last executing test programs: 19.635140243s ago: executing program 0 (id=3923): socket$unix(0x1, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x24, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='\x17\x00'}, @typed={0x8, 0xa, 0x0, 0x0, @fd}]}, 0x24}}, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000700)={'dummy0\x00', &(0x7f0000000200)=@ethtool_perm_addr={0x4b, 0x2d, "4372070000000000476fb2940acfbe4c3f9725f0f2bf568d62c050880594c23d36147b586c9a7affa71b5e2237"}}) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000cf8bed20d90f21004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="201101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) setfsuid(0x0) ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, &(0x7f00000000c0)=0x3) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) ioctl$I2C_RDWR(r4, 0x707, &(0x7f00000002c0)={&(0x7f00000001c0)=[{0x2, 0x8411, 0x6a, &(0x7f00000006c0)="0203204bdcc36cda8907f47563863d1428f47b34551c000bce0f6bc6584f11a7489c77086d578392f81c669f9b0578538b41faa64481c8fe1f043d56f3203ca184bdaf84f9d6f14d361b23c1d6ee71bfe0e705f9a8e61c4ffefc0ada1d224410ec6bdf884ee7ff669789"}, {0x7fff, 0x10, 0x16, &(0x7f0000000140)="cb7fa7b57c4a657d2e86b7c7342cbbe6a1ca5ef62e5b"}], 0x2}) syz_emit_ethernet(0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x5, 0x0, 0x42}}, 0x2e) sendmsg$nl_route_sched(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000d80)=@newqdisc={0x45c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x2, 0x80000001, 0x443, 0x8, 0xcb, 0x5, 0x9, 0x6, 0x4, 0x7, 0x0, 0x8000, 0x6, 0x1, 0x8000, 0x7fff, 0x1, 0xfffffff7, 0x9, 0x3, 0x3, 0x28000, 0xfffffff9, 0x40000000, 0x44f, 0x0, 0x1, 0x1000, 0x6, 0x3, 0x7211, 0xd, 0x2, 0x60dc, 0xd5ff, 0x7, 0x3, 0x5, 0x1, 0x80, 0x7, 0x0, 0xffff, 0x8, 0x6, 0x0, 0x0, 0x8, 0x7d80, 0x1, 0xfffff001, 0x1, 0x8, 0x9, 0x0, 0x7ff, 0x4, 0x80, 0x7e, 0x425, 0x4a, 0xffff0000, 0x2, 0x1ff, 0x29, 0xedad, 0x0, 0x7, 0x200, 0xfffffffb, 0x0, 0x9, 0x0, 0x100, 0x7, 0x10001, 0x0, 0x0, 0xfbb2, 0x62000000, 0x8, 0x0, 0x8, 0x7f, 0xa, 0x8, 0x3, 0x57d6, 0x7, 0x0, 0x3, 0x6cd, 0x5, 0xfff, 0x8000, 0x9, 0x0, 0x7f, 0xe, 0xa1b4, 0xb, 0x5, 0x3cb2, 0xffffff81, 0x8, 0xbc, 0x58, 0x7, 0x9, 0x8, 0x800, 0xff800000, 0xd3a, 0x7, 0x3ff, 0xffffffff, 0x10000, 0xba22, 0x3, 0x7, 0x6, 0x3, 0xfff, 0x200, 0x0, 0x10, 0x0, 0x76, 0x8, 0x5, 0x3ff, 0x3cc, 0x100, 0x6, 0x833, 0xb, 0x8, 0xb, 0x4, 0x2, 0x86, 0x5, 0x45, 0x7, 0x4, 0x6, 0x1, 0xc, 0x80, 0x1b, 0x3000000, 0x0, 0xfffffffe, 0x2, 0x0, 0x8001, 0xa4, 0x3de0e7f6, 0x80000001, 0xf5e, 0x4, 0x7, 0xc50, 0x3, 0x80000001, 0x1000, 0x6, 0xf7a, 0x9, 0x3, 0x7, 0x80000001, 0x80000001, 0x40, 0xba3, 0x5, 0x9, 0x7, 0xffffffff, 0x0, 0x7, 0x9, 0x2, 0x8be0, 0x3, 0xffff7fff, 0x3, 0x5, 0xe, 0x2f813bed, 0x6, 0x3, 0x8, 0x6c, 0x10000, 0x101, 0x9, 0x7, 0xf, 0x100, 0x6, 0xa, 0x7, 0x0, 0x4, 0x1dee5aac, 0x4, 0x2, 0x0, 0x1000, 0x8, 0x2, 0x3, 0x0, 0x2, 0x3, 0x4, 0x3033, 0x8, 0x8, 0x2f000, 0xfffffffc, 0x3, 0x8, 0x0, 0x6, 0x8, 0xa, 0x5, 0x2, 0x1, 0x100, 0x65a, 0x6, 0xfffffffe, 0x27, 0x8, 0x8be2, 0xcbe, 0x226ece10, 0xfffffffd, 0xdf, 0x67, 0x8, 0x4, 0x7d4, 0x2615c584, 0x7, 0x55, 0xf74a, 0x2, 0x0, 0x2, 0x0, 0x7, 0x2]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x3, 0x2, 0x3, 0x8, 0x2, 0x80000001}, {0x0, 0x0, 0x3, 0x0, 0x4, 0x40}, 0x8, 0x13, 0x16d5}}]}}]}, 0x45c}}, 0x40010) ioctl$I2C_SMBUS(r4, 0x720, 0x0) r8 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f01000000000000000000090581034000000000090582"], 0x0) syz_usb_ep_write(r8, 0x82, 0x0, 0x0) ioctl$EVIOCRMFF(r0, 0x4004550d, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='oom_score_adj\x00') 12.574286782s ago: executing program 0 (id=3939): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r1 = socket(0x1e, 0x2, 0x0) (async) r2 = socket$kcm(0x2, 0x5, 0x84) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=@newlink={0x44, 0x10, 0x1, 0x70bd2c, 0x20, {0x0, 0x0, 0x0, 0x0, 0xdf15003157970113, 0x8084}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_GSO_MAX_SEGS={0x8, 0x28, 0x513}, @IFLA_VFINFO_LIST={0x8, 0x16, 0x0, 0x1, [{0x4}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000084}, 0x20000010) (async) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) (async) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000580), 0x8800, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r6, 0x80045017, &(0x7f00000012c0)) (async) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$cec(&(0x7f0000000600), 0x0, 0x0) ioctl$CEC_TRANSMIT(r7, 0xc0386105, 0x0) (async, rerun: 32) ioctl$BTRFS_IOC_SNAP_DESTROY(0xffffffffffffffff, 0x5000940f, &(0x7f0000000080)={{}, "c34701817af46dc6c847d595042448c2efdf49066d624c84adb1479c6a8da4b84a16e81440dec6bec56f488292cc9f7857c379e9ce866819c726a1d3d66d89bd9941dad338368abe4e81b80b560f44dd077012bf6f0beee754267ebc6e3f27aa91f380805295655adae210e699f03dbabc43e63849e89dacff7c751f36e55f4dccf597661951199ee87b655cf9411c5699df2d23abdb018351d2985ca5874438fea2c947bdc8ec9f1a795e38f46acc244d741fa5c389bacb2153b90943f37db20836cf3781f4575473db9006f7906bdb2ee5747d2e645ea2b0440d287d728839ceb0bc754a017a6cf9c1d226a9789edbac0416a744073848764c15ea995d64c3ff71c311c14e7cd53c608d96de426075b45dad4f90b29d5bdacb9a575b84fcc1d80497defe60d8df081c06a719fbc4397ebbc30322e14718e1f57e7b19ce8ac84bc89bd69abb9409fca911ab6562a806219d97674774d6bfe06309c2545f0b7a3615182a6d04ad8a86901c303357aea50ee291d1869091816ae35f5cd29959c3e1b6d90e50c3afdb16ab107a21920318fc399f286d047819a09d28a2b967d760d7910b5ac7cbe7c59a66df4e7ca3176144a8da9b0a198c00dce530ea6d1d46d0c8e75f7a9c7804a4f49f41cad20311b76ebd3fa4635704f09f583d4924e9d70ce949d6523ff0cc40d876cd223a8c93f84de148ea2d8d9ed55fc341fc503bc3fa8216db667d79dc6d0c4102321ab2e6743569aa8cc586c7ef811d426d92da9ebbc68af5c89e740a9f2818a5a3026b2bd464579dfb1be8472a04df0939f92be8cb10581370495919876b3d5760066ee129319cbeed883c2d3ff441b09a22b7cb6b4d221e115cb43a9e07b5f80ee79d22fa5a7f1b868cb9895b3cce2d87bed710f8bbf6f7d2b04d4e56f0b366f2287112b1865b9fa895b9dc7601b77ee7e8aa509c59d60dd85ff8c3c79b58a87fb1fe44ded1e9517b66b6b33ceb18234d8da34da954c4282d306f7466e2eccccadbabd70314ae1fa862392404216abe77b03250dead062459f67cf5ec6b04b4378a403f70ec176d822e41731d1370d373a97fc5929a172905b31a2db84ebefb36671c60116ea1bc9ff03744fdc1c64b45269765efab05a02c811cdb3aca122439fefeb5cca03a08242dfd17bbe4354123158ba5f98520cce7fc955441ecd706b2b2980695cf2600577781a290d48028f0be6b31e19af4ad803c04116a9f81d88edd822c80c8fb72afc4fa0f156aa10d5493e45efafef15e1ae7659991784276468283118eb47ef91ab4f766304b6f2e80c1b33a5e7a22323a6329c2d8201363e44990b0713af03e554c35b7a42aa51bfddfbc797bf3ea13be7f144039cd084956a53c485b8be696afbdc2f1de4a42489f63356eb9b9edbd706b12143ab031e5e00ab34a4c184c2e915d6f96958a94a76e9e61a11702f771344d15060e84f3bf4f16c0e0093a74b2331f401a0a9e7fa86853aeed29f8ce1c5917f5dc399c03901e49384ed3adeaa90383850d7a93075b4822d50a9f15778d4714f93eef32b2587cb0a983f3dbce0bfa759a6bb3042ed456ee769388acab8d7dd054efafd2d6b342a3a5e0664a4581720603f49387e1ef6a697b3ef20abec31024ce9a382d104510c0beb9c2529bec7a022f8f9d70817c6f726b4e21e7c7ee4274cd7ed16ea2d035eea2dc6bfa3810ba779168b71ad0ad859b15fcfe9359029a0986d4bf5a23b4039a01b7d3fb0f70a078086f7c08fa8f082db534035283b847fd0c18e291b034701075e6f5145996522a488816f22f18cd8a5a50a32326248d8a213632ee3313586ce34072005372d7eb0052f227a8414df3646a35ce63a2e3a394a6fdf66a4984142ab101d718767f923bfafda35b7a40509a16fbdad1449f807871787f473ee6896246f7b682f9bb8888165260052501fb753b1d0a04d4bf14a253b97100643b724e87022a684a7db51551b0751e1cdad909948b6beb71028fe13ebea5ab1bed681e47de2d12e3f00e3b8a7e6e6e335a9b65b83ee31f82e91056707c7577332f0878001d48e71e66c4165d535296938ea11f847660a7b84cbf88fb0838f25f8b08c795c5f90508c694199b3f60677847e7f9fcb5c55a295805119ae7bf7e41118b3f44e9814b9e6c3e633d6451bf31f5234bd361174694fa7ced21a9295513625e3bcb8a94617b70c341c561d70930f314e65f335c1412f2eb2c3a1ffa70fee6893bc0f61b651360a59472f13f3e09acb982e46bef9488e291a776aa2f883b85f49ae72f470863a20e160efc0c26b5dd482a7948ee28b747d18e979b451f553cc2db7f7692bd38f4ff2facf1381a69b7ea60777fd046c16273924eeeb3053c661227dd417614eef5879c5bd1c601f43ec373bd5d56ba5af8ea4c2bbc30c6eae3041e59930def19f8847b0a75aa4acd22a59b01acc8d564efbab4c5302905d837348186cebbe11abf4fb31c82ea275cc80646ba9f84bd162d952e51c84fa5783805a0bc4f51b2d42c8795af0b693ceeb37cd9602bb0708e123abd35ab0722f51f98ffb7cd9927010b8be4a43b79d7daaf785a3a5fe396fc84f797001f848c0ccbf5cbba5a42cdb48afb5ba9421a89782c9cbe3e1279d4ac106cbe7704a173af1a219f77f8c585e7b22a19be68d94856c6df443e0a556c96edc34449fc2f207e22c0889c7a9b61ffa2482481be43876c48a02c114ed934a0dc88a62ca35b819f7de29c614f9746c5549e6d90f24a2e468d002923b712bab46f6df914db1805e87da1096a74e04f76e281009e8bc256c8e559403b6398e1ae2e9ad7347c760e8640702c9d2b1513531a040c653a4e45dfb140c80cf2b92de3a9a08e71c22e0515c5e64e24e7b267ae24681fadc0378300139ebedf9f6ed49be483f81125829d6cf62b7df7a912cfd65328971187419bb1963f1c7618755274c09487eddc2dd862e3760d203364ec5d919e92d76187fdd3f4c5f2817fb56c25b99c954268c05b9a046be0a7c05e1740eb74aa23c9c4d369d366f4008f3f598063a04cc2e7beedabb401abced26cd0dd592f88a62106601493081fbcf98ead54ebce82437b2e416ef68461222cb3ed944670fa976ce2642d5800c60750e4202856fc1417bf7a86b43a28e7586bbf765cc2867bf52101cee231a71b51599c98974771189ce4ab18928ac1d9b6cd20d0d5ae5d47c96c97dfc670a0e8ab6d72d675c6ac53fb19408aabf2d91d098306a8226b45fc5f38c42344d839a4ab7ba10c5f987193dcde8621670532f751ec8f88cc205f8d6ebc6f4fbf11922d29c07e77be9107eec73a8d1ad2e517c5eb32fa8f11c373b00ad7048aa0692931ada4f17a19f3c0f05b2607ff35d8948141d2318999ad4f4ba1aba5ae0f17ddcc0b5731ec2a7ba9a9562aebb9f201d31dc29ab740640b4844873cbe999c230f3b0ab2696955d4f130a82aad132c0a5fc27affc74338504777c55e04a76e0ab4c3739c0160fd0104e8fe39df917f4ff878bfccd6cbd35370ba7df108d04c947f66f2add756631f07cf78244280f1a2ba4495ecbb9c3adf6bf2d6df6c186033b7d2279002c1ac5d548aea24ee365da90c013843b4382b13343c4545478718ac1cfdd41c3dbb1790645ad7783daca0e5e1a3188ccb18efe099101f9e344e07c0456e5beace3db667f8940ae4caf6902f3e30583ed3d291c39d6d2816806dcb13ad24b7a45fde38b252e57238dd195087b74e18600c9f9e82126db092a90813d4967421afa7cd6e1ca56071234911a53b94d5751d2708405212ba3098c59c4f311e493637ed2b01f8933520b514217c12302f6f6f9fc7faf366c9912f288007f1fce0422f6cecfdd4e58ae085ba9fabdaea5c83d1b4424c71ab28b1c20c4965e543f907ff26562f739f33a13bdeb3854d3f4e395f7eb4b092a8adf07e855613f9c1763e249a10880962af6e0521da0ee594daffdb7d96071d58ebf6cc891c8f5d7014521c63dd8e27274cfcc0cbfcc24094746894929a7d9e0c5a7cd8471fde480032fdb524625f60f835f4cab6c7d9c899fb3c7cbba3ec14aec101a2c491663018ea9eca1548993e17988669a12c5fa530b7a8be4d81497eaeb11d365b21f1892c62c9ba6c6b381016ee4b37b4100d46cce860b03873edceaa141ce07308233768be95f495e6994840daf5bdb2988267f7097c30c6ffef74a89d0c2440b58aa544ded460e9b9babae4c2ef992f5d599c733db373b8059a4c2087368634c9b789a6f5b4b5bedebdf51b01529c7cfe4b38030594bf3f8a6277b7277060d47ad794894a00a3c9d389a2c251d89e91b16072bc3b750567d260cf81270d72ac8fe4c3a80776003b7a970c055725d65e086b87d530e128e83631ffe2a53d0591179041a7872240ebf6ba856d847ebe5838c1988d961fb9515e42cb53cf1561e217fa919ac18b3e3d6801409f99e6efd8213b7331512d5203405ccd7a5ddecef1b9d87ba205d4e5796512aed9852a5ae3fc06d22d45ee94d25c4cd220358d7f86bbd153b427d32eeeeedae562b4f8e7d603386168c0fd68c626a937b569f1762a7eab2f8cafaedb0fffb141591bd5e93e903d41f35c3ee000883ccd28955499a14332f01094ed5a4127213fac91aa7f98d9044c5e1b13dbbdff30d0b04b9a1839cc306982393d81ea4082f5acd8dc8482518d07c4f8b9a06ac3c7ef6b5480001e98a35d53fe6be2f264a7465962adc812586ace1f2bd92a4388ec4334b71a3120c4eeae81dc2f077f18a9d03384e01cb81665cf8fe1e6a0f49b8863325e0204156c32830ecbbab9c9da68a47ac1d4363bf1fc8f6b9a9c08d445865a2c95666f0b687eac87846d90309268841a771da9cab3fa6df00a9a6780f7031e08555e717ac14507052afa13f732bd45081500434760846b4ef0a38ed2da0389a76356bd793d33504b068b12b16064c1cf3cd392a28a23dce7346dfb5d587e60f37752310b2f1969a4bd17ab4c399852bc73cc09a9af8afed9704525ce2ef5cb53c9721d87bb116c0bf30fa8c1564771aba6094cb0bb332873fe6a0381dab52b92b9fd1d3a0cf6d1e69858a35a257eabb25aeeb05e7734169b067224e78cb1c7cd8fe8e191cae210c4d3e09808007e0744875397306bfdf1b4159c6f92e28f61f7a3e5b5968fabee1a9085af737d3d4bb40bfc93b576dfefbf84d0228c29a9e9cb883481c61fb4a496e19bd8836b528cb2516cc57876ef53dc69ad56c761914a29577caec15af4a2f4124a855d3a7c71a28713b6aa3c59d29d24e44c7139fd10141d76e35a41f11f2cda2fe1f6d31ba2238d532fdeb4b065a179588e530e2edf1eae0ac44b7b06c6e1bc1ae7616f0757e51ed2352e120247ae9351e907980bb88849f353c57b033e25ac9f3314a91457804cb04821bf1d792c085cd6cf6b8dfddb9c1c34ca5cebc0d721da7903331c0f4768a33bad774eea2e2479592b96f2a74007f490f4906844ab8961b34b08cc5e59770e80bb9516402cd8ae9e9739d02e53de9f8c6360d47f2af19787b015d73c39d4286706249770e6d331ef733b6da8a0350b1a2c59d332ed2a66c2873370024b785047da30eed4d0700cde6070ae8643cc828c89662571300b702c6e7131c5cf0a7335c5262a8484dab33f20e69eaecfa48b2923dcbf689d58dead26dadd77d1e954b1d457d05cb9c9e303267c2e47388afc5e985d6038e90f0a8920bc9248563c57d47846e8f6d07c239ade648d0fac448f4cf773190872a8a6491bc4de13ce888d3ab349e6512fc93a710e1732bbbbd70a2a"}) (async, rerun: 32) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x15) r8 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r8, 0x80045530, &(0x7f00000000c0)=""/111) (async, rerun: 32) r9 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) (rerun: 32) ioctl$VHOST_SET_VRING_BASE(r9, 0xaf01, 0x0) (async) ioctl$VHOST_SET_VRING_ADDR(r9, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) (async) sendmsg$nl_xfrm(r1, 0x0, 0x4001) (async) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000500)={0x14, 0x2, 0x6, 0x801}, 0x14}}, 0x0) (async) r10 = syz_io_uring_setup(0x359d, &(0x7f0000001080)={0x0, 0x6d91, 0x0, 0x2, 0x1fb}, &(0x7f0000001100), &(0x7f0000001140)) io_uring_register$IORING_REGISTER_BUFFERS(r10, 0x0, &(0x7f0000001280)=[{&(0x7f0000001480)=""/4096, 0x1000}, {&(0x7f0000001180)=""/139, 0x8b}, {&(0x7f0000001240)=""/38, 0x26}], 0x3) (async) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'veth0_vlan\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r12}}, 0x24}}, 0x0) 12.282206651s ago: executing program 0 (id=3940): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x2d4a80) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0}) r5 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x4) r6 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) truncate(&(0x7f00000001c0)='./file0\x00', 0x100000000) setsockopt$sock_int(r5, 0x1, 0x13, &(0x7f0000000000)=0x1, 0x4) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4e23, 0x6, @private1, 0xd1}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000cc0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0xcea, @remote, 0x4}, 0x1c, &(0x7f0000000140)=[{&(0x7f00000001c0)='j', 0x1}], 0x1}}], 0x1, 0x4000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000100)={r8, 0x1}, 0x8) close(r6) ioctl$IOMMU_HWPT_ALLOC$NONE(r2, 0x3b89, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r9, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r9, &(0x7f0000000000)="e6", 0x1, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) shutdown(r9, 0x1) recvfrom(r9, 0x0, 0x0, 0x61, 0x0, 0x0) ioctl$IOMMU_HWPT_ALLOC$TEST(r2, 0x3b89, &(0x7f0000000200)={0x28, 0x0, r4, 0x0, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) 10.245738569s ago: executing program 0 (id=3948): socket$unix(0x1, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x24, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='\x17\x00'}, @typed={0x8, 0xa, 0x0, 0x0, @fd}]}, 0x24}}, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000700)={'dummy0\x00', &(0x7f0000000200)=@ethtool_perm_addr={0x4b, 0x2d, "4372070000000000476fb2940acfbe4c3f9725f0f2bf568d62c050880594c23d36147b586c9a7affa71b5e2237"}}) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000cf8bed20d90f21004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="201101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) setfsuid(0x0) ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, &(0x7f00000000c0)=0x3) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) ioctl$I2C_RDWR(r4, 0x707, &(0x7f00000002c0)={&(0x7f00000001c0)=[{0x2, 0x8411, 0x6a, &(0x7f00000006c0)="0203204bdcc36cda8907f47563863d1428f47b34551c000bce0f6bc6584f11a7489c77086d578392f81c669f9b0578538b41faa64481c8fe1f043d56f3203ca184bdaf84f9d6f14d361b23c1d6ee71bfe0e705f9a8e61c4ffefc0ada1d224410ec6bdf884ee7ff669789"}, {0x7fff, 0x10, 0x16, &(0x7f0000000140)="cb7fa7b57c4a657d2e86b7c7342cbbe6a1ca5ef62e5b"}], 0x2}) syz_emit_ethernet(0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x5, 0x0, 0x42}}, 0x2e) sendmsg$nl_route_sched(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000d80)=@newqdisc={0x45c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x2, 0x80000001, 0x443, 0x8, 0xcb, 0x5, 0x9, 0x6, 0x4, 0x7, 0x0, 0x8000, 0x6, 0x1, 0x8000, 0x7fff, 0x1, 0xfffffff7, 0x9, 0x3, 0x3, 0x28000, 0xfffffff9, 0x40000000, 0x44f, 0x0, 0x1, 0x1000, 0x6, 0x3, 0x7211, 0xd, 0x2, 0x60dc, 0xd5ff, 0x7, 0x3, 0x5, 0x1, 0x80, 0x7, 0x0, 0xffff, 0x8, 0x6, 0x0, 0x0, 0x8, 0x7d80, 0x1, 0xfffff001, 0x1, 0x8, 0x9, 0x0, 0x7ff, 0x4, 0x80, 0x7e, 0x425, 0x4a, 0xffff0000, 0x2, 0x1ff, 0x29, 0xedad, 0x0, 0x7, 0x200, 0xfffffffb, 0x0, 0x9, 0x0, 0x100, 0x7, 0x10001, 0x0, 0x0, 0xfbb2, 0x62000000, 0x8, 0x0, 0x8, 0x7f, 0xa, 0x8, 0x3, 0x57d6, 0x7, 0x0, 0x3, 0x6cd, 0x5, 0xfff, 0x8000, 0x9, 0x0, 0x7f, 0xe, 0xa1b4, 0xb, 0x5, 0x3cb2, 0xffffff81, 0x8, 0xbc, 0x58, 0x7, 0x9, 0x8, 0x800, 0xff800000, 0xd3a, 0x7, 0x3ff, 0xffffffff, 0x10000, 0xba22, 0x3, 0x7, 0x6, 0x3, 0xfff, 0x200, 0x0, 0x10, 0x0, 0x76, 0x8, 0x5, 0x3ff, 0x3cc, 0x100, 0x6, 0x833, 0xb, 0x8, 0xb, 0x4, 0x2, 0x86, 0x5, 0x45, 0x7, 0x4, 0x6, 0x1, 0xc, 0x80, 0x1b, 0x3000000, 0x0, 0xfffffffe, 0x2, 0x0, 0x8001, 0xa4, 0x3de0e7f6, 0x80000001, 0xf5e, 0x4, 0x7, 0xc50, 0x3, 0x80000001, 0x1000, 0x6, 0xf7a, 0x9, 0x3, 0x7, 0x80000001, 0x80000001, 0x40, 0xba3, 0x5, 0x9, 0x7, 0xffffffff, 0x0, 0x7, 0x9, 0x2, 0x8be0, 0x3, 0xffff7fff, 0x3, 0x5, 0xe, 0x2f813bed, 0x6, 0x3, 0x8, 0x6c, 0x10000, 0x101, 0x9, 0x7, 0xf, 0x100, 0x6, 0xa, 0x7, 0x0, 0x4, 0x1dee5aac, 0x4, 0x2, 0x0, 0x1000, 0x8, 0x2, 0x3, 0x0, 0x2, 0x3, 0x4, 0x3033, 0x8, 0x8, 0x2f000, 0xfffffffc, 0x3, 0x8, 0x0, 0x6, 0x8, 0xa, 0x5, 0x2, 0x1, 0x100, 0x65a, 0x6, 0xfffffffe, 0x27, 0x8, 0x8be2, 0xcbe, 0x226ece10, 0xfffffffd, 0xdf, 0x67, 0x8, 0x4, 0x7d4, 0x2615c584, 0x7, 0x55, 0xf74a, 0x2, 0x0, 0x2, 0x0, 0x7, 0x2]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x3, 0x2, 0x3, 0x8, 0x2, 0x80000001}, {0x0, 0x0, 0x3, 0x0, 0x4, 0x40}, 0x8, 0x13, 0x16d5}}]}}]}, 0x45c}}, 0x40010) ioctl$I2C_SMBUS(r4, 0x720, 0x0) r8 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f01000000000000000000090581034000000000090582"], 0x0) syz_usb_ep_write(r8, 0x82, 0x0, 0x0) ioctl$EVIOCRMFF(r0, 0x4004550d, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='oom_score_adj\x00') 7.592585849s ago: executing program 1 (id=3953): socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000, 0xa, &(0x7f0000ffb000/0x3000)=nil) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x1, @empty, 0x200}, 0x1c) listen(r3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000026c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x10}]}}}]}]}], {0x14}}, 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x8044) r6 = accept(r3, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0) connect$unix(r6, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) r7 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x8010, r7, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x143240, 0x0) socket$nl_generic(0x10, 0x3, 0x10) fsetxattr$trusted_overlay_upper(0xffffffffffffffff, &(0x7f0000000000), &(0x7f00000000c0)={0x0, 0xfb, 0x15, 0x3, 0x6, "c2f2cedfbaab41ffb39937944de0e129"}, 0x15, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000003380)=[{{&(0x7f0000000000)=@hci, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000003340)=[{&(0x7f00000032c0)=""/98, 0x62}], 0x1}, 0x9}], 0x2, 0x2, 0x0) 6.834024002s ago: executing program 3 (id=3954): r0 = socket$can_j1939(0x1d, 0x2, 0x7) unshare(0x22020600) connect$can_j1939(r0, 0x0, 0x0) 6.528140933s ago: executing program 3 (id=3955): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x2003, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x10}}}, 0x24}}, 0x4000010) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 6.445432517s ago: executing program 2 (id=3956): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r5, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r6, 0x4138ae84, &(0x7f0000000100)={{0x7000, 0xdddd1000, 0x0, 0x0, 0x8, 0x8, 0x0, 0x2, 0x0, 0x6, 0x9, 0x10}, {0x8080000, 0x0, 0xc, 0x8, 0x0, 0x0, 0x0, 0x0, 0x7, 0x40, 0x0, 0xff}, {0x3000, 0x5000, 0xc, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x100000, 0xd000, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x4}, {0xeeee8000, 0x3000, 0x9, 0x8, 0xff, 0x4, 0x0, 0xe, 0x0, 0x3c}, {0x0, 0x0, 0x8, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x80}, {0x8080000, 0xeeef0000, 0xa, 0x6, 0x5, 0x0, 0x3, 0x0, 0xfc}, {0xf000, 0xdddd0000, 0x0, 0x0, 0x0, 0x1, 0x0, 0xa, 0x26}, {0x80a0000}, {0xeeef0000}, 0xfdfcffdb, 0x0, 0x0, 0x28, 0xb, 0xf801, 0x0, [0x0, 0x6, 0x1]}) r7 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = dup(r8) getsockname$packet(r9, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001180)=ANY=[@ANYBLOB="ec0000001000010800"/20, @ANYRES32=r10, @ANYBLOB="0b00000000000000cc001a8018000a8014000700fe8000000000000000000000000000aab0000280090001800c0000000000000008000000000000001b0000000000000008000000000000000800000000000000180002801400018005"], 0xec}}, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x20, 0x12, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x5, 0x84}}}, 0xac}, 0x1, 0x0, 0x0, 0x40000}, 0x20050800) r12 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r12, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000040)={0x6, 0x7, 0x8000, 0xb, 0x6, 0x7, 0xffffff32, 0x8001, r13}, &(0x7f0000000080)=0x20) 6.359222474s ago: executing program 3 (id=3957): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x2d4a80) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0}) r5 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x4) r6 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) truncate(&(0x7f00000001c0)='./file0\x00', 0x100000000) setsockopt$sock_int(r5, 0x1, 0x13, &(0x7f0000000000)=0x1, 0x4) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4e23, 0x6, @private1, 0xd1}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000cc0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0xcea, @remote, 0x4}, 0x1c, &(0x7f0000000140)=[{&(0x7f00000001c0)='j', 0x1}], 0x1}}], 0x1, 0x4000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000100)={r8, 0x1}, 0x8) close(r6) ioctl$IOMMU_HWPT_ALLOC$NONE(r2, 0x3b89, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r9, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r9, &(0x7f0000000000)="e6", 0x1, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) shutdown(r9, 0x1) recvfrom(r9, 0x0, 0x0, 0x61, 0x0, 0x0) ioctl$IOMMU_HWPT_ALLOC$TEST(r2, 0x3b89, &(0x7f0000000200)={0x28, 0x0, r4, 0x0, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) 6.031572067s ago: executing program 2 (id=3958): r0 = openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x40000, 0x0) ioctl$SNDCTL_TMR_STOP(r0, 0x5403) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x9, 0x0, 0x7fff0000}]}) timer_create(0x0, 0x0, &(0x7f0000000300)=0x0) timer_getoverrun(r1) syz_usb_connect(0x0, 0x286, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000a1f169405909d02b9848000000010902740201000000000904a80010ff8a3700090505104000057f03090507010002080b0409050303"], 0x0) 5.626249495s ago: executing program 1 (id=3960): socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000, 0xa, &(0x7f0000ffb000/0x3000)=nil) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x1, @empty, 0x200}, 0x1c) listen(r3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000026c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x10}]}}}]}]}], {0x14}}, 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x8044) r6 = accept(r3, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0) connect$unix(r6, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) r7 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x8010, r7, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x143240, 0x0) socket$nl_generic(0x10, 0x3, 0x10) fsetxattr$trusted_overlay_upper(0xffffffffffffffff, &(0x7f0000000000), &(0x7f00000000c0)={0x0, 0xfb, 0x15, 0x3, 0x6, "c2f2cedfbaab41ffb39937944de0e129"}, 0x15, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000003380)=[{{0x0, 0x0, &(0x7f0000003340)=[{0x0}, {&(0x7f00000032c0)=""/98, 0x62}], 0x2}, 0x9}], 0x1, 0x2, 0x0) 4.739373194s ago: executing program 4 (id=3965): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000c, 0x1010, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b34, &(0x7f00000000c0)={'ip6tnl0\x00', @broadcast}) socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x364, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001300)=@newtfilter={0x8d0, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r5, {0x0, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x14, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4}]}]}}, @TCA_RATE={0x6, 0x5, {0x3, 0x20}}, @filter_kind_options=@f_route={{0xa}, {0x874, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0xdf}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0xfff2, 0x10}}, @TCA_ROUTE4_POLICE={0x858, 0x5, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x10, 0x2, 0x43405eef, 0x7b, 0x7fffffff, 0xff, 0x3, 0x735, 0x4, 0x1, 0xffffffff, 0x2, 0x8, 0xe, 0x8, 0x80000000, 0x4, 0x5, 0x7fffffff, 0x8001, 0x5, 0x6, 0x800, 0xb, 0x59, 0x1, 0x70000000, 0x2, 0x10001, 0x0, 0x9, 0x8, 0x4, 0x7ff, 0x7, 0x1, 0x3fc4, 0x6, 0x1, 0x2, 0x4, 0x9, 0xf5e, 0x0, 0xfffffff8, 0x0, 0x5e3, 0x6, 0x5, 0xfffffeff, 0x824, 0x0, 0x32a5, 0x2, 0x7, 0x6, 0x7, 0xfffffffd, 0xe, 0x9, 0x8, 0x9, 0x3, 0x80000, 0x2, 0x8000, 0x0, 0x1, 0x0, 0xd1, 0x2, 0x3, 0x5, 0x0, 0xd8000000, 0x9, 0x4, 0x9, 0x2, 0x0, 0x8, 0x8, 0xffffffff, 0xff, 0x7fff, 0x48d9, 0x0, 0x200, 0x1000, 0x1, 0x7, 0x200, 0x8, 0x6, 0x4, 0x2, 0x5, 0x8, 0x6, 0x7, 0x6, 0x3, 0xb, 0x80000000, 0x1deb, 0x9, 0x7, 0xff, 0x14f0, 0x0, 0x5, 0xf8, 0x34, 0x4, 0x8, 0x7, 0x4, 0x7, 0xbc6, 0x7, 0x4, 0x4, 0x7, 0x401, 0x1, 0xffffff97, 0x0, 0xfffffbff, 0x7fffffff, 0x1e3, 0x5, 0x5, 0x75ca, 0x10000, 0x55, 0xfffffff8, 0x1, 0x5, 0x7, 0x1, 0xb, 0xe, 0xb, 0x3, 0x4c78, 0x0, 0x4, 0x4, 0x1, 0x6, 0x2, 0x0, 0x7ff, 0x9, 0x8, 0x0, 0x6, 0x8, 0xd, 0x7, 0x12e, 0x10, 0x3, 0x0, 0x10c4, 0xb5f2, 0xa, 0x25f, 0x6, 0x4, 0x5, 0xae, 0x5, 0x7e, 0x4, 0x200, 0x7f, 0x1, 0x9, 0x9, 0xe, 0xff, 0x9, 0x5, 0x2, 0xc12d, 0x6, 0x9, 0x80, 0xe, 0x6, 0x6, 0x8, 0x5, 0x7416, 0x3, 0x8, 0x6, 0xffffffff, 0x7, 0x8, 0x5, 0x400, 0x8, 0x0, 0x3, 0x9, 0x4, 0x3, 0x2, 0xae9, 0xffff, 0xd, 0x6, 0x2, 0x9, 0x9, 0x7, 0xfe4, 0x7, 0xfffffff6, 0x2, 0x0, 0xffffffff, 0x5, 0xfff, 0x425, 0x8, 0x8, 0x9, 0x6, 0x9, 0x400, 0x4, 0x6, 0x347, 0x0, 0x4, 0x6, 0x6, 0x4, 0x2, 0x1861, 0x7fffffff, 0xfffffffb, 0x7ff, 0x5, 0xffff, 0x3, 0x1000, 0x7, 0x9, 0xc, 0xe1, 0x9, 0x6]}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x7ff, 0x5, 0x8, 0x800, 0x2, 0xe296, 0xbf, 0x6, 0x4, 0x7fff, 0x43, 0x8, 0x9, 0xffffff65, 0x1, 0x1f0, 0x7, 0xd8ec, 0x10, 0x3, 0xff, 0x5, 0x3, 0x80000000, 0x6, 0x6fba, 0x5, 0x1, 0xe, 0x7, 0x1, 0x7, 0x3, 0x8001, 0x0, 0x100, 0x9, 0x7f, 0x401, 0x401, 0x3, 0xe, 0xdea1, 0x2, 0x8, 0x8001, 0xb, 0x81, 0x80, 0x7, 0x100, 0xf, 0x4, 0x4, 0x4, 0xfffff000, 0xd, 0x1, 0x7, 0x44, 0x6, 0x5, 0x10000, 0x7, 0x4, 0x9, 0x2, 0x2, 0x0, 0xf41, 0x5, 0x8, 0x101, 0x5, 0xa774, 0x5, 0x5, 0x4, 0x7fff, 0x7, 0x401, 0x200000, 0x3, 0x2, 0x8, 0xeb25, 0x2, 0x3, 0x209a, 0x0, 0x0, 0x0, 0x2, 0x9, 0x5, 0x3684, 0x4, 0x4, 0x3, 0x400, 0x7fffffff, 0xfffffffd, 0xe0, 0xfffffade, 0xe55c, 0x9, 0x4, 0x6, 0x10000, 0x153, 0xf, 0x6, 0x8, 0x7, 0xffff0001, 0x0, 0xff, 0x3, 0x3, 0x10, 0x1, 0xcb1b, 0x3, 0x4, 0xffff9938, 0x18000, 0xfb, 0x1, 0x4, 0x10000, 0xfff, 0x80, 0x8, 0x0, 0xbf8, 0x6, 0x2, 0x7, 0x4a9, 0xfe6cfbb, 0x7, 0x7, 0x6, 0xfffffe06, 0x0, 0xffffa822, 0x9, 0x4, 0x7, 0xfffffff7, 0x4, 0x0, 0x0, 0xfffff001, 0x5, 0x3, 0x2, 0xc, 0x6, 0x2, 0x1, 0x7, 0x3, 0x6, 0x4f470dbf, 0x1, 0x2a, 0x0, 0x5, 0x3ff, 0x9, 0x0, 0x10001, 0x5, 0x9925, 0x73, 0xfffffffa, 0x4d5, 0x8, 0x9, 0x0, 0x8001, 0xffffff01, 0x2, 0x9, 0x44, 0x5, 0x8, 0xf1e0, 0x10, 0x400003, 0x8, 0x73cad328, 0x469, 0x0, 0x400, 0x87bc, 0x6, 0x8001, 0x2000003, 0x3, 0x1, 0x9, 0x3, 0x6, 0x1000, 0x2, 0xec6, 0x4, 0x3, 0x3, 0x5, 0x5, 0x8, 0xecb, 0xffffffff, 0x8000, 0x5, 0x40, 0x20000000, 0x3, 0x5, 0x5, 0x8, 0x512, 0x4, 0xa, 0x7, 0x5, 0x0, 0x10001, 0x5, 0x4, 0x8, 0x6, 0x24, 0x6, 0x7ff, 0x1000, 0x1000, 0x2, 0x10001, 0x6, 0x2, 0x6, 0xfffff504, 0x5, 0x10001, 0x4, 0xa84f, 0x10000, 0xd41, 0x16000000, 0x1, 0x1]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x3, 0x20000000, 0x9, 0xb11e, 0x7f, {0x3, 0x0, 0x7, 0x3ff, 0x80, 0x326}, {0x35, 0x1, 0x6, 0x0, 0x8001, 0xb}, 0x9, 0x9, 0x192}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x10001}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x7fffffff}]}, @TCA_ROUTE4_TO={0x8, 0x2, 0x3c}]}}]}, 0x8d0}, 0x1, 0x0, 0x0, 0x80}, 0x800) 4.320745919s ago: executing program 3 (id=3966): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)) bpf$MAP_CREATE(0x0, 0x0, 0x48) r0 = syz_open_dev$vbi(&(0x7f0000000380), 0x0, 0x2) ioctl$VIDIOC_G_PARM(r0, 0xc0cc5615, &(0x7f0000000240)={0x6, @capture={0x0, 0x0, {0x0, 0xffffffff}, 0xfffffffb, 0x8}}) socket(0x200000100000011, 0x5, 0x4) syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x903d01) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) write(0xffffffffffffffff, &(0x7f0000000080), 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x8, 0x1000, 0x0, 0xb4b, 0x9, 0x9, 0x1, 0x400002}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1f0000000000000000000000001000", @ANYRES32, @ANYBLOB="0000000400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/15], 0x50) r5 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r5, 0xc0045627, &(0x7f00000000c0)=0x3) r6 = landlock_create_ruleset(&(0x7f0000000280)={0x2050, 0x0, 0x1}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r6, 0x1, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) rt_sigaction(0x40, &(0x7f0000000140)={&(0x7f0000000000)="24339e9e0f1c2bdfd5c4a2f10027c6c43b640febce41d3ca6566f00fc02c101c65d2150e000000dbf5", 0x0, 0x0}, 0x0, 0x8, &(0x7f0000000380)) r7 = syz_open_procfs(0x0, &(0x7f00000004c0)='stat\x00') read$FUSE(r7, &(0x7f0000004180)={0x2020}, 0x2020) sendto(r2, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0xfcb5}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f, 0x34000}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) unlink(&(0x7f0000000300)='./file0\x00') ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"}) 4.182951767s ago: executing program 1 (id=3967): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x2003, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x4000010) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 4.117352395s ago: executing program 1 (id=3968): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x68b02, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) r2 = timerfd_create(0x6, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f0000000240)={0x4, r2}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='environ\x00') preadv(r4, &(0x7f0000000580)=[{&(0x7f0000000040)=""/103, 0x67}], 0x1000000000000212, 0xc002a0, 0xcbea) writev(r3, &(0x7f0000000400)=[{&(0x7f0000000000)="390000001000111867090707a640400f0021ff3f31000000170a00170000000004003700090003002e2e2564b758b9a64411f6bb744dc48f57", 0x39}], 0x1) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r5 = socket(0x15, 0x5, 0x0) getsockopt(r5, 0x200000000114, 0x2710, 0x0, &(0x7f0000000040)) 3.979304502s ago: executing program 2 (id=3969): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000c, 0x1010, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b34, &(0x7f00000000c0)={'ip6tnl0\x00', @broadcast}) socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x364, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_HWPT_INVALIDATE$TEST(r2, 0x3b8d, &(0x7f0000000040)={0x20, 0x0, 0x0, 0xdeadbeef, 0x8, 0xffffffc1}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001300)=@newtfilter={0x8d0, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r6, {0x0, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x14, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4}]}]}}, @TCA_RATE={0x6, 0x5, {0x3, 0x20}}, @filter_kind_options=@f_route={{0xa}, {0x874, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0xdf}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0xfff2, 0x10}}, @TCA_ROUTE4_POLICE={0x858, 0x5, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x10, 0x2, 0x43405eef, 0x7b, 0x7fffffff, 0xff, 0x3, 0x735, 0x4, 0x1, 0xffffffff, 0x2, 0x8, 0xe, 0x8, 0x80000000, 0x4, 0x5, 0x7fffffff, 0x8001, 0x5, 0x6, 0x800, 0xb, 0x59, 0x1, 0x70000000, 0x2, 0x10001, 0x0, 0x9, 0x8, 0x4, 0x7ff, 0x7, 0x1, 0x3fc4, 0x6, 0x1, 0x2, 0x4, 0x9, 0xf5e, 0x0, 0xfffffff8, 0x0, 0x5e3, 0x6, 0x5, 0xfffffeff, 0x824, 0x0, 0x32a5, 0x2, 0x7, 0x6, 0x7, 0xfffffffd, 0xe, 0x9, 0x8, 0x9, 0x3, 0x80000, 0x2, 0x8000, 0x0, 0x1, 0x0, 0xd1, 0x2, 0x3, 0x5, 0x0, 0xd8000000, 0x9, 0x4, 0x9, 0x2, 0x0, 0x8, 0x8, 0xffffffff, 0xff, 0x7fff, 0x48d9, 0x0, 0x200, 0x1000, 0x1, 0x7, 0x200, 0x8, 0x6, 0x4, 0x2, 0x5, 0x8, 0x6, 0x7, 0x6, 0x3, 0xb, 0x80000000, 0x1deb, 0x9, 0x7, 0xff, 0x14f0, 0x0, 0x5, 0xf8, 0x34, 0x4, 0x8, 0x7, 0x4, 0x7, 0xbc6, 0x7, 0x4, 0x4, 0x7, 0x401, 0x1, 0xffffff97, 0x0, 0xfffffbff, 0x7fffffff, 0x1e3, 0x5, 0x5, 0x75ca, 0x10000, 0x55, 0xfffffff8, 0x1, 0x5, 0x7, 0x1, 0xb, 0xe, 0xb, 0x3, 0x4c78, 0x0, 0x4, 0x4, 0x1, 0x6, 0x2, 0x0, 0x7ff, 0x9, 0x8, 0x0, 0x6, 0x8, 0xd, 0x7, 0x12e, 0x10, 0x3, 0x0, 0x10c4, 0xb5f2, 0xa, 0x25f, 0x6, 0x4, 0x5, 0xae, 0x5, 0x7e, 0x4, 0x200, 0x7f, 0x1, 0x9, 0x9, 0xe, 0xff, 0x9, 0x5, 0x2, 0xc12d, 0x6, 0x9, 0x80, 0xe, 0x6, 0x6, 0x8, 0x5, 0x7416, 0x3, 0x8, 0x6, 0xffffffff, 0x7, 0x8, 0x5, 0x400, 0x8, 0x0, 0x3, 0x9, 0x4, 0x3, 0x2, 0xae9, 0xffff, 0xd, 0x6, 0x2, 0x9, 0x9, 0x7, 0xfe4, 0x7, 0xfffffff6, 0x2, 0x0, 0xffffffff, 0x5, 0xfff, 0x425, 0x8, 0x8, 0x9, 0x6, 0x9, 0x400, 0x4, 0x6, 0x347, 0x0, 0x4, 0x6, 0x6, 0x4, 0x2, 0x1861, 0x7fffffff, 0xfffffffb, 0x7ff, 0x5, 0xffff, 0x3, 0x1000, 0x7, 0x9, 0xc, 0xe1, 0x9, 0x6]}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x7ff, 0x5, 0x8, 0x800, 0x2, 0xe296, 0xbf, 0x6, 0x4, 0x7fff, 0x43, 0x8, 0x9, 0xffffff65, 0x1, 0x1f0, 0x7, 0xd8ec, 0x10, 0x3, 0xff, 0x5, 0x3, 0x80000000, 0x6, 0x6fba, 0x5, 0x1, 0xe, 0x7, 0x1, 0x7, 0x3, 0x8001, 0x0, 0x100, 0x9, 0x7f, 0x401, 0x401, 0x3, 0xe, 0xdea1, 0x2, 0x8, 0x8001, 0xb, 0x81, 0x80, 0x7, 0x100, 0xf, 0x4, 0x4, 0x4, 0xfffff000, 0xd, 0x1, 0x7, 0x44, 0x6, 0x5, 0x10000, 0x7, 0x4, 0x9, 0x2, 0x2, 0x0, 0xf41, 0x5, 0x8, 0x101, 0x5, 0xa774, 0x5, 0x5, 0x4, 0x7fff, 0x7, 0x401, 0x200000, 0x3, 0x2, 0x8, 0xeb25, 0x2, 0x3, 0x209a, 0x0, 0x0, 0x0, 0x2, 0x9, 0x5, 0x3684, 0x4, 0x4, 0x3, 0x400, 0x7fffffff, 0xfffffffd, 0xe0, 0xfffffade, 0xe55c, 0x9, 0x4, 0x6, 0x10000, 0x153, 0xf, 0x6, 0x8, 0x7, 0xffff0001, 0x0, 0xff, 0x3, 0x3, 0x10, 0x1, 0xcb1b, 0x3, 0x4, 0xffff9938, 0x18000, 0xfb, 0x1, 0x4, 0x10000, 0xfff, 0x80, 0x8, 0x0, 0xbf8, 0x6, 0x2, 0x7, 0x4a9, 0xfe6cfbb, 0x7, 0x7, 0x6, 0xfffffe06, 0x0, 0xffffa822, 0x9, 0x4, 0x7, 0xfffffff7, 0x4, 0x0, 0x0, 0xfffff001, 0x5, 0x3, 0x2, 0xc, 0x6, 0x2, 0x1, 0x7, 0x3, 0x6, 0x4f470dbf, 0x1, 0x2a, 0x0, 0x5, 0x3ff, 0x9, 0x0, 0x10001, 0x5, 0x9925, 0x73, 0xfffffffa, 0x4d5, 0x8, 0x9, 0x0, 0x8001, 0xffffff01, 0x2, 0x9, 0x44, 0x5, 0x8, 0xf1e0, 0x10, 0x400003, 0x8, 0x73cad328, 0x469, 0x0, 0x400, 0x87bc, 0x6, 0x8001, 0x2000003, 0x3, 0x1, 0x9, 0x3, 0x6, 0x1000, 0x2, 0xec6, 0x4, 0x3, 0x3, 0x5, 0x5, 0x8, 0xecb, 0xffffffff, 0x8000, 0x5, 0x40, 0x20000000, 0x3, 0x5, 0x5, 0x8, 0x512, 0x4, 0xa, 0x7, 0x5, 0x0, 0x10001, 0x5, 0x4, 0x8, 0x6, 0x24, 0x6, 0x7ff, 0x1000, 0x1000, 0x2, 0x10001, 0x6, 0x2, 0x6, 0xfffff504, 0x5, 0x10001, 0x4, 0xa84f, 0x10000, 0xd41, 0x16000000, 0x1, 0x1]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x3, 0x20000000, 0x9, 0xb11e, 0x7f, {0x3, 0x0, 0x7, 0x3ff, 0x80, 0x326}, {0x35, 0x1, 0x6, 0x0, 0x8001, 0xb}, 0x9, 0x9, 0x192}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x10001}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x7fffffff}]}, @TCA_ROUTE4_TO={0x8, 0x2, 0x3c}]}}]}, 0x8d0}, 0x1, 0x0, 0x0, 0x80}, 0x800) 3.46383991s ago: executing program 1 (id=3970): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x2d4a80) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0}) r5 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x4) r6 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) truncate(&(0x7f00000001c0)='./file0\x00', 0x100000000) setsockopt$sock_int(r5, 0x1, 0x13, &(0x7f0000000000)=0x1, 0x4) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4e23, 0x6, @private1, 0xd1}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000cc0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0xcea, @remote, 0x4}, 0x1c, &(0x7f0000000140)=[{&(0x7f00000001c0)='j', 0x1}], 0x1}}], 0x1, 0x4000) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000100)={r8, 0x1}, 0x8) close(r6) ioctl$IOMMU_HWPT_ALLOC$NONE(r2, 0x3b89, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r9, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r9, &(0x7f0000000000)="e6", 0x1, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) shutdown(r9, 0x1) recvfrom(r9, 0x0, 0x0, 0x61, 0x0, 0x0) ioctl$IOMMU_HWPT_ALLOC$TEST(r2, 0x3b89, &(0x7f0000000200)={0x28, 0x0, r4, 0x0, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) 3.166766287s ago: executing program 0 (id=3971): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x4, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000200)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f0000000980)=[{&(0x7f0000000880)=""/197, 0xc5}], 0x1}}, @rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f00000004c0)=[{&(0x7f0000000080)=""/28, 0x1c}], 0x1}}], 0x90}, 0x0) 3.05309634s ago: executing program 0 (id=3972): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x0) io_pgetevents(0x0, 0xf, 0x0, &(0x7f0000000600), &(0x7f0000000400)={0x77359400}, &(0x7f0000000340)={&(0x7f0000000140)={[0x7fffffff]}, 0xffffffffffffff34}) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_HASH_SREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HASH_MODULUS={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_HASH_LEN={0x8, 0x3, 0x1, 0x0, 0xd9}, @NFTA_HASH_DREG={0x8, 0x2, 0x1, 0x0, 0x12}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}, 0x1, 0x0, 0x0, 0xc084}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = syz_io_uring_setup(0x1104, &(0x7f0000000300)={0x0, 0x0, 0x80, 0x2, 0x8000021e}, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000380)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x7, 0x0, 0x0, 0x200, 0x0, 0x1}) io_uring_enter(r4, 0x47fa, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_usb_connect$uac1(0x0, 0xb1, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001ac0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x4}}, [@NFT_MSG_NEWTABLE={0xffffffffffffff1f, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x801, 0x0, 0x0, {0x5, 0x0, 0x1}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x5}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x7, 0x84}}}, 0x94}}, 0x20050800) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4c, 0x9, 0x6, 0x0, 0x3}, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x501000, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) unshare(0x2040600) ppoll(&(0x7f0000000900)=[{r0, 0x1a}], 0x1, &(0x7f0000000ac0), 0x0, 0x0) 2.808859729s ago: executing program 4 (id=3973): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002cbd7000000000003900000008000300", @ANYRES32=r2, @ANYBLOB="24005a802000018014000300030007"], 0x40}}, 0x4000) 2.487076021s ago: executing program 4 (id=3974): r0 = socket$inet6(0xa, 0x3, 0x5) capset(&(0x7f0000000000)={0x20080522}, 0x0) sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="080100000000000029000000", @ANYRES64=r0], 0x108}}], 0x2, 0xc040) 2.352104445s ago: executing program 4 (id=3975): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)={0x34, r2, 0xb97534d5fe9704cf, 0x70bd2b, 0x25dfdbfe, {{0x12}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_WME={0x4}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x0) 2.216491673s ago: executing program 4 (id=3976): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='dctcp', 0x5) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x23) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe3}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='htcp', 0x4) sendmmsg$inet(r0, &(0x7f0000002c00)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000009c0)="ea1747ee24b86a34d6d5c2e1a5c3fa9bed5f96120d23943a47f115bec6dc08286796f83a316ba76165d3827b631e77dc07a55a6cde8915a691dd4fc768ddd8c53468317c75a269a9928b524cf62f19d7ef3c0a0b030c0d185464d4ba8418d407ef29fc1e4761bcb5a68fcd2317bbfb4eb98caa0d3e2e006a251e095ed496a5552fbf256eb2f643df539bad7e9d72146c7ac03fdba4ce87cb39600feede00000000000000000000000000000616e811ea5c31696a5bc384e7f0005667204385829db5b251", 0xc4}], 0x1}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000180)="f0", 0x1}], 0x1}}], 0x2, 0x400c0) 1.963539771s ago: executing program 4 (id=3977): modify_ldt$write(0x1, &(0x7f0000000000)={0x3fd, 0xffffffffffffffff, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) socket(0xa, 0x3, 0x3a) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200), 0xc8902, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)=0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f00000000c0)={'ip6gre0\x00', {0x2, 0x4e1d, @broadcast}}) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x5, 0x9, 0x8}, 0x0) fanotify_init(0xa00, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) syz_open_dev$media(&(0x7f00000012c0), 0x66, 0x180502) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x45e, 0x101781) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/82, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000180)) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000600)={0x17}) ioctl$PPPIOCSPASS(r0, 0x40107447, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r4 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000006, 0x40010, r4, 0xaffb000) ioctl$USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x20000009, 0x40, &(0x7f0000000240)={0x0, 0x0, 0xf, 0x360}, 0x8, 0x9, 0x80, 0x0, 0x0, 0x101, 0x0}) socket(0x14, 0x80000, 0x9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_clone(0x640c7400, 0x0, 0x0, 0x0, 0x0, 0x0) 1.712595003s ago: executing program 2 (id=3978): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x2003, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x4000010) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.556834463s ago: executing program 2 (id=3979): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x14, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}]}]}], {0x14}}, 0x9c}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) 1.43578123s ago: executing program 2 (id=3980): modify_ldt$write(0x1, &(0x7f0000000000)={0x3fd, 0xffffffffffffffff, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) socket(0xa, 0x3, 0x3a) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200), 0xc8902, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)=0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f00000000c0)={'ip6gre0\x00', {0x2, 0x4e1d, @broadcast}}) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0x92, 0x55, 0x5, 0x9, 0x8}, 0x0) fanotify_init(0xa00, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) syz_open_dev$media(&(0x7f00000012c0), 0x66, 0x180502) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x45e, 0x101781) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/82, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000180)) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000600)={0x17}) ioctl$PPPIOCSPASS(r0, 0x40107447, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r4 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000006, 0x40010, r4, 0xaffb000) ioctl$USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x20000009, 0x40, &(0x7f0000000240)={0x0, 0x0, 0xf, 0x360}, 0x8, 0x9, 0x80, 0x0, 0x0, 0x101, 0x0}) socket(0x14, 0x80000, 0x9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_clone(0x640c7400, 0x0, 0x0, 0x0, 0x0, 0x0) 1.390259933s ago: executing program 1 (id=3981): socket$unix(0x1, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x24, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='\x17\x00'}, @typed={0x8, 0xa, 0x0, 0x0, @fd}]}, 0x24}}, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000700)={'dummy0\x00', &(0x7f0000000200)=@ethtool_perm_addr={0x4b, 0x2d, "4372070000000000476fb2940acfbe4c3f9725f0f2bf568d62c050880594c23d36147b586c9a7affa71b5e2237"}}) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000cf8bed20d90f21004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="201101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) setfsuid(0x0) ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, &(0x7f00000000c0)=0x3) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) ioctl$I2C_RDWR(r4, 0x707, &(0x7f00000002c0)={&(0x7f00000001c0)=[{0x2, 0x8411, 0x6a, &(0x7f00000006c0)="0203204bdcc36cda8907f47563863d1428f47b34551c000bce0f6bc6584f11a7489c77086d578392f81c669f9b0578538b41faa64481c8fe1f043d56f3203ca184bdaf84f9d6f14d361b23c1d6ee71bfe0e705f9a8e61c4ffefc0ada1d224410ec6bdf884ee7ff669789"}, {0x6, 0x1a01, 0x0, 0x0}, {0x7fff, 0x10, 0x16, &(0x7f0000000140)="cb7fa7b57c4a657d2e86b7c7342cbbe6a1ca5ef62e5b"}], 0x3}) syz_emit_ethernet(0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x5, 0x0, 0x42}}, 0x2e) sendmsg$nl_route_sched(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000d80)=@newqdisc={0x45c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x2, 0x80000001, 0x443, 0x8, 0xcb, 0x5, 0x9, 0x6, 0x4, 0x7, 0x0, 0x8000, 0x6, 0x1, 0x8000, 0x7fff, 0x1, 0xfffffff7, 0x9, 0x3, 0x3, 0x28000, 0xfffffff9, 0x40000000, 0x44f, 0x0, 0x1, 0x1000, 0x6, 0x3, 0x7211, 0xd, 0x2, 0x60dc, 0xd5ff, 0x7, 0x3, 0x5, 0x1, 0x80, 0x7, 0x0, 0xffff, 0x8, 0x6, 0x0, 0x0, 0x8, 0x7d80, 0x1, 0xfffff001, 0x1, 0x8, 0x9, 0x0, 0x7ff, 0x4, 0x80, 0x7e, 0x425, 0x4a, 0xffff0000, 0x2, 0x1ff, 0x29, 0xedad, 0x0, 0x7, 0x200, 0xfffffffb, 0x0, 0x9, 0x0, 0x100, 0x7, 0x10001, 0x0, 0x0, 0xfbb2, 0x62000000, 0x8, 0x0, 0x8, 0x7f, 0xa, 0x8, 0x3, 0x57d6, 0x7, 0x0, 0x3, 0x6cd, 0x5, 0xfff, 0x8000, 0x9, 0x0, 0x7f, 0xe, 0xa1b4, 0xb, 0x5, 0x3cb2, 0xffffff81, 0x8, 0xbc, 0x58, 0x7, 0x9, 0x8, 0x800, 0xff800000, 0xd3a, 0x7, 0x3ff, 0xffffffff, 0x10000, 0xba22, 0x3, 0x7, 0x6, 0x3, 0xfff, 0x200, 0x0, 0x10, 0x0, 0x76, 0x8, 0x5, 0x3ff, 0x3cc, 0x100, 0x6, 0x833, 0xb, 0x8, 0xb, 0x4, 0x2, 0x86, 0x5, 0x45, 0x7, 0x4, 0x6, 0x1, 0xc, 0x80, 0x1b, 0x3000000, 0x0, 0xfffffffe, 0x2, 0x0, 0x8001, 0xa4, 0x3de0e7f6, 0x80000001, 0xf5e, 0x4, 0x7, 0xc50, 0x3, 0x80000001, 0x1000, 0x6, 0xf7a, 0x9, 0x3, 0x7, 0x80000001, 0x80000001, 0x40, 0xba3, 0x5, 0x9, 0x7, 0xffffffff, 0x0, 0x7, 0x9, 0x2, 0x8be0, 0x3, 0xffff7fff, 0x3, 0x5, 0xe, 0x2f813bed, 0x6, 0x3, 0x8, 0x6c, 0x10000, 0x101, 0x9, 0x7, 0xf, 0x100, 0x6, 0xa, 0x7, 0x0, 0x4, 0x1dee5aac, 0x4, 0x2, 0x0, 0x1000, 0x8, 0x2, 0x3, 0x0, 0x2, 0x3, 0x4, 0x3033, 0x8, 0x8, 0x2f000, 0xfffffffc, 0x3, 0x8, 0x0, 0x6, 0x8, 0xa, 0x5, 0x2, 0x1, 0x100, 0x65a, 0x6, 0xfffffffe, 0x27, 0x8, 0x8be2, 0xcbe, 0x226ece10, 0xfffffffd, 0xdf, 0x67, 0x8, 0x4, 0x7d4, 0x2615c584, 0x7, 0x55, 0xf74a, 0x2, 0x0, 0x2, 0x0, 0x7, 0x2]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x3, 0x2, 0x3, 0x8, 0x2, 0x80000001}, {0x0, 0x0, 0x3, 0x0, 0x4, 0x40}, 0x8, 0x13, 0x16d5}}]}}]}, 0x45c}}, 0x40010) ioctl$I2C_SMBUS(r4, 0x720, 0x0) r8 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f01000000000000000000090581034000000000090582"], 0x0) syz_usb_ep_write(r8, 0x82, 0x0, 0x0) ioctl$EVIOCRMFF(r0, 0x4004550d, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='oom_score_adj\x00') 238.418874ms ago: executing program 3 (id=3982): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x4, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000200)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f0000000980)=[{&(0x7f0000000880)=""/197, 0xc5}], 0x1}}, @rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f00000004c0)=[{&(0x7f0000000080)=""/28, 0x1c}], 0x1}}], 0x90}, 0x0) 0s ago: executing program 3 (id=3983): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) r2 = syz_usb_connect(0x4, 0x36, &(0x7f0000000000)=ANY=[@ANYRESOCT=0x0], 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000480)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="40150800000000000a000000dfa372be969521ece3a77d0c232168a386fe82c25b8baf935dfb5f64f53037b6b33937bcee9cfde165bf84cd5cabc0414c7303fb2e12455317142d6cf51af81eda63dd"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = open(0x0, 0x0, 0x40) fcntl$notify(r5, 0x402, 0x79) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0x0) r7 = fanotify_init(0x200, 0x0) fanotify_mark(r7, 0x39, 0x1a, r6, 0x0) fanotify_mark(r7, 0x1, 0x4800003e, r6, 0x0) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0xffffffff, 0x400, 0xffffffff, 0x3}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) ioprio_set$pid(0x3, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x80}) io_uring_enter(r8, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newlink={0x58, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x115}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x4}]}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}, @IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x16}}]}, 0x58}, 0x1, 0x0, 0x0, 0x28001}, 0x8000002) kernel console output (not intermixed with test programs): nds beyond EOD, truncated [ 863.139566][T17811] Dev loop4: unable to read RDB block 7 [ 863.146231][T17811] loop4: AHDI p1 p2 [ 863.171104][T17811] loop4: partition table partially beyond EOD, truncated [ 863.181310][T17811] loop4: p1 size 4227858431 extends beyond EOD, truncated [ 863.202211][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 863.223228][ T24] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 863.240829][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 863.271137][ T24] usb 2-1: config 0 descriptor?? [ 863.284080][ T6038] udevd[6038]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 863.309631][ T10] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 863.317432][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 863.384439][ T10] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 863.402284][ T6038] udevd[6038]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 863.412245][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 863.433936][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 863.466320][ T10] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 863.475318][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 863.488087][ T10] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 863.498145][ T24] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 863.525683][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 863.542503][ T24] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 863.560389][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 863.569526][ T24] dib0700: firmware download failed at 7 with -22 [ 863.585286][ T10] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 863.595506][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 863.605790][ T24] usb 2-1: USB disconnect, device number 108 [ 863.617080][ T10] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 863.632582][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 863.644414][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 863.703575][ T10] usb 4-1: string descriptor 0 read error: -22 [ 863.711788][ T10] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 863.721267][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 863.767343][ T10] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 863.967722][ T10] usb 4-1: USB disconnect, device number 124 [ 864.068441][T11184] usb 5-1: USB disconnect, device number 103 [ 864.068467][ C1] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 864.089260][ C1] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 864.600649][ T30] audit: type=1326 audit(1760612898.105:1119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17830 comm="syz.1.3166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 864.653564][ T30] audit: type=1326 audit(1760612898.105:1120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17830 comm="syz.1.3166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 864.676092][ C1] vkms_vblank_simulate: vblank timer overrun [ 864.709252][ T30] audit: type=1326 audit(1760612898.105:1121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17830 comm="syz.1.3166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4b7df8d710 code=0x7ffc0000 [ 864.756025][ T30] audit: type=1326 audit(1760612898.105:1122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17830 comm="syz.1.3166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 864.778470][ C1] vkms_vblank_simulate: vblank timer overrun [ 864.811364][ T30] audit: type=1326 audit(1760612898.105:1123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17830 comm="syz.1.3166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 864.843974][ T30] audit: type=1326 audit(1760612898.105:1124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17830 comm="syz.1.3166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 864.869264][ T30] audit: type=1326 audit(1760612898.105:1125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17830 comm="syz.1.3166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 864.891607][ C1] vkms_vblank_simulate: vblank timer overrun [ 864.908523][ T30] audit: type=1326 audit(1760612898.105:1126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17830 comm="syz.1.3166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 864.933707][ T30] audit: type=1326 audit(1760612898.105:1127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17830 comm="syz.1.3166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 864.958143][ T30] audit: type=1326 audit(1760612898.105:1128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17830 comm="syz.1.3166" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 864.980835][T17845] binder: 17841:17845 ioctl 4018620d 0 returned -22 [ 865.028462][T17844] binder: 17841:17844 ioctl c018620c 0 returned -14 [ 865.996993][T17872] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 866.222744][T17877] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 866.445474][T17887] FAULT_INJECTION: forcing a failure. [ 866.445474][T17887] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 866.459364][T17887] CPU: 1 UID: 0 PID: 17887 Comm: syz.3.3182 Not tainted syzkaller #0 PREEMPT(full) [ 866.459383][T17887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 866.459390][T17887] Call Trace: [ 866.459395][T17887] [ 866.459401][T17887] dump_stack_lvl+0x189/0x250 [ 866.459417][T17887] ? __pfx____ratelimit+0x10/0x10 [ 866.459432][T17887] ? __pfx_dump_stack_lvl+0x10/0x10 [ 866.459452][T17887] ? __pfx__printk+0x10/0x10 [ 866.459469][T17887] should_fail_ex+0x414/0x560 [ 866.459487][T17887] _copy_to_user+0x31/0xb0 [ 866.459502][T17887] simple_read_from_buffer+0xe1/0x170 [ 866.459518][T17887] proc_fail_nth_read+0x1b3/0x220 [ 866.459534][T17887] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 866.459550][T17887] ? rw_verify_area+0x2a6/0x4d0 [ 866.459560][T17887] ? __lock_acquire+0xab9/0xd20 [ 866.459572][T17887] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 866.459587][T17887] vfs_read+0x200/0xa30 [ 866.459596][T17887] ? fdget_pos+0x247/0x320 [ 866.459615][T17887] ? __pfx___mutex_lock+0x10/0x10 [ 866.459627][T17887] ? __pfx_vfs_read+0x10/0x10 [ 866.459638][T17887] ? __fget_files+0x2a/0x420 [ 866.459652][T17887] ? __fget_files+0x3a0/0x420 [ 866.459662][T17887] ? __fget_files+0x2a/0x420 [ 866.459678][T17887] ksys_read+0x145/0x250 [ 866.459688][T17887] ? __fget_files+0x2a/0x420 [ 866.459700][T17887] ? __pfx_ksys_read+0x10/0x10 [ 866.459712][T17887] ? do_syscall_64+0xbe/0xfa0 [ 866.459724][T17887] do_syscall_64+0xfa/0xfa0 [ 866.459733][T17887] ? lockdep_hardirqs_on+0x9c/0x150 [ 866.459743][T17887] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 866.459753][T17887] ? clear_bhb_loop+0x60/0xb0 [ 866.459771][T17887] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 866.459781][T17887] RIP: 0033:0x7f1f77b8d8dc [ 866.459791][T17887] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 866.459800][T17887] RSP: 002b:00007f1f78b0b030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 866.459812][T17887] RAX: ffffffffffffffda RBX: 00007f1f77de5fa0 RCX: 00007f1f77b8d8dc [ 866.459819][T17887] RDX: 000000000000000f RSI: 00007f1f78b0b0a0 RDI: 0000000000000004 [ 866.459826][T17887] RBP: 00007f1f78b0b090 R08: 0000000000000000 R09: 0000000000000000 [ 866.459832][T17887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 866.459838][T17887] R13: 00007f1f77de6038 R14: 00007f1f77de5fa0 R15: 00007f1f77f0fa28 [ 866.459855][T17887] [ 866.706026][ C1] vkms_vblank_simulate: vblank timer overrun [ 867.896755][T17909] netlink: 11562 bytes leftover after parsing attributes in process `syz.3.3190'. [ 869.962140][T17939] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 869.976737][T17939] macvlan2: entered allmulticast mode [ 869.983114][T17939] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 870.086798][T17939] netdevsim netdevsim3 netdevsim0: left allmulticast mode [ 870.097603][T17939] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 870.197074][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.203570][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.909047][T17962] FAULT_INJECTION: forcing a failure. [ 870.909047][T17962] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 870.922585][T17962] CPU: 0 UID: 0 PID: 17962 Comm: syz.2.3203 Not tainted syzkaller #0 PREEMPT(full) [ 870.922611][T17962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 870.922621][T17962] Call Trace: [ 870.922629][T17962] [ 870.922638][T17962] dump_stack_lvl+0x189/0x250 [ 870.922662][T17962] ? __pfx____ratelimit+0x10/0x10 [ 870.922686][T17962] ? __pfx_dump_stack_lvl+0x10/0x10 [ 870.922702][T17962] ? __pfx__printk+0x10/0x10 [ 870.922732][T17962] should_fail_ex+0x414/0x560 [ 870.922761][T17962] _copy_to_user+0x31/0xb0 [ 870.922784][T17962] simple_read_from_buffer+0xe1/0x170 [ 870.922809][T17962] proc_fail_nth_read+0x1b3/0x220 [ 870.922835][T17962] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 870.922860][T17962] ? rw_verify_area+0x2a6/0x4d0 [ 870.922877][T17962] ? __lock_acquire+0xab9/0xd20 [ 870.922894][T17962] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 870.922922][T17962] vfs_read+0x200/0xa30 [ 870.922940][T17962] ? fdget_pos+0x247/0x320 [ 870.922966][T17962] ? __pfx___mutex_lock+0x10/0x10 [ 870.922995][T17962] ? __pfx_vfs_read+0x10/0x10 [ 870.923016][T17962] ? __fget_files+0x2a/0x420 [ 870.923042][T17962] ? __fget_files+0x3a0/0x420 [ 870.923063][T17962] ? __fget_files+0x2a/0x420 [ 870.923093][T17962] ksys_read+0x145/0x250 [ 870.923116][T17962] ? __pfx_ksys_read+0x10/0x10 [ 870.923140][T17962] ? do_syscall_64+0xbe/0xfa0 [ 870.923162][T17962] do_syscall_64+0xfa/0xfa0 [ 870.923177][T17962] ? lockdep_hardirqs_on+0x9c/0x150 [ 870.923195][T17962] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 870.923212][T17962] ? clear_bhb_loop+0x60/0xb0 [ 870.923233][T17962] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 870.923251][T17962] RIP: 0033:0x7f8e23b8d8dc [ 870.923268][T17962] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 870.923284][T17962] RSP: 002b:00007f8e24a17030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 870.923305][T17962] RAX: ffffffffffffffda RBX: 00007f8e23de6180 RCX: 00007f8e23b8d8dc [ 870.923319][T17962] RDX: 000000000000000f RSI: 00007f8e24a170a0 RDI: 0000000000000006 [ 870.923331][T17962] RBP: 00007f8e24a17090 R08: 0000000000000000 R09: 0000000000000000 [ 870.923343][T17962] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 870.923355][T17962] R13: 00007f8e23de6218 R14: 00007f8e23de6180 R15: 00007f8e23f0fa28 [ 870.923387][T17962] [ 871.163259][ C0] vkms_vblank_simulate: vblank timer overrun [ 871.438052][T17974] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3205'. [ 871.509792][ T5932] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 871.686380][ T5932] usb 5-1: config index 0 descriptor too short (expected 28277, got 36) [ 871.701183][ T5932] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 871.746091][ T5932] usb 5-1: config 0 has no interfaces? [ 871.762755][ T5932] usb 5-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 871.802111][ T5932] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 871.838954][ T5932] usb 5-1: config 0 descriptor?? [ 872.009248][T11403] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 872.179241][T11403] usb 2-1: Using ep0 maxpacket: 8 [ 872.279415][T11403] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 872.288144][T11403] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 872.311262][T11403] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 872.334834][T11403] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 872.365661][T11403] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 872.503726][T11403] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 872.555760][T11403] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 872.914578][T11403] usb 2-1: usb_control_msg returned -32 [ 872.936785][T11403] usbtmc 2-1:16.0: can't read capabilities [ 873.734519][T17987] usbtmc 2-1:16.0: usb_control_msg returned -32 [ 873.784883][T17975] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3205'. [ 873.797322][T17975] netlink: 'syz.1.3205': attribute type 5 has an invalid length. [ 873.808853][T17975] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3205'. [ 873.825392][T11403] usb 5-1: USB disconnect, device number 104 [ 873.869850][T17987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 873.886781][T17975] geneve2: entered promiscuous mode [ 873.893123][T17975] geneve2: entered allmulticast mode [ 873.902300][T13865] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 873.926484][T17987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 873.947254][T13865] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 873.988043][T13865] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 874.007553][T13865] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 874.799260][T11403] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 874.840415][T18008] misc userio: Invalid payload size [ 874.876865][T18008] misc userio: Invalid payload size [ 874.951320][T11403] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 874.965401][T11403] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 875.005104][T11403] usb 4-1: New USB device found, idVendor=0471, idProduct=0329, bcdDevice=db.da [ 875.064822][T11403] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 875.097380][T11403] usb 4-1: config 0 descriptor?? [ 875.607997][ T10] usb 2-1: USB disconnect, device number 109 [ 876.346533][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 876.346551][ T30] audit: type=1326 audit(1760612909.845:1144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18022 comm="syz.2.3217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 876.499222][ T30] audit: type=1326 audit(1760612909.845:1145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18022 comm="syz.2.3217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 876.559317][ T30] audit: type=1326 audit(1760612909.895:1146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18022 comm="syz.2.3217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 876.664455][ T30] audit: type=1326 audit(1760612909.895:1147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18022 comm="syz.2.3217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 876.782084][ T30] audit: type=1326 audit(1760612909.895:1148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18022 comm="syz.2.3217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 876.857407][ T30] audit: type=1326 audit(1760612909.895:1149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18022 comm="syz.2.3217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 876.916613][ T30] audit: type=1326 audit(1760612909.895:1150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18022 comm="syz.2.3217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 876.974417][ T30] audit: type=1326 audit(1760612909.895:1151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18022 comm="syz.2.3217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 877.087046][ T30] audit: type=1326 audit(1760612909.895:1152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18022 comm="syz.2.3217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 877.144356][ T30] audit: type=1326 audit(1760612909.895:1153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18022 comm="syz.2.3217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 877.312474][T18034] ip6gretap0: entered promiscuous mode [ 877.320629][T18034] vlan2: entered promiscuous mode [ 877.430490][T11403] usb 4-1: USB disconnect, device number 125 [ 878.088360][T18049] vlan2: entered promiscuous mode [ 879.189262][ T24] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 879.211794][T18060] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3224'. [ 879.399824][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 879.419339][T18060] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3224'. [ 879.545104][ T24] usb 1-1: config 0 interface 0 has no altsetting 0 [ 879.573024][ T24] usb 1-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 879.589247][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 879.606332][ T24] usb 1-1: Product: syz [ 879.617616][ T24] usb 1-1: Manufacturer: syz [ 879.626250][ T24] usb 1-1: SerialNumber: syz [ 879.690904][ T24] usb 1-1: config 0 descriptor?? [ 880.148082][ T24] gs_usb 1-1:0.0: Configuring for 1 interfaces [ 880.469488][ T10] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 880.651549][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 880.663682][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 880.681364][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 880.695147][ T10] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 880.709420][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 880.727233][ T10] usb 3-1: config 0 descriptor?? [ 881.164933][ T10] usbhid 3-1:0.0: can't add hid device: -71 [ 881.181302][ T10] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 881.200050][ T10] usb 3-1: USB disconnect, device number 118 [ 881.393433][ T24] gs_usb 1-1:0.0: Disabling termination support for channel 0 (-ETIMEDOUT) [ 881.878356][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 881.878372][ T30] audit: type=1804 audit(1760612915.375:1165): pid=18080 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.3229" name="/newroot/27/file1" dev="fuse" ino=1 res=1 errno=0 [ 881.909671][ T30] audit: type=1804 audit(1760612915.375:1166): pid=18080 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.3229" name="/newroot/27/file1" dev="fuse" ino=1 res=1 errno=0 [ 881.958247][ T24] usb 1-1: USB disconnect, device number 121 [ 882.760215][T18113] vlan3: entered promiscuous mode [ 882.765380][T18113] vlan3: entered allmulticast mode [ 882.808232][T18113] hsr_slave_1: entered allmulticast mode [ 883.279217][ T10] usb 2-1: new low-speed USB device number 110 using dummy_hcd [ 883.431058][ T10] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 883.439818][ T10] usb 2-1: config 0 has no interface number 0 [ 883.452858][ T10] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 883.513768][ T10] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 883.539774][ T10] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 883.559061][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 883.613267][ T10] usb 2-1: config 0 descriptor?? [ 883.642272][T18117] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 883.657411][ T10] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 883.933055][T18113] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3233'. [ 884.220118][T18113] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 884.230967][T18113] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 884.245002][ T10] usb 2-1: USB disconnect, device number 110 [ 884.429861][T11403] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 884.592647][T11403] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 884.602160][T11403] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 884.614758][T11403] usb 1-1: Product: syz [ 884.620110][T11403] usb 1-1: Manufacturer: syz [ 884.629921][T11403] usb 1-1: SerialNumber: syz [ 885.029310][ T5881] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 885.189260][ T5881] usb 3-1: Using ep0 maxpacket: 16 [ 885.201522][ T5881] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 192, changing to 11 [ 885.220634][ T5881] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 8 [ 885.237926][ T5881] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 885.266200][ T5881] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 885.285921][ T5881] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 885.301367][ T5881] usb 3-1: SerialNumber: syz [ 885.323010][T18149] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 885.572417][ T5881] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 885.615491][ T5881] usb 3-1: USB disconnect, device number 119 [ 886.098245][T11403] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 886.700870][T11403] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 886.776785][T11403] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 886.794228][T11403] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 886.804126][T11403] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 886.818239][T11403] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 886.831190][T11403] usb 1-1: USB disconnect, device number 122 [ 887.095671][T18184] loop4: detected capacity change from 0 to 7 [ 887.281980][ T6038] Dev loop4: unable to read RDB block 7 [ 887.371629][T18186] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3249'. [ 887.384805][ T6038] loop4: AHDI p1 p2 [ 887.413808][ T6038] loop4: partition table partially beyond EOD, truncated [ 887.569468][ T6038] loop4: p1 size 4227858431 extends beyond EOD, truncated [ 887.579738][T18192] loop2: detected capacity change from 0 to 7 [ 887.593909][ T5826] loop2: [ 887.596968][ T5826] loop2: partition table partially beyond EOD, truncated [ 887.646202][T18192] loop2: [ 887.646294][T18184] Dev loop4: unable to read RDB block 7 [ 887.649462][T18192] loop2: partition table partially beyond EOD, truncated [ 887.839856][T18184] loop4: AHDI p1 p2 [ 887.907844][T18184] loop4: partition table partially beyond EOD, truncated [ 888.028863][T18184] loop4: p1 size 4227858431 extends beyond EOD, truncated [ 888.216275][ T6038] udevd[6038]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 888.281220][ T6038] udevd[6038]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 888.298914][T18213] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3258'. [ 888.496426][T18219] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3261'. [ 888.999317][ T24] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 889.219641][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 889.273303][ T24] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 889.292554][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 889.341803][ T24] usb 5-1: config 0 descriptor?? [ 889.355314][ T30] audit: type=1326 audit(1760612922.855:1167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18242 comm="syz.1.3268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 889.454867][ T30] audit: type=1326 audit(1760612922.885:1168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18242 comm="syz.1.3268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 889.526380][ T30] audit: type=1326 audit(1760612922.885:1169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18242 comm="syz.1.3268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 889.556047][ T30] audit: type=1326 audit(1760612922.885:1170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18242 comm="syz.1.3268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 889.620811][ T30] audit: type=1326 audit(1760612922.885:1171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18242 comm="syz.1.3268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 889.644119][ T30] audit: type=1326 audit(1760612922.885:1172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18242 comm="syz.1.3268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 889.666989][ T30] audit: type=1326 audit(1760612922.885:1173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18242 comm="syz.1.3268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 889.714079][ T24] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 889.770003][ T24] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 889.812340][ T30] audit: type=1326 audit(1760612922.895:1174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18242 comm="syz.1.3268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 889.846440][ T30] audit: type=1326 audit(1760612922.895:1175): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18242 comm="syz.1.3268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 889.870083][ T30] audit: type=1326 audit(1760612922.895:1176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18242 comm="syz.1.3268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 889.892606][ C0] vkms_vblank_simulate: vblank timer overrun [ 889.981828][ T24] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 889.995323][ T24] usb 5-1: media controller created [ 890.032029][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 890.268102][T18257] vlan2: entered promiscuous mode [ 890.313120][ T24] DVB: Unable to find symbol dib7000p_attach() [ 890.319790][ T24] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 890.468691][T18229] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 890.585988][T18229] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 890.743202][ T24] rc_core: IR keymap rc-dib0700-rc5 not found [ 890.757227][ T24] Registered IR keymap rc-empty [ 890.773264][ T24] dvb-usb: could not initialize remote control. [ 890.798132][ T24] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 890.827113][ T24] usb 5-1: USB disconnect, device number 105 [ 891.024386][ T24] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 892.090049][T18285] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3278'. [ 893.419350][ T43] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 893.570709][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 893.583290][ T43] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 893.599299][ T43] usb 4-1: config 0 has no interface number 0 [ 893.608139][ T43] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 893.617864][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 893.626294][ T43] usb 4-1: Product: syz [ 893.631992][ T43] usb 4-1: Manufacturer: syz [ 893.636721][ T43] usb 4-1: SerialNumber: syz [ 893.645785][ T43] usb 4-1: config 0 descriptor?? [ 893.660643][ T43] smsc95xx v2.0.0 [ 894.146008][T18313] loop4: detected capacity change from 0 to 7 [ 894.174573][T18313] Dev loop4: unable to read RDB block 7 [ 894.180940][T18313] loop4: AHDI p1 p2 [ 894.185050][T18313] loop4: partition table partially beyond EOD, truncated [ 894.196871][T18313] loop4: p1 size 4227858431 extends beyond EOD, truncated [ 894.231070][ T43] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 894.301406][ T43] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 894.321706][ T43] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 894.338833][ T5826] udevd[5826]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 894.367970][ T43] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 894.416849][ T43] usb 4-1: USB disconnect, device number 126 [ 894.425215][T18315] netlink: 312 bytes leftover after parsing attributes in process `syz.2.3286'. [ 894.857258][T18322] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3288'. [ 894.979869][T18327] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3291'. [ 895.831608][T18351] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 895.933241][T18353] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3299'. [ 895.943822][T18353] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3299'. [ 895.989380][ T5909] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 896.139239][ T5909] usb 3-1: Using ep0 maxpacket: 32 [ 896.139364][ T43] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 896.158127][ T5909] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 896.167546][ T5909] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 896.177903][ T5909] usb 3-1: config 0 descriptor?? [ 896.257579][T18359] tipc: Started in network mode [ 896.265236][T18359] tipc: Node identity 86d2893940d2, cluster identity 4711 [ 896.273944][T18359] tipc: Enabled bearer , priority 0 [ 896.282391][T18359] syzkaller0: entered promiscuous mode [ 896.288313][T18359] syzkaller0: entered allmulticast mode [ 896.299239][ T43] usb 5-1: Using ep0 maxpacket: 32 [ 896.309641][ T43] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 896.328016][ T43] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 896.367609][ T43] usb 5-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 896.374599][T18359] tipc: Resetting bearer [ 896.394017][ T5909] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 896.416517][ T5909] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 896.425065][ T5909] dib0700: firmware download failed at 7 with -22 [ 896.529619][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 896.582519][ T5909] usb 3-1: USB disconnect, device number 120 [ 896.612703][ T43] usb 5-1: config 0 descriptor?? [ 896.629298][ T10] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 896.879210][ T10] usb 1-1: device descriptor read/64, error -71 [ 897.129218][ T10] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 897.269563][ T10] usb 1-1: device descriptor read/64, error -71 [ 897.468968][ T981] tipc: Node number set to 3321923897 [ 897.476825][ T10] usb usb1-port1: attempt power cycle [ 897.839452][ T10] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 897.920030][ T10] usb 1-1: device descriptor read/8, error -71 [ 898.171057][ T10] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 898.199902][ T10] usb 1-1: device descriptor read/8, error -71 [ 898.354238][ T10] usb usb1-port1: unable to enumerate USB device [ 898.649608][T18388] netlink: 312 bytes leftover after parsing attributes in process `syz.3.3308'. [ 898.759225][ T5909] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 898.911290][ T5909] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 898.954379][ T24] usb 5-1: USB disconnect, device number 106 [ 898.975216][ T5909] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 899.019261][ T5909] usb 2-1: New USB device found, idVendor=0471, idProduct=0329, bcdDevice=db.da [ 899.028355][ T5909] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 899.053770][ T5909] usb 2-1: config 0 descriptor?? [ 899.191574][ T30] kauditd_printk_skb: 29 callbacks suppressed [ 899.191591][ T30] audit: type=1326 audit(1760612932.695:1206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18389 comm="syz.4.3309" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 899.221444][ T30] audit: type=1326 audit(1760612932.725:1207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18389 comm="syz.4.3309" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 899.247694][ T30] audit: type=1326 audit(1760612932.755:1208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18389 comm="syz.4.3309" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 899.306509][T18358] tipc: Resetting bearer [ 899.316436][ T30] audit: type=1326 audit(1760612932.755:1209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18389 comm="syz.4.3309" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 899.344230][ T30] audit: type=1326 audit(1760612932.755:1210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18389 comm="syz.4.3309" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 899.415008][ T30] audit: type=1326 audit(1760612932.755:1211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18389 comm="syz.4.3309" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 899.442295][ T5909] usb 2-1: USB disconnect, device number 111 [ 899.449571][ T30] audit: type=1326 audit(1760612932.755:1212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18389 comm="syz.4.3309" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 899.472935][ T30] audit: type=1326 audit(1760612932.755:1213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18389 comm="syz.4.3309" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 899.496711][T18358] tipc: Disabling bearer [ 899.505406][ T30] audit: type=1326 audit(1760612932.755:1214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18389 comm="syz.4.3309" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 899.535489][ T30] audit: type=1326 audit(1760612932.755:1215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18389 comm="syz.4.3309" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 901.451828][T18427] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3316'. [ 903.253861][T18438] netlink: 312 bytes leftover after parsing attributes in process `syz.2.3320'. [ 903.371090][T18440] binder: 18439:18440 ioctl 4018620d 0 returned -22 [ 903.467355][T18446] binder: 18439:18446 ioctl c018620c 0 returned -14 [ 903.633681][T18450] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 904.639232][T11184] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 904.769288][T11184] usb 1-1: device descriptor read/64, error -71 [ 905.011610][T11184] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 905.091678][T18471] netlink: 208 bytes leftover after parsing attributes in process `syz.4.3325'. [ 905.149314][T11184] usb 1-1: device descriptor read/64, error -71 [ 905.259481][T11184] usb usb1-port1: attempt power cycle [ 905.599247][T11184] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 905.621968][T11184] usb 1-1: device descriptor read/8, error -71 [ 905.870172][T11184] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 905.899700][T11184] usb 1-1: device descriptor read/8, error -71 [ 906.005192][T18481] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 906.016156][T18480] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3329'. [ 906.020718][T11184] usb usb1-port1: unable to enumerate USB device [ 906.049742][T18480] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3329'. [ 906.469273][T11184] usb 5-1: new low-speed USB device number 107 using dummy_hcd [ 906.639796][T11184] usb 5-1: No LPM exit latency info found, disabling LPM. [ 906.694983][T11184] usb 5-1: string descriptor 0 read error: -22 [ 906.722121][T11184] usb 5-1: New USB device found, idVendor=1415, idProduct=0003, bcdDevice=65.5d [ 906.762168][T11184] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 906.795214][T11184] usb 5-1: config 0 descriptor?? [ 907.527250][T18499] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3330'. [ 907.730736][T18487] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 907.767382][T18500] netlink: 312 bytes leftover after parsing attributes in process `syz.0.3333'. [ 907.852567][T18487] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 907.955872][T11184] dvb-usb: found a 'Sony PlayTV' in cold state, will try to load a firmware [ 907.988549][T11184] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 908.018104][T11184] dib0700: firmware download failed at 7 with -22 [ 908.046152][T11184] usb 5-1: USB disconnect, device number 107 [ 908.422067][ T24] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 908.542582][T18513] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 908.621387][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 908.639891][ T24] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 908.719828][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 908.739572][ T24] usb 4-1: config 0 descriptor?? [ 908.951406][ T24] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 908.968097][ T24] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 908.990352][ T24] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 909.003831][ T24] usb 4-1: media controller created [ 909.094258][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 909.399337][ T24] DVB: Unable to find symbol dib7000p_attach() [ 909.437328][ T24] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 909.588186][T18504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 909.609231][ T24] rc_core: IR keymap rc-dib0700-rc5 not found [ 909.652944][ T24] Registered IR keymap rc-empty [ 909.658214][ T24] dvb-usb: could not initialize remote control. [ 909.669329][T18504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 909.714380][ T24] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 909.722744][T11184] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 909.742080][ T24] usb 4-1: USB disconnect, device number 127 [ 909.910621][ T24] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 909.969499][T11184] usb 5-1: Using ep0 maxpacket: 16 [ 910.015433][T11184] usb 5-1: config 0 has no interfaces? [ 910.070718][T11184] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 910.089339][T11184] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 910.111859][T11184] usb 5-1: Manufacturer: syz [ 910.137324][T11184] usb 5-1: config 0 descriptor?? [ 910.472716][ T24] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 910.504874][T18529] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 910.609249][T11184] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 910.628042][T18552] netlink: 'syz.3.3346': attribute type 8 has an invalid length. [ 910.647288][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 910.659676][ T24] usb 1-1: config 0 has an invalid interface number: 106 but max is 0 [ 910.670365][ T24] usb 1-1: config 0 has no interface number 0 [ 910.676778][ T24] usb 1-1: config 0 interface 106 has no altsetting 0 [ 910.690536][ T24] usb 1-1: New USB device found, idVendor=0421, idProduct=6901, bcdDevice=2d.1d [ 910.700113][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 910.708403][ T24] usb 1-1: Product: syz [ 910.713599][ T24] usb 1-1: Manufacturer: syz [ 910.718489][ T24] usb 1-1: SerialNumber: syz [ 910.731899][ T24] usb 1-1: config 0 descriptor?? [ 910.739902][ T24] cdc_phonet 1-1:0.106: probe with driver cdc_phonet failed with error -22 [ 910.749223][T11184] usb 2-1: device descriptor read/64, error -71 [ 911.010861][T11184] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 911.150330][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 911.151719][T11184] usb 2-1: device descriptor read/64, error -71 [ 911.269508][T11184] usb usb2-port1: attempt power cycle [ 911.511751][ T5909] usb 1-1: USB disconnect, device number 5 [ 911.619262][T11184] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 911.640708][T11184] usb 2-1: device descriptor read/8, error -71 [ 911.675830][T18570] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 911.889231][T11184] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 911.928848][T18576] netlink: 'syz.3.3353': attribute type 1 has an invalid length. [ 911.936911][T18576] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3353'. [ 912.015642][ T5909] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 912.043660][T11184] usb 2-1: device descriptor read/8, error -71 [ 912.183437][T11184] usb usb2-port1: unable to enumerate USB device [ 912.224091][ T5909] usb 1-1: unable to get BOS descriptor or descriptor too short [ 912.277749][ T5909] usb 1-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 912.301264][ T5909] usb 1-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 912.311992][ T5909] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 912.331455][ T5909] usb 1-1: Product: syz [ 912.346495][ T5909] usb 1-1: Manufacturer: syz [ 912.361653][ T5909] usb 1-1: SerialNumber: syz [ 912.617943][T11184] usb 5-1: USB disconnect, device number 108 [ 912.884399][T18576] syz.3.3353 (18576): drop_caches: 2 [ 913.362353][ T5909] usb 1-1: reset high-speed USB device number 6 using dummy_hcd [ 913.578577][T18599] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3364'. [ 913.598829][ T5909] usb 1-1: unable to get BOS descriptor or descriptor too short [ 913.603799][T13634] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 913.615578][T18599] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3364'. [ 913.637585][T13634] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 913.652004][T18601] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3365'. [ 913.668646][ T5909] usb 1-1: device firmware changed [ 913.702208][T18601] macsec1: entered allmulticast mode [ 913.711428][ T5909] usb 1-1: USB disconnect, device number 6 [ 913.718048][T18601] ip6gretap0: entered allmulticast mode [ 913.737448][T13634] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 913.785958][T13634] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 914.259259][ T24] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 914.419281][ T5909] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 914.441305][ T24] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 193, using maximum allowed: 30 [ 914.462720][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 193 [ 914.491974][ T24] usb 4-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 914.530618][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 914.566339][ T24] usb 4-1: config 0 descriptor?? [ 914.661951][ T5909] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 914.679272][ T5909] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 914.700828][ T5909] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 914.735148][ T5909] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 914.793705][ T5909] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 914.871798][ T5909] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 914.956119][ T5909] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 914.972256][ T5909] usb 3-1: Product: syz [ 914.976659][ T5909] usb 3-1: Manufacturer: syz [ 915.038320][ T24] magicmouse 0003:05AC:0269.0013: hidraw0: USB HID v11.da Device [HID 05ac:0269] on usb-dummy_hcd.3-1/input0 [ 915.042206][ T5909] cdc_wdm 3-1:1.0: skipping garbage [ 915.115944][ T5909] cdc_wdm 3-1:1.0: skipping garbage [ 915.156130][ T5909] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 915.206247][ T5909] cdc_wdm 3-1:1.0: Unknown control protocol [ 915.213585][ T24] usb 4-1: USB disconnect, device number 2 [ 915.304719][T18639] fido_id[18639]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 915.333167][T11184] usb 3-1: USB disconnect, device number 121 [ 915.524926][T18634] syz.4.3378 (18634): drop_caches: 2 [ 917.409244][T11403] usb 2-1: new full-speed USB device number 116 using dummy_hcd [ 917.619785][T11403] usb 2-1: unable to get BOS descriptor or descriptor too short [ 917.662230][T11403] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 917.688920][T11403] usb 2-1: can't read configurations, error -71 [ 917.879521][T18683] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3395'. [ 918.742100][ T43] IPVS: starting estimator thread 0... [ 918.748306][T18705] IPVS: fo: FWM 3 0x00000003 - no destination available [ 918.835887][T18706] IPVS: using max 49 ests per chain, 117600 per kthread [ 921.128735][T18735] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:248x16 (0x38415262, 8, 0, 0, 0) [ 923.194395][T18762] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3425'. [ 923.704987][T18772] netlink: 92 bytes leftover after parsing attributes in process `syz.3.3429'. [ 923.723454][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880726ddc00: rx timeout, send abort [ 924.233161][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880726ddc00: abort rx timeout. Force session deactivation [ 924.276117][T18786] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 924.404509][T18786] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 924.419643][T18786] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 925.266980][T18801] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 927.391666][ T30] kauditd_printk_skb: 28 callbacks suppressed [ 927.391686][ T30] audit: type=1326 audit(1760612960.895:1244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18825 comm="syz.0.3448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 927.420387][ C1] vkms_vblank_simulate: vblank timer overrun [ 927.500790][ T30] audit: type=1326 audit(1760612960.895:1245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18825 comm="syz.0.3448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 927.569693][ T30] audit: type=1326 audit(1760612960.895:1246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18825 comm="syz.0.3448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=99 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 927.699201][ T30] audit: type=1326 audit(1760612960.895:1247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18825 comm="syz.0.3448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 927.792772][ T30] audit: type=1326 audit(1760612960.895:1248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18825 comm="syz.0.3448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 927.906830][ T30] audit: type=1326 audit(1760612960.895:1249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18825 comm="syz.0.3448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=223 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 927.950260][ T30] audit: type=1326 audit(1760612960.895:1250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18825 comm="syz.0.3448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 928.070343][ T30] audit: type=1326 audit(1760612960.895:1251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18825 comm="syz.0.3448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 928.115222][ T30] audit: type=1326 audit(1760612960.895:1252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18825 comm="syz.0.3448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 928.137590][ C1] vkms_vblank_simulate: vblank timer overrun [ 928.180808][ T30] audit: type=1326 audit(1760612960.895:1253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18825 comm="syz.0.3448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 928.203347][ C1] vkms_vblank_simulate: vblank timer overrun [ 928.343654][T18856] netlink: 14 bytes leftover after parsing attributes in process `syz.3.3460'. [ 928.590309][ T5148] Bluetooth: hci5: command 0x0406 tx timeout [ 928.954926][T18856] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 928.972518][T18856] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 928.993070][T18856] bond0 (unregistering): Released all slaves [ 931.653054][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.660449][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 933.189669][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807aeb9c00: rx timeout, send abort [ 933.198027][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807aeba000: rx timeout, send abort [ 933.207113][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88807aeb9c00: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 933.223176][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88807aeba000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 933.537771][T16202] Bluetooth: hci1: Malformed HCI Event [ 933.879398][ T5888] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 934.093964][ T5888] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 934.117446][ T5888] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 934.145277][ T5888] usb 1-1: Product: syz [ 934.154864][ T5888] usb 1-1: Manufacturer: syz [ 934.167510][ T5888] usb 1-1: SerialNumber: syz [ 934.193367][ T5888] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 934.213128][T11184] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 934.441175][ C0] usb 1-1: ath9k_htc: invalid pkt_len (8008) [ 934.691617][ T24] usb 1-1: USB disconnect, device number 7 [ 934.902838][T18951] tipc: Failed to remove unknown binding: 66,1,1/0:3546315985/3546315986 [ 935.324488][T11184] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 935.339278][T11184] ath9k_htc: Failed to initialize the device [ 935.389504][ T24] usb 1-1: ath9k_htc: USB layer deinitialized [ 938.389532][T19022] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 938.439442][T11184] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 938.609760][T11184] usb 4-1: Using ep0 maxpacket: 8 [ 938.661900][T11184] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 938.879292][T11184] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 938.939174][T11184] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 938.948955][T11184] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 939.098302][T11184] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 939.191733][T11184] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 939.233002][T11184] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 939.918336][T19054] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 939.940801][T19054] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 939.996909][T19054] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 940.011193][T19054] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 940.033725][T19054] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 940.048983][T19054] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 940.120375][T19054] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 940.127684][T19054] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 940.200490][T19054] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 940.209227][T19054] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 940.334368][T11184] usb 4-1: USB disconnect, device number 3 [ 941.482814][T19081] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3544'. [ 941.568247][T19093] netlink: 'syz.4.3545': attribute type 4 has an invalid length. [ 941.824499][T19101] netlink: 'syz.0.3550': attribute type 4 has an invalid length. [ 941.876103][T19107] netlink: 'syz.0.3550': attribute type 4 has an invalid length. [ 944.729224][ T24] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 944.889333][T19172] netlink: 'syz.4.3574': attribute type 25 has an invalid length. [ 944.891226][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 944.920991][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 944.942950][ T24] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 944.969172][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 944.981169][ T24] usb 2-1: config 0 descriptor?? [ 945.217419][ T24] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 945.649276][ T5888] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 945.750753][ T24] usb 2-1: USB disconnect, device number 118 [ 945.799293][ T5888] usb 3-1: Using ep0 maxpacket: 16 [ 945.806566][ T5888] usb 3-1: config 28 has an invalid interface number: 169 but max is 0 [ 945.815914][ T5888] usb 3-1: config 28 has no interface number 0 [ 945.823251][ T5888] usb 3-1: config 28 interface 169 has no altsetting 0 [ 945.842418][ T5888] usb 3-1: string descriptor 0 read error: -71 [ 945.851587][ T5888] usb 3-1: New USB device found, idVendor=04e8, idProduct=a101, bcdDevice= 4.48 [ 945.869377][ T5888] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 945.883818][ T5888] r8152-cfgselector 3-1: Unknown version 0x0000 [ 945.896656][ T5888] r8152-cfgselector 3-1: rejected 1 configuration due to insufficient available bus power [ 945.911746][ T5888] r8152-cfgselector 3-1: no configuration chosen from 1 choice [ 945.930579][ T5888] r8152-cfgselector 3-1: USB disconnect, device number 122 [ 947.314049][T19231] netlink: 92 bytes leftover after parsing attributes in process `syz.0.3597'. [ 948.379287][ T24] usb 5-1: new full-speed USB device number 109 using dummy_hcd [ 948.668369][ T24] usb 5-1: unable to get BOS descriptor or descriptor too short [ 948.785727][ T24] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 948.809183][T11403] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 948.884265][ T24] usb 5-1: can't read configurations, error -71 [ 949.003294][T19275] netlink: 92 bytes leftover after parsing attributes in process `syz.3.3610'. [ 949.039280][T11403] usb 2-1: Using ep0 maxpacket: 32 [ 949.056480][T11403] usb 2-1: too many endpoints for config 0 interface 0 altsetting 64: 255, using maximum allowed: 30 [ 949.109404][T11403] usb 2-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 108, changing to 10 [ 949.144624][T11403] usb 2-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 949.172968][T11403] usb 2-1: config 0 interface 0 altsetting 64 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 949.236945][T11403] usb 2-1: config 0 interface 0 has no altsetting 0 [ 949.275526][T11403] usb 2-1: New USB device found, idVendor=172f, idProduct=0038, bcdDevice= 0.00 [ 949.309269][T11403] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 949.348065][T19281] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3613'. [ 949.358535][T11403] usb 2-1: config 0 descriptor?? [ 949.616632][T19270] netlink: 112 bytes leftover after parsing attributes in process `syz.1.3609'. [ 950.534294][T19308] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3620'. [ 951.257658][T19316] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 951.654361][T11403] usbhid 2-1:0.0: can't add hid device: -71 [ 951.660798][T11403] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 951.699514][T11403] usb 2-1: USB disconnect, device number 119 [ 951.739187][T11184] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 952.130055][T11184] usb 1-1: unable to get BOS descriptor or descriptor too short [ 952.150846][T11184] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 952.158474][T11184] usb 1-1: can't read configurations, error -71 [ 952.868925][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 952.868942][ T30] audit: type=1326 audit(1760612986.365:1259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19342 comm="syz.0.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 952.947336][ T30] audit: type=1326 audit(1760612986.405:1260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19342 comm="syz.0.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 953.033033][ T30] audit: type=1326 audit(1760612986.405:1261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19342 comm="syz.0.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 953.098695][ T30] audit: type=1326 audit(1760612986.405:1262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19342 comm="syz.0.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 953.159286][ T30] audit: type=1326 audit(1760612986.405:1263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19342 comm="syz.0.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 953.214216][ T30] audit: type=1326 audit(1760612986.405:1264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19342 comm="syz.0.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 953.272356][ T30] audit: type=1326 audit(1760612986.405:1265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19342 comm="syz.0.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 953.353892][ T30] audit: type=1326 audit(1760612986.405:1266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19342 comm="syz.0.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 953.417427][ T30] audit: type=1326 audit(1760612986.405:1267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19342 comm="syz.0.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 953.476528][ T30] audit: type=1326 audit(1760612986.405:1268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19342 comm="syz.0.3633" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb276b8eec9 code=0x7ffc0000 [ 956.939499][ T10] usb 5-1: new full-speed USB device number 111 using dummy_hcd [ 957.066877][T19417] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 957.241637][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 957.276195][ T10] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 957.329895][ T10] usb 5-1: can't read configurations, error -71 [ 957.530367][T11184] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 957.739486][T11184] usb 2-1: Using ep0 maxpacket: 32 [ 957.747559][T11184] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 957.787182][T11184] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 957.816751][T11184] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 957.848589][T11184] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 957.953417][T11184] usb 2-1: config 0 descriptor?? [ 959.409285][T11184] usb 5-1: new full-speed USB device number 113 using dummy_hcd [ 959.460845][T19463] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3675'. [ 959.481536][T19463] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3675'. [ 959.523617][T19463] macsec1: entered allmulticast mode [ 959.570204][T19463] macvlan0: entered allmulticast mode [ 959.591845][T19463] veth1_vlan: entered allmulticast mode [ 959.741946][T11184] usb 5-1: unable to get BOS descriptor or descriptor too short [ 959.756203][T11184] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 959.764069][T11184] usb 5-1: can't read configurations, error -71 [ 960.042375][ T24] usb 2-1: USB disconnect, device number 120 [ 960.371264][T19482] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 960.557947][T19489] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 961.669295][T11184] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 961.821673][T11184] usb 1-1: unable to get BOS descriptor or descriptor too short [ 961.863056][T11184] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 961.884614][T11184] usb 1-1: can't read configurations, error -71 [ 961.983303][T19516] loop2: detected capacity change from 0 to 7 [ 962.009422][T19516] Dev loop2: unable to read RDB block 7 [ 962.035576][T19516] loop2: unable to read partition table [ 962.046236][T19516] loop2: partition table beyond EOD, truncated [ 962.054219][T19516] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 962.280482][T19525] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 962.356252][T19529] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 962.817894][T19537] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 963.821511][T19559] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 964.039953][ T24] usb 2-1: new full-speed USB device number 121 using dummy_hcd [ 964.192717][ T24] usb 2-1: unable to get BOS descriptor or descriptor too short [ 964.206376][ T24] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 964.215155][ T24] usb 2-1: can't read configurations, error -71 [ 965.449429][ T24] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 965.462392][T19592] vlan2: entered promiscuous mode [ 965.619201][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 965.638285][ T24] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 965.658627][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 965.679672][ T24] usb 2-1: config 0 descriptor?? [ 965.942031][ T24] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 965.960529][T19580] netlink: 'syz.1.3717': attribute type 1 has an invalid length. [ 966.002877][ T24] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 966.101913][ T24] dib0700: firmware download failed at 7 with -22 [ 966.159898][ T24] usb 2-1: USB disconnect, device number 123 [ 966.569407][ T43] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 966.733890][ T43] usb 1-1: unable to get BOS descriptor or descriptor too short [ 966.750911][ T43] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 966.783390][ T43] usb 1-1: can't read configurations, error -71 [ 967.063683][T19610] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 967.249861][ T5909] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 967.482385][ T5909] usb 5-1: Using ep0 maxpacket: 32 [ 967.491313][ T5909] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 967.508818][ T5909] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 967.522694][ T5909] usb 5-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 967.534805][ T5909] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 967.551225][ T5909] usb 5-1: config 0 descriptor?? [ 968.416511][T19646] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 969.046683][T19655] vlan2: entered promiscuous mode [ 969.669307][ T24] usb 2-1: new full-speed USB device number 124 using dummy_hcd [ 969.861944][ T24] usb 2-1: unable to get BOS descriptor or descriptor too short [ 969.911982][ T24] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 969.920190][ T24] usb 2-1: can't read configurations, error -71 [ 970.098278][T19674] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 970.368356][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 970.368369][ T30] audit: type=1326 audit(1760613003.865:1284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19677 comm="syz.2.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 970.508779][ T30] audit: type=1326 audit(1760613003.925:1285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19677 comm="syz.2.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 970.592860][ T30] audit: type=1326 audit(1760613003.925:1286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19677 comm="syz.2.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 970.662812][ T30] audit: type=1326 audit(1760613003.935:1287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19677 comm="syz.2.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 970.720913][ T30] audit: type=1326 audit(1760613003.945:1288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19677 comm="syz.2.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 970.812918][ T30] audit: type=1326 audit(1760613003.945:1289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19677 comm="syz.2.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 970.886371][ T30] audit: type=1326 audit(1760613003.945:1290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19677 comm="syz.2.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 970.908807][ C1] vkms_vblank_simulate: vblank timer overrun [ 970.970841][ T5881] usb 5-1: USB disconnect, device number 115 [ 971.039176][ T30] audit: type=1326 audit(1760613003.945:1291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19677 comm="syz.2.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 971.238178][ T30] audit: type=1326 audit(1760613003.945:1292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19677 comm="syz.2.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 971.317470][ T30] audit: type=1326 audit(1760613003.945:1293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19677 comm="syz.2.3752" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e23b8eec9 code=0x7ffc0000 [ 971.986990][T19701] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 972.395140][T19706] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 973.400015][ T10] usb 3-1: new full-speed USB device number 123 using dummy_hcd [ 973.603387][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 973.616289][ T10] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 973.624668][ T10] usb 3-1: can't read configurations, error -71 [ 974.155387][T19731] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 974.179452][T11184] usb 5-1: new low-speed USB device number 116 using dummy_hcd [ 974.361998][T11184] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 974.385241][T11184] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 974.437181][T11184] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 974.497416][T11184] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 974.559438][T11184] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 974.654031][T11184] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 974.666408][T11184] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 974.690987][T11184] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 974.718294][T11184] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 974.769648][T11184] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 974.855181][T11184] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 974.884074][T11184] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 974.956718][T11184] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 975.061111][T11184] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 975.150833][T11184] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 975.224866][T11184] usb 5-1: string descriptor 0 read error: -22 [ 975.240904][T11184] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 975.261650][T11184] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.319723][T11184] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 975.511427][T11184] usb 5-1: USB disconnect, device number 116 [ 976.287480][T19763] netlink: 'syz.1.3775': attribute type 30 has an invalid length. [ 976.345249][T19763] bond1: option arp_missed_max: mode dependency failed, not supported in mode balance-alb(6) [ 976.364356][T19763] bond1 (unregistering): Released all slaves [ 976.395618][T19778] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 976.504026][ T30] kauditd_printk_skb: 24 callbacks suppressed [ 976.504044][ T30] audit: type=1326 audit(1760613010.005:1318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19776 comm="syz.4.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 976.541362][ T30] audit: type=1326 audit(1760613010.045:1319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19776 comm="syz.4.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 976.567850][ T30] audit: type=1326 audit(1760613010.045:1320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19776 comm="syz.4.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 976.603896][ T30] audit: type=1326 audit(1760613010.045:1321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19776 comm="syz.4.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 976.626996][ T30] audit: type=1326 audit(1760613010.045:1322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19776 comm="syz.4.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 976.629188][ T24] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 976.650532][ T30] audit: type=1326 audit(1760613010.045:1323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19776 comm="syz.4.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 976.685709][ T30] audit: type=1326 audit(1760613010.045:1324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19776 comm="syz.4.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 976.711796][ T30] audit: type=1326 audit(1760613010.185:1325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19776 comm="syz.4.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 976.735609][ T30] audit: type=1326 audit(1760613010.185:1326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19776 comm="syz.4.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 976.763632][ T30] audit: type=1326 audit(1760613010.185:1327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19776 comm="syz.4.3779" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f002d58eec9 code=0x7ffc0000 [ 976.842902][ T24] usb 1-1: unable to get BOS descriptor or descriptor too short [ 976.874530][ T24] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 976.883170][ T24] usb 1-1: can't read configurations, error -71 [ 977.324067][T19805] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3790'. [ 977.702011][ T10] usb 4-1: new low-speed USB device number 4 using dummy_hcd [ 977.714508][T19820] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 977.871267][ T10] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 977.879026][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 977.956434][ T10] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 977.999361][ T43] usb 3-1: new high-speed USB device number 125 using dummy_hcd [ 978.023582][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 978.088321][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 978.131392][ T10] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 978.139567][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 978.187502][ T10] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 978.229227][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 978.273313][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 978.300641][ T10] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 978.308382][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 978.330314][ T10] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 978.349414][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 978.389253][T11184] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 978.397383][ T10] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 978.432714][ T10] usb 4-1: string descriptor 0 read error: -22 [ 978.439774][ T10] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 978.448837][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 978.498672][ T10] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 978.539152][T11184] usb 1-1: device descriptor read/64, error -71 [ 978.739225][ T43] usb 3-1: Using ep0 maxpacket: 32 [ 978.769351][ T43] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 978.779563][ T43] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 978.788558][ T43] usb 3-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 978.789290][T11184] usb 1-1: new full-speed USB device number 17 using dummy_hcd [ 978.807323][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 978.900538][ T43] usb 3-1: config 0 descriptor?? [ 978.939199][T11184] usb 1-1: device descriptor read/64, error -71 [ 979.014133][T19829] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3797'. [ 979.059608][T11184] usb usb1-port1: attempt power cycle [ 979.316322][T19839] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3801'. [ 979.419528][T11184] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 979.439872][T11184] usb 1-1: device descriptor read/8, error -71 [ 979.630421][ T10] usb 5-1: new full-speed USB device number 117 using dummy_hcd [ 979.699835][T11184] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 979.731226][T11184] usb 1-1: device descriptor read/8, error -71 [ 979.782157][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 979.795893][ T10] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 979.804317][ T10] usb 5-1: can't read configurations, error -71 [ 979.840981][T11184] usb usb1-port1: unable to enumerate USB device [ 980.217522][T11184] usb 4-1: USB disconnect, device number 4 [ 980.446190][T19861] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3812'. [ 980.478541][T19862] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 980.959199][ T43] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 981.114899][ T43] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 981.127310][ T43] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 981.138492][ T43] usb 2-1: New USB device found, idVendor=0471, idProduct=0329, bcdDevice=db.da [ 981.148068][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 981.172440][ T43] usb 2-1: config 0 descriptor?? [ 981.839227][ T24] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 981.949328][ T43] usb 1-1: new low-speed USB device number 20 using dummy_hcd [ 981.999261][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 982.005846][ T24] usb 4-1: too many configurations: 245, using maximum allowed: 8 [ 982.022054][ T24] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 982.035572][ T24] usb 4-1: can't read configurations, error -61 [ 982.090622][ T10] usb 3-1: USB disconnect, device number 125 [ 982.111636][ T43] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 982.120114][ T43] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 982.130887][ T43] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 982.143412][ T43] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 982.155925][ T43] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 982.168883][ T43] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 982.176759][ T43] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 982.187612][ T24] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 982.198626][ T43] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 982.210661][ T43] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 982.222000][ T43] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 982.235267][ T43] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 982.243988][ T43] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 982.254815][ T43] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 982.266874][ T43] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 982.278869][ T43] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 982.294974][ T43] usb 1-1: string descriptor 0 read error: -22 [ 982.301668][ T43] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 982.310905][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 982.332106][ T43] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 982.379327][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 982.385451][ T24] usb 4-1: too many configurations: 245, using maximum allowed: 8 [ 982.394943][ T24] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 982.402602][ T24] usb 4-1: can't read configurations, error -61 [ 982.409211][ T24] usb usb4-port1: attempt power cycle [ 982.551098][T19892] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3821'. [ 982.679326][ T43] usb 3-1: new full-speed USB device number 126 using dummy_hcd [ 982.749315][ T24] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 982.769770][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 982.775341][ T24] usb 4-1: too many configurations: 245, using maximum allowed: 8 [ 982.786550][ T24] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 982.794333][ T24] usb 4-1: can't read configurations, error -61 [ 982.833446][ T43] usb 3-1: unable to get BOS descriptor or descriptor too short [ 982.843807][ T43] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 982.851508][ T43] usb 3-1: can't read configurations, error -71 [ 982.869480][T11403] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 982.929270][ T24] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 982.949864][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 982.955523][ T24] usb 4-1: too many configurations: 245, using maximum allowed: 8 [ 982.965636][ T24] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 982.974417][ T24] usb 4-1: can't read configurations, error -61 [ 982.981200][ T24] usb usb4-port1: unable to enumerate USB device [ 983.019185][T11403] usb 5-1: Using ep0 maxpacket: 32 [ 983.027026][T11403] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 983.035301][T11403] usb 5-1: config 0 has no interface number 0 [ 983.044023][T11403] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 983.053285][T11403] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 983.061363][T11403] usb 5-1: Product: syz [ 983.066171][T11403] usb 5-1: Manufacturer: syz [ 983.071001][T11403] usb 5-1: SerialNumber: syz [ 983.077517][T11403] usb 5-1: config 0 descriptor?? [ 983.087325][T11403] smsc95xx v2.0.0 [ 983.719581][ T5888] usb 2-1: USB disconnect, device number 126 [ 983.820773][T11403] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 983.832524][T11403] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 983.852451][T11403] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 983.864435][T11403] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 983.878097][T11403] usb 5-1: USB disconnect, device number 119 [ 984.109530][ T5888] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 984.289241][ T5888] usb 2-1: Using ep0 maxpacket: 32 [ 984.296218][ T5888] usb 2-1: too many endpoints for config 0 interface 0 altsetting 64: 255, using maximum allowed: 30 [ 984.309700][ T5888] usb 2-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 108, changing to 10 [ 984.321936][ T5888] usb 2-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 984.332053][ T5888] usb 2-1: config 0 interface 0 altsetting 64 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 984.345392][ T5888] usb 2-1: config 0 interface 0 has no altsetting 0 [ 984.352549][ T5888] usb 2-1: New USB device found, idVendor=172f, idProduct=0038, bcdDevice= 0.00 [ 984.365393][ T5888] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 984.384360][ T5888] usb 2-1: config 0 descriptor?? [ 984.441091][ T10] usb 1-1: USB disconnect, device number 20 [ 984.623565][T19905] netlink: 112 bytes leftover after parsing attributes in process `syz.1.3826'. [ 984.847034][T19929] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 985.189313][T11403] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 985.399175][T11403] usb 3-1: Using ep0 maxpacket: 32 [ 985.408593][T11403] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 985.420968][T11403] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 985.432006][T11403] usb 3-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 985.446523][T11403] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 985.510470][T11403] usb 3-1: config 0 descriptor?? [ 986.285072][T19941] FAULT_INJECTION: forcing a failure. [ 986.285072][T19941] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 986.315777][T19941] CPU: 1 UID: 0 PID: 19941 Comm: syz.0.3836 Not tainted syzkaller #0 PREEMPT(full) [ 986.315805][T19941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 986.315816][T19941] Call Trace: [ 986.315825][T19941] [ 986.315835][T19941] dump_stack_lvl+0x189/0x250 [ 986.315855][T19941] ? __pfx____ratelimit+0x10/0x10 [ 986.315871][T19941] ? __pfx_dump_stack_lvl+0x10/0x10 [ 986.315888][T19941] ? __pfx__printk+0x10/0x10 [ 986.315917][T19941] should_fail_ex+0x414/0x560 [ 986.315949][T19941] _copy_to_user+0x31/0xb0 [ 986.315974][T19941] simple_read_from_buffer+0xe1/0x170 [ 986.315991][T19941] proc_fail_nth_read+0x1b3/0x220 [ 986.316007][T19941] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 986.316022][T19941] ? rw_verify_area+0x2a6/0x4d0 [ 986.316037][T19941] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 986.316070][T19941] vfs_read+0x200/0xa30 [ 986.316089][T19941] ? __pfx_aa_sk_perm+0x10/0x10 [ 986.316113][T19941] ? __pfx_vfs_read+0x10/0x10 [ 986.316129][T19941] ? bpf_lsm_socket_connect+0x9/0x20 [ 986.316144][T19941] ? __sys_connect+0x339/0x440 [ 986.316158][T19941] ? do_sys_openat2+0x154/0x1c0 [ 986.316171][T19941] ? __pfx___sys_connect+0x10/0x10 [ 986.316192][T19941] ksys_read+0x145/0x250 [ 986.316214][T19941] ? __pfx_ksys_read+0x10/0x10 [ 986.316237][T19941] ? do_syscall_64+0xbe/0xfa0 [ 986.316258][T19941] do_syscall_64+0xfa/0xfa0 [ 986.316275][T19941] ? lockdep_hardirqs_on+0x9c/0x150 [ 986.316285][T19941] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 986.316295][T19941] ? clear_bhb_loop+0x60/0xb0 [ 986.316307][T19941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 986.316319][T19941] RIP: 0033:0x7fb276b8d8dc [ 986.316331][T19941] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 986.316346][T19941] RSP: 002b:00007fb277a52030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 986.316365][T19941] RAX: ffffffffffffffda RBX: 00007fb276de5fa0 RCX: 00007fb276b8d8dc [ 986.316378][T19941] RDX: 000000000000000f RSI: 00007fb277a520a0 RDI: 0000000000000004 [ 986.316389][T19941] RBP: 00007fb277a52090 R08: 0000000000000000 R09: 0000000000000000 [ 986.316400][T19941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 986.316410][T19941] R13: 00007fb276de6038 R14: 00007fb276de5fa0 R15: 00007fb276f0fa28 [ 986.316438][T19941] [ 986.548211][ C1] vkms_vblank_simulate: vblank timer overrun [ 986.810778][T19944] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 986.981902][ T5888] usbhid 2-1:0.0: can't add hid device: -71 [ 986.988787][ T5888] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 987.024432][ T5888] usb 2-1: USB disconnect, device number 127 [ 987.858017][T11403] usb 3-1: USB disconnect, device number 2 [ 988.324097][T19973] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3844'. [ 988.357408][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 988.357424][ T30] audit: type=1326 audit(1760613021.855:1333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19968 comm="syz.3.3845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f77b8eec9 code=0x7ffc0000 [ 988.421843][ T30] audit: type=1326 audit(1760613021.895:1334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19968 comm="syz.3.3845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=25 compat=0 ip=0x7f1f77b8eec9 code=0x7ffc0000 [ 988.444796][ T30] audit: type=1326 audit(1760613021.895:1335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19968 comm="syz.3.3845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f77b8eec9 code=0x7ffc0000 [ 988.468532][T19977] qrtr: Invalid version 195 [ 988.507813][ T30] audit: type=1326 audit(1760613021.895:1336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19968 comm="syz.3.3845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f77b8eec9 code=0x7ffc0000 [ 988.532156][ T30] audit: type=1326 audit(1760613021.985:1337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19968 comm="syz.3.3845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f1f77b8eec9 code=0x7ffc0000 [ 988.558851][ T30] audit: type=1326 audit(1760613021.985:1338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19968 comm="syz.3.3845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f77b8eec9 code=0x7ffc0000 [ 988.598602][ T30] audit: type=1326 audit(1760613021.985:1339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19968 comm="syz.3.3845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f77b8eec9 code=0x7ffc0000 [ 988.656444][ T30] audit: type=1326 audit(1760613021.985:1340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19968 comm="syz.3.3845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f1f77b8eec9 code=0x7ffc0000 [ 988.694159][ T30] audit: type=1326 audit(1760613021.985:1341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19968 comm="syz.3.3845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1f77b8eec9 code=0x7ffc0000 [ 988.721420][ T30] audit: type=1326 audit(1760613021.985:1342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19968 comm="syz.3.3845" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f1f77b8eec9 code=0x7ffc0000 [ 989.023674][T19997] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 989.040719][T19996] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 990.219740][ T43] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 990.416656][ T43] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 990.450687][ T43] usb 1-1: New USB device found, idVendor=17ef, idProduct=60a3, bcdDevice= 0.00 [ 990.479607][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 990.508591][ T43] usb 1-1: config 0 descriptor?? [ 991.018278][ T43] lenovo 0003:17EF:60A3.0014: hidraw0: USB HID v0.00 Device [HID 17ef:60a3] on usb-dummy_hcd.0-1/input0 [ 991.341734][ T43] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 991.499175][ T43] usb 2-1: Using ep0 maxpacket: 16 [ 991.514450][ T43] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 16 [ 991.531000][ T43] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024 [ 991.556386][ T43] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 991.567475][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 991.575870][ T43] usb 2-1: Product: 㿣ꍝ䬏線嶜﬷퀫븸켒㔾ს㾣௡﬒౗霵鵲咾癒踸ృ멡ȣ圛⿿㽜䊭㣶Ʈꕪ뇢쿝酀杀컾⮝ꏽꖳ⊅꧕轔縌꣪蒈ൡ淿鴨鵶ᜣ❭豂㩭衖晱诫蚐љ [ 991.623515][ T43] usb 2-1: Manufacturer: 敿 [ 991.631437][ T43] usb 2-1: SerialNumber: Ⲵオꕁ䕰帛驸Վꆩ [ 992.075672][ T43] cdc_ncm 2-1:1.0: bind() failure [ 992.276526][T20043] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 992.294916][ T43] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 992.299565][T20043] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 992.415785][ T43] cdc_ncm 2-1:1.1: bind() failure [ 992.436707][T20043] netlink: 'syz.0.3858': attribute type 2 has an invalid length. [ 992.509275][ T43] usb 2-1: USB disconnect, device number 2 [ 993.073620][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.080083][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.156308][T20056] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3872'. [ 993.165748][T20056] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3872'. [ 993.476574][T20062] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 993.679333][T11184] usb 1-1: USB disconnect, device number 21 [ 994.309377][ T43] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 994.659150][ T43] usb 1-1: Using ep0 maxpacket: 16 [ 994.679569][ T5932] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 994.759632][ T43] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 17408, setting to 1024 [ 994.770927][ T43] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1024 [ 994.783373][ T43] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 994.819151][ T43] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 994.889313][ T5932] usb 5-1: device descriptor read/64, error -71 [ 994.899156][ T43] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 994.962290][ T43] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 994.990247][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 995.079699][ T43] usb 1-1: SerialNumber: syz [ 995.089360][T20074] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 995.096695][T20074] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 995.140069][ T5932] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 995.243702][T20086] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 995.279318][ T5932] usb 5-1: device descriptor read/64, error -71 [ 995.361777][ T43] usb 1-1: USB disconnect, device number 22 [ 995.395197][ T5932] usb usb5-port1: attempt power cycle [ 995.739242][ T5932] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 995.773322][ T5932] usb 5-1: device descriptor read/8, error -71 [ 996.105050][ T5932] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 996.139730][ T5932] usb 5-1: device descriptor read/8, error -71 [ 996.269765][ T5932] usb usb5-port1: unable to enumerate USB device [ 997.892149][T20143] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 998.085592][T20147] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 998.819604][ T5148] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 998.832480][ T5148] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 998.842730][ T5148] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 998.864620][ T5148] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 998.899325][ T5148] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 998.919323][T16202] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 998.929364][T16202] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 998.967745][T16202] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 998.999610][T16202] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 999.007229][T16202] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 999.179323][T20151] vlan2: entered promiscuous mode [ 999.995318][T20178] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1000.545316][T20154] chnl_net:caif_netlink_parms(): no params data found [ 1001.078378][ T5148] Bluetooth: hci2: command tx timeout [ 1001.172479][T14001] syz_tun (unregistering): left allmulticast mode [ 1001.266952][T20189] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1001.398216][T20200] FAULT_INJECTION: forcing a failure. [ 1001.398216][T20200] name failslab, interval 1, probability 0, space 0, times 0 [ 1001.411315][T20200] CPU: 0 UID: 0 PID: 20200 Comm: syz.1.3916 Not tainted syzkaller #0 PREEMPT(full) [ 1001.411338][T20200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1001.411345][T20200] Call Trace: [ 1001.411350][T20200] [ 1001.411355][T20200] dump_stack_lvl+0x189/0x250 [ 1001.411372][T20200] ? __pfx____ratelimit+0x10/0x10 [ 1001.411387][T20200] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1001.411397][T20200] ? __pfx__printk+0x10/0x10 [ 1001.411411][T20200] ? __pfx___might_resched+0x10/0x10 [ 1001.411427][T20200] should_fail_ex+0x414/0x560 [ 1001.411445][T20200] should_failslab+0xa8/0x100 [ 1001.411459][T20200] __kmalloc_noprof+0xcb/0x7f0 [ 1001.411469][T20200] ? kfree+0x4d/0x6d0 [ 1001.411477][T20200] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1001.411493][T20200] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1001.411505][T20200] ? tomoyo_domain+0xd9/0x130 [ 1001.411519][T20200] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1001.411533][T20200] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1001.411549][T20200] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1001.411582][T20200] ? __fget_files+0x2a/0x420 [ 1001.411597][T20200] ? __fget_files+0x3a0/0x420 [ 1001.411608][T20200] ? __fget_files+0x2a/0x420 [ 1001.411621][T20200] security_file_ioctl+0xcb/0x2d0 [ 1001.411636][T20200] __se_sys_ioctl+0x47/0x170 [ 1001.411647][T20200] do_syscall_64+0xfa/0xfa0 [ 1001.411657][T20200] ? lockdep_hardirqs_on+0x9c/0x150 [ 1001.411667][T20200] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1001.411677][T20200] ? clear_bhb_loop+0x60/0xb0 [ 1001.411689][T20200] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1001.411699][T20200] RIP: 0033:0x7f4b7df8eec9 [ 1001.411711][T20200] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1001.411720][T20200] RSP: 002b:00007f4b7eec3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1001.411739][T20200] RAX: ffffffffffffffda RBX: 00007f4b7e1e5fa0 RCX: 00007f4b7df8eec9 [ 1001.411747][T20200] RDX: 0000200000000280 RSI: 00000000c0046686 RDI: 0000000000000003 [ 1001.411754][T20200] RBP: 00007f4b7eec3090 R08: 0000000000000000 R09: 0000000000000000 [ 1001.411760][T20200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1001.411766][T20200] R13: 00007f4b7e1e6038 R14: 00007f4b7e1e5fa0 R15: 00007f4b7e30fa28 [ 1001.411783][T20200] [ 1001.411789][T20200] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1001.880320][T13634] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1002.015636][T20212] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1002.103422][T13634] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1002.533210][T13634] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1002.567159][T13634] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1002.723898][T20154] bridge0: port 1(bridge_slave_0) entered blocking state [ 1002.742371][T20154] bridge0: port 1(bridge_slave_0) entered disabled state [ 1002.780012][T20154] bridge_slave_0: entered allmulticast mode [ 1002.797722][T20154] bridge_slave_0: entered promiscuous mode [ 1002.809308][ T5888] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 1002.835221][T13634] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1002.846457][T13634] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1002.861482][T20154] bridge0: port 2(bridge_slave_1) entered blocking state [ 1002.868778][T20154] bridge0: port 2(bridge_slave_1) entered disabled state [ 1002.876330][T20154] bridge_slave_1: entered allmulticast mode [ 1002.883985][T20154] bridge_slave_1: entered promiscuous mode [ 1002.941181][T13634] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1002.952941][T13634] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1002.982304][T20154] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1002.998189][T20154] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1003.075902][T20154] team0: Port device team_slave_0 added [ 1003.114505][T20154] team0: Port device team_slave_1 added [ 1003.149428][ T5148] Bluetooth: hci2: command tx timeout [ 1003.209198][ T5888] usb 1-1: Using ep0 maxpacket: 32 [ 1003.216483][ T5888] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1003.258678][ T5888] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1003.362642][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 1003.362659][ T30] audit: type=1326 audit(1760613036.865:1351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20230 comm="syz.1.3926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 1003.425086][ T5888] usb 1-1: config 0 descriptor?? [ 1003.489852][ T30] audit: type=1326 audit(1760613036.865:1352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20230 comm="syz.1.3926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 1003.529786][ T30] audit: type=1326 audit(1760613036.865:1353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20230 comm="syz.1.3926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 1003.558563][ T30] audit: type=1326 audit(1760613036.865:1354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20230 comm="syz.1.3926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 1003.659482][T20154] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1003.674478][ T5888] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1003.683133][T20154] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1003.751368][ T30] audit: type=1326 audit(1760613036.865:1355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20230 comm="syz.1.3926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 1003.755511][T20154] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1003.827735][ T5888] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1003.904269][ T5888] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1003.930920][ T30] audit: type=1326 audit(1760613036.865:1356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20230 comm="syz.1.3926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 1003.975008][ T5888] usb 1-1: media controller created [ 1004.000947][ T30] audit: type=1326 audit(1760613036.865:1357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20230 comm="syz.1.3926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 1004.042680][T13634] bridge_slave_1: left allmulticast mode [ 1004.050985][T13634] bridge_slave_1: left promiscuous mode [ 1004.107942][ T30] audit: type=1326 audit(1760613036.865:1358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20230 comm="syz.1.3926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 1004.141871][T13634] bridge0: port 2(bridge_slave_1) entered disabled state [ 1004.158838][ T5888] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1004.191634][T13634] bridge_slave_0: left allmulticast mode [ 1004.250291][T13634] bridge_slave_0: left promiscuous mode [ 1004.258800][ T30] audit: type=1326 audit(1760613036.865:1359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20230 comm="syz.1.3926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 1004.282246][T13634] bridge0: port 1(bridge_slave_0) entered disabled state [ 1004.394105][T20238] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1004.409242][ T30] audit: type=1326 audit(1760613036.865:1360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20230 comm="syz.1.3926" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4b7df8eec9 code=0x7ffc0000 [ 1004.432399][T20238] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1004.511922][ T5888] DVB: Unable to find symbol dib7000p_attach() [ 1004.526302][ T5888] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1004.979169][ T5888] rc_core: IR keymap rc-dib0700-rc5 not found [ 1005.007690][ T5888] Registered IR keymap rc-empty [ 1005.072424][T20242] loop4: detected capacity change from 0 to 7 [ 1005.137922][T20242] Dev loop4: unable to read RDB block 7 [ 1005.148411][T20242] loop4: AHDI p1 p2 [ 1005.155648][T20242] loop4: partition table partially beyond EOD, truncated [ 1005.163291][T20242] loop4: p1 size 4227858431 extends beyond EOD, truncated [ 1005.228697][ T6038] udevd[6038]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 1005.249704][ T5148] Bluetooth: hci2: command tx timeout [ 1005.865893][T13634] bond0 (unregistering): (slave c1): Releasing backup interface [ 1005.877139][T13634] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1005.887802][T13634] bond0 (unregistering): Released all slaves [ 1005.904936][T13634] bond1 (unregistering): (slave veth5): Releasing active interface [ 1005.915348][T13634] bond1 (unregistering): Released all slaves [ 1005.941566][T13634] bond2 (unregistering): (slave veth7): Releasing active interface [ 1005.963862][T13634] bond2 (unregistering): Released all slaves [ 1006.005955][T20154] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1006.018388][T20154] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1006.045062][T20154] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1006.138626][T13634] tipc: Disabling bearer [ 1006.185673][T13634] tipc: Left network mode [ 1006.361716][T20154] hsr_slave_0: entered promiscuous mode [ 1006.379901][T20154] hsr_slave_1: entered promiscuous mode [ 1006.388231][T20154] debugfs: 'hsr0' already exists in 'hsr' [ 1006.395264][T20154] Cannot create hsr debugfs directory [ 1006.628722][T13634] hsr_slave_0: left promiscuous mode [ 1006.635020][T13634] hsr_slave_1: left promiscuous mode [ 1007.309356][ T5148] Bluetooth: hci2: command tx timeout [ 1007.583729][T13634] team0 (unregistering): Port device team_slave_1 removed [ 1007.657459][T13634] team0 (unregistering): Port device team_slave_0 removed [ 1009.255867][T13634] IPVS: stop unused estimator thread 0... [ 1009.322366][ T5888] dvb-usb: could not initialize remote control. [ 1009.328734][ T5888] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 1009.456703][ T5932] usb 1-1: USB disconnect, device number 23 [ 1009.685705][ T5932] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1009.724972][T20307] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1009.836512][T20154] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1009.906066][T20154] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1009.965167][T20154] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1010.028591][T20321] FAULT_INJECTION: forcing a failure. [ 1010.028591][T20321] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1010.061889][T20154] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1010.149934][T20325] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1010.155179][T20321] CPU: 1 UID: 0 PID: 20321 Comm: syz.3.3942 Not tainted syzkaller #0 PREEMPT(full) [ 1010.155205][T20321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1010.155216][T20321] Call Trace: [ 1010.155226][T20321] [ 1010.155235][T20321] dump_stack_lvl+0x189/0x250 [ 1010.155261][T20321] ? __pfx____ratelimit+0x10/0x10 [ 1010.155289][T20321] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1010.155307][T20321] ? __pfx__printk+0x10/0x10 [ 1010.155325][T20321] ? __might_fault+0xb0/0x130 [ 1010.155355][T20321] should_fail_ex+0x414/0x560 [ 1010.155386][T20321] copy_fpstate_to_sigframe+0xa8d/0xce0 [ 1010.155411][T20321] ? copy_fpstate_to_sigframe+0x181/0xce0 [ 1010.155437][T20321] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 1010.155456][T20321] ? seqcount_lockdep_reader_access+0x15e/0x1c0 [ 1010.155489][T20321] ? __lock_acquire+0xab9/0xd20 [ 1010.155516][T20321] ? fpu__alloc_mathframe+0xad/0x130 [ 1010.155539][T20321] get_sigframe+0x58d/0x7d0 [ 1010.155564][T20321] ? __pfx_get_sigframe+0x10/0x10 [ 1010.155589][T20321] ? posixtimer_deliver_signal+0x305/0x410 [ 1010.155613][T20321] x64_setup_rt_frame+0x15b/0xd40 [ 1010.155640][T20321] ? lockdep_hardirqs_on+0x9c/0x150 [ 1010.155659][T20321] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1010.155682][T20321] ? get_signal+0x1150/0x1340 [ 1010.155710][T20321] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 1010.155735][T20321] ? arch_do_signal_or_restart+0x385/0x790 [ 1010.155759][T20321] arch_do_signal_or_restart+0x3f1/0x790 [ 1010.155782][T20321] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1010.155818][T20321] ? exit_to_user_mode_loop+0x40/0x130 [ 1010.155843][T20321] exit_to_user_mode_loop+0x72/0x130 [ 1010.155866][T20321] do_syscall_64+0x2bd/0xfa0 [ 1010.155884][T20321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1010.155901][T20321] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1010.155918][T20321] ? clear_bhb_loop+0x60/0xb0 [ 1010.155945][T20321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1010.155962][T20321] RIP: 0033:0x7f1f77b8d97f [ 1010.155979][T20321] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 1010.155994][T20321] RSP: 002b:00007f1f78b0b030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1010.156013][T20321] RAX: 0000000000000001 RBX: 0000000000000003 RCX: 00007f1f77b8d97f [ 1010.156025][T20321] RDX: 0000000000000001 RSI: 00007f1f78b0b090 RDI: 0000000000000003 [ 1010.156036][T20321] RBP: 00007f1f78b0b090 R08: 0000000000000000 R09: 00007f1f78b0adf7 [ 1010.156048][T20321] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 1010.156059][T20321] R13: 00007f1f77de6038 R14: 00007f1f77de5fa0 R15: 00007f1f77f0fa28 [ 1010.156088][T20321] [ 1011.342833][T20154] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1011.481574][T20154] 8021q: adding VLAN 0 to HW filter on device team0 [ 1011.565487][ T6709] bridge0: port 1(bridge_slave_0) entered blocking state [ 1011.572640][ T6709] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1011.670012][ T6709] bridge0: port 2(bridge_slave_1) entered blocking state [ 1011.677176][ T6709] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1011.994757][T20154] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1012.123261][T20154] veth0_vlan: entered promiscuous mode [ 1012.163807][T20154] veth1_vlan: entered promiscuous mode [ 1012.269477][ T5888] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 1012.355798][T20154] veth0_macvtap: entered promiscuous mode [ 1012.434449][T20154] veth1_macvtap: entered promiscuous mode [ 1012.459245][ T5888] usb 1-1: Using ep0 maxpacket: 32 [ 1012.535326][ T5888] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1012.561135][ T5888] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1012.594807][ T5888] usb 1-1: config 0 descriptor?? [ 1012.613819][T20154] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1012.677179][T20154] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1012.779949][T13865] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1012.830999][ T5888] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1012.896086][T13865] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1012.905518][ T5888] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1012.946672][T13865] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1012.994806][ T5888] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1013.002564][T13865] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1013.012087][ T5888] usb 1-1: media controller created [ 1013.052292][ T5888] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1013.315040][ T5888] DVB: Unable to find symbol dib7000p_attach() [ 1013.356595][ T5888] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1013.485996][ T61] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1013.560363][ T61] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1013.585527][T20387] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1013.649311][ T5888] rc_core: IR keymap rc-dib0700-rc5 not found [ 1013.663254][ T5888] Registered IR keymap rc-empty [ 1013.675382][T20387] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1014.016133][ T6702] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1014.034781][ T6702] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1014.389775][ T43] usb 5-1: new low-speed USB device number 124 using dummy_hcd [ 1014.550447][ T43] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1014.558631][ T43] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 1014.570363][ T43] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1014.586899][ T43] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1014.624640][ T43] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 1014.706860][ T43] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1014.720563][ T43] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 1014.748411][ T43] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1014.787599][ T43] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1014.959453][ T43] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 1014.988062][ T43] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1015.001469][ T43] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 1015.068920][ T43] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1015.135220][ T43] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1015.199241][ T43] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 1015.294340][ T43] usb 5-1: string descriptor 0 read error: -22 [ 1015.334382][ T43] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1015.434120][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1015.515776][ T43] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1015.701104][ T43] usb 5-1: USB disconnect, device number 124 [ 1015.862424][T20423] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3956'. [ 1016.075259][T20433] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1016.359255][ T43] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 1016.598475][ T43] usb 3-1: config 0 has an invalid interface number: 168 but max is 0 [ 1016.695222][ T43] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1016.715935][ T43] usb 3-1: config 0 has no interface number 0 [ 1016.753455][ T43] usb 3-1: config 0 interface 168 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1016.792957][ T43] usb 3-1: config 0 interface 168 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1016.837189][ T43] usb 3-1: config 0 interface 168 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 16 [ 1016.943312][ T43] usb 3-1: New USB device found, idVendor=0959, idProduct=2bd0, bcdDevice=48.98 [ 1016.950454][T20455] FAULT_INJECTION: forcing a failure. [ 1016.950454][T20455] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1016.966273][T20455] CPU: 0 UID: 0 PID: 20455 Comm: syz.4.3964 Not tainted syzkaller #0 PREEMPT(full) [ 1016.966297][T20455] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1016.966307][T20455] Call Trace: [ 1016.966314][T20455] [ 1016.966323][T20455] dump_stack_lvl+0x189/0x250 [ 1016.966347][T20455] ? __pfx____ratelimit+0x10/0x10 [ 1016.966371][T20455] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1016.966390][T20455] ? __pfx__printk+0x10/0x10 [ 1016.966407][T20455] ? __might_fault+0xb0/0x130 [ 1016.966434][T20455] should_fail_ex+0x414/0x560 [ 1016.966466][T20455] _copy_from_user+0x2d/0xb0 [ 1016.966491][T20455] do_sock_getsockopt+0x17d/0x450 [ 1016.966520][T20455] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1016.966546][T20455] ? do_syscall_64+0xa0/0xfa0 [ 1016.966577][T20455] __x64_sys_getsockopt+0x1a5/0x250 [ 1016.966602][T20455] ? do_syscall_64+0xa0/0xfa0 [ 1016.966621][T20455] ? do_syscall_64+0xa0/0xfa0 [ 1016.966643][T20455] do_syscall_64+0xfa/0xfa0 [ 1016.966664][T20455] ? lockdep_hardirqs_on+0x9c/0x150 [ 1016.966683][T20455] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1016.966701][T20455] ? clear_bhb_loop+0x60/0xb0 [ 1016.966724][T20455] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1016.966741][T20455] RIP: 0033:0x7f6a2538eec9 [ 1016.966759][T20455] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1016.966774][T20455] RSP: 002b:00007f6a261ea038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1016.966794][T20455] RAX: ffffffffffffffda RBX: 00007f6a255e5fa0 RCX: 00007f6a2538eec9 [ 1016.966808][T20455] RDX: 000000000000001d RSI: 0000000000000006 RDI: 0000000000000003 [ 1016.966819][T20455] RBP: 00007f6a261ea090 R08: 0000200000000040 R09: 0000000000000000 [ 1016.966831][T20455] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1016.966841][T20455] R13: 00007f6a255e6038 R14: 00007f6a255e5fa0 R15: 00007f6a2570fa28 [ 1016.966869][T20455] [ 1017.230459][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1017.301294][ T43] usb 3-1: config 0 descriptor?? [ 1017.420385][ T43] HFC-S_USB 3-1:0.168: probe with driver HFC-S_USB failed with error -5 [ 1017.512251][ T43] usb 3-1: USB disconnect, device number 3 [ 1018.035514][T20466] netlink: 9 bytes leftover after parsing attributes in process `syz.1.3968'. [ 1018.053884][T20466] ..0: renamed from hsr0 (while UP) [ 1018.065143][T20466] ..0: entered allmulticast mode [ 1018.104219][T20466] hsr_slave_0: entered allmulticast mode [ 1018.123434][T20466] A link change request failed with some changes committed already. Interface ..0 may have been left with an inconsistent configuration, please check. [ 1018.535671][ T5888] dvb-usb: could not initialize remote control. [ 1018.602545][ T5888] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 1018.761153][ T5888] usb 1-1: USB disconnect, device number 24 [ 1018.939575][T20477] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1019.100812][ T5888] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1019.506954][T20487] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3973'. [ 1020.424218][T20497] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1020.826206][T20510] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1021.039157][T11403] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1021.199328][T11403] usb 2-1: Using ep0 maxpacket: 32 [ 1021.206002][T11403] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1021.215535][T11403] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1021.238013][T11403] usb 2-1: config 0 descriptor?? [ 1021.579738][T11403] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1021.601712][T11403] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1021.644323][T11403] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1021.666543][T11403] usb 2-1: media controller created [ 1021.702741][T11403] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1022.036691][T11403] DVB: Unable to find symbol dib7000p_attach() [ 1022.083302][T11403] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1022.188709][T20509] ------------[ cut here ]------------ [ 1022.194768][T20509] usb 2-1: BOGUS control dir, pipe 80000380 doesn't match bRequestType c0 [ 1022.207239][T20509] WARNING: CPU: 0 PID: 20509 at drivers/usb/core/urb.c:414 usb_submit_urb+0x114d/0x18b0 [ 1022.217091][T20509] Modules linked in: [ 1022.221298][T20509] CPU: 0 UID: 0 PID: 20509 Comm: syz.1.3981 Not tainted syzkaller #0 PREEMPT(full) [ 1022.230700][T20509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1022.240807][T20509] RIP: 0010:usb_submit_urb+0x114d/0x18b0 [ 1022.246470][T20509] Code: df 0f b6 44 05 00 84 c0 0f 85 2a 06 00 00 45 0f b6 45 00 48 c7 c7 00 77 12 8c 48 8b 34 24 4c 89 fa 44 89 f1 e8 f4 41 89 fa 90 <0f> 0b 90 90 49 bf 00 00 00 00 00 fc ff df e9 95 f2 ff ff 89 e9 80 [ 1022.266168][T20509] RSP: 0018:ffffc9000b8f7820 EFLAGS: 00010246 [ 1022.272288][T20509] RAX: 2e8880ee76ea6600 RBX: ffff88814c8a4800 RCX: 0000000000080000 [ 1022.280285][T20509] RDX: ffffc90018102000 RSI: 0000000000005f08 RDI: 0000000000005f09 [ 1022.288350][T20509] RBP: 1ffff1100668bfb0 R08: 0000000000000003 R09: 0000000000000004 [ 1022.296439][T20509] R10: dffffc0000000000 R11: fffffbfff1bfa650 R12: ffff88807e4bf100 [ 1022.304460][T20509] R13: ffff88803345fd80 R14: 0000000080000380 R15: ffff888056f6ef20 [ 1022.312447][T20509] FS: 00007f4b7eec36c0(0000) GS:ffff888125d0c000(0000) knlGS:0000000000000000 [ 1022.321388][T20509] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1022.327965][T20509] CR2: 00002000000bd038 CR3: 000000001d2f0000 CR4: 00000000003526f0 [ 1022.335977][T20509] Call Trace: [ 1022.339262][T20509] [ 1022.342186][T20509] usb_start_wait_urb+0x114/0x4c0 [ 1022.347227][T20509] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1022.352818][T20509] usb_control_msg+0x232/0x3e0 [ 1022.357577][T20509] dib0700_i2c_xfer+0xba7/0xf70 [ 1022.362471][T20509] __i2c_transfer+0x874/0x2170 [ 1022.367225][T20509] ? lockdep_hardirqs_on+0x9c/0x150 [ 1022.372433][T20509] ? __pfx___i2c_transfer+0x10/0x10 [ 1022.377619][T20509] ? rt_mutex_lock_nested+0x15e/0x1e0 [ 1022.383016][T20509] ? i2c_transfer+0x120/0x3a0 [ 1022.387789][T20509] i2c_transfer+0x25b/0x3a0 [ 1022.392332][T20509] ? __pfx_i2c_transfer+0x10/0x10 [ 1022.397348][T20509] ? _copy_from_user+0x94/0xb0 [ 1022.402139][T20509] i2cdev_ioctl_rdwr+0x460/0x740 [ 1022.407079][T20509] i2cdev_ioctl+0x64b/0x7f0 [ 1022.411606][T20509] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1022.416631][T20509] ? __fget_files+0x3a0/0x420 [ 1022.421346][T20509] ? __fget_files+0x2a/0x420 [ 1022.425926][T20509] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1022.431017][T20509] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1022.436057][T20509] __se_sys_ioctl+0xfc/0x170 [ 1022.440698][T20509] do_syscall_64+0xfa/0xfa0 [ 1022.445207][T20509] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1022.451323][T20509] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1022.456953][T20509] ? clear_bhb_loop+0x60/0xb0 [ 1022.461812][T20509] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1022.467741][T20509] RIP: 0033:0x7f4b7df8eec9 [ 1022.472200][T20509] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1022.491976][T20509] RSP: 002b:00007f4b7eec3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1022.500437][T20509] RAX: ffffffffffffffda RBX: 00007f4b7e1e5fa0 RCX: 00007f4b7df8eec9 [ 1022.508438][T20509] RDX: 00002000000002c0 RSI: 0000000000000707 RDI: 000000000000000a [ 1022.516693][T20509] RBP: 00007f4b7e011f91 R08: 0000000000000000 R09: 0000000000000000 [ 1022.524717][T20509] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1022.532812][T20509] R13: 00007f4b7e1e6038 R14: 00007f4b7e1e5fa0 R15: 00007f4b7e30fa28 [ 1022.540998][T20509] [ 1022.544032][T20509] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1022.551303][T20509] CPU: 0 UID: 0 PID: 20509 Comm: syz.1.3981 Not tainted syzkaller #0 PREEMPT(full) [ 1022.560658][T20509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1022.570715][T20509] Call Trace: [ 1022.574006][T20509] [ 1022.576943][T20509] dump_stack_lvl+0x99/0x250 [ 1022.581546][T20509] ? __asan_memcpy+0x40/0x70 [ 1022.586149][T20509] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1022.591356][T20509] ? __pfx__printk+0x10/0x10 [ 1022.595973][T20509] vpanic+0x237/0x6d0 [ 1022.599973][T20509] ? __pfx_vpanic+0x10/0x10 [ 1022.604522][T20509] panic+0xb9/0xc0 [ 1022.608331][T20509] ? __pfx_panic+0x10/0x10 [ 1022.612750][T20509] __warn+0x31b/0x4b0 [ 1022.616732][T20509] ? usb_submit_urb+0x114d/0x18b0 [ 1022.621755][T20509] ? usb_submit_urb+0x114d/0x18b0 [ 1022.626772][T20509] report_bug+0x2be/0x4f0 [ 1022.631105][T20509] ? usb_submit_urb+0x114d/0x18b0 [ 1022.636148][T20509] ? usb_submit_urb+0x114d/0x18b0 [ 1022.641186][T20509] ? usb_submit_urb+0x114f/0x18b0 [ 1022.646218][T20509] handle_bug+0x84/0x160 [ 1022.650455][T20509] exc_invalid_op+0x1a/0x50 [ 1022.654948][T20509] asm_exc_invalid_op+0x1a/0x20 [ 1022.659790][T20509] RIP: 0010:usb_submit_urb+0x114d/0x18b0 [ 1022.665424][T20509] Code: df 0f b6 44 05 00 84 c0 0f 85 2a 06 00 00 45 0f b6 45 00 48 c7 c7 00 77 12 8c 48 8b 34 24 4c 89 fa 44 89 f1 e8 f4 41 89 fa 90 <0f> 0b 90 90 49 bf 00 00 00 00 00 fc ff df e9 95 f2 ff ff 89 e9 80 [ 1022.685037][T20509] RSP: 0018:ffffc9000b8f7820 EFLAGS: 00010246 [ 1022.691111][T20509] RAX: 2e8880ee76ea6600 RBX: ffff88814c8a4800 RCX: 0000000000080000 [ 1022.699087][T20509] RDX: ffffc90018102000 RSI: 0000000000005f08 RDI: 0000000000005f09 [ 1022.707060][T20509] RBP: 1ffff1100668bfb0 R08: 0000000000000003 R09: 0000000000000004 [ 1022.715059][T20509] R10: dffffc0000000000 R11: fffffbfff1bfa650 R12: ffff88807e4bf100 [ 1022.723024][T20509] R13: ffff88803345fd80 R14: 0000000080000380 R15: ffff888056f6ef20 [ 1022.731099][T20509] usb_start_wait_urb+0x114/0x4c0 [ 1022.736127][T20509] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1022.741685][T20509] usb_control_msg+0x232/0x3e0 [ 1022.746452][T20509] dib0700_i2c_xfer+0xba7/0xf70 [ 1022.751317][T20509] __i2c_transfer+0x874/0x2170 [ 1022.756094][T20509] ? lockdep_hardirqs_on+0x9c/0x150 [ 1022.761287][T20509] ? __pfx___i2c_transfer+0x10/0x10 [ 1022.766480][T20509] ? rt_mutex_lock_nested+0x15e/0x1e0 [ 1022.771858][T20509] ? i2c_transfer+0x120/0x3a0 [ 1022.776533][T20509] i2c_transfer+0x25b/0x3a0 [ 1022.781028][T20509] ? __pfx_i2c_transfer+0x10/0x10 [ 1022.786048][T20509] ? _copy_from_user+0x94/0xb0 [ 1022.790813][T20509] i2cdev_ioctl_rdwr+0x460/0x740 [ 1022.795750][T20509] i2cdev_ioctl+0x64b/0x7f0 [ 1022.800260][T20509] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1022.805285][T20509] ? __fget_files+0x3a0/0x420 [ 1022.809958][T20509] ? __fget_files+0x2a/0x420 [ 1022.814543][T20509] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1022.819473][T20509] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1022.824490][T20509] __se_sys_ioctl+0xfc/0x170 [ 1022.829072][T20509] do_syscall_64+0xfa/0xfa0 [ 1022.833578][T20509] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1022.839628][T20509] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1022.845250][T20509] ? clear_bhb_loop+0x60/0xb0 [ 1022.849917][T20509] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1022.855798][T20509] RIP: 0033:0x7f4b7df8eec9 [ 1022.860205][T20509] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1022.879808][T20509] RSP: 002b:00007f4b7eec3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1022.888217][T20509] RAX: ffffffffffffffda RBX: 00007f4b7e1e5fa0 RCX: 00007f4b7df8eec9 [ 1022.896184][T20509] RDX: 00002000000002c0 RSI: 0000000000000707 RDI: 000000000000000a [ 1022.904179][T20509] RBP: 00007f4b7e011f91 R08: 0000000000000000 R09: 0000000000000000 [ 1022.912142][T20509] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1022.920100][T20509] R13: 00007f4b7e1e6038 R14: 00007f4b7e1e5fa0 R15: 00007f4b7e30fa28 [ 1022.928076][T20509] [ 1022.931405][T20509] Kernel Offset: disabled [ 1022.935726][T20509] Rebooting in 86400 seconds..