fb4c58b177f3d0c90b0c936a1988b0ab3236f9a0f727c421529b911ad06e4fe01d", 0xb8, 0x40881, &(0x7f00000001c0)={0x11, 0x5, 0x0, 0x1, 0x81, 0x6, @link_local}, 0x14) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, &(0x7f00000000c0)=@framed={{}, [@jmp={0x5, 0x1, 0xa}]}, &(0x7f0000000000)='syzkaller\x00'}, 0x94) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b40)=@ipv6_newrule={0x54, 0x20, 0x1, 0x70bd28, 0x25dfdbfe, {0xa, 0xe0a579e50d9a443, 0x10, 0x6, 0xff, 0x0, 0x0, 0x3, 0x10}, [@FRA_DST={0x14, 0x1, @private1}, @FIB_RULE_POLICY=@FRA_FWMASK={0x8, 0x10, 0xc4}, @FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FIB_RULE_POLICY=@FRA_FWMARK={0x8}]}, 0x54}}, 0x20000000) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x802000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='children\x00') read$eventfd(r6, &(0x7f0000000040), 0x8) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0xfffffd66, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101804bc9555e1affd5020000000900010001797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000000009000300737975320000000014000000110001"], 0x7c}}, 0x0) r7 = creat(&(0x7f0000000100)='./file0\x00', 0x140) r8 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r8, 0xc0145608, &(0x7f00000000c0)={0x100, 0x2, 0x2}) ioctl$vim2m_VIDIOC_EXPBUF(r8, 0xc0405668, &(0x7f0000000100)={0x0, 0x1, 0x2}) close_range(r7, 0xffffffffffffffff, 0x0) sendmsg$NFT_MSG_GETTABLE(r1, &(0x7f0000000180)={0x0, 0xd, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000040a0101", @ANYRES16=r1, @ANYRES32=r7, @ANYRES16, @ANYRES64=r7], 0x14}, 0x1, 0x0, 0x0, 0x41004}, 0x0) recvmmsg(r1, &(0x7f0000001700)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 5m59.207349238s ago: executing program 1 (id=2038): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x10c4, 0xea90, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)={0x0, 0x0, 0x8, {0x8, 0x0, "392cdaab4a73"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x18, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x20, 0x1, 0x2, "c282"}, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000540)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="20010e"], 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x14, &(0x7f0000000140)={0x20, 0xc, 0x23, {0x23, 0x10, "506d43efea26c3f097070b8b55f1b8096495b2ac6f9ce377b9cf5a196768765132"}}, &(0x7f0000000340)={0x0, 0x3, 0xc4, @string={0xc4, 0x3, "167b9e1ad2586fdd0b2bf8a3712f572cc49c5fd852e142749d703831ac3bdfad8fa72d2dd155aeb992d05a44271a7f3b4f64426c325ca76f20a5041b10ca5567954a9ae274bb1c098193701a71d51e5ac3b5b055d336f90889fe2378887e3b8f3fb3929875dc6ed7e75c5e64c6156790afa0ccddbafa919ad2cc82b906230b5f1fa7fcd662280c0c1d5bb7bcd5eda48d72a6df354f24b9295b188ef21b2e0a07c22ca7065e167e3716c99a470bf903c5e0c28392c2b290f9957c1ac8661f47ad11fe"}}, &(0x7f0000000180)={0x0, 0x22, 0xf, {[@global=@item_4={0x3, 0x1, 0x4, "e89fdcbb"}, @local=@item_4={0x3, 0x2, 0x0, "95f200d5"}, @global=@item_4={0x3, 0x1, 0x7, "d768cf33"}]}}, &(0x7f0000000200)={0x0, 0x21, 0x9, {0x9, 0x21, 0x9, 0xb3, 0x1, {0x22, 0x70f}}}}, &(0x7f0000000500)={0x18, &(0x7f00000002c0)={0x20, 0x3, 0x1e, "ee7e8e570cd94eb6a5389513d2c3c7575bbb40307bcd55c13d5ed4518705"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000580)={0x20, 0x1, 0xdf, "50606b939803013a16eeb5c7225490d9d3bc1da4da2dbcbe319ef55b31fcd282746686c7c3f418f915508e52fd8461b0d4a1730b78423695486eaa542132ee0851061978f04e2a113fe6ffaeb3bc1830a289ac406b50df437f95474be2e30e67b841b9f18fb8e40be553928816090ecdd7108014846c163c9cc014bc0e19f180fc49e8adbd0f5c4a4a554e6d7673ec6364450a2946a2ca500d90c0f5fabedade099a2acb324bef4861f76364658969855b1f3dd96888ba40c98b726a6c3bfc0290c48ba3209d7d2cd8c2fd213ac8e1d0cd4477131f010b93698a624fa3e160"}, &(0x7f00000004c0)={0x20, 0x3, 0x1, 0x5}}) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f00000001c0)={0x0, 0xb2, 0x1, 0x0}) 5m58.522110682s ago: executing program 1 (id=2042): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a00), 0xffffffffffffffff) write$UHID_GET_REPORT_REPLY(0xffffffffffffffff, &(0x7f00000009c0)={0xa, {0xa, 0xe, 0x1c}}, 0xa) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x3, 0x0, @vifc_lcl_addr=@local, @local}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0xfb, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @echo_reply={0x0, 0x0, 0x0, 0x64, 0xd2}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x8, "004ae9d56a571bfa970548fc3c7b000000000000000000000200", 0xb2, 0xfffffff7, 0x4, 0x40000006}, 0x3c) 5m57.362646061s ago: executing program 33 (id=2042): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a00), 0xffffffffffffffff) write$UHID_GET_REPORT_REPLY(0xffffffffffffffff, &(0x7f00000009c0)={0xa, {0xa, 0xe, 0x1c}}, 0xa) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x3, 0x0, @vifc_lcl_addr=@local, @local}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0xfb, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @echo_reply={0x0, 0x0, 0x0, 0x64, 0xd2}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x8, "004ae9d56a571bfa970548fc3c7b000000000000000000000200", 0xb2, 0xfffffff7, 0x4, 0x40000006}, 0x3c) 5m38.335455429s ago: executing program 6 (id=2112): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x1a7a40) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x4, 0x48dd, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d9600010000000000000200", "2809e8dbe108598948224ad54afac100875397bdb22d0000b420a1a93c9e01177d3d058dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00", [0x100000000, 0x7]}}) 5m38.047229435s ago: executing program 6 (id=2114): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581", @ANYRES8], 0x0) (async, rerun: 32) r1 = syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0x0, 0x2, 0x4, 0x39}, &(0x7f0000000140)=0x0, &(0x7f0000000280)) (rerun: 32) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0x200, 0x0, 0x4) (async, rerun: 64) io_uring_enter(r1, 0xa32, 0x0, 0x47, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='numa_maps\x00') preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0x0) (async, rerun: 32) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x8, 0x4, 0x4, 0x8, 0x1014, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) (async, rerun: 32) syz_usb_control_io(r0, &(0x7f0000000b00)={0x18, &(0x7f0000000140)=ANY=[@ANYBLOB="00000f00000009009197d09647040890"], 0x0, 0x0, 0x0, 0x0}, 0x0) 5m37.697569308s ago: executing program 6 (id=2116): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0xf, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000f00000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000bf98000700000000b508f4ffffffffff8400000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 5m37.407219016s ago: executing program 6 (id=2118): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x59) socket$inet6_udplite(0xa, 0x2, 0x88) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_IRQ_LINE(r3, 0x4008ae61, &(0x7f0000000080)={0x10000, 0x80000000}) ioctl$KVM_CAP_X86_GUEST_MODE(r3, 0x4068aea3, &(0x7f00000006c0)) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) preadv(r4, &(0x7f0000001200)=[{&(0x7f0000000dc0)=""/72, 0x48}, {0x0}], 0x2, 0x40, 0x3) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r6 = dup(r5) socket$inet_mptcp(0x2, 0x1, 0x106) r7 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r7, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r7, 0x6, 0x14, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r7, &(0x7f0000000040)={0x2, 0x4e23, @empty}, 0x10) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r6, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) 5m35.739138448s ago: executing program 6 (id=2123): bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f00000002c0)=ANY=[@ANYBLOB="1808000000180000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007baaf8ff00000000b5090800821300007baaf0ff00000000bf87000000000000b5070000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000140000006c07010033d43afffe800000000000000033d40000000010ff02000000000000000000000000000189"], 0x340a) 5m35.448468466s ago: executing program 6 (id=2125): r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x109801, 0x0) write$dsp(r0, &(0x7f0000002000)='`', 0x88020) unshare(0x60400) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000680)={r1, 0xfffffd11, &(0x7f0000000980)}, 0x10) (async) pselect6(0x40, &(0x7f0000000080)={0xc, 0x0, 0x0, 0x7}, 0x0, 0x0, 0x0, 0x0) 5m20.222070926s ago: executing program 34 (id=2125): r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x109801, 0x0) write$dsp(r0, &(0x7f0000002000)='`', 0x88020) unshare(0x60400) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000680)={r1, 0xfffffd11, &(0x7f0000000980)}, 0x10) (async) pselect6(0x40, &(0x7f0000000080)={0xc, 0x0, 0x0, 0x7}, 0x0, 0x0, 0x0, 0x0) 6.802310086s ago: executing program 7 (id=3558): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a00), 0xffffffffffffffff) write$UHID_GET_REPORT_REPLY(0xffffffffffffffff, &(0x7f00000009c0)={0xa, {0xa, 0xe, 0x1c}}, 0xa) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x3, 0x0, @vifc_lcl_addr=@local, @local}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0xfb, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @echo_reply={0x0, 0x0, 0x0, 0x64, 0xd2}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000200)={@empty=0xff00, @multicast2=0xe0000300, 0x8, "004ae9d56a571bfa970548fc3c7b000000000000000000000200", 0xb2, 0xfffffff7, 0x4, 0x40000006}, 0x3c) 6.666971271s ago: executing program 7 (id=3560): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e24, @private=0xa010102}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000000c0), 0x4) r1 = syz_open_dev$cec(&(0x7f0000000080), 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r2, 0x2000000) ioctl$CEC_S_MODE(r2, 0x40046109, &(0x7f00000000c0)=0xffffffff) ioctl$CEC_S_MODE(r1, 0x40046109, &(0x7f00000002c0)=0x1) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000900), &(0x7f0000000000)=0xfe47) 5.959455852s ago: executing program 3 (id=3564): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a05000000000000240000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000058000000060a010400000000000000000100000008000b4000000000300004802c00018008000100636d7000200002800c0003800500020000000000080001400000000908000240000000000900010073797a30"], 0xcc}, 0x1, 0x0, 0x0, 0x4}, 0x0) 5.833835701s ago: executing program 3 (id=3565): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060", @ANYRESOCT], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in6=@private0, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e0001"], 0xb8}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x0, 0x0, 0x0, 0x10000000}, {0x0, 0x8}}}, 0xb8}}, 0x0) 5.736125956s ago: executing program 7 (id=3566): mount$fuse(0x0, 0x0, 0x0, 0x8000, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=0000000000000000010000', @ANYRESDEC=0x0]) (async) mount$fuse(0x0, 0x0, 0x0, 0x8000, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=0000000000000000010000', @ANYRESDEC=0x0]) r0 = open(&(0x7f0000000380)='./bus\x00', 0x40, 0x0) r1 = creat(&(0x7f0000000200)='./bus\x00', 0x84) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x8002) write$binfmt_aout(r3, 0x0, 0xffffff2b) (async) write$binfmt_aout(r3, 0x0, 0xffffff2b) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000240)=ANY=[@ANYBLOB='+\x00\x00\x00'], 0x2b) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f0000000000), 0x10) (async) connect$can_bcm(r4, &(0x7f0000000000), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f00000003c0)={'vxcan0\x00', 0x0}) sendmsg$can_bcm(r4, &(0x7f0000000480)={&(0x7f0000000340)={0x1d, r5}, 0x10, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d7fe68ca0000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000004"], 0x20000600}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$can_bcm(r4, &(0x7f0000000480)={&(0x7f0000000340)={0x1d, r5}, 0x10, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d7fe68ca0000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000004"], 0x20000600}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendfile(r2, r0, 0x0, 0x4000000053d2) syz_usb_connect(0x2, 0x3d, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000393f6fe108c10590157db0102030109022b00018109300009041cfa02f278380209050c02100000fdda0705fda246483e099483120ddade63af988db60507040002080fd9"], &(0x7f0000001180)={0x0, 0x0, 0x0, 0x0}) 5.551459349s ago: executing program 3 (id=3567): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r1, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x140, @dev={0xac, 0x14, 0x14, 0x14}}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}, 0x1, 0x6010000}, 0x0) 5.467633663s ago: executing program 3 (id=3568): connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x8000001, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfb}}, 0x10}, 0x1c) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac95ab194f93f8e795a9b29420fa62d", 0x11}], 0x1}}], 0x1, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb2200e60080b8785d96000100", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) 5.108453663s ago: executing program 4 (id=3569): getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$tipc(0x1e, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x3, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000001000000fe8000000000000000000000000000bbac1414bb00000000000000000000000000000400100000000200002000000000", @ANYRES32=0x0, @ANYRES32=0xee01], 0xb8}}, 0x0) ioctl$VIDIOC_DBG_G_CHIP_INFO(0xffffffffffffffff, 0xc0c85666, &(0x7f00000005c0)={{0x1, @addr=0x1}, "522ec2c4dfdea0e049be106158e4f5aa2e9a2a24b978bb029b829364f1d8fecd", 0x1}) sendmsg$nl_xfrm(r2, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x1) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(&(0x7f0000002040)='./file0\x00', &(0x7f0000000080)='./file0\x00') rename(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000780)='./file2\x00') symlinkat(&(0x7f0000001040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) r4 = openat$ppp(0xffffffffffffff9c, 0x0, 0x1980, 0x0) close(r4) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000400)='ns/user\x00') setns(r5, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x2060c0, 0x0) openat$audio1(0xffffffffffffff9c, &(0x7f0000000000), 0x202, 0x0) syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp6\x00') socket$xdp(0x2c, 0x3, 0x0) 5.010904166s ago: executing program 3 (id=3570): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) bind$netlink(r0, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @mcast1}]}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x54}, 0x1, 0x1000000}, 0x0) 4.525182383s ago: executing program 3 (id=3572): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x4c) r1 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x60, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0xa}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x118}, @NFTA_SET_EXPR={0x10, 0x11, 0x0, 0x1, @last={{0x9}, @void}}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x4}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe8}}, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000080)={&(0x7f00000007c0)=[{0x7fff, 0x9a00, 0x0, 0x0}, {0x7, 0x201, 0x0, 0x0}, {0x3, 0x1810, 0x0, 0x0}], 0x3}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d05c164a534308", 0x10) r4 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f0000004c00)=[{{0x0, 0x0, &(0x7f0000000240)}, 0x2ca998c3}], 0x4000032, 0x40000021, 0x0) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000340), 0x802, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r5) sendmsg$NL80211_CMD_DISASSOCIATE(r4, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, r6, 0x1, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xeb53, 0x3b}}}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x20000810) io_submit(0x0, 0x1, &(0x7f0000000700)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0xc3, r5, 0x0, 0x0, 0xbe}]) recvmsg$can_raw(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000340)=""/197, 0xc5}], 0x1}, 0x40002021) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="3800000000010500e7ffffff000000000100000214001080080001407fffffff08000140000000070800154000000004080003405a0651c64617a478000000002888f4042d2462402f3f900ead991e399cd93c61c77cec7b88b52bdb6677a426b3c205ecc2460cc3a776d064974bc4764e486bcf88207eae6684ed00fa1958cd1b5b844f98d8e40b031c676b89f93dfb5bc887907b47740a104888374f00705de063a3e2c24361f1efc1"], 0x38}, 0x1, 0x0, 0x0, 0xc8801}, 0x8010) r7 = syz_open_dev$mouse(&(0x7f0000000280), 0x944, 0x402000) ioctl$VHOST_VDPA_GET_DEVICE_ID(r7, 0x8004af70, &(0x7f0000000440)) recvfrom$rxrpc(r4, &(0x7f0000000000)=""/172, 0xac, 0x40010002, 0x0, 0x0) 4.029031541s ago: executing program 2 (id=3575): r0 = socket(0x22, 0x6, 0x81) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000400)={0x18, 0x0, {0x2, @multicast, 'ip6tnl0\x00'}}, 0x1e) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x20008080) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a70000000060a0b0400000000000000000200000044000480400001800a0001006d6174636800000030000280080002400000000118000300c6a41dee000000003a49490834eb16000f0200230a0001006f776e657200f0000900010073797a30000000000900020073797a32"], 0x98}}, 0x4048010) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'wrr\x00', 0x31, 0x7fff, 0x6}, 0x2c) ioctl$PPPOEIOCSFWD(r1, 0x40047452, 0x0) connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8000, @multicast2}}, 0x24) fsetxattr$security_ima(r4, &(0x7f0000000180), &(0x7f0000000440)=@sha1={0x1, "412415b9af27c1eb7675c6b9334306fa9c23deaf"}, 0x15, 0x1) r5 = syz_open_dev$cec(&(0x7f0000000040), 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r5, 0xc05c6104, &(0x7f00000000c0)={'\x00', 0x0, 0x5, 0x3, 0x2002a28, 0x0, "f759ca14860e00", '\x00', "03000500", "fc599184", ["8bada940ed86af0a00", "c2a4a110cfc1bac26ef76ef7", '\x00', "00113a071fa0fcd9c500"]}) sendmmsg(r0, &(0x7f0000007840), 0x0, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x5) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000dc0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x1a4, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x178, 0x4, 0x0, 0x1, [{0x160, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x150, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8}, @NFTA_MATCH_NAME={0xb, 0x1, 'policy\x00'}, @NFTA_MATCH_INFO={0x138, 0x3, "ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d04a8e3e29360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f5000000"}]}}}, {0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELOBJ={0x13c, 0x14, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_USERDATA={0xd7, 0x8, "467f58f6c0f0e52664c7d884fb43b36c5d713a74477c7e433254466ed63200bbb7e7f3ff47b4e617990606eae5da1516283279f2893d7a056139f791eaf10aa4b8f7a4d64126332f89be9a8cd84f435f6f29b4b6c404a316348449c2401a1e0a651c3d64e771fe4d0d15d253e303abe12c0559f0cfa226020eab82ba972675a9c9543335edcb061421c035c5ee55ed0eba424053121a948ddd7c017be959e8229314ac3122a276d28a792074821cb87ab2ccf7bcd836aab6b40eb1dcb65be545e520a934379474025904498e2522daa58c4abe"}, @NFTA_OBJ_HANDLE={0x7, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELTABLE={0x1a4, 0x2, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFTA_TABLE_USERDATA={0xdb, 0x6, "2a97987e71eb8b6b0c9a894fde0f606b87c4c27b676062c01401fe9fcafca7a21be842533e615f211c34d03f31f07650cd5a1b46b42446aeae43a8575feb31d16b1ab8bd79ad529bb0e4c209eef7f317589feffc502ce7614e4deef3a2cbcc6dc772a1ba036ed5b4b0ec9c475a5d6408859835408202348527670d828496ceb679735f784c2c4ffbcd150729e304673a73752afa4b39da41774179eb1f6a9ba356f44448b262b3f0cd18f9940b23c0e1feec43618b887c410ef65a8e498c7283edda11fb6d8e83cd7d0c404909f7818430faf726c17d61"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_USERDATA={0x92, 0x6, "81bdc9666245328643b6aa27a93850e1e97cb5fb696e67c79e674829939029f3c1e4238811da5414db63078ef987dde60db6f37a5fe96022d71324d9c66953f997bfe14806899242d49202fb1fa010ab90a5ca722557d478234d1085c5177117a97f7b722d0ac812e3aa752e09fc022a5c7a83a168be07b1434f6d50ead74985156017046b5c91015a50140540b5"}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_NAME={0x5, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x4ac}, 0x1, 0x0, 0x0, 0x10}, 0x4000800) r8 = dup(r6) write$6lowpan_enable(r8, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$USBDEVFS_CONTROL(r8, 0xc0105500, &(0x7f00000000c0)={0x5, 0x18, 0x2, 0x51, 0xfb, 0x0, &(0x7f0000000240)="ec1686aee02e51d588430b495f299a3ac5096af02d35c4d2680b22d1a29cbd7746a6c320d38d8e377f7fcd1ca0b2069442d95f13077c2dd1216069da851b9ddc8c80e588c881f59cbfcc258e00e8bcb541ebbef72b264ac1c2ba608e33350c82fa5371cc76c975688716e18ecb8d351a933385f43bc8661ac01968b3e24087348a4477f9d6fb321dbc2a5795b4da57cfb955afe79f2aef72b82a5d23ce682b5fccd5c5bc6668aa8589fbaa2be475299109e2bd7d49cf8ce6db99d123c5a48ea00ea846914487b2b332f7c8b4362e0afe9d55b6bf5d26471447253a658a43009c40c51534a28a5295199a79c6fd679f34cb355f799c262b58b32dc5"}) connect$rxrpc(r8, &(0x7f0000000000)=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e20, 0x3, @ipv4={'\x00', '\xff\xff', @loopback}, 0x1}}, 0x24) 3.655967479s ago: executing program 2 (id=3576): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x13) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)) socket$nl_route(0x10, 0x3, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800030008000000060018000100000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES16], 0x54}}, 0x0) 3.354834555s ago: executing program 2 (id=3577): r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) r1 = getpid() ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x4, r1, 0x0, 0x0, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc1105518, &(0x7f0000000c40)={{0x1, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x80000, 0xf, 0x80000000000000, 0x0, 0x9, 0x0, 0x0, 0x4, 0x7, 0x0, 0x7, 0x7ff, 0xfffffffe, 0x0, 0x40, 0x0, 0x0, 0x100000001, 0x0, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffd, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x80000000000000, 0x0, 0x4, 0x0, 0x0, 0x40, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffa, 0x0, 0x401, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x400000000000, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x300, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x80000000000000, 0xfffffffc, 0x1, 0x8, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x4, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0xde4, 0x7, 0x0, 0x100000000]}) 3.3125592s ago: executing program 4 (id=3578): ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8000007, 0x0, 0x5, 0x0, 0x40000000000006, 0xfa11, 0xffffffff}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0) ioctl$KVM_CHECK_EXTENSION(r4, 0xae03, 0x95) (async) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4001}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc14000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x4094}, 0x24000004) (async) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x61, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a70000000090a010400000000000000000a0000040900020073797a310000000008000a40fffffffc0900010073797a3100000000080005400000000d2c00128014000180090001006c6173740000000004000280140001800c000100636f756e746572000400028008000340000001"], 0x98}, 0x1, 0x0, 0x0, 0x4044050}, 0x40) (async) pwritev2(r5, &(0x7f0000001540)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0x1000, 0x7, 0x4) (async) syz_emit_ethernet(0x3e, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff080047000030000000000006907800000000000000008608ffffffff0102"], 0x0) syz_usb_connect(0x0, 0x41, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000e518a708ac0501859d200000690109022f00010000000009040000000e010000152403"], 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4004550c, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd30", 0x10) r8 = accept4(r7, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_GET_KEY(r8, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) (async) recvmmsg(r8, &(0x7f00000048c0)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001d00)=""/1, 0x1}], 0x1}, 0xc}], 0x1, 0x10002, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) socket(0x80000000000000a, 0x2, 0x0) 3.215182348s ago: executing program 2 (id=3579): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x59) socket$inet6_udplite(0xa, 0x2, 0x88) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000080)={0x10000, 0x80000000}) ioctl$KVM_CAP_X86_GUEST_MODE(0xffffffffffffffff, 0x4068aea3, &(0x7f00000006c0)) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) preadv(r0, &(0x7f0000001200)=[{&(0x7f0000000dc0)=""/72, 0x48}, {0x0}], 0x2, 0x40, 0x3) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r2 = dup(r1) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r4, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @empty}, 0x10) getsockopt$inet_int(r3, 0x0, 0x13, 0x0, &(0x7f0000000c00)=0xfffffffffffffe87) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) 2.600736992s ago: executing program 7 (id=3581): r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0xbc, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x8c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x8, 0x4, 0x0, 0x9], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x11, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x10000}]}, {0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x583}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x280000000000000}]}}]}, 0xbc}}, 0x0) 2.588854526s ago: executing program 5 (id=3582): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001900)=@bridge_delneigh={0x1c, 0x1e, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x0, 0x62}}, 0x1c}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001900)=@bridge_delneigh={0x1c, 0x1e, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x0, 0x62}}, 0x1c}}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x141, 0xf2, 0xc5, 0x96, 0x20, 0x16d0, 0x10b8, 0xde8e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x0, 0x83, 0xec, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x2, 0x0, 0xa}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) 2.407766796s ago: executing program 2 (id=3583): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x4008800) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001300)=@newtfilter={0x88c, 0x2c, 0xd27, 0x70bd26, 0x8000, {0x0, 0x0, 0x0, r3, {0x8}, {}, {0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x85c, 0x2, [@TCA_BASIC_ACT={0x4}, @TCA_BASIC_POLICE={0x854, 0x4, [@TCA_POLICE_TBF={0x3c, 0x1, {0xffffffff, 0x0, 0x2, 0x2, 0x0, {0x6, 0x1, 0x3, 0x1, 0x0, 0xf0a}, {0x6, 0x0, 0x0, 0x5cf0, 0x2, 0x60a}, 0xffff915d, 0x6, 0xc}}, @TCA_POLICE_RATE={0x404, 0x2, [0x1, 0x1ff, 0x8, 0x3ff, 0x80, 0x10, 0x7, 0x1, 0x4, 0x5, 0x3, 0x8, 0x6, 0x7, 0x2, 0x2, 0xfffffff8, 0x9, 0x7, 0xf, 0x60000000, 0x4, 0x1, 0x3, 0x8, 0x1c00000, 0x9, 0xffffffff, 0x9, 0xffffffff, 0x5, 0xc7, 0x100, 0xfffffffd, 0x5, 0x6, 0x7ff, 0x43b, 0x2d, 0x892, 0x5, 0x2, 0x505b, 0x6, 0x800, 0x1, 0xce2, 0x5, 0x7, 0x0, 0x771f00, 0x1, 0x10, 0xe, 0x1, 0x7, 0x4, 0x80000001, 0x1, 0x0, 0x7, 0xd, 0xfffffffa, 0xffffffff, 0x40000000, 0x9, 0x6, 0x0, 0xb, 0x3, 0x7, 0x1, 0x6a0, 0x4, 0x1, 0x3, 0x0, 0x1, 0x103b0, 0x1, 0xa6e, 0x31f, 0x7, 0x1, 0x5, 0x1, 0x9, 0xfffffff9, 0xffffffff, 0xf, 0x9, 0x1ff, 0x4, 0x40, 0xe5, 0x180, 0xf34, 0x5, 0x0, 0x2, 0x4, 0x9, 0x41800000, 0x8, 0x6d6, 0xf, 0x5, 0xff, 0x7fffffff, 0xd7f, 0x1, 0x100, 0xfa, 0x0, 0x1ab, 0x50, 0x1d, 0x4, 0x92d6, 0x2, 0x400, 0x8001, 0x3ff, 0x6, 0x1, 0x4, 0x1, 0x4, 0x5, 0x8, 0x1ff, 0x4627, 0x7, 0x28c, 0x1000, 0xaa51, 0x6, 0x6, 0xa973, 0x7, 0x80000000, 0xfb4, 0xd1, 0x0, 0x5, 0x5, 0x7, 0x5, 0xff57, 0x5, 0x7, 0xd, 0x7fffffff, 0x1, 0x3, 0x6, 0xf, 0x2f, 0x3f98, 0x5, 0x8, 0xfdc6, 0xc767, 0x7, 0x5, 0x81, 0xfffffffe, 0x8, 0x81, 0x7fffffff, 0x9, 0x7, 0x9a9, 0xe5, 0x7, 0x6, 0x0, 0xf, 0x5, 0xb, 0x3, 0x8000, 0x5, 0x6, 0x7, 0x23b, 0xd, 0x80000001, 0x3, 0xfffffff8, 0x7, 0x1, 0x7, 0xf, 0x2, 0x61e9, 0xcf2, 0x7, 0x0, 0xfffff800, 0x8, 0x8, 0x100, 0x1, 0x8001, 0xc691, 0xffff, 0x7, 0x7, 0x40, 0x5e, 0xfffffffe, 0x7, 0x8000000, 0xc, 0x4ec18179, 0x6, 0x2, 0x3f, 0x4, 0xaf9c, 0x6, 0x1, 0x80000001, 0x0, 0x7, 0xdf9f, 0x10001, 0x9, 0xf, 0x200, 0x4, 0x8, 0xb48, 0x80000001, 0x1, 0x113, 0xb, 0xffffffff, 0x2, 0x6, 0x3, 0xb, 0x5, 0x9, 0xb4, 0x2, 0x8000, 0x1, 0xa5, 0xfffffff8, 0xa65, 0x1, 0x3e3, 0x401, 0xf54d]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0xcbe, 0x7fffffff, 0x9, 0xed, 0x7ff, 0x0, 0x6, 0xe3, 0x6, 0x2, 0x8, 0x3, 0x5, 0x4, 0x2, 0x5, 0x8, 0xb4b0, 0x1, 0x8, 0x2, 0x10001, 0x39, 0x5, 0xc, 0x8, 0x4, 0x41f6, 0x6, 0x4, 0x4, 0x2, 0x8, 0xfcc1, 0x2, 0xffffffe7, 0x8, 0x2, 0x5, 0x2, 0x400, 0x9, 0xfffffff9, 0x2, 0x3f, 0x6d0, 0x7, 0x80000001, 0x0, 0x1, 0x3, 0x9, 0x3, 0x6, 0xe33, 0x2, 0xad0a, 0xc86, 0x6c9, 0x80000001, 0x4, 0x4, 0x80000000, 0x3, 0x0, 0x3ff, 0x3, 0x5, 0x3, 0x0, 0xfffffffe, 0x8000, 0x6, 0x8, 0x6, 0x8, 0x5, 0x3, 0x6, 0xffff, 0xe, 0x8000, 0x0, 0x513c4ba4, 0x4, 0x2, 0x6, 0x8, 0x9, 0xa16, 0x7, 0x9, 0xc, 0x6, 0x8, 0x5, 0xfb9, 0x10, 0x3, 0x4, 0x4, 0x1, 0x0, 0x2ad, 0x0, 0xffffffff, 0x401, 0x6, 0x0, 0x6, 0x0, 0xfffffff7, 0x2, 0x2, 0x2, 0x9, 0x3, 0x4, 0xa87, 0x6, 0x1, 0x1, 0x81, 0x2, 0x8, 0x651, 0x8, 0x8, 0x4, 0x2, 0x0, 0x1, 0x101, 0x4, 0x5, 0x800, 0xffff, 0x80000000, 0x978, 0x8, 0x80000000, 0xc, 0x5, 0x0, 0x2, 0x8000, 0x8, 0x9, 0x5, 0x2, 0xc4, 0xe, 0x8000, 0x63e, 0x2, 0x8, 0x3cc5, 0x100, 0x9, 0x2, 0xd0, 0xffffffff, 0x4, 0x100, 0xfffffff8, 0x4, 0x6000, 0x4, 0x400, 0x0, 0x3, 0x3, 0x0, 0x1, 0x4, 0xfffffff7, 0x4, 0x4, 0x800, 0x4, 0x0, 0xc, 0x2, 0x8000, 0x100, 0x4e190264, 0x9, 0xff, 0x0, 0x1, 0x401, 0xf, 0x4, 0x40, 0x10, 0x4e, 0x6e, 0x4, 0x8, 0x7, 0x6, 0x100, 0xa, 0x2, 0x9624, 0xb8a, 0x1000, 0x2, 0x9, 0x1, 0x800, 0xf, 0x1, 0x4e9, 0xf49, 0x7, 0x0, 0xd0000000, 0x6, 0xcd, 0xa, 0x8, 0x8, 0x400, 0x9, 0x8, 0xffffff81, 0x4, 0x5, 0x6, 0xfffffffd, 0x0, 0x8, 0x3, 0x4, 0x3, 0x40, 0x5, 0x0, 0x2, 0x9, 0x79eca73e, 0x4, 0x1, 0x1, 0x10, 0x2, 0x1ff, 0x0, 0x6, 0x3, 0x4, 0xe214, 0x5, 0x4, 0x8f6]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xffffffffffffffff}]}]}}]}, 0x88c}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) 2.166633097s ago: executing program 4 (id=3584): socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x4, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x113c}, 0x1, 0x0, 0x0, 0x48000}, 0x400c004) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) openat$sequencer2(0xffffff9c, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x111, 0x5}}, 0xffffffffffffff5a) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f0000000480)={0x3, 0x40, 0xfa00, {{0xa, 0xfffc, 0x0, @dev={0xfe, 0x80, '\x00', 0x11}, 0x5}, {0xa, 0x0, 0x0, @loopback}}}, 0x48) pread64(0xffffffffffffffff, &(0x7f0000000100)=""/50, 0x32, 0x20000000000040) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r5, r5, 0x0, 0x200000) mbind(&(0x7f00005b4000/0x4000)=nil, 0x4000, 0x1, 0x0, 0x100000000000041, 0x2) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r6 = fcntl$getown(0xffffffffffffffff, 0x9) sched_getattr(r6, &(0x7f0000000680)={0x38}, 0x38, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0xff, 0x5, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) r7 = socket(0x15, 0x80005, 0x0) getsockopt(r7, 0x200000000114, 0x2721, 0x0, &(0x7f0000000000)) 1.975475064s ago: executing program 7 (id=3585): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80000, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f00000000c0)={@dev={0xfe, 0x80, '\x00', 0x1}, 0x800, 0x2, 0x2, 0x7}, 0x20) setsockopt$inet6_int(r2, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f00000005c0)=ANY=[@ANYBLOB="36fb484fdaa47a550c0e40935ce451d811247f028deb7ee9433db5c46a2130809f334c483c6622de45f1fdf63a3688406c4bcf23f5c78b4daf89ad939b4da315f0f07843fb94438eaf808d3d0c2f43327b0f2a74d84d2030cc24c0391715a7e854ba86144ae72f8143c8a49fe0ec7eec5ab29bfbb34dfb3283c84fc8719ea5570ae7d44af67e66f8525d75a8d027201ddbc0aec48574e332c697fbb934d9bb1d1f07b9f572"], 0x8) sendmmsg(r2, &(0x7f00000002c0)=[{{&(0x7f0000000340)=@l2tp6={0xa, 0x500, 0x80000, @dev, 0x0, 0x1}, 0x80, 0x0}, 0x5b4}], 0x1, 0x850) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newlink={0x48, 0x10, 0x401, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x2083, 0x40446}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x40050}, 0x880) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x54, 0x0, &(0x7f0000000e00)=[@acquire, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_handle={0x77682a85, 0x0, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x22}, @fd={0x66642a85, 0x0, r5}}, &(0x7f0000000bc0)={0x0, 0x18, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) ppoll(&(0x7f0000000140)=[{r5, 0x2100}, {r6, 0x8610}], 0x2, 0x0, 0x0, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000ec0), 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x1000000000000, &(0x7f0000000340)="cb"}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) io_setup(0x207, &(0x7f00000004c0)) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000480)) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000500)={0x8f7f}, 0x4) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) mq_open(0x0, 0x40, 0x12c, &(0x7f0000000180)={0x8001, 0xfffffffffffffffd, 0x1ff}) socket$inet_sctp(0x2, 0x5, 0x84) 1.960756535s ago: executing program 2 (id=3586): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x10c4, 0xea90, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket(0x2b, 0x80801, 0x1) connect$inet6(r1, &(0x7f0000002640)={0xa, 0x4e23, 0x3ff, @empty, 0x3}, 0x1c) setsockopt$MISDN_TIME_STAMP(r1, 0x29, 0x1, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)={0x0, 0x0, 0x8, {0x8, 0x0, "392cdaab4a73"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x20, 0x1, 0x3, "c282fe"}, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000540)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="20010e"], 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$I2C_SMBUS(r2, 0x720, &(0x7f00000001c0)={0x0, 0xb2, 0x1, 0x0}) 851.067611ms ago: executing program 5 (id=3587): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000c00)=@newtfilter={0x104, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_flow={{0x9}, {0xd4, 0x2, [@TCA_FLOW_ACT={0xa8, 0x9, 0x0, 0x1, [@m_skbmod={0xa4, 0x18, 0x0, 0x0, {{0xb}, {0x10, 0x2, 0x0, 0x1, [@TCA_SKBMOD_SMAC={0xa, 0x4, @remote}]}, {0x6c, 0x6, "366fa6797bf61d897aa538962cdb8559497f713dc34963d4db64db45afc5a2fe7fcd9207e63257da6c8f05038712d11ab541b069d0b244a4d5da475327a3d24545d5d3a9ac6bdba63c172584ad92306833c25456eca0a78519ac81b9352745b12de667610bee1c2b"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}, @TCA_FLOW_BASECLASS={0x8, 0x3, {0xe, 0x3}}, @TCA_FLOW_MASK={0x8, 0x6, 0xfffffffa}, @TCA_FLOW_ADDEND={0x8}, @TCA_FLOW_XOR={0x8, 0x7, 0x4}, @TCA_FLOW_MASK={0x8, 0x6, 0x6}]}}]}, 0x104}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) 691.424344ms ago: executing program 4 (id=3588): syz_emit_ethernet(0xbd, &(0x7f0000000080)={@random="858993463aea", @local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "f01b00", 0x87, 0x2f, 0x0, @private0, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558, 0x0, 0x892f}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [], "9cf398003b63fa6bd02fdc51ad586e9ea925c07491e22b69d78cee44ce1d7c4c28e19b8f92053bd25a05f4910de2847d72f60ff058a3a4ae366894d8a2451e86705054"}, {0xa888}}}}}}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) openat$kvm(0xffffffffffffff9c, 0x0, 0x2ecc1, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) fspick(0xffffffffffffffff, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) (async) socket$netlink(0x10, 0x3, 0xa) (async) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e24, 0x2, @ipv4={'\x00', '\xff\xff', @remote}, 0x1}}}, 0x84) (async) r3 = open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x80141, 0x0) ftruncate(r3, 0x200004) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6064cdd800100000fe0000000000007bae020000c0bd0000000000000000060000000000000000001f00c204"], 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x21, &(0x7f00000005c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r5, 0xfca804a0, 0x7, 0x8, &(0x7f00000002c0)="b8000005000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) (async) ioctl$BLKRAGET(r3, 0x1263, &(0x7f0000000180)) r6 = socket$inet6(0xa, 0x80802, 0x0) sendmmsg$inet6(r6, &(0x7f0000007240)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0x6, @mcast2, 0x7}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)="1ce02c7a", 0xfe60}], 0x1}}, {{0x0, 0x0, &(0x7f0000000000), 0x1}}], 0x3, 0x1c000) (async) ppoll(&(0x7f0000000140)=[{r6, 0x5}], 0x1, 0x0, 0x0, 0x0) (async) shutdown(r6, 0x0) (async) write$apparmor_exec(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000000000000"], 0x8) sendfile(0xffffffffffffffff, r3, 0x0, 0x80001d00c0d1) 644.38137ms ago: executing program 5 (id=3589): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000740)=ANY=[@ANYBLOB="b70700000000000063915f00030000000700000000000000950000000000000029e95a8405d38b835d9888a3759a55164df5a7a367b976dfcd0a7012d97e176b8b35783d87b0f395a576930c3576e3cf480aa5c753844346200cba0f4a14b659543e56fc36503a7a0c58f0d2a407d4f71dfd1bfcda539b01e1b93890eceb325b8bad002f67ea3a4cfd4dad3d8080613581deba392041a2e3a12b152190fe813d499c"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xb579, &(0x7f000000cf3d)=""/195}, 0x23) 406.655853ms ago: executing program 5 (id=3590): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000fff500000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff0000000002000000090001"], 0x7c}}, 0x0) 406.415183ms ago: executing program 4 (id=3591): openat$kvm(0xffffffffffffff9c, 0x0, 0x1, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xb4, 0x19, 0xfd3649826d894c67, 0x400000, 0x0, {{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0xffffffffffbffffc}, {0x0, 0xacb0, 0x400000000}, 0x402, 0x0, 0x0, 0x1}}, 0xb4}}, 0x4c050) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x89, 0x0, 0x0, 0x89, 0x0, @dev, @local}, "5613e798"}}}}, 0x0) 235.829517ms ago: executing program 5 (id=3592): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYRES16=r0, @ANYRESHEX=r0], 0x14}, 0x1, 0x0, 0x0, 0x20008041}, 0x24040840) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000e80)=@gcm_256={{0x303, 0x36}, "437e509e2d2800", "8b3de2aabceef2a0640000d5a66fd32f419e59f3000000000400", "7d939a3c"}, 0x38) 221.315565ms ago: executing program 4 (id=3593): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x59) socket$inet6_udplite(0xa, 0x2, 0x88) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000080)={0x10000, 0x80000000}) ioctl$KVM_CAP_X86_GUEST_MODE(0xffffffffffffffff, 0x4068aea3, &(0x7f00000006c0)) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) preadv(r0, &(0x7f0000001200)=[{&(0x7f0000000dc0)=""/72, 0x48}, {0x0}], 0x2, 0x40, 0x3) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r2 = dup(r1) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r4, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @empty}, 0x10) getsockopt$inet_int(r3, 0x0, 0x13, 0x0, &(0x7f0000000c00)=0xfffffffffffffe87) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) 511.26µs ago: executing program 7 (id=3594): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0xa0042, 0x0) ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, &(0x7f0000000100)={0x1, 0x0, [{0x486, 0x0, 0x7}]}) r1 = syz_open_dev$vbi(&(0x7f0000000880), 0x0, 0x2) ioctl$VIDIOC_G_CTRL(r1, 0xc008561b, &(0x7f0000000100)={0x98f905, 0xb335}) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x60, 0xdd, 0x99, 0x20, 0x5e9, 0x9, 0x73db, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb6, 0x7, 0x0, 0x9, 0xbd, 0x2e}}]}}]}}, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x79, 0x10, 0xa8}, [@ldst={0x7}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) syz_usb_control_io(r2, 0x0, &(0x7f0000000900)={0x44, &(0x7f00000003c0)={0x0, 0x17}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0xa0042, 0x0) (async) ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, &(0x7f0000000100)={0x1, 0x0, [{0x486, 0x0, 0x7}]}) (async) syz_open_dev$vbi(&(0x7f0000000880), 0x0, 0x2) (async) ioctl$VIDIOC_G_CTRL(r1, 0xc008561b, &(0x7f0000000100)={0x98f905, 0xb335}) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x60, 0xdd, 0x99, 0x20, 0x5e9, 0x9, 0x73db, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb6, 0x7, 0x0, 0x9, 0xbd, 0x2e}}]}}]}}, 0x0) (async) syz_usb_control_io$uac1(r2, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x79, 0x10, 0xa8}, [@ldst={0x7}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) (async) syz_usb_control_io(r2, 0x0, &(0x7f0000000900)={0x44, &(0x7f00000003c0)={0x0, 0x17}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r2, 0x0, 0x0) (async) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) (async) syz_usb_control_io(r2, 0x0, 0x0) (async) 0s ago: executing program 5 (id=3595): r0 = socket(0x2, 0x80805, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x4, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x113c}, 0x1, 0x0, 0x0, 0x48000}, 0x400c004) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r4 = openat$sequencer2(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r4, 0x40085112, &(0x7f0000000000)=@t={0x4, 0x8, 0x1, 0x2}) write$RDMA_USER_CM_CMD_CREATE_ID(r3, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000480)={0x3, 0x40, 0xfa00, {{0xa, 0xfffc, 0x0, @dev={0xfe, 0x80, '\x00', 0x11}, 0x5}, {0xa, 0x0, 0x0, @loopback}}}, 0x48) pread64(0xffffffffffffffff, 0x0, 0x0, 0x20000000000040) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r5, r5, 0x0, 0x200000) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r6 = fcntl$getown(r0, 0x9) sched_getattr(r6, &(0x7f0000000140)={0x38}, 0xffffffa1, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0xff, 0x5, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) r7 = socket(0xa, 0xa, 0x20000) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x9c, 0x0, 0x2, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x8, 0x9}}}}, [@NL80211_ATTR_SSID={0x5, 0x34, @random="85"}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x3}, @NL80211_ATTR_PMKID={0x14, 0x55, "911a8ae1cd5d67c5699fd990d4075e1a"}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x44}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x1a}, @NL80211_ATTR_PMKID={0x14, 0x55, "aecdf0a11433f36f7a1917391e1e98b6"}, @NL80211_ATTR_BSSID={0xa}, @NL80211_ATTR_PMKID={0x14, 0x55, "cfb839de7e93e7f12bae48da5dffbb30"}, @NL80211_ATTR_PMKID={0x14, 0x55, "00d34f62ff5042c9b2285b55841cccdf"}]}, 0x9c}, 0x1, 0x0, 0x0, 0x24004800}, 0x24000001) getsockopt(r7, 0x200000000114, 0x2721, 0x0, &(0x7f0000000000)) kernel console output (not intermixed with test programs): number 43 using dummy_hcd [ 658.033062][ T5846] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 658.104933][ T5919] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 658.120509][ T5919] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 658.134099][ T5919] usb 6-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 658.143526][ T5919] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 658.169017][ T5919] usb 6-1: config 0 descriptor?? [ 658.201121][ T5846] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 658.219036][ T5846] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 658.362047][ T5846] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 658.394901][ T5846] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 658.412770][ T5846] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 658.433702][ T5846] usb 3-1: Product: syz [ 658.443029][ T5846] usb 3-1: Manufacturer: syz [ 658.452826][ T5846] usb 3-1: SerialNumber: syz [ 658.467653][ T5846] usb 3-1: config 0 descriptor?? [ 658.478684][T15831] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 658.486456][T15831] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 658.497745][ T5846] usb 3-1: ucan: probing device on interface #0 [ 658.599865][ T5919] cp2112 0003:10C4:EA90.0027: unknown main item tag 0x0 [ 658.618860][ T5919] cp2112 0003:10C4:EA90.0027: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.5-1/input0 [ 658.704088][T15839] binder: BINDER_SET_CONTEXT_MGR already set [ 658.710093][T15839] binder: 15830:15839 ioctl 4018620d 80002540 returned -16 [ 658.755525][ T5846] usb 3-1: ucan: could not read protocol version, ret=0 [ 658.762491][ T5846] usb 3-1: ucan: probe failed; try to update the device firmware [ 658.794159][ T5919] cp2112 0003:10C4:EA90.0027: Part Number: 0x82 Device Version: 0xFE [ 659.355671][T15847] SET target dimension over the limit! [ 659.400589][ T5919] cp2112 0003:10C4:EA90.0027: error reading lock byte: -32 [ 659.414585][T15849] syz_tun: entered allmulticast mode [ 659.420061][T15829] cp2112 0003:10C4:EA90.0027: Error starting transaction: -38 [ 659.434408][T15848] syz_tun: left allmulticast mode [ 659.454696][ T5914] usb 6-1: USB disconnect, device number 43 [ 659.540810][T15851] syz_tun: entered allmulticast mode [ 659.553579][T15850] syz_tun: left allmulticast mode [ 659.663234][T15857] netlink: 'syz.4.2824': attribute type 10 has an invalid length. [ 659.671210][T15857] netlink: 2 bytes leftover after parsing attributes in process `syz.4.2824'. [ 659.682550][T15857] 8021q: adding VLAN 0 to HW filter on device team0 [ 659.760007][T15861] x_tables: duplicate underflow at hook 2 [ 660.742898][ T5913] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 660.813015][ T5846] usb 3-1: USB disconnect, device number 63 [ 660.912811][ T5913] usb 5-1: Using ep0 maxpacket: 8 [ 660.936682][ T5913] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 660.978200][ T5913] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1023 [ 661.002897][ T5913] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 16 [ 661.025349][ T5913] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 661.062661][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 661.072413][ T5913] usb 5-1: Product:   [ 661.072434][ T5913] usb 5-1: Manufacturer: 倊 [ 661.072450][ T5913] usb 5-1: SerialNumber: 㰁 [ 661.086670][T15874] loop5: detected capacity change from 0 to 7 [ 661.089556][T15874] loop5: [ 661.122941][T15874] loop5: partition table partially beyond EOD, truncated [ 661.165205][T15877] vlan3: entered promiscuous mode [ 661.278286][T15864] loop8: detected capacity change from 0 to 8 [ 661.289828][T15864] Dev loop8: unable to read RDB block 8 [ 661.298520][T15864] loop8: unable to read partition table [ 661.330586][T15864] loop8: partition table beyond EOD, truncated [ 661.350076][T15864] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 661.374932][T15864] binder: 15863:15864 ioctl c0306201 80000a00 returned -14 [ 661.415333][ T5913] cdc_ncm 5-1:1.0: bind() failure [ 661.433818][ T5913] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 661.448560][ T5913] cdc_ncm 5-1:1.1: bind() failure [ 661.475288][ T5913] usb 5-1: USB disconnect, device number 73 [ 662.732871][ T5913] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 662.917719][ T5913] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 663.225043][ T5913] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 663.287102][ T5913] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 663.305253][T15909] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2841'. [ 663.322942][ T5913] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 663.353525][ T5913] usb 6-1: SerialNumber: syz [ 663.500876][T15911] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2842'. [ 663.642391][ T5913] usb 6-1: USB disconnect, device number 44 [ 663.663442][T15915] hfs: unable to load iocharset "I#hIars8Ύ wѷ}+[S_. ,s$nFBlbSR,.R]^kRL/J}&o9b6\wm$xCdeOjocڅ`1҆m#CX^ݾO;;󣫭Xp!+ƇK=A a2HKA rp" [ 663.750688][ T5822] udevd[5822]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 663.763008][T15921] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 663.891849][T15929] loop2: detected capacity change from 0 to 7 [ 663.900557][T15929] Dev loop2: unable to read RDB block 7 [ 663.906928][T15929] loop2: unable to read partition table [ 663.914544][T15929] loop2: partition table beyond EOD, truncated [ 663.920751][T15929] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 664.262283][T15945] netlink: 188 bytes leftover after parsing attributes in process `syz.3.2856'. [ 664.272091][T15945] netlink: 188 bytes leftover after parsing attributes in process `syz.3.2856'. [ 665.136707][T15961] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2860'. [ 665.207757][T15961] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2860'. [ 665.412243][T15961] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2860'. [ 665.815511][T15968] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 665.848455][T15970] loop3: detected capacity change from 0 to 7 [ 665.883915][T15970] Dev loop3: unable to read RDB block 7 [ 665.894816][T15972] veth4: entered promiscuous mode [ 665.902846][T15970] loop3: AHDI p1 p2 [ 665.910109][T15972] veth4: entered allmulticast mode [ 665.915488][T15970] loop3: partition table partially beyond EOD, truncated [ 665.927321][T15970] loop3: p1 start 1702000233 is beyond EOD, truncated [ 666.855718][T15994] netlink: 'syz.2.2871': attribute type 1 has an invalid length. [ 666.865513][T15994] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2871'. [ 667.396777][T16007] loop2: detected capacity change from 0 to 7 [ 667.408222][ T5845] loop2: [ 667.411181][ T5845] loop2: partition table partially beyond EOD, truncated [ 667.449536][T16007] loop2: [ 667.452561][T16007] loop2: partition table partially beyond EOD, truncated [ 667.713642][ T5199] loop2: [ 667.716770][ T5199] loop2: partition table partially beyond EOD, truncated [ 667.842783][ T7054] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 668.034560][ T7054] usb 3-1: config 1 has an invalid interface number: 121 but max is 0 [ 668.059251][T16015] netlink: 820 bytes leftover after parsing attributes in process `syz.4.2877'. [ 668.068673][ T7054] usb 3-1: config 1 has an invalid descriptor of length 107, skipping remainder of the config [ 668.100554][ T7054] usb 3-1: config 1 has no interface number 0 [ 668.149339][ T7054] usb 3-1: config 1 interface 121 has no altsetting 0 [ 668.165838][T16018] veth2: entered promiscuous mode [ 668.171155][T16018] veth2: entered allmulticast mode [ 668.177725][ T7054] usb 3-1: New USB device found, idVendor=0421, idProduct=01f5, bcdDevice=57.da [ 668.187088][ T7054] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 668.211757][ T7054] usb 3-1: Manufacturer: syz [ 668.250373][ T7054] usb 3-1: bad CDC descriptors [ 668.442532][ T5919] usb 3-1: USB disconnect, device number 64 [ 668.863215][ T5919] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 668.871383][ T5833] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 668.880014][ T5833] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 668.888009][ T5833] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 668.901640][ T5833] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 668.914052][ T5833] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 668.924798][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 668.932093][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 668.939520][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 668.948976][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 668.951393][T16028] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2881'. [ 668.956575][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 669.072753][ T5919] usb 4-1: Using ep0 maxpacket: 8 [ 669.079902][ T5919] usb 4-1: unable to get BOS descriptor or descriptor too short [ 669.093122][ T5919] usb 4-1: config 1 interface 0 altsetting 8 bulk endpoint 0x1 has invalid maxpacket 64 [ 669.111683][ T5919] usb 4-1: config 1 interface 0 altsetting 8 bulk endpoint 0x82 has invalid maxpacket 8 [ 669.121881][ T5919] usb 4-1: config 1 interface 0 has no altsetting 0 [ 669.162591][ T5919] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 669.179427][ T5919] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 669.201244][ T5919] usb 4-1: Product: syz [ 669.210956][ T5919] usb 4-1: Manufacturer: syz [ 669.221904][ T5919] usb 4-1: SerialNumber: syz [ 669.241076][T16022] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 669.249300][T16022] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 669.509655][T16042] netlink: 'syz.2.2883': attribute type 10 has an invalid length. [ 669.544676][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 669.544693][ T30] audit: type=1326 audit(1767785930.594:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16021 comm="syz.3.2880" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 669.642947][ T30] audit: type=1326 audit(1767785930.624:406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16021 comm="syz.3.2880" exe="/root/syz-executor" sig=0 arch=40000003 syscall=296 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 669.675574][ T30] audit: type=1326 audit(1767785930.624:407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16021 comm="syz.3.2880" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 669.723176][ T5919] usblp 4-1:1.0: usblp0: USB Bidirectional printer dev 74 if 0 alt 8 proto 2 vid 0x0525 pid 0xA4A8 [ 669.778287][ T5919] usb 4-1: USB disconnect, device number 74 [ 669.787709][ T30] audit: type=1326 audit(1767785930.624:408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16021 comm="syz.3.2880" exe="/root/syz-executor" sig=0 arch=40000003 syscall=296 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 669.811241][ T5919] usblp0: removed [ 669.898809][ T1137] netdevsim netdevsim4 netdevsim0 (unregistering): left promiscuous mode [ 670.011067][ T30] audit: type=1326 audit(1767785930.644:409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16021 comm="syz.3.2880" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 670.061421][ T30] audit: type=1326 audit(1767785930.644:410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16021 comm="syz.3.2880" exe="/root/syz-executor" sig=0 arch=40000003 syscall=353 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 670.165598][ T1137] team0: Port device netdevsim0 removed [ 670.220177][ T30] audit: type=1326 audit(1767785930.644:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16021 comm="syz.3.2880" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 670.387570][ T30] audit: type=1326 audit(1767785930.654:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16021 comm="syz.3.2880" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 670.504462][ T30] audit: type=1326 audit(1767785930.654:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16021 comm="syz.3.2880" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 670.707715][ T30] audit: type=1326 audit(1767785930.654:414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16021 comm="syz.3.2880" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 670.816348][T16029] chnl_net:caif_netlink_parms(): no params data found [ 670.832848][ T7054] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 670.995584][ T7054] usb 6-1: Using ep0 maxpacket: 8 [ 671.000963][ T5833] Bluetooth: hci2: command tx timeout [ 671.010609][ T7054] usb 6-1: unable to get BOS descriptor or descriptor too short [ 671.049334][ T7054] usb 6-1: config index 0 descriptor too short (expected 9, got 0) [ 671.064533][ T7054] usb 6-1: can't read configurations, error -22 [ 671.202854][ T7054] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 671.392447][T16073] sctp: [Deprecated]: syz.2.2889 (pid 16073) Use of int in maxseg socket option. [ 671.392447][T16073] Use struct sctp_assoc_value instead [ 671.407129][ T7054] usb 6-1: Using ep0 maxpacket: 8 [ 671.476722][ T7054] usb 6-1: unable to get BOS descriptor or descriptor too short [ 671.499051][ T7054] usb 6-1: config index 0 descriptor too short (expected 9, got 0) [ 671.522778][ T7054] usb 6-1: can't read configurations, error -22 [ 671.549157][ T7054] usb usb6-port1: attempt power cycle [ 671.685969][T16029] bridge0: port 1(bridge_slave_0) entered blocking state [ 671.693765][T16029] bridge0: port 1(bridge_slave_0) entered disabled state [ 671.702171][T16029] bridge_slave_0: entered allmulticast mode [ 671.710951][T16029] bridge_slave_0: entered promiscuous mode [ 671.734315][ T1137] bridge_slave_1: left allmulticast mode [ 671.739953][ T1137] bridge_slave_1: left promiscuous mode [ 671.842204][ T1137] bridge0: port 2(bridge_slave_1) entered disabled state [ 671.902768][ T7054] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 671.983542][ T7054] usb 6-1: Using ep0 maxpacket: 8 [ 671.983929][ T1137] bridge_slave_0: left allmulticast mode [ 671.994880][ T7054] usb 6-1: unable to get BOS descriptor or descriptor too short [ 671.998565][ T1137] bridge0: port 1(bridge_slave_0) entered disabled state [ 672.020355][ T7054] usb 6-1: config index 0 descriptor too short (expected 9, got 0) [ 672.061470][ T7054] usb 6-1: can't read configurations, error -22 [ 672.282775][ T7054] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 672.315123][ T7054] usb 6-1: Using ep0 maxpacket: 8 [ 672.322319][ T7054] usb 6-1: unable to get BOS descriptor or descriptor too short [ 672.331758][ T1137] bond1 (unregistering): (slave ip6gre1): Releasing backup interface [ 672.347334][ T7054] usb 6-1: config index 0 descriptor too short (expected 9, got 0) [ 672.356252][ T7054] usb 6-1: can't read configurations, error -22 [ 672.373147][ T7054] usb usb6-port1: unable to enumerate USB device [ 672.570790][ T1137] batman_adv: batadv0: Removing interface: gretap1 [ 672.590580][ T1137] bond3 (unregistering): (slave gretap2): Releasing active interface [ 672.821106][ T1137] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 672.831189][ T1137] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 672.841238][ T1137] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 672.849887][ T1137] bond0 (unregistering): Released all slaves [ 672.862457][ T1137] bond1 (unregistering): Released all slaves [ 672.874771][ T1137] bond2 (unregistering): Released all slaves [ 672.887804][ T1137] bond3 (unregistering): Released all slaves [ 672.909479][T16029] bridge0: port 2(bridge_slave_1) entered blocking state [ 672.922115][T16029] bridge0: port 2(bridge_slave_1) entered disabled state [ 672.929615][T16029] bridge_slave_1: entered allmulticast mode [ 672.939334][T16029] bridge_slave_1: entered promiscuous mode [ 673.037619][ T1137] : left promiscuous mode [ 673.063224][ T5833] Bluetooth: hci2: command tx timeout [ 673.190480][T16029] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 673.219392][ T1137] tipc: Disabling bearer [ 673.237895][ T1137] tipc: Left network mode [ 673.247953][T16029] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 673.458594][T16112] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 673.505372][T16112] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 673.517030][T16115] netlink: 'syz.2.2898': attribute type 10 has an invalid length. [ 673.522212][T16029] team0: Port device team_slave_0 added [ 673.557777][T16115] netlink: 2 bytes leftover after parsing attributes in process `syz.2.2898'. [ 673.590865][T16029] team0: Port device team_slave_1 added [ 673.692945][ T7054] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 673.873558][ T7054] usb 4-1: Using ep0 maxpacket: 32 [ 674.055008][ T7054] usb 4-1: device descriptor read/all, error -71 [ 674.103546][T16128] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2901'. [ 674.553777][T16029] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 674.563915][T16029] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 674.593420][T16125] netlink: 'syz.5.2899': attribute type 10 has an invalid length. [ 675.099787][T16029] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 675.126397][T16029] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 675.146864][ T5833] Bluetooth: hci2: command tx timeout [ 675.207275][T16029] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 675.233857][T16029] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 675.476309][ T1137] hsr_slave_0: left promiscuous mode [ 675.485198][ T1137] hsr_slave_1: left promiscuous mode [ 675.510066][ T1137] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 675.526284][T16154] netlink: 212348 bytes leftover after parsing attributes in process `syz.7.2905'. [ 675.542050][ T1137] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 675.612931][ T5846] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 675.884323][ T5846] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 675.900211][ T5846] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 675.926596][ T5846] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 675.944233][ T5846] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 675.972910][T16164] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2907'. [ 675.993516][ T5846] usb 4-1: config 0 descriptor?? [ 675.999698][T16165] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2907'. [ 676.093610][T16164] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2907'. [ 676.103681][T16164] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2907'. [ 676.440453][ T5846] cp2112 0003:10C4:EA90.0028: unknown main item tag 0x0 [ 676.577011][ T5846] cp2112 0003:10C4:EA90.0028: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 676.850824][ T5846] cp2112 0003:10C4:EA90.0028: Part Number: 0x82 Device Version: 0xFE [ 677.134284][ T1137] team_slave_1 (unregistering): left promiscuous mode [ 677.147816][ T1137] team0 (unregistering): Port device team_slave_1 removed [ 677.223769][ T5833] Bluetooth: hci2: command tx timeout [ 677.224705][ T1137] team_slave_0 (unregistering): left promiscuous mode [ 677.238847][T16176] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 677.269319][ T1137] team0 (unregistering): Port device team_slave_0 removed [ 677.460793][ T5846] cp2112 0003:10C4:EA90.0028: error reading lock byte: -32 [ 677.469179][T16152] cp2112 0003:10C4:EA90.0028: Error starting transaction: -38 [ 677.499615][ T5846] usb 4-1: USB disconnect, device number 77 [ 677.650525][T16178] tipc: Enabled bearer , priority 10 [ 677.744425][T16029] hsr_slave_0: entered promiscuous mode [ 677.751350][T16029] hsr_slave_1: entered promiscuous mode [ 677.962115][ T1137] IPVS: stop unused estimator thread 0... [ 677.989269][ T5846] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 678.184786][ T5846] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 678.202862][ T5846] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 678.222877][ T5846] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 678.251118][ T5846] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 678.291877][ T5846] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 678.443156][ T5846] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 678.443624][T16197] netlink: 14 bytes leftover after parsing attributes in process `syz.5.2916'. [ 678.476946][ T5846] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 678.485436][ T5846] usb 3-1: Product: syz [ 678.489580][ T5846] usb 3-1: Manufacturer: syz [ 678.507096][ T5846] cdc_wdm 3-1:1.0: skipping garbage [ 678.512308][ T5846] cdc_wdm 3-1:1.0: skipping garbage [ 678.520361][ T5846] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 678.534291][ T5846] cdc_wdm 3-1:1.0: Unknown control protocol [ 679.030997][T16181] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2913'. [ 679.117030][ T7054] usb 3-1: USB disconnect, device number 65 [ 679.541624][T16029] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 679.576669][T16029] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 679.606615][T16029] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 679.629439][T16029] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 680.038013][T16216] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 680.152875][ C1] syz_tun: tun_net_xmit 58 [ 680.210408][T16220] syz_tun (unregistering): left allmulticast mode [ 680.227539][T16220] syz_tun (unregistering): left promiscuous mode [ 680.241969][T16220] bridge0: port 3(syz_tun) entered disabled state [ 680.480706][T16029] 8021q: adding VLAN 0 to HW filter on device bond0 [ 680.575356][T16029] 8021q: adding VLAN 0 to HW filter on device team0 [ 680.608483][ T3971] bridge0: port 1(bridge_slave_0) entered blocking state [ 680.615691][ T3971] bridge0: port 1(bridge_slave_0) entered forwarding state [ 680.648660][ T1137] bridge0: port 2(bridge_slave_1) entered blocking state [ 680.655827][ T1137] bridge0: port 2(bridge_slave_1) entered forwarding state [ 680.880628][T16029] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 681.171860][T16029] veth0_vlan: entered promiscuous mode [ 681.277648][T16249] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2925'. [ 681.287148][T16029] veth1_vlan: entered promiscuous mode [ 681.459824][T16029] veth0_macvtap: entered promiscuous mode [ 681.495222][T16029] veth1_macvtap: entered promiscuous mode [ 681.603341][T16029] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 681.681071][T16029] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 682.020329][ T60] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 682.076217][ T60] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 682.098832][ T60] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 682.154376][ T60] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 682.440146][T16271] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2931'. [ 682.500920][T16271] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2931'. [ 682.773979][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 682.798189][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 682.863798][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 682.968869][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 683.430522][T16292] input: syz0 as /devices/virtual/input/input53 [ 685.004912][T16316] xt_cgroup: invalid path, errno=-2 [ 685.014904][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 685.027328][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 685.036173][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 685.053135][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 685.073467][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 685.359313][ T7054] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 685.402390][ T6006] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 685.463491][ T6006] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.541755][ T7054] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 685.594022][ T7054] usb 4-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 685.615098][T16331] sctp: [Deprecated]: syz.4.2944 (pid 16331) Use of int in maxseg socket option. [ 685.615098][T16331] Use struct sctp_assoc_value instead [ 685.634597][ T7054] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 685.664532][ T7054] usb 4-1: config 0 descriptor?? [ 685.735302][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.741688][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.950253][ T6006] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 685.980781][ T6006] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 686.094264][ T6006] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 686.107307][ T6006] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 686.795504][ T6006] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 686.800225][ T7054] petalynx 0003:18B1:0037.0029: unknown main item tag 0x5 [ 686.806568][ T6006] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 686.892749][ T7054] petalynx 0003:18B1:0037.0029: unknown global tag 0xd [ 686.956319][ T7054] petalynx 0003:18B1:0037.0029: item 0 2 1 13 parsing failed [ 686.980500][ T7054] petalynx 0003:18B1:0037.0029: parse failed [ 687.007544][ T7054] petalynx 0003:18B1:0037.0029: probe with driver petalynx failed with error -22 [ 687.044608][T16350] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 687.096913][T16350] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 687.145111][ T51] Bluetooth: hci0: command tx timeout [ 687.347077][T16359] xt_connbytes: Forcing CT accounting to be enabled [ 687.502057][ T6006] bridge_slave_1: left allmulticast mode [ 687.592909][ T6006] bridge_slave_1: left promiscuous mode [ 687.610986][ T6006] bridge0: port 2(bridge_slave_1) entered disabled state [ 687.918183][ T6006] bridge_slave_0: left allmulticast mode [ 687.924043][ T6006] bridge_slave_0: left promiscuous mode [ 687.929915][ T6006] bridge0: port 1(bridge_slave_0) entered disabled state [ 688.022832][ T5913] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 688.145879][ T6006] batman_adv: batadv0: Interface deactivated: gretap1 [ 688.206194][ T5913] usb 6-1: Using ep0 maxpacket: 32 [ 688.245848][ T5913] usb 6-1: config 0 has an invalid descriptor of length 30, skipping remainder of the config [ 688.265198][ T5913] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 688.288724][ T5913] usb 6-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice=72.1d [ 688.324334][ T5913] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 688.652846][ T5913] usb 6-1: Product: syz [ 688.659809][ T5913] usb 6-1: Manufacturer: syz [ 688.671893][ T5913] usb 6-1: SerialNumber: syz [ 688.928102][ T5913] usb 6-1: config 0 descriptor?? [ 688.948062][ T6006] bond1 (unregistering): (slave ip6gre1): Releasing backup interface [ 689.225162][ T51] Bluetooth: hci0: command tx timeout [ 689.281759][ T5914] usb 4-1: USB disconnect, device number 78 [ 690.487268][ T5913] usb 6-1: USB disconnect, device number 49 [ 690.675257][ T6006] batman_adv: batadv0: Removing interface: gretap1 [ 691.325412][ T51] Bluetooth: hci0: command tx timeout [ 691.814984][ T6006] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 691.883943][ T6006] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 691.899289][ T6006] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 691.912300][ T6006] bond0 (unregistering): Released all slaves [ 692.171589][ T6006] bond1 (unregistering): Released all slaves [ 692.183551][ T6006] bond2 (unregistering): Released all slaves [ 692.202496][ T6006] bond3 (unregistering): Released all slaves [ 692.216309][ T6006] bond4 (unregistering): Released all slaves [ 692.230698][ T6006] bond5 (unregistering): Released all slaves [ 692.909762][ T6006] bond6 (unregistering): Released all slaves [ 692.939909][T16426] netlink: 'syz.3.2961': attribute type 4 has an invalid length. [ 693.039222][T16320] chnl_net:caif_netlink_parms(): no params data found [ 693.140426][ T6006] tipc: Disabling bearer [ 693.159570][ T6006] tipc: Disabling bearer [ 693.172166][ T6006] tipc: Left network mode [ 693.462795][ T51] Bluetooth: hci0: command tx timeout [ 693.682973][T16320] bridge0: port 1(bridge_slave_0) entered blocking state [ 693.706777][T16320] bridge0: port 1(bridge_slave_0) entered disabled state [ 693.733243][T16320] bridge_slave_0: entered allmulticast mode [ 693.760185][T16320] bridge_slave_0: entered promiscuous mode [ 693.801191][T16320] bridge0: port 2(bridge_slave_1) entered blocking state [ 693.840043][T16320] bridge0: port 2(bridge_slave_1) entered disabled state [ 693.866861][T16320] bridge_slave_1: entered allmulticast mode [ 693.906482][T16320] bridge_slave_1: entered promiscuous mode [ 693.970400][T16457] netlink: 'syz.7.2968': attribute type 10 has an invalid length. [ 693.988551][T16457] netlink: 2 bytes leftover after parsing attributes in process `syz.7.2968'. [ 694.086809][T16457] bridge0: port 3(team0) entered blocking state [ 694.095609][T16457] bridge0: port 3(team0) entered disabled state [ 694.102196][T16457] team0: entered allmulticast mode [ 694.111989][T16457] team_slave_0: entered allmulticast mode [ 694.131214][T16457] team_slave_1: entered allmulticast mode [ 694.154970][T16457] bridge0: port 3(team0) entered blocking state [ 694.161347][T16457] bridge0: port 3(team0) entered forwarding state [ 694.470305][T16320] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 694.651585][T16320] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 694.855871][ T6006] hsr_slave_0: left promiscuous mode [ 694.861724][ T6006] hsr_slave_1: left promiscuous mode [ 694.898191][ T6006] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 694.920135][ T6006] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 694.970341][ T6006] veth1_macvtap: left promiscuous mode [ 694.991666][T16477] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2973'. [ 695.001530][ T6006] veth1_vlan: left promiscuous mode [ 695.008001][ T6006] veth0_vlan: left promiscuous mode [ 695.015792][T16477] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2973'. [ 695.063621][T16477] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2973'. [ 695.132589][T16478] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2973'. [ 697.506407][T16509] netlink: 'syz.4.2983': attribute type 1 has an invalid length. [ 697.696509][ T6006] team_slave_1 (unregistering): left promiscuous mode [ 697.815261][ T6006] team0 (unregistering): Port device team_slave_1 removed [ 697.919342][ T6006] team_slave_0 (unregistering): left promiscuous mode [ 697.935055][ T6006] team0 (unregistering): Port device team_slave_0 removed [ 698.108207][ T24] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 698.263630][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 698.273772][ T24] usb 5-1: config 254 has an invalid interface number: 235 but max is 0 [ 698.282566][ T24] usb 5-1: config 254 has no interface number 0 [ 698.289427][ T24] usb 5-1: config 254 interface 235 altsetting 2 bulk endpoint 0x6 has invalid maxpacket 32 [ 698.492269][ T24] usb 5-1: config 254 interface 235 altsetting 2 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 698.505025][ T24] usb 5-1: config 254 interface 235 altsetting 2 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 698.528893][ T24] usb 5-1: config 254 interface 235 altsetting 2 endpoint 0x8F has invalid wMaxPacketSize 0 [ 698.539672][ T24] usb 5-1: config 254 interface 235 has no altsetting 0 [ 698.624945][ T24] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=2b.f1 [ 698.634272][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 698.670030][ T24] usb 5-1: Product: syz [ 698.685835][ T24] usb 5-1: Manufacturer: syz [ 698.690561][ T24] usb 5-1: SerialNumber: syz [ 698.871379][T16516] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 699.257462][T16320] team0: Port device team_slave_0 added [ 699.289621][T16513] gretap1: entered promiscuous mode [ 699.340250][T16320] team0: Port device team_slave_1 added [ 699.369804][ T24] usbtest 5-1:254.235: couldn't get endpoints, -71 [ 699.567397][T16529] netlink: 104 bytes leftover after parsing attributes in process `syz.7.2987'. [ 699.577576][ T24] usbtest 5-1:254.235: probe with driver usbtest failed with error -71 [ 699.678013][ T24] usb 5-1: USB disconnect, device number 74 [ 699.711511][T16320] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 699.726600][T16531] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2988'. [ 699.729686][T16320] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 699.781871][T16320] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 699.801023][T16320] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 699.813129][T16320] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 699.871981][T16533] netlink: 80 bytes leftover after parsing attributes in process `syz.5.2989'. [ 699.896500][T16320] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 699.965309][ T6006] IPVS: stop unused estimator thread 0... [ 700.092404][T16320] hsr_slave_0: entered promiscuous mode [ 700.099602][T16320] hsr_slave_1: entered promiscuous mode [ 700.128452][T16320] debugfs: 'hsr0' already exists in 'hsr' [ 700.140940][T16320] Cannot create hsr debugfs directory [ 700.322749][T16275] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 700.486667][T16275] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 700.516468][T16275] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 700.573712][T16275] usb 6-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 700.630776][T16275] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 700.653243][ T5913] usb 5-1: new full-speed USB device number 75 using dummy_hcd [ 700.688426][T16275] usb 6-1: config 0 descriptor?? [ 700.833848][ T5913] usb 5-1: config 36 has an invalid descriptor of length 0, skipping remainder of the config [ 701.060206][ T5913] usb 5-1: config 36 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 701.107289][ T5913] usb 5-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 701.116685][ T5913] usb 5-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 701.127159][ T5913] usb 5-1: Manufacturer: syz [ 701.145052][ T5913] usb 5-1: SerialNumber: syz [ 701.409395][ T5913] usbhid 5-1:36.0: couldn't find an input interrupt endpoint [ 701.666424][ T5913] usb 5-1: USB disconnect, device number 75 [ 701.907847][T16320] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 701.944411][T16320] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 702.037190][T16320] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 702.110914][T16320] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 702.198724][T16575] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2998'. [ 702.274786][T16575] batadv0: entered promiscuous mode [ 702.281572][T16575] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 702.305382][T16575] batadv0: left promiscuous mode [ 702.331165][T16585] xt_TPROXY: Can be used only with -p tcp or -p udp [ 702.622977][T16320] 8021q: adding VLAN 0 to HW filter on device bond0 [ 702.651211][T16598] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3002'. [ 702.683038][T16598] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3002'. [ 702.696871][T16320] 8021q: adding VLAN 0 to HW filter on device team0 [ 702.727295][T16599] netlink: 'syz.4.3002': attribute type 10 has an invalid length. [ 702.785354][ T3971] bridge0: port 1(bridge_slave_0) entered blocking state [ 702.792525][ T3971] bridge0: port 1(bridge_slave_0) entered forwarding state [ 702.854152][ T3971] bridge0: port 2(bridge_slave_1) entered blocking state [ 702.861341][ T3971] bridge0: port 2(bridge_slave_1) entered forwarding state [ 702.887468][T16599] bridge0: port 2(bridge_slave_1) entered disabled state [ 702.896817][T16599] bridge0: port 1(bridge_slave_0) entered disabled state [ 703.130219][T16275] usbhid 6-1:0.0: can't add hid device: -71 [ 703.151661][T16275] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 703.159404][T16320] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 703.212273][T16275] usb 6-1: USB disconnect, device number 50 [ 703.318824][T16320] veth0_vlan: entered promiscuous mode [ 703.369782][T16320] veth1_vlan: entered promiscuous mode [ 703.468269][T16320] veth0_macvtap: entered promiscuous mode [ 703.527610][T16320] veth1_macvtap: entered promiscuous mode [ 703.779844][T16320] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 703.857998][T16320] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 703.944996][ T6015] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 703.974998][ T6015] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 704.019249][ T6015] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 704.066878][ T6015] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 704.810026][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 704.832860][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 705.043188][T13145] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 705.062185][T13145] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 705.232764][ T5913] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 705.509865][ T5913] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 705.535860][ T5913] usb 5-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 705.561567][ T5913] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 705.699818][ T5913] usb 5-1: config 0 descriptor?? [ 706.727605][T16670] netlink: 14 bytes leftover after parsing attributes in process `syz.7.3017'. [ 706.825762][T16670] hsr0: entered promiscuous mode [ 707.129153][ T5913] petalynx 0003:18B1:0037.002A: unknown main item tag 0x5 [ 707.216952][T16674] netlink: 32 bytes leftover after parsing attributes in process `syz.7.3019'. [ 707.338584][T16672] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 707.432743][ T5913] petalynx 0003:18B1:0037.002A: unknown global tag 0xd [ 707.460244][ T5913] petalynx 0003:18B1:0037.002A: item 0 2 1 13 parsing failed [ 707.474627][T16672] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 707.594999][ T5913] petalynx 0003:18B1:0037.002A: parse failed [ 707.601098][ T5913] petalynx 0003:18B1:0037.002A: probe with driver petalynx failed with error -22 [ 707.834709][ T5833] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 707.844355][ T5833] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 707.852054][ T5833] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 707.859871][ T5833] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 707.868092][ T5833] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 708.833230][ T5913] usb 5-1: USB disconnect, device number 76 [ 708.926346][T16698] netlink: 'syz.4.3027': attribute type 16 has an invalid length. [ 708.965592][ T3971] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 709.174735][T16701] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3028'. [ 709.360903][ T3971] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 709.942764][ T51] Bluetooth: hci3: command tx timeout [ 710.082598][ T3971] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 710.287846][T16717] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3033'. [ 710.289169][ T3971] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 710.309607][T16717] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3033'. [ 710.319520][T16717] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3033'. [ 710.392162][ T5830] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 710.412598][T16687] chnl_net:caif_netlink_parms(): no params data found [ 710.421517][T16718] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3033'. [ 710.583812][ T5830] usb 5-1: device descriptor read/64, error -71 [ 710.852787][ T5830] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 710.989060][T16729] netlink: 'syz.5.3037': attribute type 10 has an invalid length. [ 711.002951][ T5830] usb 5-1: device descriptor read/64, error -71 [ 711.032955][T16729] netlink: 2 bytes leftover after parsing attributes in process `syz.5.3037'. [ 711.044381][T16687] bridge0: port 1(bridge_slave_0) entered blocking state [ 711.051907][T16687] bridge0: port 1(bridge_slave_0) entered disabled state [ 711.062375][T16687] bridge_slave_0: entered allmulticast mode [ 711.079750][T16687] bridge_slave_0: entered promiscuous mode [ 711.094154][T16729] bridge0: port 3(team0) entered blocking state [ 711.104763][T16729] bridge0: port 3(team0) entered disabled state [ 711.111260][T16729] team0: entered allmulticast mode [ 711.116606][T16729] team_slave_0: entered allmulticast mode [ 711.133149][ T5830] usb usb5-port1: attempt power cycle [ 711.148776][T16729] team_slave_1: entered allmulticast mode [ 711.155624][T16729] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 711.407550][ T3971] bond1 (unregistering): (slave ip6gre1): Releasing backup interface [ 711.553236][ T5830] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 711.583468][ T5830] usb 5-1: device descriptor read/8, error -71 [ 711.696531][ T3971] batman_adv: batadv0: Removing interface: gretap1 [ 711.805045][ T3971] bond6 (unregistering): (slave geneve2): Releasing active interface [ 711.813384][ T3971] geneve2 (unregistering): left promiscuous mode [ 711.820076][ T3971] geneve2 (unregistering): left allmulticast mode [ 711.832919][ T5830] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 711.866904][ T5830] usb 5-1: device descriptor read/8, error -71 [ 711.909096][ T3971] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 711.993341][ T5830] usb usb5-port1: unable to enumerate USB device [ 712.029136][ T51] Bluetooth: hci3: command tx timeout [ 712.195925][ T3971] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 712.205822][ T3971] bond0 (unregistering): Released all slaves [ 712.219413][ T3971] bond1 (unregistering): Released all slaves [ 712.231490][ T3971] bond2 (unregistering): Released all slaves [ 712.248799][ T3971] bond3 (unregistering): Released all slaves [ 712.272509][ T3971] bond4 (unregistering): Released all slaves [ 712.465174][ T3971] bond5 (unregistering): Released all slaves [ 712.491506][ T3971] bond6 (unregistering): Released all slaves [ 712.527607][ T3971] bond7 (unregistering): Released all slaves [ 712.573139][T16687] bridge0: port 2(bridge_slave_1) entered blocking state [ 712.586984][T16687] bridge0: port 2(bridge_slave_1) entered disabled state [ 712.606460][T16687] bridge_slave_1: entered allmulticast mode [ 712.614505][T16687] bridge_slave_1: entered promiscuous mode [ 712.836105][ T3971] tipc: Disabling bearer [ 712.843023][ T3971] tipc: Left network mode [ 712.850976][T16687] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 712.900536][T16687] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 712.923235][T16755] tipc: Enabled bearer , priority 10 [ 713.047691][T16760] xt_TPROXY: Can be used only with -p tcp or -p udp [ 713.137077][T16687] team0: Port device team_slave_0 added [ 713.157751][T16687] team0: Port device team_slave_1 added [ 713.343301][T16760] C: renamed from team_slave_0 (while UP) [ 713.364179][T16760] netlink: 'syz.2.3048': attribute type 1 has an invalid length. [ 713.412866][T16760] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3048'. [ 713.425923][T16760] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 713.520913][T16687] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 713.529619][T16687] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 713.573059][T16687] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 713.608388][T16687] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 713.615810][T16687] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 713.672285][T16687] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 713.719021][ T3971] hsr_slave_0: left promiscuous mode [ 713.734207][ T3971] hsr_slave_1: left promiscuous mode [ 714.104289][ T51] Bluetooth: hci3: command tx timeout [ 714.194537][T16789] netlink: 'syz.2.3053': attribute type 10 has an invalid length. [ 716.146095][T16804] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3057'. [ 716.185589][ T51] Bluetooth: hci3: command tx timeout [ 716.535102][T16812] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3061'. [ 716.611252][T16814] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3062'. [ 716.622345][T16814] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3062'. [ 716.723027][ T5914] tipc: Node number set to 91283378 [ 716.785303][T16789] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 716.823135][T16275] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 716.887424][T16822] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3064'. [ 716.971288][T16822] syz_tun: entered promiscuous mode [ 717.000251][T16822] syz_tun: left promiscuous mode [ 717.007863][T16275] usb 5-1: Using ep0 maxpacket: 16 [ 717.022485][T16275] usb 5-1: config 5 has an invalid interface number: 168 but max is 0 [ 717.041586][T16275] usb 5-1: config 5 has no interface number 0 [ 717.065808][T16275] usb 5-1: config 5 interface 168 altsetting 7 bulk endpoint 0x5 has invalid maxpacket 1024 [ 717.091905][T16275] usb 5-1: config 5 interface 168 altsetting 7 endpoint 0x4 has invalid wMaxPacketSize 0 [ 717.105240][T16687] hsr_slave_0: entered promiscuous mode [ 717.115713][T16275] usb 5-1: config 5 interface 168 altsetting 7 bulk endpoint 0x4 has invalid maxpacket 0 [ 717.124733][T16687] hsr_slave_1: entered promiscuous mode [ 717.136510][T16687] debugfs: 'hsr0' already exists in 'hsr' [ 717.136869][T16275] usb 5-1: config 5 interface 168 has no altsetting 0 [ 717.143443][T16687] Cannot create hsr debugfs directory [ 717.191911][T16275] usb 5-1: New USB device found, idVendor=04cc, idProduct=2533, bcdDevice=fc.58 [ 717.224304][T16275] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 717.232342][T16275] usb 5-1: Product: syz [ 717.252933][T16275] usb 5-1: Manufacturer: syz [ 717.333277][T16275] usb 5-1: SerialNumber: syz [ 717.353933][T16812] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 717.455800][ T3971] IPVS: stop unused estimator thread 0... [ 717.881511][T16275] pn533_usb 5-1:5.168: NFC: Could not find bulk-in or bulk-out endpoint [ 718.001492][T16275] usb 5-1: USB disconnect, device number 81 [ 718.663158][T16275] usb 5-1: new full-speed USB device number 82 using dummy_hcd [ 718.857559][T16275] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 718.877594][T16275] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 718.934713][T16275] usb 5-1: config 0 descriptor?? [ 718.968769][T16275] cp210x 5-1:0.0: cp210x converter detected [ 719.155886][T16852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 719.181239][T16852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 719.291451][T16275] usb 5-1: cp210x converter now attached to ttyUSB0 [ 719.442541][T16687] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 719.511796][T16687] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 719.541110][ T5914] usb 5-1: USB disconnect, device number 82 [ 719.559634][T16687] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 719.591760][ T5914] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 719.615671][ T5914] cp210x 5-1:0.0: device disconnected [ 719.616424][T16687] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 719.688565][T16887] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3075'. [ 719.971198][T16903] xt_TCPMSS: Only works on TCP SYN packets [ 720.025808][T16903] usb usb1: usbfs: process 16903 (syz.5.3077) did not claim interface 0 before use [ 720.354253][T16687] 8021q: adding VLAN 0 to HW filter on device bond0 [ 720.422384][T16687] 8021q: adding VLAN 0 to HW filter on device team0 [ 720.453064][ T1137] bridge0: port 1(bridge_slave_0) entered blocking state [ 720.460230][ T1137] bridge0: port 1(bridge_slave_0) entered forwarding state [ 720.470833][ T1137] bridge0: port 2(bridge_slave_1) entered blocking state [ 720.478023][ T1137] bridge0: port 2(bridge_slave_1) entered forwarding state [ 720.519539][T16909] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3079'. [ 720.636188][T16687] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 720.930969][T16687] veth0_vlan: entered promiscuous mode [ 721.024819][T16687] veth1_vlan: entered promiscuous mode [ 721.157167][T16687] veth0_macvtap: entered promiscuous mode [ 721.249540][T16687] veth1_macvtap: entered promiscuous mode [ 721.249776][T16918] loop2: detected capacity change from 0 to 7 [ 721.278554][T16320] loop2: [ 721.281987][T16320] loop2: partition table partially beyond EOD, truncated [ 721.504654][T16918] loop2: [ 721.529759][T16918] loop2: partition table partially beyond EOD, truncated [ 721.579940][T16687] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 721.594252][ T5199] loop2: [ 721.597238][ T5199] loop2: partition table partially beyond EOD, truncated [ 721.657375][T16687] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 721.720269][ T1110] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.750703][ T1110] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.787699][ T1110] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.830671][ T1110] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.840290][ T5913] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 722.025050][ T5913] usb 3-1: Using ep0 maxpacket: 16 [ 722.035213][ T5913] usb 3-1: config index 0 descriptor too short (expected 804, got 36) [ 722.043751][ T1110] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 722.059389][ T1110] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 722.071353][ T5913] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 722.084396][ T5913] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 722.113951][ T5913] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 722.143849][ T5913] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 722.155072][ T5913] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 722.173280][ T5913] usb 3-1: config 0 descriptor?? [ 722.180903][ T3484] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 722.246872][ T3484] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 722.712066][ T5913] mcp2221 0003:04D8:00DD.002B: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 722.774717][T16946] netlink: 820 bytes leftover after parsing attributes in process `syz.7.3087'. [ 722.934367][T16951] loop5: detected capacity change from 0 to 7 [ 723.029340][T16951] Dev loop5: unable to read RDB block 7 [ 723.034997][T16951] loop5: unable to read partition table [ 723.040820][T16951] loop5: partition table beyond EOD, truncated [ 723.051605][T16951] loop_reread_partitions: partition scan of loop5 () failed (rc=-5) [ 723.150448][ T24] usb 3-1: USB disconnect, device number 66 [ 723.342981][T16956] netlink: 14 bytes leftover after parsing attributes in process `syz.3.3090'. [ 723.370685][T16956] hsr0: entered promiscuous mode [ 723.838949][T16977] xt_TCPMSS: Only works on TCP SYN packets [ 724.445197][T16982] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3094'. [ 724.550198][T16982] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3094'. [ 724.670329][T16982] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3094'. [ 725.193765][T16991] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 726.492802][ T5913] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 726.643255][ T5913] usb 3-1: Using ep0 maxpacket: 16 [ 726.797975][ T5913] usb 3-1: config 0 has too many interfaces: 129, using maximum allowed: 32 [ 726.822822][ T5913] usb 3-1: config 0 has an invalid interface number: 137 but max is 128 [ 726.853709][ T5913] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 726.872790][ T5913] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 129 [ 726.917296][ T5913] usb 3-1: config 0 has no interface number 0 [ 726.945034][ T5913] usb 3-1: New USB device found, idVendor=1943, idProduct=2250, bcdDevice= 0.01 [ 726.986656][ T5913] usb 3-1: New USB device strings: Mfr=1, Product=1, SerialNumber=3 [ 727.004829][ T5913] usb 3-1: Product: syz [ 727.011313][ T5913] usb 3-1: Manufacturer: syz [ 727.029327][ T5913] usb 3-1: SerialNumber: syz [ 727.054902][ T5913] usb 3-1: config 0 descriptor?? [ 727.070746][ T5913] go7007 3-1:0.137: Sensoray 2250 found [ 727.080240][ T5913] go7007 3-1:0.137: probe with driver go7007 failed with error -12 [ 727.293536][ T24] usb 3-1: USB disconnect, device number 67 [ 727.621308][T17061] netlink: 'syz.5.3114': attribute type 10 has an invalid length. [ 727.663942][T17061] netlink: 2 bytes leftover after parsing attributes in process `syz.5.3114'. [ 728.004550][ T5913] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 728.245641][ T5913] usb 5-1: config 0 has an invalid interface number: 171 but max is 0 [ 728.282725][ T5913] usb 5-1: config 0 has no interface number 0 [ 728.345930][ T5913] usb 5-1: config 0 interface 171 has no altsetting 0 [ 728.494331][ T5913] usb 5-1: New USB device found, idVendor=10d6, idProduct=2200, bcdDevice= 1.00 [ 728.617277][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.620212][T17076] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.3118'. [ 728.681458][ T5913] usb 5-1: Product: syz [ 728.686096][ T5913] usb 5-1: Manufacturer: syz [ 728.690719][ T5913] usb 5-1: SerialNumber: syz [ 728.705537][ T5913] usb 5-1: config 0 descriptor?? [ 728.716329][ T5913] usb-storage 5-1:0.171: USB Mass Storage device detected [ 728.920986][ T5913] usb 5-1: USB disconnect, device number 83 [ 729.396003][T17085] syz_tun: entered allmulticast mode [ 729.405089][T17083] syz_tun: left allmulticast mode [ 729.427629][T17088] syz_tun: entered promiscuous mode [ 729.435813][T17088] syz_tun: left promiscuous mode [ 729.572057][T17094] tipc: Started in network mode [ 729.577332][T17094] tipc: Node identity ac141414, cluster identity 4711 [ 729.613699][T17094] tipc: Enabled bearer , priority 10 [ 729.645717][T17099] loop5: detected capacity change from 0 to 7 [ 729.681674][T17099] loop5: [ 729.695784][T17099] loop5: partition table partially beyond EOD, truncated [ 729.927778][T17108] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3129'. [ 729.977122][T17109] syz_tun: entered allmulticast mode [ 729.982779][T17110] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3126'. [ 730.028541][T17103] syz_tun: left allmulticast mode [ 730.033962][T17110] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3126'. [ 730.128345][T17110] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3126'. [ 730.233472][T17110] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3126'. [ 730.621622][T17124] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3134'. [ 730.833155][ T5913] tipc: Node number set to 2886997012 [ 731.008165][T17131] syz_tun: entered allmulticast mode [ 731.015886][T17130] syz_tun: left allmulticast mode [ 731.302985][ T5830] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 731.484753][ T5830] usb 5-1: device descriptor read/64, error -71 [ 731.864594][ T5830] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 732.052758][ T5830] usb 5-1: device descriptor read/64, error -71 [ 732.164871][ T5830] usb usb5-port1: attempt power cycle [ 732.212820][ T5913] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 732.372871][ T5913] usb 6-1: Using ep0 maxpacket: 32 [ 732.380187][ T5913] usb 6-1: config index 0 descriptor too short (expected 35577, got 27) [ 732.404596][ T5913] usb 6-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 732.424602][ T5913] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 732.434477][ T5913] usb 6-1: config 1 has no interface number 0 [ 732.443104][ T5913] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 732.455200][ T5913] usb 6-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 732.472805][ T5913] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 732.482041][ T5913] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.512564][T17146] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3141'. [ 732.532750][ T5830] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 732.558185][ T5913] snd_usb_pod 6-1:1.1: Line 6 Pocket POD found [ 732.563754][ T5830] usb 5-1: device descriptor read/8, error -71 [ 732.637636][T17148] tipc: Enabling of bearer rejected, failed to enable media [ 732.692971][T17150] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3143'. [ 732.838593][ T5830] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 732.866851][ T5830] usb 5-1: device descriptor read/8, error -71 [ 732.990586][ T5830] usb usb5-port1: unable to enumerate USB device [ 733.042821][T17163] loop5: detected capacity change from 0 to 7 [ 733.115311][ T9916] Dev loop5: unable to read RDB block 7 [ 733.135358][ T9916] loop5: unable to read partition table [ 733.152182][ T9916] loop5: partition table beyond EOD, truncated [ 733.216590][T17163] Dev loop5: unable to read RDB block 7 [ 733.222376][T17163] loop5: unable to read partition table [ 733.229324][T17163] loop5: partition table beyond EOD, truncated [ 733.242691][T17163] loop_reread_partitions: partition scan of loop5 () failed (rc=-5) [ 733.362864][T16275] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 733.395773][T17169] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3150'. [ 733.492797][T16275] usb 3-1: device descriptor read/64, error -71 [ 733.732853][T16275] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 733.913742][T16275] usb 3-1: device descriptor read/64, error -71 [ 734.023346][T16275] usb usb3-port1: attempt power cycle [ 734.522852][T16275] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 734.550647][T16275] usb 3-1: device descriptor read/8, error -71 [ 734.792919][T16275] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 734.813558][T16275] usb 3-1: device descriptor read/8, error -71 [ 734.923156][T16275] usb usb3-port1: unable to enumerate USB device [ 735.100513][ T5913] snd_usb_pod 6-1:1.1: set_interface failed [ 735.203059][ T5913] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now disconnected [ 735.210306][ T5913] snd_usb_pod 6-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 735.251042][ T5913] usb 6-1: USB disconnect, device number 51 [ 735.295989][T17191] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3154'. [ 735.309484][T17191] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3154'. [ 735.607384][T17200] No such timeout policy "syz0" [ 736.406948][T17213] input: syz0 as /devices/virtual/input/input54 [ 736.613878][T17222] xt_CT: You must specify a L4 protocol and not use inversions on it [ 736.952841][ T5913] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 736.972785][T16275] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 737.052888][ T5830] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 737.102802][ T5913] usb 5-1: Using ep0 maxpacket: 8 [ 737.108002][T16275] usb 4-1: device descriptor read/64, error -71 [ 737.117381][ T5913] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 737.126659][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 737.135872][ T5913] usb 5-1: Product: syz [ 737.140054][ T5913] usb 5-1: Manufacturer: syz [ 737.146541][ T5913] usb 5-1: SerialNumber: syz [ 737.153891][ T5913] usb 5-1: config 0 descriptor?? [ 737.216789][ T5830] usb 6-1: Using ep0 maxpacket: 16 [ 737.234211][ T5830] usb 6-1: config index 0 descriptor too short (expected 804, got 36) [ 737.243049][ T5830] usb 6-1: config 0 has an invalid interface number: 0 but max is -1 [ 737.251145][ T5830] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 737.268280][ T5830] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 737.279654][ T5830] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 737.289282][ T5830] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 737.311490][ T5830] usb 6-1: config 0 descriptor?? [ 737.353248][T16275] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 737.365850][ T5913] usb 5-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 737.502886][T16275] usb 4-1: device descriptor read/64, error -71 [ 737.579895][T17237] xt_TCPMSS: Only works on TCP SYN packets [ 737.632406][T16275] usb usb4-port1: attempt power cycle [ 737.751784][ T5830] mcp2221 0003:04D8:00DD.002C: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 737.958069][ T5830] usb 6-1: USB disconnect, device number 52 [ 737.992910][T16275] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 738.024838][T16275] usb 4-1: device descriptor read/8, error -71 [ 738.272731][T16275] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 738.333441][T16275] usb 4-1: device descriptor read/8, error -71 [ 738.450382][T16275] usb usb4-port1: unable to enumerate USB device [ 739.437141][ T5913] usb write operation failed. (-71) [ 739.572520][ T5913] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 739.603600][ T5913] dvbdev: DVB: registering new adapter (Terratec H7) [ 739.610369][ T5913] usb 5-1: media controller created [ 739.638657][ T5913] usb read operation failed. (-71) [ 739.644891][ T5913] usb write operation failed. (-71) [ 739.656551][ T5913] dvb_usb_az6007 5-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 739.709775][ T5913] usb 5-1: USB disconnect, device number 88 [ 739.895294][T17257] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 739.936848][T17257] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 741.141911][T17273] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3178'. [ 741.529720][T17289] xt_TCPMSS: Only works on TCP SYN packets [ 741.570535][T17290] loop2: detected capacity change from 0 to 7 [ 741.588572][T17290] loop2: [ 741.599992][T17290] loop2: partition table partially beyond EOD, truncated [ 741.620982][ T5199] loop2: [ 741.625365][ T5199] loop2: partition table partially beyond EOD, truncated [ 741.674055][ T5914] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 741.794448][T17293] fuse: Bad value for 'rootmode' [ 741.833759][ T5914] usb 6-1: Using ep0 maxpacket: 16 [ 741.844930][ T5914] usb 6-1: config index 0 descriptor too short (expected 804, got 36) [ 741.888637][ T5914] usb 6-1: config 0 has an invalid interface number: 0 but max is -1 [ 741.897348][ T5914] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 741.906487][ T5914] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 741.917691][ T5914] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 741.930506][ T5914] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 741.950773][ T5914] usb 6-1: config 0 descriptor?? [ 742.134754][T17299] loop5: detected capacity change from 0 to 7 [ 742.232893][T17299] Dev loop5: unable to read RDB block 7 [ 742.239762][T17299] loop5: unable to read partition table [ 742.284772][T17299] loop5: partition table beyond EOD, truncated [ 742.373164][T17299] loop_reread_partitions: partition scan of loop5 () failed (rc=-5) [ 742.396743][ T5914] mcp2221 0003:04D8:00DD.002D: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 742.746069][ T5914] usb 6-1: USB disconnect, device number 53 [ 742.954631][ T5913] usb 3-1: new full-speed USB device number 72 using dummy_hcd [ 742.969383][T17313] netlink: 14 bytes leftover after parsing attributes in process `syz.7.3192'. [ 743.339064][ T5913] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 743.388798][ T5913] usb 3-1: config 0 has no interfaces? [ 743.433767][ T5913] usb 3-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 743.449544][ T5913] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 743.486263][ T5913] usb 3-1: config 0 descriptor?? [ 743.872895][T17331] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 743.880169][T17331] IPv6: NLM_F_CREATE should be set when creating new route [ 743.995529][T17331] bridge0: port 2(bridge_slave_1) entered disabled state [ 744.003312][T17331] bridge0: port 1(bridge_slave_0) entered disabled state [ 744.226155][T17331] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 744.240886][T17344] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3200'. [ 744.294146][T17331] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 744.658262][T17338] syz_tun: entered allmulticast mode [ 744.671393][T13142] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.682989][T13142] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.695461][T13142] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.730372][T17332] syz_tun: left allmulticast mode [ 744.736521][T13142] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.853929][T17359] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 744.862568][T17359] openvswitch: netlink: Message has 16 unknown bytes. [ 746.423654][ T10] usb 3-1: USB disconnect, device number 72 [ 746.913078][ T10] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 747.193439][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.199764][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.222819][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 747.282764][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 747.485119][ T10] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 747.513028][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 747.588593][ T10] usb 3-1: Product: syz [ 747.688957][ T10] usb 3-1: Manufacturer: syz [ 747.695946][ T10] usb 3-1: SerialNumber: syz [ 747.720494][ T10] usb 3-1: config 0 descriptor?? [ 747.735255][ T10] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 747.754212][ T10] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 748.021154][T17397] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 748.424184][ T10] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 748.482748][ T5830] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 748.818636][ T5830] usb 4-1: config 6 has an invalid interface number: 57 but max is 0 [ 748.963207][ T5830] usb 4-1: config 6 has no interface number 0 [ 748.988018][ T5830] usb 4-1: config 6 interface 57 has no altsetting 0 [ 749.003486][ T5830] usb 4-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 0.00 [ 749.024107][ T5830] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.059901][ T5830] usb 4-1: Product: syz [ 749.072327][ T5830] usb 4-1: Manufacturer: syz [ 749.077751][ T5830] usb 4-1: SerialNumber: syz [ 749.138497][T17380] program syz.2.3208 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 749.245940][ T10] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 749.262888][ T10] em28xx 3-1:0.0: board has no eeprom [ 749.301109][T17404] IPVS: set_ctl: invalid protocol: 137 127.0.0.1:20002 [ 749.324799][ T5830] usb-storage 4-1:6.57: USB Mass Storage device detected [ 749.352766][ T10] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 749.360680][ T10] em28xx 3-1:0.0: dvb set to bulk mode. [ 749.387362][ T5913] em28xx 3-1:0.0: Binding DVB extension [ 749.418471][ T10] usb 3-1: USB disconnect, device number 73 [ 749.457286][ T10] em28xx 3-1:0.0: Disconnecting em28xx [ 749.479065][ T5830] usb 4-1: USB disconnect, device number 83 [ 749.595989][ T5913] em28xx 3-1:0.0: Registering input extension [ 749.615119][ T10] em28xx 3-1:0.0: Closing input extension [ 749.643174][ T10] em28xx 3-1:0.0: Freeing device [ 750.435175][T17449] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3227'. [ 750.552014][T17450] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3227'. [ 750.563478][T17453] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3227'. [ 750.910144][T17449] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3227'. [ 751.113405][T17462] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3230'. [ 751.123328][T17462] netlink: 1 bytes leftover after parsing attributes in process `syz.5.3230'. [ 751.334094][ T5830] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 751.502861][ T5830] usb 3-1: Using ep0 maxpacket: 16 [ 751.512611][ T5830] usb 3-1: config index 0 descriptor too short (expected 804, got 36) [ 751.526627][ T5830] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 751.814208][ T5830] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 751.849531][ T5830] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 751.861259][ T5830] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 751.876935][ T5830] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 751.891811][ T5830] usb 3-1: config 0 descriptor?? [ 752.771392][ T5830] mcp2221 0003:04D8:00DD.002E: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 752.981173][ T5913] usb 3-1: USB disconnect, device number 74 [ 753.471294][T17505] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3241'. [ 754.878813][T17524] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3247'. [ 755.032763][ T5830] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 755.428227][ T5830] usb 6-1: Using ep0 maxpacket: 8 [ 755.436801][ T5830] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 755.477990][ T5830] usb 6-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 755.535665][ T5830] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 755.561579][ T5830] usb 6-1: config 0 descriptor?? [ 755.585119][ T5830] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 756.579519][T17543] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3251'. [ 757.013770][ T5830] gspca_vc032x: reg_r err -71 [ 757.018582][ T5830] vc032x 6-1:0.0: probe with driver vc032x failed with error -71 [ 757.037749][ T5830] usb 6-1: USB disconnect, device number 54 [ 757.084271][T17545] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3252'. [ 757.122863][T17545] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3252'. [ 757.602816][ T5909] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 757.668547][T17560] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3259'. [ 757.764050][ T5909] usb 3-1: Using ep0 maxpacket: 16 [ 757.934104][ T5909] usb 3-1: config index 0 descriptor too short (expected 804, got 36) [ 757.963841][ T5909] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 758.014268][ T5909] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 758.037394][ T5909] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 758.110806][ T5909] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 758.168964][ T5909] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 758.225501][ T5909] usb 3-1: config 0 descriptor?? [ 758.732601][ T5909] mcp2221 0003:04D8:00DD.002F: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 758.942971][ T10] usb 3-1: USB disconnect, device number 75 [ 759.178110][T17580] FAULT_INJECTION: forcing a failure. [ 759.178110][T17580] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 759.224550][T17581] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3263'. [ 759.293195][T17580] CPU: 1 UID: 0 PID: 17580 Comm: syz.4.3262 Tainted: G L syzkaller #0 PREEMPT(full) [ 759.293218][T17580] Tainted: [L]=SOFTLOCKUP [ 759.293223][T17580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 759.293232][T17580] Call Trace: [ 759.293238][T17580] [ 759.293244][T17580] dump_stack_lvl+0xe8/0x150 [ 759.293269][T17580] should_fail_ex+0x414/0x560 [ 759.293291][T17580] _copy_from_iter+0x1cd/0x1630 [ 759.293305][T17580] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 759.293325][T17580] ? policy_nodemask+0x27c/0x720 [ 759.293339][T17580] ? __pfx__copy_from_iter+0x10/0x10 [ 759.293353][T17580] ? set_page_refcounted+0xa0/0x1e0 [ 759.293365][T17580] ? page_copy_sane+0x4e/0x280 [ 759.293377][T17580] copy_page_from_iter+0xdd/0x170 [ 759.293390][T17580] tun_get_user+0x1d40/0x3dc0 [ 759.293407][T17580] ? tun_get_user+0x6fc/0x3dc0 [ 759.293425][T17580] ? aa_file_perm+0x44c/0x1530 [ 759.293440][T17580] ? __pfx_tun_get_user+0x10/0x10 [ 759.293454][T17580] ? __lock_acquire+0x6b6/0x2cf0 [ 759.293467][T17580] ? kstrtoull+0x12f/0x1d0 [ 759.293487][T17580] ? ref_tracker_alloc+0x318/0x460 [ 759.293498][T17580] ? get_pid_task+0x20/0x1f0 [ 759.293512][T17580] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 759.293524][T17580] ? tun_get+0x1c/0x2f0 [ 759.293536][T17580] ? tun_get+0x1c/0x2f0 [ 759.293550][T17580] ? tun_get+0x1c/0x2f0 [ 759.293561][T17580] ? tun_get+0x1c/0x2f0 [ 759.293575][T17580] tun_chr_write_iter+0x113/0x200 [ 759.293589][T17580] vfs_write+0x5c9/0xb30 [ 759.293603][T17580] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 759.293615][T17580] ? __pfx_vfs_write+0x10/0x10 [ 759.293630][T17580] ? __fget_files+0x2a/0x420 [ 759.293648][T17580] ksys_write+0x145/0x250 [ 759.293659][T17580] ? __pfx_ksys_write+0x10/0x10 [ 759.293674][T17580] __do_fast_syscall_32+0x1dc/0x570 [ 759.293688][T17580] ? lockdep_hardirqs_on+0x7b/0x110 [ 759.293698][T17580] ? do_fast_syscall_32+0x34/0x80 [ 759.293709][T17580] ? irqentry_exit+0x10f/0x670 [ 759.293721][T17580] do_fast_syscall_32+0x34/0x80 [ 759.293732][T17580] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 759.293747][T17580] RIP: 0023:0xf7f31539 [ 759.293760][T17580] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 759.293769][T17580] RSP: 002b:00000000f5426520 EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 759.293783][T17580] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000040 [ 759.293791][T17580] RDX: 0000000000000026 RSI: 00000000f73c6ff4 RDI: 0000000000000000 [ 759.293798][T17580] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 759.293805][T17580] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 759.293811][T17580] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 759.293826][T17580] [ 759.651614][T17581] batadv0: entered promiscuous mode [ 759.696172][T17581] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 759.788194][T17581] batadv0: left promiscuous mode [ 759.993476][T17589] xt_TPROXY: Can be used only with -p tcp or -p udp [ 760.153427][T17593] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3269'. [ 760.159710][T17592] binder: BINDER_SET_CONTEXT_MGR already set [ 760.169572][T17592] binder: 17591:17592 ioctl 4018620d 800002c0 returned -16 [ 760.199943][T17593] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3269'. [ 760.223772][T17600] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3270'. [ 760.244870][T17593] netlink: 'syz.5.3269': attribute type 19 has an invalid length. [ 760.268338][T17593] netlink: 'syz.5.3269': attribute type 20 has an invalid length. [ 760.833259][ T24] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 761.002964][ T24] usb 6-1: Using ep0 maxpacket: 16 [ 761.026984][ T24] usb 6-1: config index 0 descriptor too short (expected 804, got 36) [ 761.059151][ T24] usb 6-1: config 0 has an invalid interface number: 0 but max is -1 [ 761.093817][ T24] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 761.132854][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 761.175423][ T24] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 761.210986][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 761.260337][ T24] usb 6-1: config 0 descriptor?? [ 761.717267][ T24] mcp2221 0003:04D8:00DD.0030: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 761.985438][ T24] usb 6-1: USB disconnect, device number 55 [ 761.987987][T17626] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3277'. [ 762.138112][T17628] netlink: 820 bytes leftover after parsing attributes in process `syz.3.3278'. [ 762.228809][T17630] netlink: 14 bytes leftover after parsing attributes in process `syz.4.3279'. [ 762.242085][T17630] hsr0: entered promiscuous mode [ 762.416057][T17640] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3284'. [ 762.431665][T17640] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3284'. [ 762.497593][T17645] netlink: 188 bytes leftover after parsing attributes in process `syz.4.3284'. [ 762.514648][ T7054] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 762.536149][T17643] netlink: 20 bytes leftover after parsing attributes in process `syz.7.3285'. [ 762.599345][T17647] batman_adv: batadv0: Adding interface: gretap1 [ 762.613548][T17647] batman_adv: batadv0: Interface activated: gretap1 [ 762.698627][ T7054] usb 3-1: Using ep0 maxpacket: 32 [ 762.731914][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 762.731933][ T30] audit: type=1326 audit(1767786023.774:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17648 comm="syz.7.3287" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 762.747438][ T7054] usb 3-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 762.801612][ T7054] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 762.825498][ T7054] usb 3-1: Product: syz [ 762.830124][ T7054] usb 3-1: Manufacturer: syz [ 762.852838][ T7054] usb 3-1: SerialNumber: syz [ 762.884651][ T7054] usb 3-1: config 0 descriptor?? [ 762.923402][ T7054] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 762.955812][ T30] audit: type=1326 audit(1767786023.774:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17648 comm="syz.7.3287" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 763.028964][ T30] audit: type=1326 audit(1767786023.774:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17648 comm="syz.7.3287" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 763.053168][ T30] audit: type=1326 audit(1767786023.774:424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17648 comm="syz.7.3287" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 763.116994][ T30] audit: type=1326 audit(1767786023.774:425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17648 comm="syz.7.3287" exe="/root/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 763.156245][ T30] audit: type=1326 audit(1767786023.774:426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17648 comm="syz.7.3287" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 763.205483][ T30] audit: type=1326 audit(1767786023.774:427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17648 comm="syz.7.3287" exe="/root/syz-executor" sig=0 arch=40000003 syscall=362 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 763.284195][ T30] audit: type=1326 audit(1767786023.774:428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17648 comm="syz.7.3287" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 763.324198][ T30] audit: type=1326 audit(1767786023.774:429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17648 comm="syz.7.3287" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 763.351698][ T30] audit: type=1326 audit(1767786023.774:430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17648 comm="syz.7.3287" exe="/root/syz-executor" sig=0 arch=40000003 syscall=345 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 763.395934][T17670] netlink: 'syz.4.3295': attribute type 16 has an invalid length. [ 763.489639][T17673] x_tables: duplicate underflow at hook 2 [ 763.678115][T17676] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3298'. [ 763.950770][T17693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 763.978694][T17693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 764.035933][T17693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 764.060017][T17693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 764.149728][ T7054] gspca_topro: reg_w err -71 [ 764.183026][ T5909] usb 4-1: new low-speed USB device number 84 using dummy_hcd [ 764.193207][ T7054] gspca_topro: Sensor soi763a [ 764.210932][ T7054] usb 3-1: USB disconnect, device number 76 [ 764.380396][ T5909] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 764.438229][ T5909] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 764.474958][ T5909] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 764.510210][ T5909] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 764.545374][ T5909] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 764.559200][ T5909] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 764.572107][ T5909] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 764.590379][ T5909] usb 4-1: config 168 interface 0 has no altsetting 0 [ 764.600301][ T5909] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 764.608934][ T5909] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 764.643141][ T5909] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 764.656517][ T5909] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 764.688672][ T5909] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 764.728830][ T5909] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 764.770844][ T5909] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 764.812284][ T5909] usb 4-1: config 168 interface 0 has no altsetting 0 [ 764.875334][ T5909] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 764.900834][ T5909] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 764.982460][ T5909] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 765.017547][ T5909] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 765.081593][ T5909] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 765.124214][ T5909] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 765.236459][ T5909] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 765.288845][ T5909] usb 4-1: config 168 interface 0 has no altsetting 0 [ 765.317781][ T5909] usb 4-1: string descriptor 0 read error: -22 [ 765.331262][ T5909] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 765.345872][ T5909] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 765.376851][ T5909] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 765.386390][T17712] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3309'. [ 765.646568][T17718] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3312'. [ 766.036355][T17739] syz_tun: entered promiscuous mode [ 766.044766][T17739] syz_tun: left promiscuous mode [ 766.139950][ T5909] usb 4-1: USB disconnect, device number 84 [ 766.272243][T17744] syz_tun: entered allmulticast mode [ 766.285775][T17742] syz_tun: left allmulticast mode [ 767.402050][T17766] tipc: Enabling of bearer rejected, failed to enable media [ 767.656765][T17779] FAULT_INJECTION: forcing a failure. [ 767.656765][T17779] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 767.682740][T17779] CPU: 0 UID: 0 PID: 17779 Comm: syz.7.3332 Tainted: G L syzkaller #0 PREEMPT(full) [ 767.682773][T17779] Tainted: [L]=SOFTLOCKUP [ 767.682780][T17779] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 767.682791][T17779] Call Trace: [ 767.682799][T17779] [ 767.682806][T17779] dump_stack_lvl+0xe8/0x150 [ 767.682837][T17779] should_fail_ex+0x414/0x560 [ 767.682876][T17779] _copy_from_user+0x2d/0xb0 [ 767.682904][T17779] get_compat_msghdr+0xad/0x4a0 [ 767.682932][T17779] ? __pfx_get_compat_msghdr+0x10/0x10 [ 767.682957][T17779] ? kstrtouint+0x6e/0xe0 [ 767.682988][T17779] ___sys_sendmsg+0x193/0x2a0 [ 767.683011][T17779] ? __pfx____sys_sendmsg+0x10/0x10 [ 767.683032][T17779] ? get_pid_task+0x20/0x1f0 [ 767.683054][T17779] ? get_pid_task+0x20/0x1f0 [ 767.683075][T17779] ? get_pid_task+0x20/0x1f0 [ 767.683133][T17779] ? __fget_files+0x2a/0x420 [ 767.683158][T17779] ? __fget_files+0x3a0/0x420 [ 767.683192][T17779] __sys_sendmsg+0x164/0x220 [ 767.683218][T17779] ? __pfx___sys_sendmsg+0x10/0x10 [ 767.683250][T17779] ? __pfx_ksys_write+0x10/0x10 [ 767.683281][T17779] __do_fast_syscall_32+0x1dc/0x570 [ 767.683305][T17779] ? lockdep_hardirqs_on+0x7b/0x110 [ 767.683324][T17779] ? do_fast_syscall_32+0x34/0x80 [ 767.683345][T17779] ? irqentry_exit+0x10f/0x670 [ 767.683369][T17779] do_fast_syscall_32+0x34/0x80 [ 767.683392][T17779] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 767.683417][T17779] RIP: 0023:0xf705d539 [ 767.683435][T17779] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 767.683454][T17779] RSP: 002b:00000000f540b55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 767.683476][T17779] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000000 [ 767.683491][T17779] RDX: 0000000004000084 RSI: 0000000000000000 RDI: 0000000000000000 [ 767.683504][T17779] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 767.683516][T17779] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 767.683527][T17779] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 767.683554][T17779] [ 767.688358][T17778] __nla_validate_parse: 1 callbacks suppressed [ 767.688380][T17778] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3331'. [ 768.062794][ T5846] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 768.192814][ T5846] usb 5-1: device descriptor read/64, error -71 [ 768.433279][ T5846] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 768.562808][ T5846] usb 5-1: device descriptor read/64, error -71 [ 768.673172][ T5846] usb usb5-port1: attempt power cycle [ 768.734365][T17789] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3335'. [ 768.823136][T17791] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3336'. [ 768.960679][T17795] netlink: 104 bytes leftover after parsing attributes in process `syz.5.3338'. [ 769.012871][ T5846] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 769.044067][ T5846] usb 5-1: device descriptor read/8, error -71 [ 769.282474][T17804] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3341'. [ 769.292878][ T5846] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 769.353221][ T5846] usb 5-1: device descriptor read/8, error -71 [ 769.483132][ T5846] usb usb5-port1: unable to enumerate USB device [ 769.541752][T17811] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3344'. [ 769.802832][ T7054] usb 4-1: new full-speed USB device number 85 using dummy_hcd [ 769.964811][ T7054] usb 4-1: config 8 has an invalid interface number: 177 but max is 0 [ 769.973760][ T7054] usb 4-1: config 8 has no interface number 0 [ 769.979864][ T7054] usb 4-1: config 8 interface 177 altsetting 9 has an endpoint descriptor with address 0xAD, changing to 0x8D [ 769.992049][ T7054] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x8D has invalid maxpacket 1023, setting to 64 [ 770.004132][ T7054] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 770.014425][ T7054] usb 4-1: config 8 interface 177 has no altsetting 0 [ 770.021236][ T7054] usb 4-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 770.031417][ T7054] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 770.044135][T17809] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 770.738674][T17828] xt_CT: You must specify a L4 protocol and not use inversions on it [ 771.022764][ T24] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 771.182852][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 771.194055][ T24] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 771.202483][ T24] usb 5-1: config 0 has no interface number 0 [ 771.232960][ T24] usb 5-1: config 0 interface 184 has no altsetting 0 [ 771.258302][ T24] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 771.277906][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 771.288683][ T24] usb 5-1: Product: syz [ 771.293232][ T24] usb 5-1: Manufacturer: syz [ 771.300904][ T24] usb 5-1: SerialNumber: syz [ 771.318077][ T24] usb 5-1: config 0 descriptor?? [ 771.345937][ T24] smsc75xx v1.0.0 [ 771.563167][ T24] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 771.618697][ T24] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 771.649775][ T24] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 771.681352][ T24] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -32 [ 771.711929][ T24] usb 5-1: USB disconnect, device number 93 [ 771.987894][T17860] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3361'. [ 772.371545][T17873] xt_TPROXY: Can be used only with -p tcp or -p udp [ 772.441277][ T7054] usb 4-1: string descriptor 0 read error: -71 [ 772.461203][ T7054] ir_toy 4-1:8.177: required endpoints not found [ 772.487279][ T7054] usb 4-1: USB disconnect, device number 85 [ 772.725919][T17888] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3373'. [ 772.849257][T17891] xt_hashlimit: max too large, truncated to 1048576 [ 772.922752][ T7054] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 773.054824][ T5909] psmouse serio2: Failed to reset mouse on : -5 [ 773.092839][ T7054] usb 3-1: Using ep0 maxpacket: 16 [ 773.109168][ T7054] usb 3-1: config index 0 descriptor too short (expected 804, got 36) [ 773.125351][ T7054] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 773.135036][ T7054] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 773.144626][ T7054] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 773.159199][ T7054] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 773.170107][ T7054] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 773.201232][ T7054] usb 3-1: config 0 descriptor?? [ 773.718706][ T7054] mcp2221 0003:04D8:00DD.0031: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 773.785348][T17902] netlink: 820 bytes leftover after parsing attributes in process `syz.3.3377'. [ 773.932137][ T5846] usb 3-1: USB disconnect, device number 77 [ 774.242779][ T7054] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 774.402766][ T7054] usb 4-1: device descriptor read/64, error -71 [ 774.642930][ T7054] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 774.782793][ T7054] usb 4-1: device descriptor read/64, error -71 [ 774.893490][ T7054] usb usb4-port1: attempt power cycle [ 775.055927][T17920] gtp0: entered promiscuous mode [ 775.060944][T17920] gtp0: entered allmulticast mode [ 775.262909][ T7054] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 775.304182][ T7054] usb 4-1: device descriptor read/8, error -71 [ 775.419358][T17926] batman_adv: batadv0: Adding interface: gretap1 [ 775.433409][T17926] batman_adv: batadv0: Interface activated: gretap1 [ 775.549540][ T7054] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 775.593685][ T7054] usb 4-1: device descriptor read/8, error -71 [ 775.713253][ T7054] usb usb4-port1: unable to enumerate USB device [ 776.303439][T17940] netlink: 36 bytes leftover after parsing attributes in process `syz.7.3392'. [ 776.505185][ T7054] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 776.673755][ T7054] usb 6-1: Using ep0 maxpacket: 16 [ 776.681561][ T7054] usb 6-1: config index 0 descriptor too short (expected 804, got 36) [ 776.690316][ T7054] usb 6-1: config 0 has an invalid interface number: 0 but max is -1 [ 776.701632][ T7054] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 776.714641][ T7054] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 776.727888][ T7054] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 776.740381][ T7054] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 776.750592][T17947] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3394'. [ 776.800450][ T7054] usb 6-1: config 0 descriptor?? [ 776.919375][T17951] geneve2: entered promiscuous mode [ 777.012725][ T5909] misc userio: Buffer overflowed, userio client isn't keeping up [ 777.236748][T17958] syz_tun: entered allmulticast mode [ 777.258003][T17956] syz_tun: left allmulticast mode [ 777.259003][ T7054] mcp2221 0003:04D8:00DD.0032: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 777.484613][ T7054] usb 6-1: USB disconnect, device number 56 [ 777.572013][T17967] loop2: detected capacity change from 0 to 7 [ 777.602850][T17967] Dev loop2: unable to read RDB block 7 [ 777.612320][T17967] loop2: unable to read partition table [ 777.650822][T17967] loop2: partition table beyond EOD, truncated [ 777.678438][T17967] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 778.098844][ T5909] input: PS/2 Generic Mouse as /devices/serio2/input/input56 [ 778.243457][T17971] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3403'. [ 778.298930][T17971] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3403'. [ 778.346652][ T5909] psmouse serio2: Failed to enable mouse on [ 778.359861][T17971] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3403'. [ 778.395539][T17971] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3403'. [ 778.477358][T17973] tipc: Started in network mode [ 778.518800][T17973] tipc: Node identity ac141414, cluster identity 4711 [ 778.539160][T17973] tipc: Enabled bearer , priority 10 [ 778.592744][T17977] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3406'. [ 778.625063][T17977] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3406'. [ 778.658641][T17977] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3406'. [ 778.676214][T17977] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3406'. [ 778.702883][ T5909] usb 6-1: new full-speed USB device number 57 using dummy_hcd [ 778.859443][T17985] tipc: Enabling of bearer rejected, failed to enable media [ 778.884807][ T5909] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 778.907752][ T5909] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x3D, changing to 0xD [ 778.920243][ T5909] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid maxpacket 176, setting to 64 [ 778.953854][ T5909] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 7 [ 778.977726][ T5909] usb 6-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 779.018585][ T5909] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 779.033108][ T5913] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 779.063477][ T5909] usb 6-1: config 0 descriptor?? [ 779.093718][T17975] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 779.101244][T17975] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 779.202450][T17994] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3411'. [ 779.211950][ T5913] usb 4-1: Using ep0 maxpacket: 32 [ 779.222047][ T5913] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 9 [ 779.237214][ T5913] usb 4-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 779.247065][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 779.255579][ T5913] usb 4-1: Product: syz [ 779.260183][ T5913] usb 4-1: Manufacturer: syz [ 779.265922][ T5913] usb 4-1: SerialNumber: syz [ 779.276747][ T5913] usb 4-1: config 0 descriptor?? [ 779.292007][T17981] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 779.306065][ T5913] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input57 [ 779.364333][ T5909] usbhid 6-1:0.0: can't add hid device: -71 [ 779.404425][ T5909] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 779.449185][ T5909] usb 6-1: USB disconnect, device number 57 [ 779.559630][ T7054] usb 4-1: USB disconnect, device number 90 [ 779.559626][ C0] usbtouchscreen 4-1:0.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 779.621549][T18000] trusted_key: encrypted_key: insufficient parameters specified [ 779.652857][ T5913] tipc: Node number set to 2886997012 [ 779.730928][T18000] netlink: 20 bytes leftover after parsing attributes in process `syz.7.3413'. [ 779.919642][ T5909] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 780.092942][ T5909] usb 6-1: Using ep0 maxpacket: 32 [ 780.148646][ T5909] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x3D, changing to 0xD [ 780.192948][ T5909] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 176 [ 780.242268][ T5909] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 7 [ 780.262366][ T5909] usb 6-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 780.272196][ T5909] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 780.283983][ T5909] usb 6-1: config 0 descriptor?? [ 780.308713][T17975] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 780.369071][T18005] vlan2: entered promiscuous mode [ 780.395793][T18005] erspan0: entered promiscuous mode [ 780.775453][ T5909] hid-multitouch 0003:0EEF:72C4.0033: reserved main item tag 0xd [ 780.818753][ T5909] hid-multitouch 0003:0EEF:72C4.0033: hidraw0: USB HID v0.00 Device [HID 0eef:72c4] on usb-dummy_hcd.5-1/input0 [ 781.004711][ T5909] usb 6-1: USB disconnect, device number 58 [ 781.952739][ T5914] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 782.252805][ T5914] usb 6-1: Using ep0 maxpacket: 16 [ 782.307477][T18035] input: syz0 as /devices/virtual/input/input58 [ 782.317341][ T5914] usb 6-1: New USB device found, idVendor=05b7, idProduct=2002, bcdDevice= 5.00 [ 782.451555][ T5914] usb 6-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 782.532916][ T5914] usb 6-1: Product: syz [ 782.542711][ T5914] usb 6-1: SerialNumber: syz [ 782.579062][ T5914] usb 6-1: config 0 descriptor?? [ 782.855639][T18029] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 782.864484][T18029] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 782.905913][T18029] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 782.957601][T18029] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 783.084256][ T5913] usb 6-1: USB disconnect, device number 59 [ 783.148284][T18042] xt_CT: You must specify a L4 protocol and not use inversions on it [ 783.377081][T18045] __nla_validate_parse: 4 callbacks suppressed [ 783.377096][T18045] netlink: 80 bytes leftover after parsing attributes in process `syz.7.3426'. [ 784.234918][ T5914] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 784.422721][ T5914] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 784.492697][ T5914] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 784.504909][ T5914] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 784.517402][ T5914] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 784.543742][ T5914] usb 3-1: config 0 descriptor?? [ 785.491247][T18075] xt_connbytes: Forcing CT accounting to be enabled [ 785.502572][T18073] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3436'. [ 785.626193][T18079] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3439'. [ 785.665011][T18079] batadv0: entered promiscuous mode [ 785.681170][T18079] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 785.707757][T18079] batadv0: left promiscuous mode [ 786.169666][T18095] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3442'. [ 786.208038][T18095] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3442'. [ 786.222316][ T5913] usb 3-1: USB disconnect, device number 78 [ 786.237159][T18098] netlink: 'syz.3.3442': attribute type 10 has an invalid length. [ 786.763988][T18107] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3445'. [ 787.230545][T18122] netlink: 820 bytes leftover after parsing attributes in process `syz.5.3450'. [ 789.011013][T18149] netlink: 'syz.3.3458': attribute type 16 has an invalid length. [ 789.508479][T18159] x_tables: duplicate underflow at hook 2 [ 789.573497][T18162] Cannot find del_set index 0 as target [ 789.641289][T18165] kAFS: unable to lookup cell '({^@' [ 791.174237][T18202] loop2: detected capacity change from 0 to 7 [ 791.191747][T18202] Dev loop2: unable to read RDB block 7 [ 791.210837][T18202] loop2: unable to read partition table [ 791.234164][T18202] loop2: partition table beyond EOD, truncated [ 791.260798][T18202] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 791.596428][T18206] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3476'. [ 791.669301][T18211] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 792.278586][ T5909] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 792.341115][T18221] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3483'. [ 792.403621][T18221] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3483'. [ 792.445433][T18221] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3483'. [ 792.484408][ T5909] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 792.513955][ T5909] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 792.541009][T18222] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3483'. [ 792.570053][ T5909] usb 6-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 792.612879][ T5909] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 792.668973][ T5909] usb 6-1: config 0 descriptor?? [ 792.896874][T18224] tipc: Enabling of bearer rejected, already enabled [ 793.155182][ T5909] cp2112 0003:10C4:EA90.0034: unknown main item tag 0x0 [ 793.258178][ T5909] cp2112 0003:10C4:EA90.0034: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.5-1/input0 [ 793.298361][T18230] tipc: Enabling of bearer rejected, failed to enable media [ 793.351260][ T5909] cp2112 0003:10C4:EA90.0034: Part Number: 0x82 Device Version: 0xFE [ 793.552033][ T5909] cp2112 0003:10C4:EA90.0034: error requesting SMBus config [ 793.596649][ T5909] cp2112 0003:10C4:EA90.0034: probe with driver cp2112 failed with error -32 [ 793.782791][ T36] wlan0: Trigger new scan to find an IBSS to join [ 793.899677][T18250] xt_bpf: check failed: parse error [ 794.242516][T18258] xt_CT: You must specify a L4 protocol and not use inversions on it [ 794.705530][ T5909] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 794.901298][ T5909] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 795.006421][ T5909] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 795.101472][ T5913] usb 6-1: USB disconnect, device number 60 [ 795.111529][ T5909] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 795.193433][ T5909] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 795.281569][ T5909] usb 5-1: config 0 descriptor?? [ 795.409274][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 795.892964][T18272] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3499'. [ 797.239381][T18289] netlink: 'syz.7.3503': attribute type 9 has an invalid length. [ 797.590651][ T5914] usb 5-1: USB disconnect, device number 94 [ 797.913754][T18296] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3504'. [ 798.743375][ T3869] wlan0: Trigger new scan to find an IBSS to join [ 798.931247][T18300] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3506'. [ 798.979467][T18302] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3507'. [ 799.002473][T18300] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3506'. [ 799.285329][T18305] xt_connbytes: Forcing CT accounting to be enabled [ 800.016052][T18311] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3511'. [ 800.030020][ T1137] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 800.100816][T18317] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3512'. [ 800.138196][ T5914] hid-generic 0000:0000:0000.0035: unknown main item tag 0x0 [ 800.177651][ T5914] hid-generic 0000:0000:0000.0035: hidraw0: HID v0.00 Device [syz1] on syz0 [ 800.853599][ T5846] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 801.052886][ T5846] usb 4-1: Using ep0 maxpacket: 16 [ 801.077357][ T5846] usb 4-1: config index 0 descriptor too short (expected 4495, got 71) [ 801.102279][ T5846] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 801.129005][ T5846] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 801.150980][ T5846] usb 4-1: config 0 has no interface number 0 [ 801.163648][ T5914] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 801.210166][ T5846] usb 4-1: New USB device found, idVendor=046c, idProduct=14e0, bcdDevice= 0.01 [ 801.230241][ T5846] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 801.263092][ T5846] usb 4-1: Product: syz [ 801.268992][ T5846] usb 4-1: Manufacturer: syz [ 801.283134][ T5846] usb 4-1: SerialNumber: syz [ 801.307806][ T5846] usb 4-1: config 0 descriptor?? [ 801.334897][ T5846] uvcvideo 4-1:0.105: probe with driver uvcvideo failed with error -22 [ 801.372773][ T5914] usb 3-1: Using ep0 maxpacket: 16 [ 801.393500][ T5914] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 801.413323][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 801.422450][ T5914] usb 3-1: Product: syz [ 801.429760][ T5914] usb 3-1: Manufacturer: syz [ 801.437241][ T5914] usb 3-1: SerialNumber: syz [ 801.469487][ T5914] usb 3-1: config 0 descriptor?? [ 801.900526][ T5914] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 801.944835][ T5914] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 801.960626][ T5914] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 801.976602][ T5914] usb 3-1: media controller created [ 802.002509][T18339] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3519'. [ 802.012278][ T5914] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 802.221992][T18345] loop2: detected capacity change from 0 to 7 [ 802.230504][T18346] random: crng reseeded on system resumption [ 802.238790][ T5822] Dev loop2: unable to read RDB block 7 [ 802.250444][ T5822] loop2: unable to read partition table [ 802.262601][ T5822] loop2: partition table beyond EOD, truncated [ 802.292209][T18345] Dev loop2: unable to read RDB block 7 [ 802.323174][T18345] loop2: unable to read partition table [ 802.329530][T18345] loop2: partition table beyond EOD, truncated [ 802.340311][ T5846] usb 4-1: USB disconnect, device number 91 [ 802.357773][T18345] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 802.600547][ T5914] zl10353_read_register: readreg error (reg=127, ret==0) [ 802.620461][ T5914] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 802.650161][ T5914] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 802.857234][T18357] netlink: 'syz.3.3526': attribute type 16 has an invalid length. [ 802.913162][T18360] tipc: MTU too low for tipc bearer [ 802.937740][T18362] x_tables: duplicate underflow at hook 2 [ 803.330150][T18371] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3529'. [ 803.429980][T18371] syz_tun: entered promiscuous mode [ 803.515990][T18371] syz_tun: left promiscuous mode [ 804.599621][T18379] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3531'. [ 804.713492][T18383] loop5: detected capacity change from 0 to 7 [ 804.780897][T18383] Dev loop5: unable to read RDB block 7 [ 804.810199][T18383] loop5: unable to read partition table [ 804.835997][T18383] loop5: partition table beyond EOD, truncated [ 804.867292][T18383] loop_reread_partitions: partition scan of loop5 () failed (rc=-5) [ 804.989872][ T5199] Dev loop5: unable to read RDB block 7 [ 804.989919][ T5199] loop5: unable to read partition table [ 804.990097][ T5199] loop5: partition table beyond EOD, truncated [ 805.700176][T18400] batman_adv: batadv0: Adding interface: gretap1 [ 805.711975][T18400] batman_adv: batadv0: Interface activated: gretap1 [ 806.035152][T18407] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3543'. [ 806.092774][ T5914] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 806.275399][ T5914] usb 5-1: Using ep0 maxpacket: 16 [ 806.299174][ T5914] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 806.333625][ T5914] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 806.370073][ T5914] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 806.416877][ T5914] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 806.438537][ T5914] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 806.458367][ T5914] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 806.480766][ T5914] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 806.501305][ T5914] usb 5-1: Manufacturer: syz [ 806.528053][ T5914] usb 5-1: config 0 descriptor?? [ 806.866059][ T5914] rc_core: IR keymap rc-hauppauge not found [ 806.872210][ T5914] Registered IR keymap rc-empty [ 806.919960][ T5914] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 806.953129][ T5914] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 806.984318][ T5914] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 807.039506][ T5914] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input59 [ 807.154190][ T5914] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 807.300921][ T5914] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 807.507741][ T5914] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 807.612843][ T5914] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 807.663708][ T5914] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 807.705221][ T5914] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 807.813387][ T5914] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 807.842785][ T5914] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 807.902764][ T5914] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 807.974909][ T5914] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 808.048021][ T5914] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 808.094441][ T5914] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 808.151724][ T5914] usb 5-1: USB disconnect, device number 95 [ 808.403178][T18436] syzkaller0: entered promiscuous mode [ 808.426576][T18436] syzkaller0: entered allmulticast mode [ 808.606665][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.614126][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.853589][T18449] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3554'. [ 809.141570][T18458] syz_tun: entered allmulticast mode [ 809.151865][T18457] syz_tun: left allmulticast mode [ 809.263577][ T5909] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 809.432826][ T5909] usb 6-1: Using ep0 maxpacket: 32 [ 809.455825][ T5909] usb 6-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 809.481204][ T5909] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 809.513449][ T5909] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 809.591011][ T5913] usb 3-1: USB disconnect, device number 79 [ 809.721317][ T5913] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 810.167713][T18477] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3565'. [ 810.199284][T18477] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3565'. [ 810.231442][T18477] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3565'. [ 810.255332][T18477] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3565'. [ 810.372018][T18484] tipc: Enabling of bearer rejected, already enabled [ 810.630090][T18486] loop5: detected capacity change from 0 to 7 [ 810.644888][ T5822] loop5: [ 810.649255][ T5822] loop5: partition table partially beyond EOD, truncated [ 810.662863][ T5833] Bluetooth: hci0: command 0x0406 tx timeout [ 810.701074][T18486] loop5: [ 810.705024][T18486] loop5: partition table partially beyond EOD, truncated [ 810.745339][T18455] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 810.854320][T18455] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 810.989990][ T5909] usb 6-1: USB disconnect, device number 61 [ 811.454443][ T5909] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 811.624088][ T5909] usb 6-1: Using ep0 maxpacket: 32 [ 811.646674][ T5909] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 811.661433][ T5909] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 811.675926][ T5909] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 811.689332][ T5909] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 811.710589][ T5909] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.732895][ T5846] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 811.762914][ T5909] usb 6-1: Product: 왲돱ᑪ뽑⤰銤柌斍볎Ⱄ웣ᨏ⁀矰職扲垮㉍鈮꿛탄횾죙酐뱨쉘鲊蠖퍹쫋쯮ꗨ퇳㲋냉햻杠垂㼭㎋壚폈픟ᵫ썽⁐艷킃馱歑벥ㆿ쳷璏㲂ᐃ櫵煶纒䃾䌩햑崥䪁㇍誟살曏虿 [ 811.807828][T18500] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3569'. [ 811.815598][ T5909] usb 6-1: Manufacturer: Ж [ 811.826627][ T5909] usb 6-1: SerialNumber: syz [ 811.953078][ T5846] usb 4-1: Using ep0 maxpacket: 16 [ 811.967525][ T5846] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 811.984947][ T5846] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.994415][ T5846] usb 4-1: Product: syz [ 811.999514][ T5846] usb 4-1: Manufacturer: syz [ 812.033674][ T5846] usb 4-1: SerialNumber: syz [ 812.074550][ T5846] usb 4-1: config 0 descriptor?? [ 812.144377][T18496] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 812.197819][T18496] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 812.302254][ T5909] usb 6-1: 0:2 : does not exist [ 812.363112][ T5909] usb 6-1: USB disconnect, device number 62 [ 812.428399][ T5822] udevd[5822]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 812.556352][ T5846] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 812.596401][ T5846] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 812.614900][ T5846] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 812.625394][ T5846] usb 4-1: media controller created [ 812.664870][ T5846] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 813.254689][ T5846] zl10353_read_register: readreg error (reg=127, ret==0) [ 813.271004][ T5846] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 813.280591][ T5846] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 813.762919][ T5846] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 813.933008][ T5846] usb 6-1: Using ep0 maxpacket: 32 [ 813.947088][ T5846] usb 6-1: config 0 interface 0 has no altsetting 0 [ 813.974031][ T5846] usb 6-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 814.005431][ T5846] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 814.070927][ T5846] usb 6-1: Product: syz [ 814.103252][ T5846] usb 6-1: Manufacturer: syz [ 814.108705][ T5846] usb 6-1: SerialNumber: syz [ 814.153788][ T5846] usb 6-1: config 0 descriptor?? [ 814.313480][ T7054] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 814.383830][ T5846] gs_usb 6-1:0.0: Couldn't send data format (err=-71) [ 814.399622][ T5846] gs_usb 6-1:0.0: probe with driver gs_usb failed with error -71 [ 814.454423][ T5846] usb 6-1: USB disconnect, device number 63 [ 814.508537][ T7054] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 814.557440][ T7054] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 814.623226][ T7054] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 814.653880][ T7054] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 814.695471][ T7054] usb 3-1: config 0 descriptor?? [ 815.183944][ T7054] cp2112 0003:10C4:EA90.0036: unknown main item tag 0x0 [ 815.223584][ T7054] cp2112 0003:10C4:EA90.0036: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 815.369428][ T7054] cp2112 0003:10C4:EA90.0036: Part Number: 0x82 Device Version: 0xFE [ 815.557139][T18565] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3590'. [ 815.984288][ T7054] cp2112 0003:10C4:EA90.0036: error reading lock byte: -32 [ 816.004845][T18545] ------------[ cut here ]------------ [ 816.012119][T18545] usb 4-1: BOGUS control dir, pipe 80005c80 doesn't match bRequestType c0 [ 816.022472][T18545] WARNING: drivers/usb/core/urb.c:414 at usb_submit_urb+0x105c/0x18d0, CPU#0: syz.2.3586/18545 [ 816.036196][T18545] Modules linked in: [ 816.041546][T18545] CPU: 0 UID: 0 PID: 18545 Comm: syz.2.3586 Tainted: G L syzkaller #0 PREEMPT(full) [ 816.054854][T18545] Tainted: [L]=SOFTLOCKUP [ 816.060166][T18545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 816.071289][T18545] RIP: 0010:usb_submit_urb+0x111c/0x18d0 [ 816.077811][T18545] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 b7 f2 ff ff 89 e9 [ 816.100130][T18545] RSP: 0018:ffffc9000df7f4a0 EFLAGS: 00010246 [ 816.107951][T18545] RAX: 0000000000000000 RBX: ffff888032645a00 RCX: 0000000080005c80 [ 816.118057][T18545] RDX: ffff888034496cc0 RSI: ffffffff8c140a20 RDI: ffffffff8f8ee5d0 [ 816.131066][T18545] RBP: 1ffff11009e29e90 R08: 00000000000000c0 R09: 0000000000000000 [ 816.140499][T18545] R10: ffffc9000df7f5a0 R11: fffff52001befec0 R12: ffff88807e4c4100 [ 816.152088][T18545] R13: ffff88804f14f480 R14: 0000000080005c80 R15: ffff888034496cc0 [ 816.162267][T18545] FS: 0000000000000000(0000) GS:ffff888125e1f000(0063) knlGS:00000000f543db40 [ 816.173763][T18545] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 816.180849][T18545] CR2: 0000000080600018 CR3: 00000000279d2000 CR4: 00000000003526f0 [ 816.190183][T18545] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 816.200224][T18545] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 816.209636][T18545] Call Trace: [ 816.213528][T18545] [ 816.216702][T18545] ? __init_swait_queue_head+0xa9/0x150 [ 816.223071][T18545] usb_start_wait_urb+0x115/0x4f0 [ 816.229218][T18545] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 816.237003][T18545] usb_control_msg+0x232/0x3e0 [ 816.242368][T18545] dtv5100_i2c_msg+0x231/0x2f0 [ 816.248174][T18545] dtv5100_i2c_xfer+0x1a4/0x3c0 [ 816.254426][T18545] __i2c_transfer+0x79a/0x1f00 [ 816.260267][T18545] ? __lock_acquire+0x6b6/0x2cf0 [ 816.265839][T18545] __i2c_smbus_xfer+0xf5d/0x1e20 [ 816.272301][T18545] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 816.278035][T18545] ? lockdep_hardirqs_on+0x7b/0x110 [ 816.283723][T18545] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 816.290423][T18545] ? rt_mutex_lock_nested+0x15e/0x1e0 [ 816.296864][T18545] i2c_smbus_xfer+0x1f4/0x310 [ 816.302359][T18545] i2cdev_ioctl_smbus+0x1cd/0x750 [ 816.308379][T18545] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 816.315060][T18545] compat_i2cdev_ioctl+0x299/0x5c0 [ 816.320360][T18545] ? __pfx_compat_i2cdev_ioctl+0x10/0x10 [ 816.327331][T18545] ? __fget_files+0x3a0/0x420 [ 816.333279][T18545] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 816.340486][T18545] __ia32_compat_sys_ioctl+0x543/0x840 [ 816.347000][T18545] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 816.354812][T18545] ? __se_sys_futex_time32+0x360/0x3e0 [ 816.361229][T18545] ? __pfx_do_sys_openat2+0x10/0x10 [ 816.367378][T18545] ? rcu_is_watching+0x15/0xb0 [ 816.373160][T18545] __do_fast_syscall_32+0x1dc/0x570 [ 816.379604][T18545] ? lockdep_hardirqs_on+0x7b/0x110 [ 816.385673][T18545] ? do_fast_syscall_32+0x34/0x80 [ 816.392338][T18545] ? irqentry_exit+0x10f/0x670 [ 816.401616][T18545] do_fast_syscall_32+0x34/0x80 [ 816.406809][T18545] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 816.418840][T18545] RIP: 0023:0xf704d539 [ 816.424963][T18545] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 816.449663][T18545] RSP: 002b:00000000f543d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 816.459575][T18545] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000000720 [ 816.470504][T18545] RDX: 00000000800001c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 816.479866][T18545] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 816.492569][T18545] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 816.504235][T18545] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 816.515455][T18545] [ 816.518782][T18545] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 816.527795][T18545] CPU: 0 UID: 0 PID: 18545 Comm: syz.2.3586 Tainted: G L syzkaller #0 PREEMPT(full) [ 816.541371][T18545] Tainted: [L]=SOFTLOCKUP [ 816.547344][T18545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 816.561480][T18545] Call Trace: [ 816.565108][T18545] [ 816.568393][T18545] vpanic+0x1e0/0x670 [ 816.573815][T18545] panic+0xb9/0xc0 [ 816.577933][T18545] ? __pfx_panic+0x10/0x10 [ 816.583637][T18545] __warn+0x317/0x4b0 [ 816.589372][T18545] ? usb_submit_urb+0x105c/0x18d0 [ 816.597890][T18545] ? usb_submit_urb+0x105c/0x18d0 [ 816.605289][T18545] __report_bug+0x288/0x500 [ 816.611018][T18545] ? usb_submit_urb+0x105c/0x18d0 [ 816.617114][T18545] ? __pfx___report_bug+0x10/0x10 [ 816.622851][T18545] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 816.629723][T18545] ? lockdep_hardirqs_on+0x7b/0x110 [ 816.635568][T18545] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 816.642117][T18545] ? stack_depot_save_flags+0x3f3/0x810 [ 816.648139][T18545] report_bug_entry+0x19a/0x290 [ 816.653971][T18545] ? usb_submit_urb+0x111c/0x18d0 [ 816.659834][T18545] ? usb_submit_urb+0x1121/0x18d0 [ 816.665528][T18545] handle_bug+0xca/0x200 [ 816.669961][T18545] exc_invalid_op+0x1a/0x50 [ 816.674721][T18545] asm_exc_invalid_op+0x1a/0x20 [ 816.679839][T18545] RIP: 0010:usb_submit_urb+0x111c/0x18d0 [ 816.685934][T18545] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 b7 f2 ff ff 89 e9 [ 816.708551][T18545] RSP: 0018:ffffc9000df7f4a0 EFLAGS: 00010246 [ 816.714813][T18545] RAX: 0000000000000000 RBX: ffff888032645a00 RCX: 0000000080005c80 [ 816.724398][T18545] RDX: ffff888034496cc0 RSI: ffffffff8c140a20 RDI: ffffffff8f8ee5d0 [ 816.733433][T18545] RBP: 1ffff11009e29e90 R08: 00000000000000c0 R09: 0000000000000000 [ 816.742558][T18545] R10: ffffc9000df7f5a0 R11: fffff52001befec0 R12: ffff88807e4c4100 [ 816.753089][T18545] R13: ffff88804f14f480 R14: 0000000080005c80 R15: ffff888034496cc0 [ 816.761999][T18545] ? __init_swait_queue_head+0xa9/0x150 [ 816.768730][T18545] usb_start_wait_urb+0x115/0x4f0 [ 816.774962][T18545] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 816.780808][T18545] usb_control_msg+0x232/0x3e0 [ 816.787420][T18545] dtv5100_i2c_msg+0x231/0x2f0 [ 816.792832][T18545] dtv5100_i2c_xfer+0x1a4/0x3c0 [ 816.798114][T18545] __i2c_transfer+0x79a/0x1f00 [ 816.803100][T18545] ? __lock_acquire+0x6b6/0x2cf0 [ 816.810126][T18545] __i2c_smbus_xfer+0xf5d/0x1e20 [ 816.815621][T18545] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 816.821646][T18545] ? lockdep_hardirqs_on+0x7b/0x110 [ 816.828466][T18545] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 816.835036][T18545] ? rt_mutex_lock_nested+0x15e/0x1e0 [ 816.840681][T18545] i2c_smbus_xfer+0x1f4/0x310 [ 816.846226][T18545] i2cdev_ioctl_smbus+0x1cd/0x750 [ 816.851630][T18545] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 816.857956][T18545] compat_i2cdev_ioctl+0x299/0x5c0 [ 816.863686][T18545] ? __pfx_compat_i2cdev_ioctl+0x10/0x10 [ 816.869864][T18545] ? __fget_files+0x3a0/0x420 [ 816.875408][T18545] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 816.881376][T18545] __ia32_compat_sys_ioctl+0x543/0x840 [ 816.887541][T18545] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 816.894017][T18545] ? __se_sys_futex_time32+0x360/0x3e0 [ 816.899874][T18545] ? __pfx_do_sys_openat2+0x10/0x10 [ 816.906238][T18545] ? rcu_is_watching+0x15/0xb0 [ 816.911482][T18545] __do_fast_syscall_32+0x1dc/0x570 [ 816.917389][T18545] ? lockdep_hardirqs_on+0x7b/0x110 [ 816.923192][T18545] ? do_fast_syscall_32+0x34/0x80 [ 816.929239][T18545] ? irqentry_exit+0x10f/0x670 [ 816.934686][T18545] do_fast_syscall_32+0x34/0x80 [ 816.940279][T18545] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 816.947972][T18545] RIP: 0023:0xf704d539 [ 816.953395][T18545] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 816.974233][T18545] RSP: 002b:00000000f543d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 816.984037][T18545] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000000720 [ 816.992720][T18545] RDX: 00000000800001c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 817.001658][T18545] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 817.011539][T18545] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 817.020061][T18545] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 817.029141][T18545] [ 817.033255][T18545] Kernel Offset: disabled [ 817.037885][T18545] Rebooting in 86400 seconds..